WRKLOG-2026-06-01

# Identify affected commits
git log --oneline -- \
  docs/modules/ROOT/pages/2026/03/WRKLOG-2026-03-14.adoc \
  docs/modules/ROOT/pages/2026/04/WRKLOG-2026-04-18.adoc

# 1. BEFORE: Full backup of the repo
cp -a ~/atelier/_bibliotheca/domus-captures ~/atelier/_bibliotheca/domus-captures.bak

# 2. Install git-filter-repo (if not present)
# Arch: pacman -S git-filter-repo
# pip: pip install git-filter-repo

# 3. Create expressions file for replacement
cat > /tmp/scrub-expressions.txt << 'EXPR'
regex:(?i)divorce==[REDACTED]
regex:(?i)dissolutio(?!n\.adoc\.age)==[REDACTED-LEGAL]
regex:(?i)iliana==[REDACTED-NAME]
regex:(?i)angulo-arreola==[REDACTED-NAME]
regex:legal-divorce-notes\.age==legal-notes.age
regex:1099-NEC-iliana==1099-NEC
EXPR

# 4. Verify before (dry run — count matches in history)
git log -p --all -S 'divorce' -- '*.adoc' | grep -c 'divorce' || echo "0 matches"
git log -p --all -S 'iliana' -- '*.adoc' | grep -c 'iliana' || echo "0 matches"

# 5. Run filter-repo (DESTRUCTIVE — rewrites all commit hashes)
git filter-repo --replace-text /tmp/scrub-expressions.txt --force

# 6. Verify after
git log -p --all -S 'divorce' -- '*.adoc' | grep -c 'divorce' || echo "0 matches — CLEAN"
git log -p --all -S 'iliana' -- '*.adoc' | grep -c 'iliana' || echo "0 matches — CLEAN"

# 7. Re-add remotes (filter-repo removes them)
git remote add origin git@github.com:<user>/domus-captures.git
# Add any other remotes (Gitea, etc.)

# 8. Force-push to all remotes (DESTRUCTIVE — overwrites remote history)
git remote | xargs -I{} git push {} main --force

# 9. Clean up
rm /tmp/scrub-expressions.txt
rm -rf ~/atelier/_bibliotheca/domus-captures.bak  # only after verifying

# Decrypt all guest ACL CR files
find data/d001/comms/changes/CR-2026-05-28-guest-acl-lockdown -name "*.age" \
  -exec decrypt-file {} \;

# Key files after decrypt:
# - CR-2026-05-28-guest-acl-lockdown.adoc        ← main CR document
# - partials/cab-talking-points.adoc              ← board presentation notes
# - partials/itrack-fields.adoc                   ← iTrack ticket fields
# - partials/summary.adoc                         ← executive summary

find data/d001/comms/changes/CR-2026-05-28-anonymous-identity-test -name "*.age" \
  -exec decrypt-file {} \;

# Key files after decrypt:
# - CR-2026-05-28-anonymous-identity-test.adoc    ← main CR document
# - partials/cab-talking-points.adoc              ← board presentation notes
# - partials/itrack-fields.adoc                   ← iTrack ticket fields
# - partials/summary.adoc                         ← executive summary

# CR cab-talking-points already decrypted:
# data/d001/comms/changes/CR-2026-05-07-abnormal-read-write/partials/cab-talking-points.adoc

