added dropbox, OCR routing logic, graph connection fix

.claude/settings.local.json

@@ -0,0 +1,21 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(php --version)",
+      "Bash(git --version)",
+      "Bash(docker --version)",
+      "Bash(curl -s -o /dev/null -w \"%{http_code}\" http://wordpress.localhost)",
+      "Bash(grep -v \"^$\")",
+      "PowerShell(Get-NetTCPConnection -State Listen | Where-Object { $_.LocalPort -in @\\(80, 443, 3306, 8080, 8443\\) } | Select-Object LocalAddress, LocalPort, OwningProcess)",
+      "PowerShell(winget --version 2>$null)",
+      "PowerShell(if \\($?\\) { \"winget: available\" } else { \"winget: not found\" })",
+      "PowerShell($r = Invoke-WebRequest -Uri \"http://wordpress.localhost\" -UseBasicParsing -ErrorAction SilentlyContinue; \"$\\($r.StatusCode\\) - $\\($r.Headers['Content-Type']\\)\")",
+      "PowerShell($env:PATH = \"C:\\\\xampp\\\\php;$env:PATH\"; wp --info 2>&1 | Select-Object -First 5)",
+      "Bash(xxd)",
+      "mcp__Claude_in_Chrome__tabs_context_mcp",
+      "Bash(xargs grep *)",
+      "Bash(curl -s -b /tmp/wp_c2.txt -H 'Content-Type: application/json' -H 'X-WP-Nonce: cdc16f767b' -d '{\"prompt\":\"What is your role?\",\"page\":\"sa-orchestration\"}' http://wordpress.localhost/wp-json/sa-orch/v1/sara/invoke)",
+      "Bash(curl -s -b /tmp/wp_c2.txt -H 'Content-Type: application/json' -H 'X-WP-Nonce: cdc16f767b' -d '{\"board_id\":1,\"topic\":\"jno-verification\"}' http://wordpress.localhost/wp-json/sa-orch/v1/seed/generate)"
+    ]
+  }
+}

.env.example

@@ -3,6 +3,9 @@ AZURE_TENANT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 AZURE_CLIENT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 AZURE_CLIENT_SECRET=your-client-secret-here
 
+# UPN or object ID of the mailbox to monitor (required for app-only auth)
+MAILBOX_USER=user@yourdomain.com
+
 # Mail folder to monitor (top-level display name only; all others are ignored)
 MAIL_FOLDER_NAME=Inbox
 
@@ -13,14 +16,23 @@ NOTIFICATION_URL=https://your-hostname.example.com/webhook/notify
 # Graph subscription max lifetime in minutes (hard cap: 4230)
 SUBSCRIPTION_EXPIRY_MINUTES=4230
 
-# Server
+# Server (TLS is terminated by the hosting provider, not uvicorn)
 HOST=0.0.0.0
-PORT=8443
-
-# TLS certificate paths (mounted as a read-only volume into the container)
-TLS_CERT_FILE=/certs/server.crt
-TLS_KEY_FILE=/certs/server.key
+PORT=8000
 
 # Storage paths (volume-mounted)
 DATABASE_PATH=/data/rcmemail.db
 EMAIL_STORAGE_PATH=/emails
+
+# Dropbox — confirm folder paths with ops/Hunter before going live
+# App key + secret come from the Dropbox App Console (appinfo tab)
+# Refresh token is generated once via scripts/dropbox_auth.py and stored here
+DROPBOX_APP_KEY=your-app-key
+DROPBOX_APP_SECRET=your-app-secret
+DROPBOX_REFRESH_TOKEN=your-refresh-token
+DROPBOX_PO_PATH=/RCM Supply/Inside Sales/POs
+DROPBOX_INVOICE_PATH=/RCM Supply/Inside Sales/Invoices
+DROPBOX_MTR_PATH=/RCM Supply/MTRs
+
+# Processor poll interval in seconds
+PROCESSOR_POLL_INTERVAL=10

.gitignore

@@ -0,0 +1,5 @@
+.env
+__pycache__/
+*.pyc
+*.pyo
+.pytest_cache/

CLAUDE.md

@@ -44,10 +44,8 @@ This SleeperAgents-internal project (RcmEmailAutomation) sits at the SA-Orchestr
 
