Update model-chain.md: canonical Fallback Chain vs Operational Models (Jul 27 2026)

- DNS records: intelsight.io + intelsight.co zones on Cloudflare
- CloudPanel WordPress setup on app3 (152.53.241.111)
- Credentials, SSL issuance workflow, backup status
- Hudu password vault entry created (ID 129)
- Fixed root A record (was 152.153.241.111 → corrected to 152.53.241.111)
- Fixed intelsight.co redirect (added dummy A record for DNS resolution)
- my.intelsight.io DNS ready but site not yet created

README.md

@@ -20,7 +20,7 @@
   - Ops Portal (FastAPI, port 8090)
   - Prometheus (native, port 9090) + Grafana (native, port 3002)
   - Uptime Kuma (Docker, port 3001) — 9+ monitors
-  - Vaultwarden (Docker, port 8080) — vault.iamgmb.com
+  - Vaultwarden (migrated to app1, port 8081) — vault.iamgmb.com
   - Twenty CRM (Docker) — crm.debtrecoveryexperts.com
   - DocuSeal (Docker, port 3000) — sign.core.itpropartner.com
   - SearXNG (Docker, port 8888)
@@ -93,17 +93,17 @@
 
 ## Model Fallback Chain
 
-All providers use direct API keys. GPT-5.5 quality survives through admin-ai → OpenRouter, then degrades through DeepSeek → Gemini → Grok.
+Direct API keys for all providers. Claude Sonnet 5 for primary quality, then direct fallbacks through DeepSeek → GPT → Grok → Gemini.
 
 | # | Model | Provider | Gateway |
 |---|---|---|---|
-| Primary | GPT-5.5 | admin-ai | Self-hosted LiteLLM (app1) |
-| Fallback 1 | GPT-5.5 | OpenRouter | openrouter.ai |
-| Fallback 2 | DeepSeek v4 Pro | DeepSeek | api.deepseek.com |
-| Fallback 3 | Gemini 3.5 Flash | Google | generativelanguage.googleapis.com |
-| Fallback 4 | Grok 4.5 | xAI | api.x.ai |
+| Primary | Claude Sonnet 5 | admin-ai | Self-hosted LiteLLM (app1) |
+| Fallback 1 | DeepSeek v4 Pro | DeepSeek (direct) | api.deepseek.com |
+| Fallback 2 | GPT-5.6 Terra | admin-ai | Self-hosted LiteLLM (app1) |
+| Fallback 3 | Grok 2 1212 | xAI (direct) | api.x.ai |
+| Fallback 4 | Gemini 3.6 Flash | Google (direct) | generativelanguage.googleapis.com |
 
-**Credits (Jul 17):** DeepSeek $58, OpenRouter ~$30 remaining, OpenAI/xAI/Google on pay-as-you-go
+**Credits (Jul 24):** DeepSeek $~58 remaining, OpenAI/xAI/Google on pay-as-you-go
 **Health check:** Daily 8 AM cron (`model-usage-check`)
 
 ---
@@ -139,7 +139,7 @@ All providers use direct API keys. GPT-5.5 quality survives through admin-ai →
 | my.voipsimplicity.com | Cloudflare | app3 | VoIP customer portal |
 | portal.debtrecoveryexperts.com | 152.53.192.33 | Core | DRE portal |
 | crm.debtrecoveryexperts.com | Cloudflare Access | — | DRE CRM |
-| vault.iamgmb.com | 152.53.192.33 | Core | Vaultwarden |
+| vault.iamgmb.com | 152.53.36.131 | app1 | Vaultwarden |
 | sign.iamgmb.com | 152.53.192.33 | Core | Document signing |
 | shark.iamgmb.com | 152.53.192.33 | Core | Shark game |
 