# Decrypt remaining CR partials
find data/d001/comms/changes/CR-2026-05-07-abnormal-read-write -name "*.age" \
  -exec decrypt-file {} \;

decrypt-file data/d001/projects/abnormal-security/partials/seg-defender-mapping-policy-2026-05-26.adoc.age

cat > /tmp/tube-system-macs.txt << 'EOF'
C8:1A:FE:20:24:15
C8:1A:FE:20:23:F6
C8:1A:FE:20:23:A9
C8:1A:FE:20:23:E1
C8:1A:FE:20:23:C3
C8:1A:FE:20:24:16
C8:1A:FE:20:24:06
C8:1A:FE:20:23:D8
C8:1A:FE:20:24:4B
C8:1A:FE:20:24:35
C8:1A:FE:20:24:03
C8:1A:FE:20:24:09
C8:1A:FE:20:20:37
C8:1A:FE:20:1D:ED
C8:1A:FE:20:24:47
EOF

dsource d001 dev/network/ise
./scripts/ise-batch-onboard.sh /tmp/tube-system-macs.txt IoT_Onboard \
  "2026-06-01 ER - Tube System 10in TS stations iTrack-3528165"

# Verify all 15 MACs landed in IoT_Onboard and are authenticating
./scripts/ise-check-macs.sh /tmp/tube-system-macs.txt

# Kernel messages — what did the system see on attach?
dmesg | tail -30

# Full USB descriptor (manufacturer string, serial, interfaces)
lsusb -v -d 04b3:4010 2>/dev/null | awk '/idVendor|idProduct|iManufacturer|iProduct|iSerial|bInterfaceClass/'

# Did it register as a block device?
lsblk --scsi

# Or as a network interface? (reMarkable Paper Pro uses USB Ethernet by default)
ip link | grep -A1 'enp\|usb'

# Check for USB network interface
ip addr show | grep '10.11.99'

# If 10.11.99.1 appears — that's the reMarkable gateway
ssh root@10.11.99.1    # default password on device: Settings > General > About

# If no network interface, check if it's in storage mode
udisksctl status

lsusb -t    # USB topology tree — shows bus/port/driver
usb-devices | awk '/^T:|Manufacturer|Product|SerialNumber/' RS='\n\n'

$ ip addr show | grep '10.11.99'
    inet 10.11.99.2/27 ... enp128s20f0u5c2

# Build latest rmapi (required for Paper Pro)
cd /tmp && git clone --depth 1 https://github.com/ddvk/rmapi.git
cd rmapi && go build -o rmapi .

# Clear stale auth + re-authenticate
rm -rf ~/.config/rmapi ~/.cache/rmapi
/tmp/rmapi/rmapi ls /

# Install to PATH (TODO)
sudo cp /tmp/rmapi/rmapi /usr/local/bin/

$clientAuthOid = '1.3.6.1.5.5.7.3.2'

Get-ChildItem Cert:\LocalMachine\My |
Where-Object {
    $_.HasPrivateKey -and
    ($_.EnhancedKeyUsageList.ObjectId -contains $clientAuthOid)
} |
ForEach-Object {

    $tpl = ($_.Extensions | Where-Object {
        $_.Oid.Value -eq '1.3.6.1.4.1.311.21.7'
    })

    [PSCustomObject]@{
        Subject      = $_.Subject
        Issuer       = $_.Issuer
        Template     = if ($tpl) { $tpl.Format(0) } else { "N/A" }
        EKU          = ($_.EnhancedKeyUsageList | ForEach-Object {$_.FriendlyName}) -join ', '
        NotAfter     = $_.NotAfter
        PrivateKey   = $_.HasPrivateKey
        ISE_Relevant = if (
            $_.Issuer -match 'CHLASUBCA' -and
            $tpl -and
            ($_.EnhancedKeyUsageList.ObjectId -contains $clientAuthOid)
        ) { "YES" } else { "NO" }
    }
} |
Sort-Object @{Expression='ISE_Relevant'; Descending=$true}, @{Expression='NotAfter'; Descending=$true} |
Format-List

Subject      : CN=L-N62420, OU=Win11, OU=Computers, OU=CHLA, DC=LA, DC=AD, DC=CHLA, DC=ORG
Issuer       : CN=CHLASUBCA, DC=LA, DC=AD, DC=CHLA, DC=ORG
Template     : Template=ISE-Computer(...)
EKU          : Server Authentication, Client Authentication
NotAfter     : 10/20/2026
PrivateKey   : True
ISE_Relevant : YES

