Wire API health JSON into Ops Portal (servers page)

- Remove stale core-services (Vaultwarden, Twenty, SearXNG, Komodo)
- Add new App1 services (Komodo, DocuSeal, Twenty CRM backups)
- Update S3 path table with canonical locations
- Add migration history section (Jul 28)
- Note stale core/ subfolder paths in S3 for reference
- Coverage: 26 backup targets across 6 servers + router

README.md

@@ -20,7 +20,7 @@
   - Ops Portal (FastAPI, port 8090)
   - Prometheus (native, port 9090) + Grafana (native, port 3002)
   - Uptime Kuma (Docker, port 3001) — 9+ monitors
-  - Vaultwarden (Docker, port 8080) — vault.iamgmb.com
+  - Vaultwarden (migrated to app1, port 8081) — vault.iamgmb.com
   - Twenty CRM (Docker) — crm.debtrecoveryexperts.com
   - DocuSeal (Docker, port 3000) — sign.core.itpropartner.com
   - SearXNG (Docker, port 8888)
@@ -93,17 +93,17 @@
 
 ## Model Fallback Chain
 
-All providers use direct API keys. GPT-5.5 quality survives through admin-ai → OpenRouter, then degrades through DeepSeek → Gemini → Grok.
+Direct API keys for all providers. Claude Sonnet 5 for primary quality, then direct fallbacks through DeepSeek → GPT → Grok → Gemini.
 
 | # | Model | Provider | Gateway |
 |---|---|---|---|
-| Primary | GPT-5.5 | admin-ai | Self-hosted LiteLLM (app1) |
+| Primary | Claude Sonnet 5 | admin-ai | Self-hosted LiteLLM (app1) |
-| Fallback 1 | GPT-5.5 | OpenRouter | openrouter.ai |
+| Fallback 1 | DeepSeek v4 Pro | DeepSeek (direct) | api.deepseek.com |
-| Fallback 2 | DeepSeek v4 Pro | DeepSeek | api.deepseek.com |
+| Fallback 2 | GPT-5.6 Terra | admin-ai | Self-hosted LiteLLM (app1) |
-| Fallback 3 | Gemini 3.5 Flash | Google | generativelanguage.googleapis.com |
+| Fallback 3 | Grok 2 1212 | xAI (direct) | api.x.ai |
-| Fallback 4 | Grok 4.5 | xAI | api.x.ai |
+| Fallback 4 | Gemini 3.6 Flash | Google (direct) | generativelanguage.googleapis.com |
 
-**Credits (Jul 17):** DeepSeek $58, OpenRouter ~$30 remaining, OpenAI/xAI/Google on pay-as-you-go
+**Credits (Jul 24):** DeepSeek $~58 remaining, OpenAI/xAI/Google on pay-as-you-go
 **Health check:** Daily 8 AM cron (`model-usage-check`)
 
 ---
@@ -139,7 +139,7 @@ All providers use direct API keys. GPT-5.5 quality survives through admin-ai →
 | my.voipsimplicity.com | Cloudflare | app3 | VoIP customer portal |
 | portal.debtrecoveryexperts.com | 152.53.192.33 | Core | DRE portal |
 | crm.debtrecoveryexperts.com | Cloudflare Access | — | DRE CRM |
-| vault.iamgmb.com | 152.53.192.33 | Core | Vaultwarden |
+| vault.iamgmb.com | 152.53.36.131 | app1 | Vaultwarden |
 | sign.iamgmb.com | 152.53.192.33 | Core | Document signing |
 | shark.iamgmb.com | 152.53.192.33 | Core | Shark game |
 
@@ -158,7 +158,7 @@ All providers use direct API keys. GPT-5.5 quality survives through admin-ai →
 |---|---|---|---|
 | hermes-live-sync | Every 15 min | s3://hermes-vps-backups/live/ | Live state sync |
 | hermes-full-backup | Daily 1 AM | s3://hermes-vps-backups/hermes-full-backup/ | Full Hermes backup |
-| home-router-backup | Daily 6 AM | s3://mikrotik-ccr-backups/ | CCR config |
+| run-wisp-backup | Daily 6 AM | s3://mikrotik-ccr-backups/ | CCR config (via wisp-backup.py) |
 | root-essentials-backup | Daily 3 AM | S3 | /root essentials |
 | docker-volume-sync | Daily 3 AM | S3 | Docker volumes |
 | system-config-sync | Daily 4 AM | S3 | System configs |
@@ -220,7 +220,7 @@ unifi.itpropartner.com          → :8443 (UniFi)
 | Ops Portal | https://ops.itpropartner.com | Core | Internal dashboard |
 | Grafana | http://core.itpropartner.com:3002 | Core | admin/admin |
 | Uptime Kuma | https://uptimekuma.itpropartner.com | Core | Service monitoring |
-| Vaultwarden | https://vault.iamgmb.com | Core | Password vault |
+| Vaultwarden | https://vault.iamgmb.com | app1 | Password vault |
 | CloudPanel | https://panel.itpropartner.com | app3 | user: gmb / SQLite auth |
 | Traccar | https://gps.fleettracker360.com | app2 | GPS fleet tracking |
 | UniFi | https://unifi.itpropartner.com | app2 | Network controller |

api-master-list.md

@@ -0,0 +1,124 @@
+# API Master List - IT Pro Partner
+
+**Owner:** Sho'Nuff (Hermes) | **Last updated:** 2026-07-31
+**Purpose:** Single inventory of every API used across ITPP projects. Categories: Internal (self-hosted/our own), External (free or no key), Paid External (subscription/usage-based). No keys stored here - credentials live in `/root/.hermes/.env`, `.aws/credentials`, or Vaultwarden.
+
+---
+
+## 1. Internal APIs (self-hosted, our own services)
+
+| API | Vendor/Source | Host:Port | Used In |
+|---|---|---|---|
+| Super Search MCP | ITPP (in-house) | Core :8899 | Hermes MCP, DRE skip tracing, research tasks |
+| DRE MCP | ITPP (in-house) | Core :8900 | Debt Recovery Experts letters, approval workflow |
+| Twilio MCP | ITPP wrapper on Twilio | Core :8901 | Hermes voice calls, call logs |
+| OSINT Person MCP | ITPP (in-house) | Core :8902 | DRE skip tracing, background research |
+| FT360 MCP | ITPP (FleetTracker360) | Core :8903 | Traccar GPS positions, travel stats |
+| PRY | ITPP (in-house) | Core :8905 | Internal agent service |
+| Ops Portal | ITPP (in-house) | Core :8090 | Ops dashboard, backup-restore UI, service health |
+| IntelSight API | ITPP (intelsight.io) | Core :8099 | IntelSight product backend |
+| Diglocate API | ITPP (in-house) | Core :8000 | Diglocate product backend |
+| Rally backend | ITPP (in-house) | Core :8105 | rally.iamgmb.com family calendar |
+| Village Express | ITPP (in-house) | Core :8210 | Village Express parent portal |
+| Voice Agent (STT) | ITPP (Deepgram-based) | Core :9000 | Voice agent stack |
+| Voice Agent (agent) | ITPP | Core :9101 | Voice agent stack |
+| Shopping Cart | ITPP (in-house) | Core :8101 | Email-order shopping cart builder |
+| OSINT API | ITPP (in-house) | Core :8100 | OSINT research tool |
+| hermes-assistant | ITPP (in-house) | Core :8082 | Internal assistant service |
+| Shark Game | ITPP (in-house) | Core :8083 | Shark Attack Fantasy League |
+| SearXNG | SearXNG (self-hosted) | Core :8888 | Super Search primary provider, all web searches |
+| Camofox Browser | Camofox (self-hosted) | Core :9377 | Browser automation backend |
+| Twenty CRM | Twenty (self-hosted) | Core :3003 | CRM |
+| Uptime Kuma | Uptime Kuma (self-hosted) | Core :3001 | Service monitoring, status pages |
+| Grafana | Grafana (self-hosted) | Core :3000 | Dashboards |
+| Prometheus | Prometheus (self-hosted) | Core | Metrics collection |
+| Telegraf | Telegraf (self-hosted) | Core | Metrics agent |
+| MikroTik Exporter | swoga (self-hosted) | Core :9436 | MikroTik router metrics |
+| SNMP HTTP Server | ITPP script | Core :9274 | SNMP device data |
+| LiteLLM | LiteLLM (self-hosted) | app1 :4000 | AI model gateway (admin-ai.itpropartner.com) |
+| Open WebUI | Open WebUI (self-hosted) | app1 | Chat UI |
+| Wazuh | Wazuh (self-hosted) | app1 :5601/:9200 | SIEM/XDR, security monitoring |
+| Vaultwarden | Vaultwarden (self-hosted) | app1 :8081 | Password vault |
+| Komodo | Komodo (self-hosted) | app1 :9120 | Server/container management |
+| DocuSeal | DocuSeal (self-hosted) | app1 :3000 | E-signature, contracts |
+| Kokoro TTS | Kokoro (self-hosted) | app1 :8880 | Text-to-speech |
+| Hudu | Hudu (self-hosted) | app2 :3000 | IT documentation, assets, credentials |
+| Traccar | Traccar (self-hosted) | app2 :8082 | GPS tracking (FleetTracker360) |
+| Gitea | Gitea (self-hosted) | app2 :3001 | git.itpropartner.com repos |
+| UNMS / UISP | Ubiquiti (self-hosted) | app2 :8444 | WISP network management |
+| UniFi Controller | Ubiquiti (self-hosted) | app2 :8443 | UniFi network management |
+| Dawarich | Dawarich (self-hosted) | app2 :3002 | Location history |
+| Technitium DNS | Technitium (self-hosted) | app2 :5380 | DNS server |
+| CloudPanel | CloudPanel (self-hosted) | app3 | WordPress hosting panel |
+| Backup-Restore App | ITPP (in-house) | app3 :8090 | my.itpropartner.com/bacrestore |
+| Splynx API | Splynx (self-hosted) | portal.forefrontwireless.com/admin/api | Forefront Wireless ISP billing, WISP ops |
+| Mealie | Mealie (self-hosted) | 10.1.1.14:9925 (recipe.iamgmb.com) | Recipe manager |
+| Hermes MCP servers (aggregate) | ITPP | Core | Super Search, DRE, Twilio, OSINT, FT360 |
+
+## 2. External APIs (free / no key)
+
+| API | Vendor | Used In |
+|---|---|---|
+| NWS API (api.weather.gov) | NOAA | Weather forecasts, alerts (Red Oak check, product weather blocks) |
+| Open-Meteo | Open-Meteo | Quick forecasts for products, weather data |
+| DuckDuckGo Instant Answers | DuckDuckGo | Super Search fallback, lookups |
+| Wikipedia | Wikimedia | Super Search lookups, research |
+| OpenStreetMap / OSRM | OSM | Maps, geocoding, routes |
+| CourtListener | Free Law Project | OSINT court records search |
+| OpenCorporates | OpenCorporates | OSINT business records |
+| Telegram Bot API | Telegram | Hermes gateway, bot messaging |
+| Tailscale API | Tailscale | Tailnet management, device auth |
+| iCloud CalDAV | Apple | Calendar sync (Anita's calendar) |
+| IMAP/SMTP | MXroute | All email (shonuff@germainebrown.com, g@) |
+| VirusTotal | VirusTotal (free tier) | File/URL scanning |
+
+## 3. Paid External APIs
+
+| API | Vendor | Used In |
+|---|---|---|
+| Claude | Anthropic | AI model (critical client tasks, code review) |
+| GPT | OpenAI | AI model (fallback, tools) |
+| DeepSeek | DeepSeek | Primary AI model (conductor/workhorse) |
+| Gemini | Google (AI Studio) | AI model fallback |
+| Grok / xAI | xAI | AI model fallback, X search |
+| OpenRouter | OpenRouter | AI model routing (fallback) |
+| Groq | Groq | AI model (fast inference) |
+| Mistral | Mistral AI | AI model |
+| Cohere | Cohere | AI model |
+| Perplexity | Perplexity | AI model, research |
+| Fireworks | Fireworks AI | AI model |
+| NVIDIA | NVIDIA | AI model |
+| Qwen / Alibaba | Alibaba Cloud | AI model |
+| AI21 | AI21 Labs | AI model |
+| ZAI | Z.ai | AI model |
+| MiniMax | MiniMax | AI model, TTS |
+| FLUX / FAL | FAL.ai | Image generation (FLUX 2 Klein) |
+| Deepgram | Deepgram | Voice agent STT |
+| ElevenLabs | ElevenLabs | Sho'Nuff voice, outbound calls |
+| Twilio | Twilio | Voice calls, SMS (SMS pending), 10DLC |
+| RingLogix | RingLogix | CPaaS phone system (VoIP Simplicity) |
+| SyncroMSP | SyncroMSP | RMM/PSA, client asset management |
+| Bitdefender GravityZone | Bitdefender | Endpoint security, client AV |
+| Cloudflare | Cloudflare | DNS zones, domains, records |
+| Hetzner Cloud | Hetzner | app1-bu standby server, wphost02 |
+| netcup | netcup | Core/app1/app2/app3 servers |
+| Wasabi S3 | Wasabi | All backups (hermes-vps-backups bucket, app backups) |
+| Firecrawl | Firecrawl | Web extraction (Super Search fallback) |
+| Exa | Exa | Super Search premium backend, OSINT research (20k free/mo, paid beyond) |
+| UISP API | Ubiquiti | WISP device data (backup-uisp.sh) |
+
+---
+
+## Quick counts
+- Internal: ~40 endpoints
+- External free: 15
+- Paid external: ~32
+
+## Health monitoring
+- Script: `/root/.hermes/scripts/api-health-check.py` (probes all 41 internal endpoints)
+- Watchdog: cron job `35f99c362658` runs every 30 min, alerts Telegram only when something is down
+- JSON state: `/var/log/api-health/api-health.json`
+- Ops Portal: `GET /api/api-health` (auth required) serves the JSON snapshot; Servers page shows "API Health" card with per-endpoint up/down + latency, auto-refreshes every 60s with the page
+- Coverage: 41 endpoints across Core, app1, app2, app3 (verified 41/41 up on 2026
+  7: 31)
+- Note: localhost-bound services on remote hosts are probed via SSH (`ssh root@host curl 127.0.0.1:PORT`); Grafana is on :3002 not :3000; Wazuh dashboard is HTTPS-only.

backup-plan.md

@@ -1,159 +1,215 @@
-# Backup Plan — All Servers
+# ITPP Backup Plan
 
-**Last Updated:** July 16, 2026
+> **Last updated:** 2026-07-28
-**S3 Provider:** Wasabi (s3.us-east-1.wasabisys.com)
+> **Scope:** All ITPP infrastructure backups — Hermes core, application servers, routers, and external services.
-**Buckets:** hermes-vps-backups, itpropartner-backups, mikrotik-ccr-backups
+> **Storage:** Wasabi S3 (us-east-1) via `--endpoint-url https://s3.us-east-1.wasabisys.com`
-**Versioning:** ON (all buckets)
+> **Cron backend:** Hybrid — system crontab + Hermes cron jobs
 
 ---
 
-## Schedule (ET timezone)
+## Backup Inventory (26 targets)
 
