Merge PR #38: feat: add Level 0 auto-delete for heartbeat log orphans

Logs (LITELLM-HEALTH, GPU-SELF-HEAL, PM2) now pushed to SyslogSolution/health-logs
instead of creating orphan nodes in the shared knowledge graph.

- litellm-self-heal: Phase 4 now calls gitea-logger instead of kg-logger
- gpu-self-heal: Reporting section updated to Gitea path
- pm2-self-heal: Log step redirected to Gitea
- 271 existing orphan nodes remain in graph (no delete tool available)

disk-gc-threat-response.prose.md

@@ -35,8 +35,7 @@ Docker hosts get special attention:
 | All other CTs | — | LOW — no Docker | apt clean, log rotate |
 | GPU bare metal (.8, .110) | — | LOW — no Docker on GPU hosts | log rotate |
 
-> **Decommissioned:** CT 118 (jitsi) — intentionally stopped, not scanned.
-> **Migrated:** CT 101 (llm-gpu) → bare metal .8, CT 103 (ocu-llm) → bare metal .110.
+> **Note:** CT 118 is now jdownloader (active on storepve). CT 101 (llm-gpu) → bare metal .8, CT 103 (ocu-llm) → bare metal .110.
 
 ## Threat Levels
 
@@ -275,10 +274,10 @@ one-off GPU builds. No automated post-migration cleanup was in place.
 ### CT Access (via pct-run)
 | CT | Name | Node | Status |
 |----|------|------|--------|
-| 100 | abiba | amdpve | local |
-| 102 | adguard | acerpve | ✅ reachable |
+| 100 | abiba | hwepve | local |
+| 102 | adguard | minipve | ✅ reachable |
 | 104 | authentik | minipve | ✅ reachable |
-| 105 | kagentz | amdpve | ✅ reachable |
+| 105 | kagentz | hwepve | ✅ reachable |
 | 106 | ra-h-os | storepve | ✅ reachable |
 | 107 | pbs | storepve | ✅ reachable |
 | 108 | media | storepve | ✅ reachable |
@@ -286,7 +285,7 @@ one-off GPU builds. No automated post-migration cleanup was in place.
 | 111 | tdunna | amdpve | ✅ reachable |
 | 112 | tanko | amdpve | ✅ reachable |
 | 113 | baggy | amdpve | ✅ reachable |
-| 114 | mumuni | minipve | ✅ reachable |
+| 114 | mumuni | hwepve | ✅ reachable |
 | 115 | scottdenya | amdpve | ✅ reachable |
 | 116 | syslog-api | minipve | ✅ reachable |
 | 117 | zulip | storepve | ✅ reachable |
@@ -303,4 +302,4 @@ one-off GPU builds. No automated post-migration cleanup was in place.
 |------|-----|------|--------|
 | docker-vm | 192.168.68.7 | 16 Docker containers, 4 stacks | ✅ reachable |
 
-> **Decommissioned:** CT 118 (jitsi) — intentionally stopped.\n> **Migrated:** CT 101 → .8, CT 103 → .110 (bare metal GPU).\n> **KVM VM:** CT 109 (docker-vm) is a KVM VM, not LXC — access via SSH .7.
+> **Note:** CT 118 is now jdownloader (active on storepve). CT 119 (infisical-vault) added on minipve.\n> **Migrated:** CT 101 → .8, CT 103 → .110 (bare metal GPU).\n> **KVM VM:** CT 109 (docker-vm) is a KVM VM, not LXC — access via SSH .7.

docs/AUTHORING-GUIDE.md

@@ -185,7 +185,7 @@ what, and why should I care?
 
 ```
 ❌ "Monitors infrastructure health"
-✅ "Scans all 5 Proxmox nodes and 19 CTs for disk pressure, checks Docker
+✅ "Scans all 6 Proxmox nodes and 19 CTs for disk pressure, checks Docker
    container health on .7/.116/.17, alerts via Telegram DM on RED/CRITICAL"
 ```
 

gpu-self-heal.prose.md

@@ -251,8 +251,8 @@ call update-gpu-health
 
 ## Reporting
 
-### 1. Knowledge Graph
-Every action logged as `[GPU-SELF-HEAL] <run_id>` node with full audit trail.
+### 1. Gitea Log (not knowledge graph — hard rule)
+Pushed to `SyslogSolution/health-logs/gpu/{run_id}.json` — versioned, searchable, not in graph.
 
