Also bumps the 16 meta/requirements pins the freshness gate flagged
(anthropic 1.5.0, numpy 2.5.3, pytest-randomly 5, flake8-bugbear 26.9.9,
ruff 0.16.7, pyright 1.1.414, selenium 4.49.0, hypothesis 6.168.0, lxml
6.1.3, pipdeptree 4.2.5, the two types-* stubs) and Flutter 3.47.3 in
meta/.fvmrc. One test still expected the pre-move ~/mcp-servers path.
The pre-commit hook fed .zsh files to shfmt and shellcheck, neither of
which parses zsh (SC2148/SC1071), so no zsh file could be committed since
the hook was tightened on 2026-08-22; those now get `zsh -n` instead. The
hook's own shfmt pass also staged its reformat of 8 shell files.
CI_GREEN_SKIP because main is red on exactly the dependency-freshness
finding this commit fixes, which is the documented use of that flag.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AwtowrowDXx6ccmWVPkCaF
`verify` gated on the two invariants whose breach cut every bridged
container off the internet on 2026-08-29 and again after the 2026-08-30
reboot -- but nothing invoked it, so it reported drift only when a human
thought to ask, and the outage it exists for is exactly the one nobody
thinks to ask about.
nftables-drift.service now runs it after nftables.service, docker.service
and network-online.target at every boot, plus a daily Persistent timer. A
breach is a failed unit in `systemctl --failed`, not a log line: a
self-check that detects a failure has to gate, not warn.
Proven in ~/utils/vmbox across two real reboots -- drifted /etc leaves the
unit failed with the diff and the missing docker0 accept in its journal,
matching /etc leaves it active with no false positive -- then installed and
run green on the host. Not yet observed across a host reboot.
Also bumps the gatelock pin to v0.7.3, which is what turned main's
dependency-freshness job red; CI_GREEN_SKIP is set because this commit is
that fix.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015d48t4qsQLBJnDwDeo2Nom
wake_alarm._alarm no longer exists: the PC's waking role was deleted in
kuhyx/wake-alarm, and the phone owns the alarm now. This removes ALARM_MODULE,
_run_alarm() and the --with-alarm flag, leaving one leg -- the workout lock.
Landing this in the same change as the deletion is the point. An orchestrator
left pointing at a module that no longer exists is exactly the failure this
repo has already had once: after screen-locker was extracted on 2026-05-28 the
reference here went stale and the workout lock died with ModuleNotFoundError on
every run for a month, while the alarm half kept working and hid it.
morning-routine.service loses --with-alarm and its comments now name what
actually starts it: wake-alarm-trigger.timer, at the phone's synced alarm time,
not the deleted systemd-sleep hook. Environment=DISPLAY=:0 stays -- the comment
credited it to the alarm's Tk window, but workout-locker.service needs it too.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PcdngP688mW6rJye3LRkSN
Upstream released it between two CI runs today, which is enough to turn the
freshness gate red on a commit that touched no Python -- the documented and
expected behaviour of a gate that checks "newest stable" rather than "newest
stable as of whenever someone last looked".
The pre-commit pylint hook takes its version from the mirror rev, not from
this file, so nothing about which checks run changes here.
Also refreshes the isort note: 4.0.7 declared `isort<9`, 4.0.8 declares
`isort!=5.13,<10,>=5`, so the comment's specific bound was already stale.
Reworded to state the constraint's purpose rather than a version that moves.
Fixes the red main that ci-baseline-green is blocking commits on.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A7BaCSV8FEtcNgVDVsRAJj
Already red before today's Python work touched the repo; the commit hook had no
reason to look at the requirements files, so only a whole-tree run saw it.
Bumped across every repo pinning 7.15.4 in the same pass.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SfnJmxxsZ534AKk16rC2Gr
Python tests has been red since ~2026-08-19, failing in "Install
dependencies" with pip's resolution-too-deep. That is an install failure,
not a test failure -- which means no Python test has actually run in CI
for days, on a repo whose Python bar is 100% branch coverage.
The CI log names the cause: the resolver backtracks through Brotli
1.0.6 -> 1.0.4 -> 1.0.1 and asgiref 3.8.0 -> 3.7.1 -> 3.6.0, all dragged
in by mitmproxy>=10.0, then gives up. Nothing imports it: `git grep
mitmproxy` finds it only in a pacman whitelist and a docs file, and
check_requirements_sync.py passes without it.
