Files

B.D. Murphy 0c9bea72e0 Add enterprise/infra tooling and repoint Qwen3-TTS submodule to internal fork

Two groups of changes, committed together as the follow-up to the initial push:

1. .gitmodules — submodule Qwen3-TTS now points at the internal Gitea fork
   (ssh://git@mini-eq:2222/umbragit/Qwen3-TTS.git) instead of upstream GitHub,
   so a clone actually gets the UmbraAudio branding/integration commit
   012e452 rather than vanilla upstream.

2. New infra/ tooling for the cross-machine work in spec 21: agent_bridge,
   remote_credential_broker (Keychain-backed, secrets read at runtime and
   generated via read_secret/random_secret — no hardcoded credentials), the
   enterprise bootstrap scripts, and the oldbox SSH/auth prompts. Plus
   backup/ restore scripts, two specs (18 UmbraTrans, 19 enterprise control
   plane), umbraaudio/voices/lmstudio_gate.py, and in-flight edits to the
   discovery/attribution/profiling modules, config, chapter_builder, emotion,
   pronunciation, qwen_tts and routes.

Also adds *.db to .gitignore: SQLite project databases are runtime state and no
.db file was tracked before.

Verified before staging: .env's only change is UMBRA_TTS__QWEN_TTS_HELPER_URL and
the committed copy has zero secret-looking values; the broker ships only
config.example.json.

2026-10-06 06:57:41 -07:00

2.9 KiB

Raw Permalink Blame History

Oldbox SSH diagnostic handoff

You are the on-host investigator for oldbox.bdmurphy.me.

Goal

Determine why direct interactive SSH as umbra succeeds from the Mac, while the Mac-side remote broker receives:

Permission denied (publickey,password)

Known facts

Host: oldbox.bdmurphy.me
Address: 192.168.123.14
User: umbra
The Mac can run: ssh umbra@oldbox
The Mac broker is attempting SSH as umbra@oldbox
Do not change SSH configuration.
Do not restart SSH.
Do not install packages.
Do not read or print passwords, private keys, tokens, /etc/shadow contents, Keychain data, or environment secrets.
Do not ask me to provide any password in chat.
Use sudo only for read-only commands. Prefer sudo -n; if sudo -n is not permitted, report that limitation instead of prompting for a password.

Read-only inspection

1. Record host and account state

Collect:

Hostname and kernel
SSH service state
id umbra
getent passwd umbra
Home-directory permissions
Current umbra shell

2. Inspect SSH policy

Run, where permitted:

sshd -T

If permitted:

sshd -T -C user=umbra,addr=192.168.123.1,host=oldbox.bdmurphy.me

Search /etc/ssh/sshd_config and /etc/ssh/sshd_config.d for:

Match
AuthenticationMethods
PasswordAuthentication
KbdInteractiveAuthentication
UsePAM
PubkeyAuthentication
AllowUsers
DenyUsers
Certificate-related directives

3. Inspect account state

If permitted, collect:

passwd -S umbra
chage -l umbra

Report account lock or expiry information without printing hashes.

4. Inspect recent SSH authentication logs

Where readable, inspect:

journalctl -u ssh --since "15 minutes ago" --no-pager
journalctl -u sshd --since "15 minutes ago" --no-pager

Also inspect /var/log/auth.log or /var/log/secure if readable.

Report whether failures mention:

failed password
invalid user
account locked
failed public key
certificate problem
PAM failure
or another condition

5. Determine the likely authentication path

Determine whether the successful Mac login is likely password-based or key/certificate-based.

Do not attempt to log in from oldbox. Do not inspect private-key contents. Base the conclusion only on SSH policy, account state, and server logs.

Required report format

Return exactly one report with these headings:

=== IDENTITY ===
=== SSH SERVICE ===
=== SSH EFFECTIVE CONFIG ===
=== ACCOUNT STATE ===
=== AUTHENTICATION LOGS ===
=== CONCLUSION ===
=== NEXT DIAGNOSTIC ===

Rules

Redact sensitive values while retaining enough information to distinguish the authentication path.
Never include secret values.
Do not make changes.
If a command is denied, report the command and permission error.
If evidence is insufficient, say so rather than guessing.
At the end, print:

READY_FOR_MAC_AGENT

2.9 KiB Raw Permalink Blame History