HANDOFF — key-account-prime

TL;DR (current state)

The complete 12-month AI-first transformation framework for Prime Products Ltd is designed and in the vault: 08-Transformation holds strategy, charter, governance, WBS, month-by-month roadmap, discovery methodology + 5 questionnaires, 15 department execution plans, the on-prem technical blueprint (Proxmox/vLLM/Qdrant/n8n on 4× L40S; Llama-3.3-70B + Krikri-8B), the Obsidian KB and Mission Control (prime.tpl.one) blueprints, the AI use-case pipeline + agent registry, and the 11-stage commercial offer structure. REQ-001…010 capture the brief; the company profile is filled from public sources. Everything as-is is assumption-flagged pending discovery. The vault can be viewed as an interactive graph with OKF Graph — open the single HTML file, drop the repo folder on it (ADR-007).

Right now

• Status: green — Pilot on the dashboard and the roadmap (2026-07-16): the homepage pilot card was redesigned into a CEO-first infographic — six stat tiles (3 people · ~2,200 cases/yr · ~15 comms/case · 13 wks · €51,000 · go/no-go), an inline-SVG order-flow diagram (Customer → Cylinders desk + SoftOne → Supplier → Port agent) and a proportional 13-week phase bar with the 30/40/30 payment milestones — figures from Offer TPL-PRIME-2026-002/REQ-014; committed directly by the user (7e1bd04, together with the AI PM nav dropdown, the Second Brain submenu, and dropping kanban.astro for Board/Tasks). The Cylinders Pilot was then added to the 12-month roadmap as PX: a distinct dashed “offered, awaiting go-ahead” bar at ~M5–M7 on the shared RoadmapTimeline component (renders on both the dashboard and /docs/.../roadmap-12-month/) plus a PX row and explainer paragraph in roadmap-12-month.md (the pilot runs ahead of and independently of P8, own go/no-go, start triggered by the 6 July call’s open items). astro build verified (99 pages), light + dark screenshots eyeballed. Session: roadmap-pilot-px log.
• Before that: Company identity corrected vault-wide (2026-07-16): the official Greek company registry (GEMI 044869707000, VAT 998740232 — already the VAT on file) confirms the real client is Prime Products (trade name) / Prime Products Ltd (legal form, Ε.Π.Ε.) — “Vanos” turns out to have been the surname of a real co-director, Konstantinos “Kostas” Vanos, mistaken for the company name back when the profile was first filled from public sources. Corrected across ~125 files — content docs, ADRs, session logs, and the offer docs (including renaming offer codes TPL-VAN-2026-00X → TPL-PRIME-2026-00X everywhere they’re referenced) — via a per-file review-then-rename pass; Kostas Vanos’s own name was deliberately left untouched everywhere it appears (e.g. the pilot sponsor). Intentionally NOT touched — these are live infrastructure identifiers, not text to rename, and changing them is a real migration, not a doc edit: the vault: vanos OKF frontmatter slug (registered in the TPL federation map), the OKD namespace vanos, live domains (prime.tpl.one, vanos-chat.tpl.one, vanos-planka.tpl.one), Cloudflare/package project names (prime-mission-control, vanos-wiki-chat), 1Password paths (op://INFRA-OKD/*vanos*), the two nightly routine names (vanos-board-refresh-nightly, vanos-raw-ingest), and the Planka seed script’s project-name lookup key. Also not touched: raw/ source captures (kept pristine per ADR-012) and the old repo name infra-vanos wherever it refers to the repo itself, not the company. Still open: the compiled Stage-1 offer PDF (09-Various/offers/2026-07-03-vanos-stage1-requirement-analysis-offer.pdf) still shows the old name baked into the binary and filename — the generator script’s text was updated to match, but regenerating the PDF needs a machine with fpdf2 + DejaVu fonts and a corrected VAULT path (see Pending next). Session: company identity correction log.
