Erich Blume db0512b5d4 Doc review: 5 stalest cards; scale back ai-docs rule; document heph CLI (#373 )

## Doc review (5 stalest, all never-reviewed)

Each card was verified against live state (ArgoCD app list/health, manifests, 1Password item fields, Mealie API probe) and stamped `last-reviewed: 2026-06-09`.

| Card | Findings fixed |
|------|----------------|
| `reference/services/argocd.md` | Added Authentik SSO (public PKCE client, `--sso` login, admins→role:admin RBAC); documented dual-cluster management (minikube + ringtail k3s at `ringtail.tail8d86e.ts.net:6443`); corrected sync policy — the `apps` root is **manual**, not automated |
| `reference/services/authentik.md` | Blueprint list grown from 5 to 10 files; OIDC client table now lists all 8 clients with types; secrets table updated to `postgresql-*` fields and per-client secrets |
| `reference/services/grafana.md` | TeslaMate datasource moved to `pg.ops.eblu.me:5434` (ringtail); dashboard inventory refreshed (20 provisioned ConfigMaps); TeslaMate dashboards documented as init-container fetch from forge mirror at pinned tag; SSO role mapping wording corrected (Admin only for `admins` group) |
| `reference/infrastructure/unifi.md` | UnPoller image is now locally built (`registry.ops.eblu.me/blumeops/unpoller`); verified namespace/port |
| `how-to/mealie/plan-a-meal.md` | Procedure verified; **found the stored API token (`op://blumeops/mealie/credential`) returns 401** — operational fix in progress, doc content unchanged |

## AGENTS.md

- **Scaled back the ai-docs rule** (per discussion): agents now start by finding and reading relevant docs; `mise run ai-docs` (~130K tokens now) and `ai-sources` become opt-in bulk loads. `agent-change-process.md` updated to match. The `ai-docs` mise task itself is kept for now — happy to retire it in a follow-up if desired.
- **Documented the heph CLI** task workflow (list/show/context/log read paths; done/drop/skip/log/edit/task write paths) so future sessions can read and manipulate Blumeops tasks without rediscovery.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #373

2026-06-09 16:05:01 -07:00

3.5 KiB

Raw Blame History

title

modified

Mise Tasks

Operational tasks for BlumeOps, run via mise run <task>. Tasks live in mise-tasks/ and use #USAGE directives for argument parsing.

Run mise tasks --sort name for the live list with descriptions.

AI & Documentation

Task	Description
`ai-sources`	All non-doc source files for deep AI context (~270K tokens)
`docs-check-frontmatter`	Check required frontmatter fields
`docs-check-links`	Validate wiki-links resolve correctly (supports path-based links)
`docs-mikado`	View active Mikado dependency chains (C2 changes)
`docs-review`	Review the most stale doc by `last-reviewed` date
`docs-review-stale`	Report docs by last-modified date
`docs-review-tags`	Print frontmatter tag inventory

Deployment & Provisioning

Task	Description
`provision-indri`	Run Ansible playbook for indri
`provision-ringtail`	Run Ansible playbook for ringtail (NixOS)
`provision-sifaka`	Run Ansible playbook for sifaka
`fly-deploy`	Deploy Fly.io public proxy (uses op for auth)
`fly-reload`	Reload nginx config, re-resolve upstream DNS (no redeploy)
`fly-setup`	One-time Fly.io secrets and certs setup
`fly-shutoff`	Emergency shutoff: stop all Fly.io proxy machines
`dns-preview`	Preview DNS changes with pulumi
`dns-up`	Apply DNS changes with pulumi
`dns-acme-cleanup`	Delete orphaned `_acme-challenge.ops` TXT records (libdns/gandi v1.1.0 workaround)
`tailnet-preview`	Preview Tailscale ACL changes with pulumi
`tailnet-up`	Apply Tailscale ACL changes with pulumi

Containers & Registry

Task	Description
`container-list`	List containers and their recent tags
`container-build-and-release`	Trigger container build workflows via Forgejo API
`container-version-check`	Validate version consistency across container.py, Dockerfiles, nix, and manifests
`mirror-create`	Create an upstream mirror in the `mirrors/` Forgejo org
`mirror-update-pats`	Update GitHub PAT on all mirror repos on indri

Git & Forge

Task	Description
`branch-cleanup`	Delete merged branches (local and remote)
`pr-comments`	List unresolved PR comments
`runner-logs`	List Forgejo Actions runs and fetch job logs (supports `--repo`, `--limit`)
`validate-workflows`	Validate workflow files against runner schema
`mikado-branch-invariant-check`	Validate Mikado Branch Invariant on `mikado/*` branches

Operations & Monitoring

Task	Description
`services-check`	Check all services are online and responding
`service-review`	Review the most stale service for version freshness
`op-backup`	Encrypt 1Password export and send to indri for borgmatic

Infrastructure Setup

Task	Description
`ensure-minikube-indri-kubectl-config`	Set up kubectl config for minikube-indri
`ensure-k3s-ringtail-kubectl-config`	Set up kubectl config for k3s-ringtail

ML & Hardware

Task	Description
`frigate-export-model`	Export YOLOv9 model weights to ONNX via dagger

dagger — CI/CD build engine (containers, docs)
ansible — Configuration management
argocd-cli — ArgoCD deployment workflows
pulumi — DNS and Tailscale IaC
qart-tuner — QR code art generator (utils/qart/)

3.5 KiB Raw Blame History