WRKLOG-2026-06-28

PASS=$(gopass show v3/domains/d000/identity/ise/ise-01 | yq -r '.credentials.cli.password') (1)

sshpass -p "$PASS" ssh ise-01 \ (2)
  'screen-length 0 ; show application status ise' \ (3)
  2>&1 | tee /tmp/ise-app-status-$(date +%F-%H%M).txt (4)

unset PASS (5)

sudo systemctl enable --now wpa_supplicant-wired@enp134s0 (1)

bash $(find data -name 'search-endpoint.sh' -path '*/dataconnect/*') p16g (1)

ip link show enp134s0 | awk '/ether/{print $2}' (1)
# a8:2b:dd:8f:23:e6

dsource d000 dev/network/ise (1)
bash $(find data -name 'search-endpoint.sh' -path '*/dataconnect/*') p16g (2)
bash $(find data -name 'search-endpoint.sh' -path '*/dataconnect/*') p50 (3)
bash $(find data -name 'search-endpoint.sh' -path '*/dataconnect/*') 14:F6:D8 (4)

dsource d001 dev/network/ise (5)
bash $(find data -name 'search-endpoint.sh' -path '*/dataconnect/*') vocera (6)

dsource d000 dev/network/ise (1)
bash data/d000/infra/ise-api-reference/scripts/health-check.sh (2)

Unable to negotiate with 10.50.1.10 port 22: no matching host key type found. Their offer: ssh-rsa

Host 3560cx-01 (1)
    User admin
    PubkeyAuthentication no (2)
    PasswordAuthentication yes
    KbdInteractiveAuthentication yes
    PreferredAuthentications keyboard-interactive,password
    KexAlgorithms +diffie-hellman-group14-sha1 (3)
    HostKeyAlgorithms +ssh-rsa (4)
    PubkeyAcceptedAlgorithms +ssh-rsa
    Ciphers aes256-ctr,aes128-ctr (5)
    MACs hmac-sha2-256,hmac-sha1
    ControlMaster no (6)
    ConnectTimeout 10

ssh: Could not resolve hostname modestus-p50: Name or service not known

Host modestus-p50
    HostName <IP — resolve via dig or ISE DataConnect search>

age -e -R ~/.age/recipients/self.txt \ (1)
  -o ~/.ssh/config.d/80-d000-hosts.conf.age \ (2)
  ~/.ssh/config.d/80-d000-hosts.conf (3)

sensors | head -30 (1)
top -bn1 | head -15 (2)

    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
3383353 evanusm+  20   0    7180   4952   4568 R 100.0   0.0 201:17.31 less
1243951 evanusm+  20   0 3171916   1.7g 100048 S  28.6   2.7  48:54.30 claude

cat /proc/3383353/cmdline | tr '\0' ' ' (1)
# less -R -F -K

ls -l /proc/3383353/fd/0 (2)
# pipe:[5994563]  ← orphaned pipe, source gone

kill 3383353

grep -rn '\[\[' docs/modules/ROOT/partials/ (1)
grep -rn '\[\[.*\]\]' docs/modules/ROOT/partials/ --include='*.adoc' (2)
grep -rnP '(?<=\[\[).*?(?=\]\])' docs/modules/ROOT/ --include='*.adoc' (3)
grep -rl 'strace' docs/ data/ (4)
grep -rnC2 'EACCES' docs/modules/ROOT/partials/standards/ (5)
grep -rn 'source,bash' docs/ --include='*.adoc' | wc -l (6)
grep -rnv '^//' docs/modules/ROOT/partials/worklog/daily-notes/2026-06/2026-06-28.adoc (7)

find docs/ -name '*.adoc' -newer docs/antora.yml (1)
find data/ -name '*.sh' -executable (2)
find docs/modules/ROOT/partials/worklog/daily-notes/ -type d -name '2026-06-*' (3)
find . -name '*.adoc' -path '*/standards/*' (4)
find data/ -name '*.sql' -exec head -2 {} + (5)
find docs/ -name '*.adoc' -size +50k (6)
find . -name '*.adoc' -newer /tmp/ise-health-check-2026-06-28-1017.txt (7)

awk '/^=====/{print FILENAME": "$0}' docs/modules/ROOT/partials/worklog/daily-notes/2026-06/2026-06-28/*/*.adoc (1)
awk '/^\| Task/,/^\|===/' data/d000/infra/ise-api-reference/partials/cross-api-patterns.adoc | awk '/^\|/{gsub(/^\| */,""); print}' (2)
awk '/^\[source,bash\]/{p=1;next} p&&/^----/{if(++d==1)next; p=0;d=0;next} p&&d' docs/modules/ROOT/partials/worklog/daily-notes/2026-06/2026-06-28/ise-mnt-diagnostics/sshpass-pipeline.adoc (3)
awk '/^include::/{gsub(/include::|partial\$|\[\]/,""); print}' docs/modules/ROOT/partials/worklog/daily-notes/2026-06/2026-06-28.adoc (4)
awk 'FNR==1{print "--- "FILENAME" ---"} /TODO|FIXME|HACK/{print FNR": "$0}' docs/modules/ROOT/partials/worklog/daily-notes/2026-06/2026-06-28/*/*.adoc (5)

