MEF Network — Live Reality
Major session 2026-06-17. ForgeSales Phase A + B complete. Supabase schema v1 deployed (39 tables, all RLS locked). MEF CLI Phases 0–4 live. ForgeSales overhauled: Gemini removed, Claude API integrated, full outreach cycle live (compose → approve → send → receive → classify → memory). Merchant intelligence platform operational. Password gates on ForgeSales + MEF Ops + Visibility Machine. RepairRadar sync script deployed.
Server Summary
| Server | IP | RAM | OS / Proxy | Sidecars | Status |
|---|---|---|---|---|---|
| SS & Bans | 65.109.171.38 | 16GB | Ubuntu · Nginx + Traefik v2.11 | 8 (7 Docker + 1 systemd) | live |
| Prod-Ops | 204.168.169.58 | 16GB | Ubuntu · Traefik v3 only | 7 Docker | live |
| BTCPay | 89.167.70.57 | 8GB | Ubuntu · Nginx (BTCPay managed) | 0 | live |
| Agency | 95.216.141.81 | 4GB | Ubuntu · Traefik v3 | 0 | live · webhook bus 71 entries |
traefik.docker.network=backend_reup-network labels. All compose files use entrypoints=web only. Any file with entrypoints=websecure or tls.certresolver has NOT been deployed and should be treated as a stale draft.Ops Control Plane — FULLY LIVE
MEF Ops Dashboard (primary) + Discord (notification mirror) + Supabase state layer + sidecar system
| Component | Location | URL | Status |
|---|---|---|---|
| MEF Ops Dashboard | Prod-Ops · /opt/apps/mef-ops/ | operations.sovereignstack.pro | live |
| Hermes HTTP Gateway | Prod-Ops · localhost:4200 | 172.19.0.1:4200 (mgmalkz bridge) | live · auth pending |
| Supabase — project_states | wialrjhuixpsnungclfe.supabase.co | — | live · 15 rows |
| Config Service | SS&Bans · port 3099 | config.sovereignstack.pro | live |
| OpsBot (Discord) | SS&Bans · discord-bots stack | — | live |
| Webhook Bus | Agency · /opt/apps/webhook-bus/ | api.sovereignstack.pro | live · 71 entries |
Supabase Tables — CortexHQ (wialrjhuixpsnungclfe)
| Table | Purpose | Realtime | Status |
|---|---|---|---|
| project_states | 15 project rows — sidecar truth source | ✓ | live |
| project_state_history | Full audit trail | — | live |
| cortex_memory | 12-column CortexHQ brain | — | live |
| events | Inbound webhook events — powers channel feeds | ✓ | live |
| leads | RepairRadar + Reddit leads | ✓ | live |
| outreach_queue | Hermes-drafted outreach awaiting approval | ✓ | live |
| outreach_replies | Warm replies detected by IMAP | ✓ | live |
| project_todos | Per-channel todos — Supabase-backed | ✓ | live |
| project_notes | Per-channel notes — auto-save 1s debounce | ✓ | live |
| hermes_messages | Persistent Hermes chat — last 50 per channel | ✓ | live |
| audit_runs | Structured audit runs from /audit command | — | live |
| audit_findings | Findings per run — type: positive/issue/risk/money | — | live |
| project_money_metrics | Per-project verdict, revenue_mtd, blockers, next action | ✓ | live |
| session_archive | Archived Hermes chat sessions | — | live |
Sidecar System — 15 Projects Tracked
Autonomous state tracking across all active projects on both servers
| Container | Project Path | Network | Status |
|---|---|---|---|
| kratombans-sidecar | /opt/apps/bans/kratombans | kratombans-network | running |
| cbdbans-sidecar | /opt/apps/bans/cbdbans | kratombans-network | running |
| delta8bans-sidecar | /opt/apps/bans/delta8bans | kratombans-network | running |
| mushroombans-sidecar | /opt/apps/bans/mushroombans | kratombans-network | running |
| sentinel-newsroom-sidecar | /opt/apps/sentinel-newsroom | kratombans-network | running |
| ship-my-stack-sidecar | /opt/apps/ship-my-stack | kratombans-network | running |
| scan643-sidecar | /opt/apps/scan643 | scan643-network | running |
| signalforge-sidecar | /opt/apps/signalforge | bans-network | running |
| sovereignstack-sidecar | /var/www/sovereign-stack | systemd (bare metal) | running |
| reup-sidecar | /root/workspace/reup-backend | reup-backend_reup-network | running |
| sovpay-sidecar | /root/workspace/sovpay | prod-ops-network | running |
| pluginops-sidecar | /root/workspace/pluginops | prod-ops-network | running |
| repairradar-sidecar | /root/workspace/repairradar | prod-ops-network | running |
| evantage-sidecar | /root/workspace/Evantage | prod-ops-network | running |
| n8n-sidecar | /root/workspace/n8n | prod-ops-network | running |
/etc/systemd/system/sovereignstack-sidecar.serviceSovPay Merchant Provisioning Bus — ALL GATES CLOSED
7/7 phases proven. All 5 gates confirmed. Ready to sell now.
| Gate | Description | Status |
|---|---|---|
| Gate 1 — P2P | Onboarding routing + wallet dashboard flow | done |
| Gate 2 — Store | New user provisions store → adds product → customer buys → payment confirmed | done ✓ proven |
| Gate 3 — WooCommerce | Buy product on SovPay → order appears in WooCommerce admin → stock decrements | done ✓ confirmed by operator |
| Gate 4 — Safety | Terms and privacy pages live. UI copy clean. | done |
| Gate 5 — Launch | getsovpay.com landing page deployed. $$handle URL routing clean. | done ✓ live |
Known Polish Items (non-blocking)
| Item | Owner | Priority |
|---|---|---|
| In-app BTC wallet/copy/QR buttons inactive on payment screen | Cursor | Medium |
| Malformed JSON returns 500 not 400 on /api/handles/register | Cursor | Medium |
| Frontend bundle 1.29MB — code splitting needed | Cursor | Low |
| Frontend test coverage thin (14 tests) | Codex | Low |
| sovpay-postgres-1 on shared prod-ops-network — isolate to sovpay_internal | Cursor | Planned |
Provisioning Endpoints
| Endpoint | Purpose | Status |
|---|---|---|
| POST /api/provisioning/merchant/ensure | Atomic store + user + API key + webhook. Idempotent. Resumable. | live · proven |
| POST /api/provisioning/merchant/walletConnect | Connect watch-only xpub to BTCPay store. | live · proven |
| GET /api/provisioning/merchant/status | Pure DB read. Returns full phase state. Safe to poll. | live · proven |
config must be the raw xpub string, not an object. {"enabled": true, "config": "xpub..."} works. Object form fails with "Invalid account derivation".SS & Bans — Primary Server
65.109.171.38 · 16GB RAM / 150GB disk · Hetzner Helsinki · Nginx + Traefik v2.11
/opt/apps/ ├── bans/ │ ├── kratombans/ # LIVE · kratombans-api + db + sidecar │ ├── cbdbans/ # LIVE · cbdbans-api + db + sidecar · explicit traefik.docker.network label added │ ├── delta8bans/ # LIVE · delta8bans-api + db + sidecar · explicit label added │ └── mushroombans/ # LIVE · mushroombans-api + db + sidecar ├── discord-bots/ # LIVE · 5 bots: BanWatch, ProcessorPulse, SSAlert, CoOpDN, OpsBot + postgres ├── news-scraper/ # LIVE · feeds kratombans + cbdbans · port 127.0.0.1:4444 (hardened) ├── sentinel-newsroom/ # LIVE · sentinel-newsroom + sentinel-db + sidecar · explicit label added ├── openclaw/ # LIVE · control-plane (4 containers: app, db, oauth, proxy) ├── ship-my-stack/ # LIVE · shipmystack.com + sidecar · Stripe active ├── scan643/ # LIVE · scan643-api + database + sidecar ├── mef-compliance-platform-v2/ # LIVE · 6 containers · compliance-network ├── mef-prepscan-dashboard/ # LIVE · prepscan.pro sole owner (conflict resolved 2026-06-15) ├── signalforge/ # LIVE · intel.sovereignstack.pro · 5 containers · internal only ├── reupbot-pwa/ # LIVE · reup-pwa + reup-backend ├── forgesales/ # LIVE · forge.sovereignstack.pro · React+Vite+Express+Claude · Supabase · Phase A+B complete · BasicAuth gated ├── mse/ # LIVE · engine.merchantfirst.pro · Next.js 14 + Express + Postgres + Redis + Playwright └── sidecar-config/ # LIVE · config.sovereignstack.pro · port 3099 /var/www/ ├── sovereign-stack/ # LIVE · Next.js v14 · PM2 · port 3000 · sidecar via systemd · 46h uptime stable └── wordpress/ # LIVE · PHP 8.1-FPM · MariaDB · no HTTPS (planned)
