fix(contracts): Pulse port 3001→7655 (verified), jdownloader decommissioned from docker-vm → CT 118 LXC (.20)

Reviewed-on: #39

.gitignore

@@ -0,0 +1 @@
+__pycache__/

audit-hermes-config.py

@@ -0,0 +1,230 @@
+#!/usr/bin/env python3
+"""
+Hermes Config Audit — validates a live config.yaml against the prose contract rules.
+
+Usage:
+    python3 audit-hermes-config.py <config.yaml>
+    python3 audit-hermes-config.py /root/.hermes/config.yaml
+
+Exit codes:
+    0 = all checks pass
+    1 = one or more contract violations found
+
+This script encodes every rule from hermes-config-template.prose.md so config
+changes can be verified before and after application. It is the single automated
+enforcement layer for the prose contract.
+
+Contract: /root/prose-contracts/hermes-config-template.prose.md
+"""
+
+import sys
+import yaml
+
+VIOLATIONS = []
+WARNINGS = []
+PASSES = []
+
+
+def check(condition, rule, message):
+    if condition:
+        PASSES.append(f"[{rule}] {message}")
+    else:
+        VIOLATIONS.append(f"[{rule}] {message}")
+
+
+def warn(rule, message):
+    WARNINGS.append(f"[{rule}] {message}")
+
+
+def audit(path):
+    with open(path) as f:
+        cfg = yaml.safe_load(f)
+
+    model = cfg.get("model", {})
+    fb = cfg.get("fallback_providers", {})
+    comp = cfg.get("compression", {})
+    aux = cfg.get("auxiliary", {})
+    deleg = cfg.get("delegation", {})
+    cps = cfg.get("custom_providers", [])
+    cp = cps[0] if cps else {}
+
+    # --- Rule 3: API Keys via Environment ---
+    check(
+        model.get("api_key") in ("", None),
+        "Rule 3",
+        f"model.api_key must be empty (got {model.get('api_key')!r}) — keys via env var, not hardcoded",
+    )
+    check(
+        model.get("api_key_env") == "LITELLM_API_KEY",
+        "Rule 3",
+        f"model.api_key_env must be LITELLM_API_KEY (got {model.get('api_key_env')!r})",
+    )
+
+    # --- Rule 5: Main Config Base URL ---
+    expected_base = "http://192.168.68.116/v1"
+    check(
+        model.get("base_url") == expected_base,
+        "Rule 5",
+        f"model.base_url must be {expected_base} (got {model.get('base_url')!r}) — /v1 not /litellm/v1",
+    )
+
+    # --- Rule 6: max_tokens Is Required ---
+    check(
+        isinstance(model.get("max_tokens"), int) and model.get("max_tokens") <= 8192,
+        "Rule 6",
+        f"model.max_tokens must be set and <= 8192 (got {model.get('max_tokens')!r}) — thermal safety",
+    )
+
+    # --- Rule 7: Auxiliary Model Consistency ---
+    check(
+        comp.get("model") == "syslog-auto",
+        "Rule 7",
+        f"compression.model must be syslog-auto (got {comp.get('model')!r}) — auto-routing to prevent Strix Halo overload",
+    )
+    aux_comp = aux.get("compression", {})
+    check(
+        aux_comp.get("model") == "syslog-auto",
+        "Rule 7",
+        f"auxiliary.compression.model must be syslog-auto (got {aux_comp.get('model')!r}) — must match compression.model",
+    )
+
+    # --- Rule 8: GPU Workload Distribution ---
+    check(
+        aux.get("vision", {}).get("model") == "gpu-light",
+        "Rule 8",
+        f"auxiliary.vision.model must be gpu-light (got {aux.get('vision', {}).get('model')!r}) — RTX 5070 stable alias",
+    )
+    check(
+        aux.get("web_extract", {}).get("model") == "gpu-light",
+        "Rule 8",
+        f"auxiliary.web_extract.model must be gpu-light (got {aux.get('web_extract', {}).get('model')!r}) — RTX 5070 stable alias",
+    )
+
+    # --- Rule 9: Compression Threshold ---
+    check(
+        comp.get("threshold") == 0.65,
+        "Rule 9",
+        f"compression.threshold must be 0.65 for 128K models (got {comp.get('threshold')!r})",
+    )
+    check(
+        comp.get("max_context_window") == 131072,
+        "Rule 9",
+        f"compression.max_context_window must be 131072 (got {comp.get('max_context_window')!r}) — matches 128K GPU capacity",
+    )
+
+    # --- Rule 10: Default Model Must Be syslog-auto ---
+    check(
+        model.get("default") == "syslog-auto",
+        "Rule 10",
