git:20261001.5946cd2 to git:20261005.6f6c4f2

1 added, 1 removed. Audit A to A.

# devops-tools Plugin

> DevOps automation: ClickHouse, Doppler, MLflow, Cloudflare Workers, pueue, secrets management, self-hosted services.

**Hub**: [Root CLAUDE.md](../../CLAUDE.md) | **Sibling**: [itp-hooks CLAUDE.md](../itp-hooks/CLAUDE.md)

## Secrets Management

**Self-Custody Secrets first.** Store and read secrets through the operator's own stores, starting with the `vault` CLI (`vault get|set|run`), which wraps the macOS Keychain, SOPS/age backup and the manifest. 1Password is the last resort, for company-shared items only and never client-confidential ones. The full ladder is injected by `userpromptsubmit-1password-context-injection.sh` whenever a prompt mentions credentials, so it is not repeated here.

- **Company-shared 1Password items** use the service account (Claude Automation vault). Setup and the proxy caveat: [onep-credential-setup.md](./skills/cloudflare-workers-publish/references/onep-credential-setup.md).

- **Doppler** projects: `Skill(devops-tools:doppler-secret-validation)` | `Skill(itp:pypi-doppler)`.

## Self-Hosted Services

Services run on two GPU workstations: **gpu-host-1** (RTX 4090) for primary compute, **gpu-host-2** (RTX 2080 Ti) for secondary workloads. Access via Tailscale (primary) with Cloudflare Access SSH as the fallback — see the SSoT, [ssh-tunnel-companion/CLAUDE.md](../ssh-tunnel-companion/CLAUDE.md). **ZeroTier is gone** (removed 2026-04-06, macOS kernel-extension fragility); this line advertised it as a "legacy fallback" until 2026-09-05, contradicting its own linked SSoT.

| ---------- | ---------- | ---- | --------------- | ------------------------------------------------- |

> Do not add a self-hosted Firecrawl here. It ran on gpu-host-2:3002 until 2026-08-13 and was retired for the public API at `https://api.firecrawl.dev` — see `Skill(devops-tools:firecrawl-research-patterns)`.

**ClickHouse (gpu-host-1)**: Range bar data with 47 microstructure features (260M+ bars). Used by `rangebar-py` package. ClickHouse listens on localhost only — access via SSH tunnel (rangebar preflight handles automatically).

```bash

# Env vars (export per-project, e.g. from a gitignored .env):

RANGEBAR_CH_HOSTS=gpu-host-1 # SSH alias, NOT raw IP (tunnel required)

RANGEBAR_MODE=remote # Skip local ClickHouse check

# Test connectivity:

ssh gpu-host-1 "curl -s 'http://localhost:8123/?query=SELECT+1'"

```

**Network**: Tailscale primary (`ssh gpu-host-1`), Cloudflare Access fallback (`ssh gpu-host-1-cf`). See [ssh-tunnel-companion CLAUDE.md](../ssh-tunnel-companion/CLAUDE.md).

## Skills

- [agentic-process-monitor](./skills/agentic-process-monitor/SKILL.md)

- [claude-code-proxy-patterns](./skills/claude-code-proxy-patterns/SKILL.md)

- [clickhouse-cloud-management](./skills/clickhouse-cloud-management/SKILL.md)

- [clickhouse-pydantic-config](./skills/clickhouse-pydantic-config/SKILL.md)

- [cloudflare-workers-publish](./skills/cloudflare-workers-publish/SKILL.md)

- [disk-hygiene](./skills/disk-hygiene/SKILL.md)

- [distributed-job-safety](./skills/distributed-job-safety/SKILL.md)

- [doppler-secret-validation](./skills/doppler-secret-validation/SKILL.md)

- [doppler-workflows](./skills/doppler-workflows/SKILL.md)

- [dual-channel-watchexec](./skills/dual-channel-watchexec/SKILL.md)

- [firecrawl-research-patterns](./skills/firecrawl-research-patterns/SKILL.md)

- [macbook-desktop-mode](./skills/macbook-desktop-mode/SKILL.md)

- [ml-data-pipeline-architecture](./skills/ml-data-pipeline-architecture/SKILL.md)

- [ml-failfast-validation](./skills/ml-failfast-validation/SKILL.md)

- [mlflow-python](./skills/mlflow-python/SKILL.md)

- [project-directory-migration](./skills/project-directory-migration/SKILL.md)

- [pueue-job-orchestration](./skills/pueue-job-orchestration/SKILL.md)

- [macos-fda-grant-helper](./skills/macos-fda-grant-helper/SKILL.md) — interactive Full Disk Access (FDA) grant walkthrough for launchd-spawned binaries (iter 21)

- Pushover notifications **moved 2026-06-05** to the dedicated [`pushover-commander`](../pushover-commander/CLAUDE.md) plugin (send, emergency, headless app/sound management, incident-report rendering, UUID/JSONL verbatim audit). The former `pushover-verbatim-notify` skill is now `pushover-commander:verbatim-audit-notify`.

- [python-logging-best-practices](./skills/python-logging-best-practices/SKILL.md)

- [python-memory-safe-scripts](./skills/python-memory-safe-scripts/SKILL.md)

- [session-chronicle](./skills/session-chronicle/SKILL.md)

- [session-debrief](./skills/session-debrief/SKILL.md)

- [session-recovery](./skills/session-recovery/SKILL.md)

- [worktree-manager](./skills/worktree-manager/SKILL.md)

## Hooks

| ------------------------------------------------- | ---------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

- | `posttooluse-crown-jewel-plain-keychain-nudge.sh` | PostToolUse | Bash | Nudges crown-jewel `security add-generic-password … -T /usr/bin/security` toward the Touch-ID-gated tier (`vault set --gated`); escape hatch `CROWN-JEWEL-PLAIN-OK` |

+ | `posttooluse-crown-jewel-plain-keychain-nudge.sh` | PostToolUse | Bash | Nudges crown-jewel `security add-generic-password … -T /usr/bin/security` toward a crown-strict vault scope (Secure Enclave + offline recovery key, never in the plain Keychain); escape hatch `CROWN-JEWEL-PLAIN-OK` |

### Credential hooks

`userpromptsubmit-1password-context-injection.sh` injects the Self-Custody Secrets ladder when a prompt mentions credentials. `posttooluse-1password-pattern-reminder.sh` reminds after an `op` command that 1Password is the last resort, and skips meta commands (`op --version`, `signin`, `account list`). Their stdout is the SSoT for the wording.