/solutions/commerce/checkout-failure will self-resolve on next full rebuild.Prod-Ops — Production
204.168.169.58 · 16GB RAM · Hetzner Helsinki · 100% Docker · Traefik v3
/root/workspace/ ├── reup-frontend/ # LIVE · thereup.pro ├── reup-backend/ # LIVE · api.reupbot.com · reup-api + postgres + redis + sidecar ├── sovpay/ # LIVE · sovpay.me + getsovpay.com · ALL GATES CLOSED · 8.4/10 ├── pluginops/ # LIVE · pluginops.pro + sidecar ├── repairradar/ # LIVE · radar.pluginops.pro + sidecar · 68 eligible leads queued ├── pain-intelligence-dashboard/ # LIVE · signal.pluginops.pro + sidecar ├── Evantage/ # LIVE · evantage.pluginops.pro + sidecar ├── n8n/ # LIVE · brain.pluginops.pro + sidecar └── mgmalkz/ # LIVE · MGMX Commerce · $19,284 revenue · 108 orders /opt/apps/ ├── mef-ops/ # LIVE · operations.sovereignstack.pro · Hermes gateway wired ├── mgmedicalabs/ # LIVE · mgmedica.payme.mobi · Express+Vite · SendGrid ├── visibility-machine/ # LIVE · visibility.pluginops.pro · seeded · gated ├── sidecar-config/ # LIVE · sidecar.py ├── reddit-watcher/ # STAGED · needs Reddit credentials ├── reup-email-bot/ # STALE · not running · no .env └── ops/reup-agency-platform/ # STALE · source on disk · .env has live creds — rotate or deploy /opt/hermes/ # LIVE · Hermes agent · app + data + memory + workflows
BTCPay — Bitcoin Infrastructure
89.167.70.57 · 8GB RAM · kernel 6.8.0-117 · BTCPay 2.3.9 · Stable since 2026-05-29
| Container | Image | Port | Notes |
|---|---|---|---|
| btcpayserver | btcpayserver:2.3.9 | 49392 (internal) | Main BTCPay application |
| btcpayserver_lnd_bitcoin | lnd:v0.19.3 | 0.0.0.0:9735 (intentional) | Lightning peer port — must be public |
| btcpayserver_bitcoind | bitcoin:29.1 | internal only | Full Bitcoin node · 77GB and growing |
| btcpayserver_litecoind | litecoin:0.21.5.4 | internal only | 59GB — verify LTC payment methods active |
| generated_nbxplorer_1 | nbxplorer:2.6.7 | internal only | HD wallet tracker |
| generated_lnd_bitcoin_rtl_1 | rtl:v0.15.4 | 3000 (internal only) | Ride The Lightning — SSH tunnel access only |
| generated_postgres_1 | postgres:18.1 | 5432 (internal) | BTCPay database |
| nginx | nginx:1.25.3 | 80, 443 | BTCPay managed reverse proxy |
https://api.sovereignstack.pro/webhooks/btcpay · Secret: 4Z9HA6F6SF9JeRZmCdThT9rhngA8Agency — Webhook Bus & API Gateway
95.216.141.81 · 4GB RAM / 38GB disk (25% used) · Traefik v3 · SSL via Let's Encrypt
| Container | Purpose | Status |
|---|---|---|
| agency-traefik | Reverse proxy · SSL via Let's Encrypt | live |
| webhook-bus | Fastify webhook receiver + fan-out · 71 destinations | live · 0 restarts |
| webhook-bus-postgres | webhook_events table via Prisma | live · healthy |
Webhook Bus Endpoints
| Endpoint | Purpose | Auth |
|---|---|---|
| POST /webhooks/btcpay | BTCPay payment/invoice events | BTCPay-Sig HMAC |
| POST /webhooks/woocommerce | WooCommerce order events | X-WC-Webhook-Signature |
| POST /webhooks/github | GitHub push/PR/release events | X-Hub-Signature-256 |
| POST /webhooks/repair-radar | RepairRadar eligible leads | Bearer |
| POST /webhooks/reddit-lead | Reddit keyword hits | Bearer |
| GET /health | Service status + event counts | None |
| GET /events | Recent events with status | Bearer or X-API-Key |
Containers — SS & Bans
| Container(s) | Domain | Network | Status |
|---|---|---|---|
| kratombans-api + db + sidecar | kratombans.com | kratombans-network + backend_reup-network | live |
| cbdbans-api + db + sidecar | cbdbans.com | cbdbans-network · explicit label set | live |
| delta8bans-api + db + sidecar | delta8bans.com | kratombans-network · explicit label set | live |
| mushroombans-api + db + sidecar | mushroombans.com | kratombans-network | live |
| sentinel-newsroom + db + sidecar | (internal) | kratombans-network · explicit label set | live |
| ship-my-stack (4 containers + sidecar) | shipmystack.com | kratombans-network | live · Stripe active |
| scan643-api + database + sidecar | scan643.pro | scan643-network | live |
| openclaw control-plane (4 containers) | openclaw.* | kratombans-network | live |
| mef-compliance-platform-v2 (6 containers) | (internal) | compliance-network | live |
| mef-prepscan-dashboard | prepscan.pro · www.prepscan.pro · dashboard.prepscan.pro | kratombans-network | live · sole owner of prepscan.pro |
| signalforge (5 containers + sidecar) | intel.sovereignstack.pro | bans-network | live · internal only · 1,383 events collected |
| forgesales-app | forge.sovereignstack.pro | bans-network | live · Phase A+B done · Claude API · Resend · BasicAuth · full outreach cycle |
| mse-frontend + mse-worker + mse-backend + mse-postgres + mse-redis | engine.merchantfirst.pro | bans-network | live · 6 days uptime |
| discord-bots (5 bots + postgres) | (internal) | discord-internal | live |
| news-scraper | (internal) | kratombans-network | live · 127.0.0.1:4444 (hardened) |
| sidecar-config | config.sovereignstack.pro | backend_reup-network | live · port 3099 |
| traefik v2.11 | — | backend_reup-network | live · 127.0.0.1:8080 |
Bare Metal (SS & Bans)
| Process | Path | Port | Status |
|---|---|---|---|
| Next.js (sovereignstack.pro) | /var/www/sovereign-stack | 3000 | live · PM2 · 46h uptime |
| sovereignstack-sidecar | /opt/apps/sidecar-config/sidecar.py | — | live · systemd |
| WordPress | /var/www/wordpress | 80 | live · no HTTPS (planned) |
| MariaDB | host | 3306 | live · bare metal |
| Nginx | /etc/nginx/ | 80/443 | live · reverse proxy to Traefik |
Containers — Prod-Ops
| Container(s) | Domain | Network | Status |
|---|---|---|---|
| reup-web | thereup.pro | reup-network | live |
| reup-api + reup-postgres + reup-redis + reup-sidecar | api.reupbot.com | reup-backend_reup-internal (isolated DB) | live |
| sovpay-web + sovpay-api + sovpay-postgres + sovpay-sidecar | sovpay.me / getsovpay.com | prod-ops-network · DB isolation planned | live · ALL GATES CLOSED |
| pluginops (web + api + db + sidecar) | pluginops.pro | prod-ops-network · pluginops_internal (DB isolated) | live |
| repairradar + sidecar | radar.pluginops.pro | prod-ops-network | live · 68 eligible leads |
| pain-intelligence-dashboard + sidecar | signal.pluginops.pro | prod-ops-network | live |
| evantage + sidecar | evantage.pluginops.pro | prod-ops-network | live |
| n8n + sidecar | brain.pluginops.pro | prod-ops-network | live |
| mef-ops | operations.sovereignstack.pro | prod-ops-network | live · primary control plane |
| visibility-machine | visibility.pluginops.pro | prod-ops-network | live · seeded · gated · mefworks auth |
| mgmalkz (web + telegram-bot + discord-bot) | mgmalkz.com | prod-ops-network + mgmalkz_default | live · $19,284 revenue |
| mgmedica-dashboard | mgmedica.payme.mobi | prod-ops-network | live |
| traefik v3 | — | prod-ops-network | live · SSL via Let's Encrypt |
Containers — BTCPay
All official BTCPay-project images. 0 restarts across all containers. Stable since 2026-05-29.
