Memory flush: Feb 14 — Cigna fraud, Shannon launch, dashboard redesign, context hygiene

memory/2026-02-14.md

@@ -0,0 +1,65 @@
+# 2026-02-14 (Saturday) — Valentine's Day
+
+## Context Hygiene Rules Added to AGENTS.md
+- Side questions → subagent always (keep main context clean)
+- Both units always (metric + imperial) — Johan's brain is metric, lives in US
+- Thinking level: match the task (no thinking for simple stuff)
+- Also added units preference to USER.md
+
+## myCigna — Autonomous Login Achievement
+- Installed real Google Chrome on forge (v145), runs on Xvfb:99 with CDP on port 9224
+- Headless Playwright gets WAF-blocked by Cigna; real Chrome on Xvfb works perfectly
+- Login flow: username=tjjongsma (NOT email), password in TOOLS.md
+- 2FA via email to tj@jongsma.me — grabbed code from MC automatically, zero human intervention
+- Full autonomous flow: login → 2FA → navigate → extract claims data
+- Credentials stored in TOOLS.md under "myCigna"
+
+## Baycare Ventilator Fraud (CRITICAL — Sophia)
+- **Baycare Home Care billing HCPCS E0465 (home ventilator) at $3,125/month**
+- **Sophia does NOT have a ventilator. Never had one from Baycare. Off vent since Nov 2022.**
+- Jan 10 claim #260155327900: $3,125 billed, $1,781.25 applied to deductible
+- Feb 10 claim #260540751600: $3,125 billed, still processing (also E0465)
+- Other Baycare charge E0431 ($121.60/mo) = portable oxygen rental — legitimate
+- Johan has notified both Baycare and Cigna **at least 3 times** before
+- **Family is extremely self-supporting**: concierge pediatrician, own suppliers (Tri-Med, Amazon), own portable O2 (Zen-O)
+- Baycare only provides: consumable supplies (gauze, trach ties, suction tubes, gloves, H2O2, etc.)
+- The ONLY equipment Baycare could legitimately bill for = suction machine (~$300)
+- **Strategy: Don't pay. Let them escalate. Documentation ready.**
+- Formal complaint drafted: ~/documents/records/medical/baycare-ventilator-fraud-complaint-2026-02-14.md
+- If ~38 months of E0465 since Nov 2022: potentially ~$118,750 in fraudulent charges
+
+## Cron Job Finalization
+- Git audit timeout bumped 120s → 300s
+- Evening Work Queue → Evening Briefing (now isolated agentTurn, same format as morning)
+- Both briefings now require: actual release notes/changelog with links for any software updates
+- Both briefings now include infrastructure/industry topics: memory pricing, HDD pricing, hyperscaler price changes, backup/MSP industry (Veeam, Commvault, Cohesity, Rubrik, NinjaOne, AvePoint, NABL, etc.)
+- Final cron count: 7 jobs (claude-usage, git-audit, morning briefing, evening briefing, nightly maintenance, weekly synthesis, Dr. Madan reminder)
+
+## Shannon Security Scanner — Live on Zurich VPS
+- Configured Claude Code Router (CCR) to proxy Anthropic SDK → Fireworks K2.5
+- Three containers: Temporal + Router (CCR on port 3456) + Worker
+- Portal-only source code uploaded: 55 Go files, 572KB, 15,700 lines
+- Excluded: internal tools, DICOM importers, MCP bridge, patient data, binaries
+- **Scan launched**: `inou-com_shannon-1771049779401` against https://inou.com
+- Fireworks K2.5 cost: ~$0.50 worst case for full scan
+
+## Alert Dashboard (port 9202) Redesign
+- Renamed conceptually to "Watchboard" / status board
+- Added DELETE endpoint + × dismiss button on alerts
+- Full redesign: Sora font, Braun/mid-century modern aesthetic, warm gold (#c8b273) accents
+- All 12 clock numbers, gold second hand with counterweight
+- Bigger fonts (16px alerts) for arm's length viewing on Fire tablet
+- Calendar month navigation (‹ › buttons)
+- Compact day headers (S M T W T F S) — fixes Saturday cutoff
+- Two-tone warm chime instead of harsh pling
+- Purpose: status updates (texts, Shannon waiting, sensor alerts), NOT news (news stays on James Dashboard 9200)
+
+## Closet Bins Search
+- Johan needs plastic bins for closet: 46W×46D×33H cm space, wants two side by side
+- Each bin ~23cm×46cm×33cm (9"×18"×13") — this form factor doesn't exist in standard retail
+- Suggested: one wider + one narrower bin, or IKEA/Container Store in person
+
+## Evening Briefing Test Run
+- Successfully generated and posted 7 news items to dashboard
+- OpenClaw 2026.2.13 release: HuggingFace support, write-ahead delivery queue, Discord voice messages, 337 commits
+- Confirmed briefing format works with individual news items + source URLs

