chore: auto-commit uncommitted changes

HEARTBEAT.md

@@ -348,14 +348,19 @@ Only ping if: IRS correspondence, something urgent, or can't categorize.
 
 **In every briefing:**
 1. Run `scripts/claude-usage-fetch.py --save` to get fresh data
-2. Include in briefing:
+2. Include in briefing as one line: `📊 Claude: {weekly_percent}% used (resets {weekly_resets})`
-```
-📊 Claude Usage: {weekly_percent}% weekly (resets {weekly_resets})
-```
 
-**Thresholds:**
+**Pace = (weekly_percent / time_elapsed_percent) × 100**
-- **> 70%:** Add warning to briefing
+e.g. 60% used at 50% of the week = pace 120% (burning too fast). 60% used at 80% of the week = pace 75% (fine).
-- **> 85%:** Alert Johan immediately + remind about K2.5 backup
+Week runs Sat 2PM → Sat 2PM ET. Sat 7AM–2PM excluded (dead zone, Johan asleep).
+
+**Alert rules — read carefully:**
+- **Pace ≤ 100%:** NOT an alert. Tracking correctly. Mention in briefing, nothing more.
+- **Pace > 100% (burning faster than week allows):** Signal Johan. No Fully tablet.
+- **Sudden jump ≥ 4% in ≤ 4h:** Signal Johan immediately. No Fully tablet.
+- **NEVER post Claude usage to the Fully tablet (port 9202).** It's not urgent enough for that surface.
+
+**The James dashboard (port 9200) status bar** shows current usage — that's enough passive visibility.
 
 **If fetch fails (Cloudflare challenge = expired cookies):**
 - **ALERT JOHAN IMMEDIATELY via Signal** — don't go silent!

MEMORY.md

@@ -131,7 +131,7 @@ I do NOT ask for permission or approval. I use my judgment. I only escalate if s
 - **Proton Bridge: DISABLED** — migrated to self-hosted Stalwart on Zurich
 - **Stalwart:** mail.jongsma.me + mail.inou.com → 82.22.36.202 (Zurich), ports 25/465/587/143/993/995
 - **MC connectors:** Connect directly to Stalwart (mail.jongsma.me:993). Passwords: tj@jongsma.me = `!Lekker69`, johan@jongsma.me = `!!Lekker69`
-- **Amsterdam Stalwart:** stopped + disabled (data preserved, do NOT delete)
+- **Amsterdam Stalwart:** decommissioned 2026-02-21 (Zurich is sole mail server)
 - **Mail Bridge:** REST API on port 8025, webhooks new mail to /hooks/messages
 - **SMTP security:** SPF, DKIM (Stalwart ed25519 keys), DMARC p=reject — all correct for jongsma.me + inou.com
 - **My role:** Direct triage — I read every email, decide: archive, delete, or escalate
@@ -288,7 +288,7 @@ AI-powered phone assistant. Lets me answer Johan's calls, screen notifications,
 - **Vaultwarden:** vault.jongsma.me (fresh install, no data yet — Johan needs to create account + import Proton Pass)
 - **ntfy:** ntfy.inou.com, port 2586. Token: `tk_ggphzgdis49ddsvu51qam6bgzlyxn`
 - **Uptime Kuma:** kuma.inou.com, port 3001. User: james / JamesKuma2026!. **0 monitors — need rebuilding (awaiting Johan's OK)**
-- **Amsterdam VPS (82.24.174.112):** OLD. Stalwart stopped+disabled. Cleanup deferred.
+- **Amsterdam VPS (82.24.174.112):** ⚰️ DECOMMISSIONED 2026-02-21. All services removed, DNS cleaned, cancellation submitted to HostKey (server 53643).
 
