port build_host_files.py to Go, simplify Hermes MCP, cutover final

- cmd/hermes/main.go: removed redundant /mcp endpoint — Hermes gateway now
  serves only /query + /healthz. MCP goes direct to API (:8090/mcp).
- cmd/oikos/build_hosts.go: Go port of mcp/build_host_files.py as
  'oikos build-hosts'. Reads inventory.yaml, writes hosts/*.yaml.
- cmd/oikos/main.go: added build-hosts role.
- docker-compose.yml: hermes service simplified.
- apps/105: all 6 Oikos services stopped + disabled (confirmed inactive).
- Watchdog cron installed, API stop/restart verified.
- Infisical bootstrap pending (image pull timeout — retry separately).

Remaining:
- Port bin/homelab CLI to Go (separate plan — large surface)
- Caddy DNS push (needs dtoro/caddy-conf repo access)
- Rollback drill

cmd/oikos/build_hosts.go

@@ -0,0 +1,187 @@
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+func runBuildHosts() error {
+	repoDir := "."
+	if d := os.Getenv("HOMELAB_CONTEXT_DIR"); d != "" {
+		repoDir = d
+	}
+
+	data, err := os.ReadFile(filepath.Join(repoDir, "inventory.yaml"))
+	if err != nil {
+		return fmt.Errorf("read inventory: %w", err)
+	}
+
+	var inventory map[string]any
+	if err := yaml.Unmarshal(data, &inventory); err != nil {
+		return fmt.Errorf("parse inventory: %w", err)
+	}
+
+	hosts, _ := inventory["hosts"].(map[string]any)
+	services, _ := inventory["services"].(map[string]any)
+	mesh, _ := inventory["mesh"].(map[string]any)
+
+	hostsDir := filepath.Join(repoDir, "hosts")
+	os.MkdirAll(hostsDir, 0755)
+
+	desired := make(map[string]string)
+	for name, entry := range hosts {
+		entryMap, _ := entry.(map[string]any)
+		record := buildHostRecord(name, entryMap, services, mesh)
+		content := fmt.Sprintf("# Generated by oikos build-hosts from inventory.yaml.\n# Do NOT edit by hand.\n\n%s", asYAML(record))
+		desired[name+".yaml"] = content
+	}
+
+	for name, content := range desired {
+		path := filepath.Join(hostsDir, name)
+		if err := os.WriteFile(path, []byte(content), 0644); err != nil {
+			return fmt.Errorf("write %s: %w", path, err)
+		}
+		fmt.Printf("wrote %s\n", name)
+	}
+
+	// Clean orphans
+	entries, _ := os.ReadDir(hostsDir)
+	for _, e := range entries {
+		if strings.HasSuffix(e.Name(), ".yaml") && desired[e.Name()] == "" {
+			os.Remove(filepath.Join(hostsDir, e.Name()))
+			fmt.Printf("deleted orphan %s\n", e.Name())
+		}
+	}
+
+	return nil
+}
+
+func buildHostRecord(name string, entry map[string]any, services map[string]any, mesh map[string]any) map[string]any {
+	kind, _ := entry["kind"].(string)
+
+	var runsServices []string
+	for svc, v := range services {
+		if svcMap, ok := v.(map[string]any); ok {
+			if backend, ok := svcMap["backend"].(string); ok && backend == name {
+				runsServices = append(runsServices, svc)
+			}
+		}
+	}
+	sort.Strings(runsServices)
+
+	var hosted []map[string]any
+	for _, svc := range runsServices {
+		if svcMap, ok := services[svc].(map[string]any); ok {
+			entry := make(map[string]any)
+			for k, v := range svcMap {
+				entry[k] = v
+			}
+			entry["name"] = svc
+			hosted = append(hosted, entry)
+		}
+	}
+
+	record := map[string]any{
+		"name":        name,
+		"kind":        kind,
+		"os":          entry["os"],
+		"role":        entry["role"],
+		"state":       stringOr(entry["state"], "active"),
+		"host":        entry["host"],
+		"pve_id":      entry["pve_id"],
+		"storage":     entry["storage"],
+		"depends_on":  entry["depends_on"],
+		"lan_ip":      entry["lan_ip"],
+		"mesh":        entry["mesh"],
+		"peers":       entry["peers"],
+		"mounts":      entry["mounts"],
+		"public_host": entry["public_host"],
+		"ssh":         entry["ssh"],
+		"runs":        append(stringSlice(entry["runs"]), runsServices...),
+		"services_hosted": hosted,
+		"notes":       entry["notes"],
+		"age_pubkey":  entry["age_pubkey"],
+	}
+
+	if mesh != nil {
+		record["mesh_globals"] = map[string]any{
+			"primary":  mesh["primary"],
+			"accepted": mesh["accepted"],
+		}
+	}
+
+	if mcp, ok := services["homelab_mcp"].(map[string]any); ok {
+		record["mcp_endpoint"] = mcp["endpoint"]
+	}
+	if si, ok := services["secrets_issuance"].(map[string]any); ok {
+		record["secrets_issuance_endpoint"] = si["endpoint"]
+	}
+
+	cleaned := make(map[string]any)
+	for k, v := range record {
+		switch val := v.(type) {
+		case nil:
+			continue
+		case string:
+			if val == "" {
+				continue
+			}
+		case []string:
+			if len(val) == 0 {
+				continue
+			}
+		case []map[string]any:
+			if len(val) == 0 {
+				continue
+			}
+		case map[string]any:
+			if len(val) == 0 {
+				continue
+			}
+		case int:
+			if val == 0 {
+				continue
+			}
+		}
+		cleaned[k] = v
+	}
+
+	return cleaned
+}
+
+func stringOr(v any, def string) string {
+	if s, ok := v.(string); ok && s != "" {
+		return s
+	}
+	return def
+}
+
+func stringSlice(v any) []string {
+	switch val := v.(type) {
+	case []any:
+		var out []string
+		for _, item := range val {
+			if s, ok := item.(string); ok {
+				out = append(out, s)
+			}
+		}
+		return out
+	case []string:
+		return val
+	}
+	return nil
+}
+
+func asYAML(v any) string {
+	var buf bytes.Buffer
+	enc := yaml.NewEncoder(&buf)
+	enc.SetIndent(2)
+	enc.Encode(v)
+	return buf.String()
+}

