leedab 0.5.3 → 0.6.1

package/context/product-brief.md

@@ -0,0 +1,134 @@
+# LeedAB Product Brief
+
+This is the canonical product context file. All agents should read this before substantive work.
+
+## One-liner
+
+An AI operator that lives on your machine, uses your tools like a human, and takes instructions over WhatsApp.
+
+## What LeedAB Is
+
+LeedAB is a local-first AI agent that runs on hardware the customer controls. Teams interact with it through messaging channels they already use (WhatsApp, Telegram, Slack, SMS, or a web dashboard). The agent operates the customer's existing software through computer use — pointing, clicking, navigating, filling forms, reading screens — exactly as a human operator would. No APIs to configure. No data leaves the building.
+
+## What LeedAB Does
+
+Anything an expert operations person could do at a computer:
+
+- Process payroll from attendance data
+- Generate documents from templates
+- Reconcile data across spreadsheets
+- Track shipments by checking carrier portals
+- Draft and send emails
+- Organize files
+- Build reports and presentations
+- Navigate client portals, ERPs, and CRMs
+- Fill forms and submit tickets
+
+It reads screens, navigates apps, and produces real outputs.
+
+## What LeedAB Is Not
+
+- Not a chatbot (it takes action, doesn't just respond)
+- Not an RPA tool (no scripts, no integration engineering)
+- Not a SaaS (runs on hardware the customer owns)
+- Not a cloud AI wrapper (data stays local)
+- Not a dev tool (the user is an ops manager, not an engineer)
+
+## Core Value Propositions
+
+1. **No APIs, no engineering team** — works with any software via computer use
+2. **Your data stays in your building** — local-first, AES-256 encrypted at rest
+3. **10-minute setup** — one install command, a setup wizard, it's live
+4. **Message it like a coworker** — WhatsApp/Telegram/Slack interaction, no new app
+5. **Gets better every day** — persistent local memory of your vendors, templates, preferences
+
+## Key Differentiators by Competitor Class
+
+| vs. | LeedAB wins on |
+|-----|----------------|
+| Zapier / Make / n8n | No APIs needed; local-first; handles legacy software; ops use cases beyond trigger/action |
+| UiPath / Automation Anywhere | 10-min setup; no engineering team; SMB pricing; AI-native not RPA-retrofit |
+| ChatGPT / Claude Enterprise | Actually takes actions; works with the customer's actual tools; data stays local |
+| Industry ERPs | Plugs into what they already use; broad ops reach, not single-vertical |
+
+## Target Customer
+
+**Primary ICP:** SMBs (10-200 employees) in ops-heavy industries:
+- Logistics and regional distribution
+- HR and staffing firms
+- Finance / bookkeeping / accounting
+- Professional services (law, consulting)
+- Delivery fleets and field operations
+
+**Buyer persona:** Ops manager, COO, office manager, or owner-operator. Typically drowning in manual computer work. Has tried (and been frustrated by) traditional automation that required APIs, developers, or cloud migration.
+
+**Anti-persona:** Large enterprises with dedicated IT, tech companies who build their own tools, consumer users.
+
+## Technical Architecture
+
+- **Install:** single CLI command — curl one-liner (Mac/Linux) or PowerShell (Windows), or `npm install -g leedab`
+- **Runtime:** Node.js 18+
+- **Hardware minimum:** 8GB RAM, any modern Mac/Windows/Linux. Mac Mini ideal for always-on.
+- **AI providers supported:** Anthropic Claude, OpenAI, Google Gemini, DeepSeek, OpenRouter, local models (Ollama, etc.). User brings their own API key. Switch providers anytime.
+- **Storage:** Local filesystem. AES-256 encryption at rest. All logs, memory, audit trail local.
+- **Access control:** Role-based — admin, operator, viewer.
+- **Audit trail:** Full, local, inspectable, exportable, deletable.
+- **Privacy ceiling:** Run a local LLM for zero data egress. Or use Bedrock/Vertex in the customer's own cloud account.
+
+## Channels
+
+Team members interact with LeedAB through:
+
+- **WhatsApp** — most common for logistics and international SMBs
+- **Telegram** — common in certain regions and tech-forward ops teams
+- **Slack** — when the team already uses it for internal comms
+- **SMS** — fallback for lowest-common-denominator access
+- **Web dashboard** — browser UI for admins, audit review, and configuration
+
+## Onboarding Flow (current)
+
+1. User runs install command from the website
+2. Setup wizard launches, prompts for AI provider + API key
+3. User connects messaging channels (WhatsApp, Telegram, Slack, SMS)
+4. User sets team access (admin/operator/viewer roles)
+5. User messages the agent a task
+6. Agent opens apps, navigates, completes task, reports back
+
+Target: under 10 minutes end-to-end. Non-technical users must be able to complete it.
+
+## Current Traction Snapshot
+
+*This section should be updated by founders. Check `context/metrics.md` for latest numbers.*
+
+Representative testimonials from the website:
+
+- **Marcus Rivera (HR & Ops, delivery fleet):** Payroll went from two people for three days to one person sending files on Telegram and getting the full breakdown back.
+- **Amara Osei (Ops Coordinator):** Data normalization across three client formats went from half-day to seconds — the agent flags discrepancies and produces one clean sheet.
+- **Daniel Kim (COO, regional logistics):** Running on a Mac Mini in the office. Vendor rates, payroll, contract details — none of it leaves the building.
+
+## Pricing Model
+
+- 7-day free trial, cancel anytime
+- Stripe checkout, direct signup from website
+- Pricing details beyond the trial: founders to specify
+
+## Security & Compliance Posture
+
+- All customer data stays on customer hardware
+- AES-256 encryption at rest
+- Full local audit trail, tamper-evident
+- Role-based access control
+- Options for maximum privacy: local LLM (fully offline), or enterprise AI providers (AWS Bedrock / Google Vertex AI) running in the customer's own cloud account with zero-retention policies
+
+## Roadmap Headlines
+
+See `context/roadmap.md` for current roadmap. High-level themes:
+
+- Deepening channel support (voice messages, file uploads, richer formatting)
+- Memory and personalization improvements (learn customer preferences faster)
+- New vertical templates (pre-configured skill packs for logistics, HR, finance)
+- Admin dashboard improvements (audit review, team management, cost monitoring)
+
+---
+
+*Last updated: keep this date current when product details change significantly.*

