db as source of truth: wiki→seeds, archive old artifacts, knowledge ingestion

- Migrations 010 (content_hash) + 011 (search tsvector column)
- new: internal/knowledge/seed.go — knowledge seed ingest engine
- new: internal/httpapi/knowledge.go — SearchKnowledge + GetEntityKnowledge
- wire knowledge ingest into oikos seed pipeline
- convert all 36 wiki docs + 6 investigations + 12 runbooks → seeds/knowledge.yaml
- archive: knowledge/wiki/→archive/, oikos/cards/→archive/, .hermes/plans/→archive/
- delete: 9 superseded Python kernel files, ledger/, mcp/build_host_files.py
- remove empty knowledge/ directory tree

archive/oikos-cards/cards/host-apps.md

@@ -0,0 +1,21 @@
+# apps (host:apps)
+
+- kind: lxc (LXC 105)
+- state: active
+- runs-on: host:hubris
+- role: docker-apps
+- address: 192.168.8.205 (mesh: tailscale:apps)
+- mounts: /mnt/library
+- doc: knowledge/wiki/containers/105-apps.md
+- secrets: enrolled (age key present)
+
+## Blast radius
+- impacts: service:artifacto, service:homelab_mcp, service:secrets_issuance
+- affected by: host:hubris, mount:/mnt/library, repo:dtoro/Artifacto, repo:dtoro/Homelab-Docs
+- full blast radius: service:artifacto, service:homelab_mcp, service:secrets_issuance
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- 2026-07-06T11:57:21+00:00 deploy-oikos-console (config_mutation) — ok

archive/oikos-cards/cards/host-arriman.md

@@ -0,0 +1,20 @@
+# arriman (host:arriman)
+
+- kind: lxc (LXC 122)
+- state: active
+- runs-on: host:strong
+- role: arr-stack
+- address: 192.168.8.245 (mesh: tailscale:arr)
+- mounts: /mnt/media_local
+- doc: knowledge/wiki/containers/122-arriman.md
+
+## Blast radius
+- impacts: service:arr_stack
+- affected by: host:strong, mount:/mnt/media_local
+- full blast radius: service:arr_stack
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-auth-outpost.md

@@ -0,0 +1,18 @@
+# auth-outpost (host:auth-outpost)
+
+- kind: lxc (LXC 106)
+- state: active
+- runs-on: host:hubris
+- role: authentik-gateway
+- address: 192.168.8.6
+- doc: knowledge/wiki/containers/106-auth-outpost.md
+
+## Blast radius
+- impacts: (none)
+- affected by: host:hubris
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-caddy.md

@@ -0,0 +1,19 @@
+# caddy (host:caddy)
+
+- kind: lxc (LXC 121)
+- state: active
+- runs-on: host:hubris
+- role: reverse-proxy
+- address: 192.168.8.175
+- doc: knowledge/wiki/containers/121-caddy.md
+
+## Blast radius
+- impacts: service:caddy
+- affected by: host:hubris, repo:dtoro/caddy-conf
+- full blast radius: service:caddy
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-dns.md

@@ -0,0 +1,19 @@
+# dns (host:dns)
+
+- kind: lxc (LXC 107)
+- state: active
+- runs-on: host:hubris
+- role: dns-server
+- address: 192.168.8.2
+- doc: knowledge/wiki/containers/107-dns.md
+
+## Blast radius
+- impacts: service:dns
+- affected by: host:hubris
+- full blast radius: service:dns
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- 2026-07-06T11:40:28+00:00 add-record (config_mutation) — ok

archive/oikos-cards/cards/host-elementsynapse.md

@@ -0,0 +1,19 @@
+# elementsynapse (host:elementsynapse)
+
+- kind: lxc (LXC 118)
+- state: active
+- runs-on: host:strong
+- role: matrix-server
+- address: 192.168.8.242
+- doc: knowledge/wiki/containers/118-elementsynapse.md
+
+## Blast radius
+- impacts: service:matrix
+- affected by: host:strong
+- full blast radius: service:matrix
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-gitea.md

