Vault Comprehensive Audit Report — 2026-07-05

Vault Comprehensive Audit Report (2026-07-05)

Diagnostic-only audit executed per vault-comprehensive-audit-fable-prompt. Six parallel audit passes covered: memory system, structure and content integrity, databases and indexes, build/sync pipeline, tooling and platform-agnosticism, and security/hygiene/instruction consistency. No changes were made to any file; the only write was the sanctioned rebuild test of the gitignored vault-index.db.

Severity legend: [critical] breaks something or creates real risk now · [high] significant gap, fix soon · [medium] should fix, not urgent · [low] cosmetic or housekeeping.

---

1. Executive Summary

Overall health: good. The core machinery works: vault-index.db passes integrity checks and exactly matches the file tree (1,580 files), frontmatter health is essentially perfect (zero broken YAML across 1,576 files), only 8 truly broken wikilinks exist out of 5,104, all 134 symlinks resolve, the daily audit/sync automation runs cleanly, and no half-finished migrations remain. The system’s weaknesses are not in what runs; they are in what is assumed: hand-installed automation, machine-specific paths, and privacy conventions (internal/draft tags) that the build pipeline silently ignores.

The five highest-impact changes:

1. Create a bootstrap/installer + config layer (the platform-agnostic refactor, Section 5). Nothing currently installs the git hooks, launchd plist, crontab, or systemd units on a fresh clone. This is the root cause of the 2026-04 script-drift incident and the reason the index-rebuild git hooks are silently inactive on this Mac today.
2. Rotate and redact the committed OpenClaw gateway token (Section 6). One real credential value is committed, in two copies (six occurrences). Everything else in the vault correctly stores pointers, not values.
3. Add internal/draft gating to the KB sync (Section 4). ~51 tagged files (including unreleased conference abstracts) plus the full infrastructure context doc currently publish to the gated site. Harmless with 2 readers; the single biggest precondition before ever inviting a third.
4. Fix the silently broken guards: the pre-push campaign-media hook is a no-op on macOS (GNU find flag on BSD find, error suppressed), and the post-merge/post-rewrite hooks never fire because core.hooksPath points elsewhere (Section 3).
5. Restructure 01-projects / 04-archive (Section 2). 01-projects is 100% stale (8/8 dead projects) while active work lives in 03-resources/plans; archives are scattered across six ad-hoc folders inside 02-areas.

“QMD database” resolved: it is a real, third data store: the qmd semantic-search index at ~/.cache/qmd/index.sqlite (122 MB, 2,463 documents, 21,246 vectors, nightly launchd reindex). Not the vault SQLite index and not page-index.json. Setup doc: 03-resources/agent-system/docs/QMD-Semantic-Search-Setup.md.

---

2. Findings by Section

Section 1 — Memory System

127 files (index + 126 memories: 88 feedback, 21 project, 17 reference). ~70 referenced filesystem paths verified. Zero broken inter-memory wikilinks; zero broken index links.