-| Time | Server | Script | What |
+### Core (152.53.192.33) — RS 2000
-|---|---|---|---|
+
-| Every 15 min | Core | hermes-live-sync | Hermes session state → S3 live/ |
+| Service | Method | Destination | Schedule | Last Verified |
-| 1:00 AM | Core | hermes-backup.sh | Full Hermes backup |
+|---------|--------|-------------|----------|---------------|
-| 1:30 AM | Core | core-services-backup.sh | Vaultwarden, Twenty CRM, SearXNG, Komodo, Prometheus, Grafana, Uptime Kuma |
+| Hermes Agent (full) | `hermes-backup.sh` — tar.gz of config, skills, profiles, sessions | `s3://hermes-vps-backups/hermes-full-backup/` | 1:00 AM | 2026-07-28 |
-| 2:00 AM | Core | backup-audit-check.sh | Verify all backups |
+| Hermes Live Sync | `hermes-live-sync` cron — session state + profiles DB | `s3://hermes-vps-backups/live/` | Every 15 min | 2026-07-28 20:42 |
-| 2:00 AM | app1 | /root/.hermes/scripts/app1-backup.sh | LiteLLM, Open WebUI, n8n, MCP configs, Mattermost |
+| /root Essentials | `root-essentials-backup.sh` — dotfiles, keys, scripts | `s3://hermes-vps-backups/root-backup/` | 3:00 AM | 2026-07-28 |
-| 2:30 AM | app2 | /root/.hermes/scripts/app2-backup.sh | Traccar, Gitea, Hudu, UNMS, UniFi |
+| Grafana | `core-services-backup.sh` — SQLite DB dump | `s3://hermes-vps-backups/core/grafana/` | 1:30 AM | 2026-07-28 |
-| 3:00 AM | Core | root-essentials-backup.sh | /root essentials |
+| Uptime Kuma | `core-services-backup.sh` — SQLite DB dump | `s3://hermes-vps-backups/core/uptime-kuma/` | 1:30 AM | 2026-07-28 |
-| 3:00 AM | app3 | /root/.hermes/scripts/app3-backup.sh | CloudPanel, MySQL, WordPress, Nginx configs |
+| Docker Volumes | `core-services-backup.sh` — tar of key compose volumes | `s3://hermes-vps-backups/volumes/` | 1:30 AM | 2026-07-28 |
-| 5:00 AM | Core | wphost02-backup (cron) | wphost02 webapps + databases → S3 |
+| Prometheus | `core-services-backup.sh` — TSDB snapshot | `s3://hermes-vps-backups/core/prometheus/` | 1:30 AM | 2026-07-28 |
-| 1:00 AM + 1:00 PM | app3 | /opt/backup-restore/snapshot.sh | Per-site WordPress snapshots (files + DB), 60-day retention |
+
-| 3:00 AM | Core | docker-volume-sync.sh | Docker volumes |
+### App1 (152.53.36.131) — RS 4000
-| 4:00 AM | Core | system-config-sync.sh | System configs |
+
-| 6:00 AM | Core | home-router-backup.sh | MikroTik CCR config |
+| Service | Method | Destination | Schedule | Last Verified |
-| Every 10 min | core-bu | warm-standby-sync | Pull from S3 live/ → standby readiness |
+|---------|--------|-------------|----------|---------------|
+| Open WebUI | `app1-backup.sh` — data dir tar.gz | `s3://hermes-vps-backups/app1/openwebui/` | 2:00 AM | 2026-07-28 |
+| LiteLLM | `litellm-backup.sh` — Postgres DB dump + .env | `s3://hermes-vps-backups/app1/litellm/` | 3:30 AM | 2026-07-28 |
+| n8n | `app1-backup.sh` — Postgres DB dump | `s3://hermes-vps-backups/app1/n8n/` | 2:00 AM | 2026-07-28 |
+| MCP Server Configs | `app1-backup.sh` — MCP settings files | `s3://hermes-vps-backups/app1/mcp/` | 2:00 AM | 2026-07-28 |
+| Vaultwarden | `vaultwarden-backup.sh` — SQLite DB dump | `s3://hermes-vps-backups/app1/vaultwarden/` | 2:30 AM | 2026-07-28 |
+| Komodo | `komodo-backup.sh` — MongoDB dump + compose + keys | `s3://hermes-vps-backups/app1/komodo/` | 3:45 AM | 2026-07-28 |
+| DocuSeal | `docuseal-backup.sh` — SQLite DB + attachments | `s3://hermes-vps-backups/app1/docuseal/` | 4:00 AM | 2026-07-28 |
+| Twenty CRM | `twenty-backup.sh` — Postgres dump + .env + compose | `s3://hermes-vps-backups/app1/twenty/` | 4:15 AM | 2026-07-28 |
+| Kokoro TTS | *(stateless — no backup needed)* | — | — | — |
+
+### App2 (152.53.39.202) — RS 4000
+
+| Service | Method | Destination | Schedule | Last Verified |
+|---------|--------|-------------|----------|---------------|
+| Hudu | `hudu-backup.sh` — Postgres dump | `s3://hermes-vps-backups/hudu/backups/` | 7:00 AM | 2026-07-28 |
+| Gitea | `gitea-backup.sh` — repos + DB dump | `s3://hermes-vps-backups/gitea/daily/` | 8:00 AM | 2026-07-28 |
+| UNMS | `unms-backup-sync.sh` — auto-backup .unms | `s3://hermes-vps-backups/unms-backups/live/backups/` | 6:00 AM | 2026-07-28 |
+| UniFi | `unifi-backup-sync.sh` — auto-backup .unf | `s3://hermes-vps-backups/unifi-backups/` | 2:00 AM | 2026-07-18 |
+| Traccar | `app2-backup.sh` — H2 DB + config | `s3://hermes-vps-backups/app2/traccar/` | 2:30 AM | 2026-07-28 |
+
+### App3 (152.53.241.111) — RS 4000
+
+| Service | Method | Destination | Schedule | Last Verified |
+|---------|--------|-------------|----------|---------------|
+| CloudPanel DB | `app3-backup.sh` — SQLite DB | `s3://hermes-vps-backups/app3/cloudpanel/` | 3:00 AM | 2026-07-28 |
+| MySQL (all DBs) | `app3-backup.sh` — mysqldump | `s3://hermes-vps-backups/app3/mysql/` | 3:00 AM | 2026-07-28 |
+| WordPress Files | `app3-backup.sh` — wp-content tar.gz | `s3://hermes-vps-backups/app3/wordpress/` | 3:00 AM | 2026-07-28 |
+| Nginx Configs | `app3-backup.sh` — sites-enabled + config | `s3://hermes-vps-backups/app3/config/` | 3:00 AM | 2026-07-28 |
+| WordPress Snapshots | `/opt/backup-restore/snapshot.sh` — per-site tar.gz | `/opt/backup-restore/snapshots/` (local, 30-day retention) | 6 AM / 6 PM | 2026-07-28 13:00 |
+
+### wphost02 (5.161.62.38) — Hetzner CPX21
+
+| Service | Method | Destination | Schedule | Last Verified |
+|---------|--------|-------------|----------|---------------|
+| WordPress (7 sites) | `ssh → /root/backup.sh` — per-site tar.gz + all DBs | `s3://hermes-vps-backups/wphost02-backup/` | 5:00 AM | 2026-07-28 |
+
+### Home Router
+
+| Service | Method | Destination | Schedule | Last Verified |
+|---------|--------|-------------|----------|---------------|
+| MikroTik CCR2004 | `run-wisp-backup.sh` — export .rsc via SSH | `s3://mikrotik-ccr-backups/wisp-backups/configs/home/` | 6:00 AM | 2026-07-28 |
+
+### External
+
+| Service | Method | Destination | Schedule | Last Verified |
+|---------|--------|-------------|----------|---------------|
+| Hetzner Snapshots | `snapshot-hetzner.py` — API-driven disk snapshots | Hetzner Cloud (weekly) | Mon 5:00 AM | — |
 
 ---
 
-## Coverage by Server
+## Schedules Summary (ET)
 
-### Core (152.53.192.33)
+| Time | What | Runner | Script |
+|------|------|--------|--------|
+| Every 15 min | Hermes session state | Hermes cron | `hermes-live-sync` |
+| 1:00 AM | Full Hermes backup | crontab | `hermes-backup.sh` |
+| 1:30 AM | Grafana, Uptime Kuma, Docker volumes, Prometheus | crontab | `core-services-backup.sh` |
+| 2:00 AM | Open WebUI, n8n, MCP configs (App1) | crontab | `app1-backup.sh` |
+| 2:30 AM | Vaultwarden (App1) + Traccar (App2) | Hermes cron / crontab | `vaultwarden-backup.sh`, `app2-backup.sh` |
+| 3:00 AM | /root essentials + App3 (CloudPanel, MySQL, WP, Nginx) | crontab | `root-essentials-backup.sh`, `app3-backup.sh` |
+| 3:30 AM | LiteLLM (App1) | Hermes cron | `litellm-backup.sh` |
+| 3:45 AM | Komodo (App1) | Hermes cron | `komodo-backup.sh` |
+| 4:00 AM | DocuSeal (App1) | Hermes cron | `docuseal-backup.sh` |
+| 4:15 AM | Twenty CRM (App1) | Hermes cron | `twenty-backup.sh` |
+| 5:00 AM | wphost02 WordPress (SSH) | crontab | `wphost02-backup` |
+| 6:00 AM | MikroTik CCR + UNMS sync | Hermes cron | `run-wisp-backup.sh`, `unms-backup-sync.sh` |
+| 6 AM / 6 PM | WordPress per-site snapshots (App3, local) | App3 crontab | `/opt/backup-restore/snapshot.sh` |
+| 7:00 AM | Hudu (App2) | Hermes cron | `hudu-backup.sh` |
+| 8:00 AM | Gitea (App2) | Hermes cron | `gitea-backup.sh` |
+| Mon 5:00 AM | Hetzner weekly snapshots | Hermes cron | `snapshot-hetzner.py` |
 
-| Service | Method | RPO |
+---
-|---|---|---|
-| Hermes Agent | tar.gz → S3 (daily) + live sync (15 min) | 15 min |
-| Vaultwarden | SQLite dump → S3 (daily) | 24 hr |
-| Twenty CRM | Postgres pg_dump → S3 (daily) | 24 hr |
-| SearXNG | settings.yml → S3 (daily) | 24 hr |
-| Komodo | config dir → S3 (daily) | 24 hr |
-| Prometheus | TSDB snapshot → S3 (daily) | 24 hr |
-| Grafana | SQLite DB → S3 (daily) | 24 hr |
-| Uptime Kuma | SQLite DB → S3 (daily) | 24 hr |
-| DocuSeal | Covered by docker-volume-sync | 24 hr |
-| Caddy config | system-config-sync (daily) | 24 hr |
-| /root essentials | root-essentials-backup (daily) | 24 hr |
 
-### app1 (152.53.36.131)
+## Script Inventory
 
-| Service | Method | RPO |
+### On Core (`/root/.hermes/scripts/`)
-|---|---|---|
-| LiteLLM | Postgres pg_dump + config.yaml → S3 (daily) | 24 hr |
-| Open WebUI | /app/backend/data → S3 (daily) | 24 hr |
-| n8n | Postgres pg_dump → S3 (daily) | 24 hr |
-| MCP servers | Configs in Git + Docker volumes | 24 hr |
-| Mattermost | Postgres DB + data volume → S3 (daily) | 24 hr |
 
-### app2 (152.53.39.202)
+| Script | Purpose | Runs |
+|--------|---------|------|
+| `hermes-backup.sh` | Full Hermes tar.gz to S3 | crontab 1:00 AM |
+| `core-services-backup.sh` | Grafana, Uptime Kuma, volumes, Prometheus | crontab 1:30 AM |
+| `root-essentials-backup.sh` | /root keys, configs, scripts | crontab 3:00 AM |
+| `backup-audit-check.sh` | Verify recent backup timestamps | crontab 2:00 AM |
+| `vaultwarden-backup.sh` | Vaultwarden SQLite dump (SSH to App1) | Hermes cron 2:30 AM |
+| `litellm-backup.sh` | LiteLLM Postgres dump + config (SSH to App1) | Hermes cron 3:30 AM |
+| `komodo-backup.sh` | Komodo MongoDB dump (SSH to App1) | Hermes cron 3:45 AM |
+| `docuseal-backup.sh` | DocuSeal SQLite + attachments (SSH to App1) | Hermes cron 4:00 AM |
+| `twenty-backup.sh` | Twenty CRM Postgres dump (SSH to App1) | Hermes cron 4:15 AM |
+| `app1-backup.sh` | Open WebUI, n8n, MCP configs (SSH to App1) | App1 crontab 2:00 AM |
+| `app2-backup.sh` | Traccar backup (SSH to App2) | App2 crontab 2:30 AM |
+| `app3-backup.sh` | CloudPanel, MySQL, WP, Nginx (SSH to App3) | crontab 3:00 AM |
+| `wphost02-backup.sh` | SSH to wphost02, backup all sites | crontab 5:00 AM |
+| `run-wisp-backup.sh` | MikroTik CCR config export | Hermes cron 6:00 AM |
+| `unms-backup-sync.sh` | UNMS auto-backup sync to S3 | Hermes cron 6:00 AM |
+| `unifi-backup-sync.sh` | UniFi auto-backup sync to S3 | Hermes cron 2:00 AM |
+| `hudu-backup.sh` | Hudu Postgres dump to S3 | Hermes cron 7:00 AM |
+| `gitea-backup.sh` | Gitea repos + DB dump to S3 | Hermes cron 8:00 AM |
+| `snapshot-hetzner.py` | Hetzner server disk snapshots via API | Hermes cron Mon 5:00 AM |
 
-| Service | Method | RPO |
+### On App3 (`/opt/backup-restore/`)
-|---|---|---|
-| Traccar | H2 database + conf → S3 (daily) | 24 hr |
-| Gitea | Repos + DB → S3 (daily) | 24 hr |
-| Hudu | Docker volume → S3 (daily, 30-day retention) | 24 hr |
-| UNMS | S3 sync (daily) | 24 hr |
-| UniFi | Autobackup → S3 (daily) | 24 hr |
 
-### app3 (152.53.241.111)
+| Script | Purpose | Runs |
+|--------|---------|------|
+| `snapshot.sh` | Per-site WordPress tarball + DB | App3 crontab 6 AM / 6 PM |
 
-| Service | Method | RPO |
+### On wphost02 (`/root/`)
-|---|---|---|
+
-| CloudPanel CE | SQLite DB → S3 (daily) | 24 hr |
+| Script | Purpose | Runs |
-| MySQL | All databases mysqldump → S3 (daily) | 24 hr |
+|--------|---------|------|
-| WordPress | Files + wp-config → S3 (daily) | 24 hr |
+| `backup.sh` | All 7 WordPress sites + all MySQL DBs | Triggered via SSH from Core |
-| Nginx | /etc/nginx + /etc/cloudpanel → S3 (daily) | 24 hr |
-| **WordPress Snapshots** | **Per-site tarball + MySQL dump (2x daily, 60-day retention)** | **12 hr** |
-| **Backup Restore UI** | **Flask app port 8090 at my.itpropartner.com/backups** | **Instant** |
-| voipsimplicity.com | Covered by MySQL + WordPress file backup | 24 hr |
-| my.voipsimplicity.com | Covered by Git (static HTML) | N/A |
 
 ---
 
 ## S3 Bucket Structure
 
 ```
-s3://hermes-vps-backups/
+hermes-vps-backups/
-├── live/                          # 15-min Hermes state sync
+├── hermes-full-backup/     — Full Hermes daily (tar.gz)
-├── live-sync/                     # Live sync artifacts
+├── live/                   — Hermes live sync (every 15 min)
-├── hermes-full-backup/            # Daily full Hermes backups
+├── live-sync/              — Old sync format (deprecated)
-├── snapshots/                     # Hermes snapshots
+├── root-backup/            — /root essentials
-├── standby/                       # Warm standby scripts
+├── standby/                — Standby configs + recovery bundle
-├── root-backup/                   # /root essentials
 ├── core/
-│   ├── vaultwarden/
+│   ├── grafana/            — Grafana SQLite DB
-│   ├── twenty/
+│   ├── uptime-kuma/        — Uptime Kuma SQLite DB
-│   ├── searxng/
+│   ├── prometheus/         — Prometheus TSDB snapshots
-│   └── komodo/
+│   ├── vaultwarden/        — [STALE — service migrated to App1]
+│   ├── twenty/             — [STALE — service migrated to App1]
+│   ├── searxng/            — [STALE — service removed]
+│   └── komodo/             — [STALE — service migrated to App1]
 ├── app1/
-│   ├── litellm/
+│   ├── openwebui/          — Open WebUI data
-│   ├── openwebui/
+│   ├── litellm/            — LiteLLM Postgres dump + config
-│   ├── n8n/
+│   ├── n8n/                — n8n Postgres dump
-│   ├── mcp/
+│   ├── mcp/                — MCP server configs
-│   └── ollama/
+│   ├── vaultwarden/        — Vaultwarden SQLite dump
+│   ├── komodo/             — Komodo MongoDB dump
+│   ├── docuseal/           — DocuSeal SQLite + attachments
+│   └── twenty/             — Twenty CRM Postgres dump
 ├── app2/
-│   ├── traccar/
+│   └── traccar/            — Traccar H2 DB + config
-│   ├── gitea/
-│   ├── hudu/
-│   ├── unms-backups/
-│   └── unifi-backups/
 ├── app3/
-│   ├── cloudpanel/
+│   ├── cloudpanel/         — CloudPanel SQLite DB
-│   ├── mysql/
+│   ├── mysql/              — All MySQL DBs
-│   ├── wordpress/
+│   ├── wordpress/          — wp-content tar.gz
-│   └── config/
+│   └── config/             — Nginx configs
-├── volumes/                       # Docker volume syncs
+├── hudu/backups/           — Hudu Postgres dump
-├── caddy/                         # Caddy configs
+├── gitea/daily/            — Gitea repos + DB
-├── env/                           # Environment files
+├── unms-backups/live/      — UNMS auto-backups
-└── assets/                        # Static assets
+├── unifi-backups/          — UniFi controller backups
+├── wphost02-backup/        — wphost02 per-site + DB
+├── volumes/                — Docker volume dumps
+├── caddy/                  — (unused)
+├── assets/                 — Static assets
+├── snapshots/              — (unused)
+└── system-configs-*.tar.gz — Historical system config snapshots
 
-s3://itpropartner-backups/
+mikrotik-ccr-backups/
-├── home-router/                   # MikroTik CCR configs
+└── wisp-backups/configs/
-└── shonuff/                       # Personal backups
+    └── home/               — CCR2004 export .rsc
-
-s3://mikrotik-ccr-backups/         # Home CCR2004 configs
 ```
 
 ---
 
-## Restoration
+## Migration History (Jul 28, 2026)
 
-### Single Service Restore
+All the following services were migrated from Core to App1 in a single session:
-```bash
-# Example: restore LiteLLM database
-SERVICE=litellm; DATE=2026-07-16
-aws s3 cp s3://hermes-vps-backups/app1/$SERVICE/$SERVICE-$DATE.sql.gz . \
-  --endpoint-url https://s3.us-east-1.wasabisys.com
-gunzip $SERVICE-$DATE.sql.gz
-# Load into Postgres
-```
 
