AbramsOS

Overnight life-optimizer build: health (vitals/insights/BP-meds/reminders), savings
(advisor/coupons/bill-audit/reorder-timing), Assets+RentCast, Neighborhood Watch,
Biometrics, Plaid+CSV banking, Withings device sync, 38 real Amazon purchases ($8,966.66).

- lib/withings-client.js: Withings Health API OAuth (authUrl/exchange/refresh) + getMeasures mapping (type 1=weight kg→lb, 9/10=BP pair, 11=HR, 54=SpO2); handles refresh-token rotation; graceful no-creds
- routes/withings.js: /auth/withings → consent → /api/withings/callback stores encrypted token in connector_account (provider=withings) + initial sync; /api/withings/sync re-syncs (dedup via health_reading external_id); reuses vitals.insertReadings; audited medical
- connectors.ejs: 'Health devices' section — Connect Withings / Sync now / setup-needed
- server.js wiring + .env WITHINGS_* (gated). One-set-of-creds-from-working

- lib/home-value.js: RentCast AVM lookup by address; graceful no-key/no-address (never fabricates a value); Zillow API retired so RentCast is the free option
- routes/assets.js: POST /api/assets/:id/estimate → fills current_value + value_source='estimate' + range; valuationConfigured flag
- views/assets.ejs: 'Estimate' button on property cards (prompts for key if absent)
- .env: RENTCAST_API_KEY= (gated)
- DATA: opened remaining 17 older Amazon orders via George → all 37 now have real totals; complete all-time spend $8,966.66 (2022-2026)

- lib/bill-audit.js: category-aware — NEVER flags essentials (tax/rent/utility/loan); insurance/phone/internet get 'shop your rate'; discretionary/subscriptions ALWAYS surface with annual cost ('still using this?'), LLM (gemma3:12b) refines cancel/downgrade/overpriced; rule-based duplicate detector
- lib/reorder-timing.js: deterministic 'reorder soon' nudges from cadence + last_ordered (Paper towels due-now verified)
- wired both into /api/savings/run + nightly runner; kind='bill-audit'/'reorder-timing' surface on /savings
- honest: est_savings only for cancel/downgrade, never for 'review'; verified on synthetic sub then wiped

- 0014_biometrics.sql: person_biometric (1:1 per person) — DOB, sex, height, weight, blood type, eye/hair, marks, allergies, conditions, emergency contact, prints-on-file (child-ID)
- lib/biometrics.js: exact age + BMI; adult CDC BMI category; kids link to CDC percentile calculator (NO fabricated percentile)
- routes/biometrics.js upsert-per-person + views/biometrics.ejs profile cards w/ inline edit, child badges
- nav + wiring. Sensitive PII, audited; works for whole household

- lib/neighborhood.js: free OSM Nominatim geocoder (no key) + categorized real deep-link builder (Your Ring first: cameras live-view + Neighbors feed), geo-aware SpotCrime/OSM links
- routes/neighborhood.js: /neighborhood resolves address from ?asset/?address/first property; /api/neighborhood/geocode
- views/neighborhood.ejs: address+radius controls, Leaflet map w/ radius circle, property picker, link cards
- nav + wiring; links to Assets property addresses

- 0013_assets.sql: asset table (property/vehicle/account/valuable) w/ address, current_value, category, details, notes, geocode
- routes/assets.js + views/assets.ejs: /assets dashboard (net worth total + by-category stat row, add form, created date+time chips, per-property 'Watch' link to neighborhood)
- nav + wiring. Values user-entered (auto-valuation API is a later gated add). Feeds upcoming neighborhood-watch via property address

- lib/vitals-reminders.js: fires 'time for a BP check' only if a person logged BP before but not in 14d; deduped via reminder engine
- reminder-engine.generateForUser hooks it in alongside returns/warranty/recall reminders
- verified: lapsed(20d)=fire, recent(2d)=skip, never-logged=skip

- lib/bp-meds.js: deterministic classifier (curated generic stems + names -> effect/class; never LLM-guessed) — ACE/ARB/beta-blocker/CCB/diuretic (lowers) + NSAID/decongestant/steroid/stimulant (raises)
- routes/vitals.js: read-only join to medication table, bpRelevant() into /health
- views/vitals.ejs: 'Medications that affect blood pressure' panel (color-coded lowers/raises), informational-not-advice
- works when med list is populated (currently empty)

