feat: add /deploy-plugins webhook route + deploy-plugins script

README.md

@@ -1,10 +1,12 @@
 # Oikos
 
 Agentic homelab operating system written in Go. Single binary (`cmd/oikos`),
-Docker-deployed on mac-mini, with a standalone Nomos MCP agent gateway
-(`cmd/nomos`). Manages the **hubris** Proxmox homelab autonomously — observes
-state, classifies actions against policy, executes approved procedures over SSH,
-learns from outcomes, and escalates when uncertain.
+Docker-deployed on mac-mini. Manages the **hubris** Proxmox homelab
+autonomously — observes state, classifies actions against policy, executes
+approved procedures over SSH, learns from outcomes, and escalates when
+uncertain. The agent runtime is [dsh](https://github.com/deepseek-ai/deepseek-harness)
+(DeepSeek Harness, TypeScript sidecar) — it replaced the Nomos gateway and
+talks to this backend over MCP.
 
 **For agents running on enrolled clients:** start with [AGENTS.md](AGENTS.md).
 **For client machines:** see [CLIENTS.md](CLIENTS.md).
@@ -13,12 +15,12 @@ learns from outcomes, and escalates when uncertain.
 ## Quick start
 
 ```bash
-# Dev stack (postgres + api + scheduler). The api/nomos
-# services need a shared token — every route requires a real bearer
+# Dev stack (postgres + api + scheduler). The api
+# service needs a token — every route requires a real bearer
 # credential, there's no dev-open bypass.
 OIKOS_MCP_BEARER_TOKEN=dev-token docker compose --profile dev up -d
 
-# Full stack (adds Nomos agent gateway)
+# Full stack (adds execution worker + Infisical)
 OIKOS_MCP_BEARER_TOKEN=dev-token docker compose --profile full up -d
 
 # Build standalone binary
@@ -39,8 +41,8 @@ OIKOS_DATABASE_URL="postgres://oikos:oikos_dev@localhost:5432/oikos?sslmode=disa
                   ┌──────────────────────────────────┐
                   │         mac-mini (Docker)         │
                   │                                   │
-  Workstation ─── │  nomos (8092) ──MCP── api (8090) │
-  (mesh)          │    MCP gateway      REST + MCP    │
+  Workstation ─── │  dsh (3080)  ──MCP── api (8090) │
+  (mesh)          │    agent runtime    REST + MCP    │
                   │                                   │
                   │  scheduler ─── postgres             │
                   │  (observe)    (Timescale)          │
@@ -51,7 +53,7 @@ OIKOS_DATABASE_URL="postgres://oikos:oikos_dev@localhost:5432/oikos?sslmode=disa
 |-----------|------|------|
 | `oikos api` | 8090 | REST API + MCP server (tool list in [AGENTS.md §3](AGENTS.md#3-the-mcp-server)) |
 | `oikos scheduler` | — | Probe runner, signal lifecycle, metrics |
-| `nomos serve` | 8092 | MCP client gateway, query routing |
+| dsh | 3080 | Agent runtime (DeepSeek Harness sidecar, own workspace) |
 
 ## Phases
 
@@ -110,7 +112,7 @@ The control-room SPA and the Wails desktop wrapper live in their own repo,
 [dtoro/oikos-web](https://git.hubris.network/dtoro/oikos-web) (local
 checkout `~/Projects/oikos-web`) — extracted in Phase 1 of
 [plans/2026-08-15-hexagonal-architecture.md](plans/2026-08-15-hexagonal-architecture.md).
-The SPA talks to `api`/`nomos` over HTTP with a bearer token entered on
+The SPA talks to `api` over HTTP with a bearer token entered on
 first launch. It deploys as its own compose project publishing `8091:80`;
 the outer Caddy (LXC 121) targets that published port, so serving and auth
 are unchanged from the pre-split stack.
@@ -119,7 +121,6 @@ are unchanged from the pre-split stack.
 
 ```
 cmd/oikos/          Go entry point — single binary
-cmd/nomos/          Nomos MCP client gateway
 cmd/webhook/        Gitea deploy-webhook receiver (push-to-deploy on mac-mini)
 internal/           Go packages (actuator, checkdefaults, config, core, db,
                     domain, httpapi, knowledge, learning, mcp, observability,
@@ -133,7 +134,6 @@ checks/             Host health-check scripts run over SSH by the scheduler
 tools/              Client auto-setup scripts (checks)
 ssh/                Deploy keys + authorized_keys management
 vps/                Caddy/TURN config templates for the netbird VPS
-nomos/              Nomos config, persona, skills
 .agents/            Agent instruction files, shared conventions, skills
 plans/              Design documents (active + done)
 docs/adr/           Architecture decision records