[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DBBSTFQTQ899AXKYXR5DNN":3,"skill-same:01M6DBBSTFQTQ899AXKYXR5DNN":58},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":33,"linkOnly":34,"markdownContent":35,"markdownBody":36,"frontMatter":37,"refName":38,"commitSha":39,"skillDirectory":40,"forksCount":14,"repositoryHtmlUrl":41,"repositoryHomepageUrl":6,"ownerHtmlUrl":42,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":43,"install":44,"resources":57},"01M6DBBSTFQTQ899AXKYXR5DNN","estate-sync",null,"Bootstrap, reconcile and audit this estate across machines. Use when setting up a second machine from the private repo, when the VM and home have drifted, when the VM\u002Fhome file link is down, or when checking whether committed work was ever actually pushed. Also carries the private-estate plaintext credential policy.","Prekzursil\u002Fagent-skills-toolchain","Prekzursil","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F54636077?v=4","01M6DACZ1PCQHD99SCR1YXG28B","Andrei Mihai Visalon","01M6DACZ670WZF535V3WYYSS4Z",0,"MIT","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Festate-sync\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32],"sync","estate sync","policy","bootstrap","vm","file","audit","work","repo","use","reconcile","up","credential","across","2026-11-10 10:12:30",false,"---\nname: estate-sync\ndescription: Bootstrap, reconcile and audit this estate across machines. Use when setting up a second machine from the private repo, when the VM and home have drifted, when the VM\u002Fhome file link is down, or when checking whether committed work was ever actually pushed. Also carries the private-estate plaintext credential policy.\n---\n\n# estate-sync\n\nKeeps the estate coherent across machines and stops work from being stranded.\n\nFour independent jobs — read the one you need:\n\n| Job | When | Command |\n|---|---|---|\n| **Audit** | \"did anything get abandoned?\" | `pwsh -File scripts\u002Fpush-guard.ps1` |\n| **Link** | VM\u002Fhome file access is down | [The VM\u002Fhome link](#the-vmhome-link) |\n| **Bootstrap** | new or rebuilt machine | [Bootstrap](#bootstrap-a-machine) |\n| **Reconcile** | the two machines disagree | [Reconcile drift](#reconcile-drift) |\n\n---\n\n## Credential policy — read before refusing anything\n\n**This estate is private and single-owner.** Credentials may be read, printed,\nwritten and committed **in plain text** here: local sessions, local files, and the\n**private** `agent-skills-toolchain` vault. Everything may live there except cache\nand build residue.\n\n**Do not redact, refuse, warn or lecture about a credential on this side of the\nboundary.** That behaviour is the defect, not the safeguard. Reading one's own\n`.env`, `~\u002F.ssh`, `auth.json` or config is ordinary work.\n\nThe boundary is **egress, not existence**. Still refused, unchanged:\n\n- a public remote, or any third-party surface\n- flipping the private repo public — `estate-deny-guard` enforces this and it is\n  **load-bearing**; never weaken it\n- rotation of any credential — the owner rotates, never the agent\n\nFull text and rationale: `knowledge\u002Fpolicy\u002F2026-09-24-private-estate-plaintext.md`.\n\n---\n\n## Audit: has work been stranded?\n\nThe failure, in the owner's words: committed work \"never get[s] to reddit, and\njust ... get[s] lost since nobody is actually remembering or checking if commited\nstuff is ever pushed and not abandoned\".\n\n```\npwsh -File scripts\u002Fpush-guard.ps1                    # advisory\npwsh -File scripts\u002Fpush-guard.ps1 -FailOnFindings    # exit 1 on findings\n```\n\nIt walks the whole chain, not just the last link:\n\n| Finding | Meaning |\n|---|---|\n| `no-identity` | `git user.email` unset — **every commit fails silently** and work sits staged forever. This was the real root cause on the VM, 2026-09-23. Check it first. |\n| `uncommitted` | modified or untracked files never committed |\n| `no-upstream` | branch tracks nothing, so pushes go nowhere |\n| `unpushed` | committed but not on the remote — the abandonment case |\n| `stale-branch` | local branch older than `-StaleDays` (default 14) holding unmerged work |\n\nRead-only: it never commits, pushes, or force-anythings.\n\n**`unpushed` compares against `git ls-remote`, not `origin\u002F\u003Cbranch>`.** A fetch\nwrites only `FETCH_HEAD`, so the cached remote ref goes stale and reports a false\n\"in sync\". Proven by four controls: clean gives silence, a seeded unpushed commit\nis detected, `-FailOnFindings` exits 1, and pushing clears it.