claude
c0f4074a5d
Nineteen of the twenty findings were open, and they lived in an untracked audit.md at the repo root that no next session would have read. The one that is closed, the unauthenticated mavgpud proxy, went out as V-673. The report is now a frozen measurement under docs/evals/, dated and never edited again — including when a finding it names gets fixed. The live state moved to docs/caveats/, one entry per limit, each carrying its Vikunja id and the condition that makes it worth fixing. A caveat with no revisit trigger is a complaint, so every entry has one. Closing a limit deletes its entry rather than editing the measurement that found it. Two directory indexes come with it. docs/CLAUDE.md states the tier rule the repo already followed by convention: living docs corrected in place, evals frozen by date, caveats deleted when fixed. docs/caveats/CLAUDE.md indexes the nineteen by claim and severity, because an index of filenames adds nothing a directory listing does not. Tasks V-675 through V-693 carry the plans. The doc line and the tracker now join in both directions. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ESv8hqNPseYt1CnotZpqDz
1.1 KiB
Configuration and environment
Committed absolute paths pin the build to this box [#690]
Costs: go.mod replaces Hexis with /home/kami/apps/hexis, start-maven.sh
hardcodes the checkout and the data directory, and deploy/mavgpud.json holds
workstation model and Python paths. Vendoring hides the go.mod problem for an
ordinary build. -mod=mod, go mod tidy and a fresh checkout all fail.
Revisit when: anyone clones this repo elsewhere, or a tidy is needed.
Workaround: build only from this checkout, with the vendor directory.
The env example omits deployed variables [#691]
Costs: a fresh deploy can lose remote speech-to-text or ambient authentication
and run on fallback behaviour with an apparently valid config. Three variables
are referenced and undocumented: MAVEN_STT_TOKEN, MAVEN_AMBIENT_TOKEN and
CW2_TOKEN. V-673 added MAVEN_GPU_TOKEN to the example.
It is not silent. The loader logs which variables were unset and says whatever
they configure is off. What is missing is a startup failure.
Revisit when: the box is redeployed from scratch, or a new secret is added.
Workaround: read that log line at startup.