phase 3: control loop — scheduler, actuator, learning, notifier, policy, API endpoints

Implemented the full OODA control loop:

Scheduler:
- Check_defs runner with bounded worker pool (errgroup)
- Signal dedup via partial unique index (UpsertSignal)
- Recovery auto-resolves open signals
- Metrics writing (InsertMetricSample) and entity_status updates
- Housekeeping (idempotency-key prune)
- Graceful shutdown via ctx cancellation

Actuator:
- Auto-act signal consumer with FOR UPDATE SKIP LOCKED pattern
- Per-target serialization with pg_advisory_xact_lock
- Circuit breaker per target host (N consecutive failures → open)
- Autonomy kill-switch (global.auto_act, never_auto_act.<slug>)
- Execution record lifecycle (proposed → running → completed)

Learning engine:
- Hourly feedback extraction past watermark
- Wilson score confidence lower bound (conservative for small N)
- Pattern status: hypothesized → validated (N≥5, confidence ≥0.7)
- Anomaly quarantine for burst feedback
- Cap confidence by sample_size/5 (nothing confident before 5 samples)

Notifier:
- Approval token generation (HMAC single-use, hashed at rest)
- Pending approval expiry detection
- DB rendezvous pattern (no service-to-service RPC)

Policy classifier:
- Risk class resolution from policy tables
- Autonomy checks (global + per-entity kill-switch)
- Blast radius computation
- Classification routes: auto-act / escalate / hold

API endpoints (31 endpoints implemented):
- Checks: ListChecks, CreateCheck, PatchCheck
- Classifications: ListClassifications
- Executions: ListExecutions, GetExecution, RequestExecution, CancelExecution
- Approvals: ListApprovals, DecideApproval
- Patterns: ListPatterns, PatchPattern
- Skills: ListSkills, PatchSkill, ListSkillVersions
- Policy: ListApprovalRules, CreateApprovalRule, PatchApprovalRule,
  GetAutonomySettings, PatchAutonomySettings, ListRiskClasses
- Relationships: CreateRelationship, EndRelationship
- Entity types: CreateEntityType, PatchEntityType
- Metrics: QueryMetrics, GetTrends
- Knowledge: SearchKnowledge, GetEntityKnowledge (stubs)
- Agent activity: QueryAgentActivity (stub)

Infrastructure:
- Migration 009: knowledge_entities table with FTS indexes
- Config: scheduler/notifier/actuator/learning env vars
- sqlc: 30+ new Phase 3 queries
- Integration tests for all new endpoints
- go.sum updated with golang.org/x/sync

internal/config/config.go

@@ -5,6 +5,7 @@ import (
 	"log/slog"
 	"os"
 	"strings"
+	"time"
 )
 
 // Config holds all runtime configuration for an Oikos role.
@@ -31,16 +32,42 @@ type Config struct {
 
 	// Migrations directory (embedded at build time, but path for fallback)
 	MigrationsDir string
+
+	// Scheduler (Phase 3)
+	SchedulerInterval time.Duration // check loop interval (default 30s)
+
+	// Notifier (Phase 3)
+	MatrixHomeserver string // Matrix server URL
+	MatrixUserID     string // bot user ID (e.g. @oikos:matrix.hubris.network)
+	MatrixToken      string // Matrix access token
+	MatrixRoomID     string // alert room ID
+
+	// Actuator (Phase 3)
+	SSHKeyPath       string // path to the restricted SSH key
+	SSHUser          string // SSH user on targets (default "oikos")
+	CircuitThreshold int    // N consecutive failures before opening circuit (default 3)
+	CircuitSeconds   int    // circuit breaker cooldown seconds (default 300)
+
+	// Learning (Phase 3)
+	LearningInterval time.Duration // pattern extraction interval (default 3600s)
+
+	// Approval HMAC secret (Phase 3)
+	ApprovalHMACSecret string
 }
 
 // Default returns a Config with compiled defaults.
 func Default() Config {
 	return Config{
-		DatabaseURL:   "postgres://oikos:oikos@localhost:5432/oikos?sslmode=disable",
-		APIListen:     ":8090",
-		APIEnv:        "dev",
-		SeedsDir:      "seeds",
-		MigrationsDir: "migrations",
+		DatabaseURL:       "postgres://oikos:***@localhost:5432/oikos?sslmode=disable",
+		APIListen:         ":8090",
+		APIEnv:            "dev",
+		SeedsDir:          "seeds",
+		MigrationsDir:     "migrations",
+		SchedulerInterval: 30 * time.Second,
+		SSHUser:           "oikos",
+		CircuitThreshold:  3,
+		CircuitSeconds:    300,
+		LearningInterval:  3600 * time.Second,
 	}
 }
 
@@ -74,9 +101,55 @@ func FromEnv() Config {
 	}
 	c.Debug = os.Getenv("OIKOS_DEBUG") == "true" || os.Getenv("OIKOS_DEBUG") == "1"
 
+	// Phase 3 config
+	if v := os.Getenv("OIKOS_SCHEDULER_INTERVAL"); v != "" {
+		if d, err := time.ParseDuration(v); err == nil {
+			c.SchedulerInterval = d
+		}
+	}
+	if v := os.Getenv("OIKOS_MATRIX_HOMESERVER"); v != "" {
+		c.MatrixHomeserver = v
+	}
+	if v := os.Getenv("OIKOS_MATRIX_USER"); v != "" {
+		c.MatrixUserID = v
+	}
+	if v := os.Getenv("OIKOS_MATRIX_TOKEN"); v != "" {
+		c.MatrixToken = v
+	}
+	if v := os.Getenv("OIKOS_MATRIX_ROOM"); v != "" {
+		c.MatrixRoomID = v
+	}
+	if v := os.Getenv("OIKOS_SSH_KEY_PATH"); v != "" {
+		c.SSHKeyPath = v
+	}
+	if v := os.Getenv("OIKOS_SSH_USER"); v != "" {
+		c.SSHUser = v
+	}
+	if v := os.Getenv("OIKOS_CIRCUIT_THRESHOLD"); v != "" {
+		c.CircuitThreshold = parseInt(v)
+	}
+	if v := os.Getenv("OIKOS_CIRCUIT_SECONDS"); v != "" {
+		c.CircuitSeconds = parseInt(v)
+	}
+	if v := os.Getenv("OIKOS_LEARNING_INTERVAL"); v != "" {
+		if d, err := time.ParseDuration(v); err == nil {
+			c.LearningInterval = d
+		}
+	}
+	if v := os.Getenv("OIKOS_APPROVAL_HMAC_SECRET"); v != "" {
+		c.ApprovalHMACSecret = v
+	}
+
 	return c
 }
 
+// parseInt parses a decimal integer from an env var string. Returns 0 on error.
+func parseInt(s string) int {
+	var n int
+	fmt.Sscanf(s, "%d", &n)
+	return n
+}
+
 // redactedDBURL masks credentials in a postgres:// URL.
 func (c Config) redactedDBURL() string {
 	dbURL := c.DatabaseURL