Session Handoff — Brain Jarvis (V3) vetted + installed; inbox/drop-zone cleanup rule set

Where it started

Session began with /prime. User flagged two things: (1) her inbox drop zones (_INBOX-DROP-FILES-HERE/ root + Skool Posts/) weren't being cleaned up after items were processed — they should stay empty for continuous dropping; (2) she was feeding in a new community skill from Zabar's community ("AI Second Brain" / Brain Jarvis) across multiple messages — the video, and the V1/V2/V3 welcome-page copy — and wanted to know whether the V3 zip was self-contained or if she needed to also upload V1, whether to build a project folder, and whether it replaces Obsidian. She also reminded that every skill must be vetted with the skill sentinel and suspected a duplicate.

Decisions locked + what shipped

• Inbox archive rule — Once an inbox item is handled, MOVE it into _INBOX-DROP-FILES-HERE/_processed/<date>/, never delete. Drop zones (root, new skills to add/, Skool Posts/) stay empty for continuous dropping. Documented in c:\Users\srver\AIOS-Workspace\aios-starter-kit\_INBOX-DROP-FILES-HERE\README.md.
• Inbox cleanup executed — Archived handled items (2 Claude chat exports, Summit doc, 31MB batch zip, design-system-guide.pdf, image.png, 4 Skool Posts images) into _INBOX-DROP-FILES-HERE/_processed/2026-07-01/. Verified the July 2 Pinterest post uses posts/images/pinterest-tim-adam.png (NOT the inbox copy), so archiving Skool Posts images was safe.
• V3 zip is a complete superset — brain-jarvis-skill.zip bundles V1 (2D build.py + viewer/index.html), V2 (viewer/3d.html), and the V3 voice/assistant layer (server.py). User does NOT need the V1 zip for function; V1 kept only as a teaching artifact.
• Does NOT replace Obsidian — It reads a markdown vault and adds a talking + 3D-galaxy window on top. Obsidian stays the editor.
• Skill sentinel scan: 88/100, Low Risk — Read actual code, not just docs. Findings: localhost-only bind (127.0.0.1), cross-origin rejected, no shell=True/eval/exec, only declared provider endpoints (Anthropic/ElevenLabs/Vapi/Retell), and draft-mode physically blocks Bash/Write/Edit/Task + mcp__*send/post/reply/delete/publish/deploy/spend/pay/buy wildcards. Written up in PROJECTS/Brain Jarvis/reference/security-report.md.
• Duplicate resolved — skill-security-scan installed once globally at ~/.claude/skills/skill-security-scan/; the redundant .skill copy in the inbox queue was archived.
• brain-jarvis installed + configured + tested — Global at ~/.claude/skills/brain-jarvis/. config.json points at the full Sondra Brain vault, claude-opus-4-8 + key from master .env (gitignored). Galaxy built with --generic = 977 notes / 1,064 links. Tested end-to-end (grounded answers in the Jarvis voice). Desktop launcher Start Brain Jarvis.bat created.
• Project folder built — PROJECTS/Brain Jarvis/ with README hub, reference/source-material.md (all V1/V2/V3 page copy + video links + V3 transcript), reference/security-report.md, reference/brain-studio-skill.zip (V1 teaching artifact), handoffs/.

Key files for next session

• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Brain Jarvis\README.md — project hub, read first
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Brain Jarvis\reference\source-material.md — all of Zabar's V1/V2/V3 copy, video links, transcript
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Brain Jarvis\reference\security-report.md — the sentinel scan detail
• C:\Users\srver\.claude\skills\brain-jarvis\config.json — vault path + model + key (gitignored; never commit)
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\_INBOX-DROP-FILES-HERE\README.md — the archive rule
• Memory file touched: C:\Users\srver\.claude\projects\c--Users-srver-AIOS-Workspace-aios-starter-kit\memory\project_brain_jarvis.md (also feedback_inbox_intake_folder.md, feedback_skill_rebrand_inbox_workflow.md updated to archive-not-delete)
• Plan file: none

Running state

• Background processes: none
• Dev servers / ports: none currently running. Brain Jarvis server runs on port 4719 when launched (Start Brain Jarvis.bat or cd ~/.claude/skills/brain-jarvis && python server.py).
• Open worktrees / branches: none

Verification — how to confirm things still work

• ls ~/.claude/skills/brain-jarvis/SKILL.md — exists → skill installed
• cd ~/.claude/skills/brain-jarvis && python server.py then open http://localhost:4719 in Chrome — brain loads, click mic, ask a grounded question → spoken answer + galaxy node lights
• ls "_INBOX-DROP-FILES-HERE/Skool Posts" — empty → drop zone clean
• ls "PROJECTS/Brain Jarvis/reference" — README/source-material/security-report/V1 zip present

Deferred + open questions

• Deferred: build.py has two LOCAL tweaks (Windows ✓→ASCII print fix + the --generic flag) that a new-version zip will overwrite — re-apply after any update, and always rebuild with --generic (default AIOS mode hides ~900 unlinked notes, shrinks galaxy to ~68).
• Deferred: rebuild galaxy after vault changes — cd ~/.claude/skills/brain-jarvis && python build.py --vault "C:/Users/srver/AIOS-Workspace/aios-starter-kit/Sondra Brain" --out ./viewer --generic, then restart server + hard-reload (Ctrl+Shift+R).
• Open: how does Sondra want to use Brain Jarvis — personal, teach in Stars, or sell white-label ($2k build + retainer per Zabar's pitch)? Her rule: use it in Chrome herself before teaching/selling. White-label = a real bet → run /roast before committing; with client data, get consent/DPA (notes are sent to the model per query).
• Open (unrelated, being handled in another tab): pinterest-pin-angle-generator.skill still in new skills to add/ queue — do NOT process here.
• Note: posts/queue/test_post.json still references the archived _INBOX-DROP-FILES-HERE/image.png, but it's an unscheduled test post — left as-is.

Pick up here

Sondra opens Brain Jarvis in Chrome (Start Brain Jarvis.bat), talks to it, then decides the personal/teach/sell angle — with /roast before any white-label commitment.