clawd/memory/2026-02-21.md

# 2026-02-21

## Infrastructure

### forge reboot (9:30 AM ET)
- Johan approved reboot after systemd-hwe-hwdb update (255.1.6→255.1.7)
- All services came back clean (linger enabled, all services enabled)
- No kernel change, no issues

### Amsterdam cleanup (23:37 ET)
- Removed Uptime Kuma, ntfy, vaultwarden from Amsterdam VPS (82.24.174.112)
- All Docker containers gone, networks pruned
- Two leftover images (node:20-slim, temporalio/temporal) — Johan didn't ask to remove
- Amsterdam = decommissioning, Stalwart already migrated to Zurich

### Shannon / Amsterdam Kuma fix (23:33 ET)
- IP 82.24.174.112 was hammering inou.com /api/health every 60s all day
- Source: Shannon's Kuma (separate from Zurich's Kuma) had wrong monitor URL
- Fixed: updated monitor 2 "inou.com API" → https://inou.com/api/v1/health
- Then Johan asked to remove Kuma entirely → done

### SSH known_hosts
- Updated for both zurich.inou.com and 82.24.174.112 (host keys had changed after rebuilds)

## Alert Dashboard Fixes

### Pace display redesign (14:37–15:42 ET)
- Issue: dashboard showed "100%" which meant "exactly on pace" — confusing
- Briefly changed to show "86% · 145h" format, then Johan confirmed 100% = on schedule
- Reverted to pace display: `⚡ pace%`
- Further change: removed background color, text-only color (cyan/yellow/red)
- Added "pace" label: now shows `pace 99%`

### Saturday dead zone fix (23:21 ET)
- Johan sleeps Sat 7AM–2PM, can't use Claude during that window
- Fixed pace calculation: effective week = 161h (168h - 7h dead zone) instead of 168h
- Result: pace 94% instead of 100% — more accurate

## AGENTS.md / SOUL.md / HEARTBEAT.md Updates

### SOUL.md — Mission statement added
> "Get Sophia the treatment she deserves. Build inou into the medical advocacy platform the world needs. Keep Johan's world running so he can focus on both."
- inou status: building phase, NOT ready to promote

### AGENTS.md — Two new rules (from @johann_sath tweet)
1. "Never force push, delete branches, or rewrite git history" — added to Git & Backup Rules
2. "Never guess config changes — read docs first, backup before editing" — added to Resourcefulness Rules

### HEARTBEAT.md — Two new sections
1. **Intra-Day X Watch** — spawns subagent every 3-4h to check @Cloudflare, @openclaw, @moltbot, @AlexFinn, @realDonaldTrump. Always subagent, never inline. State: `lastIntraDayXScan`.
2. **inou Daily Suggestion** — spawns subagent each morning to propose ONE inou building task. No marketing suggestions. State: `lastInouSuggestion`.

### memory/inou-context.md — Created
Context file for subagents working on inou suggestions. Covers: current capabilities, business model, known gaps, design principles, Johan's constraints.

## Tech News (Feb 20)

### Claude Code major update (20:03 UTC)
- Desktop: live app preview (runs dev server inline, reads console logs)
- Pre-push code review with inline diff comments
- **Background PR monitoring + auto-fix + auto-merge** (biggest feature — CI loop closes without human)
- Session continuity: CLI → desktop → mobile
- Johan watched the demo video — excited about automated test repair in real-time

### Claude Code Security (18:02 UTC) — research preview
- Scans codebases for vulnerabilities, suggests patches for human review
- 29.5K likes — biggest engagement of the day
- Johan: "Shannon was nice for two weeks" (Shannon = our DIY security scanner, now obsoleted by Anthropic)
- Worth applying for research preview (inou codebase = good test case)

### Cloudflare "Markdown for Agents"
- Edge-level HTML→Markdown conversion via `Accept: text/markdown` header
- Requires Cloudflare proxying (orange cloud) to be enabled
- inou.com already on CF DNS (sage/aryanna nameservers) but NOT proxied
- Discussion: static pages could be proxied, but medical/app pages should NOT go through CF
- Johan: "later concern" — parked for now

### Cloudflare Code Mode MCP (earlier today)
- 2,500 API endpoints collapsed to 2 tools (search + execute) in ~1,000 tokens
- Johan noticed this himself — I missed it in morning scan
- Prompted the intra-day X watch addition to HEARTBEAT.md

### MiniMax M2.5
- Dominates OpenRouter top 5 (open-weight models now top rankings)
- 230B MoE, 80.2% SWE-Bench, ~$1/hr
- People explicitly switching to it when Claude quota runs out
- Potential K2.5 replacement for subagents

## Observations / Patterns

### Johan's X monitoring is better than mine (corrected)
- Johan found Cloudflare MCP + MiniMax himself before morning briefing caught them
- Root cause: tech scan only runs once in morning
- Fix: intra-day X watch subagent added

