# Sovereign Estate Forensic Master Action Plan Blueprint v3.0 **Document ID:** BLUEPRINT-ESTATE-RECOVERY-20261014-V3 **Date:** 14 October 2026, 04:32 AEDT **Host Fleet:** M16 (`Fabians-MacBook-Pro.local` / `diaz_m62`), M6 (`m6` / `fdtasm5pro`), Mac Mini (`mini` / `fabiandiaz`) **Status:** FULL HARDENED RECOVERY BLUEPRINT — AMBIENT CAPTURE & TELEMETRY ANCHORED --- ## 1. Executive Summary & Ground Truth Architecture This master blueprint establishes the definitive, terminal-controlled framework to audit, extract, standardize, and converge all intellectual property, engineering specifications, communication archives, and AI development history across Fabian Diaz's entire estate. Every artifact, document, and claim must be **categorically anchored to primary telemetry**: * **Spoken Audio:** Raw audio byte hashes from Plaud and Wispr Flow. * **Ambient Activity:** Typed keystrokes and focus sessions in [`~/.tas/capture-layer/store/capture.db`](file:///Users/diaz_m62/.tas/capture-layer/store/capture.db) (**4.3 MB**). * **Clipboard History:** Verbatim pasteboard snapshots in [`06_LIVE_RECEIPTS/capture_ledger.jsonl`](file:///Users/diaz_m62/0.01_Project_Bridge/06_LIVE_RECEIPTS/capture_ledger.jsonl) (**204 KB**). * **Agent Executions:** Exact tool receipts, bash commands, and diffs from Claude Code (`.jsonl`) and Codex (`.sqlite`). ``` [ THE TRUTH ENGINE ] │ ┌─────────────────────────────────┼─────────────────────────────────┐ │ │ │ [ AMBIENT CAPTURE ] [ RELATIONAL CORE ] [ ARTIFACT AUDIT ] capture.db (4.3 MB) PostgreSQL (:55432) CAS Blobs (/blobs/sha256/) capture_ledger.jsonl catalog.sqlite Google Docs (Aptos / Navy) Wispr Flow SQLite 501 Asks Ledger tas_docx.py v2.8 Gate Plaud Raw Audio S3 Agent Turns (Claude/Codex) Obsidian [[Wikilinks]] ``` ### Core Operating Laws: 1. **The Terminal Controls Everything:** Only filesystem bytes, SQLite/PostgreSQL tables, SHA-256 hashes, Git commits, and command receipts constitute evidence. AI summaries are never evidence of completion. 2. **Zero Shared Write Contention:** No machine writes across network mounts or directly into another machine's working directory. Each machine writes strictly to its local `/tmp/fleet_/` scratch space. 3. **Categorical Provenance Gate:** Every created document must be proven as human-typed, human-dictated, agent-generated, or externally imported by matching timestamps against ambient capture logs. 4. **Preserve Originals Before Extraction:** Raw binary blobs are stored immutably in Content-Addressed Storage (CAS) under `/blobs/sha256/` before text extraction or conversion. --- ## 2. Machine Hardware Partitioning & Workload Matrix By eliminating sequential bottlenecks and executing tasks in parallel across all three Apple Silicon machines, the heavy data extraction timeline compresses from **18+ sequential hours down to ~4 to 6 concurrent elapsed hours**: | Machine Node | Local Hardware Context | Dedicated Extraction Workload | Output Scratch Directory | |---|---|---|---| | **Mac Mini** (`mini`) | Always-on server (`100.76.122.34`), user `fabiandiaz`. Environment: `notebooklm-py 0.8.4` in `/Users/fabiandiaz/.tas/venvs/notebooklm/`. | 1. 4 Target Notebooks metadata extraction (`aca2c755`, `bbb25602`, `ddc9d356`, `0d13805b`).
2. Plaud.ai raw audio S3 downloads & structured transcript JSON.
3. Local Wispr Flow SQLite snapshots. | `/tmp/fleet_mini/` | | **M6** (`m6`) | CAD/GIS workstation (`100.125.160.69`), user `fdtasm5pro`. Port-forwarded PostgreSQL tunnel (`55432:55432`). | 1. PostgreSQL table dumps (`docctrl.files`, `kg.item`, `kg.node`, `kg.ask`).
