Trigger desktop CI on every push to main, not just tags

12 of 33 MCP tools now render as rich inline cards instead of raw JSON:
EntityCard, HealthSummary, LXCList, EntityTable, KnowledgeResults,
BlastRadius, ChangeLog, FleetSnapshot, MetricChart.

Architecture:
- Server: annotateJSONResult() wraps queryRows with __renderer hints
- Registry: match/dispatch system maps tool names to Svelte components
- Chat: inline dispatch with 5-card limit, overflow to collapsed group
- ToolCallGroup: unmatched prop, hides when all matched, ARIA labels

Tests: 3 new Go tests for annotateJSONResult (wrap, no-op, multi-row).

.agents/HERMES.md

@@ -1,96 +0,0 @@
-# HERMES.md — Agent persona for homelab clients
-
-This file is the canonical agent persona for **all** AI agents running on
-machines in the **hubris** homelab. It prescribes behaviour, token-efficiency
-conventions, and the source-of-truth hierarchy.
-
-## Source of truth
-
-The homelab-context repo at `/opt/homelab-context/` is the single source of
-truth for:
-- Fleet topology (`inventory.yaml`, `inventory.yaml`)
-- Service endpoints and credentials (via `homelab secret`)
-- Agent behaviour and conventions
-- Everything in this file
-
-When in doubt, check `/opt/homelab-context/` first.
-
-## Runbooks — load, don't rediscover
-
-For the canonical workflows (service health check, config change +
-deploy, client enrollment, incident investigation, and each node
-lifecycle transition), read the matching `.agents/skills/<name>/SKILL.md` before
-acting. Each skill carries its risk class, required inputs, the
-verification command, and a docs-update checklist in its frontmatter —
-classify against `seeds/policy.yaml` using that risk class before any
-mutation. Don't re-derive topology or the mutation path by grepping the
-wiki when a runbook already encodes it. See [OIKOS.md](OIKOS.md) for the
-operating model these runbooks execute inside (OODA loop, risk classes,
-approval flow, ontology).
-
-## Agent type — how this file gets loaded
-
-| Agent | Loading mechanism |
-|-------|------------------|
-| **Hermes** | `tools/setup-hermes-soul.sh` (auto-setup) → provisions `~/.hermes/SOUL.md` from this file |
-| **Goose** | `.goosehints` symlink at `~/.config/goose/.goosehints` → `/opt/homelab-context/HERMES.md` |
-| **Claude Code / Codex** | Symlink or copy this file into the project's `CLAUDES.md` / `.claude` instructions |
-
-**Do not edit SOUL.md or .goosehints directly.** Edit this file in the
-homelab-context repo instead. Changes propagate to all clients on the next
-sync (`sudo homelab sync`).
-
----
-
-## Token efficiency (caveman skill)
-
-All homelab agents use the **Caveman + RTK** token optimization approach from
-https://github.com/adityahimaone/hermes-agent-rtk-caveman.
-
-### Before running any CLI command, ask:
-
-1. **Is there a caveman wrapper equivalent?** Use the wrapper for token-efficient
-   output. Available wrappers (installed at `~/bin/caveman_wrapper.sh`):
-   - `~/bin/caveman_wrapper.sh git-status` — compact git status
-   - `~/bin/caveman_wrapper.sh git-log [n]` — compact git log
-   - `~/bin/caveman_wrapper.sh lint [target]` — compact lint results
-   - `~/bin/caveman_wrapper.sh test-results [cmd]` — compact test results
-
-2. **If no caveman wrapper exists, pipe through `rtk`** to compress output:
-   ```
-   rtk <command>
-   ```
-   RTK (Rust Token Killer) strips redundant whitespace, trims long paths, and
-   deduplicates repeated lines. This reduces token usage by 60-90% on CLI
-   operations.
-
-3. **For homelab operations**, prefer the `homelab` CLI or MCP tools over
-   raw SSH/shell — they're already token-optimized.
-
-### Templates
-
-Caveman templates live at `~/templates/`:
-- `git_status.txt` — compact git status format
-- `git_log.txt` — compact git log format
-- `lint_results.txt` — compact ESLint format
-- `test_results.txt` — compact vitest/jest format
-
-### When to skip caveman/rtk
-
-- Interactive commands (editors, prompts) — let human-readable output pass
-- Commands with no output — skip entirely
-- When you need the exact raw output for post-processing
-
-### Verification
-
-```bash
-ls ~/bin/caveman_wrapper.sh && echo "caveman ready"
-```
-
-## Important note for Hermes agents
-
-If you are reading this as a Hermes agent, your SOUL.md was auto-provisioned
-by `tools/setup-hermes-soul.sh`. This file is the canonical original — you
-can verify the content matches or re-provision by running:
-
-    bash /opt/homelab-context/tools/setup-hermes-soul.sh

.agents/NOMOS.md

@@ -0,0 +1,44 @@
+# NOMOS.md — Agent persona for homelab clients
+
+This file is the canonical agent persona for AI agents running on machines
+in the **hubris** homelab (Claude Code, Codex, or similar). It prescribes
+behaviour, token-efficiency conventions, and the source-of-truth hierarchy.
+
+The *production* Nomos agent (`cmd/nomos`, the containerized MCP client
+gateway everyone actually talks to) uses a separate, code-adjacent persona —
+`nomos/SOUL.md`, baked into its Docker image at build time
+(`compose/nomos/Dockerfile`). This file is unrelated to that one; it's for
+AI coding agents working *on* a homelab client machine, not the Nomos
+service itself.
+
+## Source of truth
+
+The homelab-context repo at `/opt/homelab-context/` is the single source of
+truth for:
+- Fleet topology (`inventory.yaml`)
+- Agent behaviour and conventions
+- Everything in this file
+
+When in doubt, check `/opt/homelab-context/` first, or query the Oikos API/MCP
+server directly (see [AGENTS.md](../AGENTS.md) §3-4) — the database is
+authoritative at runtime.
+
+## Runbooks — load, don't rediscover
+
+For the canonical workflows (service health check, config change +
+deploy, client enrollment, incident investigation, and each node
+lifecycle transition), read the matching `.agents/skills/<name>/SKILL.md` before
+acting. Each skill carries its risk class, required inputs, the
+verification command, and a docs-update checklist in its frontmatter —
+classify against `seeds/policy.yaml` using that risk class before any
+mutation. Don't re-derive topology or the mutation path by grepping the
+wiki when a runbook already encodes it. See [OIKOS.md](OIKOS.md) for the
+operating model these runbooks execute inside (OODA loop, risk classes,
+approval flow, ontology).
+
+## Token efficiency
+
+Apply [caveman.md](shared/caveman.md) — terse, fragment-heavy chat responses
+(not committed documentation). There's no separate tool to install for
+this; it's a response-style convention any agent follows by reading the
+file.

.agents/OIKOS.md

@@ -137,13 +137,13 @@ in the Go binary.
 - Go packages: `internal/scheduler/`, `internal/actuator/`,
   `internal/learning/`, `internal/notifier/`, `internal/policy/`.
 
-**Phase 4 — Agent / Hermes (DONE):**
-- Standalone Hermes MCP client binary (`cmd/hermes`) with gateway mode
+**Phase 4 — Agent / Nomos (DONE):**
+- Standalone Nomos MCP client binary (`cmd/nomos`) with gateway mode
   (:8092). Structured queries + natural-language routing to 15 MCP tools.
   Agent activity logging on every tool call. No SSH keys.
-- `hermes/` directory with config, SOUL.md, homelab-ops skill.
-- Hermes Docker service in `docker-compose.yml` (profile: full).
-- Go packages: `cmd/hermes/`, `compose/hermes/`.
+- `nomos/` directory with config, SOUL.md, homelab-ops skill.
+- Nomos Docker service in `docker-compose.yml` (profile: full).
+- Go packages: `cmd/nomos/`, `compose/nomos/`.
 
 **Phase 5 — Secrets / Infisical (DONE):**
 - `internal/secrets/`: backend abstraction (Manager) with primary
@@ -159,7 +159,7 @@ in the Go binary.
   lint, test, docker build).
 - Deploy: `scripts/deploy.sh` (git pull → docker build → compose up →
   health check), SHA-tagged images, rolling restart.
-- Caddy config: `compose/caddy/Caddyfile.oikos` (oikos/mcp/hermes →
+- Caddy config: `compose/caddy/Caddyfile.oikos` (oikos/mcp/nomos →
   mac-mini mesh :8090/:8092).
 - Watchdog: `scripts/watchdog.sh` (2min cron, Matrix alert on failure).
 - Verification: `scripts/verify-phase6.sh` (14/14 checks pass).
@@ -168,7 +168,7 @@ in the Go binary.
 
 **Current deployment:**
 - **Production**: Docker stack on mac-mini (`--profile full`: postgres, api,
-  scheduler, notifier, hermes). Deployed 2026-07-07 with full knowledge seed.
+  scheduler, notifier, nomos). Deployed 2026-07-07 with full knowledge seed.
   The Python MCP server and secrets-issuance on apps/105 have been stopped
   (see `scripts/cutover-checklist.md`).
 

.agents/dev/CONTRIBUTING.md

@@ -9,7 +9,8 @@ see [CONTRIBUTING.md](../../CONTRIBUTING.md) for a human-friendly version.
 ```
 cmd/oikos/main.go          Entry point. Subcommands: api, scheduler, notifier, migrate,
                              seed, export, secret, all
-cmd/hermes/main.go         Hermes MCP client gateway (standalone binary)
+cmd/nomos/main.go          Nomos MCP client gateway (standalone binary, formerly Hermes)
+cmd/webhook/main.go        Gitea deploy-webhook receiver (push-to-deploy on mac-mini)
 internal/httpapi/           REST + MCP server. Chi router. OpenAPI-generated types from
                              internal/httpapi/gen/api.gen.go. Strict server in impl.go.
 internal/mcp/               MCP tool implementations (get_entity, search_knowledge, etc.)
@@ -26,15 +27,20 @@ internal/domain/            Core types: entities, approvals, executions, signals
 internal/ontology/          Type hierarchy validation, relationship checks
 internal/knowledge/         Knowledge YAML seed ingestion
 internal/config/            Config loading from env vars
+web/                         Control-room SPA (Svelte 5) — standalone static build, not
+                             embedded in the oikos binary (plans/2026-07-12-wails-desktop-app.md)
 api/openapi.yaml            REST API contract. Source of truth for endpoints.
 api/codegen.yaml            oapi-codegen config → generates internal/httpapi/gen/
 migrations/                 Forward-only SQL. Format: NNN_name.up.sql. No down migrations.
 seeds/                      Bootstrap YAML. ontology.yaml, inventory.yaml, policy.yaml,
                              knowledge.yaml. Regenerated from DB via oikos export.
-compose/                    Dockerfiles. oikos/ (multi-stage), hermes/ (distroless).
+compose/                    Dockerfiles. oikos/ (2-stage, Go only — SPA is built/deployed
+                             separately), nomos/ (distroless).
                              Caddy config at compose/caddy/Caddyfile.oikos.
 scripts/                     Deploy, rollback, watchdog, verification, cutover checklist.
-hermes/                      Hermes config.yaml, SOUL.md, skills.
+checks/                      Host health-check scripts run over SSH by the scheduler.
+tools/                       Client auto-setup scripts (checks).
+nomos/                       Nomos config.yaml, SOUL.md, skills.
 .agents/                     Agent instruction files, domains, shared conventions, skills.
 plans/                       Design documents. active/ + done/.
 docs/adr/                    Architecture decision records. Numbered, prefix-sorted.

.agents/operations/agent-enrollment.md

@@ -1,365 +1,120 @@
-# Agent enrollment — bootstrap a client into the homelab context system
+# Agent enrollment — operational notes
 
-This walks through enrolling a new machine (workstation, LXC, or VM) so it
-joins the cross-client context system: a `/opt/homelab-context/` clone of
-this repo that auto-syncs every 5 min, a per-client age key for SOPS
-decryption, the `homelab` CLI, and an MCP endpoint in Claude Code's config.
+**For the actual enrollment flow, see [CLIENTS.md](../../CLIENTS.md#enrollment)
+— it's the current, authoritative version.** This page used to duplicate
+that flow in more detail, describing a `homelab` CLI-based two-step
+ceremony (`homelab client add` reserves an inventory slot → client
+bootstraps → operator finalizes the pubkey). That CLI and that flow don't
+exist anymore — enrollment today is one shot: `bootstrap.sh` calls
+`POST /api/v1/clients/enroll` directly and gets back an age keypair +
+Infisical identity in the same response. What's left here is the handful
+of things that are still true and weren't already covered elsewhere.
 
-> Onboarding a Nous-Hermes-powered Goose agent on top of standard enrollment?
-> See [hermes-agent.md](hermes-agent.md). It uses the same `bootstrap.sh`
-> with an additional `--with-hermes` flag.
-
-Architecture in [project_homelab_context_plan](https://… memory link); the
-operational reference is here.
-
-## Prerequisites the client must satisfy
+## Prerequisites
 
 | Requirement | Why | How to check |
 | --- | --- | --- |
-| Hostname matches an entry in `inventory.yaml` | The bootstrap looks up `hosts/$(hostname).yaml`. | `hostname` (Linux) / `scutil --get LocalHostName` (macOS) |
+| Hostname matches an entry in `inventory.yaml` | `EnrollClient` looks up the entity by slug derived from hostname; it must exist in `planned`/`provisioning` state. | `hostname` (Linux) / `scutil --get LocalHostName` (macOS) |
 | OS is Linux or macOS | bootstrap detects via `uname -s` | `uname -s` |
-| On the mesh (Netbird or Tailscale) **or** on the LAN | issuance is gated to mesh + LAN subnets. **For Netbird: use a setup-key, not interactive auth** — see "Getting onto Netbird" below. | `netbird status` / `tailscale status` |
-| `git`, `python3`, `python3-yaml`, `age`, `sops` | bootstrap preflight; `homelab` CLI imports yaml | See per-OS commands below |
-| Can resolve `*.hubris.network` | bootstrap calls `https://secrets.hubris.network/issue` and writes `https://mcp.hubris.network/mcp` | `dig +short mcp.hubris.network` (should return `192.168.8.175`) |
+| On the mesh (Netbird) **or** on the LAN | enrollment validates mesh IP against expected subnets | `netbird status` |
+| `curl`, `jq`, `age`, `python3` | bootstrap preflight (`bootstrap.sh:100`) — auto-installed on Fedora/RHEL/Debian/Ubuntu/macOS if missing | `command -v curl jq age python3` |
+| Can resolve `*.hubris.network` | bootstrap calls the Oikos API and writes `https://mcp.hubris.network/mcp` | `dig +short mcp.hubris.network` |
 
 ### Hostname mismatch is the most common bootstrap failure
 
-If the bootstrap exits with `no hosts/<name>.yaml in the repo`, the
-hostname doesn't match any inventory entry. Two fixes:
+If the entity for your hostname doesn't exist yet (in `planned` or
+`provisioning` state), enrollment 4xxs. Two fixes:
 
-- **Rename the host**: `sudo hostnamectl set-hostname <inventory-name>`
-  (Linux) or System Preferences → Sharing (macOS), then re-run.
-- **Rename the inventory entry**: edit `inventory.yaml` on hubris,
-  update `inventory.yaml`, push. The next sync (≤5 min) propagates.
+- **Rename the host** to match an existing planned entity:
+  `sudo hostnamectl set-hostname <inventory-name>` (Linux) or System
+  Preferences → Sharing (macOS), then re-run.
+- **Add/rename the inventory entry**: edit `seeds/inventory.yaml`, ingest
+  via `oikos seed` (or the equivalent MCP/API entity-creation path), then
+  re-run bootstrap.
 
-### Getting onto Netbird
+### Networking prerequisites (Netbird, DNS, SSH key distribution)
 
-Bootstrap auto-installs netbird and drives `netbird up` if the mesh isn't already connected (since commit `<bootstrap-tier1>`). Both paths below produce the same end state: `netbird status` shows `Management: Connected`, peer IP `100.122.x.x/16`.
-
-**Path B — interactive OIDC (default; recommended):**
-
-The new client runs bootstrap straight from a fresh OS. Bootstrap installs netbird (apt/dnf/brew based on the OS), then runs `netbird up --management-url https://netbird.hubris.network --ssh-jwt-cache-ttl 86400`. A device-code URL prints inline. The operator opens it (in a browser logged into Authentik), goes through identification → password → consent, and the CLI returns `Connected`. Bootstrap then proceeds with the rest of preflight.
-
-Pre-condition: the operator must be a registered user in Authentik (typically the lab owner). The first user-login against a netbird account with existing peers is added as `pending_approval=1` and needs an sqlite promotion to `owner` — see [124-authentik.md First-time owner promotion gotcha](../../archive/knowledge/containers/106-auth-outpost.md). Only needed once per account.
-
-**Path A — setup-key (headless/scripted onboarding):**
-
-Useful for headless servers (no browser at all) or unattended cloud-init bootstraps.
-
-1. From an already-enrolled machine, log into the dashboard at `https://netbird.hubris.network/`.
-2. **Setup Keys** → Create → set reusable + expiry → copy.
-3. On the new client (after installing netbird, OR let bootstrap install it and skip its `netbird up` driver):
-   ```bash
-   sudo netbird up --setup-key <KEY> \
-                   --management-url https://netbird.hubris.network \
-                   --ssh-jwt-cache-ttl 86400
-   ```
-
-**Why we can't OIDC-login from the public internet (still open as a follow-up):**
-
-`auth.hubris.network` resolves publicly to the VPS (`82.165.190.79`), but Traefik on the VPS doesn't currently route that hostname — only `netbird.hubris.network` is exposed. A brand-new client *off the mesh* hitting `auth.hubris.network` directly gets a Traefik default 404. In practice, Path B works fine because the operator's BROWSER (which clicks the device-code URL) is usually on a network that can reach Authentik through the public IONOS IP via some path. But "fresh laptop in a coffee shop with no prior session anywhere" still gets stuck. Future-session fix: add a Traefik route on the VPS forwarding `auth.hubris.network` via the netbird-routed `192.168.8.0/24` to LXC 124.
-
-### DNS prerequisite
-
-`*.hubris.network` resolves via the split-horizon dnsmasq on LXC 124
-([dns.md](../../archive/knowledge/infrastructure/dns.md)) for LAN clients, **but only if the
-client uses 192.168.8.180 as its resolver**. Most LXCs and roaming
-workstations don't by default. Options:
-
-- **LAN client**: set DNS to 192.168.8.180 (per-interface or
-  `/etc/resolv.conf`).
-- **Off-LAN workstation on Netbird**: configure Netbird DNS forwarder to
-  point `*.hubris.network` at LXC 124.
-- **Hack-fix anywhere**: append to `/etc/hosts`:
-  ```
-  192.168.8.175  mcp.hubris.network secrets.hubris.network
-  192.168.8.175  git.hubris.network
-  ```
-  (192.168.8.175 = caddy on LXC 121, terminates all `*.hubris.network`.)
-
-If DNS isn't an option at all, override the URLs at bootstrap time:
-
-```bash
-sudo HOMELAB_GITEA_TOKEN=... \
-     HOMELAB_REPO_URL=http://192.168.8.121:3000/dtoro/oikos.git \
-     HOMELAB_ISSUANCE_NETBIRD=http://192.168.8.205:9820/issue \
-     HOMELAB_MCP_URL=http://192.168.8.205:9810/mcp \
-     bash /tmp/bootstrap.sh --with-mcp
-```
-
-## Install dependencies
-
-Bootstrap auto-installs missing prerequisites (`git`, `python3` + PyYAML, `age`, `sops`, `netbird`) on Fedora/RHEL/Debian/Ubuntu/macOS — no manual `apt`/`dnf`/`brew` needed before running it. The only thing you must have on hand BEFORE the `curl ... | sudo bash` line is `curl` itself (used to pipe the script).
-
-Manual install is still possible (e.g. for air-gapped or unusual platforms); the per-OS recipes are below for reference but optional.
-
-<details>
-<summary>Manual recipes (Fedora / Debian / macOS)</summary>
-
-```bash
-# Fedora / RHEL / Nobara
-sudo dnf install -y git python3-pyyaml age curl
-SOPS_VERSION=v3.9.4
-sudo curl -fsSL https://github.com/getsops/sops/releases/download/$SOPS_VERSION/sops-$SOPS_VERSION.linux.amd64 \
-  -o /usr/local/bin/sops && sudo chmod +x /usr/local/bin/sops
-
-# Debian / Ubuntu
-sudo apt update && sudo apt install -y git python3-yaml age curl
-SOPS_VERSION=v3.9.4
-sudo curl -fsSL https://github.com/getsops/sops/releases/download/$SOPS_VERSION/sops-$SOPS_VERSION.linux.amd64 \
-  -o /usr/local/bin/sops && sudo chmod +x /usr/local/bin/sops
-
-# macOS
-brew install git age sops
-pip3 install pyyaml   # if `python3 -c "import yaml"` fails
-```
-
-</details>
-
-## Run the bootstrap
-
-You need a Gitea read-only personal access token for the initial clone
-(the in-cluster shared PAT is encrypted at `secrets/gitea-readonly-pat.yaml`
-but a new client can't decrypt it before bootstrap — chicken-and-egg).
-Ask the operator (or generate in Gitea: Settings → Applications → Generate
-New Token → scope `read:repository`).
-
-```bash
-TOKEN=...   # your Gitea PAT, scope read:repository
-
-# Fetch bootstrap.sh from gitea (HTTPS uses split-DNS → caddy).
-curl -fsSL -u "dtoro:$TOKEN" \
-  https://git.hubris.network/dtoro/oikos/raw/branch/main/bootstrap.sh \
-  -o /tmp/bootstrap.sh
-
-# Run it.
-sudo HOMELAB_GITEA_TOKEN=$TOKEN bash /tmp/bootstrap.sh --with-mcp
-```
-
-Flags:
-
-| Flag | Effect |
-| --- | --- |
-| `--with-mcp` | Merges the homelab MCP server into `~/.claude/.mcp.json` of the invoking user |
-| `--no-secrets` | Skips age-key issuance (use when bringing up the first hosts before secrets-issuance exists) |
-| `--dry-run` | Prints actions without executing |
-
-The bootstrap is idempotent: re-running on an enrolled client just
-verifies state, re-issues the age key only if it doesn't match the
-inventory pubkey, and refreshes the sync timer + symlinks.
-
-## Verify
-
-```bash
-homelab whoami                    # prints hosts/$(hostname).yaml
-homelab list                      # shows the full topology
-homelab status                    # ping + HTTP-check across hosts/services
-homelab secret hello              # decrypt the bootstrap-test secret
-systemctl list-timers homelab-context-sync.timer
-                                  # next run within ≤5 min
-```
-
-For Claude Code: start a new session — the `homelab` MCP server appears
-in `~/.claude/.mcp.json` and registers 14 tools (8 context, 5 management,
-1 secrets-metadata).
-
-## Post-bootstrap: SSH reachability
-
-A new workstation must be reachable from other workstations and must be
-able to reach every host by short hostname. Run these steps after the
-bootstrap verify passes:
-
-### 1. Enable SSH server
-
-```bash
-# macOS:
-sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist
-
-# Linux:
-sudo systemctl enable --now sshd
-```
-
-### 2. Generate SSH key (if missing)
-
-```bash
-ls ~/.ssh/id_ed25519.pub 2>/dev/null || ssh-keygen -t ed25519 -a 100
-```
-
-### 3. Publish pubkey to the repo
-
-```bash
-cp ~/.ssh/id_ed25519.pub /opt/homelab-context/ssh/authorized_keys/$(hostname -s).pub
-cd /opt/homelab-context && git add ssh/authorized_keys/ && git commit -m 'ssh: add $(hostname -s) pubkey' && git push
-```
-
-### 4. Deploy keys to all hosts
-
-From any existing enrolled machine (hubris or another workstation):
-
-```bash
-ssh root@192.168.8.77 "cd /opt/homelab-context && git pull --ff-only && bash ssh/deploy-keys.sh"
-```
-
-This adds the new workstation's pubkey to hubris and every running LXC.
-
-### 5. Generate SSH config
-
-```bash
-homelab ssh-config --install
-```
-
-Verify:
-
-```bash
-ssh hubris hostname     # should return "hubris" without password
-ssh gitea hostname      # should return "gitea" without password
-ssh mac-mini hostname   # should return "mac-mini" without password (workstation-to-workstation)
-```
-
-### 6. Add LAN IP to inventory (if on LAN)
-
-If the workstation has a static or reserved LAN IP, add it to
-`inventory.yaml`:
-
-```yaml
-hosts:
-  your-hostname:
-    lan_ip: 192.168.8.xxx
-```
-
-This gives it a primary LAN entry in the generated SSH config (faster
-than the Netbird fallback). Commit + push, then:
-
-```bash
-cd /opt/homelab-context && git pull --ff-only && homelab ssh-config --install
-```
+Migrated to a runbook in the knowledge base — query
+`search_knowledge("netbird mesh dns")` or `get_entity_knowledge`, or ask
+Nomos. Covers: getting onto the Netbird mesh (interactive OIDC vs.
+setup-key), why OIDC login can fail from off-mesh, split-horizon DNS
+options, and distributing a new workstation's SSH pubkey across the fleet
+via `ssh/deploy-keys.sh`.
 
 ## Claude Code permissions for fleet ops
 
 By default Claude Code's auto-mode classifier asks for confirmation on every
-ssh into the mesh. The bootstrap already installs the ssh ControlMaster block
-so subsequent in-session sshes multiplex, but the *first* ssh of each session
-still gets classifier-evaluated. Pre-authorize the common fleet ssh patterns
-by adding to `~/.claude/settings.json`:
+ssh into the mesh. Pre-authorize the common fleet ssh pattern by adding to
+`~/.claude/settings.json`:
 
 ```json
 {
   "permissions": {
     "defaultMode": "auto",
     "allow": [
-      "Bash(ssh -p 22022 *)",
-      "Bash(homelab *)"
+      "Bash(ssh -p 22022 *)"
     ]
   }
 }
 ```
 
-The first rule covers any ssh to a mesh peer on the homelab netbird port; the
-second covers all `homelab` CLI invocations. Both are scoped tight enough that
-the classifier doesn't gate them but loose enough to handle the variety of
-arguments.
+This covers any ssh to a mesh peer on the homelab netbird port, scoped tight
+enough that the classifier doesn't gate it but loose enough to handle the
+variety of arguments.
 
-If you also want the netbird `--ssh-jwt-cache-ttl` flag rationale to be
-visible to the classifier (it's not actually durable in 0.71.2, but the
-ControlMaster block is — see [runbook-dpkg-interrupted](../skills/runbook-dpkg-interrupted/SKILL.md)
-for context), drop a free-text rule into `autoMode.allow` describing the
-authorization. Optional.
+## Open questions (not verified against current architecture — don't
+guess these from the old flow)
 
-## Adding a new client to inventory
+The old two-step ceremony had answers for these; the current one-shot
+`/api/v1/clients/enroll` flow may handle them differently and this hasn't
+been re-verified:
 
-If the hostname you want isn't yet in inventory, enrollment is a two-step
-ceremony driven from an existing enrolled client (e.g. hubris). The
-`homelab` CLI handles steps 1 + 4; you provide steps 2 + 3.
-
-```bash
-# 1. On hubris (or any existing client): add the inventory entry.
-homelab client add my-new-machine
-# Prompts for kind, os, netbird FQDN, role. Commits + pushes.
-
-# 2. Join the new machine to Netbird (out-of-band, Netbird console / setup key).
-
-# 3. On the new machine: install deps + run bootstrap (above).
-#    Bootstrap calls /issue, receives a fresh age keypair, and prints the
-#    public key for the operator to commit back to inventory.
-
-# 4. On hubris: finalize the age public key.
-homelab client add my-new-machine --finalize-pubkey age1...
-# Updates inventory.yaml hosts.my-new-machine.age_pubkey, regenerates
-# inventory.yaml, commits + pushes. The 5-min sync propagates.
-```
-
-## Granting a secret to a new client
-
-Adding a client doesn't grant them every secret. Recipients are explicit
-per file via `.sops.yaml` glob rules. To grant a client access to (say)
-`secrets/hello.yaml`:
-
-1. Edit `.sops.yaml` at the repo root, add the client's `age_pubkey` to
-   the matching `creation_rules` block.
-2. Re-key the existing ciphertext for the new recipient list:
-   ```bash
-   sops updatekeys -y secrets/hello.yaml
-   ```
-3. Commit + push. On the next sync (≤5 min), the client can decrypt.
-
-## Removing a client
-
-```bash
-# From any existing client:
-homelab client remove my-old-machine
-```
-
-This:
-1. Removes the inventory entry and `hosts/my-old-machine.yaml`.
-2. Runs `sops updatekeys -y` against every file in `secrets/` (operator
-   must first remove the pubkey from `.sops.yaml` rules).
-3. Calls `secrets-issuance` `/revoke` (admin-token-gated, on LXC 105) to
-   shred the key file and add the hostname to the denylist.
-4. Commits + pushes.
-
-The CLI prints a follow-up checklist that the operator must do manually:
-
-- Revoke the peer in the Netbird console (denies future mesh access).
-- **Rotate any credentials whose ciphertext the removed client already
-  has on disk.** The age key revocation only protects *future*
-  ciphertext; what's already been pulled is still decryptable until the
-  underlying credential changes.
-- Optional: `homelab nuke my-old-machine` SSHes in, shreds
-  `/etc/age/key.txt`, removes `/opt/homelab-context`, disables sync.
+- **Removing a client.** No current equivalent confirmed for the old
+  `homelab client remove` (inventory removal + secret re-keying + key
+  revocation). Likely maps to an entity lifecycle transition
+  (`.agents/skills/lifecycle-deprecate-node/` or `lifecycle-destroy-node/`)
+  but those skills reference the same dead CLI and need their own check.
+- **Granting a secret to an already-enrolled client.** The old flow
+  hand-edited `.sops.yaml` `creation_rules` + `sops updatekeys`. Given
+  Infisical is now the primary secrets backend (SOPS is the DR fallback),
+  the current mechanism is probably Infisical-side, not a `.sops.yaml` edit
+  — not confirmed.
 
 ## Troubleshooting
 
 | Symptom | Cause | Fix |
 | --- | --- | --- |
-| `no hosts/<hostname>.yaml in the repo` | Hostname doesn't match inventory entry | Rename either side (see above) |
-| `fatal: could not read Username for 'http://192.168.8.121:3000'` | bootstrap.sh's credentials file has wrong scheme | Fixed in commit `de6f8be`; pull latest `bootstrap.sh` |
-| `gnutls_handshake() failed: TLS connection was non-properly terminated` cloning `git.hubris.network` | Client DNS resolves `*.hubris.network` to the public VPS IP | Configure split-DNS (LXC 180 / Netbird forwarder) or `/etc/hosts` override; or use `HOMELAB_REPO_URL=http://192.168.8.121:3000/dtoro/oikos.git` |
-| `TLS/SSL connection has been closed (EOF)` connecting MCP | Same — `mcp.hubris.network` resolves to public VPS without this vhost | Same DNS fix |
-| `Invalid Host header` from MCP server | FastMCP's DNS-rebinding protection (default whitelist is 127.0.0.1 only) | Fixed in commit `6848640`; pull latest `mcp/server.py` and redeploy |
-| `python3-yaml` install fails on Fedora | Wrong package name | Use `python3-pyyaml` (Fedora) instead of `python3-yaml` (Debian) |
-| `address already in use` for FastMCP | FastMCP defaults to 127.0.0.1:8000 | Fixed: server now sets `mcp.settings.host/port` from env (default `0.0.0.0:9810`) |
-| `homelab: no age key at /etc/age/key.txt` even after bootstrap | `/etc/age` is 0700 root, so non-root users couldn't even stat the key file; existence check returned False under regular users | Fixed in commit `df6aca8`: the CLI re-execs `sops -d` via sudo when invoked as a non-root user. On older deployments, re-link the CLI with `sudo ln -sfn /opt/homelab-context/bin/homelab /usr/local/bin/homelab` after the 5-min sync. |
-| `homelab` CLI doesn't pick up repo updates | Pre-`02db…` bootstrap copied the binary instead of symlinking | One-time migration: `sudo ln -sfn /opt/homelab-context/bin/homelab /usr/local/bin/homelab`. New bootstraps use the symlink, which auto-tracks the synced repo. |
-| `homelab-context-sync.service` journal shows `fatal: could not read Username for 'https://git.hubris.network'` | Pre-fix bootstrap set the gitea credential helper via `git config --global`, which writes to `/root/.gitconfig` — invisible to the systemd timer's git process (no HOME set). | One-time migration: `sudo git config --system credential.helper "store --file=/etc/homelab-context/git-credentials"`. New bootstraps store the helper in `/etc/gitconfig` instead. |
+| Enrollment 404s / entity not found | Hostname doesn't match a `planned`/`provisioning` inventory entry | See "Hostname mismatch" above |
+| `gnutls_handshake() failed` / TLS errors reaching `*.hubris.network` | Client DNS resolves `*.hubris.network` to the public VPS instead of the LAN/mesh path | See the networking runbook (split-horizon DNS section) |
 | Chat-mode `!` shell can't `sudo` (`a terminal is required to read the password`) | Claude Code's `!` invocation doesn't allocate a tty, and standard `sudo` won't read its password from stdin or a non-tty pipe. | Run the sudo'd command in a real terminal outside chat. For commands the agent issues repeatedly, configure passwordless sudo for the narrow set (e.g. `/etc/sudoers.d/homelab-self` with `<user> ALL=(ALL) NOPASSWD: /usr/bin/dnf upgrade -y, /usr/bin/apt-get *`). |
-| `netbird status -d` reports `192.168.8.180:53 ... is Unavailable` but DNS actually works | netbird's UDP-53 probe times out over the relay latency (~90ms), but actual queries still flow through systemd-resolved. Cosmetic. | Ignore unless `dig @192.168.8.180 git.hubris.network` also fails — then check dnsmasq on [LXC 124](../../archive/knowledge/containers/106-auth-outpost.md). |
-| `netbird ssh` rejected with `JWT authentication failed: validate token (expected issuer=https://netbird.hubris.network/oauth2 ...)` | Peer's SSH JWT validator cached the OLD embedded-Dex issuer from before the 2026-05-21 Authentik migration. `systemctl restart netbird` and `netbird down/up` don't clear it — `client/internal/engine_ssh.go` bails out of `updateSSH()` if the SSH server is already running. | Full daemon bounce: `sudo systemctl stop netbird; sleep 3; sudo systemctl start netbird`. Verify with `grep -iE "issuer\|audience" /var/log/netbird/client.log \| tail`. Apply once per peer post-migration. |
-| `netbird ssh` JWT passes but session closes with `user privilege check failed: user dtoro not found: unknown user dtoro` | netbird-ssh defaults the remote username to the LOCAL one (operator's laptop user). Hubris and LXCs only have `root`. | Always use explicit `root@` prefix manually: `netbird ssh -p 22022 root@proxmox-server.netbird.selfhosted`. `homelab ssh <host>` does this automatically via `inventory.yaml`'s per-host `ssh.user` field (defaults to `root`). |
-| `homelab ssh hubris` (or any host on the LAN) fails with `Connection refused` or hangs, despite mesh routing being up | Off-LAN networks (operator on a VPN / coffee shop / symmetric NAT) sometimes can't reach the LAN IP even with the netbird subnet route. | Newer homelab CLIs probe the LAN with a 1.5s TCP connect and transparently fall back to the netbird FQDN. If your `/usr/local/bin/homelab` is a symlink to `/opt/homelab-context/bin/homelab` it'll pick up the fix on the next 5-min context sync. Otherwise pull the latest from gitea. |
 
 ## Changelog
 
-### 2026-06-02 — SSH reachability post-bootstrap steps
-Added a new "Post-bootstrap: SSH reachability" section covering SSH key
-generation, pubkey publication, deployment to hosts, SSH config generation,
-and LAN IP registration. New workstations enrolled via this doc will
-automatically join the universal SSH mesh.
+### 2026-07-12 — trimmed to current architecture
+Removed everything describing the retired `homelab` CLI-based two-step
+enrollment ceremony (now: `CLIENTS.md`'s one-shot flow), the Nous-Hermes/
+Goose cross-link (that whole flow was removed the same day), and CLI-syntax
+troubleshooting rows with no current equivalent. Migrated the still-true
+Netbird/DNS/SSH-distribution content to a knowledge-base runbook rather
+than duplicating it here. What's left is genuinely current or explicitly
+flagged as unverified. Original ~365-line version is in git history
+(`git log -- .agents/operations/agent-enrollment.md`) if any of the removed
+detail turns out to still be needed.
 
-### 2026-05-31 — cross-link to hermes-agent.md
-Added a sibling page covering Nous-Hermes-on-Goose enrollment ([hermes-agent.md](hermes-agent.md)) and noted it at the top of this page. The Hermes flow extends `bootstrap.sh` with `--with-hermes` and `homelab client add` with the same flag; it does not change the underlying enrollment steps documented here.
+### 2026-06-02 — SSH reachability post-bootstrap steps
+Added a section covering SSH key generation, pubkey publication,
+deployment to hosts, SSH config generation, and LAN IP registration. New
+workstations enrolled via this doc automatically join the SSH mesh.
+(Superseded 2026-07-12 — migrated to the networking runbook.)
+
+### 2026-05-31 — cross-link to nomos-agent.md
+Added a sibling page covering Nous-Hermes-on-Goose enrollment. (Removed
+2026-07-12 along with the rest of that flow.)
 
 ### 2026-05-21 — netbird-ssh JWT issuer + username + LAN-fallback troubleshooting rows
-Added three rows to the troubleshooting table covering issues surfaced during the netbird vanilla migration: (1) post-migration SSH JWT validator cache stuck on old Dex issuer (full `systemctl stop/start` required, not `restart`), (2) `user not found` from netbird-ssh's local-username default (use explicit `root@`), and (3) homelab CLI's LAN→netbird-FQDN fallback for off-LAN operators. Companion code change: per-host `ssh.user` field in `inventory.yaml` + `homelab` CLI's `ssh_target()` helper.
+Added three rows to the troubleshooting table covering issues surfaced
+during the netbird vanilla migration. (Migrated 2026-07-12 to the
+networking runbook.)
 
 ### 2026-05-20 — initial page
 Captures the enrollment flow validated during Phase 2 of the homelab

.agents/operations/commands.md

@@ -14,7 +14,7 @@ Run from the [hubris host](../../archive/knowledge/hosts/hubris.md) as root. Whe
 | `pvesm status` | Storage pools status |
 | `pvesh get /nodes --output-format json` | Node summary as JSON |
 | `pvesh get /nodes/hubris/lxc/<id>/status/current` | Live container status |
-| `pvesh get /cluster/resources --type vm --output-format json` | Bulk per-LXC CPU/mem/disk (used by the `homelab-health-watchdog` Hermes cron — see [monitoring](../../archive/knowledge/infrastructure/monitoring.md); the old `claudio-monitor` this once fed is deprecated) |
+| `pvesh get /cluster/resources --type vm --output-format json` | Bulk per-LXC CPU/mem/disk (used by the `homelab-health-watchdog` Nomos cron — see [monitoring](../../archive/knowledge/infrastructure/monitoring.md); the old `claudio-monitor` this once fed is deprecated) |
 | `pveversion` | PVE version |
 | `journalctl -u pve-cluster -n 100` | PVE service logs |
 
@@ -53,34 +53,36 @@ Run from the [hubris host](../../archive/knowledge/hosts/hubris.md) as root. Whe
 
 ## Fleet apt operations
 
-Two `homelab` subcommands wrap the common patterns; both fan out to hubris + every LXC.
-
-| Command | What it does |
-| --- | --- |
-| `homelab apt-audit [--target HOST]` | Per-host table: dpkg-interrupted state, holds, upgradable count, non-apt binaries in system paths, DNS health. Exits nonzero if any host has dpkg-interrupted state. |
-| `homelab apt-upgrade --target HOST` | Launch `apt update && apt upgrade` inside a transient `systemd-run --collect` unit on the target. Survives ssh teardown. Apt configured with `Acquire::Retries=3` + `ForceIPv4=true`. |
-| `homelab apt-upgrade --all` | Same, fanned out across the standard targets. |
-| `homelab apt-upgrade ... --status` | Show running unit + tail `/var/log/homelab-apt-upgrade.log` on each target. |
-| `homelab apt-upgrade ... --safe` | Take a pre-upgrade snapshot per LXC first (`pct snapshot` → `vzdump` fallback for bind-mounted LXCs). Refuses if any snapshot fails unless `--force`. |
-| `homelab apt-upgrade ... --force` | Skip both the dpkg-audit gate and snapshot-failure refusal. |
-
-PVE/kernel deferral on hubris: `homelab apt-upgrade --target hubris` will try every upgrade, including kernel + `pve-*`. To skip those, `apt-mark hold` the relevant packages on hubris first; `homelab apt-audit` shows held packages so you can confirm.
+**No current CLI equivalent.** `homelab apt-audit`/`apt-upgrade` (dpkg-state
+audit, fanned-out apt upgrade with pre-upgrade snapshots) were part of the
+retired Python `homelab` CLI and don't have a ported replacement — apt
+patching today is ad hoc `run` MCP tool calls per host, without the
+audit/snapshot/status wrapping this used to provide. If that wrapping is
+still wanted, it needs to be rebuilt (e.g. as a runbook driving `run`, or a
+new MCP tool) — see
+[runbook-dpkg-interrupted](../skills/runbook-dpkg-interrupted/SKILL.md) for
+the dpkg-interrupted recovery procedure specifically.
 
 ## Oikos (agent OS layer)
 
-See [OIKOS.md](../OIKOS.md) for the operating model. Quick reference:
+See [OIKOS.md](../OIKOS.md) for the operating model. The `homelab` CLI this
+section used to document is retired; the actual current interface is the
+33 MCP tools cataloged in [AGENTS.md](../../AGENTS.md#3-the-mcp-server) plus
+the REST API. Closest current equivalents for what used to live here:
 
-| Command | What it does |
+| Old `homelab` command | Current equivalent |
 | --- | --- |
-| `homelab service <name> explain\|health\|docs\|log\|actions\|history` | Service Console v0 — context card, cached health (`--live` to force a probe), docs, logs, safe actions + risk class, ledger history |
-| `homelab node <name> relations` | Ontology blast-radius query: what this host/service impacts, is affected by, and its full transitive blast radius |
-| `homelab change preflight <service>` | Dry-run report before mutating: risk class, current health, config repo, verification command |
-| `homelab decide <action> <entity>` | Decision classifier: risk × blast radius × confidence → auto-act or escalate |
-| `homelab signal list\|raise\|ack\|resolve\|mute` | The attention layer — pending updates, thresholds, drift, anything needing attention |
-| `homelab approval request\|list\|reply\|check` | Escalate-route grants (Matrix-delivered via Hermes, or the Oikos Console's `/approvals` page) |
-| `homelab restart <service> [--approval-id <id>]` | `--approval-id` is required whenever the service's risk class needs approval (e.g. `caddy`, `dns`) — refuses mechanically without a valid grant |
+| `homelab service <name> explain\|health\|docs\|log` | MCP `explain`, `get_service_status`, `tail_log`, `get_entity_knowledge` |
+| `homelab node <name> relations` | MCP `get_blast_radius` |
+| `homelab change preflight <service>` | MCP `preflight` |
+| `homelab signal list\|ack\|resolve\|mute` | MCP `get_signal_history`, or REST `POST /api/v1/signals/{id}/ack\|resolve\|mute` (the control-room UI's Signals page wraps these) |
+| `homelab approval request\|list\|reply\|check` | REST `GET/POST /api/v1/approvals*` (Matrix-delivered via the notifier, or the control-room UI's Operations page) |
+| `homelab restart <service> --approval-id <id>` | MCP `run` (policy-gated — auto-executes if read-only/reversible_low, otherwise queues for the same Matrix/UI approval) |
+| `homelab decide <action> <entity>` | No direct equivalent — classification now happens inline inside `run`/`request_execution`, not as a separate dry-run call |
 
-Oikos Console (read-mostly dashboard): `oikos.hubris.network` once deployed — see [oikos/console/deploy/README.md](../../archive/oikos-cards/).
+There is no separately-deployed "Oikos Console" anymore — the control-room
+SPA (`web/`) is the operator dashboard, served standalone (see
+[plans/2026-07-12-wails-desktop-app.md](../../plans/2026-07-12-wails-desktop-app.md)).
 
 ## Related
 - [Hubris host](../../archive/knowledge/hosts/hubris.md)

.agents/operations/hermes-agent.md

@@ -1,210 +0,0 @@
-# Hermes agent — Nous-Hermes-powered Goose sessions on a homelab client
-
-Onboards [Nous Research's Hermes](https://nousresearch.com/) (a fine-tuned
-Llama variant) as a working terminal agent on a homelab client. Builds on top
-of standard client enrollment (see [agent-enrollment.md](agent-enrollment.md))
-— this page covers only the Hermes-specific additions.
-
-The agent runs as a [Goose](https://goose-docs.ai/) session. Goose provides:
-
-- The chat loop, multi-turn history, and streaming
-- The OpenRouter provider that routes to Nous Hermes
-- The built-in `developer` extension (shell + file editor — same surface Claude
-  Code has)
-- A remote MCP extension pointed at `mcp.hubris.network` for read-only
-  homelab context (`list_lxcs`, `tail_log`, `search_docs`, etc.)
-
-The persona is `/opt/homelab-context/HERMES.md`, symlinked as Goose's global
-`.goosehints` so it's injected into the system prompt on every session.
-
-## Prerequisites
-
-| Requirement | How |
-| --- | --- |
-| Standard enrollment complete (`homelab whoami` works) | [agent-enrollment.md](agent-enrollment.md) |
-| `secrets/openrouter-api-key.yaml` exists with a real `sk-or-...` value | See "Seeding the OpenRouter key" below |
-| The host's `age_pubkey` is on the openrouter-api-key.yaml sops rule | `homelab client add <host> --finalize-pubkey <age1...> --with-hermes` |
-
-## Onboarding flow
-
-```bash
-# 1. On hubris (or any enrolled client): reserve the inventory entry.
-homelab client add new-machine
-
-# 2. Join new-machine to Netbird (setup-key or OIDC).
-
-# 3. On new-machine: bootstrap with --with-hermes.
-TOKEN=...   # gitea PAT, read:repository
-curl -fsSL -u "dtoro:$TOKEN" \
-  https://git.hubris.network/dtoro/oikos/raw/branch/main/bootstrap.sh \
-  -o /tmp/bootstrap.sh
-sudo HOMELAB_GITEA_TOKEN=$TOKEN bash /tmp/bootstrap.sh --with-mcp --with-hermes
-
-# 4. Back on hubris: finalize the age pubkey AND grant the Hermes secret.
-homelab client add new-machine \
-  --finalize-pubkey age1... \
-  --with-hermes
-
-# 5. Wait ≤5 min for sync, then on new-machine:
-hermes "what LXCs are running?"
-```
-
-The bootstrap `--with-hermes` flag does five things, all idempotent:
-
-1. Downloads the latest Goose binary into the operator's `~/.local/bin/goose`
-   (upstream installer) and symlinks `/usr/local/bin/goose` to it.
-2. Symlinks `/opt/homelab-context/bin/hermes` → `/usr/local/bin/hermes`.
-3. Symlinks `/opt/homelab-context/HERMES.md` → `/root/HERMES.md` (Linux) or
-   `/etc/HERMES.md` (macOS) for `cat`-as-operator convenience.
-4. Drops `~/.config/goose/config.yaml` pinning the provider, model, and
-   extensions (preserves any keys the operator added by hand).
-5. Symlinks `~/.config/goose/.goosehints` → HERMES.md, so the persona is
-   injected as the system prompt on every session.
-
-## Seeding the OpenRouter key
-
-The first time anyone enrolls with `--with-hermes`, the encrypted file
-`secrets/openrouter-api-key.yaml` contains a placeholder. On hubris (or any
-existing recipient):
-
-```bash
-sops secrets/openrouter-api-key.yaml
-# editor opens; replace api_key value with the real sk-or-... key, save, close.
-git -C /opt/homelab-context add secrets/openrouter-api-key.yaml
-git -C /opt/homelab-context commit -m 'openrouter-api-key: seed real key'
-git -C /opt/homelab-context push
-```
-
-Until this step happens, `hermes …` exits with `openrouter-api-key.yaml still
-contains the placeholder`. Subsequent enrollees get the real key automatically
-via `--with-hermes` (which adds them as a sops recipient on
-`secrets/openrouter-api-key.yaml`).
-
-## Granting the OpenRouter key to an already-enrolled host
-
-If a host was enrolled without `--with-hermes` and you want to add it later:
-
-```bash
-# On hubris:
-PUBKEY=$(homelab whoami --hostname <host> | grep age_pubkey | awk '{print $2}')
-homelab client add <host> --finalize-pubkey "$PUBKEY" --with-hermes
-```
-
-`--finalize-pubkey` is required by the existing flow even when the pubkey is
-unchanged — it's also the trigger that runs the sops grant.
-
-After ≤5 min sync the host can decrypt the key. Bootstrap doesn't need to
-re-run; only the secret recipient list changed.
-
-## Verifying
-
-```bash
-homelab whoami                                # standard enrollment OK
-homelab secret openrouter-api-key | head -c 8 # decrypts (prints `api_key:`)
-which goose && which hermes                   # binaries present
-goose info -v                                  # provider/model wiring sane
-hermes "what LXCs are running?"                # interactive Goose session
-
-# Non-interactive smoke test:
-echo "List the homelab MCP tools you have available" | hermes
-```
-
-## Configuration
-
-The bootstrap-managed keys in `~/.config/goose/config.yaml`:
-
-```yaml
-GOOSE_PROVIDER: openrouter
-GOOSE_MODEL: deepseek/deepseek-v4-flash
-GOOSE_MODE: smart_approve         # asks before destructive tool calls
-extensions:
-  developer:
-    type: builtin
-    bundled: true
-    enabled: true
-    name: developer
-    timeout: 300
-  homelab:
-    type: streamable_http
-    enabled: true
-    name: homelab
-    uri: https://mcp.hubris.network/mcp
-    timeout: 60
-```
-
-Override via env on a single bootstrap run:
-
-```bash
-HOMELAB_HERMES_MODEL=nousresearch/hermes-3-llama-3.1-405b \
-HOMELAB_HERMES_MCP_URI=https://mcp.hubris.network/mcp \
-  sudo bash /tmp/bootstrap.sh --with-hermes
-```
-
-Any keys you add by hand (e.g. `GOOSE_TEMPERATURE`, extra `extensions.*`) are
-preserved across re-bootstraps — the merge only overwrites the keys it manages.
-
-## Tool permissions
-
-`GOOSE_MODE: smart_approve` is the bootstrap default: Goose runs read-only
-shell commands without prompting and asks for confirmation before destructive
-ones. To make the agent fully unattended (e.g. for scheduled jobs), set
-`GOOSE_MODE: auto` in `~/.config/goose/config.yaml`. To require confirmation on
-every tool call, use `approve`. See
-[goose-permissions](https://goose-docs.ai/docs/guides/managing-tools/goose-permissions/).
-
-## Troubleshooting
-
-| Symptom | Cause | Fix |
-| --- | --- | --- |
-| `hermes: could not decrypt secrets/openrouter-api-key.yaml` | Host isn't a recipient on the sops rule | `homelab client add <host> --finalize-pubkey <age1...> --with-hermes` from hubris |
-| `hermes: openrouter-api-key.yaml still contains the placeholder` | No real key has been seeded yet | See "Seeding the OpenRouter key" above |
-| Goose hangs on first `hermes` invocation with no output | Goose's interactive `configure` ran on first launch and is awaiting input | Re-run; the installer is supposed to skip it (CONFIGURE=false). If it persists, run `goose configure` once manually in a real terminal to commit the config. |
-| `homelab` extension fails to connect / no MCP tools listed | MCP server upgraded in Go rewrite (`internal/mcp/server.go`, Streamable HTTP via official MCP SDK). Old FastMCP SSE transport is deprecated. | Run `docker compose --profile full up` on mac-mini, or wait for the production cutover from apps/105. |
-| `goose: command not found` after bootstrap | Upstream installer dropped binary in `~/.local/bin/` but `/usr/local/bin/goose` symlink didn't land | Re-run bootstrap with `--with-hermes`; the symlink step is at the end of the install block. If still missing, `ln -sfn ~/.local/bin/goose /usr/local/bin/goose` manually. |
-| Tool calls hit OpenRouter rate limits | One shared key across many hosts | Future: per-host keys; for now, see the rate-limits guide referenced in `goose info -v`. |
-
-## Cross-references
-
-- [agent-enrollment.md](agent-enrollment.md) — base client onboarding the
-  Hermes flow assumes is done.
-- [`HERMES.md`](../HERMES.md) — the persona the Hermes agent reads on every
-  session start (via `~/.config/goose/.goosehints`).
-- [`bin/hermes`](../../bin/hermes) — the wrapper that decrypts the OpenRouter key
-  and execs `goose session`.
-- [`bootstrap.sh`](../../bootstrap.sh) — the `--with-hermes` flag's install block.
-
-## Follow-ups
-
-1. **Migrate the MCP server to streamable_http.** Goose 1.x deprecated SSE
-   (`"SSE transport is no longer supported - kept only for config file
-   compatibility"` in `crates/goose/src/agents/extension.rs`). Our FastMCP
-   server at `internal/mcp/server.go` uses Streamable HTTP (official MCP SDK). Until
-   that's changed, the `homelab` MCP extension in Goose will fail to connect.
-   The developer extension (shell + edit) covers most ops without it; this is
-   a polish item, not a blocker.
-2. **Per-host OpenRouter keys** for billing attribution. Today all Hermes
-   hosts share one key.
-3. **Pin the model version** rather than tracking `nousresearch/hermes-4-405b`
-   directly — OpenRouter periodically rotates the underlying weights.
-4. **Local-inference fallback** (ollama / vllm) once the homelab has a GPU
-   node. The wrapper, persona, and MCP wiring stay unchanged; only
-   `GOOSE_PROVIDER`/`GOOSE_MODEL` change.
-
-7. **Caveman auto-setup via post-pull hook.** The sync timer now calls
-   `tools/post-pull.sh`, which runs any `tools/*.setup.sh` after git pull.
-   Currently this auto-installs the Caveman npm package, wrapper scripts, and
-   compact output templates on all agent hosts (*token efficiency*).
-
-## Changelog
-
-### 2026-06-01 — caveman + post-pull auto-setup
-Added `tools/post-pull.sh` sync hook that auto-runs `tools/*.setup.sh`
-after every git pull. First user: `tools/setup-caveman.sh` installed Caveman
-templating + `~/bin/caveman_wrapper.sh` + `~/templates/*.txt` for token-
-efficient CLI output. Replaces raw `git pull` in launchd/systemd timers.
-Also created `tools/caveman/` with the wrapper script, JS renderer, and
-templates — the canonical source for all agent hosts.
-Captures the Hermes-on-Goose onboarding flow added in the same commit as
-`bootstrap.sh --with-hermes`, `bin/hermes`, the sops rule for
-`secrets/openrouter-api-key.yaml`, and the `homelab client add --with-hermes`
-extension. MCP streamable_http migration is queued as follow-up #1.

.agents/shared/caveman.md

@@ -30,4 +30,4 @@ Code/commits/PRs: write normal. "stop caveman" or "normal mode": revert. Level p
 ---
 
 Source: https://github.com/JuliusBrussee/caveman
-Copy to `~/.hermes/skills/` for Hermes Agent, or `~/.claude/projects/<name>/SKILL.md` for Claude Code.
+Copy to `~/.nomos/skills/` for Nomos agent, or `~/.claude/projects/<name>/SKILL.md` for Claude Code.

.agents/skills/client-enrollment/SKILL.md

@@ -2,39 +2,46 @@
 name: client-enrollment
 risk_class: config_mutation
 inputs: [hostname, kind, role]
-verification: "homelab doctor (on the new client)"
+verification: "MCP whoami(hostname) shows the entity active"
 docs_update_checklist: [hosts_narrative_page_if_lxc_or_vm]
 ---
 
 # Client enrollment
 
 Goal: bring a new host (workstation, LXC, VM) into inventory and the
-secrets model, with mesh membership only where it's actually needed.
-This wraps the existing `homelab client add` flow — see
-[operations/agent-enrollment.md](../../operations/agent-enrollment.md) for
-the full walkthrough; this runbook is the risk/lifecycle framing.
+secrets model, with mesh membership only where it's actually needed. See
+[CLIENTS.md](../../../CLIENTS.md#enrollment) for the actual current
+flow and [operations/agent-enrollment.md](../../operations/agent-enrollment.md)
+for operational notes; this runbook is the risk/lifecycle framing.
 
-1. On any enrolled client: `homelab client add <hostname>` — appends a
-   `hosts.<name>:` block to `inventory.yaml` (lifecycle `state: planned`
-   → `provisioning`, per [seeds/ontology.yaml](../../../seeds/ontology.yaml)),
-   commits + pushes.
+1. The entity must exist in `planned`/`provisioning` state before the new
+   host can self-enroll — add a `hosts.<name>:` block to
+   `seeds/inventory.yaml` and `oikos seed` to ingest it (lifecycle
+   `planned` → `provisioning`, per
+   [seeds/ontology.yaml](../../../seeds/ontology.yaml)).
 2. Netbird join is **optional, not a required step** — only needed for
    hosts that must be reachable off-LAN (workstations that roam, e.g.
-   `republic-laptop`, `mac-mini`). A node reachable on the household LAN
-   (192.168.8.0/24 — most LXCs/VMs) doesn't need it: it's already
-   reachable directly, and off-LAN clients reach it too via hubris's
-   routed `192.168.8.0/24` Netbird network resource. Skip this step for
-   LAN-only nodes; do it (out-of-band, console or setup key) only for
-   hosts that need independent off-LAN reachability.
-3. On the new host: run `bootstrap.sh` (add `--with-hermes` to also
-   enroll the Hermes agent). This provisions `/etc/age/key.txt`, the
-   sync timer, and prints an age pubkey.
-4. Back on an enrolled client: `homelab client add <hostname>
-   --finalize-pubkey <age1...>` — sets `age_pubkey`, grants shared
-   secrets, re-keys SOPS, commits + pushes. This is the
-   `provisioning → active` transition.
-5. Verify: `homelab doctor` on the new client should show all checks
-   green (clone, sync timer, age key, CLI symlink, MCP reachable).
+   `mac-mini`). A node reachable on the household LAN (192.168.8.0/24 —
+   most LXCs/VMs) doesn't need it. Skip for LAN-only nodes; do it
+   (out-of-band, console or setup key) only for hosts that need
+   independent off-LAN reachability.
+3. On the new host: run `bootstrap.sh`. This calls
+   `POST /api/v1/clients/enroll`, which validates the entity exists and
+   the mesh IP is in an expected subnet, then returns an age keypair and
+   Infisical machine identity in one response — provisions
+   `/etc/age/key.txt`, `/etc/infisical/identity`, and the context poller.
+4. **Known gap, confirmed 2026-07-12: `provisioning → active` has no
+   working path.** `EnrollClient` (`internal/httpapi/impl.go`) sets the
+   entity's state to `provisioning`, never `active`. `bootstrap.sh` prints
+   `POST /api/v1/clients/ws:$HNAME/activate` as the next step, but that
+   route doesn't exist — `api/openapi.yaml` only has `/clients/enroll`,
+   `/clients/{slug}/context`, `/clients/{slug}/secrets`. Until this is
+   fixed (add the route, or use the generic entity PATCH to flip `state`),
+   a freshly-enrolled client is stuck in `provisioning` — MCP `preflight`
+   and policy's `lifecycle_overrides` for `provisioning` still apply, but
+   nothing transitions it onward automatically.
+5. Verify: MCP `whoami(hostname)` shows the entity in `active` state with
+   its peers and health.
 
 Docs-update checklist: if the new host is an LXC/VM, add its narrative
 page under `containers/` or `vms/` and set `doc_page` in its inventory

.agents/skills/config-change-deploy/SKILL.md

@@ -2,7 +2,7 @@
 name: config-change-deploy
 risk_class: config_mutation
 inputs: [service_name, change_description]
-verification: "curl -sf <service_url> (or homelab service <name> health)"
+verification: "curl -sf <service_url> (or MCP get_service_status)"
 docs_update_checklist: [doc_page, changelog]
 ---
 
@@ -11,11 +11,10 @@ docs_update_checklist: [doc_page, changelog]
 Goal: change a tracked config repo (Caddy, Gitea customizations, an app's
 own repo) and get it live, safely.
 
-1. `homelab change preflight <service>` — current health, the service's
-   `config_repo`, its risk class, and the verification command to run
-   after. If risk class requires approval (`config_mutation` or
-   `destructive`), stop and get operator sign-off before editing — see
-   `seeds/policy.yaml`.
+1. MCP `preflight` — current health, the service's `config_repo`, its
+   risk class, and the verification command to run after. If risk class
+   requires approval (`config_mutation` or `destructive`), stop and get
+   operator sign-off before editing — see `seeds/policy.yaml`.
 2. Clone/pull the `config_repo` (never edit the backend's working tree
    directly — tracked configs change by commit + push, per
    [OIKOS.md](../../OIKOS.md) conventions).
@@ -24,10 +23,10 @@ own repo) and get it live, safely.
    [infrastructure/auto-deploy.md](../../../archive/knowledge/infrastructure/auto-deploy.md) for
    the exact receiver/reload for this service).
 5. Run the preflight's verification command. If it fails, check
-   `homelab service <name> log` for the reload/restart error.
-6. Record the change: once `oikos/ledger.py` is wired into deploy tooling
-   (Week 3), this is automatic; until then, note the change and outcome
-   in the relevant investigation/plan doc.
+   MCP `tail_log` for the reload/restart error.
+6. No manual record-keeping step needed — mutations made through the API
+   (e.g. via the `run` MCP tool) are recorded automatically in the
+   `audit_log` table.
 
 Docs-update checklist: update the service's `doc_page` if the change
 alters its behavior, ingress route, or ownership; add a changelog entry

.agents/skills/docs-lint/lint.py

@@ -1,16 +1,17 @@
 #!/usr/bin/env python3
 """Lint committed docs against .agents/shared/writing-style.md.
 
-Checks two mechanical rules:
+Checks:
   1. Banned vocabulary (significance puffers, analytical verbs, poetic nouns,
      promotional adjectives, opening crutches).
   2. Broken relative markdown links.
+  3. Plan status consistency (status vs location vs index).
 
 Prose-voice rules are not machine-checkable; this covers the parts that are.
 Run from the repo root: python3 .agents/skills/docs-lint/lint.py [paths...]
 Exit 1 if any violation is found.
 """
-import os, re, sys
+import os, re, sys, glob
 
 BANNED = [
     "pivotal", "crucial", "vital", "groundbreaking", "transformative", "testament",
@@ -33,9 +34,125 @@ def iter_md(paths):
                 if f.endswith(".md"):
                     yield os.path.join(root, f)
 
+def check_plans():
+    """Check plan status consistency: active plans with 'Done' status, files
+    missing from index, dangling index entries, done files with wrong status."""
+    REPO = os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+    plans_dir = os.path.join(REPO, "plans")
+    done_dir = os.path.join(REPO, "plans", "done")
+    index_path = os.path.join(plans_dir, "index.md")
+
+    if not os.path.exists(index_path):
+        return 0
+
+    violations = 0
+    STATUS_RE = re.compile(r'^\*\*Status:\*\*\s*(.+)', re.I)
+
+    # Parse index.md for active and done entries
+    active_files = set()
+    done_files = set()
+    current_section = None
+    with open(index_path) as f:
+        for line in f:
+            if line.startswith("## Active"):
+                current_section = "active"
+                continue
+            if line.startswith("## Done"):
+                current_section = "done"
+                continue
+            if current_section == "active":
+                m = re.search(r'\]\(([^)]+)\)', line)
+                if m:
+                    active_files.add(m.group(1))
+            elif current_section == "done":
+                m = re.search(r'\]\(([^)]+)\)', line)
+                if m:
+                    done_files.add(m.group(1))
+
+    # Active plans on disk (not in done/, not index.md)
+    disk_active = set()
+    for f in glob.glob(os.path.join(plans_dir, "*.md")):
+        name = os.path.basename(f)
+        if name == "index.md":
+            continue
+        disk_active.add(name)
+
+    # Done plans on disk
+    disk_done = set()
+    if os.path.isdir(done_dir):
+        for f in glob.glob(os.path.join(done_dir, "*.md")):
+            disk_done.add("done/" + os.path.basename(f))
+
+    # Check 1: active plans on disk whose internal status is Done/Implemented/Complete
+    for name in disk_active:
+        fpath = os.path.join(plans_dir, name)
+        with open(fpath) as f:
+            for line_num, line in enumerate(f, 1):
+                if line_num > 5:
+                    break
+                m = STATUS_RE.match(line)
+                if m:
+                    status = m.group(1).strip().lower()
+                    done_keywords = ["done", "implemented", "complete", "completed"]
+                    if any(status.startswith(kw) for kw in done_keywords):
+                        print(f"{fpath}:{line_num}: status '{m.group(1).strip()}' — file is in plans/ but appears done; move to done/")
+                        violations += 1
+                    break
+
+    # Check 2: active plans on disk not in index
+    for name in sorted(disk_active):
+        if name not in active_files:
+            fpath = os.path.join(plans_dir, name)
+            print(f"{fpath}:1: not listed in plans/index.md Active table")
+            violations += 1
+
+    # Check 3: done plans on disk not in index
+    for name in sorted(disk_done):
+        if name not in done_files:
+            fpath = os.path.join(REPO, "plans", name)
+            print(f"{fpath}:1: not listed in plans/index.md Done table")
+            violations += 1
+
+    # Check 4: index entries with no file on disk
+    for name in sorted(active_files):
+        if name not in disk_active:
+            print(f"plans/index.md: active entry '{name}' — file not found on disk")
+            violations += 1
+
+    for name in sorted(done_files):
+        if name not in disk_done:
+            print(f"plans/index.md: done entry '{name}' — file not found on disk")
+            violations += 1
+
+    # Check 5: files in done/ whose internal status doesn't say Done
+    for name in disk_done:
+        fpath = os.path.join(REPO, "plans", name)
+        with open(fpath) as f:
+            found_status = False
+            for line_num, line in enumerate(f, 1):
+                if line_num > 5:
+                    break
+                m = STATUS_RE.match(line)
+                if m:
+                    found_status = True
+                    status = m.group(1).strip().lower()
+                    if not status.startswith("done"):
+                        print(f"{fpath}:{line_num}: status '{m.group(1).strip()}' — file is in done/ but status is not 'Done'")
+                        violations += 1
+                    break
+            if not found_status:
+                print(f"{fpath}:1: file is in done/ but has no Status header")
+                violations += 1
+
+    return violations
+
 def main(argv):
     paths = argv or ["knowledge", ".agents", "operations", "investigations", "plans"]
     violations = 0
+
+    if "plans" in paths or any(p.startswith("plans") for p in paths):
+        violations += check_plans()
+
     # The style guide and this skill enumerate the banned words by definition.
     ban_exempt = ("shared/writing-style.md", "skills/docs-lint/")
     for f in sorted(set(iter_md(paths))):

.agents/skills/incident-investigation/SKILL.md

@@ -10,22 +10,23 @@ docs_update_checklist: [investigations_entry]
 
 Goal: understand what broke and why, before touching anything.
 
-1. `homelab service <name> explain` (or `homelab node <name> relations`
-   if the affected entity is a host) — get the blast radius and doc
-   pointer first. Don't start pulling logs blind.
-2. `homelab service <name> health` + `homelab service <name> log` (or
-   MCP `get_service_status` / `tail_log`) for the affected service.
+1. MCP `explain` (or `get_blast_radius` if the affected entity is a
+   host) — get the blast radius and doc pointer first. Don't start
+   pulling logs blind.
+2. MCP `get_service_status` + `tail_log` for the affected service.
 3. Walk the blast radius: is a shared dependency down (`caddy`, `dns`,
-   `authentik`, or the backend host itself)? `homelab node <name>
-   relations` shows "affected by" — check those first.
-4. `homelab apt-audit` if the symptom looks like a dpkg/upgrade
-   interaction.
+   `authentik`, or the backend host itself)? MCP `get_blast_radius`
+   shows "affected by" — check those first.
+4. If the symptom looks like a dpkg/upgrade interaction, see
+   [runbook-dpkg-interrupted](../runbook-dpkg-interrupted/SKILL.md) —
+   there's no fleet-wide apt-audit tool anymore, check the host directly.
 5. Check the change ledger for recent mutations to the affected entity
-   or anything upstream of it: `homelab service <name> history` (once
-   populated) or grep `ledger/*.jsonl`.
-6. Write findings to a new `knowledge/sources/investigations/<date>-<slug>.md` — symptom,
-   timeline, root cause, fix applied, prevention. This is the durable
-   record; don't rely on chat history.
+   or anything upstream of it: MCP `get_change_history` or `get_audit_trail`.
+6. Write findings via MCP `upsert_knowledge` (`kind: investigation`) —
+   symptom, timeline, root cause, fix applied, prevention, `about` set to
+   the affected entity's slug. The DB is the durable record now, not a
+   markdown file — `search_knowledge`/`get_entity_knowledge` read it back;
+   a chat message alone is forgotten.
 
 Docs-update checklist: always create the investigation entry. If the
 root cause was stale/wrong inventory data (a `doc_page`, `config_repo`,

.agents/skills/lifecycle-activate-node/SKILL.md

@@ -2,7 +2,7 @@
 name: lifecycle-activate-node
 risk_class: config_mutation
 inputs: [node_name]
-verification: "homelab service <name> health (if it hosts a service); homelab doctor (if it's a client)"
+verification: "MCP get_service_status (if it hosts a service); MCP whoami (if it's a client)"
 docs_update_checklist: [doc_page_complete]
 transition: "provisioning -> active"
 ---
@@ -14,23 +14,22 @@ enrolled if it needs secrets, mesh joined if it needs off-LAN reach,
 ingress live if public, health check answering, doc page complete,
 ledger entry.
 
-1. If the node is a `homelab` client: finish enrollment per
-   [client-enrollment.md](../client-enrollment/SKILL.md) (`--finalize-pubkey`,
-   mesh join, `homelab doctor` green).
+1. If the node self-enrolls as a client: finish enrollment per
+   [CLIENTS.md](../../../CLIENTS.md#enrollment) (`bootstrap.sh` →
+   `/api/v1/clients/enroll`, mesh join, MCP `whoami` returns the entity).
 2. If it hosts a public service: add the `services:` entry in
-   `inventory.yaml` (backend, url, doc_page, config_repo, risk_notes —
-   see the Week-1 service contract fields) and wire the Caddy route in
-   `dtoro/caddy-conf`.
-3. Confirm the health check answers: `homelab service <name> health` or
-   a direct `curl`.
+   `seeds/inventory.yaml` (backend, url, doc_page, config_repo,
+   risk_notes) and wire the Caddy route in `dtoro/caddy-conf`.
+3. Confirm the health check answers: MCP `get_service_status` or a
+   direct `curl`.
 4. Flip `state: provisioning` → `state: active` (or delete the `state:`
-   field — `active` is the default) in `inventory.yaml`.
+   field — `active` is the default) in `seeds/inventory.yaml`, then
+   `oikos seed` to ingest.
 5. Complete the doc page (stub → full narrative: role, specs, how it's
    configured, dependencies).
-6. Record the activation: `oikos/ledger.py append host:<name> activate
-   config_mutation --result ok` (or let the CLI wrapper do this once
-   Week 3's runbook automation lands).
+6. No manual record-keeping step needed — the activation (via whatever
+   API call flipped the state) is recorded automatically in `audit_log`.
 
-Regenerate derived data: `python3 mcp/build_host_files.py && python3
-inventory.yaml` so `inventory.yaml`, the topology diagram, and
-the context card all reflect the new state.
+Regenerate: `oikos seed` re-ingests `seeds/inventory.yaml`; `oikos export`
+writes DB state back out to the YAML if you mutated via the API/MCP
+instead of editing the file directly.

.agents/skills/lifecycle-deprecate-node/SKILL.md

@@ -2,7 +2,7 @@
 name: lifecycle-deprecate-node
 risk_class: config_mutation
 inputs: [node_name, replacement_node_or_reason]
-verification: "homelab node <name> relations — 'affected by' must be empty before completing"
+verification: "MCP get_blast_radius — 'affected by' must be empty before completing"
 docs_update_checklist: [doc_page_deprecation_note]
 transition: "active -> deprecated"
 ---
@@ -16,14 +16,14 @@ suggestion; `seeds/policy.yaml` `lifecycle_overrides.deprecated.refuse`
 lists `new-inbound-edges` as refused going forward.
 
 1. Set `state: deprecated` on the node.
-2. `homelab node <name> relations` — read `affected_by`. Every entry
-   there is something still relying on this node.
+2. MCP `get_blast_radius` — read `affected_by`. Every entry there is
+   something still relying on this node.
 3. Migrate or retire each dependent one at a time (point its `backend`/
    `config_repo`/ingress route elsewhere, or deprecate it too if it's
    being retired alongside).
-4. Re-run `homelab node <name> relations` after each dependent is moved.
-   The transition to `destroyed` is only safe once `affected_by` is
-   empty — check this every time, don't assume from memory.
+4. Re-run MCP `get_blast_radius` after each dependent is moved. The
+   transition to `destroyed` is only safe once `affected_by` is empty —
+   check this every time, don't assume from memory.
 5. Note the deprecation on the doc page: reason, replacement (if any),
    date.
 

.agents/skills/lifecycle-destroy-node/SKILL.md

@@ -2,7 +2,7 @@
 name: lifecycle-destroy-node
 risk_class: destructive
 inputs: [node_name]
-verification: "homelab node <name> relations returns unknown-entity; pct list on the backend no longer shows it"
+verification: "MCP get_blast_radius returns unknown-entity; pct list on the backend no longer shows it"
 docs_update_checklist: [archaeology_entry, containers_index_update]
 transition: "deprecated -> destroyed"
 ---
@@ -15,28 +15,35 @@ recipients removed + re-keyed, ingress/DNS removed, archaeology entry,
 ledger entry.
 
 1. Confirm the node is `deprecated` with zero `affected_by` edges
-   (`homelab node <name> relations`) — do not skip this even if the
-   deprecation runbook was followed recently; state can drift.
-2. If it's an enrolled client: `homelab client remove <name>` — revokes
-   the age key, re-keys SOPS, removes the inventory entry. This is
-   already destructive-class and confirmed in the CLI.
+   (MCP `get_blast_radius`) — do not skip this even if the deprecation
+   runbook was followed recently; state can drift.
+2. **If it's an enrolled client: no current tool for revoking its age key /
+   removing its Infisical identity.** The old `homelab client remove`
+   (age key revocation + SOPS re-key + inventory removal, all one
+   destructive-class CLI call) is retired along with the rest of that CLI
+   and hasn't been re-verified against the current enrollment
+   architecture (`POST /api/v1/clients/enroll` + Infisical machine
+   identities) — see the "Open questions" section in
+   [agent-enrollment.md](../../operations/agent-enrollment.md). Until
+   that's confirmed, treat key/identity revocation as a manual step:
+   at minimum remove the client's `age_pubkey` from any SOPS recipient
+   lists and rotate credentials whose ciphertext it already decrypted.
 3. Remove any ingress route (Caddy config repo) and DNS record still
    pointing at it.
 4. Verify backups of anything on it are retained per policy before the
    disk goes away (see `backs-up-to`).
 5. Destroy the LXC/VM (`pct destroy` / `qm destroy`).
-6. Move the `hosts.<name>:` block (if any inventory remnant survives
-   `client remove`, e.g. infra-only LXCs with no age key) into
-   inventory.yaml's `archaeology:` section: `pve_id`, `destroyed` date,
-   `reason`. Add a row to `containers/index.md` "Recently destroyed"
-   table (kept for human-readable browsing alongside the structured
-   data).
-7. `oikos/ledger.py append host:<name> destroy destructive --result ok`.
-8. Regenerate: `python3 mcp/build_host_files.py && python3
-   inventory.yaml` — the node drops out of `inventory.yaml` and
-   appears in the topology doc's archaeology table.
+6. Update the entity's `state` to `destroyed` in `seeds/inventory.yaml`
+   (or move it to an `archaeology:`-style section if the schema still has
+   one) — `pve_id`, `destroyed` date, `reason` — then `oikos seed` to
+   ingest. Add a row to `containers/index.md` "Recently destroyed" table
+   (kept for human-readable browsing alongside the structured data).
+7. No manual ledger step — mutations through the API are recorded
+   automatically in the `audit_log` table (MCP `get_audit_trail`,
+   `get_change_history`). The old `oikos/ledger.py append` was retired
+   when this became automatic.
 
-If the destroy fails partway (e.g. secrets revoked but pct destroy
-errors), do not re-run step 2 — `client remove` is not idempotent
-against a second revocation attempt on the issuance server. Finish the
-remaining steps manually and note the partial state in an investigation.
+If the destroy fails partway (e.g. secrets not fully revoked but pct
+destroy errors), finish the remaining steps manually and note the
+partial state in an investigation (MCP `upsert_knowledge`,
+`kind: investigation`).

.agents/skills/lifecycle-migrate-node/SKILL.md

@@ -2,7 +2,7 @@
 name: lifecycle-migrate-node
 risk_class: config_mutation
 inputs: [node_name, source_host, target_host]
-verification: "homelab node <name> relations (re-check blast radius); homelab service <svc> health for every hosted service"
+verification: "MCP get_blast_radius (re-check blast radius); MCP get_service_status for every hosted service"
 docs_update_checklist: [doc_page_migration_note, inventory_host_and_lan_ip]
 transition: "active -> migrating -> active"
 ---
@@ -10,12 +10,12 @@ transition: "active -> migrating -> active"
 # Lifecycle: migrate a node
 
 Modeled on the strong Phase 1+2 migration
-([plans/2026-06-03_110000-library-ssd-migration-to-ludo-mini.md](../../../.hermes/plans/2026-06-03_110000-library-ssd-migration-to-ludo-mini.md)).
+([archive/hermes-plans/2026-06-03_110000-library-ssd-migration-to-ludo-mini.md](../../../archive/hermes-plans/2026-06-03_110000-library-ssd-migration-to-ludo-mini.md)).
 Requires (ontology): preflight + backup-verified before migrating;
 post-verify + Caddy backends checked + mounts checked + docs updated
 before returning to `active`.
 
-1. `homelab change preflight <every service the node hosts>` — capture
+1. MCP `preflight` for every service the node hosts — capture
    current health as a baseline.
 2. Verify backups are current for anything with data at rest on the
    node (see `backs-up-to` edges once populated).
@@ -29,11 +29,12 @@ before returning to `active`.
 6. Post-verify: re-run the Week-1 drift check by hand — confirm Caddy's
    backend IP for each affected service matches the new `lan_ip`
    (automatic in Week 3's drift detector), confirm mounts still resolve.
-7. `homelab service <name> health` for every service the node hosts.
+7. MCP `get_service_status` for every service the node hosts.
 8. Set `state: active`. Add a migration note to the node's doc page
    (old host/IP → new, date, phase reference) — this repo's convention
    for every past migration (see `archive/knowledge/containers/101-jellyfin.md`,
    `containers/129-house.md`).
 
-Regenerate: `python3 mcp/build_host_files.py && python3
-inventory.yaml`.
+Regenerate: `oikos seed` (re-ingests `seeds/inventory.yaml` into the DB —
+the DB is authoritative at runtime, the YAML is the source of truth
+on disk).

.agents/skills/lifecycle-provision-node/SKILL.md

@@ -21,10 +21,12 @@ chosen, doc page stub.
    `qm create`), choosing the storage pool deliberately — record it as
    the `storage:` field once populated (Week 1 schema; not yet backfilled
    for existing nodes).
-2. Add the inventory entry: `homelab client add <name>` for anything that
-   will run the `homelab` CLI, or a direct `hosts.<name>:` block with
-   `state: provisioning`, `kind`, `host`, `pve_id`, `lan_ip` for
-   infra-only LXCs that won't self-enroll.
+2. Add the inventory entry: a `hosts.<name>:` block in
+   `seeds/inventory.yaml` with `state: provisioning`, `kind`, `host`,
+   `pve_id`, `lan_ip`, then `oikos seed` to ingest it. For anything that
+   will self-enroll as a client afterward (see
+   [CLIENTS.md](../../../CLIENTS.md#enrollment)), the entity must exist in
+   `planned`/`provisioning` state before `bootstrap.sh` runs there.
 3. Stub the doc page (`containers/<pve_id>-<name>.md` or
    `vms/<pve_id>-<name>.md`) — even a one-line "provisioning, see plan X"
    is enough to satisfy the transition requirement.

.agents/skills/runbook-budget-from-csv/SKILL.md

@@ -18,7 +18,7 @@ summarised into targets and fixed costs.
 - `yuvomi-mcp` is running on LXC 129 and connected as an MCP server in Claude.
 - The CSV is an N26 export (columns: Booking Date, Value Date, Partner Name,
   Partner Iban, Type, Payment Reference, Account Name, Amount (EUR), …).
-- API token: `homelab secret yuvomi-api-token` (decrypts on any enrolled client).
+- API token: `yuvomi-api-token`, via Infisical (primary) or `oikos secret` (SOPS fallback).
 - Direct API base: `https://house.hubris.network/api/v1`
 
 ---

.agents/skills/runbook-dpkg-interrupted/SKILL.md

@@ -13,7 +13,8 @@ has packages that are **unpacked but not configured**. Symptoms:
   manually run 'dpkg --configure -a' to correct the problem.`
 - `dpkg --audit` lists packages with header
   `The following packages have been unpacked but not yet configured.`
-- `homelab apt-audit` shows `DPKG: DIRTY(N)` for the host.
+- `dpkg --audit` on the host directly shows unpacked-not-configured packages
+  (there's no fleet-wide audit tool anymore — check per-host).
 
 The system is still running the **old** binaries (still in memory), but the
 **new** binaries are unpacked and waiting for their postinst to run. Two
@@ -33,19 +34,20 @@ config dirs, capabilities, etc.). The system might not come back up cleanly.
 ## Path A — target is still reachable over ssh (preferred)
 