package/context/roadmap.md

@@ -0,0 +1,76 @@
+# LeedAB Roadmap
+
+**Founders: update this file after each planning cycle. Agents check this to align recommendations with current priorities.**
+
+*Last updated: [DATE — fill in]*
+
+## Current Quarter Focus
+
+*[Founders: fill in the 1-3 biggest priorities for this quarter.]*
+
+### Theme 1: [e.g. Channel depth]
+Goal: [specific outcome]
+Key work: [list]
+
+### Theme 2: [e.g. Onboarding time-to-value]
+Goal: [specific outcome]
+Key work: [list]
+
+### Theme 3: [e.g. Vertical templates]
+Goal: [specific outcome]
+Key work: [list]
+
+## In Flight (this month)
+
+Features currently being built:
+- [Feature 1 — status, target date]
+- [Feature 2 — status, target date]
+
+## Next Up (this quarter)
+
+Queued for the next planning cycle:
+- [Feature A — rationale]
+- [Feature B — rationale]
+
+## Icebox (considering, not committed)
+
+Ideas that have merit but aren't prioritized:
+- [Idea X]
+- [Idea Y]
+
+## Explicitly Not Doing
+
+Things we've decided against, with reasoning (so we don't re-litigate):
+- [Decision — reason]
+
+## Themes by Horizon
+
+### 0-3 months (now)
+- Channel depth (voice messages, file uploads, richer formatting)
+- Onboarding improvements (first-task activation)
+- Memory and personalization refinements
+
+### 3-6 months (next)
+- Vertical template packs (logistics, HR, finance)
+- Admin dashboard improvements
+- Advanced access controls and audit review
+
+### 6-12 months (later)
+- Partner/channel program
+- Multi-agent coordination (multiple LeedAB instances per org)
+- Industry-specific compliance certifications (as customers require)
+
+### 12+ months (someday)
+- [Speculative but meaningful]
+
+## Principles for Prioritization
+
+When deciding what to build:
+
+1. **Revenue unlock first** — what removes a blocker to paid conversion?
+2. **Churn fixes second** — what are current customers leaving over?
+3. **Moat third** — what makes LeedAB harder to replicate?
+4. **Operational leverage** — what lets us serve more customers per head?
+5. **Strategic optionality** — what opens new segments?
+
+If a feature doesn't clearly land in one of these buckets, push back on it.

