cleanup: fix all stale references across .agents/ docs

- Rewrite AGENTS.md: DB as source of truth, MCP knowledge tools, archive refs
- Fix OIKOS.md: seeds/ paths, remove Python-era notes, update deployment status
- Fix commands.md, agent-enrollment.md: archive/knowledge/ links
- Fix all SKILL.md files: remove hosts/*.yaml refs, point to inventory.yaml
- Fix HERMES.md, schema.md, page-templates.md, llm-wiki.md: update paths
- Fix bootstrap.sh: identity check reads inventory.yaml
- Fix README.md, cutover-checklist.md: stale wiki references
- Move convert-wiki.py to archive/ (one-shot done)

.agents/OIKOS.md

@@ -6,8 +6,8 @@ structure, the `homelab` CLI and MCP server are the syscall surface, and
 this page defines the rules everything above them follows.
 
 Read this after [AGENTS.md](../AGENTS.md). Machine-readable companions:
-[oikos/ontology.yaml](../oikos/ontology.yaml) (systems model),
-[oikos/policy.yaml](../oikos/policy.yaml) (risk & approval).
+[seeds/ontology.yaml](../seeds/ontology.yaml) (systems model),
+[seeds/policy.yaml](../seeds/policy.yaml) (risk & approval).
 
 ## The kernel loop: OODA
 
@@ -41,16 +41,17 @@ one pass through **Observe → Orient → Decide → Act**:
 | Host / Service | topology entities | `inventory.yaml` |
 | Secret | SOPS+age encrypted value, per-client recipients | `secrets/` + `.sops.yaml` |
 | Runbook | executable workflow with risk class + verification | `.agents/skills/<name>/SKILL.md` |
-| Signal | something needing attention, with lifecycle | `signals/` ledger (Week 3) |
-| Change | one mutation: who, what, risk, approval, verification | `ledger/` (Week 2) |
-| Approval | short-TTL signed grant for a gated action | approval engine (Week 3) |
-| Incident | investigation narrative | `knowledge/sources/investigations/` |
+| Signal | something needing attention, with lifecycle | DB `signals` table |
+| Change | one mutation: who, what, risk, approval, verification | DB `audit_log` + `executions` tables |
+| Approval | short-TTL signed grant for a gated action | DB `approvals` table |
+| Incident | investigation narrative | DB `knowledge_entities` (seeded from investigations) |
+| Knowledge | document, runbook, investigation | DB `knowledge_entities` (seeded from `seeds/knowledge.yaml`) |
 | Plan | design doc for non-trivial work | `plans/` |
 | Agent | enrolled client identity = its age pubkey | `inventory.yaml` + `.sops.yaml` |
 
 ## Risk classes (enforced, not advisory)
 
-From [oikos/policy.yaml](../oikos/policy.yaml):
+From [seeds/policy.yaml](../seeds/policy.yaml):
 
 - **read_only** — status, logs, docs, inventory. Unattended.
 - **reversible_low** — restart, cache clear, sync pull. Unattended + ledger.
@@ -69,7 +70,7 @@ Eight domains — physical, compute, network, storage, software,
 identity & access, operations, external — cover everything in the lab;
 entities are connected by typed edges (`hosts`, `provides`, `mounts`,
 `stores-on`, `routes-to`, `can-decrypt`, `depends-on`, `backs-up-to`, …)
-defined in [oikos/ontology.yaml](../oikos/ontology.yaml). Rule of
+defined in [seeds/ontology.yaml](../seeds/ontology.yaml). Rule of
 completeness: **if it can break, be changed, or hold data, it has an
 entity and edges.** Blast-radius questions ("what breaks if strong goes
 down?") are graph walks, not doc archaeology.
@@ -80,9 +81,9 @@ stored as `state:` in inventory (absent = active). Destroyed nodes live in
 the `archaeology:` section. Each transition is a runbook checklist;
 deprecation completes only when inbound edges reach zero.
 
-Generated views: [infrastructure/topology.md](../knowledge/wiki/infrastructure/topology.md)
-(Mermaid, regenerated from inventory) and the live, clickable version at
-`oikos.hubris.network/graph` once the Console is deployed.
+Generated views: the live topology graph at `oikos.hubris.network/graph`
+via the API's `/api/v1/graph` endpoint, and the Mermaid export at
+`GET /api/v1/graph?format=mermaid`.
 
 ## Conventions carried forward
 
@@ -95,22 +96,24 @@ Generated views: [infrastructure/topology.md](../knowledge/wiki/infrastructure/t
 - Agents are terse ([caveman.md](shared/caveman.md)), verify claims, and fix
   collateral drift when found.
 
-## Build status (Go rewrite — 2026-07-06 consolidation plan)
+## Build status (Go rewrite — deployed 2026-07-07)
 
-The Oikos runtime was rewritten from Python to Go over 6 phases. See
+The Oikos runtime was rewritten from Python to Go over 6 phases and is deployed
+in Docker on mac-mini. See
 [plans/2026-07-06-consolidate-oikos-control-plane-onto-mac-mini.md](../plans/2026-07-06-consolidate-oikos-control-plane-onto-mac-mini.md)
-for the full plan. The Python codebase (`oikos/*.py`, `mcp/server.py`,
-`oikos/console/`) is legacy — the Flask console and Python MCP server have
-been removed. The Python kernel files (`oikos/*.py`) remain only because
-`bin/homelab` still imports them for operational CLI commands.
+for the full plan. The Python codebase has been removed; all functionality runs
+in the Go binary.
 
 **Phase 1 — Ontology + DB (DONE):**
-- `migrations/` (001–009): TimescaleDB hypertables, entity_status, CAGGs,
-  retention policies. Forward-only, idempotent.
-- `seeds/{ontology,inventory,policy}.yaml`: DB-native bootstrap + DR export.
+- `migrations/` (001–011): TimescaleDB hypertables, entity_status, CAGGs,
+  retention policies, knowledge entities with FTS. Forward-only, idempotent.
+- `seeds/{ontology,inventory,policy,knowledge}.yaml`: DB-native bootstrap +
+  DR export. Knowledge seed contains 36 documents, 6 investigations, and 12
+  runbooks.
 - `blast_radius()` SQL CTE, type hierarchy, abstract types, relationship
   validation.
-- Go packages: `internal/db/`, `internal/ontology/`, `internal/domain/`.
+- Go packages: `internal/db/`, `internal/ontology/`, `internal/domain/`,
+  `internal/knowledge/`.
 
 **Phase 2 — API (DONE):**
 - Single binary `cmd/oikos` with `oikos api` serving REST (:8090) + MCP
@@ -164,11 +167,10 @@ been removed. The Python kernel files (`oikos/*.py`) remain only because
 - Cutover checklist: `scripts/cutover-checklist.md`.
 
 **Current deployment:**
-- **Dev stack**: `docker compose --profile dev up` (postgres, api,
-  scheduler, notifier) on mac-mini. Hermes runs with `--profile full`.
-- **Production**: apps/105 still hosts the Python MCP + secrets-issuance.
-  Cutover checklist at `scripts/cutover-checklist.md` is the execution
-  plan to move production to the Docker stack.
+- **Production**: Docker stack on mac-mini (`--profile full`: postgres, api,
+  scheduler, notifier, hermes). Deployed 2026-07-07 with full knowledge seed.
+  The Python MCP server and secrets-issuance on apps/105 have been stopped
+  (see `scripts/cutover-checklist.md`).
 
 ## Python-era backlog (superseded)