Subject      : CN=b04b4396-1423-4a71-ae17-ac0baaaa844a
Issuer       : Microsoft Intune MDM Device CA
ISE_Relevant : NO

Subject      : CN=36052510-33c2-4dd5-94ca-5fb06f2f6f11
Issuer       : MS-Organization-Access
ISE_Relevant : NO

Subject      : CN=b64d7806-8f41-4565-8e5d-38c02e997de8
Issuer       : Microsoft Device Management Device CA
ISE_Relevant : NO

$clientAuthOid = '1.3.6.1.5.5.7.3.2'

Get-ChildItem Cert:\LocalMachine\My |
Where-Object {
    $_.HasPrivateKey -and
    ($_.EnhancedKeyUsageList.ObjectId -contains $clientAuthOid)
} |
ForEach-Object {
    $tpl = ($_.Extensions | Where-Object {
        $_.Oid.Value -eq '1.3.6.1.4.1.311.21.7'
    })
    [PSCustomObject]@{
        Subject      = $_.Subject
        Issuer       = $_.Issuer
        Template     = if ($tpl) { $tpl.Format(0) } else { "N/A" }
        EKU          = ($_.EnhancedKeyUsageList | ForEach-Object {$_.FriendlyName}) -join ', '
        NotAfter     = $_.NotAfter
        PrivateKey   = $_.HasPrivateKey
        ISE_Relevant = if (
            $_.Issuer -match 'CHLASUBCA' -and
            $tpl -and
            ($_.EnhancedKeyUsageList.ObjectId -contains $clientAuthOid)
        ) { "YES" } else { "NO" }
    }
} |
Sort-Object @{Expression='ISE_Relevant'; Descending=$true}, @{Expression='NotAfter'; Descending=$true} |
Format-List

Subject      : CN=Baymax, OU=Win10, OU=Computers, OU=CHLA, DC=LA, DC=AD, DC=CHLA, DC=ORG
Issuer       : CN=CHLASUBCA, DC=LA, DC=AD, DC=CHLA, DC=ORG
Template     : Template=ISE-Computer(1.3.6.1.4.1.311.21.8.11575464.7661965.4081547.4014214.1720831.189.14088985.4340598), Major Version Number=100, Minor Version Number=40
EKU          : Server Authentication, Client Authentication
NotAfter     : 1/8/2027 3:27:52 PM
PrivateKey   : True
ISE_Relevant : YES

Subject      : CN=ad0772e1-a7b9-4240-b6ce-3a80a825137d
Issuer       : DC=net + DC=windows + CN=MS-Organization-Access + OU=82dbaca4-3e81-46ca-9c73-0950c1eaca97
Template     : N/A
EKU          : Client Authentication
NotAfter     : 1/8/2036 4:00:01 PM
PrivateKey   : True
ISE_Relevant : NO

Subject      : CN=7e1ddaf9-07f4-403a-9976-f2049c3e12f5
Issuer       : CN=Microsoft Intune MDM Device CA
Template     : N/A
EKU          : Client Authentication
NotAfter     : 5/31/2027 10:25:22 PM
PrivateKey   : True
ISE_Relevant : NO

grep -RIn --include='*.adoc' \
  -E 'radius_authentications|endpoints_data|endpoint_identity_groups' .

grep -RIn --include='*.adoc' \
  'LEFT JOIN endpoints_data e ON r.calling_station_id' .

grep -RIn --include='*.adoc' \
  'r.device_name, r.device_type' .

grep -RIn --include='*.adoc' \
  -E "calling_station_id = '\\$\\{MAC\\}'" .

grep -RIn --include='*.adoc' \
  -E '\| jq -C' .

grep -RIn --include='*.adoc' \
  -E 'sqlplus|oracle|tnsnames|2484|DataConnect' .