 ### 2. Zulip Alerts (#agent-hub → alerts-gpu)
 - `issues_fixed > 0` → "🛠 GPU Self-Heal — <gpu> <issue> resolved"

hermes-agent-baseline.prose.md

@@ -25,12 +25,12 @@ done
 | Agent | CT | Node | IP | LiteLLM Alias | Key Source | Platform |
 |-------|-----|------|-----|---------------|------------|----------|
 | Tanko | 112 | amdpve | .122 | `tanko` | Infisical vault | Hermes |
-| Mumuni | 100 (abiba) | hwepve | .24 | `mumuni` | Infisical vault | Hermes (Pi gateway) |
-| Koby | 129 | amdpve | srv1079750 | `koby` | Infisical vault | **Hermes** |
-| Koonimo | 114 | amdpve | ? | `koonimo` | Infisical vault | Hermes |
+| Mumuni | 114 | hwepve | .123 | `mumuni` | Infisical vault | Hermes |
+| Koby | 111 | amdpve | srv1079750 | `koby` | Infisical vault | **Hermes** |
+| Koonimo | 113 | amdpve | .114 | `koonimo` | Infisical vault | Hermes |
 | Shumba | — | 192.168.68.119 | N/A | N/A (DeepSeek) | Hermes (RETIRED — CT119 now Infisical vault) |
 
-> **Note**: CT hostnames (tdunna→CT129, baggy→CT114) differ from agent identities (koby, koonimo).
+> **Note**: CT hostnames (tdunna→CT111, baggy→CT113) differ from agent identities (koby, koonimo).
 