-### Full Server Restore
+| Service | Old Home | New Home | Backup Before | Backup After |
-Each server's backup directory contains everything needed to rebuild that server from scratch.
+|---------|----------|----------|--------------|-------------|
-
+| Vaultwarden | Core (:8080) | App1 (:8081) | `core/vaultwarden/` (stale) | `app1/vaultwarden/` ✅ |
-### Warm Standby (Core only)
+| SearXNG | Core (:8888) | Removed | `core/searxng/` (stale) | N/A (replaced by Super Search) |
-core-bu (5.161.225.131) automatically syncs from S3 every 10 minutes. To activate:
+| Twenty CRM | Core (:3003) | App1 (:3003) | `core/twenty/` (stale) | `app1/twenty/` ✅ |
-1. Power on via Hetzner Cloud API
+| Komodo | Core (:9120) | App1 (:9120) | `core/komodo/` (stale) | `app1/komodo/` ✅ |
-2. Hermes starts from latest S3 state
+| DocuSeal | Core (:3000) | App1 (:3002) | No backup existed | `app1/docuseal/` ✅ |
+| Kokoro TTS | Core (:8880) | App1 (:8880) | N/A (stateless) | N/A (stateless) |
 
 ---
 
-## Known Gaps
+## Disaster Recovery
 
-| Gap | Impact | Plan |
+- **Live Hermes:** netcup VPS — `core.itpropartner.com` — `152.53.192.33`
-|---|---|---|
+- **Standby Hermes:** Hetzner CPX21 — `app1-bu.itpropartner.com` — `5.161.225.131`
-| No WAL archiving | RPO is 24 hours for most databases | Add WAL-G for Postgres services |
+  - Cron checks live box every 10 min, takes over if down
-| No restore testing | Don't know if backups actually restore | Schedule quarterly restore drill |
+  - Auto-restores from `s3://hermes-vps-backups/hermes-full-backup/`
-| core-bu not tested since upgrade | Standby might not work | Schedule failover test |
+  - Provider diversity: netcup outage won't kill both Core and standby
-| wphost02 S3 upload in progress | First backup running now | Monitor completion |
+- **Recovery priority:** Hermes first → infrastructure monitoring (Uptime Kuma, Grafana) → App1 services → App2 services
+- **24 backup scripts** on Core, 1 on App3, 1 on wphost02

docs/key-inventory.md

@@ -39,7 +39,7 @@ homelab.pub:       ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHT+727Cti4cZ2x6CiYDeDKZ9
 | **app1** | 152.53.36.131 | netcup RS 4000 | Via root or ippadmin+sudo | Root password in Vaultwarden |
 | **app2** | 152.53.39.202 | netcup RS 4000 | Via root or ippadmin+sudo | Root password in Vaultwarden |
 | **app3** | 152.53.241.111 | netcup RS 4000 | Via root or ippadmin+sudo | Root password in Vaultwarden |
-| **app1-bu** | 5.161.114.8 | Hetzner CPX11 | itpp-infra SSH key | Warm standby, offline by default |
+| **app1-bu** | 5.161.225.131 | Hetzner CPX21 | itpp-infra SSH key | Warm standby (core-bu) |
 
 ### Admin Account (all servers)
 

docs/model-chain.md

@@ -1,18 +1,53 @@
-# AI Model Chain — IT Pro Partner
+# AI Model Architecture — IT Pro Partner
 
-**Updated:** July 24, 2026
+**Updated:** July 27, 2026
 
-## Active Fallback Chain
+Two separate concepts that must not be conflated:
+
+---
+
+## Fallback Chain *(auto-failover — config.yaml)*
+
+Survives admin-ai outage. Uses direct API keys for F1–F4.
 
 | Tier | Model | Provider | Notes |
 |---|---|---|---|
-| **Primary** | `claude-sonnet-5` | `admin-ai` | Conductor via LiteLLM ($3.33/day cap) |
+| **Primary** | `deepseek-v4-flash` | `admin-ai` | Fast, cheap conductor via LiteLLM |
-| **Fallback 1 (F1)** | `deepseek-v4-pro` | `deepseek` | Direct DeepSeek API |
+| **F1** | `deepseek-v4-flash` | `deepseek` (direct) | Same model, direct API |
-| **Fallback 2 (F2)** | `gpt-5.6-terra` | `admin-ai` | Demoted from Primary via LiteLLM ($3.33/day cap) |
+| **F2** | `gemini-3.6-flash` | `google` (direct) | Fast, free-tier eligible |
-| **Fallback 3 (F3)** | `grok-4.5` (`grok-2-1212`) | `xai` | Direct xAI API |
+| **F3** | `grok-4.6` | `xai` (direct) | Verified working (NOT grok-4.5) |
-| **Fallback 4 (F4)** | `gemini-3.6-flash` | `google` | Direct Google API |
+| **F4** | `claude-sonnet-5` | `anthropic` (direct) | Premium survival fallback |
+
+**Only fires when the model above it is unreachable.**
+
+---
+
+## Operational Models *(daily toolbox — admin-ai only)*
+
+No direct API keys. Shared $5/day budget via hermes-agent-v3 key.
+
+| Role | Model | When |
+|---|---|---|
+| Conductor | `deepseek-v4-flash` | Orchestrating, delegating, quick decisions |
+| Workhorse | `deepseek-v4-pro` | Large context, big outputs, infra code |
+| Workhorse | `deepseek-reasoner` | Multi-step analysis, debugging, planning |
+| Auditor | `gemini-3.6-flash` | Sanity checks, every output (essentially free) |
+| Auditor | `claude-sonnet-5` | Architecture, security, auth — sparingly ($15/M output) |
+
+---
 
 ## Admin-AI Virtual Key
-- **Key Hash**: `0237186aaff1ed90295c00d73103103900d4bd07252ec1806af8a4358e45d37a`
+
-- **Allowed Models**: `claude-sonnet-5`, `gpt-5.6-terra`, `deepseek-v4-pro`, `deepseek-v4-flash`, `glm-5.2`, `MiniMax-M3`, `qwen3.7-plus`
+- **Key Name:** `hermes-agent-v3` (generated Jul 27, 2026)
-- **Daily Budget Cap**: $3.33 / day
+- **Daily Budget Cap:** $5/day shared across all operational models
+- **Expiry:** Jul 27, 2027
+- **Master Key:** stored in Hudu
+
+## Budget Targets
+
+| Component | Daily est. |
+|---|---|
+| Conductor (ds-v4-flash) | ~$0.30 |
+| Workhorses (ds-v4-pro + reasoner) | ~$1.70 |
+| Auditors (gemini + claude sparingly) | ~$0.80 |
+| **Total** | **$3–5/day** |