| Container | Image | Port | Status |
|---|---|---|---|
| btcpayserver | btcpayserver:2.3.9 | 49392 internal | live |
| btcpayserver_lnd_bitcoin | lnd:v0.19.3 | 9735 public (intentional) | live |
| btcpayserver_bitcoind | bitcoin:29.1 | internal | live · 77GB |
| btcpayserver_litecoind | litecoin:0.21.5.4 | internal | live · 59GB · verify LTC active |
| generated_nbxplorer_1 | nbxplorer:2.6.7 | internal | live |
| generated_lnd_bitcoin_rtl_1 | rtl:v0.15.4 | 3000 internal only | live · SSH tunnel only |
| generated_postgres_1 | postgres:18.1 | 5432 internal | live |
| nginx | nginx:1.25.3 | 80, 443 | live · BTCPay managed |
Docker Networks
SS & Bans
| Network | Used By | Notes |
|---|---|---|
| backend_reup-network | Traefik, sidecar-config, kratombans-api | Main Traefik network. All containers needing external routing must join this AND have explicit traefik.docker.network label. |
| kratombans-network | All bans apps, sentinel, ship-my-stack, openclaw, news-scraper, sidecars | External: true. Primary app network. Known debt: overcrowded — 18+ containers, migration planned. |
| cbdbans-network | cbdbans-api, cbdbans-db, cbdbans-sidecar | cbdbans-app explicit traefik.docker.network label set 2026-06-15. |
| bans-network | ForgeSales, MSE, SignalForge stacks | Co-mingles Postgres + Redis instances — DB lateral movement risk. Migration planned. |
| compliance-network | mef-compliance-platform-v2 stack including mef-merchant-portal | Isolated. Correct. |
| scan643-network | scan643-api, database, sidecar | External: true. Isolated. |
| discord-internal | discord-bots stack | Bot isolation. Correct. |
Prod-Ops
| Network | Used By | Notes |
|---|---|---|
| prod-ops-network | Traefik, most app containers | Main shared network. Traefik on this network. |
| reup-backend_reup-internal | reup-api, reup-postgres, reup-redis | Isolated DB network. Correct pattern. |
| reup-backend_reup-network | reup-sidecar only | Intentional — sidecar only needs reup-api access. |
| pluginops_internal | pluginops-web, pluginops-api, pluginops-db | DB isolated. Correct pattern. |
| mgmalkz_default | mgmalkz bots | Hermes gateway accessible at 172.19.0.1:4200 from this network. Intentional. |
Domains & SSL
| Domain | Points To | SSL | Status |
|---|---|---|---|
| sovereignstack.pro | SS&Bans · bare metal PM2 | Certbot | live |
| config.sovereignstack.pro | SS&Bans · port 3099 | Nginx + Certbot | live |
| intel.sovereignstack.pro | SS&Bans · SignalForge · Nginx BasicAuth | Certbot | live · internal only |
| forge.sovereignstack.pro | SS&Bans · ForgeSales | Certbot | live |
| kratombans.com / cbdbans.com / delta8bans.com / mushroombans.com | SS&Bans · Traefik | Certbot | live |
| prepscan.pro / www.prepscan.pro / dashboard.prepscan.pro | SS&Bans · mef-prepscan-dashboard | Certbot | live · conflict resolved 2026-06-15 |
| shipmystack.com | SS&Bans · Traefik | Certbot | live |
| engine.merchantfirst.pro | SS&Bans · MSE | Certbot | live |
| btcpay.sovereignstack.pro | BTCPay server | BTCPay managed | live |
| sovpay.me / getsovpay.com | Prod-Ops · Traefik | Let's Encrypt | live · all gates closed |
| sovpay.pro | Prod-Ops · Traefik | Let's Encrypt | live · API only |
| thereup.pro | Prod-Ops · Traefik | Let's Encrypt | live |
| pluginops.pro + subdomains | Prod-Ops · Traefik | Let's Encrypt | live |
| operations.sovereignstack.pro | Prod-Ops · Traefik · BasicAuth | Let's Encrypt | live · mefworks auth |
| visibility.pluginops.pro | Prod-Ops · Traefik · BasicAuth | Let's Encrypt | live · mefworks auth |
| api.sovereignstack.pro | Agency · Traefik | Let's Encrypt | live · webhook bus |
| cortexhq.tech | Hostinger | — | EXPIRED — renew or lose |
| cortexhq.shop | Hostinger | — | EXPIRED |
| ss7score.com | Hostinger | — | EXPIRED |
| sovereignrails.pro / dataapi.pro | unassigned | — | planned |
Port Reference
SS & Bans — Public Ports
| Port | Binding | Service | Notes |
|---|---|---|---|
| 80, 443 | 0.0.0.0 | Nginx | Public reverse proxy. Routes to Traefik at 8080. |
| 8080 | 127.0.0.1 | Traefik v2.11 | Internal only. Nginx proxies to here. |
| 3099 | 127.0.0.1 | sidecar-config | Internal only. Nginx proxies config.sovereignstack.pro. |
| 4444 | 127.0.0.1 | news-scraper | Internal Docker only. Hardened 2026-06-15 (was 0.0.0.0). |
BTCPay — Public Ports
| Port | Service | Notes |
|---|---|---|
| 80, 443 | Nginx (BTCPay managed) | Public HTTPS |
| 9735 | LND Lightning | Intentionally public — required for Lightning channel opens |
Agency — Public Ports
| Port | Binding | Service | Notes |
|---|---|---|---|
| 80, 443 | 0.0.0.0 | Traefik v3 | Public. SSL via Let's Encrypt. |
| 3000 | internal | webhook-bus | Internal only. Traefik routes to it. |
| 5432 | internal | webhook-bus-postgres | Internal only. |
Security Issues
| Issue | Server | Status | Action |
|---|---|---|---|
| reup-backend + reup-frontend perms 777/666 | Prod-Ops | FIXED 2026-06-15 | chmod -R o-rwx applied. Now rw-rw----. |
| news-scraper port 4444 bound to 0.0.0.0 | SS&Bans | FIXED 2026-06-15 | Changed to 127.0.0.1:4444 binding. |
| ournorthstar/ and signalforge/ world-writable (0777) | SS&Bans | FIXED 2026-06-15 | chmod 755 applied to signalforge/. ournorthstar/ pending. |
| SIDECAR_CONFIG_KEY exposed in chat | All servers | PENDING | Rotate: openssl rand -hex 32. Update all .env files and sovereignstack-sidecar systemd service. |
| Hermes gateway unauthenticated (172.19.0.1:4200) | Prod-Ops | CURSOR TASK | Add Bearer token validation to hermes-http-gateway.js using MEF_OPS_WEBHOOK_SECRET. |
| sovpay-postgres-1 on shared prod-ops-network | Prod-Ops | PLANNED | Create sovpay_internal network. Mirror pluginops_internal pattern. |
| WordPress no HTTPS | SS&Bans | PLANNED | certbot --nginx -d [wordpress domain] |
| PM2 running as root | SS&Bans | KNOWN DEBT | Architecture debt. Not urgent. |
| SESSION_JWT_SECRET — DO NOT ROTATE | Prod-Ops SovPay | LOCKED | btcpayMerchantStoreApiKeyEnc depends on this. Rotating breaks all merchant keys. |
| reup-agency-platform .env with live credentials — not running | Prod-Ops | REVIEW | Check key names in /opt/apps/ops/reup-agency-platform/.env. Rotate or deploy. |
Audit Findings — v10.0 (2026-06-15)
Full 4-server read-only scan. 56 containers confirmed healthy.
