clawd/memory/2026-02-14.md

2026-02-14 (Saturday) — Valentine's Day

Context Hygiene Rules Added to AGENTS.md

• Side questions → subagent always (keep main context clean)
• Both units always (metric + imperial) — Johan's brain is metric, lives in US
• Thinking level: match the task (no thinking for simple stuff)
• Also added units preference to USER.md

myCigna — Autonomous Login Achievement

• Installed real Google Chrome on forge (v145), runs on Xvfb:99 with CDP on port 9224
• Headless Playwright gets WAF-blocked by Cigna; real Chrome on Xvfb works perfectly
• Login flow: username=tjjongsma (NOT email), password in TOOLS.md
• 2FA via email to tj@jongsma.me — grabbed code from MC automatically, zero human intervention
• Full autonomous flow: login → 2FA → navigate → extract claims data
• Credentials stored in TOOLS.md under "myCigna"

Baycare Ventilator Fraud (CRITICAL — Sophia)

• Baycare Home Care billing HCPCS E0465 (home ventilator) at $3,125/month
• Sophia does NOT have a ventilator. Never had one from Baycare. Off vent since Nov 2022.
• Jan 10 claim #260155327900: $3,125 billed, $1,781.25 applied to deductible
• Feb 10 claim #260540751600: $3,125 billed, still processing (also E0465)
• Other Baycare charge E0431 ($121.60/mo) = portable oxygen rental — legitimate
• Johan has notified both Baycare and Cigna at least 3 times before
• Family is extremely self-supporting: concierge pediatrician, own suppliers (Tri-Med, Amazon), own portable O2 (Zen-O)
• Baycare only provides: consumable supplies (gauze, trach ties, suction tubes, gloves, H2O2, etc.)
• The ONLY equipment Baycare could legitimately bill for = suction machine (~$300)
• Strategy: Don't pay. Let them escalate. Documentation ready.
• Formal complaint drafted: ~/documents/records/medical/baycare-ventilator-fraud-complaint-2026-02-14.md
• If ~38 months of E0465 since Nov 2022: potentially ~$118,750 in fraudulent charges

Cron Job Finalization

• Git audit timeout bumped 120s → 300s
• Evening Work Queue → Evening Briefing (now isolated agentTurn, same format as morning)
• Both briefings now require: actual release notes/changelog with links for any software updates
• Both briefings now include infrastructure/industry topics: memory pricing, HDD pricing, hyperscaler price changes, backup/MSP industry (Veeam, Commvault, Cohesity, Rubrik, NinjaOne, AvePoint, NABL, etc.)
• Final cron count: 7 jobs (claude-usage, git-audit, morning briefing, evening briefing, nightly maintenance, weekly synthesis, Dr. Madan reminder)

Shannon Security Scanner — Live on Zurich VPS

• Configured Claude Code Router (CCR) to proxy Anthropic SDK → Fireworks K2.5
• Three containers: Temporal + Router (CCR on port 3456) + Worker
• Portal-only source code uploaded: 55 Go files, 572KB, 15,700 lines
• Excluded: internal tools, DICOM importers, MCP bridge, patient data, binaries
• Scan launched: inou-com_shannon-1771049779401 against https://inou.com
• Fireworks K2.5 cost: ~$0.50 worst case for full scan

Alert Dashboard (port 9202) Redesign

• Renamed conceptually to "Watchboard" / status board
• Added DELETE endpoint + × dismiss button on alerts
• Full redesign: Sora font, Braun/mid-century modern aesthetic, warm gold (#c8b273) accents
• All 12 clock numbers, gold second hand with counterweight
• Bigger fonts (16px alerts) for arm's length viewing on Fire tablet
• Calendar month navigation (‹ › buttons)
• Compact day headers (S M T W T F S) — fixes Saturday cutoff
• Two-tone warm chime instead of harsh pling
• Purpose: status updates (texts, Shannon waiting, sensor alerts), NOT news (news stays on James Dashboard 9200)

Closet Bins Search

• Johan needs plastic bins for closet: 46W×46D×33H cm space, wants two side by side
• Each bin ~23cm×46cm×33cm (9"×18"×13") — this form factor doesn't exist in standard retail
• Suggested: one wider + one narrower bin, or IKEA/Container Store in person

Evening Briefing Test Run

• Successfully generated and posted 7 news items to dashboard
• OpenClaw 2026.2.13 release: HuggingFace support, write-ahead delivery queue, Discord voice messages, 337 commits
• Confirmed briefing format works with individual news items + source URLs

Fully Dashboard Overhaul (2:00am - 2:30am)

Changes Made

• Alerts moved to left (58/42 split), clock/calendar on right
• Long-press (300ms) to mark done — dims + strikethrough, auto-purge after 2h
• Timestamps brightened — was #555, now #777-#888
• Pulse-ox camera feed — MJPEG stream via HA proxy (/api/cam/pulse-ox/stream), shows 7pm-8am only
  • Entity: camera.pulse_ox_live_view (Tapo camera at 192.168.2.183)
  • HA token passed via systemd env to alert-dashboard service
  • MJPEG stream works natively in <img> tag — no ffmpeg needed
• Typography cleanup — consolidated to 3 font sizes, 2 weights, consistent spacing
• Email triage redirected — MC dashboard_url changed from 9202 → 9200 (news API), no more triage noise on Fully board
• Hook announcements silenced — messages webhook set deliver: false
• ffmpeg installed on forge (for future use)

Architecture: Fully Dashboard (port 9202)