sed -n '/^====/,/^====/p' docs/modules/ROOT/partials/worklog/daily-notes/2026-06/2026-06-28/cpu-temp-runaway-less/investigation.adoc (1)
sed -n '10,25p' data/d000/infra/ise-api-reference/scripts/lib/ise-common.sh (2)
sed '/^\/\//d' docs/modules/ROOT/partials/worklog/daily-notes/2026-06/2026-06-28/ise-mnt-diagnostics.adoc (3)
sed -n 's/.*include::\(.*\)\[\].*/\1/p' docs/modules/ROOT/partials/worklog/daily-notes/2026-06/2026-06-28.adoc (4)

grep -rl 'AppArmor' docs/ | xargs grep -l 'EACCES' (1)
find data/ -name '*.sh' | xargs head -5 | grep -B1 'Author' (2)
grep -rn 'dc_query' data/d000/infra/ise-api-reference/scripts/ | awk -F: '{print $1}' | sort -u (3)
find docs/modules/ROOT/partials/worklog/daily-notes/2026-06/2026-06-28/ -name '*.adoc' -exec grep -l 'callout\|<1>' {} + (4)
grep -rn '\[source,' docs/ --include='*.adoc' | awk -F, '{print $2}' | tr -d ']' | sort | uniq -c | sort -rn (5)

idea "AppArmor profiles should be version-controlled in git" (1)
idea -p ise-api "add certificate expiry check to health-check.sh" (2)
idea -t education "read chapter 7 of K&R before Thursday" (3)
idea --review (4)
idea --search "apparmor" (5)

~/.local/bin/idea                          ← shell function or script
  │
  ├── Default: append to today's idea file
  │   docs/modules/ROOT/partials/worklog/daily-notes/YYYY-MM-DD/ideas/raw.adoc
  │
  ├── -p <project>: append to project inbox
  │   data/<tier>/projects/<slug>/partials/inbox.adoc
  │
  ├── -t <tag>: append with category tag
  │   Same file, but prefixed with [tag] for triage filtering
  │
  ├── --review: open today's ideas in $EDITOR
  │   nvim $(find docs/modules/ROOT/partials/worklog/daily-notes/$(date +%F) -name 'raw.adoc')
  │
  └── --search <term>: grep all idea files
      grep -rn <term> docs/modules/ROOT/partials/worklog/daily-notes/*/ideas/

===== 2026-06-28 10:45 — AppArmor profiles should be version-controlled
[tags: infrastructure, apparmor]

AppArmor profiles should be version-controlled in git. Currently editing
/etc/apparmor.d/ directly with sudo sed — no history, no rollback, no
diff. The curl and git profile fixes from this week would have been
safer with a git-managed workflow.

**Status:** raw +
**Disposition:** _pending triage_

---

Captured (raw)                             ← idea "thought"
  │
  ├── Triage (daily/weekly review)         ← idea --review
  │   │
  │   ├── → Graveyard                      ← not worth pursuing, archived with reason
  │   │     docs/modules/ROOT/partials/worklog/ideas/graveyard.adoc
  │   │
  │   ├── → Discovery (STD-019)            ← micro-learning, append to discoveries/<cat>/
  │   │     Graduation: 3+ references → Codex
  │   │
  │   ├── → Existing Project               ← link to project inbox or backlog
  │   │     data/<tier>/projects/<slug>/partials/inbox.adoc
  │   │
  │   └── → New Project                    ← idea becomes PRJ-YYYY-MM-<slug>
  │         data/project-master.yaml + full project scaffold
  │
  └── Search (anytime)                     ← idea --search "term"
      grep across all raw + triaged idea files

# Build
cd ~/atelier/_bibliotheca/domus-captures && make build-data PROJ=c-programming

# View
firefox data/d000/education/c-programming-language/output/c-programming-language.html &

# Build with education standard visible
make build-data PROJ=c-programming ENV=show-std

NVIM_APPNAME=domus-nvim nvim
# or alias: v

asciidoctor: ERROR: partials/ch01-tutorial-intro.adoc: line 58: Failed to generate image: mmdc failed:

echo 'sequenceDiagram
    A->>B: hello' | mmdc -i - -o /tmp/test.png (1)