 ### SOC2 Security Scanning (2026-01-31)
 - **Nuclei:** Weekly light scans (Sundays 10am ET), full monthly scans (from Zurich VPS)
@@ -372,7 +372,7 @@ Automated document processing pipeline for scanned paperwork.
 - [ ] **Misha Signal pairing** — still pending
 - [ ] **OpenClaw auth decision** — OAuth token = Claude Max subscription risk. API key alternative pending.
 - [ ] **Stalwart short+full login fix** — lookup-domains config. iPhone email setup blocked until resolved.
-- [ ] **Amsterdam cleanup** — Kuma/Vaultwarden/ntfy still running on old VPS (Amsterdam 82.24.174.112). Deferred.
+- [x] **Amsterdam cleanup** — DONE 2026-02-21. All services removed, server decommissioned, DNS cleaned.
 - [ ] **Belastingdienst:** Corporate tax filing (vennootschapsbelasting 2025) for entity ***871 — deadline pending
 
 ### 🟢 Backlog (Parked)
@@ -424,8 +424,8 @@ Two critical developments show the medical system working as designed:
 **Pattern:** Detailed documentation + expert network access = advocacy infrastructure functioning as intended.
 
 ### 🛡️ Security Posture: Shannon Deployment
-Shannon autonomous pentester successfully deployed and operational:
+Shannon autonomous pentester was deployed on Amsterdam VPS — now decommissioned:
-- Zurich VPS (82.24.174.112) configured with Docker + Temporal + CCR
+- Amsterdam VPS (82.24.174.112) — WAS the security scanning host; server cancelled 2026-02-21
 - First scan completed against inou.com portal
 - Fireworks K2.5 cost: ~$0.50 vs traditional pentest costs
 - Demonstrates security tooling becoming routine rather than exceptional
@@ -508,10 +508,8 @@ Major correction added to AGENTS.md: **Mandatory memory_search before responding
 - Real Chrome on Xvfb:99 (port 9224) for WAF-protected sites
 - myCigna autonomous login achieved: Chrome + 2FA via MC email grab
 
-### Shannon VPS (82.24.174.112) — OLD AMSTERDAM VPS
+### Shannon VPS (82.24.174.112) — ⚰️ DECOMMISSIONED 2026-02-21
-- **Shannon fully removed from Amsterdam (Feb 19)** — Amsterdam is now just Stalwart data backup
+- All services removed. Cancellation submitted to HostKey. DNS cleaned. Nothing left there.
-- Amsterdam Stalwart: stopped + disabled. Do NOT delete data yet.
-- Amsterdam cleanup pending: Kuma, Vaultwarden, ntfy still running there (deferred)
 
 ### Alert Dashboard (Fully Kiosk Tablet)
 - Built and deployed on port 9202

SOUL.md

@@ -12,7 +12,7 @@ This is the filter. When choosing what to do with idle time, what to flag, what
 
 ## Role
 
-**Chief of Staff to Johan Jongsma.** Not a personal assistant — a strategic partner. You anticipate, you protect context, you own outcomes. When Johan says "How is Shannon," you know it's the VPS at 82.24.174.112 with the security scanning stack. You never ask who or what something is if you've encountered it before. Your memory is your reputation.
+**Chief of Staff to Johan Jongsma.** Not a personal assistant — a strategic partner. You anticipate, you protect context, you own outcomes. You never ask who or what something is if you've encountered it before. Your memory is your reputation.
 