cmd/oikos/main.go

@@ -59,6 +59,11 @@ func main() {
 			slog.Error("export failed", "error", err)
 			os.Exit(1)
 		}
+	case "build-hosts":
+		if err := runBuildHosts(); err != nil {
+			slog.Error("build-hosts failed", "error", err)
+			os.Exit(1)
+		}
 	case "api":
 		if err := runAPI(ctx, cfg); err != nil {
 			slog.Error("api failed", "error", err)
@@ -111,6 +116,7 @@ Roles:
   migrate    Run database migrations (forward-only, idempotent)
   seed       Ingest seed YAML files into the database
   export     Export DB state back to seed YAMLs (DR / version control)
+  build-hosts Generate hosts/*.yaml from seeds/inventory.yaml
   api        Run the REST + MCP API server (Phase 2)
   scheduler  Run the observe + act loop (Phase 3)
   notifier   Run the notification service (Phase 3)

hosts/apps.yaml

@@ -1,27 +1,26 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: apps
+age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
-kind: lxc
-os: linux
-role: docker-apps
-state: active
 host: hubris
-pve_id: 105
+kind: lxc
 lan_ip: 192.168.8.205
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh:
   tailscale:
-    ip: 100.121.171.122
     fqdn: apps
+    ip: 100.121.171.122
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
 mounts:
   - /mnt/library
-public_hosts:
+name: apps
-- artifacto.hubris.network
+os: linux
+pve_id: 105
+role: docker-apps
 runs:
   - artifacto
   - plantuml
@@ -30,33 +29,31 @@ runs:
   - artifacto
   - homelab_mcp
   - secrets_issuance
-services_hosted:
-- name: artifacto
-  backend: apps
-  url: https://artifacto.hubris.network
-  doc_page: knowledge/wiki/containers/105-apps.md
-  config_repo: dtoro/Artifacto
-- name: homelab_mcp
-  backend: apps
-  port: 9810
-  systemd_unit: homelab-mcp
-  public_host: mcp.hubris.network
-  endpoint: https://mcp.hubris.network/mcp
-  doc_page: knowledge/wiki/infrastructure/homelab-context.md
-  config_repo: dtoro/Homelab-Docs
-  note: MCP server. Read-only context + management. Reachable on the LAN via Caddy and from off-LAN via
-    Netbird (192.168.8.0/24 is a network resource routed through hubris).
-  risk_notes: "agents' primary read surface \u2014 outage degrades every agent to grepping the clone"
-- name: secrets_issuance
-  backend: apps
-  port: 9820
-  systemd_unit: secrets-issuance
-  public_host: secrets.hubris.network
-  endpoint: https://secrets.hubris.network/issue
-  doc_page: .agents/operations/agent-enrollment.md
-  config_repo: dtoro/Homelab-Docs
-  note: Issues per-client age private keys. Gated at source-IP layer (mesh + LAN subnets in MESH_SUBNETS).
-  risk_notes: "identity issuance \u2014 any change is security-sensitive; key operations are destructive-class"
-age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
-mcp_endpoint: https://mcp.hubris.network/mcp
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: apps
+    config_repo: dtoro/Artifacto
+    doc_page: knowledge/wiki/containers/105-apps.md
+    name: artifacto
+    url: https://artifacto.hubris.network
+  - backend: apps
+    config_repo: dtoro/Homelab-Docs
+    doc_page: knowledge/wiki/infrastructure/homelab-context.md
+    endpoint: https://mcp.hubris.network/mcp
+    name: homelab_mcp
+    note: MCP server. Read-only context + management. Reachable on the LAN via Caddy and from off-LAN via Netbird (192.168.8.0/24 is a network resource routed through hubris).
+    port: 9810
+    public_host: mcp.hubris.network
+    risk_notes: agents' primary read surface — outage degrades every agent to grepping the clone
+    systemd_unit: homelab-mcp
+  - backend: apps
+    config_repo: dtoro/Homelab-Docs
+    doc_page: .agents/operations/agent-enrollment.md
+    endpoint: https://secrets.hubris.network/issue
+    name: secrets_issuance
+    note: Issues per-client age private keys. Gated at source-IP layer (mesh + LAN subnets in MESH_SUBNETS).
+    port: 9820
+    public_host: secrets.hubris.network
+    risk_notes: identity issuance — any change is security-sensitive; key operations are destructive-class
+    systemd_unit: secrets-issuance
+state: active