+        f"model.default must be syslog-auto (got {model.get('default')!r}) — auto-routing default",
+    )
+
+    # --- Rule 14: Provider Name Must Match custom_providers Name ---
+    check(
+        model.get("provider") == "harness",
+        "Rule 14",
+        f"model.provider must be 'harness' (got {model.get('provider')!r}) — NOT 'custom'. "
+        f"provider: custom causes generic resolution path that ignores key_env → 'no-key-required' → 401",
+    )
+    check(
+        comp.get("provider") == "harness",
+        "Rule 14",
+        f"compression.provider must be 'harness' (got {comp.get('provider')!r})",
+    )
+    for aux_name in ("vision", "web_extract", "compression"):
+        aux_provider = aux.get(aux_name, {}).get("provider")
+        check(
+            aux_provider == "harness",
+            "Rule 14",
+            f"auxiliary.{aux_name}.provider must be 'harness' (got {aux_provider!r})",
+        )
+    check(
+        deleg.get("provider") == "harness",
+        "Rule 14",
+        f"delegation.provider must be 'harness' (got {deleg.get('provider')!r})",
+    )
+    check(
+        fb.get("provider") == "deepseek",
+        "Rule 14",
+        f"fallback_providers.provider must be 'deepseek' (got {fb.get('provider')!r}) — "
+        f"true fallback diversity, not same endpoint as primary",
+    )
+    check(
+        fb.get("model") == "deepseek-v4-flash",
+        "Rule 14",
+        f"fallback_providers.model must be 'deepseek-v4-flash' (got {fb.get('model')!r})",
+    )
+    check(
+        fb.get("api_key_env") == "DEEPSEEK_API_KEY",
+        "Rule 14",
+        f"fallback_providers.api_key_env must be DEEPSEEK_API_KEY (got {fb.get('api_key_env')!r})",
+    )
+
+    # --- custom_providers sanity ---
+    check(
+        cp.get("name") == "harness",
+        "custom_providers",
+        f"custom_providers[0].name must be 'harness' (got {cp.get('name')!r})",
+    )
+    check(
+        cp.get("key_env") == "LITELLM_API_KEY" or cp.get("api_key_env") == "LITELLM_API_KEY",
+        "custom_providers",
+        f"custom_providers[0] must have key_env or api_key_env = LITELLM_API_KEY "
+        f"(got key_env={cp.get('key_env')!r}, api_key_env={cp.get('api_key_env')!r})",
+    )
+    check(
+        cp.get("base_url", "").endswith("/v1"),
+        "custom_providers",
+        f"custom_providers[0].base_url must end with /v1 (got {cp.get('base_url')!r})",
+    )
+
+    # --- No raw model names (Rule 7/8 spirit) ---
+    raw_names = {"gemma-4-12b", "qwen3.6-27B-code", "qwen3.6-35B-udq4", "ornith-1.0-35b"}
+    for section_path, section_dict in [
+        ("model", model), ("compression", comp),
+        ("auxiliary.vision", aux.get("vision", {})),
+        ("auxiliary.web_extract", aux.get("web_extract", {})),
+        ("auxiliary.compression", aux.get("compression", {})),
+        ("delegation", deleg),
+    ]:
+        m = section_dict.get("model", "")
+        if m in raw_names:
+            warn(
+                "Rule 7/8",
+                f"{section_path}.model = {m!r} — raw model name, use stable alias instead "
+                f"(gpu-light, gpu-dense, strix-moe, syslog-auto)",
+            )
+
+    # --- Report ---
+    print(f"{'=' * 60}")
+    print(f"Hermes Config Audit: {path}")
+    print(f"{'=' * 60}")
+    print(f"\n✅ PASSED ({len(PASSES)}):")
+    for p in PASSES:
+        print(f"  ✅ {p}")
+
+    if WARNINGS:
+        print(f"\n⚠️  WARNINGS ({len(WARNINGS)}):")
+        for w in WARNINGS:
+            print(f"  ⚠️  {w}")
+
+    if VIOLATIONS:
+        print(f"\n❌ VIOLATIONS ({len(VIOLATIONS)}):")
+        for v in VIOLATIONS:
+            print(f"  ❌ {v}")
+        print(f"\n{'=' * 60}")
+        print(f"RESULT: FAIL — {len(VIOLATIONS)} violation(s) must be fixed")
+        print(f"{'=' * 60}")
+        return 1
+    else:
+        print(f"\n{'=' * 60}")
+        print(f"RESULT: PASS — all contract rules satisfied")
+        print(f"{'=' * 60}")
+        return 0
+
+
+if __name__ == "__main__":
+    if len(sys.argv) < 2:
+        print("Usage: python3 audit-hermes-config.py <config.yaml>")
+        sys.exit(2)
+    sys.exit(audit(sys.argv[1]))

