phase 1: Go foundation — module, migrations, domain, seed ingest

Core deliverables:
- Go module github.com/dtoro/oikos (Go 1.26.3)
- cmd/oikos: single binary with role subcommands (migrate, seed, export)
- 6 SQL migrations: ontology meta-schema, entity instances (UUID+slug,
  blast_radius recursive function), operations (signals/checks/approvals),
  cognition (classifications/executions/feedback/patterns/skills), policy,
  observability (TimescaleDB hypertables + CAGGs + retention)
- Domain layer: entity, signal, execution, classification, pattern, skill,
  approval, check types + 11 sentinel errors + lifecycle state machines
- DB layer: pgx pool, SQL splitter (handles 94436 and -- comments), migration
  runner, seed ingest (ontology+inventory+policy) with content-hash dedup
- Config: env-based with defaults, secrets redaction
- Observability: slog JSON logger with debug mode
- Infrastructure: Makefile, docker-compose.yml, multi-stage Dockerfile
  (distroless, CGO_ENABLED=0)

Verified end-to-end against timescale/timescaledb:2.17.2-pg16:
- 6 migrations applied (65 SQL statements)
- Seeds ingested: 6 lifecycles, 59 entity types, 46 relationship types,
  111 entities, 144 relationships, 4 risk classes, 27 approval rules,
  9 autonomy settings
- Idempotent: second seed run is a no-op (content hash matches)

Bugs fixed during implementation:
- TimescaleDB CAGGs can't run in a transaction -> splitSQL() executes
  statements individually
- Semicolons in -- comments treated as separators -> comment handling
- YAML keys source/target didn't match code's source_type/target_type
- yaml.Marshal produced YAML for JSONB columns -> json.Marshal

internal/config/config.go

@@ -0,0 +1,81 @@
+package config
+
+import (
+	"fmt"
+	"os"
+	"strings"
+)
+
+// Config holds all runtime configuration for an Oikos role.
+// Hierarchy: compiled defaults → config file → env vars → Infisical (secrets only).
+type Config struct {
+	// Database
+	DatabaseURL string // postgres://user:pass@host:5432/oikos?sslmode=disable
+
+	// API
+	APIListen string // :8090
+	APIEnv    string // dev, prod
+
+	// MCP
+	MCPBearerToken string // shared secret for Hermes→API MCP calls
+
+	// Observability
+	Debug bool // verbose logging, probe payloads, SQL
+
+	// Seeds directory (for ingest/export)
+	SeedsDir string
+
+	// Migrations directory (embedded at build time, but path for fallback)
+	MigrationsDir string
+}
+
+// Default returns a Config with compiled defaults.
+func Default() Config {
+	return Config{
+		DatabaseURL:   "postgres://oikos:oikos@localhost:5432/oikos?sslmode=disable",
+		APIListen:     ":8090",
+		APIEnv:        "dev",
+		SeedsDir:      "seeds",
+		MigrationsDir: "migrations",
+	}
+}
+
+// FromEnv loads config from environment variables, overlaying defaults.
+func FromEnv() Config {
+	c := Default()
+
+	if v := os.Getenv("OIKOS_DATABASE_URL"); v != "" {
+		c.DatabaseURL = v
+	}
+	if v := os.Getenv("OIKOS_API_LISTEN"); v != "" {
+		c.APIListen = v
+	}
+	if v := os.Getenv("OIKOS_ENV"); v != "" {
+		c.APIEnv = v
+	}
+	if v := os.Getenv("OIKOS_MCP_BEARER_TOKEN"); v != "" {
+		c.MCPBearerToken = v
+	}
+	if v := os.Getenv("OIKOS_SEEDS_DIR"); v != "" {
+		c.SeedsDir = v
+	}
+	c.Debug = os.Getenv("OIKOS_DEBUG") == "true" || os.Getenv("OIKOS_DEBUG") == "1"
+
+	return c
+}
+
+// String returns a human-safe representation (secrets redacted).
+func (c Config) String() string {
+	dbURL := c.DatabaseURL
+	if i := strings.Index(dbURL, "@"); i >= 0 {
+		if j := strings.Index(dbURL, "://"); j >= 0 && j < i {
+			dbURL = dbURL[:j+3] + "***" + dbURL[i:]
+		}
+	}
+	token := ""
+	if c.MCPBearerToken != "" {
+		token = "***"
+	}
+	return fmt.Sprintf("Config{DB=%s Listen=%s Env=%s Debug=%v MCPToken=%s SeedsDir=%s}",
+		dbURL, c.APIListen, c.APIEnv, c.Debug, token, c.SeedsDir)
+}