 Access: `pct-run <CT_ID> <command>` — no IPs needed. GPU hosts (.8, .110, .15) use SSH.
 Keys are stored in Infisical vault (project=agents, env=production) and injected at
@@ -169,9 +169,9 @@ pct-run <CT> grep -A8 "vision:" /root/.hermes/config.yaml | grep api_key
 # Must show both api_key: sk-... and api_key_env: LITELLM_API_KEY
 ```
 
-### For Koby (CT 129 / tdunna)
+### For Koby (CT 111 / tdunna)
 
-Koby runs Hermes on CT 129 (tdunna). Config files at `/root/.hermes/config.yaml`.
+Koby runs Hermes on CT 111 (tdunna). Config files at `/root/.hermes/config.yaml`.
 Same Hermes pattern as Tanko/Mumuni/Koonimo — see config sections above.
 
 **LiteLLM key**: alias `koby` in LiteLLM DB, injected via `infisical run --` wrapper.
@@ -253,7 +253,7 @@ EnvironmentFile=/etc/environment        # sources LITELLM_API_KEY
 
 Run the consolidated health check:
 ```bash
-python3 /root/scripts/agent-health-check.py  # v2: now checks all 5 agents including Koby/Koonimo SSH, CT liveness, config YAML, wrapper integrity, vault non-emptiness
+python3 /root/scripts/agent-health-check.py
 ```
 This validates all 4 LiteLLM keys, detects GPU port conflicts (ghost processes),
 verifies gateway liveness, confirms Zulip streaming (`edit_message` present),

hermes-config-template.prose.md

@@ -38,7 +38,7 @@ Sub-agent profiles inherit auth from the main config — no separate keys needed
 | Mumuni | `mumuni` | 192.168.68.24 (CT100 abiba) | root@.24 | 6 profiles ✱ |
 | Abiba | `abiba-pi` | 192.168.68.24 | local | — |
 | Koby | `koby` | CT 111 (tdunna) | Zulip | — |
-| Koonimo | `koonimo` | CT 114 (baggy) | SSH root | — |
+| Koonimo | `koonimo` | CT 113 (baggy) | SSH root | — |
 | Kagenz0 | `kagenz0-*` | ? | Zulip | — |
 
 > CT hostnames (tdunna, baggy) differ from agent identities (koby, koonimo).

infrastructure-control.prose.md

@@ -13,10 +13,10 @@ description: >
   against the live system. Policy fields are authoritative. See the
   `verify-before-mutate` skill.
 
-  **Last verified:** 2026-07-27 — gpu-dense swapped to SmartCode-Fable-5
-  (Qwen3.6-27B distilled, ~50% fewer thinking tokens, improved coding reasoning).
-  Model pricing reduced 100x across all models ($0.15/$0.60 per 1M tokens).
-  All LiteLLM models set to 128K max_model_tokens. See data/learnings.md.
+  **Last verified:** 2026-07-24 — corrected Gitea IP (.17 not .110),
+  AdGuard IP (.10 not .102), AdGuard placement (minipve not acerpve),
+  Abiba placement (hwepve not amdpve), added hwepve as 6th node,
+  added dns.sysloggh.net route.
 ---
 
 # Infrastructure Control Pattern
@@ -34,7 +34,7 @@ description: >
    ┌─────────────┐    ┌──────────────┐    ┌──────────────┐
    │   Abiba     │    │   Tanko      │    │   Mumuni     │
    │   (pi)      │    │   (Hermes)   │    │   (Hermes)   │
-   │   CT 100    │    │   CT 112     │    │   CT 100     │
+   │   CT 100    │    │   CT 112     │    │   CT 114     │
    └──────┬──────┘    └──────┬───────┘    └──────┬───────┘
           │                  │                    │
           └──────────────────┼────────────────────┘
@@ -72,7 +72,7 @@ description: >
 | docker-vm (.7) | SSH root | SSH key | ✅ |
 | CT 116 (syslog-api) | SSH root | SSH key | ✅ |
 | Tanko CT (.122) | SSH jerome | id_ed25519 | ✅ |
-| Mumuni (inside CT100 abiba .24) | SSH root | id_ed25519 | ✅ |
+| Mumuni CT (.123) | SSH root | id_ed25519 | ✅ |
 | Baggy CT (113) | SSH jerome | ❌ no key access |
 | Netbird (.17) | SSH root | SSH key | ✅ |
 | Gitea | API token | Infisical vault (`GITEA_BOT_TOKEN`) | ✅ |
@@ -90,11 +90,11 @@ description: >
 
 ### Reachability Matrix
 
-| From / To | PVE API | docker-vm (.7) | CT 116 | Tanko (.122) | Mumuni (.24) | Baggy (.114) |
+| From / To | PVE API | docker-vm (.7) | CT 116 | Tanko (.122) | Mumuni (.123) | Baggy (.114) |
 |-----------|---------|----------------|--------|-------------|---------------|----------------|
 | **Abiba** (.24) | ✅ :443 | ✅ SSH | ✅ SSH | ✅ SSH jerome | ✅ SSH root | ❌ SSH |
