v:1

# current-state

ACTIVE: 2026-07-28 [CC]. Session started on infra (receipts-to-Mercury email pipeline design, see decisions-ledger.md + machine-setup-plan-2026-07-27.md Item 11), then Kisa directly asked whether infra had been overbuilt at the expense of shipping. Pivoted: receipts work PARKED, dispatched `lead-signal` to find the actual gap between "checklist says 11/13 clean" and "a demo link Kisa could send a prospect today." **Clerk secret RE-CHECKED and still `sk_test_`** (wrong, development instance) — the `after_sign_in_url` fix is still fully blocked on Kisa pulling the `sk_live_` production secret from her own Clerk dashboard and running `~/.claude/automation/set-clerk-secret.sh` in her own terminal; nothing else can substitute for that click. `lead-signal` returned a 5-item ranked punch list, none of it duplicating the checklist: **(1)** nobody has actually watched the live P1-P6 worklist render in a browser since it shipped 2026-07-07 — login has been broken the whole time, so this has zero human verification and must happen the moment the redirect is fixed, not be inferred from code; **(2)** no curated demo dataset exists, only `test-data/gaboro-stress-test.csv` (5,000 rows built for load testing, not for telling a story) — needs a 15-25 row set deliberately hitting every status label including Plan Type Needed; **(3)** no demo narrative/script exists at all, despite being queued as a next-step since 2026-07-07 and never built; **(4)** no async artifact (screenshots or a recording) exists for a prospect like labABLE to forward internally before a live call; **(5)** `docs/pilot-guide-v1.md` is written for a real, live, data-sharing pilot (crosswalk tables, 30-60 day validation) and is the wrong document to hand someone for a day-1 interest-gauging demo — needs a one-page companion, not a rewrite. Scope note carried from Kisa: the demo target is "day-1 pioneers" (labABLE, Robert, other DMEPOS contacts) for feedback/interest, explicitly NOT a real-data pilot yet — that stays gated on the unresolved PHI question with counsel (see Stack section below), so the demo runs on synthetic data only.