 ```
-homelab ssh <host> -- bash -c 'DEBIAN_FRONTEND=noninteractive dpkg --configure -a && apt -y -o Dpkg::Options::=--force-confold upgrade'
+ssh <host> -- bash -c 'DEBIAN_FRONTEND=noninteractive dpkg --configure -a && apt -y -o Dpkg::Options::=--force-confold upgrade'
 ```
 
-Or for an LXC by name:
+Or for an LXC by name (via the MCP `run` tool, or directly on the Proxmox
+host):
 
 ```
-homelab pct <lxc> exec -- bash -c 'DEBIAN_FRONTEND=noninteractive dpkg --configure -a && apt -y -o Dpkg::Options::=--force-confold upgrade'
+pct exec <lxc> -- bash -c 'DEBIAN_FRONTEND=noninteractive dpkg --configure -a && apt -y -o Dpkg::Options::=--force-confold upgrade'
 ```
 
 When that returns, confirm:
 
 ```
-homelab apt-audit --target <host>
+ssh <host> -- dpkg --audit
 ```
 
 Expect `DPKG: ok` and the remaining `UPGR` count to match what's intentionally
@@ -89,10 +91,11 @@ DEBIAN_FRONTEND=noninteractive dpkg --configure -a \
 
 ## Prevention
 
-The `homelab apt-upgrade` wrapper launches apt inside a `systemd-run --collect`
-unit on the target, so it survives ssh teardown — the failure mode that put
-hubris into this state in the first place is no longer reachable through the
-standard tool. If you absolutely need to run apt manually over ssh, wrap it:
+The old `homelab apt-upgrade` wrapper (retired along with the rest of the
+`homelab` CLI) used to launch apt inside a `systemd-run --collect` unit on
+the target so it survived ssh teardown — that's the failure mode that put
+hubris into this state in the first place. There's no fleet-wide wrapper
+anymore; if you run apt manually over ssh, wrap it yourself the same way:
 
 ```
 ssh <host> systemd-run --unit=apt-recovery --collect bash -c 'apt -y upgrade'

.agents/skills/service-health-check/SKILL.md

@@ -2,7 +2,7 @@
 name: service-health-check
 risk_class: read_only
 inputs: [service_name]
-verification: "homelab service <name> health"
+verification: "MCP get_service_status"
 docs_update_checklist: []
 ---
 
@@ -10,15 +10,15 @@ docs_update_checklist: []
 
 Goal: determine whether a service is actually healthy, without ad-hoc SSH.
 
-1. `homelab service <name> explain` — read the context card: backend,
-   blast radius, doc pointer, risk notes.
-2. `homelab service <name> health` — live health probe (HTTP code against
-   the service's `url`/`endpoint`). Once the Week-3 scheduler ships, this
-   reads a cached snapshot by default; pass `--live` to force a fresh probe.
-3. If unhealthy, `homelab service <name> log` (or MCP `tail_log`) for the
-   last 200 lines.
-4. Cross-check blast radius: `homelab node <name> relations` — is this
-   entity's own backend host healthy? A downstream failure (e.g. `strong`
+1. MCP `explain` — read the context card: backend, blast radius, doc
+   pointer, risk notes.
+2. MCP `get_service_status` — live health probe (HTTP code against the
+   service's `url`/`endpoint`); the scheduler also probes on its own
+   interval, so this may reflect a recent cached result, not necessarily
+   a fresh one.
+3. If unhealthy, `tail_log` for the last 200 lines.
+4. Cross-check blast radius: MCP `get_blast_radius` — is this entity's
+   own backend host healthy? A downstream failure (e.g. a Proxmox host
    down) will show up here before the service's own logs explain anything.
 5. If the fix is a restart: classify first (`seeds/policy.yaml` —
    `service-restart` is `reversible_low` unless the service has a

.agents/skills/session-review/SKILL.md

@@ -0,0 +1,82 @@
+---
+name: session-review
+description: "Examine a Nomos chat session, compare the user's objective with the actual outcome, identify causes of failure (missing tools, excessive tool calls, blocked actions, model behavior), and propose concrete fixes."
+risk_class: reversible_low
+inputs: [session_id]
+---
+# Session review
+
+Analyze Nomos chat sessions from the live database, diff objectives
+against outcomes, and propose fixes.
+
+## 1. Retrieve session data
+
+```bash
+# List recent sessions
+curl -s http://localhost:8092/sessions | jq '.sessions[:5]'
+
+# Fetch one session with messages
+curl -s http://localhost:8092/sessions/{session_id} | jq .
+```
+
+## 2. Classify the session
+
+For each session determine:
+
+| Dimension | Check |
+|-----------|-------|
+| Objective | What was the user trying to accomplish? |
+| Outcome | Was it achieved? (read final assistant text) |
+| Tool calls | Count, unique tools, redundancy (e.g., N+1 fan-out) |
+| Blockers | Missing action? Missing tool? Model refusal? Empty response? |
+| User frustration | Did the user need to clarify/correct/repeat? |
+| Message sizes | Content blob sizes — truncation needed? |
+
+## 3. Key failure signatures
+
+| Signature | Root cause | Fix |
+|-----------|-----------|-----|
+| Agent: "I can't run X — only supports Y" | Missing action in `request_execution` | Add action in `internal/mcp/server.go` |
+| Agent: "No local knowledge on that" + no web tool | Missing `http_get` / web fetch MCP tool | Add MCP tool |
+| Empty assistant bubble (text="", no tools) | Model returned blank completion | Retry + error surfacing |
+| Non-English boilerplate refusal | Flash-tier model degradation | Response quality guard |
+| >30 tool calls per turn, same tool repeated | N+1 fan-out instead of bulk tool | Enrich bulk tools + tighten SOUL.md |
+| Message >50KB in DB | Raw tool results persisted verbatim | Truncation in `store.go` |
+
+## 4. Extract patterns across sessions
+
+```bash
+# All sessions summary
+curl -s http://localhost:8092/sessions | jq -r '.sessions[] | "\(.id[:8]) \(.title[:80]) \(.created_at[:16])"'
+
+# Message count + tool count per session
+for id in $(curl -s http://localhost:8092/sessions | jq -r '.sessions[].id'); do
+  msgs=$(curl -s "http://localhost:8092/sessions/$id" | jq '.messages | length')
+  tools=$(curl -s "http://localhost:8092/sessions/$id" | jq '[.messages[].content.tool_calls | length] | add')
+  echo "$id $msgs msgs $tools tools"
+done
+```
+
+## 5. Output format
+
+```
+Session: {id[:8]} — "{title[:60]}"
+  Messages: {N} ({user}/{assistant})
+  Tool calls: {total} across {turns} turns
+  Top tools: {name:count, name:count, ...}
+  Objective: {one-line summary}
+  Outcome: ✅ / ❌ / ⚠️
+  Blockers: {list or "none"}
+  Fixes needed: {concrete actions}
+  Severity: blocker | friction | cosmetic
+```
+
+## Related files
+
+- `cmd/nomos/agent.go` — agent loop, tool building, response guards
+- `cmd/nomos/store.go` — session + message persistence
+- `internal/mcp/server.go` — all tool implementations including `request_execution`
+- `web/src/lib/components/ToolCallGroup.svelte` — tool result display
+- `nomos/SOUL.md` — agent persona and tool selection rules
+- `plans/2026-07-09-chat-sessions-improvements.md` — prior session findings
+- `plans/2026-07-09-session-execution-and-ux-fixes.md` — latest plan

.claude/launch.json

@@ -0,0 +1,11 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "web",
+      "runtimeExecutable": "npm",
+      "runtimeArgs": ["--prefix", "web", "run", "dev"],
+      "port": 5173
+    }
+  ]
+}

.gitea/workflows/desktop.yml

@@ -0,0 +1,98 @@
+name: Desktop App
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - 'desktop-*'
+      - 'v[0-9]+.[0-9]+.[0-9]*'
+
+jobs:
+  build-ui:
+    name: Build SPA
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: web/package-lock.json
+      - run: npm ci
+        working-directory: web
+      - run: npm run build
+        working-directory: web
+      - uses: actions/upload-artifact@v4
+        with:
+          name: spa-dist
+          path: web/dist/
+
+  build-macos-arm64:
+    name: macOS (arm64)
+    needs: build-ui
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: spa-dist
+          path: cmd/desktop/frontend/dist/
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.26'
+      - run: go install github.com/wailsapp/wails/v3/cmd/wails3@latest
+      - run: wails3 build -clean
+        working-directory: cmd/desktop
+        env:
+          CGO_ENABLED: 1
+      - run: |
+          cd cmd/desktop/build/bin
+          zip -r oikos-desktop-darwin-arm64.zip oikos-desktop.app
+      - uses: actions/upload-artifact@v4
+        with:
+          name: oikos-desktop-darwin-arm64
+          path: cmd/desktop/build/bin/oikos-desktop-darwin-arm64.zip
+
+  build-linux-amd64:
+    name: Linux (amd64)
+    needs: build-ui
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: spa-dist
+          path: cmd/desktop/frontend/dist/
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.26'
+      - run: sudo apt-get update && sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev
+      - run: go install github.com/wailsapp/wails/v3/cmd/wails3@latest
+      - run: wails3 build -clean
+        working-directory: cmd/desktop
+        env:
+          CGO_ENABLED: 1
+      - uses: actions/upload-artifact@v4
+        with:
+          name: oikos-desktop-linux-amd64
+          path: cmd/desktop/build/bin/oikos-desktop
+
+  release:
+    name: Create Release
+    needs: [build-macos-arm64, build-linux-amd64]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: oikos-desktop-darwin-arm64
+      - uses: actions/download-artifact@v4
+        with:
+          name: oikos-desktop-linux-amd64
+      - name: Release
+        uses: https://gitea.com/actions/release-action@v1
+        with:
+          files: |
+            oikos-desktop-darwin-arm64.zip
+            oikos-desktop-linux-amd64
+          api_key: ${{ secrets.GITEA_TOKEN }}

.gitignore

@@ -2,18 +2,23 @@
 __pycache__/
 *.pyc
 
-# Regenerated every scheduler run; ephemeral health-probe cache.
-oikos/state.json
-
-# Compiled binaries (Go rewrite — bin/oikos, bin/hermes)
+# Compiled binaries (Go rewrite — bin/oikos, bin/nomos)
 bin/oikos
-bin/hermes
-oikos/oikos
+bin/nomos
+oikos
+webhook
 
-# Legacy Python oikos (superseded by cmd/oikos Go binary — Phase 1-6 rewrite).
-# oikos/ kernel files are still imported by bin/homelab for operational CLI
-# commands (ssh, pct, logs, restart, status, open, secret, client, sync, mcp).
-# Remove oikos/* when bin/homelab is ported to Go.
 backups/
 .env
 .infisical-credentials
+
+# Web UI (Svelte 5) — build artifacts. The SPA is a standalone static build,
+# deployed separately from the oikos binary (plans/2026-07-12-wails-desktop-app.md
+# 0.1), so the output dir is just a build artifact.
+web/dist/
+web/node_modules/
+
+# Wails desktop app — frontend copy for embedding
+cmd/desktop/frontend/dist/
+cmd/desktop/build/
+cmd/desktop/oikos-desktop

.sops.yaml

@@ -86,11 +86,11 @@ creation_rules:
       age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs
 
   - path_regex: archive/secrets-sops-backupopenrouter-api-key\.yaml$
-    # OpenRouter API key consumed by the `hermes` wrapper (bin/hermes) when
+    # OpenRouter API key consumed by the `nomos` wrapper (bin/nomos) when
     # spawning a Goose session. Recipients are any host that should run a
-    # Nous-Hermes agent. Add a host's age_pubkey here, then
+    # Nomos agent. Add a host's age_pubkey here, then
     # `sops updatekeys -y secrets/openrouter-api-key.yaml`.
-    # See operations/hermes-agent.md.
+    # See operations/nomos-agent.md.
     age: >-
       age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
       age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6,

AGENTS.md

@@ -34,7 +34,8 @@ Run `hostname` (Linux) or `scutil --get LocalHostName` (macOS), then read:
 
 That file tells you your role, your peers, what's mounted, and what services
 you host. If it does not exist, this client was not enrolled — stop and tell
-the operator to run `homelab client add <hostname>` from an existing client.
+the operator; see [CLIENTS.md](CLIENTS.md#enrollment) for the enrollment flow
+(the entity needs to exist in `planned`/`provisioning` state first).
 
 ## 2. The topology
 
@@ -49,17 +50,24 @@ the operator to run `homelab client add <hostname>` from an existing client.
 ## 3. The MCP server
 
 The homelab exposes a Model Context Protocol server with structured tools.
-Endpoint: `https://mcp.hubris.network/mcp`.
+Endpoint: `https://mcp.hubris.network/mcp`. Every call needs
+`Authorization: Bearer <token>` — the API has no unauthenticated path except
+enrollment and `/healthz` (see "Authentication" below for where the token
+comes from).
 
-Available tools (21 total):
+Available tools (33 total):
 
   Context — observe + orient:
     get_entity(slug), list_entities(type, limit, cursor),
     get_relations(entity), get_blast_radius(entity),
     search_knowledge(query) — ILIKE search over documents, investigations,
       runbooks in the knowledge_entities table
+    get_entity_knowledge(entity_slug) — every document, investigation, and
+      runbook linked to one entity, in one call
     get_patterns(status, entity_type, action) — learned action patterns
     get_skills(status) — available automation skills
+    http_get(url) — fetch a public page/raw file (e.g. researching how to
+      deploy something before provisioning it); HTTP/HTTPS only, ~16KB cap
 
   Management — live state:
     get_service_status(service_slug) — systemctl is-active on target host
@@ -67,6 +75,8 @@ Available tools (21 total):
     list_lxcs() — all LXC containers with ID, host, IP, health
     get_lxc_state(lxc_slug) — pct status from Proxmox host
     ping_service(service_slug) — HTTP reachability from entity_status
+    list_my_secrets(caller_pubkey) — secrets accessible to this client by
+      age public key
 
   Oikos — decisions:
     explain(service_slug) — compact context card (type, state, health, relations)
@@ -84,11 +94,27 @@ Available tools (21 total):
     get_trend(entity_id, days=7) — metric slope over time
     get_event_timeline(severity, entity_slug, limit) — recent events
 
-  Execution — the single mutation path:
-    request_execution(target, action, params) — policy-gated.
-      reversible_low (restart, reload, pct_exec, apt audit) runs immediately;
-      config_mutation (systemctl enable/disable, apt upgrade) queues for operator
-      approval via Matrix, then executes on ✅.
+  Knowledge — keep the graph current (none require approval; this updates
+  the knowledge graph, not live infrastructure):
+    upsert_knowledge(title, content) — record what you learned after solving
+      a non-obvious problem; the only way anything persists past a session
+    update_entity_attributes(slug, attributes) — merge a discovered fact
+      (IP, version, port, ...) into an entity so a future task doesn't
+      rediscover it from scratch
+    create_relationship(source, target, type) — record a discovered edge
+      (depends-on, hosts, routes-to, ...) between two entities
+
+  Execution — mutating the live infrastructure:
+    run(target, command) — the general execution primitive. Run any shell
+      command against a host or LXC; every command is auto-classified —
+      read-only inspection runs immediately, anything state-changing needs
+      operator approval, and destructive patterns (rm -rf, dd, mkfs,
+      pct/qm destroy, DROP TABLE, reboot, curl-pipe-to-shell, ...) always
+      need approval regardless of what you declare. Prefer this over
+      request_execution for anything not already covered by its fixed enum.
+    request_execution(target, action, params) — the older, fixed-enum path
+      (restart, systemctl, pct_exec, apt_upgrade, pct_create). Still the
+      route for those specific actions; policy-gated the same way `run` is.
     get_execution_status(execution_id) — poll progress
 
 **When to prefer MCP over grepping the clone:** always for knowledge queries.
@@ -97,7 +123,18 @@ the DB with entity links. `get_entity_knowledge("lxc:jellyfin")` returns documen
 runbooks, and investigations in one call. Grep the clone only when MCP is
 unreachable.
 
-## 4. Knowledge conventions
+## 4. Authentication
+
+Every API/MCP route requires `Authorization: Bearer <token>` except
+`POST /api/v1/clients/enroll` and `/healthz`. Enrollment (see
+[CLIENTS.md](CLIENTS.md#enrollment)) does not currently issue a per-client
+API/MCP bearer token — there is one shared
+secret (`OIKOS_MCP_BEARER_TOKEN`, validated in `internal/httpapi/server.go`'s
+`combinedAuth`); get it from the operator until per-client token issuance
+exists. The SPA has its own flow instead: a first-launch Config screen that
+stores a token in `localStorage` (see `web/src/pages/Config.svelte`).
+
+## 5. Knowledge conventions
 
 All narrative knowledge (documents, investigations, runbooks) lives in the DB
 (`knowledge_entities` table) and is seeded from `seeds/knowledge.yaml`. Agents
@@ -122,47 +159,52 @@ per the DB-as-source-of-truth plan.
   running state, update the DB *in the same session* via the API. The `oikos export`
   command regenerates `seeds/knowledge.yaml` for version control.
 
-## 5. Acting on the homelab
+## 6. Acting on the homelab
 
-- **Read state**: use MCP tools. Hermes (the AI agent) is the primary
-  operator interface — it has 21 MCP tools for observe/orient/decide/act.
-- **Actions** (restart, logs, apt, pct exec): Hermes calls `request_execution`
-  via MCP. `reversible_low` actions execute immediately; `config_mutation`
-  and `destructive` actions are queued for operator approval via Matrix.
-- **Secrets**: managed by Infisical (`oikos secret` subcommand for migration).
-  Never hardcode secrets — use env vars from `.env`.
+- **Read state**: use MCP tools. Nomos (the AI agent) is the primary
+  operator interface — it has 33 MCP tools for observe/orient/decide/act
+  (§3).
+- **Actions** (restart, logs, apt, pct exec, or anything else): Nomos calls
+  `run` (the general execution primitive) or `request_execution` (the older
+  fixed-enum path) via MCP. `reversible_low`/read-only actions execute
+  immediately; `config_mutation` and `destructive` actions are queued for
+  operator approval via Matrix or the control-room UI's Operations page.
+- **Secrets**: managed by Infisical (`oikos secret` subcommand for
+  migration). Never hardcode secrets — use env vars from `.env`.
 - **Mutations** (restart, edit configs, etc.): classified against
   `seeds/policy.yaml`. `reversible_low` actions auto-execute;
-  `config_mutation`/`destructive` actions require approval.
-  a valid `--approval-id` from `homelab approval request` — see OIKOS.md.
+  `config_mutation`/`destructive` actions require approval — granted by
+  the operator via Matrix reply or the control-room UI, not a CLI flag.
+  See OIKOS.md.
 
-## 6. Communication mode
+## 7. Communication mode
 
 Read and apply `/opt/homelab-context/.agents/shared/caveman.md` (if present). It defines the lab's
 terse-communication standard — drop filler, keep substance, use fragments.
 
-## 7. Auto-setup mechanism
+## 8. Auto-setup mechanism
 
 The homelab-context repo ships tooling that gets automatically installed
 on every client after `git pull`. This is handled by `tools/post-pull.sh`
 (replaces the raw git pull in the sync timer) which runs any script matching
-`tools/*.setup.sh` after pull.
+`tools/setup-*.sh` after pull.
 
 Currently auto-setup:
-- **Caveman + templates** (`tools/setup-caveman.sh`): Installs Caveman npm
-  package, wrapper scripts, and compact output templates for token-efficient
-  CLI output. Wrapper at `~/bin/caveman_wrapper.sh`.
-- **Hermes agent persona** (`tools/setup-hermes-soul.sh`): Provisions
-  `~/.hermes/SOUL.md` from `HERMES.md` on Hermes agents. This ensures every
-  Hermes agent follows the canonical homelab persona (token efficiency, source
-  of truth hierarchy). No-op on non-Hermes agents.
+- **Host checks** (`tools/setup-checks.sh`): Deploys `checks/install.sh`'s
+  health-check scripts to `/opt/oikos/checks` on each host. The scheduler's
+  `ssh-script` check kind depends on these actually being there — 20 are
+  live in the DB as of 2026-07-12.
 
-To add a new auto-setup, create `tools/<name>.setup.sh` in the repo,
+To add a new auto-setup, create `tools/setup-<name>.sh` in the repo,
 commit and push. All enrolled clients pick it up within 5 minutes.
 
-To trigger sync manually: `sudo homelab sync` or wait for the 5-min timer.
+To trigger sync manually: run `/opt/homelab/tools/context-poller.sh`, or
+wait for the 5-min timer. (This mechanism — and the server-side
+`tools_changed` detection behind it — only correctly recognized
+`setup-*.sh` scripts as of 2026-07-12; before that it silently matched
+nothing, so nothing auto-ran on any client via this path.)
 
-## 8. When in doubt
+## 9. When in doubt
 
 Use MCP tools: `search_knowledge <query>` for narrative context,
 `get_entity <slug>` for structured data, `get_entity_knowledge <slug>` for

CLIENTS.md

@@ -24,9 +24,22 @@ Docker stack on mac-mini and exposes an MCP server + REST API.
 | State snapshot (health, disk, drift) | MCP `get_state_snapshot` |
 | Secrets (Infisical) | REST API + `oikos secret` CLI |
 | Approval tokens | Matrix via notifier |
+| Run a command on a host/LXC (policy-gated) | MCP `run` |
+| Record a discovered fact/relationship | MCP `update_entity_attributes`, `create_relationship`, `upsert_knowledge` |
 
-All MCP tools are read-only. Mutations use the `homelab` CLI with operator
-approval.
+Most MCP tools are read-only; a few mutate the knowledge graph (recording
+what you learned) or the live infrastructure (`run`, `request_execution`),
+gated by risk classification and — for `config_mutation`/`destructive`
+actions — operator approval. See [AGENTS.md](AGENTS.md#3-the-mcp-server) for
+the full tool catalog.
+
+## Authentication
+
+Every API/MCP call needs `Authorization: Bearer <token>` — there is no
+unauthenticated path except `POST /api/v1/clients/enroll` and `/healthz`.
+Enrollment (below) does not currently hand out a per-client bearer token;
+get the shared `OIKOS_MCP_BEARER_TOKEN` from the operator until per-client
+token issuance exists.
 
 ## Enrollment
 
@@ -41,7 +54,6 @@ curl -fsSL https://git.hubris.network/dtoro/oikos/raw/main/bootstrap.sh | sudo b
 
 # Or with optional tooling:
 curl ... | sudo bash -s -- --with-mcp      # wire Claude's MCP config
-curl ... | sudo bash -s -- --with-hermes   # install Goose + Hermes
 ```
 
 This calls `POST /api/v1/clients/enroll` on the Oikos API, which:
@@ -56,7 +68,7 @@ This calls `POST /api/v1/clients/enroll` on the Oikos API, which:
 ### What changes on your machine
 
 - `/opt/homelab/` — agent orientation files (CLIENTS.md, AGENTS.md, OIKOS.md)
-- `/opt/homelab/tools/` — tooling scripts (caveman, hermes-soul)
+- `/opt/homelab/tools/` — tooling scripts (checks)
 - `/etc/age/key.txt` — age private key for SOPS decryption (fallback)
 - `/etc/infisical/identity` — Infisical machine identity (primary secrets)
 - Context poller — launchd/systemd timer hits `GET /api/v1/clients/{slug}/context` every 5 minutes for agent file updates

CONTRIBUTING.md

@@ -9,10 +9,13 @@ repo, see [.agents/dev/CONTRIBUTING.md](.agents/dev/CONTRIBUTING.md).
 - **Go 1.26+** (see `go.mod` for pinned version)
 - **PostgreSQL with TimescaleDB** — the compose stack includes `timescale/timescaledb:2.17.2-pg16`
 - **Docker** for the full dev stack
+- **Node 22+** for `web/` (the control-room SPA — standalone, not part of the
+  compose stack or the `oikos` binary)
 
 ```bash
-# Start dependencies (Postgres + Redis)
-docker compose --profile dev up -d
+# Start dependencies (Postgres + Redis). api/nomos require a shared bearer
+# token — no dev-open bypass — so set one even for local dev.
+OIKOS_MCP_BEARER_TOKEN=dev-token docker compose --profile dev up -d
 
 # Run all tests
 make test
@@ -22,13 +25,21 @@ make test-db
 
 # Build the binary
 make build
+
+# SPA dev server (proxies to api/nomos, injecting the same token)
+cd web && OIKOS_API_TOKEN=dev-token npm run dev
 ```
 
 ## Project structure
 
 ```
+cmd/desktop/        Wails v3 desktop app (macOS + Linux)
+  main.go            Thin shell: webview, system tray, notifications, auto-update
+  wails.json         Wails project config
+  entitlements.plist macOS code-signing entitlements
 cmd/oikos/          Single-binary entry point
-cmd/hermes/         Hermes MCP client gateway
+cmd/nomos/          Nomos MCP client gateway
+cmd/webhook/        Gitea deploy-webhook receiver (push-to-deploy on mac-mini)
 internal/           All Go packages
   httpapi/          REST + MCP server (OpenAPI-generated)
   mcp/              MCP tool implementations
@@ -42,15 +53,20 @@ internal/           All Go packages
   domain/           Core types: entities, approvals, signals, patterns
   ontology/         Type hierarchy, relationship validation
   knowledge/        Knowledge YAML seed ingestion
+web/                Control-room SPA (Svelte 5) — standalone, not embedded
+                    in the oikos binary; see plans/2026-07-12-wails-desktop-app.md
 api/openapi.yaml    API contract — the source of truth for endpoints
 migrations/         Forward-only SQL migrations (TimescaleDB)
 seeds/              Bootstrap YAML: ontology, inventory, policy, knowledge
 compose/            Dockerfiles + Caddy config
 scripts/            Deploy, watchdog, rollback
-hermes/             Hermes config, persona, skills
+checks/             Host health-check scripts run over SSH by the scheduler
+tools/              Client auto-setup scripts (checks)
+nomos/              Nomos config, persona, skills
 .agents/            Agent instruction files + skills
 plans/              Design documents
 docs/adr/           Architecture decision records
+docs/operations/    Runbooks (rollback, etc.)
 ```
 
 ## Commands
@@ -68,6 +84,12 @@ docs/adr/           Architecture decision records
 | `make export` | Export DB state to YAML seeds |
 | `make dev` | Start compose dev stack |
 | `make clean` | Remove binary + test cache |
+| `make ui` | Build the SPA (`web/dist/`) |
+| `make deploy-ui` | Build + deploy the SPA to the Caddy host |
+| `make desktop` | Build the Wails desktop app for the current platform |
+| `make desktop-package` | Build + package (zip on macOS, tar.gz on Linux) |
+| `make webhook` | Build `cmd/webhook` (deploy-webhook receiver) |
+| `make tidy` | `go mod tidy` |
 
 ## Conventions
 

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build test test-db lint generate generate-check dev migrate seed export clean tidy
+.PHONY: build webhook test test-db lint generate generate-check dev migrate seed export clean tidy ui desktop desktop-package desktop-release
 
 BINARY := oikos
 GO ?= go
@@ -6,6 +6,9 @@ GO ?= go
 build:
 	$(GO) build -o $(BINARY) -tags timetzdata ./cmd/oikos
 
+webhook:
+	$(GO) build -o webhook -tags timetzdata ./cmd/webhook
+
 test:
 	$(GO) test -race -cover ./...
 
@@ -42,8 +45,36 @@ export:
 dev:
 	docker compose --profile dev up -d
 
+# Local sanity-check build of the SPA. Not embedded in the oikos binary
+# (plans/2026-07-12-wails-desktop-app.md 0.1) — deploys as its own
+# container (compose/web/Dockerfile) via `docker compose --profile full
+# up -d web`, same push-to-main pipeline as everything else.
+ui:
+	cd web && npm run build
+
+desktop: ui   ## Build the Wails desktop app for the current platform
+	rm -rf cmd/desktop/frontend/dist
+	mkdir -p cmd/desktop/frontend/dist
+	cp -r web/dist/* cmd/desktop/frontend/dist/
+	cd cmd/desktop && wails3 build -clean
+
+desktop-package: desktop   ## Build + package the desktop app (zip on macOS, tar.gz on Linux)
+	@case $$(uname -s) in \
+		Darwin) \
+			cd cmd/desktop/build/bin && zip -r oikos-desktop-darwin-$$(uname -m).zip oikos-desktop.app ;; \
+		Linux) \
+			cd cmd/desktop/build/bin && tar czf oikos-desktop-linux-$$(uname -m).tar.gz oikos-desktop ;; \
+	esac
+	@echo "Package: cmd/desktop/build/bin/"
+
+desktop-release: ui   ## Build desktop app for macOS arm64 + Linux amd64 (CI target)
+	@echo "Use 'make desktop-package' for local builds; desktop-release is for CI"
+	@exit 1
+
 clean:
 	rm -f $(BINARY)
+	rm -rf cmd/desktop/build
+	rm -rf cmd/desktop/frontend/dist
 	$(GO) clean -testcache
 
 tidy:

README.md

@@ -1,8 +1,8 @@
 # Oikos
 
 Agentic homelab operating system written in Go. Single binary (`cmd/oikos`),
-Docker-deployed on mac-mini, with a standalone Hermes MCP agent gateway
-(`cmd/hermes`). Manages the **hubris** Proxmox homelab autonomously — observes
+Docker-deployed on mac-mini, with a standalone Nomos MCP agent gateway
+(`cmd/nomos`). Manages the **hubris** Proxmox homelab autonomously — observes
 state, classifies actions against policy, executes approved procedures over SSH,
 learns from outcomes, and escalates when uncertain.
 
@@ -13,18 +13,24 @@ learns from outcomes, and escalates when uncertain.
 ## Quick start
 
 ```bash
-# Dev stack (postgres + api + scheduler + notifier)
-docker compose --profile dev up -d
+# Dev stack (postgres + api + scheduler + notifier). The api/nomos
+# services need a shared token — every route requires a real bearer
+# credential, there's no dev-open bypass.
+OIKOS_MCP_BEARER_TOKEN=dev-token docker compose --profile dev up -d
 
-# Full stack (adds Hermes agent gateway)
-docker compose --profile full up -d
+# Full stack (adds Nomos agent gateway)
+OIKOS_MCP_BEARER_TOKEN=dev-token docker compose --profile full up -d
 
 # Build standalone binary
 go build -o bin/oikos -tags timetzdata ./cmd/oikos
 
 # Run all roles in one process (dev mode)
 OIKOS_DATABASE_URL="postgres://oikos:oikos_dev@localhost:5432/oikos?sslmode=disable" \
+  OIKOS_API_TOKEN=dev-token \
   go run ./cmd/oikos all
+
+# Control-room SPA (separate from the Go binary — see web/)
+cd web && OIKOS_API_TOKEN=dev-token npm run dev   # http://localhost:5173
 ```
 
 ## Architecture
@@ -33,7 +39,7 @@ OIKOS_DATABASE_URL="postgres://oikos:oikos_dev@localhost:5432/oikos?sslmode=disa
                   ┌──────────────────────────────────┐
                   │         mac-mini (Docker)         │
                   │                                   │
-  Workstation ─── │  hermes (8092) ──MCP── api (8090) │
+  Workstation ─── │  nomos (8092) ──MCP── api (8090) │
   (mesh)          │    MCP gateway      REST + MCP    │
                   │                                   │
                   │  scheduler ── notifier ── postgres │
@@ -46,7 +52,7 @@ OIKOS_DATABASE_URL="postgres://oikos:oikos_dev@localhost:5432/oikos?sslmode=disa
 | `oikos api` | 8090 | REST API + MCP server (15 tools) |
 | `oikos scheduler` | — | Probe runner, signal lifecycle, metrics |
 | `oikos notifier` | — | Approval tokens, Matrix alerts |
-| `hermes serve` | 8092 | MCP client gateway, query routing |
+| `nomos serve` | 8092 | MCP client gateway, query routing |
 
 ## Phases
 
@@ -55,23 +61,26 @@ OIKOS_DATABASE_URL="postgres://oikos:oikos_dev@localhost:5432/oikos?sslmode=disa
 | 1 — Ontology + DB | ✅ | TimescaleDB, migrations, seeds, blast_radius |
 | 2 — API | ✅ | OpenAPI-first REST + MCP, auth, SSE, audit |
 | 3 — Control loop | ✅ | Scheduler, actuator, learning, classifier, notifier |
-| 4 — Hermes agent | ✅ | Standalone MCP client gateway, agent activity |
+| 4 — Nomos agent | ✅ | Standalone MCP client gateway, agent activity |
 | 5 — Secrets | ✅ | Infisical backend + SOPS fallback, rotation runbooks |
 | 6 — Deploy | ✅ | CI pipeline, cutover checklist, watchdog, rollback |
 
-Full plan: [plans/2026-07-06-consolidate-oikos-control-plane-onto-mac-mini.md](plans/2026-07-06-consolidate-oikos-control-plane-onto-mac-mini.md).
+Full plan: [plans/done/2026-07-06-consolidate-oikos-control-plane-onto-mac-mini.md](plans/done/2026-07-06-consolidate-oikos-control-plane-onto-mac-mini.md).
 
 ## Operations
 
 ### API endpoints
 
 ```bash
-curl http://localhost:8090/api/v1/entities?type=service  # fleet
-curl http://localhost:8090/api/v1/health                  # fleet health
-curl http://localhost:8090/api/v1/agent-activity          # agent log
+curl -H "Authorization: Bearer $OIKOS_API_TOKEN" \
+  http://localhost:8090/api/v1/entities?type=service  # fleet
+curl -H "Authorization: Bearer $OIKOS_API_TOKEN" \
+  http://localhost:8090/api/v1/health                  # fleet health
+curl -H "Authorization: Bearer $OIKOS_API_TOKEN" \
+  http://localhost:8090/api/v1/agent-activity          # agent log
 ```
 
-### Hermes queries
+### Nomos queries
 
 ```bash
 # Structured tool call
@@ -97,24 +106,40 @@ oikos secret list # enumerate SOPS secrets
 oikos secret migrate  # SOPS → Infisical
 ```
 
+### Web UI
+
+`web/` is a standalone Svelte 5 SPA — not embedded in the `oikos` binary, not
+part of `docker-compose.yml`. It talks to `api`/`nomos` over HTTP with a
+bearer token entered on first launch (see `web/src/pages/Config.svelte`).
+Build with `make ui`, deploy with `make deploy-ui` (Caddy serves the static
+output). A native desktop wrapper is planned — see
+[plans/2026-07-12-wails-desktop-app.md](plans/2026-07-12-wails-desktop-app.md).
+
 ## Repo layout
 
