# 2026-02-08 Evening Session Notes

## Product Consolidation — COMPLETE ✅
- All 32 product repos pushed to GitHub under `symphco/product-*`
- KYB and travel-planning pushed via HTTPS (SSH kept timing out on large repos)
- Finance-operating-system (227MB) finally pushed via SSH with keepalive settings
- Fixed ai-teacher-assistant remote URLs, committed new changes
- Fixed 3 repos that got switched to HTTPS during debugging — reverted to SSH
- TOOLS.md and MEMORY.md updated with new consolidated paths
- bootstrap.sh was already created earlier

## Security Incident
- Found 2 suspicious processes running from `/dev/shm/` (randomized names: `de7RHw1c`, `odwa3Wb`)
- PID 2039: 1464% CPU, 2.4GB RAM, 22 threads — classic cryptominer pattern
- PID 2018: 18% CPU companion process
- Both killed and binaries deleted from `/dev/shm/`
- **Mistake:** Deleted evidence before analyzing (should have run `strings`, `file`, checked network connections first)
- No persistence found (no crontabs, no systemd services, no .bashrc tampering)
- `/dev/shm/` doesn't survive reboots
- **Root cause likely:** UFW firewall is inactive, SSH password auth probably enabled
- Added suspicious process check to HEARTBEAT.md — reports to Raven via DM, does NOT auto-kill

## VPS Security Audit Findings
- **UFW inactive** — all ports exposed to internet
- **SSH password auth** likely enabled (default)
- **Ports 3001, 3003, 4000** directly exposed (should be behind Caddy only)
- **Port 631 (CUPS)** open for no reason
- **Discord groupPolicy "open"** with elevated tools — OpenClaw security audit flagged 3 criticals
- Auto security updates ARE enabled ✅
- Raven aware but hasn't asked to proceed with hardening yet

## Symph Agency UI Changes
1. **Port-based app management** — Removed `.aria-pids.json` dependency from start/stop/status API routes. Pure port-based using `lsof -ti :PORT` + `caddy-ports.json` as single source of truth.
2. **Universal Chat** — "Talk to ARIA" floating button on all pages (not product phase pages — PhaseChat handles those). Stores chats in `agency/chats/<context>/chat.yaml`. Creates jobs + wakes ARIA.
3. **Chat thinking indicator** — Animated dots + "ARIA is thinking..." after sending. Faster polling (3s) while waiting for reply.
4. **Roadmap YAML backend** — Migrated 54 items from ROADMAP.md parsing to `agency/roadmap.yaml`. Full CRUD API (GET/POST/PUT/DELETE).
5. **Roadmap drag & drop** — Cards draggable between Backlog/In Progress/Done columns with optimistic updates.
6. **Roadmap card detail** — Click card → slide-over panel with editable notes + Save button.
7. **Escape key support** — Added to roadmap detail panel, universal chat, and all sales page modals (DealDrawer, AddDealModal, ImportModal).

## Skills Installed
- `clawhub` CLI installed globally via npm
- `qmd` skill installed from ClawHub to `skills/qmd/`
- `qmd` CLI installed (requires Bun, also installed)
- Bun added to PATH in .bashrc/.zshrc
- Raven said to stop — has another way to install it

## Key Learnings
- **Hetzner "shared resources"** means shared physical CPU cores, NOT shared process space. Other tenants' processes never appear in your VPS.
- **`openclaw security audit`** only checks OpenClaw config (Discord policies, elevated tools, etc.) — does NOT check OS-level security (firewall, SSH, ports)
- **clawhub CLI:** `npm i -g clawhub`, then `clawhub search "query"`, `clawhub install <slug>`
- **qmd requires Bun** — not just Node.js