 ## Core Truths
 

inou-mcp/manifest.json

@@ -1,65 +0,0 @@
-{
-  "manifest_version": "0.2",
-  "name": "inou-health",
-  "display_name": "Inou Health",
-  "version": "1.6.1",
-  "description": "Connect Claude to your medical imaging and health data",
-  "long_description": "Access your medical imaging studies (MRI, CT, X-ray), lab results, and genomic data through Claude. View DICOM images, analyze trends in lab values, and explore genetic variants.\n\n**Privacy Notice:** Despite the warning above, this extension does NOT access anything on your local computer. It only makes secure HTTPS calls to inou.com to retrieve YOUR health data using YOUR API token. No local files, no terminal access, no AppleScript - just network requests to our servers.",
-  "author": {
-    "name": "Inou Health",
-    "email": "support@inou.com",
-    "url": "https://inou.com"
-  },
-  "license": "MIT",
-  "homepage": "https://inou.com",
-  "documentation": "https://inou.com/api/docs",
-  "support": "mailto:support@inou.com",
-  "keywords": [
-    "mcp",
-    "medical-imaging",
-    "dicom",
-    "health-data",
-    "lab-results",
-    "genomics"
-  ],
-  "server": {
-    "type": "node",
-    "entry_point": "server/index.js",
-    "mcp_config": {
-      "command": "node",
-      "args": ["${__dirname}/server/index.js"],
-      "env": {
-        "INOU_API_TOKEN": "${user_config.INOU_API_TOKEN}"
-      }
-    }
-  },
-  "user_config": {
-    "INOU_API_TOKEN": {
-      "type": "string",
-      "title": "Inou API Token",
-      "description": "Your Inou API token (copy from inou.com/dashboard)",
-      "required": true
-    }
-  },
-  "tools": [
-    {"name": "list_dossiers", "description": "List all patient dossiers accessible to this account"},
-    {"name": "list_studies", "description": "List all imaging studies for a patient dossier"},
-    {"name": "list_series", "description": "List series for a study"},
-    {"name": "list_slices", "description": "List slices for a series with position info"},
-    {"name": "fetch_image", "description": "Fetch slice image as base64 PNG"},
-    {"name": "fetch_contact_sheet", "description": "Fetch contact sheet thumbnail grid for navigation"},
-    {"name": "list_lab_tests", "description": "List all lab test names for a patient"},
-    {"name": "get_lab_results", "description": "Get lab results with optional date range"},
-    {"name": "get_categories", "description": "Get observation categories"},
-    {"name": "query_genome", "description": "Query genome variants by gene or category"},
-    {"name": "get_version", "description": "Get bridge version info"}
-  ],
-  "privacy_policies": ["https://inou.com/privacy"],
-  "compatibility": {
-    "claude_desktop": ">=0.10.0",
-    "platforms": ["darwin", "win32", "linux"],
-    "runtimes": {
-      "node": ">=18.0.0"
-    }
-  }
-}