Sev	Finding	Evidence
high	24 memory files have no pointer in MEMORY.md (17 fully absent, 7 mentioned but unlinked). Two are behaviorally significant and undiscoverable: feedback-asia-never-leads-assimilation, feedback-asia-teaching-detail-level	Programmatic reverse-check of index vs directory
high	feedback-tokyo-studio-framing.md contradicts itself: body approves “almost twenty years,” How-to-apply ends “use ‘over a decade’ — not ‘twenty years‘“	The two directives produce opposite copy
high	reference-wordpress-blog-taxonomy.md has a garbled value: Happy Files plugin listed as flavor/flavor-flavor-flavor (active)	Anyone acting on it fails
high	Duplicate clusters to merge: CrewAI pair (feedback-crewai-deprecated ≈ feedback-claude-max-ecosystem-preference); outbound-formatting trio (feedback-outbound-response-no-quoting ≈ feedback-inquiry-response-formatting + multilingual overlap)	Same-session near-duplicates
medium	Stale paths: project-newsletter-blog-archival-infrastructure cites a newsletter folder that is now flat files; project-vault-infrastructure-upgrades cites a plan dir that moved to 03-resources/executed-plans/vault-sqlite-index-sync-plan.md	Filesystem-verified
medium	MEMORY.md line 5 says “voice guide v2.2”; VOICE-GUIDE-UNIFIED version log ends at 2.7 draft (2026-04-22). (Side note: the guide’s own frontmatter says version: 1.1-draft, stale within the vault too)	Index vs guide version log
medium	Backup-rule tension: feedback-backup-before-practice-changes (absolute rule) never updated to reference the later forum-reply/DM exemption in feedback-forum-reply-no-backup (which is also unindexed)	Session loading only the original gets the outdated rule
medium	More merge candidates: alt-text pair, NAS-incoming pair, Facebook pair; memories duplicating vault docs (feedback-hashtag-convention restates social-media-tags.md; reference-crm-ssh-access + reference-fluentcrm-campaign-ssh overlap each other and defer to changelog docs)	Per memory rules these should merge/trim
low	~6 completed/expired project memories to retire: project-ssl-cert-migration, project-proprioceptive-awareness-brnet-campaign, project-study-group-spring-2026-comms, project-wpml-workflow-plan, project-session-prep-skill-planned (skill never built), feedback-ksenia-presentation-not-talk (both events past; keep only the confirm-per-event rule)	Dates/status vs today
low	The em-dash rule (feedback-em-dashes) is violated by nearly every memory file, including itself	Cosmetic

Section 2 — Structure and Content Integrity

1,580 md files. Per area: 00-inbox 21 · 01-projects 9 · 02-areas 1,436 (91%) · 03-resources 97 · 04-archive 3 · 05-private 4 · templates 6.

Sev	Finding	Evidence
high	01-projects is 100% stale. All 8 projects are dead, reverted, or completed (Quartz migration “Reverted,” Tina CMS completed, CrewAI deployment deprecated, KB-Setup still “in-progress” months after launch). Active planning actually lives in 03-resources/plans/ (e.g. plans/ai-os-rework/), inverting PARA	File-by-file status + git dates
high	02-areas is a monolith: 91% of all content. The 00–05 layer carries little signal; the real taxonomy is 02-areas’ second level	File counts
medium	04-archive nearly empty (3 md) while 6+ ad-hoc archive dirs live inside 02-areas (press archive-articles 112 files, PB-archive, blog _archive, key-pages _archive, campaigns archive-social-media-*, method-admin core/archive): 172+ files total	Directory scan
medium	35 files have no frontmatter at all (silent metadata loss on KB sync), including the three area folder-notes 01-projects/01-projects.md, 03-resources/03-resources.md, 04-archive/04-archive.md, 4 blog-idea stubs, taxonomy.md, science-docs files, and a loose campaign file shadowing its same-named folder	Custom scan; full list reproducible
medium	84 content directories lack an index.md or folder-note (121 counting asset dirs). Biggest: newsletters (44 md), press archive-articles (112), form-transcripts-en (85), foci (12), practice-sessions (11), blog-articles (30), executed-plans (12), voice-guides (7). This is the direct driver of most orphans	Stricter scan than vault-audit’s 73
medium	407 orphan files (26%): 02-areas 361 (practice-platform 232, mostly machine-generated digests whose own sub-indexes are themselves orphaned; the missing links are one level up and cheap to add)	vault-index.db orphan query
low	16 broken links total (8 wikilink + 8 directory/relative), concentrated in 2 files: BRNet-2026-transcripts/index.md (5 links to .txt transcripts wikilinked as .md, plus a “BNNet” typo) and people/index.md (3 links to .yml config files)	check-wikilinks.py + db
low	Naming: 03-resources/science papers/ (space), study-group dirs with spaces/parens, stray 03-resources/.claude/ dir; 420 single-use tags (potential typos)	vault-audit + scan
info	Frontmatter health otherwise perfect: 0 unclosed blocks, 0 duplicate keys, 0 manual vault_path, 0 unquoted colon-titles, 0 markdown-in-frontmatter. vault-audit.py: 19/19 checks OK	Script run 2026-07-05