hosts/arriman.yaml

@@ -1,38 +1,34 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: arriman
-kind: lxc
-os: linux
-role: arr-stack
-state: active
 host: strong
-pve_id: 122
+kind: lxc
 lan_ip: 192.168.8.245
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh:
   tailscale:
     fqdn: arr
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
 mounts:
   - /mnt/media_local
-public_hosts:
+name: arriman
-- jellyseerr.hubris.network
-- qbit.hubris.network
-- sab.hubris.network
-runs:
-- arr_stack
-services_hosted:
-- name: arr_stack
-  backend: arriman
-  note: jellyseerr / qbit / sab on docker compose
-  doc_page: knowledge/wiki/containers/122-arriman.md
 notes:
   - Migrated from hubris to strong 2026-07-05 (Phase 2). Library on ludo-lvm.
   - Contains homarr, radarr, sonarr, lidarr, sabnzbd, qbittorrent, bazarr, flaresolverr, prowlarr, jellyseerr
   - qBittorrent auth subnet whitelist expanded to 192.168.8.0/24 (for seanime + Caddy access)
-mcp_endpoint: https://mcp.hubris.network/mcp
+os: linux
+pve_id: 122
+role: arr-stack
+runs:
+  - arr_stack
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: arriman
+    doc_page: knowledge/wiki/containers/122-arriman.md
+    name: arr_stack
+    note: jellyseerr / qbit / sab on docker compose
+state: active

hosts/auth-outpost.yaml

@@ -1,20 +1,20 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: auth-outpost
-kind: lxc
-os: linux
-role: authentik-gateway
-state: active
 host: hubris
-pve_id: 106
+kind: lxc
 lan_ip: 192.168.8.6
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
+name: auth-outpost
 notes:
   - Runs Authentik outpost (reverse-proxy/SSO enforcement) for protected services
-mcp_endpoint: https://mcp.hubris.network/mcp
+os: linux
+pve_id: 106
+role: authentik-gateway
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+state: active

hosts/caddy.yaml

@@ -1,35 +1,34 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: caddy
-kind: lxc
-os: linux
-role: reverse-proxy
-state: active
 host: hubris
-pve_id: 121
+kind: lxc
 lan_ip: 192.168.8.175
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
-peers:
+  primary: netbird
-- authentik
+name: caddy
-- gitea
-runs:
-- caddy
-services_hosted:
-- name: caddy
-  backend: caddy
-  role: reverse-proxy
-  note: terminates all *.hubris.network
-  doc_page: knowledge/wiki/containers/121-caddy.md
-  config_repo: dtoro/caddy-conf
-  risk_notes: "wide blast radius \u2014 every *.hubris.network route rides on it (see oikos/policy.yaml\
-    \ service_overrides)"
 notes:
   - Terminates all *.hubris.network
   - /etc/caddy is a git checkout of dtoro/caddy-conf
-mcp_endpoint: https://mcp.hubris.network/mcp
+os: linux
+peers:
+  - authentik
+  - gitea
+pve_id: 121
+role: reverse-proxy
+runs:
+  - caddy
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: caddy
+    config_repo: dtoro/caddy-conf
+    doc_page: knowledge/wiki/containers/121-caddy.md
+    name: caddy
+    note: terminates all *.hubris.network
+    risk_notes: wide blast radius — every *.hubris.network route rides on it (see oikos/policy.yaml service_overrides)
+    role: reverse-proxy
+state: active

hosts/dns.yaml

@@ -1,29 +1,29 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: dns
-kind: lxc
-os: linux
-role: dns-server
-state: active
 host: hubris
-pve_id: 107
+kind: lxc
 lan_ip: 192.168.8.2
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
-runs:
+  primary: netbird
-- dns
+name: dns
-services_hosted:
-- name: dns
-  backend: dns
-  note: Technitium DNS, split-horizon zone
-  doc_page: knowledge/wiki/containers/107-dns.md
-  risk_notes: "LAN-wide resolver \u2014 misconfig breaks name resolution for every client"
 notes:
   - Technitium DNS, split-horizon zone for *.hubris.network
   - Primary DNS for 192.168.8.0/24 LAN (inventory.services.dns references this)
-mcp_endpoint: https://mcp.hubris.network/mcp
+os: linux
+pve_id: 107
+role: dns-server
+runs:
+  - dns
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: dns
+    doc_page: knowledge/wiki/containers/107-dns.md
+    name: dns
+    note: Technitium DNS, split-horizon zone
+    risk_notes: LAN-wide resolver — misconfig breaks name resolution for every client
+state: active

hosts/elementsynapse.yaml

@@ -1,31 +1,31 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: elementsynapse
-kind: lxc
-os: linux
-role: matrix-server
-state: active
 host: strong
-pve_id: 118
+kind: lxc
 lan_ip: 192.168.8.242
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh:
   tailscale: {}
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
-public_host: matrix.hubris.network
+  primary: netbird
-runs:
+name: elementsynapse
-- matrix
-services_hosted:
-- name: matrix
-  url: https://matrix.hubris.network
-  backend: elementsynapse
-  doc_page: knowledge/wiki/containers/118-elementsynapse.md
-  risk_notes: "alert/approval channel for Oikos \u2014 outage silences agent escalation"
 notes:
   - Migrated from hubris to strong 2026-07-05 (Phase 1 of strong migration plan).
-mcp_endpoint: https://mcp.hubris.network/mcp
+os: linux
+public_host: matrix.hubris.network
+pve_id: 118
+role: matrix-server
+runs:
+  - matrix
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: elementsynapse
+    doc_page: knowledge/wiki/containers/118-elementsynapse.md
+    name: matrix
+    risk_notes: alert/approval channel for Oikos — outage silences agent escalation
+    url: https://matrix.hubris.network
+state: active