grep -RIl --include='*.adoc' \
  -E 'radius_authentications|calling_station_id.*MAC' . | xargs nvim

grep -RIn \
  -E 'radius_authentications|calling_station_id' .

grep -RinE --include='*.adoc' 'sanchuelo' .

grep -rl -i 'sanchuelo' ~/atelier/_bibliotheca/ --include='*.txt' --include='*.adoc' | sort

find ~/atelier/_bibliotheca/ -type f \( -name '*.adoc' -o -name '*.txt' \) -print0 \
  | xargs -0 grep -li 'sanchuelo' | sort

grep -rl -i 'sanchuelo' ~/atelier/_bibliotheca/ --include='*.adoc' --include='*.txt' | xargs nvim

gh repo list --limit 100 --json name,description \
  | jq -r '.[] | select(.name | test("domus|antora|asciidoc"; "i")) | "\(.name)\t\(.description)"'

gh repo list --limit 100 --json name,description,updatedAt \
  | jq -r 'sort_by(.updatedAt) | reverse | .[:20] | .[] | "\(.updatedAt[:10])\t\(.name)\t\(.description)"'

gh repo list --limit 100 --json name,diskUsage \
  | jq -r '.[] | "\(.diskUsage)\t\(.name)"' | sort -rn | head -10

gh repo clone EvanusModestus/<repo-name> ~/atelier/_bibliotheca/<repo-name>

find docs/modules/ROOT/examples/codex/powershell -type f -name "*.adoc" \
  -exec grep -l 'Get-Process\|Start-Process\|pipeline\|Where-Object' {} \;

find docs/modules/ROOT -name "powershell" -type d \
  -exec sh -c 'echo "$1: $(find "$1" -type f | wc -l) files"' _ {} \;

for f in $(find docs/modules/ROOT/examples/codex/powershell -name "*.adoc" -type f); do
  base=$(basename "$f")
  dir_parent=$(basename $(dirname "$f"))
  grep -rq "$dir_parent/$base" docs/modules/ROOT/pages/codex/powershell/ \
    docs/modules/ROOT/examples/codex/powershell/*.adoc 2>/dev/null \
    || echo "ORPHAN: $f"
done

nvim $(find -path '*oauth*' -name '*.adoc' -type f \
  -exec grep -l 'timeout\|expire\|reconfig\|token' {} \;)

nvim $(find docs/modules/ROOT -name '*.adoc' -type f \
  -exec grep -l 'token.*expire\|oauth.*refresh' {} \;)

find -path '*oauth*' -name '*.adoc' -type f \
  -exec grep -l 'timeout\|expire' {} \; \
  -exec nvim {} \;

grep -rl 'commands/shell' docs/modules/ROOT/partials/

grep -rl 'quick-commands' docs/modules/ROOT | wc -l

file="commands/shell"
grep -rl "$file" docs/modules/ROOT/partials/ | while read f; do
  parent=$(basename "$f" .adoc)
  echo "$file -> $parent"
  grep -rl "$parent" docs/modules/ROOT/pages/ | while read p; do
    echo "  -> $(basename "$p")"
  done
done

find docs/modules/ROOT -name "*urgent.adoc*" -type f
find docs/modules/ROOT -name "*morning.adoc*" -type f

find docs/modules/ROOT -type f -regextype posix-extended \
  -regex '.*(urgent|morning|work-chla|personal|education|infrastructure|quick-commands|related)\.adoc' \
  | sort

find docs/modules/ROOT -type f -name "*.adoc" \
  | grep -E 'urgent|morning|work-chla|personal|education|infrastructure|quick-commands|related'

grep -rn --include='*.adoc' -c 'sanchuelo' . | grep -v ':0$'

grep -rl --include='*.adoc' -i 'sanchuelo' ~/atelier/_bibliotheca/ | sort

grep -rn --include='*.adoc' -i -B1 -A1 'sanchuelo' ~/atelier/_bibliotheca/domus-captures/