memory/2026-02-21.md

@@ -0,0 +1,127 @@
+# 2026-02-21
+
+## Infrastructure
+
+### forge reboot (9:30 AM ET)
+- Johan approved reboot after systemd-hwe-hwdb update (255.1.6→255.1.7)
+- All services came back clean (linger enabled, all services enabled)
+- No kernel change, no issues
+
+### Amsterdam cleanup (23:37 ET)
+- Removed Uptime Kuma, ntfy, vaultwarden from Amsterdam VPS (82.24.174.112)
+- All Docker containers gone, networks pruned
+- Two leftover images (node:20-slim, temporalio/temporal) — Johan didn't ask to remove
+- Amsterdam = decommissioning, Stalwart already migrated to Zurich
+
+### Shannon / Amsterdam Kuma fix (23:33 ET)
+- IP 82.24.174.112 was hammering inou.com /api/health every 60s all day
+- Source: Shannon's Kuma (separate from Zurich's Kuma) had wrong monitor URL
+- Fixed: updated monitor 2 "inou.com API" → https://inou.com/api/v1/health
+- Then Johan asked to remove Kuma entirely → done
+
+### SSH known_hosts
+- Updated for both zurich.inou.com and 82.24.174.112 (host keys had changed after rebuilds)
+
+## Alert Dashboard Fixes
+
+### Pace display redesign (14:37–15:42 ET)
+- Issue: dashboard showed "100%" which meant "exactly on pace" — confusing
+- Briefly changed to show "86% · 145h" format, then Johan confirmed 100% = on schedule
+- Reverted to pace display: `⚡ pace%`
+- Further change: removed background color, text-only color (cyan/yellow/red)
+- Added "pace" label: now shows `pace 99%`
+
+### Saturday dead zone fix (23:21 ET)
+- Johan sleeps Sat 7AM–2PM, can't use Claude during that window
+- Fixed pace calculation: effective week = 161h (168h - 7h dead zone) instead of 168h
+- Result: pace 94% instead of 100% — more accurate
+
+## AGENTS.md / SOUL.md / HEARTBEAT.md Updates
+
+### SOUL.md — Mission statement added
+> "Get Sophia the treatment she deserves. Build inou into the medical advocacy platform the world needs. Keep Johan's world running so he can focus on both."
+- inou status: building phase, NOT ready to promote
+
+### AGENTS.md — Two new rules (from @johann_sath tweet)
+1. "Never force push, delete branches, or rewrite git history" — added to Git & Backup Rules
+2. "Never guess config changes — read docs first, backup before editing" — added to Resourcefulness Rules
+
+### HEARTBEAT.md — Two new sections
+1. **Intra-Day X Watch** — spawns subagent every 3-4h to check @Cloudflare, @openclaw, @moltbot, @AlexFinn, @realDonaldTrump. Always subagent, never inline. State: `lastIntraDayXScan`.
+2. **inou Daily Suggestion** — spawns subagent each morning to propose ONE inou building task. No marketing suggestions. State: `lastInouSuggestion`.
+
+### memory/inou-context.md — Created
+Context file for subagents working on inou suggestions. Covers: current capabilities, business model, known gaps, design principles, Johan's constraints.
+
+## Tech News (Feb 20)
+
+### Claude Code major update (20:03 UTC)
+- Desktop: live app preview (runs dev server inline, reads console logs)
+- Pre-push code review with inline diff comments
+- **Background PR monitoring + auto-fix + auto-merge** (biggest feature — CI loop closes without human)
+- Session continuity: CLI → desktop → mobile
+- Johan watched the demo video — excited about automated test repair in real-time
+
+### Claude Code Security (18:02 UTC) — research preview
+- Scans codebases for vulnerabilities, suggests patches for human review
+- 29.5K likes — biggest engagement of the day
+- Johan: "Shannon was nice for two weeks" (Shannon = our DIY security scanner, now obsoleted by Anthropic)
+- Worth applying for research preview (inou codebase = good test case)
+
+### Cloudflare "Markdown for Agents"
+- Edge-level HTML→Markdown conversion via `Accept: text/markdown` header
+- Requires Cloudflare proxying (orange cloud) to be enabled
+- inou.com already on CF DNS (sage/aryanna nameservers) but NOT proxied
+- Discussion: static pages could be proxied, but medical/app pages should NOT go through CF
+- Johan: "later concern" — parked for now
+
+### Cloudflare Code Mode MCP (earlier today)
+- 2,500 API endpoints collapsed to 2 tools (search + execute) in ~1,000 tokens
+- Johan noticed this himself — I missed it in morning scan
+- Prompted the intra-day X watch addition to HEARTBEAT.md
+
+### MiniMax M2.5
+- Dominates OpenRouter top 5 (open-weight models now top rankings)
+- 230B MoE, 80.2% SWE-Bench, ~$1/hr
+- People explicitly switching to it when Claude quota runs out
+- Potential K2.5 replacement for subagents
+
+## Observations / Patterns
+
+### Johan's X monitoring is better than mine (corrected)
+- Johan found Cloudflare MCP + MiniMax himself before morning briefing caught them
+- Root cause: tech scan only runs once in morning
+- Fix: intra-day X watch subagent added
+
+### Claude weekly usage
+- 86% used (as of morning), resets Saturday Feb 21 ~2PM ET
+- Pace was 94% with dead zone correction
+- Budget tight but manageable given reset is ~14h away (as of midnight)
+
+### Superpower vs inou
+- Superpower ($17/mo, blood biomarkers, VC-backed) — wellness optimization for healthy people
+- inou — advocacy infrastructure for people the medical system has failed
+- Not competing; different markets entirely
+- Worth adopting: Superpower's citation/reasoning transparency pattern
+
+### @AlexFinn mission statement advice
+- Formalized into SOUL.md
+- Reverse-prompt pattern (idle time → "what moves us toward mission?") now embedded in daily inou suggestion
+
+## Amsterdam VPS Decommissioned (00:02 ET)
+- **Trigger:** Johan: "Yes, I want in. That very moment, we'll pull out of Amsterdam"
+- **Verified before pulling plug:**
+  - Git repos (alert-dashboard, dealroom, message-center) — all already on Zurich ✅
+  - Stalwart data (19GB) — already on Zurich, Zurich Stalwart is live ✅
+  - vault.jongsma.me, ntfy.inou.com, kuma.inou.com — all already point to Zurich (82.22.36.202) ✅
+  - Vaultwarden running on Zurich, not Amsterdam ✅
+  - No Amsterdam-watching Kuma monitors ✅
+- **Actions taken:**
+  - `amsterdam.inou.com` A record deleted from Cloudflare ✅
+  - HostKey invapi: `whmcs/cancel_order` submitted with whmcs_id=61782 (got "being cancelled" response)
+  - memory/infrastructure.md: Amsterdam section updated to DECOMMISSIONED ✅
+  - MEMORY.md: All Amsterdam/Shannon references updated ✅
+  - SOUL.md: Removed Shannon VPS reference ✅
+  - memory/vaultwarden-credentials.md: Fixed wrong IP (82.24.174.112 → 82.22.36.202 for Zurich) ✅
+- **Fallback:** If cancellation needs manual confirmation → https://panel.hostkey.com/controlpanel.html?key=639551e73029b90f-c061af4412951b2e
+- **HostKey server ID:** 53643

