cleanup: fix all stale references across .agents/ docs

- Rewrite AGENTS.md: DB as source of truth, MCP knowledge tools, archive refs
- Fix OIKOS.md: seeds/ paths, remove Python-era notes, update deployment status
- Fix commands.md, agent-enrollment.md: archive/knowledge/ links
- Fix all SKILL.md files: remove hosts/*.yaml refs, point to inventory.yaml
- Fix HERMES.md, schema.md, page-templates.md, llm-wiki.md: update paths
- Fix bootstrap.sh: identity check reads inventory.yaml
- Fix README.md, cutover-checklist.md: stale wiki references
- Move convert-wiki.py to archive/ (one-shot done)

.agents/skills/client-enrollment/SKILL.md

@@ -16,7 +16,7 @@ the full walkthrough; this runbook is the risk/lifecycle framing.
 
 1. On any enrolled client: `homelab client add <hostname>` — appends a
    `hosts.<name>:` block to `inventory.yaml` (lifecycle `state: planned`
-   → `provisioning`, per [oikos/ontology.yaml](../../../oikos/ontology.yaml)),
+   → `provisioning`, per [seeds/ontology.yaml](../../../seeds/ontology.yaml)),
    commits + pushes.
 2. Netbird join is **optional, not a required step** — only needed for
    hosts that must be reachable off-LAN (workstations that roam, e.g.
@@ -40,4 +40,4 @@ Docs-update checklist: if the new host is an LXC/VM, add its narrative
 page under `containers/` or `vms/` and set `doc_page` in its inventory
 entry (host-level cards don't have a `doc_page` field yet — services do;
 narrative pages are still found via the generated `see_also` in
-`hosts/<name>.yaml`).
+`inventory.yaml`).

.agents/skills/config-change-deploy/SKILL.md

@@ -15,13 +15,13 @@ own repo) and get it live, safely.
    `config_repo`, its risk class, and the verification command to run
    after. If risk class requires approval (`config_mutation` or
    `destructive`), stop and get operator sign-off before editing — see
-   `oikos/policy.yaml`.
+   `seeds/policy.yaml`.
 2. Clone/pull the `config_repo` (never edit the backend's working tree
    directly — tracked configs change by commit + push, per
    [OIKOS.md](../../OIKOS.md) conventions).
 3. Make the change, commit, push to `main`.
 4. The Gitea webhook fires the deploy pipeline for that repo (see
-   [infrastructure/auto-deploy.md](../../../knowledge/wiki/infrastructure/auto-deploy.md) for
+   [infrastructure/auto-deploy.md](../../../archive/knowledge/infrastructure/auto-deploy.md) for
    the exact receiver/reload for this service).
 5. Run the preflight's verification command. If it fails, check
    `homelab service <name> log` for the reload/restart error.

.agents/skills/docs-lint/SKILL.md

@@ -15,11 +15,11 @@ links. Prose-voice rules are not machine-checkable — those stay a review respo
 Run from the repo root:
 
     python3 .agents/skills/docs-lint/lint.py            # default: knowledge/ .agents/ operations/ investigations/ plans/
-    python3 .agents/skills/docs-lint/lint.py knowledge/wiki/containers/104-gitea.md
+    python3 .agents/skills/docs-lint/lint.py archive/knowledge/containers/104-gitea.md
 
 Exit code is non-zero when any violation is found, so it can gate a commit. The banned-vocabulary
 list mirrors `writing-style.md`; update both together if the standard changes.
 
-> **Known baseline.** `knowledge/wiki/containers/101-jellyfin.md` links into a sibling repo
+> **Known baseline.** `archive/knowledge/archive/knowledge/containers/101-jellyfin.md` links into a sibling repo
 > (`devops/homelab-authentik-admin`) that this checkout does not contain — expected, not a bug.
 > Any other broken link is a real regression; investigate before dismissing it as baseline noise.

.agents/skills/lifecycle-activate-node/SKILL.md

@@ -9,7 +9,7 @@ transition: "provisioning -> active"
 
 # Lifecycle: activate a node
 
-Per [oikos/ontology.yaml](../../../oikos/ontology.yaml). Requires: age key
+Per [seeds/ontology.yaml](../../../seeds/ontology.yaml). Requires: age key
 enrolled if it needs secrets, mesh joined if it needs off-LAN reach,
 ingress live if public, health check answering, doc page complete,
 ledger entry.
@@ -32,5 +32,5 @@ ledger entry.
    Week 3's runbook automation lands).
 
 Regenerate derived data: `python3 mcp/build_host_files.py && python3
-oikos/gen-topology.py` so `hosts/<name>.yaml`, the topology diagram, and
+inventory.yaml` so `inventory.yaml`, the topology diagram, and
 the context card all reflect the new state.

