Merge PR #38 : feat: add Level 0 auto-delete for heartbeat log orphans

feat: add Level 0 auto-delete for heartbeat log orphans
2026-07-29 21:52:14 +00:00 · 2026-07-29 21:50:19 +00:00 · 2026-07-28 23:30:33 +00:00 · 2026-07-28 21:23:24 +00:00 · 2026-07-28 21:23:04 +00:00 · 2026-07-28 21:21:46 +00:00
33 changed files with 1425 additions and 255 deletions
@@ -0,0 +1 @@
 __pycache__/
@@ -128,3 +128,10 @@ safe-mutate --verify "CMD" [--expect "PATTERN"] --mutate "CMD" [--reason "WHY"]
 Read the [Authoring Guide](docs/AUTHORING-GUIDE.md) before writing any new contract.
 It covers the full process: verify → draft → lint → review → ship, with templates
 and style rules.
 ## Maintaining this file
 Keep this file for knowledge useful to almost every future agent session in this project.
 Do not repeat what the codebase already shows; point to the authoritative file or command instead.
 Prefer rewriting or pruning existing entries over appending new ones.
 When updating this file, preserve this bar for all agents and keep entries concise.
@@ -0,0 +1 @@
 AGENTS.md
@@ -0,0 +1,230 @@
 #!/usr/bin/env python3
 """
 Hermes Config Audit — validates a live config.yaml against the prose contract rules.
 Usage:
    python3 audit-hermes-config.py <config.yaml>
    python3 audit-hermes-config.py /root/.hermes/config.yaml
 Exit codes:
    0 = all checks pass
    1 = one or more contract violations found
 This script encodes every rule from hermes-config-template.prose.md so config
 changes can be verified before and after application. It is the single automated
 enforcement layer for the prose contract.
 Contract: /root/prose-contracts/hermes-config-template.prose.md
 """
 import sys
 import yaml
 VIOLATIONS = []
 WARNINGS = []
 PASSES = []
 def check(condition, rule, message):
    if condition:
        PASSES.append(f"[{rule}] {message}")
    else:
        VIOLATIONS.append(f"[{rule}] {message}")
 def warn(rule, message):
    WARNINGS.append(f"[{rule}] {message}")
 def audit(path):
    with open(path) as f:
        cfg = yaml.safe_load(f)
    model = cfg.get("model", {})
    fb = cfg.get("fallback_providers", {})
    comp = cfg.get("compression", {})
    aux = cfg.get("auxiliary", {})
    deleg = cfg.get("delegation", {})
    cps = cfg.get("custom_providers", [])
    cp = cps[0] if cps else {}
    # --- Rule 3: API Keys via Environment ---
    check(
        model.get("api_key") in ("", None),
        "Rule 3",
        f"model.api_key must be empty (got {model.get('api_key')!r}) — keys via env var, not hardcoded",
    )
    check(
        model.get("api_key_env") == "LITELLM_API_KEY",
        "Rule 3",
        f"model.api_key_env must be LITELLM_API_KEY (got {model.get('api_key_env')!r})",
    )
    # --- Rule 5: Main Config Base URL ---
    expected_base = "http://192.168.68.116/v1"
    check(
        model.get("base_url") == expected_base,
        "Rule 5",
        f"model.base_url must be {expected_base} (got {model.get('base_url')!r}) — /v1 not /litellm/v1",
    )
    # --- Rule 6: max_tokens Is Required ---
    check(
        isinstance(model.get("max_tokens"), int) and model.get("max_tokens") <= 8192,
        "Rule 6",
        f"model.max_tokens must be set and <= 8192 (got {model.get('max_tokens')!r}) — thermal safety",
    )
    # --- Rule 7: Auxiliary Model Consistency ---
    check(
        comp.get("model") == "syslog-auto",
        "Rule 7",
        f"compression.model must be syslog-auto (got {comp.get('model')!r}) — auto-routing to prevent Strix Halo overload",
    )
    aux_comp = aux.get("compression", {})
    check(
        aux_comp.get("model") == "syslog-auto",
        "Rule 7",
        f"auxiliary.compression.model must be syslog-auto (got {aux_comp.get('model')!r}) — must match compression.model",
    )
    # --- Rule 8: GPU Workload Distribution ---
    check(
        aux.get("vision", {}).get("model") == "gpu-light",
        "Rule 8",
        f"auxiliary.vision.model must be gpu-light (got {aux.get('vision', {}).get('model')!r}) — RTX 5070 stable alias",
    )
    check(
        aux.get("web_extract", {}).get("model") == "gpu-light",
        "Rule 8",
        f"auxiliary.web_extract.model must be gpu-light (got {aux.get('web_extract', {}).get('model')!r}) — RTX 5070 stable alias",
    )
    # --- Rule 9: Compression Threshold ---
    check(
        comp.get("threshold") == 0.65,
        "Rule 9",
        f"compression.threshold must be 0.65 for 128K models (got {comp.get('threshold')!r})",
    )
    check(
        comp.get("max_context_window") == 131072,
        "Rule 9",
        f"compression.max_context_window must be 131072 (got {comp.get('max_context_window')!r}) — matches 128K GPU capacity",
    )
    # --- Rule 10: Default Model Must Be syslog-auto ---
    check(
        model.get("default") == "syslog-auto",
        "Rule 10",
        f"model.default must be syslog-auto (got {model.get('default')!r}) — auto-routing default",
    )
    # --- Rule 14: Provider Name Must Match custom_providers Name ---
    check(
        model.get("provider") == "harness",
        "Rule 14",
        f"model.provider must be 'harness' (got {model.get('provider')!r}) — NOT 'custom'. "
        f"provider: custom causes generic resolution path that ignores key_env → 'no-key-required' → 401",
    )
    check(
        comp.get("provider") == "harness",
        "Rule 14",
        f"compression.provider must be 'harness' (got {comp.get('provider')!r})",
    )
    for aux_name in ("vision", "web_extract", "compression"):
        aux_provider = aux.get(aux_name, {}).get("provider")
        check(
            aux_provider == "harness",
            "Rule 14",
            f"auxiliary.{aux_name}.provider must be 'harness' (got {aux_provider!r})",
        )
    check(
        deleg.get("provider") == "harness",
        "Rule 14",
        f"delegation.provider must be 'harness' (got {deleg.get('provider')!r})",
    )
    check(
        fb.get("provider") == "deepseek",
        "Rule 14",
        f"fallback_providers.provider must be 'deepseek' (got {fb.get('provider')!r}) — "
        f"true fallback diversity, not same endpoint as primary",
    )
    check(
        fb.get("model") == "deepseek-v4-flash",
        "Rule 14",
        f"fallback_providers.model must be 'deepseek-v4-flash' (got {fb.get('model')!r})",
    )
    check(
        fb.get("api_key_env") == "DEEPSEEK_API_KEY",
        "Rule 14",
        f"fallback_providers.api_key_env must be DEEPSEEK_API_KEY (got {fb.get('api_key_env')!r})",
    )
    # --- custom_providers sanity ---
    check(
        cp.get("name") == "harness",
        "custom_providers",
        f"custom_providers[0].name must be 'harness' (got {cp.get('name')!r})",
    )
    check(
        cp.get("key_env") == "LITELLM_API_KEY" or cp.get("api_key_env") == "LITELLM_API_KEY",
        "custom_providers",
        f"custom_providers[0] must have key_env or api_key_env = LITELLM_API_KEY "
        f"(got key_env={cp.get('key_env')!r}, api_key_env={cp.get('api_key_env')!r})",
    )
    check(
        cp.get("base_url", "").endswith("/v1"),
        "custom_providers",
        f"custom_providers[0].base_url must end with /v1 (got {cp.get('base_url')!r})",
    )
    # --- No raw model names (Rule 7/8 spirit) ---
    raw_names = {"gemma-4-12b", "qwen3.6-27B-code", "qwen3.6-35B-udq4", "ornith-1.0-35b"}
    for section_path, section_dict in [
        ("model", model), ("compression", comp),
        ("auxiliary.vision", aux.get("vision", {})),
        ("auxiliary.web_extract", aux.get("web_extract", {})),
        ("auxiliary.compression", aux.get("compression", {})),
        ("delegation", deleg),
    ]:
        m = section_dict.get("model", "")
        if m in raw_names:
            warn(
                "Rule 7/8",
                f"{section_path}.model = {m!r} — raw model name, use stable alias instead "
                f"(gpu-light, gpu-dense, strix-moe, syslog-auto)",
            )
    # --- Report ---
    print(f"{'=' * 60}")
    print(f"Hermes Config Audit: {path}")
    print(f"{'=' * 60}")
    print(f"\n✅ PASSED ({len(PASSES)}):")
    for p in PASSES:
        print(f"  ✅ {p}")
    if WARNINGS:
        print(f"\n⚠️  WARNINGS ({len(WARNINGS)}):")
        for w in WARNINGS:
            print(f"  ⚠️  {w}")
    if VIOLATIONS:
        print(f"\n❌ VIOLATIONS ({len(VIOLATIONS)}):")
        for v in VIOLATIONS:
            print(f"  ❌ {v}")
        print(f"\n{'=' * 60}")
        print(f"RESULT: FAIL — {len(VIOLATIONS)} violation(s) must be fixed")
        print(f"{'=' * 60}")
        return 1
    else:
        print(f"\n{'=' * 60}")
        print(f"RESULT: PASS — all contract rules satisfied")
        print(f"{'=' * 60}")
        return 0
 if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python3 audit-hermes-config.py <config.yaml>")
        sys.exit(2)
    sys.exit(audit(sys.argv[1]))
@@ -22,6 +22,7 @@ owners:
 - abiba
 - mumuni
 - kwame
 - ops
 trigger_types:
 - scheduled
 - event_driven
@@ -58,6 +59,7 @@ index:
    - memory-audit-maintenance
    - gpu-fleet
    - infrastructure-update
    - infrastructure-maintenance
    reference:
    - infrastructure-control
    - ra-h-os-custodianship-contract
@@ -90,6 +92,7 @@ index:
    - infrastructure-control
    - infrastructure-monitoring
    - infrastructure-update
    - infrastructure-maintenance
    - pm2-self-heal
    - disk-gc-threat-response
    gpu:
@@ -130,7 +133,6 @@ index:
    - build-zulip-plugin
    - stirling-pdf-agent-access
    - gpu-fleet
    - infrastructure-update
    - infrastructure-control
    - zulip-adapter-lessons
    - pi-approval-architecture
@@ -144,6 +146,9 @@ index:
    - mumuni-delegation
    kwame:
    - hello-world
    ops:
    - infrastructure-maintenance
    - infrastructure-update
  by_trigger:
    scheduled:
    - hermes-key-enforcement
@@ -156,6 +161,7 @@ index:
    - litellm-health
    - memory-audit-maintenance
    - infrastructure-update
    - infrastructure-maintenance
    event_driven:
    - litellm-self-heal
    - pm2-self-heal
@@ -197,6 +203,7 @@ index:
    - hermes-zulip-plugin
    - build-zulip-plugin
    - infrastructure-update
    - infrastructure-maintenance
    - ra-h-os-custodianship-contract
    - mumuni-delegation
    normal:
@@ -1256,13 +1263,108 @@ contracts:
  last_run: null
  last_status: null
  drift_alerts: []
 - name: infrastructure-maintenance
  file: infrastructure-maintenance.prose.md
  kind: responsibility
  category: maintenance
  sensitivity: high
  status: active
  owner: ops
  version: 1.0.0
  trigger:
    type: scheduled
    cadence: 0 2 * * 0
    description: Weekly host-level maintenance Sunday at 2am ET (replaces infrastructure-update
      build-phase role; infra-update moves to ops)
    cron_job_id: null
  execution:
    agent: ops
    timeout: 3600
    requires:
    - infrastructure-monitoring run within last 30 minutes (pre-update health baseline)
    - Proxmox snapshot of primary host OR /tmp backup dir created this run
    - LiteLLM master key from Infisical vault for health verification
    protocol:
    - Load contract from prose-contracts/main
    - Phase 0 preflight — capture health baseline, backup check, record image baseline
    - Phase 1 apt update && apt upgrade -y on primary host
    - Phase 2 docker compose pull for LiteLLM, SearXNG, and other running containers
    - Phase 3 restart stacks one at a time with per-stack health verification
    - Phase 4 verify every critical service (LiteLLM, SearXNG, Zulip, Gitea, PM2, Hermes gateways)
    - On failure — rollback per protocol, escalate, do not loop beyond circuit breaker
    - Log actions to ~/.hermes/runs/infrastructure-maintenance/
  verification:
    postconditions:
    - check: all critical services running after update
      verify: 'curl -sf http://192.168.68.116/litellm/v1/models && curl -sf https://chat.sysloggh.net/api/v1/server_settings && curl -sf https://git.sysloggh.net/api/v1/version && curl -sf http://192.168.68.7:8888 && pm2 jlist'
      expect: all probes 200 OK / processes online
    - check: no regressions from pre-update health baseline
      verify: diff Phase 0 health-baseline against Phase 4 results
      expect: no GREEN service turned RED
    - check: docker containers on latest stable tags
      verify: docker inspect --format '{{.Config.Image}}' <container> per service matches image-baseline.pulled_tag
      expect: all containers running pulled tags
    - check: APT packages up to date with no held broken packages
      verify: apt list --upgradable 2>/dev/null | wc -l and apt-get -s upgrade | grep -ci broken
      expect: upgradable == 0, broken == 0
    artifact: maintenance run report with phase results and any rollback/escalation
    verify_commands:
    - curl -sf http://192.168.68.116/litellm/v1/models
    - curl -sf http://192.168.68.7:8888
    - curl -sf https://chat.sysloggh.net/api/v1/server_settings
    - curl -sf https://git.sysloggh.net/api/v1/version
    - pm2 jlist
  receipt:
    format: json
    storage: ~/.hermes/runs/infrastructure-maintenance/
    graph_node: true
    schema:
      contract: string
      run_id: string
      timestamp: ISO 8601
      agent: string
      status: pass|fail|escalated
      phase: preflight|apt|images|restarts|verify|rollback|done|failed
      actions_taken: array
      postconditions: array
      drift_alerts: array
      evidence_path: string
  escalation:
    info:
      action: log_to_receipt
      notify: []
    warning:
      action: relay_alert
      notify:
      - abiba
      - mumuni
    critical:
      action: relay_alert
      notify:
      - abiba
      - mumuni
    fatal:
      action: relay_alert + pause + human_required
      notify:
      - abiba
      - mumuni
      - kwame
  circuit_breaker:
    max_retries: 2
    window: 7200
    trip_action: escalate_to_fatal
  depends_on:
  - infrastructure-monitoring
  last_run: null
  last_status: null
  drift_alerts: []
 - name: infrastructure-update
  file: infrastructure-update.prose.md
  kind: responsibility
  category: maintenance
  sensitivity: high
  status: active
-  owner: abiba
+  owner: ops
  version: 1.0.0
  trigger:
    type: scheduled
@@ -35,8 +35,7 @@ Docker hosts get special attention:
 | All other CTs | — | LOW — no Docker | apt clean, log rotate |
 | GPU bare metal (.8, .110) | — | LOW — no Docker on GPU hosts | log rotate |
-> **Decommissioned:** CT 118 (jitsi) — intentionally stopped, not scanned.