grep -rl -i 'sanchuelo' ~/atelier/_bibliotheca/ --include='*.txt' --include='*.adoc' | sort

find ~/atelier/_bibliotheca/ -type f \( -name '*.adoc' -o -name '*.txt' \) -print0 \
  | xargs -0 grep -li 'sanchuelo' | sort

grep -rl -i 'sanchuelo' ~/atelier/_bibliotheca/ --include='*.adoc' --include='*.txt' | xargs nvim

grep -P '(@\w+|^From:.*<)' comms.adoc

grep -nP '\d{1,2}/\d{1,2}/\d{2,4}|20\d{2}-\d{2}-\d{2}' comms.adoc

grep -niP '(I can |I will |I.ll |we will |we.ll )' comms.adoc

grep -niP '(\?|need to confirm|need to validate|TBD|pending)' comms.adoc

# All recipients
grep -oP '<\K[^>]+' comms.adoc | sort -u > /tmp/all-recipients

# All senders
grep -P '^From:' comms.adoc | grep -oP '<\K[^>]+' | sort -u > /tmp/replied

# Who's silent — follow-up targets
comm -23 /tmp/all-recipients /tmp/replied

awk '{print $2}' file.txt

awk -F: '{print $1, $3}' /etc/passwd

awk '/\[source,json\]/{getline; if ($0 ~ /^----/) {p=1; next}} p && /^----/{p=0; next} p' file.adoc

awk '{printf "%-30s %s\n", $1, $2}' file.txt

# Before
awk 'NR==73' /etc/ssh/sshd_config
# Change
sed -i '73s/#GSSAPIAuthentication no/GSSAPIAuthentication yes/' /etc/ssh/sshd_config
# After
awk 'NR==73' /etc/ssh/sshd_config

sed -n '10,20p' file.txt

curl -s localhost:8080/stats | jq '.stats.total_files'

jq '.results[] | select(.category == "standards")' response.json

jq -r '.[] | [.title, .path] | @tsv' response.json | column -t -s $'\t'

gh api "repos/EvanusModestus/domus-captures/commits?path=docs/&per_page=10" |
  jq -r '.[] | "\(.commit.author.date[:10]) \(.sha[:7]) \(.commit.message | split("\n")[0])"'

mkdir -p /tmp/adoc-backup-$(date +%F) && \
  find . -name "*.adoc" -type f -newermt "$(date +%F)" | \
  xargs -I{} cp {} /tmp/adoc-backup-$(date +%F)/

find .drafts -name "*.adoc" -type f | xargs -P4 -I{} asciidoctor -o /dev/null {}

find . -name "*.adoc" -type f -print0 | xargs -0 wc -l

diff <(grep '|' partials/trackers/work/adhoc/carryover.adoc | head -20) \
     <(git show HEAD~1:partials/trackers/work/adhoc/carryover.adoc | grep '|' | head -20)

diff <(find docs/modules/ROOT/pages/projects/chla/mschapv2-migration -name "*.adoc" -type f | sort) \
     <(grep -oP 'mschapv2-migration/[^[]+\.adoc' docs/modules/ROOT/nav.adoc | sort)

nvim "$(find data/ -name '*.adoc' -type f -printf '%T@ %p\n' | sort -rn | awk 'NR==1{print $2}')"

wc -l $(find docs/modules/ROOT -path '*mschapv2*' -name '*.adoc' -type f)

files=$(find .drafts -name 'in*' -type f) && [ -n "$files" ] && nvim $files

files=$(grep -rl '\[ \]' .drafts/*.adoc) && [ -n "$files" ] && nvim $files

grep -q 'TODO\|FIXME\|\[ \]' "$file" && nvim "$file"

files=$(find . -name "*tcp-clock*.age" -type f) && \
  [ -n "$files" ] && echo "$files" | xargs -I{} decrypt-file {} && \
  nvim $(echo "$files" | sed 's/\.age$//')

tee_clean() {
  tee >(sed 's/\x1b\[[0-9;]*m//g' > "$1")
}

# Color output on terminal, stripped in file
jq -C '.' data.json | tee_clean output.json
xq -C '.' data.xml | tee_clean output.json

