feat(tasks): make research-first / knowledge-write-back-last explicit steps

Closes the gap that made the knowledge loop optional/implicit: every
non-trivial task now has an EXPLICIT first plan step (research) and last
plan step (write back), not just background behavior the model might skip.

New MCP tools (the agent had no way to do these before — only REST endpoints
existed, unexposed to it):
- update_entity_attributes(slug, attributes): shallow-merge new/changed facts
  into an entity (an IP, a version, a discovered port) so a future task
  doesn't have to rediscover them from scratch. No approval required — this
  updates the knowledge graph, not live infra.
- create_relationship(source, target, type): record a discovered edge
  (depends-on, hosts, provides, ...). Idempotent, FK-validated against the
  ontology's relationship_types, no approval required.

SOUL.md: restructured the task loop so step 1 is explicitly "gather
knowledge, not just status" (get_entity_knowledge, search_knowledge,
get_relations, get_blast_radius, http_get) and the last step before
complete_task is explicitly "write back" (update_entity_attributes,
create_relationship, upsert_knowledge) — both called out as real plan
entries the operator should see in propose_plan, not silent side-work. This
is what prevents the graph drifting from reality and is the concrete
mechanism behind "tasks compound."

propose_plan's tool description reinforces the same first-step/last-step
convention at the call site.

Verified against the live stack: both tools registered and callable via MCP;
update_entity_attributes merged an attribute correctly; create_relationship
rejected an invalid type (FK violation, clear error) and succeeded with a
valid type+direction, confirmed idempotent (2 calls, 1 row).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/mcp/server.go

@@ -208,6 +208,69 @@ func newServer(pool *db.Pool, agentID uuid.UUID) *mcp.Server {
 		return upsertKnowledge(ctx, pool, args)
 	})
 
+	register(&mcp.Tool{Name: "update_entity_attributes", Description: "Merge new/changed attributes into an entity — the OTHER half of avoiding knowledge-base drift (upsert_knowledge records what you learned; this keeps the entity's own facts current). Use it when you discover something concrete about an entity's actual state that the graph doesn't reflect yet: a new IP, a version number, a config value, a discovered port — anything a FUTURE task would otherwise have to rediscover from scratch. Does NOT require approval (this updates the knowledge graph, not the live infrastructure). Merges shallowly — existing keys not mentioned are kept; keys you pass overwrite.",
+		InputSchema: objSchema(
+			prop{"slug", "string", "Entity slug to update (e.g. lxc:typetype, host:strong)."},
+			prop{"attributes", "string", "JSON object string of attributes to merge in, e.g. {\"lan_ip\":\"192.168.8.50\",\"os\":\"debian-12\"}."},
+		),
+	}, func(ctx context.Context, req *mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+		args := argsMap(req)
+		slug, _ := args["slug"].(string)
+		attrsStr, _ := args["attributes"].(string)
+		if slug == "" || attrsStr == "" {
+			return textResult("error: slug and attributes are required"), nil
+		}
+		var attrs map[string]any
+		if err := json.Unmarshal([]byte(attrsStr), &attrs); err != nil {
+			return textResult(fmt.Sprintf("error: attributes is not valid JSON: %v", err)), nil
+		}
+		attrsJSON, _ := json.Marshal(attrs)
+		ct, err := pool.Exec(ctx, `
+			UPDATE entities SET attributes = attributes || $2::jsonb, updated_at = now()
+			WHERE slug = $1`, slug, string(attrsJSON))
+		if err != nil {
+			return textResult(fmt.Sprintf("error updating %s: %v", slug, err)), nil
+		}
+		if ct.RowsAffected() == 0 {
+			return textResult(fmt.Sprintf("error: entity %q not found", slug)), nil
+		}
+		return textResult(fmt.Sprintf("Updated %s with %d attribute(s).", slug, len(attrs))), nil
+	})
+
+	register(&mcp.Tool{Name: "create_relationship", Description: "Record a relationship you discovered between two entities — the graph-structure half of keeping the knowledge base current (alongside update_entity_attributes and upsert_knowledge). Use it when you learn that one entity depends on, hosts, routes to, etc. another, and that edge isn't in the graph yet. type must be an existing relationship type (see get_relations output on similar entities for examples: hosts, provides, depends-on, configured-by, about, documents, ...). Idempotent — re-calling the same source/target/type is a no-op. Does NOT require approval.",
+		InputSchema: objSchema(
+			prop{"source", "string", "Source entity slug."},
+			prop{"target", "string", "Target entity slug."},
+			prop{"type", "string", "Relationship type name (must already exist in the ontology)."},
+		),
+	}, func(ctx context.Context, req *mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+		args := argsMap(req)
+		source, _ := args["source"].(string)
+		target, _ := args["target"].(string)
+		relType, _ := args["type"].(string)
+		if source == "" || target == "" || relType == "" {
+			return textResult("error: source, target, and type are required"), nil
+		}
+		var sourceID, targetID uuid.UUID
+		if err := pool.QueryRow(ctx, "SELECT id FROM entities WHERE slug = $1", source).Scan(&sourceID); err != nil {
+			return textResult(fmt.Sprintf("error: source entity %q not found", source)), nil
+		}
+		if err := pool.QueryRow(ctx, "SELECT id FROM entities WHERE slug = $1", target).Scan(&targetID); err != nil {
+			return textResult(fmt.Sprintf("error: target entity %q not found", target)), nil
+		}
+		_, err := pool.Exec(ctx, `
+			INSERT INTO relationships (source_id, target_id, type, attributes, valid_from)
+			SELECT $1, $2, $3, '{"by":"nomos"}'::jsonb, now()
+			WHERE NOT EXISTS (
+				SELECT 1 FROM relationships
+				WHERE source_id = $1 AND target_id = $2 AND type = $3 AND valid_to IS NULL)`,
+			sourceID, targetID, relType)
+		if err != nil {
+			return textResult(fmt.Sprintf("error creating relationship: %v (is %q a valid relationship type?)", err, relType)), nil
+		}
+		return textResult(fmt.Sprintf("Recorded: %s —%s→ %s", source, relType, target)), nil
+	})
+
 	register(&mcp.Tool{Name: "query_metrics", Description: "Query time-series metrics",
 		InputSchema: objSchema(prop{"hours", "integer", "Look-back window in hours (default 24)"}),
 	}, func(ctx context.Context, req *mcp.CallToolRequest) (*mcp.CallToolResult, error) {