+> **Note:** CT 118 is now jdownloader (active on storepve). CT 101 (llm-gpu) → bare metal .8, CT 103 (ocu-llm) → bare metal .110.
 > **Migrated:** CT 101 (llm-gpu) → bare metal .8, CT 103 (ocu-llm) → bare metal .110.
 ## Threat Levels
@@ -275,10 +274,10 @@ one-off GPU builds. No automated post-migration cleanup was in place.
 ### CT Access (via pct-run)
 | CT | Name | Node | Status |
 |----|------|------|--------|
-| 100 | abiba | amdpve | local |
+| 100 | abiba | hwepve | local |
-| 102 | adguard | acerpve | ✅ reachable |
+| 102 | adguard | minipve | ✅ reachable |
 | 104 | authentik | minipve | ✅ reachable |
-| 105 | kagentz | amdpve | ✅ reachable |
+| 105 | kagentz | hwepve | ✅ reachable |
 | 106 | ra-h-os | storepve | ✅ reachable |
 | 107 | pbs | storepve | ✅ reachable |
 | 108 | media | storepve | ✅ reachable |
@@ -286,7 +285,7 @@ one-off GPU builds. No automated post-migration cleanup was in place.
 | 111 | tdunna | amdpve | ✅ reachable |
 | 112 | tanko | amdpve | ✅ reachable |
 | 113 | baggy | amdpve | ✅ reachable |
-| 114 | mumuni | minipve | ✅ reachable |
+| 114 | mumuni | hwepve | ✅ reachable |
 | 115 | scottdenya | amdpve | ✅ reachable |
 | 116 | syslog-api | minipve | ✅ reachable |
 | 117 | zulip | storepve | ✅ reachable |
@@ -303,4 +302,4 @@ one-off GPU builds. No automated post-migration cleanup was in place.
 |------|-----|------|--------|
 | docker-vm | 192.168.68.7 | 16 Docker containers, 4 stacks | ✅ reachable |
-> **Decommissioned:** CT 118 (jitsi) — intentionally stopped.\n> **Migrated:** CT 101 → .8, CT 103 → .110 (bare metal GPU).\n> **KVM VM:** CT 109 (docker-vm) is a KVM VM, not LXC — access via SSH .7.
+> **Note:** CT 118 is now jdownloader (active on storepve). CT 119 (infisical-vault) added on minipve.\n> **Migrated:** CT 101 → .8, CT 103 → .110 (bare metal GPU).\n> **KVM VM:** CT 109 (docker-vm) is a KVM VM, not LXC — access via SSH .7.
@@ -185,7 +185,7 @@ what, and why should I care?
 ```
 ❌ "Monitors infrastructure health"
-✅ "Scans all 5 Proxmox nodes and 19 CTs for disk pressure, checks Docker
+✅ "Scans all 6 Proxmox nodes and 19 CTs for disk pressure, checks Docker
   container health on .7/.116/.17, alerts via Telegram DM on RED/CRITICAL"
 ```
@@ -9,12 +9,15 @@ description: >
  gpu-dense, gpu-light. These never change — only the underlying model does.
  Strix Halo: strix-moe → unsloth/Qwen3.6-35B-A3B-MTP (UD-Q4_K_M, 22GB).
  RTX 5070: gemma-4-12b Q4_K_M → IQ4_NL + MTP draft (122 tok/s, 2x faster).
-  UPDATED 2026-07-17: Strix Halo model swapped to Genesis Hermes V3 APEX (LuffyTheFox, 24GB, uncensored,
+  UPDATED 2026-07-17: Context reduced fleet-wide from 256K to 128K for stability.
-  Hermes agent fine-tune, tensor repair, multimodal with mmproj).
+  Strix Halo model swapped to qwen3.6-35B-udq4 (22GB, strix-moe alias).
-  RTX 5070 swapped to HauhauCS Gemma4-12B QAT Uncensored Balanced (Q4_K_M, 87 tok/s, 0/465 refusals).
+  Instability observed near 100K at 256K (now all GPUs at 128K). 128K is the stable ceiling.
  Instability observed near 100K at 256K. 128K is the stable ceiling.
  For larger context needs → fall back to external providers (deepseek).
  VRAM headroom improved: RTX 3090 ~70%, RTX 5070 ~65%.
  UPDATED 2026-07-27: gpu-dense swapped to SmartCode-Fable-5-CoT-Reasoning-QKVO-Qwen-3.6-27B-Distilled
  (UD-Q3_K_XL, ~14.7GB — Q4 was too large for 24GB VRAM with 128K KV cache). ~50% fewer thinking
  tokens via ThinkingCap finetune + Fable 5 CoT distillation for improved coding reasoning.
  VRAM ~22.4/24.6GB (91%).
 agent: abiba
 triggers:
  - on model add/remove
@@ -87,31 +90,19 @@ When a model is swapped on a GPU, ONLY the infrastructure layer changes — agen
 | Alias | GPU | Current Model | Will Route To |
 |-------|-----|---------------|---------------|
 | `strix-moe` | Strix Halo (.15) | qwen3.6-35B-udq4 | Whatever runs on Strix Halo |
-| `gpu-dense` | RTX 3090 (.8) | qwen3.6-27B-code (ThinkingCap) | Whatever runs on RTX 3090 |
+| `gpu-dense` | RTX 3090 (.8) | SmartCode-Fable-5-27B-UD-Q4_K_XL | Whatever runs on RTX 3090 |
 | `gpu-light` | RTX 5070 (.110) | gemma-4-12b | Whatever runs on RTX 5070 |
 **Backward compatibility**: Old model-specific names (qwen3.6-27B-code, gemma-4-12b, qwen3.6-35B-udq4) still work
 but are deprecated for agent configs. Only the stable aliases survive model swaps.
-## Current Model Assignments (2026-07-17)
+## Current Model Assignments (2026-07-15)
 | Model | GPU | Host | VRAM | Ctx | KV Cache | Parallel | Batch/Ubatch | Status |
 |-------|-----|------|------|-----|----------|----------|-------------|--------|
-| qwen3.6-27B-code (ThinkingCap) | RTX 3090 | .8 (llm-gpu) | ~20.9/24.6GB (85%) | **128K** | turbo4 | 1 | default | ✅ 68 tok/s |
+| SmartCode-Fable-5-27B-UD-Q3_K_XL | RTX 3090 | .8 (llm-gpu) | ~22.4/24.6GB (91%) | **128K** | q4_0 | 1 | 2048/1024 | ✅ healthy |
-| gemma-4-12b (HauhauCS QAT) | RTX 5070 | .110 (ocu-llm) | ~10.0/12.2GB (82%) | 128K | q4_0 | 1 | 2048/1024 | ✅ 87 tok/s |
+| gemma-4-12b | RTX 5070 | .110 (ocu-llm) | ~7.8/12.2GB (65%) | 128K | q4_0 | 2 | 2048/1024 | ✅ healthy |
-| Genesis Hermes V3 APEX | Strix Halo Vulkan | .15 (amdpve) | ~10GB/64GB | 128K | q4_0 | 1 | 4096/1024 | ✅ 65 tok/s |
+| qwen3.6-35B-udq4 | Strix Halo Vulkan | .15 (amdpve) | ~22GB/64GB | 128K | q4_0 | 1 | 4096/1024 | ✅ 65 tok/s |
 > **RTX 5070 model swap (2026-07-17)**: Switched from `gemma-4-12b-it-IQ4_NL` (Unsloth, 191 tok/s)
 > to `HauhauCS/Gemma4-12B-QAT-Uncensored-HauhauCS-Balanced` (Q4_K_M QAT, 87 tok/s).
 > Trade: 54% slower generation for QAT quality, 0/465 refusals, and agent-optimized tuning.
 > MTP draft also swapped: Q8_0 (444MB) → tuned draft (242MB), saving 200MB VRAM.
 > Role unchanged: gpu-light (vision, web extract, light auxiliary tasks).
 > **RTX 3090 model swap (2026-07-17)**: Switched from `Qwopus3.6-27B-v2-MTP-Q4_K_M` (63 tok/s)
 > to `bottlecapai/ThinkingCap-Qwen3.6-27B` (Q4_K_M QAT, 68 tok/s).
 > RL-finetuned: 50% fewer thinking tokens, MMLU-Pro 0.85 vs 0.83 base.
 > Self-spec MTP REQUIRED (crashes without it on turboquant build).
 > Added vision via mmproj (0.9GB). VRAM 85%.
 ## Routing Configuration (LiteLLM — July 2026)
@@ -119,8 +110,8 @@ but are deprecated for agent configs. Only the stable aliases survive model swap
 | Model | GPU | Weight | RPM Cap | Timeout |
 |-------|-----|--------|---------|---------|
-| qwen3.6-27B-code | RTX 3090 (.8:8080) | **0.55** | 500 | **300s** |
+| SmartCode-Fable-5-27B-UD-Q3_K_XL | RTX 3090 (.8:8080) | **0.55** | 500 | **300s** |
-| Genesis Hermes V3 APEX | Strix Halo (.15:8080) | **0.30** | 60 | **300s** |
+| qwen3.6-35B-udq4 | Strix Halo (.15:8080) | **0.30** | 60 | **300s** |
 | gemma-4-12b | RTX 5070 (.110:8080) | **0.15** | 200 | **120s** |
 Note: All syslog-auto entries route directly to GPUs with `api_key: not-needed`. The router (port 9000) is NOT in the inference path.
@@ -129,17 +120,17 @@ Note: All syslog-auto entries route directly to GPUs with `api_key: not-needed`.
 | Model | RPM Cap | Notes |
 |-------|---------|-------|
-| strix-moe (Hermes V3) | 40 | Tight cap — prevents Strix overload |
+| strix-moe (qwen3.6-35B-udq4) | 40 | Tight cap — prevents Strix overload |
-| qwen3.6-27B-code | 500 | ThinkingCap Q4_K_M + MTP self-spec + vision, 68 tok/s |
+| SmartCode-Fable-5-27B-UD-Q3_K_XL | 500 | High cap — primary workhorse (replaces qwen3.6-27B-code) |
-| gemma-4-12b | 500 | HauhauCS QAT Uncensored Balanced + MTP, 87 tok/s |
+| gemma-4-12b | 500 | High cap — IQ4_NL+MTP, 122 tok/s |
 ### Stable Aliases (for agent configs — never change)
 | Alias | RPM Cap | Routes To | Purpose |
 |-------|---------|-----------|---------|
 | `strix-moe` | 40 | Strix Halo | Compression tasks (MoE models) |
-| `gpu-dense` | 500 | RTX 3090 (ThinkingCap) | Heavy reasoning, code gen, delegation |
+| `gpu-dense` | 500 | RTX 3090 | Heavy reasoning |
-| `gpu-light` | 500 | RTX 5070 (HauhauCS QAT) | Vision, web extract, light tasks |
+| `gpu-light` | 500 | RTX 5070 | Vision, web extract, light tasks |
 ### Fallback Chains
 - gemma → qwen
@@ -217,7 +208,7 @@ Plaintext keys removed from this contract post-vault-migration.
 | Agent | CT | IP | LiteLLM Alias | Key Source | Access |
 |-------|-----|-----|---------------|------------|--------|
 | Tanko | 112 | .122 | `tanko` | Infisical vault | SSH jerome |
-| Mumuni | 114 | .123 | `mumuni` | Infisical vault | SSH root |
+| Mumuni | 100 (abiba) | .24 | `mumuni` | Infisical vault | SSH root |
 | Abiba | 100 | .24 | `abiba-pi` | Infisical vault | local (pi agent) |
 | Koby | 111 | ? | `koby` | Infisical vault | Zulip DM |
 | Koonimo | 113 | ? | `koonimo` | Infisical vault (migrated 2026-07-11) | no SSH |
@@ -260,13 +251,12 @@ If no SSH access, send Zulip DM via abiba-bot with vault update instructions.
  Fix: trigger roster reload via SSH after restart, or rebuild image with startup load_roster().
 - **LiteLLM /metrics**: Requires auth. Prometheus uses `/health/liveliness` as workaround.
 - **VRAM (2026-07-15)**: RTX 3090 at ~17/24.6GB (~70%) with **128K context** (reduced from 256K 2026-07-17). RTX 5070 at ~7.8/12.2GB (~65%) with 128K context + MTP. Strix Halo at ~7GB/64GB.
- **RTX 3090 runs `--parallel 2`** with MTP draft (spec-type draft-mtp, spec-draft-n-max 2).
+- **RTX 3090 (2026-07-27)**: Swapped to SmartCode-Fable-5-27B-UD-Q3_K_XL (14.7GB). Q4 was too large for 24GB VRAM with 128K context + KV cache overhead. Q3 fits at ~22.4GB (91%). Uses standard llama.cpp build b9190 (turboquant b9150 incompatible with qwen3_5 arch). Config: `-c 131072 -ctk q4_0 -ctv q4_0 --flash-attn on --cont-batching`. Sampler: `--temp 0.9 --top-p 0.95 --top-k 60 --min-p 0.0 --repeat-penalty 1.0`. Service: `/home/llmuser/llama-fable-wrapper.sh`.
- **RTX 3090 config**: `-c 131072 -ctk turbo4 -ctv turbo4 --parallel 1 --flash-attn on --cont-batching --spec-type draft-mtp --spec-draft-n-max 4`. ThinkingCap Qwen3.6-27B Q4_K_M (15.7GB) + mmproj (0.9GB) + MTP self-spec. VRAM: ~85%. Service: `/home/llmuser/llama-wrapper.sh`. ⚠️ MTP REQUIRED for stability on this turboquant build — model segfaults without `--spec-type draft-mtp`. Outputs reasoning_content (hidden from agent, improves answer quality).
+- **RTX 5070 config (2026-07-15)**: Switched to IQ4_NL + MTP draft (Q8_0) at 128K context. Gen speed: 122 tok/s. VRAM: ~7.8/12.2GB (~65%). Service: `/home/llmuser/llama-wrapper.sh`. Config: `--model gemma-4-12b-it-IQ4_NL.gguf --spec-draft-model gemma-4-12b-it-Q8_0-MTP.gguf --spec-type draft-mtp --spec-draft-n-max 4 --ctx-size 131072`.
