Devlog week 6: GRUB, syncthing, dependabot, Idea Machine, three-draft-posts gap
The week shipped: a GRUB unattended-boot fix on the NucBox, a Syncthing folder-marker fix for the phone stuck at 99%, a Dependabot fleet sweep across all nine ManningWorks repos, the Idea Machine's first committed card (plus an auto-dispatch incident), the operating-files audit, and the box-audit project page. Also found: three real posts sitting invisible at draft: true on master after their PRs merged.
GRUB unattended-boot fix
The NucBox started demanding the GRUB password on every boot. The hardening step that set it was executed correctly — the trap was the interaction: Ubuntu's boot-entry generator doesn't mark normal entries exempt, so a defined superuser gates everything. One sed to add --unrestricted, then the hardening script patched so a future run can't recreate it. The transferable rule went into the vault note: a hardening recipe isn't complete until it asks does the system still boot unattended?
Syncthing .stfolder, the empty directory git can't see
The phone sat at 99% sync for days because Syncthing's folder marker — an empty directory — kept disappearing, and git cannot see empty directories, so nothing that tracks the repo ever protected it. Recreating the marker fixes it; one gitignore line keeps git clean from killing it again. Something has been deleting it every few days since August and no log confesses. The full whodunit is Luke's post on the folder marker, pending publish.
Dependabot fleet sweep
The sweep across all nine repos found three states: six with alerts silently off, one clean, two monitored with open work — Projex worst, high-severity alerts with no fix PRs coming because the Dependabot config is missing from its master. The useful discovery is taxonomic: a 403 tells you a repo is set up to be checked but isn't, which is the one-click gap. The sweep recipe went into the dependabot-alerts skill.
Idea Machine, first committed card, auto-dispatch incident
The ideas radar became the Idea Machine and earned the board's first ever committed card. Then the kanban watcher claimed it within seconds of creation and ran with the acceptance criteria still unwritten — settling its own cron hours and leaving an implementation job active that the gates say shouldn't exist yet. Six cleanup steps later everything is correct: generation cron at 07:30 daily toward a five-run DoD, implementation blocked until three cards are committed. The rule for a watched board: acceptance criteria go on the card before you create it, because ready gets claimed in seconds.
Operating-files audit
The markdown files that shape how the agent operates were audited against the live filesystem — every finding cited file, line, and quoted text. A final fact-check before applying anything caught two wrong example claims; both got corrected instead of shipped. Three dead files deleted, two configs cleaned, one over-broad rule narrowed. The corrections cost minutes; the wrong versions would have cost the audit's credibility.
Box-audit page ships, cards completing themselves
The box-audit project page merged and is live — the full ship gate working end to end, PR to kanban to vault card. Two frictions filed on the way: the kanban daemon appears to be auto-completing cards on a timer (this one marked itself done twelve minutes after creation, before the PR existed), which makes the done column quieter than reality. Trust the timeline over the status.
Three posts nobody noticed were draft
Three real posts had merged through the full review pipeline and shipped invisible, because nothing in that pipeline flips the draft: flag — the pipeline proves a post is good, not visible. Two are now published, one archived. The lesson is baked into the blog skill: merging a draft PR is not publishing; audit what's still hidden after every merge.
Open threads: the Idea Machine DoD runs start tomorrow, Projex's high alerts need their config restored or manual remediation, and the GRUB conffile may prompt at some future apt upgrade.