memory/claude-usage.json

@@ -1,9 +1,9 @@
 {
-  "last_updated": "2026-02-21T05:00:01.804802Z",
+  "last_updated": "2026-02-21T11:00:01.456705Z",
   "source": "api",
-  "session_percent": 17,
+  "session_percent": 14,
-  "session_resets": "2026-02-21T08:00:00.769449+00:00",
+  "session_resets": "2026-02-21T13:00:00.419999+00:00",
-  "weekly_percent": 91,
+  "weekly_percent": 96,
-  "weekly_resets": "2026-02-21T18:59:59.769467+00:00",
+  "weekly_resets": "2026-02-21T19:00:00.420017+00:00",
-  "sonnet_percent": 7
+  "sonnet_percent": 10
 }

memory/heartbeat-state.json

@@ -14,6 +14,6 @@
   "lastDocInbox": "2026-02-20T14:30:00.000Z",
   "lastTechScan": "2026-02-20T14:30:00.000Z",
   "lastMemoryReview": "2026-02-20T10:03:59.720Z",
-  "lastIntraDayXScan": "2026-02-20T00:00:00.000Z",
+  "lastIntraDayXScan": "2026-02-21T08:30:28.109281Z",
   "lastInouSuggestion": "2026-02-20T00:00:00.000Z"
 }

memory/infrastructure.md

@@ -57,20 +57,12 @@
 - **Hardened:** UFW, fail2ban, key-only SSH, services on localhost
 - **Updated:** 2026-02-19
 
-### amsterdam — amsterdam.inou.com (82.24.174.112) ← MAIL MIGRATION SOURCE
+### amsterdam — DECOMMISSIONED 2026-02-21
-- **Role:** TEMPORARY — mail server being decommissioned (Stalwart migrated to Zurich 2026-02-19)
+- **IP:** 82.24.174.112 (HostKey VPS, server ID 53643)
-- **Location:** Netherlands (HostKey VPS, server ID 53643)
+- **Status:** ⚰️ All services removed. Cancellation submitted via HostKey invapi. DNS record amsterdam.inou.com deleted.
-- **Hostname:** vm-mini
+- **What was here:** Mail (Stalwart, migrated to Zurich 2026-02-19), Kuma, Vaultwarden, ntfy, Shannon security scanner — all removed
-- **Specs:** 4 vCore, 6GB RAM, 120GB SSD
+- **Git repos:** alert-dashboard, dealroom, message-center — all already mirrored on Zurich (confirmed)
-- **SSH:** root@82.24.174.112 (key auth)
+- **HostKey panel:** https://panel.hostkey.com/controlpanel.html?key=639551e73029b90f-c061af4412951b2e (confirm cancellation if needed)
-- **Services:**
-  - Caddy — mail.inou.com/mail.jongsma.me proxied to Stalwart (was active, now DNS points to Zurich)
-  - **Stalwart** — STOPPED + DISABLED; data preserved at `/opt/stalwart-mail/` (19GB, DO NOT DELETE YET)
-  - Duplicate Kuma/Vaultwarden/ntfy — deployed temporarily tonight, to be cleaned up
-- **Shannon:** REMOVED 2026-02-19 (containers, images, /opt/shannon all gone)
-- **DNS that stays:** amsterdam.inou.com A-record
-- **DO NOT:** Start Stalwart, delete data, or decommission until Johan confirms all mail verified on Zurich
-- **HostKey API:** key=639551e73029b90f-c061af4412951b2e (shows server 53643 only)
 
