cleanup: remove deprecated Python artifacts + plan remaining items

Deleted (11 files, 5 directories — not imported by any operational code):
  mcp/deploy/ (5 files) — old Python MCP deployment infra
  mcp/mcp-reader-shell — obsolete
  oikos/report.py — old Python scheduler reporter
  oikos/systemd/ (3 files) — old scheduler systemd units
  internal/.DS_Store — macOS artifact
  backups/ (2 SQL files) — old pre-cutover snapshots

Kept (operational, still needed):
  oikos/*.py (11 kernel files) — bin/homelab imports these
  oikos/cards/ (45 files) — 'homelab service explain'
  mcp/build_host_files.py — bin/homelab calls this
  ledger/ — bin/homelab writes change records
  hosts/ — generated from inventory
  secrets-issuance/ — standalone age-key service
  ssh/, tools/, vps/ — operational scripts
  bin/homelab — active Python CLI (not fully ported)

Remaining plan:
  1. Port bin/homelab fully to Go (most remaining subcommands)
  2. Delete oikos/*.py + mcp/build_host_files.py after port
  3. Infisical bootstrap (needs image pull)
  4. Gitea webhook cleanup (ids 10, 11)
  5. Watchdog manual test + rollback formal drill

oikos/report.py

@@ -1,152 +0,0 @@
-#!/usr/bin/env python3
-"""oikos/report.py — daily morning brief + weekly operator report.
-
-Both are generated text, not sent directly to Matrix — same integration
-contract as oikos/approve.py: there's no dedicated Matrix bot in this
-homelab, so Hermes (already posting alerts as @dtoro:avispero, see
-knowledge/wiki/infrastructure/monitoring.md) is the one that actually delivers this text.
-The daily brief is meant to run once a day (e.g. chained after an early
-oikos-scheduler.service run, or its own systemd timer); the weekly report
-is a deeper markdown review.
-
-Both are grounded only in what's actually implemented: signal state,
-pending approvals, and change-ledger history. There's no Prometheus yet
-(Week-3 backlog item pending LXC provisioning), so there are no trend
-lines here — only point-in-time counts.
-
-CLI:
-    python3 oikos/report.py daily
-    python3 oikos/report.py weekly
-"""
-
-from __future__ import annotations
-
-import sys
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-
-REPO = Path(__file__).resolve().parent.parent
-sys.path.insert(0, str(REPO))
-from oikos import approve as oikos_approve  # noqa: E402
-from oikos import ledger as oikos_ledger  # noqa: E402
-from oikos import scheduler as oikos_scheduler  # noqa: E402
-from oikos import signal as oikos_signal  # noqa: E402
-
-
-def _recent_ledger_entries(since: datetime) -> list[dict]:
-    since_s = since.isoformat(timespec="seconds")
-    out = []
-    if not oikos_ledger.LEDGER_DIR.exists():
-        return out
-    for path in sorted(oikos_ledger.LEDGER_DIR.glob("*.jsonl")):
-        for line in path.read_text().splitlines():
-            if not line.strip():
-                continue
-            import json
-            try:
-                e = json.loads(line)
-            except json.JSONDecodeError:
-                continue
-            if e.get("ts", "") >= since_s:
-                out.append(e)
-    out.sort(key=lambda e: e.get("ts", ""))
-    return out
-
-
-def daily_brief() -> str:
-    now = datetime.now(timezone.utc)
-    since = now - timedelta(hours=24)
-
-    state = oikos_scheduler.read_state()
-    if state is None:
-        health_line = "no scheduler snapshot yet — has oikos-scheduler.timer run?"
-    else:
-        svcs = state.get("services", {})
-        checked = [s for s in svcs.values() if s.get("checked")]
-        healthy = sum(1 for s in checked if s.get("ok"))
-        health_line = f"{healthy}/{len(checked)} services healthy (as of {state['generated_at']})"
-
-    open_signals = oikos_signal.list_signals()
-    open_signals = [s for s in open_signals if s.get("state") in ("raised", "acknowledged", "acting")]
-    by_sev = {"critical": 0, "warning": 0, "info": 0}
-    for s in open_signals:
-        by_sev[s.get("severity", "info")] = by_sev.get(s.get("severity", "info"), 0) + 1
-
-    pending = oikos_approve.list_approvals(state="pending")
-    changes = _recent_ledger_entries(since)
-
-    lines = [
-        f"Oikos daily brief — {now.strftime('%Y-%m-%d')}",
-        f"health: {health_line}",
-        f"signals: {by_sev['critical']} critical, {by_sev['warning']} warning, "
-        f"{by_sev['info']} info ({len(open_signals)} open)",
-        f"pending approvals: {len(pending)}",
-        f"changes in last 24h: {len(changes)}",
-    ]
-    if by_sev["critical"]:
-        lines.append("")
-        lines.append("Critical signals:")
-        for s in open_signals:
-            if s.get("severity") == "critical":
-                lines.append(f"  - {s['id']} {s['entity']}: {s['evidence']}")
-    if pending:
-        lines.append("")
-        lines.append("Pending approvals:")
-        for a in pending:
-            lines.append(f"  - {a['id']} {a['entity']} {a['action']} ({a['risk']})")
-    return "\n".join(lines)
-
-
-def weekly_report() -> str:
-    now = datetime.now(timezone.utc)
-    since = now - timedelta(days=7)
-    changes = _recent_ledger_entries(since)
-    decisions = [c for c in changes if c.get("action", "").startswith("decide:")]
-    auto_act = sum(1 for d in decisions if d.get("result") == "auto-act")
-    escalate = sum(1 for d in decisions if d.get("result") == "escalate")
-    mutations = [c for c in changes if not c.get("action", "").startswith("decide:")]
-
-    all_signals = oikos_signal.list_signals()
-    recent_signals = [s for s in all_signals if s.get("ts", "") >= since.isoformat(timespec="seconds")]
-    by_kind: dict[str, int] = {}
-    for s in recent_signals:
-        by_kind[s.get("kind", "?")] = by_kind.get(s.get("kind", "?"), 0) + 1
-
-    lines = [
-        f"# Oikos weekly report — {since.strftime('%Y-%m-%d')} to {now.strftime('%Y-%m-%d')}",
-        "",
-        "## Changes",
-        f"- {len(mutations)} mutation(s) recorded in the change ledger",
-        f"- {len(decisions)} classifier decision(s): {auto_act} auto-act, {escalate} escalate",
-        "",
-        "## Signals raised this week",
-    ]
-    if by_kind:
-        for kind, count in sorted(by_kind.items(), key=lambda kv: -kv[1]):
-            lines.append(f"- {kind}: {count}")
-    else:
-        lines.append("- none")
-    lines += [
-        "",
-        "## Open at time of report",
-        f"- {len([s for s in all_signals if s.get('state') in ('raised', 'acknowledged', 'acting')])} signal(s)",
-        f"- {len(oikos_approve.list_approvals(state='pending'))} pending approval(s)",
-        "",
-        "## Not yet available",
-        "- Trend lines (disk-full prediction, temp creep) — pending Prometheus provisioning",
-        "- Stale-doc detection — not yet implemented (60/90-day backlog)",
-    ]
-    return "\n".join(lines)
-
-
-def main() -> int:
-    import argparse
-    p = argparse.ArgumentParser(description="oikos daily brief / weekly report")
-    p.add_argument("kind", choices=["daily", "weekly"])
-    args = p.parse_args()
-    print(daily_brief() if args.kind == "daily" else weekly_report())
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

