I
Phase 2 Reconciliation Plan
Apr 27 architectural reset · Phase 2 of 3 · proposed actions
Phase 2 of 3 · proposals + executed work

Reconciliation calls per file. Two categories already executed, three need your sign-off.

Categories 6 (both edited) and 5 (VM newer) executed during this Phase 2 walkthrough with verification gates. Categories 1 (PC-only deployment-intent), 2 (VM-only classification), and 8 (secrets inventory) presented here as proposals with checkboxes for your review. Categories 3 (identical), 4 (no PC-newer files), and 7 (generated artifacts) need no Phase 2 work and are marked closed. After your review, an executable proceeds with the approved subset.

2
Executed (cat 6, 5)
3
Proposals (cat 1, 2, 8)
3
Closed (cat 3, 4, 7)
3
Verification corrections
4
Cat 1 flagged HTMLs
21
Cat 2 VM-only files
11
Cat 8 secret targets
Verification corrections surfaced during Phase 2. Three places where Phase 1 conclusions were incomplete or wrong, caught by the Phase 2 verification gates:
  1. Perplexity patcher WAS deployed. The Apr 27 changelog row said "NEVER DEPLOYED, you rejected the deploy command." VM file at /opt/iexdg-mcp/iexdg_content_mcp_v3_2_apr22.py contains the full patcher block as of 2026-04-27 23:06 UTC. Provenance unconfirmed (another Claude session, manual run, or automation). Decision #4 lock revised to LOCKED + EXECUTED. Robert was correct earlier in the session when he said Perplexity was already wired. Changelog updated.
  2. Phase 1 audit scope was narrower than stated. SCOPE_DIRS for PC included TOOLS/automation_scripts/, TOOLS/automation_output/, TOOLS/mcp/ but NOT TOOLS/ root. Four PC secrets at TOOLS/ root were missed: brain_bearer_token.txt, gmail_token.pickle, iexdg_apps_script_token.pickle, youtube_client_secrets.json. VM scope did not include /var/lib/iexdg-brain/, missing ~40 fastmcp OAuth state files. Phase 2 inventory below incorporates the remediated scan.
  3. fastmcp tokens DO persist across restarts. The OAuth wrapper docstring assumed SQLiteStorage import was the persistence path, with in-memory fallback. Reality: fastmcp 3.2.4 falls back to a JSON-file-based KeyValue store at /var/lib/iexdg-brain/fastmcp/oauth-proxy/. Tokens, refresh tokens, JTI mappings, DCR client registrations all persist as individual JSON files. Decision #5 lock framing about "in-memory token store doesn't survive restart" was wrong on the actual deployed behavior. The SQLiteStorage upgrade is still a Phase 3 quality-of-life improvement (proper transactional storage vs. one-file-per-token), but it is no longer a correctness fix.

Category 6 · Both edited (1 file)

EXECUTED
EXECUTED Apr 28 02:47-03:23 UTC. One file: STRATEGY/IEXDG_Complete_Action_Ledger.html. Diagnosis confirmed: PC strictly newer with three appended sprint sections (Sprints 23, 24, 25 totalling +40,490 chars), no VM-side edits to PC content. Resolution: pushed PC → VM via scp + sudo install -m 644 -o caddy -g caddy. Three-layer verification: VM file size 260,703 B + sha256 c96963d7… matches PC; HTTP 200 from https://brain.iexdg.com/strategy/IEXDG_Complete_Action_Ledger.html with 260,703 served bytes; content markers Sprint 25 ×3, Culture Talkz ×7, Bootcamp Breakthrough ×1, PFDI ×5 all live in the served response. Rollback target preserved at _audit_apr27/vm_ledger_snapshot.html.

Category 5 · VM newer (2 files)

EXECUTED
EXECUTED Apr 28 ~03:30 UTC. Two files pulled VM → PC, byte-identical PC↔VM after pull (verified by independent sha256 on both sides):
  1. iexdg_content_mcp_v3_2_apr22.py · sha ff367600… · 80,473 B · contains Apr 27 brand patches + ideogram auto-inject + the corrective-finding Perplexity research() tool. PC backup at TOOLS/mcp/iexdg_content_mcp_v3_2_apr22.py.pre_phase2_backup.
  2. Caddyfile · sha 663c6fe3… · 5,640 B · contains Apr 27 OAuth proxy routes (/auth/callback, /authorize, /register, RFC 8414 + RFC 9728 metadata, :8766 upstream). PC backup at vm_deploy/Caddyfile.pre_phase2_backup.
Both PC mirrors are now the canonical source-of-truth ahead of Phase 3 Git init.

