chore(eod): pre-reboot cleanup and documentation update

- Add scripts/update-cli-suite.sh for Manjaro/Arch CLI tool maintenance - Update .gitignore: add logs/ and docs/tech/capabilities/ exclusions - Update CHANGELOG.md with 2026-04-02 NVMe benchmark + firmware work - Update NEXT_STEPS.md: post-reboot verification tasks for GXA7801Q
2026-04-02 14:34:00 +02:00
parent 5d770d2def
commit 8fec0802ad
4 changed files with 259 additions and 4 deletions
@@ -15,8 +15,12 @@ CLAUDE.local.md

 # Logs
 *.log
+logs/
 .rlm/logs/

+# Auto-generated capability discovery
+docs/tech/capabilities/
+
 # Dependencies
 node_modules/
 venv/
@@ -8,6 +8,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]

 ### Added
+- Comprehensive NVMe benchmark for Samsung PM9A1 before firmware update: SMART health, hdparm, fio seq/rand benchmarks (2026-04-02). See `docs/tech/nvme-benchmark-pre-gxa7802q.md`.
+- CLI suite update script `scripts/update-cli-suite.sh` for Manjaro/Arch tool maintenance (2026-04-02).
+
+### Changed
+- Samsung PM9A1 NVMe firmware update applied: GXA7401Q → GXA7801Q (non-SED variant, reboot pending to activate). All nvme-cli steps succeeded (2026-04-02).
+- Corrected firmware research: GXA7802Q is SED-only (`00B07`); non-SED drives (`00B00`) require GXA7801Q. Updated `docs/tech/firmware-update-research.md` with naming convention and correct source.
+- Updated `.gitignore`: added `logs/` and `docs/tech/capabilities/` exclusions (2026-04-02).
+
+### Added (continued)
 - Created formal stability tests report documenting the 2026-03-17 memory management improvements (2026-03-17).
 - System stability improvements: enabled `systemd-oomd` and `zswap` via Ansible (2026-03-17).
 - Memory resource limits for Firebird and Mailpit Docker containers (2026-03-17).
@@ -15,7 +24,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Integrated 16GB swap file management into Ansible roles for consistency and persistence (2026-03-17).
 - Comprehensive health report for `mw-pfeddersheim-workstation` (2026-03-09).

-### Changed
+### Changed (continued)
 - Increased system swap file size from 4GB to 16GB to prevent OOM-related system hangs (2026-03-17).
 - Updated system status in `README.md` and `docs/tech/workstation-health.md` (2026-03-17).
 - Cleaned up deprecated software information from `docs/tech/stack.md` (2026-03-13).
@@ -1,13 +1,35 @@
-# Next Steps - 2026-03-17
+# Next Steps - 2026-04-02

-## High Priority
+## Immediate (Post-Reboot - GXA7801Q Firmware Activation)
+
+> NVMe firmware GXA7801Q was applied 2026-04-02 but requires reboot to activate.
+> Run `sudo reboot` when ready.
+
+- [ ] Reboot workstation to activate NVMe firmware GXA7801Q
+- [ ] Verify firmware: `nvme list` should show `GXA7801Q` (was `GXA7401Q`)
+- [ ] Check SMART health post-update: `sudo nvme smart-log /dev/nvme0n1`
+- [ ] Run post-update fio benchmark (same parameters as pre-update):
+  ```bash
+  fio --directory=/tmp --name=seq-read --rw=read --bs=4k --iodepth=32 \
+    --ioengine=libaio --direct=1 --size=1g --runtime=30 --time_based
+  ```
+- [ ] Document before/after comparison in `docs/tech/nvme-benchmark-post-gxa7801q.md`
+- [ ] Update `docs/tech/firmware-update-research.md` status from "reboot pending" to "complete"
+
+## Short Term
+
+- [ ] Update `linux-firmware` and kernel packages: `sudo pacman -Syu linux-firmware`
+- [ ] Check NVIDIA driver version: `pacman -Q nvidia`
+- [ ] Run `scripts/update-cli-suite.sh` to sync CLI tool suite
 - [ ] Monitor system behavior under multi-day sustained load to ensure `zswap` and `MGLRU` keep the system responsive.
- [ ] Verify that `archlinux-keyring-wkd-sync.service` failure is resolved or investigate further (currently noted in health report).
+- [ ] Verify that `archlinux-keyring-wkd-sync.service` failure is resolved or investigate further.

 ## Optimization
+
 - [ ] Evaluate if `systemd-oomd` is aggressive enough for interactive desktop use; if not, consider testing `earlyoom` as an alternative.
 - [ ] Automate periodic S.M.A.R.T. checks via a systemd timer (currently manual).