- **RTX 5070 config (2026-07-17)**: HauhauCS Gemma4-12B QAT Uncensored Balanced (Q4_K_M) + tuned MTP draft (242MB) at 128K context, single slot. Gen speed: 87 tok/s (vs 191 IQ4_NL). VRAM: ~10.0/12.2GB (~82%). Service: `/home/llmuser/llama-wrapper.sh`. Model: `Gemma4-12B-QAT-Uncensored-HauhauCS-Balanced-Q4_K_M.gguf`, MTP: `mtp-gemma-4-12B-it.gguf`, mmproj: `mmproj-Gemma4-12B-QAT-Uncensored-HauhauCS-Balanced-BF16.gguf`. Recommended sampling: temp 0.6, top_k 64, top_p 0.9, min_p 0.05, repeat_penalty 1.1.
+- **LiteLLM timeout tuning (verified 2026-07-27)**: SmartCode-Fable-5-27B 300s, gemma-4-12b 120s, qwen3.6-27B-code 300s (legacy), qwen3.6-35B-udq4 300s, strix-moe 300s, syslog-auto routes all 300s. Nginx proxy_read_timeout: 600s. Global request_timeout: 300s.
- **LiteLLM timeout tuning (verified 2026-07-16 against `/opt/inference-harness/litellm_config.yaml` on CT 116)**: gemma-4-12b 120s, qwen3.6-27B-code 300s, qwen3.6-35B-udq4 300s, strix-moe 300s, syslog-auto routes all 300s. Nginx proxy_read_timeout: 600s. Global request_timeout: 300s.
+- **Strix Halo GPU**: Vulkan is the working backend (ROCm/HIP path abandoned — HSA runtime blocked on Debian 13). Build at `/root/llama.cpp/build-vk/`, commit `4fc4ec5` (2026-07-01), ggml 0.15.3 shared-lib arch. Mesa RADV 25.0.7, KHR_coopmat fast path active. ~70 tok/s gen, 532 tok/s prompt. Service: `strix-server.service` on port 8080, model: `qwen3.6-35B-udq4`, alias `strix-moe`, 128K context, flash-attn + q4 KV, multimodal (mmproj loaded).
 - **Strix Halo GPU**: Vulkan is the working backend (ROCm/HIP path abandoned — HSA runtime blocked on Debian 13). Build at `/root/llama.cpp/build-vk/`, commit `4fc4ec5` (2026-07-01), ggml 0.15.3 shared-lib arch. Mesa RADV 25.0.7, KHR_coopmat fast path active. ~70 tok/s gen, 532 tok/s prompt. Service: `strix-server.service` on port 8080, model: `LuffyTheFox/Qwen3.6-35B-A3B-Uncensored-Genesis-Hermes-V3-GGUF` (APEX quant), alias `strix-moe`, 128K context, flash-attn + q4 KV, multimodal (mmproj loaded). Hermes agent fine-tune, tensor repair (SSM layers fixed via SVD), uncensored (0/465 refusals).
 - **Port conflict detection (2026-07-05)**: All 3 GPU wrappers now detect ghost processes squatting port 8080 before starting. `.8` and `.110` use inline pre-start check in `llama-wrapper.sh`; `.15` uses `/usr/local/bin/port-cleanup.sh` ExecStartPre. Replaces the blanket `pkill -9 -x llama-server` on .15 which would kill ALL llama-server instances regardless of port. Ghost detection was the root cause of .8 crash-looping for 27+ restarts (stale pid 25836 squatting 8080 after OOM kill).
- **Strix Halo thermal safeguard (2026-07-02)**: `strix-server.service` has `-n 8192` (hard generation cap per request). Without it, `--predict` defaults to -1 (infinity) — a runaway request from .123 (Mumuni) decoded 39,868 tokens over 24 min, pushing Tctl to 98°C (crit 89.8°C) and throttling 70→29 t/s. The cap bounds worst-case generation to ~5 min. Do NOT remove `-n` without a replacement ceiling. Sustained load hits ~84°C even at 92s; the APU is fanless/low-flow. Clients MUST also set `max_tokens`.
+- **Strix Halo thermal safeguard (2026-07-02)**: `strix-server.service` has `-n 8192` (hard generation cap per request). Without it, `--predict` defaults to -1 (infinity) — a runaway request from .123 (old Mumuni CT114 — now inside Abiba CT100 at .24) decoded 39,868 tokens over 24 min, pushing Tctl to 98°C (crit 89.8°C) and throttling 70→29 t/s. The cap bounds worst-case generation to ~5 min. Do NOT remove `-n` without a replacement ceiling. Sustained load hits ~84°C even at 92s; the APU is fanless/low-flow. Clients MUST also set `max_tokens`.
 - **Port 8080 firewall**: amdpve iptables restricts 8080 to 192.168.68.116 (LiteLLM/router host) only. All inbound connections are from .116 (LiteLLM proxied via nginx). Localhost curls hang (SYN dropped). Always test from .116.
 - **Router sidecar fallback**: `router.py` `check_gpu_health()` now probes GPU `/health` directly when sidecar at :8090 is absent. Sidecar JSON exporters not deployed on any GPU host — router relies on GPU-direct fallback.
 - **Router GPU_MOE_URL bug (fixed 2026-07-01)**: docker-compose had `GPU_MOE_URL=.110:8080` (gemma host) instead of `.15:8080` (amdpve). Corrected.
@@ -278,11 +268,11 @@ If no SSH access, send Zulip DM via abiba-bot with vault update instructions.
 | GPU | Model | Gen tok/s | Prompt tok/s | Baseline | Context |
 |-----|-------|-----------|--------------|----------|---------|
-| RTX 3090 (.8) | ThinkingCap-Qwen3.6-27B Q4_K_M | **68** | — | — | **128K** |
+| RTX 3090 (.8) | SmartCode-Fable-5-27B-UD-Q3_K_XL | **TBD** | — | — | **128K** |
-| RTX 5070 (.110) | HauhauCS QAT Uncensored Balanced | **87** | — | — | **128K** |
+| RTX 5070 (.110) | gemma-4-12b (IQ4_NL+MTP) | **191** | — | — | **128K** |
-| Strix Halo (.15) | Genesis Hermes V3 APEX | **65** | 140 | — | **128K** |
+| Strix Halo (.15) | qwen3.6-35B-udq4 | **65** | 140 | — | **128K** |
-Benchmarks from 2026-07-17. Strix Halo swapped to Genesis Hermes V3 APEX (LuffyTheFox). RTX 5070 MTP provides 2.7x speedup over pre-upgrade 70 tok/s.
+Benchmarks from 2026-07-17. Strix Halo model: qwen3.6-35B-udq4. RTX 5070 MTP provides 2.7x speedup over pre-upgrade 70 tok/s.
 All 3 GPUs now at 128K context (2026-07-17, reduced from 256K for stability).
 Benchmarks run through LiteLLM proxy (192.168.68.116:4001) every 5 minutes.
@@ -311,7 +301,7 @@ When the underlying model is swapped, only the LiteLLM config changes — agent
 ### Mumuni Agent Profile
-Mumuni (CT114, 192.168.68.123) is the primary business assistant. This profile is the reference for all agent configs:
+Mumuni (CT100/abiba, 192.168.68.24) is the primary business assistant. This profile is the reference for all agent configs:
 | Setting | Value | Notes |
 |---------|-------|-------|
@@ -328,7 +318,7 @@ Mumuni (CT114, 192.168.68.123) is the primary business assistant. This profile i
 | `compression.protect_last_n` | 40 | Preserves last 40 messages |
 | `memory.memory_char_limit` | 800 | Brief memory entries |
 | `personalities` | `creative` | Creative assistant personality |
-| Platforms | cli, discord, homeassistant, signal, telegram, zulip | All Hermes platforms |
+| Platforms | cli, homeassistant, signal, telegram, zulip | All Hermes platforms |
 | Main model timeout | 300s | LiteLLM global timeout |
 | Compression model timeout | 300s | strix-moe timeout increased from 120s |
@@ -336,7 +326,7 @@ Mumuni (CT114, 192.168.68.123) is the primary business assistant. This profile i
 | Agent | Host | Status |
 |-------|------|--------|
-| **Mumuni** | CT114 (.123) | ✅ Updated to stable aliases |
+| **Mumuni** | CT100 (.24) | ✅ Updated to stable aliases |
 | **Tanko** | CT112 (.122) | ✅ Updated to stable aliases |
 | **Koby** | CT111 (.129) | ❌ SSH unreachable — needs Zulip DM |
 | **Koonimo** | CT113 | ❌ SSH unreachable — needs Zulip DM |
@@ -47,7 +47,7 @@ poll .15:8080 directly; must go through router on .116.
 | Router (unified) | `http://192.168.68.116/health/unified` | 15s | models, CB, scores, GPU status |
 | Router (basic) | `http://192.168.68.116/health` | 15s | basic aliveness |
 | LiteLLM | `http://192.168.68.116/litellm/health` | 15s | proxy health, model count |
-| Strix Halo | `http://192.168.68.116/health/unified` (router) | 15s | ornith status via router — cannot poll .15:8080 directly (firewalled to .116 only) |
+| Strix Halo | `http://192.168.68.116/health/unified` (router) | 15s | Strix Halo status via router — cannot poll .15:8080 directly (firewalled to .116 only) |
 | Dashboard | `http://192.168.68.116/dashboard/` | 15s | harness-dashboard aliveness |
 ### Alert Delivery
@@ -46,7 +46,7 @@ depends_on:
 |-------|-----|------|-------|------|-----|-------|------|
 | `gpu-dense` | RTX 3090 24GB | ct8 (.8:8080) | ThinkingCap Qwen3.6-27B Q4_K_M + MTP + vision | 21.6/24.6GB (88%) | 128K | 74.9 | Heavy reasoning, code gen |
 | `gpu-light` | RTX 5070 12GB | ct110 (.110:8080) | HauhauCS Gemma4-12B QAT Q4_K_M + MTP draft | 10.1/12.2GB (83%) | 128K | 169.6 | Vision, web extract, light tasks |
-| `strix-moe` | Strix Halo 64GB | ct15 (.15:8080) | Genesis Hermes V3 APEX (LuffyTheFox, 24GB) | ~10/64GB (16%) | 128K | 62.9 | Compression, summarization, long docs |
+| `strix-moe` | Strix Halo 64GB | ct15 (.15:8080) | qwen3.6-35B-udq4 | ~10/64GB (16%) | 128K | 62.9 | Compression, summarization, long docs |
 Key notes:
 - All models use direct GPU routing via LiteLLM (`api_key: not-needed`). Router (port 9000) is deprecated and NOT in the inference path.
@@ -143,7 +143,7 @@ Key notes:
 - **Detect**: Benchmark tok/s vs baseline for each GPU at current context (all 128K)
  - RTX 3090 (128K ctx, ThinkingCap): baseline 74.8 tok/s — currently at 74.9 (100%)
  - RTX 5070 (128K ctx, HauhauCS QAT): baseline 165.2 tok/s — currently at 169.6 (103%)
-  - Strix Halo (128K ctx, Genesis Hermes V3): baseline 70.5 tok/s — currently at 62.9 (89%)
+  - Strix Halo (128K ctx, qwen3.6-35B-udq4): baseline 70.5 tok/s — currently at 62.9 (89%)
 - **Fix**:
  - If tok/s > baseline → context has headroom, consider increasing
  - If tok/s < 90% baseline → reduce context by 25% and retest
@@ -251,8 +251,8 @@ call update-gpu-health
 ## Reporting
-### 1. Knowledge Graph
+### 1. Gitea Log (not knowledge graph — hard rule)
-Every action logged as `[GPU-SELF-HEAL] <run_id>` node with full audit trail.
+Pushed to `SyslogSolution/health-logs/gpu/{run_id}.json` — versioned, searchable, not in graph.
 ### 2. Zulip Alerts (#agent-hub → alerts-gpu)
 - `issues_fixed > 0` → "🛠 GPU Self-Heal — <gpu> <issue> resolved"
@@ -5,7 +5,7 @@ version: 1.0.0
 description: >
  Canonical known-good baseline for all Syslog Hermes agents. Captures the exact
  configuration state, keys, workarounds, and audit procedure. When an agent's
-  configuration goes sideways, restore from this baseline. Last verified 2026-07-16. All GPUs 256K context (RTX 3090 .8, RTX 5070 .110, Strix Halo .15). Parallel 1 fleet-wide (Strix Halo handles compression solo).
+  configuration goes sideways, restore from this baseline. Last verified 2026-07-16. All GPUs 128K context (reduced from 256K for stability Jul 2026) (RTX 3090 .8, RTX 5070 .110, Strix Halo .15). Parallel 1 fleet-wide (Strix Halo handles compression solo).
 author: Abiba (pi agent)
 ---
@@ -25,12 +25,12 @@ done
 | Agent | CT | Node | IP | LiteLLM Alias | Key Source | Platform |
 |-------|-----|------|-----|---------------|------------|----------|
 | Tanko | 112 | amdpve | .122 | `tanko` | Infisical vault | Hermes |
-| Mumuni | 114 | minipve | .123 | `mumuni` | Infisical vault | Hermes |
+| Mumuni | 114 | hwepve | .123 | `mumuni` | Infisical vault | Hermes |
-| Koby | 129 | amdpve | srv1079750 | `koby` | Infisical vault | **Hermes** |
+| Koby | 111 | amdpve | srv1079750 | `koby` | Infisical vault | **Hermes** |
-| Koonimo | 114 | amdpve | ? | `koonimo` | Infisical vault | Hermes |
+| Koonimo | 113 | amdpve | .114 | `koonimo` | Infisical vault | Hermes |
 | Shumba | — | 192.168.68.119 | N/A | N/A (DeepSeek) | Hermes (RETIRED — CT119 now Infisical vault) |
-> **Note**: CT hostnames (tdunna→CT129, baggy→CT114) differ from agent identities (koby, koonimo).
+> **Note**: CT hostnames (tdunna→CT111, baggy→CT113) differ from agent identities (koby, koonimo).
 Access: `pct-run <CT_ID> <command>` — no IPs needed. GPU hosts (.8, .110, .15) use SSH.
 Keys are stored in Infisical vault (project=agents, env=production) and injected at
@@ -169,9 +169,9 @@ pct-run <CT> grep -A8 "vision:" /root/.hermes/config.yaml | grep api_key
 # Must show both api_key: sk-... and api_key_env: LITELLM_API_KEY
 ```
-### For Koby (CT 129 / tdunna)
+### For Koby (CT 111 / tdunna)
-Koby runs Hermes on CT 129 (tdunna). Config files at `/root/.hermes/config.yaml`.
+Koby runs Hermes on CT 111 (tdunna). Config files at `/root/.hermes/config.yaml`.