2. Spatial CAD & 1:1 DXF geometry extraction for AS 4191 compliance.
3. Local M6 session archives (330 Codex / 237 Claude logs). | `/tmp/fleet_m6/` | | **M16** (Local) | Primary cockpit (`Fabians-MacBook-Pro.local`), user `diaz_m62`. Orchestration on `:8765`, QMD on `:8181`. | 1. Multi-account mailbox header & attachment crawls.
2. Local Apple Mail `.emlx` archive extraction.
3. Content-Addressed Storage blob management (`/blobs/sha256/`).
4. Cross-referencing against `capture.db` & `capture_ledger.jsonl`.
5. TAS Document Standard v2.8 compliance gate & Obsidian mesh. | `/tmp/fleet_m16/` $\rightarrow$ `~/0.01_Project_Bridge/` | --- ## 3. Ambient Capture & Telemetry Cross-Verification Gate Every document or code artifact claiming a specific creation or modification date is cross-examined against **three independent local telemetry streams**: ``` [ ARTIFACT TIMESTAMP: T ± 60s ] │ ┌───────────┼───────────┐ ▼ ▼ ▼ [ capture.db ] [ capture_ledger ] [ Agent Session Logs ] Typed pulses Pasteboard snaps Bash commands / diffs Wispr dictation App / URL focus tool_use & tool_result ``` ### 1. Keystroke & Typing Verification ([`~/.tas/capture-layer/store/capture.db`](file:///Users/diaz_m62/.tas/capture-layer/store/capture.db)): * **Database Size:** **4.3 MB SQLite store** with full-text search (`events_fts`). * **Table `events`:** * `source = 'typed'`: Fine-grained `pulse` chunks and rolled-up `block` rows tracking typing activity per application (`app_bundle`, `app_name`, `window_title`, `url`). * `source = 'dictated'`: Direct linkages to Wispr Flow via `wispr_id`. * **Table `focus_sessions`:** Tracks terminal and desktop context transitions, recording which window was active even when typing was idle. ### 2. Clipboard Capture Ledger ([`06_LIVE_RECEIPTS/capture_ledger.jsonl`](file:///Users/diaz_m62/0.01_Project_Bridge/06_LIVE_RECEIPTS/capture_ledger.jsonl)): * **Size:** **204 KB JSONL hash chain**. * **Integrity:** Verified SHA-256 chain (`prev` hash to `entry_hash`). * **Records:** Exact text snippets, URLs, and encrypted vault references (`[LOCAL_VAULT_REF: sec_...]`) copied between applications. ### 3. Categorical Provenance Classifications: Every document in `catalog.sqlite` is assigned an evidence-backed classification: * **`PROVEN_HUMAN_TYPED`:** Text appears in `capture.db` `typed` blocks within the document's editing window. * **`PROVEN_HUMAN_DICTATED`:** Text matches Wispr Flow dictation records linked via `wispr_id`. * **`PROVEN_AGENT_GENERATED`:** Exact file diff or command execution appears in Claude Code (`.jsonl`) or Codex (`.sqlite`) session logs. * **`PROVEN_EXTERNAL_IMPORT`:** Matches an inbound email attachment (`.emlx`) or verified web download receipt. * **`UNANCHORED_SYNTHESIS`:** Document timestamp has no matching keystrokes, dictations, agent tool calls, or downloads. **Quarantined as unverified.** --- ## 4. Universal Agent Session Extraction Architecture All developer agent sessions across M16, M6, and the Mac Mini are extracted into standardized relational tables in `catalog.sqlite`: | Agent Engine | Storage Location on Disk | Native Format | Extraction Mechanism | |---|---|---|---| | **OpenAI Codex** | `~/.codex/thread_history_1.sqlite`
`~/.codex/session_index.jsonl` | SQLite: `thread_turns`, `thread_items` | Query `thread_items` by `rollout_ordinal`, parsing `item_json` for user messages, agent responses, tool commands, and diffs. | | **Claude Code** | `~/.claude/projects//*.jsonl`
