FamReynaBrain/areas/platform.md

---
date: 2026-08-05
type: area
status: active
tags: [platform, macmini, mcp, hermes, reyna-cli, voice-assistant, electronics, infra]
---

# Platform — Mac Mini Private-Host Layer

Canonical tracker for all custom (not Hermes-native) skills, MCP servers, integrations, LaunchAgents, cron jobs, and Hermes plugins. Mac mini M4 (.102) is the sole private and browser host per AGENTS.md. This doc is source of truth; other brain files link here.

## Direction: MacMiniMCP to reyna-cli consolidation

Decision 2026-08-05: Migrate out of Node MacMiniMCP MCP server and consolidate everything into reyna-cli native privacy host.

Why:
- MacMiniMCP uses fragile Applescript JXA osascript paths requiring separate Automation TCC approvals and spawning child processes.
- reyna-cli native host is one stable signed Reyna CLI.app bundle at native/ReynaCLIHost/ owning all Privacy and Automation permissions (Calendar, Contacts, Reminders, Notes via EventKit and NSAppleEventsUsageDescription).
- Python CLI becomes typed testable client over Unix socket Library Application Support reyna-cli privacy reyna-cli.sock with allowlist and redaction.
- No long-term Node fallback, no Mail or Full Disk Access scope creep, LAN stays private socket only.

Policy:
- Do not build MacMiniMCP fallback. Add native operations until callers covered, validate with service.health plus synthetic probes, then disable and archive com.local.macmini-mcp.
- Preserve root symlinks MacMiniMCP to platform/MacMiniMCP and reyna-cli to platform/reyna-cli until LaunchAgents updated to platform canonical paths.
- Xcode Automatic Signing batch wave with Gitea backup before privileged migrations per mac_privacy_migrations_2026.

Evolution:
electronics/mcp_screen micropython origin boot.py circuitpython lib desktop_client iphone_app from its spec
-> voice-assistant mcp_screen plus hermes-esp32-voice-gateway jarvis whisper-translation
-> platform/MacMiniMCP Node MCP 27 tools osascript
-> platform/reyna-cli Python facade plus Swift signed host <- current and final

## Projects layout after Aug 5 2026 cleanup

Projects/
- platform/
  - MacMiniMCP Gitea mac_mcp 743M LEGACY to archive src/server.js 27 tools
  - reyna-cli Gitea reyna-cli 960M CANONICAL Python facade Swift host
- electronics/
  - tactility/tactility 142M 16 branches tactility_apps 17M 6 branches ACTIVE
  - basic1 48M RP2350
  - eink-api eink-dairy emulatedisplay pico-8 legacy
- voice-assistant/
  - mcp_screen 2.5M origin micropython spec for desktop
  - hermes-esp32-voice-gateway jarvis whisper-translation AI-Harness-Basic VideoCaptioningTranslation
- EMI 780M EMI-Backend plus expoApp plus website
- xcode AI-Harness ReynaBot Watch App TestApp TestiOS1
- Symlinks compat: MacMiniMCP to platform/MacMiniMCP, reyna-cli to platform/reyna-cli, basic1 to electronics/basic1
- Removed: EMI_new_website PayloadCMS PoC, FamBoard Homarr widget uncommitted, remotion-hello starter
- Gitea 22 repos git.reynafamily.com/adolforeyna: 19 cloned, skipped clawbot 177k TS Feb24, WFK_theme PHP, immich-emi text, FamReynaBrain is brain

## Custom skills owned

- tactility-operations ~/.hermes/skills/tactility-operations/SKILL.md Book Player plus BibleVerse v6 BIBK per-book bin idx editorial UI plus Pi fleet 107 113 131 dashboard FS API RGB565 plus deterministic watercolor avatar workflow Grace purple constraint biggest skill refs watercolor-cute-style-guide kidsos-fleet-discovery kidsos-screen-send-fix
- reyna-cli-privacy-host ~/.hermes/skills/software-development/reyna-cli-privacy-host/SKILL.md one signed host consolidation privacy contract TDD RPC client 3-tier path validation EventKit main-thread deadlock fix launchd lifecycle capability migration refs 12 docs

Heavily customized skill refs:
- macos-private-service-hosts refs macmini-projects-grouping 2026-08-05 notes-automation-migration
- electronics-projects refs macmini-layout 2026-08-05 paper-apps-games xiao-epaper rlcd-whale-writer
- weekly-coding-recap refs gitea-local-inventory 2026-08-05 implementation
- native-mcp refs kokoro-mlx-ksay macmini-mcp-cli-facade
- software-development-lifecycle refs reyna-cli-browser-integration web-open-design gitea-integration
- church-worship-graphics-generator family-brain-automation etc brain-tidying