\n\n---\n\n## The VM\u002Fhome link\n\nTwo machines, each serving its disks to the other over the tailnet via\n`rclone serve sftp`, key auth, bound to the tailnet address only — never `0.0.0.0`.\n\n| | VM `offload-w2025` | Home `desktop-a60s9gp` |\n|---|---|---|\n| tailnet IP | `100.117.115.55` | `100.97.16.36` |\n| serves C: \u002F D: on | `:2022` \u002F `:2023` | `:2022` \u002F `:2023` |\n| launcher | `C:\\ProgramData\\vm-link\\serve.cmd` | `C:\\ProgramData\\vm-link\\home-serve.cmd` |\n| persistence | task `vm-link-serve` (boot) | task `vm-link-serve-home` — **install it** |\n\n### If the link is down, diagnose in this order\n\n```\ntailscale status | Select-String desktop-a60s9gp\n```\n\n- **`offline, last seen ...`** — the machine is powered down or asleep. **You\n  cannot fix this from the other side.** Tailscale cannot wake a machine that is\n  off without a Wake-on-LAN peer on its own LAN. Wait, or ask the owner to wake it.\n  Do not grind retries; stage the work and arm a watcher instead.\n- **node online but transfers fail** — the machine is up but its `rclone serve` is\n  not running. That is the persistence bug below.\n\n### Make it persistent (one-time, on home)\n\n`HOME-SETUP.md` originally said to run `rclone serve sftp` in a foreground shell.\nThat process dies with the shell, the session, or the machine — which is why the\nlink kept dropping (open loop L-14). Register the task instead:\n\n```\npwsh -File C:\\ProgramData\\vm-link\\install-home-service.ps1\n```\n\nElevated, idempotent, boot + logon triggers, auto-restart every minute. It\nverifies itself by checking that ports 2022 and 2023 are actually listening and\nprints `SUCCESS:home-link-persistent` only if they are.\n\nUninstall: `install-home-service.ps1 -Uninstall`.\n\n### Moving files when the link is up\n\n```\nrclone copy \u003Csrc> homeC:\u002FUsers\u002FPrekzursil\u002F\u003Cdest> --transfers 8\n```\n\nThe drive-letter mounts (L:, M:, V:, W:) are unreliable; the rclone data path is\nwhat actually works. Do not block on mounts.\n\n---\n\n## Bootstrap a machine\n\n1. `git clone` the private repo to `~\u002Fsource\u002Fagent-skills-toolchain`.\n2. Point `~\u002F.agents` at it (junction on Windows). If `~\u002F.agents` is a junction to\n   a SYSTEM-owned path, git refuses it as \"dubious ownership\":\n   `git config --global --add safe.directory \u003Cpath>`.\n3. Copy `~\u002F.claude\u002Fsettings.json` from the repo snapshot in\n   `backups\u002Fpolicy-\u003Cdate>\u002F`. **Verify every hook command path resolves on the new\n   machine before writing it** — a settings file referencing absent scripts\n   produces a harness that looks wired and silently does nothing.\n4. Set `git config user.email` and `user.name`. Skipping this is the\n   silent-commit-failure bug above.\n5. Install the VC++ x64 redistributable. Its absence broke `onnxruntime` →\n   `fastembed` → basic-memory semantic search **and**, independently, the PDF\n   library. One install fixed both.\n6. Run `pwsh -File scripts\u002Fpush-guard.ps1` to confirm a clean baseline.\n\n---\n\n## Reconcile drift\n\nBefore copying anything between machines, **establish direction**. The trap: a\nsnapshot that looks like a backup is often the *poorer* copy.\n\nMeasured 2026-09-24 — the VM's basic-memory vault held **717** notes; home's held\n**1,126**. Restoring the VM's \"backup\" over home would have destroyed ~409 notes.\n\n```\nrclone lsf homeD:\u002Fbasic-memory\u002F --include '*.md' -R | Measure-Object -Line\n```\n\nChecklist before any sync:\n\n- [ ] Count both sides. More files is not proof of newer, but fewer files is a\n      loud warning.\n- [ ] Is the \"new\" file genuinely new, or just untracked because this checkout is\n      behind? Six scripts and three docs looked like VM work and were already on\n      home.\n- [ ] Are there staged **deletions**? 21 deletions under `skills\u002Fmicrosoft-foundry\u002F`\n      were an import artifact, not a decision. Syncing would have deleted live files.\n- [ ] Exclude cache and residue: `.venv\u002F`, `out\u002F`, `__pycache__\u002F`, browser profiles.\n\n`scripts\u002Fsync-from-live.ps1 -Drift` reports live-vs-repo drift for the synced trees\n(`rules`, `agents`, `commands`, `hooks`, `.agents\u002Fskills`). Advisory only.\n\n**Known gap:** `rules\u002F` and `backups\u002F` are gitignored repo-wide with **zero**\ntracked files, so anything there is unversioned and dies with the machine.\nForce-add deliberately (`git add -f`) until that is decided.