fleet-infra-fixes — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fleet-infra-fixes (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Recurring operational fixes and credential patterns for the Appie fleet, so any agent can resolve them fast instead of re-deriving. Captured 2026-06-03.
Homebrew node (25.x/26.x) can break when simdjson upgrades the dylib (libsimdjson.29 missing), breaking codex/vercel/default-node. Symptom: dyld error or "Named export not found". Fix: brew upgrade node (-> 26) or use node@22 at /opt/homebrew/opt/node@22/bin. Default to node@22 for Mission Control + Next builds.
pnpm install in a merged repo may abort: ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY (wants to purge node_modules). Do NOT run casual installs in Mission Control. If a dep is genuinely missing, install deliberately and restart the dev server when not in use. reagraph/three are already present; r3f/drei are not.
Vercel/GitHub account tokens are scope-wide. To give a bot write access to ONLY one repo: generate an SSH deploy key ON the bot's machine (ssh-keygen -t ed25519 -N "" -f ~/.ssh/<repo>_deploy), add an ssh config alias (Host github-<repo> -> IdentityFile that key, IdentitiesOnly yes), and add the PUBLIC key in the repo Settings > Deploy keys (Allow write access). Private key never leaves the box, never goes in chat. Vercel single-project isolation needs a dedicated Vercel TEAM + team-scoped token (project-level RBAC is Enterprise only).
Never echo secrets to Telegram or any chat (they are logged server-side). Secrets live in $SECRETS_VAULT_DIR/.env or the agent's config. Tailscale serve cert/key must be gitignored (*.ts.net.crt/.key) and kept out of repos.
When GitHub/Vercel ops fail with Bad credentials, the appie-1 tokens are expired (gh keyring + vault GH_TOKEN/GITHUB_TOKEN/VERCEL_TOKEN). SSH to github as S3YED works (key appie-brain). Fix needs the human: gh auth login + vercel login. Do not try to mint tokens; document and wait.
Chrome 148 app-bound cookie encryption defeats profile-copy session reuse; Chrome 136+ blocks CDP on the real profile. So you cannot reuse a logged-in GitHub session from a copied profile. For an authenticated headed render (e.g. screenshots of WebGL views), log in via the app's own API in the Playwright context, use channel:'chrome', headless:false, --use-gl=angle.
Expose tailnet-only, NEVER funnel: tailscale serve --bg 3000 -> https://<tailnet-host>.ts.net. Disable: tailscale serve --https=443 off. The cert/key land in the cwd; move them to $SECRETS_VAULT_DIR/ts-certs/.
STT: faster-whisper (small, int8). Embeddings: ollama bge-m3. TTS: local Kokoro/Piper. Image gen: fal.ai Nano Banana. Heavy/bulk work dispatches to Spark Atlas or via ~/bin/dispatch-appie.sh.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.