package/context/skills/brand-skills.md

@@ -0,0 +1,62 @@
+# Brand — Skill Pack
+
+## LeedAB brand pillars
+- **Editorial, not corporate-tech.** The reference is a smart magazine (The Atlantic, The Economist, Stripe Press) — never a SaaS landing page.
+- **Confident restraint.** A single bold statement on a clean page beats five competing elements.
+- **Warm + dense.** Cream paper background (#efe9dd), deep ink (#1a1713), single amber accent (#c95c0a). No gradients. No abstract 3D AI imagery.
+- **Founder voice.** First person, declarative, specific.
+
+## Type system
+- **Display:** Fraunces (serif, italic-friendly, with a soft slab feel) — for headlines, hero copy, italic emphasis.
+- **Body:** Inter — for paragraphs, UI labels, all general text.
+- **Mono:** JetBrains Mono — for codes, section markers (§ XX), terminal-style metadata, agent identifiers.
+
+## Hierarchy — slide pattern
+A LeedAB slide should clear at a glance:
+1. **Section marker** (mono, small, amber) — `§ 02 — STRATEGY`
+2. **Headline** (display serif, large, near-black) — `Logistics SMBs deserve better than this.`
+3. **Lede** (sans, mid-grey) — one sentence.
+4. **Body / chart / image** — only one beneath, never three.
+5. **Footer mark** — page number + date in mono.
+
+White space is doing work. Empty zones are correct.
+
+## Colour usage
+- **Amber (#c95c0a)** — accent only. Pull-quotes, links, primary buttons, KPI emphasis. Never as a fill across an area > 25% of the slide.
+- **Ink** — primary text. Always near-black, never pure black (#000 reads harsh on warm paper).
+- **Hair (var(--hair))** — borders, dividers, subtle separators. Never use a black 1px line where a hair line works.
+- **Editorial section colours** (per team in the dashboard) — for taxonomy markers only, not for headlines.
+
+## Logo usage
+- Logo is the wordmark `LeedAB.` with a colored period — period is amber, default. The period is the only mandatory accent.
+- Minimum size: 80px wide on screen, 18mm in print.
+- Clear space: at least the height of the "L" on all sides.
+- Never re-color the wordmark itself.
+- Never set logo on a busy photographic background — use a paper-coloured panel underneath.
+
+## What to NOT do (common AI / SaaS clichés to avoid)
+- Glowing nodes / network graphs as decoration.
+- Gradient blobs in the corner.
+- Iconography that's "AI feels" (brain icons, robot heads, sparkles).
+- Stock photos of people pointing at screens.
+- Sans-serif italic for emphasis (use display serif italic instead).
+- Centred body copy.
+- Drop shadows on cards (use a 1px hair border instead).
+
+## Accessibility floor
+- Body text contrast ≥ 4.5:1 vs background.
+- Slide body never below 18pt; product UI body never below 14px.
+- Colour is never the only signal — pair with shape, weight, or text.
+- Touch targets ≥ 44×44px on mobile.
+
+## Asset specs
+- **Slide deck:** 16:9, 1920×1080, presented at 100%.
+- **Social card:** 1200×630.
+- **Email header:** 600×200, retina = 1200×400.
+- **Site hero illustration:** vector preferred; raster ≥ 1600px wide.
+
+## Don't
+- Approve a deck that violates the type system because "the client's tight on time."
+- Use red/green as the only signal for status.
+- Add a logo lockup to slides that are clearly internal.
+- Recommend a logo refresh as the answer to a positioning problem.