 Same Hermes pattern as Tanko/Mumuni/Koonimo — see config sections above.
 **LiteLLM key**: alias `koby` in LiteLLM DB, injected via `infisical run --` wrapper.
@@ -193,6 +193,8 @@ Key is injected via `infisical run --` wrapper at PM2 startup:
      "models": [
        { "id": "syslog-auto" },
        { "id": "strix-moe" },
        { "id": "gpu-dense" },
        { "id": "gpu-light" },
        { "id": "qwen3.6-27B-code" },
        { "id": "gemma-4-12b" }
      ]
@@ -5,14 +5,11 @@ description: >
  Standard Hermes configuration template for Syslog Solution LLC agents.
  Enforces shared infrastructure setup (Firecrawl, SearXNG, local models,
  RA-H OS MCP) while keeping agent-specific API keys and model choices.
-  UPDATED 2026-07-18: Compression model switched to `syslog-auto` (was `strix-moe`)
+  UPDATED 2026-07-16: Compression model is the stable alias `strix-moe` (NOT `ornith-1.0-35b`,
  to relieve Strix Halo pressure. syslog-auto distributes compression across the
  weighted pool (55% RTX 3090, 30% Strix Halo, 15% RTX 5070).
  UPDATED 2026-07-16: Compression model was the stable alias `strix-moe` (NOT `ornith-1.0-35b`,
  which LiteLLM does not serve). All 3 GPUs verified at 128K (reduced from 256K 2026-07-17 for stability).
  Added Rule 12 (Context-Issue Diagnostic) + Rule 13 (.env fallback enforcement) from the
  2026-07-16 Mumuni root-cause investigation (WAL #1300).
-  UPDATED 2026-07-12: GPU workload redistributed. Compression → Strix Halo (later switched to syslog-auto 2026-07-18). RTX 3090 context verified at 128K. Infisical .env fallback required (Rule 3/13).
+  UPDATED 2026-07-12: GPU workload redistributed. Compression → Strix Halo. RTX 3090 context verified at 128K. Infisical .env fallback required (Rule 3/13).
 ---
 ## Maintains
@@ -133,9 +130,7 @@ mcp_servers:
 # ─── Compression ───
 compression:
  enabled: true
-  model: syslog-auto              # ⚠️ Switched from strix-moe 2026-07-18 to relieve Strix Halo.
+  model: syslog-auto               # ⚠️ Must match auxiliary.compression.model. Stable alias (gpu-fleet § Stable Role-Based Aliases). NOT ornith-1.0-35b (LiteLLM does not serve that name).
                                  # syslog-auto distributes across weighted pool (55% RTX 3090,
                                  # 30% Strix Halo, 15% RTX 5070). All GPUs at 128K.
  provider: harness
  max_context_window: 131072      # MUST match actual GPU capacity. All 3 GPUs are 128K (Jul 17).
  threshold: 0.65                 # Fires at ~170K for 262K window, ~85K for 128K
@@ -150,9 +145,8 @@ compression:
 #   model: gpu-light                 # stable alias (NOT raw "gemma-4-12b")
 #   base_url: http://192.168.68.116/v1
 #   api_key_env: LITELLM_API_KEY
-# Compression uses syslog-auto (switched from strix-moe 2026-07-18) to distribute
+# Do NOT use syslog-auto for auxiliary tasks — it routes to the primary GPU.
-# load across the weighted pool and relieve Strix Halo pressure.
+# gpu-light = RTX 5070 (12B), freeing the Strix Halo for agent reasoning.
 # Vision and web_extract use gpu-light = RTX 5070 (12B).
 # Heavy aux (delegation, x_search) use gpu-dense (RTX 3090) instead.
 # NEVER use raw model names (gemma-4-12b, qwen3.6-27B-code, qwen3.6-35B-udq4)
 # in agent configs — use the stable aliases so model swaps don't break agents.
@@ -172,7 +166,7 @@ auxiliary:
    timeout: 30
  compression:
    provider: harness
-    model: syslog-auto             # Switched from strix-moe 2026-07-18. Relieves Strix Halo pressure.
+    model: syslog-auto              # MUST match compression.model above. Stable alias for Strix Halo (weighted pool).
    base_url: http://192.168.68.116/v1   # Rule 5: /v1 NOT /litellm/v1
    api_key_env: LITELLM_API_KEY
    timeout: 300                 # gpu-fleet: 300s for large-history summarization (was 60)
@@ -253,30 +247,34 @@ The following MUST be identical across ALL profiles:
 - Apply to BOTH main config AND all sub-agent profiles
 - For agents needing longer outputs: raise to 8192, but never omit
-### Rule 7: Auxiliary Model Consistency (UPDATED 2026-07-18)
+### Rule 7: Auxiliary Model Consistency (UPDATED 2026-07-16)
- Vision and web_extract use `gpu-light` (stable alias, RTX 5070 — 12GB, vision-optimized)
+- Vision and web_extract use `gemma-4-12b` (RTX 5070 — 12GB, vision-optimized)
- Compression now uses `syslog-auto` (switched from `strix-moe` 2026-07-18) to distribute
+- Compression uses `strix-moe` (stable alias for Strix Halo — 64GB, 128K ctx, compression-optimized)
-  compression load across the weighted pool (55% RTX 3090, 30% Strix Halo, 15% RTX 5070).
+- **`strix-moe` is the only valid compression model name** — LiteLLM does NOT serve `ornith-1.0-35b`
-  This relieves Strix Halo pressure while keeping compression functional on all GPUs.
+  (it serves `strix-moe`, `qwen3.6-35B-udq4`, `gpu-dense`, `gpu-light`, `syslog-auto`, `gemma-4-12b`, `qwen3.6-27B-code`). Old configs with `ornith-1.0-35b` cause 403/model-not-found on compression calls.
- **`syslog-auto` is the valid compression model** — LiteLLM serves it as the weighted pool.
+- **OPERATIONAL DECISION (2026-07-23): Use `syslog-auto` for compression across all agents.**
-  Old configs with `strix-moe` for compression should be updated to `syslog-auto`.
+  The `syslog-auto` alias routes to the Strix Halo, but uses the weighted pool instead of pinning
  to `strix-moe` directly. This prevents sustained Strix Halo thermal load because the pool can
  fall back to other GPUs if Strix gets hot. Both `compression.model` and `auxiliary.compression.model`
  MUST be `syslog-auto`.
 - All auxiliary services MUST use identical routing:
  - `base_url: http://192.168.68.116/v1`  (Rule 5: `/v1`, NOT `/litellm/v1`)
  - `api_key_env: LITELLM_API_KEY`
- **Compression via syslog-auto**: Routes through the weighted pool. Strix Halo still handles
+- **Do NOT use `syslog-auto`** for auxiliary tasks — it routes unpredictably
-  ~30% of compression calls (at 60 RPM via pool vs 40 RPM direct), but the bulk (55%)
+- **Compression on Strix Halo**: The strix-moe alias routes to Strix Halo
-  goes to RTX 3090 which has ample spare capacity.
+  (64GB UMA, 128K context) — the designated compression GPU. This frees the
  RTX 5070 for vision and web search, and the RTX 3090 for heavy reasoning.
 - The `compression:` block's `model` MUST match `auxiliary: compression: model`
 - The `compression: max_context_window: 131072` MUST match actual GPU capacity (128K)
-### Rule 8: GPU Workload Distribution (UPDATED 2026-07-18)
+### Rule 8: GPU Workload Distribution (UPDATED 2026-07-16)
- **RTX 3090 (24GB, 128K ctx, qwen3.6-27B-code)**: Heavy reasoning, code gen, long conversations — also handles ~55% of compression via syslog-auto pool
+- **RTX 3090 (24GB, 128K ctx, qwen3.6-27B-code)**: Heavy reasoning, code gen, long conversations
- **RTX 5070 (12GB, 128K ctx, gemma-4-12b)**: Vision, web search, quick tasks, web_extract — handles ~15% of compression via syslog-auto pool
+- **RTX 5070 (12GB, 128K ctx, gemma-4-12b)**: Vision, web search, quick tasks, web_extract (IQ4_NL+MTP, ~65% VRAM at 128K)
- **Strix Halo (64GB, 128K ctx, Geneis Hermes V3 APEX)**: Agent reasoning, compression (~30% via syslog-auto pool), fallback for other GPUs
+- **Strix Halo (64GB, 128K ctx, syslog-auto)**: Context compression, summarization, long docs
 - Agent profiles MUST route auxiliary tasks to the correct GPU:
-  - `auxiliary.vision.model: gpu-light` (RTX 5070)
+  - `auxiliary.vision.model: gemma-4-12b` (RTX 5070)
-  - `auxiliary.web_extract.model: gpu-light` (RTX 5070)
+  - `auxiliary.web_extract.model: gemma-4-12b` (RTX 5070)
-  - `auxiliary.compression.model: syslog-auto` (distributed pool, switched from strix-moe 2026-07-18)
+  - `auxiliary.compression.model: syslog-auto` (Strix Halo)
 - Default model (`model.default`) and custom_provider remain `syslog-auto` for auto-routing
 - For 128K context window: `threshold: 0.65` (fires at ~85K tokens)
 - Do NOT use `threshold: 0.25` — this fires at 65K, causing premature context loss
@@ -332,7 +330,8 @@ verify ALL FOUR of these against the live config. They are the only root causes
 One-line agent health check (run on the agent host):
 ```bash
-PID=$(pgrep -f "python -m hermes_cli.main gateway run" | head -1)
+# Use grep -v infisical to avoid matching the bash wrapper that contains the same string
 PID=$(pgrep -f "python -m hermes_cli.main gateway run" | grep -v infisical | head -1)
 cat /proc/$PID/environ | tr '\0' '\n' | grep ^LITELLM_API_KEY= | sed 's/=.*/<set>/'
 curl -s -o /dev/null -w 'key_health: %{http_code}\n' -H "Authorization: Bearer $(cat /proc/$PID/environ | tr '\0' '\n' | grep ^LITELLM_API_KEY= | cut -d= -f2)" http://192.168.68.116/v1/models
 ```
@@ -358,15 +357,45 @@ directly (no infisical). Apply with `systemctl daemon-reload && systemctl restar
 The wrapper sources `~/.hermes/.env` then exports `LITELLM_API_KEY="$<AGENT>_LITELLM_API_KEY"`.
 See litellm-api-keys.prose.md § Machine Identity for Vault Writes for vault sync.
 **⚠️ Vault empty-key guard:** If the vault stores the secret as an empty string,
 the wrapper will inject an empty key and the gateway will silently get 401 errors
 on all LiteLLM requests (triggering silent DeepSeek fallback). The `.env` fallback
 is present but the vault takes precedence when the secret key exists (even if empty).
 **Fix:** The wrapper MUST validate the key length after injection. If LITELLM_API_KEY
 is empty or shorter than 20 chars, log a warning and either fail with a clear error
 message or fall back to the `.env` value before starting the gateway.
 **Verification (all agents):**
 ```bash
-GP=$(pgrep -f "python -m hermes_cli.main gateway run" | head -1)
+# Use grep -v infisical to avoid matching the bash wrapper that contains the same string
 GP=$(pgrep -f "python -m hermes_cli.main gateway run" | grep -v infisical | head -1)
 K=$(cat /proc/$GP/environ | tr '\0' '\n' | grep '^LITELLM_API_KEY=' | cut -d= -f2)
 curl -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $K" http://192.168.68.116/v1/models  # must be 200
 ```
 - `/etc/environment` is NO LONGER the canonical key source (stale values there caused 401s).
 - Do NOT leave a hardcoded stale key in `/etc/environment` — it shadows the drop-in/wrapper.
 ### Rule 14: Provider Name Must Match custom_providers Name (ADDED 2026-07-19, WAL #1471)
 - `model.provider` MUST be `harness` (the `custom_providers[0].name`), NOT the literal string `custom`
 - When `provider: custom`, Hermes' `_get_named_custom_provider("custom")` returns None (no provider is
  named "custom" — it is named "harness"), causing a fall-through to the generic resolution path
  (`source: env/config`) at `runtime_provider.py:1156`
 - The generic path builds `api_key_candidates` from `model.api_key` (empty), host-gated
  OLLAMA/OPENAI/OPENROUTER keys, and `_host_derived_api_key` (returns "" for IP addresses)
 - **The generic path does NOT resolve `model.api_key_env` or `custom_providers.key_env`** —
  `LITELLM_API_KEY` is never read, producing `api_key = "no-key-required"` → HTTP 401
 - The named custom provider path (`source: custom_provider:harness`) DOES read `key_env` —
  but only triggers when `provider` matches the `custom_providers[0].name`
 - All sections MUST use `provider: harness`: `model`, `compression`, `auxiliary.vision`,
  `auxiliary.web_extract`, `auxiliary.compression`, `delegation`
 - Only `fallback_providers` uses a different provider (`deepseek`) for true fallback diversity
 - **Diagnostic**: If you see `source: env/config` in a request dump or log, the provider name
  is wrong. It should be `source: custom_provider:harness`.
 - **Audit script**: Run `python3 /root/prose-contracts/audit-hermes-config.py <config.yaml>`
  before and after any config change to catch this and all other rule violations.
 ## Execution
 1. **Check current config** — Read the target agent's config.yaml
@@ -189,7 +189,7 @@ litellm_settings:
 | Agent | CT | IP | LiteLLM Alias | Key Source | Status | Gateway Wrapper | Last Verified |
 |-------|-----|-----|---------------|------------|--------|-----------------|---------------|
 | Tanko | 112 | .122 | `tanko` | Infisical vault | ✅ Fixed | `infisical run` | 20:17 UTC Jul 5 |
-| Mumuni | 114 | .123 | `mumuni` | Infisical vault | ✅ Fixed | `infisical run` | 01:46 EDT Jul 10 |
+| Mumuni | 100 (abiba) | .24 | `mumuni` | Infisical vault | ✅ Fixed | Pi Hermes gateway | 2026-07-27 |
 | Koby | 111 | ? | `koby` | Infisical vault | ✅ Fixed | `infisical run` | 23:30 UTC Jul 5 |
 | Koonimo | 113 | ? | `koonimo` | Infisical vault | ✅ Fixed | `infisical run` (migrated 2026-07-11) | 2026-07-11 |
 | Abiba | 100 | .65 | `abiba-pi` | Infisical vault | ✅ N/A (pi native) | — | 19:44 UTC Jul 5 |
@@ -51,7 +51,7 @@ gateway restart, and connection validation.
 | Host | CT | Proxmox | IP (direct) | Hermes Home | User |
 |------|-----|---------|-------------|-------------|------|
-| Mumuni | CT114 | — | 192.168.68.123 | /root/.hermes | root |
+| Mumuni | CT100 (abiba) | hwepve | 192.168.68.24 | /root/.hermes | root |
 | Tanko | CT112 | amdpve | 192.168.68.122 | /home/jerome/.hermes | jerome |
 | Koby | CT111 | amdpve | 192.168.68.129 | /root/.hermes | root |
 | Shumba | — | — | 192.168.68.119 | /home/lucky/.hermes | lucky |
@@ -22,14 +22,14 @@ management, and prompt caching — without sacrificing agent capability.