## MCP Tools inventory

MacMiniMCP LEGACY 27 tools src/server.js via integrations js:
- Notes notes_list read create (JXA osascript)
- Calendar calendar_list_calendars list_events create_event focused Home index 2 Time window ISO
- Contacts contacts_search read create
- Reminders reminders_list_lists list create account context assignment meta
- Mail RO mail_accounts list_mailboxes list_messages 50 max read_message
- Deco deco_get_overview list_clients ipv4_status config_status router
- TTS STT speech_list_voices synthesize synthesize_base64 transcribe_file list_locales quick_test live_transcribe status close persistent pipe SpeechTranscriber
- Kokoro warm daemon 7332 speech_kokoro_status synthesize synthesize_base64 mlx-audio ksay_server.py
- Voicebox Qwen3-TTS voicebox_list_profiles health generate generate_base64 quick_reply instant contextual reply
- Apple LLM ANE 3B apple_llm_check status polish quick_reply chat close FoundationModels Swift
- Image codex_image_generate get_config_status local Codex CLI, gemini_image_generate get_config_status Gemini API, gemini_chrome_prompt_build get_config_status
- System system_get_info sw_vers uname system_speech_api_status
Auth local-only no creds. HTTP src/http.js plus stdio src/stdio.js. LaunchAgents com.local.macmini-mcp logs service out err, com.local.ksay-kokoro

reyna-cli CANONICAL Python plus Swift:
CLI uv run reyna-cli --help:
- doctor
- web FastAPI uvicorn browser UI Authentik OIDC auth.reynafamily.com to reyna-cli.reynafamily.com port 8765
- devices list ping tools call describe device registry config.py local_devices.yaml aliases kidsos4 kid4 rlcd rcld to esp32_screen
  - devices screen laptop computer iphone arm ESP32 ESP32 screen personal laptop MCP this Mac desktop companion .102 iPhone app robot arm state home wave battery
  - computer service-install start status restart logs desktop companion GUI service
- immich stats albums search sunset --limit 5 tools direct REST 8626 mcp
- mongo MongoDB direct driver 8630 bridge
- deco TP-Link Deco direct tplinkrouterc6u
- macmini Mac mini MCP facade Calendar Contacts Reminders while migration
- remarkable Paper Pro .132 UDP 49321 watchdog 15m discovery local cache macOS listener service
- privacy-host native privacy host commands lifecycle
- local-services local TTS STT Voice services direct Kokoro Voicebox Apple LLM Speech Image no MCP
Clients src/reyna_cli/clients immich mongodb zoom direct REST wrappers.

Privacy contract privacy_contract.py:
- ALLOWED_OPERATIONS service.health calendar.list events.list event.create contacts.search read create reminders.lists list create notes.list read create speech.transcribe_file locales synthesize plus expanding
- command_to_operation cmd to typed op calendar_list_calendars to calendar.list raises KeyError unknown
- scrub_privacy_result exact key match token password secret api_key authorization case-insensitive REDACT exact only not substring my_token tokenizer passwords api_key_id stay visible recursive dict list tuple non-mutating

Privacy RPC client privacy_client.py:
Unix socket JSON-lines id uuid operation args dict newline 64 KiB check before connect matching id validation PrivacyClientError missing socket timeout malformed mismatch ok false.

Swift host native/ReynaCLIHost/:
Signed Reyna CLI.app native/ReynaCLIHost/dist/Reyna CLI.app ONLY Privacy owner after migration.
Package.swift linkedFramework AppKit when macOS required for Automation dialog foreground activation.
Providers CalendarProvider ContactsProvider RemindersProvider NotesProvider fail-closed automation_required unless fixed-probe authorization, SystemInfoProvider etc.
Security owner-only via getpeereid, 3-tier path validation platform allowlist root Users private var tmp uid 0 no go write except tmp 1777 only tmp var symlink allowed, user-owned intermediates Home Library Application Support uid current dir not symlink mode 022 must be 0 allows 0700 0750 0755 rejects 0770 0777, dedicated runtime parent immediate parent of socket eg privacy uid current dir not symlink mode 077 must be 0 strictly 0700 family rejects 0750 0755 socket 0600. No symlink following lstat. RunLoop pumping bridge for EKEventStore requestFullAccessToEvents deadlock avoid DispatchSemaphore wait on main thread. Bounded accepted clients size capped nonprompting default except explicit calendar.request_full_access foreground helper.
Build Xcode automatic signing wave batch plus Gitea backup before privileged migrations, validate bundle via service.health plus unique new operation semantic proof mtime unreliable.
Launchd ProgramArguments array native binary plus --socket path, RunAtLoad KeepAlive ProcessType Interactive working dir project log paths Library Logs reyna-cli privacy-host.* runtime dirs 0700.