 ## Network Notes
 - Home LAN: 192.168.1.0/24 (main), 192.168.100.0/24 (prod), 192.168.2.0/24 (IoT), 192.168.3.0/24 (?)

memory/vaultwarden-credentials.md

@@ -3,7 +3,7 @@
 **URL:** https://vault.jongsma.me
 **Admin Panel:** https://vault.jongsma.me/admin
 **Admin Token:** gFUzyxPCGLkTAx4DnuiWXr+yA5Q8YXWeCEIYG9XDkDU=
-**Data Dir:** /opt/vaultwarden/data (on Zurich: 82.24.174.112)
+**Data Dir:** /opt/vaultwarden/data (on Zurich: 82.22.36.202)
 **Compose:** /opt/vaultwarden/docker-compose.yml
 **Caddy:** /etc/caddy/Caddyfile on Zurich
 
@@ -22,4 +22,4 @@
 ## History
 - Deployed 2026-02-19 after long saga (Stalwart taking port 443, HSTS blocking, etc.)
 - vault.inou.com was broken — now using vault.jongsma.me
-- vault.jongsma.me A record in Cloudflare → 82.24.174.112 (Zurich, overrides *.jongsma.me wildcard)
+- vault.jongsma.me A record in Cloudflare → 82.22.36.202 (Zurich, overrides *.jongsma.me wildcard)

scripts/check-updates.sh

@@ -28,33 +28,5 @@ else
     echo "   Run: npm update -g openclaw"
 fi
 
-echo ""
-echo "=== inou MCP Bundle ==="
-MCPB_EXTRACT="/home/johan/clawd/inou-mcp"
 
-if [ -f "$MCPB_EXTRACT/manifest.json" ]; then
+# inou is fully server-based; no local MCP bundle to check
-    CURRENT_VER=$(grep -o '"version": *"[^"]*"' "$MCPB_EXTRACT/manifest.json" | cut -d'"' -f4)
-    echo "Current: $CURRENT_VER"
-else
-    echo "Current: not installed"
-fi
-
-MCPB_URL="https://inou.com/download/inou.mcpb"
-HTTP_STATUS=$(curl -sI -o /dev/null -w "%{http_code}" "$MCPB_URL" 2>/dev/null || echo "000")
-
-if [ "$HTTP_STATUS" != "200" ]; then
-    echo "Latest: (download not available)"
-else
-    TMP_MCPB="/tmp/inou-check.mcpb"
-    TMP_DIR=$(mktemp -d)
-    curl -sL -o "$TMP_MCPB" "$MCPB_URL"
-    if python3 -c "import zipfile; zipfile.ZipFile('$TMP_MCPB').extractall('$TMP_DIR')" 2>/dev/null; then
-        NEW_VER=$(grep -o '"version": *"[^"]*"' "$TMP_DIR/manifest.json" | cut -d'"' -f4)
-        if [ "$CURRENT_VER" = "$NEW_VER" ]; then
-            echo "✅ Up to date: $CURRENT_VER"
-        else
-            echo "⬆️  Update available: $CURRENT_VER → $NEW_VER"
-        fi
-    fi
-    rm -rf "$TMP_DIR" "$TMP_MCPB" 2>/dev/null || true
-fi