docs/AUTHORING-GUIDE.md

@@ -13,7 +13,7 @@ the description:
 
 1. **What system does this contract touch?** Name the hosts, CTs, containers,
    and services explicitly. "The inference fleet" is vague. "GPU .8 (RTX 3090,
-   qwen), .110 (RTX 5070, gemma), .15 (Strix Halo, ornith), and LiteLLM on CT
+   qwen), .110 (RTX 5070, gemma), .15 (Strix Halo, strix-moe), and LiteLLM on CT
    116" is specific.
 
 2. **Who runs this contract, and when?** State the agent, the trigger (cron,

hermes-agent-baseline.prose.md

@@ -25,8 +25,8 @@ done
 | Agent | CT | Node | IP | LiteLLM Alias | Key Source | Platform |
 |-------|-----|------|-----|---------------|------------|----------|
 | Tanko | 112 | amdpve | .122 | `tanko` | Infisical vault | Hermes |
-| Mumuni | 114 | hwepve | .123 | `mumuni` | Infisical vault | Hermes |
-| Koby | 111 | amdpve | srv1079750 | `koby` | Infisical vault | **Hermes** |
+| Mumuni | 100 | hwepve | .24 | `mumuni` | Infisical vault | Hermes |
+| Koby | 111 | amdpve | .129 | `koby` | Infisical vault | **Hermes** |
 | Koonimo | 113 | amdpve | .114 | `koonimo` | Infisical vault | Hermes |
 | Shumba | — | 192.168.68.119 | N/A | N/A (DeepSeek) | Hermes (RETIRED — CT119 now Infisical vault) |
 

hermes-config-template.prose.md

@@ -5,14 +5,11 @@ description: >
   Standard Hermes configuration template for Syslog Solution LLC agents.
   Enforces shared infrastructure setup (Firecrawl, SearXNG, local models,
   RA-H OS MCP) while keeping agent-specific API keys and model choices.
-  UPDATED 2026-07-18: Compression model switched to `syslog-auto` (was `strix-moe`)
-  to relieve Strix Halo pressure. syslog-auto distributes compression across the
-  weighted pool (55% RTX 3090, 30% Strix Halo, 15% RTX 5070).
-  UPDATED 2026-07-16: Compression model was the stable alias `strix-moe` (NOT `ornith-1.0-35b`,
+  UPDATED 2026-07-16: Compression model is the stable alias `strix-moe` (NOT `ornith-1.0-35b`,
   which LiteLLM does not serve). All 3 GPUs verified at 128K (reduced from 256K 2026-07-17 for stability).
   Added Rule 12 (Context-Issue Diagnostic) + Rule 13 (.env fallback enforcement) from the
   2026-07-16 Mumuni root-cause investigation (WAL #1300).
-  UPDATED 2026-07-12: GPU workload redistributed. Compression → Strix Halo (later switched to syslog-auto 2026-07-18). RTX 3090 context verified at 128K. Infisical .env fallback required (Rule 3/13).
+  UPDATED 2026-07-12: GPU workload redistributed. Compression → Strix Halo. RTX 3090 context verified at 128K. Infisical .env fallback required (Rule 3/13).
 ---
 
 ## Maintains
@@ -35,7 +32,7 @@ Sub-agent profiles inherit auth from the main config — no separate keys needed
 | Agent | Key Alias | Host | SSH | Sub-Agents |
 |-------|-----------|------|-----|-----------|
 | Tanko | `tanko-*` | 192.168.68.122 | jerome@.122 | — |
-| Mumuni | `mumuni` | 192.168.68.24 (CT100 abiba) | root@.24 | 6 profiles ✱ |
+| Mumuni | `mumuni` | 192.168.68.24 | root@.24 | 6 profiles ✱ |
 | Abiba | `abiba-pi` | 192.168.68.24 | local | — |
 | Koby | `koby` | CT 111 (tdunna) | Zulip | — |
 | Koonimo | `koonimo` | CT 113 (baggy) | SSH root | — |
@@ -133,9 +130,7 @@ mcp_servers:
 # ─── Compression ───
 compression:
   enabled: true
-  model: syslog-auto              # ⚠️ Switched from strix-moe 2026-07-18 to relieve Strix Halo.
-                                  # syslog-auto distributes across weighted pool (55% RTX 3090,
-                                  # 30% Strix Halo, 15% RTX 5070). All GPUs at 128K.
+  model: syslog-auto               # ⚠️ Must match auxiliary.compression.model. Stable alias (gpu-fleet § Stable Role-Based Aliases). NOT ornith-1.0-35b (LiteLLM does not serve that name).
   provider: harness
   max_context_window: 131072      # MUST match actual GPU capacity. All 3 GPUs are 128K (Jul 17).
   threshold: 0.65                 # Fires at ~170K for 262K window, ~85K for 128K
@@ -150,9 +145,8 @@ compression:
 #   model: gpu-light                 # stable alias (NOT raw "gemma-4-12b")
 #   base_url: http://192.168.68.116/v1
 #   api_key_env: LITELLM_API_KEY
-# Compression uses syslog-auto (switched from strix-moe 2026-07-18) to distribute
-# load across the weighted pool and relieve Strix Halo pressure.
-# Vision and web_extract use gpu-light = RTX 5070 (12B).
+# Do NOT use syslog-auto for auxiliary tasks — it routes to the primary GPU.
+# gpu-light = RTX 5070 (12B), freeing the Strix Halo for agent reasoning.
 # Heavy aux (delegation, x_search) use gpu-dense (RTX 3090) instead.
 # NEVER use raw model names (gemma-4-12b, qwen3.6-27B-code, qwen3.6-35B-udq4)
 # in agent configs — use the stable aliases so model swaps don't break agents.
@@ -172,7 +166,7 @@ auxiliary:
     timeout: 30
   compression:
     provider: harness
-    model: syslog-auto             # Switched from strix-moe 2026-07-18. Relieves Strix Halo pressure.
+    model: syslog-auto              # MUST match compression.model above. Stable alias for Strix Halo (weighted pool).
     base_url: http://192.168.68.116/v1   # Rule 5: /v1 NOT /litellm/v1
     api_key_env: LITELLM_API_KEY
     timeout: 300                 # gpu-fleet: 300s for large-history summarization (was 60)
@@ -253,30 +247,34 @@ The following MUST be identical across ALL profiles:
 - Apply to BOTH main config AND all sub-agent profiles
 - For agents needing longer outputs: raise to 8192, but never omit
 