• Before that: Mission Control: Projects nav dropdown + Cylinders Pilot executive page (2026-07-15, PR #29 — open, awaiting review/merge): the site nav gained a Projects dropdown (first entry: the Cylinders Pilot + anchor links to its three sub-projects), and a new hand-written CEO-level page at /projects/cylinders-pilot/ explains the pilot for the sponsor — inline-SVG order-flow schematic (customer → cylinders desk/SoftOne → supplier → port agent), the three sub-projects with completion steps, a 13-week phase timeline mapped to D1–D4 with payment markers, a 7×7 RACI matrix, and the offer’s cost & payment milestones (€51,000 fixed; 30/40/30 = €15,300/€20,400/€15,300). All figures sourced from Offer TPL-PRIME-2026-002, REQ-014, and the interview note. astro build verified (99 pages). Project pages are hand-written executive surfaces like the homepage — update by PR on material status change. Session: projects-dropdown log.
• Before that: All three sample-corpus/board-refresh PRs merged and wiki-chat corpus manually refreshed (2026-07-15): PR #25 (sample-corpus ingestion), PR #26 (board refresh — P8 20%→25%) and PR #27 (that routine’s session log) all merged into master. /board/ going live was verified, not assumed — confirmed CI’s mission-control build regenerated /board/index.html and Cloudflare Pages reported deployment complete, then cross-checked the merged epic-board.md source directly (the site is a deterministic static build, so source and deployed content match). Separately confirmed the wiki-chat corpus does not auto-refresh yet: chat-corpus-redeploy.yml (ADR-013) skips every run with a notice because OKD_TOKEN/OKD_SERVER GitHub Actions secrets aren’t configured — a known, already-tracked gap. Closed that gap for that day only with a manual redeploy: minted a 1h deployer SA token via r720, ran an OKD binary build + rollout of wiki-chat from origin/master, verified via /api/healthz → 93 published docs, matching the site’s own count. The proper fix (ci-chat-deploy SA + 1Password + GitHub secrets) is explained but not yet done — see Pending next. Session: wiki-chat corpus refresh log.
• Before that: First sample order-email batch ingested and fully distilled (2026-07-15): 6 emails / 5 threads (8–13 Jul 2026) from the cylinders pilot’s shared mailbox, routed to a TPL relay mailbox prime@tpl.gr — a reference/design corpus, not live orders to action. Raw kept at raw/data-samples/sample-order-emails-2026-07-08-13.md (ADR-012); distilled into the Prime discovery note, read in full via Outlook web. Reveals Prime’s order-entry business as a four-tier email-driven brokerage chain (shipowner/manager → Prime → manufacturer Martek Marine/FastCalGas UK → port agent) with two independent, cross-validating quote↔order match keys (P.O. base-id suffix A/B, and Offer No = Vendor Reference), currency-aware line items, and a full RFQ→Quoted→Ordered→Acknowledged→Shipped→Delivered→Closed lifecycle. Confirms a hard technical constraint: the M365 search connector cannot expose nested message/rfc822 attachment content (itself PDFs) — automated ingestion needs full Graph API /messages/{id}/attachments/$value access with recursion into nested items (or IMAP/EWS) plus PDF text extraction with OCR fallback, folded into REQ-007 and the M365/SoftOne integration design. Also confirmed the pilot champion’s full identity — Fotini Tsampa, Customer Service, ftsampa@primeltd.com — and named the previously-anonymous UK/US cylinder supplier as Martek Marine Ltd/FastCalGas (department-cylinders.md). REQ-014 updated to match; homepage chip/action updated (only 6 of the requested 20–50 emails received so far — content read manually via Outlook web, remaining volume + matching SoftOne orders still outstanding). Session: ingest-sample-order-emails log.
