feat: amanita external probe (timer + vx-only key)

2026/2026-09-18--amanita-external-probe.md

@@ -0,0 +1,39 @@
+# 2026-09-18 — koopa as external amanita probe logger
+
+## Why
+
+Amanita hard hangs leave no panic; internal heartbeat stops with the box.
+External ICMP+SSH from **koopa** records last-alive independently so hang vs
+power/PSU can be separated after the next freeze.
+
+## Live (hernani@koopa)
+
+| Piece | Detail |
+|-------|--------|
+| Key | `~/.ssh/id_ed25519_amanita_probe` — fingerprint `SHA256:R2i2nZfI1svR6Ts3DaSw5eZj2fvnGgm1R9PoMFS4Jj0` |
+| SSH Host | `amanita-probe` → `vx@192.168.100.6`, IdentityFile that key only |
+| Script | `~/.local/bin/koopa-amanita-probe` (SoT: `scripts/amanita-probe/`) |
+| Timer | user `koopa-amanita-probe.timer` ~15 s, linger yes |
+| Log | `~/.local/state/amanita-probe/amanita-probe.{log,last,meta}` — owned by hernani, mode 644 |
+
+## amanita vx (only)
+
+Restricted `authorized_keys` line (not on root):
+
+```text
+from="192.168.100.95",no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-pty,command="/bin/cat /var/lib/amanita/heartbeat.last" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBeMenvp0D9EarfAEUtu49Q7bCbGhw+R/E1nJPQSSmZc koopa-amanita-probe@hernani-koopa
+```
+
+Forced command only cats the world-readable HB mirror. No shell, no agent/X11/port forward.
+
+## Verify (2026-09-18 ~15:09 CEST)
+
+- `systemctl --user is-active koopa-amanita-probe.timer` → active
+- `ssh amanita-probe` → EXIT 0, one HB line
+- meta: `icmp=ok ssh=ok gap_s≈15`
+- hernani can read the probe log dir on koopa (owner)
+
+## Docs / install
+
+`scripts/amanita-probe/README.md` + `install-amanita-probe.sh`.
+Do **not** put this key on root AK; do **not** bare `modprobe ramoops`.