-### Rule 7: Auxiliary Model Consistency (UPDATED 2026-07-18)
-- Vision and web_extract use `gpu-light` (stable alias, RTX 5070 — 12GB, vision-optimized)
-- Compression now uses `syslog-auto` (switched from `strix-moe` 2026-07-18) to distribute
-  compression load across the weighted pool (55% RTX 3090, 30% Strix Halo, 15% RTX 5070).
-  This relieves Strix Halo pressure while keeping compression functional on all GPUs.
-- **`syslog-auto` is the valid compression model** — LiteLLM serves it as the weighted pool.
-  Old configs with `strix-moe` for compression should be updated to `syslog-auto`.
+### Rule 7: Auxiliary Model Consistency (UPDATED 2026-07-16)
+- Vision and web_extract use `gemma-4-12b` (RTX 5070 — 12GB, vision-optimized)
+- Compression uses `strix-moe` (stable alias for Strix Halo — 64GB, 128K ctx, compression-optimized)
+- **`strix-moe` is the only valid compression model name** — LiteLLM does NOT serve `ornith-1.0-35b`
+  (it serves `strix-moe`, `qwen3.6-35B-udq4`, `gpu-dense`, `gpu-light`, `syslog-auto`, `gemma-4-12b`, `qwen3.6-27B-code`). Old configs with `ornith-1.0-35b` cause 403/model-not-found on compression calls.
+- **OPERATIONAL DECISION (2026-07-23): Use `syslog-auto` for compression across all agents.**
+  The `syslog-auto` alias routes to the Strix Halo, but uses the weighted pool instead of pinning
+  to `strix-moe` directly. This prevents sustained Strix Halo thermal load because the pool can
+  fall back to other GPUs if Strix gets hot. Both `compression.model` and `auxiliary.compression.model`
+  MUST be `syslog-auto`.
 - All auxiliary services MUST use identical routing:
   - `base_url: http://192.168.68.116/v1`  (Rule 5: `/v1`, NOT `/litellm/v1`)
   - `api_key_env: LITELLM_API_KEY`
-- **Compression via syslog-auto**: Routes through the weighted pool. Strix Halo still handles
-  ~30% of compression calls (at 60 RPM via pool vs 40 RPM direct), but the bulk (55%)
-  goes to RTX 3090 which has ample spare capacity.
+- **Do NOT use `syslog-auto`** for auxiliary tasks — it routes unpredictably
+- **Compression on Strix Halo**: The strix-moe alias routes to Strix Halo
+  (64GB UMA, 128K context) — the designated compression GPU. This frees the
+  RTX 5070 for vision and web search, and the RTX 3090 for heavy reasoning.
 - The `compression:` block's `model` MUST match `auxiliary: compression: model`
 - The `compression: max_context_window: 131072` MUST match actual GPU capacity (128K)
 
-### Rule 8: GPU Workload Distribution (UPDATED 2026-07-18)
-- **RTX 3090 (24GB, 128K ctx, qwen3.6-27B-code)**: Heavy reasoning, code gen, long conversations — also handles ~55% of compression via syslog-auto pool
-- **RTX 5070 (12GB, 128K ctx, gemma-4-12b)**: Vision, web search, quick tasks, web_extract — handles ~15% of compression via syslog-auto pool
-- **Strix Halo (64GB, 128K ctx, qwen3.6-35B-udq4)**: Agent reasoning, compression (~30% via syslog-auto pool), fallback for other GPUs
+### Rule 8: GPU Workload Distribution (UPDATED 2026-07-16)
+- **RTX 3090 (24GB, 128K ctx, qwen3.6-27B-code)**: Heavy reasoning, code gen, long conversations
+- **RTX 5070 (12GB, 128K ctx, gemma-4-12b)**: Vision, web search, quick tasks, web_extract (IQ4_NL+MTP, ~65% VRAM at 128K)
+- **Strix Halo (64GB, 128K ctx, syslog-auto)**: Context compression, summarization, long docs
 - Agent profiles MUST route auxiliary tasks to the correct GPU:
-  - `auxiliary.vision.model: gpu-light` (RTX 5070)
-  - `auxiliary.web_extract.model: gpu-light` (RTX 5070)
-  - `auxiliary.compression.model: syslog-auto` (distributed pool, switched from strix-moe 2026-07-18)
+  - `auxiliary.vision.model: gemma-4-12b` (RTX 5070)
+  - `auxiliary.web_extract.model: gemma-4-12b` (RTX 5070)
+  - `auxiliary.compression.model: syslog-auto` (Strix Halo)
 - Default model (`model.default`) and custom_provider remain `syslog-auto` for auto-routing
 - For 128K context window: `threshold: 0.65` (fires at ~85K tokens)
 - Do NOT use `threshold: 0.25` — this fires at 65K, causing premature context loss
@@ -378,6 +376,26 @@ curl -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $K" http://192.
 - `/etc/environment` is NO LONGER the canonical key source (stale values there caused 401s).
 - Do NOT leave a hardcoded stale key in `/etc/environment` — it shadows the drop-in/wrapper.
 