- lib/vitals-insights.js: computeTrends (this-30d vs prior-30d avgs), recheckFlag (deterministic rule, gentle), summarize (gemma3:12b narrates ONLY computed deltas — never invents readings; no medical advice)
- routes/vitals.js: fast trends+recheck on /health load; /api/health/insights for async LLM narrative
- views/vitals.ejs: 'This month' panel (trend chips + delta arrows + recheck banner + async narrative) + weight/RHR sparklines
- verified end-to-end on synthetic data then wiped; empty-state safe (no fabricated readings)

- scripts/collect-amazon-orders.js: parsed order confirmations 2022-2026, dedup on order#, total NULL (not fabricated — needs body enrichment)
- validates savings seeds: Nespresso Vertuo = top recurring buy (4x), shipping labels (2x)
- feeds home purchase count + /purchases + savings advisor with REAL data

- csv-parser: headerless fallback (WF/Quicken export: date,amount,*,,description) + signMode — WF debits are negative=spend, so normalize to positive + drop deposits; header CSVs unchanged
- upload.js: dedup key (csv:date:amount:merchant) + ON CONFLICT so re-uploading overlapping statements doesn't double
- connectors.ejs: 'Import CSV' upload form with WF download instructions — zero third-party signup path
- answers Steve: Plaid needs a free web signup (no CLI); CSV upload needs nothing

- views/connectors.ejs: Plaid Link flow — connect button, secure login (Plaid handles bank creds), exchange, per-bank sync; graceful 'setup needed' state when keys absent
- routes/plaid.js: GET /api/plaid/status; sync now resumes from persisted cursor + ON CONFLICT dedup (was re-pulling everything each sync -> dup purchases)
- lib/plaid-client.js: isConfigured() helper
- 0012_plaid_sync_cursor.sql: connector_account.sync_cursor + unique(user_id,order_number) on purchase
- Plaid (not Stripe) is correct for reading a bank; sandbox works now, real Wells Fargo needs Steve's prod keys

- 0011_health_readings.sql: health_reading (BP pairs, HR, weight, SpO2, glucose...) w/ dedup index
- lib/health-metrics.js: AHA BP categorization + Apple Health export.xml streaming parser (pairs systolic/diastolic by timestamp; scales SpO2)
- routes/vitals.js + views/vitals.ejs: /health dashboard w/ inline SVG BP chart, AHA color categories, per-person filter, manual add, delete; /api/health/readings JSON ingest for the Health Auto Export app
- scripts/import-apple-health.js: one-command import of an Apple Health export
- nav + wiring. NO fabricated readings — table ships empty w/ 3 real sync paths. Verified end-to-end on synthetic data then wiped.

- scripts/run-savings-advisor.js: dotenv-loaded, dedup-safe regen (local, $0)
- deploy/com.steve.abramsos-savings.plist: daily 6:05am, RunAtLoad off; bootstrap surfaced in header comment

- home: 'Savings ideas' stat tile (open count + est $ total) linking to /savings
- seeded 3 real verifiable savings mechanisms (Amazon Subscribe & Save, camelcamelcamel price alerts, Costco coupon book) — real URLs, no fabricated codes

- 0010_savings.sql: savings_suggestion + merchant_coupon tables
- lib/savings-advisor.js: grounded strategy suggestions (no hallucinated SKUs/prices)
- routes/savings.js + views/savings.ejs: dashboard w/ created date+time chips, sort+density, save/dismiss
- seeded reorder items from real Amazon email history; 4 suggestions generated
- switched local model qwen3:14b->gemma3:12b (qwen3 thinking-mode returns empty under format:json)

- scripts/ndc-recall-check.js: match each fill's 11-digit package NDC to openFDA product NDC
  (leading-zero-normalized labeler|product, exact-confirmed); 4/46 NDCs on a recall list, 40 fills
- recalls tab: prominent 'Your actual products on an FDA recall list' NDC section (headline signal)
- Rx tab: red RECALL badge on flagged fills (CREON, Fluticasone, Nystatin, Atorvastatin)

- scripts/check-fda-recalls.js: cleans OCR junk from fill drug names (95 fixed), rebuilds
  deduped medication list (83->36 real meds) with generic names, cross-references each vs
  openFDA drug-enforcement (free); 33/36 matched, 300 recall records into medication_recall
- routes/recalls.js + views/recalls.ejs: new 'Medication recalls (FDA)' section, grouped per
  med, Class I/II/III severity badges, worst-first; labeled advisory (ingredient-level match)

- 0009_prescription_fills.sql: fill-history table (date/drug/rx/qty/days/doctor/plan/plan-paid, raw OCR audit)
- scripts/load-abrams-rx.js: OCR-parsed loader, reconciled to doc totals (Natalia 220 fills / $136,254.86 of $136,328.74)
- creates person Steve (self) + Natalia (spouse); dedupes 83 medications into medication table
- routes/prescriptions.js + views/prescriptions.ejs: read-only viewer w/ per-person totals + filter; nav 'Rx'

