cleanup: fix all stale references across .agents/ docs

- Rewrite AGENTS.md: DB as source of truth, MCP knowledge tools, archive refs
- Fix OIKOS.md: seeds/ paths, remove Python-era notes, update deployment status
- Fix commands.md, agent-enrollment.md: archive/knowledge/ links
- Fix all SKILL.md files: remove hosts/*.yaml refs, point to inventory.yaml
- Fix HERMES.md, schema.md, page-templates.md, llm-wiki.md: update paths
- Fix bootstrap.sh: identity check reads inventory.yaml
- Fix README.md, cutover-checklist.md: stale wiki references
- Move convert-wiki.py to archive/ (one-shot done)

AGENTS.md

@@ -6,17 +6,22 @@ point. Read it once at start, then keep working.
 
 The operating model — OODA loop, risk classes, approval rules, the ontology,
 and node lifecycle — is defined in [OIKOS.md](.agents/OIKOS.md). Before any mutation,
-classify the action against `oikos/policy.yaml`; when the class requires
+classify the action against `seeds/policy.yaml`; when the class requires
 approval, stop and ask the operator.
 
-Agent-facing instruction is separated from human content under `.agents/`:
+Agent-facing instruction lives under `.agents/`:
 `.agents/shared/` holds the conventions every agent applies
 ([writing-style](.agents/shared/writing-style.md), [caveman](.agents/shared/caveman.md),
 [page-templates](.agents/shared/page-templates.md), [llm-wiki](.agents/shared/llm-wiki.md)), and
 `.agents/domains/` holds the per-domain schemas
 ([knowledge](.agents/domains/knowledge/schema.md), [operations](.agents/domains/operations/schema.md)).
-The narrative wiki lives under `knowledge/wiki/`; the machine-readable substrate
-(`inventory.yaml` stays at the repo root.
+
+**Source of truth:** The Postgres database is the single source of truth for all
+structured data and knowledge. It is bootstrapped from `seeds/` at deploy time:
+`seeds/ontology.yaml` (entity types, relationships, lifecycles), `seeds/inventory.yaml`
+(hosts, services, entities), `seeds/policy.yaml` (risk classes, approval rules), and
+`seeds/knowledge.yaml` (documents, investigations, runbooks). The old narrative wiki
+is archived at `archive/knowledge/` for historical reference.
 
 ## 1. Who you are
 
@@ -31,91 +36,86 @@ the operator to run `homelab client add <hostname>` from an existing client.
 ## 2. The topology
 
 - `/opt/homelab-context/inventory.yaml` — every host, LXC, VM, and workstation
-  with their mesh addresses, roles, and service mappings. Treat this file as
-  authoritative; anything you read in narrative pages should agree with it.
-- `/opt/homelab-context/knowledge/wiki/infrastructure/mesh.md` — Tailscale → Netbird state.
-  Both meshes are accepted today; Netbird is preferred for new traffic.
-- `/opt/homelab-context/knowledge/wiki/infrastructure/dns.md` — split-horizon DNS via
-  Technitium on [dns (107)](knowledge/wiki/containers/107-dns.md). `*.hubris.network`
-  resolves to 192.168.x.x on the LAN and to mesh addresses off-LAN.
+  with their mesh addresses, roles, and service mappings. This is the seed file;
+  at runtime the DB is authoritative (query via MCP `get_entity` or the REST API).
+- `/opt/homelab-context/seeds/knowledge.yaml` — full narrative knowledge: 36
+  documents, 6 investigations, 12 runbooks. Ingested into the DB on deploy.
 - `/opt/homelab-context/.agents/operations/commands.md` — the operator's cheatsheet
-  for pct, caddy, DNS, and the Oikos command surface. Use these verbs when
-  you take actions.
+  for pct, caddy, DNS, and the Oikos command surface.
 
 ## 3. The MCP server
 
 The homelab exposes a Model Context Protocol server with structured tools.
-Endpoint is in `inventory.yaml` under `services.homelab_mcp.endpoint`.
+Endpoint: `https://mcp.hubris.network/mcp`.
 
 Available tools:
 
-  Context (pure read):
-    get_host(name), list_services(), find_service(name_or_role),
-    get_topology(), search_docs(query), get_page(path),
-    get_changelog(page, since?), whoami(hostname),
-    list_my_secrets(caller_pubkey?)
+  Context (read-only):
+    get_entity(slug), list_entities(type, limit, cursor),
+    get_relations(entity), get_blast_radius(entity),
+    search_knowledge(query) — full-text search over documents, investigations,
+      runbooks (PostgreSQL FTS, replaces the old Python search_docs)
+    get_entity_knowledge(slug) — all documents, investigations, and runbooks
+      linked to an entity
+    get_topology(), whoami(hostname), list_my_secrets(caller_pubkey?)
 
   Management (read-only):
     get_service_status(service), tail_log(service, lines=200),
     list_lxcs(), get_lxc_state(lxc), ping_service(service)
 
   Oikos (read-only; see OIKOS.md):
-    explain(service) — compact context card, cheaper than search_docs+get_page
+    explain(service) — compact context card
     preflight(service) — risk class, approval requirement, verification command
-    get_relations(entity) — ontology blast-radius query (host: or service: id)
     get_change_history(entity, limit=20) — change-ledger entries
     get_state_snapshot() — last scheduler Observe-pass (health, disk, drift count)
 
 Mutations are **not** exposed via MCP. Use the `homelab` CLI for those, with
 operator confirmation — see OIKOS.md's risk classes and approval flow.
 