• Purpose: Johan's unified inbox / notification center on Fire tablet with Fully Kiosk
• API: /api/alerts (POST message+priority, GET list, PATCH done, DELETE)
• SSE: /api/alerts/stream for live push
• Camera: /api/cam/pulse-ox (snapshot) and /api/cam/pulse-ox/stream (MJPEG)
• Priority levels: critical (red), warning (amber), info (gold)
• Sound: Web Audio API chime on new alerts (gain 0.1)
• Source: /home/johan/dev/alert-dashboard/
• Service: alert-dashboard.service (systemd user)

Key Decision: Fully Board = Johan's Inbox

• Everything that survives my triage → Fully dashboard alert
• Three tiers: critical (act NOW), warning (needs you today), info (FYI)
• Email, WhatsApp, calendar reminders, system alerts — all go here
• Johan stops checking email/phone — I'm the filter
• CMMC meetings: skip by default (Johan doesn't attend)

Calendar Flow (designed, not yet implemented)

• Johan sends screenshot of Outlook list view each morning
• I OCR it, parse meetings, set 5min + 1min cron alerts to Fully board
• List view = machine-readable (exact times, no guessing from pixels)
• Week of Feb 16-20 parsed as proof of concept

WhatsApp Visibility

• MC has WhatsApp messages via message-bridge on port 8030
• Tanya's number: +17272253810
• She sent laborwerte_1457_tmp.pdf (lab results) at 8:22pm Feb 13
• Johan wants to be alerted about messages, not have me interpret them

Contacts

• +13474999485 — sent Johan Valentine's message on WhatsApp (unknown contact, uses "iyawo")

James Dashboard Fix (2:38am)

• News items now clickable — titles link to source URL when available
• Briefing agent sometimes grabs wrong URLs (Gemini article linked to Wordle page) — need to improve URL capture in briefing prompts

Johan's Desk Layout

• Left monitor: TUI console (OpenClaw CLI)
• Center: Fully dashboard (Fire tablet with Fully Kiosk, port 9202) — promoted to center
• Center-back: Sophia room camera (Tapo standalone, redundant backup while Fully proves stability)
• Right monitor: James Dashboard (port 9200)

Sophia Monitoring Stack

• Primary: VTech radio baby monitor — reliable (radio, not WiFi), beeps on power loss
• Visual: Tapo WiFi camera (192.168.2.183) + Fully dashboard MJPEG stream
• Pulse-ox: Visible on Tapo camera feed (typical restful values: 98% SpO2, 73 HR)
• WiFi camera is nice-to-have, VTech is safety-critical
• Johan listens to her breathing — prefers hearing it over silence

Email Triage (4:18 PM)

• Processed 34 messages (19 tj, 15 johan)
• Generator: 48kw ran 3x today (power outages 11:23, 11:31, 11:48 AM). GenerX tech Eduardo Rivera came for service. Service form archived.
• Bounces: 10 bounce-backs on johan@ from inou pentest probes (example.com, pentest@inou.com) — expected
• Deliveries: TP-Link Ultra-Portable delivered. Orders #4720443389 and #12539598 shipped.
• Archived: GenerX service form, order confirmations (4720443389, Nordstrom 1026793809)
• Trashed: Duke Energy usage alert, Mint Mobile survey (Mikhail), Realtor listing for own house, generator notifications, political newsletter, subscriber agreement update, marketing/spam, Valentine's lingerie promos, hardware spam
• MC issue: LLM triage failing with 401 (API key invalid), requests taking 15s+

Shannon Scan Complete

• Full pentest of inou.com via Shannon Lite on Sonnet 4.5 (OAuth token direct to Anthropic)
• Runtime: ~1.5 hours
• Findings: 2 CRITICAL (hardcoded backdoor 250365, session hijacking), 2 HIGH (session fixation, brute force)
• Authorization, SQLi, SSRF all passed clean
• 3 out-of-scope items needing internal access (path traversal, DICOM XSS, LLM prompt injection XSS)
• PowerPoint generated and placed on sophia SMB share
• All deliverables at ~/clawd/memory/shannon-scan-2026-02-14/

Prima (UMich Brain MRI AI)

• Deep dive completed — open source MIT, VLM for 50+ neuro conditions, 97.5% accuracy
• Needs Ampere+ GPU (L40S reference, RTX 3090 minimum). Forge GTX 970 is out
• Johan's idea: offer as inou service — intelligent series selection (don't run all 10K slices, pick relevant series) → RunPod serverless GPU → results in viewer
• Spec being written by subagent
• Sophia had 10,000+ slices — this is the use case

Diana Yusha Lab Report

• Added arthritis rebuttal section (Russian) — CRP 1.3 and ESR 6 don't support arthritis diagnosis
• Some Russian doctor suggested arthritis based on elevated CK 406 — incorrect interpretation

WebMCP

• Added to HEARTBEAT.md tech watch list
• Chrome experimental API for structured web agent tools — high relevance for James/OpenClaw, medium for inou

Colorado Camel Milk

• Order #16698 from Feb 7, $115 (6 pints frozen + $31 shipping)
• Still "Awaiting Shipment" — waiting for safe weather window (frozen perishable to Florida)

Infrastructure

Generator (48kw)

• Generator does NOT auto-start — manual start only
• GenerX came out today to analyze the auto-start issue (tech: Eduardo Rivera)
• The 3 runs were test runs by GenerX, NOT power outages
• Waiting on quote from GenerX for the fix

Emergency Internet Failover (TP-Link AX1500)

• Installed TP-Link AX1500 router, connected to UDM-Pro port 10
• Tested and working, then port 10 disabled on UDM-Pro
• WiFi network: X4 / password: Helder06
• For longer/full outages (including mobile coverage): swap the cable on port 10 for the longer cable (already staged nearby) and connect to Starlink
• This gives internet via Starlink → AX1500 → UDM-Pro port 10
• Shannon VPS now configured with OAuth token (no more router proxy)