PRIOR ACTIVE: 2026-07-27 [CC]. THREE separate sessions today. **(1) THIS SESSION, the Clerk sign-in blocker is ROOT-CAUSED and it was never a Clerk misconfiguration.** Two distinct faults, both GROUNDED by live curl against Clerk's own API. **Fault A, the Vercel URL can never authenticate:** the bundle carries `pk_live_Y2xlcmsuc3R0aWxzb2x1dGlvbnMuY29tJA` which decodes to `clerk.sttilsolutions.com`, a Clerk PRODUCTION instance, and production Clerk rejects any Origin that is not that domain or a subdomain. `Origin: https://signal-ui-xi.vercel.app` returns HTTP 400 `origin_invalid`; `Origin: https://signal.sttilsolutions.com` returns HTTP 200. The missing Google button is a SYMPTOM not a second bug: the `/v1/environment` call that would list `oauth_google` is the one being rejected. **Pilot readiness is therefore 12/13, not 13/13, for as long as the Vercel link is the one under test** — that settles the question left open on 2026-07-07. **Fault B, a successful sign-in lands on the wrong site:** Clerk's `after_sign_in_url` is `https://sttilsolutions.com` (the marketing site) and `sign_in_url` is `https://accounts.sttilsolutions.com/sign-in` (hosted portal, not the app's embedded card), so even on the working domain auth succeeds and dumps the user on the company homepage. Fixing B needs `CLERK_SECRET_KEY` via the Backend API; `~/.claude/automation/set-clerk-secret.sh` was written for it (hidden-prompt pattern cloned from set-nocodb-token.sh, syntax-checked, verifies against api.clerk.com and prints only the HTTP status). Clerk itself is HEALTHY: DNS correct, `oauth_google` ENABLED, email is first factor, **password is NOT a first factor** (email code or Google only, so typing a password was never going to work), signup public, no allowlist. **Cause behind the cause:** `signal-ui/src/main.jsx:10` THROWS on a missing key while `insight-engine/frontend/src/main.jsx:45` returns `<App/>`; the throw is why a pk_live had to be baked into the bundle at all. Adopting the IE degrade-gracefully pattern is scoped, NOT built. Also this session: **Playwright MCP restored** (AIOS Group D item 12, `✔ Connected`, tools load on next restart) and **the KG question settled by `challenger`** — 16 entities / 11 triples / 0 expired, every fact dated 07-26 or 07-27, so it is a 2-day-old fresh store rather than a damaged large one. Verdict: mostly empty, build it up, do NOT retire. **ALL KG data lives only in the `-wal` sidecar** (main `.sqlite3` is 4096 bytes and contains no tables), so any copy or backup taken without the sidecar silently yields a valid empty database, which is almost certainly the mechanism behind "KG found empty 2026-07-27". Backup including the sidecar at `~/.mempalace/backup-2026-07-27/`, verified readable at 11 triples. `~/.mempalace/palace/` does not exist at all, so Chroma semantic search is absent while the KG is fine: two separate stores, only one broken, and conflating them is why the reports contradicted each other. scp/SFTP re-confirmed WORKING by three live probes plus sshd_config; the KG triple is false and `vps-safe-commands/SKILL.md` is already corrected; KG NOT modified, awaiting Kisa's ruling. **(2) EARLIER SESSION, claim-verification build.** Diagnosed one shape across three systems: the policy was real but the enforcement point was missing (the compound relied on Kisa's memory; ground-vs-graft was in all 16 agent files but absent from the main session's own reply path; model routing held only via hand-picked overrides at dispatch). Built the two-half fix: `rate-response` rewritten from 7 checks to ONE claim-honesty gate plus 4 checks, triggering on claim SHAPE rather than confidence, paired with `~/.claude/automation/drift/drift-counter.py` (UserPromptSubmit hook) which scans the transcript mechanically. The DISAGREEMENT between self-report and transcript is the signal, which is why frequency stays absolute. Shapes defined once in `references/claim-shapes.md`. Kisa ruled the options-vs-recommendation scope, resolving a contradiction that spanned 4 files. Also delivered: founder's log created and seeded (11 EARNED entries plus an AVAILABLE index of 332 accelerator notes) and wired into /nuggets and /navaigate-session-brain; copy-review Rule 17 added (readability outside DMEPOS) after `challenger` caught that the first threshold would have condemned the live Signal site; NocoDB token restored via a hidden-prompt script, VERIFIED 200; AIOS Group A COMPLETE, B7 applied (now 6 opus / 10 sonnet), B8 CANCELLED as disproven. Corrected in 4 config files: subagents CAN re-delegate AND call MCP, so the chief-of-staff CLI alias is not required for orchestration. TriLane was never broken and needs no Docker. **(2) EARLIER SESSION: 2026-07-27 [CC]. AIOS/privacy-architecture session, NOT Signal product work. Delivered: STTIL's first data-classification scheme (OPEN/INTERNAL/RESTRICTED, `sttil-vault/Projects/STTIL-data-classification-v1.md`); a dry-run file classifier at `~/.claude/automation/classify/classify.py` (reports only, contains no file-moving code); `~/Documents/Playground/` built; review-hold moved OUT of `~/Documents` to `~/STTIL-Review-Hold/` (iCloud sync risk). Hazel 6.1.2 installed by Kisa, license located and REGISTERED (was on trial). Reference files corrected across two passes after `challenger` caught that the first pass introduced a new false fact. Signal touched only for doc flags, no code change. **PRIOR ACTIVE (still the real product state): 2026-07-07 [CC]. SIGNAL READINESS-MODEL BUILD COMPLETE P1-P6 (final commit 6181de7)**: backend + patient-nested worklist shipped, six independent audits, deployed to Railway + Vercel, live-verified where measurable (171 tests, Pi E2E 33/33, new bundle confirmed serving). All mockup decisions approved incl. the generalized data-gap family. REMAINING: Kisa signed-in click-through (5 probes in ledger).

NEXT (as of 2026-07-28, priority pivot to shipping): the chain is strictly ordered, each step needs the one before it. **(1) Kisa** — pull the `sk_live_` secret from Clerk's own dashboard, run `set-clerk-secret.sh` in her own terminal (needs a real tty). **(2) CC** — fix `after_sign_in_url` via the Clerk Backend API the moment (1) lands. **(3) CC/Kisa** — drive the live worklist in an actual browser for the first time since it shipped; this is verification, not a formality, nobody has seen P1-P6 render live. **(4) CC or Pi** — build the 15-25 row curated demo CSV hitting every status incl. Plan Type Needed. **(5) CC** — write the short demo narrative/script (what to click, what to say, how to frame Plan Type Needed as a feature). **(6)** screenshots or a short recording for async sharing. Receipts-to-Mercury pipeline and any further AIOS/infra work stays parked until this chain clears or Kisa reprioritizes again.