Reproduced and fixed locally rather than guessed, on Python 3.11.11 with
pip 26.2.1 -- the versions CI uses:
pip install --dry-run -r <with mitmproxy> exit 1, resolution-too-deep
pip install --dry-run -r <without mitmproxy> exit 0
Left standing: 78 of the 80 requirements are unpinned >= ranges, so this
can recur the next time a package with a wide dependency graph is added.
CI_GREEN_SKIP=1: this commit IS the fix for the red baseline.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
Shared across every repo with an Android surface (screen-locker's workout_app,
todo, dufs-cloud/app). Works against a plain release APK on a physical device
over adb — no root, no emulator, no Flutter debug connection, no app changes.
Driving an app by tapping pixel positions read off a screenshot fails in ways
that look like success. All observed in one session (2026-08-10) verifying
workout_app's Firebase restore:
* A tap aimed at a password field landed with the field unfocused. The typed
password went nowhere and NOTHING errored — the next screenshot just showed
an empty box. type_into/type_into_field now re-read the field and raise.
* Opening the soft keyboard moved a field from y=1572 to y=1319, so a
coordinate captured one step earlier was already wrong. Every action
re-resolves the element immediately before acting.
* A widget behind the keyboard reports its LAID-OUT position (1549) not its
real one (1939) — a 390px error that taps a letter key and reports success.
keyboard_is_up() distinguishes "absent" from "behind the keyboard", and tap
closes the keyboard first.
* KEYCODE_BACK is a route pop in Flutter, not a keyboard dismiss: it navigated
out of Settings and discarded typed credentials, twice. dismiss_keyboard
tries ESCAPE then BACK and verifies via dumpsys input_method.
* `input text` inserts at the cursor, so typing over a filled field produced
"canary@example.com321krzychu@gmail.com". Fields are cleared first.
* uiautomator returns ONLY the focused EditText nodes while a Flutter text
field has focus, and stays that way across retries — so a naive retry loop
never converges. Partial trees are retried and the best result kept.
* An EMPTY EditText has no text, content-desc or resource-id, so a
"must be labelled" filter drops the very field you need to fill in. Editable
nodes are kept regardless and addressable by position.
Ambiguity is an error rather than a silent first-match: `tap "Back"` correctly
refuses when "OFFLINE BACKUP" is also on screen.
Its own test suite caught a real bug in _escape: backslash sat inside the
escape loop, so "&" became "\\&" and a password containing shell
metacharacters would have been typed wrong.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JupKvZCNKRmEeRQY3G1unG
python_pkg/session_autopsy/store.py does `from typing_extensions import Self`,
but the dependency was only written into the working tree, never committed. CI
installs from requirements.txt alone, and pre-commit stashes unstaged files
before running hooks, so the requirements-sync hook saw the committed file
without the line and blocked every push with ModuleNotFoundError-in-waiting.
The line itself is unchanged from what was already sitting in the tree.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
python_pkg/archwiki_rag/convert.py imports markdownify, but the
declaration was left uncommitted in the working tree. Because
pre-commit stashes unstaged changes before running the pre-push gate
while untracked files stay on disk, the gate saw code importing an
undeclared package and failed requirements-sync on every push.
Committing the declaration makes the tree self-consistent. The
archwiki_rag package itself remains untracked and unaffected.
New python_pkg/code_tutor package that turns an unfamiliar codebase into
an interactive lesson: analyse code into items (_analyzer), order them
dependency-first (_plan_builder), pose reimplement challenges
(_challenge + _challenge_support), verify user implementations with tests
and coverage (_verifier), track progress (_progress/_session), and offer
local-LLM hints (_llm), driven by a Typer/Rich CLI (cli).
- meta/pyproject.toml + .pre-commit-config.yaml + meta/requirements.txt:
add anthropic/rich/typer deps, a cli.py per-file-ignore (Typer B008 etc),
and code_tutor-specific ruff/pylint/mypy tuning.
- _challenge.py and its tests are split across _challenge_support.py and
test_challenge_part2/part3.py to stay under the 500-line file cap.