\n\n---\n\n## Always push\n\nA commit that is not pushed is a commit that can be lost. The `cursor\u002F*` branches\nare the proof: real progress that was never pushed and is now gone.\n\nThis is enforced mechanically, not by remembering:\n\n```\npwsh -File scripts\u002Finstall-autopush.ps1            # install (idempotent)\npwsh -File scripts\u002Finstall-autopush.ps1 -WhatIf    # dry run\nsh   scripts\u002Ftest_autopush.sh                      # 9 controls\n```\n\n`scripts\u002Fgit-hooks\u002Fpost-commit-autopush` pushes every commit the moment it is made.\n\n| Property | Why |\n|---|---|\n| **Fails open** | A push failure never fails the commit. A blocked commit is strictly worse than an unpushed one — the work would not exist at all. |\n| **Loud on failure** | Writes to stderr and `~\u002F.agents\u002Flogs\u002Fautopush.log`. A repo that quietly stopped pushing is visible, not assumed fine. |\n| **Never `--force`, never `--no-verify`** | Those stay refused by `estate-deny-guard`; the hook must not route around it. |\n| **Skips mid-rebase \u002F detached HEAD** | Pushing then publishes a half-finished tree. Note `MERGE_HEAD` is NOT a usable marker — git deletes it as part of the concluding commit, so it is already gone when `post-commit` runs. |\n| **Chains, never clobbers** | An existing `post-commit` is preserved as `post-commit.pre-autopush` and run first. |\n| **Idempotent** | Detects itself via the `AUTOPUSH-HOOK-MARKER` line in the hook body. |\n\nOpt out for one command: `GIT_AUTOPUSH_OFF=1 git commit ...` — and say why.\n\n### Corollary: do not delete remote branches to tidy up\n\nA remote branch may hold the only copy of work nobody merged. Before proposing any\nprune, measure `ahead_by` per branch (`gh api repos\u002F{owner}\u002F{repo}\u002Fcompare\u002F{base}...{head}`)\nand report the actual ratio. \"It looks like agent residue\" is a hypothesis, not a\nfinding — and on this estate that hypothesis has already been wrong once.\n\n---\n\n## VM-side link restoration (runbook, executed and verified 2026-09-30)\n\nWhen the VM half of the bilateral link is down, restore per this order (all\nelevated; every step verified by its output):\n\n1. **Deploy the home key** `home_to_vm@desktop-a60s9gp` into BOTH\n   `$env:USERPROFILE\\.ssh\u0007uthorized_keys` AND\n   `C:\\ProgramData\\ssh\u0007dministrators_authorized_keys` — the admin file is the\n   one Windows OpenSSH actually reads for admin users; deploying to the user\n   file alone silently fails. Then `icacls \u003Cadminfile> \u002Finheritance:r \u002Fgrant\n   Administrators:F \u002Fgrant SYSTEM:F` and `Restart-Service sshd`.\n2. **Start the VM serve**: `C:\\ProgramData\u000bm-link\\serve.cmd` exists by design\n   (rclone sftp, C: on :2022 \u002F D: on :2023, bound to the Tailscale IP only —\n   never 0.0.0.0). Run it; verify listeners on `100.117.115.55:2022\u002F2023`.\n3. **Persist**: scheduled tasks `vm-link-serve` (boot) + `vm-link-serve-logon`\n   (logon), SYSTEM\u002Fhighest, ExecutionTimeLimit zero, 3x auto-restart;\n   sshd + WinRM StartupType Automatic.\n4. **Anti-reap**: `rclone` MUST be in `reap_orphan_mcp.ps1`'s `$whitelist` —\n   the serve is detached-by-design (dead parent) and the reaper kills that\n   shape. Verify with a `-WhatIfOnly` run showing would-kill 0.\n\n## Diagnosing \"link down\": standby vs misconfiguration\n\nTwo rules learned the hard way (2026-09-30):\n\n- **A local self-test to your own Tailscale IP is not evidence.** Hairpin\n  connects time out on Windows+Tailscale even when serving is perfectly healthy.\n  Only a cross-machine test decides.\n- **`tailscale status` showing the peer `active; relay` with\n  `tailscale ping` timing out and all TCP closed = the peer machine is in\n  Windows standby**, not misconfigured. Its tailscaled keeps the session alive\n  via relay heartbeat while the network stack sleeps. Wait for wake; do not\n  touch config. (Distinguishing signal vs a config fault: standby kills ICMP\n  *and* every port including previously-verified ones like 22\u002F3389.)\n\n## Third surface: the ovido4 mirror\n\nThe estate has TWO mirror surfaces — a **VM-level 1:1 mirror** (GCP machine image,\nexecuted 2026-10-01) and a **repo-level git mirror** (staged, awaiting token).\n\n### VM-level 1:1 mirror (GCP machine image — the Macrium equivalent)\n\n`offload-mirror` in ovido4's project (`project-90b4a09f-be6f-4040-a6c`) is a\nbyte-identical clone of `offload-w2025` created via GCP machine image. Full\nrunbook: `estates\u002Foffload-w2025\u002F2026-09-30-link-and-mirror\u002FMIRROR-RUNBOOK.md`.