PRIOR NEXT (as of 2026-07-27, sign-in session): **(Kisa) run `bash ~/.claude/automation/set-clerk-secret.sh` in her OWN Terminal** (hidden prompt needs a real tty), then **(Kisa) restart Claude Code** so the Playwright MCP tools load. **(Kisa) rule on the KG scp correction** (proposal below; `challenger` proved the current triple false with three live probes) — DONE 2026-07-28, see decision below, superseded fact carried into decisions-ledger.md marked SUPERSEDED. **(Kisa) confirm `signal.sttilsolutions.com` as the canonical Signal URL** so the readiness checklist can be updated and the Vercel link stops re-causing the sign-in report. **(CC, once CLERK_SECRET_KEY exists)** fix `after_sign_in_url` via the Clerk Backend API, no dashboard; confirm the exact endpoint at that point rather than assuming it. **(CC)** scope the Insight-Engine degrade-gracefully auth pattern into `signal-ui/src/main.jsx` (replace the throw with a keyless demo fallback; unlocks Playwright E2E on the auth path and keyless pilot demos). ~~**(Kisa or CC)** decide on `sqlite3 ~/.mempalace/knowledge_graph.sqlite3 "pragma wal_checkpoint(TRUNCATE);"` to make the KG durable in the main file~~ — DONE 2026-07-28, moot: MemPalace retired entirely same session, see decision below. ~~**(Kisa)** optional COS alias restore... `chief-of-staff.md` now carries the MCP tool names so the alias no longer strips knowledge systems~~ — MOOT 2026-07-28: those MCP tool grants (mempalace) were removed from chief-of-staff.md as part of the retirement, so this note no longer applies either way. **(CC)** graphify: seed survived at `~/.claude/references/graphify-seed-2026-07-08/` (153 nodes, 122 edges) but `~/projects/trilane/graphify-out/` is EMPTY, so the graph is rebuildable from seed rather than from scratch. PRIOR, still open: (Kisa) rule on the KG conflict below. (Kisa) Appwrite retirement step 1 (`docker compose stop`, reversible, frees 1.3GB and 23 of 28 containers). (CC) design the Hazel ruleset once Kisa supplies the workflow design from her other window. (CC/ops-steward) license + subscription register, Hazel registration email needs moving off the lost lokissed@gmail.com account, transaction ID 8Z4LR26B4D8H. **ADDED 2026-07-27 (claim-verification session):** (Kisa) read the 6 Compound Engineering notes and 8 AIOS layer notes in the vault before the next architecture decision, they sat unread while this system was built and any contradiction in them outranks the build. (CC) AIOS Groups C/D/E need RE-DERIVING before execution: the review assumes 15 agents and there are 16, the omitted one is `challenger`, and 4 of its claims are now disproven (B8 cancelled, Docker unnecessary, COS alias unnecessary, MCP/re-delegation available). (CC) watch `drift-counter.py` for a few sessions, thresholds are reasoned not measured; tune `automation/drift/patterns.txt` if it never fires or fires constantly. (Kisa) `accessibility-review` skill is gone for good, source never existed in any repo; Rule 17 covers the gap but reinstall from origin if you want the original.

OPEN DISAGREEMENT (2026-07-27): Kisa said "I don't agree entirely" about the Gmail-recovery / ops-steward proposal and stopped the session before saying which part. **Do not treat that plan as agreed.** Ask her before acting on it.

PRIOR NEXT: (Kisa+CC) FIRST: debug the Clerk sign-in issue — Kisa reported she cannot get into the app (details incoming; observed: prod sign-in page renders email-only form, no Google button visible on the Clerk card). It gates the click-through. THEN: (Kisa) 5-probe click-through of the new worklist; (Kisa) confirm OQ1 + legacy-stopgap deviation; (Kisa) attorney bundle SEND to Clyde Mathes (attorney-bundle-2026-07-07, rulings applied; LOI 8.4 carve-out open to discuss) + Gaboro re-approach; (CC) pilot-guide screenshots + demo narrative plan-type step; (CC) CSV formula-injection sanitization backlog.