 ## ── REPO LAYOUT (root level) ────────────────────────────────────────────────
 
-> Paths below are **relative to this repo root** — wherever the developer cloned it. Drive letters and absolute paths from the seeding machine do not apply. See `README.md` → "Path discipline" before assuming any path.
-
 ```
-<repo-root>/                 ← wherever the developer cloned RcmEmailAutomation
+F:\SleeperAgents\RcmEmailAutomation\
 ├── app/                     ← Python FastAPI service (production target)
 │   ├── main.py
 │   ├── auth.py, config.py, database.py, email_processor.py

Dockerfile

@@ -1,7 +1,7 @@
 FROM python:3.12-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    build-essential \
+    build-essential tesseract-ocr poppler-utils \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
@@ -14,8 +14,8 @@ RUN chmod +x /entrypoint.sh
 
 COPY app/ ./app/
 
-RUN mkdir -p /data /emails /certs
+RUN mkdir -p /data /emails
 
-EXPOSE 8443
+EXPOSE 8000
 
 ENTRYPOINT ["/entrypoint.sh"]

ONBOARDING.md

@@ -64,14 +64,13 @@ Run this audit before installing or running anything. Surface findings to the hu
 
 ### Audit checklist
 
-1. **Local stack capability** — does this machine already have a local PHP + MySQL + WordPress capability? **Where the developer's stack lives is a Phase 0 question** (see Phase 0 above) — do NOT assume a default install location. Common patterns the audit may discover:
-   - XAMPP (Windows: typically `C:\xampp`; sometimes installed on a different drive — confirm with the developer, never assume)
-   - Local by Flywheel (Windows: `C:\Users\<user>\Local Sites`; macOS: `~/Local Sites`)
-   - Laragon (Windows: typically `C:\laragon` — confirm)
-   - MAMP (macOS: `/Applications/MAMP`; Windows: `C:\MAMP`)
-   - Docker Desktop with WordPress containers (any path; ask)
+1. **Local stack capability** — does this machine already have a local PHP + MySQL + WordPress capability? Check for:
+   - XAMPP at `C:\xampp` or `F:\XAMPP` or similar
+   - Local by Flywheel at `C:\Users\<user>\Local Sites`
+   - Laragon at `C:\laragon`
+   - MAMP at `/Applications/MAMP` (macOS) or equivalent
+   - Docker Desktop with WordPress containers
    - Any custom Apache/Nginx + PHP-FPM + MySQL combination
-   - **The developer may have none of the above** — JNO must respect that and use what they have or what they explicitly approve installing. Do not install on a drive or location the developer has not authorized.
 
 2. **PHP version available** — `php --version` (target: 7.4+, 8.1+ preferred)
 
@@ -145,43 +144,49 @@ After activating each, walk its setup wizard to completion. Skip any optional in
 - FluentCRM: `wp_fc_*` tables exist (subscribers, campaigns, etc.). Admin page renders.
 - Fluent Support: `wp_fs_tickets` table exists. Admin page at `?page=fluent-support` renders. **Watch for the prefix-orphan trap** — if tables ended up at a non-standard prefix (e.g., from a cloned DB), that's a separate fix not part of fresh JNO.
 
-### Step 5 — Install SA-Orchestration plugin (pre-staged in this repo)
+### Step 5 — Clone SA-Orchestration plugin source
 
-**The plugin source is already in this repo at `<repo-root>/sa-orchestration/`** — no GitHub clone is needed. Operational doctrine MD files are at `<repo-root>/SA-orchestration MD/` for agent reference.
+Verify the canonical SA-Orchestration repository URL with the human first. The likely location:
 
-Copy (or symlink) the pre-staged plugin tree into the local WP install:
+```
+git clone https://github.com/SleeperAgents/SA-Orchestration.git /tmp/sa-orchestration-src
+```
+
+Then copy the plugin tree into the local WP install:
 