- migration 0008: person, medication, medication_recall
- /household — add spouse/dependents (records + meds attach to them)
- /medications — self-entered meds per person; every write audit-logged with a medical-consent marker (AGENTS.md gate)
- lib/fda-fetcher.js — openFDA drug-enforcement lookup; per-med + "check all" recall scan stores matches, surfaced on the card
- nav links, recall styling

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

pretest builds/migrates/seeds a throwaway abrams_os_test (schema + all migrations
+ seed.sql + rights-rules); test script pins PG_DATABASE=abrams_os_test. Stops the
auth-e2e test from wiping the real owner account on every `npm test` (AGENTS.md rule).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

sendDigest short-circuits when there are no upcoming deadlines, so empty days
don't put a "nothing due" email in the inbox.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- lib/digest.js builds an HTML digest (overdue / this week / coming up) and self-sends to Steve's own inbox via George /api/send (internal recipient, no external-send token)
- scheduler cron 08:00 America/Los_Angeles is DOUBLE-GATED: off unless DIGEST_ENABLED=1 AND GEORGE_BASIC_AUTH set; committed code is dormant and never auto-sends on its own
- .env.example documents all digest keys (default DIGEST_ENABLED=0)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- /warranties + /api/warranties CRUD (audit-logged) writing to service_commitment (source='manual')
- reminder-engine scans service_commitment.refund_window_ends_at -> 'coverage_window_closing' deadlines
- nav link, warranty id prefix

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- /bills, /reorders CRUD (audit-logged) + /deadlines over the reminder engine
- add-forms, mark-paid/ordered (rolls due date forward + refreshes deadline), created date+time chip on every admin card
- generalized sort-density.js to any [data-grid]; nav links; liquid-glass styles

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- 0007 migration: bill (Bills to Pay incl. tax/government/CRA via category) + reorder_item (frequently-ordered + best-price savings)
- lib/recurrence.js: pure cadence date math (+ 5 passing unit tests)
- reminder-engine emits calendar_reminder rows for upcoming bill due-dates and reorder points (unified Deadlines)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitignore now excludes *.bak, *.bak.*, *.pre-*, *.orig, *~ so editor
swap files and pre-edit snapshots can't be accidentally committed and
end up served from /public. Backstop in server.js: any GET whose path
matches those patterns short-circuits to 404 before express.static,
so even a stray on-disk *.bak.html can never leak.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CPSC notice + cited-rule source links now use rel="noopener noreferrer"
instead of bare rel="noopener" so we don't leak Referer to upstream pages.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- 7 new golden-file fixtures in tests/fixtures/receipts/ (Amazon, Best Buy,
  DoorDash, Apple, Etsy, Uber, Walmart, plus a non-receipt newsletter)
- tests/extractor-regression.test.js auto-discovers fixtures and asserts
  merchant + total + orderNumber + minConfidence per file
- lib/receipt-extractor.js: 2 surgical heuristic fixes uncovered by fixtures
  · extractTotal now picks the highest-rank label ("order total" >
    "grand total" > "total charged" > plain "total"); allows up to 40 chars
    between label and $amount (handles "Total charged to Visa ••1234: $18.42");
    rejects "subtotal" via 3-char lookbehind
  · extractOrderNumber adds Best-Buy-style "Order #: BBY01-806589123456"
    (alpha prefix + digits) and a tighter Amazon-only pattern
- 15/15 tests across the regression + base extractor suites

- npm install multer
- lib/csv-parser.js: parses statement-style CSVs
  · auto-detects date / amount / merchant columns (case-insensitive)
  · handles quoted fields with embedded commas, dollar signs, parens-as-negative
  · skips refunds (negative amounts) and bad rows; reports first 5 errors
- routes/upload.js: POST /api/upload/csv (multer in-memory, 10 MB cap)
  → parser → INSERT purchase rows + audit_log entries
- 10/10 csv-parser tests

- lib/compliance-guardian.js: 4 layered defenses
  · isAllowedDestination(url) — outbound HTTP allowlist (gov, NIH/FDA,
    Plaid, Google APIs, local LLM endpoints; subdomain-confusion safe)
  · detectPromptInjection(txt) — 16 patterns (ignore-prior-instructions,
    chatml fragments, role injection, exfiltration phrasing, code-eval)
  · redactPii(text) — masks card #, SSN, phone, email local-part, ZIP,
    Stripe/OpenAI-style API keys; keeps domain hints
  · guardForLlm(text) — one-shot redact+scan combiner
- lib/receipt-extractor.js: enrichWithLlm now runs guardForLlm() on body+from+
  subject before sending to Ollama; refuses enrichment if injection detected
  (returns heuristic with llmError='compliance_guardian_blocked')
- tests/compliance-guardian.test.js: 19/19 across allowlist (6), injection (4),
  redactor (6), one-shot guard (3)