• Before that: Nightly board refresh (2026-07-15): first sample order-email batch advances the P8 pilot-discovery epic — epic-board.md P8 progress moved 20% → 25%, and a new Assumption deviation was logged (mailbox ingestion needs full Graph API attachment access or IMAP/EWS plus PDF/OCR, not the M365 connector path originally assumed). PR #26 merged (2026-07-15). Session: board-refresh log.
• Before that: Rename follow-through done on the taranas checkout (2026-07-15): remote repointed, folder renamed (compat symlink left at the old path), both nightly cloud routines (vanos-board-refresh-nightly, vanos-raw-ingest) now clone TPL-S-A/key-account-prime and their prompts no longer say infra-vanos; agent memory migrated to the new project slug. Only the kotsalidis checkout still pends. Session: rename-followthrough log.
• Before that: Pilot offer priced (2026-07-11): Offer TPL-PRIME-2026-002 for the cylinders-team email-order-desk pilot (REQ-014) — €51,000 fixed fee (15% program-launch discount), status draft, pending TPL C-suite review before issue to Prime Products. The nightly board-refresh agent picked this up: epic-board.md P8 progress moved 15% → 20%, and a new Cost deviation was logged (baseline Stage-7 pricing was an unset placeholder). PR #22 merged (2026-07-15). Same site session also regrouped the Mission Control nav into dropdowns (Program / AI Portfolio / Knowledge / Tools) as the page count grew. Session: board-refresh log.
• Before that: Planka task board deployed to OKD (2026-07-11, ADR-014): TPL-internal Kanban for day-to-day task tracking (distinct from the client-facing epic-board.md//board/) — planka + planka-postgres are live and healthy in namespace vanos (alongside wiki-chat), reached today via oc port-forward for verification. Two OKD-specific fixes needed vs. the draft manifests, both applied and committed: Postgres needs PGDATA pointed at a subdirectory (the mounted PVC’s lost+found breaks initdb), and the Planka app needs an emptyDir at /app/logs (its baked-in user can’t mkdir there under OKD’s arbitrary-UID SCC). Not yet reachable publicly — still needs the Cloudflare Tunnel + Access policy (dashboard/API access this checkout doesn’t have) for vanos-planka.tpl.one. Also open: the bootstrapped admin login (DEFAULT_ADMIN_EMAIL/_PASSWORD) returns “Invalid credentials” via the API even though the stored bcrypt hash was independently verified (in-container) to match the password — tested two ways, both failed the same; root cause not found (possibly specific to testing through a port-forwarded/mismatched-hostname connection rather than the real tunnel hostname). Re-test once the tunnel is live; if it still fails, fall back to Planka’s documented interactive npm run db:create-admin-user. planka/seed-tasks.mjs (parses HANDOFF’s pending-next list + epic-board’s epics — verified via DRY_RUN=1, 28 tasks + 14 epics parse cleanly) is ready to run the moment login works.
• Before that: repo rename cleanup merged (2026-07-10, PR #21): swept the last hardcoded infra-vanos string references (hooks, skills, ADR/KB/Mission-Control docs, CLAUDE.md, README.md, site footer) left over from the same-day GitHub repo rename; also fixed an unresolved git merge-conflict block that had been committed into this file’s “Recent decisions” list. Session: finish-repo-rename log.
• Before that: the pilot clarification call happened (2026-07-06, 56 min, Fathom) and is fully ingested: transcript in raw/ (ADR-012 — new source layer), distilled into the interview note. The pilot department is the calibration-gas cylinders team (3 people, champion Fotini); REQ-014 moved captured → validated.