 ## Infrastructure
+
 - [ ] Consolidate Ansible variables for Docker memory limits into `ansible/vars/main.yml`.
 - [ ] Extend `scripts/maintenance.sh` to include a summary of the last 24h OOM events (if any).
@@ -0,0 +1,220 @@
+#!/bin/bash
+set -euo pipefail
+
+# satware® CLI Suite Update Script
+# Version: 1.0.0
+# Target: mw-pfeddersheim-workstation (Manjaro/Arch, macOS, Debian)
+# Source: Workflows/infra.cli-suite-update.md
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+CAPS_DIR="$PROJECT_DIR/docs/tech/capabilities"
+LOG_FILE="$PROJECT_DIR/logs/cli-suite-$(date +%Y%m%d).log"
+
+# --- CLI Suite Definition ---
+# Format: binary_name:package_name (colon-separated if different)
+PACMAN_TOOLS=(shellcheck fd rg:ripgrep jq bat eza zoxide fzf gum dust btm:bottom syft cosign)
+NPM_TOOLS=(cline)
+
+# --- Helpers ---
+log() { echo "[$(date '+%H:%M:%S')] $*" | tee -a "$LOG_FILE"; }
+# Get binary name from entry (before colon, or whole string)
+bin_name() { echo "${1%%:*}"; }
+# Get package name from entry (after colon, or whole string)
+pkg_name() { echo "${1#*:}"; }
+
+show_help() {
+  cat <<EOF
+satware® CLI Suite Update Script v1.0.0
+
+Usage: $(basename "$0") [OPTIONS]
+
+Options:
+  --check       Check versions only, no updates
+  --discover    Run capability discovery (help text capture)
+  --help        Show this help message
+
+Managed tools: shellcheck, fd, rg, jq, bat, eza, zoxide, fzf, gum,
+  dust, btm, gh, tea, ruff, uv, glab, himalaya, semgrep, syft,
+  cosign, nuclei, cline
+
+Source of Truth: Workflows/infra.cli-suite-update.md
+EOF
+}
+
+# --- Argument Parsing ---
+CHECK_MODE=false
+DISCOVER_MODE=false
+for arg in "$@"; do
+  case "$arg" in
+    --check) CHECK_MODE=true ;;
+    --discover) DISCOVER_MODE=true ;;
+    --help|-h) show_help; exit 0 ;;
+    *) echo "Unknown argument: $arg"; show_help; exit 1 ;;
+  esac
+done
+
+# --- Setup ---
+mkdir -p "$(dirname "$LOG_FILE")" "$CAPS_DIR"
+
+log "=== CLI Suite Update Started ==="
+log "OS: $(grep '^ID=' /etc/os-release 2>/dev/null | cut -d= -f2 || echo 'unknown')"
+log "Check mode: $CHECK_MODE | Discover mode: $DISCOVER_MODE"
+
+# --- Section 1: System Package Tools (pacman) ---
+log "[1/5] System package tools (pacman)..."
+for tool in "${PACMAN_TOOLS[@]}"; do
+  bin="$(bin_name "$tool")"
+  pkg="$(pkg_name "$tool")"
+  if command -v "$bin" &>/dev/null; then
+    log "  ✓ $bin installed"
+  else
+    log "  ✗ $bin missing - installing package $pkg..."
+    $CHECK_MODE || sudo pacman -S --noconfirm "$pkg" 2>&1 | tee -a "$LOG_FILE"
+  fi
+done
+
+if [[ "$CHECK_MODE" == false ]]; then
+  log "  Updating pacman packages..."
+  PKGS=()
+  for tool in "${PACMAN_TOOLS[@]}"; do PKGS+=("$(pkg_name "$tool")"); done
+  sudo pacman -Syu --noconfirm "${PKGS[@]}" 2>&1 | tee -a "$LOG_FILE" || true
+fi
+
+# --- Section 2: Standalone / Custom Install Tools ---
+log "[2/5] Standalone tools..."
+
+# gh - GitHub CLI
+if command -v gh &>/dev/null; then
+  log "  ✓ gh installed"
+else
+  log "  ✗ gh missing"
+  $CHECK_MODE || sudo pacman -S --noconfirm gh 2>&1 | tee -a "$LOG_FILE" || true
+fi
+
+# tea - Gitea CLI
+if command -v tea &>/dev/null; then
+  log "  ✓ tea installed"
+else
+  log "  ✗ tea missing - install via: pacman -S tea or download from git.satware.ai"
+fi
+
+# glab - GitLab CLI
+if command -v glab &>/dev/null; then
+  log "  ✓ glab installed"
+else
+  log "  ✗ glab missing"