hosts/gitea.yaml

@@ -1,36 +1,36 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: gitea
-kind: lxc
-os: linux
-role: git-server
-state: active
 host: hubris
-pve_id: 104
+kind: lxc
 lan_ip: 192.168.8.121
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh:
   tailscale:
     fqdn: gitea
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
 mounts:
   - /mnt/library
-public_host: git.hubris.network
+name: gitea
-runs:
-- gitea
-services_hosted:
-- name: gitea
-  url: https://git.hubris.network
-  backend: gitea
-  backend_url: http://192.168.8.121:3000
-  doc_page: knowledge/wiki/containers/104-gitea.md
-  config_repo: dtoro/gitea-customizations
-  risk_notes: hosts all config repos + deploy webhooks; outage blocks auto-deploy and sync
 notes:
   - Bare repos live at /mnt/library/repos/dtoro/*.git
-mcp_endpoint: https://mcp.hubris.network/mcp
+os: linux
+public_host: git.hubris.network
+pve_id: 104
+role: git-server
+runs:
+  - gitea
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: gitea
+    backend_url: http://192.168.8.121:3000
+    config_repo: dtoro/gitea-customizations
+    doc_page: knowledge/wiki/containers/104-gitea.md
+    name: gitea
+    risk_notes: hosts all config repos + deploy webhooks; outage blocks auto-deploy and sync
+    url: https://git.hubris.network
+state: active

hosts/grimmory.yaml

@@ -1,25 +1,25 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: grimmory
+age_pubkey: age1uellsemnjrzgfg9fxw4jefpy05laxzggwnwhh6ny3wl7alyp6v8q0muxet
-kind: lxc
-os: linux
-role: book-library
-state: active
 host: strong
-pve_id: 130
+kind: lxc
 lan_ip: 192.168.8.247
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
 mounts:
   - /mnt/media_local
-public_host: books.hubris.network
+name: grimmory
 notes:
   - Docker host for Grimmory (community fork of Booklore). Created 2026-06-29.
   - Migrated from hubris to strong 2026-07-05 (Phase 2d). Books on ludo-lvm.
-age_pubkey: age1uellsemnjrzgfg9fxw4jefpy05laxzggwnwhh6ny3wl7alyp6v8q0muxet
+os: linux
-mcp_endpoint: https://mcp.hubris.network/mcp
+public_host: books.hubris.network
+pve_id: 130
+role: book-library
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+state: active

hosts/haos.yaml

@@ -1,27 +1,27 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: haos
-kind: vm
-os: linux
-role: home-automation
-state: active
 host: hubris
-pve_id: 108
+kind: vm
 lan_ip: 192.168.8.101
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh:
   tailscale:
     fqdn: homeassistant
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
+name: haos
+os: linux
+pve_id: 108
+role: home-automation
 runs:
   - haos
-services_hosted:
-- name: haos
-  backend: haos
-  doc_page: knowledge/wiki/vms/108-haos.md
-mcp_endpoint: https://mcp.hubris.network/mcp
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: haos
+    doc_page: knowledge/wiki/vms/108-haos.md
+    name: haos
+state: active

hosts/house.yaml

@@ -1,26 +1,25 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: house
+age_pubkey: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
-kind: lxc
-os: linux
-role: family-planner
-state: active
 host: strong
-pve_id: 129
+kind: lxc
 lan_ip: 192.168.8.244
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
-public_host: house.hubris.network
+  primary: netbird
+name: house
 notes:
   - Docker host for Yuvomi (family planner). Created 2026-06-26.
   - Migrated from hubris to strong 2026-07-05 (Phase 1 of strong migration plan).
   - Runs Yuvomi container + WebDAV doc bridge to paperless
-- 192.168.8.212 was the hubris IP before migration (briefly picked up by teddycloud via DHCP; teddycloud
+  - 192.168.8.212 was the hubris IP before migration (briefly picked up by teddycloud via DHCP; teddycloud has since been given a static IP, see hosts.teddycloud)
-  has since been given a static IP, see hosts.teddycloud)
+os: linux
-age_pubkey: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
+public_host: house.hubris.network
-mcp_endpoint: https://mcp.hubris.network/mcp
+pve_id: 129
+role: family-planner
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+state: active

hosts/hubris.yaml

@@ -1,36 +1,36 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: hubris
+age_pubkey: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
 kind: proxmox-host
-os: linux
-role: hypervisor
-state: active
 lan_ip: 192.168.8.77
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh:
   netbird:
-    ip: 100.122.38.109
     fqdn: proxmox-server.netbird.selfhosted
+    ip: 100.122.38.109
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
 mounts:
   - /mnt/library
-ssh:
+name: hubris
-  port: 22
+os: linux
-  netbird_port: 22022
+role: hypervisor
-  user: root
 runs:
   - proxmox_ui
-services_hosted:
-- name: proxmox_ui
-  url: https://proxmox.hubris.network
-  backend: hubris
-  port: 8006
-  doc_page: knowledge/wiki/hosts/hubris.md
-  risk_notes: "hypervisor UI \u2014 changes here affect every guest on the node"
-age_pubkey: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
-mcp_endpoint: https://mcp.hubris.network/mcp
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: hubris
+    doc_page: knowledge/wiki/hosts/hubris.md
+    name: proxmox_ui
+    port: 8006
+    risk_notes: hypervisor UI — changes here affect every guest on the node
+    url: https://proxmox.hubris.network
+ssh:
+  netbird_port: 22022
+  port: 22
+  user: root
+state: active