@@ -0,0 +1,20 @@
+# gitea (host:gitea)
+
+- kind: lxc (LXC 104)
+- state: active
+- runs-on: host:hubris
+- role: git-server
+- address: 192.168.8.121 (mesh: tailscale:gitea)
+- mounts: /mnt/library
+- doc: knowledge/wiki/containers/104-gitea.md
+
+## Blast radius
+- impacts: service:gitea
+- affected by: host:hubris, mount:/mnt/library, repo:dtoro/gitea-customizations
+- full blast radius: service:gitea
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-grimmory.md

@@ -0,0 +1,20 @@
+# grimmory (host:grimmory)
+
+- kind: lxc (LXC 130)
+- state: active
+- runs-on: host:strong
+- role: book-library
+- address: 192.168.8.247
+- mounts: /mnt/media_local
+- doc: knowledge/wiki/containers/130-grimmory.md
+- secrets: enrolled (age key present)
+
+## Blast radius
+- impacts: (none)
+- affected by: host:strong, mount:/mnt/media_local
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-haos.md

@@ -0,0 +1,19 @@
+# haos (host:haos)
+
+- kind: vm (VM 108)
+- state: active
+- runs-on: host:hubris
+- role: home-automation
+- address: 192.168.8.101 (mesh: tailscale:homeassistant)
+- doc: knowledge/wiki/vms/108-haos.md
+
+## Blast radius
+- impacts: service:haos
+- affected by: host:hubris
+- full blast radius: service:haos
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-house.md

@@ -0,0 +1,19 @@
+# house (host:house)
+
+- kind: lxc (LXC 129)
+- state: active
+- runs-on: host:strong
+- role: family-planner
+- address: 192.168.8.244
+- doc: knowledge/wiki/containers/129-house.md
+- secrets: enrolled (age key present)
+
+## Blast radius
+- impacts: (none)
+- affected by: host:strong
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-hubris.md

@@ -0,0 +1,20 @@
+# hubris (host:hubris)
+
+- kind: proxmox-host
+- state: active
+- role: hypervisor
+- address: 192.168.8.77 (mesh: netbird:proxmox-server.netbird.selfhosted)
+- mounts: /mnt/library
+- doc: knowledge/wiki/hosts/hubris.md
+- secrets: enrolled (age key present)
+
+## Blast radius
+- impacts: host:apps, host:auth-outpost, host:caddy, host:dns, host:gitea, host:haos, host:mule-images, host:nextcloud, host:nfs-export, host:paperless, host:sophia, host:teddycloud, host:trmnl, host:zimaos, service:proxmox_ui
+- affected by: mount:/mnt/library
+- full blast radius: host:apps, host:auth-outpost, host:caddy, host:dns, host:gitea, host:haos, host:mule-images, host:nextcloud, host:nfs-export, host:paperless, host:sophia, host:teddycloud, host:trmnl, host:zimaos, service:artifacto, service:caddy, service:dns, service:gitea, service:haos, service:homelab_mcp, service:nextcloud, service:paperless, service:photos, service:proxmox_ui, service:secrets_issuance, service:teddycloud, service:trmnl, service:zimaos
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-jellyfin.md

@@ -0,0 +1,20 @@
+# jellyfin (host:jellyfin)
+
+- kind: lxc (LXC 101)
+- state: active
+- runs-on: host:strong
+- role: media-server
+- address: 192.168.8.246 (mesh: tailscale:jellyfin)
+- mounts: /mnt/media_local
+- doc: knowledge/wiki/containers/101-jellyfin.md
+
+## Blast radius
+- impacts: service:jellyfin
+- affected by: host:strong, mount:/mnt/media_local
+- full blast radius: service:jellyfin
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-mac-mini.md