 ```
-cp -r <repo-root>/sa-orchestration <wp-content>/plugins/sa-orchestration
+cp -r /tmp/sa-orchestration-src/plugin/sa-orchestration <wp-content>/plugins/sa-orchestration
 ```
 
-Adjust path syntax for the developer's OS. On Windows: use the WP install's `wp-content\plugins\` path. The dev's Claude resolves `<repo-root>` and `<wp-content>` from the developer's actual environment.
+Adjust path syntax for the dev's OS. On Windows: use the WP install's `wp-content\plugins\` path.
 
 **Verify**: `<wp-install>/wp-content/plugins/sa-orchestration/sa-orchestration.php` exists.
 
-If the pre-staged `sa-orchestration/` directory is missing for some reason, **stop and surface to the human**. Do not invent a clone URL. The seed should always include the plugin tree at `<repo-root>/sa-orchestration/`; absence indicates a corrupted seed, not a missing dependency.
-
 ### Step 6 — Place the Asterion canonical corpus
 
 The SA-Orchestration plugin reads its canonical content from a filterable path. For local JNO, point that path at the corpus copy in this repo.
 
 Two valid placements:
 
-**Locked approach: mirror corpus + install pre-staged mu-plugin.**
+**A. Mirror corpus into WP content** (recommended):
 