Section 3 — Databases and Index Functionality

Sev	Finding	Evidence
—	“QMD database” = the qmd semantic-search index at ~/.cache/qmd/index.sqlite (122 MB; @tobilu/qmd v1.0.7; collection baseworks-kb; nightly com.baseworks.qmd-reindex launchd job, healthy). build-vault-index.py explicitly complements it with structural queries: two databases by design	vault-audit.py:25 QMD_DB_PATH; setup doc in agent-system/docs
high	Git hooks that rebuild the index never fire on this machine. git config core.hooksPath = scripts/hooks (which holds only pre-push), so scripts/git-hooks/post-merge and post-rewrite are dead letters; a manual git pull does not rebuild the index. Mitigated (hence not critical) by the 5-minute launchd vault-sync cycle, which calls post-sync-hook.sh directly and kept the index fresh today (last_build 08:49)	core.hooksPath inspection; ~/logs/vault-sync.log
medium	scripts/hooks/pre-push silently no-ops on macOS: find -regextype posix-egrep is GNU-only; BSD find errors, the error is sent to /dev/null, FOUND is always empty, every push passes. The campaign-media guard provides zero protection exactly where media processing happens	Verified against /usr/bin/find
low	Incremental rebuild can leave one stale orphan row after file moves (407→406 after --full); post-sync-hook swallows all rebuild errors (2>/dev/null || true), so a persistently failing rebuild would only surface via the daily staleness check	Rebuild tests
info	Health: PRAGMA integrity_check ok; schema matches builder exactly (v2); counts exact vs disk (1,580/1,580); incremental 0.04s, full 0.62s; backlink/tag/orphan/broken-link queries all work. Full data-store inventory: vault-index.db, qmd index, site/src/content/page-index.json, scripts/audit-log.json, people-pipeline caches	Commands run 2026-07-05

Section 4 — Build and Sync Pipeline

Sev	Finding	Evidence
high	No internal/draft gating in the sync. sync-content.mjs contains zero tag/status filtering; only directory-name skips and the CONTENT_DIRS allowlist. Exposure: 22 files tagged internal (method-admin brand guide, science.md, key-definitions, all 5 conference abstracts incl. unreleased BRNet/Neuro/SCAPPS 2026), 6 tagged draft, 26 with status: draft; union ≈ 51 files publishing to the gated site	sync-content.mjs:192–230 (no tag logic); frontmatter grep
high	00-inbox publishes (maps to inbox/), which puts claude-code-shared-context.md (VPS IPs, SSH usernames, sudo notes, token file path and rotation procedure) and claude-vps-credential-sync.md (full token-regeneration walkthrough) on the site. No literal secret values, but a complete infrastructure recon map. Fine with 2 readers; a real problem the day reader #3 arrives	sync-content.mjs:29–35 CONTENT_DIRS
medium	The deleted GitHub Actions workflow (deploy.yml, removed 2026-04-20) took its Slack failure alert and Cloudflare cache purge with it. Verify the Cloudflare Pages project has equivalents; otherwise failed builds are silent and cache may go stale post-deploy	git e7720c75; not verifiable from repo alone
low	Ordering bug: injectVaultPath runs before repairFrontmatter, so YAML-auto-repaired pages lose their vault_path (inline-editor linkage)	sync-content.mjs:214–221
low	Stub generation silently mints a live page for every typo’d link instead of surfacing breakage; ambiguous wikilink keys resolve first-registered-wins	sync-content.mjs:583–659, 461
low	Doc drift in vault CLAUDE.md: warnings “appear in the GitHub Actions build log” (now Cloudflare Pages only); “manually adding vault_path causes duplicate keys” (stale: the script now strips before injecting). Empty .github/workflows/ dir removable	CLAUDE.md Frontmatter Rules; sync-content.mjs:260
low	copy-crepe-css.mjs has two unguarded copyFileSync calls (a crepe version bump renaming frame themes would break the Pages build); audit-links.mjs/audit-pages.mjs are ~80% duplicated code and referenced by no npm script	copy-crepe-css.mjs:51–52; site/package.json
info	05-private is correctly excluded by allowlist omission (safe default: a new root folder never publishes unless explicitly mapped). Contents: 5 files incl. a raw JSON transcript that would publish verbatim if ever mapped (sync copies non-md files too)	sync-content.mjs:29–35, 223–227; 05-private/README.md