projects/intelsight.md

@@ -0,0 +1,728 @@
+# IntelSight Business Proposal
+
+**Prepared for:** Germaine Brown & Advisory Team  
+**Date:** July 25, 2026  
+**Company:** IT Pro Partner — Product Division  
+**Product:** IntelSight (intelsight.io)  
+**Classification:** Confidential — Advisory Review
+
+---
+
+## Table of Contents
+
+1. [Executive Summary](#1-executive-summary)
+2. [Elevator Pitch](#2-elevator-pitch)
+3. [Problem Statement](#3-problem-statement)
+4. [Market Analysis](#4-market-analysis)
+5. [Product Overview](#5-product-overview)
+6. [Revenue Model](#6-revenue-model)
+7. [Competitive Advantages](#7-competitive-advantages)
+8. [Go-to-Market Strategy](#8-go-to-market-strategy)
+9. [Risk Analysis](#9-risk-analysis)
+10. [Financial Projections](#10-financial-projections)
+11. [The Ask](#11-the-ask)
+
+---
+
+## 1. Executive Summary
+
+IntelSight is a multi-tenant competitive intelligence SaaS platform that delivers enterprise-grade competitor monitoring, market analysis, and OSINT capabilities at a price point accessible to established SMBs and mid-market companies — a segment the current market leaders have effectively abandoned.
+
+The global competitive intelligence tools market was valued at **$0.56 billion in 2024** and is projected to reach **$1.62 billion by 2033**, growing at a CAGR of **12.5%** (SkyQuest, 2025). Yet the dominant players — Crayon ($15K–$100K+/year), Klue ($15K–$200K+/year), and Kompyte (custom enterprise) — exclusively target large enterprises with six-figure contracts and opaque, sales-led pricing. There is no credible, transparently priced CI platform for businesses with 10–500 employees who compete in crowded markets and need real intelligence, not just Google Alerts.
+
+IntelSight fills this gap. Built on IT Pro Partner's existing Super Search v2 infrastructure — a battle-tested multi-provider search engine with 7 providers, circuit breakers, and caching already running on netcup VPS — IntelSight adds Crunchbase API integration ($49/mo), Hunter.io email intelligence ($34/mo), LLM-powered synthesis via deepseek-v4-pro, and a purpose-built multi-tenant SaaS layer. Approximately **80% of the core search and OSINT engine already exists and is production-hardened**.
+
+With transparent annual pricing of **$199/mo (Pro)**, **$499/mo (Growth)**, and **$1,499+/mo (Enterprise)**, IntelSight costs **one-tenth to one-fiftieth** of the incumbent platforms while delivering comparable or superior capability in several dimensions. The economics are compelling: at **50 paying customers** across tiers, IntelSight projects ~**$375K–$500K ARR** with approximately **85% gross margins** — a capital-efficient software business with near-zero marginal cost of delivery.
+
+This proposal outlines the market opportunity, product architecture, revenue model, go-to-market plan, risk analysis, and the resources required to launch IntelSight as a standalone product line under the IT Pro Partner umbrella.
+
+---
+
+## 2. Elevator Pitch
+
+IntelSight gives established businesses the same competitive intelligence firepower that Fortune 500 companies pay $50,000 a year for — at less than $200 a month. By combining AI-powered search across seven providers, Crunchbase funding intelligence, Hunter.io email discovery, and LLM-driven synthesis into one multi-tenant platform, IntelSight turns the competitive intelligence market on its head: transparent pricing, instant onboarding, and no sales call required. It's Crayon for the other 99%.
+
+---
+
+## 3. Problem Statement
+
+### 3.1 The Intelligence Gap
+
+Competitive intelligence has become non-negotiable. In 2024, 68% of North American businesses invested in AI-based CI systems (SkyQuest). Companies that systematically track competitors win deals faster, price smarter, and pivot before disruption blindsides them.
+
+Yet the CI software market has a structural problem: **it only serves the top of the market.**
+
+| Platform | Entry Price (Annual) | Pricing Model | Target Segment |
+|----------|---------------------|---------------|----------------|
+| Crayon | ~$15,000–$16,000 | Custom, sales-led | Enterprise (500+ employees) |
+| Klue | ~$15,000–$20,000 | Quote-based, per-seat | Enterprise (200+ employees) |
+| Kompyte (Semrush) | Custom (budget option) | Sales-led, Semrush ecosystem | Marketing teams at mid-to-large |
+| Contify | Custom | Quote-based | Enterprise |
+| Parano.ai | €89/mo (~$97) | Transparent | Solo/small teams only |
+
+Between Parano.ai at $97/month (good for solo operators, limited depth) and Crayon/Klue at $15,000+/year (great for enterprises, inaccessible to everyone else), there is a **yawning gap** that covers:
+
+- **Established SMBs** (10–100 employees) competing in crowded verticals — SaaS, professional services, manufacturing, logistics, healthcare tech
+- **Mid-market companies** (100–500 employees) with a competitor tracking budget of $2,000–$18,000/year — not $50,000+
+- **Growth-stage startups** graduating from LaunchCheck who now need ongoing intelligence, not just launch research
+- **Boutique consulting, legal, and financial services firms** that need OSINT dossiers, funding alerts, and market signals but can't justify a full CI platform
+
+### 3.2 What These Companies Do Today
+
+Right now, they improvise. They stitch together:
+
+- Google Alerts (free, noisy, incomplete)
+- Manual Crunchbase checks (time-consuming, inconsistent)
+- LinkedIn stalking (unstructured, non-systematic)
+- Occasional SEMrush/Ahrefs logins (focus on SEO, not holistic CI)
+- Spreadsheets maintained by an overworked marketing manager
+
+The result: **delayed awareness, missed signals, and decisions made on intuition rather than intelligence**. By the time a competitor's funding round, product launch, or pricing change reaches the decision-maker through this ad-hoc pipeline, weeks or months have passed.
+
+### 3.3 The Pain Points IntelSight Solves
+
+| Pain Point | IntelSight Solution |
+|------------|-------------------|
+| Can't afford enterprise CI tools | $199/mo Pro tier — transparent, no negotiation |
+| Competitor moves discovered too late | Real-time monitoring across news, web, and funding sources |
+| No systematic competitor tracking | Multi-tenant dashboards with saved searches and alerts |
+| OSINT research takes days | Automated dossier generation — 5/mo on Pro, unlimited on Enterprise |
+| Pricing changes go undetected | Automated pricing monitoring (Growth+) |
+| Sales team lacks competitive ammo | AI-generated battle cards and SWOT reports (Growth+) |
+| Can't estimate competitor market share | Market share estimation engine (Enterprise) |
+| No early warning on new entrants | Crunchbase funding alerts flag new competitors before they launch |
+
+---
+
+## 4. Market Analysis
+
+### 4.1 Total Addressable Market (TAM)
+
+The global competitive intelligence tools market was valued at **$0.56 billion in 2024** and is forecast to reach **$1.62 billion by 2033**, growing at a CAGR of **12.5%** (SkyQuest Intelligence, 2025). A broader estimate from SendView places the total CI industry (software + services + data) at **$8.2 billion in 2023**, growing at 12.4% CAGR to **$16.8 billion by 2030**.
+
+North America dominates with ~40% market share, driven by high digital adoption and competitive intensity — 68% of North American businesses invested in AI-based CI systems in 2024.
+
+**TAM (CI Software Tools):** $560M (2024) → $1.62B (2033)  
+**TAM (CI Industry Total):** $8.2B (2023) → $16.8B (2030)
+
+### 4.2 Serviceable Addressable Market (SAM)
+
+IntelSight's SAM is the subset of the CI software market consisting of **English-language, SMB and mid-market businesses in North America** that are underserved by enterprise CI platforms.
+
+**Assumptions:**
+
+| Parameter | Value | Source/Methodology |
+|-----------|-------|-------------------|
+| US businesses with 10–500 employees | ~2.1 million | SBA / Census data (2024) |
+| Businesses in competitive verticals (tech, services, finance, healthcare, manufacturing, logistics) | ~40% of total | Conservative estimate based on industry distribution |
+| Addressable businesses in competitive verticals | ~840,000 | 2.1M × 40% |
+| Penetration of CI tools in this segment today | <3% | Current tools priced out of reach |
+| Willingness to pay $200–$1,500/mo for CI | ~15% of addressable | Based on comparable SaaS spend (CRM, analytics) |
+| **SAM (total market value)** | **~$4.2B/year** | 840K × 15% × avg $3,300/yr contract |
+
+This is a conservative SAM estimate. Even if we assume only 5% willingness to pay at our price point, the SAM exceeds **$1.4B/year**.
+
+### 4.3 Serviceable Obtainable Market (SOM)
+
+IntelSight's SOM for the first 3 years focuses on **directly reachable customers** through IT Pro Partner's existing network, digital marketing, and channel partnerships.
+
+| Year | SOM Estimate | Methodology |
+|------|-------------|-------------|
+| Year 1 | $150K–$400K ARR | ITPP network + targeted digital + LaunchCheck pipeline |
+| Year 2 | $800K–$1.5M ARR | Referral flywheel + content inbound + channel partners |
+| Year 3 | $2M–$4M ARR | Brand establishment + outbound sales + API/Enterprise expansion |
+
+### 4.4 Competitive Landscape
+
+| Competitor | Annual Cost (Entry) | Primary Strength | Primary Weakness | IntelSight Advantage |
+|------------|--------------------|--------------------|--------------------|-------------|
+| **Crayon** | $15K–$16K+ | Broad coverage, enterprise depth | Opaque pricing, 6-figure total cost, sales-led | 50x cheaper, transparent, self-serve |
+| **Klue** | $15K–$20K+ | Sales enablement, battle cards | Quote-only, high onboarding fees, per-seat costs | Battle cards included at $499/mo, not $20K/yr |
+| **Kompyte (Semrush)** | Custom (budget option) | Marketing CI, Semrush ecosystem | Locked into Semrush, custom pricing | Standalone, not ecosystem-dependent |
+| **Contify** | Custom | Strategy + market intelligence | Enterprise-only, opaque | Multi-tenant for mid-market |
+| **Parano.ai** | ~$1,100/yr (€89/mo) | Transparent pricing, continuous monitoring | Limited depth — monitoring only, no dossiers, no Crunchbase, no Hunter.io | Full-stack CI, OSINT, and funding intelligence |
+| **DIY Stack** | $50–$400/mo (tools) | Flexible, low cost | No integration, no synthesis, manual labor | Everything integrated, LLM-synthesized |
+
+**Key insight:** IntelSight does not need to beat Crayon/Klue on depth to win. It needs to be *good enough* at one-tenth the price for the 97% of businesses those platforms don't serve. This is the classic Clayton Christensen disruption play: serve the overshot market with a simpler, dramatically cheaper product.
+
+---
+
+## 5. Product Overview
+
+### 5.1 Architecture
+
+IntelSight is built on a layered architecture that maximizes reuse of existing IT Pro Partner infrastructure:
+
+```
+┌─────────────────────────────────────────────────────────┐
+│                  IntelSight Portal (React)               │
+│              Multi-tenant dashboards, reports, admin      │
+├─────────────────────────────────────────────────────────┤
+│                  API Layer (FastAPI + Auth)               │
+│          REST endpoints, RBAC, rate limiting, billing     │
+├─────────────────────────────────────────────────────────┤
+│              Intelligence Engine (Python)                 │
+│    LLM synthesis, report generation, alerting, dossiers   │
+├──────────┬──────────┬──────────┬────────────────────────┤
+│  Super   │ Crunch-  │ Hunter.  │   Additional Data       │
+│ Search   │  base    │   io     │   Sources & Plugins     │
+│   v2     │  API     │  API     │                         │
+├──────────┴──────────┴──────────┴────────────────────────┤
+│           PostgreSQL — Tenant data, user state, logs      │
+├─────────────────────────────────────────────────────────┤
+│          Stripe — Billing, subscriptions, invoicing       │
+└─────────────────────────────────────────────────────────┘
+```
+
+**Infrastructure:**
+- **Hosting:** netcup VPS (IT Pro Partner existing infra) — one production server + staging
+- **Super Search v2 MCP Server:** Already running on app1 — provides search across 7 providers (SearXNG, Exa, DuckDuckGo, Firecrawl, Wikipedia, OpenCorporates, CourtListener) with circuit breakers, caching, and health monitoring
+- **API Layer (to build):** FastAPI with JWT auth, tenant isolation, rate limiting
+- **Portal (to build):** React SPA with multi-tenant dashboards
+- **Database (to add):** PostgreSQL for tenant data, user accounts, saved searches, report storage
+- **Billing (to add):** Stripe integration for subscriptions, invoicing, dunning
+- **LLM:** deepseek-v4-pro via API for synthesis, report generation, SWOT analysis
+
+**Existing vs. to-build breakdown:**
+
+| Component | Status | Effort Estimate |
+|-----------|--------|----------------|
+| Super Search v2 engine | **Existing** | 0 hours |
+| Search provider orchestration | **Existing** | 0 hours |
+| Circuit breakers, caching, health checks | **Existing** | 0 hours |
+| Crunchbase API integration | **To build** | ~20 hours |
+| Hunter.io API integration | **To build** | ~15 hours |
+| LLM synthesis pipeline | **~50% existing** | ~30 hours |
+| FastAPI multi-tenant API layer | **To build** | ~40 hours |
+| React portal / dashboards | **To build** | ~80 hours |
+| PostgreSQL schema + migrations | **To build** | ~15 hours |
+| Stripe billing integration | **To build** | ~25 hours |
+| Auth (JWT + RBAC + tenant isolation) | **To build** | ~20 hours |
+| Alerting / notification engine | **To build** | ~20 hours |
+| Report generation templates | **To build** | ~25 hours |
+| White-label framework (Growth+) | **To build** | ~15 hours |
+| API access gateway (Enterprise) | **To build** | ~20 hours |
+| Testing, DevOps, CI/CD | **To build** | ~40 hours |
+| Documentation, onboarding | **To build** | ~20 hours |
+| **Total remaining build** | | **~385 hours** |
+
+### 5.2 Tier Structure
+
+#### Pro — $199/month (annual) / $229/month (monthly)
+
+**Target:** Established SMBs, professional services firms, boutique agencies
+
+**Features:**
+- Unlimited searches across all 7 providers
+- Competitor news monitoring with daily/weekly digests
+- Review sentiment analysis (G2, Capterra, Trustpilot)
+- Google Trends integration with competitive comparison
+- 5 OSINT dossiers per month (automated person/company research)
+- Crunchbase funding alerts for tracked competitors
+- Hunter.io email discovery — 100 lookups/month
+- Weekly automated competitive reports (PDF + email)
+- 3 user seats
+- Standard support (email, 24-hour SLA)
+
+#### Growth — $499/month (annual) / $574/month (monthly)
+
+**Target:** Mid-market companies, growth-stage startups with dedicated marketing/sales teams
+
+**Everything in Pro, plus:**
+- AI-generated competitive battle cards (auto-updating)
+- Competitor pricing change monitoring and alerts
+- Automated SWOT reports (regenerated weekly)
+- 25 saved searches with alerting
+- White-label reports (remove IntelSight branding)
+- 10 user seats
+- Priority support (email + chat, 4-hour SLA)
+- Custom report scheduling
+
+#### Enterprise — $1,499+/month (annual) / $1,724+/month (monthly)
+
+**Target:** Larger mid-market, PE/VC portfolio companies, multi-brand organizations
+
+**Everything in Growth, plus:**
+- Unlimited everything — searches, dossiers, reports, lookups
+- War room dashboards (real-time competitive monitoring display)
+- REST API access for integration with internal systems
+- Dedicated analyst review (human-in-the-loop quality assurance on reports)
+- Market share estimation engine (statistical modeling from public signals)
+- Patent filing monitoring (USPTO + international)
+- SEC filing monitoring (10-K, 10-Q, 8-K for public competitors)
+- Unlimited user seats
+- SSO/SAML (Okta, Azure AD, Google Workspace)
+- Custom data source integration
+- Dedicated account manager
+- SLA-backed uptime guarantee (99.9%)
+
+**Enterprise pricing scales with:**
+- Number of competitors tracked (base: 25, +$200/mo per additional 25)
+- Dossier volume (base: unlimited standard, premium OSINT at volume)
+- Custom integrations
+- White-glove onboarding and training
+
+### 5.3 Sister Product: LaunchCheck ($49/month)
+
+LaunchCheck serves pre-revenue founders conducting initial competitive landscape research. Features include one-time market landscape reports, competitor identification, and positioning analysis. Budget-conscious and founder-friendly.
+
+**Strategic role:** LaunchCheck is the top of the IntelSight funnel. As LaunchCheck users raise funding, hire teams, and need ongoing competitive intelligence, they naturally upgrade to IntelSight Pro or Growth. This creates a built-in lead generation engine at near-zero customer acquisition cost.
+
+---
+
+## 6. Revenue Model
+
+### 6.1 Pricing Rationale
+
+IntelSight pricing is anchored to the gap between DIY tools ($50–$400/mo fragmented) and enterprise CI platforms ($1,250–$8,300+/mo, opaque). Our pricing communicates:
+
+- **Pro ($199/mo):** "Less than your CRM subscription, but now you know what your competitors are doing."
+- **Growth ($499/mo):** "The cost of one junior analyst's day per month — but automated, 24/7, and AI-powered."
+- **Enterprise ($1,499/mo):** "Roughly 10% of a Crayon/Klue contract — with OSINT and API access they don't include."
+
+Month-to-month pricing carries a 10–15% premium to incentivize annual commitments and improve cash flow predictability.
+
+### 6.2 Cost Structure (Monthly Operating)
+
+| Expense | Monthly Cost | Annual Cost | Notes |
+|---------|-------------|-------------|-------|
+| Super Search infrastructure | $0 | $0 | Already running on ITPP infra |
+| Netcup VPS (production + staging) | $50 | $600 | Incremental to existing; largely absorbed |
+| Crunchbase API | $49 | $588 | Base plan; scales with Enterprise volume |
+| Hunter.io API | $34 | $408 | Base plan; scales with usage |
+| deepseek-v4-pro API calls | $200–$500 | $2,400–$6,000 | Variable; scales with customer count |
+| Stripe fees | ~2.9% + $0.30/transaction | Variable | ~3% of revenue |
+| Domain + SSL | $5 | $60 | intelsight.io |
+| Email delivery (Resend/SendGrid) | $20 | $240 | Transactional + report delivery |
+| Monitoring + logging | $30 | $360 | Basic observability |
+| **Total baseline operating cost** | **~$388–$688/mo** | **~$4,656–$8,256/yr** | |
+
+At scale (100+ customers), operating costs increase primarily with LLM API usage and Crunchbase/Hunter.io volume tiers, but remain substantially below revenue due to the high fixed-cost nature of the search infrastructure.
+
+### 6.3 Revenue Projections by Customer Count
+
+All figures assume annual contract pricing. Month-to-month customers add 10–15% to these numbers.
+
+#### Scenario: Balanced Mix (60% Pro / 30% Growth / 10% Enterprise)
+
+| Customers | Pro (60%) | Growth (30%) | Enterprise (10%) | Monthly Revenue | Annual Revenue (ARR) |
+|-----------|-----------|-------------|------------------|----------------|----------------------|
+| 10 | 6 × $199 | 3 × $499 | 1 × $1,499 | **$4,190** | **$50,280** |
+| 25 | 15 × $199 | 7.5 × $499 | 2.5 × $1,499 | **$10,475** | **$125,700** |
+| 50 | 30 × $199 | 15 × $499 | 5 × $1,499 | **$20,950** | **$251,400** |
+| 100 | 60 × $199 | 30 × $499 | 10 × $1,499 | **$41,900** | **$502,800** |
+| 200 | 120 × $199 | 60 × $499 | 20 × $1,499 | **$83,800** | **$1,005,600** |
+| 500 | 300 × $199 | 150 × $499 | 50 × $1,499 | **$209,500** | **$2,514,000** |
+
+#### Scenario: Pro-Heavy (80% Pro / 15% Growth / 5% Enterprise)
+
+This models early-stage reality before the brand commands Enterprise deals.
+
+| Customers | Monthly Revenue | Annual Revenue (ARR) |
+|-----------|----------------|----------------------|
+| 10 | $3,100 | $37,200 |
+| 50 | $15,500 | $186,000 |
+| 100 | $31,000 | $372,000 |
+| 200 | $62,000 | $744,000 |
+| 500 | $155,000 | $1,860,000 |
+
+#### Gross Margin Analysis
+
+At 50 customers (balanced mix), monthly costs of ~$600 vs. revenue of ~$20,950 yields a **gross margin of ~97%**. Even accounting for scaling LLM costs at higher volumes, margins remain above **85%** at 500+ customers.
+
+### 6.4 12-Month Revenue Ramp (Realistic Case)
+
+| Month | Customers | MRR | Cumulative Revenue | Notes |
+|-------|-----------|-----|-------------------|-------|
+| 1 | 0 | $0 | $0 | Pre-launch: build completion, beta |
+| 2 | 3 | $900 | $900 | Soft launch to ITPP network |
+| 3 | 5 | $1,500 | $2,400 | Early adopters, referral from LaunchCheck |
+| 4 | 8 | $2,350 | $4,750 | First content marketing traction |
+| 5 | 12 | $3,520 | $8,270 | First Growth-tier upgrades |
+| 6 | 16 | $4,720 | $12,990 | Community + LinkedIn push |
+| 7 | 22 | $6,490 | $19,480 | Referral flywheel begins |
+| 8 | 28 | $8,260 | $27,740 | First channel partner onboarded |
+| 9 | 35 | $10,325 | $38,065 | SEO content begins ranking |
+| 10 | 44 | $12,980 | $51,045 | First Enterprise deal |
+| 11 | 52 | $15,340 | $66,385 | Paid ads turned on (validated CAC) |
+| 12 | 60 | $17,700 | $84,085 | **Year 1 exit ARR: ~$212K** |
+
+**Key assumptions:**
+- Zero paid acquisition in months 1–6 (network + content + organic only)
+- Monthly churn rate: 3–5% (industry average for SMB SaaS is 3–7%)
+- Average revenue per customer: ~$295/mo (60/30/10 mix, shifting toward Growth over time)
+- Customer acquisition cost (CAC) after month 9: ~$250–$400
+
+---
+
+## 7. Competitive Advantages
+
+### 7.1 Why IntelSight Wins
+
+#### 1. Transparent, Accessible Pricing
+The incumbents' pricing is deliberately opaque — "book a demo," "contact sales." This is a feature of their business model (high-touch enterprise sales), not a bug. IntelSight flips this: public pricing, self-serve signup, credit card checkout. The psychological barrier of "contact sales" eliminates 90%+ of SMB buyers before they even evaluate.
+
+#### 2. OSINT Capabilities None of Them Have
+Crayon, Klue, and Kompyte focus on digital channel monitoring — website changes, social media, reviews. IntelSight adds **person-level OSINT**: automated background dossiers on competitor executives, key hires, court records, business affiliations. This is capability typically found in law enforcement and investigative tools, not commercial CI platforms. For customers doing due diligence, partnership evaluation, or competitive hiring intelligence, this is a decisive differentiator.
+
+#### 3. Crunchbase + Hunter.io Integration
+No competitor integrates real-time Crunchbase funding data and Hunter.io email discovery into a unified CI dashboard. Competitors track what's public on websites and social media; IntelSight tells you who just got funded, who their key people are, and how to reach them.
+
+#### 4. Capital Efficiency — ~80% Already Built
