Files

B.D. Murphy 0c9bea72e0 Add enterprise/infra tooling and repoint Qwen3-TTS submodule to internal fork

Two groups of changes, committed together as the follow-up to the initial push:

1. .gitmodules — submodule Qwen3-TTS now points at the internal Gitea fork
   (ssh://git@mini-eq:2222/umbragit/Qwen3-TTS.git) instead of upstream GitHub,
   so a clone actually gets the UmbraAudio branding/integration commit
   012e452 rather than vanilla upstream.

2. New infra/ tooling for the cross-machine work in spec 21: agent_bridge,
   remote_credential_broker (Keychain-backed, secrets read at runtime and
   generated via read_secret/random_secret — no hardcoded credentials), the
   enterprise bootstrap scripts, and the oldbox SSH/auth prompts. Plus
   backup/ restore scripts, two specs (18 UmbraTrans, 19 enterprise control
   plane), umbraaudio/voices/lmstudio_gate.py, and in-flight edits to the
   discovery/attribution/profiling modules, config, chapter_builder, emotion,
   pronunciation, qwen_tts and routes.

Also adds *.db to .gitignore: SQLite project databases are runtime state and no
.db file was tracked before.

Verified before staging: .env's only change is UMBRA_TTS__QWEN_TTS_HELPER_URL and
the committed copy has zero secret-looking values; the broker ships only
config.example.json.

2026-10-06 06:57:41 -07:00

2.5 KiB

Raw Blame History

Oldbox enterprise bootstrap instructions

You are the OpenCode agent running on oldbox. Work locally on the target host; do not wait for clipboard reports from the Mac.

Read and execute these files first:

/tmp/oldbox-temporary-access-prompt.md
/tmp/oldbox-agent-communication-prompt.md

Then complete the following local bootstrap:

1. Preserve the existing host

Inventory, but do not alter:

Qwen and GPU services
Docker containers
MySQL
Samba/Webmin/XRDP
PostgreSQL
firewall rules
existing user accounts and data

Report conflicts before changing anything.

2. Create the development workspace

Use:

/home/umbra/src/UmbraTrans

Create it with ownership umbra:umbra. Do not modify UmbraAudio files. If the enterprise source bundle is available locally, copy it there; do not invent application code or overwrite existing source.

Prepare:

Git repository/worktree
.venv managed by the approved uv workflow
non-secret .env template
test/lint/format commands from the project configuration
an explicit development and production data separation

Run the project’s tests and record the results.

3. Configure backups

Use only the NAS2 netbackup/UmbraTrans share after confirming the oldbox account can access it. Create:

backups/postgres/
backups/config/
backups/workspace/
backups/manifests/

PostgreSQL backups must be logical dumps or an approved backup tool. Never copy a live PostgreSQL data directory or SQLite database from a running service as a backup.

Use atomic temporary files, restrictive permissions, timestamps, checksums, and a retention policy. Do not put credentials in the backup path or report.

4. Establish the agent communication queue

Use the agent-comm server from the communication prompt. If NAS permissions are not yet correct, use a private local queue under the oldbox workspace and report the exact blocker; do not broaden share permissions automatically.

The queue is for sanitized instructions and reports only. It must never carry passwords, tokens, private keys, or unrestricted shell commands.

5. Report

Write a concise, machine-readable status report to the queue and print:

OLDBOX_BOOTSTRAP_COMPLETE

Include:

workspace path and ownership
test result
backup path and last backup status
communication queue path/status
unresolved blockers
confirmation that existing services were preserved

Do not claim completion for any step that was not actually verified.

2.5 KiB Raw Blame History Unescape Escape