package/context/skills/campaigns-skills.md

@@ -0,0 +1,161 @@
+# Campaigns Agent Skills
+
+> Sourced from coreyhaines31/marketingskills (MIT License)
+
+---
+name: paid-ads
+description: "When the user wants help with paid advertising campaigns on Google Ads, Meta (Facebook/Instagram), LinkedIn, Twitter/X, or other ad platforms. Also use for 'PPC,' 'paid media,' 'ROAS,' 'CPA,' 'ad campaign,' 'retargeting,' 'audience targeting,' 'Google Ads,' 'Facebook ads,' 'LinkedIn ads,' 'ad budget,' or 'cost per click.'"
+metadata:
+  version: 1.2.0
+---
+
+# Paid Ads
+
+You are an expert performance marketer. Your goal is to help create, optimize, and scale paid advertising campaigns that drive efficient customer acquisition.
+
+## Platform Selection Guide
+
+| Platform | Best For | Use When |
+|----------|----------|----------|
+| **Google Ads** | High-intent search traffic | People actively search for your solution |
+| **Meta** | Demand generation, visual products | Creating demand, strong creative assets |
+| **LinkedIn** | B2B, decision-makers | Job title/company targeting matters, higher price points |
+| **Twitter/X** | Tech audiences, thought leadership | Audience is active on X, timely content |
+
+## Campaign Structure
+
+```
+Account
+├── Campaign 1: [Objective] - [Audience/Product]
+│   ├── Ad Set 1: [Targeting variation]
+│   │   ├── Ad 1: [Creative variation A]
+│   │   ├── Ad 2: [Creative variation B]
+│   └── Ad Set 2: [Targeting variation]
+└── Campaign 2...
+```
+
+## Ad Copy Frameworks
+
+**Problem-Agitate-Solve (PAS):**
+> [Problem] → [Agitate the pain] → [Introduce solution] → [CTA]
+
+**Before-After-Bridge (BAB):**
+> [Current painful state] → [Desired future state] → [Your product as bridge]
+
+**Social Proof Lead:**
+> [Impressive stat or testimonial] → [What you do] → [CTA]
+
+## Creative Best Practices
+
+### Image Ads
+- Clear product screenshots showing UI
+- Before/after comparisons
+- Stats and numbers as focal point
+- Bold, readable text overlay (keep under 20%)
+
+### Video Ads (15-30 sec)
+1. Hook (0-3 sec): Pattern interrupt or bold statement
+2. Problem (3-8 sec): Relatable pain point
+3. Solution (8-20 sec): Show product/benefit
+4. CTA (20-30 sec): Clear next step
+
+## Key Metrics
+
+| Objective | Primary Metrics |
+|-----------|-----------------|
+| Awareness | CPM, Reach, Video view rate |
+| Consideration | CTR, CPC, Time on site |
+| Conversion | CPA, ROAS, Conversion rate |
+
+## Optimization: Fixing Poor Performance
+
+**If CPA is too high:** Check landing page → tighten targeting → test new creative angles
+
+**If CTR is low:** Test new hooks/angles → refine targeting → refresh creative
+
+**If CPM is high:** Audience too narrow → expand targeting → improve creative relevance
+
+## Retargeting by Funnel Stage
+
+| Stage | Audience | Message |
+|-------|----------|---------|
+| Top | Blog readers, video viewers | Educational, social proof |
+| Middle | Pricing/feature page visitors | Case studies, demos |
+| Bottom | Cart abandoners, trial users | Urgency, objection handling |
+
+---
+
+---
+name: ab-test-setup
+description: When the user wants to plan, design, or implement an A/B test or experiment, or build a growth experimentation program. Also use for "A/B test," "split test," "experiment," "hypothesis," "statistical significance," "how long should I run this test," "growth experiments," "experiment backlog," "ICE score," or "experimentation program."
+metadata:
+  version: 1.2.0
+---
+
+# A/B Test Setup
+
+You are an expert in experimentation and A/B testing. Your goal is to help design tests that produce statistically valid, actionable results.
+
+## Hypothesis Framework
+
+```
+Because [observation/data],
+we believe [change]
+will cause [expected outcome]
+for [audience].
+We'll know this is true when [metrics].
+```
+
+**Weak**: "Changing the button color might increase clicks."
+
+**Strong**: "Because users report difficulty finding the CTA (per heatmaps), we believe making the button larger with contrasting color will increase CTA clicks by 15%+ for new visitors."
+
+## Sample Size Quick Reference
+
+| Baseline | 10% Lift | 20% Lift | 50% Lift |
+|----------|----------|----------|----------|
+| 1% | 150k/variant | 39k/variant | 6k/variant |
+| 3% | 47k/variant | 12k/variant | 2k/variant |
+| 5% | 27k/variant | 7k/variant | 1.2k/variant |
+| 10% | 12k/variant | 3k/variant | 550/variant |
+
+## Metrics Selection
+
+- **Primary metric**: Single metric tied to hypothesis
+- **Secondary metrics**: Support primary metric interpretation
+- **Guardrail metrics**: Things that shouldn't get worse
+
+## Pre-Launch Checklist
+- [ ] Hypothesis documented
+- [ ] Primary metric defined
+- [ ] Sample size calculated
+- [ ] Variants implemented correctly
+- [ ] Tracking verified
+- [ ] QA on all variants
+
+## Growth Experimentation Program
+
+### ICE Prioritization
+Score each hypothesis 1-10 on:
+- **Impact**: How much will this move the primary metric?
+- **Confidence**: How sure are we this will work?
+- **Ease**: How fast and cheap can we ship and measure?
+
+**ICE Score** = (Impact + Confidence + Ease) / 3
+
+### Experiment Velocity Targets
+| Metric | Target |
+|--------|--------|
+| Experiments launched per month | 4-8 |
+| Win rate | 20-30% |
+| Average test duration | 2-4 weeks |
+| Backlog depth | 20+ hypotheses |
+
+### The Experiment Loop
+1. Generate hypotheses (from data, research, competitors, customer feedback)
+2. Prioritize with ICE scoring
+3. Design and run the test
+4. Analyze results with statistical rigor
+5. Promote winners to a playbook
+6. Generate new hypotheses from learnings
+→ Repeat

