0.29.0 — code-quality refactor (plan E1–E5): file splits, sqlc migration, SSH unification, test coverage

E1: split monolithic files — cmd/nomos (main.go → server.go + mcp.go + workers.go),
    internal/mcp/tools.go → entity_tools/ops_tools/knowledge_tools/analysis_tools,
    internal/httpapi/impl.go → domain files (entities, events, signals, ontology,
    fleet_health, client_context, client_lifecycle, entity_mutations, query_audit).
E2: migrate raw pool.Exec queries to sqlc (entities/relationships queries + generated).
E3: unify SSH — consolidate crypto/ssh dial into actuator/client.go (+client_test).
E4/E5: add tests — db/lifecycle, checkdefaults/build, ontology/preconditions, policy/risk.

internal/mcp/server.go

@@ -26,7 +26,6 @@ import (
 	"github.com/dtoro/oikos/internal/observability"
 	"github.com/dtoro/oikos/internal/policy"
 	"github.com/dtoro/oikos/internal/remote"
-	"github.com/dtoro/oikos/internal/secrets"
 	"github.com/google/jsonschema-go/jsonschema"
 	"github.com/google/uuid"
 	"github.com/modelcontextprotocol/go-sdk/mcp"
@@ -49,9 +48,18 @@ func objSchema(props ...prop) *jsonschema.Schema {
 	return s
 }
 
+// secretBackend is the interface MCP tools use to access the secrets store.
+// Defined here to avoid importing the full secrets package (which brings in
+// the Infisical SDK). Mirrors the subset of secrets.Backend used by tools.
+type secretBackend interface {
+	Get(ctx context.Context, key string) (string, error)
+	Set(ctx context.Context, key string, value string) error
+	List(ctx context.Context) ([]string, error)
+}
+
 // NewHandler creates an http.Handler that serves the Oikos MCP server.
 // agentID is the Nomos agent entity UUID; tool calls are logged to agent_activity.
-func NewHandler(pool *db.Pool, token string, agentID uuid.UUID, sec secrets.Backend) http.Handler {
+func NewHandler(pool *db.Pool, token string, agentID uuid.UUID, sec secretBackend) http.Handler {
 	s := newServer(pool, agentID, sec)
 	handler := mcp.NewStreamableHTTPHandler(func(r *http.Request) *mcp.Server {
 		if token != "" {
@@ -67,7 +75,7 @@ func NewHandler(pool *db.Pool, token string, agentID uuid.UUID, sec secrets.Back
 // toolHandler is the function signature registered via AddTool.
 type toolHandler = mcp.ToolHandler
 
-func newServer(pool *db.Pool, agentID uuid.UUID, sec secrets.Backend) *mcp.Server {
+func newServer(pool *db.Pool, agentID uuid.UUID, sec secretBackend) *mcp.Server {
 	s := mcp.NewServer(&mcp.Implementation{Name: "oikos", Version: "dev"}, &mcp.ServerOptions{
 		Logger: slog.Default(),
 	})
@@ -483,22 +491,14 @@ func sshExecStream(ctx context.Context, host, user, command string, sink execlog
 		user = sshUser
 	}
 
-	addr := host + ":22"
-	signer, err := ssh.ParsePrivateKey(sshKey)
+	signer, err := actuator.LoadSignerFromBytes(sshKey)
 	if err != nil {
 		return "", fmt.Errorf("parse key: %w", err)
 	}
 
-	cfg := &ssh.ClientConfig{
-		User:            user,
-		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
-		HostKeyCallback: actuator.HostKeyCallback(),
-		Timeout:         10 * time.Second,
-	}
-
-	client, err := ssh.Dial("tcp", addr, cfg)
+	client, err := actuator.Dial(ctx, actuator.DialOptions{Host: host, User: user, Signer: signer})
 	if err != nil {
-		return "", fmt.Errorf("dial %s: %w", host, err)
+		return "", err
 	}
 	defer client.Close()