oikos/systemd/oikos-scheduler.service

@@ -1,14 +0,0 @@
-[Unit]
-Description=Oikos observe pass: health probes, drift detectors, signal engine
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=oneshot
-WorkingDirectory=/opt/homelab-context
-ExecStart=/usr/bin/env bash /opt/homelab-context/oikos/systemd/run-scheduler.sh
-TimeoutStartSec=120
-Nice=10
-
-[Install]
-WantedBy=multi-user.target

oikos/systemd/oikos-scheduler.timer

@@ -1,11 +0,0 @@
-[Unit]
-Description=Periodic Oikos observe pass (health, drift, signals)
-
-[Timer]
-OnBootSec=5min
-OnUnitActiveSec=10min
-AccuracySec=1min
-Unit=oikos-scheduler.service
-
-[Install]
-WantedBy=timers.target

oikos/systemd/run-scheduler.sh

@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-# Wrapper for oikos-scheduler.service: run one Observe pass, then commit +
-# push signals/*.jsonl if the run raised/transitioned anything. state.json
-# is intentionally NOT committed (see .gitignore) — it's regenerated every
-# run with no audit value in the diff; signals/ is the tracked ledger.
-set -euo pipefail
-cd /opt/homelab-context
-
-python3 oikos/scheduler.py run
-
-# `git status --porcelain` (not `git diff`) so a brand-new signals/*.jsonl
-# file (untracked) is caught too, not just modifications to tracked ones.
-if [ -d signals ] && [ -n "$(git status --porcelain -- signals/)" ]; then
-    git add signals/
-    if ! git diff --cached --quiet; then
-        git commit -m "signals: oikos-scheduler observe pass $(date -u +%Y-%m-%dT%H:%M:%SZ)"
-        git push
-    fi
-fi