PRIOR ACTIVE: 2026-06-28. Signal paused at clean checkpoint — Insight Engine in active BUILD phase for July 4 deadline. See insight-engine/context/current-state.md and insight-engine/handoff-clock.md for full state. Key progress today: x-sight guided experience designed (Compass) and approved by Kisa, lane-lock handoff clock created, frontend finish readiness assessed (15 ranked items). Claude is building the Compass landing + B1 deploy blocker + finish items. Signal READINESS MODEL still queued at the clean checkpoint from 2026-06-27.

[AIOS build status] The map is written. Highest-impact build is the readiness model, NOT AIOS enhancements. AIOS Phase 1 items (reasoning frameworks, Playground, /board skill) are <5 hours total and optional until Signal has customer momentum.

- 2026-07-27 [CC]: A blocker that survives three weeks is usually the wrong question, not a hard problem. The Clerk sign-in failure was logged 2026-07-07 as "no Google button, debug in progress" and treated as a Clerk misconfiguration. It was neither: a production Clerk key refuses every origin outside its own domain, so the Vercel URL was structurally incapable of authenticating and the missing button was downstream of a rejected API call. Two curls against Clerk's own `/v1/environment`, one per origin, settled in a minute what a fortnight of intermittent debugging had not, because they asked the SERVICE what it thought instead of reading the app. Same shape as the scp lesson: the system does not lie about itself, and the cheapest question is usually the one addressed directly to it. Corollary found the same session: the reason a `pk_live` was in the bundle at all is that `signal-ui/src/main.jsx:10` throws without a key while Insight Engine returns `<App/>`, so a design choice about failure modes propagated into an auth outage three layers away.
- 2026-07-27 [CC]: A policy with no enforcement point works exactly as often as someone remembers it. Found the same shape in three systems in one day (compound capture, ground-vs-graft, model routing); none of the rules was wrong, all three lacked a trigger wired to the moment they apply. Corollary now built: a self-report inherits the blind spot it is meant to catch, so pair it with a mechanical check and treat the disagreement as the signal. Same day, second proof of the verify-against-the-system rule: the session told Kisa four times that Docker gated TriLane search while line 58 of operating-rules.md already recorded the opposite and the backend was running the whole time. She installed software she did not need.
- 2026-07-27 [CC]: Verify claims against the live system, never against a document. I "confirmed" that scp/SFTP were disabled on the VPS by reading the skill file against itself, seeded that false fact into the KG (which outranks every other source), and `challenger` disproved it in one command. Same failure shape as the stale files I was correcting.
- 2026-07-27 [CC]: Silent success is this stack's characteristic failure. Eight of nine LaunchAgents gone, the KG empty, `.secrets.env` missing, `~/.claude/plans/` and `raycast/` silently gitignored, Appwrite 502 for weeks. Every one reported success by saying nothing. Assume absence, verify presence.
- 2026-07-27 [CC]: cto-architect ruling — Hazel does NOT substitute for the Game Center token layer (different surfaces), but the token layer was never a PHI solution either (its own guardrails: shipment dates break safe harbor regardless). AWS is the real-PHI path, BAA already signed, RDS/S3 provisioned, Supabase coupling verified at only 11 references across 3 files. Recommended unit is a supplier-side de-identification tool (3-5 days), not local deployment of Signal (3-5 weeks). Pricing in that report is unquoted, do not act on dollar figures.
- 2026-07-26 [CC]: Hazel gate returned STOPPED by integration-steward, then overtaken by events (Kisa had already installed it). Scope confirmed by Kisa: Downloads and working files only, transcripts and Signal data excluded.
- 2026-06-27 [Pi]: Insight Engine adaptivity review cycle COMPLETE — 3 audit docs written (pi-build-review-2026-06-27.md: 7 findings, 3 HIGH/2 MEDIUM/2 LOW; claude-pushback-to-pi-2026-06-27.md: 3 challenges; pi-pushback-response-2026-06-27.md: all 3 conceded with code evidence). Claude implements 5 fixes next. Truncation root cause found: deepseek/deepseek-v4-flash was missing from models.json with no explicit maxTokens, compounded by thinking:high. Added with maxTokens=65536.