 ```
-# (a) Mirror the canonical corpus into the WP install
 mkdir -p <wp-install>/wp-content/sa-asterion
 cp -r <this-repo>/asterion/* <wp-install>/wp-content/sa-asterion/
-
-# (b) Install the pre-staged mu-plugin (already in this repo at <repo-root>/mu-plugins/sa-orch-spec-root.php)
-mkdir -p <wp-install>/wp-content/mu-plugins
-cp <this-repo>/mu-plugins/sa-orch-spec-root.php <wp-install>/wp-content/mu-plugins/sa-orch-spec-root.php
 ```
 
-The pre-staged mu-plugin points the `sa_orch_asterion_spec_root` filter at `WP_CONTENT_DIR . '/sa-asterion'`. **Do not author it from a snippet** — the file exists at `<repo-root>/mu-plugins/sa-orch-spec-root.php`. If missing, the seed is corrupt — surface to the human.
+**B. Point the spec_root filter at this repo's `asterion/` directory directly** (no copy):
+
+Drop a mu-plugin at `<wp-install>/wp-content/mu-plugins/sa-orch-spec-root.php`:
+
+```php
+<?php
+add_filter( 'sa_orch_asterion_spec_root', function () {
+    return 'F:/SleeperAgents/RcmEmailAutomation/asterion';
+}, 5 );
+```
 
-Earlier seed versions described a "Path B" pointing the filter at the repo's `asterion/` directly without mirroring. That fails on container-based stacks (DDEV) where the container only mounts `public_html/`. The mirror approach above works on every stack.
+Choose A for cleanliness (corpus lives inside the WP install). Choose B for "single source of truth" (corpus stays in this repo, the WP install reads through). Either is acceptable for JNO.
 
 **Verify**: filesystem readable by the web user; `01-ontology.md` and `02-invariants.md` exist at the chosen location.
 
@@ -311,68 +316,6 @@ Stop. Wait for human direction.
 
 ---
 
-### Step 14 — Configure Remote Roots (post-acceptance, optional but recommended)
-
-SA-Orchestration v0.8.0 ships a new admin page: **SA-Orchestration → Remote Roots**. It connects this leaf install to a remote SA-Orchestration root (e.g., the dev root at `sleeperagendev.wpenginepowered.com` or a per-client root) via leaf-initiated polling. The leaf fetches Fluent Boards tasks where the authenticated user is an assignee on the root.
-
-**Doctrine**: leaf-initiated, always up; the root never reaches into the leaf.
-
-#### One-time setup
-
-1. On the **root** install:
-   - Visit `<root>/wp-admin/profile.php`
-   - Scroll to **Application Passwords** → enter name (e.g. `"<leaf-host> leaf"`) → **Add New Application Password** → copy the value (one-time display)
-
-2. On the **leaf** (this install):
-   - Open: `<wp-install>/wp-admin/admin.php?page=sa-orchestration-remote-roots`
-   - **Root URL**: e.g. `https://sleeperagendev.wpenginepowered.com`
-   - **App Username**: the WP login on the root (typically the user's email)
-   - **App Password**: paste the value from step 1
-   - **Save Remote Root**
-
-3. Click **Fetch Now**.
-
-#### The MVP loop
-
-1. On the root's Fluent Boards, self-assign to any task.
-2. Back on this leaf, click **Fetch Now**.
-3. The new assignment appears in the table.
-
-#### Out of MVP scope (deferred to v0.8.1+)
-
-- Multi-root (only ONE root configurable in MVP)
-- Adaptive polling cadence (manual fetch only in MVP; OS-level cron is Board #41)
-- Fluent Support ticket auto-creation (just a list in MVP)
-- Curated upstream replies (one-way down only in MVP)
-
----
-
-### Updating SA-Orchestration after source changes
-
-When the SA-Orchestration source repo ships an update (new plugin classes, bug fixes, doctrine v1.x), this repo's pre-staged `sa-orchestration/` tree is rolled forward by the seed maintainer in a separate commit. There is **no auto-update push**; updates propagate manually:
-
-```
-SA-Orch source → seed repos (maintainer commits) → your local clone (git pull) → your live WP (re-deploy)
-```
-
-To pull a source update into your live local WP install:
-
-```
-# 1. Pull latest pre-staged plugin tree
-cd <repo-root>
-git pull
-
-# 2. Re-deploy to local WP install
-cp -r sa-orchestration/* <wp-install>/wp-content/plugins/sa-orchestration/
-
-# 3. Verify
-# Visit /wp-admin/admin.php?page=sa-orchestration to confirm new admin pages.
-```
-
-Adjust path syntax for the developer's OS. **Note**: WP plugin "deactivate then reactivate" is NOT required for source-tree updates that don't add database tables. If a new schema migration ships, run a one-time deactivate→activate cycle.
-
----
-
 ## Rollback (if a step fails)
 
 - **Step 1–3 fail**: WP itself isn't operational. Investigate the local stack; not an SA-Orch concern.

README.md

@@ -32,20 +32,7 @@ CR ⊇ CA ⊇ JourneySeeker ⊇ MissionNet/MeshNet ⊇ SA-Orchestration ⊇ Bran
 