.agents/skills/lifecycle-deprecate-node/SKILL.md

@@ -9,10 +9,10 @@ transition: "active -> deprecated"
 
 # Lifecycle: deprecate a node
 
-Per [oikos/ontology.yaml](../../../oikos/ontology.yaml): a node keeps running
+Per [seeds/ontology.yaml](../../../seeds/ontology.yaml): a node keeps running
 but takes no new dependents. **Completion condition: zero remaining
 inbound `depends-on`/`routes-to` edges** — this is a hard gate, not a
-suggestion; `oikos/policy.yaml` `lifecycle_overrides.deprecated.refuse`
+suggestion; `seeds/policy.yaml` `lifecycle_overrides.deprecated.refuse`
 lists `new-inbound-edges` as refused going forward.
 
 1. Set `state: deprecated` on the node.

.agents/skills/lifecycle-destroy-node/SKILL.md

@@ -10,7 +10,7 @@ transition: "deprecated -> destroyed"
 # Lifecycle: destroy a node
 
 **Destructive.** Requires operator approval + typed confirmation phrase
-per `oikos/policy.yaml`. Requires (ontology): backups verified, secrets
+per `seeds/policy.yaml`. Requires (ontology): backups verified, secrets
 recipients removed + re-keyed, ingress/DNS removed, archaeology entry,
 ledger entry.
 
@@ -33,7 +33,7 @@ ledger entry.
    data).
 7. `oikos/ledger.py append host:<name> destroy destructive --result ok`.
 8. Regenerate: `python3 mcp/build_host_files.py && python3
-   oikos/gen-topology.py` — the node drops out of `hosts/*.yaml` and
+   inventory.yaml` — the node drops out of `inventory.yaml` and
    appears in the topology doc's archaeology table.
 
 If the destroy fails partway (e.g. secrets revoked but pct destroy

.agents/skills/lifecycle-migrate-node/SKILL.md

@@ -32,8 +32,8 @@ before returning to `active`.
 7. `homelab service <name> health` for every service the node hosts.
 8. Set `state: active`. Add a migration note to the node's doc page
    (old host/IP → new, date, phase reference) — this repo's convention
-   for every past migration (see `containers/101-jellyfin.md`,
+   for every past migration (see `archive/knowledge/containers/101-jellyfin.md`,
    `containers/129-house.md`).
 
 Regenerate: `python3 mcp/build_host_files.py && python3
-oikos/gen-topology.py`.
+inventory.yaml`.

.agents/skills/lifecycle-provision-node/SKILL.md

@@ -2,17 +2,17 @@
 name: lifecycle-provision-node
 risk_class: config_mutation
 inputs: [node_name, kind, storage_pool]
-verification: "grep 'state: provisioning' hosts/<name>.yaml"
+verification: "grep 'state: provisioning' inventory.yaml"
 docs_update_checklist: [doc_page_stub]
 transition: "planned -> provisioning"
 ---
 
 # Lifecycle: provision a node
 
-Per [oikos/ontology.yaml](../../../oikos/ontology.yaml) `lifecycle.transitions`.
+Per [seeds/ontology.yaml](../../../seeds/ontology.yaml) `lifecycle.transitions`.
 Policy note: `provisioning` nodes get a lifecycle override —
 `config_mutation` actions downgrade to `reversible_low` because nothing
-depends on the node yet (see `oikos/policy.yaml` `lifecycle_overrides`).
+depends on the node yet (see `seeds/policy.yaml` `lifecycle_overrides`).
 
 Requires (from ontology): inventory entry, IP reserved, storage pool
 chosen, doc page stub.

.agents/skills/runbook-dpkg-interrupted/SKILL.md

@@ -103,8 +103,8 @@ Then `systemctl status apt-recovery` from a fresh ssh to check progress.
 ## Related
 
 - [Operations cheatsheet](../../operations/commands.md)
-- [Auto-deploy pipelines](../../../knowledge/wiki/infrastructure/auto-deploy.md)
-- [Hubris host page](../../../knowledge/wiki/hosts/hubris.md)
+- [Auto-deploy pipelines](../../../archive/knowledge/infrastructure/auto-deploy.md)
+- [Hubris host page](../../../archive/knowledge/hosts/hubris.md)
 
 ## Changelog
 

.agents/skills/service-health-check/SKILL.md

@@ -20,7 +20,7 @@ Goal: determine whether a service is actually healthy, without ad-hoc SSH.
 4. Cross-check blast radius: `homelab node <name> relations` — is this
    entity's own backend host healthy? A downstream failure (e.g. `strong`
    down) will show up here before the service's own logs explain anything.
-5. If the fix is a restart: classify first (`oikos/policy.yaml` —
+5. If the fix is a restart: classify first (`seeds/policy.yaml` —
    `service-restart` is `reversible_low` unless the service has a
    `service_overrides` entry, e.g. `caddy`/`dns` are `config_mutation`).
    Unattended agents may act on `reversible_low` without approval.