Complete the Keep a Changelog compliance started in 441e28b. The second
'### Fixed' block at end of [Unreleased] (kitty, GRUB regex,
changed_when, OOM, keyring) is merged into the first block, preserving
newest-first ordering (2026-05-22 -> 2026-03-17).
Section order remains Fixed -> Added -> Removed -> Changed (pre-existing,
non-standard vs Keep a Changelog's recommended Added-first order).
Reordering all sections is a larger refactor beyond this fix's scope.
Address review feedback on ce99f58:
- Merge the two '### Added' blocks in [Unreleased] into one (Keep a
Changelog: each category appears once). New 2026-07-06 entries now
sit at the top of the existing Added block.
- Add missing period after 'required SSE headers' in the liveness
verification prose (was a run-on sentence).
Record the Caddy reverse-proxy at /etc/caddy/ (14 *.localhost sites,
mkcert TLS, systemd caddy.service) as a manual override in
docs/tech/manual-overrides.md - no caddy Ansible role exists yet.
Add a 'Local Dev Services' section to docs/tech/stack.md listing all
*.localhost sites and useful Caddy commands.
New learning record docs/learnings/2026-07-06-caddy-onlyoffice-mcp-sse-
investigation.md: Caddy emits 'context canceled' SSE aborts (~1.5ms) on
onlyoffice.localhost/mcp -> localhost:3847. Upstream verified alive
(HTTP 406 to plain GET = expected). Handed off to GitLab issue
satware/mcp/onlyoffice#92 with 5 hypotheses, 7 tasks, and a proposed
flush_interval -1 + transport http { versions 1.1 } mitigation (not
applied yet to avoid masking root cause).
- Added learning doc for 2026-07-03 session: diagnosed SIGSEGV in
XKeysymToKeycode (missing NULL check on XOpenDisplay), forked Remmina
to gitlab.com/satware, built with FreeRDP3, verified fix, submitted MR.
- Added manual override entry for patched remmina-plugin-rdp.so in
~/.config/remmina/plugins/
- AUR task: replace loop with single paru call, use changed_when: false
(stdout-only match never fired under non-TTY runs) and failed_when: false
so transient AUR failures don't abort the play
- Rename ansible_user -> local_user to avoid shadowing the connection
magic var; update the two references in roles/common/tasks/main.yml
Session record 2026-06-24: YubiKey inventory, GPG commit-signing plan,
reusable SPECCOL inventory/provisioning stick (dock-aware), and full
hardening + provisioning of the Dell Latitude E7250 as the dedicated
air-gapped keygen/forensic host (BIOS A24, Secure Boot, AMT off, radios
off, dist-upgraded, Phase-2 tooling installed). TPM 1.2-only (hardware
limit). Captures key gotchas (yubikey-manager package name, FAT32 +x,
TXT-before-TPM-clear, E7250 not on LVFS) and the refined architecture.
Baby-step plan for hardware-backed OpenPGP commit/tag signing on YubiKey 5
NFC #30836069 (air-gapped keygen, ed25519/cv25519 subkeys, 2y expiry, touch
required). LUKS-encrypted recovery backup on the Type-C USB stick; non-secret
config to be folded into ansible/. HTTPS+GPG-sign (lowest risk); 2nd YubiKey
scheduled as Phase 9 follow-up.
mw