 Causal Relativity, Causal Agentics, JourneySeeker, the Compass Doctrine, the Story Seed pattern, and the Quest-vs-Job distinction are pre-existing intellectual property authored by **Mark Holak**. They are preserved under Invariant **I9** of the SA-Orchestration spec pack. **You may reference these concepts. You may not re-author them as if they originated at the implementation layer or at the agent layer.** When you cite them, cite them.
 
-The full canonical corpus lives at **`asterion/` in this repo** (copied here at seed time from the SA-Orchestration source of truth that lives in a separate SleeperAgents-internal repository — the absolute path on the seeding machine is not relevant to the developer's machine). Read it when you encounter a term you are uncertain about.
-
-### Path discipline (read once; never violate)
-
-This seed was authored on a different machine than the developer's. **Any absolute path that may appear in `ONBOARDING.md`, in this README, or in code excerpts is illustrative — drawn from the seeding machine — not canonical for the developer's environment.** Drive letters, root paths, and OS conventions on the seeding machine do not transfer.
-
-Specifically:
-
-- **Do not** install anything onto a drive letter, mount point, or path the developer has not declared.
-- **Do not** assume any directory exists outside this repo's tree without verifying or asking.
-- **Always** map paths through the developer's stated layout (Phase 0 surfaces this).
-- **When in doubt about where something goes, ask.** The developer is the arbiter of their domain (see Phase 0 in `ONBOARDING.md`). Asking is cheaper than installing into the wrong place.
-
-If the developer has not declared a drive layout in Phase 0, **ask explicitly before any install action**. Path-related questions are the kind that quietly pass when the agent assumes — and quietly destroy when the assumption is wrong.
+The full canonical corpus lives at `asterion/` in this repo (copied from the SA-Orchestration source of truth at `F:/SleeperAgents/SA-orchestration/asterion/`). Read it when you encounter a term you are uncertain about.
 
 ### Doctrine carry-forward (the operating discipline)
 

app/classifier.py

@@ -0,0 +1,60 @@
+from __future__ import annotations
+
+import io
+import logging
+
+logger = logging.getLogger(__name__)
+
+_KEYWORD_MAP = (
+    ("mtr", ("material test report", "mill test report", "mtr")),
+    ("po", ("purchase order", "p.o.", "purchase ord")),
+    ("invoice", ("invoice", "inv #", "inv#")),
+    ("quote", ("quotation", "quote", "rfq", "request for quote", "bid")),
+)
+
+DocType = str  # 'po' | 'invoice' | 'mtr' | 'quote' | 'unknown'
+
+
+def classify(subject: str, filename: str, file_bytes: bytes) -> DocType:
+    subject_lower = subject.lower() if subject else ""
+    filename_lower = filename.lower() if filename else ""
+
+    if "mtr" in subject_lower:
+        return "mtr"
+    if "mtr" in filename_lower:
+        return "mtr"
+
+    text = _ocr_pdf(file_bytes)
+    if not text:
+        return "unknown"
+
+    sample = text[:500].lower()
+
+    for doc_type, keywords in _KEYWORD_MAP:
+        if any(kw in sample for kw in keywords):
+            return doc_type
+
+    return "unknown"
+
+
+def _ocr_pdf(file_bytes: bytes) -> str:
+    try:
+        from pdf2image import convert_from_bytes
+        import pytesseract
+    except ImportError:
+        logger.warning("pdf2image or pytesseract not installed; OCR unavailable")
+        return ""
+
+    try:
+        images = convert_from_bytes(file_bytes, first_page=1, last_page=2)
+    except Exception:
+        logger.exception("pdf2image conversion failed")
+        return ""
+
+    parts: list[str] = []
+    for img in images:
+        try:
+            parts.append(pytesseract.image_to_string(img))
+        except Exception:
+            logger.exception("pytesseract OCR failed on page")
+    return "\n".join(parts)

app/config.py

@@ -9,18 +9,25 @@ class Settings(BaseSettings):
     azure_client_id: str
     azure_client_secret: SecretStr
 
+    mailbox_user: str
     mail_folder_name: str
     notification_url: HttpUrl
     subscription_expiry_minutes: int = 4230
 
     host: str = "0.0.0.0"
-    port: int = 8443
-    tls_cert_file: Path
-    tls_key_file: Path
+    port: int = 8000
 
     database_path: Path = Path("/data/rcmemail.db")
     email_storage_path: Path = Path("/emails")
 
+    dropbox_app_key: str
+    dropbox_app_secret: SecretStr
+    dropbox_refresh_token: SecretStr
+    dropbox_po_path: str = "/RCM Supply/Inside Sales/POs"
+    dropbox_invoice_path: str = "/RCM Supply/Inside Sales/Invoices"
+    dropbox_mtr_path: str = "/RCM Supply/MTRs"
+    processor_poll_interval: int = 10
+
     model_config = SettingsConfigDict(env_file=".env", extra="ignore")
 
 

app/database.py

