The IP whitelist was removed from the Gitea router on VM103; the live
DB copy of the skill was updated through the API.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Only what stays true across updates: services, data paths, the data owner,
how to fix an ownership problem, how to check the result. Versions and the
update path are the workflow's job.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The data dir is owned by 1000:1000 (mode 700), so 1.11.x crash-loops on
permission denied. The daily vzdump covers the data disk, so a portable
backup is not a STOP condition.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The first post-upgrade check on Nextcloud could run nothing: every hl exec, even `id`, was refused by the allowlist (only the
three db:add-* commands were on it, and the model had no way to know). `hl exec-rules` (route /agent/exec-rules) lists the
exact commands the session's project accepts, and the repair and post-upgrade prompts send the model there first. The
allowlist gets the read-only receipt check of the skill: occ status (with and without --output=json), occ config:app:get core
lastcron, occ app:list and pidof crond in the cron service. A test holds the file to this exact list. No new dependency.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
For the post-upgrade check (owner, 2026-09-20): php occ db:add-missing-indices, db:add-missing-columns and
db:add-missing-primary-keys, as www-data in nextcloud/app, exact argv. Nothing runs them until the owner sets a post-upgrade
executor for nextcloud in Apps. A test holds the committed file to the rule schema and to this exact list. No new dependency.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Facts about each app for the model (release notes, requirements such as database versions, STOP cases,
checks, the way back): table skills (migration v4), config/skills/<project>.md imported once from
the old system (frontmatter dropped, no secrets), added to the database at driver start when missing
and never overwritten, GET/POST /api/projects/:project/skill and a Skill panel on the app page.
Only the skill of the project the model works on will be loaded.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
grafana-influxdb (1.8.x), keycloak-db (postgres 18.x) and nextcloud-db (mariadb 10.6.x) are tracked,
with real updates off; gitea-db (postgres:14) and nextcloud-redis (redis:7-alpine) run floating tags
whose real version is unknown, so they are added disabled with strict patterns: guessing "14" as 14.0
would propose a downgrade. The driver now adds entries of config/apps.json that the database lacks,
after the existing rows, and never changes rows the owner configured.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
config/apps.json (15 apps, generated once from the old skills, patterns anchored at both
ends, homeassistant off) is loaded into app_config when it is empty. Real mode refuses to
start on a database that still holds demo rows.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
homelab-updaterandClaude Opus 5.5