 - `agent-configs`: current config.yaml from each active Hermes agent (Mumuni
  .123, any others on .129/.122) including compression, model, context_window,
  prompt_caching, memory settings
- `gpu-health`: health check response from all 3 GPU backends (ornith .15:8080,
+- `gpu-health`: health check response from all 3 GPU backends (strix-moe .15:8080,
  qwen .8:8080, gemma .110:8080)
 ### Maintains
 The optimized inference stack configuration — every change is applied and
 verified end-to-end. Postcondition: avg request_duration_ms ≤ 15000 for 90% of
-non-ornith traffic; ≤ 30000 for ornith-bound agentic calls.
+inference calls.
 #### liteLLM-routing
 The syslog-auto routing weights, model-specific timeouts, RPM limits, and
@@ -53,18 +53,17 @@ duration.
 ### Strategies
-**Context is the root cause.** Every ~46K prompt token costs ~87s of ornith
+**Context is the root cause.** Every ~46K prompt token costs ~87s of
 prefill time at 532 tok/s. Fix context first, routing second.
- **Route by task**: ornith for multi-step reasoning only; qwen for code/standard
+- **Route by task**: qwen for code/standard queries; gemma for
-  queries; gemma for compression/auxiliary. Never send simple completion to a
+  compression/auxiliary; strix-moe for compression tasks.
-  35B MoE.
+- **Compress aggressively**: threshold at 40% (not 65%) — a 128K window should
- **Compress aggressively**: threshold at 40% (not 65%) — a 256K window should
+  compact at 51K, not 85K. Target 15% tail (not 30%).
  compact at 102K, not 166K. Target 15% tail (not 30%).
 - **Cache everything repeated**: system prompts, skill docs, AGENTS.md — these
  never change between turns. Single-digit cache hit rate is unacceptable.
 - **Lower context ceiling**: 128K window is the stable ceiling for agent conversations.
-  GPUs reduced from 256K to 128K (2026-07-17). For larger contexts, route to external providers.
+  GPUs reduced from 256K to 128K (2026-07-17). 128K window should compact at 85K (0.65 threshold). For larger contexts, route to external providers.
 ### Shape
@@ -100,5 +99,5 @@ call enable-prompt-caching
 call verify-latency
  host: 192.168.68.116
-  models: [syslog-auto, qwen3.6-27B-code, gemma-4-12b, ornith-1.0-35b]
+  models: [syslog-auto, qwen3.6-27B-code, gemma-4-12b]
 ```
@@ -3,7 +3,7 @@ kind: pattern
 name: infrastructure-control
 description: >
  Full infrastructure monitoring and control pattern covering the
-  5-node Proxmox cluster, 3 Docker ecosystems (22 containers),
+  6-node Proxmox cluster, 3 Docker ecosystems (22 containers),
  NFS storage, and network services. Defines monitors, remediations,
  and the access matrix for all environments.
@@ -12,6 +12,11 @@ description: >
  never mutate infrastructure based on them without first confirming
  against the live system. Policy fields are authoritative. See the
  `verify-before-mutate` skill.
  **Last verified:** 2026-07-24 — corrected Gitea IP (.17 not .110),
  AdGuard IP (.10 not .102), AdGuard placement (minipve not acerpve),
  Abiba placement (hwepve not amdpve), added hwepve as 6th node,
  added dns.sysloggh.net route.
 ---
 # Infrastructure Control Pattern
@@ -42,8 +47,8 @@ description: >
               │      │      │      │      │
          ┌────┘ ┌────┘ ┌────┘ ┌────┘ ┌────┘
          ▼      ▼      ▼      ▼      ▼
-       minipve amdpve storepve acerpve ocupve
+       minipve amdpve storepve acerpve ocupve hwepve
-        (.12)   (.15)   (.6)    (.9)    (.5)
+        (.12)   (.15)   (.6)    (.9)    (.5)    (.4)
          ▼
   ┌─────────────────────────────────────────────┐
@@ -95,15 +100,21 @@ description: >
 ## Section 2: Proxmox Cluster — Monitoring
-### Nodes (5)
+### Nodes (6)
 | Node | IP | CPU | RAM | VMs/CTs | Role |
 |------|----|-----|-----|---------|------|
-| minipve | .12 | 16C | 30GB | authentik, gitea, mumuni, syslog-api, jitsi | Auth, git, messaging |
+| minipve | .12 | 16C | 30GB | authentik, gitea, syslog-api, infisical-vault, jitsi | Auth, git, messaging |
-| amdpve | .15 | 32C | 62GB | abiba, kagentz, tanko, tdunna, baggy, scottdenya | Agents, compute |
+| amdpve | .15 | 32C | 62GB | tanko, tdunna, baggy, scottdenya | Agents, compute |
-| storepve | .6 | 28C | 31GB | docker-vm, ra-h-os, PBS, media, zulip | Docker, storage, chat |
+| storepve | .6 | 28C | 31GB | docker-vm, ra-h-os, PBS, media, jdownloader, zulip | Docker, storage, chat |
-| acerpve | .9 | 28C | 31GB | llm-gpu, adguard | GPU VMs |
+| acerpve | .9 | 28C | 31GB | llm-gpu | GPU VMs |
 | ocupve | .5 | 12C | 14GB | ocu-llm | GPU VMs |
 | hwepve | .4 | 12C | 15GB | abiba, kagentz, (mumuni CT 114 stopped) | Agents (new node) |
 > **Note:** CTs on storepve include jdownloader (CT 118). AdGuard (CT 102) is on
 > minipve at .10, not acerpve. Abiba (CT 100) is on hwepve, not amdpve. Mumuni
 > (CT 114) is on hwepve (currently stopped), not minipve. Mumuni also has a
 > second instance on minipve at .123 — distinguish by CT ID, not hostname.
 ### Checks (every 5 min)
@@ -199,7 +210,7 @@ description: >
 **Prometheus targets**:
 - 192.168.68.8:9400 (RTX 3090 — qwen)
 - 192.168.68.110:9400 (RTX 5070 — gemma)
- 192.168.68.15:9400 (Strix Halo — ornith)
+- 192.168.68.15:9400 (Strix Halo — qwen3.6-35B-udq4)
 - 192.168.68.24:9401 (Router metrics exporter)
 - harness-litellm:4000 (LiteLLM health)
@@ -354,16 +365,18 @@ fine. Services that resolve directly to a LAN IP are NetBird-independent.
 |---------|--------|-------------|-------------|-------------|--------|
 | Proxmox API | minipve.sysloggh.net:8006 | 192.168.68.12 | LAN IP | No | ✅ |
 | LiteLLM | litellm.sysloggh.net | 192.168.68.116 | LAN IP | No | ✅ |
-| Authentik | auth.sysloggh.net:443 | 192.168.68.11 | CNAME → netbird | **Yes** | ⚠️ |
+| Authentik | auth.sysloggh.net:443 | 192.168.68.11:9000 | CNAME → netbird | **Yes** | ⚠️ |
-| Gitea | git.sysloggh.net:443 | 192.168.68.110 | CNAME → netbird | **Yes** | ⚠️ |
+| Gitea | git.sysloggh.net:443 | 192.168.68.17:3000 | CNAME → netbird | **Yes** | ⚠️ |
 | Zulip | chat.sysloggh.net:443 | 192.168.68.19 | CNAME → netbird | **Yes** | ⚠️ VERIFY-BEFORE-USE |
 | Pulse | pulse.sysloggh.net:443 | 192.168.68.7 | CNAME → netbird | **Yes** | ⚠️ |
-| DNS UI | dns.sysloggh.net:443 | 192.168.68.102 | CNAME → netbird | **Yes** | ⚠️ |
+| DNS UI | dns.sysloggh.net:443 | 192.168.68.10:80 | CNAME → netbird | **Yes** | ⚠️ |
 | SearXNG | searxng.sysloggh.net:8888 | 192.168.68.7:8888 | LAN IP | No | ✅ |
 | Firecrawl | firecrawl.sysloggh.net:3002 | 192.168.68.7:3002 | LAN IP | No | ✅ |
-**Verified 2026-07-02:** NetBird VPS rebooted after a hang; all CNAME'd
+**Verified 2026-07-24:** NetBird VPS rebooted after a hang; all CNAME'd
 services recovered. LAN-IP-direct paths stayed up throughout the outage.
 Also added `dns.sysloggh.net` route (was missing entirely).
 See `scripts/netbird-add-domain.sh` for adding new proxy routes.
 ### 5.2 Checks (every 2 min)
@@ -511,8 +524,8 @@ enforced by the `routing-regression.config_url_violations` check in Section
 | LiteLLM API | `http://192.168.68.116:4000` | `https://litellm.sysloggh.net` |
 | LiteLLM (nginx) | `http://192.168.68.116` | — |
 | Grafana | `http://192.168.68.116:3001` | — |
-| Authentik | `https://192.168.68.11` | `https://auth.sysloggh.net` |
+| Authentik | `https://192.168.68.11:9000` | `https://auth.sysloggh.net` |
-| Gitea | `http://192.168.68.110:3000` | `https://git.sysloggh.net` |
+| Gitea | `http://192.168.68.17:3000` | `https://git.sysloggh.net` |
 | Zulip API | `http://192.168.68.19` | `https://chat.sysloggh.net` |
 | SearXNG | `http://192.168.68.7:8888` | — |
 | Firecrawl | `http://192.168.68.7:3002` | — |
@@ -575,25 +588,26 @@ ssh root@192.168.68.110 "systemctl restart llama-server"
 | CT | Name | Node | IP | Role | Agent |
 |----|------|------|----|------|-------|
-| 100 | abiba | amdpve | .24 | Pi agent (this host) | ✅ pi |
+| 100 | abiba | **hwepve** | .24 | Pi agent | ✅ pi |
 | 101 | llm-gpu | acerpve | .8 | GPU RTX 3090 | ❌ |
-| 102 | adguard | acerpve | — | DNS | ❌ |
+| 102 | adguard | **minipve** | **.10** | DNS | ❌ |
 | 103 | ocu-llm | ocupve | .110 | GPU RTX 5070 | ❌ |
 | 104 | authentik | minipve | .11 | OIDC | ❌ |
-| 105 | kagentz | amdpve | — | Agent Zero | ✅ |
+| 105 | kagentz | **hwepve** | — | Agent Zero | ✅ |
 | 106 | ra-h-os | storepve | .65 | KG bridge | ✅ MCP |
 | 107 | pbs | storepve | — | Backups | ❌ |
 | 108 | media | storepve | — | Media | ❌ |
 | 109 | docker-vm | storepve | .7 | Docker host | ❌ |
-| 110 | gitea | minipve | — | Git | ❌ |
+| 110 | gitea | minipve | **.17** | Git | ❌ |
 | 111 | tdunna | amdpve | .129 | Hermes agent | ✅ |
 | 112 | tanko | amdpve | .122 | Hermes agent | ✅ |
-| 113 | baggy | amdpve | ? | Hermes agent | ✅ |
+| 113 | baggy | amdpve | .114 | Hermes agent | ✅ |
-| 114 | mumuni | minipve | .123 | Hermes agent | ✅ |
+| 114 | mumuni | **hwepve** | .123 | Hermes agent (stopped) | ✅ |
-| 115 | scottdenya | amdpve | — | ? | ❌ |
+| 115 | scottdenya | amdpve | .75 | Denya OneCare | ❌ |
 | 116 | syslog-api | minipve | .116 | LiteLLM + Grafana | ❌ |
-| 117 | zulip | storepve | — | Chat | ❌ |
+| 117 | zulip | storepve | .19 | Chat | ❌ |
-| 118 | jitsi | minipve | — | Video | ❌ |
+| 118 | jdownloader | storepve | — | JDownloader container | ❌ |
 | 119 | infisical-vault | minipve | — | Vault | ❌ |
 ## Appendix C: Docker Compose Files Location
@@ -613,27 +627,28 @@ Source of truth: `/root/scripts/pct-run.sh` or `prose-contracts/scripts/pct-run.
 | CT | Name | Node | pct-run |
 |-----|------|------|---------|
-| 100 | abiba | amdpve | `pct-run 100` |
+| 100 | abiba | hwepve | `pct-run 100` |
-| 105 | kagentz | amdpve | `pct-run 105` |
+| 105 | kagentz | hwepve | `pct-run 105` |
 | 111 | tdunna | amdpve | `pct-run 111` |
 | 112 | tanko | amdpve | `pct-run 112` |
 | 113 | baggy | amdpve | `pct-run 113` |
 | 115 | scottdenya | amdpve | `pct-run 115` |
 | 104 | authentik | minipve | `pct-run 104` |
 | 110 | gitea | minipve | `pct-run 110` |
-| 114 | mumuni | minipve | `pct-run 114` |
+| 114 | mumuni | hwepve | `pct-run 114` |
 | 116 | syslog-api | minipve | `pct-run 116` |
 | 106 | ra-h-os | storepve | `pct-run 106` |
 | 107 | proxmox-backup | storepve | `pct-run 107` |
 | 108 | media | storepve | `pct-run 108` |
 | 117 | zulip | storepve | `pct-run 117` |
-| 102 | adguard | acerpve | `pct-run 102` |
+| 102 | adguard | **minipve** | `pct-run 102` |
 GPU bare-metal hosts (.8 acerpve, .110 ocupve, .15 amdpve) are NOT CTs — use SSH directly:
 ```bash
 ssh root@192.168.68.8   # RTX 3090
 ssh root@192.168.68.110 # RTX 5070
 ssh root@192.168.68.15  # Strix Halo
 ssh root@192.168.68.4   # hwepve (abiba, kagentz, mumuni)
 ```
 ## Section 7: Agent Health Check (consolidated — 2026-07-05)
@@ -0,0 +1,200 @@
 ---
 kind: responsibility
 name: infrastructure-maintenance
 description: >
  Weekly system-level maintenance for the Syslog inference fleet: OS package
  updates on the primary host, Docker image pulls for LiteLLM/SearXNG and other
  running containers, container restarts with health verification, post-update
  verification of every critical service (LiteLLM proxy, SearXNG, Zulip, Gitea,
  PM2 processes, Hermes gateways), and rollback on failure. Consolidates the
  raw shell scripts that previously did this piecemeal. This contract owns the
  HOST-LEVEL weekly maintenance loop on the primary host plus Docker image
  pulls ONLY for .116 and .7, while infrastructure-update owns the FULL-FLEET
  cluster-wide wave (apt across the full PVE cluster + CTs/VMs AND its Docker
  image Wave 3 across all stacks). Runs Sunday 2am ET. Owner:
  ops (firstmate secondmate). Blast radius: an unverified image pull can break
  LiteLLM (all agents lose inference) or SearXNG (search-stack down); a bad apt
  upgrade can leave the host in a half-upgraded state. Pre-update backup check
  and rollback are mandatory for this reason.