\n\n**The three blockers and their fixes** (so nobody rediscovers them):\n\n1. **Billing write-block is account-specific**: `BILLING_DISABLED` on GCP\n   writes affects ovido4@gmail.com but NOT prekzursil1993 (roles\u002Fowner), even\n   on the same project. Switch account to do writes.\n2. **Global CPU quota**: `CPUS_ALL_REGIONS` limit=12 per project; a 12-vCPU\n   VM consumes it all. Cannot co-locate a second instance in the same project.\n   Deploy to the other project instead.\n3. **Cross-project service account**: machine image inherits the SOURCE\n   project's SA; target account lacks `iam.serviceAccountUser` on it. Fix:\n   pass `--service-account=\u003Ctarget-project-number>-compute@developer.gserviceaccount.com`\n   explicitly on `instances create`.\n\n**What NOT to use**: wbadmin\u002FWindows Server Backup (requires feature install\nreboot); GCP metadata SSH key deploy (no compute-accounts-daemon on custom\nimages). Use `reset-windows-password` + paramiko for initial access instead.\n\n**The working sequence**:\n```bash\n# 1. snapshot + image (as prekzursil1993, source project)\ngcloud compute machine-images create mirror-full-YYYYMMDD \\\n  --source-instance=offload-w2025 --source-instance-zone=europe-central2-a \\\n  --project=webcoder-462916 --storage-location=europe-central2\n\n# 2. deploy (as ovido4, target project)\ngcloud compute instances create offload-mirror \\\n  --source-machine-image=projects\u002Fwebcoder-462916\u002Fglobal\u002FmachineImages\u002Fmirror-full-YYYYMMDD \\\n  --zone=europe-central2-a --project=project-90b4a09f-be6f-4040-a6c \\\n  --machine-type=n2-custom-12-98304 \\\n  --service-account=\u003Ctarget-SA> --scopes=default\n\n# 3. access\ngcloud compute reset-windows-password offload-mirror --user=prekzursil ...\n# then paramiko password-login → deploy SSH key → key auth\n```\n\n### Repo-level git mirror (staged)\n\nA git `push --mirror` snapshot of the vault repo. Staged at\n`D:\\opt\\vault\\mirror-push\\agent-skills-toolchain.git` (bare clone, all refs)\nwith `push-mirror-to-ovido4.sh` — one command once an ovido4 GitHub token is\nprovided. No ovido4 GitHub credential exists on the VM or in the vault env\nbackups (all three stored tokens are Prekzursil) — the token must come from\nhome or be minted.\n\n### Mirror-pending convention\n\nWhen the primary link is down, session deltas accumulate as\n`D:\\opt\\vault\\mirror-pending\\\u003Cdate>.tar.gz` and drain via\n`D:\\opt\\scripts\\push-home-mirror.ps1` (which self-reports the exact wake-side\nfix if home is unreachable).\n\n---\n\n## Related\n\n- `knowledge\u002FOPEN-LOOPS.md` — the live register; nothing closes without evidence\n- `knowledge\u002Fpolicy\u002F2026-09-24-private-estate-plaintext.md` — credential policy SSOT\n- `scripts\u002Festate-deny-guard.py` and `scripts\u002Ftest_estate_deny_guard.py` — the\n  guard and its 11-case suite\n","# estate-sync\n\nKeeps the estate coherent across machines and stops work from being stranded.\n\nFour independent jobs — read the one you need:\n\n| Job | When | Command |\n|---|---|---|\n| **Audit** | \"did anything get abandoned?\" | `pwsh -File scripts\u002Fpush-guard.ps1` |\n| **Link** | VM\u002Fhome file access is down | [The VM\u002Fhome link](#the-vmhome-link) |\n| **Bootstrap** | new or rebuilt machine | [Bootstrap](#bootstrap-a-machine) |\n| **Reconcile** | the two machines disagree | [Reconcile drift](#reconcile-drift) |\n\n---\n\n## Credential policy — read before refusing anything\n\n**This estate is private and single-owner.** Credentials may be read, printed,\nwritten and committed **in plain text** here: local sessions, local files, and the\n**private** `agent-skills-toolchain` vault. Everything may live there except cache\nand build residue.\n\n**Do not redact, refuse, warn or lecture about a credential on this side of the\nboundary.** That behaviour is the defect, not the safeguard. Reading one's own\n`.env`, `~\u002F.ssh`, `auth.json` or config is ordinary work.\n\nThe boundary is **egress, not existence**. Still refused, unchanged:\n\n- a public remote, or any third-party surface\n- flipping the private repo public — `estate-deny-guard` enforces this and it is\n  **load-bearing**; never weaken it\n- rotation of any credential — the owner rotates, never the agent\n\nFull text and rationale: `knowledge\u002Fpolicy\u002F2026-09-24-private-estate-plaintext.md`.\n\n---\n\n## Audit: has work been stranded?