@@ -158,7 +158,7 @@ All providers use direct API keys. GPT-5.5 quality survives through admin-ai →
 |---|---|---|---|
 | hermes-live-sync | Every 15 min | s3://hermes-vps-backups/live/ | Live state sync |
 | hermes-full-backup | Daily 1 AM | s3://hermes-vps-backups/hermes-full-backup/ | Full Hermes backup |
-| home-router-backup | Daily 6 AM | s3://mikrotik-ccr-backups/ | CCR config |
+| run-wisp-backup | Daily 6 AM | s3://mikrotik-ccr-backups/ | CCR config (via wisp-backup.py) |
 | root-essentials-backup | Daily 3 AM | S3 | /root essentials |
 | docker-volume-sync | Daily 3 AM | S3 | Docker volumes |
 | system-config-sync | Daily 4 AM | S3 | System configs |
@@ -220,7 +220,7 @@ unifi.itpropartner.com          → :8443 (UniFi)
 | Ops Portal | https://ops.itpropartner.com | Core | Internal dashboard |
 | Grafana | http://core.itpropartner.com:3002 | Core | admin/admin |
 | Uptime Kuma | https://uptimekuma.itpropartner.com | Core | Service monitoring |
-| Vaultwarden | https://vault.iamgmb.com | Core | Password vault |
+| Vaultwarden | https://vault.iamgmb.com | app1 | Password vault |
 | CloudPanel | https://panel.itpropartner.com | app3 | user: gmb / SQLite auth |
 | Traccar | https://gps.fleettracker360.com | app2 | GPS fleet tracking |
 | UniFi | https://unifi.itpropartner.com | app2 | Network controller |

backup-plan.md

@@ -23,7 +23,7 @@
 | 1:00 AM + 1:00 PM | app3 | /opt/backup-restore/snapshot.sh | Per-site WordPress snapshots (files + DB), 60-day retention |
 | 3:00 AM | Core | docker-volume-sync.sh | Docker volumes |
 | 4:00 AM | Core | system-config-sync.sh | System configs |
-| 6:00 AM | Core | home-router-backup.sh | MikroTik CCR config |
+| 6:00 AM | Core | run-wisp-backup.sh | MikroTik CCR config (via wisp-backup.py) |
 | Every 10 min | core-bu | warm-standby-sync | Pull from S3 live/ → standby readiness |
 
 ---

docs/key-inventory.md

@@ -39,7 +39,7 @@ homelab.pub:       ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHT+727Cti4cZ2x6CiYDeDKZ9
 | **app1** | 152.53.36.131 | netcup RS 4000 | Via root or ippadmin+sudo | Root password in Vaultwarden |
 | **app2** | 152.53.39.202 | netcup RS 4000 | Via root or ippadmin+sudo | Root password in Vaultwarden |
 | **app3** | 152.53.241.111 | netcup RS 4000 | Via root or ippadmin+sudo | Root password in Vaultwarden |
-| **app1-bu** | 5.161.114.8 | Hetzner CPX11 | itpp-infra SSH key | Warm standby, offline by default |
+| **app1-bu** | 5.161.225.131 | Hetzner CPX21 | itpp-infra SSH key | Warm standby (core-bu) |
 
 ### Admin Account (all servers)
 

docs/model-chain.md

@@ -1,18 +1,53 @@
-# AI Model Chain — IT Pro Partner
+# AI Model Architecture — IT Pro Partner
 
-**Updated:** July 24, 2026
+**Updated:** July 27, 2026
 
-## Active Fallback Chain
+Two separate concepts that must not be conflated:
+
+---
+
+## Fallback Chain *(auto-failover — config.yaml)*
+
+Survives admin-ai outage. Uses direct API keys for F1–F4.
 
 | Tier | Model | Provider | Notes |
 |---|---|---|---|
-| **Primary** | `claude-sonnet-5` | `admin-ai` | Conductor via LiteLLM ($3.33/day cap) |
-| **Fallback 1 (F1)** | `deepseek-v4-pro` | `deepseek` | Direct DeepSeek API |
-| **Fallback 2 (F2)** | `gpt-5.6-terra` | `admin-ai` | Demoted from Primary via LiteLLM ($3.33/day cap) |
-| **Fallback 3 (F3)** | `grok-4.5` (`grok-2-1212`) | `xai` | Direct xAI API |
-| **Fallback 4 (F4)** | `gemini-3.6-flash` | `google` | Direct Google API |
+| **Primary** | `deepseek-v4-flash` | `admin-ai` | Fast, cheap conductor via LiteLLM |
+| **F1** | `deepseek-v4-flash` | `deepseek` (direct) | Same model, direct API |
+| **F2** | `gemini-3.6-flash` | `google` (direct) | Fast, free-tier eligible |
+| **F3** | `grok-4.6` | `xai` (direct) | Verified working (NOT grok-4.5) |
+| **F4** | `claude-sonnet-5` | `anthropic` (direct) | Premium survival fallback |
+
+**Only fires when the model above it is unreachable.**
+
+---
+
+## Operational Models *(daily toolbox — admin-ai only)*
+
+No direct API keys. Shared $5/day budget via hermes-agent-v3 key.
+
+| Role | Model | When |
+|---|---|---|
+| Conductor | `deepseek-v4-flash` | Orchestrating, delegating, quick decisions |
+| Workhorse | `deepseek-v4-pro` | Large context, big outputs, infra code |
+| Workhorse | `deepseek-reasoner` | Multi-step analysis, debugging, planning |
+| Auditor | `gemini-3.6-flash` | Sanity checks, every output (essentially free) |
+| Auditor | `claude-sonnet-5` | Architecture, security, auth — sparingly ($15/M output) |
+
+---
 