## Cross-Project Bridge

Insight Engine (July 4 deadline = tomorrow) is the active project. Key files:

- State: `/Users/sttil-solutions/projects/insight-engine/context/current-state.md`
- Handoff clock: `/Users/sttil-solutions/projects/insight-engine/handoff-clock.md` (phase/owner/gate per item)
- Active item: explore-to-deck wow-core (supersedes the earlier x-sight chat-first / Priority Threads plan) — Phase BUILD, owned by Claude. Phase 1 + all honest finding breakdowns BUILT, audited, live-verified 2026-07-03; branch feat/adaptive-stories pushed.
- **Vocabulary**: "cross-sights" = the concept (insights spanning multiple lenses). "indicator" = a data point from one domain feeding a thread. No "signal" in IE design language.
- **Next**: Kisa eyeballs the live flow → single door flip (new default at /, old at ?legacy); then Chunk 2 discovery engine.
- Bridge freshened 2026-07-03 [CC] (bridge-only edit; Signal itself remains paused at the 2026-06-27 checkpoint).

## Decisions (last

- 2026-07-28 [CC]: Priority pivot — Kisa named the infra/shipping tradeoff directly ("have we overbuilt infra?") mid-session. Ruling applied without further debate: receipts-to-Mercury pipeline and any further AIOS/infra work parked; `lead-signal` dispatched to find the real gap between the pilot-readiness checklist and an actual demo link. Demo scope confirmed as day-1 pioneer interest-gathering on synthetic data, explicitly not a real-data pilot (that stays gated on the PHI question with counsel).
- 2026-07-28 [CC]: MemPalace (MCP server + KG + palace) RETIRED, not scoped down. Root cause: the KG held 13 triples in its whole life and none were brand/product facts (the mandated pre-copy check had been querying an empty-for-its-purpose store); the tunnel/hallway graph layer never produced output (keyword taxonomy built for a personal AI-companion, not STTIL content); two of four palace rooms held junk (Obsidian plugin bundle, Granola cache) because mining has no exclusion filter; a single test mine burned 20+ min of CPU and had to be stopped by killing the whole server process, no partial-cancel possible. Verified independently by `challenger` before execution (confirmed: single launch point, 100% content redundant with sttil-vault, zero brand facts in KG; refuted the "no junk found" sub-claim, junk is present). Replacement: `~/.claude/references/decisions-ledger.md` for cross-project facts (the two genuinely unique KG facts, Hazel license location and content_intelligence_scope, were extracted there before deletion); Signal-specific facts (PHI status, Clerk constraint, canonical URL) already lived in this file and needed no migration. The scp/SFTP-disabled KG triple, long known false, is carried into the ledger explicitly marked SUPERSEDED rather than as current. `~/.mempalace/` quarantined to `~/.mempalace.RETIRED-2026-07-28` (not deleted), MCP registration removed and confirmed absent from `claude mcp list`, WAL checkpoint on the KG done as part of the export (moot now but caused no harm). Also fixed same session: NavBot's Telegram bot was down (stale token post-rotation, confirmed via direct Telegram API 401, unrelated root cause from the KG work), restarted clean; the trilane project's `CLAUDE.md` had a live "mine on 'done for the day'" trigger, which is the exact command that caused tonight's runaway CPU burn — removed entirely, not just patched.

- 2026-07-07 [Kisa/CC]: Legal bundle rulings applied. Recipient = Clyde Mathes; entity = KJF Professional Services LLC dba STTIL Solutions, Florida LLC, CONFIRMED; arbitration = default dispute posture (NDA 10.2 rewritten to mirror LOI S14). Final-signed-text-rules principle applied: bundle verified against the executed labABLE PDF (signed Daniel Rojas + Arkisia Fenn 6/12/2026; binding sections 3-11; kit-in-kit ABSENT from executed text, discussed concept only; Delaware law on their paper). Signature blocks now Arkisia (Kisa) Fenn. All rulings in KG (legal_entity superseded, dispute_resolution_default, attorney_of_record, Kisa legal_name). Open: LOI 8.4 carve-out keep/drop. Also FIXED same session: TriLane search 500s were a dead OpenRouter key in trilane/backend/.env (embedding AND llm keys), swapped to the working ~/.config/openrouter key, kickstarted, verified live end to end (.env.bak-2026-07-07 backup; key now shared with ask.py, mint a dedicated key later if preferred).