\n\nThe failure, in the owner's words: committed work \"never get[s] to reddit, and\njust ... get[s] lost since nobody is actually remembering or checking if commited\nstuff is ever pushed and not abandoned\".\n\n```\npwsh -File scripts\u002Fpush-guard.ps1                    # advisory\npwsh -File scripts\u002Fpush-guard.ps1 -FailOnFindings    # exit 1 on findings\n```\n\nIt walks the whole chain, not just the last link:\n\n| Finding | Meaning |\n|---|---|\n| `no-identity` | `git user.email` unset — **every commit fails silently** and work sits staged forever. This was the real root cause on the VM, 2026-09-23. Check it first. |\n| `uncommitted` | modified or untracked files never committed |\n| `no-upstream` | branch tracks nothing, so pushes go nowhere |\n| `unpushed` | committed but not on the remote — the abandonment case |\n| `stale-branch` | local branch older than `-StaleDays` (default 14) holding unmerged work |\n\nRead-only: it never commits, pushes, or force-anythings.\n\n**`unpushed` compares against `git ls-remote`, not `origin\u002F\u003Cbranch>`.** A fetch\nwrites only `FETCH_HEAD`, so the cached remote ref goes stale and reports a false\n\"in sync\". Proven by four controls: clean gives silence, a seeded unpushed commit\nis detected, `-FailOnFindings` exits 1, and pushing clears it.\n\n---\n\n## The VM\u002Fhome link\n\nTwo machines, each serving its disks to the other over the tailnet via\n`rclone serve sftp`, key auth, bound to the tailnet address only — never `0.0.0.0`.\n\n| | VM `offload-w2025` | Home `desktop-a60s9gp` |\n|---|---|---|\n| tailnet IP | `100.117.115.55` | `100.97.16.36` |\n| serves C: \u002F D: on | `:2022` \u002F `:2023` | `:2022` \u002F `:2023` |\n| launcher | `C:\\ProgramData\\vm-link\\serve.cmd` | `C:\\ProgramData\\vm-link\\home-serve.cmd` |\n| persistence | task `vm-link-serve` (boot) | task `vm-link-serve-home` — **install it** |\n\n### If the link is down, diagnose in this order\n\n```\ntailscale status | Select-String desktop-a60s9gp\n```\n\n- **`offline, last seen ...`** — the machine is powered down or asleep. **You\n  cannot fix this from the other side.** Tailscale cannot wake a machine that is\n  off without a Wake-on-LAN peer on its own LAN. Wait, or ask the owner to wake it.\n  Do not grind retries; stage the work and arm a watcher instead.\n- **node online but transfers fail** — the machine is up but its `rclone serve` is\n  not running. That is the persistence bug below.\n\n### Make it persistent (one-time, on home)\n\n`HOME-SETUP.md` originally said to run `rclone serve sftp` in a foreground shell.\nThat process dies with the shell, the session, or the machine — which is why the\nlink kept dropping (open loop L-14). Register the task instead:\n\n```\npwsh -File C:\\ProgramData\\vm-link\\install-home-service.ps1\n```\n\nElevated, idempotent, boot + logon triggers, auto-restart every minute. It\nverifies itself by checking that ports 2022 and 2023 are actually listening and\nprints `SUCCESS:home-link-persistent` only if they are.\n\nUninstall: `install-home-service.ps1 -Uninstall`.\n\n### Moving files when the link is up\n\n```\nrclone copy \u003Csrc> homeC:\u002FUsers\u002FPrekzursil\u002F\u003Cdest> --transfers 8\n```\n\nThe drive-letter mounts (L:, M:, V:, W:) are unreliable; the rclone data path is\nwhat actually works. Do not block on mounts.\n\n---\n\n## Bootstrap a machine\n\n1. `git clone` the private repo to `~\u002Fsource\u002Fagent-skills-toolchain`.\n2. Point `~\u002F.agents` at it (junction on Windows). If `~\u002F.agents` is a junction to\n   a SYSTEM-owned path, git refuses it as \"dubious ownership\":\n   `git config --global --add safe.directory \u003Cpath>`.\n3. Copy `~\u002F.claude\u002Fsettings.json` from the repo snapshot in\n   `backups\u002Fpolicy-\u003Cdate>\u002F`. **Verify every hook command path resolves on the new\n   machine before writing it** — a settings file referencing absent scripts\n   produces a harness that looks wired and silently does nothing.\n4. Set `git config user.email` and `user.name`. Skipping this is the\n   silent-commit-failure bug above.\n5. Install the VC++ x64 redistributable. Its absence broke `onnxruntime` →\n   `fastembed` → basic-memory semantic search **and**, independently, the PDF\n   library. One install fixed both.\n6. Run `pwsh -File scripts\u002Fpush-guard.ps1` to confirm a clean baseline.\n\n---\n\n## Reconcile drift\n\nBefore copying anything between machines, **establish direction**. The trap: a\nsnapshot that looks like a backup is often the *poorer* copy.