wiki: sync 2026-08-12 00:38 UTC — 6 file(s) updated

brain.md

@@ -1,6 +1,6 @@
 # 🧠 Knowledge Wiki — Brain Summary
 
-_Last updated: 2026-08-11 20:33 UTC_
+_Last updated: 2026-08-12 00:37 UTC_
 
 ## Workstreams & Status
 
@@ -26,7 +26,7 @@ _Last updated: 2026-08-11 20:33 UTC_
 
 ## VSSA Client Investigation
 
-- **Confirmed 2026-07-31:** maintain one concise, evidence-backed Markdown dossier per VSSA client, explain identified systems in plain language, investigate the companies/contractors behind them using public evidence, and improve the reusable `client-investigator` skill only with validated practices. Repository: `vssa-v1/vssa-clients`; recurring job: `88833e00b4a2`.
+- **Current delivery (2026-08-12):** repository `vssa-v1/documentation` publishes the Keycloak-protected **VSSA - Clients & Systems** Docusaurus site. It contains 290 client dossiers, a flat client sidebar, native local search, and a conservatively resolved registry of 419 systems from 620 evidence observations. Continuous-research job `88833e00b4a2` runs every two hours; latest coverage is 79 researched, 189 partial, 22 no-public-evidence, and 0 pending, with clients 099–108 next.
 
 ## Key People
 
@@ -57,6 +57,7 @@ _Last updated: 2026-08-11 20:33 UTC_
 - **Gitea API credential (confirmed 2026-08-02):** use Bitwarden-provided `HL_V1_GITEA_ACCESS_TOKEN` for `gitea.lego-cloud.eu`; never use `GITHUB_TOKEN` for that instance or copy the Gitea token into `/opt/data/.env`. Bitwarden keys are exported without aliases and gateway restart is required after key changes.
 - **Gitea recovery (confirmed 2026-08-11):** Gitea `1.27.0` crashed all SSH/Smart-HTTP Git-serving processes despite healthy web/API; upgrade to `1.27.1` restored API and both Git transports. The queued VSSA commit `6fc42ab` was pushed and remotely verified.
 - **Gitea Pages pattern (verified 2026-08-11):** Actions runners build repositories and publish to `/gondor-v1-gitea-pages/<organization>/<repository>/`, exposed at `https://pages.apps.lego-cloud.eu/<organization>/<repository>/`. The Pages dataset must be allowed by `container.valid_volumes` and mounted into job containers. `skic-v1-playground/documentation` run 2326 and the live site were verified.
+- **Actions Docker (verified 2026-08-11):** use the runner-mounted `/var/run/docker.sock` directly (client `29.6.2-1`, Engine `29.0.4`). DinD is unnecessary and privileged DinD is not currently supported by this runner.
 - **Gondor v1 (2026-08-02):** Hermes SSH access as `lego` is verified to Osgiliath 000 and both Minas Tirith workers; use the `gondor-v1-nodes` skill. Open ingress incident: Argo CD's hostPort 80/443 `ingress-nginx` conflicts with Osgiliath's system Nginx; repair through `home-v1/gondor-v1.git`, not a transient live patch.
 - **Hermes outage (2026-08-04–11):** confirmed Codex quota exhaustion first blocked model responses while Discord/cron remained alive; a separate likely host/container-runtime failure then stopped all gateway, scheduler, log, and health progress after 2026-08-04 14:00:42 UTC. Physical restart at 2026-08-11 00:11:40 restored service without Hermes repair. Exact host-level trigger remains **UNKNOWN** because previous-boot TrueNAS/kernel/ZFS/runtime/hardware telemetry is unavailable inside the container.
 - **world-v1/network-v1:** ✅ global Internet address book; IP-level mapping now separates registry holder, route origin, operator, and service. Initial records: `0.0.0.0` and `1.1.1.1`; wiki page at `wiki/infrastructure/network-v1.md`