Where data comes from, which agent touches it, where it comes to rest, and what is not wired yet. Operational reference — file paths and credential locations are real.
Left to right is chronological. Work does not start at Jira — Jira's only
inbound-to-agent edge is the agent-ready dispatch, drawn as the return loop
it actually is.
zero is an actor, not just a sink. It runs the Granola→Notion sync on a
schedule. The Studio only hosts granola-watchdog.sh, which fires at 19:15,
stays silent when healthy, and alerts by Telegram when a run goes missing.
Mechanism and path for each connection, so a failure traces to a specific file rather than a guess.
| From → To | Direction | Mechanism |
|---|---|---|
| Teams / Meet → Granola | capture | Meeting notes captured at call time |
| Granola → Notion | scheduled | Task on zero, weekdays 18:00 — one Activity Log entry per meeting |
| Teams / Meet → Claude | ad hoc | Transcripts read directly into a session. Leaves no record unless written out |
| Claude ↔ Obsidian | read + write | ~/Documents/Work/Knowledge — CLAUDE.md hot cache → memory/ depth |
| Claude → Notion | write | Clients DB deedb5be…; append timeline row at top of current month, set Last Activity |
| Jira → Claude | dispatch | ~/bin/jira-agent-ready.sh SessionStart hook · POST /rest/api/3/search/jql |
| Jira → Obsidian | one-way | TASKS.md in vault root. ClickUp is retired |
| Claude → GitHub | read + write | gh CLI · token in macOS keyring · scopes gist, read:org, repo, workflow |
| Claude ↔ Codex | peer | council MCP both sides · ~/bin/council-codex.sh launches Codex into the session |
| Codex → Obsidian | read only | disk-full-read-access — reads the whole vault |
| Codex → inbox | write only | Knowledge/inbox/ is the sole writable vault path; Joe or Claude triages into memory/ |
| Codex → Notion | read | MCP https://mcp.notion.com/mcp · OAuth · read tools pre-approved, writes default-deny |
| Codex → GitHub | read + write | MCP api.githubcopilot.com/mcp/ · bearer GH_TOKEN |
| Codex → Jira | read + write | REST direct · creds ~/.config/zerojira/.env. No MCP by choice |
| Vault + trackers → zero | additive | ~/bin/zero-hub-sync.sh · rclone copy, never deletes · Tailscale 100.105.220.108 |
Each of these has already caused a real failure or is one step away from doing so.
Codex runs sandboxed and cannot reach the macOS Keychain, so its sf falls back to
~/.sfdx/key.json and re-encrypts every auth file. The next unsandboxed sf
then fails to decipher. Both tools are pinned to the file key, so this is contained — but both agents
still act as the same Salesforce user.
There is no supported way to give Codex its own store: Global.SFDX_DIR is hardcoded to
os.homedir(), not an environment variable. The only real separation is identity —
a distinct SF user for Codex, with its own permission set.
A query helper that swallows exceptions returns [] rather than raising. During the WA
conference load this wrote a garbage 441-row file over a good client deliverable.
~/Documents/Work/Knowledge is not a git repository, and it is the source of truth.
zero's copy is additive so old files survive, but an overwrite propagates on the next sync.
The gh token lives in the keyring, which the sandbox cannot read, and Codex's default
environment policy strips *TOKEN* from the child shell. The MCP path works because Codex
reads GH_TOKEN in its own process before the sandbox applies.
One engagement carries a no-AI / no-recording policy, and its calls are in Granola. That sits directly on the capture path drawn above. Written sign-off was drafted and is not sent.
Unresolved — the missing item is authorisation, not deliverablesGaps that are real but not yet failures.
Engagement logs go in and are read by humans. No agent reads engagement history back as context before starting work. That edge does not exist.
~/.codex/*.sqlite holds its own memories, threads and history. Nothing syncs it to the
vault or to zero — the crossed edge on the right of the diagram.
Via Granola they reach Notion on a schedule. Read directly into a session, they leave nothing behind unless deliberately written out.
Entries at the tail are dropped before load with no error. One line per entry; detail belongs in topic files.