+Super Search v2 is production-hardened. The multi-provider search layer with circuit breakers, intelligent caching, and health monitoring is running today on IT Pro Partner infrastructure. This is not a greenfield build — it's a SaaS layer on top of proven infrastructure. Startup competitors would need 6–12 months and $100K+ to replicate just the search engine.
+
+#### 5. IT Pro Partner Credibility
+IntelSight is not a no-name startup asking businesses to trust it with strategic data. The "IntelSight is a product of IT Pro Partner" footer provides immediate credibility: an established MSP/IT services company with real infrastructure, real clients, and real operational maturity. This matters enormously in B2B SaaS, where vendor risk assessment is part of every purchase decision.
+
+#### 6. Built-in Funnel via LaunchCheck
+LaunchCheck at $49/mo captures pre-revenue founders. As those founders succeed — raise funding, hire teams, need ongoing CI — they graduate to IntelSight. This is a customer acquisition flywheel that no competitor has: capture them at the idea stage, grow with them.
+
+#### 7. LLM-Native, Not LLM-Bolted-On
+IntelSight's synthesis engine is built around LLM capabilities from the ground up — not a legacy rules engine with an AI chatbot glued on top. Reports, SWOT analyses, battle cards, and dossiers are generated directly from raw intelligence signals by the LLM, producing coherent, actionable output rather than keyword-matched alert spam.
+
+### 7.2 Competitive Positioning Map
+
+```
+                    HIGH PRICE
+                        │
+          Crayon ●      │      ● Klue
+          ($15K+)       │      ($15K+)
+                        │
+    Kompyte ●           │           ● Contify
+    (Custom)            │           (Custom)
+                        │
+────────────────────────┼────────────────────────
+     LOW CAPABILITY     │      HIGH CAPABILITY
+                        │
+                        │
+          DIY Stack ●   │
+          ($600-4K)     │     ★ IntelSight
+                        │     ($2.4K-18K)
+                        │
+          Parano.ai ●   │
+          ($1.1K)       │
+                        │
+                    LOW PRICE
+```
+
+IntelSight occupies the high-capability, low-price quadrant that is currently empty. It delivers enterprise-grade capability (OSINT, Crunchbase, Hunter.io, LLM synthesis) at SMB-accessible pricing.
+
+---
+
+## 8. Go-to-Market Strategy
+
+### 8.1 Phase 1: Foundation (Months 1–2)
+
+**Objective:** Complete build, onboard beta users, validate pricing.
+
+**Activities:**
+- Complete remaining ~385 hours of development (API layer, portal, billing, auth)
+- Recruit 5–10 beta users from IT Pro Partner's existing client base (free/discounted in exchange for feedback)
+- Set up Stripe, email infrastructure, analytics (Plausible/PostHog)
+- Launch intelsight.io landing page with waitlist
+- Produce 3–5 high-quality content pieces (comparison posts: "Crayon vs. IntelSight," "Klue Alternatives for SMBs")
+- Set up Google Search Console, submit sitemap
+
+**KPIs:**
+- Beta users: 5–10
+- Waitlist signups: 100+
+- Content pieces published: 5
+
+### 8.2 Phase 2: Soft Launch (Months 3–6)
+
+**Objective:** Convert early adopters, establish content flywheel, validate CAC.
+
+**Channels:**
+- **IT Pro Partner network:** Direct outreach to existing clients who compete in crowded markets. Warm introductions to client networks.
+- **LaunchCheck pipeline:** Email LaunchCheck users about IntelSight upgrade path. Target: 15% conversion of LaunchCheck users within 6 months of their first funding round.
+- **Content marketing:** Weekly blog posts targeting "competitive intelligence for SMB," "competitor tracking tools," "Crayon alternatives," "Klue pricing" — high-intent SEO keywords with manageable competition.
+- **LinkedIn organic:** Germaine Brown's personal brand + IT Pro Partner company page. Regular posts on competitive strategy, market intelligence tips, product updates. Target: 2–3 posts/week.
+- **Communities:** Indie Hackers, Hacker News (Show HN launch), relevant Subreddits (r/SaaS, r/smallbusiness, r/startups), Product Hunt launch.
+
+**KPIs:**
+- Paying customers: 12–16
+- MRR: $3,500–$4,700
+- Blog posts: 16–20 (4/month)
+- Organic traffic: 500–1,000 monthly visitors
+- CAC: Not yet measurable (mostly organic)
+
+### 8.3 Phase 3: Growth (Months 7–9)
+
+**Objective:** Activate referral flywheel, begin paid acquisition, close first Enterprise deal.
+
+**Channels:**
+- **Referral program:** "Give 20% off, get 20% off" — simple, proven, low-friction. Each existing customer becomes a distribution channel.
+- **Paid search:** Google Ads on competitor brand terms ("Crayon alternative," "Klue pricing," "competitive intelligence software"). Initial budget: $1,000/mo.
+- **Comparison pages:** Dedicated landing pages for "IntelSight vs. [Competitor]" — these are the highest-converting pages in B2B SaaS.
+- **Webinars:** Monthly webinar on "Competitive Intelligence for [Industry]" — 30 minutes, practical, recorded for on-demand library.
+- **Channel partnerships:** Approach 3–5 marketing agencies, fractional CMO consultancies, and business coaches who serve SMBs. Offer 20% recurring commission on referred customers.
+
+**KPIs:**
+- Paying customers: 28–35
+- MRR: $8,200–$10,300
+- Monthly organic traffic: 2,000–3,000
+- CAC (blended): $250–$350
+- First Enterprise customer
+
+### 8.4 Phase 4: Scale (Months 10–12)
+
+**Objective:** Establish predictable growth engine, expand channels, raise prices if validated.
+
+**Channels:**
+- **Outbound sales light:** One part-time SDR targeting mid-market companies in competitive verticals. Target list: 500 companies, personalized outreach.
+- **Paid social:** LinkedIn Ads targeting marketing directors, product marketing managers, and strategy leads at SMB/mid-market.
+- **Content library expansion:** Templates, playbooks, industry benchmarks — gated content for lead capture.
+- **Integrations marketplace:** Native integrations with Slack, Microsoft Teams, HubSpot, Salesforce (prioritize by customer demand).
+- **Conference presence:** Attend 2–3 industry events as attendee or small sponsor (SaaStr, B2B Marketing Exchange, etc.).
+
+**KPIs:**
+- Paying customers: 52–60
+- MRR: $15,300–$17,700
+- Annual exit ARR: ~$212,000
+- CAC (blended): $300–$400
+- LTV:CAC ratio: >5:1 (target)
+
+### 8.5 Customer Acquisition Strategy Summary
+
+| Channel | CAC Estimate | Time to Mature | Scalability | Priority |
+|---------|-------------|----------------|-------------|----------|
+| ITPP network referrals | $0–$50 | Immediate | Low (finite) | ★★★★★ |
+| LaunchCheck pipeline | $0–$25 | 3–6 months | Medium | ★★★★★ |
+| Content/SEO | $100–$300 | 6–12 months | High | ★★★★ |
+| LinkedIn organic | $0–$50 | 1–3 months | Medium | ★★★★ |
+| Referral program | $50–$150 | 6+ months | High | ★★★★ |
+| Product Hunt / HN / Reddit | $0–$50 | Immediate | Low (one-time) | ★★★ |
+| Webinars | $150–$400 | 3–6 months | Medium | ★★★ |
+| Paid search (Google) | $250–$500 | 1–2 months | High | ★★★ |
+| Channel partners | $200–$400 | 6–12 months | High | ★★ |
+| Outbound sales | $400–$800 | 1–3 months | High | ★★ |
+| Paid social (LinkedIn) | $300–$600 | 1–3 months | High | ★★ |
+
+---
+
+## 9. Risk Analysis
+
+### 9.1 Market Risks
+
+| Risk | Probability | Impact | Mitigation |
+|------|-----------|--------|------------|
+| **Market too small for meaningful returns** | Low | High | TAM of $560M growing at 12.5% CAGR. Even 0.1% market share = $560K ARR. The SMB/mid-market segment is demonstrably underserved. Revenue projections target 0.01–0.05% of TAM in Year 1 — conservative. |
+| **Enterprise incumbents move downmarket** | Medium | Medium | Crayon/Klue/Kompyte are structurally disincentivized to serve SMBs — their cost structure, sales model, and product complexity demand enterprise ACVs. If they launch "light" tiers, they risk cannibalizing their existing $50K+ deals. IntelSight has first-mover advantage in transparent SMB CI. |
+| **Economic downturn reduces SMB software spending** | Medium | Medium-High | CI becomes *more* valuable in downturns, not less — competitors get aggressive, pricing wars intensify. IntelSight's low price point is recession-resilient ($199/mo is rarely the line item cut). Multi-year contracts provide revenue stability. |
+
+### 9.2 Product Risks
+
+| Risk | Probability | Impact | Mitigation |
+|------|-----------|--------|------------|
+| **Search quality degrades (provider outages)** | Low | Low-Medium | Super Search v2 already has circuit breakers and 7-provider redundancy. If one provider fails, others take over automatically. This is production-proven. |
+| **LLM hallucinations in reports** | Medium | High | All LLM-generated content includes confidence indicators and source attribution. Enterprise tier includes human analyst review. Reports are clearly labeled as AI-generated. Hallucination detection pipeline planned for v1.1. |
+| **Multi-tenant data isolation failure** | Low | Critical | Row-level security at database layer. Tenant ID enforced at API middleware. Penetration testing before launch. Independent security audit at 100+ customers. |
+| **Feature creep slows launch** | High | Medium | Strict MVP scope enforcement. Build only the features needed to sell Pro tier first. Enterprise features in Phase 2. Launch with what works, iterate. |
+
+### 9.3 Competitive Risks
+
+| Risk | Probability | Impact | Mitigation |
+|------|-----------|--------|------------|
+| **Semrush/Kompyte launches $199 SMB tier** | Low-Medium | Medium | Semrush's DNA is SEO/marketing, not holistic CI + OSINT. They'd need to build search aggregation, Crunchbase integration, Hunter.io, and OSINT from scratch. IntelSight would have 12–18 months of market presence before a credible response. |
+| **Open-source CI tool emerges** | Medium | Low | Open-source tools lack the data integrations (Crunchbase, Hunter.io) and LLM synthesis. They require self-hosting and maintenance — the opposite of what SMBs want. IntelSight competes on convenience and integration, not just search. |
+| **AI-native startup raises VC and undercuts pricing** | Medium | Medium-High | Possible. Mitigation: move fast, lock in customers with annual contracts, build switching costs via saved searches/dossiers/historical data. First-mover advantage + ITPP credibility creates defensibility. If a VC-funded competitor emerges, IntelSight's capital-efficient model means we don't need to match their burn rate to compete. |
+
+### 9.4 Operational Risks
+
+| Risk | Probability | Impact | Mitigation |
+|------|-----------|--------|------------|
+| **Germaine bandwidth — only person who can build/support** | High | High | This is the single biggest risk. Mitigation: (1) aggressive documentation from day one, (2) identify a part-time contractor for support within 3 months of launch, (3) build self-serve onboarding that minimizes support burden, (4) consider a technical co-founder or first engineering hire at $10K MRR. |
+| **deepseek-v4-pro API changes or price increases** | Low-Medium | Medium | LLM abstraction layer in the architecture allows provider switching. Claude, GPT-4o, and open-source models (via Groq/Together) are fallbacks. Multi-model capability should be built into v1.1. |
+| **Crunchbase or Hunter.io API deprecation or price changes** | Low | Medium | Both have stable, long-standing APIs. Crunchbase has been API-first for years. Alternatives exist: PitchBook (pricier), Apollo.io (Hunter.io alternative). Monitor API changelogs and maintain abstraction layers. |
+| **Stripe account issues (holds, reserves, fraud disputes)** | Low | Medium | Standard SaaS risk. Maintain separate Stripe account from IT Pro Partner main account. Implement clear refund policy (30-day money-back guarantee). Fraud detection rules for signups from high-risk regions. |
+
+### 9.5 Regulatory & Compliance Risks
+
+| Risk | Probability | Impact | Mitigation |
+|------|-----------|--------|------------|
+| **OSINT data collection legality** | Low | High | All OSINT data is collected from publicly available sources. No scraping of login-protected content. Privacy policy clearly discloses data sources and usage. Compliance with GDPR/CCPA for data handling. Legal review of OSINT dossier templates before launch. |
+| **GDPR / data privacy regulations** | Low-Medium | Medium | Data minimization — only store what's needed. EU customer data stays on EU infrastructure. Privacy policy and data processing agreement (DPA) available. Cookie consent where required. |
+
+---
+
+## 10. Financial Projections
+
+### 10.1 12-Month P&L Projection (Realistic Case)
+
+| Line Item | Month 1–3 | Month 4–6 | Month 7–9 | Month 10–12 | Year 1 Total |
+|-----------|-----------|-----------|-----------|-------------|-------------|
+| **Revenue** | | | | | |
+| MRR (end of period) | $1,500 | $4,720 | $10,325 | $17,700 | — |
+| Cumulative Revenue | $2,400 | $12,990 | $38,065 | $84,085 | **$84,085** |
+| **Cost of Revenue** | | | | | |
+| Infrastructure + APIs | $1,200 | $1,800 | $2,400 | $3,000 | $8,400 |
+| LLM API costs | $600 | $1,500 | $3,000 | $4,500 | $9,600 |
+| Stripe fees (~3%) | $72 | $390 | $1,142 | $2,523 | $4,127 |
+| **Total COGS** | **$1,872** | **$3,690** | **$6,542** | **$10,023** | **$22,127** |
+| **Gross Profit** | **$528** | **$9,300** | **$31,523** | **$74,062** | **$61,958** |
+| _Gross Margin_ | _22%_ | _72%_ | _83%_ | _88%_ | _74%_ |
+| **Operating Expenses** | | | | | |
+| Development (remaining build) | $15,000 | $10,000 | $5,000 | $2,500 | $32,500 |
+| Content marketing | $1,500 | $3,000 | $3,000 | $3,000 | $10,500 |
+| Paid acquisition | $0 | $0 | $3,000 | $6,000 | $9,000 |
+| Tools + software | $300 | $300 | $500 | $500 | $1,600 |
+| Legal + compliance | $2,000 | $0 | $0 | $2,000 | $4,000 |
+| Miscellaneous | $500 | $500 | $750 | $1,000 | $2,750 |
+| **Total OpEx** | **$19,300** | **$13,800** | **$12,250** | **$15,000** | **$60,350** |
+| **Net Income** | **-$18,772** | **-$4,500** | **$19,273** | **$59,062** | **$1,608** |
+| _Net Margin_ | _Negative_ | _Negative_ | _51%_ | _70%_ | _2%_ |
+
+**Key observations:**
+- Year 1 is effectively break-even on a cumulative basis
+- The business becomes meaningfully profitable by Month 7 (MRR covers all OpEx + COGS)
+- Exit run-rate in Month 12: ~$212K ARR with ~88% gross margins
+- Total Year 1 investment (net of revenue): approximately **-$22K in months 1–6**, fully recovered by month 9
+
+### 10.2 3-Year Projection
+
+| | Year 1 | Year 2 | Year 3 |
+|---|--------|--------|--------|
+| **Customers (end of year)** | 60 | 200 | 500 |
+| **ARR (end of year)** | $212,000 | $750,000 | $2,000,000 |
+| **Total Revenue** | $84,085 | $550,000 | $1,500,000 |
+| **Gross Margin** | 74% (ramping) | 87% | 89% |
+| **OpEx** | $60,350 | $180,000 | $400,000 |
+| **Net Income** | $1,608 | $298,500 | $935,000 |
+| **Net Margin** | 2% | 54% | 62% |
+
+**Year 2 assumptions:**
+- 200 customers (3.3x growth)
+- First full-time hire: customer success / support ($60K–$80K)
+- Part-time SDR or agency outbound ($30K–$40K)
+- Content marketing investment increases
+- LLM costs optimized (caching, model routing)
+
+**Year 3 assumptions:**
+- 500 customers (2.5x growth)
+- Small team: 2–3 full-time (engineering, support, sales)
+- Brand recognition drives organic inbound
+- API revenue from Enterprise tier becomes meaningful
+- Potential channel partnership revenue
+
+### 10.3 Unit Economics (Steady State)
+
+| Metric | Value | Industry Benchmark | Assessment |
+|--------|-------|-------------------|------------|
+| Average MRR per customer | ~$295 | $100–$500 (SMB SaaS) | Healthy |
+| Annual contract value (ACV) | ~$3,540 | $1,200–$6,000 | Strong for SMB |
+| Gross margin | 85–89% | 70–80% (good SaaS) | Excellent |
+| Monthly churn | 3–4% | 3–7% (SMB SaaS) | Target: <3% |
+| Customer lifetime (months) | 25–33 | 14–33 | Good |
+| LTV | ~$7,375–$9,735 | — | — |
+| CAC (blended) | $250–$400 | $200–$1,000 | Excellent |
+| LTV:CAC ratio | 18:1 to 39:1 | >3:1 (good) | Outstanding |
+| CAC payback period | ~1–2 months | <12 months (good) | Exceptional |
+
+The unit economics are extraordinarily favorable because:
+1. **Near-zero marginal cost of delivery** — the search infrastructure is fixed-cost
+2. **Low CAC** — network effects (ITPP, LaunchCheck, referrals) dominate early acquisition
+3. **Annual contracts** — reduce churn, improve cash flow predictability
+
+### 10.4 Capital Requirements
+
+IntelSight is designed to be **capital-efficient from day one**:
+
+| Item | Cost | Notes |
+|------|------|-------|
+| Remaining development (~385 hours) | $0 | Built by Germaine / internal team |
+| Initial infrastructure setup | $500 | Domain, SSL, minor VPS adjustments |
+| Legal (terms, privacy policy, incorporation review) | $3,000–$5,000 | One-time |
+| Content marketing (first 6 months) | $3,000–$5,000 | Writers, tools |
+| Design (logo, brand, landing page) | $2,000–$4,000 | One-time |
+| Stripe + tools (first 6 months) | $1,000–$2,000 | Ongoing, covered by early revenue |
+| **Total initial outlay** | **$9,500–$16,500** | |
+
+This is not a venture-scale capital ask. The primary investment is **Germaine's time** — approximately 385 hours of development to complete the SaaS layer, plus ongoing content, sales, and support effort.
+
+---
+
+## 11. The Ask
+
+### 11.1 What We Need to Launch
+
+| Resource | Details | Timeline |
+|----------|---------|----------|
+| **Development capacity** | ~385 hours to build API layer, portal, billing, auth | Months 1–2 |
+| **Legal review** | Terms of service, privacy policy, data processing agreement, OSINT compliance review | Month 1 |
+| **Brand identity** | Logo, color system, landing page design, email templates | Month 1 |
+| **Content writer** | 4–8 blog posts for launch; ongoing 1–2/week | Month 1, ongoing |
+| **Beta testers** | 5–10 ITPP clients willing to provide feedback | Month 2 |
+| **Go-to-market execution** | Germaine's time for content, LinkedIn, community engagement, sales conversations | Ongoing (5–10 hrs/week) |
+| **Part-time support** | Customer support contractor (at $5K MRR) | Month 4–6 |
+| **Initial operating capital** | ~$10,000–$16,500 for one-time setup costs | Month 1 |
+
+### 11.2 Immediate Decisions Required
+
+1. **Approval to brand IntelSight as a standalone product** under IT Pro Partner ("IntelSight is a product of IT Pro Partner") — maintaining ITPP credibility while allowing IntelSight to develop its own market identity
+2. **Confirmation of pricing model** — are $199/$499/$1,499 the right anchor points? Should month-to-month premium be 10%, 15%, or 20%?
+3. **Resource allocation** — confirmation that Germaine can dedicate ~385 hours to the build, plus ongoing GTM effort
+4. **Launch timeline** — target soft launch in Month 3 (late October 2026)
+5. **Legal entity structure** — does IntelSight operate as a division of IT Pro Partner, or as a separate LLC with ITPP as parent? This affects liability, accounting, and eventual exit options
+
+### 11.3 What Success Looks Like (Month 12)
+
+- **60 paying customers** across Pro, Growth, and Enterprise tiers
+- **~$212,000 ARR** with 88% gross margins
+- **3–5 Enterprise customers** validating the high-end pricing
+- **Content library** of 50+ articles ranking for CI-related search terms
+- **Referral program** generating 15%+ of new customers
+- **LaunchCheck pipeline** converting at 10–15%
+- **Team:** Germaine + 1 part-time support contractor
+- **Option value:** At 10x ARR multiple (conservative for B2B SaaS), the business would be valued at ~$2.1M — built for a ~$15K initial investment
+
+### 11.4 The Bigger Picture
+
+IntelSight is not just a product — it's a strategic asset for IT Pro Partner. It demonstrates technical sophistication beyond traditional MSP services, creates a recurring revenue stream independent of services billing, and positions IT Pro Partner as a technology company, not just a services company.
+
+In a market where established players charge $50,000/year for less capability, IntelSight's combination of transparent pricing, superior OSINT capability, and capital-efficient infrastructure is not merely competitive — it's disruptive. The question is not whether this market exists. It's whether we move fast enough to capture it.
+
+---
+
+## Appendix A: Competitor Pricing Deep Dive
+
+| Platform | Pricing Model | Entry Annual Cost | Enterprise Annual Cost | Transparent? | Free Trial |
+|----------|--------------|-------------------|------------------------|-------------|------------|
+| **Crayon** | Custom, sales-led | ~$15,000–$16,000 | $50,000–$100,000+ | No | Demo only |
+| **Klue** | Quote-based, per-seat | ~$15,000–$20,000 | $100,000–$200,000+ | No | Demo only |
+| **Kompyte** | Custom (Semrush bundle) | ~$8,000–$12,000 (est.) | Custom | No | Demo only |
+| **Contify** | Custom, quote-based | ~$10,000–$15,000 (est.) | Custom | No | Demo only |
+| **Parano.ai** | Public, tiered | ~$1,068 (€89/mo) | €249/mo (~$3,200/yr) | Yes | 7-day trial |
+| **Semrush .Trends** | Add-on to Semrush | $3,468 ($289/mo add-on) | $3,468+ | Yes | 7-day trial |
+| **IntelSight** | Public, tiered | **$2,388 ($199/mo)** | **$17,988+ ($1,499/mo)** | **Yes** | **14-day trial** |
+
+## Appendix B: API and Data Source Costs
+
+| Service | Plan | Monthly Cost | Annual Cost | Limits |
+|---------|------|-------------|-------------|--------|
+| Crunchbase API | Basic | $49 | $588 | 50,000 API calls/mo, basic company/people data |
+| Hunter.io | Growth | $34 | $408 | 500 email lookups/mo (shared across tenants) |
+| deepseek-v4-pro | Pay-per-token | $200–$500 (est.) | $2,400–$6,000 | Variable; scales with customer count |
+| Super Search v2 | Internal | $0 | $0 | Already running on ITPP infrastructure |
+| Netcup VPS | Existing infra | $0 (absorbed) | $0 | Existing ITPP servers |
+
+## Appendix C: Glossary
+
+| Term | Definition |
+|------|-----------|
+| **ARR** | Annual Recurring Revenue — the annualized value of subscription contracts |
+| **MRR** | Monthly Recurring Revenue |
+| **CAC** | Customer Acquisition Cost — total sales & marketing spend / new customers acquired |
+| **LTV** | Lifetime Value — average revenue per customer over their lifetime |
+| **TAM** | Total Addressable Market — the total market demand for the product |
+| **SAM** | Serviceable Addressable Market — the portion of TAM reachable by the product |
+| **SOM** | Serviceable Obtainable Market — the portion of SAM realistically capturable |
+| **OSINT** | Open Source Intelligence — intelligence gathered from publicly available sources |
+| **CI** | Competitive Intelligence — the systematic collection and analysis of competitor information |
+| **MCP** | Model Context Protocol — the protocol used by Super Search v2 for AI integration |
+
+---
+
+**Document prepared by:** IntelSight Product Division, IT Pro Partner  
+**Contact:** Germaine Brown  
+**Classification:** Confidential — For Advisory Team Review Only  
+**Version:** 1.0 — July 25, 2026