\n\nMeasured 2026-09-24 — the VM's basic-memory vault held **717** notes; home's held\n**1,126**. Restoring the VM's \"backup\" over home would have destroyed ~409 notes.\n\n```\nrclone lsf homeD:\u002Fbasic-memory\u002F --include '*.md' -R | Measure-Object -Line\n```\n\nChecklist before any sync:\n\n- [ ] Count both sides. More files is not proof of newer, but fewer files is a\n      loud warning.\n- [ ] Is the \"new\" file genuinely new, or just untracked because this checkout is\n      behind? Six scripts and three docs looked like VM work and were already on\n      home.\n- [ ] Are there staged **deletions**? 21 deletions under `skills\u002Fmicrosoft-foundry\u002F`\n      were an import artifact, not a decision. Syncing would have deleted live files.\n- [ ] Exclude cache and residue: `.venv\u002F`, `out\u002F`, `__pycache__\u002F`, browser profiles.\n\n`scripts\u002Fsync-from-live.ps1 -Drift` reports live-vs-repo drift for the synced trees\n(`rules`, `agents`, `commands`, `hooks`, `.agents\u002Fskills`). Advisory only.\n\n**Known gap:** `rules\u002F` and `backups\u002F` are gitignored repo-wide with **zero**\ntracked files, so anything there is unversioned and dies with the machine.\nForce-add deliberately (`git add -f`) until that is decided.\n\n---\n\n## Always push\n\nA commit that is not pushed is a commit that can be lost. The `cursor\u002F*` branches\nare the proof: real progress that was never pushed and is now gone.\n\nThis is enforced mechanically, not by remembering:\n\n```\npwsh -File scripts\u002Finstall-autopush.ps1            # install (idempotent)\npwsh -File scripts\u002Finstall-autopush.ps1 -WhatIf    # dry run\nsh   scripts\u002Ftest_autopush.sh                      # 9 controls\n```\n\n`scripts\u002Fgit-hooks\u002Fpost-commit-autopush` pushes every commit the moment it is made.\n\n| Property | Why |\n|---|---|\n| **Fails open** | A push failure never fails the commit. A blocked commit is strictly worse than an unpushed one — the work would not exist at all. |\n| **Loud on failure** | Writes to stderr and `~\u002F.agents\u002Flogs\u002Fautopush.log`. A repo that quietly stopped pushing is visible, not assumed fine. |\n| **Never `--force`, never `--no-verify`** | Those stay refused by `estate-deny-guard`; the hook must not route around it. |\n| **Skips mid-rebase \u002F detached HEAD** | Pushing then publishes a half-finished tree. Note `MERGE_HEAD` is NOT a usable marker — git deletes it as part of the concluding commit, so it is already gone when `post-commit` runs. |\n| **Chains, never clobbers** | An existing `post-commit` is preserved as `post-commit.pre-autopush` and run first. |\n| **Idempotent** | Detects itself via the `AUTOPUSH-HOOK-MARKER` line in the hook body. |\n\nOpt out for one command: `GIT_AUTOPUSH_OFF=1 git commit ...` — and say why.\n\n### Corollary: do not delete remote branches to tidy up\n\nA remote branch may hold the only copy of work nobody merged. Before proposing any\nprune, measure `ahead_by` per branch (`gh api repos\u002F{owner}\u002F{repo}\u002Fcompare\u002F{base}...{head}`)\nand report the actual ratio. \"It looks like agent residue\" is a hypothesis, not a\nfinding — and on this estate that hypothesis has already been wrong once.\n\n---\n\n## VM-side link restoration (runbook, executed and verified 2026-09-30)\n\nWhen the VM half of the bilateral link is down, restore per this order (all\nelevated; every step verified by its output):\n\n1. **Deploy the home key** `home_to_vm@desktop-a60s9gp` into BOTH\n   `$env:USERPROFILE\\.ssh\u0007uthorized_keys` AND\n   `C:\\ProgramData\\ssh\u0007dministrators_authorized_keys` — the admin file is the\n   one Windows OpenSSH actually reads for admin users; deploying to the user\n   file alone silently fails. Then `icacls \u003Cadminfile> \u002Finheritance:r \u002Fgrant\n   Administrators:F \u002Fgrant SYSTEM:F` and `Restart-Service sshd`.\n2. **Start the VM serve**: `C:\\ProgramData\u000bm-link\\serve.cmd` exists by design\n   (rclone sftp, C: on :2022 \u002F D: on :2023, bound to the Tailscale IP only —\n   never 0.0.0.0). Run it; verify listeners on `100.117.115.55:2022\u002F2023`.\n3. **Persist**: scheduled tasks `vm-link-serve` (boot) + `vm-link-serve-logon`\n   (logon), SYSTEM\u002Fhighest, ExecutionTimeLimit zero, 3x auto-restart;\n   sshd + WinRM StartupType Automatic.\n4. **Anti-reap**: `rclone` MUST be in `reap_orphan_mcp.ps1`'s `$whitelist` —\n   the serve is detached-by-design (dead parent) and the reaper kills that\n   shape. Verify with a `-WhatIfOnly` run showing would-kill 0.