- 2026-07-07 [Kisa/CC]: P6 SHIPPED (6181de7) — all five design decisions approved and built (patient nesting, purple data-gap family, extended legend, per-line export, honest-label data-gap filter). Readiness-model build P1-P6 COMPLETE in one day: 6 ship commits, every item independently audited before ship, adversarial review killed a false-green pre-ship, live-measured verification at each step. Known deviations logged: legacy DOCS_REQUIRED stopgap retained on the ?legacy=1 surface; OQ1 shipped per umbrella plan.

- 2026-07-07 [Kisa/CC]: P6 rulings round 1 — nesting layout APPROVED and per-line export APPROVED (both in KG). Failed-data principle set by Kisa: Signal never acts on rows whose required info was not mapped or provided, and never hides them — engine-dropped rows now surface in skipped_reasons (shipped + deployed same day). Plan Type Needed stays its own state (it selects the rules; not a chaseable document); all other file-level gaps get the purple family treatment pending Decision B-v2/E.

- 2026-07-07 [CC]: Readiness-model backend COMPLETE (P2-P5 shipped same day as P1): citation IDs live (R-registry), patient rollup + nested payload live, device-scoped overrides live (doc_status migration applied to prod; overrides now feed the verdict; the leak is dead, live-measured), plan-type enforcement live (zero greens without a mapped plan type, live-measured; Phase 2c deletion stays Kisa-gated). Every item independently audited SHIP before ship. P6 mockup rendered for Kisa (4 decisions annotated).