projects/schoolcart.md

@@ -0,0 +1,662 @@
+# SchoolCart Business Proposal
+
+**Prepared for:** Germaine Brown & Advisory Team  
+**Date:** July 27, 2026  
+**Company:** IT Pro Partner — Product Division  
+**Product:** SchoolCart (Working Title — formerly shopping.iamgmb.com)  
+**Classification:** Confidential — Advisory Review
+
+---
+
+## Table of Contents
+
+1. [Executive Summary](#1-executive-summary)
+2. [Elevator Pitch](#2-elevator-pitch)
+3. [Problem Statement](#3-problem-statement)
+4. [Market Analysis](#4-market-analysis)
+5. [Product Overview](#5-product-overview)
+6. [Revenue Model](#6-revenue-model)
+7. [Competitive Advantages](#7-competitive-advantages)
+8. [Go-to-Market Strategy](#8-go-to-market-strategy)
+9. [Risk Analysis](#9-risk-analysis)
+10. [Financial Projections](#10-financial-projections)
+11. [The Ask](#11-the-ask)
+
+---
+
+## 1. Executive Summary
+
+SchoolCart turns any school supply list PDF into a one-click Amazon cart — saving parents 2–3 hours of manual shopping, stores, and frustration. The parent uploads the PDF, the system parses 45+ line items, matches each to an Amazon ASIN, and returns a pre-filled cart link. One click buys everything. SchoolCart earns Amazon Associates commission on every purchase plus optional service fees for premium features.
+
+Every year, **54 million K-12 students** in the US receive supply lists. Their parents collectively spend **$3.8 billion** on school supplies. Most of this spend happens in the 6-week back-to-school window (July–August), fought in crowded Walmart and Target aisles or through tedious manual Amazon searches. The current alternatives — prepackaged kits ($60–$90, limited items), store-hopping, or item-by-item Amazon searching — all leave parents frustrated, overspent, or both.
+
+SchoolCart already works. The core pipeline — PDF upload, item parsing, Amazon ASIN matching, cart URL generation, and email delivery — is built and tested on a live 45-item supply list. The system correctly parsed 45 items, matched all to Amazon ASINs, and generated a functional cart URL carrying the `itpropartner-20` Associate Tag. What's missing is the payment gating (Stripe to unlock the cart link), subscription tiers, and customer-facing branding.
+
+The numbers are straightforward. At **$4.99 per cart** (impulse-buy price), converting just **0.1% of the 54 million students' parents** yields **$2.7M/year in service fees** plus **$50K–$150K in Amazon Associates commissions**. Even at 1,000 paid carts per back-to-school season, that's **$5K in service fees + $500–$1.5K in commissions** with near-zero marginal cost — a capital-efficient micro-SaaS that funds itself from day one.
+
+This proposal outlines the market opportunity, product architecture, revenue model, go-to-market plan, and what's needed to ship before the 2027 back-to-school season.
+
+---
+
+## 2. Elevator Pitch
+
+School supply season sucks. You get a list with 45 random items, fight Walmart crowds for 2 hours, and still forget the pink erasers. SchoolCart fixes it: upload your kid's supply list PDF, we turn it into a one-click Amazon cart in 20 seconds, and everything shows up at your door. No store trips, no missed items. Name your kid's cart, get the right brand every time. $4.99 gets you a link. $9.99 gets you a perfect cart with your kid's name on it. $19.99 covers the whole family all year.
+
+---
+
+## 3. Problem Statement
+
+### 3.1 The Back-to-School Shopping Nightmare
+
+The school supply ritual is broken. Every summer, 54 million K-12 parents receive a supply list — typically a PDF or paper handout listing 30–60 specific items: "4 packages Ticonderoga pencils only," "1 box Kleenex (Girls Only)," "1 roll of paper towels (Boys Only)," "Spray Sunscreen," "plastic spoons and forks," "Water Color Paints (Label with name)," "3 composition notebooks (wide-ruled)," and so on.
+
+These lists are:
+- **Highly specific** — wrong brand/broken sharpeners/Ticonderoga pencils only
+- **Balkanized** — different lists for Boys vs. Girls, different items per teacher
+- **Time-sensitive** — must buy before school starts, often on a tight timeline
+- **Large** — 30–60 items, each requiring its own search and decision
+
+### 3.2 How Parents Currently Solve It
+
+| Method | Time Cost | Money Cost | Pain Level |
+|--------|-----------|------------|------------|
+| **Walmart/Target trip** | 2–3 hours + driving | Retail price + impulse buys | 🔴 High — crowds, out-of-stocks, multiple stores |
+| **Manual Amazon search** | 1–2 hours | Online price + Prime shipping | 🟡 Medium — tedious, 45 individual searches/orders |
+| **Prepackaged school kit** | 10 minutes | $60–$90 (50–100% markup) | 🟢 Low but expensive and often incomplete — "kit has generic pencils, teacher wants Ticonderoga" |
+| **Spreadsheet + store comparison** | 3–5 hours | Optimized but insane time cost | 🔴 High — only organized parents attempt this |
+| **Sibling hand-me-downs** | Varies | $0 but incomplete | 🟡 Medium — works for some items, not all |
+
+### 3.3 The Gap SchoolCart Fills
+
+**No tool exists** that takes a raw school supply list PDF and produces a complete, accurate, one-click Amazon cart. The existing services (TeacherLists, SchoolSupplyBox, etc.) sell prepackaged kits — you get what they decided to bundle, not what the teacher actually asked for. And no one solves the core friction: matching a 45-item PDF to Amazon ASINs automatically.
+
+SchoolCart is the only service that:
+1. **Parses the actual PDF** — line items, quantities, notes, gendered items
+2. **Matches each item to the right Amazon ASIN** — "Ticonderoga pencils" not "any pencils"
+3. **Generates a complete cart** — one click buys everything
+4. **Earns commission** — Amazon Associates tag built into every cart
+5. **Delivers it** — email the link, done
+
+---
+
+## 4. Market Analysis
+
+### 4.1 Total Addressable Market (TAM)
+
+| Metric | Value | Source |
+|--------|-------|--------|
+| K-12 students in US | ~54 million | NCES (2024) |
+| Households with school-age children | ~36 million | Census (2024) |
+| Average annual school supply spend per student | ~$70 | Deloitte Back-to-School Survey 2024 |
+| **Total annual school supply spend** | **~$3.8 billion** | National Retail Federation 2024 |
+| Back-to-school retail season total | ~$41.5 billion (clothing + supplies + electronics) | NRF 2024 |
+| Online share of back-to-school shopping | ~57% (growing) | Deloitte 2024 |
+
+**TAM (Service fees):** 36M households × potential $4.99–$9.99 per list = **$180M–$360M/year** if every household used a paid cart service.
+
+**TAM (Commissions):** $3.8B supply spend × 4% average Amazon Associates commission = **$152M/year** addressable commission pool.
+
+### 4.2 Serviceable Addressable Market (SAM)
+
+SchoolCart targets English-speaking US households with school-age children who already shop online for school supplies.
+
+| Parameter | Value | Methodology |
+|-----------|-------|-------------|
+| Online shoppers among school households | ~57% (20.5M households) | Deloitte 2024 |
+| Would use a list-to-cart service | ~15% of online shoppers (3.1M households) | Conservative — comparable to meal-kit adoption rates |
+| Average annual spend per household | ~$150 (1–2 students) | NRF 2024 |
+| **SAM (service fees)** | **3.1M × $4.99 = ~$15.5M/year** | If every household used paid once |
+| **SAM (commissions)** | 3.1M × $150 × 4% = **~$18.6M/year** | If all online spend captured |
+
+### 4.3 Serviceable Obtainable Market (SOM)
+
+| Year | SOM (Carts) | SOM (Revenue) | Methodology |
+|------|-------------|---------------|-------------|
+| Year 1 (2027 BTS) | 500–2,000 | $2,500–$10,000 (service) + $500–$4,000 (commission) | Facebook groups, organic, ITPP network. Beta in 2026, full launch for 2027 BTS season |
+| Year 2 (2028 BTS) | 5,000–15,000 | $25,000–$75,000 (service) + $5,000–$30,000 (commission) | Word-of-mouth, school/PTA plans, SEO |
+| Year 3 (2029 BTS) | 20,000–50,000 | $100,000–$250,000 (service) + $20,000–$100,000 (commission) | PTA partnerships, brand awareness, paid acquisition |
+
+**Key reality:** This is a **seasonal business**. 80%+ of annual revenue happens in July–August. The rest of the year, the service sits idle unless we expand to other list types (holiday wish lists, team sports equipment lists, college dorm lists).
+
+### 4.4 Competitive Landscape
+
+| Competitor | What they do | Price | SchoolCart Advantage |
+|------------|-------------|-------|---------------------|
+| **TeacherLists.com** | Prepackaged school supply kits, teacher creates list, kits shipped to school | $60–$90/kit (marked up) | SchoolCart lets parents buy what's actually on the list, not a pre-bundled kit. Kits only include ~30 items; real lists have 45+. And you wait 2–3 weeks for kit delivery. |
+| **SchoolSupplyBox.com** | Same model as TeacherLists — prepackaged kits | $50–$80/kit | Same limitations. Parent has no control over brands or substitutions. |
+| **Amazon Back-to-School Store** | Curated category pages, not list-specific | Retail price + Prime | Manual — parent still has to search 45 items individually. No list auto-import. |
+| **Walmart + Target BTS aisles** | In-store shopping + pickup | Retail | Requires physical trip, out-of-stocks, 2–3 hours. SchoolCart is one click from home. |
+| **DIY Spreadsheet** | Parent creates their own shopping list, searches manually | $0 (time cost) | SchoolCart automates the entire matching process. 45 items in 20 seconds vs. 1–2 hours. |
+| **PTA/PTO kit programs** | Volunteers assemble kits, school fundraiser | $50–$90 + fundraiser margin | Limited. Kits are what the PTA decided to include, not your teacher's specific list. |
+
+**No direct competitor exists** that takes an arbitrary school supply list PDF and produces a live Amazon cart. The prepackaged kit model (TeacherLists, SchoolSupplyBox) is the closest, but it's a fundamentally different product — you get what they bundled, not what the teacher asked for. SchoolCart is the first **list-to-cart** service for school supplies.
+
+---
+
+## 5. Product Overview
+
+### 5.1 Architecture
+
+```
+┌──────────────────────────────────────────────────┐
+│           User Uploads PDF (shopping.iamgmb.com)  │
+│           Upload page + Stripe checkout            │
+├──────────────────────────────────────────────────┤
+│              FastAPI Backend (Python)               │
+│   PDF parsing (PyMuPDF) → Item extraction           │
+│   Amazon ASIN matching → Cart URL generation         │
+│   Email delivery (SMTP via MXroute)                  │
+├──────────────────────────────────────────────────┤
+│     Already built ↓    │      To build ↓           │
+├──────────────────────────────────────────────────┤
+│  PDF parser (proven)   │  Stripe payment gating     │
+│  Amazon search (36/45  │  Subscription tiers        │
+│    matched in test)    │  School/PTA portal         │
+│  Cart URL generator    │  User accounts/auth        │
+│  Email delivery (SMTP) │  Cart preview page         │
+│  Associate tag wiring  │  Order history / receipts  │
+│                        │  Analytics dashboard       │
+└──────────────────────────────────────────────────┘
+```
+
+**Infrastructure:**
+| Component | Status | Location |
+|-----------|--------|----------|
+| Backend (FastAPI) | **Built** | netcup VPS — port 8101, systemd `shopping-cart` |
+| Frontend (static HTML) | **Built** | served by FastAPI at `/` |
+| PDF parser | **Built** | PyMuPDF, bullet normalization, 45-item test passed |
+| Amazon search | **Built** | 5-second delay, direct Amazon scraping |
+| Cart URL generator | **Built** | Amazon cart/add.html with AssociateTag |
+| Email delivery | **Built** | SMTP via MXroute, shonuff@germainebrown.com |
+| Caddy reverse proxy | **Built** | shopping.iamgmb.com → 127.0.0.1:8101 |
+| **Stripe payment** | **To build** | ~8 hours |
+| **User accounts** | **To build** | ~12 hours |
+| **Subscription tiers** | **To build** | ~16 hours |
+| **School/PTA portal** | **To build** | ~40 hours |
+| **Cart preview** | **To build** | ~8 hours |
+| **Analytics** | **To build** | ~4 hours |
+
+### 5.2 How It Works (Current Flow)
+
+1. Parent visits **shopping.iamgmb.com**
+2. Uploads their child's school supply list PDF
+3. System parses the PDF — extracts line items, quantities, special notes
+4. Each item is searched on Amazon → best ASIN match found
+5. System generates a single Amazon cart URL with all matched items
+6. Cart URL is delivered to the parent's email
+7. Parent clicks → Amazon cart opens with all items pre-loaded
+8. Parent reviews, adjusts, checks out — **Amazon Associates commission earned**
+
+### 5.3 Tier Structure
+
+#### Quick Cart — $4.99 per order
+
+**Target:** Parents who just want this one list done
+
+**Features:**
+- Upload any school supply list PDF
+- Full item parsing + Amazon ASIN matching (single pass)
+- Complete cart URL delivered by email
+- All items on one Amazon cart
+- Amazon Associate tag tracking
+
+#### Premium Cart — $9.99 per order
+
+**Target:** Parents who want it done right — better matching, no second-guessing
+
+**Features:**
+- Everything in Quick Cart
+- **Name your cart** — "Johnny's 6th Grade Cart," "Becky's 4th Grade Cart" — email arrives with your kid's name on it
+- **Multi-pass ASIN matching** — 3+ search variants per item, picks the best match
+- **Brand-specific matching** — "Ticonderoga pencils" matches to Ticonderoga, not generic
+- **Out-of-stock handling** — suggests the closest substitute if the exact item is unavailable
+- **Unmatched item alerts** — flags items that couldn't be matched with a suggested alternative
+- **Priority processing** — same-day delivery (vs. next-day on Quick Cart)
+- **Priority support** — SMS + email, not just email
+
+#### Family Pass — $19.99/year
+
+**Target:** Parents with multiple children, or parents who want it on autopilot year after year
+
+**Features:**
+- All Premium features for every cart
+- **Unlimited lists for the entire household** — all kids, all grades, all schools
+- **Saved student profiles** — Johnny (6th grade, STEM Academy), Becky (4th grade, STEM Academy)
+- **Named carts** auto-saved to the dashboard — view, re-order, or share last year's list
+- **One-click reorder** for next school year — items changed? System flags the differences, same cart
+- **Price comparison** — see how much each item changed from last year
+- **Auto-reminder** — email when new school year lists are available
+- Pay for two kids' Quick Carts ($9.98) and the Family Pass already saves you money
+
+#### School/PTA Plan — FREE (Distribution Channel)
+
+**Target:** PTA/PTO organizations, school districts
+
+**The model:** SchoolPlan is **not a revenue tier** — it's a **distribution channel**. The school doesn't pay. Instead, SchoolCart **donates $1 to the PTA** for every cart purchased through the school's portal.
+
+**What the school/PTA gets (free):**
+- All class supply lists pre-loaded — teachers upload once, all parents get carts
+- Branded parent portal — `garrisonschool.schoolcart.com`
+- Bulk email tool — one click sends every parent their personalized cart link
+- Teacher portal — Mrs. Smith types her list, updates auto-push to parents
+- **$1 per cart donated to the PTA** — zero-effort fundraiser
+
+**What SchoolCart gets:**
+- Warm endorsement — the school emails all parents, posts in the Facebook group
+- Trust — "from the school" beats "random website I found" every time
+- Distribution — the PTA does the marketing for free
+
+**Comparison:**
+
+| Model | School Says Yes? | Distribution | Revenue |
+|-------|-----------------|-------------|---------|
+| $199/yr subscription | 🤷 "Maybe — need board approval" | Weak — one portal link on school website | $199 |
+| **Free + $1 donation per cart** | ✅ "Yes, free money for us" | Strong — PTA emails all parents, posts in FB group | $0 upfront, $1–$500+ in donations |
+
+---
+
+## 6. Revenue Model
+
+### 6.1 Revenue Streams
+
+| Stream | Source | Margin |
+|--------|--------|--------|
+| **Service fees** | $4.99/$9.99 per cart, $19.99/yr family pass, $1/cart PTA donation (school plan) | ~95% (near-zero marginal cost) |
+| **Amazon Associates commission** | 1–10% of cart total | ~100% on top of service fees |
+| **School/PTA sponsorships** | Premium listing, featured placement | Negotiable |
+| **Affiliate upsells** | Recommended items (lunchboxes, backpacks, labeled items) | Commission-based |
+
+### 6.2 Pricing Rationale
+
+| Tier | Price | Why |
+|------|-------|-----|
+| **Quick Cart** | $4.99 | Impulse-buy threshold. A latte. Parents will pay $5 to skip a 2-hour Walmart trip without thinking. |
+| **Premium Cart** | $9.99 | Name the cart, multi-pass matching, brand-specific, OOS handling, priority support. For the parent who wants "done right." |
+| **Family Pass** | $19.99/yr | All kids, all year, every cart named and saved. Two kids' Quick Carts = $9.98. This is $10 more for unlimited all year. Yearly needs weight — $19.99 feels like a real membership, not a coupon. |
+| **School Plan** | FREE | Distribution channel, not a revenue tier. School gets a branded portal and $1/cart donated to the PTA. SchoolCart gets warm endorsement and free marketing. |
+
+### 6.3 Cost Structure
+
+| Expense | Monthly Cost | Notes |
+|---------|-------------|-------|
+| Netcup VPS (shopping-cart) | $0 (absorbed) | Running on existing ITPP infrastructure |
+| Amazon scraper bandwidth | $0 | 5-second delay, low volume at launch |
+| SMTP (MXroute) | $0 (existing) | Already paid for ITPP email |
+| Domain (shopping.iamgmb.com) | $0 (existing) | Owned by Germaine |
+| Stripe fees | 2.9% + $0.30/txn | ~$0.45 per $4.99 cart |
+| New domain (target .com) | ~$12/year | Cloudflare cost |
+| **Total baseline** | **~$0–$12/mo** | Near-zero operating cost |
+
+### 6.4 Revenue Projections
+
+#### Scenario: Back-to-School Season Only (80% of annual revenue in July–August)
+
+| Carts Sold | Service Revenue | Est. Commission (avg $70 cart × 4%) | Total Revenue |
+|-----------|----------------|--------------------------------------|---------------|
+| 500 | $2,495 | $1,400 | **$3,895** |
+| 2,000 | $9,980 | $5,600 | **$15,580** |
+| 5,000 | $24,950 | $14,000 | **$38,950** |
+| 10,000 | $49,900 | $28,000 | **$77,900** |
+| 50,000 | $249,500 | $140,000 | **$389,500** |
+
+#### Realistic 3-Year Ramp
+
+| | Year 1 (2027) | Year 2 (2028) | Year 3 (2029) |
+|---|--------------|--------------|--------------|
+| **BTS season carts** | 500–2,000 | 5,000–15,000 | 20,000–50,000 |
+| **Service revenue** | $2.5K–$10K | $25K–$75K | $100K–$250K |
+| **Commission revenue** | $0.5K–$4K | $5K–$30K | $20K–$100K |
+| **School partners** | 0–2 | 10–25 | 30–100 |
+| **School cart donations ($1/cart)** | $0–$500 | $1K–$3K | $3K–$10K |
+| **Family Passes** | 0–50 | 500–2,000 | 2,500–10,000 |
+| **Family Pass revenue** | $0–$1K | $10K–$40K | $50K–$200K |
+| **Total Annual Revenue** | **$3K–$15.5K** | **$41K–$148K** | **$173K–$560K** |
+| **Gross Margin** | 90–95% | 92–95% | 93–97% |
+
+---
+
+## 7. Competitive Advantages
+
+### 7.1 Why SchoolCart Wins
+
+#### 1. First Mover in List-to-Cart for School Supplies
+TeacherLists and SchoolSupplyBox sell *prepackaged kits* — someone decides what goes in the box, not the teacher who wrote the list. SchoolCart is the only service that takes the actual PDF and says "this is exactly what your teacher wants, here's a cart." This is a fundamentally different product.
+
+#### 2. Amazon Associates Pipeline
+Every cart carries an Associate Tag. Even if the parent only pays $4.99, SchoolCart earns commission on everything in the cart — potentially $2–$6 per cart on top of the service fee. Over 5,000 carts, that's $10K–$30K in passive commission revenue. No one else does this because no one else builds the cart.
+
+#### 3. Zero-Marginal-Cost Infrastructure
+The entire service runs on existing ITPP infrastructure — the same VPS that already runs backup, monitoring, and other services. There is no Heroku bill, no AWS burn, no startup operating cost. SchoolCart can be profitable at 1 sale/day.