Error: Failed to launch the browser process!
[FATAL:zygote_host_impl_linux.cc(128)] No usable sandbox!
If you are running on Ubuntu 23.10+ or another Linux distro that has disabled
unprivileged user namespaces with AppArmor, see
https://chromium.googlesource.com/chromium/src/+/main/docs/security/apparmor-userns-restrictions.md

# Verify the restriction
cat /proc/sys/kernel/unprivileged_userns_clone (1)
sysctl kernel.unprivileged_userns_clone        (2)
aa-status | grep chromium                       (3)

# Check if unprivileged user namespaces are enabled
sysctl kernel.unprivileged_userns_clone (1)

# Check AppArmor status for a specific binary
aa-status | grep -A5 'mmdc\|chromium\|puppeteer' (2)

# Watch for AppArmor denials in real time
sudo dmesg -w | grep -i 'DENIED\|apparmor' (3)

# Check audit log for recent denials
sudo ausearch -m AVC -ts recent | grep -i 'DENIED' (4)

# Trace the failing process
strace -f -e clone,clone3 mmdc -i input.mmd -o output.png 2>&1 | grep -i 'EPERM\|EACCES' (5)

echo -e '\nHost modestus-p50\n    HostName 10.50.10.170' >> ~/.ssh/config.d/80-d000-hosts.conf (1)
sed -i 's/10\.50\.10\.170/10.50.10.107/' ~/.ssh/config.d/80-d000-hosts.conf (2)
grep '10.50.10.107' ~/.ssh/config.d/80-d000-hosts.conf (3)
ssh modestus-p50 (4)

cat /etc/hosts (1)
sudo chattr +i /etc/hosts (2)
lsattr /etc/hosts (3)
# ----i---------e------- /etc/hosts

sudo lsof -i -n -P | grep -i 'firefox\|chrome\|ESTABLISHED' | awk '{print $1, $3, $9}' | sort -u (1)

firefox gabriel 10.50.10.107:33490->142.251.152.119:443  # Google/YouTube
firefox gabriel 10.50.10.107:58624->151.101.65.42:443    # Reddit (151.101.x.x = Fastly/Reddit CDN)
firefox gabriel 10.50.10.107:39956->34.107.243.93:443    # Google services
steam   gabriel 10.50.10.107:39317->162.254.195.75:27018 # Steam (allowed)
gameoverl gabriel 127.0.0.1:53638->127.0.0.1:57343      # Ravenfield game (local, allowed)

sudo pkill -u gabriel firefox (1)

sudo find /home/gabriel/.mozilla/firefox -name 'places.sqlite' (1)

PROFILE=$(sudo find /home/gabriel/.mozilla/firefox -name 'places.sqlite' -print -quit)
sudo sqlite3 "$PROFILE" "SELECT datetime(last_visit_date/1000000,'unixepoch','localtime') AS visited, url FROM moz_places WHERE last_visit_date IS NOT NULL ORDER BY last_visit_date DESC LIMIT 50;" (1)

sudo sqlite3 "$PROFILE" "SELECT datetime(last_visit_date/1000000,'unixepoch','localtime'), url FROM moz_places WHERE url LIKE '%youtube%' OR url LIKE '%reddit%' ORDER BY last_visit_date DESC LIMIT 20;" (1)

sudo sqlite3 "$PROFILE" "SELECT SUBSTR(url, INSTR(url,'://')+3, INSTR(SUBSTR(url,INSTR(url,'://')+3),'/')-1) AS domain, SUM(visit_count) AS visits FROM moz_places WHERE visit_count > 0 GROUP BY domain ORDER BY visits DESC LIMIT 20;" (1)

sudo python3 <<'EOF'
import json, lz4.block, sys, glob

profiles = glob.glob('/home/gabriel/.mozilla/firefox/*/sessionstore-backups/recovery.jsonlz4')
if not profiles:
    print("No active session found")
    sys.exit(0)

with open(profiles[0], 'rb') as f:
    magic = f.read(8)
    data = json.loads(lz4.block.decompress(f.read()))

for w in data.get('windows', []):
    for t in w.get('tabs', []):
        entries = t.get('entries', [])
        if entries:
            print(entries[-1].get('url', ''))
EOF
(1)

age-plugin-yubikey (1)

Choose a slot (1-20, or press Enter for slot 1):
Using slot 82 (Retired Key Management 1)
Generated new key pair.

recipient: age1yubikey1q...
identity: age-plugin-yubikey-1...