 agent: ops
 triggers:
  - weekly (Sunday 02:00 ET) via cron
  - on demand when ops/abiba triggers "infra maintenance"
 version: 1.0.0
 ---
 ## Maintains
 - maintenance-status: { phase: idle|preflight|apt|images|restarts|verify|rollback|done|failed, host, step, result, timestamp }
 - image-baseline: { service, current_tag, pulled_tag, digest, updated_at } — last known-good image per container
 - apt-state: { upgradable_before, upgradable_after, held_broken, kernel_reboot_required }
 - health-baseline: snapshot of critical-service health captured pre-update (used for regression check post-update)
 - rollback-snapshot: { backup_path, configs, image_digests, timestamp } — restore point created in preflight
 - maintenance-history: array of past runs with phase results and any escalations
 ## Scope
 Primary host is the maintenance host where apt updates apply. Docker image pulls
 span the two Docker ecosystems that run critical services. infrastructure-update
 runs the full-fleet cluster-wide wave (including its Wave 3 Docker pulls across
 all stacks/hosts); this contract runs a narrower host-level weekly pull limited
 to .116 and .7. Topology, CT IDs, and IPs are live-state fields — verify against
 `infrastructure-control.prose.md` (the source of truth) and the live system
 before mutating.
 | Host | IP | Role | Trust |
 |------|----|------|-------|
 | CT 116 (syslog-api) | 192.168.68.116 | LiteLLM proxy + Grafana + Prometheus (inference harness) | ⚠️ VERIFY-BEFORE-USE |
 | VM 109 (docker-vm) | 192.168.68.7 | SearXNG + Firecrawl + home stack (Docker host) | ⚠️ VERIFY-BEFORE-USE |
 | CT 117 (zulip) | 192.168.68.19 | Zulip (storepve bridge IP .19) | ⚠️ VERIFY-BEFORE-USE |
 | Gitea | https://git.sysloggh.net | Prose-contracts + agent configs source control | ⚠️ VERIFY-BEFORE-USE |
 | CT 100 (abiba/pi) | 192.168.68.24 | PM2 processes (pi agent harness) | ⚠️ VERIFY-BEFORE-USE |
 > "Primary host" for the apt phase is the host the ops agent runs maintenance
 > from. Confirm which host that is against infrastructure-control before
 > running; do not assume. If the ops agent is containerized/CT-based, apt runs
 > inside that CT.
 ## Requires
 - SSH/exec access to CT 116 (.116) and VM 109 (.7) for Docker operations
 - `apt`, `docker`, `docker compose` available on target hosts
 - LiteLLM master key available (Infisical vault, `LITELLM_API_KEY`) for health verification
 - `infrastructure-monitoring` run completed within the last 30 minutes — provides the pre-update health baseline used by the regression check
 - Writable backup directory `/tmp/infra-maintenance-backup-<date>/` on each mutated host
 - Proxmox snapshot of the primary host available (or confirmed not required) before apt phase
 ## Continuity
 - Self-driven: weekly cron `0 2 * * 0` (Sunday 02:00 ET)
 - Also wakes on: explicit "infra maintenance" trigger from ops/abiba
 - Depends on `infrastructure-monitoring` for the pre-update health baseline — do not run if the last monitoring run is stale (>30 min) or RED; abort and escalate instead
 ## Execution
 ### Phase 0 — Preflight (snapshot/backup check + health baseline)
 1. **Capture health baseline** — run the `infrastructure-monitoring` postcondition checks (LiteLLM, Zulip, Gitea, SearXNG, Proxmox API) and record results as `health-baseline`. If any critical service is already down, **abort**: maintenance must not run on a degraded fleet.
 2. **Backup check** — confirm a Proxmox snapshot of the primary host exists OR `/tmp/infra-maintenance-backup-<date>/` was created this run. Snapshot critical config files into the backup dir:
   - `/opt/inference-harness/docker-compose.yml`, `/opt/inference-harness/litellm_config.yaml` (CT 116)
   - `/opt/search-stack/searxng/docker-compose.yml`, `/opt/search-stack/firecrawl-source/docker-compose.yaml` (VM 109)
 3. **Record image baseline** — `docker inspect --format '{{.Image}} {{.Config.Image}}' <container>` for every running container on .116 and .7; store digests in `image-baseline` so rollback can restore them.
 4. **Disk check** — `df -h` on each mutated host; abort if free space <20% (apt upgrade + image pulls need headroom).
 ### Phase 1 — OS package updates (primary host)
 ```bash
 # On the primary host only (VERIFY host against infrastructure-control first)
 apt update
 apt upgrade -y
 ```
 - Capture `apt list --upgradable` before and after → store in `apt-state`.
 - If apt reports held/broken packages (`apt-get -s upgrade | grep -i broken`, or non-zero exit), **stop** — do not force. Record `held_broken` and go to rollback/escalate.
 - If `/var/run/reboot-required` exists after upgrade, flag `kernel_reboot_required: true` in `apt-state` but **do not reboot automatically** — that's a separate coordinated action (see infra-update Wave 4). Note it in the report.
 ### Phase 2 — Docker image pulls
 Pull latest stable tags for every running container. Do NOT pin to `:main`/`:nightly` — use stable tags where the compose file specifies them; otherwise `latest`.
 ```bash
 # CT 116 (.116) — inference harness
 cd /opt/inference-harness && docker compose pull
 # VM 109 (.7) — search + home stacks
 cd /opt/search-stack/searxng && docker compose pull
 cd /opt/search-stack/firecrawl-source && docker compose pull
 # any other running stacks on .7 (home stack, audiobookshelf) — pull per their compose files
 ```
 - LiteLLM and SearXNG are the two explicitly required pulls; "any other running containers" means every stack with a compose file on .116 and .7.
 - Record pulled tag + digest per service in `image-baseline`.
 ### Phase 3 — Container restarts with health verification
 Restart one stack at a time, verify health before moving to the next. Do not restart everything at once — a failure mid-wave must leave the rest running.
 ```bash
 # CT 116
 cd /opt/inference-harness && docker compose up -d
 # VM 109
 cd /opt/search-stack/searxng && docker compose up -d
 cd /opt/search-stack/firecrawl-source && docker compose up -d
 ```
 After each stack comes up, wait for health (max 120s):
 - `docker ps` shows the container `Up` (and `healthy` if a healthcheck is defined)
 - Service-specific probe passes (see Phase 4 probes)
 If a stack fails to come up within 120s, **stop the wave** and go to rollback for that stack only; do not proceed to the next.
 ### Phase 4 — Post-update service verification
 After ALL updates (apt + images + restarts), verify every critical service is back up and matches the pre-update baseline. This is the regression gate.
 | Service | Probe | Expect |
 |---------|-------|--------|
 | LiteLLM proxy | `curl -sf http://192.168.68.116/litellm/v1/models` | 200 OK, models returned |
 | LiteLLM MCP gateway | `curl -sf http://192.168.68.116:4000/mcp-rest/tools/list -H "Authorization: Bearer $MASTER_KEY"` | 90 tools (23 RA-H OS + 67 GitHub) |
 | SearXNG | `curl -sf http://192.168.68.7:8888` | 200 OK |
 | Zulip | `curl -sf https://chat.sysloggh.net/api/v1/server_settings` | 200 OK |
 | Gitea | `curl -sf https://git.sysloggh.net/api/v1/version` | 200 OK |
 | PM2 processes | `pm2 jlist` (CT 100) | all pi-agent processes `online` |
 | Hermes gateways | SSH to Mumuni CT 114, Tanko CT 112; `systemctl is-active hermes-gateway` | `active` for each |
 Regression check: every service that was GREEN in `health-baseline` must still be GREEN. A service that was already RED (and caused a preflight abort) is excluded — but Phase 0 should have aborted before we got here.
 ## Rollback Protocol
 If ANY service in Phase 4 fails to come back up (or regresses vs baseline):
 1. **Image rollback** — for the failing stack, restore the previous image:
   ```bash
   # Restore from recorded image-baseline digest
   docker compose down
   # Pin the service image to the recorded digest in compose, then recreate
   #   image: <name>@sha256:<previous_digest>
   docker compose pull && docker compose up -d
   ```
 2. **APT rollback** — restore the primary host from the Proxmox snapshot taken/confirmed in Phase 0. If no snapshot, `apt install <pkg>=<old_version>` per package using apt history (`/var/log/apt/history.log`).
 3. **Config rollback** — restore configs from `/tmp/infra-maintenance-backup-<date>/`.
 4. **Re-verify** — re-run the Phase 4 probes on the rolled-back service. If still failing, escalate (do not loop — circuit breaker below).
 5. **Escalate** — send a Zulip DM to abiba + mumuni with: failing service, phase, baseline vs current, rollback actions taken, backup path.
 ## Circuit Breaker
 - `max_retries: 2` per failing phase — after 2 rollback attempts on the same service, stop and escalate.
 - `window: 7200` seconds — no more than 2 retries within a 2-hour window.
 - `trip_action: escalate_to_fatal` — when tripped, escalate to fatal (abiba + mumuni + kwame) and pause; a human must clear before the next scheduled run.
 ## Report
 After completion (or on abort), emit a receipt (JSON) to `~/.hermes/runs/infrastructure-maintenance/` and send a Zulip DM summary:
 ```
 🛠 Infrastructure Maintenance — YYYY-MM-DD
 Phase: apt | images | restarts | verify | rollback
 Primary host: <host>
 APT: <N> packages upgraded, <M> held/broken, kernel_reboot_required=<bool>
 Images pulled: LiteLLM <tag>, SearXNG <tag>, <others>
 Services: all GREEN | <service> FAILED (rolled back)
 Baseline regression: none | <details>
 Backup: /tmp/infra-maintenance-backup-YYYYMMDD/
 Escalation: none | warning | critical | fatal
 ```
 ## Verification Postconditions
 - All critical services running after update (Phase 4 all GREEN)
 - No regressions from pre-update health baseline (Phase 0 baseline)
 - Docker containers on latest stable tags (`image-baseline.pulled_tag` recorded)
 - APT packages up to date with no held broken packages (`apt-state.held_broken == 0`)
 ## Related Contracts
 - `infrastructure-update.prose.md` — owns the full-fleet cluster-wide wave INCLUDING its Wave 3 Docker image updates across all stacks (SearXNG, Firecrawl, Inference Harness on .116, home stack, audiobookshelf); infrastructure-maintenance is a deliberately narrower host-level weekly pull scoped to .116 and .7.
 - `infrastructure-monitoring.prose.md` — provides the pre-update health baseline (depends_on).
 - `infrastructure-control.prose.md` — topology source of truth (CT IDs, IPs, hostnames).
 - `litellm-health.prose.md` — LiteLLM probe details.
 - `proxmox-monitor.prose.md` — Docker stats + monitoring stack health.
@@ -2,7 +2,7 @@
 kind: responsibility
 name: infrastructure-update
 description: >
-  Autonomous system-wide update contract covering all 5 Proxmox nodes,
+  Autonomous system-wide update contract covering all 6 Proxmox nodes,
  15+ containers/VMs, and 4 Docker ecosystems. Updates apt packages,
  Docker images, and container stacks in safe waves with health checks
  and automatic rollback on failure.
@@ -56,10 +56,11 @@ Before ANY update wave:
 | amdpve (.15) | Proxmox node | `apt update && apt upgrade -y` | 5 min |
 | acerpve (.9) | Proxmox node | `apt update && apt upgrade -y` | 5 min |
 | ocupve (.5) | Proxmox node | `apt update && apt upgrade -y` | 5 min |
 | hwepve (.4) | Proxmox node | `apt update && apt upgrade -y` | 5 min |
 | CT 100 (.24) | Abiba (pi) | `apt update && apt upgrade -y` | 3 min |
 | CT 116 (.116) | syslog-api (LiteLLM host) | `apt update && apt upgrade -y` | 3 min |
 | CT 112 (tanko, amdpve) | Tanko | `apt update && apt upgrade -y` | 3 min |
-| CT 114 (mumuni, minipve) | Mumuni | `apt update && apt upgrade -y` | 3 min |
+| CT 114 (mumuni, hwepve) | Mumuni | `apt update && apt upgrade -y` | 3 min |
 | VM 101 (.8) | llm-gpu (RTX 3090) | `apt update && apt upgrade -y` | 3 min |
 | VM 103 (.110) | ocu-llm (RTX 5070) | `apt update && apt upgrade -y` | 3 min |
@@ -67,7 +68,7 @@ Before ANY update wave:
 - All VMs/CTs running: check via Proxmox API
 - LiteLLM healthy: `curl localhost:4000/health/liveliness` (via CT 116)
 - LiteLLM MCP tools: `curl localhost:4000/mcp-rest/tools/list -H "Authorization: Bearer $MASTER_KEY"` → 90 tools
- GPU servers responding: check :8080 on VM 101, VM 103; check ornith via router (http://192.168.68.116/health/unified — .15:8080 is firewalled to .116 only)
+- GPU servers responding: check :8080 on VM 101, VM 103; check strix-moe via router (http://192.168.68.116/health/unified — .15:8080 is firewalled to .116 only)
 - Zulip agents connected: check Mumuni/Tanko gateway state
 - Abiba PM2 processes online: `pm2 status`
@@ -91,17 +92,52 @@ Before ANY update wave:
 - Firecrawl test: `curl :3002/`
 - SearXNG test: `curl :8888`
-## Wave 4: Proxmox Kernel Reboot (if needed)
+## Wave 4: Proxmox Kernel Reboot
 Only if `[ -f /var/run/reboot-required ]` on any node.
 | Target | Action |
 |--------|--------|
 | Affected PVE node | Verify all CTs/VMs migrated or stopped |
-| | `reboot` via PVE API |
+| | `reboot` via PVE API (or `systemctl reboot -f` if dbus fails) |
 | | Wait 120s for node to come back |
 | | Start any stopped CTs |
 ### Post-reboot sweep (known gaps)
 After every node reboot, run these checks:
 1. **CT auto-start sweep** — LXC containers sometimes don't start despite
   `onboot: 1`. Check every CT on the rebooted node and start any left stopped:
   ```bash
   pct list | awk '/stopped/{print $1}' | xargs -I{} pct start {}
   ```
   Known cases: scottdenya (CT 115 on amdpve), authentik (CT 104 on minipve).