- 2026-07-07 [CC]: Attorney-review legal bundle PREPARED (lead-sttil drafted, ops-steward independently reviewed, 6 findings fixed incl. 4 HIGH counterparty-name leaks). LOI template v3 (product-agnostic body, Exhibit A pre-filled for Signal, labABLE negotiation learnings folded in), NDA template v3 (products list corrected to Signal/Vitality Med Tracker/UMSIS + catch-all), BAA template v1 (generalized from Gaboro draft, forward-looking posture block), cover memo bundling both templates + BAA + FDA CDS memo + labABLE AKS question per reactivation plan 00. Entity name corrected everywhere to KJF Professional Services LLC dba STTIL Solutions (per executed labABLE LOI; kg_add recorded); formation state left as placeholder (old docs disagree: Delaware/Florida/Pennsylvania) = attorney Q1. Templates: STTIL-Vault/Projects/Legal/ (LOI+NDA v3) + signal/pitch/legal/ (BAA, memo). Send-ready docx: signal/pitch/legal/attorney-bundle-2026-07-07/.
- 2026-07-07 [CC]: Readiness model WIRED LIVE (plan 01, commit a3af499, Railway deploy verified). Phase 2a seam confirmed: readiness AUGMENTS legacy output (byte-identical legacy proven by live diff). OQ1 executed per umbrella plan 00 ("ship plan_type ingestion with the wiring") — minimal client-mapped column, never guessed; flagged for Kisa's explicit confirmation, two-line revert if reversed. Adversarial review caught a false-green in the draft row-resolution; fixed via dedup-group-keyed ReadinessIndex, regression-locked. Grounded test count: 132 (the old "73 tests" figure corrected per plan 01 §12.5).
- 2026-07-06 [CC]: Model routing SETTLED (Kisa agreed) — strongest model in the orchestrator seat (plain claude, full MCP, skip-permissions), sonnet/haiku subagents for mechanical work, Fable-as-subagent only for cleanly separable hard problems. Docs-verified: delegation multiplies tokens on one shared pool; per-agent model override + mid-session /model GROUNDED. Config application PARKED. Discovered com.sttil.cos-model-switch: Fable-to-Opus swap fires 2026-07-07 09:00. Watcher audit: 9 agents healthy, clean exits; research watcher never built.
- 2026-07-06 [CC]: Crew Compounding Memory Phase 1 shipped + independently verified — retrieve-and-inject wired into the dispatch skill (validity-stamped "WHAT THE CREW ALREADY KNOWS" block, current==true filter, recall guard) + ~/.claude/crew-log.md; built by the memory-crew, verified PASS (2 agents flagged every planted contradiction, independent grader confirmed). Also ruled: UMSIS activates sttil/umsis docs-only (state in the repo, not the vault). Spec + build record: STTIL-Vault/Projects/STTIL Solutions/Crew Compounding Memory - Design Spec - 2026-07-05.md.
- 2026-06-27 [CC]: Readiness engines COMMITTED — c07d054 (dedup foundation) + 206bf71 (verdict engine); code-auditor found + fixed HIGH config-surface false-green holes (a known plan missing from payer_rules.json no longer grades green; the green gate now checks every item); 73 tests green. Pi readiness-UX brief staged. labABLE CRUSH brief SENT. PRIORITIZATION DECISION (Kisa): Signal active build pauses at this checkpoint; Claude + Kisa finish the Insight Engine to its July 4 deadline (separate lane); Pi advances the Signal UX design async. Lanes-clear: one project per terminal/session.
- 2026-06-26 [Pi]: STTIL AIOS architecture map DESIGNED and WRITTEN to STTIL-Vault/Projects/STTIL-AIOS-architecture-map.md (338 lines, 10 sections). 6-layer architecture with per-layer Have/Partial/Gap status, build sequence in 3 phases, and comparison to coach's framework. Kisa is ahead of coach's L2 AIOS in memory breadth, multi-model research, and cross-session state protocol. Highest-impact build remains the Signal readiness model.
- 2026-06-26 [CC]: Readiness-model core engines SHIPPED — dedup.py (250 lines, 30 tests) + readiness.py (286 lines, 27 tests). All 57 tests green. Dedup key = (patient_id, device_type, DOS). Verdict engine kills the false green (required+absent blocks green, plan unknown = Plan Type Needed). Additive only, not yet wired into live pipeline. Remaining: rules-to-config, patient rollup, device override, plan-type enforcement, frontend nesting.
- 2026-06-25 [CC]: labABLE call done (CRUSH/audit-readiness angle). CRUSH brief + verified, 3-model-cross-checked research (Opus agents, Sonnet 4.6, Perplexity Sonar) staged for Kisa to send (Projects/labABLE-CRUSH-brief-2026-06-25.md). Perplexity MCP fixed (BASE_URL=/chat/completions). OpenRouter `ask` multi-model CLI wired. Pi briefed to design the STTIL AIOS map. Display corruption diagnosed as macOS 26.0.1 GPU issue (fix = update to 26.5.1).
- 2026-06-24 [Pi/Kisa]: Dedup decision LOCKED — key = (patient_id, device_type, date_of_service). Order_number is display-only, never in dedup key. Scales to all DMEPOS categories. Dedup design (tiebreakers, quantity merge guard, test cases) at docs/dedup-design-2026-06-24.md. Readiness-model build is UNBLOCKED.
- 2026-06-24 [Pi]: Convex-Signal spike full design persisted to docs/convex-signal-spike-design-2026-06-24.md. Module map with 6 swappable seams (auth, data, readiness, storage, automations, notifications), Repository interface for backend portability, Convex schema (8 tables), Convex-first auth (Clerk swappable), phased 40h/5-day plan. Claude builds Phase 1.
- 2026-06-24 [CC]: Older decision lines (dispatch trigger shipped, NocoDB corruption diagnosis, Convex evaluation, ship-status-in-git principle, AIOS-consulting parked) trimmed per the keep-~8 rule; all live on in knowledge.md, docs/ship-status-ledger.md, the Convex/data-platform Open Threads, and git history of this file.

## Open Threads (max 5)

- CLERK LOGIN (opened 2026-07-07, **ROOT-CAUSED 2026-07-27, secret RE-CHECKED still test 2026-07-28**): Fault A (origin rejection) resolved by using the canonical `signal.sttilsolutions.com` URL. Fault B (`after_sign_in_url` pointing at the marketing site) still open — `~/.claude/.secrets.env`'s `CLERK_SECRET_KEY` is confirmed still `sk_test_` (50 chars, wrong dev instance), so the Backend API fix cannot run yet. Blocks the entire demo-readiness chain in NEXT above; this is now the single highest-priority open item in the whole project.
- CONVEX SPIKE + DATA-PLATFORM DECISION (2026-06-24, untouched since): Convex spike design ready (docs/convex-signal-spike-design-2026-06-24.md) but gated on Kisa's Convex BAA email; NocoDB leads table also still broken (no-PK, corrupted). Both parked behind the same missing decision — no action expected until Kisa revisits.
- DEMO READINESS (opened 2026-07-28): 5-item gap list from `lead-signal`, see ACTIVE above — curated dataset, narrative script, async artifact, and a live browser check of the P1-P6 UI (never done since ship) are all missing. This is the active work once CLERK LOGIN clears.
- LEGAL BUNDLE (2026-07-07): **SENT to Clyde Mathes ~2026-07-23 (confirmed by Kisa 2026-07-26); reply expected within days.** Was previously marked READY TO SEND (signal/pitch/legal/attorney-bundle-2026-07-07, 5 docx + sendable memo; rulings applied: Florida, arbitration, Arkisia Fenn signature; verified against the executed labABLE PDF). Open: LOI 8.4 Partner Concepts carve-out keep/drop, memo already asks counsel about its enforceability. Attorney reply gates the FDA memo ruling, AKS guidance, and any LOI/NDA execution with a pilot partner. (Stale READINESS MODEL thread pruned: P1-P6 complete per ACTIVE.)
- labABLE: CRUSH brief SENT 2026-06-27. Watch for their reply; schedule the follow-up call (Mehul open to the proactive auditor-style play). Internal-only prep at Projects/labABLE-next-call-prep-INTERNAL-2026-06-25.md.

