Agent diagnostics

Give every project the same diagnostic access, set up once in hq: logs, the live Home Assistant API and database, real config, preview environments, throwaway HA/SignalK instances, browser automation (Claude in Chrome, headless Playwright), and the local services agents log in to (OpenObserve, SignalK, Home Assistant, routers). Each one gets a dedicated agent account, a skill or doc, a known place for its secret and the same sandbox rules in every project.

Context

Today each resource was set up inside whichever project needed it first, so another project can’t use it without copying credentials and permissions over by hand. The private inventory, with hosts, accounts and gaps, is hq-private/reference/diagnostics.md.

Where things live:

• Secret values: ~/Projects/.hq.env/<service>.env on the laptop, outside every git repo, mode 600. ha-repl tokens stay in its own user-level config. Never in hq or hq-private.
• Docs, skills, sandbox profiles, account list: hq-private, because they name private hosts; generic skills that name nothing private go in the agent-plugins marketplace.
• Later: AWS Secrets Manager, once the remote developer environment exists.

Agent accounts are separate from the maintainer’s own logins, read-only unless a task needs more, so access shows up in audit logs and can be revoked without touching anything else.

Preview containers and starter VMs may fit better on the remote developer environment, which is blocked on the AWS migration. This project does the parts that work on the laptop now and gives that environment a spec to build to.

Plan

Now (laptop)

• @agent Gitignore .logs.env where a copy exists (supernotify had it; updates2mqtt fixed by the maintainer, 2026-11-10)
• @agent Create ~/Projects/.hq.env/ and move the OpenObserve credentials in (2026-11-10)
• @agent Write a diagnostics section in reference/project_tooling.md
• @human Confirm or create agent accounts: OpenObserve, HA home, SignalK, boat and home routers (hq-private#93, closed 2026-11-10)
• @pair openobserve skill: query logs by service and time range, loading openobserve.env (diagnostics plugin in a private hq-private marketplace, hq-private#97; installed 2026-11-10)
• @pair Sandbox profiles per family (homeassistant, signalk) in hq-private, plus a command that writes them into each repo’s .claude/settings.local.json, driven by repos.toml (hq-private#94, #96; applied to 19 checkouts 2026-11-10)
• @pair Retire one-off curl allows in project settings.local.json in favour of the profile’s host rules (--prune, 2026-11-10)
• @human Remove the boat SignalK server’s address from sandbox.network.allowedDomains in ~/.claude/settings.json, now that the signalk profile covers it per repo (2026-11-10)
• @pair Point supernotify and updates2mqtt at ~/Projects/.hq.env/openobserve.env, then delete their .logs.env copies (nothing read them; the skill uses the central file; deleted 2026-11-10)
• @pair Move the preview environment out of supernotify into a reusable pattern, or document it as the template
• @pair Home dev SignalK (Docker or VM) for plugin development, since the boat server is only online when the boat is in use; add its host to the signalk sandbox profile
• @human Dedicated Chrome profile for Claude in Chrome, logged in only with agent accounts (hq-private#93; aiagent, 2026-11-10)
• @pair Browser guidance: Claude in Chrome for UI checks on real instances, headless Playwright for preview and docs; shared Playwright setup instead of per-repo npx installs
• @pair Cloud routines: advisory text in the snapshot instead of blocked sources (hq-private#95, hq#3; merged 2026-11-10)
• @agent Sweep reports for other “blocked”/“not read” gaps (e.g. hacs/default via raw.githubusercontent.com) and move each source into the snapshot
• @agent Remove the stale openobserve MCP entry for the old ~/Code/rhizomatics-ha/supernotify path

Later (developer environment)

• @human Decide which resources move to the remote dev environment (preview, starters, mounted config)
• @pair Move .hq.env secrets to AWS Secrets Manager and resolve them at runtime (now planned in mise environments, through fnox profiles)

Decisions

• 2026-11-10: local secrets live in ~/Projects/.hq.env/, one file per service, outside every repo (maintainer).
• 2026-11-10: agent accounts on local services are in scope (maintainer).
• 2026-11-10: project started (maintainer).

Log

• 2026-11-10: proposed from a maintainer note listing five scattered diagnostic resources; inventory written in hq-private.
• 2026-11-10: started. Created ~/Projects/.hq.env/ with openobserve.env; added agent accounts to the scope and the inventory; filed hq-private#93 for account checks; tooling reference updated. Next: sandbox profiles.
• 2026-11-10: browser automation (Claude in Chrome, Playwright) and the OpenObserve MCP server added to scope and inventory; Chrome profile item added to hq-private#93. Sandbox profiles and sync command opened as hq-private#94 (dry run: 19 checkouts, 7 curl allows to prune). Next after merge: openobserve skill.
• 2026-11-10: OrbStack made an opt-in profile (environments moving to the dev server), hq-private#96. Profiles applied with --prune; the earlier #94 run had given every HA repo OrbStack access, removed by hand, with supernotify opted in. All 19 checkouts up to date.
• 2026-11-10: diagnostics plugin with the openobserve skill merged (hq-private#97) and installed at user level; tested against the live server. Per-project .logs.env copies deleted. Next: browser guidance, preview pattern.
• 2026-11-10: agent accounts: OpenObserve confirmed; HA home non-admin user (hass.env, ha-repl stays on the user-level admin config); boat router (rutos.env). Read-only homeassistant skill (hq-private#98) and boat router in the signalk sandbox profile (hq-private#99).
• 2026-11-10: environments split into production and dev/test (maintainer); production access is by exception, routers especially. Secrets under .hq.env/prod/ (hq-private#102); production hosts removed from every checkout’s sandbox, one opt-in prod-* profile per system with --remove (hq-private#103). MQTT agent account added; login not yet confirmed (broker rejects the client id).
• 2026-11-10: homeassistant skill removed again (hq-private#100): it duplicated ha-repl’s API client mode, which works with the non-admin token. The maintainer will add the gaps (history, logbook, services list, clearer empty/401 messages) to ha-repl itself.
• 2026-11-10: proposed mise environments, which loads .hq.env secrets through mise and fnox instead of sourcing plaintext files. The Secrets Manager task moves there.
• 2026-11-13 — project-review: no commits since 11-10. Open: preview pattern, home dev SignalK, browser guidance, snapshot sweep, stale MCP entry. Not stalled yet (3 days).