WRKLOG-2026-06-23

bash scripts/secrets-backup-cleanup.sh --dry-run
bash scripts/secrets-backup-cleanup.sh --keep 3

bash scripts/secrets-inventory-gen.sh --domain d000

bash scripts/secrets-inventory-gen.sh --domain d000 --output /tmp/generated.yaml

yq '.tiers | keys' /tmp/DOMAIN_INVENTORY.yaml

yq '.tiers.dev | keys' /tmp/DOMAIN_INVENTORY.yaml
yq '.tiers.prod | keys' /tmp/DOMAIN_INVENTORY.yaml

yq '.tiers.dev | to_entries | map(select(.value.status == "DEPRECATED")) | from_entries | keys' /tmp/DOMAIN_INVENTORY.yaml

yq '.tiers.dev.network.scoped | keys' /tmp/DOMAIN_INVENTORY.yaml
yq '.tiers.dev.identity.scoped | keys' /tmp/DOMAIN_INVENTORY.yaml
yq '.tiers.dev.pki.scoped | keys' /tmp/DOMAIN_INVENTORY.yaml

diff <(yq '.tiers | keys' /tmp/DOMAIN_INVENTORY.yaml) \
     <(yq '.tiers | keys' /tmp/generated.yaml)

yq '.retired | to_entries[] | .key + ": " + .value.reason' /tmp/DOMAIN_INVENTORY.yaml

yq '.' /tmp/DOMAIN_INVENTORY.yaml > /tmp/before.yaml
age -e -R ~/.age/recipients/self.txt -o /tmp/test.yaml.age /tmp/DOMAIN_INVENTORY.yaml
age -d -i ~/.age/identities /tmp/test.yaml.age | yq '.' > /tmp/after.yaml
diff /tmp/before.yaml /tmp/after.yaml && echo "Round-trip clean" || echo "MISMATCH"
rm /tmp/before.yaml /tmp/after.yaml /tmp/test.yaml.age

rm ~/.secrets/environments/domains/DOMAIN_INVENTORY.yaml.age
age -e -R ~/.age/recipients/self.txt \
  -o ~/.secrets/environments/domains/DOMAIN_INVENTORY.yaml.age \
  /tmp/DOMAIN_INVENTORY.yaml

age -d -i ~/.age/identities ~/.secrets/environments/domains/DOMAIN_INVENTORY.yaml.age \
  | yq '.tiers | keys'

rm /tmp/DOMAIN_INVENTORY.yaml /tmp/generated.yaml

git -C ~/.secrets add environments/domains/DOMAIN_INVENTORY.yaml.age
git -C ~/.secrets commit -m "docs(d000): two-tier model — retire lab/staging, blast radius roadmap"

diff <(age -d -i ~/.age/identities ~/.secrets/environments/domains/d000/lab/network.env.age \
       | yq 'keys') \
     <(age -d -i ~/.age/identities ~/.secrets/environments/domains/d000/dev/network.env.age \
       | yq 'keys')

rm -rf ~/.secrets/environments/domains/d000/lab
rm -rf ~/.secrets/environments/domains/d000/staging
rm -rf ~/.secrets/environments/domains/d000/notes

git -C ~/.secrets add -A
git -C ~/.secrets commit -m "chore(d000): remove retired tiers (lab, staging, notes)"

dq-stow -R zsh

cd ~/atelier/_projects/personal/dots-quantum
git checkout -- zsh/.zshrc
dq-stow -R zsh

cd ~/atelier/_projects/personal/dots-quantum

# Dry run — see what would be linked
stow -n -v shell 2>&1 | head -20
stow -n -v bin 2>&1 | head -20
stow -n -v tmux 2>&1 | head -20

# If clean, stow them
dq-stow shell
dq-stow bin
dq-stow tmux

# Unstow a package (removes symlinks, leaves originals in dots-quantum)
dq-stow -D shell
dq-stow -D bin
dq-stow -D tmux

# Nuclear: restore .zshrc specifically
cd ~/atelier/_projects/personal/dots-quantum
git checkout -- zsh/.zshrc
dq-stow -R zsh

# 1. Revert the commit
git -C ~/atelier/_projects/personal/dots-quantum log --oneline -5
git -C ~/atelier/_projects/personal/dots-quantum revert HEAD