• Key call findings: suppliers have no B2B/API — email-only RFQs (assumption corrected); ~3 customer procurement platforms are the integration unknown; ~5–10 requests/day, ~1,100 cases/half-year, ~15 comms/case; three sub-processes (intake→quote, vessel-window tracking, agent delivery & confirmation); manual contract tracking (MSC, ~1,000 vessels) is a named pain; SoftOne Web Services stated available (verify Phase 2); success = one platform + morning worklist + time-to-close; no budget figure, urgent. Email domain confirmed @primeltd.com (Fathom labels) — Access policy already matches. First department file: department-cylinders.md.
• Earlier the same day: pilot discovery plan + CEO questionnaire created; company identity corrected (VAT 998740232, website primeproducts.gr).
• Raw→wiki→UI flow automated (same session, in the same PR): the /ingest-raw skill (detect via scripts/check-raw-ingested.sh → distill → registers/HANDOFF/log → PR, idempotent), a Stop hook nudge (raw-ingest-gate.sh, once/day), the raw-ingest-lint CI check (PR fails on un-ingested raw files), a nightly cloud routine vanos-raw-ingest, and ADR-013: chat corpus rebuild+rollout on every knowledge-affecting master push (dormant until OKD_TOKEN/OKD_SERVER land in Actions secrets). The only manual step left is the PR merge (curation). Flow documented in raw/README.md.
• Last successful step (before that): graph evolution timeline LIVE (REQ-013, ADR-010): the /graph/ view gained a scrub/replay timeline built from git history — unborn notes grey, born-or-changed notes pulse, links form as both ends come alive; CI checks out full history. PR #11 merged, visually confirmed on prime.tpl.one. Session: graph-timeline log.
• Before that (same day): epic board shipped (REQ-012, ADR-009): epic-board.md — 14 epics (roadmap P0–P12 + pre-program) with frozen baseline, status/progress, and an append-only deviations-from-baseline log (first fill records the Stage-1 discount, the wiki-chat scope add, early Mission Control/KB delivery, and the Sep-2026 start assumption) — rendered at /board/; refreshed by the board-refresh skill, nightly via cloud routine vanos-board-refresh-nightly (00:00 UTC) and on demand. In PR #10, pending merge. Session: epic-board log.
• Before that: wiki-chat shipped end-to-end (REQ-011, ADR-008): Bedrock Opus 4.6 over the whole published vault (no retrieval DB, prompt-cached — warm question ~5 s / ~$0.08), deployed on OKD in the new vanos namespace, exposed via Cloudflare tunnel vanos-chat.tpl.one with a shared-secret gate, proxied same-origin as prime.tpl.one/api/* (Pages Function, behind the site’s Access). The floating chat bubble is LIVE on every prime.tpl.one page (PR #6 + #7 merged, visually confirmed). Session: wiki-chat log.
• Before that: applied a 15% program-launch discount to the Stage-1 offer — fixed fee now €59,075 (was €69,500), payment split 40%/60% (€23,630 / €35,445); price table, rationale, PDF master, and every referencing page (commercial index, stage structure, homepage) updated to match.
• Before that: Mission Control homepage rewritten for the business reader — plain-language journey stepper with “you are here”, Stage-1 cost + step-by-step pricing cards, CEO action list (session log, PR #2). Before that: Stage-1 offer TPL-PRIME-2026-001 drafted and priced — €69,500 fixed fee pre-discount (108 person-days, effort-transparent rationale, full TPL C-suite committed), PDF master in 09-Various/offers/ (filename/binary still pending regeneration — see Pending next), offer page published to Mission Control (commit c19b7ad, pushed). Same day: OKF Graph visualizer shipped in tools/okf-graph/ (ADR-007) and published on Mission Control at /graph/ — build-time snapshot of published docs only (ADR-005 guardrail; links to unpublished notes stripped), “Graph” in the site nav, verified headlessly end-to-end.
• Currently blocked on: CEO review/sign-off (charter, governance, board outline, program name “Pharos”, start month ~Sep 2026 assumed) + TPL C-suite review of the draft offer before it is issued to Prime Products.