`~/.claude/history.jsonl` | Append-only JSON Lines (37 files on M16, e.g. `4ee8defe...jsonl` [28.8 MB]) | Stream-parse each JSON line into `type` (`user`, `assistant`, `tool_use`, `tool_result`), extracting full prompts, bash commands, stdout/stderr, and tool parameters. | | **Antigravity (`agy`)** | `~/.gemini/antigravity-cli/`
`/tmp/fleet_mini/sessions/` | Protobuf (`jetski_state.pbtxt`) + JSON execution envelopes | Parse the JSON stdout envelopes (`status`, `response`, `usage`, `structured_output`) and session scratch logs (`agy.log`). | | **Grok CLI / GrokBot** | `~/.grok/` and `~/.grokbot/` | JSON daemon state, logs, and interaction records | Ingest `local-exec-daemon.log` and `local-exec-backend-return.json` to capture commands, returns, and execution contexts. | | **Perplexity (Comet / Tasks)** | `~/.perplexity-local-browser.sock`
`Google Drive/Perplexity/`
Browser Profile IndexedDB | Local IPC socket + exported Markdown + Cloud task JSON | Ingest the 74 exported transcripts in notebook `ddc9d356` and query `/api/computer/tasks/` via authenticated browser session to pull full task logs. | ### Relational Schema in `catalog.sqlite`: ```sql CREATE TABLE agent_sessions ( session_id TEXT PRIMARY KEY, agent_name TEXT, -- 'codex', 'claude', 'antigravity', 'grok', 'perplexity' host TEXT, -- 'm16', 'm6', 'mini' file_path TEXT, file_sha256 TEXT, started_at TEXT, completed_at TEXT, total_turns INTEGER ); CREATE TABLE agent_turns ( turn_id TEXT PRIMARY KEY, session_id TEXT REFERENCES agent_sessions(session_id), ordinal INTEGER, speaker TEXT, -- 'user', 'agent', 'tool_use', 'tool_result' content TEXT, tool_command TEXT, tool_output TEXT, exit_code INTEGER, char_count INTEGER, raw_sha256 TEXT ); ``` --- ## 5. Phase 0: Fleet Pre-Flight & Hardening (All Hosts) **Target Duration:** 15–20 minutes (Parallel) **Objective:** Isolate legacy processes, verify authentication tokens, and freeze baseline listings without triggering read side-effects. ### Parallel Actions: 1. **On M16 (Local):** * Inspect and terminate the legacy process tree rooted at PID 9530 (including headless Chrome PID 9548) explicitly by PID. Avoid blanket wildcard `pkill`. * Initialize local CAS directory tree: ```bash mkdir -p ~/0.01_Project_Bridge/07_ESTATE_LAKE/blobs/sha256 mkdir -p ~/0.01_Project_Bridge/05_INCOMING_EXPORTS/notebook_metadata ``` 2. **On Mac Mini (`mini`):** * Execute non-mutating passive authentication check: ```bash ssh -o BatchMode=yes -o ConnectTimeout=5 mini \ "/Users/fabiandiaz/.tas/venvs/notebooklm/bin/python -B -m notebooklm --storage /Users/fabiandiaz/.notebooklm/profiles/scifd auth check --test --passive --json" ``` * If response redirects or fails, halt with `AUTH_EXPIRED`. * Issue a single batch list-level call across all target notebooks to freeze initial listing before any detail read can advance `last_viewed_at`: ```bash ssh mini "/Users/fabiandiaz/.tas/venvs/notebooklm/bin/python -B -m notebooklm --storage /Users/fabiandiaz/.notebooklm/profiles/scifd list --json" > /tmp/fleet_mini/initial_listing.json ``` 3. **On M6 (`m6`):** * Verify read-only PostgreSQL tunnel connectivity on `127.0.0.1:55432`. * Confirm read access to CAD and DXF project paths without modifying working tree. --- ## 6. Phase 1: Parallel Ingestion Execution (Concurrent Fleet) **Target Duration:** 