Category 1 · PC-only (461) · VM-deployment-intent flagged (4)

PROPOSED

Heuristic scan of 26 top-level STRATEGY/*.html files for brain.iexdg.com, /srv/brain/public, and canonical-link markers. 4 files surfaced. The other 435 PC-only entries (TOOLS scripts, memory, archived dashboards, working artifacts, subdirectories of STRATEGY) are PC-by-design and need no Phase 2 action. Per-row recommendations below; the deploy-intent calls fall to your judgment.

ApproveSTRATEGY HTML (PC)Size · mtimeMarkersProposed action
STRATEGY/Apr27_Session_Changelog.html44.2 KB
2026-04-28 02:48 UTC		brain.iexdg.com x2
/srv/brain/public x1		Likely PC-only by design (internal session log). brain.iexdg.com mentions are reference, not deploy intent. Recommend: do not deploy.
STRATEGY/IEXDG_Brand_Rules_Apr27.html38.3 KB
2026-04-27 13:15 UTC		brain.iexdg.com x1Internal documentation of brand-rule enforcement matrix. brain.iexdg.com mention is contextual, not deploy intent. Recommend: do not deploy.
STRATEGY/IEXDG_Google_Cloud_Architecture_Apr27.html53.9 KB
2026-04-27 07:42 UTC		brain.iexdg.com x21
/srv/brain/public x1		Per Apr 27 changelog row: 'lives at brain.iexdg.com after deploy' (intended deploy target). 21 mentions of brain.iexdg.com confirm deploy intent. Recommend: deploy to /srv/brain/public/strategy/.
STRATEGY/IEXDG_MCP_Connection_Paths_Apr27.html52.6 KB
2026-04-27 06:49 UTC		brain.iexdg.com x5Per Apr 27 changelog row: visual aid built for DNicole's Mac connector confusion. 5 mentions of brain.iexdg.com. Recommend: deploy to /srv/brain/public/strategy/.

Category 2 · VM-only (21) · classified by changelog

PROPOSED

0 unexplained. Every VM-only file maps to one of four explained buckets. The Sprint 21+ deploys missed PC-mirror-creation step at the time, so 15 files exist on VM that should ideally have a PC mirror in vm_deploy/. That is the actual Phase 2 work , pull these 15 down so PC source-of-truth is complete before Phase 3 Git init.

Apr 27 work, expected 1 files

Already accounted for in changelog. No Phase 2 action.

ApproveVM pathSizeNote
/opt/iexdg-mcp/iexdg_content_mcp_v3_2_apr22.py.bak-apr2768.6 KBApr 27 backup of v3.2 pre-patch. Intentionally VM-only.

Sprint 21+ deploys without PC mirror , Phase 2 pulls these to vm_deploy/ 15 files

Pull each from VM to vm_deploy/ (or appropriate PC sub-path), establish PC source-of-truth. Verify byte-identical post-pull.

ApproveVM pathSizeNote
/opt/iexdg-mcp/rag/ingest_session.py3.3 KBRAG engine module. Per Sprint 21+ deploys.
/opt/iexdg-mcp/rag/iexdg_rag_hook.py3.8 KBRAG engine module. Per Sprint 21+ deploys.
/opt/iexdg-mcp/rag/dashboard.py7.3 KBRAG engine module. Per Sprint 21+ deploys.
/opt/iexdg-mcp/rag/iexdg_rag_engine.py17.9 KBRAG engine module. Per Sprint 21+ deploys.
/opt/iexdg-mcp/rag/search_kb.py4.2 KBRAG engine module. Per Sprint 21+ deploys.
/opt/iexdg-mcp/rag/ingest_all.py14.0 KBRAG engine module. Per Sprint 21+ deploys.
/srv/brain/public/library.html22.9 KBStatic dashboard HTML or asset. Per Sprint 21+ deploys.
/srv/brain/public/brain_system_explained.html17.1 KBStatic dashboard HTML or asset. Per Sprint 21+ deploys.
/srv/brain/public/system_map.html28.4 KBStatic dashboard HTML or asset. Per Sprint 21+ deploys.
/etc/systemd/system/iexdg-shadow-crawl.timer132 Bshadow-crawl.timer systemd unit. Per Sprint 21-23 deploys. PC mirror should exist in vm_deploy/.
/etc/systemd/system/iexdg-analytics-advisor.service275 Banalytics-advisor.service systemd unit. Per Sprint 21-23 deploys. PC mirror should exist in vm_deploy/.
/etc/systemd/system/iexdg-analytics-advisor.timer132 Banalytics-advisor.timer systemd unit. Per Sprint 21-23 deploys. PC mirror should exist in vm_deploy/.
/etc/systemd/system/iexdg-brain-evolution.timer130 Bbrain-evolution.timer systemd unit. Per Sprint 21-23 deploys. PC mirror should exist in vm_deploy/.
/etc/systemd/system/iexdg-brain-evolution.service271 Bbrain-evolution.service systemd unit. Per Sprint 21-23 deploys. PC mirror should exist in vm_deploy/.
/etc/systemd/system/iexdg-shadow-crawl.service265 Bshadow-crawl.service systemd unit. Per Sprint 21-23 deploys. PC mirror should exist in vm_deploy/.