 | **Tanko** (.122) | ❌ | ❌ | ❌ via NetBird | ✅ | ❌ | ❌ |
-| **Mumuni** (.24) | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ |
+| **Mumuni** (.123) | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ |
 
 **Conclusion:** Only Abiba has cross-infrastructure access. All monitoring contracts run from Abiba.
 
@@ -109,12 +109,12 @@ description: >
 | storepve | .6 | 28C | 31GB | docker-vm, ra-h-os, PBS, media, jdownloader, zulip | Docker, storage, chat |
 | acerpve | .9 | 28C | 31GB | llm-gpu | GPU VMs |
 | ocupve | .5 | 12C | 14GB | ocu-llm | GPU VMs |
-| hwepve | .4 | ? | ? | abiba, (mumuni CT 114 stopped) | Agents (new node) |
+| hwepve | .4 | 12C | 15GB | abiba, kagentz, (mumuni CT 114 stopped) | Agents (new node) |
 
 > **Note:** CTs on storepve include jdownloader (CT 118). AdGuard (CT 102) is on
-> minipve at .10, not acerpve. Abiba (CT 100) is on hwepve and now runs Mumuni
-> Zulip gateway internally. CT 114 (old mumuni container) destroyed 2026-07-26.
-> Mumuni now runs inside Abiba CT100 (.24). Old CT114 destroyed 2026-07-26.
+> minipve at .10, not acerpve. Abiba (CT 100) is on hwepve, not amdpve. Mumuni
+> (CT 114) is on hwepve (currently stopped), not minipve. Mumuni also has a
+> second instance on minipve at .123 — distinguish by CT ID, not hostname.
 
 ### Checks (every 5 min)
 
@@ -365,7 +365,7 @@ fine. Services that resolve directly to a LAN IP are NetBird-independent.
 |---------|--------|-------------|-------------|-------------|--------|
 | Proxmox API | minipve.sysloggh.net:8006 | 192.168.68.12 | LAN IP | No | ✅ |
 | LiteLLM | litellm.sysloggh.net | 192.168.68.116 | LAN IP | No | ✅ |
-| Authentik | auth.sysloggh.net:443 | 192.168.68.11 | CNAME → netbird | **Yes** | ⚠️ |
+| Authentik | auth.sysloggh.net:443 | 192.168.68.11:9000 | CNAME → netbird | **Yes** | ⚠️ |
 | Gitea | git.sysloggh.net:443 | 192.168.68.17:3000 | CNAME → netbird | **Yes** | ⚠️ |
 | Zulip | chat.sysloggh.net:443 | 192.168.68.19 | CNAME → netbird | **Yes** | ⚠️ VERIFY-BEFORE-USE |
 | Pulse | pulse.sysloggh.net:443 | 192.168.68.7 | CNAME → netbird | **Yes** | ⚠️ |
@@ -586,8 +586,6 @@ ssh root@192.168.68.110 "systemctl restart llama-server"
 
 ## Appendix B: CT Inventory
 
-| CT | Name | Node | IP | Role | Agent |
-|----|------|------|----|------|-------|
 | CT | Name | Node | IP | Role | Agent |
 |----|------|------|----|------|-------|
 | 100 | abiba | **hwepve** | .24 | Pi agent | ✅ pi |
@@ -604,6 +602,7 @@ ssh root@192.168.68.110 "systemctl restart llama-server"
 | 111 | tdunna | amdpve | .129 | Hermes agent | ✅ |
 | 112 | tanko | amdpve | .122 | Hermes agent | ✅ |
 | 113 | baggy | amdpve | .114 | Hermes agent | ✅ |
+| 114 | mumuni | **hwepve** | .123 | Hermes agent (stopped) | ✅ |
 | 115 | scottdenya | amdpve | .75 | Denya OneCare | ❌ |
 | 116 | syslog-api | minipve | .116 | LiteLLM + Grafana | ❌ |
 | 117 | zulip | storepve | .19 | Chat | ❌ |
@@ -629,14 +628,14 @@ Source of truth: `/root/scripts/pct-run.sh` or `prose-contracts/scripts/pct-run.
 | CT | Name | Node | pct-run |
 |-----|------|------|---------|
 | 100 | abiba | hwepve | `pct-run 100` |
-| 105 | kagentz | **hwepve** | `pct-run 105` |
+| 105 | kagentz | hwepve | `pct-run 105` |
 | 111 | tdunna | amdpve | `pct-run 111` |
 | 112 | tanko | amdpve | `pct-run 112` |
 | 113 | baggy | amdpve | `pct-run 113` |
 | 115 | scottdenya | amdpve | `pct-run 115` |
 | 104 | authentik | minipve | `pct-run 104` |
 | 110 | gitea | minipve | `pct-run 110` |
-
+| 114 | mumuni | hwepve | `pct-run 114` |
 | 116 | syslog-api | minipve | `pct-run 116` |
 | 106 | ra-h-os | storepve | `pct-run 106` |
 | 107 | proxmox-backup | storepve | `pct-run 107` |
@@ -649,35 +648,27 @@ GPU bare-metal hosts (.8 acerpve, .110 ocupve, .15 amdpve) are NOT CTs — use S
 ssh root@192.168.68.8   # RTX 3090
 ssh root@192.168.68.110 # RTX 5070
 ssh root@192.168.68.15  # Strix Halo
-ssh root@192.168.68.4   # hwepve (abiba, kagentz) — Mumuni runs inside CT 100
+ssh root@192.168.68.4   # hwepve (abiba, kagentz, mumuni)
 ```
 
