oikos phase 0: ontology + inventory + policy seeds, OpenAPI contract, ADRs

- seeds/ontology.yaml: 59 entity types (5 abstract, is-a hierarchy), 46
  relationship types with cardinality, 6 lifecycles with terminal states
  and named precondition checks
- seeds/inventory.yaml: 110 entities / 142 relationships translated from
  legacy inventory.yaml (fleet, services, ingress, storage, governance,
  archaeology); thin spots marked for backfill
- seeds/policy.yaml: 4 risk classes, 27 approval rules (hierarchy-aware,
  per-entity overrides), autonomy kill-switch off (cold start)
- api/openapi.yaml: full v1 REST contract (40 paths), RFC 9457 errors,
  cursor pagination, idempotency, ETag/If-Match, scopes; redocly-clean
- docs/adr/0001-0010: initial architecture decision records
- scripts/validate-seeds.py: Phase 0 gate — hierarchy, lifecycles,
  endpoints, cardinality, policy cross-refs (0 errors)
- plan: layer CHECK gains 'meta' (root type), cardinality gains
  'many-to-one'

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/adr/0007-threat-model.md

@@ -0,0 +1,27 @@
+# ADR 0007 — Threat model and trust zones
+
+Status: accepted (2026-07-07) · Plan: rev 3, Security model section
+
+## Context
+The control plane can restart services and (eventually) mutate config
+fleet-wide. Compromise of any one container must not equal compromise of
+the fleet.
+
+## Decision
+Trust zones as Docker networks: net-front (Caddy→api only), net-data
+(Postgres), net-ops (SSH egress, actuator only). Hermes holds no SSH keys;
+the actuator uses a restricted key (command=/from= in authorized_keys)
+until the /executions gateway fully brokers actions. Caddy is an explicit
+trust root but the API independently validates OIDC JWTs — network origin
+is defense-in-depth, never the auth (this enables the LAN break-glass API
+binding; the Hermes gateway remains mesh-only). Policy changes are
+dual-controlled with before/after hash auditing and a startup
+hash-vs-known-good check. Approval tokens are single-use HMAC, hashed at
+rest, TTL-bound.
+
+## Consequences
+- Documented residual risks: plaintext LAN break-glass hop (emergency use),
+  Postgres as shared dependency of all roles, macOS host itself unmanaged
+  by the OS.
+- Rotation cadences: actuator SSH key 6mo, machine tokens 90d, webhook
+  HMAC 1y — scheduler raises expiry signals 2 weeks ahead.