Section 5 — Tooling, Automation, Platform-Agnosticism (the AIOS core)

Full script inventory (21 executables/units) and hardcoded-path table are in the appendix below. Key findings:

Sev	Finding	Evidence
critical	No bootstrap/installer for any machine. Git hooks, launchd plist, VPS crontab, and systemd units are all installed by hand; a fresh clone (Asia’s Mac, rebuilt VPS) silently lacks the entire automation layer. The 2026-04 ~/scripts/ drift incident (running copy 1069 lines vs repo 714) was a direct symptom	No install script anywhere in repo
critical	scripts/hooks/pre-push broken on macOS (see Section 3): the guard is a no-op precisely on the machines that process media	GNU find flag, stderr suppressed
high	Out-of-repo dependencies: slack-notify.sh, vault-audit-slack.sh, daily-infra-updates.sh live only in VPS ~/scripts/; repo scripts hardcode /home/patrick/scripts/slack-notify.sh. Reproducibility hole	people-webhook-heartbeat.sh:23; slack-notify-systemd-failure@.service:8
high	.claude/settings.local.json is committed but Patrick’s-Mac-specific (/Users/vboy/.cache/qmd, five VPS-cat allowances). Should be gitignored per-machine, with shared allowances in a committed settings.json	.claude/settings.local.json:22,31–39
high	archive-newsletter skill hardcodes /Users/vboy/... twice: the only skill with truly broken cross-machine paths	SKILL.md:60,229
medium	Three coexisting path conventions: portable self-resolution (vault-sync.sh, archive-inbox.py, build-vault-index.py: correct), env-var with VPS default (forum-content-sync.py, translate-community-content.py), and fully hardcoded (people-pipeline.sh, forum-content-sync.sh, update-sitemap-reference.sh, webhook daemon defaults)	Path table in appendix
medium	vault-audit.py embeds launchctl (macOS-only) in its sync check: emits spurious warnings on the VPS. Should platform-dispatch (launchctl on darwin, crontab grep on linux)	vault-audit.py:351–357
medium	Skill issues: create-newsletter references newsletters/fluentcrm-merge-codes.md (file moved to communications/fluentcrm-merge-codes.md); update-science-content references nonexistent 02-areas/website/pages/; Mac-only skills (compress-photos, extract-frames, wp-media-import, pbcopy steps in create-email/create-newsletter) don’t declare it	SKILL.md refs verified
low	Housekeeping: .claude/CLAUDE.backup-2026-04-29.md committed; launchd plist logs to /tmp (wiped on reboot) while the script logs to ~/logs (split logging); migrate-community-folders.py is one-time-done (archive candidate); plist hardcodes /opt/homebrew/bin (fine for Apple Silicon Macs, meaningless elsewhere)	Inventory
info	No half-finished migrations. Community-forums consolidation is status: complete in executed-plans; the PAUSED crontab was re-enabled 2026-04-14 (the “remains paused” line in shared-context is a dated historical entry). .codex/CODEX.md is consistent with CLAUDE.md (thin by design; could gain one line pointing at CLAUDE.md as authoritative)	Plan file; audit-log.json healthy through today

AIOS pattern, summarized for the refactor target: tool-agnostic skills as plain markdown with a thin .claude/skills/ redirect layer; Maps as single sources of truth (vault-map, skill-map, infrastructure-map with a “reflect infra changes same session” rule and last-verified dates, split permanent-infra vs swappable-agent-layer); dual-audience indexes (human INDEX.md + AI skill-map); History session logs; paths always ~-relative or vault-relative with machine topology in exactly one map file. The Baseworks vault already has fragments (shared-context ≈ infrastructure-map, claude-code-skills/index.md ≈ INDEX) but skills are Claude-Code-locked, infra facts are scattered across three places, and shared-context mixes current-state reference with 300+ lines of chronological log.

