dtoro
aa6017e0ca
Problem: two issues surfaced after the dashboard-01 shell change (cbfd09c). (1) Sidebar.Inset previously had an explicit h-svh that hard-capped the app's height at the viewport; adding variant="inset" put a margin on that same fixed-height box, pushing it taller than the viewport with nothing left in the chain to cap it (Sidebar.Provider's own wrapper only sets min-h-svh — a floor, not a ceiling). Result: the whole page scrolled as one long document instead of each page's own content scrolling internally with the header pinned — confirmed via computed styles, e.g. Entities.svelte's table wrapper measured scrollHeight 6531px against a 900px viewport, all of it spilling past body instead of scrolling in its own rounded-border container. (2) The color palette was GitHub-dark-inspired (blue-tinted grays: #0d1117 bg, #58a6ff primary/accent) rather than the neutral grays the shadcn-svelte dashboard-01 reference actually uses. Change: - App.svelte: moved the height cap up to Sidebar.Provider itself (class="h-svh") instead of Sidebar.Inset, since the cap needs to sit above wherever the inset variant's margin gets applied, not on the same box as the margin. - app.css: replaced the core tokens (background/foreground/card/ popover/primary/secondary/muted/accent/border/input/ring/sidebar-*) with shadcn's canonical dark-theme OKLCH values (0-chroma neutral grays), pulled directly from huntabyte/shadcn-svelte's own docs/src/app.css rather than approximated. --success/--warning deliberately kept as real, distinguishable colors — they signal actual health state, and desaturating them to match the neutral chrome would reintroduce the "can't tell what's actually happening" problem this whole project started from (see279549c). --accent-blue now aliases --sidebar-primary (still a real blue) instead of --primary, so the couple of spots wanting an interactive "pop" still have one while buttons/links/focus rings ride the neutral --primary. Risk: reversible_low (UI-only). Verification: npx tsc --noEmit clean (excluding pre-existing unrelated .svelte type-resolution warnings). go build/vet clean (backend untouched, sanity check only). Manually verified in the browser preview at 1400px: document.body.scrollHeight now exactly matches window.innerHeight on both Overview and the 193-row Entities table (previously 6531px vs 900px); scrolled the Entities table wrapper to row ~60 and confirmed the header/filter bar/column headers stay pinned while only the table body scrolls; confirmed neutral gray rendering across Overview's stat cards, the event-rate chart, and Chat's tool-call list. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Oikos
Agentic homelab operating system written in Go. Single binary (cmd/oikos),
Docker-deployed on mac-mini, with a standalone Nomos MCP agent gateway
(cmd/nomos). Manages the hubris Proxmox homelab autonomously — observes
state, classifies actions against policy, executes approved procedures over SSH,
learns from outcomes, and escalates when uncertain.
For agents running on enrolled clients: start with AGENTS.md. For client machines: see CLIENTS.md. For developers: see CONTRIBUTING.md.
Quick start
# Dev stack (postgres + api + scheduler + notifier)
docker compose --profile dev up -d
# Full stack (adds Nomos agent gateway)
docker compose --profile full up -d
# Build standalone binary
go build -o bin/oikos -tags timetzdata ./cmd/oikos
# Run all roles in one process (dev mode)
OIKOS_DATABASE_URL="postgres://oikos:oikos_dev@localhost:5432/oikos?sslmode=disable" \
go run ./cmd/oikos all
Architecture
┌──────────────────────────────────┐
│ mac-mini (Docker) │
│ │
Workstation ─── │ nomos (8092) ──MCP── api (8090) │
(mesh) │ MCP gateway REST + MCP │
│ │
│ scheduler ── notifier ── postgres │
│ (observe) (Matrix) (Timescale)│
└──────────────────────────────────┘
| Component | Port | Role |
|---|---|---|
oikos api |
8090 | REST API + MCP server (15 tools) |
oikos scheduler |
— | Probe runner, signal lifecycle, metrics |
oikos notifier |
— | Approval tokens, Matrix alerts |
nomos serve |
8092 | MCP client gateway, query routing |
Phases
| Phase | Status | Description |
|---|---|---|
| 1 — Ontology + DB | ✅ | TimescaleDB, migrations, seeds, blast_radius |
| 2 — API | ✅ | OpenAPI-first REST + MCP, auth, SSE, audit |
| 3 — Control loop | ✅ | Scheduler, actuator, learning, classifier, notifier |
| 4 — Nomos agent | ✅ | Standalone MCP client gateway, agent activity |
| 5 — Secrets | ✅ | Infisical backend + SOPS fallback, rotation runbooks |
| 6 — Deploy | ✅ | CI pipeline, cutover checklist, watchdog, rollback |
Full plan: plans/2026-07-06-consolidate-oikos-control-plane-onto-mac-mini.md.
Operations
API endpoints
curl http://localhost:8090/api/v1/entities?type=service # fleet
curl http://localhost:8090/api/v1/health # fleet health
curl http://localhost:8090/api/v1/agent-activity # agent log
Nomos queries
# Structured tool call
curl -X POST localhost:8092/query -H "Content-Type: application/json" \
-d '{"tool":"get_blast_radius","args":{"entity_id":"service:authentik"}}'
# Natural language
curl -X POST localhost:8092/query -H "Content-Type: application/json" \
-d '{"query":"what depends on authentik?"}'
CLI
oikos migrate # apply DB migrations
oikos seed # ingest ontology/inventory/policy seeds
oikos export # export DB state to YAML
oikos api # serve REST + MCP
oikos scheduler # run observe loop
oikos notifier # run notification loop
oikos all # all roles in one process
oikos secret list # enumerate SOPS secrets
oikos secret migrate # SOPS → Infisical
Repo layout
cmd/oikos/ Go entry point — single binary
cmd/nomos/ Nomos MCP client gateway
internal/ Go packages (httpapi, mcp, scheduler, actuator, learning,
notifier, policy, secrets, db, config, ontology, domain,
knowledge)
api/openapi.yaml API contract (OpenAPI 3.1)
migrations/ Forward-only SQL migrations (TimescaleDB)
seeds/ Bootstrap YAML (ontology, inventory, policy, knowledge)
compose/ Dockerfiles + Caddy config
scripts/ Deploy, watchdog, verification, rollback
nomos/ Nomos config, persona, skills
.agents/ Agent instruction files, shared conventions, skills
archive/ Historical reference (legacy wiki, plans, SOPS backups)
plans/ Design documents (active + done)
docs/adr/ Architecture decision records
For agents
See AGENTS.md for the full orientation. Quick reference:
- Source of truth: DB (runtime) then seeds (bootstrap). Old wiki is
archived at
archive/knowledge/— use MCPsearch_knowledgeinstead. - Mutations: classify against policy, request approval for
destructive/config_mutation - Secrets: Infisical (primary) or SOPS (fallback) — never hardcode
Related
- OIKOS.md — operating model, OODA loop, ontology
- CLIENTS.md — client onboarding guide
- CONTRIBUTING.md — developer guide
- plans/ — design documents and cutover checklist
- docs/adr/ — architecture decision records