docs: fix plan/repo drift, retire dead Goose+Nomos and Caveman tooling

Documentation and repo-hygiene pass following the client/server split:

Plan drift (audited all other active plans against current code):
- oikos-gaps-and-improvements.md: mark Section C and D.5 resolved (both
  described cmd/hermes, renamed to cmd/nomos with a real LLM loop since);
  refresh ~10 stale file:line citations; fix tool-count (33, not 28).
- liveness-drift-and-ux-cohesion.md: fix stale default-model claim (now
  deepseek-v4-pro since 2026-07-10) and "not yet deployed" status.
- nomos-agent-code-review.md: fix C1's citation (one unauthenticated route
  to nomos now, not two, after the client/server split).
- wails-desktop-app.md: record the production deploy outcome.

Repo structure: added missing directories to README/CONTRIBUTING layout
tables (checks/, tools/, cmd/webhook/, docs/operations/), fixed a broken
link, added ADR 0015 documenting the auth/CORS/client-split model (there
wasn't one despite CONTRIBUTING's own process requiring it), normalized
ADR 0013/0014's format drift, added an Authentication section to
AGENTS.md/CLIENTS.md (every example call was missing the now-required
bearer header).

Retired the Goose+Nomos workstation flow (bootstrap.sh --with-nomos,
tools/setup-nomos-soul.sh, .agents/operations/nomos-agent.md) and the
Caveman auto-install tooling (tools/setup-caveman.sh, tools/caveman/) —
both superseded by the production containerized Nomos agent, which has
never used either. Kept .agents/shared/caveman.md itself (the terse
writing-style convention agents still follow by reading it).

Deleted the orphaned legacy Python oikos/ directory — nothing imports it,
and bin/homelab (the CLI it was kept for) no longer exists in the repo.

Rewrote .agents/operations/agent-enrollment.md (365 -> ~110 lines) and
commands.md to match the current architecture instead of the retired
`homelab` CLI; migrated the still-true networking prerequisites (Netbird,
split-horizon DNS, SSH key distribution) into the knowledge base as a
runbook via upsert_knowledge rather than duplicating them in markdown.
Updated all 10 .agents/skills/ runbooks referencing the dead CLI with
their real MCP tool / REST API equivalents, or flagged them as needing
verification where no equivalent is confirmed yet.

Two real bugs found and fixed, not just docs:
- The tools/setup-*.sh auto-setup glob was tools/*.setup.sh in THREE
  places (tools/post-pull.sh, bootstrap.sh, and internal/httpapi/impl.go's
  GetClientContext handler) since the mechanism's introduction on
  2026-06-02 — never matched any real filename, so no client has ever
  picked up an auto-setup script via git-pull or the context-poller sync.
  Fixed all three; the Go server-side fix is the one that actually matters
  since it's what the current context-poller mechanism depends on.
- bootstrap.sh removed dead vestigial --gitea-token/--gitea-user flags
  (parsed, never consumed) left over from an earlier clone-based model.

Also flagged, not fixed (documented as an open gap in
client-enrollment/SKILL.md): bootstrap.sh tells a freshly-enrolled client
to call POST /api/v1/clients/{slug}/activate to finish enrollment, but
that route doesn't exist in api/openapi.yaml — EnrollClient sets entities
to provisioning and nothing currently transitions them to active.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tools/caveman/caveman.js

@@ -1,23 +0,0 @@
-#!/usr/bin/env node
-// Caveman template renderer — reads template + data JSON files and renders output
-// Installed automatically via homelab-context post-pull hook
-const caveman = require("caveman");
-const fs = require("fs");
-const path = require("path");
-
-const args = process.argv.slice(2);
-if (args.length === 0) {
-  console.error("Usage: caveman <template> [data.json]");
-  process.exit(1);
-}
-
-const templatePath = args[0];
-let data = {};
-if (args.length > 1) {
-  data = JSON.parse(fs.readFileSync(args[1], "utf8"));
-}
-
-const template = fs.readFileSync(templatePath, "utf8");
-const templateName = path.basename(templatePath, path.extname(templatePath));
-caveman.register(templateName, template);
-console.log(caveman.render(templateName, data).trim());