 2. **Zulip recovery** — When docker-vm or storepve reboots, the Zulip main
   container loses its Docker network assignment (SIGKILL during storage
   outage detaches it from `zulip_default` network). Run:
   ```bash
   ssh root@192.168.68.19 'docker rm -f zulip-zulip-1 && cd /opt/zulip && docker compose up -d'
   ```
   The compose restart recreates the container on the correct network.
 3. **docker-vm Docker daemon** — After reboot, Docker can take 3-4 minutes
   to become `active`. The docker-proxy for Pulse (port 7655) starts early,
   so Pulse is accessible before `docker ps` reports ready. Wait for Docker
   before checking other stacks.
 ### VPS ↔ docker-vm tunnel
 After any VPS or docker-vm reboot, verify the dedicated WireGuard tunnel:
 ```bash
 ssh root@72.61.0.17 'wg show wg1' | grep "latest handshake"
 # If no handshake in >60s:
 ssh root@72.61.0.17 'wg-quick up wg1'
 ```
 The tunnel uses PersistentKeepalive=25 and is systemd-enabled, but should
 be verified after a reboot.
 ## Rollback Protocol
 If ANY verification fails:
@@ -124,7 +160,7 @@ Before Wave 1, snapshot these files:
 /opt/home_stack/docker-compose.yml                      (VM 109 .7)
 /opt/audiobookshelf/docker-compose.yml                  (VM 109 .7)
 /root/.pi/agent/extensions/config.yaml                  (CT 100 .24)
-/etc/systemd/system/ornith-server.service               (amdpve .15)
+/etc/systemd/system/ornith-server.service               (amdpve .15 — strix-moe)
 /etc/systemd/system/llama-server.service                (VM 101 .8, VM 103 .110)
 # Hermes agent configs (key enforcement — 2026-07-10)
 /root/.hermes/config.yaml                               (Mumuni CT 114, Tanko CT 112, etc.)
@@ -183,7 +219,7 @@ When LiteLLM is upgraded to a version supporting per-key MCP grants:
 ## Success Criteria
- [ ] All 5 PVE nodes updated, no reboot-loop
+- [ ] All 6 PVE nodes updated, no reboot-loop
 - [ ] All VMs/CTs running post-update
 - [ ] All Docker containers healthy (VM 109 + CT 116 + CT 117)
 - [ ] LiteLLM inference passing (syslog-auto test)
@@ -199,7 +235,7 @@ After completion, send Zulip DM:
 ```
 📋 Infrastructure Update — YYYY-MM-DD
-Updated: 5 PVE nodes, 12 CTs/VMs, 30+ containers
+Updated: 6 PVE nodes, 12 CTs/VMs, 30+ containers
 Security fixes: N CVEs patched
 Downtime: <service> <duration>
 Failures: none / <details>
@@ -8,18 +8,18 @@ description: >
  Ensures agents never use the master key directly. Rotation is event-driven,
  not calendar-driven — rotate only on compromise, personnel change, or
  periodic security hygiene (quarterly/annually).
-  
+
  UPDATED 2026-07-12: Keys are stored in Infisical vault (project=agents, env=production)
  BUT each agent host MUST keep a local .env fallback. Infisical service tokens can
  expire/404. The .env fallback prevents agents from running without keys.
  Tanko incident: token 404 → gateway had no LITELLM_API_KEY for hours.
-  
+
  UPDATED 2026-07-16: Vault is SYNCED (session-13 keys written to vault via abiba service
  token, all validate 200). Koby/Koonimo migrated from hardcoded drop-ins to the
  infisical-gateway.sh wrapper (live vault injection). 4/5 agents now vault-backed.
  Canonical process: see § Production Vault Access Process. Tanko (user jerome) pending.
  Abiba's key is now a proper agent key (NOT the master key — stale note removed).
-  
+
  UPDATED 2026-07-17: FLEET-WIDE STANDARDIZATION. All 4 agents (Mumuni, Tanko, Koby, Koonimo)
  standardized on a single pattern: systemd drop-in (ExecStart= reset + wrapper path) →
  infisical-gateway.sh while-true loop → /usr/bin/infisical run --token → bash -c key
@@ -30,7 +30,7 @@ description: >
  Critical lessons: (1) NEVER use shell variables inside single-quoted bash -c in wrappers
  — hardcode absolute paths. (2) Drop-ins override unit file ExecStart permanently.
  (3) Capture /proc/<pid>/environ before gateway restarts to preserve running env set.
-  
+
  Current key inventory and agent list: see gpu-fleet.prose.md § Agent Keys.
  Source of truth for LiteLLM config: /opt/inference-harness/litellm_config.yaml
  on CT 116. Last verified: 2026-07-17.
@@ -154,7 +154,7 @@ through its agent wrapper.
   The `ExecStart=` (empty reset) clears any ExecStart from the main unit file,
   then the second `ExecStart=` sets the wrapper. This drop-in **survives unit file
   regeneration** by `hermes gateway install` — the drop-in always wins.
-   
+
   **Why a drop-in instead of editing the unit file:** `hermes gateway install`
   (called during Hermes updates and some self-heal operations) regenerates the
   systemd unit file with `ExecStart=/path/to/python -m hermes_cli.main gateway run`.
@@ -171,14 +171,14 @@ through its agent wrapper.
 - **Survives gateway crash**: the wrapper's `while true` + systemd `Restart=always` revive the gateway. Two-layer defense.
 - **Survives Hermes updates**: systemd drop-in overrides unit file ExecStart — `hermes gateway install` cannot break the vault injection.
 - **Survives reboot**: systemd user service + `loginctl enable-linger` ensures gateway starts at boot without a login session.
- **Auditable**: `cat /proc/$(pgrep hermes_cli)/environ` shows all injected keys; `infisical secrets` shows the vault source.
+- **Auditable**: `cat /proc/$(pgrep -f 'python.*hermes_cli.main.gateway.run' | grep -v infisical | head -1)/environ` shows all injected keys (note: pipe through grep -v infisical to avoid matching the bash wrapper); `infisical secrets` shows the vault source.
 ### Migration status (2026-07-17)
 | Agent | Host | Pattern | Keys | Status |
 |-------|------|---------|------|--------|
 | abiba | .24 | pi agent wrapper | ABIBA_LITELLM_API_KEY + ABIBA_ZULIP_API_KEY | ✅ vault-backed |
-| mumuni | .123 | systemd drop-in + while-true wrapper + st.8e848433 | MUMUNI_LITELLM_API_KEY + MUMUNI_ZULIP_API_KEY | ✅ vault-backed + .env fallback |
+| mumuni | .24 (CT100 abiba) | Pi Hermes gateway (no systemd) | MUMUNI_LITELLM_API_KEY + MUMUNI_ZULIP_API_KEY | ✅ vault-backed + .env fallback |
 | tanko | .122 | systemd drop-in + while-true wrapper + st.8e848433 (user jerome) | TANKO_LITELLM_API_KEY + TANKO_ZULIP_API_KEY | ✅ vault-backed + .env fallback |
 | koby | .129 | systemd drop-in + while-true wrapper + st.8e848433 | KOBY_LITELLM_API_KEY, shares TANKO_ZULIP_API_KEY (tanko-bot) | ✅ vault-backed |
 | koonimo | .114 | systemd drop-in + while-true wrapper + st.8e848433 | KOONIMO_LITELLM_API_KEY + KOONIMO_ZULIP_API_KEY | ✅ vault-backed |
@@ -42,7 +42,7 @@ Request → nginx:80 → LiteLLM:4000 → GPU(llama-server, parallel 2)
 **What changed (v3.2.0 → v4.0.0 — 2026-07-08)**:
 - Router REMOVED from request path — LiteLLM proxies directly to GPU
 - All GPUs at parallel 2 (was parallel 1)
- NVIDIA context reduced 256K→128K to free VRAM  (SUPERSEDED 2026-07-16: all GPUs back to 256K — see litellm-self-heal)
+- NVIDIA context reduced 256K→128K to free VRAM — now the stable ceiling across all GPUs (2026-07-17)
 - LiteLLM timeouts tuned: gemma 25→120s, qwen 40→90s  (SUPERSEDED 2026-07-16: qwen 300s, gemma 120s, strix 300s — see litellm-self-heal)
 - nginx proxy_read_timeout: 600s, LiteLLM request_timeout: 300s
@@ -72,9 +72,9 @@ Request → nginx:80 → LiteLLM:4000 → GPU(llama-server, parallel 2)
 | Host | IP | Hardware | Models Served | Engine | Context | Parallel |
 |------|-----|----------|---------------|--------|---------|----------|
-| llm-gpu | 192.168.68.8 | NVIDIA RTX 3090 (24 GB) | qwen3.6-27B-code | llama-server systemd | **256K** | 2 |
+| llm-gpu | 192.168.68.8 | NVIDIA RTX 3090 (24 GB) | qwen3.6-27B-code | llama-server systemd | **128K** | 2 |
-| ocu-llm | 192.168.68.110 | NVIDIA RTX 5070 (12 GB) | gemma-4-12b | llama-server systemd | **256K** | 2 |
+| ocu-llm | 192.168.68.110 | NVIDIA RTX 5070 (12 GB) | gemma-4-12b | llama-server systemd | **128K** | 2 |
-| amdpve | 192.168.68.15 | AMD Strix Halo 64GB UMA | qwen3.6-35B-udq4 (LiteLLM alias: strix-moe) | llama-server systemd (Vulkan) | 256K | 2 |
+| amdpve | 192.168.68.15 | AMD Strix Halo 64GB UMA | qwen3.6-35B-udq4 (LiteLLM alias: strix-moe) | llama-server systemd (Vulkan) | 128K | 2 |
 ## Model Fallback Chains (LiteLLM)
@@ -7,7 +7,7 @@ note: >
  Auto-remediation code was removed from the pi Zulip extension (retired 2026-07-04),
  now reimplemented as `litellm-health-check.sh` on CT 116.
  Script: `/opt/inference-harness/scripts/litellm-health-check.sh` on CT 116 (cron `0 */6 * * *`).
-  Reports to /var/log/litellm/health-*.json and RA-H OS knowledge graph.
+  Reports to /var/log/litellm/health-*.json and Gitea (SyslogSolution/health-logs).
  GPU monitoring integrated from gpu-monitor on .24:9100.
  Consolidated from litellm-health + litellm-self-heal on 2026-07-09 to eliminate
@@ -20,7 +20,7 @@ description: >
  LiteLLM inference stack health monitoring + self-healing. Verifies the full
  nginx → LiteLLM → GPU chain, 8 containers on CT 116, 3 GPU hosts, model
  inference, and agent keys. Applies remediation rules for common failures.
-  Reports every action via Zulip DM and RA-H OS knowledge graph.
+  Reports every action via Zulip DM and Gitea (SyslogSolution/health-logs).
 ---
 # LiteLLM Operations — Health Check + Self-Heal
@@ -57,9 +57,9 @@ Request → nginx:80 → LiteLLM:4000 → GPU(llama-server, parallel 2)
 | Host | IP | Hardware | Models Served | Engine | Context | Parallel |
 |------|-----|----------|---------------|--------|---------|----------|
-| llm-gpu | 192.168.68.8 | NVIDIA RTX 3090 (24 GB) | qwen3.6-27B-code | llama-server systemd (`/home/llmuser/llama-wrapper.sh`, `-c 262144 --parallel 2 --ngl 99`) | **256K** | 2 |
+| llm-gpu | 192.168.68.8 | NVIDIA RTX 3090 (24 GB) | qwen3.6-27B-code | llama-server systemd (`/home/llmuser/llama-wrapper.sh`, `-c 131072 --parallel 2 --ngl 99`) | **128K** | 2 |
-| ocu-llm | 192.168.68.110 | NVIDIA RTX 5070 (12 GB) | gemma-4-12b | llama-server systemd (`/home/llmuser/llama-wrapper.sh`, `--ctx-size 262144 --parallel 2`, IQ4_NL + MTP draft) | **256K** | 2 |
+| ocu-llm | 192.168.68.110 | NVIDIA RTX 5070 (12 GB) | gemma-4-12b | llama-server systemd (`/home/llmuser/llama-wrapper.sh`, `--ctx-size 131072 --parallel 2`, IQ4_NL + MTP draft) | **128K** | 2 |
-| amdpve | 192.168.68.15 | AMD Strix Halo 64GB UMA | qwen3.6-35B-udq4 (LiteLLM alias: `strix-moe`) | llama-server systemd (Vulkan) | 256K | 2 |
+| amdpve | 192.168.68.15 | AMD Strix Halo 64GB UMA | qwen3.6-35B-udq4 (LiteLLM alias: `strix-moe`) | llama-server systemd (Vulkan) | 128K | 2 |
 > Verified on ground 2026-07-16 via `curl /v1/models` on each host + `llama-wrapper.sh`. The AMD host's underlying model is `qwen3.6-35B-udq4`; LiteLLM exposes it under two `model_name`s: `qwen3.6-35B-udq4` and `strix-moe` (rpm 40). The legacy name `ornith-1.0-35b` does NOT exist in LiteLLM and must not be referenced.
@@ -101,8 +101,8 @@ Request → nginx:80 → LiteLLM:4000 → GPU(llama-server, parallel 2)
 ## Script Operations (synced 2026-07-16)
 - **Health-check script** (`/opt/inference-harness/scripts/litellm-health-check.sh` on CT 116): `gpu-fleet` check fails only on **critical** alerts (warnings are informational). Tests `strix-moe` (not `ornith-1.0-35b`).
- **GPU monitor** (`/root/scripts/gpu-monitor-server.py` on pi .24): runs as **systemd unit `gpu-monitor.service`** (was bare `&` process). `gpu_count` includes Strix Halo (was 2, now 3). VRAM alert thresholds: warning 93%, critical 97% (raised from 90/95 — 256K context steady-state is ~96% on RTX 3090, not a fault).
+- **GPU monitor** (`/root/scripts/gpu-monitor-server.py` on pi .24): runs as **systemd unit `gpu-monitor.service`** (was bare `&` process). `gpu_count` includes Strix Halo (was 2, now 3). VRAM alert thresholds: warning 93%, critical 97% (raised from 90/95 — 128K context steady-state is ~70% on RTX 3090, not a fault).
- **Agent key monitor** (`/root/scripts/agent-health-check.py` on pi .24, cron `*/10`): reads each agent's **live** `LITELLM_API_KEY` from its gateway process env via SSH — never hardcodes keys (hardcoded keys rot on rotation and caused 9×401/30min). Fleet roster: abiba, tanko, mumuni, koby, koonimo (legacy `tdunna`/`baggy` removed — never existed).