-## Section 7: Agent Health Check v2 (2026-07-26)
+## Section 7: Agent Health Check (consolidated — 2026-07-05)
 
-Single non-disruptive check running every 10 minutes via cron
-(`/root/scripts/agent-health-check.py`). v2 fixes critical gaps:
-- Koby (.129) and Koonimo (.114) now have SSH hosts — no longer skipped
-- Agent-specific vault keys (`{NAME}_LITELLM_API_KEY`) not shared master key
-- CT liveness check via `pct status` on PVE nodes
-- Config YAML integrity check
-- Wrapper/CLI integrity check
-- Vault secret non-emptiness check
+Replaces 7 scattered Zulip health scripts with a single non-disruptive check
+running every 10 minutes via cron (`/root/scripts/agent-health-check.py`).
 
 The script is **read-only** — it never restarts, kills, or modifies anything.
+Disruptive cron-based gateways restarts (like Mumuni's zulip-watchdog.sh,
+which was kill+nohup outside systemd) are banned by policy.
 
 ### Checks Performed
 
 | Check | Frequency | What It Detects |
 |-------|-----------|-----------------|
-| LiteLLM key validation | 10 min | All 5 agent-specific keys authenticate (not shared master key) |
+| LiteLLM key validation | 10 min | All 4 agent keys authenticate and return models |
 | GPU port conflict | 10 min | Ghost processes squatting port 8080 (ss vs systemd MainPID) |
-| Gateway liveness | 10 min | Gateway process running, state file readable (all 5 agents) |
+| Gateway liveness | 10 min | Gateway process running, state file readable |
 | Zulip streaming | 10 min | `edit_message` present in adapter (streaming supported) |
 | Recent errors | 10 min | Error count in journald for last 10 min |
-| CT liveness | 10 min | `pct status` on PVE nodes — catches stopped CTs |
-| Config YAML integrity | 10 min | Python `yaml.safe_load()` — catches syntax errors |
-| Wrapper/CLI integrity | 10 min | hermes wrapper exists, infisical path correct, hermes-real reachable |
-| Vault secrets | 10 min | Agent-specific vault keys are non-empty and start with `sk-` |
 
 ### Disabled Scripts
 

infrastructure-update.prose.md

@@ -2,7 +2,7 @@
 kind: responsibility
 name: infrastructure-update
 description: >
-  Autonomous system-wide update contract covering all 5 Proxmox nodes,
+  Autonomous system-wide update contract covering all 6 Proxmox nodes,
   15+ containers/VMs, and 4 Docker ecosystems. Updates apt packages,
   Docker images, and container stacks in safe waves with health checks
   and automatic rollback on failure.
@@ -56,10 +56,11 @@ Before ANY update wave:
 | amdpve (.15) | Proxmox node | `apt update && apt upgrade -y` | 5 min |
 | acerpve (.9) | Proxmox node | `apt update && apt upgrade -y` | 5 min |
 | ocupve (.5) | Proxmox node | `apt update && apt upgrade -y` | 5 min |
+| hwepve (.4) | Proxmox node | `apt update && apt upgrade -y` | 5 min |
 | CT 100 (.24) | Abiba (pi) | `apt update && apt upgrade -y` | 3 min |
 | CT 116 (.116) | syslog-api (LiteLLM host) | `apt update && apt upgrade -y` | 3 min |
 | CT 112 (tanko, amdpve) | Tanko | `apt update && apt upgrade -y` | 3 min |
-| CT 114 (mumuni, minipve) | Mumuni | `apt update && apt upgrade -y` | 3 min |
+| CT 114 (mumuni, hwepve) | Mumuni | `apt update && apt upgrade -y` | 3 min |
 | VM 101 (.8) | llm-gpu (RTX 3090) | `apt update && apt upgrade -y` | 3 min |
 | VM 103 (.110) | ocu-llm (RTX 5070) | `apt update && apt upgrade -y` | 3 min |
 
