# 2026-02-08

## Product Consolidation — Major Migration Day

### Phase 1 (Complete)
- Stopped PM2 apps (gala-grid, sthics, garagepro)
- Moved caddy-ports.json to workspace (git-backed)
- Created products-registry.yaml
- Updated all Symph Agency code paths (workspace.ts, API routes)
- Updated caddy-manager skill

### Phase 2 — GitHub Product Repos (Mostly Complete)
- Created 32 `symphco/product-*` GitHub repos
- All 9 products with apps: git submodule setup done
- Push status:
  - **Pushed successfully (29):** ai-teacher-assistant, dailymood-journal, event-creation-event-suppliers, motor-vehicle-maintenance, sthics, condominium-subdivision-management, + all small discovery-only products
  - **Still pushing (3):** travel-planning, kyb-compliance, finance-operating-system (large design assets, slow SSH upload)

### Phase 3+ (TODO)
- Verify all pushes complete
- Update PM2 configs for remaining apps
- bootstrap.sh created for disaster recovery
- Cleanup old projects/ dirs (already clean)

### AI Teacher Assistant 502 Fix
- App was down due to missing .next build (cleared during migration)
- Rebuilt and started via PM2 on port 3003
- Added to PM2 with new product path

### Key Insight
- Git push over SSH is SLOW for repos with large design assets (4-5MB PNGs)
- ~1MB/min upload speed to GitHub
- Some pushes fail silently — need to verify with `gh api` or `git ls-remote`
- nohup needed for long pushes to survive exec timeouts

---

## 🚨 Cryptominer Incident
- Found two processes in `/dev/shm/`: `de7RHw1c` (PID 2039, 1464% CPU) and `odwa3Wb` (PID 2018)
- Also `/dev/shm/lrt` directory with miner files
- Killed processes, deleted files — CPU dropped from 97% to 5%
- **Mistake:** Should have inspected binaries before deleting (lost forensic evidence)
- No persistence found (no crontabs, no systemd timers, no .bashrc hooks)
- Likely entry via exposed Node.js ports (3001, 3003 etc.) or SSH password auth

## VPS Security Audit Results
- **Firewall:** OFF (ufw inactive) — NEEDS HARDENING
- **SSH:** Password auth likely enabled (default) — needs key-only
- **Exposed ports:** 22, 80, 443, 3001, 3003, 4000, 631 (CUPS)
- **OpenClaw:** Discord groupPolicy="open" — needs allowlist
- Auto security updates: enabled ✅
- Added suspicious process monitoring to HEARTBEAT.md

## App Management: Pure Port-Based
- Removed `.aria-pids.json` entirely
- `caddy-ports.json` is single source of truth
- All start/stop/status API routes use `lsof -ti :PORT`
- Committed and deployed

## Symph Agency UI Features Built Today
- **Universal Chat**: Floating "Talk to ARIA" on all system pages, stored in `agency/chats/<context>/chat.yaml`, includes thinking indicator
- **Roadmap YAML backend**: Migrated 54 items from ROADMAP.md to `agency/roadmap.yaml`, drag-drop kanban with detail panel
- **Agents page**: Hide completed >1hr, show last message
- **Chat Logs pagination**: Server-side 25/page with lazy load
- **Inbox dismiss**: DELETE endpoint with hover X button

## TODO (Carried Forward)
- [ ] VPS security hardening (UFW, SSH key-only, bind Node to 127.0.0.1, close CUPS)
- [ ] Verify 3 remaining large repo pushes (travel-planning, kyb-compliance, finance-operating-system)
- [ ] Consolidation Phases 3-8 (PM2 paths, workspace refs, verify, cleanup)
- [ ] Re-auth Claude Code (`claude /login` in browser)
- [ ] GaragePro Phase 2 feature agents