# Wrap a whole block
{
  echo "=== Summary ==="
  jq -C '.[] | .name' data.json
} | tee_clean summary.txt

for cmd in asciidoctor asciidoctor-pdf pandoc rouge d2 mmdc age; do
  printf "%-20s %s\n" "$cmd" "$(command -v $cmd >/dev/null 2>&1 && echo 'OK' || echo 'MISSING')"
done

printf '---\n\n'

printf '%s\n\n' '---'

lsof -i TCP -n -P | awk '/ssh.*ESTABLISHED/ {print $2, $9}'

lsof -i TCP -n -P | awk '/ssh.*kvm-01.*ESTABLISHED/ {print $2}' | sort -u | xargs kill

lsof -i TCP -n -P | awk '/ssh.*ESTABLISHED/ {print $2}' | sort -u | xargs kill

find / -name "*.conf" 1>results.txt 2>errors.txt

find / -name "*.conf" 2>/dev/null

command 2>&1 | grep "pattern"

cat <<'EOF'
Line 1
Line 2
EOF

git commit -m "$(cat <<'EOF'
feat: add new feature

Multi-line description here.
EOF
)"

cd ~/atelier/_projects/personal/domus-api && uv run uvicorn domus_api.main:app --host 0.0.0.0 --port 8080

curl -s localhost:8080/ | jq

curl -s 'localhost:8080/search?q=mandiant' | jq

curl -s 'localhost:8080/search?q=mandiant' | jq '.results[] | {path, title, match_count}'

curl -s 'localhost:8080/pages?category=standards' | jq

curl -s localhost:8080/attributes | jq

gh search code "vault seal" --owner EvanusModestus --json repository,path,textMatches |
  jq '.[] | {repo: .repository.full_name, file: .path, match: .textMatches[].fragment}'

gh api 'repos/EvanusModestus/domus-captures/git/trees/main?recursive=1' |
  jq '[.tree[] | select(.path | endswith(".adoc"))] | length'

bat docs/modules/ROOT/pages/2026/04/WRKLOG-$(date +%Y-%m-%d).adoc

bat docs/modules/ROOT/partials/trackers/work/priorities/current.adoc

bat docs/modules/ROOT/partials/trackers/work/adhoc/carryover.adoc

bat docs/modules/ROOT/partials/projects/mandiant-remediation/summary.adoc

grep -rl "MSCHAPv2" docs/modules/ROOT/ --include="*.adoc" | sort

grep -rn "pattern" docs/modules/ROOT/partials/codex/ --include="*.adoc" -B1 -A3

ls -1 docs/modules/ROOT/pages/2026/04/WRKLOG-*.adoc

echo $(( ($(date +%s) - $(date -d "2026-03-09" +%s)) / 86400 ))

age --decrypt -i ~/.secrets/.metadata/keys/master.age.key \
  data/d001/projects/mandiant-remediation/findings-status-2026-04-16.adoc.age \
  | bat --language asciidoc

for d in data/d001/projects/*/; do
  total=$(find "$d" -type f | wc -l)
  plain=$(find "$d" -type f ! -name '*.age' ! -name 'README.adoc' ! -name '.gitkeep' ! -name '*.py' | wc -l)
  printf "%-25s %s files  %s plaintext\n" "$(basename "$d")" "$total" "$plain"
done

export ISE_HOST="{ise-ip}" ISE_USER="admin" ISE_PASS="$(gopass show -o ise/admin)"