+### Rule 14: Provider Name Must Match custom_providers Name (ADDED 2026-07-19, WAL #1471)
+
+- `model.provider` MUST be `harness` (the `custom_providers[0].name`), NOT the literal string `custom`
+- When `provider: custom`, Hermes' `_get_named_custom_provider("custom")` returns None (no provider is
+  named "custom" — it is named "harness"), causing a fall-through to the generic resolution path
+  (`source: env/config`) at `runtime_provider.py:1156`
+- The generic path builds `api_key_candidates` from `model.api_key` (empty), host-gated
+  OLLAMA/OPENAI/OPENROUTER keys, and `_host_derived_api_key` (returns "" for IP addresses)
+- **The generic path does NOT resolve `model.api_key_env` or `custom_providers.key_env`** —
+  `LITELLM_API_KEY` is never read, producing `api_key = "no-key-required"` → HTTP 401
+- The named custom provider path (`source: custom_provider:harness`) DOES read `key_env` —
+  but only triggers when `provider` matches the `custom_providers[0].name`
+- All sections MUST use `provider: harness`: `model`, `compression`, `auxiliary.vision`,
+  `auxiliary.web_extract`, `auxiliary.compression`, `delegation`
+- Only `fallback_providers` uses a different provider (`deepseek`) for true fallback diversity
+- **Diagnostic**: If you see `source: env/config` in a request dump or log, the provider name
+  is wrong. It should be `source: custom_provider:harness`.
+- **Audit script**: Run `python3 /root/prose-contracts/audit-hermes-config.py <config.yaml>`
+  before and after any config change to catch this and all other rule violations.
+
 ## Execution
 
 1. **Check current config** — Read the target agent's config.yaml

hermes-zulip-plugin.prose.md

@@ -55,7 +55,7 @@ connectivity recovery including end-to-end DM validation.
 
 | Host | CT | Proxmox | IP (direct) | Hermes Home | User |
 |------|-----|---------|-------------|-------------|------|
-| Mumuni | CT114 | — | 192.168.68.123 | /root/.hermes | root |
+| Mumuni | CT100 | — | 192.168.68.24 | /root/.hermes | root |
 | Tanko | CT112 | amdpve | 192.168.68.122 | /home/jerome/.hermes | jerome |
 | Koby | CT111 | amdpve | 192.168.68.129 | /root/.hermes | root |
 | Shumba | — | — | 192.168.68.119 | /home/lucky/.hermes | lucky |

hermes-zulip-restore.prose.md

@@ -2,7 +2,7 @@
 kind: function
 name: hermes-zulip-restore
 description: >
-  Restores Zulip connectivity for any Hermes agent (Mumuni CT114, Tanko CT112,
+  Restores Zulip connectivity for any Hermes agent (Mumuni CT100, Tanko CT112,
   Koby CT111, Shumba on Lucky's mini PC). Deploys the zulip-platform adapter to the correct bundled plugin
   path, verifies env credentials, restarts the gateway, and confirms Zulip
   connects. Run this whenever a Hermes agent stops responding on Zulip or after

inference-optimization.prose.md

@@ -87,7 +87,7 @@ call apply-liteLLM-routing
 
 call apply-agent-compression
   agent: mumuni
-  host: 192.168.68.123
+  host: 192.168.68.24
   config_path: /root/.hermes/config.yaml
 