@@ -32,6 +32,17 @@ CREATE TABLE IF NOT EXISTS notifications (
     error_message     TEXT,
     storage_path      TEXT
 );
+
+CREATE TABLE IF NOT EXISTS routing_results (
+    id                  INTEGER PRIMARY KEY AUTOINCREMENT,
+    notification_id     INTEGER NOT NULL,
+    processed_at        TEXT NOT NULL DEFAULT (datetime('now')),
+    attachment_filename TEXT,
+    document_type       TEXT,
+    action              TEXT,
+    destination_path    TEXT,
+    error_message       TEXT
+);
 """
 
 
@@ -140,6 +151,45 @@ async def update_notification_status(
     await conn.commit()
 
 
+async def get_fetched_notifications(conn: aiosqlite.Connection) -> list[dict]:
+    cursor = await conn.execute(
+        "SELECT * FROM notifications WHERE processing_status = 'fetched' ORDER BY received_at"
+    )
+    rows = await cursor.fetchall()
+    return [dict(r) for r in rows]
+
+
+async def set_notification_routing_status(
+    conn: aiosqlite.Connection, notif_id: int, status: str
+) -> None:
+    await conn.execute(
+        "UPDATE notifications SET processing_status = ? WHERE id = ?",
+        (status, notif_id),
+    )
+    await conn.commit()
+
+
+async def log_routing_result(
+    conn: aiosqlite.Connection,
+    notification_id: int,
+    filename: str | None,
+    doc_type: str | None,
+    action: str,
+    destination_path: str | None = None,
+    error_message: str | None = None,
+) -> None:
+    await conn.execute(
+        """
+        INSERT INTO routing_results
+            (notification_id, attachment_filename, document_type, action,
+             destination_path, error_message)
+        VALUES (?, ?, ?, ?, ?, ?)
+        """,
+        (notification_id, filename, doc_type, action, destination_path, error_message),
+    )
+    await conn.commit()
+
+
 if __name__ == "__main__":
     import asyncio
 

app/dropbox_client.py

@@ -0,0 +1,27 @@
+from __future__ import annotations
+
+import logging
+
+import dropbox
+from dropbox.files import WriteMode
+
+logger = logging.getLogger(__name__)
+
+
+class DropboxClient:
+    def __init__(self, app_key: str, app_secret: str, refresh_token: str) -> None:
+        self._dbx = dropbox.Dropbox(
+            app_key=app_key,
+            app_secret=app_secret,
+            oauth2_refresh_token=refresh_token,
+        )
+
+    def upload(self, file_bytes: bytes, dest_path: str) -> str:
+        """Upload bytes to dest_path. Returns the path Dropbox assigned (may differ on collision)."""
+        result = self._dbx.files_upload(
+            file_bytes,
+            dest_path,
+            mode=WriteMode.add,
+            autorename=True,
+        )
+        return result.path_display

app/email_processor.py

@@ -4,6 +4,7 @@ from pathlib import Path
 
 import aiosqlite
 
+from app.config import settings
 from app.database import update_notification_status
 from app.graph_client import GraphClient
 from app.storage import write_email
@@ -22,7 +23,7 @@ async def fetch_and_store(
 ) -> Path:
     try:
         email_data = await client.get(
-            f"/me/messages/{message_id}",
+            f"/users/{settings.mailbox_user}/messages/{message_id}",
             params={"$expand": "attachments", "$select": (
                 "id,subject,from,toRecipients,ccRecipients,receivedDateTime,"
                 "body,uniqueBody,hasAttachments,attachments,webLink"
@@ -60,4 +61,4 @@ async def fetch_and_store(
 async def _fetch_large_attachment(
     client: GraphClient, message_id: str, attachment_id: str
 ) -> bytes:
-    return await client.get_raw(f"/me/messages/{message_id}/attachments/{attachment_id}/$value")
+    return await client.get_raw(f"/users/{settings.mailbox_user}/messages/{message_id}/attachments/{attachment_id}/$value")

app/folder_resolver.py

@@ -3,8 +3,8 @@ from app.graph_client import GraphClient
 _BASE = "https://graph.microsoft.com/v1.0"
 
 
-async def resolve_folder_id(client: GraphClient, display_name: str) -> str:
-    path = "/me/mailFolders"
+async def resolve_folder_id(client: GraphClient, display_name: str, mailbox_user: str) -> str:
+    path = f"/users/{mailbox_user}/mailFolders"
     params: dict = {"$top": 100}
 
     while path:

app/main.py

@@ -52,7 +52,7 @@ async def lifespan(app: FastAPI) -> AsyncGenerator:
     app.state.settings = settings
     app.state.subscription_id = None
 
-    folder_id = await resolve_folder_id(client, settings.mail_folder_name)
+    folder_id = await resolve_folder_id(client, settings.mail_folder_name, settings.mailbox_user)
     app.state.folder_id = folder_id
     logger.info("Monitoring folder '%s' (id=%s)", settings.mail_folder_name, folder_id)
 

app/processor.py

@@ -0,0 +1,196 @@
+"""Standalone attachment routing process.