@@ -0,0 +1,17 @@
+# mac-mini (host:mac-mini)
+
+- kind: workstation
+- state: active
+- role: dev
+- address: 192.168.178.182 (mesh: netbird:mac-mini-234-17.netbird.selfhosted)
+- secrets: enrolled (age key present)
+
+## Blast radius
+- impacts: (none)
+- affected by: (none)
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-mule-images.md

@@ -0,0 +1,20 @@
+# mule-images (host:mule-images)
+
+- kind: lxc (LXC 120)
+- state: active
+- runs-on: host:hubris
+- role: photo-management
+- address: 192.168.8.136 (mesh: tailscale:muleimage)
+- mounts: /mnt/library
+- doc: knowledge/wiki/containers/120-mule-images.md
+
+## Blast radius
+- impacts: service:photos
+- affected by: host:hubris, mount:/mnt/library, repo:dtoro/mule-image
+- full blast radius: service:photos
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-netbird-vps.md

@@ -0,0 +1,17 @@
+# netbird-vps (host:netbird-vps)
+
+- kind: external
+- state: active
+- role: netbird-mgmt
+- address:  (mesh: netbird:netbird-ionos.netbird.selfhosted)
+
+## Blast radius
+- impacts: service:authentik
+- affected by: (none)
+- full blast radius: service:authentik
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-nextcloud.md

@@ -0,0 +1,20 @@
+# nextcloud (host:nextcloud)
+
+- kind: lxc (LXC 114)
+- state: active
+- runs-on: host:hubris
+- role: file-sync
+- address: 192.168.8.224 (mesh: tailscale:nextcloud)
+- mounts: /mnt/library
+- doc: knowledge/wiki/containers/114-nextcloud.md
+
+## Blast radius
+- impacts: service:nextcloud
+- affected by: host:hubris, mount:/mnt/library
+- full blast radius: service:nextcloud
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-nfs-export.md

@@ -0,0 +1,18 @@
+# nfs-export (host:nfs-export)
+
+- kind: lxc (LXC 102)
+- state: active
+- runs-on: host:hubris
+- role: storage-export
+- address: 192.168.8.200
+- doc: knowledge/wiki/containers/102-nfs-export.md
+
+## Blast radius
+- impacts: (none)
+- affected by: host:hubris
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-paperless.md

@@ -0,0 +1,20 @@
+# paperless (host:paperless)
+
+- kind: lxc (LXC 103)
+- state: active
+- runs-on: host:hubris
+- role: document-archive
+- address: 192.168.8.130 (mesh: tailscale:paperless)
+- mounts: /mnt/library
+- doc: knowledge/wiki/containers/103-paperless.md
+
+## Blast radius
+- impacts: service:paperless
+- affected by: host:hubris, mount:/mnt/library
+- full blast radius: service:paperless
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-rclone.md

@@ -0,0 +1,17 @@
+# rclone (host:rclone)
+
+- kind: lxc
+- state: active
+- role: backup
+- address:  (mesh: netbird:rclone.netbird.selfhosted)
+- secrets: enrolled (age key present)
+
+## Blast radius
+- impacts: (none)
+- affected by: (none)
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-republic-laptop.md

@@ -0,0 +1,16 @@
+# republic-laptop (host:republic-laptop)
+
+- kind: workstation
+- state: active
+- role: primary-dev
+- address:  (mesh: netbird:republic-laptop.netbird.selfhosted)
+
+## Blast radius
+- impacts: (none)
+- affected by: (none)
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-romm.md

@@ -0,0 +1,19 @@
+# romm (host:romm)
+
+- kind: lxc (LXC 134)
+- state: active
+- runs-on: host:strong
+- role: rom-manager
+- address: 192.168.8.249
+- mounts: /mnt/media_local
+- doc: knowledge/wiki/containers/134-romm.md
+
+## Blast radius
+- impacts: (none)
+- affected by: host:strong, mount:/mnt/media_local
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-seanime.md