memory/working-context.md

@@ -1,33 +1,34 @@
 # Working Context
 
-## Last Session: 2026-02-13 (RCA & Architecture Overhaul)
+## Last Session: 2026-02-14 (Cigna Investigation, Shannon Launch, Dashboard Redesign)
 
 ### What happened
-- Deep RCA on continuity loss → led to full infrastructure restructuring
-- Johan promoted me to Chief of Staff
-- Rebuilt email pipeline: K2.5 triage embedded in Message Center (Go binary at /home/johan/dev/message-center/)
-- MC triage prompt: ~/clawd/config/email-triage-prompt.md (hot-reloadable)
-- Killed K2.5 watchdog cron (288 phantom sessions/day)
-- Cleaned 2,514 orphaned session files
-- Daily reset moved from 4am → 9pm ET
-- Nightly Maintenance cron at 9pm (updates + memory flush + session cleanup)
-- Context pruning enabled (cache-ttl, 5m)
-- Email webhook moved from main → mail agent
+- myCigna autonomous login: real Chrome on Xvfb:99, CDP port 9224, 2FA via MC email
+- **Baycare ventilator fraud discovered**: billing E0465 ($3,125/mo) for ventilator Sophia doesn't have. 3+ prior notifications ignored. Complaint drafted.
+- Shannon security scanner live on Zurich VPS, scanning inou.com portal with K2.5 via CCR router
+- Alert dashboard (9202) redesigned: Braun/mid-century vibe, Sora font, larger text, calendar nav
+- Evening briefing cron upgraded from systemEvent → real isolated briefing
+- Both briefings now require release notes details + cover infrastructure/industry topics
+- Context hygiene rules added: subagent for side questions, dual units, thinking levels
 
 ### Active Projects
-- **MC triage** — just deployed, needs monitoring. Watch for false negatives (important emails getting trashed)
-- **Shannon VPS** (82.24.174.112) — Docker built, Shannon containers up, but API key has no credits. Needs top-up.
-- **Alert Dashboard** — running on port 9202, source at /home/johan/dev/alert-dashboard/
+- **Shannon scan** — running on zurich (82.24.174.112), workflow `inou-com_shannon-1771049779401`. Check results.
+- **Baycare fraud** — complaint at ~/documents/records/medical/. Strategy: don't pay, let escalate.
+- **MC triage** — deployed, monitoring for false negatives
+- **Alert Dashboard** — port 9202, redesigned, source at /home/johan/dev/alert-dashboard/
 - **Azure Files Backup** — feature complete, blocked on `az login` MFA. Free account expires ~Feb 27!
-- **inou Mobile** — Flutter app, WebView needs inou.com/app content
 - **Dr. Madan call** — Sunday Feb 15 at 2PM ET (reminder cron set, auto-deletes)
 
 ### Pending
 - Kaseya device policy change (BYOD → managed devices). Johan needs to request MacBook Pro.
 - Real estate: 851 Brightwaters listed at $7.25M on Zillow. Diana Geegan negotiating.
 - Belastingdienst: Dutch corporate tax filing reminder for 2025
+- Dashboard redesign feedback pending (Johan viewing on Fire tablet)
 
 ### Key Reminders
 - bird for X/Twitter — ALWAYS
 - memory_search before responding to references — MANDATORY
 - Right model for right job: Opus for judgment, K2.5 for grunt work
+- Side questions → subagent always (context hygiene)
+- Both units always (metric + imperial)
+- myCigna: username=tjjongsma, real Chrome on Xvfb (not headless Playwright)