0.29.0 — code-quality refactor (plan E1–E5): file splits, sqlc migration, SSH unification, test coverage

E1: split monolithic files — cmd/nomos (main.go → server.go + mcp.go + workers.go),
    internal/mcp/tools.go → entity_tools/ops_tools/knowledge_tools/analysis_tools,
    internal/httpapi/impl.go → domain files (entities, events, signals, ontology,
    fleet_health, client_context, client_lifecycle, entity_mutations, query_audit).
E2: migrate raw pool.Exec queries to sqlc (entities/relationships queries + generated).
E3: unify SSH — consolidate crypto/ssh dial into actuator/client.go (+client_test).
E4/E5: add tests — db/lifecycle, checkdefaults/build, ontology/preconditions, policy/risk.

internal/ontology/preconditions_test.go

@@ -0,0 +1,102 @@
+package ontology
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/dtoro/oikos/internal/domain"
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// The lifecycle precondition checks split into a pure attribute/type guard
+// and a DB query. These cover the pure guards at 0%: the entity-type skip
+// rules and the attribute presence/absence semantics. The DB-backed checks
+// (health, edges, backups, docs) are exercised by make test-db.
+//
+// ctx/pool/entityID are unused by the pure guards, so nil is safe here.
+var (
+	noCtx  = context.Background()
+	noPool *pgxpool.Pool // nil: the pure guards never touch the pool
+	noID   = uuid.New()
+)
+
+func TestCheckAgeKeyEnrolled(t *testing.T) {
+	cases := []struct {
+		name      string
+		entityType string
+		attrs     map[string]any
+		wantErr   bool
+	}{
+		{"workstation with age key", "workstation", map[string]any{"age_pubkey": "age1abc"}, false},
+		{"workstation missing age key", "workstation", map[string]any{}, true},
+		{"server needs a key too", "server", map[string]any{}, true},
+		{"lxc is exempt", "lxc", map[string]any{}, false},
+		{"vm is exempt", "vm", map[string]any{}, false},
+		{"docker-container is exempt", "docker-container", map[string]any{}, false},
+		{"nil attrs on a workstation", "workstation", nil, true},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			err := checkAgeKeyEnrolled(noCtx, noPool, noID, c.entityType, c.attrs)
+			if c.wantErr && !errors.Is(err, domain.ErrInvalidTransition) {
+				t.Errorf("want ErrInvalidTransition, got %v", err)
+			}
+			if !c.wantErr && err != nil {
+				t.Errorf("want nil, got %v", err)
+			}
+		})
+	}
+}
+
+func TestCheckMeshJoined(t *testing.T) {
+	cases := []struct {
+		name       string
+		entityType string
+		attrs      map[string]any
+		wantErr    bool
+	}{
+		{"workstation with mesh_ip", "workstation", map[string]any{"mesh_ip": "10.0.0.5"}, false},
+		{"workstation missing mesh_ip", "workstation", map[string]any{}, true},
+		{"server missing mesh_ip", "server", map[string]any{}, true},
+		{"lxc is exempt", "lxc", map[string]any{}, false},
+		{"vm is exempt", "vm", map[string]any{}, false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			err := checkMeshJoined(noCtx, noPool, noID, c.entityType, c.attrs)
+			if c.wantErr && !errors.Is(err, domain.ErrInvalidTransition) {
+				t.Errorf("want ErrInvalidTransition, got %v", err)
+			}
+			if !c.wantErr && err != nil {
+				t.Errorf("want nil, got %v", err)
+			}
+		})
+	}
+}
+
+func TestCheckSecretsRevoked(t *testing.T) {
+	// checkSecretsRevoked treats an ABSENT age_pubkey as "secrets revoked"
+	// (the inverse of checkAgeKeyEnrolled). It is type-agnostic.
+	cases := []struct {
+		name    string
+		attrs   map[string]any
+		wantErr bool
+	}{
+		{"age key gone → revoked", map[string]any{}, false},
+		{"age key still present → blocked", map[string]any{"age_pubkey": "age1abc"}, true},
+		{"nil attrs → revoked", nil, false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			err := checkSecretsRevoked(noCtx, noPool, noID, "workstation", c.attrs)
+			if c.wantErr && !errors.Is(err, domain.ErrInvalidTransition) {
+				t.Errorf("want ErrInvalidTransition, got %v", err)
+			}
+			if !c.wantErr && err != nil {
+				t.Errorf("want nil, got %v", err)
+			}
+		})
+	}
+}