@@ -0,0 +1,19 @@
+# seanime (host:seanime)
+
+- kind: lxc (LXC 133)
+- state: active
+- runs-on: host:strong
+- role: anime-media-server
+- address: 192.168.8.248
+- mounts: /mnt/media_local/anime
+- doc: knowledge/wiki/containers/133-seanime.md
+
+## Blast radius
+- impacts: (none)
+- affected by: host:strong, mount:/mnt/media_local/anime
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-sophia.md

@@ -0,0 +1,19 @@
+# sophia (host:sophia)
+
+- kind: lxc (LXC 119)
+- state: active
+- runs-on: host:hubris
+- role: workshop
+- address: 192.168.8.109 (mesh: tailscale:sophia)
+- mounts: /mnt/library
+- doc: knowledge/wiki/containers/119-sophia.md
+
+## Blast radius
+- impacts: (none)
+- affected by: host:hubris, mount:/mnt/library
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-strong.md

@@ -0,0 +1,19 @@
+# strong (host:strong)
+
+- kind: proxmox-host
+- state: active
+- role: hypervisor
+- address: 192.168.178.181
+- doc: knowledge/wiki/hosts/strong.md
+- secrets: enrolled (age key present)
+
+## Blast radius
+- impacts: host:arriman, host:elementsynapse, host:grimmory, host:house, host:jellyfin, host:romm, host:seanime
+- affected by: (none)
+- full blast radius: host:arriman, host:elementsynapse, host:grimmory, host:house, host:jellyfin, host:romm, host:seanime, service:arr_stack, service:jellyfin, service:matrix
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-teddycloud.md

@@ -0,0 +1,20 @@
+# teddycloud (host:teddycloud)
+
+- kind: lxc (LXC 131)
+- state: active
+- runs-on: host:hubris
+- role: teddycloud
+- address: 192.168.8.150
+- mounts: /mnt/library
+- doc: knowledge/wiki/containers/131-teddycloud.md
+
+## Blast radius
+- impacts: service:teddycloud
+- affected by: host:hubris, mount:/mnt/library
+- full blast radius: service:teddycloud
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- 2026-07-06T11:05:35+00:00 activate (config_mutation) — ok

archive/oikos-cards/cards/host-trmnl.md

@@ -0,0 +1,19 @@
+# trmnl (host:trmnl)
+
+- kind: lxc (LXC 128)
+- state: active
+- runs-on: host:hubris
+- role: trmnl-middleware
+- address: 192.168.8.211
+- doc: knowledge/wiki/containers/128-trmnl.md
+
+## Blast radius
+- impacts: service:trmnl
+- affected by: host:hubris, repo:dtoro/terminalito
+- full blast radius: service:trmnl
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/host-zimaos.md

@@ -0,0 +1,19 @@
+# zimaos (host:zimaos)
+
+- kind: vm (VM 100)
+- state: active
+- runs-on: host:hubris
+- role: nas-frontend-eval
+- address: 192.168.8.195
+- doc: knowledge/wiki/vms/100-zimaos.md
+
+## Blast radius
+- impacts: service:zimaos
+- affected by: host:hubris
+- full blast radius: service:zimaos
+
+## Safe actions
+- see the services this host runs for action-level risk classes
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-arr_stack.md

@@ -0,0 +1,17 @@
+# arr_stack (service:arr_stack)
+
+- backend: host:arriman
+- doc: knowledge/wiki/containers/122-arriman.md
+
+## Blast radius
+- impacts: (none)
+- affected by: host:arriman
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — reversible_low (approval: none)
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-artifacto.md

@@ -0,0 +1,20 @@
+# artifacto (service:artifacto)
+
+- backend: host:apps
+- url: https://artifacto.hubris.network
+- doc: knowledge/wiki/containers/105-apps.md
+- config repo: dtoro/Artifacto
+
+## Blast radius
+- impacts: (none)
+- affected by: host:apps
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — reversible_low (approval: none)
+- edit-config-and-deploy — config_mutation (approval: operator)
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-authentik.md