curl -sk "https://$ISE_HOST:{ise-ers-port}/ers/config/identitygroup" \
  -H "Accept: application/json" -u "$ISE_USER:$ISE_PASS" | jq '.SearchResult.resources[].name'

curl -sk "https://$ISE_HOST:{ise-ers-port}/ers/config/endpoint?filter=mac.EQ.AA:BB:CC:DD:EE:FF" \
  -H "Accept: application/json" -u "$ISE_USER:$ISE_PASS" | jq '.SearchResult.total'

openssl x509 -in {cert-dir}/client.pem -text -noout | head -30

openssl x509 -in {cert-dir}/client.pem -enddate -noout

ss -tlnp | grep -E ':{port-https}|:{port-ssh}|:{port-ldaps}'

nc -zv {ise-ip} {ise-ers-port}

dig {ise-hostname} +short

pwsh -NoLogo -Command 'Get-Process | Sort-Object WorkingSet64 -Descending |
  Select-Object -First 5 ProcessName, Id,
    @{N="MB";E={[math]::Round($_.WorkingSet64/1MB)}} | Format-Table'

pwsh -NoLogo -Command 'Get-Process | Where-Object {$_.ProcessName -like "*teams*"} | Stop-Process'
pwsh -NoLogo -Command 'Start-Process "ms-teams"'

pwsh -NoLogo -Command 'Get-Process | Sort-Object WorkingSet64 -Descending |
  Select-Object -First 5 ProcessName, Id,
    @{N="MB";E={[math]::Round($_.WorkingSet64/1MB)}} | ConvertTo-Json' | jq '.'

netsh wlan disconnect interface="Wi-Fi"
netsh wlan show networks mode=bssid
netsh wlan connect name="CHLA-Remote" interface="Wi-Fi"

ssh evan@modestus-razer.inside.domusdigitalis.dev

age --decrypt -i ~/.secrets/.metadata/keys/master.age.key \
  data/d001/projects/mandiant-remediation/findings-status-2026-04-16.adoc.age \
  | bat --language asciidoc --file-name "findings-status-2026-04-16.adoc"

for f in data/d001/projects/mandiant-remediation/{findings-status,guest-acl-update,siem-report}-2026-04-16.adoc; do
  rm -f "${f}.age" && echo y | encrypt-file "$f"
done

for f in data/d001/projects/*/*.adoc; do
  age="${f}.age"
  if [ -f "$f" ] && [ -f "$age" ]; then
    pt_mod=$(/usr/bin/stat -c'%Y' "$f")
    age_mod=$(/usr/bin/stat -c'%Y' "$age")
    [ "$pt_mod" -gt "$age_mod" ] && echo "STALE: $f"
  fi
done

shred -u data/d001/projects/mandiant-remediation/man-report.txt

find data/d001/projects -type f ! -name '*.age' ! -name 'README.adoc' ! -name '.gitkeep' ! -name '*.py' | sort

wpctl status                                    # PipeWire status
pactl list sinks short                          # list audio sinks
pw-play /usr/share/sounds/freedesktop/stereo/bell.oga  # test default sink
journalctl -b --grep='sof|cs35l56' --no-pager | tail -20  # kernel audio firmware
cat /proc/asound/cards                          # ALSA sound cards

gopass-personal-docs    # interactive entry creation
gopass-query bills      # list recurring bills with totals
gopass-query storage    # list storage units with gate codes
gopass-query export bills  # export category to JSON

make new-day      # create today's worklog + update attributes
make serve        # build + local server (port 8000)
make              # build only
make sync-nav     # sync worklog nav entries
make update-index # rebuild monthly index

for d in data/d001/projects/*/; do
  total=$(find "$d" -type f | wc -l)
  plain=$(find "$d" -type f ! -name '*.age' ! -name 'README.adoc' ! -name '.gitkeep' ! -name '*.py' | wc -l)
  echo "$(basename "$d") | ${total} files | ${plain} plaintext"
done