Pending next

• Follow-up infra rename (new, 2026-07-16): the OKD namespace vanos, live domains (prime.tpl.one, vanos-chat.tpl.one, vanos-planka.tpl.one), Cloudflare/package project names (prime-mission-control, vanos-wiki-chat), the vault: vanos OKF frontmatter slug, 1Password paths, and the two nightly routine names all still say “vanos” after today’s company-identity correction — intentionally left alone since renaming them is a real infra migration (DNS, OKD namespace move, Cloudflare project rename, federation-map update in master-vault), not a text edit. Decide whether/when to do this migration, and who has the Cloudflare/OKD access to do it safely.
• Regenerate the Stage-1 offer PDF (09-Various/offers/2026-07-03-vanos-stage1-requirement-analysis-offer.pdf): generate-stage1-offer-pdf.py text was updated today to say Prime Products/Prime Products Ltd/TPL-PRIME-2026-001, but the compiled PDF binary + its filename still show the old name. Needs a machine with fpdf2 + DejaVu fonts, network access to fetch the TPL logo, and the script’s hardcoded VAULT path corrected to the actual checkout path before re-running; then rename the output file.
• Review + merge PR #29 (Projects nav dropdown + /projects/cylinders-pilot/ executive page) — done, merged (efaf668); still open sub-question: whether the pricing section should be gated while the offer is draft
• Merge PR #26 (board refresh: P8 progress + new Assumption deviation) — done, merged 2026-07-15, /board/ verified live
• Merge PR #27 (board-refresh routine’s own session log + HANDOFF) — done, merged 2026-07-15
• Merge the sample-order-email ingestion PR — done (PR #25 merged, 2026-07-15), first batch analyzed, REQ-007/REQ-014 updated, hard technical constraint on attachment access surfaced
• Confirm Graph API mailbox/attachment-permission model with Evangelia (IT) before the pilot automation build starts — the M365 search connector can’t expose attachment content (see “Right now”); needs the IT intro first
• Merge PR #22 (board refresh: pilot priced, nav regroup) — done, merged 2026-07-15
• TPL C-suite review of the pilot offer (TPL-PRIME-2026-002, €51,000) → issue to Prime Products (status draft → issued)
• Finish the Planka rollout (ADR-014, planka+planka-postgres already live in vanos, planka/): (1) create the Cloudflare Tunnel + Access policy for vanos-planka.tpl.one (TPL-only) — needs Cloudflare account access this checkout doesn’t have — then oc create secret planka-tunnel + oc apply -f planka/deploy/cloudflared.yaml; (2) resolve the admin-login “Invalid credentials” issue (see “Right now”) — retest via the real hostname, fall back to npm run db:create-admin-user if it persists; (3) run planka/seed-tasks.mjs to seed the Program Epics + Pending Tasks boards
• CEO clarification call on the pilot — done (2026-07-06), Fathom-recorded, transcript ingested (interview note), REQ-014 → validated
• Await from Prime Products (call action items): Fotini’s team-details email (names/roles/emails/tools — including whether Tsatsou/Makris/Apergi seen in the sample corpus are cylinders-team members) + intro to Evangelia (IT); first batch of 6 sample order emails received and fully distilled 2026-07-15 (content read manually via Outlook web — automated ingestion still blocked, see “Right now”) — still need the remaining volume toward 20–50 sample order emails + matching SoftOne orders. TPL side: send meeting notes to Kostas + team; schedule the follow-up (data-handoff) call
• Start Phase 1 of the pilot discovery plan when the intro lands: department deep-dive interviews + desk-side observation + KPI baseline (time-to-close); Phase 2 in parallel via Evangelia — verify SoftOne Web Services live, mailbox access model, names/access of the ~3 customer platforms
• Decide pilot infrastructure (cloud interim vs waiting for on-prem hardware) — needs an ADR (discovery-plan open risk)
• On the call: reconfirm the client email domain — confirmed @primeltd.com (Fathom participant labels); Access policy already matches, no change needed
