- Add users.groups.devs for shared resources
- dev-add: check devs group exists before creating user
- dev-add: use .profile for login shell PATH setup
- dev-add: configure npm prefix and .npm-global directory
- dev-add: create AGENTS.md with friendly capability guide
- Update onboarding message with npm install examples
- Add docs/server-AGENTS.md for reference
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- egress-watchdog: Use process substitution to avoid subshell gotcha
- killswitch: Rename USER to TARGET_USER (avoid shadowing builtin)
- Add documentation comments for UID range and grep -P dependency
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Monitors EGRESS-LIMIT kernel log entries, tracks strikes per user,
triggers killswitch after 3 consecutive violations within a minute.
Runs every minute via systemd timer.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Kills all processes for a user
- Terminates login session
- Logs to syslog with reason
- Refuses to kill system users (uid < 1000)
- Closes ops-jrz1-396
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- docs/security-posture.md: Threat model, risk assessment, recommendations
- Make home directories private (chmod 700)
- Update learner-add.sh to create private homes
- Closes ops-jrz1-k2a
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove manual /usr/local/bin/claude install
- Remove claude symlink setup from learner-add.sh
- Update onboarding docs with npm install instructions
- Users choose their AI coder: claude, opencode, gemini, codex
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Install claude binary to /usr/local/bin
- Symlink to ~/.local/bin for users (in PATH)
- Update learner-add.sh to set up symlink for new users
- Add /usr/local/bin to PATH via shellInit
- learner-add.sh: add users to learners group, source Slack env
- New design doc comparing direct Slack vs maubot/Matrix approach
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Use 'users' group instead of per-user groups
- Remove shell specification (NixOS has different paths)
- Use 'ip' command instead of 'hostname -I' for IP detection