### Claude weekly usage
- 86% used (as of morning), resets Saturday Feb 21 ~2PM ET
- Pace was 94% with dead zone correction
- Budget tight but manageable given reset is ~14h away (as of midnight)

### Superpower vs inou
- Superpower ($17/mo, blood biomarkers, VC-backed) — wellness optimization for healthy people
- inou — advocacy infrastructure for people the medical system has failed
- Not competing; different markets entirely
- Worth adopting: Superpower's citation/reasoning transparency pattern

### @AlexFinn mission statement advice
- Formalized into SOUL.md
- Reverse-prompt pattern (idle time → "what moves us toward mission?") now embedded in daily inou suggestion

## Amsterdam VPS Decommissioned (00:02 ET)
- **Trigger:** Johan: "Yes, I want in. That very moment, we'll pull out of Amsterdam"
- **Verified before pulling plug:**
  - Git repos (alert-dashboard, dealroom, message-center) — all already on Zurich ✅
  - Stalwart data (19GB) — already on Zurich, Zurich Stalwart is live ✅
  - vault.jongsma.me, ntfy.inou.com, kuma.inou.com — all already point to Zurich (82.22.36.202) ✅
  - Vaultwarden running on Zurich, not Amsterdam ✅
  - No Amsterdam-watching Kuma monitors ✅
- **Actions taken:**
  - `amsterdam.inou.com` A record deleted from Cloudflare ✅
  - HostKey invapi: `whmcs/cancel_order` submitted with whmcs_id=61782 (got "being cancelled" response)
  - memory/infrastructure.md: Amsterdam section updated to DECOMMISSIONED ✅
  - MEMORY.md: All Amsterdam/Shannon references updated ✅
  - SOUL.md: Removed Shannon VPS reference ✅
  - memory/vaultwarden-credentials.md: Fixed wrong IP (82.24.174.112 → 82.22.36.202 for Zurich) ✅
- **Fallback:** If cancellation needs manual confirmation → https://panel.hostkey.com/controlpanel.html?key=639551e73029b90f-c061af4412951b2e
- **HostKey server ID:** 53643

## Cron Job Fixes (00:48 ET)
- **Evening Briefing**: removed dead Shannon/Amsterdam step 5
- **Weekly Security Posture Scan**: fixed broken model `claude-sonnet-4-20250514` → `claude-sonnet-4-6`; removed `amsterdam.inou.com` from scan targets; cleared error state
- **Watchdog (K2.5)**: removed Claude usage block that was posting to Fully tablet (port 9202) — violates no-tablet rule

## inou MCP Bundle removed (00:50 ET)
- Johan: "we are fully server based, remove it from builds & checks"
- Stripped inou MCP Bundle section from `check-updates.sh` (~30 lines)
- Removed `inou-mcp/` directory (manifest.json + server binary)
- No more nightly 404 to `inou.com/download/inou.mcpb`

## OpenClaw Model Routing (02:03 ET)
- Clarified: not using OpenRouter — direct provider connections (Anthropic, Fireworks, xAI)
- OpenRouter IS supported out of the box (`openclaw onboard --auth-choice openrouter-api-key`)
- Model format: `openrouter/provider/model-id`, no pre-config of all 200+ models needed
- `models.json` per-agent optional — only needed for UI/cost tracking

## 9 PM inou.mcpb 404 — Root Cause Found (00:43 ET)
- **Nightly Maintenance** cron job (9 PM ET) calls `check-updates.sh` step 5
- That script did HEAD request to `https://inou.com/download/inou.mcpb` → 404
- Source IP 192.168.1.1 = forge routing through gateway → Caddy sees router IP
- Fixed: inou.mcpb check removed from script entirely

## M365 Teams on Fully Dashboard (02:31 ET)
- 3 Kaseya Teams messages appeared ~8h after being sent (backfill on token refresh)
- Source: `message-center/config.yaml` has M365 connector polling `johan.jongsma@kaseya.com`
- Johan confirmed this is intentional — triggers him to check Teams
- Backfill on token refresh = minor annoyance, acceptable

## S2M3 Vendor Lunch Email (04:08 ET)
- Johan asked "where does this come from?" — it's on Fully dashboard as alert
- Traced through M365 connector → email from `events@s2m3consulting.com`
- Cold outreach: vendor lunch pitch at Steak 48, Beverly Hills, March 5th 11:30 AM PST
- "Optimize and reduce IT spend" pitch — nothing to act on