@@ -218,7 +219,7 @@ When LiteLLM is upgraded to a version supporting per-key MCP grants:
 
 ## Success Criteria
 
-- [ ] All 5 PVE nodes updated, no reboot-loop
+- [ ] All 6 PVE nodes updated, no reboot-loop
 - [ ] All VMs/CTs running post-update
 - [ ] All Docker containers healthy (VM 109 + CT 116 + CT 117)
 - [ ] LiteLLM inference passing (syslog-auto test)
@@ -234,7 +235,7 @@ After completion, send Zulip DM:
 ```
 📋 Infrastructure Update — YYYY-MM-DD
 
-Updated: 5 PVE nodes, 12 CTs/VMs, 30+ containers
+Updated: 6 PVE nodes, 12 CTs/VMs, 30+ containers
 Security fixes: N CVEs patched
 Downtime: <service> <duration>
 Failures: none / <details>

litellm-self-heal.prose.md

@@ -7,7 +7,7 @@ note: >
   Auto-remediation code was removed from the pi Zulip extension (retired 2026-07-04),
   now reimplemented as `litellm-health-check.sh` on CT 116.
   Script: `/opt/inference-harness/scripts/litellm-health-check.sh` on CT 116 (cron `0 */6 * * *`).
-  Reports to /var/log/litellm/health-*.json and RA-H OS knowledge graph.
+  Reports to /var/log/litellm/health-*.json and Gitea (SyslogSolution/health-logs).
   GPU monitoring integrated from gpu-monitor on .24:9100.
   
   Consolidated from litellm-health + litellm-self-heal on 2026-07-09 to eliminate
@@ -20,7 +20,7 @@ description: >
   LiteLLM inference stack health monitoring + self-healing. Verifies the full
   nginx → LiteLLM → GPU chain, 8 containers on CT 116, 3 GPU hosts, model
   inference, and agent keys. Applies remediation rules for common failures.
-  Reports every action via Zulip DM and RA-H OS knowledge graph.
+  Reports every action via Zulip DM and Gitea (SyslogSolution/health-logs).
 ---
 
 # LiteLLM Operations — Health Check + Self-Heal
@@ -211,8 +211,8 @@ for reference but inactive. If Redis issues occur, check harness-redis container
 
 Every remediation cycle produces a structured report:
 
-### 1. RA-H OS Knowledge Graph Node
-Created as `[LEARN] litellm-self-heal: <run_id>` with full JSON report.
+### 1. Gitea Log Entry
+Pushed to `SyslogSolution/health-logs/litellm/{run_id}.json` — versioned, searchable, not in graph.
 
 ### 2. Zulip DM to Owner
 - `issues_fixed > 0` — "🛠 LiteLLM Self-Heal — Fix Applied"
@@ -252,9 +252,11 @@ call report-generator
   health: health
   actions: actions
 
--- Phase 4: Log to knowledge graph
-call kg-logger
+-- Phase 4: Log to Gitea (not knowledge graph — hard rule)
+call gitea-logger
   run_id: run_id
+  repo: SyslogSolution/health-logs
+  path: litellm/{run_id}.json
   health: health
   actions: actions
 
@@ -300,3 +302,20 @@ With failures:
   ]
 }
 ```
+
+## gitea-logger Implementation
+
+When this step executes, write the report JSON to a temp file and push to Gitea:
+
+```bash
+REPO="https://abiba-bot:${GITEA_PAT}@git.sysloggh.net/SyslogSolution/health-logs"
+DIR="litellm"
+FILE="${run_id}.json"
+echo "${report_json}" > /tmp/${FILE}
+(cd /tmp && git clone --depth 1 "${REPO}" && 
+  cp ${FILE} health-logs/${DIR}/${FILE} && 
+  cd health-logs && git add ${DIR}/${FILE} && 
+  git commit -m "litellm-health: ${run_id}" && git push)
+rm -rf /tmp/health-logs /tmp/${FILE}
+```
+

