# 2026-04-19 Daily Notes

## Aundrea's Phone CalDAV — Done
- Same setup as Matt: `cal.hoffdesk.com`, `assistant` user
- Both phones synced on shared family calendar

## Gaming PC OpenSSH Bridge — Done
- Windows OpenSSH Server installed, SSH key auth working
- SCP workaround: Python pipe on remote side (Windows `scp` binary mode broken)
- Backup script updated: `REMOTE_HOST=matthew@matt-pc.tail864e81.ts.net`

## Newsletter Bug Fixes
- **`notify` NameError**: `_route_newsletter_items()` now takes explicit `notify` + `email_subject` params
- **Classification prompt**: Updated `email_classify.txt` — multi-topic/week-ahead emails now route to newsletter, not appointment
- **Day-of-week correction**: Added `claimed_day_of_week` to both appointment and newsletter extraction prompts
- **Duplicate calendar events**: Cleaned up; dedup logic was fine, duplicates from re-processing during debug
- Commit `87beb5d` pushed

## Auth Failure Circuit Breaker — Built
- 3 IMAP auth failures → trips → ONE alert → silence for all subsequent
- Auto-resets on success, manual reset via CLI or state file deletion
- `~/.family_assistant/auth_circuit_breaker.json` (gitignored)

## Repo PII Audit & Cleanup
- Removed `scripts/research_agent/`, `scripts/research_cli.py`, stale test file
- Scrubbed all hardcoded passwords, IPs, domains, paths from production code
- README + WEBHOOK_DEPLOY fully rewritten for sovereign stack
- `pyproject.toml` v1.0.0 — removed Google API deps, added caldav/icalendar/chromadb/fastapi/uvicorn
- Repo: 45 files, zero PII

## Revenue Opportunities — Decision Record
- Analysis complete. Full details in `research/revenue-opportunities-2026-04-19.md`
- Top picks: ClawHub skills → Deployment retainers → Document API → Email-to-Calendar SaaS
- **PT clinic vertical**: interesting but needs EMR write-access validation with 3 clinic directors before committing
- **Status**: On hold. No active work. Do not continue research without Matt's explicit request.

## Costco Route Telegram Bot — Built & Live
- `/costco <items>` → route-optimized shopping list
- Inline calibration buttons for zone reassignment
- Three-layer classification: ChromaDB lookup → LLM → sanity checks
- Sanity checker + validation pipeline catches LLM hallucinations
- Instacart 2017 dataset seeded: 49,688 products → ChromaDB
- Two-tier matching: user calibration (0.85 threshold), instacart seed (0.93)
- Bug fixes: ChromaDB false matches (threshold raised), LLM hallucination/dropping items
- Bot running: `cd costco-route && source .env && python3 -m costco_route.bot`

## Recipe Extractor — Built
- `costco_route/recipe_extractor.py` — URL → fetch + extract + zone classify + save
- Telegram bot: `/recipe <url>`, `/recipes`, auto-detect URLs in free text
- Local Rolodex: `~/.costco_route/recipes/{slug}.json`

## HoffDesk Web — Sprint 1 APPROVED
- Project plan: `shared/project-docs/hoffdesk-web-project.md` — **APPROVED by Director**
- Sprint 1: Family Dashboard MVP (calendar + weather + health)
- Architecture: Cloudflare Pages (frontend), FastAPI on Beelink (API via CF Tunnel + CF Access Email OTP), HTMX + Tailwind
- **Socrates Day 1:** CF Tunnel proof-of-life → THEN aggregate API spec `GET /api/today`
- **Daedalus Day 1:** Design tokens (unblocked, start immediately)
- **Briefings updated** with Director's explicit priorities
- **Next:** Wadsworth to track tunnel progress, specialists to check in

## Security Lockdown — Director's Orders Executed
**2026-04-20 ~00:50 UTC**

**Wadsworth tasks (COMPLETED):**
1. ✅ Heartbeat config verified — already correct (target=last, every=30m, lightContext=true)
2. ✅ `chmod 600` applied:
   - `~/.openclaw/agents/daedalus/agent/auth-state.json`
   - `~/.openclaw/agents/main/agent/auth-state.json`
   - `~/.config/radicale/rights`
3. ✅ plugins.allow reviewed — no phantom entries found

**Socrates tasks (IN PROGRESS — parallel):**
1. ⏸️ Pause dashboard tunnel (10 min hold)
2. Update OpenClaw config — Daedalus primary model to cloud ✅ (already done)
3. Bind Radicale strictly to 127.0.0.1
4. Enable UFW — allow OpenSSH + Tailscale only
5. Disable PasswordAuthentication in /etc/ssh/sshd_config

**Outstanding
- Auth circuit breaker commit pending (code written, needs push)
- Drop-Box Drive + Telegram image interception (blocked on Google)
- Multi-calendar, Docker Compose, YAML prompts (post-v1.0)
- Costco bot: no systemd service yet, multi-store support