homelab-updaterandClaude Sonnet 5 7e622d80e3 hl exec-rules: the model looks at what it may run; Nextcloud's receipt checks are on the allowlist ...

The first post-upgrade check on Nextcloud could run nothing: every hl exec, even `id`, was refused by the allowlist (only the
three db:add-* commands were on it, and the model had no way to know). `hl exec-rules` (route /agent/exec-rules) lists the
exact commands the session's project accepts, and the repair and post-upgrade prompts send the model there first. The
allowlist gets the read-only receipt check of the skill: occ status (with and without --output=json), occ config:app:get core
lastcron, occ app:list and pidof crond in the cron service. A test holds the file to this exact list. No new dependency.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-09-20 02:32:42 +02:00

..

skills

skills: one per compose project, imported from the old SKILL.md files, edited in the app

2026-09-19 22:10:01 +02:00

agent-exec.json

hl exec-rules: the model looks at what it may run; Nextcloud's receipt checks are on the allowlist

2026-09-20 02:32:42 +02:00

apps.json

config: database components of gitea, grafana, keycloak and nextcloud; new file entries join a running database

2026-09-19 21:05:20 +02:00