 ```
 cmd/oikos/          Go entry point — single binary
-cmd/hermes/         Hermes MCP client gateway
+cmd/nomos/          Nomos MCP client gateway
+cmd/webhook/        Gitea deploy-webhook receiver (push-to-deploy on mac-mini)
 internal/           Go packages (httpapi, mcp, scheduler, actuator, learning,
                     notifier, policy, secrets, db, config, ontology, domain,
                     knowledge)
+web/                Control-room SPA (Svelte 5) — standalone, not embedded
 api/openapi.yaml    API contract (OpenAPI 3.1)
 migrations/         Forward-only SQL migrations (TimescaleDB)
 seeds/              Bootstrap YAML (ontology, inventory, policy, knowledge)
 compose/            Dockerfiles + Caddy config
 scripts/            Deploy, watchdog, verification, rollback
-hermes/             Hermes config, persona, skills
+checks/             Host health-check scripts run over SSH by the scheduler
+tools/              Client auto-setup scripts (checks)
+ssh/                Deploy keys + authorized_keys management
+vps/                Caddy/TURN config templates for the netbird VPS
+nomos/              Nomos config, persona, skills
 .agents/            Agent instruction files, shared conventions, skills
 archive/            Historical reference (legacy wiki, plans, SOPS backups)
 plans/              Design documents (active + done)
 docs/adr/           Architecture decision records
+docs/operations/    Runbooks (rollback, etc.)
 ```
 
 ## For agents

api/openapi.yaml

@@ -312,6 +312,17 @@ paths:
             type: string
         style: form
         explode: true
+      - name: include
+        in: query
+        schema:
+          type: array
+          items:
+            type: string
+            enum:
+            - status
+        style: form
+        explode: true
+        description: include=status joins entity_status and populates GraphView.health
       responses:
         '200':
           description: Graph view
@@ -1696,6 +1707,22 @@ paths:
                 $ref: '#/components/schemas/HealthSummary'
         default:
           $ref: '#/components/responses/Problem'
+  /dashboard/summary:
+    get:
+      tags:
+      - observability
+      operationId: getDashboardSummary
+      summary: One-round-trip overview for the control room home page
+      x-required-scope: viewer
+      responses:
+        '200':
+          description: Dashboard summary
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DashboardSummary'
+        default:
+          $ref: '#/components/responses/Problem'
   /export:
     get:
       tags:
@@ -1887,6 +1914,21 @@ components:
         updated_at:
           type: string
           format: date-time
+        health:
+          type: string
+          description: last observed health, when the entity is monitored
+          nullable: true
+          enum:
+          - healthy
+          - degraded
+          - down
+          - unknown
+          - stale
+        last_check_at:
+          type: string
+          format: date-time
+          nullable: true
+          description: when health was last observed
     EntityCreate:
       type: object
       required:
@@ -1983,6 +2025,17 @@ components:
         truncated:
           type: boolean
           description: True if node cap was hit
+        health:
+          type: object
+          description: entity id -> health, present when include=status was requested
+          additionalProperties:
+            type: string
+            enum:
+            - healthy
+            - degraded
+            - down
+            - unknown
+            - stale
     EntityType:
       type: object
       required:
@@ -2207,6 +2260,7 @@ components:
           - disk
           - cert-expiry
           - drift
+          - ping
           - ssh-script
         target:
           type: string
@@ -2246,6 +2300,7 @@ components:
           - disk
           - cert-expiry
           - drift
+          - ping
           - ssh-script
         target:
           type: string
@@ -2992,6 +3047,9 @@ components:
               type: integer
             unknown:
               type: integer
+            stale:
+              type: integer
+              description: last observation older than the check's expected cadence
         entities:
           type: array
           items:
@@ -3012,6 +3070,7 @@ components:
                 - degraded
                 - down
                 - unknown
+                - stale
               trend:
                 type: string
                 enum:
@@ -3024,6 +3083,72 @@ components:
                 type: string
                 format: date-time
                 nullable: true
+    DashboardSummary:
+      type: object
+      required:
+      - entities_by_type
+      - entities_by_state
+      - health
+      - signals_by_severity
+      - approvals_pending
+      - executions_by_state
+      - event_rate
+      properties:
+        entities_by_type:
+          type: object
+          description: entity counts keyed by type
+          additionalProperties:
+            type: integer
+        entities_by_state:
+          type: object
+          description: entity counts keyed by state
+          additionalProperties:
+            type: integer
+        health:
+          type: object
+          required:
+          - healthy
+          - degraded
+          - down
+          - unknown
+          properties:
+            healthy:
+              type: integer
+            degraded:
+              type: integer
+            down:
+              type: integer
+            unknown:
+              type: integer
+            stale:
+              type: integer
+              description: last observation older than the check's expected cadence
+        signals_by_severity:
+          type: object
+          description: open (non-resolved) signal counts keyed by severity
+          additionalProperties:
+            type: integer
+        approvals_pending:
+          type: integer
+        executions_by_state:
+          type: object
+          description: execution counts keyed by state, last 24h
+          additionalProperties:
+            type: integer
+        event_rate:
+          type: array
+          description: event counts bucketed by 5-minute interval, most recent last
+          items:
+            type: object
+            required:
+            - bucket
+            - count
+            properties:
+              bucket:
+                type: string
+                format: date-time
+              count:
+                type: integer
     EnrollRequest:
       type: object
       required:

bootstrap.sh

@@ -3,15 +3,14 @@
 #
 # Thin client model (rev 2): no git clone, no sync timer. Fetches only the
 # agent orientation files (CLIENTS.md, AGENTS.md, OIKOS.md) and tooling
-# (caveman, hermes-soul) from the raw Gitea URL. Enrolls via the Oikos API
-# to receive an age keypair and Infisical machine identity. A lightweight
-# context poller replaces the old 5-minute git pull.
+# (checks) from the raw Gitea URL. Enrolls via the Oikos API to receive an
+# age keypair and Infisical machine identity. A lightweight context poller
+# replaces the old 5-minute git pull.
 #
 # Usage:
 #   curl -fsSL https://git.hubris.network/dtoro/oikos/raw/main/bootstrap.sh \
 #     | sudo bash
 #   curl ... | sudo bash -s -- --with-mcp           # wire Claude's .mcp.json
-#   curl ... | sudo bash -s -- --with-hermes        # install Goose + Hermes
 #   curl ... | sudo bash -s -- --dry-run            # show what would happen
 #
 # Prerequisites:
@@ -28,16 +27,10 @@ REPO_RAW_URL="${HOMELAB_RAW_URL:-https://git.hubris.network/dtoro/oikos/raw/main
 OIKOS_API_URL="${HOMELAB_OIKOS_URL:-https://oikos.hubris.network/api/v1}"
 CLONE_DIR="${HOMELAB_CONTEXT_DIR:-/opt/homelab}"
 MCP_URL="${HOMELAB_MCP_URL:-https://mcp.hubris.network/mcp}"
-HERMES_MCP_URI="${HOMELAB_HERMES_MCP_URI:-https://mcp.hubris.network/mcp}"
-HERMES_MODEL="${HOMELAB_HERMES_MODEL:-nousresearch/hermes-4-405b}"
 
 WITH_MCP=0
-WITH_HERMES=0
 DRY_RUN=0
 
-GITEA_TOKEN="${HOMELAB_GITEA_TOKEN:-}"
-GITEA_USER="${HOMELAB_GITEA_USER:-dtoro}"
-
 # ── helpers ──────────────────────────────────────────────────────────
 
 log()  { echo "[oikos] $*"; }
@@ -79,10 +72,7 @@ detect_mesh_ip() {
 while [ $# -gt 0 ]; do
     case "$1" in
         --with-mcp)       WITH_MCP=1 ;;
-        --with-hermes)    WITH_HERMES=1 ;;
         --dry-run)        DRY_RUN=1 ;;
-        --gitea-token)    GITEA_TOKEN="$2"; shift ;;
-        --gitea-user)     GITEA_USER="$2"; shift ;;
         *) die "unknown flag: $1" ;;
     esac
     shift
@@ -148,7 +138,7 @@ done
 
 # ── fetch tools ──────────────────────────────────────────────────────
 log "fetching tools..."
-for tool in setup-caveman.sh setup-hermes-soul.sh caveman.js caveman_wrapper.sh post-pull.sh; do
+for tool in setup-checks.sh post-pull.sh; do
     url="$REPO_RAW_URL/tools/${tool}"
     dest="$CLONE_DIR/tools/${tool}"
     dry mkdir -p "$(dirname "$dest")"
@@ -161,16 +151,6 @@ for tool in setup-caveman.sh setup-hermes-soul.sh caveman.js caveman_wrapper.sh
     fi
 done
 
-# ── fetch caveman templates ──────────────────────────────────────────
-for tmpl in git_log.txt git_status.txt test_results.txt; do
-    url="$REPO_RAW_URL/tools/caveman/templates/${tmpl}"
-    dest="$CLONE_DIR/tools/caveman/templates/${tmpl}"
-    dry mkdir -p "$(dirname "$dest")"
-    if curl -fsSL --connect-timeout 10 "$url" -o "$dest.tmp" 2>/dev/null; then
-        mv "$dest.tmp" "$dest"
-    fi
-done
-
 # ── detect control-plane (use localhost if API is reachable directly) ─
 if [ -z "${HOMELAB_OIKOS_URL:-}" ]; then
     if curl -s --connect-timeout 2 http://localhost:8090/api/v1/health >/dev/null 2>&1; then
@@ -300,7 +280,7 @@ case "$OS" in
 esac
 
 # ── run auto-setup scripts ───────────────────────────────────────────
-for setup in "$CLONE_DIR"/tools/*.setup.sh; do
+for setup in "$CLONE_DIR"/tools/setup-*.sh; do
     [ -f "$setup" ] || continue
     log "running setup: $(basename "$setup")"
     dry bash "$setup"
@@ -319,17 +299,6 @@ if [ "$WITH_MCP" -eq 1 ]; then
     log "  + MCP wired to $MCP_URL"
 fi
 
-# ── --with-hermes: install Goose + Hermes wrapper ────────────────────
-if [ "$WITH_HERMES" -eq 1 ]; then
-    log "installing Hermes agent..."
-    GOOSE_URL="https://github.com/block/goose/releases/latest/download/goose-${OS}-${ARCH:-amd64}"
-    if [ "$OS" = Darwin ]; then GOOSE_URL="https://github.com/block/goose/releases/latest/download/goose-darwin-${ARCH:-arm64}"; fi
-    dry curl -fsSL "$GOOSE_URL" -o /usr/local/bin/goose 2>/dev/null && chmod +x /usr/local/bin/goose || warn "goose not installed"
-    # Drop Hermes persona
-    cp "$CLONE_DIR/HERMES.md" "$CLONE_DIR/.agents/HERMES.md" 2>/dev/null || true
-    log "  + Hermes agent installed"
-fi
-
 # ── netbird SSH JWT cache ────────────────────────────────────────────
 if command -v netbird >/dev/null 2>&1; then
     dry netbird up --management-url https://netbird.hubris.network --ssh-jwt-cache-ttl 86400 2>/dev/null || true

checks/backup_freshness.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# backup_freshness.sh — check that backups exist and are recent.
+set -euo pipefail
+
+BACKUP_DIRS="${OIKOS_BACKUP_DIRS:-/var/backups /opt/backups /mnt/backups}"
+GRACE_HOURS="${OIKOS_BACKUP_GRACE:-48}"
+STALE=""
+
+for dir in $BACKUP_DIRS; do
+  [ -d "$dir" ] || continue
+  NEWEST=$(find "$dir" -type f -mmin -$((GRACE_HOURS * 60)) 2>/dev/null | head -1 || true)
+  if [ -z "$NEWEST" ]; then
+    LATEST_TS=$(find "$dir" -type f -printf '%T@ %p\n' 2>/dev/null | sort -rn | head -1 | awk '{print $1}' || echo "0")
+    LATEST_HOURS=$(awk "BEGIN {printf \"%.0f\", ($(date +%s) - ${LATEST_TS:-0})/3600}")
+    STALE="$STALE $dir(${LATEST_HOURS}h)"
+  fi
+done
+
+if [ -n "$STALE" ]; then
+  echo "{\"health\":\"degraded\",\"signalKind\":\"backup-stale\",\"evidence\":\"stale backups:$(echo "$STALE" | sed 's/ /, /g')\"}"
+else
+  echo '{"health":"healthy"}'
+fi

checks/caddy_error_rate.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# caddy_error_rate.sh — 5xx error rate from Caddy JSON access logs.
+set -euo pipefail
+
+LOG_DIR=""
+if [ -d /var/log/caddy ]; then
+  LOG_DIR="/var/log/caddy"
+elif [ -d /var/lib/caddy/logs ]; then
+  LOG_DIR="/var/lib/caddy/logs"
+elif [ -d /opt/caddy/logs ]; then
+  LOG_DIR="/opt/caddy/logs"
+fi
+
+if [ -z "$LOG_DIR" ]; then
+  echo '{"health":"healthy"}'
+  exit 0
+fi
+
+CUTOFF=$(date -u -d "5 minutes ago" +%Y-%m-%dT%H:%M 2>/dev/null || date -u -v-5M +%Y-%m-%dT%H:%M 2>/dev/null || echo "")
+
+TOTAL=0
+ERR_5XX=0
+
+for LOG in "$LOG_DIR"/access*.log "$LOG_DIR"/access*.json "$LOG_DIR"/*.log 2>/dev/null; do
+  [ -f "$LOG" ] || continue
+  [ -r "$LOG" ] || continue
+
+  if [ -n "$CUTOFF" ]; then
+    NEW=$(awk -v cutoff="$CUTOFF" '$0 >= cutoff {print}' "$LOG" 2>/dev/null | wc -l | tr -d ' ' || echo 0)
+    if [ "$NEW" -gt 0 ]; then
+      TOTAL=$((TOTAL + NEW))
+      ERR_5XX=$((ERR_5XX + $(awk -v cutoff="$CUTOFF" '$0 >= cutoff && /"status":5[0-9][0-9]/ {print}' "$LOG" 2>/dev/null | wc -l | tr -d ' ' || echo 0)))
+    fi
+  fi
+done
+
+if [ "$TOTAL" -gt 100 ]; then
+  RATE=$(awk "BEGIN {printf \"%.1f\", $ERR_5XX*100/$TOTAL}")
+  if [ "$(echo "$RATE > 5" | bc 2>/dev/null || echo 0)" = "1" ]; then
+    echo "{\"health\":\"degraded\",\"signalKind\":\"caddy-errors\",\"evidence\":\"${RATE}% 5xx rate ($ERR_5XX/$TOTAL)\",\"metrics\":{\"caddy_5xx_rate\":$RATE,\"caddy_requests\":$TOTAL,\"caddy_5xx\":$ERR_5XX}}"
+    exit 0
+  fi
+  echo "{\"health\":\"healthy\",\"metrics\":{\"caddy_5xx_rate\":$RATE,\"caddy_requests\":$TOTAL,\"caddy_5xx\":$ERR_5XX}}"
+else
+  echo '{"health":"healthy"}'
+fi

checks/cpu_check.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# cpu_check.sh — CPU usage % and thermal temperature.
+set -euo pipefail
+
+USAGE=$(top -bn1 2>/dev/null | awk '/^%Cpu/ {print 100 - $8}' || true)
+if [ -z "$USAGE" ]; then
+  CORES=$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 1)
+  USAGE=$(awk -v cores="$CORES" '{print ($1+$2+$3)*100/cores}' /proc/loadavg 2>/dev/null || echo "0")
+fi
+
+TEMP=""
+if [ -f /sys/class/thermal/thermal_zone0/temp ]; then
+  TEMP=$(awk '{printf "%.1f", $1/1000}' /sys/class/thermal/thermal_zone0/temp 2>/dev/null || true)
+fi
+
+if [ -n "$TEMP" ]; then
+  echo "{\"health\":\"healthy\",\"metrics\":{\"cpu_pct\":$USAGE,\"cpu_temp\":$TEMP}}"
+else
+  echo "{\"health\":\"healthy\",\"metrics\":{\"cpu_pct\":$USAGE}}"
+fi

checks/disk_smart_check.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# disk_smart_check.sh — SMART pre-failure indicators for physical disks.
+set -euo pipefail
+
+if ! command -v smartctl >/dev/null 2>&1; then
+  echo '{"health":"healthy"}'
+  exit 0
+fi
+
+DISKS=$(lsblk -ndo NAME,TYPE 2>/dev/null | awk '$2=="disk"{print "/dev/"$1}' || true)
+if [ -z "$DISKS" ]; then
+  echo '{"health":"healthy"}'
+  exit 0
+fi
+
+FAILED=""
+for dev in $DISKS; do
+  INFO=$(smartctl -H "$dev" 2>/dev/null || true)
+  if ! echo "$INFO" | grep -q "PASSED\|OK"; then
+    MODEL=$(smartctl -i "$dev" 2>/dev/null | awk -F': ' '/Device Model|Product/{print $2; exit}' || echo "$dev")
+    FAILED="$FAILED $MODEL"
+  fi
+done
+
+if [ -n "$FAILED" ]; then
+  echo "{\"health\":\"degraded\",\"signalKind\":\"disk-smart-fail\",\"evidence\":\"SMART check failed for:$(echo "$FAILED" | sed 's/ /, /g')\"}"
+else
+  echo '{"health":"healthy"}'
+fi

checks/disk_usage_check.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# disk_usage_check.sh — disk usage and inode usage per mountpoint.
+set -euo pipefail
+
+MOUNTS=$(df -k 2>/dev/null | awk 'NR>1 && $1 ~ /^\// && $NF !~ /^\/(snap|dev|proc|sys|run|private)/ {print $NF}' || true)
+FIRST=1
+
+echo -n '{"health":"healthy","metrics":{'
+for m in $MOUNTS; do
+  LINE=$(df -k "$m" 2>/dev/null | awk 'NR==2 {print $3, $4, $5, $7}' | tr -d '%' || true)
+  if [ -z "$LINE" ]; then continue; fi
+  USED=$(echo "$LINE" | awk '{print $1}')
+  FREE=$(echo "$LINE" | awk '{print $2}')
+  PCT=$(echo "$LINE" | awk '{print $3}')
+
+  INODE_LINE=$(df -i "$m" 2>/dev/null | awk 'NR==2 {print $5}' | tr -d '%' || echo "0")
+  INODE_PCT=$(echo "${INODE_LINE:-0}" | sed 's/-/0/')
+
+  KEY=$(echo "$m" | sed 's|/|_|g' | sed 's|^_||')
+  [ -z "$KEY" ] && KEY="root"
+
+  if [ $FIRST -eq 0 ]; then echo -n ','; fi
+  FIRST=0
+  echo -n "\"disk_${KEY}_pct\":$PCT,\"inode_${KEY}_pct\":$INODE_PCT"
+done
+echo '}}'

checks/docker_health_check.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# docker_health_check.sh — detect unhealthy Docker containers.
+set -euo pipefail
+
+if ! command -v docker >/dev/null 2>&1; then
+  echo '{"health":"healthy"}'
+  exit 0
+fi
+
+UNHEALTHY=$(docker ps --filter "health=unhealthy" --format "{{.Names}}" 2>/dev/null || true)
+
+if [ -n "$UNHEALTHY" ]; then
+  COUNT=$(echo "$UNHEALTHY" | wc -l | tr -d ' ')
+  NAMES=$(echo "$UNHEALTHY" | tr '\n' ',' | sed 's/,$//')
+  echo "{\"health\":\"degraded\",\"signalKind\":\"docker-unhealthy\",\"evidence\":\"$COUNT unhealthy container(s): $NAMES\",\"metrics\":{\"docker_unhealthy\":$COUNT}}"
+else
+  TOTAL=$(docker ps -q 2>/dev/null | wc -l | tr -d ' ' || echo 0)
+  echo "{\"health\":\"healthy\",\"metrics\":{\"docker_unhealthy\":0,\"docker_total\":$TOTAL}}"
+fi

checks/fd_check.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# fd_check.sh — open file descriptor usage ratio.
+set -euo pipefail
+
+FD_PCT=0
+if [ -r /proc/sys/fs/file-nr ]; then
+  read -r ALLOC _ LIMIT < /proc/sys/fs/file-nr
+  if [ "$LIMIT" -gt 0 ]; then
+    FD_PCT=$(awk "BEGIN {printf \"%.1f\", $ALLOC*100/$LIMIT}")
+  fi
+fi
+
+echo "{\"health\":\"healthy\",\"metrics\":{\"fd_pct\":$FD_PCT}}"

checks/install.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# install all check scripts into the canonical directory.
+# Auto-setup hook called by tools/post-pull.sh.
+set -euo pipefail
+
+CLONE_DIR="${HOMELAB_CONTEXT_DIR:-/opt/homelab}"
+CHECK_SRC="$CLONE_DIR/checks"
+CHECK_DST="${OIKOS_CHECK_DIR:-/opt/oikos/checks}"
+
+if [ ! -d "$CHECK_SRC" ]; then
+  exit 0
+fi
+
+mkdir -p "$CHECK_DST"
+
+for script in "$CHECK_SRC"/*.sh; do
+  name=$(basename "$script")
+  if [ "$name" = "install.sh" ]; then continue; fi
+  if [ -f "$CHECK_DST/$name" ]; then
+    if cmp -s "$script" "$CHECK_DST/$name"; then
+      continue
+    fi
+  fi
+  cp "$script" "$CHECK_DST/$name"
+  chmod 755 "$CHECK_DST/$name"
+  echo "[setup-checks] installed $name"
+done
+
+echo "[setup-checks] done"

checks/journal_check.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# journal_check.sh — count journal errors in the last check interval.
+set -euo pipefail
+
+ERRORS=0
+
+if command -v journalctl >/dev/null 2>&1; then
+  ERRORS=$(journalctl -p err --since "-5min" --no-pager 2>/dev/null | wc -l | tr -d ' ' || echo 0)
+fi
+
+if [ "$ERRORS" -gt 0 ]; then
+  echo "{\"health\":\"degraded\",\"signalKind\":\"journal-errors\",\"evidence\":\"$ERRORS error entries in last 5min\",\"metrics\":{\"journal_errors\":$ERRORS}}"
+else
+  echo '{"health":"healthy","metrics":{"journal_errors":0}}'
+fi

checks/load_check.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# load_check.sh — system load average scaled by CPU count.
+set -euo pipefail
+
+LOAD=$(awk '{print $1}' /proc/loadavg 2>/dev/null || sysctl -n vm.loadavg 2>/dev/null | awk '{print $2}' || echo "0")
+CORES=$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 1)
+
+echo "{\"health\":\"healthy\",\"metrics\":{\"load1\":$LOAD,\"cores\":$CORES}}"

checks/memory_check.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# memory_check.sh — RAM usage percentage.
+set -euo pipefail
+
+TOTAL=1
+AVAIL=1
+
+if [ -r /proc/meminfo ]; then
+  TOTAL=$(awk '/^MemTotal:/ {printf "%d", $2}' /proc/meminfo)
+  AVAIL=$(awk '/^MemAvailable:/ {printf "%d", $2}' /proc/meminfo)
+elif [ "$(uname)" = "Darwin" ]; then
+  MEM=$(vm_stat 2>/dev/null | awk '
+    /page size/ {ps=$8}
+    /Pages free/   {free+=$NF}
+    /Pages active/ {active+=$NF}
+    /Pages wired/  {wired+=$NF}
+    END {printf "%.2f %.2f", ps*(free+active+wired)/1048576, ps*wired/1048576}')
+  TOTAL=$(echo "$MEM" | awk '{printf "%.0f", $1}')
+  AVAIL=$(echo "$MEM" | awk '{printf "%.0f", $1 - $2}')
+fi
+
+if [ "$TOTAL" -eq 0 ]; then TOTAL=1; fi
+if [ "$AVAIL" -lt 0 ]; then AVAIL=0; fi
+
+USED_PCT=$(awk "BEGIN {printf \"%.1f\", (1 - $AVAIL/$TOTAL)*100}")
+
+echo "{\"health\":\"healthy\",\"metrics\":{\"mem_pct\":$USED_PCT}}"

checks/oom_check.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# oom_check.sh — detect OOM kills since last boot.
+set -euo pipefail
+
+OOM_COUNT=0
+
+if command -v dmesg >/dev/null 2>&1; then
+  OOM_COUNT=$(dmesg 2>/dev/null | grep -ci 'out of memory\|oom-killer\|Killed process' || echo 0)
+elif command -v journalctl >/dev/null 2>&1; then
+  OOM_COUNT=$(journalctl -k --no-pager 2>/dev/null | grep -ci 'out of memory\|oom-killer\|Killed process' || echo 0)
+fi
+
+if [ "$OOM_COUNT" -gt 0 ]; then
+  echo "{\"health\":\"degraded\",\"signalKind\":\"oom-kills\",\"evidence\":\"$OOM_COUNT OOM events detected since boot\",\"metrics\":{\"oom_count\":$OOM_COUNT}}"
+else
+  echo '{"health":"healthy","metrics":{"oom_count":0}}'
+fi

checks/process_check.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# process_check.sh — systemd service liveness.
+set -euo pipefail
+
+SERVICE="${1:-}"
+if [ -z "$SERVICE" ]; then
+  echo '{"health":"unknown","signalKind":"process-check","evidence":"no service name provided"}'
+  exit 0
+fi
+
+if ! command -v systemctl >/dev/null 2>&1; then
+  echo '{"health":"unknown","signalKind":"process-check","evidence":"systemctl not found"}'
+  exit 0
+fi
+
+STATE=$(systemctl is-active "$SERVICE" 2>/dev/null || echo "unknown")
+
+if [ "$STATE" = "active" ]; then
+  echo "{\"health\":\"healthy\"}"
+else
+  echo "{\"health\":\"degraded\",\"signalKind\":\"$SERVICE\",\"evidence\":\"$SERVICE is $STATE\"}"
+fi

checks/swap_check.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# swap_check.sh — swap usage percentage.
+set -euo pipefail
+
+if [ -r /proc/meminfo ]; then
+  SWAP_TOTAL=$(awk '/^SwapTotal:/ {printf "%d", $2}' /proc/meminfo)
+  SWAP_FREE=$(awk '/^SwapFree:/ {printf "%d", $2}' /proc/meminfo)
+elif [ "$(uname)" = "Darwin" ]; then
+  SP=$(sysctl vm.swapusage 2>/dev/null | awk '{print $4, $9}' | tr -d 'M' || echo "0 0")
+  SWAP_TOTAL=$(echo "$SP" | awk '{printf "%.0f", $1*1024}')
+  SWAP_FREE=$(echo "$SP" | awk '{printf "%.0f", ($1-$2)*1024}')
+else
+  SWAP_TOTAL=0
+  SWAP_FREE=0
+fi
+
+if [ "$SWAP_TOTAL" -eq 0 ]; then
+  echo "{\"health\":\"healthy\",\"metrics\":{\"swap_pct\":0}}"
+else
+  USED_PCT=$(awk "BEGIN {printf \"%.1f\", (1 - $SWAP_FREE/$SWAP_TOTAL)*100}")
+  echo "{\"health\":\"healthy\",\"metrics\":{\"swap_pct\":$USED_PCT}}"
+fi

checks/time_check.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# time_check.sh — NTP synchronization status and clock drift.
+set -euo pipefail
+
+DRIFT_S=0
+SYNCED=true
+
+if command -v chronyc >/dev/null 2>&1; then
+  TRACKING=$(chronyc tracking 2>/dev/null || true)
+  DRIFT_NS=$(echo "$TRACKING" | awk '/System time/ {print $4}' | sed 's/-//' || echo "0")
+  DRIFT_S=$(awk "BEGIN {printf \"%.6f\", $DRIFT_NS/1e9}")
+  # chronyc returns a very small value when synced (nanoseconds)
+elif command -v timedatectl >/dev/null 2>&1; then
+  STATUS=$(timedatectl show 2>/dev/null || true)
+  if echo "$STATUS" | grep -q "NTPSynchronized=no"; then
+    SYNCED=false
+  fi
+fi
+
+if ! $SYNCED; then
+  echo '{"health":"degraded","signalKind":"time-drift","evidence":"NTP not synchronized"}'
+elif [ "$(echo "$DRIFT_S > 1" | bc 2>/dev/null || echo 0)" = "1" ]; then
+  echo "{\"health\":\"degraded\",\"signalKind\":\"time-drift\",\"evidence\":\"clock drift ${DRIFT_S}s exceeds 1s threshold\",\"metrics\":{\"clock_drift_s\":$DRIFT_S}}"
+else
+  echo "{\"health\":\"healthy\",\"metrics\":{\"clock_drift_s\":$DRIFT_S}}"
+fi

checks/updates_check.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# updates_check.sh — pending apt security updates and reboot-required flag.
+set -euo pipefail
+
+SECURITY=0
+REBOOT=0
+
+if command -v apt >/dev/null 2>&1; then
+  apt update -qq >/dev/null 2>&1 || true
+  SECURITY=$(apt list --upgradable 2>/dev/null | grep -c '\-security' || true)
+fi
+
+if [ -f /var/run/reboot-required ]; then
+  REBOOT=1
+fi
+
+echo "{\"health\":\"healthy\",\"metrics\":{\"security_updates\":$SECURITY,\"reboot_required\":$REBOOT}}"

checks/uptime_check.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+# uptime_check.sh — detect unexpected reboots by monitoring uptime.
+set -euo pipefail
+
+UPTIME=$(awk '{printf "%.0f", $1}' /proc/uptime 2>/dev/null || sysctl -n kern.boottime 2>/dev/null | awk '{print $4}' | tr -d ',' || echo "0")
+
+echo "{\"health\":\"healthy\",\"metrics\":{\"uptime_seconds\":$UPTIME}}"

checks/zfs_check.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# zfs_check.sh — ZFS pool health.
+set -euo pipefail
+
+if ! command -v zpool >/dev/null 2>&1; then
+  echo '{"health":"healthy"}'
+  exit 0
+fi
+
+STATUS=$(zpool status -x 2>&1 || true)
+SCRUB_OVERDUE=""
+
+if echo "$STATUS" | grep -q "all pools are healthy"; then
+  for pool in $(zpool list -Ho name 2>/dev/null || true); do
+    LAST=$(zpool status "$pool" 2>/dev/null | awk '/scan:/{print $0}' || true)
+    if [ -z "$LAST" ] || echo "$LAST" | grep -q "scrub repaired"; then
+      SCRUB_OVERDUE="$pool"
+      break
+    fi
+  done
+  if [ -n "$SCRUB_OVERDUE" ]; then
+    echo "{\"health\":\"degraded\",\"signalKind\":\"zfs-scrub-overdue\",\"evidence\":\"pool $SCRUB_OVERDUE scrub has errors or is overdue\"}"
+  else
+    echo '{"health":"healthy"}'
+  fi
+else
+  HEALTH=$(echo "$STATUS" | grep "state:" | awk '{print $2}' | head -1)
+  echo "{\"health\":\"degraded\",\"signalKind\":\"zfs-degraded\",\"evidence\":\"pool state: $HEALTH\"}"
+fi

cmd/desktop/entitlements.plist

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.app-sandbox</key>
+	<false/>
+	<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+	<true/>
+	<key>com.apple.security.cs.disable-library-validation</key>
+	<true/>
+	<key>com.apple.security.device.audio-input</key>
+	<false/>
+	<key>com.apple.security.device.camera</key>
+	<false/>
+	<key>com.apple.security.files.user-selected.read-write</key>
+	<true/>
+	<key>com.apple.security.network.client</key>
+	<true/>
+	<key>com.apple.security.network.server</key>
+	<false/>
+	<key>keychain-access-groups</key>
+	<array>
+		<string>$(AppIdentifierPrefix)com.hubris.oikos-desktop</string>
+	</array>
+</dict>
+</plist>

cmd/desktop/main.go

@@ -0,0 +1,382 @@
+package main
+
+import (
+	"embed"
+	"encoding/json"
+	"fmt"
+	"io"
+	"io/fs"
+	"log"
+	"net/http"
+	"os"
+	"os/exec"
+	"os/user"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/zalando/go-keyring"
+)
+
+//go:embed frontend/dist
+var assets embed.FS
+
+const (
+	keyringService = "com.hubris.oikos-desktop"
+	keyringUser    = "oikos"
+	version        = "0.1.0"
+	updateURL      = "https://git.hubris.network/api/v1/repos/dtoro/oikos/releases"
+	pollInterval   = 30 * time.Second
+	updateInterval = 6 * time.Hour
+)
+
+type OikosConfig struct {
+	ApiUrl    string `json:"apiUrl"`
+	Token     string `json:"token,omitempty"`
+	IsDesktop bool   `json:"isDesktop"`
+}
+
+// ---- ConfigService ----
+
+type ConfigService struct{ app *application.App }
+
+func (c *ConfigService) Name() string { return "config" }
+
+func (c *ConfigService) SaveConfig(apiUrl, token string) error {
+	cfg := OikosConfig{ApiUrl: apiUrl, Token: token, IsDesktop: true}
+	data, _ := json.Marshal(cfg)
+	return keyring.Set(keyringService, keyringUser, string(data))
+}
+
+func (c *ConfigService) ClearConfig() error {
+	return keyring.Delete(keyringService, keyringUser)
+}
+
+func (c *ConfigService) EnableAutoStart() error {
+	if runtime.GOOS != "darwin" {
+		return fmt.Errorf("autostart not supported on %s", runtime.GOOS)
+	}
+	usr, _ := user.Current()
+	dir := filepath.Join(usr.HomeDir, "Library", "LaunchAgents")
+	os.MkdirAll(dir, 0755)
+
+	exe, _ := os.Executable()
+	plist := fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>Label</key>
+	<string>com.hubris.oikos-desktop</string>
+	<key>ProgramArguments</key>
+	<array>
+		<string>%s</string>
+	</array>
+	<key>RunAtLoad</key>
+	<true/>
+	<key>KeepAlive</key>
+	<false/>
+</dict>
+</plist>`, exe)
+
+	return os.WriteFile(filepath.Join(dir, "com.hubris.oikos-desktop.plist"), []byte(plist), 0644)
+}
+
+func (c *ConfigService) DisableAutoStart() error {
+	if runtime.GOOS != "darwin" {
+		return fmt.Errorf("autostart not supported on %s", runtime.GOOS)
+	}
+	usr, _ := user.Current()
+	path := filepath.Join(usr.HomeDir, "Library", "LaunchAgents", "com.hubris.oikos-desktop.plist")
+	return os.Remove(path)
+}
+
+// ---- Window persistence ----
+
+type windowState struct {
+	X      int `json:"x"`
+	Y      int `json:"y"`
+	Width  int `json:"width"`
+	Height int `json:"height"`
+}
+
+func windowStatePath() string {
+	usr, _ := user.Current()
+	return filepath.Join(usr.HomeDir, ".config", "oikos", "window.json")
+}
+
+func loadWindowState() *windowState {
+	data, err := os.ReadFile(windowStatePath())
+	if err != nil {
+		return nil
+	}
+	var ws windowState
+	if err := json.Unmarshal(data, &ws); err != nil {
+		return nil
+	}
+	if ws.Width < 200 || ws.Height < 200 {
+		return nil
+	}
+	return &ws
+}
+
+func saveWindowState(w application.Window) {
+	x, y := w.Position()
+	width, height := w.Size()
+	ws := windowState{X: x, Y: y, Width: width, Height: height}
+	data, _ := json.Marshal(ws)
+
+	usr, _ := user.Current()
+	dir := filepath.Join(usr.HomeDir, ".config", "oikos")
+	os.MkdirAll(dir, 0755)
+	os.WriteFile(filepath.Join(dir, "window.json"), data, 0644)
+}
+
+// ---- Config loading ----
+
+func loadConfig() *OikosConfig {
+	data, err := keyring.Get(keyringService, keyringUser)
+	if err != nil {
+		return nil
+	}
+	var cfg OikosConfig
+	if err := json.Unmarshal([]byte(data), &cfg); err != nil {
+		return nil
+	}
+	cfg.IsDesktop = true
+	return &cfg
+}
+
+// ---- Asset handler ----
+
+func newAssetHandler(cfg *OikosConfig) http.Handler {
+	distFS, err := fs.Sub(assets, "frontend/dist")
+	if err != nil {
+		log.Fatalf("embedded assets: %v", err)
+	}
+
+	fallback := http.FileServer(http.FS(distFS))
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		path := r.URL.Path
+		if path == "/" || path == "/index.html" {
+			data, err := fs.ReadFile(distFS, "index.html")
+			if err != nil {
+				fallback.ServeHTTP(w, r)
+				return
+			}
+			html := string(data)
+			if cfg != nil {
+				configJSON, _ := json.Marshal(cfg)
+				placeholder := `<script>window.__OIKOS_CONFIG__ = {};</script>`
+				injected := fmt.Sprintf(`<script>window.__OIKOS_CONFIG__ = %s;</script>`, configJSON)
+				html = strings.ReplaceAll(html, placeholder, injected)
+			}
+			w.Header().Set("Content-Type", "text/html; charset=utf-8")
+			w.Write([]byte(html))
+			return
+		}
+		fallback.ServeHTTP(w, r)
+	})
+}
+
+// ---- Notifications ----
+
+type dashboardSummary struct {
+	ApprovalsPending int `json:"approvals_pending"`
+	Signals          struct {
+		Critical int `json:"critical"`
+	} `json:"signals_by_severity"`
+}
+
+func (d *dashboardSummary) alertCount() int {
+	return d.ApprovalsPending + d.Signals.Critical
+}
+
+func notify(title, subtitle string) {
+	if runtime.GOOS != "darwin" {
+		return
+	}
+	script := fmt.Sprintf(
+		`display notification "%s" with title "%s" sound name "default"`,
+		strings.ReplaceAll(subtitle, `"`, `\"`),
+		strings.ReplaceAll(title, `"`, `\"`),
+	)
+	exec.Command("osascript", "-e", script).Run()
+}
+
+func pollDashboard(cfg *OikosConfig) {
+	if cfg == nil || cfg.ApiUrl == "" || cfg.Token == "" {
+		return
+	}
+
+	var lastCount int
+	first := true
+
+	for {
+		req, err := http.NewRequest("GET", cfg.ApiUrl+"/api/v1/dashboard/summary", nil)
+		if err != nil {
+			time.Sleep(pollInterval)
+			continue
+		}
+		req.Header.Set("Authorization", "Bearer "+cfg.Token)
+
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			time.Sleep(pollInterval)
+			continue
+		}
+
+		body, _ := io.ReadAll(resp.Body)
+		resp.Body.Close()
+
+		var summary dashboardSummary
+		if err := json.Unmarshal(body, &summary); err != nil {
+			time.Sleep(pollInterval)
+			continue
+		}
+
+		if first {
+			lastCount = summary.alertCount()
+			first = false
+		} else {
+			current := summary.alertCount()
+			if current > lastCount {
+				notify("Oikos", fmt.Sprintf("%d pending approval(s), %d critical signal(s)", summary.ApprovalsPending, summary.Signals.Critical))
+			}
+			lastCount = current
+		}
+
+		time.Sleep(pollInterval)
+	}
+}
+
+// ---- Auto-update ----
+
+type giteaRelease struct {
+	TagName string `json:"tag_name"`
+	Assets  []struct {
+		Name               string `json:"name"`
+		BrowserDownloadURL string `json:"browser_download_url"`
+	} `json:"assets"`
+}
+
+func checkUpdates() {
+	for {
+		resp, err := http.Get(updateURL + "?draft=false&pre-release=false&limit=1")
+		if err != nil {
+			time.Sleep(updateInterval)
+			continue
+		}
+		body, _ := io.ReadAll(resp.Body)
+		resp.Body.Close()
+
+		var releases []giteaRelease
+		if err := json.Unmarshal(body, &releases); err != nil || len(releases) == 0 {
+			time.Sleep(updateInterval)
+			continue
+		}
+
+		latest := releases[0]
+		latestVersion := strings.TrimPrefix(latest.TagName, "v")
+		if latestVersion == version {
+			time.Sleep(updateInterval)
+			continue
+		}
+
+		app := application.Get()
+		if app == nil {
+			time.Sleep(updateInterval)
+			continue
+		}
+
+		msg := fmt.Sprintf("Version %s is available (you have %s). Download from Gitea releases.", latestVersion, version)
+		app.Dialog.Info().
+			SetTitle("Update Available").
+			SetMessage(msg).
+			Show()
+		time.Sleep(updateInterval)
+	}
+}
+
+// ---- Main ----
+
+func main() {
+	cfg := loadConfig()
+
+	app := application.New(application.Options{
+		Name:        "Oikos",
+		Description: "Homelab Control Room",
+		Services: []application.Service{
+			application.NewService(&ConfigService{}),
+		},
+		Assets: application.AssetOptions{
+			Handler: newAssetHandler(cfg),
+		},
+		Mac: application.MacOptions{
+			ApplicationShouldTerminateAfterLastWindowClosed: false,
+		},
+	})
+
+	// --- System tray ---
+	systemTray := app.SystemTray.New()
+	systemTray.SetLabel("Oikos")
+	systemTray.SetTooltip("Oikos — Control Room")
+
+	trayMenu := application.NewMenu()
+	trayMenu.Add("Open Control Room").OnClick(func(ctx *application.Context) {
+		for _, w := range app.Window.GetAll() {
+			w.Show()
+			w.Focus()
+		}
+	})
+	trayMenu.AddSeparator()
+	trayMenu.Add("Check for Updates").OnClick(func(ctx *application.Context) {
+		go checkUpdates() // force immediate check on demand
+	})
+	trayMenu.AddSeparator()
+	trayMenu.Add("Quit").OnClick(func(ctx *application.Context) {
+		app.Quit()
+	})
+	systemTray.SetMenu(trayMenu)
+
+	// --- Main window ---
+	ws := loadWindowState()
+	width, height := 1400, 900
+	minWidth, minHeight := 1024, 700
+
+	window := app.Window.NewWithOptions(application.WebviewWindowOptions{
+		Title:    "Oikos — Control Room",
+		Width:    width,
+		Height:   height,
+		MinWidth: minWidth,
+		MinHeight: minHeight,
+		URL:      "/",
+	})
+
+	if ws != nil {
+		window.SetPosition(ws.X, ws.Y)
+		window.SetSize(ws.Width, ws.Height)
+	} else {
+		window.Center()
+	}
+	window.Show()
+
+	systemTray.AttachWindow(window)
+	systemTray.Run()
+
+	// Register shutdown handler to save window state
+	app.OnShutdown(func() {
+		saveWindowState(window)
+	})
+
+	// Start background goroutines
+	go pollDashboard(cfg)
+	go checkUpdates()
+
+	err := app.Run()
+	if err != nil {
+		log.Fatal(err)
+	}
+}

cmd/desktop/wails.json

@@ -0,0 +1,9 @@
+{
+  "name": "oikos",
+  "outputfilename": "oikos-desktop",
+  "frontend:dir": "frontend",
+  "author": {
+    "name": "Hubris",
+    "email": "d.toro.v@pm.me"
+  }
+}

cmd/hermes/main.go

@@ -1,341 +0,0 @@
-package main
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"log/slog"
-	"net/http"
-	"os"
-	"os/signal"
-	"strings"
-	"syscall"
-	"time"
-)
-
-func main() {
-	if len(os.Args) < 2 {
-		fmt.Fprintln(os.Stderr, "usage: hermes serve")
-		os.Exit(1)
-	}
-
-	mcpURL := os.Getenv("HERMES_MCP_URL")
-	if mcpURL == "" {
-		mcpURL = "http://localhost:8090/mcp"
-	}
-
-	agentSlug := os.Getenv("HERMES_AGENT_SLUG")
-	if agentSlug == "" {
-		agentSlug = "agent:hermes"
-	}
-
-	switch os.Args[1] {
-	case "serve":
-		ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
-		defer cancel()
-
-		client, err := newMCPClient(mcpURL)
-		if err != nil {
-			slog.Error("hermes: mcp connect", "url", mcpURL, "error", err)
-			os.Exit(1)
-		}
-
-		mux := http.NewServeMux()
-		mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
-			w.WriteHeader(200)
-			w.Write([]byte("ok"))
-		})
-		mux.HandleFunc("/query", func(w http.ResponseWriter, r *http.Request) {
-			handleQuery(w, r, client, agentSlug, mcpURL)
-		})
-
-		addr := os.Getenv("HERMES_LISTEN")
-		if addr == "" {
-			addr = ":8092"
-		}
-
-		srv := &http.Server{Addr: addr, Handler: mux}
-		go func() {
-			slog.Info("hermes: gateway listening", "addr", addr, "mcp", mcpURL)
-			if err := srv.ListenAndServe(); err != http.ErrServerClosed {
-				slog.Error("hermes: serve", "error", err)
-			}
-		}()
-
-		<-ctx.Done()
-		slog.Info("hermes: shutting down")
-		srv.Shutdown(context.Background())
-		client.close()
-
-	default:
-		fmt.Fprintf(os.Stderr, "unknown command: %s\n", os.Args[1])
-		os.Exit(1)
-	}
-}
-
-// handleQuery maps structured queries to MCP tool calls.
-func handleQuery(w http.ResponseWriter, r *http.Request, client *mcpClient, agentSlug, mcpURL string) {
-	if r.Method != http.MethodPost {
-		http.Error(w, "method not allowed", 405)
-		return
-	}
-
-	var req struct {
-		Query string `json:"query"`
-		Tool  string `json:"tool"`
-		Args  map[string]any `json:"args"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, "bad request: "+err.Error(), 400)
-		return
-	}
-
-	start := time.Now()
-	var result any
-	var err error
-
-	// Direct tool call (structured)
-	if req.Tool != "" {
-		result, err = client.callTool(req.Tool, req.Args)
-	} else {
-		// Natural-language-ish query routing
-		q := strings.ToLower(req.Query)
-		result, err = routeQuery(client, q, agentSlug)
-	}
-
-	duration := time.Since(start).Milliseconds()
-
-	if err != nil {
-		slog.Error("hermes: query failed", "query", req.Query, "error", err)
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]any{
-			"error":       err.Error(),
-			"elapsed_ms":  duration,
-			"agent_slug":  agentSlug,
-		})
-		return
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(map[string]any{
-		"result":      result,
-		"elapsed_ms":  duration,
-		"agent_slug":  agentSlug,
-		"mcp_url":     mcpURL,
-	})
-}
-
-// routeQuery maps natural-language-style queries to MCP tool calls.
-func routeQuery(client *mcpClient, query, agentSlug string) (any, error) {
-	switch {
-	case strings.Contains(query, "depends on") || strings.Contains(query, "depend on"):
-		entity := extractEntity(query)
-		if entity == "" {
-			return nil, fmt.Errorf("no entity found in query: %s", query)
-		}
-		return client.callTool("get_blast_radius", map[string]any{
-			"entity_id": entity,
-		})
-
-	case strings.Contains(query, "what is") || strings.Contains(query, "describe"):
-		entity := extractEntity(query)
-		if entity == "" {
-			entity = query
-		}
-		return client.callTool("get_entity", map[string]any{
-			"slug_or_id": entity,
-		})
-
-	case strings.Contains(query, "health") || strings.Contains(query, "status"):
-		return client.callTool("get_health_summary", map[string]any{})
-
-	case strings.Contains(query, "restart") || strings.Contains(query, "reload"):
-		entity := extractEntity(query)
-		if entity == "" {
-			return nil, fmt.Errorf("no entity found in query: %s", query)
-		}
-		return client.callTool("request_execution", map[string]any{
-			"target": entity,
-			"action": "restart",
-		})
-
-	case strings.Contains(query, "what can you do") || strings.Contains(query, "help"):
-		return client.callTool("tools/list", nil)
-
-	default:
-		return client.callTool("get_health_summary", map[string]any{})
-	}
-}
-
-// extractEntity guesses an entity slug from a query.
-func extractEntity(query string) string {
-	for _, slug := range []string{"authentik", "caddy", "vaultwarden", "gitea", "immich"} {
-		if strings.Contains(query, slug) {
-			return "service:" + slug
-		}
-	}
-	if strings.Contains(query, "mac-mini") {
-		return "host:mac-mini"
-	}
-	if strings.Contains(query, "hubris") {
-		return "host:hubris"
-	}
-	return ""
-}
-
-// ─── MCP Streamable HTTP client ────────────────────────────────────────
-
-type mcpClient struct {
-	baseURL    string
-	sessionID  string
-	http       *http.Client
-	nextID     int
-}
-
-func newMCPClient(baseURL string) (*mcpClient, error) {
-	c := &mcpClient{
-		baseURL: baseURL,
-		http:    &http.Client{Timeout: 30 * time.Second},
-	}
-
-	// Initialize session
-	resp, err := c.doRequest("initialize", map[string]any{
-		"protocolVersion": "2024-11-05",
-		"capabilities":    map[string]any{},
-		"clientInfo":      map[string]any{"name": "hermes", "version": "2.0"},
-	})
-	if err != nil {
-		return nil, fmt.Errorf("initialize: %w", err)
-	}
-	if resp.sessionID == "" {
-		return nil, fmt.Errorf("no session ID in initialize response")
-	}
-	c.sessionID = resp.sessionID
-
-	// Send initialized notification
-	c.doRequest("notifications/initialized", map[string]any{})
-
-	slog.Info("hermes: mcp connected", "session", c.sessionID[:16]+"...")
-	return c, nil
-}
-
-type mcpJSONRPCResponse struct {
-	sessionID string
-	Result    json.RawMessage `json:"result"`
-	Error     json.RawMessage `json:"error"`
-}
-
-func (c *mcpClient) doRequest(method string, params map[string]any) (*mcpJSONRPCResponse, error) {
-	c.nextID++
-	body, _ := json.Marshal(map[string]any{
-		"jsonrpc": "2.0",
-		"method":  method,
-		"params":  params,
-		"id":      c.nextID,
-	})
-
-	req, err := http.NewRequest(http.MethodPost, c.baseURL, bytes.NewReader(body))
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Accept", "application/json, text/event-stream")
-	if c.sessionID != "" {
-		req.Header.Set("Mcp-Session-Id", c.sessionID)
-	}
-
-	resp, err := c.http.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	result := &mcpJSONRPCResponse{}
-	result.sessionID = resp.Header.Get("Mcp-Session-Id")
-
-	// Parse SSE stream: "event: message\ndata: <json>\n\n"
-	scanner := bufio.NewScanner(resp.Body)
-	for scanner.Scan() {
-		line := scanner.Text()
-		if strings.HasPrefix(line, "data: ") {
-			data := line[6:]
-			if err := json.Unmarshal([]byte(data), result); err != nil {
-				return nil, fmt.Errorf("parse response: %w", err)
-			}
-		}
-	}
-
-	if result.Error != nil {
-		return nil, fmt.Errorf("rpc error: %s", string(result.Error))
-	}
-
-	if result.sessionID != "" {
-		c.sessionID = result.sessionID
-	}
-
-	return result, nil
-}
-
-func (c *mcpClient) callTool(name string, args map[string]any) (any, error) {
-	resp, err := c.doRequest("tools/call", map[string]any{
-		"name":      name,
-		"arguments": args,
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	// Parse MCP content: { "content": [{ "type": "text", "text": "..." }] }
-	var toolResult struct {
-		Content []struct {
-			Type string `json:"type"`
-			Text string `json:"text"`
-		} `json:"content"`
-	}
-	if err := json.Unmarshal(resp.Result, &toolResult); err != nil {
-		return string(resp.Result), nil
-	}
-
-	var texts []string
-	for _, c := range toolResult.Content {
-		if c.Type == "text" {
-			// Try to parse as JSON for structured display
-			var parsed any
-			if json.Unmarshal([]byte(c.Text), &parsed) == nil {
-				return parsed, nil
-			}
-			texts = append(texts, c.Text)
-		}
-	}
-	if len(texts) == 1 {
-		return texts[0], nil
-	}
-	return texts, nil
-}
-
-func (c *mcpClient) listTools() ([]string, error) {
-	resp, err := c.doRequest("tools/list", map[string]any{})
-	if err != nil {
-		return nil, err
-	}
-	var tr struct {
-		Tools []struct {
-			Name        string `json:"name"`
-			Description string `json:"description"`
-		} `json:"tools"`
-	}
-	if err := json.Unmarshal(resp.Result, &tr); err != nil {
-		return nil, err
-	}
-	var names []string
-	for _, t := range tr.Tools {
-		names = append(names, t.Name)
-	}
-	return names, nil
-}
-
-func (c *mcpClient) close() {
-	// MCP sessions are ephemeral; no explicit close needed
-}

cmd/nomos/agent.go

@@ -0,0 +1,796 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/openai/openai-go"
+	"github.com/openai/openai-go/option"
+	"github.com/openai/openai-go/shared"
+)
+
+// maxIterations bounds one chat turn's tool-calling loop. Provisioning a
+// service is a long chain (research → plan → request_execution → per-step
+// install/verify run calls), so this must be generous; a full deploy with the
+// decomposed pct_create flow can legitimately need many steps. On exhaustion
+// the loop now produces a real summary (finalSummary) rather than a dead end.
+const maxIterations = 40
+const maxLLMRetries = 1
+
+// historyWindowSize bounds how many of a session's most recent persisted
+// messages are replayed into the LLM's context on each turn — see
+// store.go's getRecentMessages for why this exists (fix A2 of
+// plans/2026-07-11-nomos-agent-code-review.md: unbounded history replay was
+// a real, observed-in-production cost/latency/eventual-context-limit risk).
+// 30 is a fixed-window choice, not token-budget-aware: simplest option that
+// still keeps roughly the current task's working context, at the cost of
+// occasionally dropping something a very long task still needed — the
+// system note injected when truncation happens tells the model to check
+// upsert_knowledge/search_knowledge rather than assume something didn't
+// happen. A token-aware trim or LLM-summarize-on-drop are documented
+// stretch options if a fixed window proves insufficient in practice.
+const historyWindowSize = 30
+
+var refusalDenylist = []string{
+	"我没有相关信息",
+	"您可以尝试问我其它问题",
+	"我无法",
+	"抱歉，我无法",
+	"关于这个问题，我没有",
+}
+
+type agent struct {
+	clients    *mcpClientPool // one MCP client PER SESSION, not shared — see mcpClientPool's doc comment
+	system     string
+	provider   *openai.Client
+	model      string
+	store      *store
+	agentID    uuid.UUID
+	reqOpts    []option.RequestOption
+	apiBase    string // oikos HTTP API base, derived from NOMOS_MCP_URL, for chat-assent approvals
+	apiToken   string // OIKOS_MCP_BEARER_TOKEN — api's combinedAuth requires it (no dev-open bypass)
+	httpClient *http.Client
+}
+
+func newAgent(ctx context.Context, clients *mcpClientPool, st *store, agentSlug string) (*agent, error) {
+	system := loadSoul()
+	apiKey := os.Getenv("OPENROUTER_API_KEY")
+	model := os.Getenv("NOMOS_MODEL")
+	if model == "" {
+		// v4-pro over v4-flash: the flash tier over-narrates, occasionally
+		// emits canned refusals, and is unreliable at multi-step tool use —
+		// exactly the agentic provisioning path the operator needs to work.
+		model = "deepseek/deepseek-v4-pro"
+	}
+
+	provider := openai.NewClient(
+		option.WithBaseURL("https://openrouter.ai/api/v1"),
+		option.WithAPIKey(apiKey),
+	)
+
+	agentID := st.resolveAgentID(ctx, agentSlug)
+	if agentID == uuid.Nil {
+		slog.Warn("nomos: agent entity not found; tool-call activity will not be logged", "slug", agentSlug)
+	}
+
+	// OpenRouter provider routing. data_collection=deny pins to zero-data-
+	// retention providers (privacy: conversations + tool results transit
+	// OpenRouter); require_parameters ensures the routed provider actually
+	// supports tool calling. NOMOS_PROVIDER_SORT (price|throughput|latency)
+	// and Exacto tool-accuracy routing are opt-in — the latter via a model
+	// suffix in NOMOS_MODEL (e.g. "deepseek/deepseek-v4-flash:exacto"), so an
+	// unsupported value never silently breaks the confirmed routing below.
+	providerRouting := map[string]any{
+		"data_collection":    "deny",
+		"require_parameters": true,
+	}
+	if sort := os.Getenv("NOMOS_PROVIDER_SORT"); sort != "" {
+		providerRouting["sort"] = sort
+	}
+	reqOpts := []option.RequestOption{option.WithJSONSet("provider", providerRouting)}
+
+	// Derive the oikos HTTP API base from the MCP URL (e.g.
+	// "http://api:8090/mcp?session_id=..." -> "http://api:8090"). Used for
+	// chat-assent approvals, which call the same decision endpoint the UI's
+	// Approve button calls.
+	mcpURL := os.Getenv("NOMOS_MCP_URL")
+	apiBase := ""
+	if idx := strings.Index(mcpURL, "/mcp"); idx > 0 {
+		apiBase = mcpURL[:idx]
+	}
+
+	return &agent{
+		clients:    clients,
+		system:     system,
+		provider:   &provider,
+		model:      model,
+		store:      st,
+		agentID:    agentID,
+		reqOpts:    reqOpts,
+		apiBase:    apiBase,
+		apiToken:   os.Getenv("OIKOS_MCP_BEARER_TOKEN"),
+		httpClient: &http.Client{Timeout: 15 * time.Second},
+	}, nil
+}
+
+func loadSoul() string {
+	paths := []string{"/app/nomos/SOUL.md", "nomos/SOUL.md"}
+	for _, p := range paths {
+		if data, err := os.ReadFile(p); err == nil {
+			return string(data)
+		}
+	}
+	return `You are Nomos, the steward of the oikos — the AI agent for the hubris homelab.
+You have access to MCP tools to query topology, health, knowledge, and request
+gated mutations through request_execution. Be concise. Prefer tools over guessing.`
+}
+
+// assentWindowDuration is how long after an operator approves a plan that
+// config_mutation commands auto-run without re-approval. The operator
+// approved the plan; the agent should execute it end-to-end without
+// stopping every step to re-ask. Destructive actions still always need
+// explicit typed confirmation regardless of the window.
+const assentWindowDuration = 30 * time.Minute
+
+// openAssentWindow records an active assent window in autonomy_settings so
+// the MCP run tool (separate process) can check it before requiring approval
+// for config_mutation commands. Key is scoped to this agent's UUID AND this
+// session/task — see store.go's assentWindowActive for why: without the
+// session dimension, approving one task's plan would silently auto-run
+// unapproved actions in any other concurrently-running task.
+func (a *agent) openAssentWindow(ctx context.Context, sessionID string) {
+	if a.store == nil || a.store.pool == nil || a.agentID == uuid.Nil || sessionID == "" {
+		return
+	}
+	key := assentWindowKey(a.agentID, sessionID)
+	expires := time.Now().Add(assentWindowDuration).UTC().Format(time.RFC3339)
+	_, err := a.store.pool.Exec(ctx,
+		`INSERT INTO autonomy_settings (key, value) VALUES ($1, $2)
+		 ON CONFLICT (key) DO UPDATE SET value = $2`, key, expires)
+	if err != nil {
+		slog.Warn("nomos: openAssentWindow", "error", err)
+	} else {
+		slog.Info("nomos: assent window opened", "agent", a.agentID, "session", sessionID, "expires", expires)
+	}
+}
+
+type toolDef struct {
+	Name        string         `json:"name"`
+	Description string         `json:"description"`
+	InputSchema map[string]any `json:"inputSchema"`
+}
+
+type agentEvent struct {
+	Type       string `json:"type"`
+	Data       any    `json:"data,omitempty"`
+	SessionID  string `json:"session_id,omitempty"`
+	Iteration  int    `json:"iteration,omitempty"`
+}
+
+func (a *agent) chat(ctx context.Context, sessionID, message string, emit func(agentEvent)) {
+	a.chatWith(ctx, sessionID, message, "", emit)
+}
+
+// chatWith is chat() with an optional system-injected note appended after the
+// replayed history. The auto-continuation worker uses it to resume a session
+// with a finished execution's result ("execution X completed: … — continue the
+// plan") without persisting a fake user turn. message is normally the new user
+// message; for a worker continuation it is empty and systemInject carries the
+// note.
+func (a *agent) chatWith(ctx context.Context, sessionID, message, systemInject string, emit func(agentEvent)) {
+	correlationID := uuid.New().String()
+
+	tools, err := a.buildTools(sessionID)
+	if err != nil {
+		emit(agentEvent{Type: "error", Data: fmt.Sprintf("build tools: %v", err), SessionID: sessionID})
+		return
+	}
+
+	system := a.system
+	if snapshot := a.fleetSnapshot(sessionID); snapshot != "" {
+		system += "\n\n" + snapshot
+	}
+	messages := []openai.ChatCompletionMessageParamUnion{openai.SystemMessage(system)}
+	history, truncatedHistory, _ := a.store.getRecentMessages(ctx, sessionID, historyWindowSize)
+	if truncatedHistory {
+		// Tell the model explicitly rather than silently dropping older
+		// turns — otherwise it might assume something wasn't done just
+		// because it doesn't see the turn that did it.
+		messages = append(messages, openai.SystemMessage(fmt.Sprintf(
+			"[System: this task has been running long enough that only the most recent %d turns of its history are included above your context — earlier turns happened but aren't shown. If you need to know what was already tried or found, check search_knowledge/get_entity_knowledge (if you recorded it) rather than assuming it didn't happen.]",
+			historyWindowSize)))
+	}
+	// sawSetGoal / sawCompleteTask track whether this session has EVER framed
+	// itself as a structured task (set_goal) or already reached a terminal
+	// state (complete_task) — across both replayed history and this turn's
+	// own tool calls (updated again below as they happen live). Used by the
+	// end-of-turn safety net (plans/2026-07-11-task-completion-safety-net.md,
+	// fix 1): most sessions are a single trivial Q&A exchange that answers in
+	// text and never calls either tool, leaving agent_sessions.status stuck
+	// at its creation-time default forever. If a session never framed itself
+	// as a task, its first plain-text turn-end IS the task ending.
+	var sawSetGoal, sawCompleteTask bool
+	var lastAssistantCalls []persistedCall
+	for _, m := range history {
+		text := extractText(m.Content)
+		switch m.Role {
+		case "user":
+			messages = append(messages, openai.UserMessage(text))
+		case "assistant":
+			if calls := extractToolCalls(m.Content); len(calls) > 0 {
+				messages = append(messages, assistantToolCallMessage(calls))
+				for _, c := range calls {
+					messages = append(messages, openai.ToolMessage(c.resultText(), c.id))
+					switch c.name {
+					case "set_goal":
+						sawSetGoal = true
+					case "complete_task":
+						sawCompleteTask = true
+					}
+				}
+				lastAssistantCalls = calls
+			}
+			if text != "" {
+				messages = append(messages, openai.AssistantMessage(text))
+			}
+		}
+	}
+	if len(history) == 0 {
+		messages = append(messages, openai.UserMessage(message))
+	}
+
+	// Chat-assent approval: if the immediately-preceding assistant turn
+	// proposed gated action(s) and the operator's new message reads as
+	// authorization ("go ahead", "yes", ...), grant them now — this is the
+	// primary approval path; the Approve button in the UI is a fallback for
+	// when the operator wants to click instead of type. Destructive-risk
+	// actions are never granted by loose assent — they need the stricter
+	// isTypedConfirmation ("I confirm ...", per SOUL.md's guidance for what
+	// to ask the operator to type).
+	pending := extractPendingApprovals(lastAssistantCalls)
+	assent := isAssent(message)
+	typedConfirm := isTypedConfirmation(message)
+	if len(pending) > 0 && (assent || typedConfirm) {
+		var granted, blocked []string
+		for _, p := range pending {
+			if p.destructive && !typedConfirm {
+				blocked = append(blocked, p.execID)
+				continue
+			}
+			if !p.destructive && !assent {
+				continue // typed-confirm alone doesn't grant a non-destructive item without also reading as assent
+			}
+			ok, status, aerr := a.approveExecution(ctx, p.execID)
+			if aerr != nil {
+				slog.Error("nomos: chat-assent approve", "execution", p.execID, "error", aerr)
+				continue
+			}
+			if ok {
+				granted = append(granted, p.execID)
+				slog.Info("nomos: chat-assent granted", "execution", p.execID, "status", status, "session", sessionID)
+				emit(agentEvent{Type: "tool_use", Data: map[string]any{"name": "chat_assent", "args": map[string]any{"execution_id": p.execID}, "id": "assent-" + p.execID}, SessionID: sessionID})
+				emit(agentEvent{Type: "tool_result", Data: map[string]any{"name": "chat_assent", "result": fmt.Sprintf("Approved via chat assent (%q). Status: %s.", message, status), "id": "assent-" + p.execID}, SessionID: sessionID})
+
+				// An explicit typed confirmation for a destructive action
+				// opens a short, target-scoped window so the rest of a
+				// destructive recovery sequence on the SAME target (e.g.
+				// stop -> destroy) doesn't need a second typed confirmation.
+				if p.destructive && typedConfirm {
+					if execUUID, perr := uuid.Parse(p.execID); perr == nil {
+						if target := a.store.executionTarget(ctx, execUUID); target != "" {
+							a.store.openDestructiveWindow(ctx, a.agentID, target, sessionID)
+							slog.Info("nomos: destructive window opened", "agent", a.agentID, "target", target, "session", sessionID)
+						}
+					}
+				}
+			}
+		}
+		if len(granted) > 0 {
+			a.openAssentWindow(ctx, sessionID)
+			note := fmt.Sprintf("[System: the operator's message approved pending execution(s) %s via chat assent — they are now running. An assent window is now active for 30 minutes: config_mutation commands will auto-run without re-approval. Do not re-request or call request_execution/run again for these; check get_execution_status if you need the outcome. CONTINUE executing the full plan — do not stop and wait for 'continue' after each step. Only surface to the operator for destructive actions (need typed confirmation) or if you're genuinely stuck after trying alternatives.]", strings.Join(granted, ", "))
+			messages = append(messages, openai.SystemMessage(note))
+		}
+		if len(blocked) > 0 {
+			note := fmt.Sprintf("[System: execution(s) %s are classified DESTRUCTIVE and were NOT approved by loose assent — you must ask the operator for an explicit typed confirmation before they can run. Once they do confirm, further destructive steps on that SAME target (e.g. finishing a stop-then-destroy sequence) will auto-run for 15 minutes without asking again — but a different target always needs its own confirmation.]", strings.Join(blocked, ", "))
+			messages = append(messages, openai.SystemMessage(note))
+		}
+	} else if assent && len(lastAssistantCalls) == 0 {
+		// The operator said "proceed"/"go ahead"/"yes" but the preceding
+		// assistant turn had NO pending approvals — meaning the agent
+		// proposed a plan in text and asked "shall I?" without calling
+		// request_execution yet. Inject a system note telling the agent
+		// the operator approved — go execute the plan now.
+		note := "[System: The operator approved your proposed plan. Execute it now — call request_execution or run to carry out the steps you described. Do not re-describe the plan or ask for confirmation again. The assent window is active: config_mutation commands will auto-run once you create them.]"
+		messages = append(messages, openai.SystemMessage(note))
+		a.openAssentWindow(ctx, sessionID)
+	}
+
+	// Worker continuation: append the finished-execution note so the model
+	// sees the result and decides the next step (proceed / recover / done).
+	if systemInject != "" {
+		messages = append(messages, openai.SystemMessage(systemInject))
+	}
+
+	for i := 0; i < maxIterations; i++ {
+		params := openai.ChatCompletionNewParams{
+			Model:    openai.ChatModel(a.model),
+			Messages: messages,
+			Tools:    tools,
+		}
+
+		var msg openai.ChatCompletionMessage
+		var acc openai.ChatCompletionAccumulator
+
+		for attempt := 0; attempt <= maxLLMRetries; attempt++ {
+			acc = openai.ChatCompletionAccumulator{}
+			stream := a.provider.Chat.Completions.NewStreaming(ctx, params, a.reqOpts...)
+			for stream.Next() {
+				chunk := stream.Current()
+				acc.AddChunk(chunk)
+				if len(chunk.Choices) > 0 {
+					if delta := chunk.Choices[0].Delta.Content; delta != "" {
+						emit(agentEvent{Type: "text_delta", Data: delta, SessionID: sessionID, Iteration: i + 1})
+					}
+				}
+			}
+			if err := stream.Err(); err != nil {
+				if attempt < maxLLMRetries {
+					slog.Warn("nomos: llm stream error, retrying", "error", err, "attempt", attempt+1, "session", sessionID)
+					continue
+				}
+				emit(agentEvent{Type: "error", Data: fmt.Sprintf("llm: %v", err), SessionID: sessionID})
+				return
+			}
+			if len(acc.Choices) == 0 {
+				if attempt < maxLLMRetries {
+					slog.Warn("nomos: no choices in response, retrying", "attempt", attempt+1, "session", sessionID)
+					continue
+				}
+				emit(agentEvent{Type: "error", Data: "no choices in response", SessionID: sessionID})
+				return
+			}
+
+			msg = acc.Choices[0].Message
+
+			if len(msg.ToolCalls) == 0 {
+				if isRefusalOrEmpty(msg.Content) {
+					if attempt < maxLLMRetries {
+						slog.Warn("nomos: empty or refusal response, retrying",
+							"session", sessionID, "iter", i+1, "attempt", attempt+1,
+							"content_len", len(msg.Content))
+						continue
+					}
+					emit(agentEvent{Type: "error", Data: "Nomos returned an empty or unusable response — please retry.", SessionID: sessionID})
+					return
+				}
+			}
+			break
+		}
+
+		if len(msg.ToolCalls) == 0 {
+			emit(agentEvent{Type: "text", Data: msg.Content, SessionID: sessionID})
+			if !sawSetGoal && !sawCompleteTask {
+				a.autoCompleteTrivialTask(ctx, sessionID, msg.Content)
+			}
+			emit(agentEvent{Type: "done", Data: map[string]any{
+				"session_id":     sessionID,
+				"usage":          acc.Usage,
+				"correlation_id": correlationID,
+				"iterations":     i + 1,
+			}, SessionID: sessionID})
+			return
+		}
+
+		slog.Info("nomos: tool calls", "count", len(msg.ToolCalls), "iter", i+1, "correlation", correlationID)
+
+		messages = append(messages, msg.ToParam())
+
+		for _, tc := range msg.ToolCalls {
+			var args map[string]any
+			if err := json.Unmarshal([]byte(tc.Function.Arguments), &args); err != nil {
+				args = map[string]any{}
+			}
+
+			switch tc.Function.Name {
+			case "set_goal":
+				sawSetGoal = true
+			case "complete_task":
+				sawCompleteTask = true
+			}
+
+			emit(agentEvent{
+				Type:      "tool_use",
+				Data:      map[string]any{"name": tc.Function.Name, "args": args, "id": tc.ID},
+				SessionID: sessionID,
+				Iteration: i + 1,
+			})
+
+			start := time.Now()
+			// Session-scoped task tools are handled in-process; everything else
+			// is forwarded to the shared MCP server.
+			var result any
+			var callErr error
+			if localRes, handled := a.handleTaskTool(ctx, sessionID, tc.Function.Name, args); handled {
+				result = localRes
+			} else {
+				// _session_id rides along on the wire call only — never in
+				// `args` (which is what gets emitted/logged/persisted as the
+				// model's own tool call) — so the MCP-side assent/destructive
+				// window checks can scope to THIS task instead of bleeding
+				// across every concurrently-running one sharing this agent
+				// identity. Not part of any tool's declared InputSchema, so
+				// the model never sees or supplies it.
+				wireArgs := make(map[string]any, len(args)+1)
+				for k, v := range args {
+					wireArgs[k] = v
+				}
+				wireArgs["_session_id"] = sessionID
+				var client *mcpClient
+				client, callErr = a.clients.get(sessionID)
+				if callErr == nil {
+					result, callErr = client.callTool(tc.Function.Name, wireArgs)
+				}
+			}
+			elapsed := int(time.Since(start).Milliseconds())
+
+			inputJSON, _ := json.Marshal(args)
+			inputStr := string(inputJSON)
+
+			if callErr != nil {
+				a.store.logActivity(ctx, a.agentID, sessionID, tc.Function.Name, args, inputStr, callErr.Error(), elapsed, false, correlationID)
+
+				emit(agentEvent{
+					Type:      "tool_result",
+					Data:      map[string]any{"name": tc.Function.Name, "error": callErr.Error(), "id": tc.ID},
+					SessionID: sessionID,
+					Iteration: i + 1,
+				})
+				messages = append(messages, openai.ToolMessage(callErr.Error(), tc.ID))
+				slog.Error("nomos: tool error", "tool", tc.Function.Name, "error", callErr, "ms", elapsed)
+				continue
+			}
+
+			resultJSON, _ := json.Marshal(result)
+			a.store.logActivity(ctx, a.agentID, sessionID, tc.Function.Name, args, inputStr, string(resultJSON), elapsed, true, correlationID)
+
+			// Link any execution this tool queued/started back to this
+			// session, so the auto-continuation worker can feed its result
+			// back here when it finishes (see cmd/nomos/continue.go). Async
+			// executions (pct_create, apt_upgrade) are the ones that matter —
+			// their result lands after this turn ends.
+			for _, execID := range extractExecutionIDs(string(resultJSON)) {
+				a.store.linkExecution(ctx, execID, sessionID)
+			}
+
+			// Record which entities this task touched (task —involves→ entity)
+			// and pulse them on the live context panel. Args only — never
+			// results — so a bulk query doesn't drag the whole fleet in.
+			a.store.recordTouched(ctx, sessionID, tc.Function.Name, args)
+
+			// When the agent records knowledge, link that note to this task so
+			// the task's outcome view shows what it learned (and pulse it live).
+			if tc.Function.Name == "upsert_knowledge" {
+				a.store.linkKnowledgeToTask(ctx, sessionID, string(resultJSON))
+			}
+
+			emit(agentEvent{
+				Type:      "tool_result",
+				Data:      map[string]any{"name": tc.Function.Name, "result": result, "id": tc.ID},
+				SessionID: sessionID,
+				Iteration: i + 1,
+			})
+			messages = append(messages, openai.ToolMessage(string(resultJSON), tc.ID))
+			slog.Info("nomos: tool success", "tool", tc.Function.Name, "ms", elapsed)
+
+			// ask_operator pauses the task: the agent has posed a decision only