 -- Phase 4: Enable llama.cpp prompt caching on GPU hosts

infrastructure-control.prose.md

@@ -90,7 +90,7 @@ description: >
 
 ### Reachability Matrix
 
-| From / To | PVE API | docker-vm (.7) | CT 116 | Tanko (.122) | Mumuni (.123) | Baggy (.114) |
+| From / To | PVE API | docker-vm (.7) | CT 116 | Tanko (.122) | Mumuni (.24) | Baggy (.114) |
 |-----------|---------|----------------|--------|-------------|---------------|----------------|
 | **Abiba** (.24) | ✅ :443 | ✅ SSH | ✅ SSH | ✅ SSH jerome | ✅ SSH root | ❌ SSH |
 | **Tanko** (.122) | ❌ | ❌ | ❌ via NetBird | ✅ | ❌ | ❌ |
@@ -161,7 +161,7 @@ description: >
 |-------|------|-----------|
 | **Firecrawl** | `/opt/search-stack/firecrawl-source/` | api, rabbitmq, postgres, playwright, redis |
 | **SearXNG** | `/opt/search-stack/searxng/` | searxng, valkey |
-| **Home stack** | `/opt/home_stack/` | jdownloader, stirling-pdf, pulse |
+| **Home stack** | `/opt/home_stack/` | stirling-pdf, pulse (jdownloader decommissioned 2026-08-01 → dedicated CT 118 LXC) |
 | **Audiobookshelf** | `/opt/audiobookshelf/` | audiobookshelf |
 | **Trove agents** | docker run (standalone) | trove-agent-proxmox, trove-test-agent-1, trove-test-server-1, docker-stats |
 
@@ -178,11 +178,15 @@ description: >
 - Compose: `/opt/home_stack/docker-compose.yml`
 - Control script: `/opt/home_stack/infra-control.sh`
 
-**JDownloader**:
-- URL: `http://192.168.68.7:5800` (web UI via VNC)
+**JDownloader** (decommissioned from docker-vm 2026-08-01 — moved to dedicated CT 118 LXC):
+- LXC: CT 118 on storepve, `192.168.68.20` (JDownloader + VNC 5900 + web UI 6080)
+- Web UI: `http://192.168.68.20:6080` (noVNC via websockify)
+- Docker container `jdownloader-2` on .7 removed; compose entry stripped
 
-**Pulse** (Uptime Kuma):
-- URL: `http://192.168.68.7:3001`
+**Pulse**:
+- URL: `http://192.168.68.7:7655` (direct LAN)
+- Public: `https://pulse.sysloggh.net` (NetBird CNAME proxy)
+- Container: `rcourtman/pulse:5.1.35` in `/opt/home_stack` (port 7655, was 3001)
 
 ### Ecosystem B: CT 116 syslog-api (192.168.68.116)
 
@@ -368,7 +372,7 @@ fine. Services that resolve directly to a LAN IP are NetBird-independent.
 | Authentik | auth.sysloggh.net:443 | 192.168.68.11:9000 | CNAME → netbird | **Yes** | ⚠️ |
 | Gitea | git.sysloggh.net:443 | 192.168.68.17:3000 | CNAME → netbird | **Yes** | ⚠️ |
 | Zulip | chat.sysloggh.net:443 | 192.168.68.19 | CNAME → netbird | **Yes** | ⚠️ VERIFY-BEFORE-USE |
-| Pulse | pulse.sysloggh.net:443 | 192.168.68.7 | CNAME → netbird | **Yes** | ⚠️ |
+| Pulse | pulse.sysloggh.net:443 | 192.168.68.7:7655 | CNAME → netbird | **Yes** | ✅ verified 2026-08-01 |
 | DNS UI | dns.sysloggh.net:443 | 192.168.68.10:80 | CNAME → netbird | **Yes** | ⚠️ |
 | SearXNG | searxng.sysloggh.net:8888 | 192.168.68.7:8888 | LAN IP | No | ✅ |
 | Firecrawl | firecrawl.sysloggh.net:3002 | 192.168.68.7:3002 | LAN IP | No | ✅ |
@@ -606,7 +610,7 @@ ssh root@192.168.68.110 "systemctl restart llama-server"
 | 115 | scottdenya | amdpve | .75 | Denya OneCare | ❌ |
 | 116 | syslog-api | minipve | .116 | LiteLLM + Grafana | ❌ |
 | 117 | zulip | storepve | .19 | Chat | ❌ |
-| 118 | jdownloader | storepve | — | JDownloader container | ❌ |
+| 118 | jdownloader | storepve | .20 | JDownloader LXC (dedicated, migrated from docker-vm 2026-08-01) | ✅ |
 | 119 | infisical-vault | minipve | — | Vault | ❌ |
 
 ## Appendix C: Docker Compose Files Location

infrastructure-maintenance.prose.md

@@ -140,7 +140,7 @@ After ALL updates (apt + images + restarts), verify every critical service is ba
 | Zulip | `curl -sf https://chat.sysloggh.net/api/v1/server_settings` | 200 OK |
 | Gitea | `curl -sf https://git.sysloggh.net/api/v1/version` | 200 OK |
 | PM2 processes | `pm2 jlist` (CT 100) | all pi-agent processes `online` |
-| Hermes gateways | SSH to Mumuni CT 114, Tanko CT 112; `systemctl is-active hermes-gateway` | `active` for each |
+| Hermes gateways | SSH to Mumuni CT 100, Tanko CT 112; `systemctl is-active hermes-gateway` | `active` for each |
 
 Regression check: every service that was GREEN in `health-baseline` must still be GREEN. A service that was already RED (and caused a preflight abort) is excluded — but Phase 0 should have aborted before we got here.
 