+  $CHECK_MODE || sudo pacman -S --noconfirm glab 2>&1 | tee -a "$LOG_FILE" || true
+fi
+
+# uv - Python package manager
+if command -v uv &>/dev/null; then
+  log "  ✓ uv installed"
+  $CHECK_MODE || uv self update 2>&1 | tee -a "$LOG_FILE" || true
+else
+  log "  ✗ uv missing"
+  $CHECK_MODE || sudo pacman -S --noconfirm uv 2>&1 | tee -a "$LOG_FILE" || true
+fi
+
+# ruff - Python linter
+if command -v ruff &>/dev/null; then
+  log "  ✓ ruff installed"
+else
+  log "  ✗ ruff missing"
+  $CHECK_MODE || sudo pacman -S --noconfirm ruff 2>&1 | tee -a "$LOG_FILE" || true
+fi
+
+# himalaya - Email CLI
+if command -v himalaya &>/dev/null; then
+  log "  ✓ himalaya installed"
+else
+  log "  ✗ himalaya missing"
+  $CHECK_MODE || sudo pacman -S --noconfirm himalaya 2>&1 | tee -a "$LOG_FILE" || true
+fi
+
+# semgrep - Static analysis
+if command -v semgrep &>/dev/null; then
+  log "  ✓ semgrep installed"
+else
+  log "  ✗ semgrep missing - install via: pipx install semgrep"
+fi
+
+# hf - Hugging Face Hub CLI (via pipx)
+if command -v hf &>/dev/null; then
+  log "  ✓ hf installed"
+else
+  log "  ✗ hf missing - install via: pipx install 'huggingface_hub[cli]'"
+fi
+
+# scrot - Screenshot (Linux only)
+if command -v scrot &>/dev/null; then
+  log "  ✓ scrot installed"
+else
+  log "  ✗ scrot missing"
+  $CHECK_MODE || sudo pacman -S --noconfirm scrot 2>&1 | tee -a "$LOG_FILE" || true
+fi
+
+# --- Section 3: npm Global Tools ---
+log "[3/5] npm global tools..."
+for tool in "${NPM_TOOLS[@]}"; do
+  if command -v "$tool" &>/dev/null; then
+    log "  ✓ $tool installed"
+    $CHECK_MODE || npm update -g "$tool" 2>&1 | tee -a "$LOG_FILE" || true
+  else
+    log "  ✗ $tool missing - installing..."
+    $CHECK_MODE || npm install -g "$tool" 2>&1 | tee -a "$LOG_FILE"
+  fi
+done
+
+# --- Section 4: Go/Custom Tools ---
+log "[4/5] Go/custom tools..."
+
+# nuclei - Vulnerability scanner
+if command -v nuclei &>/dev/null; then
+  log "  ✓ nuclei installed"
+else
+  log "  ✗ nuclei missing - install via: go install or download release"
+fi
+
+# --- Section 5: Summary ---
+log "[5/5] Installation summary..."
+INSTALLED=0
+MISSING=0
+ALL_TOOLS=(shellcheck fd rg jq bat eza zoxide fzf gum dust btm scrot gh tea ruff uv glab himalaya semgrep syft cosign nuclei hf cline)
+
+for tool in "${ALL_TOOLS[@]}"; do
+  if command -v "$tool" &>/dev/null; then
+    INSTALLED=$((INSTALLED + 1))
+  else
+    MISSING=$((MISSING + 1))
+    log "  MISSING: $tool"
+  fi
+done
+
+log "Result: ${INSTALLED}/${#ALL_TOOLS[@]} tools installed, ${MISSING} missing"
+
+# --- Capability Discovery ---
+if [[ "$DISCOVER_MODE" == true ]]; then
+  log "=== Capability Discovery ==="
+  
+  # Capture help output for key tools
+  for tool in uv glab gh tea ruff; do
+    if command -v "$tool" &>/dev/null; then
+      OUTFILE="$CAPS_DIR/${tool}-help.txt"
+      log "  Capturing $tool help -> $OUTFILE"
+      ${tool} --help > "$OUTFILE" 2>&1 || true
+    fi
+  done
+  
+  # Capture subcommand help for tools with complex CLIs
+  for sub in "uv audit" "uv pip" "glab mcp" "glab ci" "gh api" "tea login"; do
+    CMD_ARRAY=($sub)
+    OUTFILE="$CAPS_DIR/${sub// /-}-help.txt"
+    log "  Capturing '$sub' help -> $OUTFILE"
+    "${CMD_ARRAY[@]}" --help > "$OUTFILE" 2>&1 || true
+  done
+  
+  log "Capability discovery complete. Files in $CAPS_DIR/"
+fi
+
+log "=== CLI Suite Update Finished ==="