## sessions_spawn broken — Gateway Fix Attempt (12:07 PM)
- **Root cause 1 (fixed)**: `bind: "lan"` made OC use `ws://192.168.1.16:18789` → blocked by new OC security check (non-loopback ws://)
- **Fix applied**: changed `bind: "lan"` → `bind: "custom"` + `customBindHost: "0.0.0.0"` in `/home/johan/.openclaw/openclaw.json`
- URL now correctly uses `ws://127.0.0.1:18789` (loopback)
- **Root cause 2 (unresolved)**: Still fails with "pairing required" (1008) — device auth layer not bypassed for agent-to-agent connections
- `dangerouslyDisableDeviceAuth: true` only scopes to `controlUi`, not subagent spawning
- Impact: intra-day X scans and inou suggestions can't spawn; cron jobs unaffected

## Fully Dashboard Pace Fix (15:16 ET)
- Johan: "I don't see my pace on the Fully dashboard"
- Root cause: visibility gate was `usage > 75%` — after weekly reset (2 PM ET), usage = 1%, hidden
- Fix: changed condition to `timePct > 0` (always visible after reset, hides only in first seconds)
- Weekly usage now at 1% after reset; pace = ~125% (normalizes quickly)

## Stalwart — Jacques + Roos Full Email Login (16:38 ET)
- Jacques reported "Incorrect username/password" with code `9S4BLMDF` (not his password)
- Root cause: account name was short form `jacques`, but trying to log in as `jacques@jongsma.me`
- Johan: "I prefer long username (easier on iPhone)"
- Fixed: updated account names via Stalwart API to full email addresses:
  - `jacques` → `jacques@jongsma.me` (pw: `7I#rydMKlri6r%!g`)
  - `rozemarijn` → `rozemarijn@jongsma.me` (pw: `cRKEWJL4h3MGn3Li`)
- Verified both IMAP logins work (jacques: 21 msgs, roos: 66 msgs)
- Sent Dutch-language setup instructions to both via Signal
- Port 8080 on Zurich = Vaultwarden (NOT Stalwart); Stalwart admin API = port 8880
- Stalwart admin: `admin:agolM71pOwZBJhggROBDkn8R` via HTTP Basic on `http://127.0.0.1:8880/api/principal`

## Evening Briefing — 8:02 PM

### Key stories:
- **SCOTUS struck down Trump emergency tariffs** as unconstitutional (Fri Feb 20). 2 Trump nominees voted against him. Trump retaliated with 10-15% global tariff. Markets still rallied S&P +0.69% to 6,909.
- **SentinelOne (S) +4.35%** — short position working against Johan
- **NABL -11.18% Thursday** post Q4 earnings — beat revenue but soft 8-9% 2026 guidance. Downgraded to Hold by Wall Street Zen today.
- **OpenClaw 2026.2.21** dropped today: Gemini 3.1 support, 100+ security hardening fixes, Discord voice/streaming, thread-bound subagents, iOS/Watch polish
- **Gemini 3.1 Pro** launched Feb 19: better ARC-AGI-2 reasoning, now in preview across Gemini API/Vertex/GitHub Copilot
- **Karpathy** bought Mac Mini to tinker with OpenClaw, tweet going viral

### Dashboard: http://100.123.216.65:9200 (briefing id: bba734b8)
### Telegram: sent ✅

## Nightly Maintenance (9:00 PM ET)
- OS: all packages up to date (0 upgraded)
- Claude Code: up to date (2.1.50)
- OpenClaw: updated 2026.2.21 → **2026.2.21-2** ✅
- Session cleanup: 15 orphaned .jsonl files removed, 9 cron :run: keys removed
- sessions.json: 40 entries remaining
- Working context updated, update log written

## AirLLM Test (9 PM ET)
- Installed AirLLM (layer-by-layer GPU offloading library)
- Tested Qwen2.5-7B-Instruct on GTX 970 (4GB VRAM)
- Result: **works** — correct answer, 6.1s/token, peak VRAM only 1.57GB
- Key insight: VRAM stays ~1.5GB regardless of model size (one layer at a time)
- Implication: 70B models theoretically runnable on forge, ~8-12s/token
- Model cached at: ~/.cache/huggingface/hub/models--Qwen--Qwen2.5-7B-Instruct/
- Useful for: batch document analysis, offline medical record processing
- Fix needed: `optimum==1.22.0` (newer versions removed BetterTransformer), input_ids must be moved to CUDA before generate()

## OC sessions_spawn Fix
- Root cause: OC 2026.2.21 update stripped operator.write+read scopes from device token
- Fix: manually added scopes back to device-auth.json + devices/paired.json, restarted gateway
- Also fixed gateway bind: "lan" → "custom" + customBindHost: "0.0.0.0" (loopback URL for spawning)
- sessions_spawn working again as of ~5 PM ET

## Stalwart Family Accounts Updated
- Jacques + Rozemarijn: account names changed to full email (jacques@jongsma.me, rozemarijn@jongsma.me)
- Sent credentials to both via Signal in Dutch