# 2. Reload
source ~/.zshrc

# 3. Or hard reset to previous commit (destructive — loses all changes since)
git -C ~/atelier/_projects/personal/dots-quantum reset --hard HEAD~1

find . \
  \( -path './.git' -o -path '*/.git' -o -path '*/node_modules' \
     -o -path '*/__pycache__' -o -path '*/.claude' \) -prune \
  -o -type f -mtime -1 \
  -printf '%TY-%Tm-%Td %TH:%TM  %p\n' |
sort -r | head -20

find . -path './.git' -prune -o \
  -type f -mtime -1 \
  -printf '%TY-%Tm-%Td %TH:%TM  %p\n' |
awk '/\.(adoc|md|yaml|yml|sh)$/' |
sort -r | head -20

find . -path './.git' -prune -o \
  -type f -mtime -1 \
  -printf '%TY-%Tm-%Td %TH:%TM  %8s  %p\n' |
sort -r | head -20

find . -path './.git' -prune -o \
  -type f -mmin -120 \
  -printf '%TY-%Tm-%Td %TH:%TM  %p\n' |
sort -r | head -20

find . -path './.git' -prune -o \
  -type f \
  -printf '%T@ %TY-%Tm-%Td %TH:%TM  %p\n' |
sort -nr | head -20 |
awk '{$1=""; print substr($0,2)}'

find ~/atelier/_bibliotheca -maxdepth 1 -type d |
while read -r repo; do
  count=$(find "$repo" -path '*/.git' -prune -o -type f -mtime -1 -print 2>/dev/null | wc -l)
  [ "$count" -gt 0 ] && echo "$count  $repo"
done | sort -nr

find . -path './.git' -prune -o \
  -type f -mtime -1 \
  -exec stat --format='%y  %n' {} \; 2>/dev/null |
awk '{print $1, $2, $NF}' |
sort -r | head -15

fd --type f --changed-within 1d --exclude .git .

grep -rn '=== Dispositio' data/d001/proj*/abnor*

data/d001/projects/abnormal-security/partials/cr-tester-expansion-2026-06-18.adoc:156:=== Dispositio

TARGET=$(find data/d001/proj*/abnor* -name 'cr-tester-ex*.adoc' ! -name '*.bak' -path '*/partials/*')
echo "$TARGET"

awk 'NR==156{found=0} NR>=156{print; if(/^====$/) found++; if(found==2) exit}' "$TARGET"

=== Dispositio

[TIP]
====
Abnormal Security has been running in read/write mode for six weeks alongside Microsoft Defender for Office 365. Twenty-one pilot users across InfoSec and two server team members — the people most likely to be targeted by BEC and credential phishing. The platform performed exactly as expected throughout the pilot.

All protection is governed by a single Exchange security group. Four Defender policies — anti-spam, safe links, safe attachments, and the external sender modification rule — are scoped to that group. This change adds members to the group. That's it. No policy modifications, no mail flow changes, no configuration drift, no downtime.

We expand in two phases: remaining server team on Wednesday, all of Information Services on Thursday. Each phase gets 24 hours of monitored validation before the next. If anything surfaces, we remove the newly added members — policies revert within minutes. The pre-change state is captured as a JSON export for audit traceability.

This is a group membership change with instant rollback. The architecture makes it low-risk by design.
====

cp "$TARGET"{,.bak}

v +156 "$TARGET"

:156                       " jump to line 156
/^====$/                   " search forward — lands on opening ====
n                          " advance to closing ====
:.                         " note this line number (e.g. 176)
:156,176d                  " delete the entire block
O                          " open line above cursor — paste revised content

cat > /tmp/dispositio.adoc << 'EOF'
=== Dispositio

[TIP]
====
We've successfully piloted Abnormal Security alongside Microsoft Defender for Office 365 for six weeks with the team most likely to face targeted attacks — our InfoSec staff and two server team members. The platform delivered exactly what we expected, and we're ready to expand.

The rollout is straightforward. All protection runs through a single Exchange security group with four scoped Defender policies (anti-spam, safe links, safe attachments, and external sender modification). We're simply adding members to this existing group — no policy changes, no mail flow adjustments, no configuration drift, and no downtime.

We'll move in two phases:

* *Wednesday* — remaining server team
* *Thursday* — all of Information Services

Each phase gets 24 hours of monitored validation before the next. If anything surfaces, we remove the new members and revert within minutes — the protection policies remain unchanged, so there's no ripple effect. We've captured the pre-change state as a JSON export for audit traceability.

