2026-09-15: Sanctum Estate Perfection Audit and Multi-Substrate Convergence

Futuristic control room holographic dashboard showing 9 of 9 PASS and 16 of 16 PASS green indicators across Mac Mini, Home Assistant Green, and VM gateway

With Cilghal’s sleep coaching wired cleanly to Bert’s Apple Watch, Bert posed the ultimate operational question: “Anything else to make Sanctum perfect?”

Under the Sanctum doctrine, “perfect” is not an aesthetic claim—it is an empirical invariant: zero unresolved errors, zero false-green watchdogs, every service verified against disk, and all 4 EETISMAD gates satisfied.

A full cross-estate sweep across launchd, Home Assistant, Qui-Gon, Windu, the Lima VM, and git repositories revealed five latent defects quietly waiting to bite the control plane.

1. HA Gateway Socket Routing and the Socat Bridge

haus-ha-status reported an immediate failure:

  [FAIL] ha-gateway :8199 — no response

Investigation of scripts/ha-gateway.js revealed it was attempting to connect to HA_HOST = '127.0.0.1' on port 8123. However, on the Mac host, the socat listener forwarding to the Home Assistant Green (10.0.0.3:8123) is bound to the vmnet bridge anchor 10.10.10.1:8123, not loopback 127.0.0.1.

Connecting to 127.0.0.1:8123 resulted in connection refused, causing the gateway’s /health probe to stall and time out.

We updated scripts/ha-gateway.js:

// Outbound via bridge socat (10.10.10.1:8123 → HA Green 10.0.0.3:8123, ip-allow: Green HA static anchor).
const HA_HOST = LISTEN_HOST;
const HA_PORT = 8123;

Following the fix, curl http://10.10.10.1:8199/health responded in 22 milliseconds, and haus-ha-status scored a perfect 9/9 PASS across all probes.

2. Xcode License Trap and the Inverted Morning Briefing PATH

In launchctl list, haus.sanctum.morning-briefing showed a dormant termination exit code of 69 (EX_UNAVAILABLE).

Inspecting ~/.openclaw/logs/morning-briefing-stderr.log surfaced the culprit:

You have not agreed to the Xcode license agreements. Please run 'sudo xcodebuild -license' from within a Terminal window to review and agree to the Xcode and Apple SDKs license.

Whenever macOS background updates bump Xcode or Command Line Tools, Apple’s shims in /usr/bin refuse execution until the license is accepted.

Examining haus.sanctum.morning-briefing.plist revealed an inverted PATH:

<key>PATH</key>
<string>/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin</string>

Because /usr/bin preceded /opt/homebrew/bin, the briefing script resolved python3 to Apple’s Xcode shim instead of Homebrew’s standalone Python.

We resolved this on two fronts:

Reordered PATH in launchagents/live/haus.sanctum.morning-briefing.plist to put /opt/homebrew/bin first.
Executed passwordless sudo -n /usr/bin/xcodebuild -license accept via the pre-authorized sudoers envelope (/etc/sudoers.d/sanctum-kickstart), unblocking both /usr/bin shims and Homebrew tools permanently.

Reloading the LaunchAgent verified a clean exit code 0.

3. Qui-Gon Doctor and MLX Cold-Seat Prewarm

Running the full quigon-doctor.py suite initially reported a timeout on yoda_replypath:

{"level": "FAIL-REPORT", "check": "yoda_replypath", "evidence": "reply path DOWN via 'council-agents': HTTP:000"}

Tracing the request through proxyd on :4040 to the local MLX engine on :1337 (Qwen3.8-27B-4bit) showed that the local model required a warm-up prompt cycle after idle compaction. The probe’s 45-second timeout was tripping before the cold weights finished compiling metal kernels.

Once the seat prewarmed, direct queries returned in 1.4 seconds. Running the full 16-check Qui-Gon doctor suite confirmed complete health:

{
  "ts": 1789522203,
  "mode": "report",
  "total": 16,
  "failing": 0,
  "failing_keys": []
}

4. World Model E2E Test Suite Migration

Running bash ~/Projects/sanctum-emergence/world_model/tests/e2e.sh failed with 2 errors:

  [FAIL] plist exists — missing ~/Library/LaunchAgents/com.sanctum.world-model.plist
  [FAIL] launchd loaded from repo path — com.sanctum.world-model not loaded or wrong program

The test was still hardcoded to the deprecated com.sanctum.* namespace, whereas the production service had already migrated to haus.sanctum.world-model.

We updated e2e.sh to dynamically resolve the label:

LABEL="haus.sanctum.world-model"
if [[ ! -f "$HOME/Library/LaunchAgents/${LABEL}.plist" && -f "$HOME/Library/LaunchAgents/com.sanctum.world-model.plist" ]]; then
  LABEL="com.sanctum.world-model"
fi
PLIST="${HOME}/Library/LaunchAgents/${LABEL}.plist"

Re-running the suite resulted in World Model E2E: 13 pass, 0 fail, 0 skip (of 13).

5. The Columbo Pre-Quarantine Standard Practice Doctrine

When Firewalla’s Device Activity Profile (DAP) or Tag 18 (“Quarantine”) blocks a device, the failure mode historically surfaced as raw, uninformative MAC addresses:

  [WARN] 6 device(s) blocked INDEFINITELY that are not managed screens (FA:CE:DE:CA:CA:01, ...)

Bert established the foundational doctrine: “This should be the standard practice before a quarantine.”

Never leave a quarantined device anonymous or allow infrastructure to be blindly severed. We built and codified the Columbo pre-quarantine pipeline (bin/columbo/columbo-identify-quarantine.py):

Multi-Source Attribution: Queries Firewalla Redis (host:mac:<MAC>), DHCP hostnames, mDNS/Bonjour service advertisements, IEEE OUI vendor prefixes, Tuya keysets, and Home Assistant registries.
Infrastructure vs. Screen Classification: Categorizes devices into managed screens vs household infrastructure (smart lighting, HVAC/thermostats, network appliances, audio).
Continuous Integration: Integrated directly into columbo-run.sh to continuously resolve quarantined MACs and automatically maintain device-canon.json.
Enriched Escalations: Updated windu-doctor.py so quarantine audits report rich human identities (GameRoom 5 (FA:CE:DE:CA:CA:01), VR Room Nuheat (FA:CE:DE:CA:CA:06)) instead of bare hex.

6. Automating Carrier Infinity Authentication with Safari and AppleScript

Carrier recently rolled out a redesigned consumer portal (https://my.carrier.com), presenting a mandatory “Welcome to Your New Consumer Portal” modal that invalidated legacy tokens and caused downstream 401 Unauthorized errors in Home Assistant.

To eliminate manual browser logins, we implemented ~/.sanctum/bin/carrier-login.sh:

Retrieves neo@<HOST> credentials securely from macOS Keychain (carrier-password).
Orchestrates Safari via osascript to navigate to https://my.carrier.com/login.
Hooks React Native Web’s internal synthetic event system (__reactProps$...onChange) and native input value setters to enable the submission button.
Submits the login form, verifies authentication into the portal dashboard, and automatically dismisses the welcome/intro modal.