• Greek working translation of the pilot questionnaire — done (2026-07-06): questionnaire-pilot-order-desk.el.md per ADR-011; homepage rewritten as the pilot dashboard (pilot card + CEO call as action #1)
• Merge PR #10 (epic board + board-refresh agent) — done (2026-07-04), /board/ live; nightly routine vanos-board-refresh-nightly armed (first run tonight 00:00 UTC)
• Merge PR #11 (graph evolution timeline) — done (2026-07-04), timeline live and visually confirmed on /graph/
• After the first nightly board PRs: judge noise; consider auto-merge for pure status refreshes (ADR-009 relaxation clause)
• Merge PR #7 (site chat widget + /api/* Pages Function) — done (2026-07-03), bubble live and visually confirmed on prime.tpl.one
• Tighten the wiki-chat tunnel ingress to /api/* only (standalone page/healthz currently public at vanos-chat.tpl.one — UI shell only, chat gated)
• Provision the OKD side of ADR-013 (chat corpus auto-redeploy is dormant — confirmed still skipping on every 2026-07-15 merge): the binary BuildConfig bc/wiki-chat already exists and works (used for the 2026-07-15 manual redeploy); what’s left is a dedicated SA ci-chat-deploy + edit role in vanos, a long-lived token → 1Password → GitHub secrets OKD_TOKEN/OKD_SERVER; verify api.okd.tpl.one:6443 is reachable from GitHub runners (else r720 self-hosted runner). Until this lands, every knowledge-affecting merge needs a manual wiki-chat redeploy (recipe: agent memory okd-access-vanos) — corpus was at 93 published docs matching the site as of 2026-07-15.
• Wiki-chat follow-ups: key-rotation runbook (OKD Secrets + Pages env), revisit eu.* inference profile for Opus 4.6 when it ships (traffic currently via us-east-1 — ADR-008); corpus-freshness rebuild hook → solved by ADR-013 (pending the secrets above)
• CEO review: project charter, governance model, board presentation outline; confirm start month + program name
• Price the Stage-1 offer — done (2026-07-03): Offer TPL-PRIME-2026-001, €69,500 fixed fee, PDF master in 09-Various/offers/
• Push commit c19b7ad to origin/master — done (2026-07-03), CI auto-deploys the offer page + PDF to prime.tpl.one
• TPL C-suite review of the draft offer → issue to Prime Products (status draft → issued); confirm day rates (€1,100/€700/€450) against the TPL rate card first
• Add Microsoft Entra ID as Cloudflare Access IdP (needs Entra app registration); OTP email PIN works meanwhile — prime.tpl.one is LIVE behind Access (ADR-006), CI auto-deploys on every push
• Update the live Cloudflare Access allow policy to @primeltd.com — done (2026-07-03), updated via Cloudflare API to match the vault correction
• Move secrets/cloudflare*.key (untracked, git-ignored) into the Prime Products 1Password vault once provisioned
• Greek working translations of the five questionnaires for administration
• Discovery kickoff (M1): interviews per requirement-analysis-framework; validate company profile and all department-plan assumptions
• Verify SoftOne Web Services availability + HQ server-room power/cooling (technical/IT questionnaire) — gates the hardware order
• First infrastructure capture in 03-Infrastructure/
• Decision: register in the TPL Federation Map — done (2026-07-03), as the first client-engagement vault, pointer-only (owner: Leadership, no cross-references from other federation vaults into this one, given confidential Prime Products business data). See master-vault/_log.md [2026-07-03] NEW-VAULT.
• 1Password vault for Prime Products secrets — ADR pending; first credentials exist meanwhile in the INFRA-OKD vault (op://INFRA-OKD/infra-vanos-chat-bedrock-key) and should migrate when the Prime Products vault lands
• Eyeball pass on OKF Graph in a real browser (drop the repo root on it) — headless checks passed, human look at layout/feel pending
• (later) Link-check script + additional hooks per the infra-okd pattern; Onyx/context-lake ingestion