This is a group membership change with instant rollback baked into the design. The architecture itself makes it low-risk.
====
EOF

END=$(awk 'NR>=157 && /^====$/{ if(++n==2){print NR; exit} }' "$TARGET")
sed -i -e "156,${END}d" -e "155r /tmp/dispositio.adoc" "$TARGET"

diff <(awk 'NR==156{f=0} NR>=156{print; if(/^====$/) f++; if(f==2) exit}' "$TARGET".bak) \
     <(awk 'NR==156{f=0} NR>=156{print; if(/^====$/) f++; if(f==2) exit}' "$TARGET")

diff <(git show HEAD:"$TARGET" | awk 'NR==156{f=0} NR>=156{print; if(/^====$/) f++; if(f==2) exit}') \
     <(awk 'NR==156{f=0} NR>=156{print; if(/^====$/) f++; if(f==2) exit}' "$TARGET")

awk 'NR==156{found=0} NR>=156{print; if(/^====$/) found++; if(found==2) exit}' "$TARGET"

cp "$TARGET"{.bak,}

git checkout -- "$TARGET"

rm "$TARGET".bak /tmp/dispositio.adoc

tee docs/modules/ROOT/partials/worklog/daily-notes/2026-06/2026-06-23/dispositio-revision.adoc << 'ADOC'
==== Workflow addendum 2026-06-23 15:59

The dispositio summary needed revision. The workflow below documents two methods for performing a multi-line block replacement in an AsciiDoc file: one using Neovim, the other using sed with a heredoc. Both follow the same lifecycle: *identify → backup → implement → verify → rollback*.

===== Locate the target

Use `grep -rn` to return both the filename and line number in a single pass.

[source,bash]

.Output
[source,console]

Assign the path to a variable to avoid repetition in every subsequent command. The `find` filter excludes `.bak` files and constrains the match to `partials/` to guarantee a single result.

[source,bash]

===== Identify the line range

Print from the `=== Dispositio` heading through the closing `====` delimiter to confirm the exact block boundaries. AsciiDoc admonition blocks use `====` for both open and close, so `sed` range addressing stops on the first match. `awk` with a delimiter counter handles this correctly.

[source,bash]

.Output
[source,asciidoc]

dsource d001 dev/network/ise

cat data/shared/partials/ise-ers/helpers.adoc
cat data/shared/partials/ise-mnt/helpers.adoc
cat data/shared/partials/ise-dataconnect/helpers.adoc

source data/shared/scripts/ise-inventory.sh | tee /tmp/ise-inventory-$(date +%F).txt

MAC="14:F6:D8:7B:31:80" . $(find data -name 'full-endpoint-profile.sh')

dc-run-sql $(find data -name 'migration-executive-summary.sql') | tee /tmp/exec-summary.json | jq '.'

netapi ise get-endpoints --group "Linux-Research-Workstations" --all -f json | jq -r '.[].mac'

netapi ise get-endpoint 14:F6:D8:7B:31:80 -f json | jq '{groupId, identityGroup, mac, staticGroupAssignment}'

netapi ise dc auth-history 14:F6:D8:7B:31:80 -f json | jq '.[] | {time, status, authz_profile}'

netapi ise mnt session 14:F6:D8:7B:31:80

netapi ise mnt coa 14:F6:D8:7B:31:80

netapi ise get-policy-sets -f json | jq -r '.[].name'

dsource d000 dev/network/ise

bash $(find data/d000/infra/ise-api-reference/scripts/mnt -name 'active-sessions.sh') table

MAC                IP                 USER        NAS
64:32:A8:C4:C7:19  64:32:A8:C4:C7:19  10.50.1.40
A0:59:50:C9:92:EE  A0:59:50:C9:92:EE  10.50.1.40
56:38:C0:55:C5:8F  56:38:C0:55:C5:8F  10.50.1.40
24:FD:FA:04:A8:33  24:FD:FA:04:A8:33  10.50.1.40

bash $(find data/d000/infra/ise-api-reference/scripts/mnt -name 'session-detail.sh') 64:32:A8:C4:C7:19

{
  "user_name": "64:32:A8:C4:C7:19",
  "nas_ip_address": "10.50.1.40",
  "calling_station_id": "64:32:A8:C4:C7:19",
  "cpmsession_id": "2801320A00000161DE36DEF9",
  "destination_ip_address": "10.50.1.20",
  "acs_server": "ise-01",
  "auth_acs_timestamp": "2026-06-18T21:49:59.690-07:00",
  "nas_port_id": "capwap_90000002",
  "endpoint_policy": "Intel-Device",
  "acct_status_type": "Start"
}

cat $(find data/d000/infra/wlc-api-reference/scripts/cli -name 'wlc-audit.txt')

data/d000/infra/scripts/cli/
├── net-push.sh          # Multi-device push tool (chmod 700)
├── devices.yaml         # Device inventory — hosts, gopass paths, prompts
└── .net-push.sha256     # Integrity hash (auto-generated)