+			// the operator can make. End the turn here so it doesn't barrel past
+			// its own question — the answer (panel or chat reply) resumes it.
+			// The prompt becomes the assistant's visible message so the question
+			// also shows inline in the transcript.
+			if tc.Function.Name == "ask_operator" {
+				prompt, _ := args["prompt"].(string)
+				emit(agentEvent{Type: "text", Data: prompt, SessionID: sessionID})
+				emit(agentEvent{Type: "done", Data: map[string]any{
+					"session_id":     sessionID,
+					"correlation_id": correlationID,
+					"iteration":      i + 1,
+				}, SessionID: sessionID})
+				return
+			}
+		}
+	}
+
+	// Hitting the step limit used to end the turn with a bare "max iterations
+	// reached without final answer" — a dead end that made the operator ask
+	// "status?" to find out what actually happened after a long working turn.
+	// Instead, spend one final call asking the model to summarize what it did
+	// and the current state, so the turn always ends with a real report.
+	messages = append(messages, openai.SystemMessage("[System: you've reached the step limit for this turn. STOP calling tools now and write a concise status report: what you accomplished, the current state of the goal, anything that failed, and what remains. This is what the operator sees.]"))
+	summary := a.finalSummary(ctx, messages)
+	if summary == "" {
+		summary = "I hit this turn's step limit while working. I've done a lot but couldn't wrap up cleanly — ask me for a status update and I'll summarize the current state."
+	}
+	emit(agentEvent{Type: "text", Data: summary, SessionID: sessionID})
+	emit(agentEvent{Type: "done", Data: map[string]any{
+		"session_id":     sessionID,
+		"correlation_id": correlationID,
+		"iterations":     maxIterations,
+	}, SessionID: sessionID})
+}
+
+// finalSummary makes one non-tool LLM call to turn an exhausted tool-loop into
+// a real status report instead of a dead-end message. Best-effort: empty on
+// any error, and the caller has a fallback.
+func (a *agent) finalSummary(ctx context.Context, messages []openai.ChatCompletionMessageParamUnion) string {
+	params := openai.ChatCompletionNewParams{
+		Model:    openai.ChatModel(a.model),
+		Messages: messages,
+		// No Tools: force a text answer.
+	}
+	resp, err := a.provider.Chat.Completions.New(ctx, params, a.reqOpts...)
+	if err != nil || len(resp.Choices) == 0 {
+		return ""
+	}
+	return resp.Choices[0].Message.Content
+}
+
+// extractText pulls the "text" field from a persisted message's JSONB content.
+func extractText(content json.RawMessage) string {
+	var m struct {
+		Text string `json:"text"`
+	}
+	if err := json.Unmarshal(content, &m); err != nil {
+		return ""
+	}
+	return m.Text
+}
+
+// persistedCall is one merged tool_use+tool_result pair from a persisted
+// assistant message's tool_calls array. The store keeps them as two entries
+// sharing the same id (mirroring the SSE event pair); replay needs one
+// entry per id to build a valid tool-calling assistant message.
+type persistedCall struct {
+	id     string
+	name   string
+	args   json.RawMessage
+	result json.RawMessage
+	errMsg string
+}
+
+func (c persistedCall) resultText() string {
+	if c.errMsg != "" {
+		return c.errMsg
+	}
+	if len(c.result) > 0 {
+		return string(c.result)
+	}
+	return "null"
+}
+
+// extractToolCalls parses and merges a persisted message's tool_calls array,
+// preserving first-seen order across ids.
+func extractToolCalls(content json.RawMessage) []persistedCall {
+	var m struct {
+		ToolCalls []struct {
+			ID     string          `json:"id"`
+			Type   string          `json:"type"`
+			Name   string          `json:"name"`
+			Args   json.RawMessage `json:"args"`
+			Result json.RawMessage `json:"result"`
+			Error  string          `json:"error"`
+		} `json:"tool_calls"`
+	}
+	if err := json.Unmarshal(content, &m); err != nil || len(m.ToolCalls) == 0 {
+		return nil
+	}
+
+	byID := make(map[string]*persistedCall, len(m.ToolCalls))
+	var order []string
+	for _, tc := range m.ToolCalls {
+		if tc.ID == "" {
+			continue
+		}
+		pc, ok := byID[tc.ID]
+		if !ok {
+			pc = &persistedCall{id: tc.ID}
+			byID[tc.ID] = pc
+			order = append(order, tc.ID)
+		}
+		if tc.Name != "" {
+			pc.name = tc.Name
+		}
+		if len(tc.Args) > 0 && string(tc.Args) != "null" {
+			pc.args = tc.Args
+		}
+		if tc.Type == "tool_result" {
+			pc.errMsg = tc.Error
+			pc.result = tc.Result
+		}
+	}
+
+	calls := make([]persistedCall, 0, len(order))
+	for _, id := range order {
+		calls = append(calls, *byID[id])
+	}
+	return calls
+}
+
+// assistantToolCallMessage builds the tool-calling assistant message that
+// must precede the tool-role results being replayed.
+func assistantToolCallMessage(calls []persistedCall) openai.ChatCompletionMessageParamUnion {
+	toolCalls := make([]openai.ChatCompletionMessageToolCallParam, 0, len(calls))
+	for _, c := range calls {
+		args := string(c.args)
+		if args == "" {
+			args = "{}"
+		}
+		toolCalls = append(toolCalls, openai.ChatCompletionMessageToolCallParam{
+			ID: c.id,
+			Function: openai.ChatCompletionMessageToolCallFunctionParam{
+				Name:      c.name,
+				Arguments: args,
+			},
+		})
+	}
+	return openai.ChatCompletionMessageParamUnion{
+		OfAssistant: &openai.ChatCompletionAssistantMessageParam{ToolCalls: toolCalls},
+	}
+}
+
+// fleetSnapshot returns a compact, current-as-of-now fleet health line for
+// the system prompt so the agent starts each turn already oriented instead
+// of spending its first iteration rediscovering topology it already has
+// tools to query. Best-effort: an empty string on any failure just means no
+// snapshot, not an error for the turn.
+func (a *agent) fleetSnapshot(sessionID string) string {
+	client, err := a.clients.get(sessionID)
+	if err != nil {
+		return ""
+	}
+	result, err := client.callTool("get_health_summary", map[string]any{})
+	if err != nil {
+		return ""
+	}
+	rows, ok := result.([]any)
+	if !ok {
+		return ""
+	}
+
+	counts := map[string]int{}
+	var attention []string
+	for _, r := range rows {
+		row, ok := r.(map[string]any)
+		if !ok {
+			continue
+		}
+		health, _ := row["health"].(string)
+		counts[health]++
+		if health != "healthy" && health != "" {
+			if slug, ok := row["slug"].(string); ok && len(attention) < 10 {
+				attention = append(attention, fmt.Sprintf("%s(%s)", slug, health))
+			}
+		}
+	}
+	if len(counts) == 0 {
+		return ""
+	}
+
+	summary := fmt.Sprintf("Current fleet snapshot (as of now): healthy=%d degraded=%d down=%d stale=%d unknown=%d.",
+		counts["healthy"], counts["degraded"], counts["down"], counts["stale"], counts["unknown"])
+	if len(attention) > 0 {
+		summary += " Needs attention: " + fmt.Sprintf("%v", attention) + "."
+	}
+	return summary
+}
+
+// isRefusalOrEmpty returns true when the LLM response is blank or looks like a
+// canned non-English refusal to an English-language conversation. Flash-tier
+// models occasionally emit Chinese boilerplate deflection instead of a real
+// answer; this catches it before it reaches the UI.
+func isRefusalOrEmpty(text string) bool {
+	if strings.TrimSpace(text) == "" {
+		return true
+	}
+	ascii, nonASCII := 0, 0
+	for _, r := range text {
+		if r <= 127 {
+			ascii++
+		} else {
+			nonASCII++
+		}
+	}
+	if nonASCII > ascii {
+		return true
+	}
+	for _, pattern := range refusalDenylist {
+		if strings.Contains(text, pattern) {
+			return true
+		}
+	}
+	return false
+}
+
+func (a *agent) buildTools(sessionID string) ([]openai.ChatCompletionToolParam, error) {
+	client, err := a.clients.get(sessionID)
+	if err != nil {
+		return nil, err
+	}
+	defs, err := client.listToolsFull()
+	if err != nil {
+		return nil, err
+	}
+	// Append nomos-local, session-scoped task tools (complete_task, …) to the
+	// MCP tool list. They're routed to handleTaskTool, not the MCP client.
+	defs = append(defs, taskToolDefs()...)
+
+	var tools []openai.ChatCompletionToolParam
+	for _, d := range defs {
+		params := shared.FunctionParameters(d.InputSchema)
+		if params == nil {
+			params = shared.FunctionParameters{"type": "object", "properties": map[string]any{}}
+		}
+
+		tools = append(tools, openai.ChatCompletionToolParam{
+			Type: "function",
+			Function: shared.FunctionDefinitionParam{
+				Name:        d.Name,
+				Description: openai.String(d.Description),
+				Parameters:  params,
+			},
+		})
+	}
+	return tools, nil
+}
+
+// listToolsFull returns the MCP server's tool list, cached on this client
+// after the first call (see mcpClient.toolsCache). Fix F1 of
+// plans/2026-07-11-nomos-agent-code-review.md: buildTools calls this at the
+// start of every chat turn, including every auto-continuation resume — the
+// tool list is static for the lifetime of one MCP connection, so re-fetching
+// it every single time was avoidable network+parsing work on the hot path.
+// Cache invalidates on reconnectLocked (an api restart may change what's
+// registered).
+func (c *mcpClient) listToolsFull() ([]toolDef, error) {
+	c.toolsMu.Lock()
+	if c.toolsCache != nil {
+		cached := c.toolsCache
+		c.toolsMu.Unlock()
+		return cached, nil
+	}
+	c.toolsMu.Unlock()
+
+	resp, err := c.doRequest("tools/list", map[string]any{})
+	if err != nil {
+		return nil, err
+	}
+	var tr struct {
+		Tools []struct {
+			Name        string         `json:"name"`
+			Description string         `json:"description"`
+			InputSchema map[string]any `json:"inputSchema"`
+		} `json:"tools"`
+	}
+	if err := json.Unmarshal(resp.Result, &tr); err != nil {
+		return nil, err
+	}
+	out := make([]toolDef, len(tr.Tools))
+	for i, t := range tr.Tools {
+		out[i] = toolDef{
+			Name:        t.Name,
+			Description: t.Description,
+			InputSchema: t.InputSchema,
+		}
+	}
+
+	c.toolsMu.Lock()
+	c.toolsCache = out
+	c.toolsMu.Unlock()
+	return out, nil
+}

cmd/nomos/assent.go

@@ -0,0 +1,183 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"regexp"
+	"strings"
+)
+
+// Chat-assent approval: the operator authorizes a proposed action by
+// replying normally in chat ("go ahead", "yes", "do it") instead of clicking
+// a separate Approve button. This is deterministic (not LLM-judged) so it
+// can't be talked around by a model that misreads intent, and it only ever
+// looks at the assistant turn immediately preceding the operator's reply —
+// an old "yes" from three messages ago can never retroactively approve
+// something new. Destructive-risk actions are excluded: they always need the
+// explicit typed-confirmation flow, never loose assent.
+
+// pendingApproval is one gated action proposed in the immediately-preceding
+// assistant turn, extracted from its tool_result text.
+type pendingApproval struct {
+	execID      string
+	destructive bool
+}
+
+// executionQueuedRE matches the "execution <uuid> queued" phrasing shared by
+// the run and request_execution/pct_create tool result messages.
+var executionQueuedRE = regexp.MustCompile(`(?i)execution\s+([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\s+queued`)
+
+// extractPendingApprovals scans the tool results of one assistant turn for
+// gated actions that are still awaiting a decision.
+func extractPendingApprovals(calls []persistedCall) []pendingApproval {
+	var out []pendingApproval
+	for _, c := range calls {
+		text := c.resultText()
+		m := executionQueuedRE.FindStringSubmatch(text)
+		if m == nil {
+			continue
+		}
+		out = append(out, pendingApproval{
+			execID:      m[1],
+			destructive: strings.Contains(strings.ToUpper(text), "DESTRUCTIVE"),
+		})
+	}
+	return out
+}
+
+// negationWords, checked first: any of these anywhere in the message means
+// the reply is NOT assent, even if a positive word also appears (e.g. "no,
+// don't restart it yet" contains neither "yes" nor "go ahead", but "wait"
+// alone should also block a stray "yes" a sentence later — checking negation
+// first and returning false errs toward re-confirming rather than assuming
+// consent, per "when in doubt, escalate"). Includes contracted negatives
+// ("haven't", "isn't", ...) alongside "don't"/"do not" — found live: "I
+// haven't confirmed anything yet" was reading as an explicit confirmation
+// because none of the contracted forms were covered, only "don't"/"do not".
+// Deliberately does NOT include a bare "not": that's broad enough to false-
+// negative ordinary assent ("go ahead, this is not risky") — the specific
+// contracted-verb forms below are unambiguous negation on their own.
+var negationWords = []string{
+	"no", "nope", "don't", "do not", "stop", "wait", "hold on", "hold off",
+	"not yet", "cancel", "nevermind", "never mind", "actually don't", "skip that",
+	"haven't", "hasn't", "isn't", "wasn't", "aren't", "can't", "cannot",
+	"won't", "wouldn't", "shouldn't", "didn't", "doesn't",
+}
+
+// assentWords, checked only if no negation matched.
+var assentWords = []string{
+	"go ahead", "goahead", "yes", "yep", "yeah", "yup", "do it", "proceed",
+	"approve", "approved", "confirm", "confirmed", "ship it", "sounds good",
+	"lgtm", "run it", "execute", "ok go", "okay go", "please do",
+}
+
+// wordTokenRe splits a message into lowercase word tokens. Apostrophes
+// (straight ' and curly ’) stay attached to their word so "don't"/"haven't"
+// tokenize as one token, not two.
+var wordTokenRe = regexp.MustCompile(`[a-z0-9'’]+`)
+
+func tokenize(msg string) []string {
+	return wordTokenRe.FindAllString(strings.ToLower(strings.ReplaceAll(msg, "’", "'")), -1)
+}
+
+// containsPhrase reports whether phrase (one or more words) appears as a
+// consecutive run of WHOLE tokens in tokens — never a mid-word substring
+// match. This is the fix for a real false positive found live: the old
+// substring check (`strings.Contains(m, "yes")`) matched "yes" inside
+// "yesterday", and "confirm" inside "confirmed"/"unconfirmed" without regard
+// for word boundaries. Negation already used a word-boundary check
+// (space-padded); assent/confirm words didn't — this brings both onto the
+// same, more robust tokenized comparison instead of ad-hoc string padding.
+func containsPhrase(tokens []string, phrase string) bool {
+	words := strings.Fields(phrase)
+	if len(words) == 0 || len(words) > len(tokens) {
+		return false
+	}
+	for i := 0; i+len(words) <= len(tokens); i++ {
+		match := true
+		for j, w := range words {
+			if tokens[i+j] != w {
+				match = false
+				break
+			}
+		}
+		if match {
+			return true
+		}
+	}
+	return false
+}
+
+// isAssent reports whether msg is a plain-language authorization of a
+// pending proposal. Deliberately simple and auditable: a fixed word list,
+// not a model judgment call, so behavior is predictable and can't be
+// prompt-injected via the pending action's own content.
+func isAssent(msg string) bool {
+	tokens := tokenize(msg)
+	for _, w := range negationWords {
+		if containsPhrase(tokens, w) {
+			return false
+		}
+	}
+	for _, w := range assentWords {
+		if containsPhrase(tokens, w) {
+			return true
+		}
+	}
+	return false
+}
+
+// isTypedConfirmation reports whether msg is an explicit confirmation strong
+// enough to grant a DESTRUCTIVE pending action. Deliberately a separate,
+// stricter check from isAssent: a bare "yes"/"go ahead"/"proceed" must never
+// grant something destructive, only an explicit "confirm" statement does —
+// this is the typed-confirmation phrase SOUL.md tells the operator to use
+// ("I confirm destroy 135"). Still negation-aware for the same reason as
+// isAssent: "don't confirm yet" must not accidentally match.
+func isTypedConfirmation(msg string) bool {
+	tokens := tokenize(msg)
+	for _, w := range negationWords {
+		if containsPhrase(tokens, w) {
+			return false
+		}
+	}
+	return containsPhrase(tokens, "confirm") || containsPhrase(tokens, "confirmed")
+}
+
+// approveExecution grants (or denies) a pending execution via the same HTTP
+// endpoint the chat UI's Approve button calls, so both paths share one code
+// path server-side (executeApprovedAction) and one audit trail. Returns the
+// decided status, or an error if the request failed outright (a 4xx for an
+// already-decided/expired approval is reported via ok=false, not a hard err,
+// since that's an expected race, not a bug).
+func (a *agent) approveExecution(ctx context.Context, execID string) (ok bool, status string, err error) {
+	if a.apiBase == "" {
+		return false, "", fmt.Errorf("no API base configured")
+	}
+	body, _ := json.Marshal(map[string]string{"decision": "approve"})
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost,
+		a.apiBase+"/api/v1/approvals/"+execID+"/decision", bytes.NewReader(body))
+	if err != nil {
+		return false, "", err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	if a.apiToken != "" {
+		req.Header.Set("Authorization", "Bearer "+a.apiToken)
+	}
+	resp, err := a.httpClient.Do(req)
+	if err != nil {
+		return false, "", err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return false, "", nil // already decided / expired / not found — not a hard failure
+	}
+	var out struct {
+		Status string `json:"status"`
+	}
+	json.NewDecoder(resp.Body).Decode(&out)
+	return true, out.Status, nil
+}

cmd/nomos/assent_test.go

@@ -0,0 +1,136 @@
+package main
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestIsAssent_Positive(t *testing.T) {
+	cases := []string{
+		"go ahead", "Go ahead.", "yes", "Yes!", "yeah", "yep", "do it",
+		"proceed", "approve", "ship it", "sounds good", "lgtm", "please do",
+		"ok go ahead and run it",
+	}
+	for _, c := range cases {
+		if !isAssent(c) {
+			t.Errorf("isAssent(%q) = false, want true", c)
+		}
+	}
+}
+
+func TestIsAssent_Negative(t *testing.T) {
+	cases := []string{
+		"no", "no, don't", "wait", "hold on", "not yet", "cancel that",
+		"nevermind", "what's the plan for tomorrow?", "how many CPUs does strong have?",
+		"maybe later", "",
+	}
+	for _, c := range cases {
+		if isAssent(c) {
+			t.Errorf("isAssent(%q) = true, want false", c)
+		}
+	}
+}
+
+func TestIsAssent_NegationBeatsAssentWord(t *testing.T) {
+	// Contains "yes" as a substring pattern risk word but is clearly not
+	// assent — negation must win.
+	cases := []string{
+		"no, don't do it yet",
+		"wait, not yet please",
+	}
+	for _, c := range cases {
+		if isAssent(c) {
+			t.Errorf("isAssent(%q) = true, want false (negation should block)", c)
+		}
+	}
+}
+
+// TestIsAssent_WholeWordBoundary regression-tests a real false positive found
+// live: the old substring check matched "yes" inside "yesterday" (and would
+// equally match "confirm" inside "confirmed"/"unconfirmed" for
+// isTypedConfirmation below) because only negation used a word-boundary
+// check — assent/confirm words used a bare strings.Contains. Confirmed via a
+// throwaway probe before being fixed; kept here permanently so a future
+// change can't silently reintroduce it.
+func TestIsAssent_WholeWordBoundary(t *testing.T) {
+	cases := []string{
+		"not sure, maybe yesterday's logs show something useful",
+		"my eyesight isn't great, what does that say",
+	}
+	for _, c := range cases {
+		if isAssent(c) {
+			t.Errorf("isAssent(%q) = true, want false (word-boundary: 'yes' must not match inside 'yesterday'/'eyesight')", c)
+		}
+	}
+}
+
+// TestIsTypedConfirmation_ContractedNegation regression-tests the other real
+// false positive: isTypedConfirmation gates DESTRUCTIVE actions, and
+// "confirm" matching inside "confirmed" combined with contracted negatives
+// ("haven't") not being in negationWords meant a message that explicitly
+// says the operator has NOT confirmed something could read as confirming it.
+func TestIsTypedConfirmation_ContractedNegation(t *testing.T) {
+	cases := []string{
+		"I haven't confirmed anything yet, let me think",
+		"that isn't confirmed on my end",
+		"we can't confirm that until tomorrow",
+	}
+	for _, c := range cases {
+		if isTypedConfirmation(c) {
+			t.Errorf("isTypedConfirmation(%q) = true, want false (contracted negation should block)", c)
+		}
+	}
+}
+
+func TestIsTypedConfirmation(t *testing.T) {
+	positive := []string{
+		"I confirm destroy 135 in strong",
+		"confirm",
+		"Confirmed.",
+		"yes I confirm",
+	}
+	for _, c := range positive {
+		if !isTypedConfirmation(c) {
+			t.Errorf("isTypedConfirmation(%q) = false, want true", c)
+		}
+	}
+	negative := []string{
+		"yes", "go ahead", "do it", "proceed", "lgtm", // loose assent must NOT satisfy this
+		"no, don't confirm yet", "wait", "",
+	}
+	for _, c := range negative {
+		if isTypedConfirmation(c) {
+			t.Errorf("isTypedConfirmation(%q) = true, want false (only explicit confirm should pass)", c)
+		}
+	}
+}
+
+func TestExtractPendingApprovals(t *testing.T) {
+	mkCall := func(text string) persistedCall {
+		b, _ := json.Marshal(text)
+		return persistedCall{id: "x", name: "run", result: json.RawMessage(b)}
+	}
+	calls := []persistedCall{
+		mkCall("run on host:strong requires approval (risk: config_mutation) — execution 019f4930-e22b-7c47-8c6e-715dcd59df19 queued. Present the command..."),
+		mkCall("some unrelated read-only result, no approval here"),
+		mkCall("run on lxc:caddy requires approval (risk: destructive) — execution 019f4931-aaaa-7c47-8c6e-715dcd59df20 queued. This is classified DESTRUCTIVE — flag that clearly."),
+	}
+	got := extractPendingApprovals(calls)
+	if len(got) != 2 {
+		t.Fatalf("expected 2 pending approvals, got %d: %+v", len(got), got)
+	}
+	if got[0].execID != "019f4930-e22b-7c47-8c6e-715dcd59df19" || got[0].destructive {
+		t.Errorf("first approval wrong: %+v", got[0])
+	}
+	if got[1].execID != "019f4931-aaaa-7c47-8c6e-715dcd59df20" || !got[1].destructive {
+		t.Errorf("second approval should be flagged destructive: %+v", got[1])
+	}
+}
+
+func TestExtractPendingApprovals_NoneWhenNoneQueued(t *testing.T) {
+	b, _ := json.Marshal("fleet is healthy, nothing to report")
+	calls := []persistedCall{{id: "x", result: json.RawMessage(b)}}
+	if got := extractPendingApprovals(calls); len(got) != 0 {
+		t.Errorf("expected no pending approvals, got %+v", got)
+	}
+}

cmd/nomos/continue.go

@@ -0,0 +1,288 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/dtoro/oikos/internal/safego"
+	"github.com/google/uuid"
+)
+
+// execIDRe matches "execution <uuid>" in a tool result — the phrasing shared
+// by request_execution / run when they queue or start a gated execution.
+// Only these async executions need continuation; the synchronous auto-run
+// path returns its output inline and is already observed in-turn.
+var execIDRe = regexp.MustCompile(`(?i)execution\s+([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})`)
+
+func extractExecutionIDs(toolResult string) []uuid.UUID {
+	matches := execIDRe.FindAllStringSubmatch(toolResult, -1)
+	seen := map[uuid.UUID]bool{}
+	var out []uuid.UUID
+	for _, m := range matches {
+		if id, err := uuid.Parse(m[1]); err == nil && !seen[id] {
+			seen[id] = true
+			out = append(out, id)
+		}
+	}
+	return out
+}
+
+// idleTaskThreshold is how long a goal-bearing session can sit non-terminal
+// with no activity before the idle sweep nudges it, per
+// plans/2026-07-11-task-completion-safety-net.md. Arbitrary starting point,
+// not measured against real task durations — long enough that it won't fire
+// mid-turn, short enough the board doesn't lie for hours.
+const idleTaskThreshold = 15 * time.Minute
+
+// runIdleSweepWorker is the safety net for case 2 of
+// plans/2026-07-11-task-completion-safety-net.md: sessions that called
+// set_goal (so the inline safety net in agent.go correctly left them alone,
+// since they framed themselves as a real task) but then stalled without
+// ever calling complete_task. Coarser than runContinuationWorker's 4s tick
+// since "gone idle" is a much slower signal than "an execution just
+// finished." Blocks until ctx is cancelled.
+func (a *agent) runIdleSweepWorker(ctx context.Context) {
+	if a.store == nil {
+		slog.Warn("nomos: idle sweep worker disabled (no store)")
+		return
+	}
+	slog.Info("nomos: idle sweep worker started")
+	ticker := time.NewTicker(5 * time.Minute)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			a.processIdleSweep(ctx)
+		}
+	}
+}
+
+// processIdleSweep nudges a stalled goal-bearing session once; if it's still
+// non-terminal on the NEXT sweep (meaning the nudge itself went unanswered,
+// not just that the model is still working), auto-closes it with a
+// visible "auto-closed" outcome instead of leaving it stuck forever — same
+// reasoning resumeSession already applies below for a different failure
+// mode (a resume that produces no response at all).
+func (a *agent) processIdleSweep(ctx context.Context) {
+	stale := a.store.staleGoalSessions(ctx, idleTaskThreshold, 5)
+	for _, s := range stale {
+		s := s
+		if s.CompletionNudges == 0 {
+			safego.Go("nomos:idle-nudge:"+s.ID, func() {
+				if err := a.store.bumpCompletionNudge(ctx, s.ID); err != nil {
+					slog.Error("nomos: idle nudge bump failed", "session", s.ID, "error", err)
+					return
+				}
+				note := fmt.Sprintf("[System: this task ('%s') has been idle for %s with no complete_task call. "+
+					"If the goal is done (or can't be completed), call complete_task now with the outcome and a "+
+					"one-line summary. If you're still genuinely working through the plan, ignore this and continue.]",
+					s.Goal, idleTaskThreshold)
+				a.resumeSession(ctx, s.ID, note)
+			})
+			continue
+		}
+		safego.Go("nomos:idle-autoclose:"+s.ID, func() {
+			summary := fmt.Sprintf("Auto-closed after %s idle with no response to a completion nudge.", idleTaskThreshold)
+			if err := a.store.completeTask(ctx, s.ID, "partial", summary); err != nil {
+				slog.Error("nomos: idle auto-close failed", "session", s.ID, "error", err)
+			}
+		})
+	}
+}
+
+// runContinuationWorker is the event loop that replaces the human typing
+// "continue". It polls for gated executions that (a) were initiated by a chat
+// session and (b) have just finished, and — while that agent has an open assent
+// window (an approved plan is in flight) — feeds each result back into the
+// agent so it proceeds to the next step or recovers from the failure, all
+// without an operator tick. Blocks until ctx is cancelled.
+func (a *agent) runContinuationWorker(ctx context.Context) {
+	if a.store == nil {
+		slog.Warn("nomos: continuation worker disabled (no store)")
+		return
+	}
+	slog.Info("nomos: continuation worker started")
+	ticker := time.NewTicker(4 * time.Second)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			a.processContinuations(ctx)
+		}
+	}
+}
+
+// processContinuations dispatches each pending item as its OWN goroutine
+// (safego.Go, so a panic deep in one task's resumed turn — JSON parsing of
+// model output, an unexpected nil in a tool result — is recovered and logged
+// instead of taking down this whole function, which used to run every
+// item sequentially in the SAME goroutine as the ticker loop. Two problems
+// that fixed: (1) throughput — task B's continuation no longer waits for
+// task A's full (up to 10-minute) resumed turn to finish first, the exact
+// per-task blocking this session's earlier concurrency work removed from the
+// live-chat path but had left in place here; (2) survivability — since Go
+// panics unwind the goroutine they occur in, an unrecovered one here used to
+// mean this call (and every future tick, since the whole ticker loop runs in
+// one goroutine) would simply stop — auto-continuation for every task would
+// silently die until nomos restarted. Now a single bad item can only ever
+// take down its own goroutine.
+func (a *agent) processContinuations(ctx context.Context) {
+	pending := a.store.pendingContinuations(ctx, 5)
+	for _, p := range pending {
+		// Scope gate: only auto-continue while an approved plan is active FOR
+		// THIS SESSION. Checked per-item, not once for the whole batch — with
+		// multiple tasks in flight, one task's open window must never cover a
+		// pending continuation belonging to a different task.
+		if !a.store.assentWindowActive(ctx, a.agentID, p.SessionID) {
+			// A finished one-off execution with no window is left as-is
+			// (marked continued so we don't re-check it forever) — the
+			// operator decides what happens next, as today.
+			a.store.markContinued(ctx, p.ExecID)
+			continue
+		}
+		a.store.markContinued(ctx, p.ExecID) // stamp first: a failure here must not cause a re-continue loop
+		safego.Go("nomos:continue-session:"+p.SessionID, func() { a.continueSession(ctx, p) })
+	}
+}
+
+// continueSession re-invokes the agent for one finished execution. Persists
+// progress LIVE — a placeholder row immediately, updated in place as each
+// tool call completes — instead of only saving once the whole continuation
+// finishes. The frontend polls (see chat.ts startPolling); without
+// incremental persistence here, a continuation that runs several tool calls
+// before concluding would look like total silence in the UI for however long
+// that takes, which is exactly the "I just wait while nothing happens"
+// complaint this exists to fix — polling alone only helps if there's
+// something new to poll for.
+func (a *agent) continueSession(ctx context.Context, p pendingContinuation) {
+	slog.Info("nomos: auto-continuing session", "session", p.SessionID, "execution", p.ExecID, "status", p.Status)
+	a.resumeSession(ctx, p.SessionID, buildContinuationNote(p))
+}
+
+// resumeSession re-invokes the agent for a session with a system-injected note —
+// a finished execution (continueSession) or an operator's answer to a question
+// (handleAnswerQuestion) — persisting progress LIVE (a placeholder row updated
+// in place as each tool call lands) so the frontend poller sees each step,
+// instead of total silence until the whole resume concludes.
+func (a *agent) resumeSession(ctx context.Context, sessionID, note string) {
+	placeholder, _ := json.Marshal(map[string]any{
+		"role": "assistant",
+		"text": "",
+		"auto": true,
+	})
+	msgID, err := a.store.insertMessageReturningID(ctx, sessionID, "assistant", placeholder)
+	if err != nil {
+		slog.Error("nomos: resume placeholder insert failed", "session", sessionID, "error", err)
+	}
+
+	var toolCalls []map[string]any
+	var finalText, errText string
+
+	persist := func() {
+		if msgID == uuid.Nil {
+			return
+		}
+		text := finalText
+		if text == "" && errText != "" {
+			text = fmt.Sprintf("(auto-continuation hit an internal error and did not respond: %s — the execution's own result is above; you may need to prompt the agent again)", errText)
+		}
+		body, _ := json.Marshal(map[string]any{
+			"role":       "assistant",
+			"text":       text,
+			"tool_calls": toolCalls,
+			"auto":       true, // marks this as an autonomous continuation, not an operator turn
+		})
+		a.store.updateMessage(ctx, msgID, body)
+	}
+
+	// One retry if the LLM call itself produced nothing (transient flake /
+	// empty-response) — the whole point of this mechanism is "don't give up
+	// on the first error," which should apply to the continuation call
+	// itself, not just the homelab commands it's continuing. Found live: a
+	// destructive-recovery continuation hit an empty LLM response, its
+	// internal retry (chatWith's own maxLLMRetries=1) also came up empty, and
+	// without this outer retry the operator would see nothing at all.
+	cctx, cancel := context.WithTimeout(ctx, 10*time.Minute)
+	defer cancel()
+	for attempt := 0; attempt < 2; attempt++ {
+		toolCalls, finalText, errText = nil, "", ""
+		emit := func(ev agentEvent) {
+			if ev.Type == "tool_use" || ev.Type == "tool_result" {
+				if m, ok := ev.Data.(map[string]any); ok {
+					m["type"] = ev.Type
+					toolCalls = append(toolCalls, m)
+				}
+				persist() // live: a poller sees this step land within seconds
+			}
+			if ev.Type == "text" {
+				finalText, _ = ev.Data.(string)
+			}
+			if ev.Type == "error" {
+				errText, _ = ev.Data.(string)
+			}
+		}
+		a.chatWith(cctx, sessionID, "", note, emit)
+		if finalText != "" || len(toolCalls) > 0 {
+			break
+		}
+		if attempt == 0 {
+			slog.Warn("nomos: resume produced nothing, retrying once", "session", sessionID, "error", errText)
+		}
+	}
+
+	if errText != "" && finalText == "" {
+		slog.Error("nomos: resume produced no response after retry", "session", sessionID, "error", errText)
+		// Give the task a real, operator-visible terminal state instead of
+		// leaving it silently stuck at whatever status it was in (typically
+		// 'executing' or 'awaiting_input') forever. Before this, a
+		// permanently-failed resume was invisible beyond a log line — the
+		// task board just showed a task that never changed, with nothing
+		// telling the operator it needed attention. Marking it failed here
+		// doesn't prevent the operator from continuing to work the task via
+		// a fresh chat message afterward; it just stops the silent hang.
+		summary := fmt.Sprintf("Auto-resume failed after retrying: %s", errText)
+		if len(summary) > 200 {
+			summary = summary[:200] + "…"
+		}
+		if cerr := a.store.completeTask(context.Background(), sessionID, "failure", summary); cerr != nil {
+			slog.Error("nomos: failed to mark task failed after resume gave up", "session", sessionID, "error", cerr)
+		}
+	}
+	persist() // final state — same row, updated one last time with the concluding text
+}
+
+// buildContinuationNote frames the finished execution for the model: what
+// happened, and what to do about it. The persist-through-errors instruction
+// lives here (and in SOUL) so the agent recovers instead of stopping.
+func buildContinuationNote(p pendingContinuation) string {
+	action := p.Action
+	if i := strings.IndexByte(action, ':'); i > 0 && len(action) > 40 {
+		action = action[:i] // keep just the action verb for brevity; params are in the DB
+	}
+	result := p.Result
+	if len(result) > 3000 {
+		result = result[:3000] + "…[truncated]"
+	}
+	var b strings.Builder
+	fmt.Fprintf(&b, "[System: execution %s (%s) finished with status=%s.\nResult: %s\n\n",
+		p.ExecID, action, p.Status, result)
+	switch p.Status {
+	case "completed":
+		b.WriteString("It SUCCEEDED. Continue the approved plan: run the next step. If this was the final step, verify the end goal actually works (e.g. curl the service) and then report success to the operator. Do NOT stop and wait for the operator to say 'continue'.")
+	case "failed", "cancelled":
+		b.WriteString("It FAILED. Do NOT give up or hand back to the operator. Diagnose the cause from the result above (and by running read-only inspection commands if needed), form a hypothesis, fix it, and retry or take an alternative approach. You have an active assent window, so config_mutation steps run without re-approval. Only stop and ask the operator if you are genuinely blocked (need information only they have) or the fix would require a destructive action they haven't approved.")
+	default: // denied / revoked
+		b.WriteString("The operator denied or revoked this step. Stop executing this plan and briefly acknowledge.")
+	}
+	b.WriteString("]")
+	return b.String()
+}

cmd/nomos/continue_test.go

@@ -0,0 +1,39 @@
+package main
+
+import "testing"
+
+func TestExtractExecutionIDs(t *testing.T) {
+	// Real tool-result phrasings that should yield an execution id.
+	pos := map[string]string{
+		`"pct_create on host:strong auto-approved via assent window — execution 019f4b19-eafd-74ed-baa6-d24a27b3f52c running."`: "019f4b19-eafd-74ed-baa6-d24a27b3f52c",
+		`"run on lxc:caddy requires approval (risk: config_mutation) — execution 019f4af7-7eff-7723-b38c-b540b267f407 queued."`:   "019f4af7-7eff-7723-b38c-b540b267f407",
+		`"apt_upgrade on host:hubris auto-approved via assent window — execution 019f4b58-c88c-7767-87dd-044608ced913 running."`:  "019f4b58-c88c-7767-87dd-044608ced913",
+	}
+	for in, want := range pos {
+		ids := extractExecutionIDs(in)
+		if len(ids) != 1 || ids[0].String() != want {
+			t.Errorf("extractExecutionIDs(%q) = %v, want [%s]", in, ids, want)
+		}
+	}
+
+	// Synchronous auto-run and read-only results carry no "execution <uuid>"
+	// phrasing — they've already completed inline and must NOT be linked for
+	// continuation.
+	neg := []string{
+		`"run on host:strong (read_only, auto): 09:30 up 8 days"`,
+		`"run on lxc:caddy (config_mutation, auto via assent window): done"`,
+		`[{"slug":"lxc:caddy","health":"healthy"}]`,
+		`"target not found: lxc:nope"`,
+	}
+	for _, in := range neg {
+		if ids := extractExecutionIDs(in); len(ids) != 0 {
+			t.Errorf("extractExecutionIDs(%q) = %v, want none", in, ids)
+		}
+	}
+
+	// De-dupes repeated ids in one result.
+	dup := `execution 019f4b19-eafd-74ed-baa6-d24a27b3f52c queued ... execution 019f4b19-eafd-74ed-baa6-d24a27b3f52c running`
+	if ids := extractExecutionIDs(dup); len(ids) != 1 {
+		t.Errorf("expected de-dup to 1 id, got %v", ids)
+	}
+}

cmd/nomos/main.go

@@ -0,0 +1,818 @@
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"os"
+	"os/signal"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/dtoro/oikos/internal/safego"
+	"github.com/google/uuid"
+)
+
+func main() {
+	if len(os.Args) < 2 {
+		fmt.Fprintln(os.Stderr, "usage: nomos serve")
+		os.Exit(1)
+	}
+	mcpURL := os.Getenv("NOMOS_MCP_URL")
+	if mcpURL == "" {
+		mcpURL = "http://localhost:8090/mcp"
+	}
+	// api's combinedAuth requires a bearer token on every request (no
+	// dev-open bypass — plans/2026-07-12-wails-desktop-app.md 0.4); this is
+	// the same shared secret api validates against (OIKOS_MCP_BEARER_TOKEN).
+	mcpToken := os.Getenv("OIKOS_MCP_BEARER_TOKEN")
+
+	agentSlug := os.Getenv("NOMOS_AGENT_SLUG")
+	if agentSlug == "" {
+		agentSlug = "agent:nomos"
+	}
+
+	databaseURL := os.Getenv("DATABASE_URL")
+	if databaseURL == "" {
+		databaseURL = os.Getenv("OIKOS_DATABASE_URL")
+	}
+
+	switch os.Args[1] {
+	case "serve":
+		ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
+		defer cancel()
+
+		// One MCP client PER SESSION, not one shared client for the whole
+		// process — see mcpClientPool's doc comment. A dedicated client is
+		// created lazily on each session's first tool call.
+		clientPool := newMCPClientPool(mcpURL, mcpToken)
+		// Prove connectivity at startup the same way the old single-client
+		// constructor did, so a misconfigured/unreachable MCP endpoint still
+		// fails fast on boot instead of only on the first real chat. Doesn't
+		// reuse the pool (nothing to key it by yet) — just a throwaway probe.
+		if probe, err := newMCPClient(mcpURL, mcpToken); err != nil {
+			slog.Error("nomos: mcp connect", "url", mcpURL, "error", err)
+			os.Exit(1)
+		} else {
+			probe.close()
+		}
+
+		st, err := newStore(ctx, databaseURL)
+		if err != nil {
+			slog.Error("nomos: db connect", "error", err)
+			os.Exit(1)
+		}
+		if st != nil {
+			defer st.close()
+		}
+
+		nAgent, err := newAgent(ctx, clientPool, st, agentSlug)
+		if err != nil {
+			slog.Error("nomos: agent init", "error", err)
+			os.Exit(1)
+		}
+
+		// Event-driven auto-continuation: feed finished async executions back
+		// into the agent so an approved plan runs to completion (and recovers
+		// from failures) without the operator ticking it forward each step.
+		safego.Go("nomos:continuation-worker", func() { nAgent.runContinuationWorker(ctx) })
+
+		// Idle sweep for stalled goal-bearing tasks (fix 2+3 of
+		// plans/2026-07-11-task-completion-safety-net.md) — a coarser,
+		// slower-ticking counterpart to the continuation worker above.
+		safego.Go("nomos:idle-sweep-worker", func() { nAgent.runIdleSweepWorker(ctx) })
+
+		safego.Go("nomos:mcp-pool-sweeper", func() {
+			ticker := time.NewTicker(5 * time.Minute)
+			defer ticker.Stop()
+			for {
+				select {
+				case <-ctx.Done():
+					return
+				case <-ticker.C:
+					clientPool.sweep()
+				}
+			}
+		})
+
+		mux := http.NewServeMux()
+		mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
+			w.WriteHeader(200)
+			w.Write([]byte("ok"))
+		})
+		mux.HandleFunc("/query", func(w http.ResponseWriter, r *http.Request) {
+			handleQuery(w, r, clientPool, agentSlug, mcpURL)
+		})
+		mux.HandleFunc("/chat", func(w http.ResponseWriter, r *http.Request) {
+			handleChat(w, r, nAgent, st)
+		})
+		mux.HandleFunc("/sessions", func(w http.ResponseWriter, r *http.Request) {
+			handleSessionsList(w, r, st)
+		})
+		mux.HandleFunc("/sessions/", func(w http.ResponseWriter, r *http.Request) {
+			handleSessionDetail(w, r, st, nAgent)
+		})
+
+		addr := os.Getenv("NOMOS_LISTEN")
+		if addr == "" {
+			addr = ":8092"
+		}
+
+		srv := &http.Server{Addr: addr, Handler: mux}
+		safego.Go("nomos:http-server", func() {
+			slog.Info("nomos: gateway listening", "addr", addr, "mcp", mcpURL, "db", databaseURL != "")
+			if err := srv.ListenAndServe(); err != http.ErrServerClosed {
+				slog.Error("nomos: serve", "error", err)
+			}
+		})
+
+		<-ctx.Done()
+		slog.Info("nomos: shutting down")
+		srv.Shutdown(context.Background())
+		clientPool.closeAll()
+
+	default:
+		fmt.Fprintf(os.Stderr, "unknown command: %s\n", os.Args[1])
+		os.Exit(1)
+	}
+}
+
+func sseEvent(w http.ResponseWriter, flusher http.Flusher, event agentEvent) {
+	data, _ := json.Marshal(event)
+	fmt.Fprintf(w, "data: %s\n\n", data)
+	flusher.Flush()
+}
+
+func handleChat(w http.ResponseWriter, r *http.Request, a *agent, st *store) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", 405)
+		return
+	}
+
+	var req struct {
+		SessionID string `json:"session_id"`
+		Message   string `json:"message"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "bad request: "+err.Error(), 400)
+		return
+	}
+	if req.Message == "" {
+		http.Error(w, "message is required", 400)
+		return
+	}
+
+	flusher, ok := w.(http.Flusher)
+	if !ok {
+		http.Error(w, "streaming not supported", 500)
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("Connection", "keep-alive")
+	w.WriteHeader(200)
+
+	ctx := r.Context()
+	sessionID := req.SessionID
+
+	// pctx (persistence context) is deliberately context.Background(), not
+	// ctx/r.Context(), for every DB write in this handler — ctx cancels the
+	// instant the client disconnects (Stop button, tab close, network blip),
+	// and a write made with an already-cancelled context fails. Before this
+	// fix, the assistant message was only ever saved ONCE, at the very end,
+	// using ctx — so a disconnect mid-turn silently lost the ENTIRE turn's
+	// tool-call history from the persisted transcript, even though real work
+	// (executions launched, knowledge written) had already happened
+	// server-side. The agent's own work (a.chat below) still correctly stops
+	// when ctx cancels — this only changes what happens to persistence.
+	pctx := context.Background()
+
+	if sessionID == "" {
+		title := truncate(req.Message, 80)
+		sess, err := st.createSession(pctx, title)
+		if err != nil {
+			slog.Error("nomos: create session", "error", err)
+			sessionID = "ephemeral"
+		} else {
+			sessionID = sess.ID
+		}
+	} else {
+		st.touchSession(pctx, sessionID)
+	}
+
+	slog.Info("nomos: chat", "session", sessionID, "message", truncate(req.Message, 100))
+
+	userMsg, _ := json.Marshal(map[string]any{"role": "user", "text": req.Message})
+	st.saveMessage(pctx, sessionID, "user", userMsg)
+
+	// If this task has a pending operator question, the incoming message IS the
+	// answer — close it so the panel clears. No separate resume needed: this
+	// chat turn is the resume, and the agent sees the question + answer in its
+	// replayed history.
+	if qid := st.openQuestionID(pctx, sessionID); qid != "" {
+		st.answerQuestion(pctx, sessionID, qid, req.Message)
+	}
+
+	sseEvent(w, flusher, agentEvent{Type: "session", Data: sessionID, SessionID: sessionID})
+
+	toolCalls := []map[string]any{}
+	var finalText string
+
+	// Incremental persistence, mirroring resumeSession's existing
+	// placeholder+update pattern (continue.go): insert a placeholder now,
+	// update the SAME row after every tool call, so whatever happened before
+	// an abort is never lost — only what hadn't happened yet is.
+	placeholder, _ := json.Marshal(map[string]any{"role": "assistant", "text": ""})
+	msgID, err := st.insertMessageReturningID(pctx, sessionID, "assistant", placeholder)
+	if err != nil {
+		slog.Error("nomos: chat placeholder insert failed", "session", sessionID, "error", err)
+	}
+	persist := func() {
+		if msgID == uuid.Nil {
+			return
+		}
+		body, _ := json.Marshal(map[string]any{
+			"role":       "assistant",
+			"text":       finalText,
+			"tool_calls": toolCalls,
+		})
+		st.updateMessage(pctx, msgID, body)
+	}
+
+	a.chat(ctx, sessionID, req.Message, func(ev agentEvent) {
+		if ev.Type == "tool_use" || ev.Type == "tool_result" {
+			if m, ok := ev.Data.(map[string]any); ok {
+				m["type"] = ev.Type
+				toolCalls = append(toolCalls, m)
+			}
+			persist() // live: survives even if the client disconnects right after
+		}
+		if ev.Type == "text" {
+			finalText, _ = ev.Data.(string)
+		}
+		sseEvent(w, flusher, ev)
+	})
+
+	persist() // final state — same row, updated one last time with the concluding text
+
+	// Generate a meaningful title from the assistant's first answer
+	// instead of reusing the raw user message for every session.
+	if finalText != "" && sessionID != "ephemeral" {
+		title := truncate(finalText, 80)
+		if title != "" {
+			st.updateSessionTitle(pctx, sessionID, title)
+		}
+	}
+}
+
+func handleSessionsList(w http.ResponseWriter, r *http.Request, st *store) {
+	if st == nil {
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]any{"sessions": []any{}})
+		return
+	}
+
+	if r.Method == http.MethodOptions {
+		return
+	}
+
+	sessions, err := st.listSessions(r.Context())
+	if err != nil {
+		http.Error(w, err.Error(), 500)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]any{"sessions": sessions})
+}
+
+func handleSessionDetail(w http.ResponseWriter, r *http.Request, st *store, a *agent) {
+	if st == nil {
+		http.Error(w, "not found", 404)
+		return
+	}
+
+	rest := strings.TrimPrefix(r.URL.Path, "/sessions/")
+	parts := strings.Split(rest, "/")
+	id := parts[0]
+	if id == "" {
+		http.Error(w, "session id required", 400)
+		return
+	}
+
+	// POST /sessions/{id}/questions/{qid}/answer — the operator answers a
+	// pinned question from the context panel; resume the agent with the answer.
+	if len(parts) == 4 && parts[1] == "questions" && parts[3] == "answer" {
+		if r.Method != http.MethodPost {
+			http.Error(w, "method not allowed", 405)
+			return
+		}
+		handleAnswerQuestion(w, r, st, a, id, parts[2])
+		return
+	}
+
+	// GET /sessions/{id}/plan and /sessions/{id}/questions — REST hydration for
+	// the context panel when it first opens a task; live events carry deltas
+	// from there.
+	if len(parts) == 2 && r.Method == http.MethodGet {
+		switch parts[1] {
+		case "plan":
+			steps, err := st.getPlanSteps(r.Context(), id)
+			if err != nil {
+				http.Error(w, err.Error(), 500)
+				return
+			}
+			w.Header().Set("Content-Type", "application/json")
+			json.NewEncoder(w).Encode(map[string]any{"steps": steps})
+			return
+		case "questions":
+			questions, err := st.getQuestions(r.Context(), id)
+			if err != nil {
+				http.Error(w, err.Error(), 500)
+				return
+			}
+			w.Header().Set("Content-Type", "application/json")
+			json.NewEncoder(w).Encode(map[string]any{"questions": questions})
+			return
+		}
+	}
+
+	switch r.Method {
+	case http.MethodDelete:
+		if err := st.deleteSession(r.Context(), id); err != nil {
+			http.Error(w, err.Error(), 500)
+			return
+		}
+		w.WriteHeader(204)
+
+	case http.MethodGet:
+		messages, err := st.getMessages(r.Context(), id)
+		if err != nil {
+			http.Error(w, err.Error(), 500)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]any{"session_id": id, "messages": messages})
+
+	default:
+		http.Error(w, "method not allowed", 405)
+	}
+}
+
+// handleAnswerQuestion records the operator's answer to a pinned question and
+// resumes the agent in the background with that answer injected. Returns 202 —
+// the agent's response lands via the normal message-polling path, not this POST.
+func handleAnswerQuestion(w http.ResponseWriter, r *http.Request, st *store, a *agent, sessionID, questionID string) {
+	var req struct {
+		Answer string `json:"answer"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil || strings.TrimSpace(req.Answer) == "" {
+		http.Error(w, "answer is required", 400)
+		return
+	}
+	prompt, _, _ := st.getQuestion(r.Context(), questionID)
+	if err := st.answerQuestion(r.Context(), sessionID, questionID, req.Answer); err != nil {
+		http.Error(w, err.Error(), 500)
+		return
+	}
+	if a != nil {
+		note := fmt.Sprintf("[System: the operator answered your question %q with: %q. "+
+			"Continue the task from here — do not re-ask.]", prompt, req.Answer)
+		safego.Go("nomos:resume-session", func() { a.resumeSession(context.Background(), sessionID, note) })
+	}
+	w.WriteHeader(202)
+}
+
+func handleQuery(w http.ResponseWriter, r *http.Request, pool *mcpClientPool, agentSlug, mcpURL string) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", 405)
+		return
+	}
+
+	var req struct {
+		Query string         `json:"query"`
+		Tool  string         `json:"tool"`
+		Args  map[string]any `json:"args"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "bad request: "+err.Error(), 400)
+		return
+	}
+
+	// The structured /query endpoint is stateless/session-less — "query" is a
+	// fixed pool key (not a real session id) so repeated calls reuse one
+	// dedicated connection instead of paying a fresh MCP handshake every time,
+	// while still never sharing a connection with an actual chat task.
+	client, err := pool.get("query")
+	if err != nil {
+		http.Error(w, "mcp unavailable: "+err.Error(), 502)
+		return
+	}
+
+	start := time.Now()
+
+	if req.Tool != "" {
+		result, err := client.callTool(req.Tool, req.Args)
+		duration := time.Since(start).Milliseconds()
+		if err != nil {
+			slog.Error("nomos: query failed", "tool", req.Tool, "error", err)
+			w.Header().Set("Content-Type", "application/json")
+			json.NewEncoder(w).Encode(map[string]any{
+				"error":      err.Error(),
+				"elapsed_ms": duration,
+				"agent_slug": agentSlug,
+			})
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]any{
+			"result":     result,
+			"elapsed_ms": duration,
+			"agent_slug": agentSlug,
+			"mcp_url":    mcpURL,
+		})
+		return
+	}
+
+	if req.Query != "" {
+		if strings.Contains(strings.ToLower(req.Query), "what can you do") ||
+			strings.Contains(strings.ToLower(req.Query), "help") {
+
+			tools, err := client.listTools()
+			duration := time.Since(start).Milliseconds()
+			if err != nil {
+				w.Header().Set("Content-Type", "application/json")
+				json.NewEncoder(w).Encode(map[string]any{
+					"error":      err.Error(),
+					"elapsed_ms": duration,
+				})
+				return
+			}
+			w.Header().Set("Content-Type", "application/json")
+			json.NewEncoder(w).Encode(map[string]any{
+				"message":    "natural language queries belong to /chat. Use structured /query with 'tool' for direct MCP calls.",
+				"tools":      tools,
+				"elapsed_ms": duration,
+			})
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]any{
+			"message":    "natural language queries belong to /chat. Use structured /query with 'tool' for direct MCP calls.",
+			"elapsed_ms": time.Since(start).Milliseconds(),
+		})
+		return
+	}
+
+	http.Error(w, "either 'tool' or 'query' required", 400)
+}
+
+func truncate(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	return s[:n] + "..."
+}
+
+// ─── MCP Streamable HTTP client ────────────────────────────────────────
+
+type mcpClient struct {
+	baseURL   string
+	token     string // OIKOS_MCP_BEARER_TOKEN — api's combinedAuth requires it on every request (no dev-open bypass)
+	sessionID string
+	http      *http.Client
+	nextID    int
+	mu        sync.Mutex // this client is one stateful MCP session; serialize ITS OWN calls
+
+	// toolsCache holds the last tools/list result. The tool list is static
+	// for the lifetime of one MCP connection — it only changes when the api
+	// process (re)registers tools, i.e. on a restart, which this client
+	// already detects and reacts to via reconnectLocked. Without this,
+	// buildTools (called at the start of EVERY chat turn, including every
+	// auto-continuation resume) paid a full tools/list round-trip every
+	// single time for a list that's almost always identical to the last one.
+	// Guarded separately from mu (not reused) so a cache check never
+	// contends with an in-flight doRequest call for a different method.
+	toolsMu    sync.Mutex
+	toolsCache []toolDef
+}
+
+func newMCPClient(baseURL, token string) (*mcpClient, error) {
+	c := &mcpClient{
+		baseURL: baseURL,
+		token:   token,
+		http:    &http.Client{Timeout: 30 * time.Second},
+	}
+
+	resp, err := c.doRequest("initialize", map[string]any{
+		"protocolVersion": "2024-11-05",
+		"capabilities":    map[string]any{},
+		"clientInfo":      map[string]any{"name": "nomos", "version": "2.0"},
+	})
+	if err != nil {
+		return nil, fmt.Errorf("initialize: %w", err)
+	}
+	if resp.sessionID == "" {
+		return nil, fmt.Errorf("no session ID in initialize response")
+	}
+	c.sessionID = resp.sessionID
+
+	c.doRequest("notifications/initialized", map[string]any{})
+
+	slog.Info("nomos: mcp connected", "session", c.sessionID[:16]+"...")
+	return c, nil
+}
+
+type mcpJSONRPCResponse struct {
+	sessionID string
+	Result    json.RawMessage `json:"result"`
+	Error     json.RawMessage `json:"error"`
+}
+
+// errStaleSession signals that the MCP server rejected our session id (e.g.
+// after an api/MCP restart), so the client should re-initialize and retry.
+var errStaleSession = fmt.Errorf("mcp session stale")
+
+// doRequest serializes MCP calls and transparently re-initializes the session
+// if the server has forgotten it (common after an api redeploy), retrying the
+// original call once. Without this, an api restart permanently breaks nomos
+// until it is itself restarted.
+func (c *mcpClient) doRequest(method string, params map[string]any) (*mcpJSONRPCResponse, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	resp, err := c.send(method, params)
+	if err != nil && method != "initialize" && errors.Is(err, errStaleSession) {
+		slog.Warn("nomos: mcp session stale, reconnecting")
+		if rerr := c.reconnectLocked(); rerr != nil {
+			return nil, fmt.Errorf("mcp reconnect: %w (original: %v)", rerr, err)
+		}
+		return c.send(method, params)
+	}
+	return resp, err
+}
+
+// reconnectLocked re-initializes the MCP session. The caller must hold c.mu.
+func (c *mcpClient) reconnectLocked() error {
+	c.sessionID = ""
+	// A reconnect means the api process was restarted (or forgot us) — its
+	// tool registration may have changed, so the cached list is no longer
+	// trustworthy.
+	c.toolsMu.Lock()
+	c.toolsCache = nil
+	c.toolsMu.Unlock()
+	resp, err := c.send("initialize", map[string]any{
+		"protocolVersion": "2024-11-05",
+		"capabilities":    map[string]any{},
+		"clientInfo":      map[string]any{"name": "nomos", "version": "2.0"},
+	})
+	if err != nil {
+		return err
+	}
+	if resp.sessionID == "" {
+		return fmt.Errorf("no session ID on re-initialize")
+	}
+	c.sessionID = resp.sessionID
+	_, _ = c.send("notifications/initialized", map[string]any{})
+	slog.Info("nomos: mcp reconnected", "session", c.sessionID[:16]+"...")
+	return nil
+}
+
+// send performs one MCP round-trip. It does not lock; callers hold c.mu.
+func (c *mcpClient) send(method string, params map[string]any) (*mcpJSONRPCResponse, error) {
+	c.nextID++
+	body, _ := json.Marshal(map[string]any{
+		"jsonrpc": "2.0",
+		"method":  method,
+		"params":  params,
+		"id":      c.nextID,
+	})
+
+	req, err := http.NewRequest(http.MethodPost, c.baseURL, bytes.NewReader(body))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept", "application/json, text/event-stream")
+	if c.sessionID != "" {
+		req.Header.Set("Mcp-Session-Id", c.sessionID)
+	}
+	if c.token != "" {
+		req.Header.Set("Authorization", "Bearer "+c.token)
+	}
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	// A rejected/unknown session comes back as 4xx (commonly 400/404).
+	if resp.StatusCode == http.StatusNotFound || resp.StatusCode == http.StatusBadRequest {
+		return nil, errStaleSession
+	}
+
+	result := &mcpJSONRPCResponse{}
+	result.sessionID = resp.Header.Get("Mcp-Session-Id")
+
+	scanner := bufio.NewScanner(resp.Body)
+	scanner.Buffer(make([]byte, 0, 64*1024), 4*1024*1024)
+	gotData := false
+	for scanner.Scan() {
+		line := scanner.Text()
+		if strings.HasPrefix(line, "data: ") {
+			gotData = true
+			data := line[6:]
+			if err := json.Unmarshal([]byte(data), result); err != nil {
+				return nil, fmt.Errorf("parse response: %w", err)
+			}
+		}
+	}
+
+	if result.Error != nil {
+		return nil, fmt.Errorf("rpc error: %s", string(result.Error))
+	}
+
+	// Empty body with no result and a session set: the server likely dropped
+	// our session. Notifications legitimately return no data, so exempt them.
+	if !gotData && result.Result == nil && method != "notifications/initialized" {
+		return nil, errStaleSession
+	}
+
+	if result.sessionID != "" {
+		c.sessionID = result.sessionID
+	}
+
+	return result, nil
+}
+
+func (c *mcpClient) callTool(name string, args map[string]any) (any, error) {
+	resp, err := c.doRequest("tools/call", map[string]any{
+		"name":      name,
+		"arguments": args,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var toolResult struct {
+		Content []struct {
+			Type string `json:"type"`
+			Text string `json:"text"`
+		} `json:"content"`
+	}
+	if err := json.Unmarshal(resp.Result, &toolResult); err != nil {
+		return string(resp.Result), nil
+	}
+
+	var texts []string
+	for _, c := range toolResult.Content {
+		if c.Type == "text" {
+			var parsed any
+			if json.Unmarshal([]byte(c.Text), &parsed) == nil {
+				return parsed, nil
+			}
+			texts = append(texts, c.Text)
+		}
+	}
+	if len(texts) == 1 {
+		return texts[0], nil
+	}
+	return texts, nil
+}
+
+func (c *mcpClient) listTools() ([]string, error) {
+	resp, err := c.doRequest("tools/list", map[string]any{})
+	if err != nil {
+		return nil, err
+	}
+	var tr struct {
+		Tools []struct {
+			Name        string `json:"name"`
+			Description string `json:"description"`
+		} `json:"tools"`
+	}
+	if err := json.Unmarshal(resp.Result, &tr); err != nil {
+		return nil, err
+	}
+	var names []string
+	for _, t := range tr.Tools {
+		names = append(names, t.Name)
+	}
+	return names, nil
+}
+
+func (c *mcpClient) close() {
+}
+
+// ─── Per-session MCP client pool ────────────────────────────────────────
+//
+// A single shared mcpClient serializes EVERY tool call across EVERY
+// concurrently-running task through one mutex (see mcpClient.mu) — `run`
+// executes its SSH command synchronously inside that lock and is capped at
+// up to 10 minutes, so one task mid-`run` stalled every other task's tool
+// calls, even trivial reads, behind it. The MCP *server* has no per-
+// connection state to protect (newServer in internal/mcp/server.go returns
+// one shared *mcp.Server instance whose tool handlers close only over the DB
+// pool, which is already safe for concurrent use) — the mutex existed purely
+// because the *client* reused one stateful transport session, not because
+// the server needed it. Giving each task's own session its own client
+// removes the cross-task serialization entirely: a task's own tool calls
+// stay sequential (which they already are — the agent loop calls tools one
+// at a time within a turn), but no longer block anyone else's.
+type mcpClientPool struct {
+	baseURL string
+	token   string
+	mu      sync.Mutex
+	clients map[string]*pooledMCPClient
+}
+
+type pooledMCPClient struct {
+	client   *mcpClient
+	lastUsed time.Time
+}
+
+func newMCPClientPool(baseURL, token string) *mcpClientPool {
+	return &mcpClientPool{baseURL: baseURL, token: token, clients: make(map[string]*pooledMCPClient)}
+}
+
+// get returns the client for sessionID, creating and initializing one (a
+// real MCP handshake) on first use. Session ids that don't identify a real
+// persisted conversation ("" / "ephemeral", the no-DB-store path; "query",
+// the structured /query endpoint) still get exactly one dedicated,
+// reused client each via the same map — just keyed on a fixed string instead
+// of a real session id — so that traffic doesn't pay a fresh handshake per
+// request while still never sharing a connection with an actual task.
+func (p *mcpClientPool) get(sessionID string) (*mcpClient, error) {
+	key := sessionID
+	if key == "" {
+		key = "ephemeral"
+	}
+
+	p.mu.Lock()
+	if pc, ok := p.clients[key]; ok {
+		pc.lastUsed = time.Now()
+		p.mu.Unlock()
+		return pc.client, nil
+	}
+	p.mu.Unlock()
+
+	// Initialize outside the lock — it's a network round-trip, and holding
+	// the pool mutex for it would serialize unrelated sessions' first calls
+	// behind each other, undermining the whole point of this pool.
+	c, err := newMCPClient(p.baseURL, p.token)
+	if err != nil {
+		return nil, err
+	}
+
+	p.mu.Lock()
+	// Another goroutine may have created one for the same key while we were
+	// initializing (two of this session's tool calls racing on a cold
+	// start); keep whichever won, close out the loser's connection (a no-op
+	// today, but future-proof if mcpClient.close ever does real teardown).
+	if existing, ok := p.clients[key]; ok {
+		p.mu.Unlock()
+		c.close()
+		return existing.client, nil
+	}
+	p.clients[key] = &pooledMCPClient{client: c, lastUsed: time.Now()}
+	p.mu.Unlock()
+	return c, nil
+}
+
+// mcpClientIdleTimeout is how long an idle session's MCP client is kept
+// before eviction — long enough to outlive a single slow `run` (capped at 10
+// minutes server-side) plus normal think-time between a task's tool calls,
+// short enough not to accumulate one abandoned connection per finished task
+// forever.
+const mcpClientIdleTimeout = 20 * time.Minute
+
+// sweep evicts clients idle past mcpClientIdleTimeout. Call on a ticker.
+func (p *mcpClientPool) sweep() {
+	cutoff := time.Now().Add(-mcpClientIdleTimeout)
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	for key, pc := range p.clients {
+		if pc.lastUsed.Before(cutoff) {
+			pc.client.close()
+			delete(p.clients, key)
+		}
+	}
+}
+
+func (p *mcpClientPool) closeAll() {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	for key, pc := range p.clients {
+		pc.client.close()
+		delete(p.clients, key)
+	}
+}

cmd/nomos/store_test.go

@@ -0,0 +1,238 @@
+package main
+
+// Integration tests against a real Postgres, mirroring
+// internal/db/integration_test.go's pattern: guarded by
+// OIKOS_TEST_DATABASE_URL (skipped when unset), throwaway database per run,
+// full migrations applied, dropped on cleanup. Run with:
+//
+//   docker compose up -d postgres
+//   OIKOS_TEST_DATABASE_URL="postgres://oikos:oikos_dev@localhost:5432/oikos?sslmode=disable" go test ./cmd/nomos/
+
+import (
+	"context"
+	"fmt"
+	"math/rand"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/dtoro/oikos/internal/db"
+	"github.com/jackc/pgx/v5"
+)
+
+// newTestStore creates a throwaway, fully-migrated database and returns a
+// *store connected to it, cleaned up (including a matching task:<session>
+// entity type in the ontology, needed by createTaskEntity/proposePlan tests)
+// via t.Cleanup.
+func newTestStore(t *testing.T) *store {
+	t.Helper()
+	baseURL := os.Getenv("OIKOS_TEST_DATABASE_URL")
+	if baseURL == "" {
+		t.Skip("OIKOS_TEST_DATABASE_URL not set — skipping integration test")
+	}
+	ctx := context.Background()
+
+	admin, err := pgx.Connect(ctx, baseURL)
+	if err != nil {
+		t.Fatalf("connect admin: %v", err)
+	}
+	dbName := fmt.Sprintf("oikos_test_nomos_%08x", rand.Int63())
+	if _, err := admin.Exec(ctx, "CREATE DATABASE "+dbName); err != nil {
+		admin.Close(ctx)
+		t.Fatalf("create test db: %v", err)
+	}
+	admin.Close(ctx)
+
+	testURL := swapTestDatabase(baseURL, dbName)
+	pool, err := db.New(ctx, testURL)
+	if err != nil {
+		t.Fatalf("connect test db: %v", err)
+	}
+	t.Cleanup(func() {
+		pool.Close()
+		admin, err := pgx.Connect(ctx, baseURL)
+		if err == nil {
+			admin.Exec(ctx, "DROP DATABASE IF EXISTS "+dbName+" WITH (FORCE)")
+			admin.Close(ctx)
+		}
+	})
+	if err := pool.Migrate(ctx); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+
+	// session_plan_steps/session_questions tests don't need the ontology
+	// seed, but createTaskEntity's INSERT INTO entities (type='task') has an
+	// FK to entity_types — seed the minimal rows it needs directly rather
+	// than pulling in the full seeds/ontology.yaml ingest path.
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO entity_types (name, domain, layer) VALUES ('entity', 'meta', 'meta')
+		ON CONFLICT DO NOTHING;
+		INSERT INTO entity_types (name, parent_type, domain, layer) VALUES ('task', 'entity', 'cognition', 'cognition')
+		ON CONFLICT DO NOTHING;`); err != nil {
+		t.Fatalf("seed minimal ontology: %v", err)
+	}
+
+	return &store{pool: pool.Pool}
+}
+
+func swapTestDatabase(url, dbName string) string {
+	qi := strings.Index(url, "?")
+	params, base := "", url
+	if qi >= 0 {
+		params = url[qi:]
+		base = url[:qi]
+	}
+	si := strings.LastIndex(base, "/")
+	return base[:si+1] + dbName + params
+}
+
+// TestGetRecentMessages_Truncation is the concrete proof for fix A2 of
+// plans/2026-07-11-nomos-agent-code-review.md: chatWith used to replay a
+// session's ENTIRE history on every turn with no bound. getRecentMessages
+// caps that; this test checks both sides — under the limit, nothing is
+// dropped and truncated=false; over it, only the most recent `limit` come
