feat: add /deploy-plugins webhook route + deploy-plugins script

docker-compose.yml

@@ -2,11 +2,9 @@
 # Usage: docker compose up -d postgres  (just the DB)
 #        make dev                     (full dev stack)
 #
-# The SPA isn't embedded in the oikos binary (see
-# plans/2026-07-12-wails-desktop-app.md 0.1/0.6) but it IS part of this
-# stack as its own `web` service (compose/web/Dockerfile), so it deploys
-# through the same push-to-main pipeline as everything else. `npm run dev`
-# in web/ is still the fast local-iteration path.
+# The control-room SPA lives in its own repo (dtoro/oikos-web) with its own
+# compose project; the agent runtime (dsh) runs outside this stack and talks
+# to api's /mcp like any MCP client.
 
 services:
   postgres:
@@ -78,13 +76,12 @@ services:
       OIKOS_ENV: dev
       OIKOS_DEBUG: "true"
       # No dev-open auth bypass (plans/2026-07-12-wails-desktop-app.md 0.4) —
-      # every request needs this token. nomos uses the same value to call
-      # back into api's /mcp and /api/v1/approvals/*/decision.
+      # every request needs this token. dsh uses the same value to call
+      # into api's /mcp and /api/v1/approvals/*/decision.
       OIKOS_MCP_BEARER_TOKEN: ${OIKOS_MCP_BEARER_TOKEN:-dev-token}
       OIKOS_OIDC_ISSUER: ${OIKOS_OIDC_ISSUER:-https://auth.hubris.network/application/o/oikos/}
       OIKOS_OIDC_CLIENT_ID: ${OIKOS_OIDC_CLIENT_ID:-otkHBSueHJsYtOHstL6rn5izeGgyOsavp1qA1hod}
       OIKOS_NOMOS_AGENT_SLUG: ${OIKOS_NOMOS_AGENT_SLUG:-agent:nomos}
-      NOMOS_PROXY_URL: http://nomos:8092
       # Rate limiting (plan D3). Default off; set OIKOS_API_RATE_LIMIT to a
       # requests/sec value to throttle runaway agent loops per source IP.
       OIKOS_API_RATE_LIMIT: ${OIKOS_API_RATE_LIMIT:-}
@@ -104,10 +101,9 @@ services:
     stop_grace_period: 30s
     mem_limit: 512m
     cpus: 1.0
-    # Exists so nomos can wait for the API to actually answer rather than just
-    # for its container to exist — see nomos's depends_on below. wget is
-    # BusyBox's, already in the alpine runtime image, so this adds no
-    # dependency. /healthz pings the DB, so "healthy" means genuinely ready.
+    # Self-probe so `docker compose ps` reports genuine readiness: /healthz
+    # pings the DB, so "healthy" means actually answering. wget is BusyBox's,
+    # already in the alpine runtime image, so this adds no dependency.
     healthcheck:
       test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8090/healthz"]
       interval: 5s
@@ -118,7 +114,7 @@ services:
       # The api's NewHandler stalls on TWO unreachable external deps at startup
       # before binding :8090: Infisical (4x auth retries, ~40s) and OIDC
       # discovery (auth.hubris.network, ~35s of timeouts). Total ~90-95s, so
-      # the start period must clear it or nomos (depends_on: api-healthy) fails.
+      # the start period must clear it.
       start_period: 180s
 
   # Scheduler (Phase 3) — observe loop
@@ -188,52 +184,11 @@ services:
       retries: 3
       start_period: 90s
 
-  # Nomos agent gateway (Phase 4) — mesh-published :8092
-  nomos:
-    image: oikos-nomos:${OIKOS_VERSION:-latest}
-    build:
-      context: .
-      dockerfile: compose/nomos/Dockerfile
-    restart: unless-stopped
-    profiles: ["full"]
-    depends_on:
-      api:
-        # service_started only waits for the container to exist, so nomos came
-        # up while the API was still binding :8090, failed its MCP initialize,
-        # exited 1, and crash-looped for ~25s on every single deploy. It always
-        # recovered, which is exactly why it went unnoticed. service_healthy
-        # waits for the API to actually answer.
-        condition: service_healthy
-    environment:
-      NOMOS_MCP_URL: http://api:8090/mcp
-      NOMOS_AGENT_SLUG: agent:nomos
-      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY}
-      NOMOS_MODEL: ${NOMOS_MODEL:-deepseek/deepseek-v4-pro}
-      DATABASE_URL: postgres://oikos:${OIKOS_DB_PASSWORD:-oikos_dev}@postgres:5432/oikos?sslmode=disable
-      # Must match api's OIKOS_MCP_BEARER_TOKEN above — api's combinedAuth
-      # rejects every request without it now (no dev-open bypass).
-      OIKOS_MCP_BEARER_TOKEN: ${OIKOS_MCP_BEARER_TOKEN:-dev-token}
-      # Infisical secret store (Phase 5) — nomos resolves mcp_bearer-token
-      # and openrouter_api-key from here, overriding the env values above.
-      OIKOS_INFISICAL_SITE_URL: ${OIKOS_INFISICAL_SITE_URL:-}
-      OIKOS_INFISICAL_CLIENT_ID: ${OIKOS_INFISICAL_CLIENT_ID:-}
-      OIKOS_INFISICAL_CLIENT_SECRET: ${OIKOS_INFISICAL_CLIENT_SECRET:-}
-      OIKOS_INFISICAL_PROJECT_ID: ${OIKOS_INFISICAL_PROJECT_ID:-}
-      OIKOS_INFISICAL_ENV: ${OIKOS_INFISICAL_ENV:-dev}
-    ports:
-      - "8092:8092"
-    stop_signal: SIGTERM
-    stop_grace_period: 10s
-    mem_limit: 512m
-    cpus: 1.0
-    # nomos runs on a distroless image (no shell/wget), so the healthcheck
-    # uses the binary's own `healthcheck` subcommand to self-probe /healthz.
-    healthcheck:
-      test: ["CMD", "/nomos", "healthcheck"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 15s
+  # Nomos agent gateway (Phase 4) — decommissioned. Replaced by dsh
+  # (DeepSeek Harness) as the agent runtime; see
+  # plans/2026-08-16-dsh-as-agent-replace-nomos.md section 5. dsh runs
+  # outside this stack (Node.js sidecar, dev at http://127.0.0.1:3080)
+  # and talks to api's /mcp like any MCP client.
 
   # The control-room SPA moved to its own repo (dtoro/oikos-web, Phase 1 of
   # plans/2026-08-15-hexagonal-architecture.md) with its own compose project