HA runtime template contexts (shell_command {{ }} rendering) cannot read
secrets.yaml; kuma_push_url rendered undefined every fire and the Kuma
push dead-man never sent a beat. Move the full curl command into the
secret (kuma_heartbeat_cmd) and reference it with !secret, which is
substituted at config parse where secrets work.
On-box fix applied + verified under GLPI CR 21; this commit makes the
git copy match the deployed state.
Ticket: https://projects.knownelement.com/issues/811
CR: https://cmdb.knownelement.com/front/change.form.php?id=21
Top-level 'filter:' cannot merge from packages (expected dict); the
booleans rejected 'description'. Both found live in the 12:38 deploy:
package booleans + smoothed sensors failed to materialize.
Meat: https://projects.knownelement.com/issues/344#comment
Local check_config passes (validated); CI job fails in the runner env.
Three causes already fixed (alpine-musl node mount, py3.13 floor,
checkout needs node); 4s failure needs UI job logs. Full trail in the
follow-up ticket. On-box 'ha core check' remains the release gate.
Adversarial review verdict FAIL -> addressed: runtime-low + shutdown
chain re-poll /5 min (edge-crossing could miss a page mid-outage);
suppression stamp set after notify; plan body names all 7 hosts
explicitly; test fixes (pipefail SIGPIPE, comment-only assertion).
Reviewer P1 'tripp_lite slug' refuted with live entity registry
evidence (entity_id derives from name; sensor exists, 8f48730 aligned).
On-box ha core check passed with the changed files.
Review thread: #3
Boots HA 2026.8.3 against the repo config with CI-only stub secrets;
catches bad Jinja/unknown keys/schema drift yamllint cannot see.
Meat: https://projects.knownelement.com/issues/778
HA curls status.knownelement.com push URL on a 5-min pattern; Kuma
pages the founder directly if heartbeats stop. Alert path independent
of HA itself.
https://projects.knownelement.com/issues/792
Missing/stale criticals after restart page with specifics instead of
waiting for humans; watchdog handles recovery; revert procedure
documented for repeat failures.
Watchdog notify crash root-caused: iOS companion schema rejects
data.clickAction; url is the iOS deep-link key. Suite updated to
assert url presence per alert.
https://projects.knownelement.com/issues/778
rest_command integration silently fails to register on this box
(404 services, valid config+secret; root-cause pending #741).
shell_command curl is the working mechanism; arm-switch gate unchanged.
https://projects.knownelement.com/issues/355
Role-based rework per founder: overview + detail dashboards. UPS
parity (Tripp Lite runtime-minutes template). Phase 1 of the ground-up
rework; Capacity/Access views land with fans + lock.
https://projects.knownelement.com/issues/784
Gardening pass: themes/ dir must exist for include_dir_merge_named;
scenes/scripts marked intentionally-empty; cross-repo contract pointer
to KNEL/doorman README. dev only.
https://projects.knownelement.com/issues/784
value_template must be a sibling key of condition in the action
sequence, not a continuation - reload 500 pointed at line 494.
Detail: https://projects.knownelement.com/issues/344
Recovery twin of the high-temperature alert: per-tier below-triggers
(fire-line minus 5F, held 10 min), from_state guard against restart
false-positives, peak-value reporting. Matches existing notify
targets; UPS on-battery already had its restored twin.
Detail: https://projects.knownelement.com/issues/344
Maxwell card runs in-tree nouveau on kernel 7.0.14 (no proprietary
branch supports both 7.0 and Maxwell); regex widened with a
non-capturing alternation, template downstream unchanged.
Detail: https://projects.knownelement.com/issues/763
Also absorbs PFVCluster operator tooling: tools/ha-ws-call.py and
docs/reference-packs/ (historical, NOT loaded by HA — clearly marked).
No live-config changes in this commit.
Detail: https://projects.knownelement.com/issues/762
Break-glass badges fire the relay locally on the reader host (no HA
dependency); the flagged scan still reaches HA for the audit trail
but skips re-dispatch. NOTE: deployed while pfv-bms is down — YAML
lint clean, ha core check to run at Friday boot before arming.
https://projects.knownelement.com/issues/345
Found live 2026-09-03: after reload-only deploys, webhook-triggered
automations (doorman ingest, deploy fast path) silently stop firing
while the endpoint still returns HTTP 200. Proven: core restart
restores them. Sha-watch now restarts core on every new master HEAD
(same semantics as the webhook fast path for packages/** changes).
https://projects.knownelement.com/issues/345
Live webhook test caught it: TemplateRuntimeError 'No filter named
split'. enabled_ids/holder rebuilt with row.split('|') method calls
in a namespace loop.
https://projects.knownelement.com/issues/345
Roster fetched live from KNEL/access-roster via gitea API (no git
mechanics; access-roster stays the single gated source of truth).
Known/disabled/unknown decision branches + last-scan entities.
UNLOCK deliberately not wired - pending HA->Pi control path (#741).
Validated: yamllint clean, ha core check passed on staged copy.
https://projects.knownelement.com/issues/345
subopi3 SoC idles at 117F and false-alarmed the 104F ambient bucket
at 23:15 CDT. Silicon (server CPUs, drac cpu, Pi/Jetson SoCs) now
alerts at 176F (80C pre-throttle).
Detail: https://projects.knownelement.com/issues/733
gitea got no auth (401: only signed in user) - secrets do not
concatenate. Secret now holds the full 'Bearer <token>' header.
Detail: https://projects.knownelement.com/issues/734
ic-builder
vptechops
mrcharles