## LaunchAgents user domain Library LaunchAgents

- com.local.macmini-mcp.plist LEGACY node --watch src/http.js WD Projects/MacMiniMCP symlink resolves to platform/MacMiniMCP logs .logs/service.*.log to be archived after reyna-cli coverage
- com.local.ksay-kokoro.plist Projects/MacMiniMCP/.venv/bin/python scripts/ksay_server.py WD MacMiniMCP logs ksay.out err TTS warm daemon 127.0.0.1:7332 keep used by both old and new
- com.reyna.cli.privacy-host.plist CANONICAL Reyna CLI.app Contents MacOS ReynaCLIHost --socket Library Application Support reyna-cli privacy reyna-cli.sock WD reyna-cli KeepAlways Interactive RunAtLoad
- com.reynafamily.reyna-cli.remarkable-listener.plist plus remarkable-sync.plist Paper Pro .132 UDP 49321 watchdog plus 30s sync to brain ~/brain areas notetaker etc
- ai.hermes.gateway.plist GW API 127.0.0.1:8642 model muse-spark-1.1 fallback openai-codex gpt-5-mini terra provider custom meta-claude
- com.adolforeyna.calendar-checkin.plist com.reyna.hermes-browser-dashboard-proxy.plist ancillary

Current plists reference old symlink-root paths that resolve via symlinks. Update to platform canonical only on explicit approval plus launchctl unload load.

## Hermes Plugins durable

- ~/.hermes/plugins/esp32-voice-gateway/ durable plugin bundled patch patch/*.patch self-heals api/esp32/voice WebSocket routes _handle_esp32_voice_ws ESP32_AUDIO_MAX_BYTES etc after hermes update wipes gateway/platforms/api_server.py in-tree patches. __init__.py checks api_server.py for ESP32 markers auto-applies patch via git apply logs actionable warning. Operator must run separate shell restart outside GW process SIGTERM guard cannot restart from inside gateway. Future v2 runtime injection monkeypatch.

- ~/.hermes/plugins/hermes-achievements/ scan_checkpoint state gamification.

## Cron Jobs .hermes/cron/jobs.json

- Script-only no agent spawn fast:
  - reyna_family_wind_down_whatsapp.py weekday 20:30 group 120363424746547296@g.us deliver local
  - reyna_morning_briefing_whatsapp.py daily 8am FamReynaBot group deliver local
  - chiapas_flight_price_monitor.py daily 7am Kayak monitor empty stdout no alert deliver origin
- Agent jobs:
  - weekly-coding-recap Mon 8am runs ~/.hermes/scripts/weekly_coding_recap.py to brain/areas/coding/recaps/YYYY-WXX.md updates areas/coding.md index silent unless fails. FIXED 2026-08-05: pinned provider openai-codex model gpt-5.6-terra via hermes cron edit 50b9ca5ec3cb --provider openai-codex --model gpt-5.6-terra — previously errored model drift gpt-5 to gpt-5.6-terra unpinned needs cronjob action update pin provider model.
- One-shots plant feed Aug14 Aug28 exact reminder push.

Scripts location ~/.hermes/scripts or bundled backup platform/reyna-cli/backup/macmini-automation-baseline-2026-08-03/hermes-scripts/weekly_coding_recap.py.

## Related brain files

- Areas: coding weekly recaps index, mac_privacy_migrations_2026 signing wave rules infra map, network devices_inventory raw_scans caddy_parsed git.reynafamily.com, operations hermes_migration_macmini_2026-08-02.md apple_mail_local_read_research
- Projects: para_brain_mcp_server brain Gitea FamReynaBrain.git ~/brain backed, voice_dev_infrastructure_2026 triad 102 110 150 plus GW 8642, voice_agent_platform_research_2026 open-gpt-live StreamCore fork, jarvis_v2_always_listening (iMac11,3 Intel i3 550 PipeWire Silero VAD openWakeWord hey_jarvis faster-whisper ECAPA faceID fusion), tactility_voice_gateway_elato_transition_2026, paseo_centralized_agents_2026, reyna_cli_browser_control Gemini Web image gen via iMac headed Chrome CDP 9222, pocketbase_family_baas_2026, electronics_xiao_epaper_400x300_2026, etc.
- READMEs: platform/README.md electronics/README.md voice-assistant/README.md in Projects

## Next

- Fix weekly-coding-recap cron pin job 50b9ca5ec3cb provider openai-codex model gpt-5.6-terra or pin original
- Add remaining privacy-host operations per reyna-cli-privacy-host skill Calendar events create list Contacts Reminders Notes automation_required boundary speech until MacMiniMCP coverage complete then archive com.local.macmini-mcp
- Update LaunchAgent working directories from symlink-root to platform canonical explicit approval plus unload load
- Verify after regroup: launchctl list grep macmini ksay reyna, uv run reyna-cli doctor --json, ls -l Library/Application Support/reyna-cli/privacy/reyna-cli.sock, curl macmini-mcp http tools
- Gitea inventory doc update when clawbot WFK_theme decision
- Keep this file single tracker update when new MCP tool skill cron LaunchAgent plugin added plus cross-ref to tactility-operations and reyna-cli-privacy-host skills references

[[Areas]] | [[Projects]]