+// back, in chronological order, with truncated=true.
+func TestGetRecentMessages_Truncation(t *testing.T) {
+	s := newTestStore(t)
+	ctx := context.Background()
+
+	sess, err := s.createSession(ctx, "history window test")
+	if err != nil {
+		t.Fatalf("createSession: %v", err)
+	}
+
+	const total = 35
+	const limit = 30
+	for i := 0; i < total; i++ {
+		role := "user"
+		if i%2 == 1 {
+			role = "assistant"
+		}
+		body := fmt.Appendf(nil, `{"role":%q,"text":"msg-%d"}`, role, i)
+		if err := s.saveMessage(ctx, sess.ID, role, body); err != nil {
+			t.Fatalf("saveMessage %d: %v", i, err)
+		}
+	}
+
+	msgs, truncated, err := s.getRecentMessages(ctx, sess.ID, limit)
+	if err != nil {
+		t.Fatalf("getRecentMessages: %v", err)
+	}
+	if !truncated {
+		t.Errorf("truncated = false, want true (%d messages > limit %d)", total, limit)
+	}
+	if len(msgs) != limit {
+		t.Fatalf("got %d messages, want %d", len(msgs), limit)
+	}
+	// Chronological order: the oldest of the RETAINED messages should be the
+	// (total-limit)-th one saved (msg-5, since msg-0..4 were dropped), and
+	// the last should be the most recently saved (msg-34).
+	wantFirst := fmt.Sprintf("msg-%d", total-limit)
+	wantLast := fmt.Sprintf("msg-%d", total-1)
+	if got := extractText(msgs[0].Content); got != wantFirst {
+		t.Errorf("first retained message = %q, want %q", got, wantFirst)
+	}
+	if got := extractText(msgs[len(msgs)-1].Content); got != wantLast {
+		t.Errorf("last retained message = %q, want %q", got, wantLast)
+	}
+
+	// Under the limit: nothing dropped.
+	sess2, err := s.createSession(ctx, "small session")
+	if err != nil {
+		t.Fatalf("createSession: %v", err)
+	}
+	for i := 0; i < 5; i++ {
+		body := fmt.Appendf(nil, `{"role":"user","text":"msg-%d"}`, i)
+		if err := s.saveMessage(ctx, sess2.ID, "user", body); err != nil {
+			t.Fatalf("saveMessage: %v", err)
+		}
+	}
+	msgs2, truncated2, err := s.getRecentMessages(ctx, sess2.ID, limit)
+	if err != nil {
+		t.Fatalf("getRecentMessages (small): %v", err)
+	}
+	if truncated2 {
+		t.Errorf("truncated = true for a 5-message session under a %d limit, want false", limit)
+	}
+	if len(msgs2) != 5 {
+		t.Errorf("got %d messages, want 5", len(msgs2))
+	}
+}
+
+// TestProposePlan_AppendVsReplace is the concrete proof for the plan-append
+// fix (commit 5384499, "plan panel showed only the latest step, not the full
+// plan"): proposePlan must REPLACE the step list only while every existing
+// step is still 'pending' (a genuine pre-execution revision), and APPEND
+// once any step has started — otherwise a model that calls propose_plan once
+// per step (rather than once with the full list, as instructed) erases every
+// already-completed step each time, and the operator only ever sees the
+// latest single step instead of real progress.
+func TestProposePlan_AppendVsReplace(t *testing.T) {
+	s := newTestStore(t)
+	ctx := context.Background()
+
+	sess, err := s.createSession(ctx, "plan append test")
+	if err != nil {
+		t.Fatalf("createSession: %v", err)
+	}
+
+	// First call: no steps exist yet — must persist as-is (replace mode,
+	// trivially: nothing to replace).
+	out1, err := s.proposePlan(ctx, sess.ID, []planStepInput{{Title: "Step A"}})
+	if err != nil {
+		t.Fatalf("proposePlan #1: %v", err)
+	}
+	if len(out1) != 1 || out1[0]["seq"] != 1 {
+		t.Fatalf("proposePlan #1 = %+v, want one step at seq 1", out1)
+	}
+
+	// Mark step 1 as started.
+	if err := s.updatePlanStep(ctx, sess.ID, 1, "running", ""); err != nil {
+		t.Fatalf("updatePlanStep: %v", err)
+	}
+
+	// Second call, simulating a model that (against instructions) calls
+	// propose_plan again per-step instead of once with the full list: since
+	// step 1 has left 'pending', this MUST append, not replace.
+	out2, err := s.proposePlan(ctx, sess.ID, []planStepInput{{Title: "Step B"}})
+	if err != nil {
+		t.Fatalf("proposePlan #2: %v", err)
+	}
+	if len(out2) != 1 || out2[0]["seq"] != 2 {
+		t.Fatalf("proposePlan #2 = %+v, want one step at seq 2 (appended after the running step 1)", out2)
+	}
+
+	steps, err := s.getPlanSteps(ctx, sess.ID)
+	if err != nil {
+		t.Fatalf("getPlanSteps: %v", err)
+	}
+	if len(steps) != 2 {
+		t.Fatalf("got %d persisted steps, want 2 (step 1 must survive the second propose_plan call)", len(steps))
+	}
+	if steps[0].Title != "Step A" || steps[0].Status != "running" {
+		t.Errorf("step 1 = %+v, want Step A still running (not erased)", steps[0])
+	}
+	if steps[1].Title != "Step B" || steps[1].Status != "pending" {
+		t.Errorf("step 2 = %+v, want Step B pending", steps[1])
+	}
+
+	// Third call BEFORE anything runs on a fresh session: every step is
+	// still pending, so this must REPLACE, not append.
+	sess2, err := s.createSession(ctx, "plan replace test")
+	if err != nil {
+		t.Fatalf("createSession: %v", err)
+	}
+	if _, err := s.proposePlan(ctx, sess2.ID, []planStepInput{{Title: "Original"}}); err != nil {
+		t.Fatalf("proposePlan (initial): %v", err)
+	}
+	if _, err := s.proposePlan(ctx, sess2.ID, []planStepInput{{Title: "Revised"}}); err != nil {
+		t.Fatalf("proposePlan (revise before execution): %v", err)
+	}
+	revisedSteps, err := s.getPlanSteps(ctx, sess2.ID)
+	if err != nil {
+		t.Fatalf("getPlanSteps: %v", err)
+	}
+	if len(revisedSteps) != 1 || revisedSteps[0].Title != "Revised" {
+		t.Fatalf("got %+v, want a single 'Revised' step (pre-execution revise must replace, not append)", revisedSteps)
+	}
+}

cmd/nomos/tasks.go

@@ -0,0 +1,293 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"strings"
+)
+
+// Task tools are nomos-LOCAL, not MCP tools. They are session-scoped, and the
+// shared MCP server (api:8090/mcp) has no session id — so these are handled
+// in-process by nomos, which knows the session/task and holds the store.
+// buildTools appends these to the model's tool list; the agent loop routes a
+// call whose name isTaskTool to handleTaskTool instead of the MCP client.
+//
+// Phase 3 ships complete_task; set_goal / propose_plan / update_plan_step /
+// ask_operator land in later phases through the same mechanism.
+
+func taskToolDefs() []toolDef {
+	return []toolDef{
+		{
+			Name: "set_goal",
+			Description: "State the goal of this task in one sentence, as early as you " +
+				"can. This is what the task is trying to achieve (e.g. 'Deploy TypeType " +
+				"as an LXC on strong'); it heads the task on the board and the context " +
+				"panel. Call it once you understand what the operator wants.",
+			InputSchema: map[string]any{
+				"type": "object",
+				"properties": map[string]any{
+					"goal": map[string]any{"type": "string", "description": "The task's goal, one sentence."},
+				},
+				"required": []string{"goal"},
+			},
+		},
+		{
+			Name: "propose_plan",
+			Description: "Lay out ALL the ordered steps you'll take to reach the goal, in ONE " +
+				"call, listing every step end-to-end — not just the next one. The operator " +
+				"sees the full list in the context panel and watches it progress; a plan " +
+				"with only 1 step looks broken to them even if you intend to add more later. " +
+				"Your FIRST step should be research (prior knowledge, relations, blast radius " +
+				"— not just this target's status) and your LAST step should be writing back " +
+				"what you learned (update_entity_attributes / create_relationship / " +
+				"upsert_knowledge) BEFORE complete_task — this is what keeps the knowledge " +
+				"graph from drifting out of date. " +
+				"Call this ONCE, before you start executing (after gathering what you need). " +
+				"As you work, call update_plan_step (not propose_plan again) to advance each " +
+				"step. Only re-call propose_plan if the plan itself has fundamentally changed " +
+				"(e.g. a new approach is needed) — in that case new steps are appended after " +
+				"whatever already ran, never erasing completed work.",
+			InputSchema: map[string]any{
+				"type": "object",
+				"properties": map[string]any{
+					"steps": map[string]any{
+						"type":        "array",
+						"description": "Ordered steps, first to last.",
+						"items": map[string]any{
+							"type": "object",
+							"properties": map[string]any{
+								"title":       map[string]any{"type": "string", "description": "Short imperative step title (e.g. 'Create the LXC')."},
+								"detail":      map[string]any{"type": "string", "description": "Optional one-line detail."},
+								"target_slug": map[string]any{"type": "string", "description": "Optional entity slug this step acts on (e.g. lxc:typetype)."},
+							},
+							"required": []string{"title"},
+						},
+					},
+				},
+				"required": []string{"steps"},
+			},
+		},
+		{
+			Name: "update_plan_step",
+			Description: "Advance a plan step as you work it. Set status to 'running' when " +
+				"you start it (pass execution_id if the step queued a gated action, so " +
+				"the board can auto-close it when that finishes), then 'done' / 'failed' " +
+				"/ 'skipped' / 'blocked' when it resolves. Keeps the operator's progress " +
+				"view honest.",
+			InputSchema: map[string]any{
+				"type": "object",
+				"properties": map[string]any{
+					"seq":          map[string]any{"type": "integer", "description": "1-based step number from propose_plan."},
+					"status":       map[string]any{"type": "string", "enum": []string{"running", "done", "failed", "skipped", "blocked"}, "description": "New status for the step."},
+					"execution_id": map[string]any{"type": "string", "description": "Optional execution UUID this step is running, so it auto-closes on completion."},
+				},
+				"required": []string{"seq", "status"},
+			},
+		},
+		{
+			Name: "ask_operator",
+			Description: "Ask the operator a question when you hit a real decision only " +
+				"they can make — an ambiguous target, a trade-off, missing information, " +
+				"or a destructive choice not already approved. This pins a structured " +
+				"question card in the context panel (with your options and the entities " +
+				"involved) and PAUSES the task until they answer; their answer resumes " +
+				"you automatically. Do NOT use it for things you can determine yourself " +
+				"with tools — only for genuine decisions.",
+			InputSchema: map[string]any{
+				"type": "object",
+				"properties": map[string]any{
+					"prompt": map[string]any{"type": "string", "description": "The question, stated plainly."},
+					"why":    map[string]any{"type": "string", "description": "Why you're asking / what's at stake."},
+					"options": map[string]any{
+						"type": "array", "items": map[string]any{"type": "string"},
+						"description": "The choices, if it's a pick-one decision.",
+					},
+					"context_entities": map[string]any{
+						"type": "array", "items": map[string]any{"type": "string"},
+						"description": "Entity slugs relevant to the decision (shown as chips).",
+					},
+				},
+				"required": []string{"prompt"},
+			},
+		},
+		{
+			Name: "complete_task",
+			Description: "Mark the current task finished. Call this once the goal is " +
+				"verified done — or when you've genuinely failed or only partially " +
+				"succeeded. Sets the task's outcome and a one-line summary shown on the " +
+				"task board. Record what you learned with upsert_knowledge BEFORE " +
+				"completing, so future tasks on the same entities benefit.",
+			InputSchema: map[string]any{
+				"type": "object",
+				"properties": map[string]any{
+					"outcome": map[string]any{
+						"type":        "string",
+						"enum":        []string{"success", "failure", "partial"},
+						"description": "Did the task achieve its goal?",
+					},
+					"summary": map[string]any{
+						"type":        "string",
+						"description": "One line describing the result (shown on the task card).",
+					},
+				},
+				"required": []string{"outcome", "summary"},
+			},
+		},
+	}
+}
+
+// toInt coerces a JSON tool-arg number (float64 after unmarshal) to int.
+func toInt(v any) int {
+	switch n := v.(type) {
+	case float64:
+		return int(n)
+	case int:
+		return n
+	default:
+		return 0
+	}
+}
+
+// toStringSlice coerces a JSON tool-arg array to a non-empty []string.
+func toStringSlice(v any) []string {
+	arr, ok := v.([]any)
+	if !ok {
+		return nil
+	}
+	out := make([]string, 0, len(arr))
+	for _, e := range arr {
+		if s, ok := e.(string); ok && strings.TrimSpace(s) != "" {
+			out = append(out, s)
+		}
+	}
+	return out
+}
+
+// handleTaskTool executes a nomos-local task tool. Returns (result, true) if it
+// handled the call, or (nil, false) if name is not a local task tool (so the
+// caller forwards it to the MCP client).
+func (a *agent) handleTaskTool(ctx context.Context, sessionID, name string, args map[string]any) (any, bool) {
+	switch name {
+	case "set_goal":
+		goal, _ := args["goal"].(string)
+		if strings.TrimSpace(goal) == "" {
+			return "error: set_goal needs a goal", true
+		}
+		if err := a.store.setGoal(ctx, sessionID, goal); err != nil {
+			return fmt.Sprintf("error setting goal: %v", err), true
+		}
+		return "Goal set: " + goal, true
+
+	case "propose_plan":
+		raw, _ := args["steps"].([]any)
+		var steps []planStepInput
+		for _, r := range raw {
+			m, ok := r.(map[string]any)
+			if !ok {
+				continue
+			}
+			title, _ := m["title"].(string)
+			if strings.TrimSpace(title) == "" {
+				continue
+			}
+			detail, _ := m["detail"].(string)
+			target, _ := m["target_slug"].(string)
+			steps = append(steps, planStepInput{Title: title, Detail: detail, TargetSlug: target})
+		}
+		if len(steps) == 0 {
+			return "error: propose_plan needs at least one step with a title", true
+		}
+		persisted, err := a.store.proposePlan(ctx, sessionID, steps)
+		if err != nil {
+			return fmt.Sprintf("error proposing plan: %v", err), true
+		}
+		return fmt.Sprintf("Plan set: %d step(s). Execute them now, marking each with update_plan_step as you go.", len(persisted)), true
+
+	case "update_plan_step":
+		seq := toInt(args["seq"])
+		status, _ := args["status"].(string)
+		execID, _ := args["execution_id"].(string)
+		if seq <= 0 || status == "" {
+			return "error: update_plan_step needs seq (>=1) and status", true
+		}
+		if err := a.store.updatePlanStep(ctx, sessionID, seq, status, execID); err != nil {
+			return fmt.Sprintf("error updating step %d: %v", seq, err), true
+		}
+		return fmt.Sprintf("Step %d → %s", seq, status), true
+
+	case "ask_operator":
+		prompt, _ := args["prompt"].(string)
+		if strings.TrimSpace(prompt) == "" {
+			return "error: ask_operator needs a prompt", true
+		}
+		qctx := map[string]any{}
+		if why, _ := args["why"].(string); strings.TrimSpace(why) != "" {
+			qctx["why"] = why
+		}
+		if opts := toStringSlice(args["options"]); len(opts) > 0 {
+			qctx["options"] = opts
+		}
+		if ents := toStringSlice(args["context_entities"]); len(ents) > 0 {
+			qctx["entities"] = ents
+		}
+		if _, err := a.store.askOperator(ctx, sessionID, prompt, qctx); err != nil {
+			return fmt.Sprintf("error posting question: %v", err), true
+		}
+		return "Question posted to the operator; the task is paused until they answer. " +
+			"Do not continue or call more tools — end your turn now and wait for their answer.", true
+
+	case "complete_task":
+		outcome, _ := args["outcome"].(string)
+		summary, _ := args["summary"].(string)
+		switch outcome {
+		case "":
+			outcome = "success" // no outcome given at all — assume success, the common case
+		case "success", "failure", "partial":
+			// valid, use as-is
+		default:
+			// The tool schema declares an enum, but a weaker model (or a
+			// typo) can still send anything — an unrecognized value used to
+			// persist as-is, silently, with only "failure" special-cased
+			// (store.completeTask derives status='failed' from it; anything
+			// else became status='done' regardless of what the value
+			// actually said). Default to "partial" rather than silently
+			// treating an unrecognized value as "success" — safer to
+			// under-claim than over-claim a task's outcome.
+			slog.Warn("nomos: complete_task got an unrecognized outcome, defaulting to partial",
+				"session", sessionID, "outcome", outcome)
+			outcome = "partial"
+		}
+		if err := a.store.completeTask(ctx, sessionID, outcome, summary); err != nil {
+			return fmt.Sprintf("error completing task: %v", err), true
+		}
+		return fmt.Sprintf("Task marked %s: %s", outcome, summary), true
+	default:
+		return nil, false
+	}
+}
+
+// autoCompleteTrivialTask is the case-1 fix from
+// plans/2026-07-11-task-completion-safety-net.md: a session that never
+// called set_goal never framed itself as a structured task, so a turn that
+// ends with a plain-text answer and no further tool calls IS the task
+// ending — but the model consistently skips complete_task for exactly this
+// case (confirmed live: 43/50 production sessions were a single trivial
+// Q&A exchange, none of which ever reached a terminal status). Rather than
+// leave agent_sessions.status stuck at its creation-time default forever,
+// close it out mechanically here: no judgment call needed, since SOUL.md
+// already treats a one-shot answered question as done by definition.
+func (a *agent) autoCompleteTrivialTask(ctx context.Context, sessionID, responseText string) {
+	summary := strings.TrimSpace(responseText)
+	summary = strings.SplitN(summary, "\n", 2)[0] // first line only — the board shows one line
+	const maxLen = 120
+	if len(summary) > maxLen {
+		summary = summary[:maxLen] + "…"
+	}
+	if summary == "" {
+		summary = "Answered without further action needed."
+	}
+	if err := a.store.completeTask(ctx, sessionID, "success", summary); err != nil {
+		slog.Error("nomos: auto-complete trivial task failed", "session", sessionID, "error", err)
+	}
+}

cmd/oikos/main.go

@@ -4,13 +4,12 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"net/http"
 	"os"
 	"os/signal"
 	"strings"
 	"syscall"
 
-	"net/http"
-
 	"github.com/dtoro/oikos/internal/config"
 	"github.com/dtoro/oikos/internal/db"
 	"github.com/dtoro/oikos/internal/httpapi"
@@ -120,7 +119,7 @@ Roles:
   knowledge  Convert wiki to knowledge seed (one-shot)
   version    Print version info
 
-The operator interface is Hermes (MCP agent) — no CLI needed.
+The operator interface is Nomos (MCP agent) — no CLI needed.
 Environment:
   OIKOS_DATABASE_URL    Postgres connection string
   OIKOS_API_LISTEN      API listen address (default :8090)

cmd/webhook/main.go

@@ -0,0 +1,96 @@
+package main
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"os"
+	"os/exec"
+	"time"
+
+	"github.com/dtoro/oikos/internal/safego"
+)
+
+func main() {
+	port := os.Getenv("WEBHOOK_LISTEN")
+	if port == "" {
+		port = ":9797"
+	}
+
+	secret := os.Getenv("WEBHOOK_HMAC_SECRET")
+	if secret == "" {
+		fmt.Fprintln(os.Stderr, "WEBHOOK_HMAC_SECRET must be set")
+		os.Exit(1)
+	}
+
+	repoDir := os.Getenv("WEBHOOK_REPO_DIR")
+	if repoDir == "" {
+		repoDir = os.Getenv("HOME") + "/Projects/oikos"
+	}
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/deploy", func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			http.Error(w, "method not allowed", 405)
+			return
+		}
+
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			http.Error(w, "read body failed", 400)
+			return
+		}
+
+		sigHex := r.Header.Get("X-Hub-Signature-256")
+		if sigHex == "" {
+			http.Error(w, "missing signature", 401)
+			return
+		}
+
+		mac := hmac.New(sha256.New, []byte(secret))
+		mac.Write(body)
+		expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
+
+		if !hmac.Equal([]byte(sigHex), []byte(expected)) {
+			slog.Warn("webhook: invalid signature")
+			http.Error(w, "invalid signature", 401)
+			return
+		}
+
+		slog.Info("webhook: deploy triggered")
+		w.WriteHeader(http.StatusAccepted)
+		w.Write([]byte(`{"status":"deploy started"}`))
+
+		safego.Go("webhook:deploy", func() {
+			cmd := exec.Command(repoDir + "/scripts/deploy.sh")
+			cmd.Dir = repoDir
+			cmd.Env = append(os.Environ(),
+				"REPO_DIR="+repoDir,
+				"PROFILE=full",
+			)
+			cmd.Stdout = os.Stdout
+			cmd.Stderr = os.Stderr
+			start := time.Now()
+			if err := cmd.Run(); err != nil {
+				slog.Error("webhook: deploy failed", "error", err, "duration", time.Since(start))
+				return
+			}
+			slog.Info("webhook: deploy succeeded", "duration", time.Since(start))
+		})
+	})
+
+	mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(200)
+		w.Write([]byte("ok"))
+	})
+
+	slog.Info("webhook: listening", "port", port)
+	if err := http.ListenAndServe(port, mux); err != nil {
+		slog.Error("webhook: serve failed", "error", err)
+		os.Exit(1)
+	}
+}

compose/caddy/Caddyfile.oikos

@@ -1,28 +1,59 @@
-# Caddy reverse-proxy snippet for Oikos — Phase 6 cutover
-# Lives in dtoro/caddy-conf repo; auto-deploys to caddy (LXC 121).
-# Replaces the old MCP server on apps/105 with the Docker stack on mac-mini.
+# Caddy reverse-proxy snippet for Oikos — Phase 6 cutover, updated for the
+# client/server split (plans/2026-07-12-wails-desktop-app.md, Phase 0).
+# Lives in dtoro/caddy-conf repo; auto-deploys to caddy (LXC 121). THIS COPY
+# IS A REFERENCE, NOT DEPLOYED FROM HERE — keep it in sync manually.
+#
+# The SPA is no longer embedded in the oikos binary; it's built and served
+# by its own container (compose/web/Dockerfile, docker-compose.yml's `web`
+# service, mac-mini:8091) rather than as static files read off local disk —
+# see that service's comment for why. Every API/MCP/agent route now requires
+# a bearer token in all cases (api's dev-open bypass was removed) —
+# non-browser clients (Wails, curl, a future mobile client) can't complete
+# Authentik's browser-session login, so those routes bypass `import
+# authentik` the same way the enrollment endpoint always has and rely on
+# api's own combinedAuth instead. See the Wails plan's "Plan review"
+# section, gap 1.
+#
+# mac-mini and the LXC subnet are routed, so these target its direct LAN IP
+# rather than the mesh (netbird) hostname.
 
-# Oikos REST API (operator) — enrollment endpoint bypasses Authentik
 oikos.hubris.network {
     tls {
         dns ionos {env.IONOS_AUTH_API_TOKEN}
     }
     @enroll path /api/v1/clients/enroll
     handle @enroll {
-        reverse_proxy <mac-mini-mesh-ip>:8090
+        reverse_proxy 192.168.178.182:8090
     }
+    # Bearer-token clients — api's combinedAuth (internal/httpapi/server.go)
+    # is the real gate for all three; Authentik would just reject non-browser
+    # callers before they ever get there. /agent/* now goes through api's own
+    # (auth'd) proxy mount rather than straight to nomos:8092, so it's
+    # covered by the same check as /api/v1/* and /mcp.
+    @api path /api/v1/* /mcp /agent/*
+    handle @api {
+        reverse_proxy 192.168.178.182:8090
+    }
+    # Everything else: the static SPA shell, served by the `web` container.
+    # No sensitive data lives here — real enforcement is the bearer-token
+    # check above — Authentik is just a first line of defense against
+    # anonymous crawlers finding the bundle.
     handle {
         import authentik
-        reverse_proxy <mac-mini-mesh-ip>:8090
+        reverse_proxy 192.168.178.182:8091
     }
 }
 
-# Oikos MCP endpoint (Hermes agents) — no auth required
+# Oikos MCP endpoint (agents) — bearer token required (api's combinedAuth),
+# no separate gate here.
 mcp.hubris.network {
-    reverse_proxy <mac-mini-mesh-ip>:8090
+    reverse_proxy 192.168.178.182:8090
 }
 
-# Hermes gateway (workstation access)
-hermes.hubris.network {
-    reverse_proxy <mac-mini-mesh-ip>:8092
+# Nomos's own gateway (workstation access) — still has NO auth of its own
+# (C1, plans/2026-07-11-nomos-agent-code-review.md, still open). Anyone who
+# can reach this host can talk to nomos directly, bypassing api entirely.
+# Not fixed by the client/server split — tracked separately.
+nomos.hubris.network {
+    reverse_proxy 192.168.178.182:8092
 }

compose/hermes/Dockerfile

@@ -1,25 +0,0 @@
-# Hermes agent container — standalone MCP client gateway (Phase 4)
-FROM golang:1.26-alpine AS builder
-
-RUN apk add --no-cache git ca-certificates
-
-WORKDIR /build
-COPY go.mod go.sum ./
-RUN go mod download
-
-COPY . .
-
-RUN CGO_ENABLED=0 go build -o /hermes -tags timetzdata -ldflags="-s -w" ./cmd/hermes
-
-FROM gcr.io/distroless/static:nonroot
-
-COPY --from=builder /hermes /hermes
-COPY hermes/ /app/hermes/
-
-ENV HERMES_MCP_URL=http://api:8090/mcp
-ENV HERMES_AGENT_SLUG=agent:hermes
-ENV HERMES_LISTEN=:8092
-
-EXPOSE 8092
-
-ENTRYPOINT ["/hermes", "serve"]

compose/nomos/Dockerfile

@@ -0,0 +1,26 @@
+# Nomos agent container — standalone MCP client gateway (Phase 4)
+FROM golang:1.26-alpine AS builder
+
+RUN apk add --no-cache git ca-certificates
+
+WORKDIR /build
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN CGO_ENABLED=0 go build -o /nomos -tags timetzdata -ldflags="-s -w" ./cmd/nomos
+
+FROM gcr.io/distroless/static:nonroot
+
+COPY --from=builder /nomos /nomos
+COPY nomos/ /app/nomos/
+
+ENV NOMOS_MCP_URL=http://api:8090/mcp
+ENV NOMOS_AGENT_SLUG=agent:nomos
+ENV NOMOS_LISTEN=:8092
+ENV NOMOS_MODEL=deepseek/deepseek-v4-pro
+
+EXPOSE 8092
+
+ENTRYPOINT ["/nomos", "serve"]

compose/oikos/Dockerfile

@@ -1,4 +1,7 @@
-# Multi-stage Dockerfile for Oikos (ADR 0001: single binary)
+# Dockerfile for Oikos API server. The SPA is no longer embedded (see
+# plans/2026-07-12-wails-desktop-app.md 0.1) — it's built and deployed
+# separately as static files (see `make ui` / `make deploy-ui`).
+# Stage 1: build Go binary
 FROM golang:1.26-alpine AS builder
 
 RUN apk add --no-cache git ca-certificates
@@ -11,8 +14,10 @@ COPY . .
 
 RUN CGO_ENABLED=0 go build -o /oikos -tags timetzdata -ldflags="-s -w" ./cmd/oikos
 
-# --- Runtime: distroless static ---
-FROM gcr.io/distroless/static:nonroot
+# --- Runtime: alpine with SSH + ping for scheduler checks ---
+FROM alpine:3.21
+
+RUN apk add --no-cache ca-certificates openssh-client-default
 
 COPY --from=builder /oikos /oikos
 COPY --from=builder /build/seeds /seeds

compose/web/Caddyfile

@@ -0,0 +1,5 @@
+:80 {
+	root * /srv
+	file_server
+	try_files {path} /index.html
+}

compose/web/Dockerfile

@@ -0,0 +1,18 @@
+# Dockerfile for the oikos control-room SPA. Built separately from the
+# oikos binary (compose/oikos/Dockerfile) — see docker-compose.yml's `web`
+# service. The outer production Caddy (caddy-conf repo, LXC 121) handles
+# Authentik + splits /api/*, /mcp, /agent/* off to the api service; this
+# container only serves static files with SPA-fallback routing.
+
+FROM node:22-alpine AS builder
+
+WORKDIR /build/web
+COPY web/package.json web/package-lock.json ./
+RUN npm ci
+COPY web/ ./
+RUN npm run build
+
+FROM caddy:2-alpine
+
+COPY --from=builder /build/web/dist /srv
+COPY compose/web/Caddyfile /etc/caddy/Caddyfile

docker-compose.yml

@@ -1,10 +1,17 @@
 # Docker Compose for Oikos development
 # Usage: docker compose up -d postgres  (just the DB)
 #        make dev                     (full dev stack)
+#
+# The SPA isn't embedded in the oikos binary (see
+# plans/2026-07-12-wails-desktop-app.md 0.1/0.6) but it IS part of this
+# stack as its own `web` service (compose/web/Dockerfile), so it deploys
+# through the same push-to-main pipeline as everything else. `npm run dev`
+# in web/ is still the fast local-iteration path.
 
 services:
   postgres:
     image: timescale/timescaledb:2.17.2-pg16
+    restart: unless-stopped
     environment:
       POSTGRES_DB: oikos
       POSTGRES_USER: oikos
@@ -51,6 +58,7 @@ services:
     build:
       context: .
       dockerfile: compose/oikos/Dockerfile
+    restart: unless-stopped
     profiles: ["dev", "full"]
     depends_on:
       seed:
@@ -60,7 +68,14 @@ services:
       OIKOS_API_LISTEN: ":8090"
       OIKOS_ENV: dev
       OIKOS_DEBUG: "true"
-      OIKOS_HERMES_AGENT_SLUG: ${OIKOS_HERMES_AGENT_SLUG:-agent:hermes}
+      # No dev-open auth bypass (plans/2026-07-12-wails-desktop-app.md 0.4) —
+      # every request needs this token. nomos uses the same value to call
+      # back into api's /mcp and /api/v1/approvals/*/decision.
+      OIKOS_MCP_BEARER_TOKEN: ${OIKOS_MCP_BEARER_TOKEN:-dev-token}
+      OIKOS_OIDC_ISSUER: ${OIKOS_OIDC_ISSUER:-https://auth.hubris.network/application/o/oikos/}
+      OIKOS_OIDC_CLIENT_ID: ${OIKOS_OIDC_CLIENT_ID:-otkHBSueHJsYtOHstL6rn5izeGgyOsavp1qA1hod}
+      OIKOS_NOMOS_AGENT_SLUG: ${OIKOS_NOMOS_AGENT_SLUG:-agent:nomos}
+      NOMOS_PROXY_URL: http://nomos:8092
     volumes:
       - ${OIKOS_SSH_KEY_PATH:-~/.ssh/id_ed25519}:/etc/oikos/ssh_key:ro
     ports:
@@ -74,6 +89,7 @@ services:
     build:
       context: .
       dockerfile: compose/oikos/Dockerfile
+    restart: unless-stopped
     profiles: ["dev", "full"]
     depends_on:
       seed:
@@ -82,6 +98,12 @@ services:
       OIKOS_DATABASE_URL: postgres://oikos:${OIKOS_DB_PASSWORD:-oikos_dev}@postgres:5432/oikos?sslmode=disable
       OIKOS_DEBUG: "true"
       OIKOS_SCHEDULER_INTERVAL: "30s"
+      OIKOS_SSH_KEY_PATH: /etc/oikos/ssh_key
+      OIKOS_SSH_USER: root
+    volumes:
+      - ${OIKOS_SSH_KEY_PATH:-~/.ssh/id_ed25519}:/etc/oikos/ssh_key:ro
+    cap_add:
+      - NET_RAW
     command: ["scheduler"]
     stop_signal: SIGTERM
     stop_grace_period: 30s
@@ -91,6 +113,7 @@ services:
     build:
       context: .
       dockerfile: compose/oikos/Dockerfile
+    restart: unless-stopped
     profiles: ["dev", "full"]
     depends_on:
       seed:
@@ -107,26 +130,48 @@ services:
     stop_signal: SIGTERM
     stop_grace_period: 30s
 
-  # Hermes agent gateway (Phase 4) — mesh-published :8092
-  hermes:
+  # Nomos agent gateway (Phase 4) — mesh-published :8092
+  nomos:
     build:
       context: .
-      dockerfile: compose/hermes/Dockerfile
+      dockerfile: compose/nomos/Dockerfile
+    restart: unless-stopped
     profiles: ["full"]
     depends_on:
       api:
         condition: service_started
     environment:
-      HERMES_MCP_URL: http://api:8090/mcp
-      HERMES_AGENT_SLUG: agent:hermes
+      NOMOS_MCP_URL: http://api:8090/mcp
+      NOMOS_AGENT_SLUG: agent:nomos
+      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY}
+      NOMOS_MODEL: ${NOMOS_MODEL:-deepseek/deepseek-v4-pro}
+      DATABASE_URL: postgres://oikos:${OIKOS_DB_PASSWORD:-oikos_dev}@postgres:5432/oikos?sslmode=disable
+      # Must match api's OIKOS_MCP_BEARER_TOKEN above — api's combinedAuth
+      # rejects every request without it now (no dev-open bypass).
+      OIKOS_MCP_BEARER_TOKEN: ${OIKOS_MCP_BEARER_TOKEN:-dev-token}
     ports:
       - "8092:8092"
     stop_signal: SIGTERM
     stop_grace_period: 10s
 
+  # Control-room SPA — static build served behind Caddy. The outer
+  # production Caddy (caddy-conf repo, LXC 121) splits /api/*, /mcp,
+  # /agent/* off to api:8090 and sends everything else here; this
+  # container only serves static files with SPA-fallback routing.
+  web:
+    build:
+      context: .
+      dockerfile: compose/web/Dockerfile
+    restart: unless-stopped
+    profiles: ["dev", "full"]
+    ports:
+      - "8091:80"
+    stop_signal: SIGTERM
+
   # Redis (required by Infisical — Phase 5)
   redis:
     image: redis:7-alpine
+    restart: unless-stopped
     profiles: ["infisical", "full"]
     volumes:
       - redis-data:/data
@@ -139,6 +184,7 @@ services:
   # Infisical self-hosted (Phase 5 secrets management)
   infisical:
     image: infisical/infisical:latest
+    restart: unless-stopped
     profiles: ["infisical", "full"]
     depends_on:
       postgres:

docs/adr/0012-hermes-oikos-interactions.md

@@ -230,4 +230,13 @@ sequenceDiagram
   `GET /clients/{slug}/context`.
 - **The DB is the single source of truth.** All state transitions,
   audit entries, and event emissions go through Postgres. The scheduler,
-  actuator, notifier, and API all read/write the same tables.
+  actuator, notifier, and API all read/write the same tables.
+
+---
+
+**2026-07-08 — renamed to Nomos.** The Hermes agent gateway was renamed to
+Nomos (from *oikonomos*, the steward of the oikos) under the
+[Nomos resident agent plan](../../plans/2026-07-08-nomos-resident-agent.md),
+N0 milestone. The gateway binary (`cmd/nomos`), Docker service, DB slug
+(`agent:nomos`), and all referencing docs were updated. All architectural
+principles in this ADR remain unchanged.

docs/adr/0013-signal-triggers.md

@@ -0,0 +1,200 @@
+# ADR 0013 — Signal trigger architecture
+
+**Status:** Accepted
+**Date:** 2026-07-08
+
+## Overview
+
+When Nomos is asked "what are the thermals of hubris?", here is exactly what happens:
+
+```mermaid
+sequenceDiagram
+    participant N as Nomos (Agent)
+    participant A as Oikos API
+    participant S as Scheduler (Docker)
+    participant H as Hubris (Proxmox)
+    participant T as TimescaleDB
+
+    Note over S,H: Every 60s (autonomous loop)
+    S->>H: SSH exec /opt/oikos/checks/cpu_check.sh
+    H-->>S: {"health":"ok","metrics":{"cpu_pct":2.5,"cpu_temp":48}}
+    S->>T: INSERT metric_samples (cpu_pct, cpu_temp)
+    S->>T: UPSERT entity_status (health)
+    alt unhealthy
+        S->>T: UPSERT signal (dedup by target+kind)
+    end
+
+    Note over N,T: User asks "what are the thermals of hubris?"
+    N->>A: MCP query_metrics(metric=["cpu_pct","cpu_temp"])
+    A->>T: SELECT time_bucket(…) FROM metric_samples
+    T-->>A: cpu_pct=15%, cpu_temp=48°C
+    A-->>N: {avg, min, max} per bucket
+```
+
+## Two Paths
+
+### Path A — Autonomous Collection (Scheduler)
+
+1. Operator creates a check via REST API: `POST /api/v1/checks`
+2. Scheduler loads enabled checks every 30s from `check_defs` table
+3. For `ssh-script` checks, scheduler SSHs to target host and runs `/opt/oikos/checks/<script>.sh`
+4. Script returns JSON with `health`, `signalKind`, `evidence`, and `metrics`
+5. Metrics written to TimescaleDB `metric_samples` table **every cycle** (healthy or not)
+6. If unhealthy: a signal is raised (deduplicated by target_entity_id + kind)
+7. If healthy again: the signal is auto-resolved, entity_status health updated
+8. All state changes emit SSE events for real-time UI updates
+
+### Path B — Query (Nomos via MCP)
+
+1. Nomos calls `query_metrics(metric=["cpu_pct","cpu_temp"])` MCP tool
+2. API runs time-bucketed aggregation over `metric_samples`
+3. Returns latest readings with avg/min/max per bucket
+4. Nomos formats them and presents to the user
+
+## Check Kinds
+
+| Kind | Where it runs | Protocol | Example |
+|------|--------------|----------|---------|
+| `ping` | Scheduler container | ICMP (`ping` binary) | Reachability + latency |
+| `http` | Scheduler container | HTTP GET | Service endpoint health |
+| `tcp` | Scheduler container | TCP dial | Port open check |
+| `disk` | Scheduler container | `unix.Statfs` | Local disk usage + inodes |
+| `cert-expiry` | Scheduler container | TLS dial | Certificate days remaining |
+| `ssh-script` | Remote target via SSH | SSH exec + JSON | Any script in `/opt/oikos/checks/` |
+
+## Available Check Scripts
+
+All scripts live in `/opt/oikos/checks/` on target hosts. They output JSON:
+
+```json
+{"health":"healthy","metrics":{"cpu_pct":2.5,"cpu_temp":48.0}}
+```
+or on failure:
+```json
+{"health":"degraded","signalKind":"disk-smart-fail","evidence":"SMART failed for Samsung 990"}
+```
+
+| Script | Metrics | Signal (on failure) |
+|--------|---------|---------------------|
+| `cpu_check.sh` | `cpu_pct`, `cpu_temp` | threshold-based |
+| `memory_check.sh` | `mem_pct` | threshold-based |
+| `load_check.sh` | `load1`, `cores` | threshold-based |
+| `swap_check.sh` | `swap_pct` | threshold-based |
+| `disk_usage_check.sh` | `disk_*_pct`, `inode_*_pct` | threshold-based |
+| `disk_smart_check.sh` | — | `disk-smart-fail` |
+| `updates_check.sh` | `security_updates`, `reboot_required` | threshold-based |
+| `zfs_check.sh` | — | `zfs-degraded`, `zfs-scrub-overdue` |
+| `process_check.sh` | — | `<service-name>` |
+| `uptime_check.sh` | `uptime_seconds` | threshold-based |
+| `oom_check.sh` | `oom_count` | `oom-kills` |
+| `journal_check.sh` | `journal_errors` | `journal-errors` |
+| `time_check.sh` | `clock_drift_s` | `time-drift` |
+| `fd_check.sh` | `fd_pct` | threshold-based |
+| `docker_health_check.sh` | `docker_unhealthy`, `docker_total` | `docker-unhealthy` |
+| `caddy_error_rate.sh` | `caddy_5xx_rate`, `caddy_requests`, `caddy_5xx` | `caddy-errors` |
+| `backup_freshness.sh` | — | `backup-stale` |
+
+## Script Deployment
+
+```mermaid
+sequenceDiagram
+    participant R as Git Repo
+    participant T as Sync Timer (5min)
+    participant H as Target Host
+
+    Note over R,T: Operator pushes scripts
+    R->>T: git pull (homelab-context)
+    T->>T: tools/post-pull.sh
+    T->>T: → tools/setup-checks.sh
+    T->>T: → checks/install.sh
+    T->>H: cp *.sh → /opt/oikos/checks/
+```
+
+## Defining a Check
+
+```bash
+curl -X POST http://oikos:8090/api/v1/checks \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "kind": "ssh-script",
+    "target": "host:hubris",
+    "config": {
+      "host": "192.168.8.77",
+      "script": "cpu_check.sh",
+      "thresholds": {
+        "cpu_pct": {"warn": 90, "crit": 95},
+        "cpu_temp": {"crit": 85}
+      }
+    },
+    "interval_s": 60
+  }'
+```
+
+## Signal Lifecycle
+
+```mermaid
+stateDiagram-v2
+    [*] --> raised
+    raised --> acknowledged
+    raised --> muted: mute_until set
+    raised --> resolved: condition cleared
+
+    acknowledged --> acting: classification exists
+    acknowledged --> muted
+    acknowledged --> resolved
+
+    acting --> resolved: verification passed
+    acting --> raised: retry budget remaining
+    acting --> failed
+
+    failed --> acknowledged: operator retry
+
+    muted --> raised: mute_until expired
+
+    resolved --> [*]
+```
+
+Signals deduplicate: **one open signal per (target_entity_id, kind)**.
+Repeated failures increment `occurrence_count` instead of creating duplicates.
+
+## Threshold Evaluation
+
+Each check config can define per-metric thresholds in the `config` JSONB:
+
+```json
+{
+  "thresholds": {
+    "cpu_temp": {"crit": 85},
+    "cpu_pct": {"warn": 90, "crit": 95}
+  }
+}
+```
+
+Severity mapping:
+- metric >= `crit` → severity = `critical`
+- metric >= `warn` → severity = `warning`
+- `health == "down"` with no thresholds → severity = `critical`
+- Otherwise → severity = `warning`
+
+## Data Flow (DB Tables)
+
+```mermaid
+flowchart TD
+    CD[check_defs] -->|scheduler reads| EC[executeCheck]
+    EC -->|healthy?| RS[resolve signal + upsert entity_status]
+    EC -->|unhealthy?| US[UpsertSignal dedup by target+kind]
+    EC -->|every cycle| IM[INSERT metric_samples]
+    US --> S[signals]
+    RS --> ES[entity_status]
+    IM --> MS[(metric_samples)]
+    MS --> R1H[metric_rollups_1h continuous aggregate]
+    MS --> R1D[metric_rollups_1d continuous aggregate]
+```
+
+## Prerequisites for SSH Checks
+
+1. **Key**: SSH private key mounted at `/etc/oikos/ssh_key` in the scheduler container
+2. **User**: `OIKOS_SSH_USER=root` (or set `"user"` in check config)
+3. **Scripts**: Deployed on target host at `/opt/oikos/checks/`
+4. **Network**: Scheduler container must reach target host (bridge → LAN works)
+5. **Container**: Scheduler needs `openssh-client` (alpine base) + `CAP_NET_RAW` (for ping)

docs/adr/0014-entity-model.md

@@ -0,0 +1,613 @@
+# ADR 0014 — Entity model: types, relationships & interactions
+
+**Status:** Accepted
+**Date:** 2026-07-08
+**Scope:** Full inventory of every entity type, relationship, state machine, and
+cognition pipeline — with clear markers for what is **code-real** vs **schema-only**.
+
+---
+
+## 1. Entity Type Hierarchy (56 types)
+
+```mermaid
+graph TD
+    subgraph meta["layer: meta"]
+        entity["★ entity"]
+    end
+
+    subgraph infrastructure["layer: infrastructure"]
+        subgraph physical["domain: physical"]
+            site
+            ups
+            sensor
+            peripheral
+        end
+
+        subgraph compute["domain: compute"]
+            ce["★ compute-entity"]
+            machine["★ machine"]
+            proxmox-host
+            standalone-server
+            workstation
+            appliance
+            vm
+            container["★ container"]
+            lxc
+            docker-container
+            hypervisor
+        end
+
+        subgraph network["domain: network"]
+            net["★ network"]
+            lan
+            mesh
+            vlan
+            network-interface
+            dns-zone
+            dns-record
+            ingress-route
+            certificate
+            firewall-rule
+        end
+
+        subgraph storage["domain: storage"]
+            storage-pool
+            volume
+            backup-target
+            dataset
+        end
+
+        subgraph software["domain: software"]
+            service
+            application
+            config-repo
+            deploy-pipeline
+            package-set
+            cluster
+            compose-stack
+        end
+
+        subgraph external["domain: external"]
+            domain-registration
+            cloud-service
+            isp-link
+            vendor-dependency
+        end
+    end
+
+    subgraph governance["layer: governance"]
+        subgraph identity["domain: identity"]
+            person
+            agent
+            identity-provider
+            account
+            secret
+            key
+            access-grant
+        end
+    end
+
+    subgraph cognition["layer: cognition"]
+        check
+        signal
+        classification
+        execution
+        feedback
+        pattern
+        skill
+        approval
+        document
+        runbook
+        investigation
+    end
+
+    entity --> ce
+    entity --> machine
+    entity --> net
+    entity --> container
+    entity --> site
+    entity --> ups
+    entity --> sensor
+    entity --> peripheral
+    entity --> vm
+    entity --> hypervisor
+    entity --> network-interface
+    entity --> dns-zone
+    entity --> dns-record
+    entity --> ingress-route
+    entity --> certificate
+    entity --> firewall-rule
+    entity --> storage-pool
+    entity --> volume
+    entity --> backup-target
+    entity --> dataset
+    entity --> service
+    entity --> application
+    entity --> config-repo
+    entity --> deploy-pipeline
+    entity --> package-set
+    entity --> cluster
+    entity --> compose-stack
+    entity --> domain-registration
+    entity --> cloud-service
+    entity --> isp-link
+    entity --> vendor-dependency
+    entity --> person
+    entity --> agent
+    entity --> identity-provider
+    entity --> account
+    entity --> secret
+    entity --> key
+    entity --> access-grant
+    entity --> check
+    entity --> signal
+    entity --> classification
+    entity --> execution
+    entity --> feedback
+    entity --> pattern
+    entity --> skill
+    entity --> approval
+    entity --> document
+    entity --> runbook
+    entity --> investigation
+
+    ce --> machine
+    ce --> container
+    machine --> proxmox-host
+    machine --> standalone-server
+    machine --> workstation
+    machine --> appliance
+    container --> lxc
+    container --> docker-container
+    net --> lan
+    net --> mesh
+    net --> vlan
+```
+
+★ = abstract (cannot be instantiated; polymorphic target for relationships)
+
+### Concrete instances (88 active entities)
+
+| Type | Count | Examples |
+|------|-------|---------|
+| `lxc` | 19 | jellyfin, caddy, dns, gitea, nextcloud, matrix, arriman… |
+| `service` | 25 | caddy, authentik, dns, jellyfin, paperless, matrix… |
+| `ingress-route` | 21 | *.hubris.network |
+| `config-repo` | 6 | caddy-conf, gitea-customizations, mule-image… |
+| `proxmox-host` | 2 | hubris, strong |
+| `workstation` | 2 | mac-mini, republic-laptop |
+| `standalone-server` | 1 | netbird-vps |
+| `vm` | 2 | zimaos, haos |
+| `storage-pool` | 3 | local-lvm-hubris, library-hubris, ludo-lvm |
+| `volume` | 2 | library, media-local |
+| + sites, networks, agents, documents, destroyed… | | |
+
+---
+
+## 2. Core Sequence: Machine Onboarding
+
+```mermaid
+sequenceDiagram
+    participant O as Operator
+    participant A as Oikos API
+    participant D as DB
+    participant S as Scheduler
+    participant T as Target Machine
+
+    O->>A: POST /api/v1/entities {type:proxmox-host, slug:host:new, …}
+    A->>D: INSERT INTO entities
+    A->>A: ensureDefaultChecks().resolveHost() → lan_ip
+    A->>D: INSERT check_defs × 6 (target_id set)
+    A-->>O: 201 Created
+
+    Note over S,T: 30s scheduler tick
+    S->>D: ListEnabledCheckDefs
+    S->>T: SSH exec /opt/oikos/checks/cpu_check.sh
+    T-->>S: {"health":"ok","metrics":{"cpu_pct":2.5,"cpu_temp":48}}
+    S->>D: INSERT metric_samples
+    S->>D: UPSERT entity_status (health)
+```
+
+**What's code-real here:**
+- `CreateEntity()` at `internal/httpapi/impl.go:811` — handles POST, validates type, calls `ensureDefaultChecks()`
+- `ensureDefaultChecks()` → `internal/checkdefaults/defaults.go:144` — resolves host IP, SSH user, creates 6 check_defs rows with target_id
+- Scheduler at `internal/scheduler/scheduler.go:26` — loads `ListEnabledCheckDefs`, dispatches by kind, writes metrics + signals
+
+---
+
+## 3. Core Sequence: The OODA Loop (observe → orient → decide → act → learn)
+
+```mermaid
+flowchart TB
+    subgraph OBSERVE["🔍 OBSERVE (Scheduler every 30s)"]
+        direction TB
+        S1["ListEnabledCheckDefs"]
+        S2["ping → exec.Command(ping, host)"]
+        S3["http → http.Get(url)"]
+        S4["tcp → net.DialTimeout(tcp, addr)"]
+        S5["disk → unix.Statfs(path)"]
+        S6["cert-expiry → tls.Dial + cert.NotAfter"]
+        S7["ssh-script → exec.Command(ssh, host, script)"]
+        S8["checkResult{health, signalKind, evidence, metrics}"]
+        S1 --> S2 & S3 & S4 & S5 & S6 & S7
+        S2 & S3 & S4 & S5 & S6 & S7 --> S8
+        S8 -->|INSERT| MS[("metric_samples")]
+        S8 -->|UPSERT| SG["signals (dedup by target+kind)"]
+        S8 -->|UPSERT| ES["entity_status (health)"]
+    end
+
+    subgraph ORIENT["🧭 ORIENT (Classification)"]
+        direction TB
+        C1["policy.ClassifySignal(signal, entity, blast_radius)"]
+        C2["read_only → route: auto_act"]
+        C3["reversible_low → route: auto_act"]
+        C4["config_mutation → route: escalate"]
+        C5["destructive → route: hold"]
+        C1 --> C2 & C3 & C4 & C5
+    end
+
+    subgraph DECIDE["⚖️ DECIDE (Approval Gate)"]
+        direction TB
+        D1["auto_act → execute immediately"]
+        D2["escalate → INSERT approval (pending)"]
+        D3["notifier → Matrix alert + HMAC token"]
+        D4["operator replies ✅ or ❌"]
+        D5["hold → queued, never auto-executed"]
+        D2 --> D3 --> D4
+    end
+
+    subgraph ACT["⚡ ACT (Execution)"]
+        direction TB
+        A1["Nomos → MCP request_execution"]
+        A2["actuator.Execute() → SSH exec"]
+        A3["systemctl restart / apt upgrade / pct exec"]
+        A1 --> A2 --> A3
+    end
+
+    subgraph LEARN["🧠 LEARN (Patterns + Skills)"]
+        direction TB
+        L1["execution → produces → feedback"]
+        L2["feedback → contributes-to → pattern"]
+        L3["pattern → informs → skill"]
+        L1 --> L2 --> L3
+    end
+
+    SG --> ORIENT
+    ORIENT --> DECIDE
+    DECIDE --> ACT
+    ACT --> LEARN
+
+    style OBSERVE fill:#e3f2fd
+    style ORIENT fill:#fff3e0
+    style DECIDE fill:#fce4ec
+    style ACT fill:#e8f5e9
+    style LEARN fill:#f3e5f5
+```
+
+### What's code-real in the OODA loop
+
+| Phase | Table | Code | Status |
+|-------|-------|------|--------|
+| Observe | `check_defs`, `metric_samples` | `scheduler.go:26-215` | ✅ fully wired, 6 probe kinds |
+| Observe → Orient | `signals` | `scheduler.go:130-141` (UpsertSignal) | ✅ dedup, severity, events |
+| Orient | `classifications` | `policy/classify.go` (function exists) | ⚠ function defined but scheduler never calls it |
+| Decide | `approvals` | `server.go:311-367` (request_execution) | ✅ escalation gate works |
+| Act | `executions` | `actuator/exec.go` (SSH exec) | ✅ systemctl, apt, pct |
+| Learn | `feedback`, `patterns`, `skills` | tables + list endpoints only | ⚠ schema only, no write path |
+
+---
+
+## 4. Relationship Types — The Edge Catalog (34 edges)
+
+### Infrastructure Topology
+
+```mermaid
+graph LR
+    HH["host:hubris"] -->|hosts| LX1["lxc:jellyfin"]
+    HH -->|hosts| LX2["lxc:caddy"]
+    HH -->|hosts| LX3["lxc:dns"]
+    HH -->|hosts| LX4["lxc:gitea"]
+    HH -->|hosts| LX5["lxc:…"]
+    HS["host:strong"] -->|hosts| LX6["lxc:jellyfin"]
+    HS -->|hosts| LX7["lxc:arriman"]
+    HH -->|member-of| CL["cluster:homelab"]
+    HS -->|member-of| CL
+    LX2 -->|provides| SV1["service:caddy"]
+    LX4 -->|provides| SV2["service:gitea"]
+    LX3 -->|provides| SV3["service:dns"]
+    HH -->|mounts| VL["volume:library"]
+    HH -->|stores-on| PL["pool:library-hubris"]
+```
+
+### Network
+
+```mermaid
+graph LR
+    IG["ingress:paperless.hubris.network"] -->|routes-to| SP["service:paperless"]
+    IG -->|secured-by| IDP["idp:authentik"]
+    IG -->|uses-certificate| CRT["cert:*.hubris.network"]
+    SJ["service:jellyfin"] -->|authenticates-via| IDP
+    DNS["dns:paperless"] -->|in-zone| ZN["zone:hubris.network"]
+    DNS -->|resolves-to| LX["lxc:caddy"]
+    HH["host:hubris"] -->|connects-via| LL["lan:lab"]
+    HS["host:strong"] -->|connects-via| LH["lan:household"]
+```
+
+### Service Dependencies (feeds blast_radius CTE)
+
+```mermaid
+graph LR
+    JF["service:jellyfin"] -->|depends-on| AK["service:authentik"]
+    PP["service:paperless"] -->|depends-on| AK
+    AR["service:arr-stack"] -->|depends-on| JF
+    AK -->|depends-on| CD["service:caddy"]
+    AK -->|depends-on| DNS["service:dns"]
+```
+
+### Cognition (OODA edges)
+
+```mermaid
+graph LR
+    CK["check:ssh-script:d419257d"] -->|checks| HH["host:hubris"]
+    CK -->|raises| SG["signal:cpu-pressure"]
+    SG -->|about| HH
+    CL["classification:xyz"] -->|classifies| SG
+    CL -->|precedes| EX["execution:restart-xyz"]
+    EX -->|targets| HH
+    EX -->|performs| AG["agent:nomos"]
+```
+
+### Governance
+
+```mermaid
+graph LR
+    DT["person:dtoro"] -->|owns| NO["agent:nomos"]
+    DT -->|decides| AP["approval:xyz"]
+    AK["idp:authentik"] -->|authenticates| DT
+```
+
+---
+
+## 5. Lifecycle State Machines
+
+### Infrastructure (15 concrete types use this)
+
+```mermaid
+stateDiagram-v2
+    [*] --> planned
+    planned --> provisioning
+    planned --> destroyed: cancelled
+
+    provisioning --> active
+    provisioning --> failed
+
+    active --> migrating
+    active --> failed
+    active --> deprecated
+
+    migrating --> active: post-verify
+    migrating --> failed
+
+    failed --> active: recovery verified
+    failed --> deprecated: write-off
+
+    deprecated --> active: un-deprecate
+    deprecated --> destroyed
+
+    destroyed --> [*]
+```
+
+**Real precondition checks** (code in `impl.go:1494-1579`):
+| Transition | Precondition | How it's checked |
+|------------|-------------|-----------------|
+| provisioning→active | `health-check-answering` | `SELECT health FROM entity_status WHERE entity_id=$1` — must be healthy |
+| provisioning→active | `age-key-enrolled-if-needed` | Checks `attributes->>'age_pubkey'` (workstation only) |
+| provisioning→active | `mesh-joined-if-needed` | Checks `attributes->>'mesh_ip'` (workstation only) |
+| provisioning→active | `doc-page-complete` | `SELECT count(*) FROM relationships WHERE target_id=$1 AND type='documents'` |
+| deprecated→destroyed | `no-inbound-edges` | `SELECT count(*) FROM relationships WHERE target_id=$1 AND valid_to IS NULL` |
+| any → terminated | `backups-verified` | Checks flag in entity attributes |
+| any → terminated | `secrets-revoked` | Checks flag in entity attributes |
+
+**Soft preconditions** (always pass — operator-confirmed): `inventory-entry`, `ip-reserved`, `preflight-passed`, `backup-verified`, `replacement-live`, `caddy-backends-checked`, `un-deprecate-note`, etc.
+
+### Signal
+
+```mermaid
+stateDiagram-v2
+    [*] --> raised
+    raised --> acknowledged
+    raised --> muted: mute_until set
+    raised --> resolved: condition cleared
+
+    acknowledged --> acting: classification exists
+    acknowledged --> muted
+    acknowledged --> resolved
+
+    acting --> resolved: verification passed
+    acting --> raised: retry budget
+    acting --> failed
+
+    failed --> acknowledged: operator retry
+
+    muted --> raised: mute_until expired
+
+    resolved --> [*]
+```
+
+**Implemented preconditions:**
+- `raised → muted`: requires `mute_until` set (MuteSignal handler, `impl.go:615-689`)
+- `acting → resolved`: requires `verification-passed` (soft — operator confirms)
+
+**Dedup mechanism:** `UNIQUE INDEX uq_signals_open ON signals(target_entity_id, kind) WHERE state NOT IN ('resolved','failed')` — at most one open signal per (entity, kind). Repeated failures call `UpsertSignal` which increments `occurrence_count` on the existing row.
+
+### Execution
+
+```mermaid
+stateDiagram-v2
+    [*] --> proposed
+    proposed --> approved
+    proposed --> auto_approved
+    proposed --> denied
+    proposed --> expired
+
+    approved --> executing
+    auto_approved --> executing
+    expired --> [*]
+    denied --> [*]
+
+    executing --> verified
+    executing --> failed
+    executing --> timed_out
+
+    failed --> rolled_back
+    rolled_back --> verified
+    rolled_back --> rollback_failed
+
+    verified --> [*]
+    rollback_failed --> [*]
+    timed_out --> [*]
+```
+
+### Approval
+
+```mermaid
+stateDiagram-v2
+    [*] --> pending
+    pending --> approved
+    pending --> denied
+    approved --> revoked
+    approved --> expired
+
+    denied --> [*]
+    revoked --> [*]
+    expired --> [*]
+```
+
+---
+
+## 6. What's Code-Real vs Schema-Only
+
+### ✅ Fully Implemented (code exists, running in production)
+
+| Component | File(s) | What it does |
+|-----------|---------|-------------|
+| Entity CRUD | `impl.go:811-966` | Create, read, patch, list entities |
+| Lifecycle transitions | `impl.go:1494-1579` | Precondition checks + state transitions |
+| Relationship management | `seed.go` (ingest) | Create edges with `valid_from/valid_to` |
+| Client enrollment | `impl.go:1134-1236` | `POST /clients/enroll` — age keypair, Infisical, state: provisioning |
+| Check definitions | `phase3.go:265-376` | CreateCheck, ListChecks, PatchCheck |
+| Scheduler observe | `scheduler.go:26-215` | 6 probe kinds, metric_samples, signals, entity_status |
+| Signals | `scheduler.go:81-161` | UpsertSignal (dedup), ResolveSignal, severity evaluation |
+| Executions | `server.go:286-411` | request_execution MCP tool — reversible_low/config_mutation/destructive |
+| Approvals | `server.go:970-1052` | createApproval, DecideApproval → executeApprovedAction |
+| Notifier | `notifier/notifier.go` | Matrix alerts for pending approvals |
+| Patterns | `phase3.go:1100+` | ListPatterns, PatchPattern (status/quarantine) |
+| Skills | `phase3.go:1300+` | ListSkills, PatchSkill, ListSkillVersions |
+| Default checks | `checkdefaults/defaults.go` | Auto-create checks on entity creation/enrollment/seed |
+| TimescaleDB metrics | `metric_samples` table | Hypertable with 1h/1d continuous aggregates, 90-day retention |
+| Events + SSE | `events` table + pg_notify | Real-time UI updates via SSE endpoint |
+| Audit log | `audit_log` hypertable | Every mutation with actor + action |
+| Knowledge entities | `knowledge_entities` | Documents, runbooks, investigations with FTS |
+| MCP tools | `server.go` | 24 tools for observe/orient/decide/act |
+| Blast radius | `blast_radius()` fn | Recursive CTE — depends-on + hosts + routes-to edges |
+
+### ⚠ Schema Defined, Not Yet Wired (table exists, no active code path creates rows)
+
+| Component | What's Missing |
+|-----------|---------------|
+| `classifications` auto-creation | `policy.ClassifySignal()` exists but scheduler never calls it. Signals are raised but never automatically classified. |
+| `feedback` records | No code writes to the `feedback` table. Execution results are not analyzed for patterns. |
+| Pattern auto-learning | No code transitions patterns from `hypothesized → validated`. Requires `evidence-count≥5 + confidence≥0.7` but no aggregation runs. |
+| Skill execution | Skill entities carry a JSON `procedure` field but no execution engine reads or runs it. |
+| `drift` check kind | Defined in OpenAPI and `check_defs.kind` enum, but no scheduler implementation exists. |
+
+### 📋 Defined in Seeds Only (ontology.yaml references, no DB schema)
+
+| Item | Notes |
+|------|-------|
+| Relationship type `cluster` | Mentioned in inventory but not in ontology relationship_types |
+| `certificate` entity type | Referenced in `uses-certificate` edges but no concrete certificates in inventory |
+| Relationship type `powers` / `monitors` | Not defined in relationship_types |
+
+---
+
+## 7. Database Physical Schema
+
+```mermaid
+erDiagram
+    lifecycle_defs ||--o{ entity_types : "lifecycle_id FK"
+    entity_types ||--o{ entities : "type FK"
+    entity_types ||--o| entity_types : "parent_type FK (self-ref)"
+
+    entities ||--o| entity_status : "dual entity (shared PK)"
+    entities ||--o| check_defs : "dual entity (shared PK)"
+    entities ||--o| signals : "dual entity (shared PK)"
+    entities ||--o| classifications : "dual entity (shared PK)"
+    entities ||--o| executions : "dual entity (shared PK)"
+    entities ||--o| feedback : "dual entity (shared PK)"
+    entities ||--o| patterns : "dual entity (shared PK)"
+    entities ||--o| skills : "dual entity (shared PK)"
+    entities ||--o| approvals : "dual entity (shared PK)"
+    entities ||--o| knowledge_entities : "dual entity (shared PK)"
+
+    entities ||--o{ relationships : "source_id FK"
+    entities ||--o{ relationships : "target_id FK"
+
+    check_defs }o--|| entities : "target_id FK"
+    signals }o--|| entities : "target_entity_id FK"
+    executions }o--|| entities : "target_entity_id FK"
+    approvals }o--|| entities : "subject_entity_id FK"
+
+    entity_types ||--o{ relationship_types : "source_type FK"
+    entity_types ||--o{ relationship_types : "target_type FK"
+    relationship_types ||--o{ relationships : "type FK"
+
+    entity_types ||--o{ approval_rules : "entity_type FK"
+
+    signals ||--o| check_defs : "check_id FK"
+```
+
+**Key architectural patterns:**
+- **Dual entities:** `check_defs`, `signals`, `classifications`, `executions`, `feedback`, `patterns`, `skills`, `approvals`, `knowledge_entities` — all have `entity_id UUID PK REFERENCES entities(id)`. Every row is also an entity.
+- **Partial unique indexes:** `relationships` (current edges), `signals` (open signals), `patterns` (per-type action) — all use `WHERE` clauses for snapshot semantics.
+- **TimescaleDB hypertables:** `metric_samples`, `events`, `audit_log`, `agent_activity` — with continuous aggregates and retention policies.
+- **SSE fan-out:** `pg_notify('oikos_events', ...)` trigger on `events` INSERT → Go listener fan-out → SSE connections.
+
+---
+
+## 8. How Nomos Queries Thermals — End-to-End Trace
+
+```mermaid
+sequenceDiagram
+    participant U as User
+    participant N as Nomos (Agent)
+    participant A as Oikos API
+    participant T as TimescaleDB
+    participant S as Scheduler
+    participant H as Hubris
+
+    Note over S,H: Autonomous collection (every 60s)
+    S->>H: SSH exec cpu_check.sh
+    H-->>S: {"metrics":{"cpu_pct":15,"cpu_temp":48}}
+    S->>T: INSERT metric_samples (cpu_pct, cpu_temp)
+
+    Note over U,N: User asks question
+    U->>N: "what are the thermals of hubris?"
+    N->>A: MCP query_metrics(metric=["cpu_pct","cpu_temp"])
+    A->>T: SELECT time_bucket('1h', ts) … FROM metric_samples
+    T-->>A: {avg:15, min:2, max:40} (cpu_pct)
+    T-->>A: {avg:48, min:42, max:85} (cpu_temp)
+    A-->>N: time-bucketed metrics
+    N-->>U: "CPU at 15%, temp 48°C — normal range"
+```
+
+**What made this possible (chronologically):**
+1. `scheduler.go` refactored to return metrics map → `checkResult{metrics}`
+2. `ssh-script` check kind implemented → SSH exec to remote host
+3. `cpu_check.sh` deployed to hubris → returns `{"metrics":{"cpu_pct":2.5,"cpu_temp":48}}`
+4. Check created: `POST /checks {"kind":"ssh-script","target":"host:hubris","config":{"host":"192.168.8.77","script":"cpu_check.sh"}}`
+5. Fixed: `InsertMetricSample` missing `ts` column → `now()` literal
+6. Fixed: SSH port/user parsing bugs
+7. Fixed: SSH warnings polluting JSON output
+8. Scheduler loop → metrics written to TimescaleDB every 60s
+9. MCP `query_metrics` reads from TimescaleDB → Nomos gets live data

docs/adr/0015-api-bearer-auth-client-server-split.md

@@ -0,0 +1,62 @@
+# ADR 0015 — Bearer-token auth for every route + client/server split
+
+Status: accepted (2026-07-12) · Plan: plans/2026-07-12-wails-desktop-app.md, Phase 0
+
+## Context
+The control-room SPA was embedded in the `oikos` binary (`go:embed`,
+ADR 0001) and served at `/ui/*`. `combinedAuth` (`internal/httpapi/server.go`)
+opened a dev-open bypass — no credential required at all — whenever
+`OIKOS_ENV=dev` and no static token/OIDC issuer was configured. That was
+true not just in local dev but in the actual mac-mini production deploy:
+`docker-compose.yml`'s `api` service hardcoded `OIKOS_ENV: dev` with no
+token set, so every route (`/api/v1/*`, `/mcp`, and an `/agent` reverse-proxy
+mount to nomos that had never been wrapped in `combinedAuth` at all) was
+reachable unauthenticated from anywhere on the mesh/LAN. A planned Wails
+desktop client and any future non-browser client can't rely on same-origin
+requests or a dev-open bypass; they need the SPA to be a standalone,
+CORS-capable client that authenticates over HTTP like any other caller.
+
+## Decision
+- Delete the SPA embed (`web/embed.go`, the `/ui/*` routes). `web/` is a
+  standalone static build, deployed separately (`make ui` / `make
+  deploy-ui`), served at `/` by Caddy with SPA fallback.
+- Remove the dev-open bypass entirely. Every route requires a valid
+  static bearer token (`OIKOS_API_TOKEN` / `OIKOS_MCP_BEARER_TOKEN`) or an
+  OIDC JWT, with two narrow exceptions: `/healthz` (liveness) and
+  `POST /api/v1/clients/enroll` (IP-gated in the handler instead).
+  `GET /api/v1/events/stream` additionally accepts the token as a
+  `?token=` query param, since `EventSource` can't set custom headers.
+- Add CORS (`github.com/go-chi/cors`, `OIKOS_CORS_ORIGIN`, default `*`) so a
+  cross-origin SPA (Vite dev server, a future Wails webview) can reach the
+  API. No `AllowCredentials` — auth is a header, not a cookie, so
+  credentialed CORS mode isn't needed and the two don't combine safely with
+  a wildcard origin.
+- Wrap the previously-unauthenticated `/agent` proxy mount in the same
+  `combinedAuth` middleware as every other route.
+- `cmd/nomos` becomes an authenticated client of `api`: it now sends
+  `Authorization: Bearer $OIKOS_MCP_BEARER_TOKEN` on its own outbound calls
+  (MCP + the chat-assent approval-decision endpoint), which it never did
+  before — dev-open covered for it until now.
+- The SPA gets a runtime config module (`web/src/lib/config.ts`) and a
+  first-launch `Config.svelte` screen: server URL + token, stored in
+  `localStorage`, injected into every `fetch()` via a shared
+  `fetchWithAuth` wrapper. Resolved fresh per request (not cached at
+  module-load time), so the same build works same-origin or cross-origin
+  without a rebuild.
+
+## Consequences
+- Closing dev-open was a live security fix, not just future-proofing —
+  verified post-deploy that unauthenticated requests to production now 401.
+- Nomos's *own* HTTP gateway (`cmd/nomos`, port 8092) still has no auth of
+  its own — out of scope here, tracked separately
+  (plans/2026-07-11-nomos-agent-code-review.md, finding C1).
+- Production Caddy (`dtoro/caddy-conf`, not this repo) does not yet expose
+  `oikos.hubris.network` at all, so the interaction between Authentik
+  forward-auth and bearer-token clients (a non-browser client can't
+  complete a browser SSO redirect) is unresolved — needs an `@enroll`-style
+  bypass for `/api/v1/*`/`/mcp`/`/agent/*` before public exposure. This
+  repo's `compose/caddy/Caddyfile.oikos` (a reference copy, not deployed
+  from here) has the bypass; the real config does not yet.
+- There is one shared bearer secret for all agents/clients, not per-client
+  tokens — acceptable for the current fleet size, revisit if per-client
+  revocation becomes necessary.

docs/adr/README.md

@@ -16,3 +16,8 @@ Statuses: proposed | accepted | superseded-by-NNNN.
 | [0008](0008-forward-only-migrations.md) | Forward-only migrations |
 | [0009](0009-sse-over-websocket.md) | SSE over WebSocket for the event stream |
 | [0010](0010-infisical-with-sops-fallback.md) | Infisical secrets with SOPS DR fallback |
+| [0011](0011-client-lifecycle-flows.md) | Client lifecycle sequence diagrams |
+| [0012](0012-hermes-oikos-interactions.md) | Hermes/Oikos interaction architecture |
+| [0013](0013-signal-triggers.md) | Signal trigger architecture |
+| [0014](0014-entity-model.md) | Entity model — types, relationships, state machines, OODA loop |
+| [0015](0015-api-bearer-auth-client-server-split.md) | Bearer-token auth for every route + client/server split |

docs/operations/rollback.md

@@ -70,7 +70,7 @@ curl http://localhost:8090/healthz
 # Entity count matches
 curl -s http://localhost:8090/api/v1/entities?limit=1 | jq '.items | length'
 
-# MCP tools working (via Hermes)
+# MCP tools working (via Nomos)
 curl -s http://localhost:8092/query -d '{"tool":"get_health_summary"}'
 ```
 