3–5 hours (Concurrent) **Execution:** Dispatched across all three machines simultaneously. ### Lane A: Mac Mini Execution 1. **Four Target Notebooks Metadata Extraction:** * Target IDs: `0.01% Ai Power Users` (`aca2c755`), `KG` (`bbb25602`), `Perplexity Computer` (`ddc9d356`), `Instagram Research` (`0d13805b`). * Enforce Deny-List: The 23 Domain 00 source IDs from `00_MASTER_INDEX.md` and the 2 named restricted records (`6aa662b7`, `1f0ab642`) are recorded as `EXCLUDED_DOMAIN_00` with zero bodies fetched. * Step down chat limits dynamically (100 $\rightarrow$ 30 $\rightarrow$ 10) to prevent dropping connections on the 50 MB internal RPC ceiling. * Output: Raw JSON payloads written to `/tmp/fleet_mini/raw//` and indexed into `/tmp/fleet_mini/catalogue.sqlite`. 2. **Plaud.ai Audio & Transcript Pipeline:** * Download original audio files via signed S3 URLs directly to `/tmp/fleet_mini/audio/`. * Extract full structured JSON transcripts (`outline`, `transcript_blocks`, `polish_text`) and speaker diarisation segments. 3. **Wispr Flow Local Snapshot:** * Execute Python `sqlite3.backup()` from read-only URIs to freeze committed WAL frames, preserving raw, formatted, and pasted text variants. ### Lane B: M6 Execution 1. **PostgreSQL Relational Dump:** * Dump tables `docctrl.files`, `kg.item`, `kg.node`, and `kg.ask` to `/tmp/fleet_m6/postgres_dump.jsonl` using read transactions. 2. **Spatial CAD / DXF Layer Extraction:** * Run `ezdxf` geometry and layer extractor across Portaboom base frames and boom arm assemblies, outputting layer manifests and block definitions. 3. **Session Archive Indexing:** * Generate raw SHA-256 manifests of the 330 Codex and 237 Claude session logs in `/tmp/fleet_m6/session_manifest.jsonl`. ### Lane C: M16 Execution 1. **Multi-Account Mailbox Manifest:** * Paged header crawl across `scifd3443@gmail.com`, `f.diaz.co@gmail.com`, `tas.portaboom@gmail.com`, and M365 (`trafficaccess.com.au`). * Pull `Message-ID`, `Thread-ID`, `Date`, `From`, `To`, `Subject`, and `HasAttachments` to `mail_manifest.jsonl`. 2. **Content-Addressed Attachment Extraction:** * Stream attachments directly to `/blobs/sha256/`. * Global Deduplication: If the same 12 MB PDF exists in 15 threads, write bytes once; record 15 relational occurrences in `catalog.sqlite`. 3. **Local Mail Cache Crawl:** * Parse resident `.emlx` files from `~/Library/Mail/V10/` to recover historical attachments purged from cloud inboxes. --- ## 7. Phase 2: Fleet Consolidation & Atomic Merge (M16 Cockpit) **Target Duration:** 45–60 minutes **Execution Host:** M16 Local Terminal **Objective:** Pull all remote payloads to M16, verify checksums, and merge into the unified relational ledger. ### Action Items: 1. **Atomic Ingest via Rsync:** ```bash rsync -avz mini:/tmp/fleet_mini/ ~/0.01_Project_Bridge/07_ESTATE_LAKE/incoming_mini/ rsync -avz m6:/tmp/fleet_m6/ ~/0.01_Project_Bridge/07_ESTATE_LAKE/incoming_m6/ ``` 2. **Post-Transfer Checksum Verification:** * Verify every transferred file against its remote source manifest. Any hash mismatch triggers an immediate single-file re-fetch. 