hosts/jellyfin.yaml

@@ -1,39 +1,38 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: jellyfin
-kind: lxc
-os: linux
-role: media-server
-state: active
 host: strong
-pve_id: 101
+kind: lxc
 lan_ip: 192.168.8.246
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh:
   tailscale:
     fqdn: jellyfin
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
 mounts:
   - /mnt/media_local
-public_host: media.hubris.network
+name: jellyfin
-runs:
-- jellyfin
-services_hosted:
-- name: jellyfin
-  url: https://media.hubris.network
-  backend: jellyfin
-  doc_page: knowledge/wiki/containers/101-jellyfin.md
-  risk_notes: native Authentik OIDC via SSO-Auth plugin, no Caddy forward-auth gate; VAAPI transcode depends
-    on GPU passthrough on strong
 notes:
   - Jellyfin 10.11.11 with VAAPI hardware acceleration (Radeon 680M iGPU on strong)
   - 4 cores / 8 GiB RAM / 1 GiB swap
   - SSO-Auth plugin v4.0.0.4 with Authentik OIDC (no Caddy forward-auth gate)
   - GPU passed via dev0+dev1: /dev/dri/renderD128 + card0
   - Migrated from hubris to strong 2026-07-05 (Phase 2). Library on ludo-lvm.
-mcp_endpoint: https://mcp.hubris.network/mcp
+os: linux
+public_host: media.hubris.network
+pve_id: 101
+role: media-server
+runs:
+  - jellyfin
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: jellyfin
+    doc_page: knowledge/wiki/containers/101-jellyfin.md
+    name: jellyfin
+    risk_notes: native Authentik OIDC via SSO-Auth plugin, no Caddy forward-auth gate; VAAPI transcode depends on GPU passthrough on strong
+    url: https://media.hubris.network
+state: active

hosts/mac-mini.yaml

@@ -1,24 +1,24 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: mac-mini
+age_pubkey: age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs
 kind: workstation
-os: macos
-role: dev
-state: active
 lan_ip: 192.168.178.182
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh:
   netbird:
     fqdn: mac-mini-234-17.netbird.selfhosted
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
-ssh:
+  primary: netbird
-  user: dtoro
+name: mac-mini
 notes:
   - Only macOS in the fleet. Bootstrap uses launchd.
-age_pubkey: age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs
+os: macos
-mcp_endpoint: https://mcp.hubris.network/mcp
+role: dev
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+ssh:
+  user: dtoro
+state: active

hosts/mule-images.yaml

@@ -1,32 +1,32 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: mule-images
-kind: lxc
-os: linux
-role: photo-management
-state: active
 host: hubris
-pve_id: 120
+kind: lxc
 lan_ip: 192.168.8.136
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh:
   tailscale:
     fqdn: muleimage
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
 mounts:
   - /mnt/library
+name: mule-images
+os: linux
 public_host: photos.hubris.network
+pve_id: 120
+role: photo-management
 runs:
   - photos
-services_hosted:
-- name: photos
-  url: https://photos.hubris.network
-  backend: mule-images
-  doc_page: knowledge/wiki/containers/120-mule-images.md
-  config_repo: dtoro/mule-image
-mcp_endpoint: https://mcp.hubris.network/mcp
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: mule-images
+    config_repo: dtoro/mule-image
+    doc_page: knowledge/wiki/containers/120-mule-images.md
+    name: photos
+    url: https://photos.hubris.network
+state: active