Section 6 — Security, Hygiene, Instruction Consistency

Sev	Finding	Evidence
high	Live OpenClaw gateway token committed, two copies: bare 64-hex value plus auto-authenticating URLs. Mitigations: private repo, nginx Basic Auth in front, service currently down (HTTP 526). Still the only real credential value in the vault; rotate and replace with a pointer	03-resources/agent-system/docs/OpenClaw-Deployment-Guide.md:61,66,278,302 + stale site copy site/src/content/docs/resources/.../OpenClaw-Deployment-Guide.md:66,283,307
medium	~344 tracked files under site/src/content/docs/ are ignored-but-still-tracked stale build output (last touched 2026-03-31): 3-month-old duplicates of live content, including one copy of the token above. .gitignore rules exist but never untracked them	git log -- site/src/content/docs; both .gitignore files say “legacy — will be removed”
medium	Two binaries slipped past the media pipeline: instagram-carousel-preview.html (2.1 MB, base64 images; HTML bypasses both gitignore patterns and the pre-push hook) and BRNet Poster_2026_Baseworks.pdf (1.5 MB real file where every sibling PDF is a NAS symlink)	Size scan; ls verification
medium	Three-way build-doc drift: vault CLAUDE.md says GitHub Actions (dir is empty); .gitignore comments call the Astro site “legacy — will be removed”; global CLAUDE.md says Astro+Starlight→Cloudflare Pages is current. One alignment pass needed	See also Section 4
low	03-resources/agent-system/crewai/ (13 files incl. _WIP-DO-NOT-REFERENCE.md) is deprecated-in-place: archive material. ~7 MB of vendored Obsidian plugin/theme JS/CSS is the largest repo weight class (plausibly intentional for shared config): decide	Dir scan
info	Otherwise clean: no private keys, no Slack webhooks, no B2 key values, no DB passwords; git-history scan clean (the sk-ant-oat01-... in shared-context is a truncated placeholder, never a real value); zero tracked .DS_Store/.bak/.log/db files; all 134 symlinks resolve (NAS was mounted during audit); 04-archive itself healthy; instruction layers have zero dangling file references and no true contradictions (duplication is consistent and hierarchy-declared); CODEX.md clean	Full scans 2026-07-05

---

3. Prioritized Remediation Plan

Quick wins (safe, mechanical, no discussion needed)

Status 2026-07-07: items 1–10 all done (executed by Claude Code on Patrick’s Mac; #6 was completed earlier the same day by the wikilink auto-repair work, leaving only the 6 directory links that belong to S5).