+
+Run with:  python -m app.processor
+
+Polls the SQLite DB for notifications with processing_status='fetched', classifies
+each attachment via OCR, and uploads routable documents to Dropbox.
+"""
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+import signal
+import sys
+from datetime import datetime
+from pathlib import Path
+
+from app.classifier import classify
+from app.config import settings
+from app.database import (
+    get_db,
+    get_fetched_notifications,
+    log_routing_result,
+    set_notification_routing_status,
+)
+from app.dropbox_client import DropboxClient
+
+logging.basicConfig(
+    level=logging.INFO,
+    format="%(asctime)s [processor] %(levelname)s %(message)s",
+)
+logger = logging.getLogger(__name__)
+
+_ROUTABLE = {"po", "invoice", "mtr"}
+
+_DEST_MAP = {
+    "po": settings.dropbox_po_path,
+    "invoice": settings.dropbox_invoice_path,
+    "mtr": settings.dropbox_mtr_path,
+}
+
+_shutdown = asyncio.Event()
+
+
+def _handle_signal(*_: object) -> None:
+    logger.info("Shutdown signal received")
+    _shutdown.set()
+
+
+async def _process_notification(
+    dbx: DropboxClient,
+    notif: dict,
+) -> None:
+    notif_id: int = notif["id"]
+    storage_path = notif.get("storage_path")
+    if not storage_path:
+        logger.warning("Notification %d has no storage_path; skipping", notif_id)
+        async with get_db(settings.database_path) as conn:
+            await set_notification_routing_status(conn, notif_id, "routing_error")
+            await log_routing_result(
+                conn, notif_id, None, None, "error",
+                error_message="no storage_path recorded",
+            )
+        return
+
+    meta_path = Path(storage_path) / "metadata.json"
+    try:
+        meta = json.loads(meta_path.read_text())
+    except Exception as exc:
+        logger.error("Cannot read metadata.json for notification %d: %s", notif_id, exc)
+        async with get_db(settings.database_path) as conn:
+            await set_notification_routing_status(conn, notif_id, "routing_error")
+            await log_routing_result(
+                conn, notif_id, None, None, "error",
+                error_message=f"metadata read failed: {exc}",
+            )
+        return
+
+    subject: str = meta.get("subject", "")
+    received_dt: str = meta.get("received_datetime", "")
+    date_prefix = _date_prefix(received_dt)
+    attachments: list[dict] = meta.get("attachments", [])
+
+    uploaded_count = 0
+    final_status = "routing_skipped"
+
+    for att in attachments:
+        filename: str = att.get("name", "attachment")
+        att_path = Path(storage_path) / "attachments" / filename
+
+        try:
+            file_bytes = att_path.read_bytes()
+        except Exception as exc:
+            logger.error("Cannot read attachment %s: %s", att_path, exc)
+            async with get_db(settings.database_path) as conn:
+                await log_routing_result(
+                    conn, notif_id, filename, None, "error",
+                    error_message=f"file read failed: {exc}",
+                )
+            final_status = "routing_error"
+            continue
+
+        doc_type = classify(subject, filename, file_bytes)
+        logger.info("Notification %d / %s → %s", notif_id, filename, doc_type)
+
+        if doc_type in _ROUTABLE:
+            dest_folder = _DEST_MAP[doc_type]
+            month_folder = received_dt[:7] if received_dt else "unknown"
+            dest_path = f"{dest_folder}/{month_folder}/{date_prefix}_{filename}"
+            try:
+                actual_path = await asyncio.to_thread(dbx.upload, file_bytes, dest_path)
+                logger.info("Uploaded %s → %s", filename, actual_path)
+                async with get_db(settings.database_path) as conn:
+                    await log_routing_result(
+                        conn, notif_id, filename, doc_type, "uploaded",
+                        destination_path=actual_path,
+                    )
+                uploaded_count += 1
+                final_status = "routed"
+            except Exception as exc:
+                logger.error("Dropbox upload failed for %s: %s", filename, exc)
+                async with get_db(settings.database_path) as conn:
+                    await log_routing_result(
+                        conn, notif_id, filename, doc_type, "error",
+                        error_message=f"upload failed: {exc}",
+                    )
+                final_status = "routing_error"
+        else:
+            async with get_db(settings.database_path) as conn:
+                await log_routing_result(conn, notif_id, filename, doc_type, "skipped")
+
