# Working Context
*Updated: 2026-03-12 21:00 ET (nightly maintenance)*

## Status: Active — Security incident resolved, S short profitable, inou SMTP was wrong (fixed in memory)

---

## Current Projects

### George (vault1984 Writer Agent) — LIVE ✅
- Discord bot: App ID `1480980894042030211`, username `George`
- Workspace: `/home/johan/george/` (SOUL.md, USER.md, AGENTS.md written)
- OC config: `accounts.george` wired, gateway restarted
- Bot connected and live on Discord

### inou.com — Active Development
- **101+ uncommitted files** in `/home/johan/dev/inou/` — growing, needs commit + push
- **SMTP correction (Mar 12):** Johan corrected the briefing nudge — inou uses Proton SMTP token directly (`smtp.protonmail.ch:587`), NOT Proton Bridge. No bridge needed. Memory updated.
- 2 unpushed commits on master
- dealspace: 1 unpushed commit on master (still)
- james-dashboard: 3 unpushed commits (still)

### SentinelOne (S) — Short Position ✅ Profitable
- Q4 earnings dropped Mar 12 AH (~5 PM ET)
- Revenue: **$271.2M** (+20% YoY) — exactly in line, no beat
- EPS: $0.07 vs $0.06 est (tiny beat)
- ARR: $1.12B (+22% YoY)
- **Soft Q1 guidance** → stock dropped AH. Short is winning.
- Stock closed at ~$11.55 before earnings, sliding after hours

### Kaseya M365 Integration — PERMANENTLY REMOVED ✅
- Dead since Feb 27; Johan decided to abandon
- 9 stale Kaseya alerts cleaned from Watchboard (Fully dashboard, port 9202) on Mar 12

### Security Incident — RESOLVED (Mar 12)
- **`python3 -m http.server` running on port 9999 for 5+ days** (started ~Mar 7)
- Was serving `/tmp` to entire LAN with no auth
- Exposed: `clawvault-preview.db` (vault WAL), `chrome_import.csv`, other temp files
- **Johan: kill it, burn it, bury it, DELETE** → Done. Shredded files.
- Stale M365 OAuth callback server (localhost-only) also killed
- **Johan's preference: Go over Python.** Python only for temporary one-off tools.

### Python Inventory (Johan wants Go-first)
Running Python (system, untouchable): fail2ban, unattended-upgrades
Johan's code that's Python:
- `inou/health-poller` — 18 .py files, active Renpho + health data integration
- `mail-agent` — superseded by MC (Go), can be deleted
- `clawd/scripts/` — various one-off scripts (OK to stay Python for now)

---

## Open Threads / Pending Decisions

1. **inou git** — 82+ uncommitted files; needs commit + push to Zurich (ongoing)
2. **dealspace** — 1 unpushed commit on master
3. **james-dashboard** — 3 unpushed commits on master
4. **clawd** — 1 unpushed commit on master (may vary)
5. **X watch double-fire bug** — race condition on heartbeat state writes; same story pings Telegram twice. Fix: atomic write / lock before spawning
6. **vault1984 / inou architecture** — Hans's agentchat discussion pending follow-up
7. **inou health-poller Python** — Johan prefers Go; consider rewrite eventually
8. **mail-agent Python** — superseded by MC; candidate for deletion

---

## Recent Context (Mar 12)

### Early Morning (1–5 AM ET)
- Git audit: inou 5 uncommitted + 2 unpushed; james-dashboard 2 unpushed; dealspace 29 unpushed
- OpenClaw 2026.3.11 "Hunter & Healer Alpha" dropped — 1M ctx free models via OpenRouter, GPT 5.4 bug fix, Gemini Embedding 2 for memory. Alerted Johan via Telegram (3:39 AM, night shift).
- Johan asked about S earnings → confirmed reporting AH Mar 12. Cron set for 4:05 PM ET.

### Morning Briefing (9:45 AM ET)
- Iran/Hormuz Crisis: US sank 16 Iranian minelayers, Brent +4.8% → $92, WTI +4.6% → $87
- IEA releasing 400M barrels — largest emergency release in history
- SentinelOne Q4 earnings: same day AH, Johan short

### Afternoon (13:30–15:00 ET via OpenClaw TUI)
- **Kaseya alerts purge**: Johan asked why Watchboard still had Kaseya alerts; 9 stale alerts deleted from alerts.json
- **Port 9999 cleanup**: Johan noticed port 9999 security alert — discovered python3 http.server serving /tmp to LAN for 5+ days. Killed and files shredded.
- **Python audit**: Johan asked what Python is still running. Identified active items, stale M365 callback killed.
- **inou SMTP correction**: Johan corrected wrong nudge — inou uses direct Proton SMTP token, not bridge. Memory updated.

### Evening (17:45–18:00 ET via Telegram)
- Johan asked about S earnings → results were in. Short is profitable (soft Q1 guidance drove AH drop).

### Evening Briefing (20:17 ET)
- S&P 500: 6,740 (−0.8%, broke 50 & 100-day MAs)
- Oil surged >$100/bbl — Iran blocked Strait of Hormuz, Iraq halted oil ports
- US releasing 172M barrels from SPR
- Markets: risk-off across the board

---

## Infrastructure Notes

- forge (192.168.1.16) = sole active instance, all services live
- 192.168.1.17 = old server, all user services stopped/disabled
- George agent workspace: `/home/johan/george/`
- MC pipeline: tj@jongsma.me + johan@jongsma.me + WhatsApp (no M365)
- Watchboard (port 9202): working, Kaseya column permanently paused + alerts purged
- inou SMTP: uses Proton SMTP token directly (NOT Proton Bridge)
- **OC version:** 2026.3.11 (up to date)
- **Claude Code version:** 2.1.74 (up to date)