data/d000/infra/wlc-api-reference/scripts/cli/
├── wlc-audit.txt        # 28-check WLC audit
├── wlc-push.sh          # Original single-device tool (superseded)
└── patches/
    ├── accounting-fix.txt
    └── write-memory.txt

devices:
  9800-wlc-01:
    host: 9800-wlc-01
    gopass: v3/domains/d000/network/devices/9800-wlc-01/ssh/admin
    prompt: "#"
    type: ios-xe
    destructive: "write memory|write mem|wr mem|wr$|erase|reload|delete"

  vyos-01:
    host: vyos-01
    gopass: v3/domains/d000/network/devices/firewall/vyos-01/vyos-admin
    prompt: "\\$"
    type: vyos
    destructive: "commit|save|reboot|delete"

# List all devices
bash $(find data/d000/infra/scripts/cli -name 'net-push.sh') --list

# Dry run — preview commands without sending
bash $(find data/d000/infra/scripts/cli -name 'net-push.sh') 9800-wlc-01 wlc-audit.txt --dry-run

# Run audit — all show commands, read-only
bash $(find data/d000/infra/scripts/cli -name 'net-push.sh') 9800-wlc-01 wlc-audit.txt

# Apply a patch — destructive command requires hostname confirmation
bash $(find data/d000/infra/scripts/cli -name 'net-push.sh') 9800-wlc-01 patches/write-memory.txt

$ net-push 9800-wlc-01 patches/write-memory.txt

WARNING: Patch contains destructive commands for 9800-wlc-01 (ios-xe):
   2: write memory

Type the device name to confirm [9800-wlc-01]: _

# Full enriched table
bash $(find data/d000/infra/ise-api-reference/scripts/mnt -name 'session-report.sh') table

# JSON array — all fields, pipeable to more jq
bash $(find data/d000/infra/ise-api-reference/scripts/mnt -name 'session-report.sh') json

# Compact — MAC, IP, accounting status
bash $(find data/d000/infra/ise-api-reference/scripts/mnt -name 'session-report.sh') summary

# Split other_attr_string into key-value pairs for one MAC
bash $(find data/d000/infra/ise-api-reference/scripts/mnt -name 'session-report.sh') attrs E0:D5:5D:6C:E1:66

MAC                IP            USER                                       NAS         ACCT   PROFILE
64:32:A8:C4:C7:19  —             64:32:A8:C4:C7:19                          10.50.1.40  Start  Intel-Device
A0:59:50:C9:92:EE  —             A0:59:50:C9:92:EE                          10.50.1.40  Start  Windows10-Workstation
56:38:C0:55:C5:8F  —             56:38:C0:55:C5:8F                          10.50.1.40  Start  Unknown
24:FD:FA:04:A8:33  —             24:FD:FA:04:A8:33                          10.50.1.40  Start  Unknown

bash $(find data/d000/infra/ise-api-reference/scripts/mnt -name 'session-detail.sh') E0:D5:5D:6C:E1:66 | jq '{user: .sessionParameters.user_name, ip: .sessionParameters.framed_ip_address, nas: .sessionParameters.nas_ip_address, acct: .sessionParameters.acct_status_type, profile: .sessionParameters.endpoint_policy}'

{
  "user": "modestus-p16g.inside.domusdigitalis.dev",
  "ip": "10.50.1.204",
  "nas": "10.50.1.40",
  "acct": "Stop",
  "profile": "Intel-Device"
}

pgrep -a picocom

390232 picocom -b 9600 /dev/ttyUSB0

bash $(find data/d000/infra/scripts/diagnostics -name 'lsof-by-pid.sh') picocom

# Name → PIDs → lsof (what the script does internally)
lsof -p $(pgrep -d, picocom)

# Multiple PIDs joined with comma
lsof -p $(pgrep -d, kitty)

# Inline PID resolution for network filtering
lsof -i -a -p $(pgrep ssh-agent)

# ESTABLISHED connections only
bash $(find data/d000/infra/scripts/diagnostics -name 'lsof-network.sh') established

# What's listening on RADIUS port
bash $(find data/d000/infra/scripts/diagnostics -name 'lsof-network.sh') 1812

# All SSH connections
bash $(find data/d000/infra/scripts/diagnostics -name 'lsof-network.sh') ssh

# Connections by any process name
bash $(find data/d000/infra/scripts/diagnostics -name 'lsof-network.sh') claude

data/d000/infra/scripts/diagnostics/
├── lsof-serial.sh      # Serial/console port ownership
├── lsof-network.sh     # Network connections by state/port/process
├── lsof-by-pid.sh      # All file handles by process (name or PID)
└── lsof-files.sh       # Who holds a file/device/directory