3. **Merge into Unified `catalog.sqlite`:** * Populate master relational tables: * `objects`: `sha256` (PK), `size_bytes`, `mime_type`, `first_seen_at`. * `locations`: `sha256`, `host_or_cloud`, `path_or_uri`, `mtime`, `birthtime`, `version_id`. * `email_attachments`: `attachment_sha256`, `message_id`, `thread_id`, `account`, `filename`. * `voice_audio`: `audio_sha256`, `device_id`, `duration_sec`, `transcript_id`. * `transcriptions`: `id`, `audio_sha256`, `raw_text`, `formatted_text`, `pasted_text`, `speakers`. --- ## 8. Phase 3: The 12-Sample Proof Gate Across All Formats **Target Duration:** 1.5–2 hours **Execution Host:** M16 Local Terminal **Objective:** Confirm complete extraction fidelity and terminal searchability across all 12 representative evidence classes before running bulk transformations. ### The 12 Test Chains: 1. **Vector PDF:** PORTABOOM PB4000L Brochure (`174503e9`) $\rightarrow$ Full text extracted $\rightarrow$ Verbatim spec searchable. 2. **Scanned PDF / Image:** DC12V Manual (`b3d88830`) $\rightarrow$ Extractor flags `IMAGE_ONLY` without crashing. 3. **Native Google Doc:** `TAS-ARCH-001` $\rightarrow$ Exported via API $\rightarrow$ Formatting, tables, and links preserved. 4. **Multi-Tab Spreadsheet:** Shipping Calculator v4 $\rightarrow$ Sheet names, formulas, and cells cataloged. 5. **CAD / DXF File (M6):** PB4000 base frame DXF $\rightarrow$ Layers and block metadata extracted via `ezdxf`. 6. **Plaud Recording:** Meeting 7 Oct 2026 (`de78c0c9`) $\rightarrow$ Audio hashed to CAS; transcript blocks linked. 7. **Wispr Flow SQLite Record:** Local `flow.sqlite` $\rightarrow$ WAL snapshot captured; raw, formatted, and pasted text extracted. 8. **Email Attachment:** SLS-869 quote PDF from TE PNG thread $\rightarrow$ Attachment hashed; linked to Message-ID. 9. **iMessage Conversation:** `chat.db` row $\rightarrow$ Parsed message text and linked photo attachment in Attachments folder verified. 10. **Git Repository Commit History:** `0.01pct-project` $\rightarrow$ Complete commit tree and diff hashes indexed. 11. **Evicted iCloud Stub File:** Dataless file in Mobile Documents $\rightarrow$ Detected as `ICLOUD_STUB_EVICTED` without network hang. 12. **Large Session Chat Log (>50 MB):** Multi-turn session $\rightarrow$ Stream-chunked without memory exhaustion. ### Acceptance Standard: $$\text{Original File Located} \longrightarrow \text{Binary Hashed} \longrightarrow \text{Extracted to CAS} \longrightarrow \text{Terminal Search Verified}$$ --- ## 9. Phase 4: Document Standardization Gate (`tas_docx.py`) & Google Drive Sync **Target Duration:** 2–3 hours **Execution Host:** M16 Local Terminal **Standard Authority:** [`/Users/diaz_m62/.tas/tas_docx.py`](file:///Users/diaz_m62/.tas/tas_docx.py) (TAS Standards v2.8 / STD-007.1) ``` [ EXTRACTED RECORD ] ──► [ tas_docx Build ] ──► [ tas_docx.verify() Gate ] │ ┌────────────────────┴────────────────────┐ ▼ ▼ [ PASS: [] ] [ FAIL: Held ] │ │ ▼ ▼ Upload to Google Drive Log violation to Twin Convert to Google Doc Keep in local scratch Stamp URL to Obsidian Never upload nonconforming ``` ### The Compliance Verification Gate: Every document compiled for Google Drive must return an empty error list `[]` from `tas_docx.verify()`. Non-compliant files are held locally in scratch and blocked from upload. ### Enforced Rules: * **Typography:** Minimum 80% Aptos font (`Aptos 11pt` body, `5pt` after; headings bold Navy `#1B2A4A` at `20pt`, `15pt`, `12pt`). * **Margins:** A4, 1-inch (2.54 cm) sides, 2.5 cm top/bottom, 1.0 cm header/footer distance. * **Headers & Footers:** Right 8pt Navy header (`Filename / Created | Status`); centered 8pt Navy footer (*Traffic & Access