🔴 Critical — All Resolved
| Finding | Server | Resolution |
|---|---|---|
| Duplicate Traefik router for prepscan.pro (mef-compliance-dashboard + mef-prepscan-dashboard) — non-deterministic routing | SS&Bans | RESOLVED — mef-compliance-dashboard stopped and removed. mef-prepscan-dashboard is sole owner. Compose file marked SUPERSEDED. |
| reup-backend + reup-frontend 777/666 permissions — .env world-readable | Prod-Ops | RESOLVED — chmod -R o-rwx applied to both directories. |
| DESTINATIONS_JSON — 53/114 expected destinations (61 missing) | Agency | RESOLVED — Rebuilt to 71 entries (35+35+1). All placeholders resolved. New projects added. |
🟠 High — All Resolved
| Finding | Server | Resolution |
|---|---|---|
| Disk at 82% (118GB used of 150GB) | Prod-Ops | RESOLVED — 92GB recovered via docker system prune. Now 25% (36GB used). |
| news-scraper port 4444 bound to 0.0.0.0 | SS&Bans | RESOLVED — Changed to 127.0.0.1:4444. |
| kratombans-sidecar generic Traefik router name "api" — collision risk | SS&Bans | DOCUMENTED — Rename to kratombans-sidecar-api on next deploy. |
| sovereign-stack PM2 51 restarts | SS&Bans | CLEARED — Historical accumulation. 46h uptime, 0 unstable restarts. Not an active problem. |
🟡 Medium — Documented / Deferred
| Finding | Server | Status |
|---|---|---|
| Traefik network labels implicit — cbdbans, delta8bans, sentinel-newsroom missing explicit traefik.docker.network | SS&Bans | FIXED — Labels added. Compose files updated. |
| Stale .production.yml files causing schema confusion | SS&Bans | FIXED — Renamed to .STALE across bans stack and signalforge. |
| kratombans-network overcrowding — 18+ unrelated containers | SS&Bans | DEBT — Planned migration. Not urgent. |
| bans-network co-mingles ForgeSales/MSE/SignalForge Postgres + Redis | SS&Bans | DEBT — Planned migration. |
| Dead nginx vhosts td.sovereignstack.pro + tdalt.sovereignstack.pro | SS&Bans | PENDING — Remove from nginx sites-enabled. |
| sovpay-postgres-1 on shared prod-ops-network | Prod-Ops | DEBT — Create sovpay_internal. Pattern: pluginops_internal. |
| mgmalkz-traefik-1 in Created state — port conflict landmine | Prod-Ops | RESOLVED — Container removed by prune. Compose file was already clean. |
| Hermes gateway unauthenticated at 172.19.0.1:4200 | Prod-Ops | CURSOR TASK — Add Bearer auth. |
| Visibility Machine BasicAuth hash confusion ($$ vs $) | Prod-Ops | RESOLVED — Hash hardcoded in compose label. $$ format correct everywhere. |
| BTCPay Litecoin node 59GB — verify active | BTCPay | CHECK — BTCPay Store Settings → Payment Methods → LTC. |
🟢 Low / Informational
| Finding | Server | Status |
|---|---|---|
| 3 orphaned Docker networks | SS&Bans | cleanup |
| 4 leftover .tar.gz archives | SS&Bans + Prod-Ops | cleared on Prod-Ops |
| 2 zombie node processes | SS&Bans + Prod-Ops | self-clearing on restart |
| Node.js 18 deprecated by @supabase/supabase-js | SS&Bans + Prod-Ops | planned upgrade to Node 20 |
| BTCPay disk — 29% used, Bitcoin 77GB growing | BTCPay | set 75% alert |
| RTL (Ride The Lightning) port 3000 internal | BTCPay | intentional · SSH tunnel only |
Stale / Inactive
| Item | Location | Notes |
|---|---|---|
| /home/mef/sovereign-stack/ | SS&Bans | Old copy. 709MB. Safe to delete — live version is /var/www/sovereign-stack. |
| reup-email-bot | Prod-Ops /opt/apps/reup-email-bot/ | Not running. No .env. Move to Agency when ready. |
| reup-agency-platform | Prod-Ops /opt/apps/ops/ | Source on disk, not running. Has .env with live credentials — review and rotate or deploy. |
| reddit-watcher | Prod-Ops /opt/apps/reddit-watcher/ | Single Python file, not running. Needs Reddit credentials to activate. |
| sentinel-social | Agency /opt/apps/sentinel-social/ | Directory exists, no containers running. Needs 16 .env secrets (Twitter/Reddit/FB/IG). |
| Duplicate BTCPay test stores | BTCPay server | Old stores from failed provisioning attempts. Archive via BTCPay admin. |
| .production.yml files | SS&Bans various | Renamed to .STALE — never deployed. entrypoints=websecure conflicts with Nginx-first architecture. |
| mef-compliance-dashboard/ | SS&Bans /opt/apps/ | Superseded by mef-prepscan-dashboard. Compose file marked SUPERSEDED. Directory safe to delete. |
Discord Ops Control Room — Notification Mirror
Discord is the notification mirror. MEF Ops Dashboard is the primary operator interface. Discord channel additions frozen.
📁 COMMAND ├── # directives # Active work orders. Current focus lives here. ├── # agent-log # All agent activity. Automated reports. ├── # deployments # Deployment events across all servers. ├── # priorities # Weekly focus list. └── # changelog # Version history and release notes. 📁 SS & BANS SERVER ├── # sovereignstack # sovereignstack.pro Next.js marketing site. ├── # kratombans # kratombans.com legislative tracking. ├── # cbdbans # CBD legislative tracking. ├── # delta8bans # Delta-8 THC legislative tracking. ├── # mushroombans # Psilocybin/mushroom legislative tracking. ├── # sentinel-newsroom # Automated news pipeline. ├── # mef-compliance # MEF compliance engine. ├── # scan643 # Automated website scanning. ├── # ship-my-stack # shipmystack.com B2B deployment SaaS. ├── # openclaw # OpenClaw platform. ├── # forgesales # LIVE · forge.sovereignstack.pro · ForgeSales ├── # mse # LIVE · engine.merchantfirst.pro · Merchant Survival Engine └── # signalforge # LIVE · intel.sovereignstack.pro · Intelligence terminal 📁 PROD-OPS SERVER ├── # reup # thereup.pro multi-tenant payment orchestration. ├── # sovpay # sovpay.me non-custodial Bitcoin PWA. ALL GATES CLOSED. ├── # pluginops # pluginops.pro internal plugin processing. ├── # repairradar # radar.pluginops.pro lead gen SaaS. 68 leads queued. ├── # evantage # evantage.pluginops.pro ├── # pain-intel # signal.pluginops.pro pain intelligence dashboard. ├── # n8n-brain # brain.pluginops.pro n8n automation hub. └── # visibility-machine # LIVE · visibility.pluginops.pro · build-in-public command deck 📁 BTCPAY SERVER ├── # btcpay # btcpay.sovereignstack.pro self-hosted BTCPay. ├── # payment-kernel # payment-kernel self-hostable payment OS. ├── # sovereign-kernel # Sovereign payment kernel. └── # lightning # Lightning Network operations. 📁 AGENCY SERVER ├── # webhook-bus # Webhook bus. 71 entries live. └── # api-gateway # api.sovereignstack.pro central endpoint bus. 📁 AGENTS ├── # hermes-chat # Hermes autonomous agent. Live operations. └── # general # Cross-project ops discussion. 📁 INTEL ├── # ban-alerts # BanWatch bot. Real-time legislative alerts. ├── # processor-pulse # ProcessorPulse bot. Payment processor monitoring. ├── # ss-status # SSAlert bot. Infrastructure uptime. └── # notifications # General system notifications. 📁 REVENUE ├── # leads-incoming # RepairRadar + Reddit keyword hits. ├── # outreach-queue # Hermes outreach drafts awaiting SEND approval. ├── # outreach-sent # Log of dispatched emails. └── # replies-detected # Warm reply detected. Hermes generates 1-3-1 response.
Webhook Bus — Fan-out Architecture
api.sovereignstack.pro · Agency server · 71 entries · Rebuilt 2026-06-15
External service (BTCPay / WooCommerce / GitHub / RepairRadar / etc.)