dots-quantum/ollama/.config/ollama/modelfiles/
├── quick.Modelfile      # qwen3:30b-a3b — general
├── coder.Modelfile      # deepseek-r1:32b — code
├── analyst.Modelfile    # deepseek-r1:32b — data/logs
├── neteng.Modelfile     # deepseek-r1:32b — ISE/network
├── docs.Modelfile       # qwen3:30b-a3b — AsciiDoc
└── setup.sh             # Creates all models from Modelfiles

dq-stow ollama
bash ~/.config/ollama/modelfiles/setup.sh

source ~/.zshrc
ai

ssh -G modestus-p50 | awk '/^hostname/'

grep 'modestus-p50' ~/atelier/_projects/personal/dots-quantum/ssh/.ssh/config.d/20-d000-key-hierarchy.conf

grep 'modestus-p50' ~/atelier/_projects/personal/dots-quantum/ssh/.ssh/config.d/80-d000-hosts.conf

modestus-p50         — | No A record (retired?)
modestus-p16g        — | No A record (DHCP — currently 10.50.1.204)
thinkpad-x1          — | No A record (retired?)
gabriel-workstation  — | No A record

bash $(find data/d000/infra/ise-api-reference/scripts/mnt -name 'session-report.sh')

bash $(find data/d000/infra/ise-api-reference/scripts/mnt -name 'session-detail.sh') A0:59:50:C9:92:EE

P50_IP=$(bash $(find data/d000/infra/ise-api-reference/scripts/mnt -name 'reshape-session.sh') \
  A0:59:50:C9:92:EE | jq -r '.identity.ip')
printf "modestus-p50 IP: %s\n" "$P50_IP"

ZONE_BEFORE=$(dig +noall +answer axfr inside.domusdigitalis.dev @10.50.1.90 | \
  awk '$4=="A" {h=$1; sub(/\.$/,"",h); printf "%-45s %s\n", h, $5}' | sort -k2,2V)

ssh bind-01 sudo named-checkzone inside.domusdigitalis.dev /var/named/inside.domusdigitalis.dev.zone

ssh bind-01 sudo vim /var/named/inside.domusdigitalis.dev.zone

modestus-p50    IN  A  <IP-FROM-STEP-1>

ssh bind-01 sudo named-checkzone inside.domusdigitalis.dev /var/named/inside.domusdigitalis.dev.zone

ssh bind-01 sudo rndc reload inside.domusdigitalis.dev

diff <(echo "$ZONE_BEFORE") \
     <(dig +noall +answer axfr inside.domusdigitalis.dev @10.50.1.90 | \
       awk '$4=="A" {h=$1; sub(/\.$/,"",h); printf "%-45s %s\n", h, $5}' | sort -k2,2V)

paste <(dig +short modestus-p50.inside.domusdigitalis.dev @10.50.1.90) \
      <(dig +short modestus-p50.inside.domusdigitalis.dev @10.50.1.91) \
  | awk '{printf "primary=%-15s secondary=%s\n", $1, $2}'

ssh bind-01 sudo rndc notify inside.domusdigitalis.dev

for name in kvm-0{1,2} nas-0{1,2} vyos-0{1,2} vyos-vip bind-0{1,2} ipa-0{1,2} \
  keycloak-0{1,2} ipsk-mgr-0{1,2} vault-0{1,2,3} certmgr-01 \
  home-dc0{1,2} 9800-wlc-0{1,2} wlc-0{1,2} k3s-master-0{1,2,3} \
  ise-0{1,2} gitea-01 3560cx-01 9300-01 ipmi-0{1,2} \
  wazuh wazuh-indexer wazuh-dashboard wazuh-workers wazuh-api \
  prometheus alertmanager grafana \
  modestus-{p16g,aw,razer} thinkpad-x1 modestus-p50 gabriel-workstation; do
  ip=$(dig +short "${name}.inside.domusdigitalis.dev" @10.50.1.90)
  [ -n "$ip" ] && printf "Host %s\n    HostName %s\n\n" "$name" "$ip"
done >| ~/atelier/_projects/personal/dots-quantum/ssh/.ssh/config.d/80-d000-hosts.conf

ssh -G modestus-p50 | awk '/^hostname|^user|^port/'

age -e -R ~/.age/recipients/self.txt \
  -o ~/atelier/_projects/personal/dots-quantum/ssh/.ssh/config.d/80-d000-hosts.conf.age \
  ~/atelier/_projects/personal/dots-quantum/ssh/.ssh/config.d/80-d000-hosts.conf

Host modestus-p50 gabriel-workstation
    HostName <IP>
    User gabriel