tools/caveman/caveman_wrapper.sh

@@ -1,76 +0,0 @@
-#!/usr/bin/env bash
-# Caveman + RTK Wrapper - Automated token-efficient output formatting
-# Installed automatically via homelab-context post-pull hook
-# Source: https://github.com/adityahimaone/hermes-agent-rtk-caveman
-# Usage: caveman_wrapper.sh <workflow> [options]
-
-set -e
-
-WORKFLOW="$1"
-shift
-
-CAVEMAN=~/bin/caveman
-TEMPLATES_DIR=~/templates
-DATA_DIR=/tmp/caveman_data
-
-mkdir -p "$DATA_DIR"
-
-case "$WORKFLOW" in
-  git-status)
-    git status --porcelain | awk '
-    BEGIN { staged=0; modified=0; untracked=0; deleted=0 }
-    /^[MARC]./ { staged_arr[staged++] = substr($0, 4) }
-    /^.[MARC]/ { modified_arr[modified++] = substr($0, 4) }
-    /^\?\?/ { untracked_arr[untracked++] = substr($0, 4) }
-    /^D/ || /^.D/ { deleted_arr[deleted++] = substr($0, 4) }
-    END {
-      printf "{"
-      printf "\"staged\":["
-      for(i=0;i<staged;i++) printf "%s\"%s\"", (i>0?",":""), staged_arr[i]
-      printf "],\"modified\":["
-      for(i=0;i<modified;i++) printf "%s\"%s\"", (i>0?",":""), modified_arr[i]
-      printf "],\"untracked\":["
-      for(i=0;i<untracked;i++) printf "%s\"%s\"", (i>0?",":""), untracked_arr[i]
-      printf "],\"deleted\":["
-      for(i=0;i<deleted;i++) printf "%s\"%s\"", (i>0?",":""), deleted_arr[i]
-      printf "]}"
-    }' > "$DATA_DIR/git_status.json"
-
-    if command -v rtk &>/dev/null; then
-      rtk "$CAVEMAN" "$TEMPLATES_DIR/git_status.txt" "$DATA_DIR/git_status.json"
-    else
-      node "$CAVEMAN" "$TEMPLATES_DIR/git_status.txt" "$DATA_DIR/git_status.json"
-    fi
-    ;;
-
-  git-log)
-    LIMIT="${1:-10}"
-    git log --oneline -"$LIMIT" --format='{"hash":"%h","author":"%an","date":"%ad","message":"%s"}' --date=short | \
-      jq -s '.' > "$DATA_DIR/git_log.json"
-    jq '{commits: .}' "$DATA_DIR/git_log.json" > "$DATA_DIR/git_log_final.json"
-    if command -v rtk &>/dev/null; then
-      rtk "$CAVEMAN" "$TEMPLATES_DIR/git_log.txt" "$DATA_DIR/git_log_final.json"
-    else
-      node "$CAVEMAN" "$TEMPLATES_DIR/git_log.txt" "$DATA_DIR/git_log_final.json"
-    fi
-    ;;
-
-  test-results)
-    TEST_CMD="${1:-npx vitest run}"
-    $TEST_CMD --reporter json 2>/dev/null | \
-      jq '{total: .numTotalTests, passed: .numPassedTests, failed: .numFailedTests, suites: [.testResults[] | {name: .name, status: .status, duration: .duration}]}' > "$DATA_DIR/test_results.json" || true
-    if command -v rtk &>/dev/null; then
-      rtk "$CAVEMAN" "$TEMPLATES_DIR/test_results.txt" "$DATA_DIR/test_results.json"
-    else
-      node "$CAVEMAN" "$TEMPLATES_DIR/test_results.txt" "$DATA_DIR/test_results.json"
-    fi
-    ;;
-
-  *)
-    echo "Usage: caveman_wrapper.sh <workflow> [options]"
-    echo "  git-status            - Compact git status"
-    echo "  git-log [limit]       - Recent git commits"
-    echo "  test-results [cmd]    - Compact test results"
-    exit 1
-    ;;
-esac

tools/caveman/templates/git_log.txt

@@ -1,3 +0,0 @@
-Recent Commits:
-{{- for d.commits as commit }}  {{commit.hash}} {{commit.date}} {{commit.message}}
-{{- end }}

tools/caveman/templates/git_status.txt

@@ -1,12 +0,0 @@
-{{- if d.staged }}Staged:
-{{- for d.staged as file }}  + {{file}}
-{{- end }}{{- end }}
-{{- if d.modified }}Modified:
-{{- for d.modified as file }}  ~ {{file}}
-{{- end }}{{- end }}
-{{- if d.untracked }}Untracked:
-{{- for d.untracked as file }}  ? {{file}}
-{{- end }}{{- end }}
-{{- if d.deleted }}Deleted:
-{{- for d.deleted as file }}  - {{file}}
-{{- end }}{{- end }}

