diff --git a/agent-builder/.claude/context.md b/agent-builder/.claude/context.md
index cbeea10..c084881 100644
--- a/agent-builder/.claude/context.md
+++ b/agent-builder/.claude/context.md
@@ -404,5 +404,47 @@ Build, test, and push both builder agents to production. Work as long as it take
 
 **Next session first task:** Hermes deployment (id=138) — grill-me pending, read reference_open_source_ai_tools.md first
 
+### 2026-06-25 Sprint Day 9 facts
+- id=138 Hermes DEPLOYED ✅ — container healthy on server-01, dashboard port 9119, external route hermes.reverseproxyserver.net
+- config.yaml: provider=custom, base_url=http://172.17.0.1:11434/v1, model=llama3.1:8b, tool_loop_guardrails.hard_stop_enabled=true
+- Bitwarden bridge fixed: BRIDGE_API_KEY, VAULT_TOKEN, BW_CLIENTID, BW_CLIENTSECRET were empty (Coolify env var debt) — regenerated + redeployed via subprocess env injection
+- Security enforcement hook v1.1 live on primary: 25 tests passing, hard-blocks sudo bypass + secret exposure
+- Vault IP confirmed drifting — always resolve via docker inspect. Fixed ref 172.16.16.30 is stale.
+- Jenkins = all deployments (boundary locked in memory); Hermes = all monitoring
+- Hermes port 8642 already active at startup — no config change needed
+- Skill files: SKILL.md format at /opt/data/skills/<category>/<name>/SKILL.md (NOT skill.yaml)
+- Shell toolset for Telegram: add `hermes-cli` to platform_toolsets.telegram in config.yaml (PENDING)
+
+### 2026-06-26 Sprint Day 10 early AM facts
+- Background agent prompt discipline established after first agent looped (50+ calls/45 min) vs second agent (8 calls/4 min)
+- Required rules for all background agent prompts: --max-turns 15, loop detection instruction, credential map inline, data pre-fetched, defined output format
+- Automation audit: 74 items — 35 N8N / 15 Hermes / 13 Hybrid / 8 Jenkins
+- required_playbooks column added to automation_ideas, 73 rows backfilled by type with Gitea raw URLs
+- Both builder playbooks updated: required_playbooks fetch (Step 2) + human NTFY prompt review gate added
+- id=74 Ruflo moved to personal_projects id=151; id=152 infrastructure auth map added
+- Hermes user chat_id: 8871022110
+
+### 2026-06-26 Sprint Day 10 afternoon facts
+- Infrastructure auth map BUILT + VERIFIED: secret/data/claude/infrastructure-auth-map (3 fields: yaml/json/markdown)
+- Background agent wrote it in 2 tool calls/80 seconds
+- Vault IP currently 172.16.16.5 (confirm drift — always resolve dynamically)
+- All 16 service paths verified present in Vault. Key field corrections vs assumptions:
+  - bitwarden-bridge: field=BRIDGE_API_KEY (not api_key)
+  - gitea: fields=[admin_token, admin_username]
+  - bitwarden (N8N): field=bw_session
+  - sudo-bridge-db exists: fields=[db, password, user]
+- Auth map updated to v2 with all corrections
+- Parallel agent strategy confirmed: same total tokens as serial, faster wall-clock, no added cost
+- Auth map is now the canonical credential reference — eliminates agent credential-hunting problem
+- New personal_projects logged: id=154 (Domain playbooks → Gitea), id=155 (required_playbooks precision pass, blocked by 154), id=156 (SessionStart hook for auth map)
+
+**Next session first tasks (in order):**
+1. Hermes config change: add hermes-cli to platform_toolsets.telegram (quick background agent)
+2. Create container-health-sweep/SKILL.md + semantic-recall/SKILL.md (background agent)
+3. id=154 Domain playbooks → Gitea (unblocks id=155)
+4. id=155 Per-automation required_playbooks precision pass
+5. id=156 SessionStart hook — auth map injection
+6. Build id=24 Agent Builder Agent + id=67 N8N Builder Agent
+
 ## Update instructions
 Update at the end of every agent-builder session. Keep agent status, key decisions, and prereq checklist current.