diff --git a/hosts/claudio-bot.yaml b/hosts/claudio-bot.yaml
index 1e46b6a..05cc839 100644
--- a/hosts/claudio-bot.yaml
+++ b/hosts/claudio-bot.yaml
@@ -18,6 +18,7 @@ mesh_globals:
   - tailscale
 notes:
 - Reads /opt/homelab-context/ on startup
+age_pubkey: age1xmkeq968areza2necqyq0065dpeegngzyr6dhagh0n6pl33lccfqe5mqn9
 see_also:
 - containers/123-claudio-bot.md
 mcp_endpoint: https://mcp.hubris.network/sse
diff --git a/inventory.yaml b/inventory.yaml
index 5ee7f63..cc9f0fd 100644
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -1,125 +1,77 @@
-# Homelab inventory — canonical structured topology
-#
-# This file is the single source of truth for hosts, services, and mesh
-# addresses. Everything in hosts/*.yaml is generated from this file by
-# mcp/build_host_files.py — do not edit hosts/*.yaml by hand.
-#
-# Conventions:
-#   - hostname keys here MUST match the actual `hostname` of the machine
-#     (or, on macOS, `scutil --get LocalHostName` if set).
-#   - `os:` one of: linux, macos
-#   - `kind:` one of: proxmox-host, lxc, vm, workstation
-#   - `mesh:` lists addresses the host is reachable at. Both `netbird` and
-#     `tailscale` are accepted during the in-flight migration
-#     (see infrastructure/mesh.md). Prefer netbird FQDNs over raw IPs.
-#   - `age_pubkey:` is provisioned by the secrets-issuance service on first
-#     bootstrap and committed back here. New entries leave it empty.
-#   - When a service moves hosts, update only the `services:` section here;
-#     never duplicate the address elsewhere.
-
-# ---------------------------------------------------------------------------
-# Static config (mesh + service endpoints)
-# ---------------------------------------------------------------------------
-
 mesh:
-  primary: netbird           # preferred for new clients
-  accepted: [netbird, tailscale]
+  primary: netbird
+  accepted:
+  - netbird
+  - tailscale
   netbird_subnet: 100.122.0.0/16
   netbird_domain: netbird.selfhosted
-
-# Top-level service registry. Each entry resolves to a host above plus a URL.
 services:
   proxmox_ui:
     url: https://proxmox.hubris.network
     backend: hubris
     port: 8006
-
   gitea:
     url: https://git.hubris.network
     backend: gitea
     backend_url: http://192.168.8.121:3000
-
   caddy:
     backend: caddy
     role: reverse-proxy
     note: terminates all *.hubris.network
-
   authentik:
     url: https://auth.hubris.network
     backend: authentik
-
   dnsmasq:
     backend: authentik
     note: split-horizon DNS, /etc/dnsmasq.d/hubris-split.conf
-
   jellyfin:
     url: https://media.hubris.network
     backend: jellyfin
-
   nextcloud:
     url: https://cloud.hubris.network
     backend: nextcloud
-
   paperless:
     url: https://paperless.hubris.network
     backend: paperless
-
   matrix:
     url: https://matrix.hubris.network
     backend: elementsynapse
-
   photos:
     url: https://photos.hubris.network
     backend: mule-images
-
   photos_new:
     url: https://photos-new.hubris.network
     backend: mule-photos-new
-
   plato:
     url: https://plato.hubris.network
     backend: plato
-
   arr_stack:
     backend: arriman
     note: jellyseerr / qbit / sab on docker compose
-
   artifacto:
     backend: apps
     url: https://artifacto.hubris.network
-
   zimaos:
     url: https://zimaos.hubris.network
     backend: zimaos
-
   haos:
     backend: haos
-
-  # New services introduced by this plan.
   homelab_mcp:
     backend: apps
     port: 9810
     public_host: mcp.hubris.network
     endpoint: https://mcp.hubris.network/sse
-    note: MCP server. Read-only context + management. Reachable on the LAN
-      via Caddy and from off-LAN via Netbird (192.168.8.0/24 is a network
-      resource routed through hubris).