 ## Admin-AI Virtual Key
-- **Key Hash**: `0237186aaff1ed90295c00d73103103900d4bd07252ec1806af8a4358e45d37a`
-- **Allowed Models**: `claude-sonnet-5`, `gpt-5.6-terra`, `deepseek-v4-pro`, `deepseek-v4-flash`, `glm-5.2`, `MiniMax-M3`, `qwen3.7-plus`
-- **Daily Budget Cap**: $3.33 / day
+
+- **Key Name:** `hermes-agent-v3` (generated Jul 27, 2026)
+- **Daily Budget Cap:** $5/day shared across all operational models
+- **Expiry:** Jul 27, 2027
+- **Master Key:** stored in Hudu
+
+## Budget Targets
+
+| Component | Daily est. |
+|---|---|
+| Conductor (ds-v4-flash) | ~$0.30 |
+| Workhorses (ds-v4-pro + reasoner) | ~$1.70 |
+| Auditors (gemini + claude sparingly) | ~$0.80 |
+| **Total** | **$3–5/day** |

sites/intelsight.io.md

@@ -0,0 +1,91 @@
+# IntelSight.io — Site Documentation
+
+## Overview
+
+| Detail | Value |
+|---|---|
+| Domain | intelsight.io |
+| Aliases | intelsight.co (redirect), www.intelsight.io |
+| Platform | WordPress (CloudPanel CE) |
+| Server | app3 (152.53.241.111) |
+| Panel | panel.itpropartner.com |
+| Created | July 26, 2026 |
+| SSL | Let's Encrypt via CloudPanel |
+
+## Cloudflare DNS Records (Zone: `4c2ade01f77efc5a3821dc64f5cf3277`)
+
+| Type | Name | Value | Proxy |
+|---|---|---|---|
+| A | intelsight.io | 152.53.241.111 | ✅ Orange |
+| A | my.intelsight.io | 152.53.241.111 | ✅ Orange |
+| CNAME | www.intelsight.io | intelsight.io | ✅ Orange |
+
+SSL/TLS mode: Full (strict)
+
+### intelsight.co (Zone: `f12f30677b754b39c51a8bd29527ca8f`)
+
+| Type | Name | Value | Proxy |
+|---|---|---|---|
+| A | intelsight.co | 192.0.2.1 | ✅ Orange |
+
+**Page Rule:** `intelsight.co/*` → `https://intelsight.io/$1` (301, active)
+
+No origin server needed — Cloudflare edge handles the redirect. The dummy A record is required for DNS resolution; traffic never reaches the origin IP.
+
+## CloudPanel Site Details
+
+- **Site User (SSH):** `intelsight` / `LoveMyBoys.1520!`
+- **Home directory:** `/home/intelsight`
+
+## Database
+
+| Detail | Value |
+|---|---|
+| Host | 127.0.0.1 |
+| Port | 3306 |
+| Database | intelsight |
+| User | intelsight |
+| Password | lUO7FjpYRxdJyK7BadiW |
+
+## WordPress Admin
+
+- **URL:** https://intelsight.io/wp-admin/
+- **User:** ippadmin
+- **Password:** LoveMyBoys1520!
+- **Admin Email:** admin@intelsight.io ⚠️ **Needs changing** to `info@itpropartner.com` (CloudPanel ignores the form field and auto-generates `admin@domain`)
+
+## Service Status
+
+| Service | Status | Notes |
+|---|---|---|
+| intelsight.io | ✅ Live | WordPress default install |
+| intelsight.co → intelsight.io | ✅ Redirecting | 301 via Cloudflare page rule |
+| my.intelsight.io | ⏳ DNS ready | **No site created yet** — returns 525 |
+| SSL | ✅ Issued | Let's Encrypt via CloudPanel |
+
+## SSL Issuance
+
+Let's Encrypt via `clpctl lets-encrypt:install:certificate`. Must temporarily unproxy DNS records for HTTP-01 validation, then reproxy:
+
+```bash
+# Unproxy
+curl -s -X PATCH "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$RECORD_ID" \
+  -H "Authorization: Bearer $CF_TOKEN" \
+  -d '{"proxied":false}'
+
+# Issue cert (on app3)
+ssh root@152.53.241.111 "clpctl lets-encrypt:install:certificate --domainName=intelsight.io"
+
+# Repoxy
+curl -s -X PATCH "..." -d '{"proxied":true}'
+```
+
+## Backup
+
+Covered by app3 daily backup at 3 AM ET → `s3://hermes-vps-backups/cloudpanel-backups/`
+
+## Next Steps
+
+1. Change WordPress admin email from `admin@intelsight.io` to `info@itpropartner.com`
+2. Create WordPress site at `my.intelsight.io` for the customer portal
+3. Install WordPress theme and configure branding