│
▼ POST to Agency webhook bus
api.sovereignstack.pro/webhooks/[source]
│
├── kind: "discord" → Discord webhook URL → Discord channel
│
└── kind: "mef-ops" → Bearer POST to operations.sovereignstack.pro
/api/inbound/[channelId]
│
▼
INSERT into Supabase events table
│
▼
Supabase Realtime pushes to dashboard
Fan-out Summary (71 entries total)
| Kind | Count | Notes |
|---|---|---|
| discord | 35 | All channels named. Consistent new-style schema. |
| mef-ops | 35 | All undefined-mef-ops placeholders resolved. |
| http | 1 | engine.merchantfirst.pro ban signal webhook. mushroombans added to sources. |
Agent Setup
Agent Division of Labor
| Agent | Role | Primary Strength | Does NOT |
|---|---|---|---|
| Claude Desktop | Strategist / Architect | Plans, analyzes, briefs, produces /ops/ files, architecture decisions | Touch production, deploy, send outreach |
| Hermes Desktop | Revenue Operator | Runs money loop, drafts outreach, monitors replies, daily report | Invent products, refactor code, start side quests |
| Cursor | Implementation Engineer | Wires missing endpoints, fixes bugs, implements CLI commands | Redesign business, create new products |
| Codex | Bulk Execution Worker | Scans repos, builds large modules, long audits, generates tests | Handle outreach, make business decisions |
Hermes Configuration
| Setting | Value | Notes |
|---|---|---|
| Location | /opt/hermes/ · Prod-Ops | app + data + memory + workflows + repos dirs |
| Config | /root/.hermes/config.yaml | Primary config. Env vars in /opt/hermes/.env override. |
| approvals.mode | auto ✓ | Routine actions execute without prompts. |
| browser.allow_private_urls | true ✓ | Hermes can reach internal services. |
| agent.max_turns | 150 ✓ | Increased for longer autonomous SDR sessions. |
| SOUL file (SDR) | /opt/hermes/soul-sdr.md | Defines SDR behavior, email tone, approval gate logic. Create before activating outreach. |
| AgentMail | NOT CONFIGURED | Required for autonomous email dispatch. Tell Hermes in #hermes-chat to set up. |
| Discord channels | All channels whitelisted | free_response_channels: all channels. |
MEF Ops Dashboard — Primary Control Plane
operations.sovereignstack.pro · Prod-Ops · Next.js · Supabase Realtime · Hermes Gateway
Auth
Traefik BasicAuth middleware. User: mefworks. Hash hardcoded in docker-compose.yml label with $$ escaping. Pattern: "traefik.http.middlewares.mef-auth.basicauth.users=mefworks:$$apr1$$..."
Persistence Layer (Supabase)
project_todos, project_notes, hermes_messages all Supabase-backed with Realtime. audit_runs and audit_findings populated by /audit command. project_money_metrics updated by audit — verdict, revenue_mtd, blockers, next_money_action.
Revenue Engine — SDR Pipeline
RepairRadar discovery + Reddit social listening + Hermes SDR + Sentinel Social
Revenue Targets — Priority Order
| Priority | Target | Blocker | Owner | Command |
|---|---|---|---|---|
| 1 | RepairRadar 68 eligible leads | SOUL file + AgentMail + webhook bus 4-URL (NOW DONE) | Hermes | mef outreach draft <leadId> |
| 2 | SovPay B2B merchant onboarding | None — all gates closed | Hermes outreach | mef pay merchant provision <handle> |
| 3 | ShipMyStack outreach | No SDR targeting active | Hermes | mef outreach draft <leadId> --product shipmystack |
| 4 | ForgeSales outreach | No inbound yet | Hermes | Standard outreach flow |
| 5 | MSE outreach | No SDR targeting | Hermes | Standard outreach flow |
| 6 | SovereignStack.pro checkout offers | No traffic yet | Sentinel Social + content | Visibility Machine post factory |
| 7 | Bans network / Mit45 acquisition | Waiting on Mit45 response | Claude + human | Follow up on offer sent |
SDR Pipeline Activation Checklist
| Action | Server | Status |
|---|---|---|
| Create Hermes SOUL file (/opt/hermes/soul-sdr.md) | Prod-Ops | PENDING |
| Tell Hermes to set up AgentMail inbox | #hermes-chat | PENDING |
| Add 4 REVENUE webhook URLs to bus DESTINATIONS_JSON | Agency | DONE — in 71-entry rebuild |
| Add /webhooks/repair-radar route to webhook bus | Agency | CURSOR TASK |
| Wire RepairRadar eligible-lead POST to bus | Prod-Ops | CURSOR TASK |
| Create Reddit bot account + app credentials | reddit.com | PENDING |
| Fill Sentinel Social .env and start container | Agency | 16 secrets needed |
Proven Revenue
| Source | Amount | Orders | Method |
|---|---|---|---|
| MGMX Commerce (mgmalkz) | $19,284 | 108 | BTCPay checkout |
| StoutAlkz (ReUp P2P) | $1,406,842 | 8,498 | Zero processor — Zelle/CashApp/Chime/BTC |
| duckdose (ReUp P2P) | $1,406,042 | 6,498 | Zero processor |
| Stout Alks + stoutalkz.org (Apr–Jun 2026) | ~$371K | — | AltPay P2P |
| stoutallz.org (NMI processor) | active | — | NMI card checkout via Pledged Plugins |
| Shippo labels (12 months) | $85,397 net | 5,911 labels | FedEx + USPS — corroborates P2P volume |
AI Operations Pipeline
Designed 2026-06-15. Ready to implement. All /ops/ files produced.
Daily Operating Workflow
06:00 Hermes Desktop wakes up
→ mef money (revenue snapshot)
→ mef money leads --limit 10
→ mef money blockers
→ drafts top 3 outreach emails
→ posts to #outreach-queue
06:30 HUMAN reviews queue
→ approves or edits
→ replies SEND in MEF Ops
Async Hermes watches #replies-detected
→ warm reply → drafts 1-3-1 response
→ posts to #outreach-queue for approval
17:00 Hermes generates DAILY_MONEY_REPORT.md
Rules of Engagement
| # | Rule |
|---|---|
| 1 | No new build unless it unlocks a revenue action within 24 hours. |
| 2 | No AI is allowed to create new product ideas unless explicitly asked. |
| 3 | Every task must map to: lead / sale / follow-up / deployment / invoice / blocker removal. |
| 4 | Every day starts with mef money. |
| 5 | Every day ends with DAILY_MONEY_REPORT.md. |
| 6 | If a system is not connected to money, it is ignored for 7 days. |
| 7 | Human approves outbound sales messages until trust is established. |
| 8 | Claude plans. Hermes operates. Cursor implements. Codex bulk-executes. |
/ops/ Files Produced
| File | Purpose |
|---|---|
| AI_OPERATIONS_BLUEPRINT.md | Master execution document — 15 sections |
| ACTIVE_ROLES.md | One-page role reference |
| TODAY_EXECUTION_QUEUE.md | Daily task queue |
| DAILY_MONEY_REPORT_TEMPLATE.md | Hermes fills nightly |
| HERMES_REVENUE_SOUL.md | Deploy to /opt/hermes/soul-sdr.md |
| CURSOR_EXECUTION_RULES.md | Cursor constraints and priority queue |
| CODEX_EXECUTION_RULES.md | Codex task format |
| CLAUDE_STRATEGY_RULES.md | When and how to use Claude |
| NO_NEW_PROJECTS.md | Scope freeze for 30 days |
MEF CLI — mef
Designed 2026-06-15. TypeScript. Routes into existing services. Ready to implement.
mef CLI is a personal operating system for running the entire MEF ecosystem from one command surface. It routes into existing services — never reimplements them. Config lives at ~/.mef/config.yaml.Command Hierarchy
mef money # Revenue snapshot — runs daily mef money leads --limit 10 # Top eligible leads mef money blockers # What's blocking revenue mef money opportunities # Products ready to sell mef money followups # Threads needing next action mef pay invoice create --amount 250 --currency USD mef pay merchant provision <handle> mef pay merchant status <handle> mef pay health mef comply scan <url> mef comply wp audit <url> mef comply bans status kratom mef intel leads list --status eligible mef intel processor status mef intel collect mef outreach draft <leadId> mef outreach queue mef outreach send <outreachId> mef outreach replies mef monitor status mef monitor logs <project> --tail 50 mef monitor ssl <domain> mef webhook health mef webhook watch --channel leads-incoming mef webhook replay <eventId> mef agent status mef agent run hermes <task> mef agent soul show mef agent soul edit mef deploy project <name> mef deploy sovereignstack mef server health --server all mef server ps --server prod-ops mef server ports --server prod-ops mef audit <project> mef project list mef project blockers
Architecture
| Adapter | Used For | Target |
|---|---|---|
| SSH Adapter | Server ops, deploy, logs, port checks | Hetzner servers via node-ssh |
| HTTP Adapter | BTCPay Greenfield, SovPay provisioning, webhook bus | API endpoints with auth headers |
| Supabase Adapter | project_states, leads, outreach, money_metrics | IPv4 pooler + SSL CA + SNI (known quirk) |
| Shell Adapter | Local commands | child_process |
Phase Documents Produced
| File | Content |
|---|---|
| INVENTORY_REPORT.md | All projects classified: ACTIVE / REVENUE READY / NEAR REVENUE / INTERNAL / ARCHIVE / DEAD |
| CAPABILITY_MAP.md | 14 capability domains organized by function, not project |
| CLI_SPEC.md | Full command hierarchy, global flags, config file structure |
| MONEY_COMMANDS.md | mef money subcommands — reads from Supabase project_money_metrics |
| ROUTING_ARCHITECTURE.md | Plugin-based module system, YAML routing table, auto-discovery |
| CONSOLIDATION_REPORT.md | 21 KEEP, 3 MERGE, 2 REPLACE, 4 DELETE, 7 ACTIVATE, 7 DEFER |
Project Registry — New in v10.0
| Project | URL | Server | Stack | Status |
|---|---|---|---|---|
| SignalForge | intel.sovereignstack.pro | SS&Bans | React + FastAPI + Postgres + Redis | LIVE · internal only · 1,383 events |
| ForgeSales | forge.sovereignstack.pro | SS&Bans | React+Vite+Express+Claude API+Supabase+Resend | LIVE · Phase A+B complete · full outreach cycle · BasicAuth gated |
| MSE | engine.merchantfirst.pro | SS&Bans | Next.js 14 + Express + Postgres + Redis + Playwright | LIVE · 6 days uptime |
| Visibility Machine | visibility.pluginops.pro | Prod-Ops | Node.js + Gemini AI | LIVE · seeded · 7 posts scheduled |
| ReUp Mini | reupmini.com | Vercel | Next.js 15 + api.reupmini.com | LIVE · production-safe frontend deployed |
| MEF Story Engine | (local) | Local dev (H:\) | Cursor project · 15,944 images | ACTIVE LOCAL · proof documentation |
Visibility Machine Capabilities
Build Log · Proof Vault · Clip Builder · Post Factory (Gemini — 7 platforms) · Angle Finder · Dispatch Calendar · Launch Pad · Money Board · Growth Tracker · Reuse Library
Active: ReUp Proof Series — P2P at $1.4M campaign (50% complete). 7 posts scheduled June 16–25. Auth: Traefik BasicAuth, mefworks. Repo: MEF-works/visibility-machine. Deploy key: C:\Users\MeF\.ssh\mgmalkz.pem
ReUp Mini
Passwordless merchant onboarding. Direct shop link + embed code. In-page checkout modal. Cash App / Venmo / Zelle / PayPal / BTC / ETH. Zero custody. Starter free / Pro $29/mo (coming soon).