package/context/skills/compliance-skills.md

@@ -0,0 +1,83 @@
+# Compliance — Skill Pack
+
+## Frameworks to know (LeedAB's likely customer mix)
+- **SOC 2 Type 2** — US enterprise + most regulated US verticals.
+- **ISO 27001** — international + EU customers, often paired with ISO 27701 for privacy.
+- **GDPR** — anything touching EU residents.
+- **Australian Privacy Principles (APP)** — under the Privacy Act 1988 (Cth). Mandatory for entities with > $3m AUD turnover.
+- **HIPAA** — only when working with US healthcare data. Heavyweight — flag if customer asks.
+- **PCI-DSS** — if storing or transmitting card data. Most customers should NOT be in scope (use a tokenisation provider).
+
+## SOC 2 control families (Trust Services Criteria)
+- **CC1** — Control environment (governance)
+- **CC2** — Communication and information
+- **CC3** — Risk assessment
+- **CC4** — Monitoring activities
+- **CC5** — Control activities
+- **CC6** — Logical and physical access
+- **CC7** — System operations
+- **CC8** — Change management
+- **CC9** — Risk mitigation
+
+When mapping evidence, label which CC it satisfies — auditors search by control number.
+
+## Risk register conventions
+| Field | Convention |
+|-------|------------|
+| Likelihood | 1 (rare) – 5 (almost certain) |
+| Impact | 1 (negligible) – 5 (catastrophic) |
+| Score | L × I (1–25) |
+| Status | Open / Mitigating / Accepted / Closed |
+| Owner | Named individual or role, never "the team" |
+| Review cadence | Quarterly minimum; monthly for score ≥ 15 |
+
+A risk under "Accepted" must have a written rationale from a director / equivalent.
+
+## Insurance — minimum coverage shape (Australian SMB)
+- **Public liability:** $20m (commercial standard).
+- **Professional indemnity:** $5–10m for a SaaS / services business; higher for advice.
+- **Cyber:** $1–5m, with coverage for ransomware + business interruption + customer notification costs.
+- **Product liability:** if shipping physical goods.
+- **Workers' comp / WorkCover:** mandatory by state.
+- **Directors & officers:** once you have outside investors or independent directors.
+
+Renewals get a 60-day-before-expiry alert.
+
+## Vendor due diligence questionnaire — common questions to pre-bake answers for
+- Where is data hosted (region + provider)?
+- Is data encrypted at rest? In transit? With what?
+- Who has access to production data? How is access reviewed?
+- Backup frequency, recovery tested?
+- Incident response plan? RTO / RPO?
+- Sub-processors used (with their own security posture)?
+- Right to audit clause?
+- Data deletion process on customer request?
+- DPA / DPIA available?
+
+Maintain a "DDQ master sheet" — the same questions get asked by every customer with slight wording changes.
+
+## Workplace H&S (logistics + trades especially)
+- Incident reporting within 24 hrs internally; serious incidents notifiable to the regulator (SafeWork in NSW, etc).
+- Toolbox talks weekly; minutes filed.
+- Safe Work Method Statements (SWMS) for high-risk work.
+- Return-to-work plans for any > 5-day absence due to injury.
+
+## Regulatory monitoring
+Subscribe (or follow): OAIC (privacy AU), CISA (US cyber), ENISA (EU cyber), industry-specific regulators (ATSB for transport, ASIC for finance, AHPRA for health).
+
+## Plain-English policy templates worth maintaining
+- Acceptable Use Policy
+- Data Retention Policy
+- Incident Response Policy
+- Access Control Policy
+- BYOD / Endpoint Policy
+- Vendor Management Policy
+- Business Continuity Plan
+
+Each policy: one page max, examples on every rule, owner named, last-reviewed date in the header.
+
+## Don't
+- Claim a certification that hasn't been issued. "SOC 2 in progress" is honest; "SOC 2 compliant" without an attestation is a lie.
+- Treat compliance as an annual sprint. The risk register lives.
+- Accept a vendor questionnaire answer that you can't evidence.
+- Substitute legal review for compliance review — they catch different things.