go.mod

@@ -5,14 +5,20 @@ go 1.26.3
 require (
 	github.com/getkin/kin-openapi v0.140.0
 	github.com/go-chi/chi/v5 v5.3.1
+	github.com/go-chi/cors v1.2.2
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/jsonschema-go v0.4.3
 	github.com/google/uuid v1.6.0
+	github.com/infisical/go-sdk v0.8.0
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/modelcontextprotocol/go-sdk v1.6.1
 	github.com/oapi-codegen/runtime v1.4.2
+	github.com/openai/openai-go v1.12.0
+	github.com/wailsapp/wails/v3 v3.0.0-alpha2.117
+	github.com/zalando/go-keyring v0.2.8
 	golang.org/x/crypto v0.53.0
 	golang.org/x/sync v0.21.0
+	golang.org/x/sys v0.46.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -21,6 +27,7 @@ require (
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	cloud.google.com/go/iam v1.1.11 // indirect
+	github.com/adrg/xdg v0.5.3 // indirect
 	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
 	github.com/aws/aws-sdk-go-v2 v1.27.2 // indirect
 	github.com/aws/aws-sdk-go-v2/config v1.27.18 // indirect
@@ -36,21 +43,27 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sts v1.28.12 // indirect
 	github.com/aws/smithy-go v1.20.2 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/coder/websocket v1.8.14 // indirect
+	github.com/danieljoos/wincred v1.2.3 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/go-openapi/jsonpointer v0.22.5 // indirect
 	github.com/go-openapi/swag/jsonname v0.25.5 // indirect
 	github.com/go-resty/resty/v2 v2.13.1 // indirect
+	github.com/godbus/dbus/v5 v5.2.2 // indirect
 	github.com/gofrs/flock v0.8.1 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect
 	github.com/googleapis/gax-go/v2 v2.17.0 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
-	github.com/infisical/go-sdk v0.8.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/jchv/go-winloader v0.0.0-20250406163304-c1995be93bd1 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/oasdiff/yaml v0.1.0 // indirect
 	github.com/oasdiff/yaml3 v0.0.13 // indirect
 	github.com/oracle/oci-go-sdk/v65 v65.95.2 // indirect
@@ -60,6 +73,10 @@ require (
 	github.com/segmentio/asm v1.1.3 // indirect
 	github.com/segmentio/encoding v0.5.4 // indirect
 	github.com/sony/gobreaker v0.5.0 // indirect
+	github.com/tidwall/gjson v1.14.4 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/tidwall/sjson v1.2.5 // indirect
 	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
@@ -70,7 +87,6 @@ require (
 	go.opentelemetry.io/otel/trace v1.39.0 // indirect
 	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/oauth2 v0.35.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/text v0.38.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	google.golang.org/api v0.267.0 // indirect

go.sum

@@ -7,6 +7,8 @@ cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCB
 cloud.google.com/go/iam v1.1.11 h1:0mQ8UKSfdHLut6pH9FM3bI55KWR46ketn0PuXleDyxw=
 cloud.google.com/go/iam v1.1.11/go.mod h1:biXoiLWYIKntto2joP+62sd9uW5EpkZmKIvfNcTWlnQ=
 github.com/RaveNoX/go-jsoncommentstrip v1.0.0/go.mod h1:78ihd09MekBnJnxpICcwzCMzGrKSKYe4AqU6PDYYpjk=
+github.com/adrg/xdg v0.5.3 h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78=
+github.com/adrg/xdg v0.5.3/go.mod h1:nlTsY+NNiCBGCK2tpm09vRqfVzrc2fLmXGpBLF0zlTQ=
 github.com/apapsch/go-jsonmerge/v2 v2.0.0 h1:axGnT1gRIfimI7gJifB699GoE/oq+F2MU7Dml6nw9rQ=
 github.com/apapsch/go-jsonmerge/v2 v2.0.0/go.mod h1:lvDnEdqiQrp0O42VQGgmlKpxL1AP2+08jFMw88y4klk=
 github.com/aws/aws-sdk-go-v2 v1.27.2 h1:pLsTXqX93rimAOZG2FIYraDQstZaaGVVN4tNw65v0h8=
@@ -38,23 +40,40 @@ github.com/aws/smithy-go v1.20.2/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC
 github.com/bmatcuk/doublestar v1.1.1/go.mod h1:UD6OnuiIn0yFxxA2le/rnRU1G4RaI4UvFv1sNto9p6w=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w=
+github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
+github.com/coder/websocket v1.8.14 h1:9L0p0iKiNOibykf283eHkKUHHrpG7f65OE3BhhO7v9g=
+github.com/coder/websocket v1.8.14/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
 github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/danieljoos/wincred v1.2.3 h1:v7dZC2x32Ut3nEfRH+vhoZGvN72+dQ/snVXo/vMFLdQ=
+github.com/danieljoos/wincred v1.2.3/go.mod h1:6qqX0WNrS4RzPZ1tnroDzq9kY3fu1KwE7MRLQK4X0bs=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
-github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
+github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
+github.com/envoyproxy/go-control-plane/envoy v1.36.0 h1:yg/JjO5E7ubRyKX3m07GF3reDNEnfOboJ0QySbH736g=
+github.com/envoyproxy/go-control-plane/envoy v1.36.0/go.mod h1:ty89S1YCCVruQAm9OtKeEkQLTb+Lkz0k8v9W0Oxsv98=
+github.com/envoyproxy/protoc-gen-validate v1.3.0 h1:TvGH1wof4H33rezVKWSpqKz5NXWg5VPuZ0uONDT6eb4=
+github.com/envoyproxy/protoc-gen-validate v1.3.0/go.mod h1:HvYl7zwPa5mffgyeTUHA9zHIH36nmrm7oCbo4YKoSWA=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/getkin/kin-openapi v0.140.0 h1:JFn675aXRFjyiZKa/BFWploGldQlI0gobp4J5k0EZ2g=
 github.com/getkin/kin-openapi v0.140.0/go.mod h1:lISrB64F0CPcuDJ3LdtPTMJBY8VENjR9wJBdrcT6J3g=
 github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8=
 github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
+github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=
+github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
+github.com/go-json-experiment/json v0.0.0-20251027170946-4849db3c2f7e h1:Lf/gRkoycfOBPa42vU2bbgPurFong6zXeFtPoxholzU=
+github.com/go-json-experiment/json v0.0.0-20251027170946-4849db3c2f7e/go.mod h1:uNVvRXArCGbZ508SxYYTC5v1JWoz2voff5pm25jU1Ok=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
+github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
 github.com/go-openapi/jsonpointer v0.22.5 h1:8on/0Yp4uTb9f4XvTrM2+1CPrV05QPZXu+rvu2o9jcA=
 github.com/go-openapi/jsonpointer v0.22.5/go.mod h1:gyUR3sCvGSWchA2sUBJGluYMbe1zazrYWIkWPjjMUY0=
 github.com/go-openapi/swag/jsonname v0.25.5 h1:8p150i44rv/Drip4vWI3kGi9+4W9TdI3US3uUYSFhSo=
@@ -64,10 +83,14 @@ github.com/go-openapi/testify/v2 v2.4.0/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16p
 github.com/go-resty/resty/v2 v2.13.1 h1:x+LHXBI2nMB1vqndymf26quycC4aggYJ7DECYbiz03g=
 github.com/go-resty/resty/v2 v2.13.1/go.mod h1:GznXlLxkq6Nh4sU59rPmUw3VtgpO3aS96ORAI6Q7d+0=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
+github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
 github.com/gofrs/flock v0.8.1 h1:+gYjHKf32LDeiEEFhQaotPbLuUXjY5ZqxKgXy7n59aw=
 github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
 github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/jsonschema-go v0.4.3 h1:/DBOLZTfDow7pe2GmaJNhltueGTtDKICi8V8p+DQPd0=
@@ -92,11 +115,19 @@ github.com/jackc/pgx/v5 v5.10.0 h1:VhSvgU2jSli8o3AqIEOTJr7rZwAEUVo4E4XhR94Zfr0=
 github.com/jackc/pgx/v5 v5.10.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jchv/go-winloader v0.0.0-20250406163304-c1995be93bd1 h1:njuLRcjAuMKr7kI3D85AXWkw6/+v9PwtV6M6o11sWHQ=
+github.com/jchv/go-winloader v0.0.0-20250406163304-c1995be93bd1/go.mod h1:alcuEEnZsY1WQsagKhZDsoPCRoOijYqhZvPwLG0kzVs=
 github.com/juju/gnuflag v0.0.0-20171113085948-2ce1bb71843d/go.mod h1:2PavIy+JPciBPrBUjwbNvtwB6RQlve+hkpll6QSNmOE=
-github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/matryer/is v1.4.1 h1:55ehd8zaGABKLXQUe2awZ99BD/PTc2ls+KV/dXphgEQ=
+github.com/matryer/is v1.4.1/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/modelcontextprotocol/go-sdk v1.6.1 h1:0zOSupjKUxPKSocPT1Wtago+mUHU2/uZ4xSOY0FGReU=
 github.com/modelcontextprotocol/go-sdk v1.6.1/go.mod h1:kzm3kzFL1/+AziGOE0nUs3gvPoNxMCvkxokMkuFapXQ=
 github.com/oapi-codegen/nullable v1.1.0 h1:eAh8JVc5430VtYVnq00Hrbpag9PFRGWLjxR1/3KntMs=
@@ -107,9 +138,13 @@ github.com/oasdiff/yaml v0.1.0 h1:0bqZjfKc/8S9urj4JuwepX41WX9EoA6ifhU3SV06cXg=
 github.com/oasdiff/yaml v0.1.0/go.mod h1:kOlRmMdL2X3vucLCEQO5u61SU22RysnfXvcttrZA1O0=
 github.com/oasdiff/yaml3 v0.0.13 h1:06svmvOHOVBqF81+sY2EUScvUI/iS/vl2VIeUUxZQwg=
 github.com/oasdiff/yaml3 v0.0.13/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
+github.com/openai/openai-go v1.12.0 h1:NBQCnXzqOTv5wsgNC36PrFEiskGfO5wccfCWDo9S1U0=
+github.com/openai/openai-go v1.12.0/go.mod h1:g461MYGXEXBVdV5SaR/5tNzNbSfwTBBefwc+LlDCK0Y=
 github.com/oracle/oci-go-sdk/v65 v65.95.2 h1:0HJ0AgpLydp/DtvYrF2d4str2BjXOVAeNbuW7E07g94=
 github.com/oracle/oci-go-sdk/v65 v65.95.2/go.mod h1:u6XRPsw9tPziBh76K7GrrRXPa8P8W3BQeqJ6ZZt9VLA=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
@@ -129,6 +164,8 @@ github.com/spkg/bom v0.0.0-20160624110644-59b7046e48ad/go.mod h1:qLr4V1qq6nMqFKk
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -136,12 +173,26 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.14.4 h1:uo0p8EbA09J7RQaflQ1aBRffTR7xedD2bcIVSYxLnkM=
+github.com/tidwall/gjson v1.14.4/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
+github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.117 h1:udyjqPG3AIgkod5QDR/WblCkpV8R86BFPSrsWxSyt5Y=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.117/go.mod h1:74WH2FScMsgucZvHHvv7eOefDXCm/CjuIxqhhZgPhKg=
 github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
 github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
 github.com/yuin/goldmark v1.4.0/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPccHs=
+github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
@@ -152,6 +203,10 @@ go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
 go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
 go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
 go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
+go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
+go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
+go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
+go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
 go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
 go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
@@ -187,13 +242,16 @@ golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
 golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200810151505-1b9f1253b3ed/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
@@ -232,8 +290,12 @@ golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
 google.golang.org/api v0.267.0 h1:w+vfWPMPYeRs8qH1aYYsFX68jMls5acWl/jocfLomwE=
 google.golang.org/api v0.267.0/go.mod h1:Jzc0+ZfLnyvXma3UtaTl023TdhZu6OMBP9tJ+0EmFD0=
+google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 h1:VQZ/yAbAtjkHgH80teYd2em3xtIkkHd7ZhqfH2N9CsM=
+google.golang.org/genproto v0.0.0-20260128011058-8636f8732409/go.mod h1:rxKD3IEILWEu3P44seeNOAwZN4SaoKaQ/2eTg4mM6EM=
 google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 h1:merA0rdPeUV3YIIfHHcH4qBkiQAc1nfCKSI7lB4cV2M=
 google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409/go.mod h1:fl8J1IvUjCilwZzQowmw2b7HQB2eAuYBabMXzWurF+I=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 h1:Jr5R2J6F6qWyzINc+4AM8t5pfUz6beZpHp678GNrMbE=

hermes/SOUL.md

@@ -1,50 +0,0 @@
-# SOUL.md — Hermes agent persona (Phase 4, container runtime)
-
-You are **Hermes**, the homelab AI agent running in a Docker container on
-mac-mini. You operate in **gateway mode** on mesh-only port 8092.
-
-## Source of truth
-
-The Oikos DB is the authoritative source for topology, service state, policy,
-and agent activity. The homelab-context repo at `/opt/homelab-context/` backs
-the human-facing wiki. When they disagree, the DB wins.
-
-## Interaction model
-
-| Tool | Route |
-|---|---|
-| Read state | MCP tools (query DB directly) |
-| Request action | `request_execution` MCP tool (routes through policy gating) |
-| Escalate | Matrix notification to operator |
-| Self-inspect | `get_agent_activity` MCP tool |
-
-You have **no SSH access**. All mutations flow through `/executions`, which
-the actuator (a separate container with restricted SSH key) picks up.
-
-## Key MCP tools
-
-- `get_entity`, `list_entities` — resolve slugs to state
-- `get_blast_radius` — understand impact before requesting action
-- `get_health_summary` — fleet status at a glance
-- `get_signal_history` — open alerts
-- `get_trend` — metric trends for decisions
-- `request_execution` — the ONLY mutation path
-- `get_agent_activity` — your own behavior log
-
-## Policy awareness
-
-Before calling `request_execution`:
-- Check risk class via `get_entity` on the target
-- If `destructive` or `config_mutation`: escalate to operator
-- If `reversible_low` with validated pattern: auto-act allowed
-
-## Token efficiency
-
-Use MCP tools over raw queries. MCP responses are already compressed. When
-describing state, be concise — the operator reads your output in Matrix.
-
-## Skills
-
-Skills live in `/app/hermes/skills/`. Load a skill when its description
-matches the task. The `homelab-ops` skill covers:
-- Health checks, signal triage, pattern validation, and escalation flow.

hermes/config.yaml

@@ -1,33 +0,0 @@
-# Hermes agent config — standalone MCP client gateway (Phase 4)
-
-mcp:
-  endpoint: ${HERMES_MCP_URL}?session_id=${HERMES_SESSION_ID}
-  transport: streamable_http
-
-server:
-  listen: ${HERMES_LISTEN}
-  mesh_only: true
-
-agent:
-  name: hermes
-  slug: ${HERMES_AGENT_SLUG}
-
-query_routing:
-  # Maps natural-language query patterns to MCP tools
-  - pattern: "depends on"
-    tool: get_blast_radius
-    entity_param: entity_id
-  - pattern: "restart"
-    tool: request_execution
-    action: restart
-  - pattern: "health"
-    tool: get_health_summary
-  - pattern: "what is"
-    tool: get_entity
-    entity_param: slug_or_id
-  - pattern: "recent events"
-    tool: get_event_timeline
-  - pattern: "signals"
-    tool: get_signal_history
-  - pattern: "patterns"
-    tool: get_patterns

internal/checkdefaults/defaults.go

@@ -0,0 +1,204 @@
+package checkdefaults
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+)
+
+type CheckDef struct {
+	Kind       string
+	Script     string
+	Host       string
+	User       string
+	Port       int
+	Thresholds map[string]any
+	Extra      map[string]any
+}
+
+func ResolveHost(attrs map[string]any) string {
+	if ip, ok := attrs["lan_ip"].(string); ok && ip != "" {
+		return ip
+	}
+	if mesh, ok := attrs["mesh"].(map[string]any); ok {
+		if nb, ok := mesh["netbird"].(map[string]any); ok {
+			if ip, ok := nb["ip"].(string); ok && ip != "" {
+				return ip
+			}
+		}
+	}
+	if ip, ok := attrs["mesh_ip"].(string); ok && ip != "" {
+		return ip
+	}
+	return ""
+}
+
+func resolveSSHUser(attrs map[string]any) string {
+	if ssh, ok := attrs["ssh"].(map[string]any); ok {
+		if u, ok := ssh["user"].(string); ok && u != "" {
+			return u
+		}
+	}
+	return "root"
+}
+
+func resolveSSHPort(attrs map[string]any) int {
+	if ssh, ok := attrs["ssh"].(map[string]any); ok {
+		switch p := ssh["port"].(type) {
+		case float64:
+			return int(p)
+		case int:
+			return p
+		}
+	}
+	return 22
+}
+
+func ForEntityType(entityType string, attrs map[string]any) []CheckDef {
+	host := ResolveHost(attrs)
+	user := resolveSSHUser(attrs)
+	port := resolveSSHPort(attrs)
+
+	ssh := func(script string) CheckDef {
+		return CheckDef{Kind: "ssh-script", Script: script, Host: host, User: user, Port: port}
+	}
+
+	switch entityType {
+	case "proxmox-host", "standalone-server":
+		if host == "" {
+			return nil
+		}
+		return []CheckDef{
+			{Kind: "ping", Host: host},
+			ssh("cpu_check.sh"),
+			ssh("memory_check.sh"),
+			ssh("load_check.sh"),
+			ssh("disk_usage_check.sh"),
+			ssh("updates_check.sh"),
+		}
+	case "workstation":
+		if host == "" {
+			return nil
+		}
+		return []CheckDef{
+			{Kind: "ping", Host: host},
+			ssh("cpu_check.sh"),
+			ssh("memory_check.sh"),
+			ssh("load_check.sh"),
+		}
+	case "lxc":
+		if host == "" {
+			return nil
+		}
+		return []CheckDef{
+			ssh("cpu_check.sh"),
+			ssh("memory_check.sh"),
+			ssh("load_check.sh"),
+			ssh("disk_usage_check.sh"),
+		}
+	case "vm":
+		if host == "" {
+			return nil
+		}
+		return []CheckDef{
+			{Kind: "ping", Host: host},
+		}
+	case "service":
+		if host == "" {
+			return nil
+		}
+		n, _ := attrs["name"].(string)
+		if n == "" {
+			return nil
+		}
+		return []CheckDef{
+			{Kind: "ssh-script", Script: "process_check.sh", Host: host, User: user, Port: port,
+				Extra: map[string]any{"args": n}},
+		}
+	}
+	return nil
+}
+
+func ShortSlug(slug string) string {
+	const n = 8
+	if len(slug) > n {
+		return slug[len(slug)-n:]
+	}
+	return slug
+}
+
+func DefaultInterval(kind string) int32 {
+	switch kind {
+	case "ping":
+		return 30
+	case "ssh-script":
+		return 60
+	default:
+		return 300
+	}
+}
+
+func Ensure(ctx context.Context, tx pgx.Tx, entityID uuid.UUID, slug, entityType string, attrsJSON []byte) {
+	_, _ = tx.Exec(ctx,
+		`INSERT INTO entity_status (entity_id, health, updated_at)
+		 VALUES ($1, 'unknown', now())
+		 ON CONFLICT (entity_id) DO NOTHING`,
+		entityID)
+
+	var attrs map[string]any
+	if len(attrsJSON) > 0 {
+		json.Unmarshal(attrsJSON, &attrs)
+	}
+	if attrs == nil {
+		attrs = map[string]any{}
+	}
+
+	defs := ForEntityType(entityType, attrs)
+	if len(defs) == 0 {
+		return
+	}
+
+	for i, def := range defs {
+		checkID, err := uuid.NewV7()
+		if err != nil {
+			checkID = uuid.New()
+		}
+		checkSlug := fmt.Sprintf("check:%s:%s:%d", def.Kind, ShortSlug(slug), i)
+
+		_, _ = tx.Exec(ctx,
+			`INSERT INTO entities (id, slug, type, name, state, attributes, version, created_at, updated_at)
+			 VALUES ($1, $2, 'check', $2, 'active', '{}', 1, now(), now())
+			 ON CONFLICT (slug) DO NOTHING`,
+			checkID, checkSlug)
+
+		configMap := map[string]any{}
+		if def.Script != "" {
+			configMap["script"] = def.Script
+		}
+		if def.Host != "" {
+			configMap["host"] = def.Host
+		}
+		if def.User != "" && def.User != "root" {
+			configMap["user"] = def.User
+		}
+		if def.Port != 0 && def.Port != 22 {
+			configMap["port"] = def.Port
+		}
+		if def.Thresholds != nil {
+			configMap["thresholds"] = def.Thresholds
+		}
+		for k, v := range def.Extra {
+			configMap[k] = v
+		}
+		configJSON, _ := json.Marshal(configMap)
+
+		_, _ = tx.Exec(ctx,
+			`INSERT INTO check_defs (entity_id, target_id, kind, config, interval_s, timeout_s, enabled)
+			 VALUES ($1, $2, $3, $4, $5, 30, true)
+			 ON CONFLICT (entity_id) DO NOTHING`,
+			checkID, entityID, def.Kind, configJSON, DefaultInterval(def.Kind))
+	}
+}

internal/config/config.go

@@ -19,10 +19,16 @@ type Config struct {
 	APIEnv    string // dev, prod
 
 	// Auth (Phase 2: static bearer tokens + OIDC JWT)
-	APIToken       string // operator/CI bearer token for the REST API
-	MCPBearerToken string // shared secret for Hermes→API MCP calls
-	OIDCIssuer     string // OIDC issuer URL for JWT validation (e.g. https://authentik.example.com/application/o/oikos/)
-	OIDCClientID   string // OIDC client ID (aud claim expected in JWT)
+	APIToken         string // operator/CI bearer token for the REST API
+	MCPBearerToken   string // shared secret for Nomos→API MCP calls
+	OIDCIssuer       string // OIDC issuer URL for JWT validation (e.g. https://authentik.example.com/application/o/oikos/)
+	OIDCClientID     string // OIDC client ID (aud claim expected in JWT)
+	OIDCClientSecret string // optional client secret for token endpoint proxy (confidential clients)
+
+	// CORS (client/server split — see plans/2026-07-12-wails-desktop-app.md
+	// 0.3). Needed for the Wails webview and local dev (Vite on a different
+	// port than the API); a no-op when the SPA and API share an origin.
+	CORSAllowedOrigin string
 
 	// Observability
 	Debug bool // verbose logging, probe payloads, SQL
@@ -54,9 +60,9 @@ type Config struct {
 	// Approval HMAC secret (Phase 3)
 	ApprovalHMACSecret string
 
-	// Hermes agent entity ID (Phase 4)
-	HermesAgentID   string
-	HermesAgentSlug string
+	// Nomos agent entity ID (Phase 4)
+	NomosAgentID   string
+	NomosAgentSlug string
 
 	// Infisical (Phase 5)
 	InfisicalSiteURL      string
@@ -73,6 +79,7 @@ func Default() Config {
 		DatabaseURL:       "postgres://oikos:***@localhost:5432/oikos?sslmode=disable",
 		APIListen:         ":8090",
 		APIEnv:            "dev",
+		CORSAllowedOrigin: "*",
 		SeedsDir:          "seeds",
 		MigrationsDir:     "migrations",
 		SchedulerInterval: 30 * time.Second,
@@ -102,12 +109,18 @@ func FromEnv() Config {
 	if v := os.Getenv("OIKOS_OIDC_CLIENT_ID"); v != "" {
 		c.OIDCClientID = v
 	}
+	if v := os.Getenv("OIKOS_OIDC_CLIENT_SECRET"); v != "" {
+		c.OIDCClientSecret = v
+	}
 	if v := os.Getenv("OIKOS_API_TOKEN"); v != "" {
 		c.APIToken = v
 	}
 	if v := os.Getenv("OIKOS_MCP_BEARER_TOKEN"); v != "" {
 		c.MCPBearerToken = v
 	}
+	if v := os.Getenv("OIKOS_CORS_ORIGIN"); v != "" {
+		c.CORSAllowedOrigin = v
+	}
 	if v := os.Getenv("OIKOS_SEEDS_DIR"); v != "" {
 		c.SeedsDir = v
 	}
@@ -151,11 +164,11 @@ func FromEnv() Config {
 	if v := os.Getenv("OIKOS_APPROVAL_HMAC_SECRET"); v != "" {
 		c.ApprovalHMACSecret = v
 	}
-	if v := os.Getenv("OIKOS_HERMES_AGENT_ID"); v != "" {
-		c.HermesAgentID = v
+	if v := os.Getenv("OIKOS_NOMOS_AGENT_ID"); v != "" {
+		c.NomosAgentID = v
 	}
-	if v := os.Getenv("OIKOS_HERMES_AGENT_SLUG"); v != "" {
-		c.HermesAgentSlug = v
+	if v := os.Getenv("OIKOS_NOMOS_AGENT_SLUG"); v != "" {
+		c.NomosAgentSlug = v
 	}
 
 	// Phase 5: Infisical secrets

internal/db/queries/operations.sql

@@ -240,8 +240,8 @@ SELECT * FROM risk_classes ORDER BY name;
 SELECT * FROM approval_rules ORDER BY entity_type, action;
 
 -- name: InsertMetricSample :exec
-INSERT INTO metric_samples (entity_id, metric, value, tags)
-VALUES ($1, $2, $3, $4);
+INSERT INTO metric_samples (entity_id, metric, value, tags, ts)
+VALUES ($1, $2, $3, $4, now());
 
 -- name: QueryMetrics :many
 SELECT time_bucket(sqlc.arg('bucket_interval')::interval, ts) AS bucket,

internal/db/seed.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 
+	"github.com/dtoro/oikos/internal/checkdefaults"
 	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5"
 )
@@ -143,6 +144,8 @@ func IngestInventorySeed(ctx context.Context, tx pgx.Tx, data map[string]any) (*
 			return nil, fmt.Errorf("entity_status %s: %w", slug, err)
 		}
 
+		checkdefaults.Ensure(ctx, tx, entityID, slug, typeName, attrsBytes)
+
 		r.Entities++
 	}
 

internal/db/sqlcgen/models.go

@@ -26,6 +26,22 @@ type AgentActivity struct {
 	CorrelationID *string
 }
 
+type AgentMessage struct {
+	ID        uuid.UUID
+	SessionID uuid.UUID
+	Role      string
+	Content   []byte
+	CreatedAt time.Time
+}
+
+type AgentSession struct {
+	ID           uuid.UUID
+	Title        string
+	Actor        string
+	CreatedAt    time.Time
+	LastActiveAt time.Time
+}
+
 type Approval struct {
 	EntityID        uuid.UUID
 	SubjectEntityID *uuid.UUID

internal/db/sqlcgen/operations.sql.go

@@ -560,8 +560,8 @@ func (q *Queries) InsertFeedback(ctx context.Context, arg InsertFeedbackParams)
 }
 
 const insertMetricSample = `-- name: InsertMetricSample :exec
-INSERT INTO metric_samples (entity_id, metric, value, tags)
-VALUES ($1, $2, $3, $4)
+INSERT INTO metric_samples (entity_id, metric, value, tags, ts)
+VALUES ($1, $2, $3, $4, now())
 `
 
 type InsertMetricSampleParams struct {

internal/httpapi/activity.go

@@ -0,0 +1,215 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+)
+
+// activityItem is one row in the global activity feed — a human-readable
+// projection of an execution, independent of the paginated/alphabetically-
+// sorted ListExecutions (which orders by target slug for entity-scoped
+// browsing, not recency — wrong shape for "what just happened").
+type activityItem struct {
+	ID          string  `json:"id"`
+	Target      string  `json:"target"`
+	Verb        string  `json:"verb"`    // e.g. "run", "pct_create", "systemctl"
+	Summary     string  `json:"summary"` // human-readable: the command, or purpose, or action detail
+	RiskClass   string  `json:"risk_class"`
+	Status      string  `json:"status"`
+	DurationMs  *int    `json:"duration_ms"`
+	Error       string  `json:"error,omitempty"`
+	CreatedAt   string  `json:"created_at"`
+	CompletedAt *string `json:"completed_at"`
+}
+
+// splitAction parses the "verb:params" encoding used throughout executions.action
+// (see internal/mcp/server.go) into a verb and a human-readable summary. For
+// `run`, params is JSON {command, purpose} — show the purpose if present
+// (it's written for a human), falling back to the raw command. For other
+// actions (pct_create, systemctl, apt_upgrade, pct_exec), params is either a
+// JSON blob or a short flag string — truncate either as a fallback summary.
+func splitAction(action string) (verb, summary string) {
+	idx := strings.IndexByte(action, ':')
+	if idx < 0 {
+		return action, ""
+	}
+	verb, params := action[:idx], action[idx+1:]
+	if verb == "run" {
+		var p struct {
+			Command string `json:"command"`
+			Purpose string `json:"purpose"`
+		}
+		if json.Unmarshal([]byte(params), &p) == nil {
+			if p.Purpose != "" {
+				return verb, p.Purpose
+			}
+			return verb, p.Command
+		}
+	}
+	if verb == "pct_create" {
+		var p struct {
+			Hostname string `json:"hostname"`
+		}
+		if json.Unmarshal([]byte(params), &p) == nil && p.Hostname != "" {
+			return verb, "provision " + p.Hostname
+		}
+	}
+	if len(params) > 140 {
+		params = params[:140] + "…"
+	}
+	return verb, params
+}
+
+// serveRecentActivity backs the Operations page's live activity feed — the
+// global "what is the system doing / what did it just do" view, recency-
+// ordered (unlike ListExecutions, which sorts by target for pagination).
+// Custom route, same shape/rationale as serveRecentKnowledge.
+func (s *Server) serveRecentActivity(w http.ResponseWriter, req *http.Request) {
+	ctx := req.Context()
+	limit := 50
+	if l := req.URL.Query().Get("limit"); l != "" {
+		if n, err := strconv.Atoi(l); err == nil && n > 0 && n <= 200 {
+			limit = n
+		}
+	}
+
+	rows, err := s.pool.Query(ctx, `
+		SELECT e.entity_id, te.slug, e.action, e.risk_class, e.status,
+		       e.duration_ms, e.result, e.created_at::text, e.completed_at::text
+		FROM executions e
+		JOIN entities te ON te.id = e.target_entity_id
+		ORDER BY e.created_at DESC
+		LIMIT $1`, limit)
+	if err != nil {
+		writeProblem(w, req, http.StatusInternalServerError, "query failed", err.Error())
+		return
+	}
+	defer rows.Close()
+
+	items := []activityItem{}
+	for rows.Next() {
+		var it activityItem
+		var action string
+		var resultBytes []byte
+		var completedAt *string
+		if err := rows.Scan(&it.ID, &it.Target, &action, &it.RiskClass, &it.Status,
+			&it.DurationMs, &resultBytes, &it.CreatedAt, &completedAt); err != nil {
+			slog.Error("httpapi: activity/recent row scan failed", "error", err)
+			continue
+		}
+		it.Verb, it.Summary = splitAction(action)
+		it.CompletedAt = completedAt
+		if len(resultBytes) > 0 {
+			var result map[string]any
+			if json.Unmarshal(resultBytes, &result) == nil {
+				if e, ok := result["error"].(string); ok && e != "" {
+					if len(e) > 200 {
+						e = e[:200] + "…"
+					}
+					it.Error = e
+				}
+			}
+		}
+		items = append(items, it)
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]any{"items": items})
+}
+
+// sessionDigestItem summarizes one execution for the session digest.
+type sessionDigestItem struct {
+	Target    string `json:"target"`
+	Verb      string `json:"verb"`
+	Summary   string `json:"summary"`
+	RiskClass string `json:"risk_class"`
+	Status    string `json:"status"`
+}
+
+// serveSessionDigest answers "what did THIS chat session actually do" —
+// commands run (grouped by outcome), distinct entities touched, and knowledge
+// written during the session's time window. Uses nomos_plan_executions (the
+// session<->execution link added for auto-continuation) as the source of
+// truth for which executions belong to this session; knowledge correlation is
+// a best-effort time-window match since knowledge_entities has no session_id.
+func (s *Server) serveSessionDigest(w http.ResponseWriter, req *http.Request) {
+	ctx := req.Context()
+	sessionID := chi.URLParam(req, "id")
+	if sessionID == "" {
+		writeProblem(w, req, http.StatusBadRequest, "missing session id", "")
+		return
+	}
+
+	rows, err := s.pool.Query(ctx, `
+		SELECT te.slug, e.action, e.risk_class, e.status
+		FROM nomos_plan_executions l
+		JOIN executions e ON e.entity_id = l.execution_id
+		JOIN entities te ON te.id = e.target_entity_id
+		WHERE l.session_id = $1
+		ORDER BY e.created_at`, sessionID)
+	if err != nil {
+		writeProblem(w, req, http.StatusInternalServerError, "query failed", err.Error())
+		return
+	}
+	defer rows.Close()
+
+	items := []sessionDigestItem{}
+	byStatus := map[string]int{}
+	targets := map[string]bool{}
+	for rows.Next() {
+		var it sessionDigestItem
+		var action string
+		if err := rows.Scan(&it.Target, &action, &it.RiskClass, &it.Status); err != nil {
+			continue
+		}
+		it.Verb, it.Summary = splitAction(action)
+		items = append(items, it)
+		byStatus[it.Status]++
+		targets[it.Target] = true
+	}
+
+	entityList := make([]string, 0, len(targets))
+	for t := range targets {
+		entityList = append(entityList, t)
+	}
+
+	// Best-effort knowledge correlation: notes the agent wrote during this
+	// session's active window. Not exact (no session_id on knowledge_entities)
+	// but close enough to show "you learned N things in this session".
+	var knowledgeTitles []string
+	krows, err := s.pool.Query(ctx, `
+		SELECT ke.title FROM knowledge_entities ke
+		WHERE ke.source = 'nomos-agent'
+		  AND ke.updated_at BETWEEN
+		    (SELECT COALESCE(MIN(created_at), now()) FROM agent_messages WHERE session_id = $1)
+		    AND
+		    (SELECT COALESCE(MAX(created_at), now()) + interval '2 minutes' FROM agent_messages WHERE session_id = $1)
+		ORDER BY ke.updated_at`, sessionID)
+	if err == nil {
+		defer krows.Close()
+		for krows.Next() {
+			var t string
+			if krows.Scan(&t) == nil {
+				knowledgeTitles = append(knowledgeTitles, t)
+			}
+		}
+	}
+	if knowledgeTitles == nil {
+		knowledgeTitles = []string{}
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]any{
+		"session_id":        sessionID,
+		"total_executions":  len(items),
+		"by_status":         byStatus,
+		"entities_touched":  entityList,
+		"executions":        items,
+		"knowledge_created": knowledgeTitles,
+	})
+}

internal/httpapi/api_test.go

@@ -96,12 +96,31 @@ func newTestHandler(t *testing.T, cfg config.Config) http.Handler {
 	return NewHandler(handlerCtx, pool, cfg)
 }
 
+// testAuthToken is the static bearer token devConfig() configures. There is
+// no dev-open bypass (removed — plans/2026-07-12-wails-desktop-app.md 0.4),
+// so every test handler needs a real credential; get/postJSON/do inject it
+// by default. Pass an explicit "" value for "Authorization" in headers to
+// test the no-credential path.
+const testAuthToken = "test-dev-token"
+
+// applyHeaders sets req's default Authorization header, then layers headers
+// on top. A "" value deletes the header instead of setting it, so tests can
+// exercise the missing-credential case.
+func applyHeaders(req *http.Request, headers map[string]string) {
+	req.Header.Set("Authorization", "Bearer "+testAuthToken)
+	for k, v := range headers {
+		if v == "" {
+			req.Header.Del(k)
+		} else {
+			req.Header.Set(k, v)
+		}
+	}
+}
+
 func get(t *testing.T, h http.Handler, path string, headers map[string]string) (*httptest.ResponseRecorder, map[string]any) {
 	t.Helper()
 	req := httptest.NewRequest("GET", path, nil)
-	for k, v := range headers {
-		req.Header.Set(k, v)
-	}
+	applyHeaders(req, headers)
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 	var body map[string]any
@@ -113,6 +132,7 @@ func postJSON(t *testing.T, h http.Handler, path string, payload string) (*httpt
 	t.Helper()
 	req := httptest.NewRequest("POST", path, strings.NewReader(payload))
 	req.Header.Set("Content-Type", "application/json")
+	applyHeaders(req, nil)
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 	var body map[string]any
@@ -122,7 +142,8 @@ func postJSON(t *testing.T, h http.Handler, path string, payload string) (*httpt
 
 func devConfig() config.Config {
 	c := config.Default()
-	c.APIEnv = "dev" // no tokens → dev-open auth
+	c.APIEnv = "dev"
+	c.APIToken = testAuthToken
 	return c
 }
 
@@ -295,7 +316,7 @@ func TestAPIBearerAuth(t *testing.T) {
 	}
 
 	// API requires the token
-	rec, body := get(t, h, "/api/v1/entities", nil)
+	rec, body := get(t, h, "/api/v1/entities", map[string]string{"Authorization": ""})
 	if rec.Code != 401 {
 		t.Errorf("no token = %d, want 401 (%v)", rec.Code, body)
 	}

internal/httpapi/dashboard.go

@@ -0,0 +1,172 @@
+package httpapi
+
+import (
+	"context"
+	"time"
+
+	"github.com/dtoro/oikos/internal/httpapi/gen"
+)
+
+// GetDashboardSummary returns one round-trip overview for the control room
+// home page: entity counts, health rollup, open signals, pending approvals,
+// executions in the last 24h, and an event-rate sparkline.
+func (s *Server) GetDashboardSummary(ctx context.Context, req gen.GetDashboardSummaryRequestObject) (gen.GetDashboardSummaryResponseObject, error) {
+	resp := gen.DashboardSummary{
+		EntitiesByType:    map[string]int{},
+		EntitiesByState:   map[string]int{},
+		SignalsBySeverity: map[string]int{},
+		ExecutionsByState: map[string]int{},
+	}
+
+	rows, err := s.pool.Query(ctx, `SELECT type, count(*) FROM entities GROUP BY type`)
+	if err != nil {
+		return nil, err
+	}
+	for rows.Next() {
+		var typ string
+		var n int
+		if err := rows.Scan(&typ, &n); err != nil {
+			rows.Close()
+			return nil, err
+		}
+		resp.EntitiesByType[typ] = n
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	rows, err = s.pool.Query(ctx, `SELECT coalesce(state, 'unknown'), count(*) FROM entities GROUP BY state`)
+	if err != nil {
+		return nil, err
+	}
+	for rows.Next() {
+		var state string
+		var n int
+		if err := rows.Scan(&state, &n); err != nil {
+			rows.Close()
+			return nil, err
+		}
+		resp.EntitiesByState[state] = n
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	// Exclude 'check' entities (internal probes) — only entities actually
+	// being monitored should count toward the fleet health rollup.
+	rows, err = s.pool.Query(ctx, `
+		SELECT st.health, count(*)
+		FROM entity_status st JOIN entities e ON e.id = st.entity_id
+		WHERE e.type <> 'check'
+		GROUP BY st.health`)
+	if err != nil {
+		return nil, err
+	}
+	stale := 0
+	for rows.Next() {
+		var health string
+		var n int
+		if err := rows.Scan(&health, &n); err != nil {
+			rows.Close()
+			return nil, err
+		}
+		switch health {
+		case "healthy":
+			resp.Health.Healthy = n
+		case "degraded":
+			resp.Health.Degraded = n
+		case "down":
+			resp.Health.Down = n
+		case "stale":
+			stale = n
+		default:
+			resp.Health.Unknown = n
+		}
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	if stale > 0 {
+		resp.Health.Stale = &stale
+	}
+
+	rows, err = s.pool.Query(ctx, `
+		SELECT severity, count(*) FROM signals
+		WHERE state NOT IN ('resolved', 'failed')
+		GROUP BY severity`)
+	if err != nil {
+		return nil, err
+	}
+	for rows.Next() {
+		var severity string
+		var n int
+		if err := rows.Scan(&severity, &n); err != nil {
+			rows.Close()
+			return nil, err
+		}
+		resp.SignalsBySeverity[severity] = n
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	if err := s.pool.QueryRow(ctx,
+		`SELECT count(*) FROM approvals WHERE status = 'pending'`,
+	).Scan(&resp.ApprovalsPending); err != nil {
+		return nil, err
+	}
+
+	rows, err = s.pool.Query(ctx, `
+		SELECT status, count(*) FROM executions
+		WHERE created_at > now() - interval '24 hours'
+		GROUP BY status`)
+	if err != nil {
+		return nil, err
+	}
+	for rows.Next() {
+		var status string
+		var n int
+		if err := rows.Scan(&status, &n); err != nil {
+			rows.Close()
+			return nil, err
+		}
+		resp.ExecutionsByState[status] = n
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	rows, err = s.pool.Query(ctx, `
+		SELECT date_trunc('hour', ts) + (extract(minute FROM ts)::int / 5) * interval '5 minutes' AS bucket,
+		       count(*)
+		FROM events
+		WHERE ts > now() - interval '6 hours'
+		GROUP BY bucket
+		ORDER BY bucket`)
+	if err != nil {
+		return nil, err
+	}
+	for rows.Next() {
+		var bucket time.Time
+		var n int
+		if err := rows.Scan(&bucket, &n); err != nil {
+			rows.Close()
+			return nil, err
+		}
+		resp.EventRate = append(resp.EventRate, struct {
+			Bucket time.Time `json:"bucket"`
+			Count  int       `json:"count"`
+		}{Bucket: bucket, Count: n})
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	return gen.GetDashboardSummary200JSONResponse(resp), nil
+}

internal/httpapi/default_checks.go

@@ -0,0 +1,13 @@
+package httpapi
+
+import (
+	"context"
+
+	"github.com/dtoro/oikos/internal/checkdefaults"
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+)
+
+func ensureDefaultChecks(ctx context.Context, tx pgx.Tx, entityID uuid.UUID, slug, entityType string, attrsJSON []byte) {
+	checkdefaults.Ensure(ctx, tx, entityID, slug, entityType, attrsJSON)
+}

internal/httpapi/gen/api.gen.go

@@ -81,6 +81,7 @@ const (
 	CheckKindDisk       CheckKind = "disk"
 	CheckKindDrift      CheckKind = "drift"
 	CheckKindHttp       CheckKind = "http"
+	CheckKindPing       CheckKind = "ping"
 	CheckKindSshScript  CheckKind = "ssh-script"
 	CheckKindTcp        CheckKind = "tcp"
 )
@@ -91,6 +92,7 @@ const (
 	CheckCreateKindDisk       CheckCreateKind = "disk"
 	CheckCreateKindDrift      CheckCreateKind = "drift"
 	CheckCreateKindHttp       CheckCreateKind = "http"
+	CheckCreateKindPing       CheckCreateKind = "ping"
 	CheckCreateKindSshScript  CheckCreateKind = "ssh-script"
 	CheckCreateKindTcp        CheckCreateKind = "tcp"
 )
@@ -102,6 +104,15 @@ const (
 	ClassificationRouteHold     ClassificationRoute = "hold"
 )
 
+// Defines values for EntityHealth.
+const (
+	EntityHealthDegraded EntityHealth = "degraded"
+	EntityHealthDown     EntityHealth = "down"
+	EntityHealthHealthy  EntityHealth = "healthy"
+	EntityHealthStale    EntityHealth = "stale"
+	EntityHealthUnknown  EntityHealth = "unknown"
+)
+
 // Defines values for EntityTypeLayer.
 const (
 	EntityTypeLayerCognition      EntityTypeLayer = "cognition"
@@ -153,11 +164,21 @@ const (
 	ExecutionStatusVerifying      ExecutionStatus = "verifying"
 )
 
+// Defines values for GraphViewHealth.
+const (
+	GraphViewHealthDegraded GraphViewHealth = "degraded"
+	GraphViewHealthDown     GraphViewHealth = "down"
+	GraphViewHealthHealthy  GraphViewHealth = "healthy"
+	GraphViewHealthStale    GraphViewHealth = "stale"
+	GraphViewHealthUnknown  GraphViewHealth = "unknown"
+)
+
 // Defines values for HealthSummaryEntitiesHealth.
 const (
 	HealthSummaryEntitiesHealthDegraded HealthSummaryEntitiesHealth = "degraded"
 	HealthSummaryEntitiesHealthDown     HealthSummaryEntitiesHealth = "down"
 	HealthSummaryEntitiesHealthHealthy  HealthSummaryEntitiesHealth = "healthy"
+	HealthSummaryEntitiesHealthStale    HealthSummaryEntitiesHealth = "stale"
 	HealthSummaryEntitiesHealthUnknown  HealthSummaryEntitiesHealth = "unknown"
 )
 
@@ -295,6 +316,11 @@ const (
 	Out  GetEntityRelationsParamsDirection = "out"
 )
 
+// Defines values for GetGraphParamsInclude.
+const (
+	Status GetGraphParamsInclude = "status"
+)
+
 // Defines values for QueryMetricsParamsRollup.
 const (
 	QueryMetricsParamsRollupAuto QueryMetricsParamsRollup = "auto"
@@ -520,6 +546,38 @@ type ClientSecrets struct {
 	Keys []string `json:"keys"`
 }
 
+// DashboardSummary defines model for DashboardSummary.
+type DashboardSummary struct {
+	ApprovalsPending int `json:"approvals_pending"`
+
+	// EntitiesByState entity counts keyed by state
+	EntitiesByState map[string]int `json:"entities_by_state"`
+
+	// EntitiesByType entity counts keyed by type
+	EntitiesByType map[string]int `json:"entities_by_type"`
+
+	// EventRate event counts bucketed by 5-minute interval, most recent last
+	EventRate []struct {
+		Bucket time.Time `json:"bucket"`
+		Count  int       `json:"count"`
+	} `json:"event_rate"`
+
+	// ExecutionsByState execution counts keyed by state, last 24h
+	ExecutionsByState map[string]int `json:"executions_by_state"`
+	Health            struct {
+		Degraded int `json:"degraded"`
+		Down     int `json:"down"`
+		Healthy  int `json:"healthy"`
+
+		// Stale last observation older than the check's expected cadence
+		Stale   *int `json:"stale,omitempty"`
+		Unknown int  `json:"unknown"`
+	} `json:"health"`
+
+	// SignalsBySeverity open (non-resolved) signal counts keyed by severity
+	SignalsBySeverity map[string]int `json:"signals_by_severity"`
+}
+
 // EnrollRequest defines model for EnrollRequest.
 type EnrollRequest struct {
 	// Hostname Actual hostname of the enrolling machine
@@ -552,18 +610,27 @@ type EnrollResponse struct {
 
 // Entity defines model for Entity.
 type Entity struct {
-	Attributes       *map[string]interface{} `json:"attributes,omitempty"`
-	CreatedAt        time.Time               `json:"created_at"`
-	Id               openapi_types.UUID      `json:"id"`
-	MaintenanceUntil *time.Time              `json:"maintenance_until"`
-	Name             string                  `json:"name"`
-	Slug             string                  `json:"slug"`
-	State            *string                 `json:"state"`
-	Type             string                  `json:"type"`
-	UpdatedAt        time.Time               `json:"updated_at"`
-	Version          int                     `json:"version"`
+	Attributes *map[string]interface{} `json:"attributes,omitempty"`
+	CreatedAt  time.Time               `json:"created_at"`
+
+	// Health last observed health, when the entity is monitored
+	Health *EntityHealth      `json:"health"`
+	Id     openapi_types.UUID `json:"id"`
+
+	// LastCheckAt when health was last observed
+	LastCheckAt      *time.Time `json:"last_check_at"`
+	MaintenanceUntil *time.Time `json:"maintenance_until"`
+	Name             string     `json:"name"`
+	Slug             string     `json:"slug"`
+	State            *string    `json:"state"`
+	Type             string     `json:"type"`
+	UpdatedAt        time.Time  `json:"updated_at"`
+	Version          int        `json:"version"`
 }
 
+// EntityHealth last observed health, when the entity is monitored
+type EntityHealth string
+
 // EntityCreate defines model for EntityCreate.
 type EntityCreate struct {
 	// Attributes Validated against the type's attribute_schema
@@ -696,12 +763,18 @@ type ExecutionRequest struct {
 // GraphView defines model for GraphView.
 type GraphView struct {
 	Edges []Relationship `json:"edges"`
-	Nodes []Entity       `json:"nodes"`
+
+	// Health entity id -> health, present when include=status was requested
+	Health *map[string]GraphViewHealth `json:"health,omitempty"`
+	Nodes  []Entity                    `json:"nodes"`
 
 	// Truncated True if node cap was hit
 	Truncated *bool `json:"truncated,omitempty"`
 }
 
+// GraphViewHealth defines model for GraphView.Health.
+type GraphViewHealth string
+
 // HealthSummary defines model for HealthSummary.
 type HealthSummary struct {
 	Entities []struct {
@@ -715,7 +788,10 @@ type HealthSummary struct {
 		Degraded int `json:"degraded"`
 		Down     int `json:"down"`
 		Healthy  int `json:"healthy"`
-		Unknown  int `json:"unknown"`
+
+		// Stale last observation older than the check's expected cadence
+		Stale   *int `json:"stale,omitempty"`
+		Unknown int  `json:"unknown"`
 	} `json:"summary"`
 }
 
@@ -1234,8 +1310,14 @@ type GetGraphParams struct {
 	Root    *string   `form:"root,omitempty" json:"root,omitempty"`
 	Depth   *int      `form:"depth,omitempty" json:"depth,omitempty"`
 	RelType *[]string `form:"rel_type,omitempty" json:"rel_type,omitempty"`
+
+	// Include include=status joins entity_status and populates GraphView.health
+	Include *[]GetGraphParamsInclude `form:"include,omitempty" json:"include,omitempty"`
 }
 
+// GetGraphParamsInclude defines parameters for GetGraph.
+type GetGraphParamsInclude string
+
 // SearchKnowledgeParams defines parameters for SearchKnowledge.
 type SearchKnowledgeParams struct {
 	Q     string `form:"q" json:"q"`
@@ -1469,6 +1551,9 @@ type ServerInterface interface {
 	// List secrets accessible to this client
 	// (GET /clients/{slug}/secrets)
 	GetClientSecrets(w http.ResponseWriter, r *http.Request, slug EntitySlug)
+	// One-round-trip overview for the control room home page
+	// (GET /dashboard/summary)
+	GetDashboardSummary(w http.ResponseWriter, r *http.Request)
 	// List entities
 	// (GET /entities)
 	ListEntities(w http.ResponseWriter, r *http.Request, params ListEntitiesParams)
@@ -1664,6 +1749,12 @@ func (_ Unimplemented) GetClientSecrets(w http.ResponseWriter, r *http.Request,
 	w.WriteHeader(http.StatusNotImplemented)
 }
 
+// One-round-trip overview for the control room home page
+// (GET /dashboard/summary)
+func (_ Unimplemented) GetDashboardSummary(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(http.StatusNotImplemented)
+}
+
 // List entities
 // (GET /entities)
 func (_ Unimplemented) ListEntities(w http.ResponseWriter, r *http.Request, params ListEntitiesParams) {
@@ -2537,6 +2628,26 @@ func (siw *ServerInterfaceWrapper) GetClientSecrets(w http.ResponseWriter, r *ht
 	handler.ServeHTTP(w, r)
 }
 
+// GetDashboardSummary operation middleware
+func (siw *ServerInterfaceWrapper) GetDashboardSummary(w http.ResponseWriter, r *http.Request) {
+
+	ctx := r.Context()
+
+	ctx = context.WithValue(ctx, BearerAuthScopes, []string{})
+
+	r = r.WithContext(ctx)
+
+	handler := http.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		siw.Handler.GetDashboardSummary(w, r)
+	}))
+
+	for _, middleware := range siw.HandlerMiddlewares {
+		handler = middleware(handler)
+	}
+
+	handler.ServeHTTP(w, r)
+}
+
 // ListEntities operation middleware
 func (siw *ServerInterfaceWrapper) ListEntities(w http.ResponseWriter, r *http.Request) {
 
@@ -3305,6 +3416,14 @@ func (siw *ServerInterfaceWrapper) GetGraph(w http.ResponseWriter, r *http.Reque
 		return
 	}
 
+	// ------------- Optional query parameter "include" -------------
+
+	err = runtime.BindQueryParameter("form", true, false, "include", r.URL.Query(), &params.Include)
+	if err != nil {
+		siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "include", Err: err})
+		return
+	}
+
 	handler := http.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		siw.Handler.GetGraph(w, r, params)
 	}))
@@ -4547,6 +4666,9 @@ func HandlerWithOptions(si ServerInterface, options ChiServerOptions) http.Handl
 	r.Group(func(r chi.Router) {
 		r.Get(options.BaseURL+"/clients/{slug}/secrets", wrapper.GetClientSecrets)
 	})
+	r.Group(func(r chi.Router) {
+		r.Get(options.BaseURL+"/dashboard/summary", wrapper.GetDashboardSummary)
+	})
 	r.Group(func(r chi.Router) {
 		r.Get(options.BaseURL+"/entities", wrapper.ListEntities)
 	})
@@ -5020,6 +5142,34 @@ func (response GetClientSecretsdefaultApplicationProblemPlusJSONResponse) VisitG
 	return json.NewEncoder(w).Encode(response.Body)
 }
 
+type GetDashboardSummaryRequestObject struct {
+}
+
+type GetDashboardSummaryResponseObject interface {
+	VisitGetDashboardSummaryResponse(w http.ResponseWriter) error
+}
+
+type GetDashboardSummary200JSONResponse DashboardSummary
+
+func (response GetDashboardSummary200JSONResponse) VisitGetDashboardSummaryResponse(w http.ResponseWriter) error {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(200)
+
+	return json.NewEncoder(w).Encode(response)
+}
+
+type GetDashboardSummarydefaultApplicationProblemPlusJSONResponse struct {
+	Body       Problem
+	StatusCode int
+}
+
+func (response GetDashboardSummarydefaultApplicationProblemPlusJSONResponse) VisitGetDashboardSummaryResponse(w http.ResponseWriter) error {
+	w.Header().Set("Content-Type", "application/problem+json")
+	w.WriteHeader(response.StatusCode)
+
+	return json.NewEncoder(w).Encode(response.Body)
+}
+
 type ListEntitiesRequestObject struct {
 	Params ListEntitiesParams
 }
@@ -6401,6 +6551,9 @@ type StrictServerInterface interface {
 	// List secrets accessible to this client
 	// (GET /clients/{slug}/secrets)
 	GetClientSecrets(ctx context.Context, request GetClientSecretsRequestObject) (GetClientSecretsResponseObject, error)
+	// One-round-trip overview for the control room home page
+	// (GET /dashboard/summary)
+	GetDashboardSummary(ctx context.Context, request GetDashboardSummaryRequestObject) (GetDashboardSummaryResponseObject, error)
 	// List entities
 	// (GET /entities)
 	ListEntities(ctx context.Context, request ListEntitiesRequestObject) (ListEntitiesResponseObject, error)
@@ -6870,6 +7023,30 @@ func (sh *strictHandler) GetClientSecrets(w http.ResponseWriter, r *http.Request
 	}
 }
 
+// GetDashboardSummary operation middleware
+func (sh *strictHandler) GetDashboardSummary(w http.ResponseWriter, r *http.Request) {
+	var request GetDashboardSummaryRequestObject
+
+	handler := func(ctx context.Context, w http.ResponseWriter, r *http.Request, request interface{}) (interface{}, error) {
+		return sh.ssi.GetDashboardSummary(ctx, request.(GetDashboardSummaryRequestObject))
+	}
+	for _, middleware := range sh.middlewares {
+		handler = middleware(handler, "GetDashboardSummary")
+	}
+
+	response, err := handler(r.Context(), w, r, request)
+
+	if err != nil {
+		sh.options.ResponseErrorHandlerFunc(w, r, err)
+	} else if validResponse, ok := response.(GetDashboardSummaryResponseObject); ok {
+		if err := validResponse.VisitGetDashboardSummaryResponse(w); err != nil {
+			sh.options.ResponseErrorHandlerFunc(w, r, err)
+		}
+	} else if response != nil {
+		sh.options.ResponseErrorHandlerFunc(w, r, fmt.Errorf("unexpected response type: %T", response))
+	}
+}
+
 // ListEntities operation middleware
 func (sh *strictHandler) ListEntities(w http.ResponseWriter, r *http.Request, params ListEntitiesParams) {
 	var request ListEntitiesRequestObject
@@ -8031,166 +8208,175 @@ func (sh *strictHandler) GetTrends(w http.ResponseWriter, r *http.Request, entit
 // Base64 encoded, gzipped, json marshaled Swagger object
 var swaggerSpec = []string{
 