Repo: MEF-works/reup-mini-new · Commit: dfac727 · Env: NEXT_PUBLIC_MOCK_MODE=false on Vercel
WordPress Sites — Hostinger
| Domain | Purpose | Status |
|---|---|---|
| mefworks.com | Primary brand / dev/engineer public site + client PWA | live |
| sovereignstack.pro | SovereignStack marketing + checkout (Next.js on Hetzner — not Hostinger WP) | live · bare metal |
| stoutalkz.com | Client commerce — $1.4M ReUp P2P volume | live |
| thereup.pro | Multi-merchant/customer Expo full commerce dual-sided app | live |
| reuppro.com | Modern Next.js multi-merchant platform | live |
| reupmini.com | ReUp Mini — live P2P mini shop platform | live · Vercel |
| getsovpay.com | SovPay marketing landing page | live |
| kratombans.com | Kratom legislative tracking (also on Hetzner) | live |
| kratombans.blog | KratomBans blog content | live |
| mgmalkz.com | MGMX Commerce — $19,284 revenue | live |
| merchantfirst.pro | MSE marketing domain | live |
| shipmystack.com | ShipMyStack B2B deployment SaaS | live · Stripe active |
| scan643.pro | Scan643 compliance scanning | live |
| elitegaragedoorohio.com | Personal — garage door business if reactivated | live |
| eliteplugs.com | Products | live |
| engineeredresults.pro | Agency/services | live |
| flowstateops.pro | Ops brand | live |
| freewayrails.pro | Freeway Rails payment product | live |
| getreup.pro | ReUp marketing | live |
| groundedobservations.com | Content/blog | live |
| highriskpayments.news | High-risk payments content/intel | live |
| highriskthis.com | Brand | live |
| levyai.tech | Levy agent brand | live |
| licenses.mefworks.com | License management | live |
| mef.money | Internal filing cabinet / WooCommerce test env / WooDock / MEF~DOCS | internal only |
| mefdup.com | Dev/engineer public facing + client progress PWA (built, not active) | built · inactive |
| payme.mobi | SovPay P2P adjacent | live |
| reparchitect.youaskedchatgptwhat.com | Content | live |
| reupbot.store | ReUp store | live |
| samnmef.com | Personal/brand | live |
| scan643.com | Scan643 marketing | live |
| sovereignrails.pro | Payment kernel brand (domain only) | planned |
| stoutalkzz.com | Client commerce variant | live |
| sweepersedge.com | Affiliate social casino — 53+ pages unique content, first commercial build | live |
| up247time.pro | Uptime monitoring product | live |
| youaskedchatgptwhat.com | Content | live |
| cortexhq.tech | CortexHQ brand | EXPIRED |
| ss7score.com | SS7 product | EXPIRED |
Domain Inventory — 73 Total (Hostinger)
ReUp Cluster (RENEW Jul–Aug 2026)
thereup.pro · thereup.store · thereup.site · thereup.cloud · reupbot.com · reupbot.store · reuppro.com · reupmini.com · getreup.pro · stayup.pro
SovPay Cluster
sovpay.me · sovpay.pro · getsovpay.com · payme.mobi
Bans Network
kratombans.com · kratombans.blog · kratombans.site · cbdbans.com · delta8bans.com · mushroombans.com · psilocybinbans.com · mef-bans.network · mefbans.com
SovereignStack / Infrastructure
sovereignstack.pro · sovereignrails.pro · freewayrails.pro · altpayrails.com · dataapi.pro · shipmystack.com · pluginops.pro · repairradar.pro · engineeredresults.pro · up247time.pro
Scan / Compliance
scan643.com · scan643.pro · prepscan.pro · readystate.pro · highriskpayments.pro · highriskpayments.news · highriskpayments.online · highriskpayments.cc · highriskthis.com
CortexHQ
cortexhq.pro · cortexhq.tech (EXPIRED) · cortexhq.blog · cortexhq.shop (EXPIRED)
MEF Brand
mefworks.com · mefdup.com · menterprisefirminc.com · licenses.mefworks.com · mef.money · mef-bans.network · mefbans.com
Agent / AI Brands
levyai.tech · neuragoal.pro · realitygrid.pro · ournorthstar.space
Commerce / Clients
stoutalkz.com · stoutalkzz.com · mgmalkz.com · mgmx.pro · mgmtracker.pro · eliteplugs.com · elitegaragedoorohio.com · sweepersedge.com
Products / Tools / Misc
merchantfirst.pro · merchantscout.pro · forgesales.pro · flowstateops.pro · groundedobservations.com · youaskedchatgptwhat.com · reparchitect.youaskedchatgptwhat.com · githubxray.pro · accountableinteractions.com · safemoney.pro · safeguarded.pro · papermaker.pro · householdheros.pro · samnmef.com · ss7score.com (EXPIRED) · altpayrails.com · reupmini.com · ournorthstar.space · mgmx.pro
Next Actions
Tonight (Critical Path)
| Priority | Action | Server | Owner |
|---|---|---|---|
| 1 | Build signal-filter.py — keyword filter on SignalForge output → intel_signals → intel_events | SS&Bans | Cursor |
| 2 | Build merchant-event-matcher.py — links intel_events to merchant_profiles | SS&Bans | Cursor |
| 3 | Tune RepairRadar scan targeting — real high-risk merchant domains not test/docs sites | Prod-Ops | Cursor + RepairRadar UI |
| 4 | Schedule repairradar_sync.py cron on Prod-Ops (after targeting tuned) | Prod-Ops | Human |
| 5 | Deploy Hermes SOUL file → /opt/hermes/soul-sdr.md | Prod-Ops | Human + SSH |
| 6 | Tell Hermes in #hermes-chat to set up AgentMail inbox | #hermes-chat | Human |
| 7 | Clean up test merchant rows (test-merchant*.com) from Supabase | Supabase | Human |
Cursor Task Queue (Ordered)
| Priority | Task | Server |
|---|---|---|
| 1 | signal-filter.py — SignalForge → intel_signals → intel_events (keyword rules defined in ops session) | SS&Bans |
| 2 | merchant-event-matcher.py — daily job matching new intel_events to merchant_profiles | SS&Bans |
| 3 | RepairRadar targeting tuning — focus scan criteria on kratom/CBD/delta8/mushroom/firearms/adult verticals | Prod-Ops |
| 4 | ForgeSales Phase C — daily run endpoint + n8n cron at 05:00 | SS&Bans |
| 5 | Wire RepairRadar eligible-lead POST → api.sovereignstack.pro/webhooks/repair-radar (webhook bus) | Prod-Ops |
| 6 | Add Bearer token auth to hermes-http-gateway.js on Prod-Ops | Prod-Ops |
| 7 | Fix sovereign-stack Next.js bound on *:3000 → 127.0.0.1:3000 | SS&Bans |
| 8 | Create sovpay_internal Docker network — isolate sovpay-postgres | Prod-Ops |
| 9 | Remove dead nginx vhosts td.sovereignstack.pro + tdalt.sovereignstack.pro | SS&Bans |
Completed This Session (2026-06-17)
| Item | Status |
|---|---|
| ForgeSales Phase A — Gemini removed, Claude integrated, auth, persistence, outreach cycle | ✓ DONE |
| ForgeSales Phase B — Market Scout, Sales Doctrine, Script Forge, CRM Tracker wired to Supabase | ✓ DONE |
| Supabase schema v1 — 39 tables, all RLS enabled, all policies correct | ✓ DONE |
| MEF CLI Phases 0–4 — config, project, monitor, money, webhook, pay, comply, server, deploy | ✓ DONE |