infrastructure-update.prose.md

@@ -60,7 +60,7 @@ Before ANY update wave:
 | CT 100 (.24) | Abiba (pi) | `apt update && apt upgrade -y` | 3 min |
 | CT 116 (.116) | syslog-api (LiteLLM host) | `apt update && apt upgrade -y` | 3 min |
 | CT 112 (tanko, amdpve) | Tanko | `apt update && apt upgrade -y` | 3 min |
-| CT 114 (mumuni, hwepve) | Mumuni | `apt update && apt upgrade -y` | 3 min |
+| CT 100 (mumuni/abiba, hwepve) | Mumuni | `apt update && apt upgrade -y` | 3 min |
 | VM 101 (.8) | llm-gpu (RTX 3090) | `apt update && apt upgrade -y` | 3 min |
 | VM 103 (.110) | ocu-llm (RTX 5070) | `apt update && apt upgrade -y` | 3 min |
 
@@ -78,7 +78,7 @@ Before ANY update wave:
 |------|-------|---------|
 | VM 109 (.7) | Firecrawl | `cd /opt/search-stack/firecrawl-source && docker compose pull && docker compose up -d` |
 | VM 109 (.7) | SearXNG | `cd /opt/search-stack/searxng && docker compose pull && docker compose up -d` |
-| VM 109 (.7) | Home stack (Pulse, Stirling PDF, JDownloader 2) | `cd /opt/home_stack && docker compose pull && docker compose up -d` |
+| VM 109 (.7) | Home stack (Pulse, Stirling PDF) — JDownloader moved to CT 118 LXC 2026-08-01 | `cd /opt/home_stack && docker compose pull && docker compose up -d` |
 | VM 109 (.7) | Audiobookshelf | `cd /opt/audiobookshelf && docker compose pull && docker compose up -d` |
 | CT 116 (.116) | Inference Harness (LiteLLM, Prometheus, Grafana) | `cd /opt/inference-harness && docker compose pull && docker compose up -d` |
 | CT 117 (zulip, storepve) | Zulip | `docker pull zulip/docker-zulip:latest && docker restart zulip-zulip-1` |
@@ -160,7 +160,7 @@ Before Wave 1, snapshot these files:
 /opt/home_stack/docker-compose.yml                      (VM 109 .7)
 /opt/audiobookshelf/docker-compose.yml                  (VM 109 .7)
 /root/.pi/agent/extensions/config.yaml                  (CT 100 .24)
-/etc/systemd/system/ornith-server.service               (amdpve .15 — strix-moe)
+/etc/systemd/system/strix-server.service                (amdpve .15 — strix-moe)
 /etc/systemd/system/llama-server.service                (VM 101 .8, VM 103 .110)
 # Hermes agent configs (key enforcement — 2026-07-10)
 /root/.hermes/config.yaml                               (Mumuni CT 114, Tanko CT 112, etc.)

memory-fixer.prose.md

@@ -0,0 +1,71 @@
+---
+kind: pattern
+name: memory-fixer
+description: >
+  Auto-fix low-hanging fruit in the graph. No judgment calls — only deterministic Level 1 operations. 
+  Escalate anything that needs Kwame's input.
+version: 1.1.0
+---
+
+# Memory Fixer
+
+## Purpose
+Auto-fix low-hanging fruit in the graph. No judgment calls — only deterministic Level 1 operations. Escalate anything that needs Kwame's input.
+
+## Level 0 Auto-Deletes (Allowed Without Approval)
+Ephemeral heartbeat and log nodes that violate "Logs NEVER go in the graph":
+
+- `[LITELLM-HEALTH]`, `[GPU-SELF-HEAL]`, `[PM2-SELF-HEAL]`
+- `[PROXMOX-MONITOR]`, `[GPU-MONITOR]`, `[INFRA-MONITOR]`, `[AGENT-HEALTH]`, `[DISK-GC]`
+- `[WAL]` entries older than 30 days
+
+**Condition:** node must be an orphan (no edges). Deleting a connected node risks breaking other nodes.
+
+**Method:** direct SQLite on `.65` (MCP has no delete tool):
+```bash
+ssh root@192.168.68.65 "sqlite3 /root/.local/share/RA-H/db/rah.sqlite \"
+DELETE FROM nodes WHERE id IN (
+  SELECT id FROM nodes WHERE id NOT IN (SELECT from_node_id FROM edges)
+  AND id NOT IN (SELECT to_node_id FROM edges)
+  AND title LIKE '[LITELLM-HEALTH]%' -- add more prefixes as needed
+);\""
+```
+
+## Level 1 Auto-Fixes (No Judgment Required)
+
+### 1. Missing `type` Field
+For nodes with content but no `metadata.type`:
+- Title contains "Proxmox" or "infrastructure" → `type: infrastructure`
+- Title contains "skill" or "how to" or "guide" → `type: skill`
+- Title contains "doc" or "template" or "brand" → `type: documentation`
+- Title starts with "WAL:" or "TASK:" → `type: note`
+- Title starts with "[LEARN]" → `type: documentation`
+- Otherwise → `type: note` (default)
+
+### 2. Missing `tenant` / `namespace`
+For any node with NULL tenant or namespace:
+```sql
+UPDATE nodes 
+SET metadata = json_set(
+  COALESCE(metadata, '{}'),
+  '$.tenant', 'syslogsolution',
+  '$.namespace', 'syslogsolution'
+)
+WHERE json_extract(metadata, '$.tenant') IS NULL 
+   OR json_extract(metadata, '$.namespace') IS NULL;
+```
+
+### 3. Staleness State Transitions
+Using the type-based windows from the memory-monitor contract:
+- Nodes stale > their window → transition to `state: review_pending`
+- Nodes in `review_pending` for >7 days → escalate to Kwame (Level 2)
+
+## Level 2 Escalations (Kwame Decision Required)
+1. **Nodes in `review_pending` >7 days** — Archive, refresh, or keep?
+2. **Orphan Nodes >90 days old** — Delete or Connect?
+3. **Potential Duplicate Nodes** — Same title or >70% overlap. Merge or Keep?
+4. **Conflicting Metadata** — Content suggests one tenant but metadata says another.
+
+## Logging
+Every Level 1 fix logged to `~/.hermes/logs/memory-fixer/YYYY-MM-DD.md`
+Every Level 2 escalation logged and delivered to Kwame.

