| 1 | # Zion PM - what's left for YOU (the only blockers) |
| 2 | |
| 3 | Everything is built and verified. These are the credentials/config only you can provide. Add them |
| 4 | and each feature goes live. Nothing here needs me - but I can do the wiring once values exist. |
| 5 | |
| 6 | ## 1. Email send + intake (the outreach + client engine) |
| 7 | For each account, generate a **Gmail App Password** (myaccount.google.com → Security → App passwords; |
| 8 | needs 2FA on). Add to `/shared/projects/.env.secrets` (one line each, no quotes needed): |
| 9 | |
| 10 | ``` |
| 11 | GMAIL_APP_PW_ZIONBOGGAN=xxxxxxxxxxxxxxxx # zionboggan@gmail.com (recruiter outreach) |
| 12 | GMAIL_APP_PW_ZIONBOGGAN0=xxxxxxxxxxxxxxxx # zionboggan0@gmail.com (client professional) |
| 13 | GMAIL_APP_PW_ZCC=xxxxxxxxxxxxxxxx # ZCC Media Agency (client professional) |
| 14 | GMAIL_APP_PW_ZION=xxxxxxxxxxxxxxxx # personal hybrid |
| 15 | GMAIL_APP_PW_WORKYAYA=xxxxxxxxxxxxxxxx # workyaya2018@gmail.com (personal hybrid) |
| 16 | ``` |
| 17 | |
| 18 | Then fill the two unknown addresses in `policy.yaml > sender_identities > accounts`: |
| 19 | - `zcc_media.address` - the exact ZCC Media Agency address (gmail.com? or your own domain?) |
| 20 | - `zion_personal.address` - which "zion" address is the personal-hybrid one? |
| 21 | |
| 22 | (If ZCC is a Google Workspace domain, set its `provider: workspace` - app passwords still work.) |
| 23 | |
| 24 | **Intake is label-gated so it never floods you:** in each Gmail, create a filter that applies a |
| 25 | label named **`PM`** to whatever you want the agent to see (e.g. replies to outreach, client mail). |
| 26 | The PM only reads messages under the `PM` label. Then run `python3 bin/intake-email.py` (or its timer). |
| 27 | |
| 28 | ## 2. Mobile desk (Cockpit PWA + push) |
| 29 | - **Expose it:** set `PM_WEB_TOKEN=<long-random>` then `bash bin/pm-web.sh` (binds 0.0.0.0:8780). |
| 30 | Without a token it binds localhost only. Open `http://<host>:8780/?t=<token>` on your iPhone → |
| 31 | Share → Add to Home Screen. It installs as a clean app (swipe approvals, add tasks by typing). |
| 32 | - **Front it properly (recommended):** add a Traefik route `REDACTED-HOST` → CT:8780 with |
| 33 | Authentik forwardAuth (same pattern as your other lab apps), then drop the token. |
| 34 | - **Push pings:** set a push channel so it taps you only when needed: |
| 35 | - ntfy (free): `PM_NTFY_TOPIC=<topic>` (+ `PM_NTFY_SERVER` if self-hosted), or |
| 36 | - Pushover ($5 once, very polished): tell me and I'll add a 6-line Pushover sender to `notify.sh`. |
| 37 | |
| 38 | ## 3. Voice intake |
| 39 | Record a memo and drop the audio in `inbox/voice/` (share it there from your phone via Samba). |
| 40 | `bash bin/intake-voice.sh` transcribes it on the 3060 STT sidecar (CT215:8770) → task. Nothing to |
| 41 | configure unless the sidecar URL/model changed (`PM_STT_URL`, `PM_STT_MODEL`). |
| 42 | |
| 43 | ## 4. Browser hand |
| 44 | Already functional on this host (Playwright + Chromium present). On whatever host runs the conductor, |
| 45 | ensure: `pip install --user playwright && python3 -m playwright install chromium`. For logged-in |
| 46 | actions on a site, I'll add a saved-session profile per site when you point me at the first one. |
| 47 | |
| 48 | ## 5. (Recommended, you skipped it) Budget guard |
| 49 | You're on a metered GLM weekly cap (the 11% scare). Say the word and I'll add a guard that tracks |
| 50 | usage and auto-fails-over the brain to local Ollama / your $16 backup key before lockout, then back. |
| 51 | Small build, saves the whole PM from dying mid-campaign. |