| Full outreach loop confirmed — propose → approve → Resend send → email received | ✓ DONE |
| Inbound webhook with Claude classifier + Svix signature verification | ✓ DONE |
| Merchant memory writing on every action (scan, outreach, reply, strategy) | ✓ DONE |
| RepairRadar sync script built and deployed to Prod-Ops | ✓ DONE |
| BasicAuth password gates on ForgeSales + MEF Ops + Visibility Machine | ✓ DONE |
| SS&Bans kernel upgrade + reboot — all 54 containers and PM2 processes came back clean | ✓ DONE |
| Architecture philosophy locked — Supabase is Shared Truth, decision engine not intel landfill | ✓ LOCKED |
Infrastructure Planned
| Action | Notes |
|---|---|
| Set up Bitwarden Secrets Manager | Before handing Hermes live email credentials. Machine access token, separate from personal vault. |
| Add SSL to WordPress | SS&Bans: certbot --nginx -d [wordpress domain] |
| BTCPay disk alert at 75% | Bitcoin node growing ~5-10GB/month on 492GB volume. |
| Node.js 18 → 20 upgrade | SS&Bans bare metal + Prod-Ops. Required by @supabase/supabase-js. |
| Prod-Ops kernel reboot | Kernel update pending on Prod-Ops — same as SS&Bans. pm2 save first then reboot. |
| ReUp domain renewals | URGENT — July/August 2026. Set reminders now. |
| Rotate SIDECAR_CONFIG_KEY | Was exposed in session. openssl rand -hex 32. Update all .env files and sovereignstack-sidecar systemd service. |
ForgeSales — Merchant Intelligence Platform
forge.sovereignstack.pro · SS&Bans · Phase A + B complete 2026-06-17
Architecture
ForgeSales is the Human+AI workspace. It does NOT own merchant data — Supabase owns all intelligence. ForgeSales surfaces merchant history, risks, opportunities, outreach, and memory. Every action writes back to Supabase.
Dual DB Pattern
| Client | Used For | Auth |
|---|---|---|
pg pool via DATABASE_URL | Core ForgeSales tables: leads, email_templates, campaigns, campaign_runs, collaboration_actions, internal_comms, handoff_requests | Postgres password |
@supabase/supabase-js via server/services/supabase.js | Merchant schema: merchant_profiles, merchant_scans, merchant_findings, merchant_outreach, merchant_memory_events, merchant_event_matches, intel_events, contacts, organizations, scan_decisions | SUPABASE_SERVICE_ROLE_KEY |
Phase A — Completed 2026-06-17
| Task | Status | Notes |
|---|---|---|
| Strip Gemini, install Claude SDK | done | claude-sonnet-4-6 · callClaude() + callClaudeJSON() in server/services/claude.js |
| API key auth on /api/collab + /api/agent | done | FORGESALES_API_KEY header · VITE_FORGESALES_API_KEY baked into frontend build |
| Persist data to Postgres | done | Templates, campaigns, notes, handoffs, proposals survive container restart |
| CollabNotifications wired into App.tsx | done | Pending proposals + flagged notes visible in UI header |
| POST /api/agent/outreach/propose | done | Writes to collaboration_actions + outreach_queue + merchant_outreach |
| Approval auto-triggers Resend send | done | POST /api/collab/action/respond {approved:true} → Resend fires → memory event written |
| Inbound email webhook rebuilt (Claude classifier) | done | Svix signature verification · Claude classifies reply intent · updates merchant stage + memory |
| Extend /api/ingest to write merchant schema | done | Upserts merchant_profiles + merchant_scans + contacts + merchant_memory_events |
| Email templates updated | done | Informing not selling tone · Early Access footer · sovereignstack.pro signature |
| Webhook bus fan-out | done | Fires on propose, send, reply, ingest → MEF Ops channels |
| Rotate credentials | done | New INGEST_API_KEY + FORGESALES_API_KEY · .env gitignored |
| Traefik BasicAuth password gate | done | mefworks / same password as MEF Ops + Visibility Machine |
Phase B — Completed 2026-06-17
| Screen | Was | Now |
|---|---|---|
| Market Scout / Find Leads | Empty Gemini-powered prospect search | Live merchant browser from merchant_profiles. Cards show domain, vertical, geo, stage, score, findings count, intel matches, outreach count. Detail drawer: 6 tabs (Overview, Scans, Findings, Intel, Outreach, Memory). Quick Scan + Full Scan buttons trigger engine.prepscan.pro. |
| Sales Doctrine / Strategy Playbook | Generic sales playbook generator (Gemini) | Per-merchant strategy engine. Select merchant → Claude reads full context from Supabase (scans, findings, intel matches, memory) → generates approach, lead_with, supporting_points, intel_hooks, avoid, confidence, urgency. Output feeds Script Forge. |
| Script Forge / Message Lab | Free-form message generator (Gemini) | Receives pre-populated context from Sales Doctrine. Claude generates email with ai_claims[] (every claim has evidence + source + confidence). Queue for Approval → proposal enters outreach cycle. |
| CRM Tracker / Merchant CRM | Static pipeline table | Merchant list on left, color-coded memory timeline on right. Every scan, email, reply, intel match, mitigation displayed chronologically from merchant_memory_events. |
New Backend Endpoints (Phase B)
| Endpoint | Purpose |
|---|---|
| GET /api/merchants | List merchant_profiles with filters (stage, vertical, geo, search) + scan/finding/intel counts |
| GET /api/merchants/:id | Full merchant profile — scans, findings, outreach, intel matches, memory, contacts |
| GET /api/merchants/:id/memory | Paginated merchant memory timeline |
| POST /api/merchants/:id/scan | Trigger PrepScan at engine.prepscan.pro — writes memory event on trigger |
| POST /api/merchants/:id/strategy | Claude strategy brief from full merchant context — writes opportunity_surfaced memory event |
| POST /api/agent/outreach/compose | Claude email draft with ai_claims[], Early Access footer, sovereignstack.pro signature |
| POST /api/scan-decisions | Record scan decision (outreach/monitor/skip/disqualify) with outcome tracking |
| GET /api/scan-decisions | List scan decisions with filters |
Merchant Schema — Supabase v1
Deployed 2026-06-17 · 39 tables total · All RLS enabled · All service_role protected
Core Philosophy
Supabase is Shared Truth. Every system writes facts to Supabase. Every AI reads from Supabase. No AI owns truth. No frontend owns truth. Facts are permanent. Reasoning is temporary. Only store information that changes: merchant risk, merchant opportunity, outreach, operations, revenue, or mitigation. Discard everything else.