-	"H4sIAAAAAAAC/+x923LcuNngq6C4W5VWwlb7MPNnR75SZI3txI61lib/pkauFpr8uhsRCHAAsKWOS1W5",
-	"2gfYyhPmSbZwIEh2g2z2QZYzlRtbEkEQ+E74zvgSJTzLOQOmZHTyJZoDTkGYH8+v8Ez/n4JMBMkV4Sw6",
-	"iT6B5IVIAC1ASMIZmnKB3k2HH7BK5lEcyWQOGdbvqWUO0UkklSBsFj08PMRRjgXOQLkPnBVCcrH+iY85",
-	"/qUAlJjHaCp4hjDKBSwILyQSIHPOJPxGIgb3amyHRXFE9Lu/FCCWURwxnOmP+4fty4qjc6aIWr5L11fy",
-	"00/vXiMukKTFDA3geHaMbuZcqpN5MRFE3hyVn82xmldfJWkURwJ+KYiANDpRooA+K7ikRQDg9lljCXfy",
-	"JMPJMCOM3MToht4nJwlO02XbevS7W67oR8GzK6Lf/hIErMZKA6xTLjKsopMoxQqGSr8aB+Z9l0KWcwUs",
-	"Wf4Jluu7PaMEmBrOgIHAClJ0C8tXSEBO8VKiO6LmhKEX382RAFUIhtQcEBdkRhimnjRKKFhirhZd+/hQ",
-	"f72+/gzfvwc2U/Po5PmL/xVc+tTS+DqGrvCsIlPCBXpzfvUKfff8BeLM80lGZOZ4JLy4ioe2QdR7khHV",
-	"hiVqHtYnSGGKC6qik++fxXrPJCuy6OTFM/0bYfa35373hCmYgTAfuuJd9KD49tTwoHdqMWbkwQWwlLDZ",
-	"aZ4LvsBU/ynhTAEz+8N5TkmCNcxHf5Ma8F9qH/yfAqbRSfQ/RpU4G9mncuQnNJ9cobc5ZjNAUuEZpK8Q",
-	"RhkoPMTuDXSHJUoEGEocpAWmQ70iwelR9BBHF4JPKGQdC83tiN9tt+By3sB6z4XgAg0+/XiGfvju+9+b",
-	"ZVySGcP0p1zDOj0Y1OysoTW4LyFZjigxb7B4OgOmThNFFkQZBs8Fz0EoYpGM3ZOxpYYvETBNcz9HinM6",
-	"TjClhgGw5ExTif52QjQDRXGUJfm4pDuQCaZmX9HnNdKKI6xXMSZpgGniKOFCgH3ZDWEFpXhCoeS4tVfS",
-	"QtjxmewY7/kljsCI7b7TNxZam4WwvFBjWWQZFsteM/FCbfuKBCm3AIUskgRkFxgmnFPATA9W/BbYOOGF",
-	"JcfNcDNkYIVKj7VYpaXn2VOJ1Z/tEa1kVKOUeIU2K7Lik79BovT36rJpna4te62TmxUgY6z6LtZSfdr9",
-	"zmaadXNM+pEB3OdEgNxqmZZk/NiisHBdHXZLWFrndbiHpFCWqXNOSbIcJkYQ69+xUiDY0CCjncFzvKQc",
-	"B3Q2oyJp3HAJKbKzo5RMp+0gq/AriLwdJxRb8l4nfaehrT9QWBWyvsXcHmaaqgzNQGpkGSPmBwtrqyYu",
-	"+C2kwT3Kwi6sUyfUGpA/rxLOEhBMbiaPED84PdGRcgMaDod+pw1yaZB4F9t8KihsxTq4UJzxbDmmsABa",
-	"h69+Uh0Dhh9gASIIRyeLyxOnCcsPeIkmgPBEKoEThQaEzUEQJVHK79hRH0bryQWbiCvhOYztWrtRrk2u",
-	"HMTQjkV8AUKQFGSftTp1NHTchEgiTAsraKlm3YT8M0MnT08C++Kmm5l6AS0IqiIl6pwpsdwORIniou/x",
-	"bQeval/mFIziSH8RK2syL6WC0shLC9oC2V2UKVCY0NpWKggcRm3KQM15vymMpdxL7TFujzHJ+402YnKc",
-	"8BR66j0H0GQqzHrGDVOZJcRLUErPuEZqt9Yyh3uc5XrN0YzyCabHmoLHOFEh4VZYo2Ar7WGBaRFmx/5S",
-	"6tbY8Xambjl0Nofkdn2zCWdTEvC7/AVTYu0cLWrd6RegV43WOhnWlN+e54LemlhgOpZhal7VnuZK5Xqe",
-	"RP+bEnmrD2AQamiOZA2OVJCpsfvlfGj3FNYv2tQZhcUMNugdA8KkwiyBoRGOaa+T0k7cchK72fVDNND/",
-	"bjUzyYBrwycMww6CiqO/c9bH3OhQmRx51DBZX1FFJj0otO2IrOi0iwi9f6fNIGsSmx/+X8+exd8Y6W0i",
-	"nm4S8Dt7HtxYifJuFNex24qwi9IruAu+NiEocFB0EfpDaJFa/yBT5wXaTfdKStm5NmRCsVRjgVNi7R+i",
-	"IAvrUO4PWAi8DCsOB7GcewpdZ2aODZpSYEmXBGBFNrHQrzxTIcQKSHiWATOWuwfrvlan4IWCVcV3aM/h",
-	"mvI757TFjDR+ut7unVtCew+uuHUH2RlWk+1umz7AFVLZaG/aKMIZZwruVYDijctnSijIsfU7BPwIF1jN",
-	"JeJTZEYjfdqJwqwYmTeRmmOFytfjLQhfEkdtzQ9ekQykwllu7Dtt1jO4VyjnlCINO5Aa4f2YQPJcWtKe",
-	"te/wShSAyBQd69HHS5zp7yQk17CTtZ2FvHqc9gGdGTf67bEEVeTHcr47zGrn94r5zhlXnJEEJRbdPuDi",
-	"mDbepEF2nsiGkC4hEWAV9DVFWa4v6R2bEkkSTJE0LyI9DGHjNSUTCkhxpOZEosTMvgUc1nVfGVz2OROc",
-	"0k+OaNaWPedSlS7W5tJPE1VgisoBBodzQGDmI2yGMpzMCQvSXAZy7syj5qSXNmCsn6N3F4a6tcQ1yt7C",
-	"atlWDrRqCZsionfyhMHdkOJc8fxoo8lkpu2CmwsjhgTHOBdkgRWMb0Phy9M358PL87NP51fDP53/dXh8",
-	"fGy2S7mmhhQSsczb9mrmLiaUJOGp8Qye6/nsGE1TZurLjxeXNbYN2xeOHseW4JxwbyPanxjRLIHpaaHm",
-	"jkbRu9e9ZrYEv/Xs7rUQUVl6G5cEMzYBha4PuDcqErOMh+yLm0hjBQvxGsrD4GwHRZjMVDg2ppQgk0KB",
-	"DGoXj6gNZVhLR6bNuXHBlHXO7BZ1KAVLKzNXboVaKkXU4kPpGQZqMwl28kps5yF1NoJzu5jdV3M0kNZY",
-	"TjtdtPpIG9TR5qzAM6xVFSO29Qd+I5F/cewiv4FPb8RaO3aaK3lt7S5pDzlAlEwhWSZUL8TZZGP7agce",
-	"V474QirjokeMs6F31EPlLugn8ZtIakfARTjN41QhClgqxJk/GKcEaCpR5laYC5DA1HEUb4G7DyBM7sFi",
-	"DYd9EPdVODeM6iuj/FcYRmYcGiiBmSRGU/Z7Ch/KLQi4cmTQAsNxPZ2lvqA/Xn78M7osQbXR7Gq8HNh2",
-	"yjVwg4+IHJd0GLbiKV6CqNtsGShsjwmBrSVRCI2VGV+AMOgzds6MkdaQpwd0X+usFaE5FvqIKtlts01o",
-	"YDrudKKth0BNBBdM2DMXkJjslM97CVwnXR1iSig30eFX8rmTvjZK2fFa1tVjUI53U00xlUGH3RolHZKE",
-	"diaZbnEbxlM3QlrcaAfBx660GRRRC5dateru2z4MhhV+xCCYhAUIp2fWaIdHcXSHRelZEURprTXsODKG",
-	"W9gulf0VKh9r9Iqf9UgdC0wkpFtEuNz57XfmlxgkLZ9kspXLs5Y4tjmW6kLbfccnDVds77e4BpvaMxvo",
-	"kdytWyfG9fbPCpwFtKXLW0Ipsk/RYF1nsk+csDgKaUwCpJG4+ztmH9GxagfXTsbNgO3S1MW+1BNIcHIp",
-	"Vs0MJxsi7sx4cslfRvxoPp4uaz/bwVNMbLRMLy8d88LkGOkTjtq/C65/GE9wcut+0z+O3Xuf9/FU1xYS",
-	"0Oy2Tpvy+VLb+rC9+Gp141VSrJKsAgy2uzkqwBJYth2ddRpfYUXzyPp0M26y9SC1ns0BN4MwPYrircPL",
-	"9aqLjYeDm6sz4eGNwPn8LwTu1mEI6QyacauunOhPDoFyTvKQl5rxdIvZnBsoMI8SBUvKbO6w015/CiU4",
-	"Nynqc6ICfvpVpYzbFDG75RCc3gKman5ZpQ6vwEqvl6xscMWzbGZoRIzNX0xkGGYCp1Yq8DvNKAW7Zfqn",
-	"oKaKpbJhx/3kVmucWUAztE0yLbTKnHO9VPuzVOYDjdXu6pDq9Eo42IUQsxZBakORh3FQIzRgDz4psRR8",
-	"WG58s322HbLL/a1CxW0urgguBJM/MX5HNS2/JQHZ2FPLoITdQjoOUvbGmJTA7LZX0Lj9ZGYkz0OS8C2Z",
-	"zSmZzbVANVVDZXSrF83bTLXemW2KKAodO654JOVJkdmQlSjYhPNb49JYgFRk1parvdlpahcQQvL70l59",
-	"rcXoOrXX/YlBazttd2htiW0FIiP6KNzpZe8SC6i0X6aCZyfoi+In6IsDlTxBP2srOh0aGRij4+Pjzw8P",
-	"D9Em7iFlkraR9Wse19o6QvD+AEqQ5BKEg3DgAFi2WQ+Zebclg4HSIq9TksB3URw9n+t/WrIWjErTddjg",
-	"xawX+21RfZLh+15TZoT1GreNmeyzIVcKbvEdsrBAZZbjhs+uakiy15niD8QuleXKDFr9QkUXngo8zitE",
-	"hhZxYbNwtrPQ85wSkO15YM2UniY0/5tQyRmi/A4EmvCCpbHWonJI0WSJYGHfswVLo++jAEqbY8InprZD",
-	"CtE5pO8BpdUgb+XupQrlFazXnv1SYIGZIqwtK22Lypf5MudqDpL83SY8losvC6xWvG7mAPFjPrcXnHVB",
-	"c7eYXYOSagZcCakGKa1hvmbbdaWQ1IpEV0+vlSz4WrWCEFwEToofCdB0aOoHapkTyA5Hg+9evDiqZ5M0",
-	"v2diVWHx3Gb+rcDOzuDH95EqZZLwBtoJpTluUkq86zzCE16okwnV+lgtQ6oQZLP5aD7TGTO40GaB7DTE",
-	"uyKzH969jlHCBcgYCZyNs0mMUiJvx7NJjEgeIwVZTrGCGGWarmSMJIgFSUCGvFdzLgP64iUtZmVM8kLw",
-	"+4zfmyQelx9TC7QHDfJwMtDbIsNsKACnWq4g59TvmaRjvkvvk5O/AaXLKWHbx3vpfRKjRRYjLlDKk1sQ",
-	"pvoaE1ZP6+of8XXA24Djttyfqvinn03vaxyDvhPv3UHvXptQucDJLcrLZRA207/MBBgn0oZjIngcRytL",
-	"6Nz2pefElU1ryRLo0LEAgSm1ggeRaXPh3nu3u3XeEnE+K4QA5kP/rXkEUkHepTmadY8zkBLP+kVAp4QR",
-	"Od/fifoYjlhfaSoK5sI6xjDzeJC32sxsOVwV5D08FXpUp5TsTFR0zFjiy6InNEvDwbZBzm703lfhq7Cw",
-	"dI1sPLv09lN6aWsTIDomaFNRzeE9Nk1UtrEPSDpWfFfaWcWJhU5ceVCdrKytbROK+qUq9UZMt+O3HR8b",
-	"3+vnjQsDZBMMwskqCRYpYZiuxF85g6HiQ24yaN0vGWaaePR/1bPyN/Pwc7CGsjvkTZhWSmG/PBHnSepV",
-	"OB1tW+618f1wUkF9Tc0vxA2oB/FG5O1ZGc5bIdkylFt9skIbcwirimPLH22SvchapKsvoMFUm5wtxtUm",
-	"XLbgJwyf9Y0ElhECjmv4sk7KxgnfM25Z2kg9D1Uh1VgCsK1CzlOK8y5jcM5pOk75Hds3IW7b7hZVfoNV",
-	"4IfO9R226rfeNyW3QJfjBBc9+Tor1N5JgTxJjNLV7fA4QK7JRlWwch26rBGc3JYxgNK5YL6jt23NVMnp",
-	"oh5Q/rzLIT8Hn2pqijYO0WKjbKZRS2RxutEavFfZZIV6gpx8Syjdy6e2OZvE1PCMK89Bzzd6d6PZxj9W",
-	"yD2V6o6sN1slSNItHf654AmkhQipn2XqXoqMIjyySRCjMothVCa35BQz9Onl8IejtXxiuM8h0aaET79p",
-	"qx1nWg6W/shsLT69eSP1fJpw8oBbd++4tyHPS21RhEKba6bbzlNZuB5iroA1JH32SpAFt/CXpgJPrcBS",
-	"IFf8pAKmxidbM+Y2JNOWzlLRXTtR+bN3c52u1Tl456l3ilYs0CqjLp3xuZpKmWWYBZwmb7h3lpmmNy7Z",
-	"Kwo3s3Kdk1YZhyjflSOUxJzyQg8wbiYZVrr6F08ICLdyUXobqoVlU6B42b+8Wxv9zQRhKedRXJbqm3Jy",
-	"1nLotp19WwA6XHT/X882ll26dcce3SEquSqDUisAZDzDdNmiTRMBVWbUDtkd6won1xwX9LsSE5ijhAEW",
-	"KBf8b/bTMfp9imza2uZYYnvcVFIespze289NiUI5CJTi5dZBQR+mq6AVTMyQkBRaQzFVFRb4E8ACxGmh",
-	"5qHWvdYsGi0I3IE4QXqY1p5u0cd3r8/QH//7qp60Sdjw9OId+tc//onOcJour9mUizss0iEu1BwRUzIE",
-	"TMKQsGEKuZrHiHFb3OS8N1pDE4WaHx1fM9N68sS4BUmC7Dpt3Z9tz1oVCQ5MZxF0Y7J9b/S7ZftSQ0zm",
-	"zYraDSuZRphGp3UdNl0Gv2uAmioueLTeX9S2Cx3qsxyQ3mxZ3P2R3HKJ5jwDiifo4+UxutLq5ZRQ0BvX",
-	"Q377W7/Ja2Z2+dvfooHpQIoTNTR64dEJesNNxAAEkqqYSIQFoKqB7h1Rc8RxToZa7M2AxdfMlihKNCg/",
-	"f/b+XYymhdZK0E/v5JGFlwEzzgDJHJLja3bNzjhbaHRyVtNPXh6dXLMhOrdRKP31sj0pumlrhnpzrF95",
-	"T6SSqJCAbr6YMzqu93R+uLGLd42gczwjzAa8Bk7QINPgFn3/LEYZvkcvnj07MvP+xCSeArr4eHllC69z",
-	"hW5Wuv/eoIHtI5xTvER3hKX8zr79oTBCAQnX6lqiBAuxRDfutLt5hd6cX7kOxBLdnF/h2U2MLk6vzt6i",
-	"Mn8D3ZQNfW/QwLUCLlsA28/4ev8KZi9fvvwB/XR1Zp6fu6Qk8xSnqQApzbomzRRJNGj2pDaIupoD+nB2",
-	"gYz4n+IE0EAqATgzM7y9urqIEZ9OSUIw1QR0+fpPR5rsTAgKUoQVuhllSX5zzTirCGFCGBZLhFmqB/NC",
-	"GT+q4SVL15plXZLQK0RMGSCnEt0JnF+zip6sfYxMXQjChtqlNrPSnBOmpOVHShJwoRjHZBe2EFeLa0Ed",
-	"Y8qT0chZ3scukjxyBbu1OGJk2e304l1NazmJnh8/O35mzNwcGM5JdBK9PH52/NIGgedG3o2MkBjiWktb",
-	"d2haJxDh7F0anUT/uwCxbHa/bXY8/zncOrnWgLSj0XPLu42OpTtMUE/d6Hw5pDlXmxv5fuE9xrpO0j1G",
-	"ug7xPUbaNtgPn1daSr949myrhsgrSYSl2dDLfmiiPpQdXGtXv33HFLOEwBm9duSUS0DAlMnjeogrxSy8",
-	"BQ+zWuvpWpap7emMJjDHC2LaGRg3O55J49OeaHbGE1K6Xe+H5cJtA6/oJLLqgJl1VDooZSsn6WPh1I/q",
-	"xUTe6qhwebhOrG3MU3px1j65d3/bXx1v+BbsT8cWnqD25wdNoAjXKLTkBY94uQ0jjL6Q9GHkG51rWDcp",
-	"fgOC/QUWGse5SxBpstRr0wvaoyHe8gsr1zZYWjLZMH/g6XIPMqpv2tdmWja1XLr0nBk0zRhvyfxt6RPy",
-	"9sPpWdUu2doGA0nYjMKwkBCjsvjHqdRDSVLY3FHGbyNMic0LHR72ZMRd7zp47RaJBCRcpJAe4mSwuDIp",
-	"OsCWdVg66LYCtC/L+KibZZoitfn+HTqYGdJP96q3TN1F+7J9dx9T8WpT+zjb5c21KrT/KH37HWxVx+Yn",
-	"PNr0Ikp1Dw2URK/PL8+ODsHeZubt9b0mz5oIcre6d2aH9GLaNbWrJ+37vI4dmLVs37r2aq3a7tdF2bZd",
-	"8tMRtaOIAylrhgRRClPCXPlLRdC2xHWTxtamWdkcKAutJ1SrNqLS5Wr10keeH/bTQfTa6ucD4NfOhLDD",
-	"8cBKmyGWwxQrHKPSTfn7o944D4kvo6Tvq5uXPU6aJGRan+xIQe5SskclHdua5Strsq2UU150tT/l2JmM",
-	"7kqsa9UR0a6E0mjvseHAWxnbz8vhi/G/tsZZduVd93Vs1Yz4V3dINntrP+FpuUJOBxCrbkbQlp01HLVu",
-	"OQfksgl5IYflE2TMMqQEJvRoV3+Ii0qNbLdZg5pgsUvZ7FCWLWVjH+6SCDOEZ4BuYZljImJ3e5/5e3uP",
-	"0NhENGrFsY2sL94obzhGZ5hSELbpH6YCcLpEc7wA/Q33DmHm2GGQaunSqI4wiV42wNGUCrb57FnZE/gx",
-	"pHmzL/BXFugrzXVDlxuaERkw5a/ytBFA20CZpR5hB6Bv+zGEEYO7sg/tv/7xT0SkLKCkoZJ+arTjl1BR",
-	"uSPcFhK3V+s0KPyLpMXsYZRUDcqDaRifXITxbk6SuetDbnqPxzasZsnWdAC2vb7L1trItBg3RDwjC2BI",
-	"lbFGE2VmqAwAm+biJmpHmFSAU8SnaEYUygtKQ0T6BlSzufrauRXaAuKMLt3ipF8ckdW67JWWL1++/OGo",
-	"5Spf2zV960tGPz+mitKAREgqu5bkKVCFD0Czb0A5MkjqMzuI4gqc2xJnvJNWay4sfvgcoGxZdUyfdfaD",
-	"HpoEE+MdNG/YYHJado+10/5GrknsdsIsm7U/Ot7LDwXwftmr7/uBTNsScl0N5r8uMdTbqbQqwGV6wyYJ",
-	"8iOhCoSpzq/fD0RYQosUJNKjgaWYKdkmOnb17/p6tW1f9I0vt36z7Gja+eIKsRUT+9B1iuHMpIWMXIpm",
-	"6Cu/7On4/bfS0dvbbH0l3dy1NaNEHoznoWIer2rXmiXt7MY6L4XrN+nHavRH/8qOrJKK2j1ZsbvS3Xz6",
-	"/ArP2qZ0w0ZmjJvwIB4whtZU0w1U0fRflINH3mBpN8LOnF1VM5RqRo+RnLFv/22qZqS2Dk3Woe2JoO22",
-	"BOc4MQZYmW98FKPSjeJmt8GuqsGnyacIWGxNM02LwXJ3PuAb0mh9Dfy3TftrXSi+Mv2vd0hol3Sus2Xc",
-	"RMgvBRRPyiZ+Cwgj/VqhPOkO3v+fsxj95UOMfIeJI2QGmpYR+/JT6ToOKkNvQHnSe0Tju018OZy5bjRP",
-	"h503vpJ+NcF1p0PuAE761aT78pqDutTBAgIXN9Qu36g6rqcwfXXNCKUww7Qxic0kRt89+0HrtWa6YfX8",
-	"6Bhd2Byymf7INbMCUdtEy+rVl2hQSjkPl6OgvNPb21XWPXK0oX7/xlf3TrUxiIs3VGfrU3GIC1dUzRU0",
-	"g9Qu21i5iOMgUmtk7nccVvc7tomwP+hxn+ywXrEMU87RsEM8eF6aRnwkK7Lo5PtAIdFjWxOrKWq5LXVZ",
-	"L9XaridQW5se+4Gtm6pskR8ynZpqUW82WK/qTOB8jlLiOnQdwqVaViyUHyRT64hwgn2KCZVfVZyvE3SZ",
-	"/iQ3H8i+zUc/ihZAd04lq8qwghwRTbhhFt9HxJSWGReDefL58I7PfUzu7j7ZO9NxfdpDhLheG6AjUZ/W",
-	"3Pjp4zgDDV3kkSOPnpB4rWfVq9SjqpK4jYpX23s94vG5+qkA9i6aUTDInRhy+ziAfs8pDbdQM8VJq0r/",
-	"10Jl3TG6MN7XzuzV84W7x7GHxHn0qp+gV7TWtOI/6adP7NtcOI/9U7k2F7aO9IApp2+JVFyYUCuUrLBr",
-	"qZGdYGQrH1uDUZc2Mf0SmEJ2Q8foHCdz+/3fSHRD0puyJtf8DQl+h0iKBgJkkcE1M4Ls5r1Wlc0Mw3ev",
-	"b45idGNGr7yrgRqjmxQr7J/88fLjn6+ZeRVZaB+jt4CFmgBWyF4qrqSeQCzR8+/lMfoDSDWE6ZQLEwQk",
-	"5sm//vHPa2a6GkOKchBDWUz0Ticg0KSYTkHEKBU8H3KaglSuhPfiv45emSLcN+dXyMHsmimOJji5nZJw",
-	"IPjSwLRNWLWGcDwEUC5gSu73jdhYI6t6sYGCzhk2s62Ce2XBMawoqH3C9Sjg5TlyLx7C7b8oCcjOiQaX",
-	"l+dH+zBHlZvTGaerhu1aiffo+dnfSD3Ev9fR4WsUn/D4qGjrUIGxOrVunYUWtwQ7ruaA5pilFMRqdGLg",
-	"M8gMDR7FNoNUujjFqGy9F18zzFIERM1BIGDGG+6OBd8LeGCTKV2Z6hHiopa/ds183ZrzvZkYSNmGoDkT",
-	"YeimvKHrxuecnVLJEdybv5YpFjafRHAKJv3JJgPZ6T7++f1f0R1e2jFSbzF0FLiIxHm96PWbDB+u3qj1",
-	"tUOIFcd1sEIZPUGDzDbIdPXLPoh1CCXrkyegOvU50l6if/3f/1cVSdq0ev0nR7VbJXjWst+qsZsDIjVa",
-	"ejyXby98HMIv5kFsD0f0O+QuIdxNRu3lT2giYWRv1XuUmuMzM/XTo/LMXxx4gFC7mQthVArXkb/OENWr",
-	"/nesbtWyWbSXt56bx5cA6d7OnBXVwbT14bZZWRN6fz398B7VLn5a7xDKFKd8tsur9ozc+sUVfcMvIK7t",
-	"w0/eRw/REEWTQh/wBxGuZTo6knpivRtpOyolroH96z+Ul6W//oRGyDWkMcFnwRsZ9HIpFWS9iMf487uk",
-	"qrkHcZOxdqmw8JHYQT0Oe/QK8Ywo40y7m2uFwUYQBvYCnbbsO8H5Tkp9R4DoxYYAUWw6ZFLT5s9qrL39",
-	"9f07Y0q1NJ2Fplxk0aPmGVf3VwZo1zxEC/N0b9K9LCYWpxrHCyILTMnfXc8tc38k+h0y90fu4AjXJFrd",
-	"D9lGoz9SAGUvonzMA6N51WUArHYAKkGzP2jNxtC8Ma11gJubtxBhqd4KF/s4vHxD5JEELJJ2SF+ax/4O",
-	"xX6m/S/Rqrq8n738DVjBjVskDxepekvUIUzaHwtKhybP36LTNuP0SK7iuYPysJQxcjczNljUv7IVDX3x",
-	"cYIe2Ut1Wvq1ofO9uSa0AvwhOitQ6jUcOSpxhuyFpNo2D2Vz9kVjmJvNhaDBGFB/pjY2hG0euiGO9cEN",
-	"6iVZegekehzrvrXp/od6azFsebVhIFKPC8VrkfrmRZf2KobdCmN3CXc9pWht3CV6OF600yIJB+ptZ4jV",
-	"VE4N7Zwo85S76zFcN4napObHymo5IIocI2koblshYS6yCbCETyvrP2Hj2t7Qzcm1jIst17p29c4mympA",
-	"JPjpxhb7kKBH3WFOeFSSi3HA1qqc9GFeW275t9pqayRarqk/ddrckuXQIyDs/K4nnyIsXanpOCuUMwy8",
-	"i1pzDh56x+HdHBiqclHX/Mb1kpMra4d9w2UneoVPWXpiib2zkcqLZy960KF1J9c7Mu7t3lTagFFzqCjZ",
-	"GDa2trpG0P3ptenZCFLs6Is+jkMtWQLajiuG20LRaU0Ef4tFilKgoEyjbsYVkkWec2G6bc9N/25366lE",
-	"cE+krSv39zb4UmsbfX/9MsAatSTt3TjjqyRq66U9YbJ2G0fUGsQ8EUfUGst4rFdJhftwguse2x2yvygH",
-	"baN779EEccfYe79MgV9TzL287vzpIu6eNA4Ub88rUivpmYK78WuzJlK+fdDeWuEbKZDEU1BLtMB0AU70",
-	"Xr75/dExOvWNmLU4z+vazpqqc/ldm7C+8HeGf31J3STJ1pa4my95X7ubaN/L2x+euB2uZ7hv8ZS4qkp3",
-	"cMlIaOD6ggMaoQq2aFSdJEf9eW3l7HAZKb5MrKDQrwn7p4KCjL6B/uF6IYcsKDD7OnA/cCSKpmlWBSJ3",
-	"SD0688ZVo5G8/9oro3frTyJ3iZ9ttoOnCsR6BXQp+V622mMNUH+jFll9jdvYZE/C5hc2U8BZQw0qQYO0",
-	"wHQYCPt20kwPtn7sbpX7UckjWyf/puRhKMKx9yEJw2UgdjkjT92YS1CKsNnTyvrmWg4o7v3uDtEY2y4S",
-	"STcnGtwSSofyjqhkHiMGCxDDsjem6f1ytMORENZpP2EiTUZguQgiUZ1eKKRo8OLZC/S7KmnwGL3nd2Da",
-	"BBFlCwXc0tHNjPIJpsd6ujFO1Am6jvh0eh3daAsWpzb70G5pXA5Ct+DqDcpjh2QZpAQroEv99WdHJ+Zo",
-	"qoHFtkw086A77DJJMOtuz2GkTYg8d5Mbejv6EaYXDRptiww9nt76bfLIqcGmLW1Rgtik5idUkr14LGm9",
-	"7CLYkJCvGmT28ccfNUt4gtxPfgoib4cmNXaDtuxvl39aXbm65P6AijKRt6iEwYH0ZVGfc0vRqNHTKNu1",
-	"QpKCNX1XG6umjYLkfmUs5uq/bRNeOsta9p6plrC2lSN7hRS/C3UarYWZgB3mbphzlmqtpj71QIKStmHK",
-	"WHFru5hMFiLRLeT2RJibCsDl0S4NLNrMqHN3taCNoQVatqzHBdFgTkBgkcyXQ3yHBRy9QgkWKWGY2uvV",
-	"plwkkLYZUt00920YUvU1Pk1wq9kq4KvcE9CgSJextFOnlLI3fNehcOnG9K6dg4PVZPu7j9mUR3F051xF",
-	"cZQIokgSvBP6USrG+1zY8mty81ucP6GXvyS6Q3WY9TS83ZUpNR6xxSY4uX2USpPT5NbBPIz17p3bVw93",
-	"rcRpUmVoYge8HW+UaEAvK6x2c3DwfSgU1OB3iCCEXuu4YIrQvp26W+/yW725vJp5j8v2vi5FaAB7UnDN",
-	"SK6u3h+CKARIThePQxef7NwHJo12NK8h85tAnoNChb8MswJTutwVfdpU3aA02CH9rjC07pexyTr9T/T+",
-	"MY91jZWnPNUtVRzqUDezoQHFCqTyJWg5CPvoaLeQvp32scMPFhXfcKw9J4xBOvY3zYe6B66H2zUmWmPt",
-	"31503THENx9bNzRpLuIh+tcSKTuG0WsUPnJT9ZDmfylHfnsCbGeB5Pe0P77cVKXvx3Ths3jbXgztWSFv",
-	"yvFk3+KnKzN6a1H071bMYbZ5QNJxYDsEowNLEWaYLiVxjf4oLWs4TA/vQCHVNgUdj1lMpbcCSWFcN3rq",
-	"CWAB4rRQ8+jk588a4/bWbPvhQtDoJBrhnIwWzw09uP2sX6/jyuBdhbavKzDNWU3TmLrvvLkNW1azlodi",
-	"b8gCf0VXXN1BRKTtSEw4i8vraGotltydM+tznm9X6uDm41X1xZew38Ns0bXhGVhUmxhQ4xbF4IJ8t4bq",
-	"FgJ3o15c3fePBqm5TX+EE1WbFurNjL605F2apXnVS8uz2gxevq2/Xw/AxCupRrEPjlVTuSjK+kS+QtKR",
-	"hqsTrnx1tRrHL8HSKxnbimXz3ZSo2PXpi11xcw1TDS4LgTvnQq2/53oePHx++P8BAAD//5TywEKf5AAA",
+	"H4sIAAAAAAAC/+x963IbudXgq6C4WzXUpCn6MpPsyLU/FFljO7FjraXJt6mRiwK7D0mM0EAPgKbEuFyV",
+	"X/sAW3nCPMlXuHY3iSabF1nOVP7YkhqNBs4FOPfzqZfyvOAMmJK9k0+9GeAMhPnx/ApP9f8ZyFSQQhHO",
+	"eie9DyB5KVJAcxCScIYmXKA3k8E7rNJZL+nJdAY51u+pRQG9k55UgrBp7/Pnz0mvwALnoNwHzkohuVj9",
+	"xPsC/1oCSs1jNBE8RxgVAuaElxIJkAVnEr6RiMG9GtlhvaRH9Lu/liAWvaTHcK4/Hh62LyvpnTNF1OJN",
+	"trqSn3568xJxgSQtp6gPx9NjdDPjUp3MyrEg8ubIf7bAalZ9lWS9pCfg15IIyHonSpTQZQWXtIwA3D5r",
+	"LOFOnuQ4HeSEkZsE3dD79CTFWbZoW49+d8sV/Sh4fkX025+igNVYaYB1wkWOVe+kl2EFA6VfTSLzvskg",
+	"L7gCli7+DIvV3Z5RAkwNpsBAYAUZuoXFCySgoHgh0R1RM8LQs+9mSIAqBUNqBogLMiUM00AaHgqWmKtF",
+	"1z4+0F+vrz/H92+BTdWsd/L02f+KLn1iaXwVQ1d4WpEp4QK9Or96gb57+gxxFvgkJzJ3PBJfXMVD2yDq",
+	"LcmJasMSNQ/rE2QwwSVVvZPvnyR6zyQv897Jsyf6N8Lsb0/D7glTMAVhPnTF19GD4ttTw2e9U4sxcx5c",
+	"AMsIm54WheBzTPWfUs4UMLM/XBSUpFjDfPiL1ID/VPvg/xQw6Z30/sewOs6G9qkchgnNJ5fobYbZFJBU",
+	"eArZC4RRDgoPsHsD3WGJUgGGEvtZielAr0hwetT7nPQuBB9TyNcstLAjfrfdgv28kfWeC8EF6n/48Qz9",
+	"8N33fzDLuCRThulPhYZ1djCo2Vlja3BfQtKP8Jg3WDydAlOnqSJzogyDF4IXIBSxSMbuychSw6ceME1z",
+	"P/cU53SUYkoNA2DJmaYS/e2UaAbqJb08LUae7kCmmJp99T6ukFbSw3oVI5JFmCbppVwIsC+7IaykFI8p",
+	"eI5beSUrhR2fyzXjA78kPTDHdtfpGwutzUJYUaqRLPMci0WnmXiptn1FgpRbgEKWaQpyHRjGnFPATA9W",
+	"/BbYKOWlJcfNcDNkYA+VDmuxQkvHu6c6Vn+2V7SSvRqlJEu0WZEVH/8CqdLfq59Nq3Rt2WuV3OwBMsKq",
+	"62It1Wfr39lMs26OcTcygPuCCJBbLdOSTBhblhauy8NuCcvqvA73kJbKMnXBKUkXg9QcxPp3rBQINjDI",
+	"aGfwAi8oxxGZzYhIGjdcQobs7Cgjk0k7yCr8CiJvRynFlrxXSd9JaKsPFFalrG+xsJeZpipDM5CZs4wR",
+	"84OFtRUT5/wWsugeZWkXtlYm1BJQuK9SzlIQTG4mjxg/ODnRkXIDGg6HYacNcmmQ+Dq2+VBS2Ip1cKk4",
+	"4/liRGEOtA5f/aS6Bgw/wBxEFI7uLPY3ThOW7/ACjQHhsVQCpwr1CZuBIEqijN+xoy6M1pELNhFXygsY",
+	"2bWuR7lWuQoQAzsW8TkIQTKQXdbqxNHYdRMjiTgtLKGlmnUT8s8MnTw+CeyLm/XM1AloUVCVGVHnTInF",
+	"diBKFRddr287eFn6MrdgL+npL2JlVeaFVOCVvKykLZDdRZgChQmtbaWCwGHEphzUjHebwmjKncQeY/YY",
+	"kaLbaHNMjlKeQUe55wCSTIXZwLhxKrOEeAlK6RlXSO3WauZwj/NCr7k3pXyM6bGm4BFOVexwK61SsJX0",
+	"MMe0jLNj91Pq1ujxdqb159DZDNLb1c2mnE1IxO7yV0yJ1XP0Uetuvwi9arTWybAm/Ha8F/TWxBzTkYxT",
+	"87L0NFOq0POk+t+MyFt9AYNQA3Mla3Bkgkw0lgorgUg5G9itxcWMNqlGYTGFDeJHnzCpMEthYM7IrNOF",
+	"aSduuZDd7Poh6ut/t5qZ5MC1/hMH5Rq6Snp/56yL1rFGcnJUUkNofUUVtXQg1LabsiLXdbQYzDxtelmT",
+	"5sLw3z95knydFLiJhtZTQtjg0+j+PObXY7qO5Fa8XXgb4S5o24SnyLWxjt4/xxappREycTah3SSx1J+k",
+	"K0PGFEs1EjgjVhsiCvK4ROX+gIXAi7gYcRA9uuMR7JTOkUFTBixddxCwMh9b6Fd2qhhiBaQ8z4EZPT6A",
+	"dV8dVPBSwbIYPLC3ck0UnnHaolQaq11nY88toZ0HV9y6wxEaF5rtbpsWwSVS2ah9Wp/CGWcK7lWE4o0B",
+	"aEIoyJG1QkSsChdYzSTiE2RGI33pidKsGJk3kZphhfzryRaEL4mjtuYHr0gOUuG8MNqeVvIZ3CtUcEqR",
+	"hh1IjfBuTCB5IS1pT9t3eCVKQGSCjvXo4wXO9XdSUmjYydrOYjY+TruAzowbfnssQZXFsZztDrPaNb6k",
+	"zHPGFWckRalFd3C/OKZNNsmTay9mQ0iXkAqw4vqK2CxXl/SGTYgkKaZImheRHoawsaGSMQWkOFIzIlFq",
+	"Zt8CDquSsIwu+yWWszHHIrusjMJLLOBUdDnyZqvoZWOUMwJyNF6MtIJjyBZnGdFbxfSiMefq60t2Oivm",
+	"GdOw1ECBDI0XyM6btGiG7uP+0j/wt53qtPrpuT4hhNvw0lT6mZ9pXKa3oOxk3w9ywkoFyF/hCcq5VJqp",
+	"9Bv6oqzjuokQO1H3ay4Y2DdQt5vXvxCjlmVeC7baA6HdTxfHfGIAg559N4shYgaYqoh0lcFU4AxarAEZ",
+	"v2uR+O18i/hDqTCNINysj4+lxqnZB6cZ6BMaW2+0EY6+kQjuC0g1LaTYChQxwbNkt6xldUuY80tNqs26",
+	"nVWzxNBpr3uLO5iDcAasXdHHC2CozzgbCJCcziE7cn7AVXz6z62samlrK5wdO2kC8uNbSiJnWJx2G+wc",
+	"g9g5E5zSD+6OXaG1GZfK+6easDlNVYkp8gPMlTcDBGY+wqYox+mMsCgD5yBnzrbUnPTSRtvo5+jNhREG",
+	"tIBqzq+5NVFYsalVqdoUTnInTxjcDSguFC+ONtqbzLTr4OZiMGJy1qgQZI4VjG5jsR+nr84Hl+dnH86v",
+	"Bn8+/9vg+PjYbJdyfXlmkIpF0bZXM3c5piSNT42n8FTPZ8doGjVTX76/uKxJOXHjjLu+R/Z+drJw2x3/",
+	"EyNagsD0tFQzd6WjNy87zWzlg61nd6/FiMrS28gTzMh4Y9d9wL1RkZiVU5B9cRNpLGEhWUF5HJztoIiT",
+	"mYoHFiglyLhUjXOsem0X5bG6blqvAMiQHZWguxkwx/AGdESinDOiuHX0BdtJh4PcXz4fD+d8Moq5uZsc",
+	"CJpbMou3SzNBL40ttikaG9eWY32RMMxSGJVMWZv/blP5I7f1mKus1bUIvV6Lab5jdEGbbWknY/d2jjdn",
+	"bHL3odl9NUeDnBvLaeeYVtdbg2/abOB4irXOa+hbf+AbicKLIxdQFPn0Rqy1Y6e5kpfWgCettgSIkgmk",
+	"i5TqhTjj3mhJdVjF45KuWEplPL9IizPB/wuV+bnbXdhEUjsCLuLRg6cKUTDcxoLIMCFAM4lyt8JCgASm",
+	"jnvJFrh7B8KEtM1XcNgFcV+Ec+OovjJWpArDVjFAfSUwk0ZorfYUF1daEHDlyKAFhqN6lGR9QX+6fP8X",
+	"dOlBtdF+13g5su2Ma+BGHxE58nQYNwdTvABRN/7loLC9QAW2JqlSaKxM+RyEQZ9R9qaMtEbSBEB3NfO1",
+	"IrTAQl/ent02GxcNTEdrnTKrkTUmMAjM/VkISE3Q48e9Dlx3ujrEeCg30RFW8nEtfW08ZUcrwbwPQTnB",
+	"3zHBVEYdQCuUdEgS2plk1h+3cTytR0iLP+Yg+NiVNqNH1NxF7C77jbaPrsAKP2BsRd2KUKMd3kt6d1h4",
+	"E70gSsvzcQ+EUWnjBk7ZXaAKISxB8LOGgWOBiYRsi8AJd3/XjAluiVHSCrGLW/nOavHIm0N0nCmj6/i0",
+	"4dPr/BbXYFN7Bpk+kN9u63jrzo4+gfOItHR5SyhF9inqr8pM9ok7LI5iEpMAaU7c/T18D+ihs4NrN+Nm",
+	"wK6T1MW+1BOJm3WRu83AWRt5tDaQ1tn6zPGj+XiyqP1sB08wsdEXennZiJfGEq5vOGr/Lrj+YTTG6a37",
+	"Tf84cu993MflWVtIRLLbOho3hOFu6wwNx1ergbM6xaqTVYDB9nqOirAElm1XZ53Gl1jRmpONczDnJggc",
+	"Musi6/PCGq2PesnW4Ur1ZL6Nl4Oba20c3SuBi9lfCdytwhCyKTQDINal2nxwCJQzUsRcMJUdqs1sv6Nx",
+	"KRKZGXGTkQwNrssnT55DsHU5jdTavAhLaZnB/7Y0acxHzkMN0Zg5xrMtgOPsfRGwKFGy1Oc8xZ3Z+lMo",
+	"xYVZ1IyoiP96WcbkNpDaYjCG9tcGBq2+VO+6aGxwyYUQ8HkovK1Y93Y8jlvjsAQ0I8BIrs9in6Gll+wC",
+	"vZT5QMMntaudba2xxcGwiwdTtqHqP27DFrfhMuQdACu/XBTuf2b8jmq+eU0i10pXOzVht5CNoly0MS5E",
+	"YHbbKXCrXahhpChil8hrMp1RMp1p1Jg8Xh9h0omvbOx451hzRRSFNTuu+DDjaZnbsBFRsjHnt8YaNAep",
+	"yLQte2qzvdkuIIbkt17Vf6mP7FWOqptio4aKrN0WuCW2FYicaClip5eDNTGiDXyaCJ6foE+Kn6BPDlTy",
+	"BP3McA7ZwLBqgo6Pjz9+/vx5o3ub+LQpc6+sGKtr64jB+x0oQdJLEA7Ckctm0aZ45ebdlihCSsuiTkkC",
+	"3/WS3tOZ/qclctBIg+suNjyfdmK/LfJBc3zfacqcsE7jtrEwhPyEpRIY+A5ZWCCfd7Dhs8vCpex0b4VL",
+	"d514dGUGRUMqFlYhcFQQcF4hMraICxsJu51xoygoAdkei90Mq21C878IlZwhyu9AoDEvWZZoia2wQSQw",
+	"t+/ZFOLh970ISptj4reyVuFKsXbINo7UYCDYS9wqKlivPPu1xAIzRVhbZPgWuaizRcHVDCT5u8098Iv3",
+	"Kc9LBktzgYQxH9tTwNdBczd3Z4OSarqvh1SDlFYwX1OL14Vx1so2LN9eS3lptfxBIbiI3BQ/EqDZwGT0",
+	"1cJxkB2O+t89e3bUHuVn3Hzx47lNc16CnZ0hjO9yqvh8nQ20E0s12CSUBK9DD495qU7GVMtjteCBUpDN",
+	"mrf5zFp3y4VWPeRaG8Y6p/a7Ny8TlHIBMkEC56N8nKCMyNvRdJwgUiRIQV5QE4yYm5i2BGmxnaQgo0GJ",
+	"XEbkxUtaTr0790Lw+5zfm8gwF3RVi1GI2jLiEWavyxyzgQCc6XMFOX9Ix8gv8116n578ApQuJoRt7yqn",
+	"92mC5nmCuEAZT29BmHoomLB6aHV3Z7kD3gYctwWUVem43ewHIRowanYKhjH05qWJMhA4vUWFXwZhU/3L",
+	"VICxv224JqLXcW9pCWu3fRk4cWnT+mSJ1Myag8CU2oMHkUlz4cHwubsFoMVZf1YKASxETbSGYEgFxTrJ",
+	"0ax7lIOUeNrNeTwhjMjZ/vbnh7BhhwBUUTLnETOKWcCDvNVqZsvlqqDoYA3Ro9aekmuTBRwzenxZ9MRm",
+	"adgmN5yzGx0flecvfli60nKBXTqbeMNpa2NH1kzQJqKay3tkypptox+QbKT4rrSzjBMLnaQyPruzsra2",
+	"TSjqFuXVGTHrbebt+Nj4XjeLXxwgm2AQj/NJscgIw3TJdc0ZDBQfcBOW7X7JMdPEo/+rnvnfzMONtvOY",
+	"5YNpoRT2C7FxlqROpUx622Zeb3w/Ho9RX1PzC0kD6lG8EXl75j2h8aSkUfXJCm3MIawqV+F/tIluIm85",
+	"XUMSK6Za5WxRrjbhsgU/cfisbiSyjBhwXAm2VVI2hv6OLl+vI3W8VIVUIwnAtvLWTygu1imDM06zUcbv",
+	"2L6xhNvWm6pCQ6wAP3Cm77hWv/W+KbkFuhiluOzI13mp9o6n5GlqhK71Bo8DhOlsFAUr06ELuMHprfcB",
+	"eOOC+Y7etlVTbc5QJQp93OWSr2LsbeLkIYpe+fJWtRggJxutwHuZTZaoJ8rJt4TSvWxqmwNxTB7tqLIc",
+	"dHyjc324bexjpdxTqF4TMGgz9Um2pcG/EDyFrBQx8dNHPWbICMJDGz8y9AEgQx8XVFDM0Ifngx+OVkKx",
+	"vd9uFCKX2qq5MH0OentkvuIL37yReihSPO7Crbuzj92Q56XWKGLu0xXVbeepLFwPMVdEG5Ih8CeeCNnd",
+	"XpoJPHGxCz6IIdhJBUyMTbamzG2IQ/bGUrE+7aSyZ+9mOl1JEQnG02AUrVig9Yy6dMrnchRqnmMWMZq8",
+	"4sFYZsrQuTi5Xry8pKtluMw4RIU6WTF3esZLPcCYmWRc6OqedyIgXlxN6W2o1hRYihfdS6xopb8ZWy3l",
+	"rJf4qjkmH5y1XLptd98WgI4Xvvn9k42lD9y6k4DuGJVceafUEgAZzzFdtEjTREAVVLZDBMmqwMk1x0Xt",
+	"rsQ45ihhgAUqBP/FfjpBf8iQjfjb7Ets95tKymOa01v7uQlRqACBMrzY2ikY3HQVtKKBGRLSUksoJiHF",
+	"VQsALECclrFcxfdOLRrOCdyBOEF6mJaebtH7Ny/P0J/+66oe70rY4PTiDfrXP/6JznCWLa7ZhIs7LLIB",
+	"LtUMEZNtBUzCgLBBBoWaJYhxmxfmrDdaQhOlmh0dXzNTDPrEmAVJiuw6bTKpLZheZZ72TZEvdGMCpW/0",
+	"u76guCEm82ZF7YaVTGlqI9O6mtcu+cGVJM8UF3w1qO3MFvAe6LsckN6sL7DyntxyiWY8B4rH6P3lMbrS",
+	"4uWEUNAb10O+/TZs8pqZXX77LeqbmuA4VQMjFx6doFfceAxAIKnKsURYAKpK2t8RNUMcF2Sgj70psOSa",
+	"2bxXifr+82dv3yRoUmqpBP30Rh5ZeBkw4xyQLCA9vmbX7IyzuUYnZzX55PnRyTUboHPrhdJf9wXD0U1b",
+	"efKbY/3KWyKVRKUEdPPJ3NFJvcvC5xu7eNeaocBTwqzDq+8OGmRKzqPvnyQox/fo2ZMnR2ben5jEE0AX",
+	"7y+vbPGTQqGbpXr8N6hvK/sXFC/QHWEZv7NvvyvNoYCEaz4hUYqFWKAbd9vdvECvzq9cTwCJbs6v8PQm",
+	"QRenV2evkY/fQDe+xP4N6rvi/L4ov/1MqLlTwez58+c/oJ+uzszzcxeUZJ7iLBMgpVnXuBldivrNLhEG",
+	"UVczQO/OLmw5kAlOAfWlEoBzM8Prq6uLBPHJhKQEU01Aly//fGRziEtmItEVuhnmaXFzzTirCGFMGBYL",
+	"hFmmB/NSGTuq4SVL15plXZDQC0RMBiWnEt0JXFyzip6sfoxMSg3ChtqlVrOyghOmpOVHSlJwrhjHZBc2",
+	"u1sf14I6xpQnw6HTvI+dJ3nossBrfsSeZbfTizc1qeWk9/T4yfETo+YWwHBBeie958dPjp9bJ/DMnHdD",
+	"c0gMcK3IvLs0rRGIcPYm6530/k8JYtGsR9/sQfJzvJlBrST4mtYLLe82aojvMEE9dGPtyzHJudrcMHTw",
+	"6DDW9XboMNL1bOkw0jam+PxxqcnDsydPtmpRsBRE6NWGTvpDE/URfaTeQGb7qmVmCZE7euXK8UtAwJSJ",
+	"4/qcVIJZfAsBZrVmELVIVttlAY1hhufE1MgwZnY8lcambcNMx8SbXe8HfuG2lmbvpGfFATPrMJROaeUk",
+	"fS2chlGdmChoHRUuD1cbvY15vBVn5ZN7V5z/zfFGaIryeGwRCGp/ftAEinCNQj0vVCWAtmGE4SeSfR6G",
+	"1iMa1k2K34Dg0FJK47hwASJNlnppujMENCRbfmGpkZKlJRMN80eeLfYgo/qmQ1qrZVPLpYvAmVHVjPGW",
+	"yN+W4jOv352eVQ0MrG7Ql4RNKQxKCQnyeVNOpB5IksHmMkVhG3FKbLZY+rwnI+7afeilWyQSkHKRQXaI",
+	"m8HiyoToAFvUYemg2wrQriwTvG6WacrMxvuvkcHMkG6yV72I+S7Sl62E/5CCV5vYx9kub64k8P1H6Nvv",
+	"Yqt6KDzi1aYX4cU91FcSvTy/PDs6BHubmbeX95o8azzI68W9MzukE9OuiF0daT/EdezArL6S+sqrtcy+",
+	"3xZl2wYGj0fUjiIOJKwZEkQZTAhz6S8VQbsKjxsktjbJysZAWWg9oli1EZUuVquTPPL0sJ+Ootcmjh8A",
+	"v3YmhB2O+/a0GWA5yLDCCfJmyj8cdcZ57PgyQvq+srkvD9MkIVM1ZkcKcm1CH5R0bFWbLyzJtlKObz25",
+	"P+XYmYzsSqxp1RHRroTSqIyy4cJbGtvNyhHqGHxpidNXxl+1dWzVEOA3d0k2+1s84m25RE4HOFbdjKA1",
+	"O6s4atlyBshFE/JSDvwTZNQypAQm9GhXe4jzSg1tCWODmmiyi68TKX2d4iS4uyTCDOEpoFtYFJiIxPXT",
+	"NX9vLzybGI9GLTm2EfXFG+kNx+gMUwrC1kvEVADOFmiG56C/4YtYMHPtMMj06dLIjjCBXtbB0TwVbEXj",
+	"M1+X/yFO82ax6S98oC9VbI61GzYjcmAqNNe2HkDbxIBlAWEHoG/7MYQRgztf3Phf//gnIlKW4GnI00+N",
+	"dsISKip3hNtC4rbZXYPCP0laTj8P06pJSDQM44PzMN7NSDpzvUBM/4/EutUs2Zqy0rbfhm9vgUybD0PE",
+	"UzIHhpT3NRovM0PeAWwafBivHWFSAc4Qn6ApUagoKY0R6StQzQYnK/dWbAuIM7pwi5NhcURW67JNpp8/",
+	"f/7DUUtzfdu5ZOu23x8fUkRpQCJ2Kru2IBlQhQ9As69AOTJI6zM7iOIKnNsSZ7KTVHtJy2nv88cIZcuq",
+	"a8l0bZHxgQkwMdZB84Z1Jme+8K6d9hu5cmK3E6ZvmPLgePcfiuD9slPvlQOpth5y65q8fFliyHwLmGGt",
+	"GE5UEn4FaqVfzAMibuVbMSu5H4P84vfH03sGA8FLlg2UIIUJqdOCT4gFcm3+keA8NyFBqMBT2MPHWi9o",
+	"06qC+ACTTWf4j4QqEKY+Qr1ZoivEJZEeDSzDTMm2w3tXC3vIGNz2xVC1des3fTnetS8usXs5tg9drR7O",
+	"TGDO0AXJxr7y656m938rLam9qNoX0o5cTT5K5MFOXaiYJyg7tXJVOxsSz/319lVaEhvF/b+wKdFTUbst",
+	"0dRKy8BWzji/wtO2Kd2woRnjJjyIDZKhFeVgA1U0LUh+8DCojO1q8JnTbOtNQCq10/W3mgddOeVMav3c",
+	"xH3aqhRac05xgVOjAvuI76MEeUOWm926G6vqtCaiJaIzNxVlfQz63QWXe0ynCFUIvm7aX6kD8oXpf7VG",
+	"RftJ58qyJk2E/FpC+ahsEraAMNKvlSqQbv/t/z1L0F/fJSjU+DhCZqAp2rEvP3njfZsUGkjvAc0fbceX",
+	"w5mrB/R42HkVahkshxjvdMkdwE2ynPbge3TUTx0sINJ1pNY5pmoXkMHkxTUjlMIU08YkNpYbfffkBy3X",
+	"mukG1fOjY3Rho/im+iPXzB6IWitdVK8+R31/ygW4HEXPO729Xc+6B/b31JvHfHH7YBuDOI9Pdbc+Foc4",
+	"h1FV3kIzSK1TzFIXmYOcWkPT5XpQdbluO8L+qMd9sMM6eZNMQk1DDwngeW5KIZK8zHsn30dSuR5am1gO",
+	"EixsslFLk9jOVZnaCiXZD2xd1maLCJ3JxNbZ9ai1du2pwMUMZcTVSDuEUdvnjPgPkok1BbmDfYIJlV/0",
+	"OF8laB+AJjdfyKHQSjeKFkB3DuarEuGiHNEbc8MsoZKLSe4zJgbz5OPhTc/7qNzri7zvTMf1aQ/hZHxp",
+	"gI5EfVrT9zx40voauiggRx49IvFa23YQqYdVLncbFS8XWHvA63P5UxHsXTT9kFC4Y8jt4wDyPac0XsTO",
+	"mDqXhf4vhcqaadp045Xr44fP5649a4cT58HzrqJW0VrZkP8EAD+ybXPufCaPZdqc20zeAwb9viZScWGc",
+	"3eBZYWdHxNxCy+SetroDL21qwCUwheyGjtE5Tmf2+99IdEOyG58VbXvgC36HSIb6AmSZwzUzB9nNWy0q",
+	"mxkGb17eHCXoxoxeelcDNUE3GVY4PPnT5fu/XDPzKrLQPkavAQs1Bqz0uZUbOGvOW6Cn38tj9EeQagCT",
+	"CRfGDUvMk3/945/XzNSVhgwVIAayHOudjkGgcTmZgEhQJngx4DQDqVwS9cXvj16YNOhX51fIweyaKY7G",
+	"OL2dkLgr/tLAtO2wanXhBAigQsCE3O/rsbFKVvViAwVrZ9jMtgrulQXHoKKg9glX/bCX58i9eAiz/9wT",
+	"kJ0T9S8vz4/2YY4qOmqtn64atmsu5INHyH8lGSn/XldHyBJ9xOujoq1DOcbq1Lp1HGDS4uy4mgGaYZZR",
+	"EMveiX6I4TM0eJTYGF7p/BRDX/wwuWaYZQiImoFAwIw13F0LoRpz34azukThI8RFLYLwmoXMQWd7Mz4Q",
+	"XwiiORNh6Ma3l7sJUX+nVHIE9+avPsjFRvQITsEEoNlwLDvd+7+8/Ru6wws7Ruotxq4C55E4r6cdf5Xu",
+	"w+V2cF/ahVhx3BpW8N4T1M9tiVKXQR6cWIcQsj4EAqpTnyPtBfrX//v/VZqqTWzQf3JUu1WIbS3+sBq7",
+	"2SFSo6WHM/l2wsch7GIBxK5t3O+Q66C52xm1lz2hiYShbQn5IFnfZ2bqx0flWeh6eQBXu5kLYeQP12Ho",
+	"xYnqdRd2zC/WZ7NoTzA+N48vAbK9jTlLooMprMRtrFwTen87ffcW1VpvrdZoZYpTPt3lVXtHbv3ikrwR",
+	"FpDU9hEm7yKHaIiicakv+IMcrj4hAEk9sd6NtDWtUtdC4OUffaf/lx/QELmSQD4Sr5EqtpAK8k7EY+z5",
+	"605V08Rzk7J2qbAInth+3Q979ALxnChjTLubaYHBehD6toVRW/Sd4HwnoX6Ng+jZBgdRYmqUUlNo0Uqs",
+	"ne313WuTSrUwtZ0mXOS91bC8pU6hv3DCvB9k5P6mxbeCFyU1El5osXrs+j0mXTbhPhPfQ6jJuNw5oeuu",
+	"HjJ+vWopG+FI8xDNzdO9GfKyHFtK1ZQ7J7LElPzd1XIzPVDR75DpgbqDeV8zXtXjtI3zfqQA6rVH64OB",
+	"tNmuNQJWO+CAscVmY65Vrp/WmvVNRzdEWKa3wsU+ZrxQaHsoAYu0HdKX5nHozdnNYPFrb1kJ2M8K8BXo",
+	"9o3upIfzv70m6hCK+o8lpQOTP2LRaYu8BiRXXuq+FwFkglzHzwaLhle2oqFPwfvRISarTku/NXS+Ne1n",
+	"K8AfomIHpUFuk0OPM2Qb3SLFozGqXdEY52bTaDbq2erO1EYzskVpN3jn3rlBnU6Wzm62Dvd8KJl7EFEl",
+	"Lqf5lpmR+ANcKl6LP2g2ULUtPnZLuN7FifeYR2ujR+3heNFOiyQcqGaiIVaTkTewc6I8UO6u13Bd0Ws7",
+	"Nd9XutgBUeQYSUNx27wP0yApwhIhWK77hI120LGO3LU4ki3XutLSaRNlNSAS/XRji11IMKDuMDc88uRi",
+	"zMq13C19mdeW6/9WW22NRP2aulOnjZhZDAIC4ib9ekgtwtKlMI/yUjnFIBjeNefgQTCH3s2AoSrCdsUa",
+	"Xk+kubLa5VecTKNX+JgJNZbY1xboefbkWQc6tEbyeqXPvY22SiswagYVJRvFxubs1wi6O7027TVRih1+",
+	"0tdxrNRPRNpxKX5bCDqt4e2vschQBhSUKQDPuEKyLAouTBX3makL77rpSgT3RNp6BaEfSEjhtzEFL59H",
+	"WKMWer4bZ3yR8HO9tEcMQW/jiFrhoUfiiFrBooD1KlRyH05wVYnXByJc+EHbyN57FNfcMaKgW/zDbymS",
+	"wLfRf7w4gkAaB4oiKCpS8/RMwXWS2yyJ+LcPWrMt3ukESTwBtUBzTOfgjt7LV384OkanocC3Ps6LurSz",
+	"Iupcftd2WF+EXvRf/qRukmRrqeVfSywwU6ZRVbQjz2rPq6rhf63ZVa2zlfEjhTExtfZxyywHhvsab4mr",
+	"KiEJe0ZCfVdvHtAQVbBFw+omOerOa0t3h4uzCclvJYVuxf0/lBRk7yuoS68Xcsg0CbOvA9eZR6JsqmaV",
+	"e3WHgKqzoFw1GhSEr70wcrf+JHLNIW0RJzxRIFbzuv3J97xVH2uA+ivVyOpr3EYnexQ2v7DxD04balAJ",
+	"6mclpoOIM3stzXRg64eugroflTywdvJvSh6GIhx7H5IwXFzlOmPkqRtzCUoRNn3cs765lgMe92F3hyi4",
+	"bheJpJsT9W8JpQN5R1Q6SxCDOYiBr7lqKtoc7XAlxGXaD5hIE+foF0EkqtMLhQz1nz15hn5XhUIeo7f8",
+	"DkzxI6Js+oNbOrqZUj7G9FhPN8KpOkHXPT6ZXPdutAaLMxtTabc08oPQLbgsCn/tkDyHjGAFdKG//uTo",
+	"xFxNNbDYUpxmHnSHXXwMZuuLjpjTJkaeu50bejv6EaYXDRpt8ww9nNz6dfLIqcGmTdhRgthQ7UcUksPx",
+	"6GndV6dsnJAvGmT2/scfNUsEgtzv/BRE3g5MwO8GafkDkbdnbtxjphT7ZRxSUCbyFnkYHEheFvU5tzwa",
+	"NXoaycj2kKRgVd/lgr1ZI826W3KOaSm5bcDL2mSdvWeqheFtZcheIsXvYhVsa24mYIfpOXTOMi3V1Kfu",
+	"S1DSloEZKW51FxPJQiS6hcLeCDOT17g42qUsR5sade5aVlofWqQQzapfEPVnBAQW6WwxwHdYwNELlGKR",
+	"EYapbds34SKFrE2RWk9zX4ciVV/j4zi3mgUQvkj/iQZFuoilneq/+J4D6y6FSzemc0YgHCzTPPTUZhPe",
+	"S3p3zlSU9FJBFEmjvcYfJA++SyOg35KZ3+L8Ea38nugOVbk40PB2rXhqPGJTaHB6+yD5M6fprYN5HOvr",
+	"d25fPVy7ktO0itDEDng7dippQC8vrXRzcPC9KxXU4HcIJ4Re66hkitCuFeBbe0Qud8SvZt6jieOXpQgN",
+	"4EAKrsTK1dXbQxCFAMnp/GHo4oOd+8Ck0Y7mFWR+FchzUKjwl2NWYkoXu6JPq6obhAY7pFtrTGt+GZmo",
+	"0/947x/yWtdYecxb3VLFoS51Mxvqm5QqFRLrChD20dFuLn077UO7HywqvmJfe0EYg2zkoBqvibjqbteY",
+	"aPW1f33edccQX71v3dCkafBE9K8eKTu60WsUPnRTdTjN/+pHfn0H2M4HUtjT/vhyU3nbj6ktaPG2/TG0",
+	"Z96/SceTXZOfrszorY+if7dkDrPNA5KOA9shGB1YhjDDdCGJK19Iqc/hMJXJI4lU2yR0PGQyld4KpKUx",
+	"3eipx4AFiNNSzXonP3/UGLfd2O2HS0F7J70hLshw/tTQg9vPatsml9zv8s5DXoEpOWtK4dRt581t2LSa",
+	"lTgU23kNQuu3pOptRaSts0w4S3ybo1rhKNfLaHXO8+1SHdx8vMq++BS3e5gtuuJCfYtq4wNqdOeMLijU",
+	"oKh6K7hOjUnwUkrUzyAlGQxxqmrTQr1E06eWuEuztCB66fOsNkM431bfrztgkqVQoyQ4x6qpnBdldaKQ",
+	"IelIw+UJV7a6Wo7jp2jqlUxsxrL5bkZU4qoPJihk43tMNbgsBu6CC7X6nqvk8Pnj5/8OAAD//2XM3suJ",
+	"7gAA",
 }
 
 // GetSwagger returns the content of the embedded swagger specification file

internal/httpapi/impl.go

@@ -75,22 +75,31 @@ func (s *Server) resolveEntityID(ctx context.Context, idOrSlug string) (uuid.UUI
 	return id, err
 }
 