+
+#### 4. Speed of Iteration
+Built and tested in a weekend. The full pipeline works — PDF → parse → match → cart → email. No other team can do this in the time we can. A startup would need 2–3 months and $10K+ to replicate what's already running.
+
+#### 5. Seasonal Timing Advantage
+The 2026 back-to-school season is already upon us. A startup would miss this window. SchoolCart can soft-launch for 2026 and dominate 2027.
+
+### 7.2 Competitive Positioning Map
+
+```
+                   HIGH PRICE
+                       │
+      Prepackaged ●    │
+      Kits ($60-90)    │
+                       │
+                       │
+───────────────────────┼───────────────────────
+   LOW CONVENIENCE     │     HIGH CONVENIENCE
+                       │
+                       │
+      Walmart/Target ● │
+      (2-3 hours)      │      ★ SchoolCart
+                       │      ($5-10 + commission)
+       Manual Amazon ● │
+       (1-2 hours)     │
+                   LOW PRICE
+```
+
+SchoolCart occupies the **high-convenience, low-price quadrant** that is currently empty. Prepackaged kits are more expensive and less flexible. Stores are cheaper but time-costly. SchoolCart is the only option that's both cheap and convenient.
+
+---
+
+## 8. Go-to-Market Strategy
+
+### 8.1 Phase 0: Soft Launch (August 2026)
+
+**Objective:** Validate pipeline with real parents during the current back-to-school season.
+
+**Tactic:**
+- shopping.iamgmb.com stays as free tier (no payment yet)
+- Share link in Facebook parent groups, PTA Facebook groups
+- Goal: 20–50 real parents use the service, provide feedback on ASIN matching quality
+- Collect emails for 2027 BTS launch
+
+### 8.2 Phase 1: Foundation (September 2026 – April 2027)
+
+**Objective:** Build payment system, polish matching, prepare for 2027 BTS season.
+
+**Activities:**
+- Build Stripe checkout for $4.99/$9.99 cart unlock + $19.99/yr Family Pass subscription
+- Improve ASIN matching — multiple search attempts, brand-specific matching
+- Build cart preview page (show matched items before asking for payment)
+- Set up branded domain and landing page (cartmylist.com or similar)
+- Write 5–10 SEO articles: "2027 School Supply List Guide," "Best School Supplies on Amazon," "How to Save Money on School Supplies"
+- Recruit 50 beta testers from ITPP client network (free service, feedback required)
+- Build school contact list — email PTA/PTO presidents, principals
+
+### 8.3 Phase 2: Launch (May–August 2027)
+
+**Objective:** Capture 80% of annual revenue in the 8-week BTS window.
+
+**Channels:**
+
+| Channel | Tactics | Cost | Expected Carts |
+|---------|---------|------|---------------|
+| **Facebook parent groups** | Every school, town, and grade-level parent group. Post "Upload your kid's supply list → get a one-click Amazon cart." DM group admins for permission. | $0 (time) | 200–500 |
+| **Facebook/Instagram ads** | Target: parents of K-12 kids, interest: "school," "PTA," "teacher," "Amazon Prime." Creative: 30-second video of PDF upload → cart in 10 seconds. | $500–$2,000 | 500–2,000 |
+| **Amazon Associate influencer** | Mom bloggers, teacher influencers, back-to-school YouTubers. Affiliate offer: 20% commission on cart fees from their referral. | 20% commission share | 200–1,000 |
+| **PTA partnership outreach** | Direct email to 500+ PTA presidents: "Offer SchoolCart to your parents as a free fundraiser — SchoolCart donates $1/cart to your PTA." Email list from PTA.org directory. | $0 | 500–2,000 |
+| **School email blasts** | Partner with 5–10 schools to include SchoolCart link in their BTS newsletter. Offer: free service for that school's parents in exchange for being the exclusive provider. | $0 (revenue share) | 200–1,000 |
+| **Google Ads** | "school supply list cart," "amazon school supply list," "upload supply list to amazon." Low-competition keywords. | $200–$500 | 100–300 |
+| **TikTok organic** | 15-second video: speed-run of PDF upload → cart result. Target: #backschool #schoolsupplies. | $0 | Varies |
+| **Reddit (r/Parenting, r/Teachers, r/school)** | Value-first posts: "Teacher here — turn your supply list PDF into a single Amazon cart." Don't spam. | $0 | 50–200 |
+
+### 8.4 Phase 3: Scale (September 2027+)
+
+**Objective:** Expand to adjacent list types and build year-round revenue.
+
+**Expansion opportunities:**
+- **Holiday wish lists** — "Create your child's Amazon wish list from their handwritten list"
+- **Summer camp packing lists** — Camp sends a PDF, parents get a cart
+- **Team sports equipment** — Soccer, baseball, football: "Your coach's equipment list → Amazon cart"
+- **College dorm lists** — Target freshman move-in list
+- **Teacher classroom wish lists** — DonorsChoose-style: upload your classroom supply list, parents/funders buy it
+- **Lunchbox/meal prep lists** — School lunch menu → Amazon cart for groceries
+
+### 8.5 First 100 Customers — How They Find Us
+
+| # | Source | How |
+|---|--------|-----|
+| 1–10 | **Germaine's network** | Direct share in personal Facebook, LinkedIn, neighborhood group. "Hey, I built this thing..." |
+| 11–25 | **Local school PTAs** | Email Germaine's kids' school PTA. One post in the private Facebook group → 15 parents. |
+| 26–50 | **Facebook parent groups** | Join 5 "Back to School [City]" groups. Post the tool. Organic engagement. |
+| 51–75 | **Teacher word-of-mouth** | First batch of parents tell their teachers. Teachers share with other parents. |
+| 76–100 | **ITPP client network** | IT Pro Partner clients have kids in school. "Hey client, your kid have a supply list? Here's a free test." |
+
+### 8.6 Key Metrics — First 90 Days
+
+| Metric | Target | How Measured |
+|--------|--------|-------------|
+| Carts generated (total) | 20–50 | DB count |
+| Items parsed per cart | 30–50 avg | Logged in app |
+| ASIN match rate | >70% | Matched / total items |
+| Email delivery success rate | >95% | SMTP logs |
+| User time saved per cart | 1–2 hours (estimated) | Survey (optional) |
+| Revenue | ~$100–$250 | Stripe (post-launch) |
+
+### 8.7 Bottlenecks That Could Delay Launch
+
+| Bottleneck | Risk | Mitigation |
+|-----------|------|------------|
+| **ASIN matching accuracy** | Medium — wrong items erode trust | Build fallback: if top match looks wrong, try 3 more searches. Manual override in Premium tier. Let parent confirm/reject items. |
+| **PDF parsing edge cases** | Low — handwriting, scanned images, weird formatting | PyMuPDF handles most formats. Fallback: OCR for scanned PDFs (Tesseract — free, 1 second per page). |
+| **Amazon rate limiting** | Medium — aggressive scraping gets blocked | Current 5-second delay is conservative. Add rotating user-agents. Consider PA-API as fallback (limited but avoids scraping). |
+| **Seasonality** | High — 80% of annual volume in 6 weeks | Build in off-season. Expand to other list types. Use off-season for polish, SEO, partnerships. |
+| **Stripe account risk** | Low-Medium — high volume of small transactions may trigger hold | Use ITPP Stripe to launch. Spin out to separate entity if volume exceeds 10K carts. Keep chargeback rate <1%. |
+| **Legal — Associates compliance** | Low | Amazon Associates TOS are straightforward for cart URL generation. Don't misrepresent prices, don't scrape Amazon product pages for commercial data beyond matching. Standard affiliate marketing practice. |
+
+---
+
+## 9. Risk Analysis
+
+### 9.1 Market Risks
+
+| Risk | Probability | Impact | Mitigation |
+|------|-----------|--------|------------|
+| **Parents don't trust PDF upload** | Medium | High | Show a preview of parsed items before asking for payment. Host the service, don't require downloads. Share sample output on landing page. |
+| **BTS season too tight for 2026** | High | Low | 2026 is a soft launch — free tier only, collect feedback, build payment gating. 2027 is the real revenue year. |
+| **PTAs build their own tool** | Low | Medium | PTAs don't have technical resources. Even large PTAs can barely maintain their website. |
+| **Amazon changes cart URL format** | Low | High | Cart URL format has been stable for years. If deprecation is announced, we have 6+ months to adapt. |
+
+### 9.2 Product Risks
+
+| Risk | Probability | Impact | Mitigation |
+|------|-----------|--------|------------|
+| **ASIN matching fails on unusual items** | Medium | Medium-High | "Spray Sunscreen" and "plastic spoons and forks" are edge cases — matched in test but could fail on niche items. Build confidence thresholds: if match score is low, flag for manual review (Premium tier includes this). |
+| **Amazon blocks scraping** | Medium | High | Current approach works but is fragile. PA-API is more reliable but has restricted categories and rate limits. Build both paths — scrape for wide matching, PA-API as validation. |
+| **PDF parser fails on scanned/handwritten lists** | Medium | Low | Scanned PDFs are rare for school supply lists (they're usually typed/printed). Add OCR fallback for the edge cases. |
+| **Cart URL breaks for large carts (45+ items)** | Low | Medium | Amazon cart URL supports 50+ items via ASIN.1...ASIN.N pattern. Tested with 45 items and worked. Monitor Amazon's limits. |
+
+### 9.3 Competitive Risks
+
+| Risk | Probability | Impact | Mitigation |
+|------|-----------|--------|------------|
+| **TeacherLists adds PDF upload** | Low-Medium | Medium | They'd need to build Amazon matching from scratch (they don't do it now — they have inventory agreements with suppliers). Would take 6–12 months. SchoolCart has head start. |
+| **Amazon builds "upload your list" feature** | Low | High | Possible but unlikely — Amazon's BTS store is curated categories, not a PDF parser. If they do, SchoolCart pivots to school/PTA portal + family subscription model (value-added layer on top). |
+| **App stores flood with copycats** | Medium | Low | Mobile apps have lower trust — uploading a school supply list PDF to "some app" is sketchy. SchoolCart is a web service, no install required. First-mover + SEO + PTA relationships create defensibility. |
+
+### 9.4 Operational Risks
+
+| Risk | Probability | Impact | Mitigation |
+|------|-----------|--------|------------|
+| **BTS support volume overwhelms** | Medium | High | One person handling support for 5K+ carts in 6 weeks is a risk. Mitigation: self-serve (FAQ page, video demo, email auto-responders). Consider temp support contractor at $500–$1K for BTS peak. |
+| **Stripe payment holds on high volume** | Low-Medium | Medium | Small transactions ($4.99) hitting in waves look like micro-transaction fraud. Communicate with Stripe in advance. Maintain low dispute rate. Keep documentation ready. |
+| **Domain/brand not settled in time** | Medium | Low | shopping.iamgmb.com works for soft launch. Branded domain is important for Year 2, not Year 1. |
+
+---
+
+## 10. Financial Projections
+
+### 10.1 12-Month P&L (Realistic Case — 2027 BTS)
+
+| Line Item | Jan–Jun | Jul–Aug (BTS) | Sep–Dec | Year 1 Total |
+|-----------|---------|---------------|---------|-------------|
+| **Revenue** | | | | |
+| Carts sold | 0 (build) | 500–2,000 | 50–100 (off-season) | 550–2,100 |
+| Service fees ($4.99 avg) | $0 | $2,495–$9,980 | $250–$500 | **$2,745–$10,480** |
+| Amazon commissions (est. 4% × $70 avg cart) | $0 | $1,400–$5,600 | $140–$280 | **$1,540–$5,880** |
+| School plans | $0 | $0–$400 | $0 | **$0–$400** |
+| **Total Revenue** | **$0** | **$3,895–$15,980** | **$390–$780** | **$4,285–$16,760** |
+| **Costs** | | | | |
+| Stripe fees (~$0.45/cart) | $0 | $225–$900 | $22–$45 | $247–$945 |
+| Domain renewal | $12 | $0 | $0 | $12 |
+| **Total COGS** | **$12** | **$225–$900** | **$22–$45** | **$259–$957** |
+| **Gross Profit** | **-$12** | **$3,670–$15,080** | **$368–$735** | **$4,026–$15,803** |
+| _Gross Margin_ | _N/A_ | _94–94.5%_ | _94–94.5%_ | _94–94.5%_ |
+| **Operating Expenses** | | | | |
+| Development (Stripe, accounts, tiers) | 0 (Germaine time) | 0 | 0 | $0 |
+| Content/SEO (10 articles) | $500 | $0 | $500 | $1,000 |
+| Facebook ads (BTS season) | $0 | $500–$2,000 | $0 | $500–$2,000 |
+| Tools + misc | $100 | $100 | $100 | $300 |
+| **Total OpEx** | **$600** | **$600–$2,100** | **$600** | **$1,800–$3,300** |
+| **Net Income** | **-$612** | **$2,570–$13,980** | **-$232–$135** | **$2,226–$12,503** |
+
+### 10.2 Unit Economics
+
+| Metric | Value | Notes |
+|--------|-------|-------|
+| Average revenue per cart | ~$7.80 | $4.99 service + ~$2.80 commission |
+| Stripe fee per cart | ~$0.45 | 2.9% + $0.30 on $5 |
+| Gross margin per cart | ~94% | $0.45 cost on $7.80 revenue |
+| CAC (organic) | $0–$1 | Facebook groups, word-of-mouth |
+| CAC (paid) | $2–$5 | Facebook/Google ads — estimated |
+| LTV (single-use) | $7.80 | One cart only |
+| LTV (family pass) | $50+ | $19.99/yr × 3+ years of usage |
+| LTV (school plan) | $600+ | $199/yr × 3+ years |
+
+### 10.3 Total Run Rate & Runway
+
+**Current situation:**
+- Existing infrastructure: $0 incremental cost
+- Development time: Germaine's time (not billed)
+- Marketing budget: $500–$2,000 for BTS ads (discretionary)
+
+**Runway:**
+- If zero revenue: SchoolCart costs $12/year in domain fees. It can sit indefinitely without any revenue pressure.
+- With 500 carts: ~$3,900 revenue on ~$1,050 total costs = **$2,850 profit**
+- This business can never lose money at meaningful scale — the cost structure is so low that 100 carts/year pays for everything.
+
+### 10.4 If This Fails Within 6 Months — Most Likely Reason
+
+**"Parents just go to Walmart."**
+
+The biggest risk is that the pain of school supply shopping isn't painful enough to justify $5. If parents prefer the status quo — 2 hours at Walmart, impulse buys, out-of-stock frustration — over paying $5 for a one-click cart, the business doesn't work.
+
+**Contingency signs (first 90 days):**
+- PDF upload rate: <10 uploads in first week = weak awareness, not weak need
+- Cart preview → pay conversion: <30% = price resistance
+- Repeat usage: <5% = weak retention, need better experience
+
+**Mitigation if true:**
+- Drop price to $2.99 (impulse-buy threshold for "doubters")
+- Free tier (ads? No — free is free, earn on commission only)
+- Focus entirely on school plans (PTA subsidizes the cost, parents pay $0)
+- Pivot to teacher wish lists / DonorsChoose model (different pain point, same tech)
+
+---
+
+## 11. The Ask
+
+### 11.1 What We Need to Launch (for 2027 BTS)
+
+| Resource | Details | Timeline | Cost |
+|----------|---------|----------|------|
+| **Stripe integration** | Payment gating for cart unlock | September 2026 | ~8 hours (Germaine) |
+| **User accounts** | Email + password, order history | October 2026 | ~12 hours |
+| **Branded domain** | Register cartmylist.com or similar | Immediate | ~$12/year |
+| **Landing page** | Branded homepage with upload + explainer | November 2026 | ~8 hours |
+| **Content/SEO** | 10 BTS articles for 2027 search traffic | January–May 2027 | $500–$1,000 (writer) |
+| **Facebook ads budget** | BTS season paid acquisition | July–August 2027 | $500–$2,000 |
+| **PTA outreach list** | Directory of 200+ PTA contacts | May–June 2027 | $0 (manual) |
+| **Total investment** | | | **~$512–$1,012 cash + ~28 hours dev** |
+
+### 11.2 Immediate Decisions Required
+
+1. **Domain name** — which .com to register? All verified available as of Jul 27, 2026:
+
+   | Domain | Available | Verdict |
+   |--------|-----------|---------|
+   | **cartmylist.com** | ✅ | ⭐ **Top pick** — short, verb-driven ("cart my list"), memorable, easy to spell |
+   | **quickorderlist.com** | ✅ | Good fallback — descriptive but longer |
+   | **schoollistcart.com** | ✅ | Descriptive but 17 chars |
+   | **ezcartlist.com** | ✅ | Short but "EZ" looks dated |
+   | **schoolcartpro.com** | ✅ | Good for Year 2 when brand is established |
+   | **schoolcart.io** | ✅ | Trendy but .io less trusted by parents |
+   | list2cart.com | ❌ Registered | Taken
+2. **Stripe account** — use ITPP Stripe to launch, or create separate entity first?
+3. **Company structure** — operate under IT Pro Partner, or new LLC?
+4. **Pricing model** — confirmed as Quick Cart $4.99, Premium Cart $9.99 (named carts + multi-pass matching), Family Pass $19.99/yr (all kids, all year), School Plan FREE ($1/cart donated to PTA)
+5. **Timeline** — soft launch for August 2026 (free), or wait until 2027 BTS with full paid launch?
+
+### 11.3 What Success Looks Like (Month 12 — August 2027)
+
+- **500–2,000 paid carts processed** in the 8-week BTS window
+- **$3K–$16K revenue** (service fees + commissions) — not life-changing, but validated
+- **90%+ parent satisfaction** — "this saved me 2 hours"
+- **ASIN match rate >80%** — continuous improvement
+- **2–5 school/PTA plans** signed for 2028
+- **Content library** of 20+ BTS articles ranking on Google
+- **Clear path to $50K+ in Year 2**
+
+### 11.4 The Bigger Picture
+
+SchoolCart isn't just about school supplies. It's a **pattern** — list-to-cart as a service — that applies to:
+
+- **Holiday wish lists** — November–December (another high-volume season)
+- **Summer camp packing** — May–June
+- **College dorm lists** — July–August (same season as BTS)
+- **Team sports equipment** — August–September
+- **Teacher classroom wish lists** — Year-round
+
+The core tech — PDF parser → Amazon ASIN matcher → cart URL generator — is the engine. School supplies are the first market because the pain is acute, the lists are standardized, and the timing creates urgency. Once the engine works, every list type is a new revenue stream.
+
+And the entire thing runs on existing infrastructure with near-zero operating cost. At 1,000 paid carts per year, it pays for itself. At 10,000, it's real income. At 100,000, it's a business worth selling.
+
+The only question is whether school supply shopping hurts enough for parents to pay $5 to make it stop. The evidence — screaming kids, crowded stores, out-of-stock shelves, 2-hour ordeals — suggests yes.
+
+---
+
+## Appendix A: Technical Architecture (Current)
+
+| Component | Technology | Status | Details |
+|-----------|-----------|--------|---------|
+| Backend | FastAPI (Python) | ✅ Live | port 8101, systemd service |
+| PDF Parser | PyMuPDF + custom bullet normalization | ✅ Live | Handles PDF text, bullet chars, line items |
+| Amazon Search | Direct Amazon HTML scrape | ✅ Live | 5-second delay per item |
+| Cart URL | Amazon cart/add.html + AssociateTag | ✅ Live | Tested with 45 items |
+| Email | SMTP via MXroute (shonuff@germainebrown.com) | ✅ Live | Cart URL delivery |
+| Caddy | Reverse proxy, LE auto-certs | ✅ Live | shopping.iamgmb.com |
+| Frontend | Static HTML (served by FastAPI) | ✅ Live | Upload form |
+
+## Appendix B: Test Results (July 27, 2026)
+
+| Metric | Result |
+|--------|--------|
+| Items in PDF | 45 |
+| Items parsed | 45 |
+| ASINs matched | 45 (36 unique, some duplicated across gendered items) |
+| Cart URL | Generated ✓ |
+| Email delivery | Sent ✓ |
+| Processing time | ~20 seconds (includes 5-second Amazon delay per item) |
+
+## Appendix C: Known Improvement Backlog
+
+| Improvement | Priority | Est. Effort |
+|-------------|----------|-------------|
+| Zero-width char stripping (merged words) | High | 30 min |
+| Quantity extraction from item text ("3 packages...") | High | 1 hour |
+| Section header filtering ("Walmart:", "Amazon:", etc.) | Medium | 30 min |
+| Brand-specific ASIN matching ("Ticonderoga" → specific model) | Medium | 2 hours |
+| Multiple search attempts per item (fallback chain) | Medium | 2 hours |
+| Cart preview page (show items before payment) | Medium | 4 hours |
+| OCR for scanned PDFs (Tesseract) | Low | 2 hours |
+| PA-API integration (backup to scraping) | Low | 4 hours |
+| Rotating user-agents for Amazon | Low | 30 min |
+| Sentiment scoring for matched ASINs (rating/price) | Low | 2 hours |
+
+---
+
+**Document prepared by:** Sho'Nuff Brown — AI Ops Engineer  
+**Contact:** Germaine Brown — g@germainebrown.com  
+**Classification:** Confidential — For Advisory Team Review Only  
+**Version:** 1.0 — July 27, 2026