New Tables Added 2026-06-17
| Table | Purpose | Key Columns |
|---|---|---|
| organizations | Holding companies, agency clients | name, type, industry[] |
| merchant_profiles | One row per store. Domain unique but NOT permanent ID. References organizations. | domain, vertical[], geo_states[], stage, last_scan_at, last_outreach_at, last_reply_at, source, forgesales_id |
| contacts | Humans at a merchant. Separated from domain. | merchant_id, organization_id, email, name, role, verified |
| merchant_scans | Every scan from every scanner. Evidence lives here permanently. | merchant_id, scanner, score, risk_level, violation_count, findings jsonb, report_snapshot jsonb, evidence jsonb, sources jsonb |
| merchant_findings | Individual actionable findings. Resolved or unresolved. | merchant_id, scan_id, finding_type, severity, title, evidence jsonb, confidence, resolved_at |
| intel_events | ONE row per real-world event. Never duplicated. Source of truth for all regulatory/market intel. | title, category, severity, affected_verticals[], affected_states[], evidence jsonb, decision_impact, confidence, is_active |
| merchant_event_matches | Links merchants to intel events. One event → N matches. UNIQUE(merchant_id, event_id). | merchant_id, event_id, match_reason, priority, status |
| merchant_outreach | Every outreach attempt permanently. Full draft + send + reply history. | merchant_id, contact_id, subject, body, status, ai_claims jsonb, intel_event_ids[], scan_ids[], sent_at, replied_at |
| merchant_memory_events | Crown jewel. Append-only history of everything. Never update, only insert. | merchant_id, event_type, title, summary, evidence jsonb, sources jsonb, outcome, related_id, recorded_by |
| intel_signals | SignalForge filtered output. Only decision-relevant events. | source, category, title, score, relevance_tags[], product_verticals[], geo_scope, raw_payload jsonb, promoted_to_event |
| scan_decisions | Track every scan decision with outcome. History dataset. | merchant_id, scan_id, domain, decision, reason, decided_by, outcome, decided_at |
merchant_memory_events — Event Types
scan_completed · outreach_sent · reply_received · finding_detected · finding_resolved · intel_matched · processor_issue · mitigation_applied · client_onboarded · subscription_started · subscription_ended · opportunity_surfaced · outcome_recorded · discord_joined · discord_question
RLS Policy Summary
| Policy Pattern | Tables | Access |
|---|---|---|
| service_role_all only | All merchant/intelligence tables, ForgeSales collab tables, leads, outreach_queue, session_archive | Backend only via service role key. No anonymous access. |
| service_role_all + anon_read | project_states, project_state_history, events, hermes_messages, project_todos, project_notes, audit_findings, audit_runs, project_money_metrics | MEF Ops frontend reads via anon key. Backend writes via service role. |
Outreach Cycle — Full Loop Live
Scout → Compose → Approve → Send → Receive → Classify → Store
Full Cycle Flow
RepairRadar / PrepScan / Manual scan
↓
POST /api/ingest (x-api-key: INGEST_API_KEY)
→ upserts leads table (pg)
→ upserts merchant_profiles (Supabase)
→ inserts merchant_scans (Supabase)
→ upserts contacts (Supabase)
→ inserts merchant_memory_events: scan_completed
→ fan-out to #leads-incoming via webhook bus
↓
Market Scout — merchant card appears with score + findings
↓
Sales Doctrine — select merchant → Generate Strategy
→ Claude reads: scans + findings + intel_matches + memory
→ Returns: approach, lead_with, supporting_points, intel_hooks, avoid
→ Writes merchant_memory_events: opportunity_surfaced
↓
Script Forge — Forge Payload (pre-populated context)
→ POST /api/agent/outreach/compose
→ Claude generates email with ai_claims[] (every claim cited)
→ Early Access footer + sovereignstack.pro signature
↓
Queue for Approval → POST /api/agent/outreach/propose
→ collaboration_actions (status: pending_approval)
→ outreach_queue (status: pending)
→ merchant_outreach (status: draft, ai_claims jsonb)
→ fan-out to MEF Ops #outreach-queue + CollabNotifications
↓
HUMAN REVIEWS — approves in ForgeSales UI or MEF Ops
↓
POST /api/collab/action/respond {approved: true}
→ Resend sends email from outreach@sovereignstack.pro
→ collaboration_actions → executed
→ outreach_queue → sent
→ merchant_outreach → sent
→ leads → contacted
→ merchant_profiles stage → contacted, last_outreach_at updated
→ merchant_memory_events: outreach_sent
→ fan-out to #outreach-sent
↓
Reply arrives → Resend inbound → POST /api/webhooks/inbound-email
→ Svix signature verified (RESEND_WEBHOOK_SIGNING_SECRET)
→ Lookup lead/contact by from email
→ Claude classifies: intent, sentiment, summary, urgency, key_points
→ merchant_outreach: replied_at + reply_summary
→ leads: status → replied
→ merchant_profiles: stage → replied, last_reply_at updated
→ merchant_memory_events: reply_received
→ internal_comms: flagged note (visible in Leads·Outreach·CRM)
→ fan-out to #replies-detected
AI Zero-Trust Rules
Every email draft includes internal ai_claims jsonb — never shown to merchant, stored permanently in merchant_outreach. Each claim must include:
| Field | Required | Notes |
|---|---|---|
| claim | ✓ | Exact claim made in email |
| evidence | ✓ | Source of this claim — scan result, finding ID, intel event |
| source | ✓ | Which scanner/event this came from and when |
| confidence | ✓ | 0-100. If AI cannot explain itself, it does not make the claim. |
| verifiable | ✓ | true/false — can the merchant verify this independently |
Early Access Email Footer (locked — use verbatim)
You are receiving these findings as part of our Early Access Merchant Survival Engine program. For a limited time, we are sharing intelligence reports, compliance findings, and industry alerts with a small group of merchants at no cost. The purpose of this program is simple: to prove the value of the intelligence before asking anyone to pay for it. Over the coming weeks, we will continue sharing relevant findings that may affect your business. If these reports prove valuable to you, there will be an option to continue receiving them as part of the Merchant Survival Network after the pilot period ends. No obligation. No pressure. Just useful information designed to help merchants stay ahead of changing risks and opportunities.
Email Configuration
| Setting | Value |
|---|---|
| Provider | Resend |
| From address | outreach@sovereignstack.pro |
| Inbound webhook | POST /api/webhooks/inbound-email on forge.sovereignstack.pro |
| Signature verification | Svix · RESEND_WEBHOOK_SIGNING_SECRET in .env |
| MX record | Already configured in Hostinger DNS for sovereignstack.pro |
Intelligence Pipeline — Architecture Locked
Scripts filter → Supabase stores → AI reasons → ForgeSales surfaces
Data Flow
Reality ↓ PrepScan · Scan643 · RepairRadar · SignalForge ↓ Filter Engine (scripts — fast, cheap, deterministic — NOT AI) ↓ Supabase (Shared Truth) intel_signals → intel_events → merchant_event_matches merchant_profiles → merchant_scans → merchant_findings merchant_outreach → merchant_memory_events ↓ ForgeSales · Discord Bots · Hermes · Visibility Machine ↓ Human Decisions ↓ Outcomes → stored back into Supabase (merchant_memory_events)
Intelligence Systems Status
| System | Role | Output Table | Status |
|---|---|---|---|
| PrepScan | Playwright scanner · 200+ rulesets · compliance findings | merchant_scans via /api/ingest | live · engine.prepscan.pro |
| Scan643 | Checkout/payment script intel · processor dependencies · third-party scripts | merchant_scans via /api/ingest | live · scan643.pro |
| RepairRadar | Deep domain scans · AI reasoning · outreach eligibility scoring | leads + merchant_profiles via repairradar_sync.py | live · targeting needs tuning |
| SignalForge | Regulatory/tech/commerce/cybersecurity intel collection · 9,018 collected · 2,439 promoted | intel_signals (filter script pending) | live · signal-filter.py NOT YET BUILT |
RepairRadar Sync Script
| Item | Detail |
|---|---|
| Location | /root/scripts/repairradar_sync.py on Prod-Ops |
| Source DB | SQLite at /root/workspace/repairradar/prisma/dev.db |
| Target | POST to ForgeSales /api/ingest → merchant_profiles + merchant_scans + leads |
| Run | INGEST_API_KEY=xxx python3 /root/scripts/repairradar_sync.py |
| Dry run | Add --dry-run flag — shows what would be synced without POSTing |
| Cron | 0 4 * * * — not yet scheduled (pending RepairRadar targeting tuning) |
| Status | Built and tested · 4 eligible leads found (3 real merchants + 1 noise) · targeting needs tuning before cron |
Pending Intelligence Scripts
| Script | Purpose | Server | Status |
|---|---|---|---|
| signal-filter.py | Reads SignalForge API · keyword/score filter · writes decision-relevant events to intel_signals · promotes to intel_events | SS&Bans | NOT BUILT |
| merchant-event-matcher.py | For each new intel_event · queries merchant_profiles by vertical[] + geo_states[] · creates merchant_event_matches rows · deduplicates via UNIQUE constraint | SS&Bans or Prod-Ops | NOT BUILT |
MSE Subscription Model (planned)
| Tier | What's Included |
|---|---|
| Free / Early Access | Weekly intel email personalized to their domain + vertical. No Discord. No obligation. Pilot period. |
| Merchant Survival Network ($X/mo) | Everything above + MSE Discord access + monthly compliance rescan + processor alert monitoring via ProcessorPulse + direct human response path + historical report access (full merchant memory) |