Solutions | Page X of Y*) with live Word dynamic fields (`PAGE` / `NUMPAGES`). * **Tables:** Navy header row (`#1B2A4A`) with white bold text, alternating row shading (`#F2F6FA`), light gray borders (`#D0D0D0`), and repeating header rows on multi-page tables. * **Text Hygiene:** Complete programmatic ban on em/en dashes (`—`, `–`). Replaced with commas, colons, or "to". * **Brand & Claims Filter:** `PORTABOOM` in all-caps; `Traffic & Access Solutions` (`&`, not `and`). Automatic rejection of unapproved marketing claims (*"one-person"*, *"full solar autonomy"*, unapproved dispatch text). * **The Digital Twin:** Checksums and verification receipts are saved to `.docx.json` alongside each document. --- ## 10. Phase 5: Obsidian Mesh & Tri-Modal Working Faces **Target Duration:** 1–2 hours **Execution Host:** M16 Local Terminal **Objective:** Deliver fully clickable navigation across all three working interfaces. ### 1. The Three Synchronized Working Faces: * **Face 1: The Founder Web Cockpit (`https://kg.fdnxt.com`):** * Real-time WebSocket telemetry (`postgres_changes`) bound to PostgreSQL on M6. * 4 Kanban state columns: `NEED`, `PROPOSED`, `VERIFIED`, `DONE`. * Multi-Room execution grid (`room:NOW`, `room:P01_PLAUD_BATCH`, `room:SECURITY_AUDIT`). * Live node visual telemetry: 🟢 Emerald (Insert), 🔵 Cyan (Read), 🟡 Amber (Handoff), 🔴 Red (Circuit Breaker Tripped). * **Face 2: The Offline Obsidian Knowledge Vault (`~/0.01_Project_Bridge/`):** * Every record card has frontmatter tags and bidirectional `[[wikilinks]]`. * Generates entity hub notes under `05_INCOMING_EXPORTS/_entities/.md` for all tracked entities (`AS4191`, `Ankuai_24V_BLDC`, `Arduino_Opta`, `Elsema_MCR915`, `TfNSW`, `NTRO_TIPES`). * Clickable Everywhere Linking Standard: * `obsidian://open?vault=0.01_Project_Bridge&file=...` (Opens local card in Obsidian). * `file:///Users/diaz_m62/0.01_Project_Bridge/07_ESTATE_LAKE/blobs/sha256/...` (Opens raw binary/audio on disk). * `https://docs.google.com/document/d/...` (Opens native TAS Google Doc). * `https://mail.google.com/mail/...` (Opens primary email thread). * **Face 3: The Terminal Control Surface (M16 Cockpit):** * Telemetry streaming on port `:8765`. * Local QMD search on port `:8181`. * Sub-millisecond SQL queries across `catalog.sqlite` with zero token burn. --- ## 11. Execution Schedule & Operational Cadence | Stage | Activities & Milestones | Active Time | Elapsed Window | |---|---|---|---| | **Stage 1: Pre-Flight & Hardening** | Phase 0: Process cleanup on M16, token validation on Mini, table checks on M6. | 15–20 mins | Day 1, 09:00 – 09:20 | | **Stage 2: Distributed Parallel Ingest** | Phase 1: Mini (Notebooks/Plaud/Wispr), M6 (Postgres/CAD/Logs), M16 (Mail/Attachments). | 3.0 – 5.0 hrs | Day 1, 09:30 – 14:30 | | **Stage 3: Fleet Consolidation** | Phase 2: Atomic rsync transfer to M16, hash validation, merge into `catalog.sqlite`. | 45–60 mins | Day 1, 14:30 – 15:30 | | **Stage 4: Proof Gate Validation** | Phase 3: Verify the 12 representative evidence chains across all formats. | 1.5 – 2.0 hrs | Day 1, 15:30 – 17:30 | | **Stage 5: Standardize & Link** | Phase 4 & 5: TAS v2.8 document gate, Google Drive sync, Obsidian mesh, master graph. | 2.5 – 3.5 hrs | Day 2, 09:00 – 12:30 | | **Total Distributed Execution** | **Full Estate Convergence Across All 3 Hosts** | **~8.5 – 12.0 hrs** | **1.5 Days Elapsed** |