@@ -0,0 +1,19 @@
+# authentik (service:authentik)
+
+- backend: host:netbird-vps
+- url: https://auth.hubris.network
+- doc: knowledge/wiki/containers/106-auth-outpost.md
+- risk notes: SSO provider — outage locks login to OIDC/forward-auth services
+
+## Blast radius
+- impacts: (none)
+- affected by: host:netbird-vps
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — reversible_low (approval: none)
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-caddy.md

@@ -0,0 +1,20 @@
+# caddy (service:caddy)
+
+- backend: host:caddy
+- doc: knowledge/wiki/containers/121-caddy.md
+- config repo: dtoro/caddy-conf
+- risk notes: wide blast radius — every *.hubris.network route rides on it (see oikos/policy.yaml service_overrides)
+
+## Blast radius
+- impacts: (none)
+- affected by: host:caddy
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — config_mutation (approval: operator)
+- edit-config-and-deploy — config_mutation (approval: operator)
+
+## Recent changes
+- 2026-07-06T11:29:56+00:00 add-site-block (config_mutation) — ok

archive/oikos-cards/cards/service-dns.md

@@ -0,0 +1,18 @@
+# dns (service:dns)
+
+- backend: host:dns
+- doc: knowledge/wiki/containers/107-dns.md
+- risk notes: LAN-wide resolver — misconfig breaks name resolution for every client
+
+## Blast radius
+- impacts: (none)
+- affected by: host:dns
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — config_mutation (approval: operator)
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-gitea.md

@@ -0,0 +1,21 @@
+# gitea (service:gitea)
+
+- backend: host:gitea
+- url: https://git.hubris.network
+- doc: knowledge/wiki/containers/104-gitea.md
+- config repo: dtoro/gitea-customizations
+- risk notes: hosts all config repos + deploy webhooks; outage blocks auto-deploy and sync
+
+## Blast radius
+- impacts: (none)
+- affected by: host:gitea
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — reversible_low (approval: none)
+- edit-config-and-deploy — config_mutation (approval: operator)
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-haos.md

@@ -0,0 +1,17 @@
+# haos (service:haos)
+
+- backend: host:haos
+- doc: knowledge/wiki/vms/108-haos.md
+
+## Blast radius
+- impacts: (none)
+- affected by: host:haos
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — reversible_low (approval: none)
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-homelab_mcp.md

@@ -0,0 +1,21 @@
+# homelab_mcp (service:homelab_mcp)
+
+- backend: host:apps
+- url: https://mcp.hubris.network/mcp
+- doc: knowledge/wiki/infrastructure/homelab-context.md
+- config repo: dtoro/Homelab-Docs
+- risk notes: agents' primary read surface — outage degrades every agent to grepping the clone
+
+## Blast radius
+- impacts: (none)
+- affected by: host:apps
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — reversible_low (approval: none)
+- edit-config-and-deploy — config_mutation (approval: operator)
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-jellyfin.md

@@ -0,0 +1,19 @@
+# jellyfin (service:jellyfin)
+
+- backend: host:jellyfin
+- url: https://media.hubris.network
+- doc: knowledge/wiki/containers/101-jellyfin.md
+- risk notes: native Authentik OIDC via SSO-Auth plugin, no Caddy forward-auth gate; VAAPI transcode depends on GPU passthrough on strong
+
+## Blast radius
+- impacts: (none)
+- affected by: host:jellyfin
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — reversible_low (approval: none)
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-matrix.md

@@ -0,0 +1,19 @@
+# matrix (service:matrix)
+
+- backend: host:elementsynapse
+- url: https://matrix.hubris.network
+- doc: knowledge/wiki/containers/118-elementsynapse.md
+- risk notes: alert/approval channel for Oikos — outage silences agent escalation
+
+## Blast radius
+- impacts: (none)
+- affected by: host:elementsynapse
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — reversible_low (approval: none)
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-nextcloud.md