1. Rotate the OpenClaw gateway token DONE 2026-07-07 (as redact-and-archive per Open Question #7): OpenClaw retired, so no rotation. Token AND nginx basic-auth password redacted; guide moved to 04-archive/agent-system/; prose references updated.
2. DONE 2026-07-07: 313 tracked files removed from the index (everything under site/src/content/docs/ except index.mdx, the only source file). Both .gitignore files now blanket docs/* with an !index.mdx exception so stub pages can’t be re-added by the sync auto-commit. Second token copy gone.
3. DONE 2026-07-07: pre-push rewritten with portable -iname clauses (works on BSD and GNU find), plus a >512 KB HTML check for embedded base64 media.
4. DONE 2026-07-07: both hooks moved into scripts/hooks/ (the active core.hooksPath); path self-resolution verified at the new depth. Manual pulls now rebuild the index.
5. DONE 2026-07-07: archive-newsletter paths made vault-relative; create-newsletter merge-codes path corrected; update-science-content references corrected to 02-areas/website/key-pages/ (the real location, confirmed by its _archive/ subfolder).
6. DONE 2026-07-07 (by the wikilink auto-repair implementation, see wikilink-auto-repair-plan): 8 links auto-fixed. The remaining 6 directory-style links await the S5 index.md work.
7. DONE 2026-07-07: 11 memories retired/merged (5 completed projects deleted; CrewAI, outbound-quoting, alt-text, NAS-incoming, Facebook-URL, and CRM-SSH memories merged into their kept counterparts), 15 missing pointers added, Tokyo-studio contradiction resolved (over-a-decade directive retired), Happy Files garble fixed (HappyFiles Pro), backup-rule exemption cross-referenced, both stale paths fixed, version note now v2.8. Result: 114 memory files, full index coverage, zero dangling index links.
8. DONE 2026-07-07: CLAUDE.md wording fixed (Cloudflare Pages; vault_path claim corrected), .gitignore comments updated with #2, empty .github/ and the CLAUDE.md backup deleted. VOICE-GUIDE-UNIFIED frontmatter was already fixed to 2.8 by the same-day voice audit session.
9. DONE 2026-07-07: both copied to NAS (byte-verified) and replaced with symlinks — poster → media/research/posters/, carousel HTML → media/campaigns/2026-04-proprioceptive-awareness-brnet/.
10. DONE 2026-07-07: minimal title + created (from first git commit date) added to all 35; titles taken from each file’s H1 where present. Root CLAUDE.md/README.md/index.md intentionally left as repo docs.

Structural (needs your sign-off / one session each)

S1. Platform-agnostic refactor (the heart of the request), in order:

1. config/vault.defaults.env (committed) + config/vault.local.env (gitignored, per-machine: MACHINE_ROLE=workstation|server|mirror) + tiny shared loaders scripts/lib/env.sh / env.py. Env format over TOML: zero-dependency, shell- and Python-readable, and formalizes the pattern already proven by ~/.config/baseworks/claude-token.
2. Path rule: no script embeds /srv/, /Users/, /home/; vault paths resolve from the script’s own location (three scripts already do this correctly; make it universal across the 6 hardcoded ones).
3. config/jobs.manifest (job | roles | cron-syntax schedule | command | needs-token) + scripts/bootstrap/render-jobs.sh generating launchd plists (Mac), a marker-delimited crontab block (VPS), and systemd timer/unit Environment lines from vault.env.
4. Idempotent scripts/bootstrap/install.sh: symlink hooks into .git/hooks/hooksPath, render+load scheduler entries per role, verify deps (python3, git; role-conditional qmd, claude, SSH keys), report status. Add a “bootstrap current?” check to vault-audit.py and platform-dispatch its sync check.
5. Bring slack-notify.sh (+ vault-audit-slack.sh wrapper) into scripts/ so no repo script references /home/patrick/scripts/. Estimated: steps 1+2+4 one session, step 3 one session, step 5 small.

S2. AIOS-style knowledge layer (follows S1): split claude-code-shared-context.md into a current-state infrastructure-map.md (with last-verified dates and the same-session update rule) and a separate chronological history file; move skill content to tool-neutral markdown with .claude/skills/ as thin redirects (the pattern health-checkin/sync-health already use); declare Mac-only skills explicitly; add one authoritative-pointer line to .codex/CODEX.md.

S3. PARA restructure: archive all 8 dead 01-projects entries; decide whether 01-projects becomes the home of active plans (moving 03-resources/plans/ actives there) or is dropped in favor of plans/; consolidate or bless the six area-local archives; archive 03-resources/agent-system/crewai/. DONE 2026-07-07 (per Open Question #4 decision — restore PARA as designed): 7 dead project logs → 04-archive/projects/; 16 active plans + ai-os-rework/ → 01-projects/; 4 implemented/executed plans → 03-resources/executed-plans/; 03-resources/plans/ retired to a pointer index; CrewAI archived earlier same day. The six area-local archives were left in place (blessed) — consolidating 172+ files bought nothing and risked breaking relative links; revisit only if they cause real friction.