+    async with get_db(settings.database_path) as conn:
+        await set_notification_routing_status(conn, notif_id, final_status)
+    logger.info("Notification %d → %s", notif_id, final_status)
+
+
+def _date_prefix(received_dt: str) -> str:
+    try:
+        return datetime.fromisoformat(received_dt).strftime("%Y%m%d")
+    except Exception:
+        return "00000000"
+
+
+async def run() -> None:
+    dbx = DropboxClient(
+        app_key=settings.dropbox_app_key,
+        app_secret=settings.dropbox_app_secret.get_secret_value(),
+        refresh_token=settings.dropbox_refresh_token.get_secret_value(),
+    )
+    logger.info(
+        "Processor started; polling every %ds", settings.processor_poll_interval
+    )
+
+    while not _shutdown.is_set():
+        try:
+            async with get_db(settings.database_path) as conn:
+                pending = await get_fetched_notifications(conn)
+
+            if pending:
+                logger.info("Found %d notification(s) to process", len(pending))
+                for notif in pending:
+                    async with get_db(settings.database_path) as conn:
+                        await set_notification_routing_status(
+                            conn, notif["id"], "routing_queued"
+                        )
+
+                for notif in pending:
+                    await _process_notification(dbx, notif)
+        except Exception:
+            logger.exception("Unhandled error in processor loop")
+
+        try:
+            await asyncio.wait_for(
+                _shutdown.wait(), timeout=settings.processor_poll_interval
+            )
+        except asyncio.TimeoutError:
+            pass
+
+    logger.info("Processor stopped")
+
+
+def main() -> None:
+    loop = asyncio.new_event_loop()
+    asyncio.set_event_loop(loop)
+
+    for sig in (signal.SIGTERM, signal.SIGINT):
+        loop.add_signal_handler(sig, _handle_signal)
+
+    try:
+        loop.run_until_complete(run())
+    finally:
+        loop.close()
+
+
+if __name__ == "__main__":
+    main()

docker-compose.yml

@@ -3,9 +3,8 @@ services:
     build: .
     env_file: .env
     ports:
-      - "8443:8443"
+      - "8000:8000"
     volumes:
-      - ./certs:/certs:ro
       - rcmemail-data:/data
       - rcmemail-emails:/emails
     restart: unless-stopped

entrypoint.sh

@@ -3,8 +3,10 @@ set -e
 
 python -m app.database --init
 
+python -m app.processor &
+PROCESSOR_PID=$!
+trap "kill $PROCESSOR_PID 2>/dev/null; wait $PROCESSOR_PID 2>/dev/null" EXIT TERM INT
+
 exec uvicorn app.main:app \
     --host "${HOST:-0.0.0.0}" \
-    --port "${PORT:-8443}" \
-    --ssl-certfile "${TLS_CERT_FILE}" \
-    --ssl-keyfile "${TLS_KEY_FILE}"
+    --port "${PORT:-8000}"

requirements.txt

@@ -5,3 +5,7 @@ httpx==0.27.0
 pydantic-settings==2.3.0
 apscheduler==3.10.4
 aiosqlite==0.20.0
+dropbox==12.0.2
+pdf2image==1.17.0
+pytesseract==0.3.13
+Pillow==10.4.0

scripts/dropbox_auth.py

@@ -0,0 +1,58 @@
+"""One-time Dropbox OAuth setup — generates the refresh token for .env.
+
+Usage:
+    python scripts/dropbox_auth.py
+
+What it does:
+    1. Prints an authorization URL — open it in a browser and click Allow.
+    2. Paste the auth code back at the prompt.
+    3. Prints the refresh token to copy into DROPBOX_REFRESH_TOKEN in your .env.
+
+After this runs once the refresh token lives in .env and no further browser
+interaction is ever needed. The app uses it silently at runtime.
+
+Requirements: pip install dropbox
+"""
+import sys
+
+try:
+    import dropbox
+    from dropbox import DropboxOAuth2FlowNoRedirect
+except ImportError:
+    sys.exit("dropbox package not installed — run: pip install dropbox")
+
+
+def main() -> None:
+    app_key = input("Enter DROPBOX_APP_KEY: ").strip()
+    app_secret = input("Enter DROPBOX_APP_SECRET: ").strip()
+
+    auth_flow = DropboxOAuth2FlowNoRedirect(
+        app_key,
+        app_secret,
+        token_access_type="offline",
+    )
+
+    authorize_url = auth_flow.start()
+    print("\n--- Step 1 ---")
+    print("Open this URL in a browser and click Allow:\n")
+    print(authorize_url)
+    print()
+
+    auth_code = input("--- Step 2 --- Paste the authorization code here: ").strip()
+
+    try:
+        result = auth_flow.finish(auth_code)
+    except Exception as exc:
+        sys.exit(f"Auth failed: {exc}")
+
+    print("\n--- Done ---")
+    print("Add these to your .env file:\n")
+    print(f"DROPBOX_APP_KEY={app_key}")
+    print(f"DROPBOX_APP_SECRET={app_secret}")
+    print(f"DROPBOX_REFRESH_TOKEN={result.refresh_token}")
+    print()
+    print("The refresh token does not expire. Re-run this script only if you revoke app access.")
+
+
+if __name__ == "__main__":
+    main()