hosts/netbird-vps.yaml

@@ -1,40 +1,35 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: netbird-vps
 kind: external
-os: linux
+mcp_endpoint: https://mcp.hubris.network/mcp
-role: netbird-mgmt
-state: active
 mesh:
   netbird:
-    ip: 100.122.165.149
     fqdn: netbird-ionos.netbird.selfhosted
+    ip: 100.122.165.149
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
-ssh:
+  primary: netbird
-  user: root
+name: netbird-vps
+notes:
+  - Public IONOS VPS — hosts the vanilla netbird mgmt+signal+relay+dashboard stack + host coturn (see infrastructure/vps-hardening.md + infrastructure/mesh.md changelog 2026-05-21).
+  - NOT a homelab client. No /etc/age/key.txt, no /opt/homelab-context clone. Managed via ssh from hubris; sshd is locked to hubris's pubkey.
+  - Public IPv4 82.165.190.79. Auto-patching via unattended-upgrades.
+  - Configs rendered by `homelab render-vps-configs` from vps/turnserver.conf.tmpl + vps/management.json.tmpl, with secrets decrypted from secrets/turn-shared-secret.yaml + secrets/netbird-authentik-oidc.yaml on hubris.
+os: linux
+role: netbird-mgmt
 runs:
   - authentik
-services_hosted:
-- name: authentik
-  url: https://auth.hubris.network
-  backend: netbird-vps
-  doc_page: knowledge/wiki/containers/106-auth-outpost.md
-  note: core runs on the VPS since 2026-05-31; LAN forward-auth outpost is auth-outpost (LXC 106) at 192.168.8.6:9000.
-    Previous backend value "authentik" referenced the retired embedded-outpost host (LXC 124).
-  risk_notes: "SSO provider \u2014 outage locks login to OIDC/forward-auth services"
-notes:
-- "Public IONOS VPS \u2014 hosts the vanilla netbird mgmt+signal+relay+dashboard stack + host coturn (see\
-  \ infrastructure/vps-hardening.md + infrastructure/mesh.md changelog 2026-05-21)."
-- NOT a homelab client. No /etc/age/key.txt, no /opt/homelab-context clone. Managed via ssh from hubris;
-  sshd is locked to hubris's pubkey.
-- Public IPv4 82.165.190.79. Auto-patching via unattended-upgrades.
-- Configs rendered by `homelab render-vps-configs` from vps/turnserver.conf.tmpl + vps/management.json.tmpl,
-  with secrets decrypted from secrets/turn-shared-secret.yaml + secrets/netbird-authentik-oidc.yaml on
-  hubris.
-mcp_endpoint: https://mcp.hubris.network/mcp
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: netbird-vps
+    doc_page: knowledge/wiki/containers/106-auth-outpost.md
+    name: authentik
+    note: core runs on the VPS since 2026-05-31; LAN forward-auth outpost is auth-outpost (LXC 106) at 192.168.8.6:9000. Previous backend value "authentik" referenced the retired embedded-outpost host (LXC 124).
+    risk_notes: SSO provider — outage locks login to OIDC/forward-auth services
+    url: https://auth.hubris.network
+ssh:
+  user: root
+state: active

hosts/nextcloud.yaml

@@ -1,31 +1,31 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: nextcloud
-kind: lxc
-os: linux
-role: file-sync
-state: active
 host: hubris
-pve_id: 114
+kind: lxc
 lan_ip: 192.168.8.224
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh:
   tailscale:
     fqdn: nextcloud
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
 mounts:
   - /mnt/library
+name: nextcloud
+os: linux
 public_host: cloud.hubris.network
+pve_id: 114
+role: file-sync
 runs:
   - nextcloud
-services_hosted:
-- name: nextcloud
-  url: https://cloud.hubris.network
-  backend: nextcloud
-  doc_page: knowledge/wiki/containers/114-nextcloud.md
-mcp_endpoint: https://mcp.hubris.network/mcp
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: nextcloud
+    doc_page: knowledge/wiki/containers/114-nextcloud.md
+    name: nextcloud
+    url: https://cloud.hubris.network
+state: active

hosts/nfs-export.yaml

@@ -1,18 +1,18 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: nfs-export
-kind: lxc
-os: linux
-role: storage-export
-state: active
 host: hubris
-pve_id: 102
+kind: lxc
 lan_ip: 192.168.8.200
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
-mcp_endpoint: https://mcp.hubris.network/mcp
+  primary: netbird
+name: nfs-export
+os: linux
+pve_id: 102
+role: storage-export
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+state: active

hosts/paperless.yaml

@@ -1,32 +1,32 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: paperless
-kind: lxc
-os: linux
-role: document-archive
-state: active
 host: hubris
-pve_id: 103
+kind: lxc
 lan_ip: 192.168.8.130
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh:
   tailscale:
     fqdn: paperless
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
 mounts:
   - /mnt/library
+name: paperless
+os: linux
 public_host: paperless.hubris.network
+pve_id: 103
+role: document-archive
 runs:
   - paperless
-services_hosted:
-- name: paperless
-  url: https://paperless.hubris.network
-  backend: paperless
-  doc_page: knowledge/wiki/containers/103-paperless.md
-  risk_notes: "document archive \u2014 treat data as irreplaceable; DB operations are destructive-class"
-mcp_endpoint: https://mcp.hubris.network/mcp
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: paperless
+    doc_page: knowledge/wiki/containers/103-paperless.md
+    name: paperless
+    risk_notes: document archive — treat data as irreplaceable; DB operations are destructive-class
+    url: https://paperless.hubris.network
+state: active

hosts/rclone.yaml

@@ -1,19 +1,19 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: rclone
+age_pubkey: age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x
 kind: lxc
-os: linux
+mcp_endpoint: https://mcp.hubris.network/mcp
-role: backup
-state: active
 mesh:
   netbird:
     fqdn: rclone.netbird.selfhosted
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
-age_pubkey: age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x
+  primary: netbird
-mcp_endpoint: https://mcp.hubris.network/mcp
+name: rclone
+os: linux
+role: backup
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+state: active

hosts/republic-laptop.yaml

@@ -1,20 +1,20 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: republic-laptop
 kind: workstation
-os: linux
+mcp_endpoint: https://mcp.hubris.network/mcp
-role: primary-dev
-state: active
 mesh:
   netbird:
     fqdn: republic-laptop.netbird.selfhosted
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
+name: republic-laptop
+os: linux
+role: primary-dev
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
 ssh:
   user: dtoro
-mcp_endpoint: https://mcp.hubris.network/mcp
+state: active
-secrets_issuance_endpoint: https://secrets.hubris.network/issue

