Viktor Barzin 82b7866bc9 [claude-agent-service] Remove orphaned DevVM SSH key wiring ... ## Context The remote-executor pattern that SSHed into the DevVM (10.0.10.10) to run `claude -p` was fully migrated to the in-cluster service `claude-agent-service.claude-agent.svc:8080/execute` in commits 42f1c3cf and 99180bec (2026-04-18). Five parallel codebase audits (GH Actions, Woodpecker + scripts, K8s CronJobs/Deployments, n8n, local scripts/hooks/docs) confirmed zero remaining SSH+claude sites. This commit removes two cleanup artifacts left behind by that migration. ## This change 1. Deletes `.claude/skills/archived/setup-remote-executor.md` — the archived skill doc for the obsolete SSH-based pattern. Already in `archived/`, harmless but noise; deleting prevents anyone copy-pasting the old approach. 2. Removes `kubernetes_secret.ssh_key` from `stacks/claude-agent-service/main.tf`. The Secret was created from the `devvm_ssh_key` field at Vault `secret/ci/infra` but was never mounted into the agent pod. The pod's `git-init` init container uses HTTPS + `$GITHUB_TOKEN` exclusively and force-rewrites every `git@github.com:` and `https://github.com/` URL via `git config url.insteadOf`, so no downstream `git` invocation could fall through to SSH even if it tried. 3. Removes the now-orphaned `data "vault_kv_secret_v2" "ci_secrets"` block — the SSH key resource was its only consumer. ## What is NOT in this change - The `devvm_ssh_key` field at Vault `secret/ci/infra` stays in place. Removing it requires read/modify/put of the full secret and the upside is one unused Vault key. Not worth it without strong justification. - DevVM host decommission is out of scope (separate audit needed for non-Claude users of the host). - Pre-existing `terraform fmt` warnings at lines 464-505 (CronJob alignment) left untouched per no-adjacent-refactor rule. ## Test plan ### Automated - `terraform fmt -check stacks/claude-agent-service/main.tf` — only the pre-existing lines 464-505 are flagged; no new fmt warnings introduced by these deletions. ### Manual verification 1. `cd infra/stacks/claude-agent-service && ../../scripts/tg apply` 2. Expect exactly one resource destroyed: `kubernetes_secret.ssh_key`. The `ci_secrets` data source removal is plan-time only; does not appear in resource counts. 3. `kubectl -n claude-agent get secret ssh-key` → `NotFound`. 4. `kubectl -n claude-agent get pod` → both pods Running, no restart events. 5. Submit a synthetic agent job via HTTP API to confirm pipeline still works: curl -X POST http://claude-agent-service.claude-agent.svc.cluster.local:8080/execute with a minimal prompt; expect job completes with `exit_code=0`. Closes: code-bck Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-04-18 13:31:15 +00:00
..
agents	Add agent task tracking documentation	2026-04-15 17:11:26 +00:00
commands	[ci skip] update kubectl skill to use local kubeconfig	2026-02-07 13:42:35 +00:00
reference	[docs] Update anti-AI and rybbit docs after rewrite-body removal	2026-04-17 21:43:13 +00:00
scripts	rename weekly-backup → daily-backup across scripts, timers, services, and docs [ci skip]	2026-04-13 18:37:04 +00:00
skills	[claude-agent-service] Remove orphaned DevVM SSH key wiring	2026-04-18 13:31:15 +00:00
calendar-query.py	sync regenerated providers.tf + upstream changes	2026-03-22 02:56:04 +02:00
CLAUDE.md	[docs] Clarify external-monitor auto-annotation in CLAUDE.md	2026-04-18 11:45:56 +00:00
cluster-health.sh	fix: update healthcheck to report internal and external monitors separately	2026-04-14 19:44:20 +00:00
home-assistant-sofia.py	[ci skip] Add ha-sofia Home Assistant deployment to skills	2026-02-07 21:26:05 +00:00
home-assistant.py	add claude [ci skip]	2026-02-06 20:10:02 +00:00
internet-mode-used_DO_NOT_REMOVE_MANUALLY_SECURITY_RISK	add claude [ci skip]	2026-02-06 20:10:02 +00:00
pfsense.py	[ci skip] Add pfSense firewall management skill	2026-02-14 12:42:10 +00:00
settings.json	add claude files [ci skip]	2026-01-18 15:40:43 +00:00