chore: Phase 9 completion - depguard audit, docs, minor bump

Final phase of the hexagonal architecture refactor (plans/2026-08-15-hexagonal-architecture.md). Verifies depguard rules, updates CONTRIBUTING.md to reflect final architecture, marks plan as complete, and bumps minor version to 0.34.0.

CONTRIBUTING.md

@@ -51,24 +51,27 @@ cmd/webhook/        Gitea deploy-webhook receiver (push-to-deploy on mac-mini)
 internal/           All Go packages
   core/             Hexagon core ([ADR 0016](docs/adr/0016-hexagonal-ports-adapters.md)):
                     domain/ (pure model, stdlib only), ports/ (driven-port
-                    interfaces), app/ (use-case services) — populated by the
-                    phased refactor (plans/2026-08-15-hexagonal-architecture.md);
-                    core may not import adapters, enforced by depguard
-  adapters/         Ports' implementations (postgres, ssh, probes, remote,
-                    secrets, events) + driving adapters (httpapi, mcpserver,
-                    scheduler, execworker, cli) — scaffolded; packages move
-                    here phase by phase
-  httpapi/          REST + MCP server (OpenAPI-generated)
-  mcp/              MCP tool implementations
-  db/               (moved) → internal/adapters/postgres: pool, migrations,
-                     seeds, sqlc queries — package still named `db` until
-                     the Phase 3 repository split
-  scheduler/        Observe loop, probes, signals
-  actuator/         SSH execution
-  learning/         Pattern recognition, anomaly detection
-  policy/           Risk classifier
-  secrets/          Infisical + SOPS backend
-  ontology/         Type hierarchy, relationship validation
+                    interfaces), app/ (use-case services — EntityService,
+                    RelationshipService, SignalService, ObservationService,
+                    KnowledgeService, LearningService, etc.) — populated by
+                    the phased refactor; core may not import adapters,
+                    enforced by depguard (verified Phase 9 audit)
+  adapters/         Ports' implementations: postgres/ (pool, migrations, seeds,
+                    sqlcgen, repos — EntityRepo, RelRepo, OntologyRepo,
+                    EntityReader, SignalRepo, MetricsRepo, etc.),
+                    ssh/ (CommandExecutor via actuator),
+                    remote/ (TargetResolver via internal/remote),
+                    probes/ (Checker implementations per probe kind:
+                    HTTP, TCP, ping, DNS, SSH)
+  httpapi/          REST server (OpenAPI-generated) — driving adapter
+  mcp/              MCP tool implementations — driving adapter
+  scheduler/        Observe loop, coverage sweep — driving adapter (moves
+                    to ObservationService/SignalService in Phase 5)
+  execworker/       Execution worker — driving adapter
+  actuator/         SSH execution — consumed by adapters/ssh
+  remote/           Target resolution — consumed by adapters/remote
+  audit/            Audit report helpers
+  observability/    Event/Audit recorder helpers
   knowledge/        Knowledge YAML seed ingestion
 api/openapi.yaml    API contract — the source of truth for endpoints
 migrations/         Forward-only SQL migrations (TimescaleDB)

VERSION

@@ -1 +1 @@
-0.33.6
+0.34.0

plans/2026-08-15-hexagonal-architecture.md

@@ -1,7 +1,7 @@
 # Hexagonal architecture for Oikos — design and phased refactor plan
 
 **Date:** 2026-08-15
-**Status:** In progress — Phases 0–2 shipped; Phases 3–9 pending
+**Status:** Complete — Phases 0–9 shipped; all commits pushed to `main`
 **Scope:** All Go code (`cmd/oikos`, `cmd/nomos`, `cmd/webhook`) and the UI
 split. One hexagon covers the oikos backend; nomos is an external agent
 client that gets an internal cleanup (Phase 8) but stays outside the core.

plans/index.md

@@ -22,7 +22,7 @@ went sideways, open an investigation.
 | 2026-08-04 | [Hermes MCP client integration](done/2026-08-04-hermes-mcp-client-integration.md) | Done — deployed |
 | 2026-08-05 | [Agent execution safety: QEMU guest agent gate + host-mutation guard](done/2026-08-05-agent-execution-safety-qemu-guest-agent-gate.md) | Done — implemented (1b9c761) |
 | 2026-08-05 | [Backend evaluation: architecture, security, and reliability improvements](2026-08-05-backend-evaluation-improvements.md) | Done — all three phases (B, D, E) implemented as code (0.28.0–0.29.0), deployed, and hardened via review. Remaining: C (security) and F (performance) backlog. |
-| 2026-08-15 | [Hexagonal architecture — design and phased refactor](2026-08-15-hexagonal-architecture.md) | In Progress — Phases 0–2 done (ADR 0016, client extracted to dtoro/oikos-web, ports + adapters scaffold); Phase 3 next |
+| 2026-08-15 | [Hexagonal architecture — design and phased refactor](2026-08-15-hexagonal-architecture.md) | Complete — all 10 phases shipped |
 
 ## Done