hosts/romm.yaml

@@ -1,26 +1,26 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: romm
-kind: lxc
-os: linux
-role: rom-manager
-state: active
 host: strong
-pve_id: 134
+kind: lxc
 lan_ip: 192.168.8.249
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
 mounts:
   - /mnt/media_local
-public_host: roms.hubris.network
+name: romm
 notes:
   - Docker host for RomM (romm.app) self-hosted ROM manager. Created 2026-07-05.
   - MariaDB sidecar at /opt/romm/docker-compose.yml.
   - ROMs on ludo-lvm media volume at /mnt/media_local/roms.
   - 1 core / 2 GiB RAM / 16 GiB rootfs (ludo-lvm).
-mcp_endpoint: https://mcp.hubris.network/mcp
+os: linux
+public_host: roms.hubris.network
+pve_id: 134
+role: rom-manager
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+state: active

hosts/seanime.yaml

@@ -1,29 +1,29 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: seanime
-kind: lxc
-os: linux
-role: anime-media-server
-state: active
 host: strong
-pve_id: 133
+kind: lxc
 lan_ip: 192.168.8.248
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
 mounts:
   - /mnt/media_local/anime
-public_host: seanime.hubris.network
+name: seanime
 notes:
   - Seanime anime media server for online streaming + local library scanning
   - Created 2026-07-05. Binary at /opt/seanime/bin/seanime, systemd service.
   - Connected to qBittorrent on arriman (192.168.8.245:8080)
   - 8 online streaming extensions installed (HiAnime, AniWatch, KickAssAnime, etc.)
   - /anime mounted from strong ludo-lvm (/mnt/media_local/anime)
-- Caddy: "https://seanime.hubris.network \u2192 192.168.8.248:43211"
+  - Caddy: https://seanime.hubris.network → 192.168.8.248:43211
   - qBittorrent auth subnet whitelist expanded to 192.168.8.0/24 for seanime access
-mcp_endpoint: https://mcp.hubris.network/mcp
+os: linux
+public_host: seanime.hubris.network
+pve_id: 133
+role: anime-media-server
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+state: active

hosts/sophia.yaml

@@ -1,23 +1,23 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: sophia
-kind: lxc
-os: linux
-role: workshop
-state: active
 host: hubris
-pve_id: 119
+kind: lxc
 lan_ip: 192.168.8.109
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh:
   tailscale:
     fqdn: sophia
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
 mounts:
   - /mnt/library
-mcp_endpoint: https://mcp.hubris.network/mcp
+name: sophia
+os: linux
+pve_id: 119
+role: workshop
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+state: active

hosts/strong.yaml

@@ -1,32 +1,24 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: strong
+age_pubkey: age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4
 kind: proxmox-host
-os: linux
-role: hypervisor
-state: active
 lan_ip: 192.168.178.181
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
+name: strong
+notes:
+  - Reformatted from Linux workstation ("ludo-mini" in this wiki, still the machine's nickname) to Proxmox VE 9.2.3 on 2026-07-01. Renamed the inventory/wiki identity from ludo-mini to strong on the same day so it matches the OS/cluster hostname everywhere (bootstrap looks up hosts/$(hostname).yaml, so a mismatch would break enrollment).
+  - Joined hubris's "Homelab" cluster same day. 2-node, no QDevice tiebreaker yet — see hosts/hubris.md quorum note.
+  - Netbird not yet installed (fresh OS wiped prior enrollment); reachable today only via the household LAN / existing Fritz static route to 192.168.8.0/24. Re-enroll in mesh as a follow-up if off-LAN access to this host itself (not just its future guests) is needed.
+  - First step of the planned library-SSD migration — see .hermes/plans/2026-06-03_110000-library-ssd-migration-to-ludo-mini.md (filename kept as-is, it's a historical planning doc). Only Phase 1 (Proxmox install + cluster join) is done; no physical drive move, service migration, or GPU passthrough has happened yet.
+os: linux
+role: hypervisor
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
 ssh:
   user: root
-notes:
+state: active
-- Reformatted from Linux workstation ("ludo-mini" in this wiki, still the machine's nickname) to Proxmox
-  VE 9.2.3 on 2026-07-01. Renamed the inventory/wiki identity from ludo-mini to strong on the same day
-  so it matches the OS/cluster hostname everywhere (bootstrap looks up hosts/$(hostname).yaml, so a mismatch
-  would break enrollment).
-- "Joined hubris's \"Homelab\" cluster same day. 2-node, no QDevice tiebreaker yet \u2014 see hosts/hubris.md\
-  \ quorum note."
-- Netbird not yet installed (fresh OS wiped prior enrollment); reachable today only via the household
-  LAN / existing Fritz static route to 192.168.8.0/24. Re-enroll in mesh as a follow-up if off-LAN access
-  to this host itself (not just its future guests) is needed.
-- "First step of the planned library-SSD migration \u2014 see .hermes/plans/2026-06-03_110000-library-ssd-migration-to-ludo-mini.md\
-  \ (filename kept as-is, it's a historical planning doc). Only Phase 1 (Proxmox install + cluster join)\
-  \ is done; no physical drive move, service migration, or GPU passthrough has happened yet."
-age_pubkey: age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4
-mcp_endpoint: https://mcp.hubris.network/mcp
-secrets_issuance_endpoint: https://secrets.hubris.network/issue