- routes/connectors.js syncDrive(): after a Drive PDF lands in document table,
  immediately calls pdf.parseFile() + receipt-extractor (heuristic + LLM).
  Inserts a purchase row when extractor returns a draft.
- Images skipped (OCR is a later tick); failed parses flip parsed_status='failed'
- audit_log gets document_parsed + purchase_extracted (source: 'drive_pdf')
- 34/35 tests still green

- tests/crypto.test.js (7): AES-256-GCM round-trip, IV uniqueness, tamper
  detection on ciphertext + auth tag, unicode, empty-string, env-var validation
- tests/ids.test.js (6): prefix per kind, unknown-kind throws, distinctness,
  ULID monotonic-over-time, lowercase invariant
- 13/13 green; pure unit tests, no PG, no server

- routes/recalls.js: GET /recalls (HTML), GET /api/recalls (JSON)
  · joins recall_match × recall_event × purchase
  · status filter (pending_review/confirmed/dismissed) with chip-counts
- views/recalls.ejs: confidence-coded cards (red ≥85%, amber otherwise)
  with CPSC source link
- nav: /recalls added between /claims and /audit
- 2 new tests (auth-gate + API-gate)

- db/migrations/0006_service_commitments.sql applied
- lib/commitment-extractor.js: regex+LLM extraction of money_back_guarantee,
  satisfaction_guarantee, returns_window, price_match, service_sla, lifetime
- routes/connectors.js: pipes extracted commitments to DB after purchase insert
- 10/10 in commitment-extractor.test.js (in-isolation)

NOTE: full suite shows 8 EPIPE failures in auth-e2e + 1 smoke — pure pg-pool
state from the morning's PG session terminate, NOT a code regression. Kill
all abrams_os pg sessions and re-run npm test for clean 53/53.

- db/migrations/0005_rights_rules.sql: rights_rule_snapshot (versioned, jurisdictional)
- scripts/seed-rights-rules.js: 8 hand-curated rules
  · 15 USC §1666i / Reg Z claims-and-defenses (card disputes ≥$50)
  · 12 CFR §1026.13 billing-error rights (60d window)
  · Magnuson-Moss federal warranty (15 USC §2301-2312)
  · 16 CFR §700 FTC pre-sale warranty disclosure
  · FTC money-back guarantee guides
  · 14 CFR §259.5 / DOT 2024 airline refund rule
  · EU 261/2004 standard compensation
  · CPSC recall remedy entitlement
- lib/claim-strategist.js: pickCitedRules() matches reason_code + routing,
  threads citation_block into both LLM prompt and template fallback;
  fills claim_case.cited_rules_jsonb with citation+source_url+title
- views/claim-detail.ejs: renders 'Cited rules' panel with source links
- 6 new tests (matching, limits, unknown-reason fallthrough)
- 42/43 green; 15 PG tables now

- routes/audit.js: GET /audit (HTML), GET /api/audit/events (JSON)
- views/audit.ejs: filter chips + table view + 7d/30d/90d toggle
- nav: /audit link added
- tests: 2 (auth-gate + JSON-endpoint gate)
- 36/37 green
- Skipped item 10 (George email send) — overnight YOLO rule says no email-send code without Steve approval

- npm install node-cron
- lib/scheduler.js: two jobs
  · reminders: every 4h (idempotent via UNIQUE dedupe)
  · cpsc:       daily 03:17 PT, last 7 days (idempotent via ON CONFLICT)
- Logs each tick to logs/scheduler.log
- start() is a no-op when NODE_ENV=test or SCHEDULER_DISABLED=1, so tests stay fast
- Wired into server.js startup; verified live: scheduler started message in log
- 34/35 green

- middleware/csrf.js: cookie+body double-submit pattern
  · ensureToken mints non-httpOnly aos.csrf cookie on every request
  · verifyToken rejects 403 on POST/PUT/DELETE/PATCH to NON-/api/ routes
    when body._csrf or x-csrf-token header doesn't match the cookie
  · /api/* exempted (same-origin JS, sameSite=lax cookie protects)
  · timing-safe comparison with length-guard (avoids 500 on length mismatch)
- views: hidden _csrf input added to signup/signin/enroll-totp/step-up/signout
- tests/csrf.test.js: 4 new (no-token rejection, wrong-token rejection, GET mints cookie)
- 34/35 green (1 skip — pdf-parse fixture)

