0.29.0 — code-quality refactor (plan E1–E5): file splits, sqlc migration, SSH unification, test coverage

E1: split monolithic files — cmd/nomos (main.go → server.go + mcp.go + workers.go),
    internal/mcp/tools.go → entity_tools/ops_tools/knowledge_tools/analysis_tools,
    internal/httpapi/impl.go → domain files (entities, events, signals, ontology,
    fleet_health, client_context, client_lifecycle, entity_mutations, query_audit).
E2: migrate raw pool.Exec queries to sqlc (entities/relationships queries + generated).
E3: unify SSH — consolidate crypto/ssh dial into actuator/client.go (+client_test).
E4/E5: add tests — db/lifecycle, checkdefaults/build, ontology/preconditions, policy/risk.

internal/db/lifecycle.go

@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"strings"
 
 	"github.com/dtoro/oikos/internal/db/sqlcgen"
 	"github.com/google/uuid"
@@ -79,35 +78,35 @@ func checkPrecondition(ctx context.Context, tx pgx.Tx, entityID uuid.UUID, entit
 			return fmt.Errorf("%d inbound relationship edges remaining", count)
 		}
 	case "backups-verified", "secrets-revoked", "ingress-dns-removed":
-		var attrs string
-		if err := tx.QueryRow(ctx, "SELECT coalesce(attributes::text,'{}') FROM entities WHERE id = $1", entityID).Scan(&attrs); err != nil {
+		attrs, err := fetchAttrs(ctx, tx, entityID)
+		if err != nil {
 			return err
 		}
 		want := map[string]string{
-			"backups-verified":   "backups_verified",
-			"secrets-revoked":    "secrets_revoked",
+			"backups-verified":    "backups_verified",
+			"secrets-revoked":     "secrets_revoked",
 			"ingress-dns-removed": "ingress_dns_removed",
 		}[check]
-		if !strings.Contains(attrs, want) {
+		if !attrTruthy(attrs, want) {
 			return fmt.Errorf("%s not recorded in entity attributes", want)
 		}
 	case "age-key-enrolled-if-needed":
 		if entityType == "workstation" {
-			var attrs string
-			if err := tx.QueryRow(ctx, "SELECT coalesce(attributes::text,'{}') FROM entities WHERE id = $1", entityID).Scan(&attrs); err != nil {
+			attrs, err := fetchAttrs(ctx, tx, entityID)
+			if err != nil {
 				return err
 			}
-			if !strings.Contains(attrs, "age_pubkey") {
+			if !attrTruthy(attrs, "age_pubkey") {
 				return fmt.Errorf("age key not enrolled (no age_pubkey in attributes)")
 			}
 		}
 	case "mesh-joined-if-needed":
 		if entityType == "workstation" {
-			var attrs string
-			if err := tx.QueryRow(ctx, "SELECT coalesce(attributes::text,'{}') FROM entities WHERE id = $1", entityID).Scan(&attrs); err != nil {
+			attrs, err := fetchAttrs(ctx, tx, entityID)
+			if err != nil {
 				return err
 			}
-			if !strings.Contains(attrs, "mesh_ip") {
+			if !attrTruthy(attrs, "mesh_ip") {
 				return fmt.Errorf("mesh not joined (no mesh_ip in attributes)")
 			}
 		}
@@ -144,3 +143,40 @@ func checkPrecondition(ctx context.Context, tx pgx.Tx, entityID uuid.UUID, entit
 	}
 	return nil
 }
+
+// fetchAttrs loads an entity's JSONB attributes column as a decoded map.
+// Missing attributes decode to an empty map (every key absent).
+func fetchAttrs(ctx context.Context, tx pgx.Tx, entityID uuid.UUID) (map[string]any, error) {
+	var raw string
+	if err := tx.QueryRow(ctx, "SELECT coalesce(attributes::text,'{}') FROM entities WHERE id = $1", entityID).Scan(&raw); err != nil {
+		return nil, err
+	}
+	var attrs map[string]any
+	if err := json.Unmarshal([]byte(raw), &attrs); err != nil {
+		return nil, fmt.Errorf("decode entity attributes: %w", err)
+	}
+	if attrs == nil {
+		attrs = map[string]any{}
+	}
+	return attrs, nil
+}
+
+// attrTruthy reports whether key is present in attrs with a meaningful value.
+// It replaces substring matching on raw JSONB text: a previous strings.Contains
+// check treated {"backups_verified": false} as satisfied (the key text was
+// present) and bypassed the attributes GIN index. Booleans must be true;
+// strings must be non-empty; nil/absent fail.
+func attrTruthy(attrs map[string]any, key string) bool {
+	v, ok := attrs[key]
+	if !ok || v == nil {
+		return false
+	}
+	switch t := v.(type) {
+	case bool:
+		return t
+	case string:
+		return t != ""
+	default:
+		return true // numbers, objects, arrays count as present
+	}
+}