mumuni-delegation-prose-contract.prose.md

@@ -6,7 +6,7 @@ description: >
   delegation, verification, and delivery. Defines when to delegate, which
   worker to use for what, how to handle failures, and the kanban board
   protocol. Enforces context-window discipline and separation of concerns.
-  Runs on Mumuni (inside Abiba CT100, hwepve, .24) via Hermes agent (Hermes Zulip gateway).
+  Runs on Mumuni (inside Abiba CT100, hwepve, .24) via Hermes agent (Pi + Hermes Zulip gateway).
 version: 1.0.0
 ---
 
@@ -31,7 +31,7 @@ Workers execute tasks on whatever infrastructure they're given — SSH to .6,
 ## Why This Matters
 
 Without enforced delegation, the manager consumes the full iteration budget
-(60 calls) on single-turn tasks — SSH to 5 nodes, check each VM, read logs —
+(60 calls) on single-turn tasks — SSH to 6 nodes, check each VM, read logs —
 leaving no capacity for actual coordination. The result: context overflow
 (59K tokens in system prompt), iteration exhaustion, and degraded response
 quality. This contract exists because I blew through my budget checking
@@ -82,7 +82,7 @@ it asks the manager (via relay) — it doesn't go find it on its own.
 
 **This is a hard rule, not a recommendation.** Violating it produces the exact
 type of discrepancy the kanban pipeline exists to prevent: a review worker finds
-"5 nodes present" in the raw data but "5/5 online" in the report — even though
+"6 nodes present" in the raw data but "6/6 online" in the report — even though
 one of those nodes was unreachable. The report lied because it used data the
 raw data never provided.
 
