Update model-chain.md: canonical Fallback Chain vs Operational Models (Jul 27 2026)

- DNS records: intelsight.io + intelsight.co zones on Cloudflare
- CloudPanel WordPress setup on app3 (152.53.241.111)
- Credentials, SSL issuance workflow, backup status
- Hudu password vault entry created (ID 129)
- Fixed root A record (was 152.153.241.111 → corrected to 152.53.241.111)
- Fixed intelsight.co redirect (added dummy A record for DNS resolution)
- my.intelsight.io DNS ready but site not yet created

docs/model-chain.md

@@ -1,18 +1,53 @@
-# AI Model Chain — IT Pro Partner
+# AI Model Architecture — IT Pro Partner
 
-**Updated:** July 24, 2026
+**Updated:** July 27, 2026
 
-## Active Fallback Chain
+Two separate concepts that must not be conflated:
+
+---
+
+## Fallback Chain *(auto-failover — config.yaml)*
+
+Survives admin-ai outage. Uses direct API keys for F1–F4.
 
 | Tier | Model | Provider | Notes |
 |---|---|---|---|
-| **Primary** | `claude-sonnet-5` | `admin-ai` | Conductor via LiteLLM ($3.33/day cap) |
+| **Primary** | `deepseek-v4-flash` | `admin-ai` | Fast, cheap conductor via LiteLLM |
-| **Fallback 1 (F1)** | `deepseek-v4-pro` | `deepseek` | Direct DeepSeek API |
+| **F1** | `deepseek-v4-flash` | `deepseek` (direct) | Same model, direct API |
-| **Fallback 2 (F2)** | `gpt-5.6-terra` | `admin-ai` | Demoted from Primary via LiteLLM ($3.33/day cap) |
+| **F2** | `gemini-3.6-flash` | `google` (direct) | Fast, free-tier eligible |
-| **Fallback 3 (F3)** | `grok-4.5` (`grok-2-1212`) | `xai` | Direct xAI API |
+| **F3** | `grok-4.6` | `xai` (direct) | Verified working (NOT grok-4.5) |
-| **Fallback 4 (F4)** | `gemini-3.6-flash` | `google` | Direct Google API |
+| **F4** | `claude-sonnet-5` | `anthropic` (direct) | Premium survival fallback |
+
+**Only fires when the model above it is unreachable.**
+
+---
+
+## Operational Models *(daily toolbox — admin-ai only)*
+
+No direct API keys. Shared $5/day budget via hermes-agent-v3 key.
+
+| Role | Model | When |
+|---|---|---|
+| Conductor | `deepseek-v4-flash` | Orchestrating, delegating, quick decisions |
+| Workhorse | `deepseek-v4-pro` | Large context, big outputs, infra code |
+| Workhorse | `deepseek-reasoner` | Multi-step analysis, debugging, planning |
+| Auditor | `gemini-3.6-flash` | Sanity checks, every output (essentially free) |
+| Auditor | `claude-sonnet-5` | Architecture, security, auth — sparingly ($15/M output) |
+
+---
 
 ## Admin-AI Virtual Key
-- **Key Hash**: `0237186aaff1ed90295c00d73103103900d4bd07252ec1806af8a4358e45d37a`
+
-- **Allowed Models**: `claude-sonnet-5`, `gpt-5.6-terra`, `deepseek-v4-pro`, `deepseek-v4-flash`, `glm-5.2`, `MiniMax-M3`, `qwen3.7-plus`
+- **Key Name:** `hermes-agent-v3` (generated Jul 27, 2026)
-- **Daily Budget Cap**: $3.33 / day
+- **Daily Budget Cap:** $5/day shared across all operational models
+- **Expiry:** Jul 27, 2027
+- **Master Key:** stored in Hudu
+
+## Budget Targets
+
+| Component | Daily est. |
+|---|---|
+| Conductor (ds-v4-flash) | ~$0.30 |
+| Workhorses (ds-v4-pro + reasoner) | ~$1.70 |
+| Auditors (gemini + claude sparingly) | ~$0.80 |
+| **Total** | **$3–5/day** |