\n\n## Diagnosing \"link down\": standby vs misconfiguration\n\nTwo rules learned the hard way (2026-09-30):\n\n- **A local self-test to your own Tailscale IP is not evidence.** Hairpin\n  connects time out on Windows+Tailscale even when serving is perfectly healthy.\n  Only a cross-machine test decides.\n- **`tailscale status` showing the peer `active; relay` with\n  `tailscale ping` timing out and all TCP closed = the peer machine is in\n  Windows standby**, not misconfigured. Its tailscaled keeps the session alive\n  via relay heartbeat while the network stack sleeps. Wait for wake; do not\n  touch config. (Distinguishing signal vs a config fault: standby kills ICMP\n  *and* every port including previously-verified ones like 22\u002F3389.)\n\n## Third surface: the ovido4 mirror\n\nThe estate has TWO mirror surfaces — a **VM-level 1:1 mirror** (GCP machine image,\nexecuted 2026-10-01) and a **repo-level git mirror** (staged, awaiting token).\n\n### VM-level 1:1 mirror (GCP machine image — the Macrium equivalent)\n\n`offload-mirror` in ovido4's project (`project-90b4a09f-be6f-4040-a6c`) is a\nbyte-identical clone of `offload-w2025` created via GCP machine image. Full\nrunbook: `estates\u002Foffload-w2025\u002F2026-09-30-link-and-mirror\u002FMIRROR-RUNBOOK.md`.\n\n**The three blockers and their fixes** (so nobody rediscovers them):\n\n1. **Billing write-block is account-specific**: `BILLING_DISABLED` on GCP\n   writes affects ovido4@gmail.com but NOT prekzursil1993 (roles\u002Fowner), even\n   on the same project. Switch account to do writes.\n2. **Global CPU quota**: `CPUS_ALL_REGIONS` limit=12 per project; a 12-vCPU\n   VM consumes it all. Cannot co-locate a second instance in the same project.\n   Deploy to the other project instead.\n3. **Cross-project service account**: machine image inherits the SOURCE\n   project's SA; target account lacks `iam.serviceAccountUser` on it. Fix:\n   pass `--service-account=\u003Ctarget-project-number>-compute@developer.gserviceaccount.com`\n   explicitly on `instances create`.\n\n**What NOT to use**: wbadmin\u002FWindows Server Backup (requires feature install\nreboot); GCP metadata SSH key deploy (no compute-accounts-daemon on custom\nimages). Use `reset-windows-password` + paramiko for initial access instead.\n\n**The working sequence**:\n```bash\n# 1. snapshot + image (as prekzursil1993, source project)\ngcloud compute machine-images create mirror-full-YYYYMMDD \\\n  --source-instance=offload-w2025 --source-instance-zone=europe-central2-a \\\n  --project=webcoder-462916 --storage-location=europe-central2\n\n# 2. deploy (as ovido4, target project)\ngcloud compute instances create offload-mirror \\\n  --source-machine-image=projects\u002Fwebcoder-462916\u002Fglobal\u002FmachineImages\u002Fmirror-full-YYYYMMDD \\\n  --zone=europe-central2-a --project=project-90b4a09f-be6f-4040-a6c \\\n  --machine-type=n2-custom-12-98304 \\\n  --service-account=\u003Ctarget-SA> --scopes=default\n\n# 3. access\ngcloud compute reset-windows-password offload-mirror --user=prekzursil ...\n# then paramiko password-login → deploy SSH key → key auth\n```\n\n### Repo-level git mirror (staged)\n\nA git `push --mirror` snapshot of the vault repo. Staged at\n`D:\\opt\\vault\\mirror-push\\agent-skills-toolchain.git` (bare clone, all refs)\nwith `push-mirror-to-ovido4.sh` — one command once an ovido4 GitHub token is\nprovided. No ovido4 GitHub credential exists on the VM or in the vault env\nbackups (all three stored tokens are Prekzursil) — the token must come from\nhome or be minted.\n\n### Mirror-pending convention\n\nWhen the primary link is down, session deltas accumulate as\n`D:\\opt\\vault\\mirror-pending\\\u003Cdate>.tar.gz` and drain via\n`D:\\opt\\scripts\\push-home-mirror.ps1` (which self-reports the exact wake-side\nfix if home is unreachable).