## Stack

- Signal: `patient_id` carries the supplier's internal identifier (MRN, account #). Tokenization via RAP-ID/CSP-ID (rotating anonymous ID, not static UUID). Real PHI currently BLOCKED/mock, no active exposure.
- **DISPUTED, awaiting counsel (flagged 2026-07-26):** this file previously read "PHI contained in `patient_id`", while `signal/CLAUDE.md:25` states the architecture never stores patient names and that `patient_id` is the sole crosswalk key. Both cannot be true as written. An account number is one of HIPAA's 18 identifiers, and `Barrier-Log.md:16` notes a cipher of an MRN is still derived from identity. **Do not resolve this by picking a side.** The attorney bundle asks counsel this exact question and the answer governs. Until it returns, build to the more restrictive reading: treat `patient_id` as potentially PHI.
- Signal-api: Railway (signal-api-production-91c2). Signal-ui: Vercel (signal-ui-xi.vercel.app). Supabase: itmospnregdyiatbbdwl (JWT key).
- Clerk: **PRODUCTION** instance (`pk_live_...` decoding to `clerk.sttilsolutions.com`), key on Vercel + Railway; Google OAuth ENABLED, email is first factor, **password is NOT a first factor** (email code or Google only). **Origin constraint, verified 2026-07-27:** a production instance serves only origins equal to or subdomains of `sttilsolutions.com`, so `signal.sttilsolutions.com` works (HTTP 200) and `signal-ui-xi.vercel.app` is refused (HTTP 400 `origin_invalid`). Both domains serve a byte-identical bundle, so this is a domain problem, never a build problem. `after_sign_in_url` currently points at the marketing site and needs correcting via the Backend API.
- Leads: website form -> n8n webhook (n8n.sttilsolutions.com/webhook/signal-cgm-lead) -> NocoDB (Signal base source corrupted, no-PK; capture works, cleanup blocked). Convex spike + platform decision pending.
- Compliant fallback: AWS BAA signed 2026-05-27, RDS (signal-db) + S3 provisioned, parked. Convex Professional $25/mo = BAA-capable alternative under evaluation.
- TriLane: localhost:8000 (signal/sessions/scale-software). Pi reaches it over HTTP (127.0.0.1:8000); contract in trilane/TRILANE_HTTP_API.md.
- Model for Pi: deepseek/deepseek-v4-flash — model added to models.json with explicit maxTokens=65536 (was missing, causing truncation).
- Tooling (Claude side): Perplexity MCP fixed (BASE_URL=/chat/completions); OpenRouter `ask` CLI at ~/scripts/ask.py (key ~/.config/openrouter/key).

## Tip

State protocol: read = `git pull --rebase` then read this file (warn if Updated > 24h old); write = edit ACTIVE/NEXT, append one author-stamped decision, then commit + push. Full protocol in the `state-sync` skill. Detailed ship-status (what shipped / didn't / why) = docs/ship-status-ledger.md. TriLane = searchable archive, not live state.

## Updated: 2026-07-28 [CC] — nuggets checkpoint. Priority pivot from infra (receipts-to-Mercury design, parked) to Signal demo readiness after Kisa flagged possible overbuild; `lead-signal` returned a 5-item gap list; Clerk secret re-confirmed still `sk_test_`, still the top blocker. Consolidated 3 stacked Updated: lines from 07-07/07-27 into this one per the append-drift fix in operating-rules.md; prior history intact in git log.