S4. Publish-boundary hardening (before any third reader): add the ~10-line frontmatter gate in sync-content.mjs (internal/draft tags, status: draft); move or tag the two infra docs in 00-inbox; verify Cloudflare Pages has build-failure alerting and cache purge (replacing what deploy.yml did); optionally fix the vault_path/repair ordering bug in the same edit. DONE 2026-07-07 (except one manual check): gate implemented (55 files excluded on first run — inline and YAML-list tag forms, status: draft, draft: true); both infra docs tagged internal; vault_path ordering bug fixed; 05-private added to the allowlist per the Open Question #1 decision. Still manual: verify in the Cloudflare dashboard that the Pages project has build-failure notifications and post-deploy cache purge — not verifiable from the repo.

S5. Link/index hygiene at scale: add index.md to the 84 content dirs (scriptable: generate stub indexes listing children as wikilinks; this also collapses most of the 407 orphans), then re-run the orphan query and handle the residue. DONE 2026-07-07: new reusable scripts/generate-dir-indexes.py created 88 stub indexes (idempotent — never touches an existing index). Machine-generated content dirs (primer assignment exports, forum sync topics/activity/forums/groups, DMs, contact inquiries) got marker-delimited auto-list sections refreshed by the same script’s --refresh mode, now wired into post-sync-hook.sh so new exports never orphan. Residual strays hand-linked from their area folder notes. Result: broken wikilinks 16 → 0 (linter and index both), orphans 407 → 15, all 15 legitimately standalone (templates, entry points, transient inbox docs, 05-private).

.claude settings split

DONE 2026-07-07 — see Open Question #8.

---

4. Open Questions for Patrick

1. 05-private DECIDED 2026-07-07: publish it to the gated site. Patrick: the vault has exactly two readers (Patrick + Asia), the site is Cloudflare-Access-gated with 2FA, and personal material interrelated with Baseworks is fine there. Add 05-private to the sync allowlist when implementing S4.
2. internal/draft gating DECIDED 2026-07-07: implement now (S4 approved).
3. 00-inbox publishing DECIDED 2026-07-07: keep publishing; the two infra docs are tagged internal and excluded by the S4 gate. No links break.
4. PARA direction DECIDED 2026-07-07: restore PARA as designed. Active plans move into 01-projects/; 03-resources/plans/ reserves for reference/executed material; dead project logs go to 04-archive. S3 approved on this basis.
5. AIOS target (S1/S2): is the vault.env + jobs-manifest + bootstrap design the shape you want, or do you want to mirror AIOS more literally (Maps/ directory, Skills/ at vault level)? The proposal keeps Baseworks conventions and borrows AIOS principles rather than its exact layout. (2026-07-07: Patrick undecided — S1/S2 wait.)
6. Obsidian plugins/themes in git DECIDED 2026-07-07: trim unused. All 3 plugins are enabled (keep); 3 of 4 themes were unused and removed (Catppuccin, Blue Topaz, AnuPpuccin — ~3.8 MB); active theme PLN stays.
7. OpenClaw: service currently returns HTTP 526 (down). Rotate the token and keep the deployment, or is OpenClaw retired? DECIDED 2026-07-05: OpenClaw is retired entirely. No rotation needed; redact the committed token and archive the OpenClaw docs. Also decided: CrewAI is fully retired. Archive 03-resources/agent-system/crewai/, the two CrewAI architecture/deployment docs, and 01-projects/Baseworks-n8n-CrewAI-Deployment.md so none of it crowds the knowledge base (upgrades the Section 6 [low] finding to an approved action). EXECUTED 2026-07-07: all four moved to 04-archive/agent-system/, references updated, index added.
8. .claude/settings.local.json split DECIDED + DONE 2026-07-07. The local file turned out to be already untracked; shared cross-machine grants now live in a committed .claude/settings.json, local file explicitly gitignored, and a stray committed memory file under .claude/projects/ was removed. Other machines keep their local grants; no action needed beyond pulling.

