Levandor

telep-mainframe Master Agent — implementation / outcome

4 min read

Built and verified the always-on, phone-drivable Claude control-plane agent on the host telep-mainframe, per the spec in 2026-08-08-telep-master-agent-design. It mirrors the Incus container control-planes (alpiq/facekom/crypto) but adds the one thing they lack: systemd autostart. This note records what was built + verified; the design/spec is not repeated here.

For Agents

Service: control-plane.service — User=levander, Type=forking, Restart=always, enabled. Runs claude remote-control --name control-plane-telep-mainframe --spawn same-dir inside a tmux session. Reachable from: the Claude app Code tab — shows Connected · obsidian · main. Verified working from the user’s phone. Vault clone: /home/levander/obsidian (this repo, wowjeeez/obsidian). Sync: obsidian-sync.timer (enabled, OnBootSec=5min / OnUnitActiveSec=15min) runs /usr/local/bin/obsidian-sync.sh — bidirectional pull --rebase --autostash + commit + push. Worklog: projects/homelab/telep-master-worklog.md. Permissions stay ACTIVE — --dangerously-skip-permissions is deliberately NOT used.

What was built + verified

control-plane.service

  • Runs claude remote-control --name control-plane-telep-mainframe --spawn same-dir in a persistent tmux session, as levander, Type=forking, Restart=always, enabled (survives the LUKS clevis+TPM2 auto-unlocked reboots like the other host services).
  • Came up headless and shows Connected · obsidian · main in the Claude app Code tab. Verified working from the user’s phone.

The app shows the auto-spawned session name, not --name

--spawn same-dir spawns a session whose auto-generated name (e.g. …-velvety-star) is what the Claude app displays — not the device --name (control-plane-telep-mainframe). Don’t look for the --name string in the app; it identifies the device/host, while the visible session is the spawned one.

Vault clone + auth

  • Cloned to /home/levander/obsidian.
  • Deploy key id_ed25519, wired repo-local via core.sshCommand (not global SSH config), so only this repo uses the key.
  • Git identity on the box: name telep-mainframe, email ledererandras2004@gmail.com.
  • The deploy key was added by the user as a write deploy key on the private wowjeeez/obsidian repo.

obsidian-sync.timer

  • enabled, OnBootSec=5min / OnUnitActiveSec=15min.
  • Runs /usr/local/bin/obsidian-sync.sh: bidirectional git pull --rebase --autostash → commit local changes → push.
  • Keeps the host clone and the Mac vault convergent. (The multi-writer-to-main ceiling from the design still applies; --autostash handles the common case.)

Harness parity

  • Path-rewritten historian + obsidian-documenter agent defs installed at /home/levander/.claude/agents/ (Mac vault path → /home/levander/obsidian).
  • A host ~/.claude/CLAUDE.md carrying the context-retrieval + proactive-documentation workflow.

Degrades gracefully — Mac-only sources are absent on the box

The host harness references tools that don’t exist on telep-mainframe: claude-mem, the Mac auto-memory store, and the obsidian CLI (an Obsidian-app plugin). These are Mac-only and the agent defs degrade gracefully without them — the documenter falls back to direct file I/O against /home/levander/obsidian and git, which is exactly what’s needed on a headless box.

Security posture (recorded deliberately)

This is the important part to keep on record — it mirrors the container control-plane posture.

  • Trust dialogs were pre-seeded so the agent launches headless: remoteDialogSeen and hasTrustDialogAccepted=true set in ~/.claude.json (backups ~/.claude.json.bak-*). This only skips the one-time trust prompt.
  • --dangerously-skip-permissions is deliberately NOT used — tool permissions stay ACTIVE. Destructive/tool actions surface approval prompts in the Claude app as the human-in-the-loop guardrail. Pre-seeding trust widens launch, not authority.

The guardrail is approval, not a sandbox — and approve = root

The box has passwordless sudo (/etc/sudoers.d/levander). So an approved sudo action from the phone is instant root. The guardrail is the human tapping “approve”, NOT any sandbox or capability limit. Approve deliberately. (Context: a prior autonomous agent on this fleet took the site’s only DNS/gateway down and forced a factory reset with no backup — 2026-08-03-telep-router-factory-reset-recovery.)

Relationship to the spec

The full design, motivation, components table, known gotchas, and success criteria are in 2026-08-08-telep-master-agent-design. This note is the “it’s built and here’s what’s actually true” companion — service names, verified state, the session-name display quirk, the graceful-degradation caveat, and the recorded security posture.

Graph View

Backlinks