scripts/agent-health-check.py

@@ -49,7 +49,7 @@ AGENTS = {
 GPU_HOSTS = {
     "gpu-rtx3090 (.8)":     {"host": "192.168.68.8",   "port": 8080, "service": "llama-server"},
     "gpu-rtx5070 (.110)":   {"host": "192.168.68.110", "port": 8080, "service": "llama-server"},
-    "gpu-strixhalo (.15)":  {"host": "192.168.68.15",  "port": 8080, "service": "ornith-server"},
+    "gpu-strixhalo (.15)":  {"host": "192.168.68.15",  "port": 8080, "service": "strix-server"},
 }
 
 FAIL = []
@@ -57,6 +57,16 @@ FAIL = []
 INFISICAL_TOKEN = os.environ.get("INFISICAL_TOKEN")
 INFISICAL_API_URL = os.environ.get("INFISICAL_API_URL", "https://vault.sysloggh.net")
 
+# Fallback: if no env token, read the shared vault token file
+if not INFISICAL_TOKEN:
+    _token_path = os.path.expanduser("~/.infisical-token")
+    if os.path.isfile(_token_path):
+        try:
+            with open(_token_path) as _f:
+                INFISICAL_TOKEN = _f.read().strip()
+        except (OSError, UnicodeDecodeError):
+            pass
+
 # ── Helpers ──────────────────────────────────────────────────────────
 
 def ssh(host, cmd, user="root"):

scripts/daily-infra-report.py

@@ -313,8 +313,8 @@ def collect():
         "updated_at": tanko_data.get("updated_at"),
     }
     
-    # Mumuni (CT 114, IP 192.168.68.123)
-    mumuni_state = ssh("192.168.68.123", "cat ~/.hermes/gateway_state.json 2>/dev/null")
+    # Mumuni (CT 100, IP 192.168.68.24)
+    mumuni_state = ssh("192.168.68.24", "cat ~/.hermes/gateway_state.json 2>/dev/null")
     mumuni_data = {}
     try:
         mumuni_data = json.loads(mumuni_state) if mumuni_state else {}
@@ -322,7 +322,7 @@ def collect():
         mumuni_data = {}
     mumuni_platforms = mumuni_data.get("platforms", {})
     report["agents"]["mumuni"] = {
-        "platform": "hermes", "ct": 114, "ip": "192.168.68.123",
+        "platform": "hermes", "ct": 114, "ip": "192.168.68.24",
         "gateway_state": mumuni_data.get("gateway_state", "unknown"),
         "telegram_state": mumuni_platforms.get("telegram", {}).get("state", "unknown"),
         "zulip_state": mumuni_platforms.get("zulip", {}).get("state", "not_installed"),
@@ -330,7 +330,7 @@ def collect():
         "hermes_version": "",
     }
     # Get Hermes version
-    ver = ssh("192.168.68.123", "hermes --version 2>/dev/null | head -1")
+    ver = ssh("192.168.68.24", "hermes --version 2>/dev/null | head -1")
     if ver:
         report["agents"]["mumuni"]["hermes_version"] = ver.split("·")[0].replace("Hermes Agent ","").strip()
     

scripts/zulip-monitor.sh

@@ -100,7 +100,7 @@ else
 fi
 
 # ── Platform B: Hermes (Mumuni) ──
-MUMUNI_STATE=$(ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 root@192.168.68.123 \
+MUMUNI_STATE=$(ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 root@192.168.68.24 \
   "cat ~/.hermes/gateway_state.json 2>/dev/null" 2>/dev/null || echo "{}")
 MUMUNI_ZULIP=$(echo "$MUMUNI_STATE" | python3 -c "
 import sys,json