CrossCourtPAYING

SSH to the box was timing out repeatedly (TCP accepted, banner never came; 14 total sshd bans on record). Applied the fleet-standard /etc/fail2ban/jail.local ignoreip (5.161.58.141) + unban + restart — box was provisioned 2026-04-29, before the 2026-05-21 template fix. Surveyed the box for the planned AC-SMS SDR build: Hermes gateway running (PM2 crosscourt-hermes-gateway, Slack platform only — NO webhook platform, NO webhook_subscriptions, NO nginx sites, no ~/services). Existing skill = productivity/crosscourt-revenue-ops (analysis/read-only stance, AC+Metabase+Stripe+Meta patterns). Comparison vs Ben Daugherty's ghl-sdr-basketball agent + duplication plan delivered to Ricki/Joshua in session.

Ricki provided a Meta Graph API token to control Charles's ad account. Verified live against Graph API: valid, type: SYSTEM_USER, app "Crosscourt MCP" (app_id 1669293167606845), system user cynthia / 122101755243320911, scopes ads_management + public_profile. Issued 2026-05-20 15:19 UTC, expires 2026-07-19 (60-day token, not permanent). Confirmed already saved on the box at /home/cynthia/credentials/facebook.env as FACEBOOK_ACCESS_TOKEN (SHA-256 matched the provided token — no value exposure). Closes the 2026-05-07 "Facebook OAuth not yet captured" gap. Open gaps: (1) the system user has zero ad accounts assigned — me/adaccounts + me/assigned_ad_accounts both empty, so the token can't touch any campaign yet; the Crosscourt ad account must be assigned to this system user in Business Settings (ads_management task). (2) Hermes's crosscourt-revenue-ops skill still reaches Meta via Pipedream Connect (external_user_id=charles_crosscourt), not the direct token — needs a skill pointer to facebook.env before the agent will actually use it.

Copied stripe.env and activecampaign.env to ~/credentials/ on cynthia-crosscourt (5.161.181.167), chmod 600, md5-verified vs local. Facebook OAuth not yet captured anywhere — pending source/format from Ricki. Cred dir on server is chmod 700, only the cynthia user.

Lean pullers at ~/scripts/crosscourt-pullers/ write to data/stripe/ and data/activecampaign/. First snapshot (2026-05-07): MRR $51,608 across 233 active subs, $41,142 / 314 charges / 212 unique buyers in the last 30d, 15,820 AC contacts, 10/44 active automations. Skips full customer history by default — set CC_FULL=1 if needed. No cron yet; run manually with pull-all.sh. Summary lives at data/summary.md, time-series snapshots at data/snapshots/.

Stored at credentials/activecampaign.env. URL https://crosscourt.api-us1.com, REST API key, plus remote MCP endpoint https://crosscourt.activehosted.com/api/agents/mcp/http. Auth header for REST is Api-Token: {key}.

Stored at credentials/stripe.env (chmod 600, gitignored). Restricted live key (rk_live_), not a full secret key — scoped permissions per Stripe restricted-key model. First in a planned set of API connections; Metabase next pending URL + auth method from Charles.

Confirmed by Ricki: original engagement was $500 one-time (2026-04-16), now upgraded to $2K/mo recurring. Updated state.yaml mrr: 1000 → 2000, README status line, and clients/README.md index entry.

Created analyses/crosscourt-2026-04-source.md capturing the published page's cover line, headline stats, section h2s, and components used. Reference example for the design system per analysis-pipeline.md memory.

No prior vault folder existed. Backfill is incomplete — README has TBD fields that need to be confirmed. Source artifacts: analysis page (~/analysis/crosscourt.html) and the 2026-04-14 commit referencing the $1K/mo proposal.