sites/intelsight.io.md

@@ -0,0 +1,91 @@
+# IntelSight.io — Site Documentation
+
+## Overview
+
+| Detail | Value |
+|---|---|
+| Domain | intelsight.io |
+| Aliases | intelsight.co (redirect), www.intelsight.io |
+| Platform | WordPress (CloudPanel CE) |
+| Server | app3 (152.53.241.111) |
+| Panel | panel.itpropartner.com |
+| Created | July 26, 2026 |
+| SSL | Let's Encrypt via CloudPanel |
+
+## Cloudflare DNS Records (Zone: `4c2ade01f77efc5a3821dc64f5cf3277`)
+
+| Type | Name | Value | Proxy |
+|---|---|---|---|
+| A | intelsight.io | 152.53.241.111 | ✅ Orange |
+| A | my.intelsight.io | 152.53.241.111 | ✅ Orange |
+| CNAME | www.intelsight.io | intelsight.io | ✅ Orange |
+
+SSL/TLS mode: Full (strict)
+
+### intelsight.co (Zone: `f12f30677b754b39c51a8bd29527ca8f`)
+
+| Type | Name | Value | Proxy |
+|---|---|---|---|
+| A | intelsight.co | 192.0.2.1 | ✅ Orange |
+
+**Page Rule:** `intelsight.co/*` → `https://intelsight.io/$1` (301, active)
+
+No origin server needed — Cloudflare edge handles the redirect. The dummy A record is required for DNS resolution; traffic never reaches the origin IP.
+
+## CloudPanel Site Details
+
+- **Site User (SSH):** `intelsight` / `LoveMyBoys.1520!`
+- **Home directory:** `/home/intelsight`
+
+## Database
+
+| Detail | Value |
+|---|---|
+| Host | 127.0.0.1 |
+| Port | 3306 |
+| Database | intelsight |
+| User | intelsight |
+| Password | lUO7FjpYRxdJyK7BadiW |
+
+## WordPress Admin
+
+- **URL:** https://intelsight.io/wp-admin/
+- **User:** ippadmin
+- **Password:** LoveMyBoys1520!
+- **Admin Email:** admin@intelsight.io ⚠️ **Needs changing** to `info@itpropartner.com` (CloudPanel ignores the form field and auto-generates `admin@domain`)
+
+## Service Status
+
+| Service | Status | Notes |
+|---|---|---|
+| intelsight.io | ✅ Live | WordPress default install |
+| intelsight.co → intelsight.io | ✅ Redirecting | 301 via Cloudflare page rule |
+| my.intelsight.io | ⏳ DNS ready | **No site created yet** — returns 525 |
+| SSL | ✅ Issued | Let's Encrypt via CloudPanel |
+
+## SSL Issuance
+
+Let's Encrypt via `clpctl lets-encrypt:install:certificate`. Must temporarily unproxy DNS records for HTTP-01 validation, then reproxy:
+
+```bash
+# Unproxy
+curl -s -X PATCH "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$RECORD_ID" \
+  -H "Authorization: Bearer $CF_TOKEN" \
+  -d '{"proxied":false}'
+
+# Issue cert (on app3)
+ssh root@152.53.241.111 "clpctl lets-encrypt:install:certificate --domainName=intelsight.io"
+
+# Repoxy
+curl -s -X PATCH "..." -d '{"proxied":true}'
+```
+
+## Backup
+
+Covered by app3 daily backup at 3 AM ET → `s3://hermes-vps-backups/cloudpanel-backups/`
+
+## Next Steps
+
+1. Change WordPress admin email from `admin@intelsight.io` to `info@itpropartner.com`
+2. Create WordPress site at `my.intelsight.io` for the customer portal
+3. Install WordPress theme and configure branding