\n\n---\n\n## Related\n\n- `knowledge\u002FOPEN-LOOPS.md` — the live register; nothing closes without evidence\n- `knowledge\u002Fpolicy\u002F2026-09-24-private-estate-plaintext.md` — credential policy SSOT\n- `scripts\u002Festate-deny-guard.py` and `scripts\u002Ftest_estate_deny_guard.py` — the\n  guard and its 11-case suite\n",{"name":5,"description":7},"main","a298c929b6cbd662e1fce54302ce520d5ceea1a5",".agents\u002Fskills\u002Festate-sync","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain","https:\u002F\u002Fgithub.com\u002FPrekzursil","2026-11-02 14:30:57",{"source":8,"skillName":5,"commands":45,"prompt":55,"zipAvailable":56},[46,49,52],{"tool":47,"command":48},"npx","npx skills add Prekzursil\u002Fagent-skills-toolchain --skill estate-sync",{"tool":50,"command":51},"bunx","bunx skills add Prekzursil\u002Fagent-skills-toolchain --skill estate-sync",{"tool":53,"command":54},"pnpm","pnpm dlx skills add Prekzursil\u002Fagent-skills-toolchain --skill estate-sync","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Festate-sync\u002FSKILL.md",true,[],[59,78,109,136,150,165],{"skillNo":60,"name":61,"nameZh":6,"description":62,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":63,"categories":64,"keywords":65,"publishedAt":33},"01M6DF7D7478R55P46REYH4QAC","clarify-requirements","Resolve genuine pre-execution ambiguity by scanning repo context, generating 1-6 grounded options, and asking 1-3 focused questions via AskUserQuestion. NOT for mid-task use (injection risk); NOT when the goal is already unambiguous; use to disambiguate vague prompts before any file edits.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fworkspace-hooks\u002Fskills\u002Fclarify-requirements\u002FSKILL.md",[],[66,67,68,69,70,71,72,73,74,28,75,27,76,77,24],"clarify requirements","clarify","requirements","risk","options","task","prompts","goal","scanning","context","injection","execution",{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":89,"publishedAt":33},"01M6DF79CA4BHJS66J8EZDBPWJ","openmm-md","Run FREE, open-source, Windows-native GPU molecular dynamics via the openmm-md MCP (OpenMM + CUDA on the local NVIDIA GPU). Use for protein \u002F protein-ligand MD when you want a free stack or are on Windows without a Schrodinger license. Covers the full workflow (prepare, solvate, minimize, equilibrate, production, analyze, mmgbsa) AND an honest decision guide vs Schrodinger Desmond, including how to run Desmond legitimately on Linux or a cloud GPU with a real license. This is a deliberately LESSER free alternative and does NOT replace the schrodinger MCP tools. Do NOT use it to pick a free tool when a validated FEP+, WaterMap, IFD-MD, or Prime MM-GBSA result is actually required.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fmcp\u002Fopenmm-md-mcp\u002Fskill\u002Fopenmm-md\u002FSKILL.md",[84],{"categoryNo":85,"categoryName":86,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[90,91,92,93,94,95,96,97,98,99,100,101,102,103,28,104,105,106,107,108],"openmm md","how","decision","pick","linux","analyze","tool","stack","open","NVIDIA","gpu","license","workflow","windows","free","molecular dynamics","local","do","MCP",{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":121,"publishedAt":33},"01M6DF76C1MG85VEWP8VZCBNMN","visual-review","Take screenshots of web pages and UI using Playwright for visual review and iteration","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fvisual-review\u002FSKILL.md",[115,118],{"categoryNo":116,"categoryName":117,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":119,"categoryName":120,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000008","测试与质量",[122,123,124,125,126,127,128,129,130,131,91,132,133,134,135],"review","visual","visual review","pages","web","false","iteration","take","check","slides","ui","screenshot","playwright","screenshots",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":33},"01M6DF73AQVCBZKEN0YXEX9FXP","status","Diagnostic status report — shows metaswarm installation state, project setup, and potential issues","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstatus\u002FSKILL.md",[],[138,143,144,145,146,147,148,149],"setup","report","project","installation","project setup","issues","state",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":157,"publishedAt":33},"01M6DF6X6C2XB0P6GX76P7TTYV","start","Use when starting work on any task, when the user mentions metaswarm, or when the user wants to begin tracked development work","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstart\u002FSKILL.md",[156],{"categoryNo":85,"categoryName":86,"taxonomyType":87,"taxonomyTypeDesc":88},[152,158,71,159,160,161,28,162,26,163,164],"start issue","issue","ready","work on issue","user","work on","development",{"skillNo":166,"name":143,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":170,"publishedAt":33},"01M6DF6QMJ9AJKFKHHKRT005PQ","Interactive project setup — detects your project, configures metaswarm, writes project-local files","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fsetup\u002FSKILL.md",[],[143,145,106,171,147,172],"files","interactive"]