tools/caveman/templates/test_results.txt

@@ -1,4 +0,0 @@
-{{- if d.failed }}Tests: {{d.passed}}/{{d.total}} passed ({{d.failed}} failed)
-{{- for d.suites as suite }}{{- if suite.status == "failed" }}  {{suite.name}} ({{suite.duration}}ms)
-{{- end }}{{- end }}{{- else }}All {{d.total}} tests passed
-{{- end }}

tools/post-pull.sh

@@ -3,7 +3,7 @@
 # Replaces raw `git pull` in the launchd/systemd timer.
 # Runs after every git pull to auto-setup tools from the repo.
 #
-# Convention: any script at tools/*.setup.sh is sourced/exec'd after pull.
+# Convention: any script at tools/setup-*.sh is sourced/exec'd after pull.
 # This lets us ship new tooling to all agent hosts via a simple git push.
 
 set -euo pipefail
@@ -31,7 +31,7 @@ else
 fi
 
 # 2. Run any auto-setup scripts
-for setup_script in "$CONTEXT_DIR"/tools/*.setup.sh; do
+for setup_script in "$CONTEXT_DIR"/tools/setup-*.sh; do
   [ -f "$setup_script" ] || continue
   echo "[post-pull] running $setup_script..."
   bash "$setup_script" || echo "[post-pull] WARNING: $setup_script exited with code $?"

tools/setup-caveman.sh

@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-# setup-caveman.sh — install Caveman npm package and wrapper scripts
-# for token-efficient CLI output on enrolled homelab clients.
-set -euo pipefail
-
-CLONE_DIR="${HOMELAB_CONTEXT_DIR:-/opt/homelab}"
-BIN_DIR="$HOME/bin"
-TOOLS_DIR="$CLONE_DIR/tools"
-
-mkdir -p "$BIN_DIR"
-
-# Install the caveman npm package globally.
-if ! command -v caveman >/dev/null 2>&1; then
-    if command -v npm >/dev/null 2>&1; then
-        npm install -g caveman 2>/dev/null || true
-        echo "[setup-caveman] caveman npm package installed"
-    fi
-fi
-
-# Copy wrapper to ~/bin.
-if [ -f "$TOOLS_DIR/caveman_wrapper.sh" ]; then
-    cp "$TOOLS_DIR/caveman_wrapper.sh" "$BIN_DIR/caveman_wrapper.sh"
-    chmod +x "$BIN_DIR/caveman_wrapper.sh"
-    echo "[setup-caveman] wrapper installed to $BIN_DIR/caveman_wrapper.sh"
-fi
-
-# Copy templates.
-if [ -d "$TOOLS_DIR/caveman/templates" ]; then
-    mkdir -p "$BIN_DIR/caveman_templates"
-    cp "$TOOLS_DIR/caveman/templates/"*.txt "$BIN_DIR/caveman_templates/" 2>/dev/null || true
-    echo "[setup-caveman] templates installed"
-fi
-
-echo "[setup-caveman] done"

tools/setup-checks.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # setup-checks.sh — deploy check scripts to /opt/oikos/checks on each host.
-# Auto-setup hook: tools/*.setup.sh runs after every git pull.
+# Auto-setup hook: tools/setup-*.sh runs after every git pull.
 set -euo pipefail
 
 CLONE_DIR="${HOMELAB_CONTEXT_DIR:-/opt/homelab}"

tools/setup-nomos-soul.sh

@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-# setup-nomos-soul.sh — provision Nomos agent persona.
-# Copies ~/.nomos/SOUL.md from nomos/SOUL.md. No-op on non-Nomos agents.
-set -euo pipefail
-
-CLONE_DIR="${HOMELAB_CONTEXT_DIR:-/opt/homelab}"
-
-if [ -f "$CLONE_DIR/nomos/SOUL.md" ]; then
-    mkdir -p "$HOME/.nomos"
-    cp "$CLONE_DIR/nomos/SOUL.md" "$HOME/.nomos/SOUL.md"
-    echo "[setup-nomos-soul] SOUL.md provisioned"
-else
-    echo "[setup-nomos-soul] no nomos/SOUL.md found; skipping"
-fi