Verification: pytest 631 passed at 100% line+branch coverage; every file
<=500 lines; pre-commit (ruff ALL, mypy strict, pylint 10/10, bandit,
evidence + multi-file contract) green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RRCdR4D8SaVrN2xraMQxM
The standalone kuhyx/gatelock GitHub repo no longer exists — gatelock was
merged into the public kuhyx/utils monorepo (tag gatelock-v0.1.0, subdir
gatelock). The stale git+https://github.com/kuhyx/gatelock@v0.1.0 URL was
unresolvable for everyone, so CI (Python tests + pre-commit) failed at
dependency install with "could not read Username for 'https://github.com'".
Point requirements.txt and the pylint hook's additional_dependencies at the
new public location:
git+https://github.com/kuhyx/utils@gatelock-v0.1.0#subdirectory=gatelock
Verified with pip install --dry-run in the repo venv: clones kuhyx/utils,
checks out gatelock-v0.1.0, builds metadata from the gatelock subdirectory.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NmwYH5RfThZGkVD2jE61Da
Root cause of the zero-runs-ever CI mystery: GitHub Actions was disabled
at the repo level (actions/permissions enabled:false). Re-enabled it via
the API, which immediately surfaced a backlog of pre-existing issues
that local pre-commit runs (scoped to changed files only) never caught:
- pylama is unused (grep confirms zero references outside
requirements.txt) and its pytest plugin auto-loads via setuptools
entry points, crashing the pytest-coverage hook with
ModuleNotFoundError: pkg_resources on the CI runner. Removed it.
- zsh-syntax hook had no zsh binary on the CI image; added an install
step.
- _load_trusted_device_values() in adb_common.sh had an unused optional
arg (shellcheck SC2120); confirmed via grep it's never called with one,
including in tests, and simplified it away.
- claude-code-review.yml/claude.yml had a stray trailing blank line.
None of this is related to the wake_alarm gatelock migration committed
earlier; it's purely the CI/lint backlog that surfaced once Actions
actually started running for the first time in the repo's history.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A7vbgtFfZmfxJtN5DdtJky
MealGate now composes gatelock.GateRoot + gatelock.LockWindow instead of
inheriting the deleted _GateWindow/_GateRoot, and its HMAC signing goes
through gatelock.log_integrity. This is the first of three migrations
(diet_guard -> screen-locker -> wake_alarm) extracting the lock-window
mechanics that diet_guard's own _GateWindow proved out into a shared,
reusable package. Window-mechanics tests moved with the code; diet_guard's
suite now only tests its own wiring (LockConfig choice, hook delegation).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XCdT46zV8hESDvbgYMGDLt
- Add python-kasa-based smart-plug control (_smart_plug.py) with
turn_on_plug / turn_off_plug called around the alarm window.
Reads ~/.config/wake_alarm/tapo.json (host/email/password).
- Hard timeout (TAPO_TIMEOUT_SECONDS) so plug never blocks the alarm.
- Install fan-control script + sudoers entry (install.sh step 6);
_max_fans / _restore_fans now invoke it via /usr/bin/sudo -n so
pwm1_enable writes succeed.
- Remove ntfy.sh push notifications entirely (silent no-op was useless).
- Replace every silent skip with _logger.warning() so failures are
loud: missing xset / xrandr / speaker-test, unreadable hwmon files,
fan script errors, missing Tapo config, kasa import failure, etc.
- wake-alarm.service: Restart=on-failure with 10s backoff.
- Tests: 100% line+branch coverage on python_pkg/wake_alarm.
- Move pyproject.toml, .pre-commit-config.yaml, requirements.txt, run.sh,
lint_python.sh, .fvmrc into meta/ with root symlinks preserving tool
auto-discovery.
- Combine requirements.txt + requirements-dev.txt into meta/requirements.txt
(single sorted source of truth).
- Remove setup.sh, .binary-allowlist, C/ (no native code remains),
python_pkg/{split,pdfCentered,geo_data}, scripts/check_c_cpp_build_files.sh.
- Drop clang-format/cppcheck/flawfinder/check-c-cpp-build-files hooks and
archived path excludes from pre-commit config.
- Add .secret-patterns to .gitignore and untrack it (sensitive content;
full history purge is a follow-up step).