sites/intelsight.md

@@ -0,0 +1,87 @@
+# IntelSight — New WordPress Site on CloudPanel
+
+**Status:** Live  
+**Date created:** July 26, 2026  
+**Server:** app3 (152.53.241.111, netcup RS 4000)  
+**Panel:** https://panel.itpropartner.com  
+**Site URL:** https://intelsight.io  
+**Purpose:** Marketing site for IntelSight competitive intelligence SaaS product
+
+---
+
+## Domain
+
+| Detail | Value |
+|---|---|
+| Domain | `intelsight.io` |
+| Registrar | Cloudflare Registrar |
+| Purchased | July 26, 2026 |
+| Cost | $50/year (.io) + $15/year (.co) |
+| Defensive domains | `intelsight.co` (redirect only) |
+
+---
+
+## DNS (Cloudflare)
+
+| Type | Name | Value | Proxy |
+|---|---|---|---|
+| A | `intelsight.io` | `152.53.241.111` | Proxied (orange) |
+| CNAME | `www` | `intelsight.io` | Proxied (orange) |
+
+SSL/TLS mode: **Flexible** — Cloudflare provides edge cert; origin uses CloudPanel self-signed cert.
+
+---
+
+## CloudPanel Site
+
+| Detail | Value |
+|---|---|
+| Domain | `intelsight.io` |
+| Site User (SSH) | `intelsight` |
+| Site User Password | `LoveMyBoys.1520!` |
+| PHP Version | 8.x (CloudPanel default) |
+| Vhost | `/etc/nginx/sites-enabled/intelsight.io.conf` |
+| Docroot | `/home/intelsight/htdocs/intelsight.io` |
+
+---
+
+## WordPress
+
+| Detail | Value |
+|---|---|
+| Admin URL | https://intelsight.io/wp-admin/ |
+| Admin Username | `ippadmin` |
+| Admin Password | `LoveMyBoys1520!` |
+| Admin Email | `admin@intelsight.io` → **CHANGE to `info@itpropartner.com`** |
+| DB Name | `intelsight` |
+| DB User | `intelsight` |
+| DB Password | `lUO7FjpYRxdJyK7BadiW` |
+| DB Host | `127.0.0.1:3306` |
+
+---
+
+## Quirks & Pitfalls
+
+1. **CloudPanel overrides Admin Email.** The form field "Admin E-Mail" is ignored — CloudPanel auto-generates `admin@<domain>`. Fix in WordPress → Settings → General after first login.
+
+2. **Let's Encrypt + Cloudflare proxy conflict.** CloudPanel's Nginx template redirects all HTTP to HTTPS before `.well-known` validation, so LE HTTP-01 challenges fail through Cloudflare proxy. Workaround: use Cloudflare "Flexible" SSL mode. Edge cert is Cloudflare's; origin cert is CloudPanel self-signed.
+
+3. **CloudPanel CLI has no `site:list`.** Use `app:list` or check `/etc/nginx/sites-enabled/` directly.
+
+---
+
+## Post-Creation Checklist
+
+- [ ] Change Admin Email to `info@itpropartner.com`
+- [ ] Install SSL certs if switching from Flexible to Full (strict) later
+- [ ] Run `clpctl lets-encrypt:install:certificate --domainName=intelsight.io` if graying out Cloudflare proxy
+- [ ] Add to backup schedule (app3 backups at 3 AM ET)
+- [ ] Add to Hudu — API asset / website documentation
+
+---
+
+## Related Docs
+
+- `servers.md` — app3 server details
+- `backup-plan.md` — backup schedule
+- Hudu → IT Pro Partner → Websites / IntelSight