VM-only backups, intentionally 3 files

Caddyfile backups from Apr 27 OAuth deploy. Keep on VM, do not migrate.

ApproveVM pathSizeNote
/etc/caddy/Caddyfile.bak-pre-consent-1153165.3 KBPre-OAuth Caddyfile backups. Apr 27 deploy artifacts. Intentionally VM-only.
/etc/caddy/Caddyfile.oauth.staged5.3 KBPre-OAuth Caddyfile backups. Apr 27 deploy artifacts. Intentionally VM-only.
/etc/caddy/Caddyfile.bak-pre-oauth-apr273.7 KBPre-OAuth Caddyfile backups. Apr 27 deploy artifacts. Intentionally VM-only.

Live VM state, do not migrate 2 files

Runtime data files. Do not commit to PC. Phase 3 Git init excludes these paths.

ApproveVM pathSizeNote
/opt/iexdg-mcp/ghl_posture.json9.0 KBGHL posture observer output. Live state.
/opt/iexdg-mcp/ghl_posture.db592.0 KBGHL posture observer output. Live state.

0 files in Unexplained , investigate.

Categories 3, 4, 7 · No Phase 2 work

CLOSED
CategoryStatusPhase 3 implication
3 · Identical (53 files)No reconciliation needed. Hashes match.Files stay where they are. Git init treats these as already-canonical.
4 · PC newer (0 files)Empty category. No work.n/a
7 · Generated · skip migration (387 entries)Working artifacts (logs, content drops, audit outputs, RAG db, etc.). Listed for completeness only.Add to .gitignore patterns at Phase 3 Git init. Sample patterns: TOOLS/automation_output/, _audit_apr27/, _brain_research_apr23_out*/, *.log, iexdg_knowledge.db*.

Category 8 · Secrets inventory (expanded post-correction)

PROPOSED
Scope correction. Phase 1 audit scope was TOOLS/automation_scripts/, TOOLS/automation_output/, TOOLS/mcp/, STRATEGY/, vm_deploy/, CLAUDE.md, memory/ , but did NOT include TOOLS/ root or TOOLS/brand_assets/. VM scope did NOT include /var/lib/iexdg-brain/. Four PC secrets at TOOLS/ root + the VM /var/lib/iexdg-brain/fastmcp/ dir were not surfaced. Phase 2 inventory below incorporates the remediated scan. Phase 3 audit scope should explicitly cover: TOOLS/* (full tree), /var/lib/iexdg-brain/ (with sudo).

Per your earlier decision, secrets handling is deferred to its own work item , this section is inventory only, not action proposals. Recommendations are for the eventual handling pass, not for tonight.