Write the identity to a file? (y/n)

mkdir -p ~/.age/identities ~/.age/recipients
# The identity file goes to ~/.age/identities/ (points to the YubiKey — no secret material)
# The recipient (public key) goes to ~/.age/recipients/yubikey.txt

echo "YubiKey age test — $(date)" | age -r "$(cat ~/.age/recipients/yubikey.txt)" > /tmp/yubikey-age-test.age (1)
age -d -i ~/.age/identities/age-identity-yubikey.txt /tmp/yubikey-age-test.age (2)
rm /tmp/yubikey-age-test.age

gopass init --store v4 --crypto age (1)
gopass config --store v4 (2)

gopass insert v4/test/hello (1)
gopass show v4/test/hello (2)
gopass rm v4/test/hello (3)

v3/ → GPG-backed (current production, read-only going forward)
v4/ → age/YubiKey-backed (new entries, rotated credentials)

sudo usbguard list-devices | grep -i yubi (1)

58: block id 1050:0407 serial "" name "YubiKey OTP+FIDO+CCID" hash "+yHSjnnIMzjrazEwqcEGVKmguy5xWgoVqqAQUnLyL5E=" parent-hash "Kc8J9gPb2yey1PIXEe9+4eCOuAHxcR7EsZlau6dOQZM=" via-port "3-1" with-interface { 03:01:01 03:00:00 0b:00:00 } with-connect-type "hotplug"

# List all discoverable projects
cd ~/atelier/_bibliotheca/domus-captures && make build-data-list

# Build a specific project
make build-data PROJ=<slug>

# Build with private attributes (d000)
make build-data PROJ=ise-api ENV=env-d000

# Build d001 projects (decrypt first)
d001 open <slug>
make build-data PROJ=<slug> TIER=d001 ENV=env-d001
# verify, then:
d001 close <slug>

# Open in browser
firefox data/d000/<category>/<project>/output/<project>.html &

garrysmod/addons/
└── my_first_addon/
    └── lua/
        └── autorun/
            └── client/
                └── my_hud.lua    <-- your code goes here

hook.Add("HUDPaint", "GabrielHUD", function() (1)
    draw.SimpleText(                           (2)
        "// GABRIEL'S WORLD //",               (3)
        "DermaLarge",                          (4)
        ScrW() / 2, 30,                        (5)
        Color(255, 215, 0),                    (6)
        TEXT_ALIGN_CENTER
    )
end)

    local hp = LocalPlayer():Health()             (1)
    local hpColor                                 (2)
    if hp > 75 then                               (3)
        hpColor = Color(0, 255, 100)              -- green
    elseif hp > 25 then
        hpColor = Color(255, 200, 0)              -- yellow
    else
        hpColor = Color(255, 50, 50)              -- red!
    end

    draw.RoundedBox(8, 20, ScrH()-60,             (4)
        200, 40, Color(0,0,0,180))                -- dark background
    draw.RoundedBox(8, 20, ScrH()-60,
        200 * (hp / 100), 40, hpColor)            (5)
    draw.SimpleText("HP: " .. hp, "DermaLarge",   (6)
        120, ScrH()-55, Color(255,255,255),
        TEXT_ALIGN_CENTER)

    local armor = LocalPlayer():Armor()          (1)
    if armor > 0 then                            (2)
        draw.RoundedBox(8, 230, ScrH()-60, 200, 40, Color(0,0,0,180))
        draw.RoundedBox(8, 230, ScrH()-60, 200*(armor/100), 40,
            Color(50, 150, 255))                 (3)
        draw.SimpleText("ARMOR: "..armor, "DermaLarge",
            330, ScrH()-55, Color(255,255,255), TEXT_ALIGN_CENTER)
    end

    local wep = LocalPlayer():GetActiveWeapon()  (1)
    if IsValid(wep) then                         (2)
        draw.SimpleText(wep:GetPrintName(),      (3)
            "DermaLarge", ScrW()-30, ScrH()-55,
            Color(200,200,200), TEXT_ALIGN_RIGHT)
    end
    draw.SimpleText("KILLS: "..LocalPlayer():Frags(), (4)
        "DermaDefault", ScrW()-30, 30,
        Color(255,100,100), TEXT_ALIGN_RIGHT)

hook.Add("HUDShouldDraw", "HideDefaultHUD",     (1)
    function(name)
        local hide = {                           (2)
            ["CHudHealth"] = true,
            ["CHudArmor"] = true,
            ["CHudAmmo"] = true,
        }
        if hide[name] then return false end       (3)
    end)
print("[GABRIEL] Custom HUD loaded!")             (4)

gh api repos/EvanusModestus/domus-captures/dependabot/alerts/10 \
  -X PATCH \
  -f state=dismissed \
  -f dismissed_reason="tolerable_risk" \
  -f dismissed_comment="DoS via crafted YAML — all YAML input is author-controlled. No untrusted input path. Waiting for Antora upstream fix."