@@ -0,0 +1,18 @@
+# nextcloud (service:nextcloud)
+
+- backend: host:nextcloud
+- url: https://cloud.hubris.network
+- doc: knowledge/wiki/containers/114-nextcloud.md
+
+## Blast radius
+- impacts: (none)
+- affected by: host:nextcloud
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — reversible_low (approval: none)
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-paperless.md

@@ -0,0 +1,19 @@
+# paperless (service:paperless)
+
+- backend: host:paperless
+- url: https://paperless.hubris.network
+- doc: knowledge/wiki/containers/103-paperless.md
+- risk notes: document archive — treat data as irreplaceable; DB operations are destructive-class
+
+## Blast radius
+- impacts: (none)
+- affected by: host:paperless
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — reversible_low (approval: none)
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-photos.md

@@ -0,0 +1,20 @@
+# photos (service:photos)
+
+- backend: host:mule-images
+- url: https://photos.hubris.network
+- doc: knowledge/wiki/containers/120-mule-images.md
+- config repo: dtoro/mule-image
+
+## Blast radius
+- impacts: (none)
+- affected by: host:mule-images
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — reversible_low (approval: none)
+- edit-config-and-deploy — config_mutation (approval: operator)
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-proxmox_ui.md

@@ -0,0 +1,19 @@
+# proxmox_ui (service:proxmox_ui)
+
+- backend: host:hubris
+- url: https://proxmox.hubris.network
+- doc: knowledge/wiki/hosts/hubris.md
+- risk notes: hypervisor UI — changes here affect every guest on the node
+
+## Blast radius
+- impacts: (none)
+- affected by: host:hubris
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — reversible_low (approval: none)
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-secrets_issuance.md

@@ -0,0 +1,21 @@
+# secrets_issuance (service:secrets_issuance)
+
+- backend: host:apps
+- url: https://secrets.hubris.network/issue
+- doc: .agents/operations/agent-enrollment.md
+- config repo: dtoro/Homelab-Docs
+- risk notes: identity issuance — any change is security-sensitive; key operations are destructive-class
+
+## Blast radius
+- impacts: (none)
+- affected by: host:apps
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — reversible_low (approval: none)
+- edit-config-and-deploy — config_mutation (approval: operator)
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-teddycloud.md

@@ -0,0 +1,19 @@
+# teddycloud (service:teddycloud)
+
+- backend: host:teddycloud
+- url: https://teddy.hubris.network
+- doc: knowledge/wiki/containers/131-teddycloud.md
+- risk notes: no Caddy forward-auth gate (unlike sab.hubris.network on the same Caddyfile) — reachable to anyone on the LAN/mesh who can resolve teddy.hubris.network; undocumented in inventory.yaml until 2026-07-06 (drift-caught)
+
+## Blast radius
+- impacts: (none)
+- affected by: host:teddycloud
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — reversible_low (approval: none)
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-trmnl.md

@@ -0,0 +1,20 @@
+# trmnl (service:trmnl)
+
+- backend: host:trmnl
+- url: https://trmnl.hubris.network
+- doc: knowledge/wiki/containers/128-trmnl.md
+- config repo: dtoro/terminalito
+
+## Blast radius
+- impacts: (none)
+- affected by: host:trmnl
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — reversible_low (approval: none)
+- edit-config-and-deploy — config_mutation (approval: operator)
+
+## Recent changes
+- (none yet)

archive/oikos-cards/cards/service-zimaos.md

@@ -0,0 +1,18 @@
+# zimaos (service:zimaos)
+
+- backend: host:zimaos
+- url: https://zimaos.hubris.network
+- doc: knowledge/wiki/vms/100-zimaos.md
+
+## Blast radius
+- impacts: (none)
+- affected by: host:zimaos
+
+## Safe actions
+- health-check — read_only (approval: none)
+- view-logs — read_only (approval: none)
+- view-docs — read_only (approval: none)
+- restart — reversible_low (approval: none)
+
+## Recent changes
+- (none yet)