PC-side secrets (9 files)

PC pathSizeKindPhase 2/3 handling
STRATEGY/client_secret_918058969668-34gdqpptimgnq9jpvs5uorbbukthvqdk.apps.googleusercontent.com.json429 Bgcp oauth client secret (.json)MOVE Move to TOOLS/secrets/, add to .gitignore. Regenerate + revoke before Phase 3 Git init.
TOOLS/automation_scripts/client_secret_918058969668-aqjshutnlbhp43ksu1d6u592usrg2a7r.apps.googleusercontent.com.json414 Bgcp oauth client secret (.json)MOVE Move to TOOLS/secrets/, add to .gitignore. Different OAuth client (installed) than the STRATEGY one (web). Regenerate together.
TOOLS/automation_scripts/youtube_token.pickle1.2 KBpickle (oauth token, NOT READ)MOVE OAuth refresh token. Move to TOOLS/secrets/, .gitignore. Re-auth flow if rotated.
vm_deploy/iexdg-mcp.env1.8 KBenv file (NOT READ)MOVE Real env file with API keys. NEVER commit. Phase 3: migrate to GCP Secret Manager (Gate 7).
vm_deploy/iexdg-mcp.env.template1.5 KBunknownKEEP Template file (no real keys). Safe to commit. Reclassify out of secrets bucket.
TOOLS/brain_bearer_token.txt819 Bbearer token (txt, archived per Apr 24 deploy memory)MOVE Caddy bearer token archive. Move to TOOLS/secrets/, .gitignore.
TOOLS/gmail_token.pickle2.3 KBpickle (oauth token, NOT READ)MOVE OAuth refresh token. Move to TOOLS/secrets/, .gitignore. Re-auth flow if rotated.
TOOLS/iexdg_apps_script_token.pickle1.2 KBpickle (oauth token, NOT READ)MOVE OAuth refresh token. Move to TOOLS/secrets/, .gitignore. Re-auth flow if rotated.
TOOLS/youtube_client_secrets.json361 Bgcp oauth client secret (.json)MOVE Move to TOOLS/secrets/, add to .gitignore.

VM-side secrets (2 entries · including the OAuth state directory)

VM pathSizeKindPhase 2/3 handling
/etc/default/iexdg-mcp3.9 KBenv file (NOT READ)PATH-ONLY Real env file. Phase 3 Gate 7: migrate to GCP Secret Manager. Already partially scaffolded per Sprint 23 (3 of 3 secrets created in Secret Manager, VM scope flip pending).
/var/lib/iexdg-brain/fastmcp/
(directory tree, ~40 files)		~80 KB totalfastmcp OAuth proxy state (JSON files): registered DCR clients, refresh tokens, JTI mappings, transaction state, upstream tokensPATH-ONLY Persistent OAuth state. Phase 3: explicit handling spec for OAuth state migration (Git init must NOT include this directory; live VM data only). Backup strategy if VM rebuilt.
Three OAuth pickle tokens at PC TOOLS/ , most plausibly used by:
  • gmail_token.pickle · the email-sending scripts: _send_dnicole_audit_digest_apr27.py, _send_format_email_apr25.py, send_apr13_progress_email.py, plus daily_content_drop.py and content_drop_v2.py for the nightly drop email. Scopes per memory: readonly + send + modify.
  • iexdg_apps_script_token.pickle · the Apps Script Web App bridge that proxies the VIS Captures Google Sheet (vis_sheets_bridge.gs). Used by content drop pipeline to read captures + set status.
  • youtube_token.pickle at TOOLS/automation_scripts/ · YouTube API access for youtube_watcher.py, youtube_manager.py, batch_transcribe.py, the daily content drop pipeline.

Approval gate · what executes after your review

PROPOSED

Use the per-row checkboxes above to approve specific actions. Once approved subset is identified, the executable Phase 2 wraps as one mechanical pass:

ApproveActionEffect
Deploy approved Category 1 HTMLs to /srv/brain/public/strategy/Static HTMLs become reachable at brain.iexdg.com/strategy/. Caddy serves immediately. Sub-second per file.
Pull approved Category 2 CHANGELOG_PRIOR files to vm_deploy/ (and PC subdirectories as appropriate)Establishes complete PC source-of-truth for the 15 Sprint 21+ deploy artifacts. No VM changes. Verify byte-identical post-pull.
Defer secrets handling to Phase 3 prep work itemNo action tonight. Phase 3 Git init pre-work creates TOOLS/secrets/, builds .gitignore, plans Secret Manager migration.
Phase 2 close-out criteria. Phase 2 closes when: (a) approved Cat 1 deploys land + verify, (b) approved Cat 2 pulls land + verify, (c) .gitignore draft exists for Phase 3, (d) the three Apr 28 verification corrections are reflected in their source documents (changelog row updates already done for Perplexity; Decision #5 framing correction pending). After close-out, Phase 3 Git init is the next step.