@@ -137,7 +137,7 @@ delegate_task(
 ```
 delegate_task(
     tasks=[
-        {"goal": "Check all 5 Proxmox nodes for VM status", "context": "SSH to each node via 192.168.68.x, run 'qm list'"},
+        {"goal": "Check all 6 Proxmox nodes for VM status", "context": "SSH to each node via 192.168.68.x, run 'qm list'"},
         {"goal": "Check Docker container health on .7/.116/.17", "context": "SSH to each host, check container status"},
     ]
 )
@@ -191,7 +191,7 @@ Only verified results reach Kwame. Format per channel:
     {
       "lane_id": "devops-check",
       "worker": "syslog-devops",
-      "goal": "Check all 5 Proxmox nodes",
+      "goal": "Check all 6 Proxmox nodes",
       "status": "dispatched|completed|failed",
       "output_file": "/tmp/node-report.md"
     }

pm2-self-heal.prose.md

@@ -52,7 +52,7 @@ description: >
    - If status is "online" → pass, log restarts count
    - If status is "stopped" or "errored" → **DO NOT RESTART** — alert owner immediately
    - If restarts > 5 in last hour → alert owner with full diagnostics
-4. **Log results** — Create `[LEARN]` node in knowledge graph for any actions taken
+4. **Log results** — Append to `SyslogSolution/health-logs/pm2/{timestamp}.md` in Gitea (not knowledge graph — hard rule)
 5. **Alert** — Send Zulip DM to owner if escalation needed (do NOT run pm2 commands during alerting)
 6. **Wait 5 min** → repeat from step 1
 

proxmox-monitor.prose.md

@@ -88,7 +88,7 @@ agent: abiba
 | acerpve | 192.168.68.9 | PVE (hosts llm-gpu qemu/101) |
 | minipve | 192.168.68.12 | PVE |
 | amdpve | 192.168.68.15 | PVE + Strix Halo LLM (qwen3.6-35B-udq4, strix-moe) |
-| hwepve | 192.168.68.4 | PVE (Huawei Matebook 16, 12C/15GB) — hosts Mumuni (lxc/114) migrated from minipve 2026-07-20 |
+| hwepve | 192.168.68.4 | PVE (Huawei Matebook 16, 12C/15GB) — hosts abiba (lxc/100), kagentz (lxc/105), mumuni (lxc/114). CTs 100/105 migrated from amdpve, CT 114 from minipve 2026-07-20 |
 
 ## Operations
 

scripts/pct-run.sh

@@ -11,31 +11,33 @@ set -euo pipefail
 # ── CT ID → PVE Node mapping (maintained HERE, not in prose contracts) ──
 declare -A CT_NODES=(
     # amdpve (192.168.68.15)
-    [100]=amdpve    # abiba
-    [105]=amdpve    # kagentz
     [111]=amdpve    # tdunna
     [112]=amdpve    # tanko
     [113]=amdpve    # baggy
     [115]=amdpve    # scottdenya
     # minipve (192.168.68.12)
+    [102]=minipve   # adguard (was acerpve)
     [104]=minipve   # authentik
     [110]=minipve   # gitea
-    [114]=minipve   # mumuni
     [116]=minipve   # syslog-api
+    [119]=minipve   # infisical-vault
     # storepve (192.168.68.6)
     [106]=storepve  # ra-h-os
     [107]=storepve  # proxmox-backup
     [108]=storepve  # media
     [117]=storepve  # zulip
-    # acerpve (192.168.68.9)
-    [102]=acerpve   # adguard
+    [118]=storepve  # jdownloader
+    # acerpve (192.168.68.9) — no CTs (bare metal GPU .8)
+    # hwepve (192.168.68.4)
+    [100]=hwepve    # abiba (was amdpve)
+    [105]=hwepve    # kagentz (was amdpve)
+    [114]=hwepve    # mumuni (was minipve)
     # ocupve (192.168.68.5) — no CTs (bare metal GPU .110)
     #
     # REMOVED CTs (migrated to bare metal, decommissioned, or VMs):
     #   101 llm-gpu   → bare metal 192.168.68.8   (RTX 3090)
     #   103 ocu-llm   → bare metal 192.168.68.110 (RTX 5070)
     #   109 docker-vm → KVM VM 192.168.68.7       (use direct SSH)
-    #   118 jitsi     → stopped, not in service
 )
 
 # Each node must be root-accessible via SSH hostname
@@ -48,6 +50,7 @@ declare -A NODE_IPS=(
     [storepve]=192.168.68.6
     [acerpve]=192.168.68.9
     [ocupve]=192.168.68.5
+    [hwepve]=192.168.68.4
 )
 
 resolve_node() {

scripts/prose-ai-review.sh

@@ -46,17 +46,19 @@ You are a code reviewer for OpenProse infrastructure contracts in the Syslog Sol
 
 The infrastructure-control.prose.md contract is the canonical reference for the cluster topology:
 
-**Proxmox Cluster "Tabiri" (5 nodes):**
-- amdpve (192.168.68.15): abiba, kagentz, tanko, tdunna, baggy, scottdenya
-- minipve (192.168.68.12): authentik, gitea, mumuni, syslog-api, jitsi
-- storepve (192.168.68.6): docker-vm, ra-h-os, PBS, media, zulip
-- acerpve (192.168.68.9): llm-gpu, adguard
+**Proxmox Cluster "Tabiri" (6 nodes):**
+- amdpve (192.168.68.15): tanko, tdunna, baggy, scottdenya
+- minipve (192.168.68.12): adguard, authentik, gitea, syslog-api, infisical-vault
+- storepve (192.168.68.6): docker-vm, ra-h-os, PBS, media, jdownloader, zulip
+- acerpve (192.168.68.9): llm-gpu
 - ocupve (192.168.68.5): ocu-llm
+- hwepve (192.168.68.4): abiba, kagentz, mumuni
 
-**CT IDs (verified 2026-07-04 against PVE API):**
+**CT IDs (verified 2026-07-24 against PVE API):**
 100:abiba  102:adguard  104:authentik  105:kagentz  106:ra-h-os
 107:pbs    108:media    110:gitea      111:tdunna   112:tanko
 113:baggy  114:mumuni   115:scottdenya  116:syslog-api 117:zulip
+118:jdownloader  119:infisical-vault
 
 **NO CT 122, CT 123, or .19 exist in the cluster.**