-**When to prefer MCP over grepping the clone:** any time you need to resolve a
-name to an address, look up service status, or search the wiki by content.
-Grep is fine for browsing or when MCP is unreachable.
+**When to prefer MCP over grepping the clone:** always for knowledge queries.
+`search_knowledge("jellyfin hardware acceleration")` returns ranked results from
+the DB with entity links. `get_entity_knowledge("lxc:jellyfin")` returns documents,
+runbooks, and investigations in one call. Grep the clone only when MCP is
+unreachable.
 
-## 4. Wiki conventions
+## 4. Knowledge conventions
 
-See [page-templates.md](.agents/shared/page-templates.md) for file naming, page
-structure, and the tone standard. Quick reference:
+All narrative knowledge (documents, investigations, runbooks) lives in the DB
+(`knowledge_entities` table) and is seeded from `seeds/knowledge.yaml`. Agents
+can register new knowledge via the API:
 
-- **File naming:** Foundational docs are ALL-CAPS (AGENTS.md, OIKOS.md, GLOSSARY.md);
-  containers use `<id>-<name>.md`; infrastructure uses lowercase-with-dashes; plans
-  and investigations use `YYYY-MM-DD-slug.md`; skills are `<name>/SKILL.md`.
-- **Where pages live:** Narrative under `knowledge/wiki/{containers,hosts,vms,infrastructure}/`;
-  incident records under `knowledge/sources/investigations/`; runbook procedures under
-  `.agents/skills/<name>/SKILL.md`; operator reference under `.agents/operations/`;
-  design docs under `plans/`. Cross-link liberally; orphans are bugs.
-- **Changelog format:** Every page ends with a `## Changelog` section, entries in
-  reverse-chronological order:
+```
+POST /api/v1/knowledge/{entity_slug}
+{"title": "...", "content": "...", "tags": ["..."]}
+```
 
-      ### YYYY-MM-DD — short title
-      one or two lines describing what changed and why.
+The DB is the truth. The old wiki files are archived at `archive/knowledge/` for
+historical reference.
 
+- **Runbook procedures** live as `runbook` entities in the DB and as SKILL.md
+  files under `.agents/skills/<name>/`. They carry `risk_class`, `procedure`
+  (JSON-schema-validated), and are linked to entity types via `applies_to_type`.
+- **Investigations** are `investigation` entities linked to affected entities
+  via `about` edges.
+- **Documents** are `document` entities linked to entities via `documents` edges.
+  They carry `at_glance` (structured attributes) and `changelog` (parsed entries).
 - **Live state precedence.** If you observe a discrepancy between the docs and
-  running state, update the docs *in the same session* (per the same-session update
-  rule in [page-templates.md](.agents/shared/page-templates.md#same-session-update-rule)).
+  running state, update the DB *in the same session* via the API. The `oikos export`
+  command regenerates `seeds/knowledge.yaml` for version control.
 
 ## 5. Acting on the homelab
 
 - **Read state**: prefer MCP tools, then files, then shell. Examples:
   `homelab whoami`, `homelab list`, `homelab status`, `homelab logs caddy`.
 - **Cross-host actions** (caddy reload, pct exec, etc.): use the `homelab`
-  CLI — it resolves hostname → mesh address → ssh / pct path for you. Direct
-  SSH still works; the CLI just removes the lookup burden.
+  CLI — it resolves hostname → mesh address → ssh / pct path for you.
 - **Secrets**: never hardcode. Call `homelab secret <name>` to decrypt on
-  demand using the per-client age key at `/etc/age/key.txt`. Secrets ARE
-  available in this system — `list_my_secrets()` (MCP) shows what you can
-  decrypt.
+  demand using the per-client age key at `/etc/age/key.txt`.
 - **Mutations** (restart, edit configs, etc.): classify against
-  `oikos/policy.yaml` first (`homelab decide <action> <entity>`).
+  `seeds/policy.yaml` first (`homelab decide <action> <entity>`).
   `reversible_low` actions just need the interactive confirmation prompt;
   `config_mutation`/`destructive` actions are mechanically refused without
   a valid `--approval-id` from `homelab approval request` — see OIKOS.md.
-  For ad-hoc work, SSH and edit directly — but commit changes that touch
-  tracked configs (caddy, gitea custom, artifacto, mule-image, etc.; see
-  `knowledge/wiki/infrastructure/auto-deploy.md`).
-- **Wiki updates**: same-session rule applies to any meaningful state change
-  this client makes.
 
 ## 6. Communication mode
 
@@ -145,5 +145,6 @@ To trigger sync manually: `sudo homelab sync` or wait for the 5-min timer.
 
 ## 8. When in doubt
 
-Run `homelab mcp search_docs <query>` or `homelab mcp get_host <name>`.
-The clone is the fallback; MCP is the index.
+Use MCP tools: `search_knowledge <query>` for narrative context,
+`get_entity <slug>` for structured data, `get_entity_knowledge <slug>` for
+everything linked to an entity. The clone is the fallback; MCP is the index.