Reference decorator crab

Master plan: /home/justinwieb/forge/memory/handoffs/decorator-crab-master-plan-2026-04-21.md

Scaffold: /home/justinwieb/forge/infra/context-api/ (skeleton only; no code yet)

What the crab does: When Justin mentions a new app/device/service, the Decorator Crab agent: 1. Researches the API + security screen (rule #1 check — never personal Gmail) 2. Provisions creds into n8n's encrypted vault (never on filesystem) 3. Writes a normalizer + JSON schema for infra/context-api/ 4. Builds an n8n workflow that POSTs to Context API /ingest/<source> 5. Data lands in SQLite Context Graph (data/context.db) 6. Daily rollup cron writes memory/daily/YYYY-MM-DD_rollup.md; weekly cron grows memory/general/justin-profile.md 7. Any agent can GET /context?about=wellness|finance|business|calendar|... for a curated JSON slice

Hard rules (mirror CLAUDE.md): - Personal Gmail ([email protected]) OAuth is forever off-limits. Use business alias / dedicated Workspace account. - Banking reads only (Plaid / Teller / QBO). No move-money path without HIL approval gate + caps. - All credentials in n8n encrypted DB; .env holds only service tokens (600 perms, gitignored). - Context API binds to 127.0.0.1 + Tailscale; never Cloudflare Tunnel.

Phased rollout: - Phase 0: Context API skeleton + HA/Frigate/Weather/ICS - Phase 1: Eight Sleep + Garmin (wellness) - Phase 2: Plaid + QuickBooks (financial, read-only) - Phase 3: Business email + expanded Notion - Phase 4: YouTube + deeper Shopify/Cloudflare

Agent session label: crab (Opus47) — persistent, reads plan on boot.