hosts/teddycloud.yaml

@@ -1,42 +1,35 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: teddycloud
-kind: lxc
-os: linux
-role: teddycloud
-state: active
 host: hubris
-pve_id: 131
+kind: lxc
 lan_ip: 192.168.8.150
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
 mounts:
   - /mnt/library
+name: teddycloud
+notes:
+  - Docker host for TeddyCloud (ghcr.io/toniebox-reverse-engineering/teddycloud), a self-hosted reimplementation of the Toniebox cloud backend. Debian 12 (bookworm).
+  - 1 core / 1 GiB RAM / 512 MiB swap / 16 GiB rootfs (local-lvm).
+  - Predates the client-enrollment convention — undocumented in inventory.yaml until 2026-07-06, when Oikos's drift detector (oikos/drift.py) caught pve_id 131 live on hubris (`pct list`) with no inventory entry. Static IP assigned 2026-07-05 during the strong migration (was picking up 192.168.8.243 via DHCP before that — see hosts/strong.md's 2026-07-05 changelog).
+  - No age_pubkey / homelab-context enrollment — not a homelab CLI client, just a docker-compose app container. Not a required follow-up unless it needs secrets.
+os: linux
 public_host: teddy.hubris.network
+pve_id: 131
+role: teddycloud
 runs:
   - teddycloud
-services_hosted:
-- name: teddycloud
-  url: https://teddy.hubris.network
-  backend: teddycloud
-  doc_page: knowledge/wiki/containers/131-teddycloud.md
-  note: self-hosted TeddyCloud (Toniebox cloud reimplementation), docker compose
-  risk_notes: "no Caddy forward-auth gate (unlike sab.hubris.network on the same Caddyfile) \u2014 reachable\
-    \ to anyone on the LAN/mesh who can resolve teddy.hubris.network; undocumented in inventory.yaml until\
-    \ 2026-07-06 (drift-caught)"
-notes:
-- Docker host for TeddyCloud (ghcr.io/toniebox-reverse-engineering/teddycloud), a self-hosted reimplementation
-  of the Toniebox cloud backend. Debian 12 (bookworm).
-- 1 core / 1 GiB RAM / 512 MiB swap / 16 GiB rootfs (local-lvm).
-- "Predates the client-enrollment convention \u2014 undocumented in inventory.yaml until 2026-07-06, when\
-  \ Oikos's drift detector (oikos/drift.py) caught pve_id 131 live on hubris (`pct list`) with no inventory\
-  \ entry. Static IP assigned 2026-07-05 during the strong migration (was picking up 192.168.8.243 via\
-  \ DHCP before that \u2014 see hosts/strong.md's 2026-07-05 changelog)."
-- "No age_pubkey / homelab-context enrollment \u2014 not a homelab CLI client, just a docker-compose app\
-  \ container. Not a required follow-up unless it needs secrets."
-mcp_endpoint: https://mcp.hubris.network/mcp
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: teddycloud
+    doc_page: knowledge/wiki/containers/131-teddycloud.md
+    name: teddycloud
+    note: self-hosted TeddyCloud (Toniebox cloud reimplementation), docker compose
+    risk_notes: no Caddy forward-auth gate (unlike sab.hubris.network on the same Caddyfile) — reachable to anyone on the LAN/mesh who can resolve teddy.hubris.network; undocumented in inventory.yaml until 2026-07-06 (drift-caught)
+    url: https://teddy.hubris.network
+state: active

hosts/trmnl.yaml

@@ -1,28 +1,28 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: trmnl
-kind: lxc
-os: linux
-role: trmnl-middleware
-state: active
 host: hubris
-pve_id: 128
+kind: lxc
 lan_ip: 192.168.8.211
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
+name: trmnl
+os: linux
 public_host: trmnl.hubris.network
+pve_id: 128
+role: trmnl-middleware
 runs:
   - trmnl
-services_hosted:
-- name: trmnl
-  backend: trmnl
-  url: https://trmnl.hubris.network
-  note: self-hosted middleware for TRMNL e-ink plugins (polled by TRMNL cloud)
-  doc_page: knowledge/wiki/containers/128-trmnl.md
-  config_repo: dtoro/terminalito
-mcp_endpoint: https://mcp.hubris.network/mcp
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: trmnl
+    config_repo: dtoro/terminalito
+    doc_page: knowledge/wiki/containers/128-trmnl.md
+    name: trmnl
+    note: self-hosted middleware for TRMNL e-ink plugins (polled by TRMNL cloud)
+    url: https://trmnl.hubris.network
+state: active

hosts/zimaos.yaml

@@ -1,26 +1,26 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
+# Generated by oikos build-hosts from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
+# Do NOT edit by hand.
-# Source of truth: ../inventory.yaml
+
-name: zimaos
-kind: vm
-os: linux
-role: nas-frontend-eval
-state: active
 host: hubris
-pve_id: 100
+kind: vm
 lan_ip: 192.168.8.195
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh_globals:
-  primary: netbird
   accepted:
     - netbird
     - tailscale
+  primary: netbird
+name: zimaos
+os: linux
 public_host: zimaos.hubris.network
+pve_id: 100
+role: nas-frontend-eval
 runs:
   - zimaos
-services_hosted:
-- name: zimaos
-  url: https://zimaos.hubris.network
-  backend: zimaos
-  doc_page: knowledge/wiki/vms/100-zimaos.md
-mcp_endpoint: https://mcp.hubris.network/mcp
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: zimaos
+    doc_page: knowledge/wiki/vms/100-zimaos.md
+    name: zimaos
+    url: https://zimaos.hubris.network
+state: active