Recent decisions

• ADR-014 — Planka task board: TPL-internal Kanban, OKD-hosted, seeded from the vault (accepted — deployed to vanos, not yet publicly reachable)
• ADR-013 — Wiki-chat corpus freshness: CI rebuild & redeploy on master push (accepted — dormant until OKD secrets land)
• ADR-012 — Raw source layer (raw/): committed to the repo, never part of the wiki (accepted — first instance: the pilot-interview transcript)
• ADR-011 — Greek administration copies of discovery questionnaires (.el.md), English master (accepted — first instance: the pilot questionnaire)
• ADR-010 — Graph timeline dates come from git history at build time (accepted — live on /graph/)
• ADR-009 — Epic board as a vault doc, refreshed by a scheduled board-refresh agent (accepted — live, /board/)
• ADR-008 — Wiki-chat backend: full corpus in context, colocated in chat/, hosted on OKD (accepted — live in the vanos namespace)

Recent sessions

• 2026-07-16 — Roadmap gains the Cylinders Pilot (PX) + homepage pilot infographic
• 2026-07-16 — Company identity corrected: Vanos → Prime Products
• 2026-07-15 — Projects nav dropdown + Cylinders Pilot executive page (PR #29)

Environment / key state

• Repo renamed 2026-07-10: infra-vanos → key-account-prime (GitHub repo + this checkout’s local folder), and the leftover hardcoded infra-vanos string references across the vault (hooks, skills, docs, site footer) swept + merged same day (PR #21). This checkout now at /home/spiran/workspace/key-account-prime → remote https://github.com/TPL-S-A/key-account-prime.git (TPL-S-A org; master fully synced with origin; gh CLI authenticated as cooper-ai-bot on this checkout, push confirmed working; git identity for commits set repo-locally as Cooper <cooper@tpl.gr> — no global git identity exists on this machine). The taranas checkout followed on 2026-07-15 (now /home/taranas/workspace/key-account-prime, remote repointed, compat symlink at the old path; nightly cloud routines repointed the same day). Only /home/kotsalidis/workspace/infra-vanos still uses the old folder name — GitHub redirects the old remote URL transparently, but rename the local folder + git remote set-url there too when convenient.
• TPL_VAULTS_ROOT=/home/taranas/workspace — master-vault & the TPL federation live as sibling repos; conventions: master-vault/conventions.md.
• Obsidian: open the repo root as a vault (config in .obsidian/, tracked).
• Secrets: nothing plaintext in the repo. Wiki-chat credentials: Bedrock API key at op://INFRA-OKD/infra-vanos-chat-bedrock-key/credential; gate secret + tunnel token live only as OKD Secrets in vanos (+ Pages project env / local git-ignored secrets/). Dedicated Prime Products 1Password vault still TBD.
• OKD: namespace vanos runs wiki-chat (+ wiki-chat-tunnel cloudflared connector); cluster access via ssh r720 or local oc login against api.okd.tpl.one:6443. r720 has a live oc session (as taranas) — this checkout’s own oc login is expired/unauthorized. Planka (planka, planka-postgres, planka-tunnel) is designed to join the same namespace (ADR-014) but not yet applied.
• Automation: .claude/skills/vault-session/ + Stop hook .claude/hooks/vault-session-gate.sh (nudges for a session log once per day when unlogged work exists).
• Naming (2026-07-16): the client company is Prime Products (trade name) / Prime Products Ltd (legal form, GEMI 044869707000, VAT 998740232) — not “Vanos”. “Vanos” was the surname of a real co-director, Konstantinos “Kostas” Vanos, mistaken for the company name early on. All vault content, ADRs, and session logs were corrected; live infra identifiers (vault: vanos slug, OKD namespace, domains, project names, 1Password paths, nightly-routine names) intentionally still say “vanos” — see Pending next for the follow-up infra migration.

Handoff prompt (copy-paste for cold-start)

We are working in key-account-prime — the second brain of Prime Products Ltd, built on the TPL Knowledge-OS conventions (OKF frontmatter, ADRs in 06-Decisions, requirements as REQ-NNN in 02-Requirements, session logs in _sessions, HANDOFF.md always fresh). Note: the client was mistakenly called “Vanos” (a director’s surname) until corrected 2026-07-16 — live infra identifiers (OKD namespace, domains, vault: vanos slug) still say “vanos” by design, see Pending next. Read HANDOFF.md → README.md → 08-Transformation/_index.md → 02-Requirements/_index.md. Phase: transformation program designed; next is CEO sign-off, the Stage-1 offer, Mission Control setup, and discovery kickoff. All committed content is English-only (ADR-003), even when the working session is in Greek. Never plaintext secrets. At the end of every substantive session: session log + HANDOFF refresh.