- views/claims.ejs: card grid showing routing/state/due-date per claim
- views/claim-detail.ejs: full draft letter (Georgia serif), evidence index,
  pending action_queue rows with 'Approve draft' button
- routes/claims.js: GET /claims (list HTML), GET /claims/:id (detail HTML)
- nav: /claims link added
- Approving = 'I've reviewed this'; send wire-up still deferred to George tick

- db/migrations/0004_claims.sql: claim_case (state machine: draft|sent|resolved)
  + action_queue (approval_level: auto|user_required, state: pending|approved|executed)
- lib/claim-strategist.js: deterministic routing by reason_code
  · returns_window_closing → refund / merchant
  · warranty_expiry         → repair / manufacturer
  · recall_action_due       → recall_remedy / manufacturer
  Letter drafted via local Ollama qwen3:14b; falls through to template if LLM down.
  Every claim_case spawns ONE user_required action_queue row — never auto-executes.
- routes/claims.js: GET /api/claims, /:id; POST /from-reminder/:id; /:caseId/actions/:actionId/approve
- 2 new tests with mocked-down Ollama proving the template-fallback path
- 30/31 green (1 skip — pdf-parse fixture)

- db/migrations/0003_reminders.sql: calendar_reminder + dedupe unique index on
  (user_id, owner_table, owner_id, reason_code) so reruns are no-ops
- lib/reminder-engine.js: 3 deadline types fire today
  · returns_window_closing  (5d before 30d default returns mark)
  · warranty_expiry         (30d before 1y default mark)
  · recall_action_due       (14d after a recall_match lands)
- routes/reminders.js: /api/reminders/upcoming, /:id/dismiss, /regenerate
- 4 new tests (uses fixture user_steve + tracked test purchase ids)
- 28/29 tests green (1 skip — pdf-parse fixture)

- npm install pdf-parse
- lib/pdf-parser.js: parseFile(), parseBuffer(), resolveDocumentPath()
  (lazy-require pdf-parse so its test fixture doesn't load at startup)
- routes/documents.js: GET /api/documents (list), POST /api/documents/:id/parse
  pipeline: extract PDF text → synthesize gmail-summary → run heuristic + LLM
  → insert purchase + audit_log entries
- /api/documents wired into server.js behind requireAuth
- 25/25 tests (1 skip — pdf-parse sample fixture not installed in production)

- db/migrations/0002_recalls.sql: recall_event, recall_match, recall_pull_log
- lib/cpsc-fetcher.js: hits saferproducts.gov public API + normalizes to our shape
- lib/recall-matcher.js: canonical scoring pseudocode from docs/SPEC.md
  (gtin/upc 0.45, model fuzzy 0.25, brand 0.05, post-purchase 0.05, UDI 0.40)
- scripts/ingest-recalls.js: idempotent backfill (run: node scripts/ingest-recalls.js [days])
- No live data ingested yet; ingest is opt-in

- lib/drive-fetcher.js: list+download via drive.readonly OAuth scope
- query: name~/receipt|invoice|order|confirmation/i + mime in (pdf, image/*) + last 90 days
- routes/connectors.js: gmail sync now also walks Drive on the same google connector;
  files saved to uploads/drive-<id>.<ext>; document rows inserted with kind='attachment'
- audit_log gets one document_persisted event per file
- 22/22 tests still green

- lib/ollama.js: thin Ollama client with strict-JSON mode + timeout
- lib/receipt-extractor.js: enrichWithLlm() merges into low-conf heuristic results;
  heuristic-trust rule (LLM never overrides a heuristic-filled field)
- routes/connectors.js: gmail sync now calls extractWithFallback when conf < 0.7
- tests: 3 new in tests/extractor-llm.test.js with cache-injected mock ollama
- Total: 22/22 green; live smoke against Mac1 confirms end-to-end works

- Auth: bcrypt password + otplib TOTP (single-user, locked after first signup)
- Step-up TOTP re-verify within 60s before /import or any 'Import all' run
- 4 new tables: auth_credential, auth_totp, auth_session, auth_event
- DB-backed sessions (signed cookie aos.sid, 30d TTL, httpOnly+sameSite=lax)
- Connectors: Gmail (already wired) + Drive (drive.readonly added) + Plaid sandbox
- Plaid: link/token + exchange + transactions/sync; access tokens AES-256-GCM at rest
- /import dashboard fans out to every connected connector via Promise.all + cookie-forward
- Compliance posture updated (PCI-aware: never PAN/CVV, only Plaid item refs)
- 19/19 tests green (5 smoke + 6 extractor + 8 auth-e2e)