Menu

Individual skill

fleet-maintenance

Mac fleet inventory and upkeep with full/worker profiles: collect installed apps and packages, compare desired versus observed state, audit local-account escrow references, update Homebrew/global packages, safely sync repos and Xcode, and report disk, service, backup, update, and security health.

skills/fleet-maintenance/SKILL.md

Read pinned source

Source commit d210c0a77c8f9ae5e1d939b13238a75e87cdb69a

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 2, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
7,470
Repository last updated
Oct 30, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# Fleet Maintenance

Maintain Peter's Macs while protecting ambiguous local work. Package updates are explicitly allowed during active sessions and may disrupt the software being upgraded. Use `$remote-mac` for inventory/SSH and `$xcode-sync` for all Xcode work.

## Desired state

- Read `~/Projects/manager/fleet/inventory.json` for desired software and local-account escrow references. Read `references/fleet-schema.md` before changing its schema or adopting packages.
- Keep exactly two profiles unless Peter explicitly changes the model:
  - `full`: daily-driver Macs with the complete development, communication, media, and agentic toolset.
  - `worker`: lean remote Macs that mainly run Codex, Claude, OpenClaw nodes, and supporting agent infrastructure.
- Treat profile policy as `minimum`: install required entries and report extras without removing them. Never silently turn observed software into desired state.
- Keep topology, SSH routing, and handed-off status in `~/Projects/manager/computers.yaml`. Do not duplicate live topology in this skill.
- Keep passwords, recovery keys, and private keys in 1Password. The inventory stores opaque item IDs only. Invoke `$one-password` before any `op` command; a `pending` reference is not an error during package maintenance.
- Require the classic OpenSSH mesh named by `ssh_mesh` on both profiles. The manager fleet setup document owns the canonical peer list and live proof. Use the symmetric Tailscale TCP 22 grant plus per-host `authorized_keys`; macOS GUI Tailscale clients cannot act as Tailscale SSH servers. Distribute public keys only, keep private keys host-local, verify both directions with `BatchMode=yes` and a finite timeout, and leave offline or provider-blocked directions pending.