sites/intelsight.io.md

@@ -0,0 +1,91 @@
+# IntelSight.io — Site Documentation
+
+## Overview
+
+| Detail | Value |
+|---|---|
+| Domain | intelsight.io |
+| Aliases | intelsight.co (redirect), www.intelsight.io |
+| Platform | WordPress (CloudPanel CE) |
+| Server | app3 (152.53.241.111) |
+| Panel | panel.itpropartner.com |
+| Created | July 26, 2026 |
+| SSL | Let's Encrypt via CloudPanel |
+
+## Cloudflare DNS Records (Zone: `4c2ade01f77efc5a3821dc64f5cf3277`)
+
+| Type | Name | Value | Proxy |
+|---|---|---|---|
+| A | intelsight.io | 152.53.241.111 | ✅ Orange |
+| A | my.intelsight.io | 152.53.241.111 | ✅ Orange |
+| CNAME | www.intelsight.io | intelsight.io | ✅ Orange |
+
+SSL/TLS mode: Full (strict)
+
+### intelsight.co (Zone: `f12f30677b754b39c51a8bd29527ca8f`)
+
+| Type | Name | Value | Proxy |
+|---|---|---|---|
+| A | intelsight.co | 192.0.2.1 | ✅ Orange |
+
+**Page Rule:** `intelsight.co/*` → `https://intelsight.io/$1` (301, active)
+
+No origin server needed — Cloudflare edge handles the redirect. The dummy A record is required for DNS resolution; traffic never reaches the origin IP.
+
+## CloudPanel Site Details
+
+- **Site User (SSH):** `intelsight` / `LoveMyBoys.1520!`
+- **Home directory:** `/home/intelsight`
+
+## Database
+
+| Detail | Value |
+|---|---|
+| Host | 127.0.0.1 |
+| Port | 3306 |
+| Database | intelsight |
+| User | intelsight |
+| Password | lUO7FjpYRxdJyK7BadiW |
+
+## WordPress Admin
+
+- **URL:** https://intelsight.io/wp-admin/
+- **User:** ippadmin
+- **Password:** LoveMyBoys1520!
+- **Admin Email:** admin@intelsight.io ⚠️ **Needs changing** to `info@itpropartner.com` (CloudPanel ignores the form field and auto-generates `admin@domain`)
+
+## Service Status
+
+| Service | Status | Notes |
+|---|---|---|
+| intelsight.io | ✅ Live | WordPress default install |
+| intelsight.co → intelsight.io | ✅ Redirecting | 301 via Cloudflare page rule |
+| my.intelsight.io | ⏳ DNS ready | **No site created yet** — returns 525 |
+| SSL | ✅ Issued | Let's Encrypt via CloudPanel |
+
+## SSL Issuance
+
+Let's Encrypt via `clpctl lets-encrypt:install:certificate`. Must temporarily unproxy DNS records for HTTP-01 validation, then reproxy:
+
+```bash
+# Unproxy
+curl -s -X PATCH "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$RECORD_ID" \
+  -H "Authorization: Bearer $CF_TOKEN" \
+  -d '{"proxied":false}'
+
+# Issue cert (on app3)
+ssh root@152.53.241.111 "clpctl lets-encrypt:install:certificate --domainName=intelsight.io"
+
+# Repoxy
+curl -s -X PATCH "..." -d '{"proxied":true}'
+```
+
+## Backup
+
+Covered by app3 daily backup at 3 AM ET → `s3://hermes-vps-backups/cloudpanel-backups/`
+
+## Next Steps
+
+1. Change WordPress admin email from `admin@intelsight.io` to `info@itpropartner.com`
+2. Create WordPress site at `my.intelsight.io` for the customer portal
+3. Install WordPress theme and configure branding

sites/intelsight.md

@@ -0,0 +1,87 @@
+# IntelSight — New WordPress Site on CloudPanel
+
+**Status:** Live  
+**Date created:** July 26, 2026  
+**Server:** app3 (152.53.241.111, netcup RS 4000)  
+**Panel:** https://panel.itpropartner.com  
+**Site URL:** https://intelsight.io  
+**Purpose:** Marketing site for IntelSight competitive intelligence SaaS product
+
+---
+
+## Domain
+
+| Detail | Value |
+|---|---|
+| Domain | `intelsight.io` |
+| Registrar | Cloudflare Registrar |
+| Purchased | July 26, 2026 |
+| Cost | $50/year (.io) + $15/year (.co) |
+| Defensive domains | `intelsight.co` (redirect only) |
+
+---
+
+## DNS (Cloudflare)
+
+| Type | Name | Value | Proxy |
+|---|---|---|---|
+| A | `intelsight.io` | `152.53.241.111` | Proxied (orange) |
+| CNAME | `www` | `intelsight.io` | Proxied (orange) |
+
+SSL/TLS mode: **Flexible** — Cloudflare provides edge cert; origin uses CloudPanel self-signed cert.
+
+---
+
+## CloudPanel Site
+
+| Detail | Value |
+|---|---|
+| Domain | `intelsight.io` |
+| Site User (SSH) | `intelsight` |
+| Site User Password | `LoveMyBoys.1520!` |
+| PHP Version | 8.x (CloudPanel default) |
+| Vhost | `/etc/nginx/sites-enabled/intelsight.io.conf` |
+| Docroot | `/home/intelsight/htdocs/intelsight.io` |
+
+---
+
+## WordPress
+
+| Detail | Value |
+|---|---|
+| Admin URL | https://intelsight.io/wp-admin/ |
+| Admin Username | `ippadmin` |
+| Admin Password | `LoveMyBoys1520!` |
+| Admin Email | `admin@intelsight.io` → **CHANGE to `info@itpropartner.com`** |
+| DB Name | `intelsight` |
+| DB User | `intelsight` |
+| DB Password | `lUO7FjpYRxdJyK7BadiW` |
+| DB Host | `127.0.0.1:3306` |
+
+---
+
+## Quirks & Pitfalls
+
+1. **CloudPanel overrides Admin Email.** The form field "Admin E-Mail" is ignored — CloudPanel auto-generates `admin@<domain>`. Fix in WordPress → Settings → General after first login.
+
+2. **Let's Encrypt + Cloudflare proxy conflict.** CloudPanel's Nginx template redirects all HTTP to HTTPS before `.well-known` validation, so LE HTTP-01 challenges fail through Cloudflare proxy. Workaround: use Cloudflare "Flexible" SSL mode. Edge cert is Cloudflare's; origin cert is CloudPanel self-signed.
+
+3. **CloudPanel CLI has no `site:list`.** Use `app:list` or check `/etc/nginx/sites-enabled/` directly.
+
+---
+
+## Post-Creation Checklist
+
+- [ ] Change Admin Email to `info@itpropartner.com`
+- [ ] Install SSL certs if switching from Flexible to Full (strict) later
+- [ ] Run `clpctl lets-encrypt:install:certificate --domainName=intelsight.io` if graying out Cloudflare proxy
+- [ ] Add to backup schedule (app3 backups at 3 AM ET)
+- [ ] Add to Hudu — API asset / website documentation
+
+---
+
+## Related Docs
+
+- `servers.md` — app3 server details
+- `backup-plan.md` — backup schedule
+- Hudu → IT Pro Partner → Websites / IntelSight