Files

B.D. Murphy 0c9bea72e0 Add enterprise/infra tooling and repoint Qwen3-TTS submodule to internal fork

Two groups of changes, committed together as the follow-up to the initial push:

1. .gitmodules — submodule Qwen3-TTS now points at the internal Gitea fork
   (ssh://git@mini-eq:2222/umbragit/Qwen3-TTS.git) instead of upstream GitHub,
   so a clone actually gets the UmbraAudio branding/integration commit
   012e452 rather than vanilla upstream.

2. New infra/ tooling for the cross-machine work in spec 21: agent_bridge,
   remote_credential_broker (Keychain-backed, secrets read at runtime and
   generated via read_secret/random_secret — no hardcoded credentials), the
   enterprise bootstrap scripts, and the oldbox SSH/auth prompts. Plus
   backup/ restore scripts, two specs (18 UmbraTrans, 19 enterprise control
   plane), umbraaudio/voices/lmstudio_gate.py, and in-flight edits to the
   discovery/attribution/profiling modules, config, chapter_builder, emotion,
   pronunciation, qwen_tts and routes.

Also adds *.db to .gitignore: SQLite project databases are runtime state and no
.db file was tracked before.

Verified before staging: .env's only change is UMBRA_TTS__QWEN_TTS_HELPER_URL and
the committed copy has zero secret-looking values; the broker ships only
config.example.json.

2026-10-06 06:57:41 -07:00

1.7 KiB

Raw Permalink Blame History

Oldbox SSH authentication-log handoff

A Mac-side broker SSH attempt was just made against umbra@oldbox.bdmurphy.me. It received Permission denied (publickey,password).

You are the OpenCode agent running on oldbox. Perform only read-only authentication diagnostics now.

Do not change SSH configuration. Do not restart SSH. Do not install anything. Do not read or print passwords, hashes, private keys, or tokens. If a sudo command prompts, the human operator may enter the sudo password locally. Never ask for or transmit that password through chat or the report.

Run these commands as needed:

sudo journalctl -u ssh --since "3 minutes ago" --no-pager
sudo journalctl -u sshd --since "3 minutes ago" --no-pager
sudo /usr/sbin/sshd -T -C user=umbra,addr=192.168.123.12,host=oldbox.bdmurphy.me
sudo passwd -S umbra

If journalctl is not the active service name, use the service that owns port 22. If sshd -T -C is unavailable, report the exact error.

Filter the output to authentication-relevant lines only, especially:

Accepted password
Failed password
Failed publickey
Invalid user
account locked
PAM/session-open failures
certificate errors
source address and username

Return exactly this compact report:

=== AUTH LOG RESULT ===
<paste only relevant sanitized lines, or the exact permission/error>

=== EFFECTIVE SSH AUTH ===
<paste only relevant key/value lines, or the exact error>

=== ACCOUNT STATE ===
<passwd -S result; no hash>

=== CONCLUSION ===
<one short conclusion: wrong password, key/certificate path, PAM issue,
 or insufficient evidence>

=== NEXT ACTION ===
<one specific next step>

READY_FOR_MAC_AGENT

Do not guess. Do not make changes. Do not include secret values.

1.7 KiB Raw Permalink Blame History

Oldbox SSH authentication-log handoff

1.7 KiB

Raw Permalink Blame History