package/context/skills/concierge-skills.md

@@ -0,0 +1,55 @@
+# Concierge — Skill Pack
+
+## Daily brief send time
+**07:00 local to the founder.** Late enough that overnight events have settled, early enough to set the day's posture before the first meeting.
+
+## Calendar defence rules (default)
+- **Friday afternoons** are off-limits for new internal meetings.
+- **Tuesday and Thursday mornings** = deep work blocks. New requests get pushed.
+- **No meetings before 09:00 or after 18:00** without the founder's explicit ok per request.
+- **Buffer 15 minutes** between back-to-back meetings — never accept a request that violates this.
+- **Internal recurring 1:1s ≥ 6 people** is a yellow flag — propose async update instead.
+
+## Decline templates
+- **Cold meeting request, no clear ask:** "Thanks — what's the specific outcome you'd want from a 30 min? I'm happy to find time once that's clear."
+- **Meeting that should be a Loom:** "Could we do this async? If you Loom me 5 minutes I can send a written reply tonight."
+- **Speaking / panel invite, low signal:** "Thanks for thinking of me — passing this round on this one. Best of luck."
+- **Press request:** route to marketing / brand. Never decline solo.
+
+## Travel decision defaults
+- **Direct flights** preferred even when 30–50% pricier — time + reduced miss-risk.
+- **Window seats** unless trip is < 2 hrs (then aisle for speed off-plane).
+- **Hotels:** previously-stayed-at if available. New hotels need ≥ 4.5 stars and walking distance to first meeting.
+- **Transfer:** Uber Black on arrival days, normal Uber otherwise. Public transport for known cities only.
+- **Lounge access:** worth it for any trip with a layover > 90 min.
+
+## Expense categories (Mina-specific defaults)
+- Travel — flights, hotels, transfers
+- Travel meals — separate from team meals
+- Software — own subscriptions only (team subs go on company card)
+- Professional development — courses, books, conferences
+- Health — gym, supplements, physio
+- Personal — anything not deductible
+
+## Meeting prep one-pager — when to produce
+- Any external meeting with a new person.
+- Any internal meeting where the founder is being asked to make a decision.
+- Any board / investor meeting.
+- Skip for: standing internal team meetings, casual social, or anything < 15 min.
+
+## "Always assume" defaults (Mina)
+- Sydney is home base.
+- Standard contract for advisory work is 0.25–0.5% equity, 2-year vest, 6-month cliff.
+- Coffee meetings: yes. Networking events with > 50 people: default no.
+- Public speaking: yes if audience is engineers / founders, no if audience is generic business.
+
+## Personal info handling
+- **Never** echo passport details, credit card details, home address, family names in chat.
+- Write straight to `outputs/concierge/private/` (gitignored) or push to a vault `_secrets/` note.
+- If the founder pastes one in chat, take the action and respond without echoing.
+
+## Don't
+- Default to the founder's phone calendar without checking work calendar conflicts.
+- Book transit that requires changes the founder explicitly avoids (e.g. mid-flight transfers in low-trust airports).
+- Recommend public restaurants for sensitive meetings.
+- Send daily briefs that are just calendar dumps with no editorial.