Seth/mac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: reconcile CLAUDE.md/DECISIONS with what shipped (sudo approach, rrsync, set -e lessons)

Browse Source 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Mortdecai
2026-09-15 19:41:58 -04:00
parent d622cf6aef
commit 617fc789b1
2 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+9 -6
View File
@@ -21,16 +21,19 @@ laptop" shape).
## Current State ## Current State
- **Phase:** ideation -> design approved-ish; spec at `docs/plans/2026-09-15-mac-setup-design.md` - **Phase:** shipping — `scripts/run.sh` applied & verified 2026-09-15. Manual checklist (`docs/manual-checklist.md`) pending Seth; Ableton not yet installed.
- **Repo:** `git.sethpc.xyz/Seth/mac` - **Repo:** `git.sethpc.xyz/Seth/mac`
- **Deploy target:** the MacBook, `ssh mac` (192.168.0.94, user seth, en0 Wi-Fi) - **Deploy target:** the MacBook, `ssh mac` (192.168.0.94, user seth, en0 Wi-Fi)
- **Hardware:** MacBookPro18,1 (16" 2021), M1 Pro, 32 GB, 512 GB. **macOS 26.2 Tahoe.** - **Hardware:** MacBookPro18,1 (16" 2021), M1 Pro, 32 GB, 512 GB. **macOS 26.2 Tahoe.**
- Remote Login enabled + claude key installed 2026-09-15. `ssh mac` works from steel141. - Remote Login enabled + claude key installed 2026-09-15. `ssh mac` works from steel141.
- **FileVault is on** — no SSH after a reboot until the password is typed at the lid. - **FileVault is on** — no SSH after a reboot until the password is typed at the lid.
- Stock state is already clean: no Homebrew/CLT, only Safari in /Applications, - Applied: Homebrew + Brewfile (GNU userland, kitty, rectangle, tailscale-app),
Siri off, Apple Intelligence opted out. Full snapshot: bash5 login shell, hostname `mac`, Linux-feel + debloat `defaults`, Dock=2 apps,
`docs/reference/inventory-2026-09-15.md` — read when checking "was X stock?". DAW power profile (AC sleep 0 / powernap 0), nightly rsync backup agent.
- No changes made yet. Pre-change inventory: `docs/reference/inventory-2026-09-15.md`.
- Backup: `~/Music/Ableton` + `~/Documents` -> `pve173:/tank/backups/mac` nightly
03:30 via launchd; key is rrsync-jailed; sanoid keeps history (tank_media template).
- SparkFun PPP service left in place (macOS won't remove the sole service on a port; harmless).
## Conventions ## Conventions
@@ -40,5 +43,5 @@ laptop" shape).
- Before any `launchctl disable`/`bootout`: record current `launchctl print` state to `.backup/` - Before any `launchctl disable`/`bootout`: record current `launchctl print` state to `.backup/`
- Homebrew `Brewfile` at repo root is the package manifest — `brew bundle` is the install - Homebrew `Brewfile` at repo root is the package manifest — `brew bundle` is the install
- macOS gotchas go in this file's Conventions; per-decision reasoning goes in `DECISIONS.md` - macOS gotchas go in this file's Conventions; per-decision reasoning goes in `DECISIONS.md`
- **Apply everything:** `scripts/run.sh` from steel141 (sudo primed from `$HOMELAB_PASSWORD` over `ssh -tt`). Second run must be all `[skip]`. - **Apply everything:** `scripts/run.sh` from steel141. It installs a TEMPORARY `/etc/sudoers.d/mac-setup` (NOPASSWD) via `_install_sudoers.sh` for the run and removes it on every exit path (+40-min on-Mac self-destruct backstop). Needs `$HOMELAB_PASSWORD`. Second run is all `[skip]`.
- GUI-only steps live in `docs/manual-checklist.md` — read when something "didn't apply" (it's probably on that list). - GUI-only steps live in `docs/manual-checklist.md` — read when something "didn't apply" (it's probably on that list).
DECISIONS.md
+5
View File
@@ -16,6 +16,11 @@ Format: `YYYY-MM-DD: <decision> — <why>`
- 2026-09-15: Spotlight indexing stays on, Siri/web suggestions off — Finder search is useful; Live's browser has its own index. - 2026-09-15: Spotlight indexing stays on, Siri/web suggestions off — Finder search is useful; Live's browser has its own index.
- 2026-09-15: iCloud account stays, iCloud Drive Desktop&Documents sync OFF — cloud sync mid-save is a DAW project killer. - 2026-09-15: iCloud account stays, iCloud Drive Desktop&Documents sync OFF — cloud sync mid-save is a DAW project killer.
- 2026-09-15: **Unattended sudo = temporary `/etc/sudoers.d/mac-setup` (NOPASSWD), not pty password injection.** Piping the password into `ssh -tt` raced and hung 14 min on the real run (passed a fast test). The drop-in is validated before activation, removed on every run.sh exit path, and self-destructs on the Mac after 40 min. See run.sh / _install_sudoers.sh.
- 2026-09-15: Mac's backup key on pve173 is **rrsync-restricted** (`command="/usr/bin/rrsync /tank/backups/mac"`) — a travelling laptop's key must never be unrestricted root on the tank host. Proven: an interactive command over that key is refused.
- 2026-09-15: **Optional/cosmetic steps must be non-fatal under `set -e`.** The SparkFun removal (macOS refuses) and the GUI-domain `launchctl bootstrap` (flaky over SSH) both aborted the run until guarded with `|| warn`. Rule for this repo: anything that can legitimately fail without breaking the goal gets a best-effort guard.
- 2026-09-15: `defaults displaysleep` on AC = 30 min, not 0 — display sleep doesn't stop Live's audio; only system `sleep` does.
## Deferred / Rejected ## Deferred / Rejected
<!-- Decisions NOT to do something are just as valuable -- prevents re-proposing rejected ideas --> <!-- Decisions NOT to do something are just as valuable -- prevents re-proposing rejected ideas -->
- 2026-09-15: Cmd<->Ctrl global swap REJECTED — Live 12 and every Mac tutorial are Cmd-native; kitty already handles Ctrl+Shift+C/V. Karabiner per-app remaps are the fallback, not a global swap. - 2026-09-15: Cmd<->Ctrl global swap REJECTED — Live 12 and every Mac tutorial are Cmd-native; kitty already handles Ctrl+Shift+C/V. Karabiner per-app remaps are the fallback, not a global swap.