-
+    note: MCP server. Read-only context + management. Reachable on the LAN via Caddy
+      and from off-LAN via Netbird (192.168.8.0/24 is a network resource routed through
+      hubris).
   secrets_issuance:
     backend: apps
     port: 9820
     public_host: secrets.hubris.network
     endpoint: https://secrets.hubris.network/issue
-    note: Issues per-client age private keys. Gated at source-IP layer
-      (mesh + LAN subnets in MESH_SUBNETS).
-
-# ---------------------------------------------------------------------------
-# Hosts (Proxmox host + LXCs + VMs + workstations)
-# ---------------------------------------------------------------------------
-
+    note: Issues per-client age private keys. Gated at source-IP layer (mesh + LAN
+      subnets in MESH_SUBNETS).
 hosts:
-
-  # ----- The hypervisor -----
   hubris:
     kind: proxmox-host
     os: linux
@@ -130,13 +82,11 @@ hosts:
         ip: 100.122.38.109
         fqdn: proxmox-server.netbird.selfhosted
     ssh:
-      port: 22                 # OpenSSH
-      netbird_port: 22022      # see infrastructure/ssh-access.md
+      port: 22
+      netbird_port: 22022
     mounts:
-      - /mnt/library           # shared lvmthin
+    - /mnt/library
     age_pubkey: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
-
-  # ----- LXC containers (all on hubris) -----
   jellyfin:
     kind: lxc
     pve_id: 101
@@ -145,10 +95,12 @@ hosts:
     role: media-server
     lan_ip: 192.168.8.206
     public_host: media.hubris.network
-    mesh: {netbird: {fqdn: jellyfin.netbird.selfhosted}}
-    mounts: [/mnt/library]
-    age_pubkey: ""
-
+    mesh:
+      netbird:
+        fqdn: jellyfin.netbird.selfhosted
+    mounts:
+    - /mnt/library
+    age_pubkey: ''
   nfs-export:
     kind: lxc
     pve_id: 102
@@ -156,9 +108,10 @@ hosts:
     os: linux
     role: storage-export
     lan_ip: 192.168.8.200
-    mesh: {netbird: {fqdn: nfs-export.netbird.selfhosted}}
-    age_pubkey: ""
-
+    mesh:
+      netbird:
+        fqdn: nfs-export.netbird.selfhosted
+    age_pubkey: ''
   paperless:
     kind: lxc
     pve_id: 103
@@ -167,10 +120,12 @@ hosts:
     role: document-archive
     lan_ip: 192.168.8.130
     public_host: paperless.hubris.network
-    mesh: {netbird: {fqdn: paperless.netbird.selfhosted}}
-    mounts: [/mnt/library]
-    age_pubkey: ""
-
+    mesh:
+      netbird:
+        fqdn: paperless.netbird.selfhosted
+    mounts:
+    - /mnt/library
+    age_pubkey: ''
   gitea:
     kind: lxc
     pve_id: 104
@@ -180,12 +135,14 @@ hosts:
     lan_ip: 192.168.8.121
     public_host: git.hubris.network
     backend_port: 3000
-    mesh: {netbird: {fqdn: gitea.netbird.selfhosted}}
-    mounts: [/mnt/library]
+    mesh:
+      netbird:
+        fqdn: gitea.netbird.selfhosted
+    mounts:
+    - /mnt/library
     notes:
-      - "Bare repos live at /mnt/library/repos/dtoro/*.git"
-    age_pubkey: ""
-
+    - Bare repos live at /mnt/library/repos/dtoro/*.git
+    age_pubkey: ''
   apps:
     kind: lxc
     pve_id: 105
@@ -193,18 +150,21 @@ hosts:
     os: linux
     role: docker-apps
     lan_ip: 192.168.8.205
-    public_hosts: [artifacto.hubris.network]
+    public_hosts:
+    - artifacto.hubris.network
     mesh:
-      netbird: {fqdn: apps.netbird.selfhosted}
-      tailscale: {ip: 100.121.171.122}
-    mounts: [/mnt/library]
+      netbird:
+        fqdn: apps.netbird.selfhosted
+      tailscale:
+        ip: 100.121.171.122
+    mounts:
+    - /mnt/library
     runs:
-      - artifacto
-      - plantuml
-      - homelab-mcp           # introduced by this plan
-      - secrets-issuance      # introduced by this plan
+    - artifacto
+    - plantuml
+    - homelab-mcp
+    - secrets-issuance
     age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
-
   nextcloud:
     kind: lxc
     pve_id: 114
@@ -213,10 +173,12 @@ hosts:
     role: file-sync
     lan_ip: 192.168.8.224
     public_host: cloud.hubris.network
-    mesh: {netbird: {fqdn: nextcloud.netbird.selfhosted}}
-    mounts: [/mnt/library]
-    age_pubkey: ""
-
+    mesh:
+      netbird:
+        fqdn: nextcloud.netbird.selfhosted
+    mounts:
+    - /mnt/library
+    age_pubkey: ''
   elementsynapse:
     kind: lxc
     pve_id: 118
@@ -225,9 +187,10 @@ hosts:
     role: matrix-server
     lan_ip: 192.168.8.239
     public_host: matrix.hubris.network
-    mesh: {netbird: {fqdn: elementsynapse.netbird.selfhosted}}
-    age_pubkey: ""
-
+    mesh:
+      netbird:
+        fqdn: elementsynapse.netbird.selfhosted
+    age_pubkey: ''
   sophia:
     kind: lxc
     pve_id: 119
@@ -235,10 +198,12 @@ hosts:
     os: linux
     role: workshop
     lan_ip: 192.168.8.157
-    mesh: {netbird: {fqdn: sophia.netbird.selfhosted}}
-    mounts: [/mnt/library]
-    age_pubkey: ""
-
+    mesh:
+      netbird:
+        fqdn: sophia.netbird.selfhosted
+    mounts:
+    - /mnt/library
+    age_pubkey: ''
   mule-images:
     kind: lxc
     pve_id: 120
@@ -247,10 +212,12 @@ hosts:
     role: photo-management
     lan_ip: 192.168.8.136
     public_host: photos.hubris.network
-    mesh: {netbird: {fqdn: mule-images.netbird.selfhosted}}
-    mounts: [/mnt/library]
-    age_pubkey: ""
-
+    mesh:
+      netbird:
+        fqdn: mule-images.netbird.selfhosted
+    mounts:
+    - /mnt/library
+    age_pubkey: ''
   caddy:
     kind: lxc
     pve_id: 121
@@ -259,12 +226,15 @@ hosts:
     role: reverse-proxy
     lan_ip: 192.168.8.175
     notes:
-      - "Terminates all *.hubris.network"
-      - "/etc/caddy is a git checkout of dtoro/caddy-conf"
-    peers: [authentik, gitea]
-    mesh: {netbird: {fqdn: caddy.netbird.selfhosted}}
-    age_pubkey: ""
-
+    - Terminates all *.hubris.network
+    - /etc/caddy is a git checkout of dtoro/caddy-conf
+    peers:
+    - authentik
+    - gitea
+    mesh:
+      netbird:
+        fqdn: caddy.netbird.selfhosted
+    age_pubkey: ''
   arriman:
     kind: lxc
     pve_id: 122
@@ -272,11 +242,16 @@ hosts:
     os: linux
     role: arr-stack
     lan_ip: 192.168.8.132
-    public_hosts: [jellyseerr.hubris.network, qbit.hubris.network, sab.hubris.network]
-    mesh: {netbird: {fqdn: arriman.netbird.selfhosted}}
-    mounts: [/mnt/library]
-    age_pubkey: ""
-
+    public_hosts:
+    - jellyseerr.hubris.network
+    - qbit.hubris.network
+    - sab.hubris.network
+    mesh:
+      netbird:
+        fqdn: arriman.netbird.selfhosted
+    mounts:
+    - /mnt/library
+    age_pubkey: ''
   claudio-bot:
     kind: lxc
     pve_id: 123
@@ -284,11 +259,12 @@ hosts:
     os: linux
     role: matrix-agent
     lan_ip: 192.168.8.230
-    mesh: {netbird: {fqdn: claudio-bot.netbird.selfhosted}}
+    mesh:
+      netbird:
+        fqdn: claudio-bot.netbird.selfhosted
     notes:
-      - "Reads /opt/homelab-context/ on startup"
-    age_pubkey: ""
-
+    - Reads /opt/homelab-context/ on startup
+    age_pubkey: age1xmkeq968areza2necqyq0065dpeegngzyr6dhagh0n6pl33lccfqe5mqn9
   authentik:
     kind: lxc
     pve_id: 124
@@ -298,10 +274,11 @@ hosts:
     lan_ip: 192.168.8.180
     public_host: auth.hubris.network
     notes:
-      - "Also hosts split-horizon dnsmasq: /etc/dnsmasq.d/hubris-split.conf"
-    mesh: {netbird: {fqdn: authentik.netbird.selfhosted}}
-    age_pubkey: ""
-
+    - 'Also hosts split-horizon dnsmasq: /etc/dnsmasq.d/hubris-split.conf'
+    mesh:
+      netbird:
+        fqdn: authentik.netbird.selfhosted
+    age_pubkey: ''
   plato:
     kind: lxc
     pve_id: 126
@@ -310,10 +287,12 @@ hosts:
     role: app
     lan_ip: 192.168.8.190
     public_host: plato.hubris.network
-    mesh: {netbird: {fqdn: plato.netbird.selfhosted}}
-    mounts: [/mnt/library/documents/plato]
-    age_pubkey: ""
-
+    mesh:
+      netbird:
+        fqdn: plato.netbird.selfhosted
+    mounts:
+    - /mnt/library/documents/plato
+    age_pubkey: ''
   mule-photos-new:
     kind: lxc
     pve_id: 127
@@ -322,10 +301,10 @@ hosts:
     role: photo-management
     lan_ip: 192.168.8.181
     public_host: photos-new.hubris.network
-    mesh: {netbird: {fqdn: mule-photos-new.netbird.selfhosted}}
-    age_pubkey: ""
-
-  # ----- VMs (on hubris) -----
+    mesh:
+      netbird:
+        fqdn: mule-photos-new.netbird.selfhosted
+    age_pubkey: ''
   zimaos:
     kind: vm
     pve_id: 100
@@ -333,38 +312,43 @@ hosts:
     os: linux
     role: nas-frontend-eval
     public_host: zimaos.hubris.network
-    mesh: {netbird: {fqdn: zimaos.netbird.selfhosted}}
-    age_pubkey: ""
-
+    mesh:
+      netbird:
+        fqdn: zimaos.netbird.selfhosted
+    age_pubkey: ''
   haos:
     kind: vm
     pve_id: 108
     host: hubris
     os: linux
     role: home-automation
-    mesh: {netbird: {fqdn: haos.netbird.selfhosted}}
-    age_pubkey: ""
-
-  # ----- Workstations (roaming, primary agent clients) -----
+    mesh:
+      netbird:
+        fqdn: haos.netbird.selfhosted
+    age_pubkey: ''
   republic-laptop:
     kind: workstation
     os: linux
     role: primary-dev
-    mesh: {netbird: {fqdn: republic-laptop.netbird.selfhosted}}
+    mesh:
+      netbird:
+        fqdn: republic-laptop.netbird.selfhosted
     age_pubkey: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6
-
   mac-mini:
     kind: workstation
     os: macos
     role: dev
-    mesh: {netbird: {fqdn: mac-mini.netbird.selfhosted}}
+    mesh:
+      netbird:
+        fqdn: mac-mini.netbird.selfhosted
     notes:
-      - "Only macOS in the fleet. Bootstrap uses launchd."
-    age_pubkey: ""
-
+    - Only macOS in the fleet. Bootstrap uses launchd.
+    age_pubkey: ''
   ludo-mini:
     kind: workstation
     os: linux
     role: dev
-    mesh: {netbird: {fqdn: ludo-mini.netbird.selfhosted}}
-    age_pubkey: ""
+    mesh:
+      netbird:
+        fqdn: ludo-mini.netbird.selfhosted
+    age_pubkey: ''