---

Appendix A — Script Inventory (Section 5 detail)

Script	Purpose	Runs via	Portability
vault-sync.sh	pull/rebase → archive-inbox → commit/push → post-sync hook	launchd 300s (Mac), cron (VPS); --pull-only (NAS)	Portable (self-resolving)
post-sync-hook.sh	rebuild vault-index.db + qmd update	called by vault-sync + git hooks	Portable; qmd guarded
git-hooks/post-merge, post-rewrite	index rebuild after manual pull	not active (wrong hooks dir)	Portable
hooks/pre-push	block real media binaries in *-assets/	git hook via core.hooksPath	Broken on macOS (GNU find)
archive-inbox.py	move [x] inbox items to archives	each vault-sync cycle	Portable
build-vault-index.py	SQLite structural index	post-sync-hook	Portable
check-wikilinks.py	broken-link linter	manual	Portable
vault-audit.py	daily health check → audit-log.json	VPS cron 4:15 ET (Slack wrapper); /vault-audit	launchctl branch macOS-only
build-people-index.py + people_remote.py	people records w/ WP/CRM joins	people-pipeline cron 6x/day (VPS)	Portable core; needs SSH
people-pipeline.sh	chains exports → people index → vault index	VPS cron	Hardcoded /srv, /home/patrick
people-webhook-daemon.py + .service	FluentCRM webhook → re-aggregate	systemd (VPS)	Env-overridable, VPS defaults
people-webhook-heartbeat.sh	daily service health → Slack	VPS cron 4:20 ET	VPS-only; out-of-repo slack-notify.sh
slack-notify-systemd-failure@.service	Slack alert on unit failure	systemd OnFailure	VPS-only; hardcoded IP
forum-content-sync.py/.sh	BuddyBoss → vault markdown	VPS cron */15	.py half-portable (env); .sh hardcoded
translate-community-content.py	translate non-EN community content	called by forum sync	env-overridable
export-contact-inquiries.py	contact-form entries → vault	people pipeline (VPS)	needs SSH
build-program-dashboard.py	cohort dashboards	manual	Portable
update-sitemap-reference.sh	sitemap → md reference	VPS cron weekly	Hardcoded /srv
migrate-community-folders.py	one-time 2026-04 migration (done)	manual	Historical
launchd/com.baseworks.vault-sync.plist	Mac scheduler	launchd	$HOME-based (good); /opt/homebrew PATH; logs to /tmp

Appendix B — Hardcoded Paths (code/config only)

File:Line	Value
scripts/forum-content-sync.sh:7,9	/srv/baseworks/knowledge-base; /home/patrick/scripts/...log
scripts/people-pipeline.sh:14,16	same pattern
scripts/people-webhook-heartbeat.sh:19,23,24	/home/patrick/scripts/{heartbeat,slack-notify,logs}
scripts/people-webhook-daemon.py:30–38,112	/srv/..., /home/patrick/..., IP 46.224.129.16
scripts/people-webhook.service:10–15	/srv/..., /home/patrick/... (acceptable: per-host unit)
scripts/slack-notify-systemd-failure@.service:8	/home/patrick/scripts/slack-notify.sh; IP
scripts/translate-community-content.py:21, forum-content-sync.py:32	default VAULT_DIR=/srv/... (env-overridable)
scripts/update-sitemap-reference.sh:11	/srv/baseworks/knowledge-base
scripts/vault-audit.py:351–357	launchctl
scripts/launchd/...plist:24	/opt/homebrew/bin
.claude/settings.local.json:22,31–39	/Users/vboy/.cache/qmd, VPS SSH allowances
.claude/skills/archive-newsletter/SKILL.md:60,229	/Users/vboy/Obsidian/...
.claude/skills/extract-frames/SKILL.md:31	/opt/homebrew/bin/
create-email:230, create-newsletter:231	pbcopy (macOS)
compress-photos, wp-media-import:10	sips, /Volumes/baseworks/media/ (Mac-scoped by nature)

---

Related

• vault-comprehensive-audit-fable-prompt
• claude-code-shared-context
• the-two-layers-framework