-// entityCols requires the entities table to be aliased as `e`.
+// entityCols requires the entities table to be aliased as `e`, with
+// entity_status left-joined and aliased as `st` (see withEntityStatus).
 const entityCols = `e.id, e.slug, e.type, e.name, e.state, e.attributes,
-                    e.maintenance_until, e.version, e.created_at, e.updated_at`
+                    e.maintenance_until, e.version, e.created_at, e.updated_at,
+                    st.health, st.last_check_at`
 
 func scanEntity(row pgx.Row) (gen.Entity, error) {
 	var e gen.Entity
 	var state *string
 	var attrsJSON []byte
 	var maint *time.Time
+	var health *string
+	var lastCheckAt *time.Time
 	err := row.Scan(&e.Id, &e.Slug, &e.Type, &e.Name, &state, &attrsJSON,
-		&maint, &e.Version, &e.CreatedAt, &e.UpdatedAt)
+		&maint, &e.Version, &e.CreatedAt, &e.UpdatedAt, &health, &lastCheckAt)
 	if err != nil {
 		return e, err
 	}
 	e.State = state
 	e.MaintenanceUntil = maint
+	if health != nil {
+		h := gen.EntityHealth(*health)
+		e.Health = &h
+	}
+	e.LastCheckAt = lastCheckAt
 	var attrs map[string]any
 	if len(attrsJSON) > 0 && json.Unmarshal(attrsJSON, &attrs) == nil && len(attrs) > 0 {
 		e.Attributes = &attrs
@@ -113,6 +122,7 @@ func (s *Server) ListEntities(ctx context.Context, req gen.ListEntitiesRequestOb
 		)
 		SELECT ` + entityCols + ` FROM entities e
 		JOIN entity_types et ON et.name = e.type
+		LEFT JOIN entity_status st ON st.entity_id = e.id
 		WHERE e.type IN (SELECT name FROM tt)
 		  AND ($2::text IS NULL OR e.state = $2)
 		  AND ($3::text IS NULL OR et.domain = $3)
@@ -159,7 +169,7 @@ func (s *Server) GetEntity(ctx context.Context, req gen.GetEntityRequestObject)
 		return nil, err
 	}
 	e, err := scanEntity(s.pool.QueryRow(ctx,
-		"SELECT "+entityCols+" FROM entities e WHERE e.id = $1", id))
+		"SELECT "+entityCols+" FROM entities e LEFT JOIN entity_status st ON st.entity_id = e.id WHERE e.id = $1", id))
 	if err != nil {
 		return nil, err
 	}
@@ -231,6 +241,7 @@ func (s *Server) GetBlastRadius(ctx context.Context, req gen.GetBlastRadiusReque
 		SELECT `+entityCols+`, b.depth
 		FROM blast_radius($1, $2) b
 		JOIN entities e ON e.id = b.entity_id
+		LEFT JOIN entity_status st ON st.entity_id = e.id
 		ORDER BY b.depth, e.slug`, id, depth)
 	if err != nil {
 		return nil, err
@@ -246,13 +257,20 @@ func (s *Server) GetBlastRadius(ctx context.Context, req gen.GetBlastRadiusReque
 		var state *string
 		var attrsJSON []byte
 		var maint *time.Time
+		var health *string
+		var lastCheckAt *time.Time
 		var d int
 		if err := rows.Scan(&e.Id, &e.Slug, &e.Type, &e.Name, &state, &attrsJSON,
-			&maint, &e.Version, &e.CreatedAt, &e.UpdatedAt, &d); err != nil {
+			&maint, &e.Version, &e.CreatedAt, &e.UpdatedAt, &health, &lastCheckAt, &d); err != nil {
 			return nil, err
 		}
 		e.State = state
 		e.MaintenanceUntil = maint
+		if health != nil {
+			h := gen.EntityHealth(*health)
+			e.Health = &h
+		}
+		e.LastCheckAt = lastCheckAt
 		var attrs map[string]any
 		if len(attrsJSON) > 0 && json.Unmarshal(attrsJSON, &attrs) == nil && len(attrs) > 0 {
 			e.Attributes = &attrs
@@ -283,10 +301,13 @@ func (s *Server) GetGraph(ctx context.Context, req gen.GetGraphRequestObject) (g
 		nodes, err = s.queryEntities(ctx, `
 			SELECT `+entityCols+`
 			FROM blast_radius($1, $2, $3) b JOIN entities e ON e.id = b.entity_id
+			LEFT JOIN entity_status st ON st.entity_id = e.id
 			ORDER BY e.slug`, rootID, depth, req.Params.RelType)
 	} else {
 		nodes, err = s.queryEntities(ctx, `
-			SELECT `+entityCols+` FROM entities e ORDER BY e.slug LIMIT $1`,
+			SELECT `+entityCols+` FROM entities e
+			LEFT JOIN entity_status st ON st.entity_id = e.id
+			ORDER BY e.slug LIMIT $1`,
 			graphNodeCap+1)
 		if err == nil && len(nodes) > graphNodeCap {
 			nodes = nodes[:graphNodeCap]
@@ -322,9 +343,44 @@ func (s *Server) GetGraph(ctx context.Context, req gen.GetGraphRequestObject) (g
 	if truncated {
 		resp.Truncated = &truncated
 	}
+
+	if req.Params.Include != nil {
+		for _, inc := range *req.Params.Include {
+			if inc == gen.Status {
+				health, herr := s.entityHealthByID(ctx, ids)
+				if herr != nil {
+					return nil, herr
+				}
+				resp.Health = &health
+				break
+			}
+		}
+	}
+
 	return resp, nil
 }
 
+// entityHealthByID returns entity_status.health keyed by entity id, for the
+// given id set (used by GetGraph's include=status).
+func (s *Server) entityHealthByID(ctx context.Context, ids []uuid.UUID) (map[string]gen.GraphViewHealth, error) {
+	health := make(map[string]gen.GraphViewHealth, len(ids))
+	rows, err := s.pool.Query(ctx,
+		`SELECT entity_id, health FROM entity_status WHERE entity_id = ANY($1)`, ids)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var id uuid.UUID
+		var h string
+		if err := rows.Scan(&id, &h); err != nil {
+			return nil, err
+		}
+		health[id.String()] = gen.GraphViewHealth(h)
+	}
+	return health, rows.Err()
+}
+
 func (s *Server) queryEntities(ctx context.Context, query string, args ...any) ([]gen.Entity, error) {
 	rows, err := s.pool.Query(ctx, query, args...)
 	if err != nil {
@@ -488,14 +544,18 @@ func (s *Server) GetFleetHealth(ctx context.Context, req gen.GetFleetHealthReque
 		Type        string                          `json:"type"`
 	}{}
 
+	// Exclude 'check' entities (internal probes) — only entities actually
+	// being monitored should count toward fleet health.
 	rows, err := s.pool.Query(ctx, `
 		SELECT e.slug, e.type, st.health, st.last_check_at
 		FROM entity_status st JOIN entities e ON e.id = st.entity_id
+		WHERE e.type <> 'check'
 		ORDER BY e.slug`)
 	if err != nil {
 		return nil, err
 	}
 	defer rows.Close()
+	stale := 0
 	for rows.Next() {
 		var slug, typ, health string
 		var lastCheck *time.Time
@@ -509,6 +569,8 @@ func (s *Server) GetFleetHealth(ctx context.Context, req gen.GetFleetHealthReque
 			resp.Summary.Degraded++
 		case "down":
 			resp.Summary.Down++
+		case "stale":
+			stale++
 		default:
 			resp.Summary.Unknown++
 		}
@@ -525,6 +587,9 @@ func (s *Server) GetFleetHealth(ctx context.Context, req gen.GetFleetHealthReque
 			Type:        typ,
 		})
 	}
+	if stale > 0 {
+		resp.Summary.Stale = &stale
+	}
 	return resp, rows.Err()
 }
 
@@ -920,6 +985,8 @@ func (s *Server) CreateEntity(ctx context.Context, req gen.CreateEntityRequestOb
 		return nil, eventErr
 	}
 
+	ensureDefaultChecks(ctx, tx, inserted.ID, slug, req.Body.Type, attrsJSON)
+
 	if err := tx.Commit(ctx); err != nil {
 		return nil, err
 	}
@@ -1184,6 +1251,8 @@ func (s *Server) EnrollClient(ctx context.Context, req gen.EnrollClientRequestOb
 		"info", "oikos-api", "",
 		map[string]any{"slug": req.Body.Slug, "type": current.Type})
 
+	ensureDefaultChecks(ctx, tx, id, req.Body.Slug, current.Type, attrsJSON)
+
 	if err := tx.Commit(ctx); err != nil {
 		return nil, err
 	}
@@ -1221,7 +1290,10 @@ func (s *Server) GetClientContext(ctx context.Context, req gen.GetClientContextR
 			for rows.Next() {
 				var p string
 				if scanErr := rows.Scan(&p); scanErr == nil {
-					if strings.HasPrefix(p, "tools/") && strings.HasSuffix(p, ".setup.sh") {
+					// Matches tools/setup-*.sh (the auto-setup convention —
+					// see tools/post-pull.sh). Was tools/*.setup.sh until
+					// 2026-07-12, which never matched any real filename.
+					if strings.HasPrefix(p, "tools/setup-") && strings.HasSuffix(p, ".sh") {
 						toolsChanged = append(toolsChanged, p)
 					} else if p == ".sops.yaml" {
 						sopsChanged = true

internal/httpapi/knowledge.go

@@ -2,16 +2,165 @@ package httpapi
 
 import (
 	"context"
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"strconv"
 
 	"github.com/dtoro/oikos/internal/httpapi/gen"
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
 )
 
+// serveRecentKnowledge backs the Knowledge page's "what the system knows / has
+// learned" view (a custom route, not part of the generated OpenAPI surface).
+// It returns recency-ordered knowledge with a small stats header so the
+// operator can literally watch the knowledge base grow — especially the notes
+// Nomos writes itself via upsert_knowledge (source='nomos-agent'), which is
+// the concrete evidence of "the system is getting better." Optional ?source=
+// and ?limit= query params.
+func (s *Server) serveRecentKnowledge(w http.ResponseWriter, req *http.Request) {
+	ctx := req.Context()
+	limit := 50
+	if l := req.URL.Query().Get("limit"); l != "" {
+		if n, err := strconv.Atoi(l); err == nil && n > 0 && n <= 200 {
+			limit = n
+		}
+	}
+	source := req.URL.Query().Get("source") // "" = all, "nomos-agent" = agent-authored only
+
+	type item struct {
+		Slug          string   `json:"slug"`
+		Title         string   `json:"title"`
+		Kind          string   `json:"kind"`
+		Source        string   `json:"source"`
+		Tags          []string `json:"tags"`
+		UpdatedAt     string   `json:"updated_at"`
+		AgentAuthored bool     `json:"agent_authored"`
+	}
+
+	// updated_at is cast to text in SQL — pgx v5 can't scan a timestamptz
+	// directly into a Go string (needs time.Time or an explicit cast), and
+	// that scan error was being silently swallowed below (every row skipped,
+	// endpoint returned 200 with an empty list and correct-looking stats
+	// since the stats query doesn't scan any timestamp column — found live).
+	rows, err := s.pool.Query(ctx, `
+		SELECT e.slug, ke.title, e.type, COALESCE(ke.source,''), ke.tags, ke.updated_at::text
+		FROM knowledge_entities ke
+		JOIN entities e ON e.id = ke.entity_id
+		WHERE ($1 = '' OR ke.source = $1)
+		ORDER BY ke.updated_at DESC
+		LIMIT $2`, source, limit)
+	if err != nil {
+		writeProblem(w, req, http.StatusInternalServerError, "query failed", err.Error())
+		return
+	}
+	defer rows.Close()
+	items := []item{}
+	for rows.Next() {
+		var it item
+		var src string
+		if err := rows.Scan(&it.Slug, &it.Title, &it.Kind, &src, &it.Tags, &it.UpdatedAt); err != nil {
+			slog.Error("httpapi: knowledge/recent row scan failed", "error", err)
+			continue
+		}
+		it.Source = src
+		it.AgentAuthored = src == "nomos-agent"
+		if it.Tags == nil {
+			it.Tags = []string{}
+		}
+		items = append(items, it)
+	}
+
+	// Stats header: total, by kind, agent-authored, and how many changed in the
+	// last 7 days (the "still learning" signal).
+	var total, agentAuthored, last7d int
+	byKind := map[string]int{}
+	srows, err := s.pool.Query(ctx, `
+		SELECT e.type, COUNT(*),
+		       COUNT(*) FILTER (WHERE ke.source = 'nomos-agent'),
+		       COUNT(*) FILTER (WHERE ke.updated_at > now() - interval '7 days')
+		FROM knowledge_entities ke JOIN entities e ON e.id = ke.entity_id
+		GROUP BY e.type`)
+	if err == nil {
+		defer srows.Close()
+		for srows.Next() {
+			var kind string
+			var c, a, l int
+			if srows.Scan(&kind, &c, &a, &l) == nil {
+				byKind[kind] = c
+				total += c
+				agentAuthored += a
+				last7d += l
+			}
+		}
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]any{
+		"stats": map[string]any{
+			"total":          total,
+			"by_kind":        byKind,
+			"agent_authored": agentAuthored,
+			"last_7d":        last7d,
+		},
+		"items": items,
+	})
+}
+
+// serveKnowledgeContent returns the full markdown body for a document/
+// investigation/runbook entity, by its own entity id or slug. Nothing else
+// exposes knowledge_entities.content — GetEntityKnowledge (below) answers a
+// different question ("what knowledge references THIS entity"), and
+// SearchKnowledge only returns a short ts_headline snippet. The KB detail
+// panel needs the entity's own full content when it IS a knowledge entity.
+func (s *Server) serveKnowledgeContent(w http.ResponseWriter, req *http.Request) {
+	ctx := req.Context()
+	// chi.URLParam returns the raw, still-percent-encoded segment (unlike
+	// the OpenAPI-generated routes, which decode via
+	// runtime.BindStyledParameterWithOptions before reaching the handler) —
+	// slugs like "document:containers/101-jellyfin" arrive as
+	// "document%3Acontainers%2F101-jellyfin" and must be unescaped here.
+	idOrSlug, err := url.PathUnescape(chi.URLParam(req, "id"))
+	if err != nil {
+		writeProblem(w, req, http.StatusBadRequest, "invalid id", err.Error())
+		return
+	}
+
+	var title, content, source string
+	var tags []string
+	var updatedAt string
+	err = s.pool.QueryRow(ctx, `
+		SELECT ke.title, ke.content, COALESCE(ke.source,''), ke.tags, ke.updated_at::text
+		FROM knowledge_entities ke
+		JOIN entities e ON e.id = ke.entity_id
+		WHERE e.slug = $1 OR e.id::text = $1`, idOrSlug).
+		Scan(&title, &content, &source, &tags, &updatedAt)
+	if err != nil {
+		writeProblem(w, req, http.StatusNotFound, "no knowledge content for entity", "")
+		return
+	}
+	if tags == nil {
+		tags = []string{}
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]any{
+		"title":      title,
+		"content":    content,
+		"source":     source,
+		"tags":       tags,
+		"updated_at": updatedAt,
+	})
+}
+
 func (s *Server) SearchKnowledge(ctx context.Context, request gen.SearchKnowledgeRequestObject) (gen.SearchKnowledgeResponseObject, error) {
 	q := request.Params.Q
 	limit := clampLimit(request.Params.Limit)
 
 	rows, err := s.pool.Query(ctx, `
-		SELECT e.slug, COALESCE(et.name,''), ke.title, ke.source, ke.tags,
+		SELECT e.id, e.slug, COALESCE(et.name,''), ke.title, ke.source, ke.tags,
 		       ts_rank(ke.search, plainto_tsquery('english', $1)) AS rank,
 		       ts_headline('english', ke.content, plainto_tsquery('english', $1),
 		         'MaxWords=40, MinWords=15, ShortWord=3, MaxFragments=3,
@@ -31,12 +180,13 @@ func (s *Server) SearchKnowledge(ctx context.Context, request gen.SearchKnowledg
 	items := []gen.KnowledgeHit{}
 
 	for rows.Next() {
+		var id uuid.UUID
 		var slug, eType, title, source string
 		var tags []string
 		var rank float32
 		var snippet *string
 
-		if err := rows.Scan(&slug, &eType, &title, &source, &tags, &rank, &snippet); err != nil {
+		if err := rows.Scan(&id, &slug, &eType, &title, &source, &tags, &rank, &snippet); err != nil {
 			return nil, err
 		}
 
@@ -49,6 +199,7 @@ func (s *Server) SearchKnowledge(ctx context.Context, request gen.SearchKnowledg
 		}
 
 		items = append(items, gen.KnowledgeHit{
+			Id:         id,
 			Slug:       slug,
 			Title:      title,
 			Type:       hitType,
@@ -72,7 +223,7 @@ func (s *Server) GetEntityKnowledge(ctx context.Context, request gen.GetEntityKn
 	entitySlug := request.EntityId
 
 	rows, err := s.pool.Query(ctx, `
-		SELECT e.slug, COALESCE(et.name,''), ke.title, ke.source, ke.tags
+		SELECT e.id, e.slug, COALESCE(et.name,''), ke.title, ke.source, ke.tags
 		FROM knowledge_entities ke
 		JOIN entities e ON e.id = ke.entity_id
 		JOIN entity_types et ON et.name = e.type
@@ -82,7 +233,7 @@ func (s *Server) GetEntityKnowledge(ctx context.Context, request gen.GetEntityKn
 		  AND r.valid_to IS NULL
 		  AND r.type IN ('documents', 'about')
 		UNION
-		SELECT e.slug, COALESCE(et.name,''), ke.title, ke.source, ke.tags
+		SELECT e.id, e.slug, COALESCE(et.name,''), ke.title, ke.source, ke.tags
 		FROM knowledge_entities ke
 		JOIN entities e ON e.id = ke.entity_id
 		JOIN entity_types et ON et.name = e.type
@@ -91,7 +242,7 @@ func (s *Server) GetEntityKnowledge(ctx context.Context, request gen.GetEntityKn
 		JOIN entities ent ON ent.type = target_type.name AND ent.slug = $1
 		WHERE r.valid_to IS NULL
 		  AND r.type = 'procedure-for'
-		ORDER BY 1`,
+		ORDER BY 2`,
 		entitySlug)
 	if err != nil {
 		return nil, err
@@ -100,10 +251,11 @@ func (s *Server) GetEntityKnowledge(ctx context.Context, request gen.GetEntityKn
 
 	items := []gen.KnowledgeHit{}
 	for rows.Next() {
+		var id uuid.UUID
 		var slug, eType, title, source string
 		var tags []string
 
-		if err := rows.Scan(&slug, &eType, &title, &source, &tags); err != nil {
+		if err := rows.Scan(&id, &slug, &eType, &title, &source, &tags); err != nil {
 			return nil, err
 		}
 
@@ -116,6 +268,7 @@ func (s *Server) GetEntityKnowledge(ctx context.Context, request gen.GetEntityKn
 		}
 
 		items = append(items, gen.KnowledgeHit{
+			Id:         id,
 			Slug:       slug,
 			Title:      title,
 			Type:       hitType,

internal/httpapi/learning_view.go

@@ -0,0 +1,129 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"sort"
+)
+
+// capabilityTimelineItem summarizes one verb's track record — when the
+// agent first succeeded at it, and how reliable it's been since. Derived
+// directly from executions (which has real, growing data) rather than the
+// patterns/skills tables, which are correctly modeled but have zero writers
+// anywhere in the codebase today — building against them now would ship a
+// permanently empty page. See plans/2026-07-10-general-gated-execution.md
+// step 8 evaluation.
+type capabilityTimelineItem struct {
+	Verb         string  `json:"verb"`
+	FirstSuccess *string `json:"first_success"`
+	Successes    int     `json:"successes"`
+	Total        int     `json:"total"`
+}
+
+// serveLearningTimeline backs the Learning page's capability timeline: one
+// row per distinct verb (parsed via splitAction, same helper the activity
+// feed uses), ordered by when it first succeeded — an honest "the system
+// learned to do X" signal without depending on the unpopulated patterns
+// table.
+func (s *Server) serveLearningTimeline(w http.ResponseWriter, req *http.Request) {
+	ctx := req.Context()
+	rows, err := s.pool.Query(ctx, `
+		SELECT action, status, created_at::text
+		FROM executions
+		ORDER BY created_at`)
+	if err != nil {
+		writeProblem(w, req, http.StatusInternalServerError, "query failed", err.Error())
+		return
+	}
+	defer rows.Close()
+
+	type agg struct {
+		firstSuccess *string
+		successes    int
+		total        int
+	}
+	byVerb := map[string]*agg{}
+	for rows.Next() {
+		var action, status, createdAt string
+		if err := rows.Scan(&action, &status, &createdAt); err != nil {
+			slog.Error("httpapi: learning/timeline row scan failed", "error", err)
+			continue
+		}
+		verb, _ := splitAction(action)
+		a, ok := byVerb[verb]
+		if !ok {
+			a = &agg{}
+			byVerb[verb] = a
+		}
+		a.total++
+		if status == "completed" {
+			a.successes++
+			if a.firstSuccess == nil {
+				ca := createdAt
+				a.firstSuccess = &ca
+			}
+		}
+	}
+
+	items := make([]capabilityTimelineItem, 0, len(byVerb))
+	for verb, a := range byVerb {
+		items = append(items, capabilityTimelineItem{
+			Verb: verb, FirstSuccess: a.firstSuccess, Successes: a.successes, Total: a.total,
+		})
+	}
+	// Verbs with at least one success sort by when that first happened;
+	// verbs that have never succeeded sort last (nothing to celebrate yet).
+	sort.Slice(items, func(i, j int) bool {
+		fi, fj := items[i].FirstSuccess, items[j].FirstSuccess
+		if fi == nil {
+			return false
+		}
+		if fj == nil {
+			return true
+		}
+		return *fi < *fj
+	})
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]any{"items": items})
+}
+
+type trendBucket struct {
+	Day       string `json:"day"`
+	Successes int    `json:"successes"`
+	Failures  int    `json:"failures"`
+}
+
+// serveLearningTrend backs the Learning page's 30-day success/fail trend
+// chart — a daily bucket of execution outcomes, straight off the executions
+// table.
+func (s *Server) serveLearningTrend(w http.ResponseWriter, req *http.Request) {
+	ctx := req.Context()
+	rows, err := s.pool.Query(ctx, `
+		SELECT date_trunc('day', created_at)::date::text AS day,
+		       COUNT(*) FILTER (WHERE status = 'completed') AS successes,
+		       COUNT(*) FILTER (WHERE status = 'failed') AS failures
+		FROM executions
+		WHERE created_at > now() - interval '30 days'
+		GROUP BY day
+		ORDER BY day`)
+	if err != nil {
+		writeProblem(w, req, http.StatusInternalServerError, "query failed", err.Error())
+		return
+	}
+	defer rows.Close()
+
+	items := []trendBucket{}
+	for rows.Next() {
+		var b trendBucket
+		if err := rows.Scan(&b.Day, &b.Successes, &b.Failures); err != nil {
+			slog.Error("httpapi: learning/trend row scan failed", "error", err)
+			continue
+		}
+		items = append(items, b)
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]any{"items": items})
+}

internal/httpapi/mutations_test.go

@@ -24,9 +24,7 @@ func do(t *testing.T, h http.Handler, method, path string, body any, headers map
 	}
 	req := httptest.NewRequest(method, path, rdr)
 	req.Header.Set("Content-Type", "application/json")
-	for k, v := range headers {
-		req.Header.Set(k, v)
-	}
+	applyHeaders(req, headers)
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 	var decoded map[string]any

internal/httpapi/pct_create_test.go

@@ -0,0 +1,119 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+// TestFlexBoolUnmarshal covers the exact production failure: the LLM emitted
+// `"privileged":0` / `"nesting":1` (numbers) and the strict bool field made the
+// already-approved pct_create execution fail to parse, so the LXC was never
+// created.
+func TestFlexBoolUnmarshal(t *testing.T) {
+	type cfg struct {
+		Privileged flexBool `json:"privileged"`
+		Nesting    flexBool `json:"nesting"`
+	}
+	cases := []struct {
+		in         string
+		privileged bool
+		nesting    bool
+		wantErr    bool
+	}{
+		{`{"privileged":0,"nesting":1}`, false, true, false},        // the prod payload
+		{`{"privileged":false,"nesting":true}`, false, true, false}, // canonical
+		{`{"privileged":"1","nesting":"0"}`, true, false, false},    // stringified
+		{`{"privileged":"true","nesting":"no"}`, true, false, false},
+		{`{}`, false, false, false}, // absent → zero
+		{`{"privileged":"maybe"}`, false, false, true},
+	}
+	for _, c := range cases {
+		var out cfg
+		err := json.Unmarshal([]byte(c.in), &out)
+		if (err != nil) != c.wantErr {
+			t.Fatalf("%s: err=%v wantErr=%v", c.in, err, c.wantErr)
+		}
+		if c.wantErr {
+			continue
+		}
+		if bool(out.Privileged) != c.privileged || bool(out.Nesting) != c.nesting {
+			t.Errorf("%s: got priv=%v nest=%v want priv=%v nest=%v",
+				c.in, bool(out.Privileged), bool(out.Nesting), c.privileged, c.nesting)
+		}
+	}
+}
+
+func TestResolveTemplate(t *testing.T) {
+	avail := []string{
+		"debian-12-standard_12.7-1_amd64.tar.zst",
+		"debian-13-standard_13.0-1_amd64.tar.zst",
+		"ubuntu-24.04-standard_24.04-2_amd64.tar.zst",
+	}
+	cases := []struct {
+		requested string
+		want      string
+	}{
+		{"debian-13-standard_13.0-1_amd64.tar.zst", "debian-13-standard_13.0-1_amd64.tar.zst"}, // exact
+		{"debian-13", "debian-13-standard_13.0-1_amd64.tar.zst"},                               // prefix
+		{"", "debian-13-standard_13.0-1_amd64.tar.zst"},                                        // auto newest debian
+		{"debian-99", "debian-13-standard_13.0-1_amd64.tar.zst"},                               // miss prefix → auto debian
+	}
+	for _, c := range cases {
+		if got := resolveTemplate(c.requested, avail); got != c.want {
+			t.Errorf("resolveTemplate(%q): got %q want %q", c.requested, got, c.want)
+		}
+	}
+	if got := resolveTemplate("debian-13", nil); got != "" {
+		t.Errorf("empty cache should yield empty, got %q", got)
+	}
+}
+
+// TestJSONErrValidForNastyOutput guards the bug where command output with
+// quotes/backslashes/newlines produced invalid JSON, failing the ::jsonb cast
+// and silently dropping the execution's final status update.
+func TestJSONErrValidForNastyOutput(t *testing.T) {
+	nasty := "CT 132 already exists on node \"hubris\"\n\tpath C:\\x\r\n\x00 100%"
+	for _, payload := range [][]byte{
+		jsonErr("%s", nasty),
+		jsonErr("list templates on %s: %s", "host:strong", nasty),
+	} {
+		var m map[string]any
+		if err := json.Unmarshal(payload, &m); err != nil {
+			t.Fatalf("jsonErr produced invalid JSON: %v\npayload=%s", err, payload)
+		}
+		if _, ok := m["error"]; !ok {
+			t.Errorf("missing error key: %s", payload)
+		}
+	}
+}
+
+// TestGatewayPreflightPassed guards the exact bug found live: "UNREACHABLE"
+// contains "REACHABLE" as a substring, so a strings.Contains(out,"REACHABLE")
+// check is true for BOTH outcomes and can never fail. Exact-match only.
+func TestGatewayPreflightPassed(t *testing.T) {
+	cases := []struct {
+		out  string
+		want bool
+	}{
+		{"PREFLIGHT_OK", true},
+		{"PREFLIGHT_OK\n", true},
+		{"  PREFLIGHT_OK  ", true},
+		{"PREFLIGHT_FAIL", false},
+		{"PREFLIGHT_FAIL\n", false},
+		{"", false},
+		{"some garbage output", false},
+		// the specific historical bug: a naive substring check on the old
+		// REACHABLE/UNREACHABLE markers would have called this true.
+		{"UNREACHABLE", false},
+	}
+	for _, c := range cases {
+		if got := gatewayPreflightPassed(c.out); got != c.want {
+			t.Errorf("gatewayPreflightPassed(%q) = %v, want %v", c.out, got, c.want)
+		}
+	}
+}
+
+// provisionScript and sanitizePkgs were removed when pct_create was made
+// atomic (create + start + register only) — installing packages and running
+// setup scripts is now the agent's own job via follow-up `run` calls, which
+// already has its own classifier/sanitization tests in internal/policy.

internal/httpapi/phase3.go

@@ -3,11 +3,13 @@ package httpapi
 import (
 	"context"
 	"crypto/sha256"
+	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"log/slog"
 	"os"
+	"strconv"
 	"strings"
 	"time"
 
@@ -16,6 +18,7 @@ import (
 	"github.com/dtoro/oikos/internal/domain"
 	"github.com/dtoro/oikos/internal/httpapi/gen"
 	"github.com/dtoro/oikos/internal/observability"
+	"github.com/dtoro/oikos/internal/safego"
 	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgtype"
@@ -27,6 +30,26 @@ var (
 	_sshKey  []byte
 )
 
+// flexBool accepts a JSON bool, number (0/1), or string ("true"/"1"/"yes").
+// LLMs routinely emit `"privileged": 0` instead of `false`; a strict `bool`
+// field made the approved pct_create execution fail to parse *after* the
+// operator had already approved it — the container was never created and the
+// operator saw "queued" with no result. This type tolerates the common shapes.
+type flexBool bool
+
+func (b *flexBool) UnmarshalJSON(data []byte) error {
+	s := strings.TrimSpace(strings.Trim(string(data), `"`))
+	switch strings.ToLower(s) {
+	case "true", "1", "yes", "on":
+		*b = true
+	case "false", "0", "no", "off", "", "null":
+		*b = false
+	default:
+		return fmt.Errorf("cannot parse %q as bool", s)
+	}
+	return nil
+}
+
 func initSSH() {
 	if _sshUser == "" {
 		_sshUser = os.Getenv("OIKOS_SSH_USER")
@@ -47,6 +70,14 @@ func initSSH() {
 	}
 }
 
+// sshExecTimeout bounds how long a single remote command may run. Without
+// this, a hung remote command (e.g. a piped install script stuck retrying
+// DNS against a misconfigured gateway) blocks the executing goroutine
+// forever: the execution never leaves 'approved'/'running', the operator
+// sees an unkillable spinner, and get_execution_status has nothing new to
+// report. Generous enough for a real apt/docker install; not infinite.
+const sshExecTimeout = 10 * time.Minute
+
 func sshExec(ctx context.Context, host, user, command string) (string, error) {
 	initSSH()
 	if len(_sshKey) == 0 {
@@ -81,11 +112,51 @@ func sshExec(ctx context.Context, host, user, command string) (string, error) {
 	}
 	defer session.Close()
 
-	out, err := session.CombinedOutput(command)
-	if err != nil && out == nil {
-		return "", fmt.Errorf("exec: %w", err)
+	type result struct {
+		out []byte
+		err error
+	}
+	done := make(chan result, 1)
+	go func() {
+		// See internal/mcp/server.go's sshExec for why this recovers rather
+		// than letting a rare SSH-library panic crash the whole api process.
+		defer func() {
+			if r := recover(); r != nil {
+				done <- result{nil, fmt.Errorf("panic in ssh exec: %v", r)}
+			}
+		}()
+		out, err := session.CombinedOutput(command)
+		done <- result{out, err}
+	}()
+
+	select {
+	case r := <-done:
+		text := strings.TrimSpace(string(r.out))
+		// A non-zero exit MUST surface as an error. The previous guard only
+		// errored when there was no output, so a `pct create` that printed
+		// "CT 132 already exists" and exited non-zero was reported as
+		// success — the execution was marked completed though nothing was
+		// provisioned.
+		if r.err != nil {
+			if text != "" {
+				return text, fmt.Errorf("%w: %s", r.err, text)
+			}
+			return text, fmt.Errorf("exec: %w", r.err)
+		}
+		return text, nil
+	case <-time.After(sshExecTimeout):
+		// Close the session/client to hang up the remote side; the
+		// goroutine above will eventually exit once that unblocks
+		// CombinedOutput, but we don't wait for it — the caller needs an
+		// answer now, not an indefinite hang.
+		session.Close()
+		client.Close()
+		return "", fmt.Errorf("timed out after %s waiting for command to finish on %s", sshExecTimeout, host)
+	case <-ctx.Done():
+		session.Close()
+		client.Close()
+		return "", ctx.Err()
 	}
-	return strings.TrimSpace(string(out)), nil
 }
 
 func resolveHostSSH(ctx context.Context, pool *db.Pool, entitySlug string) (string, string, error) {
@@ -120,28 +191,100 @@ func resolveHostSSH(ctx context.Context, pool *db.Pool, entitySlug string) (stri
 	return "", "", fmt.Errorf("no IP found for %s", entitySlug)
 }
 
+// resolveRunTarget mirrors internal/mcp.resolveExecTarget for the approved-
+// execution side: any target slug (host: or lxc:) resolves to the SSH
+// endpoint that runs the command plus a wrap function that turns a plain
+// shell command into what actually needs to be sent — identity for a host,
+// `pct exec <pve_id>` for an LXC. Kept as a small duplicate rather than a
+// cross-package import to avoid coupling httpapi to mcp for one helper.
+func resolveRunTarget(ctx context.Context, pool *db.Pool, targetSlug string) (host, user string, wrap func(string) string, err error) {
+	if strings.HasPrefix(targetSlug, "host:") {
+		host, user, err = resolveHostSSH(ctx, pool, targetSlug)
+		return host, user, func(cmd string) string { return cmd }, err
+	}
+	if strings.HasPrefix(targetSlug, "lxc:") {
+		var pveID, hostAttr string
+		// COALESCE the host column: many older LXC entities (seeded from
+		// inventory, not provisioned by pct_create) have pve_id but no host
+		// attribute at all. Scanning a SQL NULL into a plain string errors
+		// the whole row, wrongly reporting "missing pve_id" even when it was
+		// present — COALESCE avoids the NULL, "" is handled below.
+		if qerr := pool.QueryRow(ctx, "SELECT attributes->>'pve_id', COALESCE(attributes->>'host', '') FROM entities WHERE slug = $1", targetSlug).Scan(&pveID, &hostAttr); qerr != nil || pveID == "" {
+			return "", "", nil, fmt.Errorf("LXC not found or missing pve_id: %s", targetSlug)
+		}
+		hostSlug := hostAttr
+		if hostSlug == "" {
+			hostSlug = "hubris"
+		}
+		if !strings.HasPrefix(hostSlug, "host:") {
+			hostSlug = "host:" + hostSlug
+		}
+		host, user, err = resolveHostSSH(ctx, pool, hostSlug)
+		id := pveID
+		return host, user, func(cmd string) string {
+			b64 := base64.StdEncoding.EncodeToString([]byte(cmd))
+			return fmt.Sprintf("pct exec %s -- bash -c 'echo %s | base64 -d | bash'", id, b64)
+		}, err
+	}
+	return "", "", nil, fmt.Errorf("unsupported target %q: must be host:<slug> or lxc:<slug>", targetSlug)
+}
+
 // executeApprovedAction runs a gated action after operator approval.
 // Runs in a background goroutine to not block the HTTP response.
+// emitExecutionEvent records an execution lifecycle event for SSE fan-out so
+// the control room can watch approved actions run to completion live.
+func emitExecutionEvent(ctx context.Context, pool *db.Pool, execID uuid.UUID, status string, detail map[string]any) {
+	severity := "info"
+	if status == "failed" {
+		severity = "warning"
+	}
+	_ = observability.Event(ctx, sqlcgen.New(pool), "execution."+status, &execID, severity, "actuator", "", detail)
+	if status == "completed" || status == "failed" || status == "cancelled" {
+		closePlanStepForExecution(ctx, pool, execID, status)
+	}
+}
+
+// closePlanStepForExecution auto-closes a task plan step whose linked execution
+// just reached a terminal state, so the task board advances even if the agent
+// doesn't call update_plan_step itself (belt and suspenders — the agent links
+// the step to the execution when it starts it; the api finishes it here). Emits
+// plan.step.finished correlated to the step's session. No-op for the vast
+// majority of executions, which aren't plan steps.
+func closePlanStepForExecution(ctx context.Context, pool *db.Pool, execID uuid.UUID, execStatus string) {
+	stepStatus := "done"
+	if execStatus == "failed" || execStatus == "cancelled" {
+		stepStatus = "failed"
+	}
+	var stepID, sessionID string
+	var seq int
+	if err := pool.QueryRow(ctx, `
+		UPDATE session_plan_steps SET status = $2, finished_at = now()
+		WHERE execution_id = $1 AND status NOT IN ('done', 'failed', 'skipped')
+		RETURNING id::text, session_id::text, seq`, execID, stepStatus).Scan(&stepID, &sessionID, &seq); err != nil {
+		return // no matching open step
+	}
+	_ = observability.Event(ctx, sqlcgen.New(pool), "plan.step.finished", &execID, "info", "actuator", sessionID,
+		map[string]any{"step_id": stepID, "seq": seq, "status": stepStatus, "execution_id": execID.String()})
+}
+
 func executeApprovedAction(ctx context.Context, pool *db.Pool, execID uuid.UUID, targetSlug string, actionStr string) {
 	slog.Info("httpapi: executing approved action", "execution_id", execID, "target", targetSlug, "action", actionStr)
 
-	host, user, err := resolveHostSSH(ctx, pool, targetSlug)
+	host, user, wrap, err := resolveRunTarget(ctx, pool, targetSlug)
 	if err != nil {
 		slog.Error("httpapi: resolve host for approved execution", "error", err, "target", targetSlug)
 		pool.Exec(ctx, `UPDATE executions SET status='failed', result=$2::jsonb WHERE entity_id=$1`,
-			execID, fmt.Sprintf(`{"error":"%s"}`, err.Error()))
+			execID, jsonErr("%s", err.Error()))
+		emitExecutionEvent(ctx, pool, execID, "failed", map[string]any{"target": targetSlug, "error": err.Error()})
 		return
 	}
 
-	parts := strings.SplitN(actionStr, ":", 3)
-	if len(parts) < 2 {
-		slog.Error("httpapi: malformed action string", "action", actionStr)
+	idx := strings.Index(actionStr, ":")
+	if idx < 0 {
+		slog.Error("httpapi: malformed action string (no colon)", "action", actionStr)
 		return
 	}
-	action, params := parts[0], parts[1]
-	if len(parts) == 3 {
-		params = parts[1] + ":" + parts[2]
-	}
+	action, params := actionStr[:idx], actionStr[idx+1:]
 
 	startedAt := time.Now()
 	var output, cmd string
@@ -166,30 +309,379 @@ func executeApprovedAction(ctx context.Context, pool *db.Pool, execID uuid.UUID,
 		cmd = fmt.Sprintf("apt update -qq 2>&1 >/dev/null && apt upgrade -y -qq 2>&1; echo '---'; systemctl is-active %s || true", svc)
 		output, err = sshExec(ctx, host, user, cmd)
 
+	case "pct_create":
+		var cfg struct {
+			VMID        int      `json:"vmid"`
+			Hostname    string   `json:"hostname"`
+			Cores       int      `json:"cores"`
+			Memory      int      `json:"memory"`
+			DiskGB      int      `json:"disk_gb"`
+			IP          string   `json:"ip"`
+			GW          string   `json:"gw"`
+			Bridge      string   `json:"bridge"` // e.g. vmbr0/vmbr1 — which bridge actually reaches the target subnet on this host varies per host, don't assume vmbr0
+			Storage     string   `json:"storage"`
+			Template    string   `json:"template"`
+			Privileged  flexBool `json:"privileged"`
+			Nesting     flexBool `json:"nesting"`
+			Mounts      []string `json:"mounts"`
+			Nameserver  string   `json:"nameserver"`
+			Searchdomain string  `json:"searchdomain"`
+			// No services/post_install here anymore — pct_create is atomic
+			// (create + start + register only). Installing packages and
+			// running setup scripts is the agent's job via follow-up `run`
+			// calls against lxc:<hostname>, so each step is individually
+			// observable and recoverable instead of one opaque multi-minute
+			// black box. See the comment above the removed post-create block.
+		}
+		if err := json.Unmarshal([]byte(params), &cfg); err != nil {
+			slog.Error("httpapi: pct_create parse params", "error", err, "params", params)
+			pool.Exec(ctx, `UPDATE executions SET status='failed', result=$2::jsonb WHERE entity_id=$1`,
+				execID, jsonErr("invalid pct_create params: %v", err))
+			emitExecutionEvent(ctx, pool, execID, "failed", map[string]any{"target": targetSlug, "error": err.Error()})
+			return
+		}
+		// Only hostname is required. vmid is optional — when 0 (or later found
+		// to collide) the VMID guard below assigns a free cluster id.
+		if cfg.Hostname == "" {
+			pool.Exec(ctx, `UPDATE executions SET status='failed', result=$2::jsonb WHERE entity_id=$1`,
+				execID, `{"error":"pct_create: hostname is required"}`)
+			emitExecutionEvent(ctx, pool, execID, "failed", map[string]any{"target": targetSlug, "error": "missing hostname"})
+			return
+		}
+		if cfg.Cores == 0 {
+			cfg.Cores = 1
+		}
+		if cfg.Memory == 0 {
+			cfg.Memory = 512
+		}
+		if cfg.DiskGB == 0 {
+			cfg.DiskGB = 8
+		}
+		if cfg.Storage == "" {
+			cfg.Storage = "local-lvm"
+		}
+		if cfg.GW == "" {
+			cfg.GW = "192.168.8.2"
+		}
+		if cfg.Nameserver == "" {
+			cfg.Nameserver = "192.168.8.2"
+		}
+		if cfg.Searchdomain == "" {
+			cfg.Searchdomain = "hubris.network"
+		}
+		// Template pre-flight: resolve against what the host actually has
+		// cached. A hardcoded name (e.g. debian-13) fails opaquely with a raw
+		// `pct` error when that exact file isn't present. List the cache, then
+		// either validate the requested template or auto-pick the newest
+		// debian one; on miss, fail early with the available list so the
+		// operator/agent can retry with a real name.
+		cacheList, tplErr := sshExec(ctx, host, user, "ls -1 /var/lib/vz/template/cache/ 2>/dev/null | grep -E '\\.tar\\.(zst|gz|xz)$' || true")
+		available := []string{}
+		for _, l := range strings.Split(strings.TrimSpace(cacheList), "\n") {
+			if l = strings.TrimSpace(l); l != "" {
+				available = append(available, l)
+			}
+		}
+		if tplErr != nil {
+			pool.Exec(ctx, `UPDATE executions SET status='failed', result=$2::jsonb WHERE entity_id=$1`,
+				execID, jsonErr("list templates on %s: %s", targetSlug, tplErr.Error()))
+			emitExecutionEvent(ctx, pool, execID, "failed", map[string]any{"target": targetSlug, "error": tplErr.Error()})
+			return
+		}
+		cfg.Template = resolveTemplate(cfg.Template, available)
+		if cfg.Template == "" {
+			msg := fmt.Sprintf("no usable LXC template on %s. Available: %v", targetSlug, available)
+			pool.Exec(ctx, `UPDATE executions SET status='failed', result=$2::jsonb WHERE entity_id=$1`,
+				execID, jsonErr("%s", msg))
+			emitExecutionEvent(ctx, pool, execID, "failed", map[string]any{"target": targetSlug, "error": msg})
+			return
+		}
+
+		// VMID collision guard. Proxmox VMIDs are cluster-wide, so the model's
+		// guess (e.g. 132) can collide with a container on another node — pct
+		// create then fails with "CT N already exists on node X". Fetch the set
+		// of in-use VMIDs across the cluster; if the requested id is taken (or
+		// absent), fall back to the cluster's next free id so provisioning
+		// still succeeds instead of dead-ending on the operator's approval.
+		usedRaw, _ := sshExec(ctx, host, user, `pvesh get /cluster/resources --type vm --output-format json 2>/dev/null | grep -o '"vmid":[0-9]*' | grep -o '[0-9]*' || true`)
+		used := map[int]bool{}
+		for _, l := range strings.Fields(usedRaw) {
+			if n, e := strconv.Atoi(strings.TrimSpace(l)); e == nil {
+				used[n] = true
+			}
+		}
+		if cfg.VMID == 0 || used[cfg.VMID] {
+			nextRaw, nerr := sshExec(ctx, host, user, `pvesh get /cluster/nextid 2>/dev/null`)
+			nextID, cerr := strconv.Atoi(strings.TrimSpace(nextRaw))
+			if nerr != nil || cerr != nil || nextID == 0 {
+				msg := fmt.Sprintf("VMID %d is already in use on the cluster and could not resolve a free id", cfg.VMID)
+				pool.Exec(ctx, `UPDATE executions SET status='failed', result=$2::jsonb WHERE entity_id=$1`,
+					execID, jsonErr("%s", msg))
+				emitExecutionEvent(ctx, pool, execID, "failed", map[string]any{"target": targetSlug, "error": msg})
+				return
+			}
+			slog.Info("httpapi: pct_create VMID reassigned", "requested", cfg.VMID, "assigned", nextID)
+			cfg.VMID = nextID
+		}
+
+		privFlag := "--unprivileged 1"
+		if cfg.Privileged {
+			privFlag = "--unprivileged 0"
+		}
+
+		nestingFlag := ""
+		features := []string{}
+		if cfg.Nesting {
+			features = append(features, "nesting=1")
+		}
+		if cfg.Privileged {
+			features = append(features, "keyctl=1")
+		}
+		if len(features) > 0 {
+			nestingFlag = fmt.Sprintf(" --features %s", strings.Join(features, ","))
+		}
+
+		if cfg.Bridge == "" {
+			cfg.Bridge = "vmbr0"
+		}
+
+		// net0: DHCP when no static IP is given (or ip=="dhcp"). Proxmox
+		// rejects a gateway alongside ip=dhcp, so only add gw for a static IP.
+		net0 := "name=eth0,bridge=" + cfg.Bridge + ","
+		isStatic := cfg.IP != "" && !strings.EqualFold(cfg.IP, "dhcp")
+		if !isStatic {
+			net0 += "ip=dhcp"
+		} else {
+			net0 += "ip=" + cfg.IP
+			if cfg.GW != "" {
+				net0 += ",gw=" + cfg.GW
+			}
+		}
+
+		// Pre-flight: for a static config, ping the gateway from the target
+		// HOST, on the SPECIFIC BRIDGE being requested, before spending 5+
+		// minutes creating the container. This is the check that would have
+		// caught the real TypeType failure immediately instead of after a
+		// full provision attempt.
+		//
+		// Binding to the bridge (`ping -I <bridge>`) matters and was found
+		// live: a plain unqualified `ping <gw>` from the host can succeed via
+		// the host's own routing table (multiple routes, possibly through an
+		// upstream router) even when the *container* — which only gets a
+		// naive on-link default route via its bridge's veth — can never ARP
+		// that gateway at all. Confirmed on `strong`: bare `ping 192.168.8.2`
+		// succeeded (via the host's default route), but a container actually
+		// attached to vmbr0 showed 100% packet loss trying to reach the same
+		// address, because vmbr0 doesn't carry that subnet's L2 segment.
+		// Binding to the bridge interface reproduces what the container will
+		// actually experience, not what the host's broader routing table can
+		// reach.
+		if isStatic && cfg.GW != "" {
+			pingOut, pingErr := sshExec(ctx, host, user, fmt.Sprintf("ping -I %s -c1 -W2 %s >/dev/null 2>&1 && echo PREFLIGHT_OK || echo PREFLIGHT_FAIL", cfg.Bridge, cfg.GW))
+			if pingErr != nil || !gatewayPreflightPassed(pingOut) {
+				msg := fmt.Sprintf(
+					"gateway %s is not reachable from %s on bridge %s — this almost always means the bridge doesn't carry that subnet on this host (each bridge only reaches the network it's physically wired to). "+
+						"Do not retry with a different gateway guess in the same subnet: find an existing LXC on this host with an IP in the same /28 and copy its exact bridge+gateway, or use DHCP instead.",
+					cfg.GW, targetSlug, cfg.Bridge)
+				pool.Exec(ctx, `UPDATE executions SET status='failed', result=$2::jsonb WHERE entity_id=$1`,
+					execID, jsonErr("%s", msg))
+				emitExecutionEvent(ctx, pool, execID, "failed", map[string]any{"target": targetSlug, "error": msg})
+				return
+			}
+		}
+
+		templatePath := fmt.Sprintf("/var/lib/vz/template/cache/%s", cfg.Template)
+		createCmd := fmt.Sprintf(
+			"pct create %d %s --hostname %s --cores %d --memory %d --rootfs %s:%d %s --net0 %s%s --start 1",
+			cfg.VMID, templatePath, cfg.Hostname, cfg.Cores, cfg.Memory,
+			cfg.Storage, cfg.DiskGB, privFlag, net0, nestingFlag)
+
+		if cfg.Nameserver != "" {
+			createCmd += fmt.Sprintf(" --nameserver %s", cfg.Nameserver)
+		}
+		if cfg.Searchdomain != "" {
+			createCmd += fmt.Sprintf(" --searchdomain %s", cfg.Searchdomain)
+		}
+
+		// Add mount points
+		for i, mp := range cfg.Mounts {
+			if i < 10 { // pct supports up to mp9
+				createCmd += fmt.Sprintf(" --mp%d %s", i, mp)
+			}
+		}
+
+		slog.Info("httpapi: pct_create running", "vmid", cfg.VMID, "hostname", cfg.Hostname, "cmd", createCmd)
+		output, err = sshExec(ctx, host, user, createCmd)
+
+		// pct_create is now DELIBERATELY ATOMIC: create + start + register,
+		// nothing else. It used to also run apt installs and a post_install
+		// script inline as one black-box multi-minute SSH call — the agent
+		// got back a single opaque success/fail for the whole thing with no
+		// way to see (or fix) which step actually broke. That's the opposite
+		// of what makes an agent able to recover from errors.
+		//
+		// Installing packages, running post_install, and verifying the
+		// service now happen as the agent's OWN follow-up `run` calls against
+		// the new lxc:<hostname> target — each one is synchronous (in an
+		// active assent window) or individually gated, so the agent observes
+		// every step's real output and can diagnose + retry the exact thing
+		// that failed instead of re-doing the whole container. See SOUL.md
+		// "After pct_create: you drive the install" and provisionScript's
+		// surviving role (DNS self-heal) is now something the agent invokes
+		// itself via `run`, not something baked into this handler.
+		//
+		// cfg.Services/cfg.PostInstall are intentionally no longer read here.
+
+		// On success, register the entity in the DB with proper relationships
+		if err == nil {
+			slug := "lxc:" + cfg.Hostname
+			var lxcID uuid.UUID
+			lxcID, _ = uuid.NewV7()
+			attrs := map[string]any{
+				"pve_id": fmt.Sprintf("%d", cfg.VMID),
+				"host":   strings.TrimPrefix(targetSlug, "host:"),
+				"ip":     cfg.IP,
+			}
+			attrsJSON, _ := json.Marshal(attrs)
+			_, insErr := pool.Exec(ctx, `INSERT INTO entities (id, slug, type, name, state, attributes, enrolled_at)
+				VALUES ($1, $2, 'lxc', $3, 'provisioning', $4, now()) ON CONFLICT (slug) DO NOTHING`, lxcID, slug, cfg.Hostname, attrsJSON)
+			if insErr != nil {
+				slog.Error("httpapi: pct_create entity insert", "error", insErr, "slug", slug)
+			}
+
+			// Create hosts relationship: Proxmox host → LXC
+			var hostID uuid.UUID
+			if err := pool.QueryRow(ctx, "SELECT id FROM entities WHERE slug = $1", targetSlug).Scan(&hostID); err == nil {
+				_, relErr := pool.Exec(ctx, `INSERT INTO relationships (source_id, target_id, type, attributes, valid_from)
+					VALUES ($1, $2, 'hosts', '{"provisioned_by":"nomos"}'::jsonb, now())`, hostID, lxcID)
+				if relErr != nil {
+					slog.Error("httpapi: pct_create relationship insert", "error", relErr, "host", targetSlug, "lxc", slug)
+				}
+			}
+
+			// Create entity_status row for health tracking
+			pool.Exec(ctx, `INSERT INTO entity_status (entity_id, health, last_check_at)
+				VALUES ($1, 'unknown', now()) ON CONFLICT (entity_id) DO NOTHING`, lxcID)
+
+			emitExecutionEvent(ctx, pool, execID, "executing", map[string]any{
+				"lxc_slug": slug, "vmid": cfg.VMID, "host": targetSlug,
+			})
+
+			slog.Info("httpapi: pct_create entity registered", "slug", slug, "vmid", cfg.VMID, "host", targetSlug)
+		}
+
+	case "run":
+		// The general gated primitive: arbitrary shell against any host or
+		// LXC, approved and classified by internal/policy.ClassifyCommand at
+		// request time (see mcp/server.go's "run" tool). No fixed action
+		// enum — new capability doesn't require new Go code here.
+		var cfg struct {
+			Command string `json:"command"`
+			Purpose string `json:"purpose"`
+		}
+		if perr := json.Unmarshal([]byte(params), &cfg); perr != nil {
+			pool.Exec(ctx, `UPDATE executions SET status='failed', result=$2::jsonb WHERE entity_id=$1`,
+				execID, jsonErr("invalid run params: %v", perr))
+			emitExecutionEvent(ctx, pool, execID, "failed", map[string]any{"target": targetSlug, "error": perr.Error()})
+			return
+		}
+		cmd = wrap(cfg.Command)
+		output, err = sshExec(ctx, host, user, cmd)
+
 	default:
 		slog.Error("httpapi: unknown gated action for approved execution", "action", action, "execution_id", execID)
 		pool.Exec(ctx, `UPDATE executions SET status='failed', result=$2::jsonb WHERE entity_id=$1`,
-			execID, fmt.Sprintf(`{"error":"unknown action: %s"}`, action))
+			execID, jsonErr("unknown action: %s", action))
 		return
 	}
 
 	durationMs := int(time.Since(startedAt).Milliseconds())
-	result := fmt.Sprintf(`{"output":"%s"}`, strings.ReplaceAll(output, "\n", "\\n"))
 	status := "completed"
 	verified := true
+	// Build result via json.Marshal, not string interpolation. Command output
+	// (apt/pct) contains quotes, backslashes and control chars; the old
+	// fmt.Sprintf only escaped "\n", producing invalid JSON that failed the
+	// ::jsonb cast — so this UPDATE was silently discarded and the execution
+	// was stuck at "approved" forever even though provisioning succeeded.
+	resMap := map[string]any{"output": output}
 	if err != nil {
-		result = fmt.Sprintf(`{"output":"%s","error":"%s"}`, strings.ReplaceAll(output, "\n", "\\n"), err.Error())
+		resMap["error"] = err.Error()
 		status = "failed"
 		verified = false
 	}
+	resultJSON, _ := json.Marshal(resMap)
 
-	pool.Exec(ctx, `UPDATE executions SET status=$2, result=$3::jsonb, duration_ms=$4, verified=$5, started_at=$6, completed_at=$7 WHERE entity_id=$1`,
-		execID, status, result, durationMs, verified, startedAt, time.Now())
+	if _, uerr := pool.Exec(ctx, `UPDATE executions SET status=$2, result=$3::jsonb, duration_ms=$4, verified=$5, started_at=$6, completed_at=$7 WHERE entity_id=$1`,
+		execID, status, resultJSON, durationMs, verified, startedAt, time.Now()); uerr != nil {
+		slog.Error("httpapi: finalize execution status", "error", uerr, "execution_id", execID, "intended_status", status)
+	}
+
+	emitExecutionEvent(ctx, pool, execID, status, map[string]any{
+		"action": action, "target": targetSlug, "duration_ms": durationMs,
+	})
 
 	slog.Info("httpapi: approved action executed",
 		"execution_id", execID, "action", action, "status", status, "duration_ms", durationMs)
 }
 
+// jsonErr builds a valid {"error": "..."} JSON payload for an execution's
+// result column. Always use this instead of fmt.Sprintf'ing JSON by hand —
+// error text and command output routinely contain quotes/backslashes that
+// break a hand-built string and fail the ::jsonb cast.
+func jsonErr(format string, args ...any) []byte {
+	b, _ := json.Marshal(map[string]any{"error": fmt.Sprintf(format, args...)})
+	return b
+}
+
+// resolveTemplate maps a requested template name to one actually present in
+// the host's template cache. Exact match wins; a bare distro hint (e.g.
+// "debian-13" or "debian") matches by prefix; empty picks the newest debian
+// (falling back to any) template available. Returns "" when nothing fits.
+// gatewayPreflightPassed interprets the PREFLIGHT_OK/PREFLIGHT_FAIL markers
+// from the pct_create gateway pre-flight check. Pulled out as its own
+// function (rather than an inline strings.Contains at the call site) so it's
+// unit-testable: a prior version checked for "REACHABLE", which is a
+// substring of "UNREACHABLE" — the check could never actually fail, and it
+// took a live deployment to notice. Exact-match markers plus a test make
+// that specific bug class structurally unable to recur silently.
+func gatewayPreflightPassed(out string) bool {
+	return strings.TrimSpace(out) == "PREFLIGHT_OK"
+}
+
+func resolveTemplate(requested string, available []string) string {
+	if len(available) == 0 {
+		return ""
+	}
+	if requested != "" {
+		for _, a := range available {
+			if a == requested {
+				return a
+			}
+		}
+		for _, a := range available {
+			if strings.HasPrefix(a, requested) {
+				return a
+			}
+		}
+	}
+	// Auto-pick: prefer debian, then the lexically-greatest (newest version).
+	best := ""
+	for _, a := range available {
+		if strings.Contains(a, "debian") && a > best {
+			best = a
+		}
+	}
+	if best != "" {
+		return best
+	}
+	for _, a := range available {
+		if a > best {
+			best = a
+		}
+	}
+	return best
+}
+
 // ─── Checks ────────────────────────────────────────────────────────────
 
 func (s *Server) ListChecks(ctx context.Context, req gen.ListChecksRequestObject) (gen.ListChecksResponseObject, error) {
@@ -302,7 +794,7 @@ func (s *Server) CreateCheck(ctx context.Context, req gen.CreateCheckRequestObje
 	entity, err := q.InsertEntity(ctx, sqlcgen.InsertEntityParams{
 		ID:         id,
 		Slug:       slug,
-		Type:       "check_def",
+		Type:       "check",
 		Name:       slug,
 		Attributes: []byte("{}"),
 	})
@@ -678,7 +1170,10 @@ func (s *Server) RequestExecution(ctx context.Context, req gen.RequestExecutionR
 
 	q := sqlcgen.New(tx)
 
-	execSlug := "exec:" + id.String()[:8]
+	// Full UUID, not a truncated prefix — an 8-char prefix of a UUIDv7
+	// collides for real under back-to-back requests since the leading bytes
+	// encode a millisecond timestamp (observed live via the MCP run tool).
+	execSlug := "exec:" + id.String()
 	if _, err := q.InsertEntity(ctx, sqlcgen.InsertEntityParams{
 		ID:         id,
 		Slug:       execSlug,
@@ -947,27 +1442,75 @@ func (s *Server) DecideApproval(ctx context.Context, req gen.DecideApprovalReque
 		return nil, auditErr
 	}
 
+	// Emit for SSE fan-out (in-tx; NOTIFY fires post-commit).
+	if evErr := observability.Event(ctx, q, "approval.decided", &id, "info", "api", "",
+		map[string]any{"decision": status, "actor": actor}); evErr != nil {
+		return nil, evErr
+	}
+
 	// On approve: execute the linked gated command.
 	if status == "approved" {
 		var execID, targetID uuid.UUID
-		var actionStr, targetSlug string
+		var actionStr, targetSlug, riskClass string
 		err := tx.QueryRow(ctx, `
-			SELECT e.entity_id, e.target_entity_id, e.action
+			SELECT e.entity_id, e.target_entity_id, e.action, e.risk_class
 			FROM executions e
 			WHERE e.approval_id = $1 AND e.status = 'pending_approval'
-			LIMIT 1`, id).Scan(&execID, &targetID, &actionStr)
+			LIMIT 1`, id).Scan(&execID, &targetID, &actionStr, &riskClass)
 		if err == nil {
 			// Resolve target entity slug from targetID.
 			_ = tx.QueryRow(ctx, "SELECT slug FROM entities WHERE id = $1", targetID).Scan(&targetSlug)
 
-			go executeApprovedAction(context.Background(), s.pool, execID, targetSlug, actionStr)
-			_, _ = tx.Exec(ctx, `UPDATE executions SET status = 'approved', risk_class = 'config_mutation' WHERE entity_id = $1`, execID)
+			safego.Go("httpapi:executeApprovedAction", func() {
+				executeApprovedAction(context.Background(), s.pool, execID, targetSlug, actionStr)
+			})
+			// Status only — risk_class was set correctly at request time
+			// (e.g. by policy.ClassifyCommand for `run`); overwriting it to
+			// a hardcoded 'config_mutation' here corrupted the audit ledger
+			// for every other risk class, including destructive.
+			_, _ = tx.Exec(ctx, `UPDATE executions SET status = 'approved' WHERE entity_id = $1`, execID)
+
+			// Approving a plan step — by ANY route (this endpoint backs both
+			// the chat Approve button and chat-assent) — opens/extends the
+			// agent's assent window. This is the scope gate the Nomos
+			// auto-continuation worker checks: with the window open, the
+			// finished execution's result is fed back to the agent so it runs
+			// the plan to completion. Without opening it here, approving via
+			// the button (instead of typing "go ahead") would silently not
+			// auto-continue.
+			var agentID *uuid.UUID
+			if qerr := tx.QueryRow(ctx, "SELECT agent_id FROM executions WHERE entity_id = $1", execID).Scan(&agentID); qerr == nil && agentID != nil {
+				expires := time.Now().Add(30 * time.Minute).UTC().Format(time.RFC3339)
+				_, _ = tx.Exec(ctx, `INSERT INTO autonomy_settings (key, value) VALUES ($1, $2)
+					ON CONFLICT (key) DO UPDATE SET value = $2`, "assent_window.agent:"+agentID.String(), expires)
+
+				// Approving a DESTRUCTIVE step via the button is exactly as
+				// explicit as a typed "I confirm" — the operator affirmatively
+				// clicked Approve on a card that said DESTRUCTIVE. Open the
+				// same short, target-scoped destructive window chat-assent's
+				// typed-confirm path opens, for parity: a multi-step
+				// destructive recovery (stop, then destroy) shouldn't need a
+				// fresh confirmation per click any more than it needs one per
+				// typed phrase.
+				if riskClass == "destructive" && targetSlug != "" {
+					dExpires := time.Now().Add(15 * time.Minute).UTC().Format(time.RFC3339)
+					_, _ = tx.Exec(ctx, `INSERT INTO autonomy_settings (key, value) VALUES ($1, $2)
+						ON CONFLICT (key) DO UPDATE SET value = $2`,
+						"destructive_window.agent:"+agentID.String()+".target:"+targetSlug, dExpires)
+				}
+			}
 
 			slog.Info("httpapi: approved execution queued",
 				"execution_id", execID, "target", targetSlug, "action", actionStr)
 		} else {
 			slog.Warn("httpapi: no pending execution found for approval", "approval_id", id, "error", err)
 		}
+	} else {
+		// Denied/revoked: reflect it on the linked execution too. Previously
+		// only the approvals row changed, so the execution stayed
+		// 'pending_approval' forever — any UI/poller reading execution
+		// status (not approval status) never saw the decision.
+		_, _ = tx.Exec(ctx, `UPDATE executions SET status = $2, completed_at = now() WHERE approval_id = $1 AND status = 'pending_approval'`, id, status)
 	}
 
 	if err := tx.Commit(ctx); err != nil {
@@ -1814,10 +2357,6 @@ func (s *Server) QueryMetrics(ctx context.Context, req gen.QueryMetricsRequestOb
 	if req.Params.EntityId == nil || *req.Params.EntityId == "" {
 		return nil, fmt.Errorf("%w: entity_id is required", domain.ErrInvalidInput)
 	}
-	if req.Params.Metric == nil || len(*req.Params.Metric) == 0 {
-		return nil, fmt.Errorf("%w: metric is required", domain.ErrInvalidInput)
-	}
-
 	entityID, err := s.resolveEntityID(ctx, *req.Params.EntityId)
 	if err != nil {
 		return nil, err
@@ -1832,8 +2371,33 @@ func (s *Server) QueryMetrics(ctx context.Context, req gen.QueryMetricsRequestOb
 		to = *req.Params.To
 	}
 
+	var metricNames []string
+	if req.Params.Metric != nil && len(*req.Params.Metric) > 0 {
+		metricNames = *req.Params.Metric
+	} else {
+		// metric omitted: report every metric recorded for this entity in range.
+		rows, err := s.pool.Query(ctx, `
+			SELECT DISTINCT metric FROM metric_samples
+			WHERE entity_id = $1 AND ts >= $2 AND ts <= $3
+			ORDER BY metric`, entityID, from, to)
+		if err != nil {
+			return nil, err
+		}
+		for rows.Next() {
+			var name string
+			if err := rows.Scan(&name); err != nil {
+				rows.Close()
+				return nil, err
+			}
+			metricNames = append(metricNames, name)
+		}
+		if err := rows.Err(); err != nil {
+			return nil, err
+		}
+	}
+
 	items := []gen.MetricSeries{}
-	for _, metricName := range *req.Params.Metric {
+	for _, metricName := range metricNames {
 		series := gen.MetricSeries{
 			EntityId: entityID.String(),
 			Metric:   metricName,

internal/httpapi/phase3_test.go

@@ -154,6 +154,7 @@ func TestPhase4MCPEndpointAlive(t *testing.T) {
 	req := httptest.NewRequest("POST", "/mcp", strings.NewReader(body))
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("Accept", "application/json, text/event-stream")
+	req.Header.Set("Authorization", "Bearer "+testAuthToken)
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)