+- **Agent key monitor** (`/root/scripts/agent-health-check.py` on pi .24, cron `*/10`): v2 (2026-07-26) — reads each agent's **agent-specific** `{NAME}_LITELLM_API_KEY` from Infisical vault (not the shared master key). Covers: LiteLLM keys, GPU ports, agent gateways (all 5 agents now SSHa ble), CT liveness (pct status on PVE nodes), config.yaml YAML integrity, wrapper/CLI integrity, vault secret non-emptiness checks. Fleet roster: tanko (.122), mumuni (.24, inside abiba CT100), koby (.129), koonimo (.114), abiba (.24). Legacy `tdunna`/`baggy` replaced with canonical agent hostnames.
 - **Stale keys cleaned**: `daily-infra-report.py` SYNTHETIC_API_KEY was stale (`sk-U_ydi3B` → 401); now reads `LITELLM_MASTER_KEY` from env. Deprecated scripts (`router-original.py`, `router-phase0-backup.py`, `apply-fixes.py`) still reference `sk-syslog-local-master-key` but do not actively poll LiteLLM.
 ## Maintains
@@ -211,8 +211,8 @@ for reference but inactive. If Redis issues occur, check harness-redis container
 Every remediation cycle produces a structured report:
-### 1. RA-H OS Knowledge Graph Node
+### 1. Gitea Log Entry
-Created as `[LEARN] litellm-self-heal: <run_id>` with full JSON report.
+Pushed to `SyslogSolution/health-logs/litellm/{run_id}.json` — versioned, searchable, not in graph.
 ### 2. Zulip DM to Owner
 - `issues_fixed > 0` — "🛠 LiteLLM Self-Heal — Fix Applied"
@@ -252,9 +252,11 @@ call report-generator
  health: health
  actions: actions
-- Phase 4: Log to knowledge graph
+-- Phase 4: Log to Gitea (not knowledge graph — hard rule)
-call kg-logger
+call gitea-logger
  run_id: run_id
  repo: SyslogSolution/health-logs
  path: litellm/{run_id}.json
  health: health
  actions: actions
@@ -300,3 +302,20 @@ With failures:
  ]
 }
 ```
 ## gitea-logger Implementation
 When this step executes, write the report JSON to a temp file and push to Gitea:
 ```bash
 REPO="https://abiba-bot:${GITEA_PAT}@git.sysloggh.net/SyslogSolution/health-logs"
 DIR="litellm"
 FILE="${run_id}.json"
 echo "${report_json}" > /tmp/${FILE}
 (cd /tmp && git clone --depth 1 "${REPO}" && 
  cp ${FILE} health-logs/${DIR}/${FILE} && 
  cd health-logs && git add ${DIR}/${FILE} && 
  git commit -m "litellm-health: ${run_id}" && git push)
 rm -rf /tmp/health-logs /tmp/${FILE}
 ```
@@ -0,0 +1,71 @@
 ---
 kind: pattern
 name: memory-fixer
 description: >
  Auto-fix low-hanging fruit in the graph. No judgment calls — only deterministic Level 1 operations. 
  Escalate anything that needs Kwame's input.
 version: 1.1.0
 ---
 # Memory Fixer
 ## Purpose
 Auto-fix low-hanging fruit in the graph. No judgment calls — only deterministic Level 1 operations. Escalate anything that needs Kwame's input.
 ## Level 0 Auto-Deletes (Allowed Without Approval)
 Ephemeral heartbeat and log nodes that violate "Logs NEVER go in the graph":
 - `[LITELLM-HEALTH]`, `[GPU-SELF-HEAL]`, `[PM2-SELF-HEAL]`
 - `[PROXMOX-MONITOR]`, `[GPU-MONITOR]`, `[INFRA-MONITOR]`, `[AGENT-HEALTH]`, `[DISK-GC]`
 - `[WAL]` entries older than 30 days
 **Condition:** node must be an orphan (no edges). Deleting a connected node risks breaking other nodes.
 **Method:** direct SQLite on `.65` (MCP has no delete tool):
 ```bash
 ssh root@192.168.68.65 "sqlite3 /root/.local/share/RA-H/db/rah.sqlite \"
 DELETE FROM nodes WHERE id IN (
  SELECT id FROM nodes WHERE id NOT IN (SELECT from_node_id FROM edges)
  AND id NOT IN (SELECT to_node_id FROM edges)
  AND title LIKE '[LITELLM-HEALTH]%' -- add more prefixes as needed
 );\""
 ```
 ## Level 1 Auto-Fixes (No Judgment Required)
 ### 1. Missing `type` Field
 For nodes with content but no `metadata.type`:
 - Title contains "Proxmox" or "infrastructure" → `type: infrastructure`
 - Title contains "skill" or "how to" or "guide" → `type: skill`
 - Title contains "doc" or "template" or "brand" → `type: documentation`
 - Title starts with "WAL:" or "TASK:" → `type: note`
 - Title starts with "[LEARN]" → `type: documentation`
 - Otherwise → `type: note` (default)
 ### 2. Missing `tenant` / `namespace`
 For any node with NULL tenant or namespace:
 ```sql
 UPDATE nodes 
 SET metadata = json_set(
  COALESCE(metadata, '{}'),
  '$.tenant', 'syslogsolution',
  '$.namespace', 'syslogsolution'
 )
 WHERE json_extract(metadata, '$.tenant') IS NULL 
   OR json_extract(metadata, '$.namespace') IS NULL;
 ```
 ### 3. Staleness State Transitions
 Using the type-based windows from the memory-monitor contract:
 - Nodes stale > their window → transition to `state: review_pending`
 - Nodes in `review_pending` for >7 days → escalate to Kwame (Level 2)
 ## Level 2 Escalations (Kwame Decision Required)
 1. **Nodes in `review_pending` >7 days** — Archive, refresh, or keep?
 2. **Orphan Nodes >90 days old** — Delete or Connect?
 3. **Potential Duplicate Nodes** — Same title or >70% overlap. Merge or Keep?
 4. **Conflicting Metadata** — Content suggests one tenant but metadata says another.
 ## Logging
 Every Level 1 fix logged to `~/.hermes/logs/memory-fixer/YYYY-MM-DD.md`
 Every Level 2 escalation logged and delivered to Kwame.
@@ -6,7 +6,7 @@ description: >
  delegation, verification, and delivery. Defines when to delegate, which
  worker to use for what, how to handle failures, and the kanban board
  protocol. Enforces context-window discipline and separation of concerns.
-  Runs on Mumuni (CT 118, storepve, .6) via Hermes agent.
+  Runs on Mumuni (inside Abiba CT100, hwepve, .24) via Hermes agent (Pi + Hermes Zulip gateway).
 version: 1.0.0
 ---
@@ -19,8 +19,8 @@ version: 1.0.0
 ## Topology
-**Cluster:** 5 Proxmox nodes (ocupve, acerpve, minipve, amdpve, storepve)
+**Cluster:** 6 Proxmox nodes (ocupve, acerpve, minipve, amdpve, storepve, hwepve)
-**Manager:** Mumuni (CT 118, storepve, .6) via Hermes agent
+**Manager:** Mumuni (inside Abiba CT100, hwepve, .24) via Hermes agent
 **Workers:** 6 profiles, all running on the same agent — no separate hosts needed
 This contract is infrastructure-agnostic in terms of which nodes are used.
@@ -31,7 +31,7 @@ Workers execute tasks on whatever infrastructure they're given — SSH to .6,
 ## Why This Matters
 Without enforced delegation, the manager consumes the full iteration budget
-(60 calls) on single-turn tasks — SSH to 5 nodes, check each VM, read logs —
+(60 calls) on single-turn tasks — SSH to 6 nodes, check each VM, read logs —
 leaving no capacity for actual coordination. The result: context overflow
 (59K tokens in system prompt), iteration exhaustion, and degraded response
 quality. This contract exists because I blew through my budget checking
@@ -82,7 +82,7 @@ it asks the manager (via relay) — it doesn't go find it on its own.
 **This is a hard rule, not a recommendation.** Violating it produces the exact
 type of discrepancy the kanban pipeline exists to prevent: a review worker finds
-"5 nodes present" in the raw data but "5/5 online" in the report — even though
+"6 nodes present" in the raw data but "6/6 online" in the report — even though
 one of those nodes was unreachable. The report lied because it used data the
 raw data never provided.
@@ -137,7 +137,7 @@ delegate_task(
 ```
 delegate_task(
    tasks=[
-        {"goal": "Check all 5 Proxmox nodes for VM status", "context": "SSH to each node via 192.168.68.x, run 'qm list'"},
+        {"goal": "Check all 6 Proxmox nodes for VM status", "context": "SSH to each node via 192.168.68.x, run 'qm list'"},
        {"goal": "Check Docker container health on .7/.116/.17", "context": "SSH to each host, check container status"},
    ]
 )
@@ -191,7 +191,7 @@ Only verified results reach Kwame. Format per channel:
    {
      "lane_id": "devops-check",
      "worker": "syslog-devops",
-      "goal": "Check all 5 Proxmox nodes",
+      "goal": "Check all 6 Proxmox nodes",
      "status": "dispatched|completed|failed",
      "output_file": "/tmp/node-report.md"
    }
@@ -52,7 +52,7 @@ description: >
   - If status is "online" → pass, log restarts count
   - If status is "stopped" or "errored" → **DO NOT RESTART** — alert owner immediately
   - If restarts > 5 in last hour → alert owner with full diagnostics
-4. **Log results** — Create `[LEARN]` node in knowledge graph for any actions taken
+4. **Log results** — Append to `SyslogSolution/health-logs/pm2/{timestamp}.md` in Gitea (not knowledge graph — hard rule)
 5. **Alert** — Send Zulip DM to owner if escalation needed (do NOT run pm2 commands during alerting)
 6. **Wait 5 min** → repeat from step 1
@@ -5,7 +5,7 @@ description: >
  Proxmox cluster + Docker monitoring via the existing Grafana/Prometheus stack
  on CT 116. Replaces Pulse with file-provisioned Grafana dashboards. Three
  exporters feed Prometheus: prometheus-pve-exporter (cluster-aware, single
-  instance), node_exporter (all 5 PVE nodes), and a custom docker-stats-exporter
+  instance), node_exporter (all 6 PVE nodes), and a custom docker-stats-exporter
  (Docker 29 / containerd image-store compatible, since cAdvisor cannot resolve
  the layerdb). Dashboards exposed at http://192.168.68.116:3001/ (direct LAN, not behind nginx).
 agent: abiba
@@ -33,8 +33,8 @@ agent: abiba
 | Exporter | Host:Port | Scope | Notes |
 |----------|-----------|-------|-------|
-| prometheus-pve-exporter | .116:9221 (container) | All 5 nodes + 14 guests + 36 storage pools | Single instance, cluster-aware via amdpve API. Config `/opt/monitoring/pve.yml` (token `monitoring@pve!prometheus`, PVEAuditor role). Metric schema is label-based (`id=node/amdpve`, `id=lxc/100`). |
+| prometheus-pve-exporter | .116:9221 (container) | All 6 nodes + guests + 36 storage pools | Single instance, cluster-aware via amdpve API. Config `/opt/monitoring/pve.yml` (token `monitoring@pve!prometheus`, PVEAuditor role). Metric schema is label-based (`id=node/amdpve`, `id=lxc/100`). |
-| node_exporter | .5/.6/.9/.12/.15:9100 (systemd) | Per-node CPU/mem/disk/net/temp | Installed via apt on all 5 PVE nodes, enabled (reboot-persistent). Collectors: textfile, systemd, tcpstat, ethtool. |
+| node_exporter | .5/.6/.9/.12/.15/.4:9100 (systemd) | Per-node CPU/mem/disk/net/temp | Installed via apt on all 6 PVE nodes, enabled (reboot-persistent). Collectors: textfile, systemd, tcpstat, ethtool. hwepve (.4) added 2026-07-19. |
 | docker-stats-exporter | .116:9324 (container) | 10 Docker containers on .116 | **Custom** (cAdvisor v0.51 incompatible with Docker 29 containerd image store — layerdb gone). Uses Docker Engine API over unix socket. Script `/opt/monitoring/docker-stats-exporter.py`. |
 ## PVE API Token
@@ -48,7 +48,7 @@ agent: abiba
 | UID | Title | Panels | Source |
 |-----|-------|--------|--------|
-| proxmox-cluster | Proxmox Cluster Overview | 16 | cluster status, 5-node CPU/mem/disk/load gauges, guests table, storage pools, guest CPU/mem timeseries |
+| proxmox-cluster | Proxmox Cluster Overview | 16 | cluster status, 6-node CPU/mem/disk/load gauges, guests table, storage pools, guest CPU/mem timeseries |
 | proxmox-node | Proxmox Node Detail | 13 | per-node CPU per-core, memory, network, disk IO/IOPS/latency, temperature, disk space (variable: $node) |
 | docker-containers | Docker Containers | 10 | per-container CPU/mem/network, restarts, memory limit ratio (variable: $container) |
 | gpu-fleet | GPU Fleet | 7 | (existing, preserved in DB, not provisioned) |
@@ -77,9 +77,9 @@ agent: abiba
 | `/opt/monitoring/grafana/dashboards/build-dashboards.py` | .116 | dashboard JSON generator |
 | `/opt/monitoring/grafana/dashboards/json/*.json` | .116 | provisioned dashboard definitions |
 | `/opt/monitoring/grafana/datasources/prometheus.yml` | .116 | datasource provisioning |
-| `/etc/default/prometheus-node-exporter` | .5/.6/.9/.12/.15 | node_exporter collector config |
+| `/etc/default/prometheus-node-exporter` | .5/.6/.9/.12/.15/.4 | node_exporter collector config |
-## Cluster "Tabiri" — 5 Nodes
+## Cluster "Tabiri" — 6 Nodes
 | Node | IP | Role |
 |------|----|----|
@@ -87,7 +87,8 @@ agent: abiba
 | storepve | 192.168.68.6 | PVE |
 | acerpve | 192.168.68.9 | PVE (hosts llm-gpu qemu/101) |
 | minipve | 192.168.68.12 | PVE |
-| amdpve | 192.168.68.15 | PVE + Strix Halo LLM (ornith) |
+| amdpve | 192.168.68.15 | PVE + Strix Halo LLM (qwen3.6-35B-udq4, strix-moe) |
 | hwepve | 192.168.68.4 | PVE (Huawei Matebook 16, 12C/15GB) — hosts abiba (lxc/100), kagentz (lxc/105), mumuni (lxc/114). CTs 100/105 migrated from amdpve, CT 114 from minipve 2026-07-20 |
 ## Operations
@@ -1,10 +1,10 @@
 #!/usr/bin/env python3
 """
-/root/scripts/agent-health-check.py — Consolidated Agent Health Verification
+/root/scripts/agent-health-check.py — Consolidated Agent Health Verification v2
-Single non-disruptive health check replacing 7 scattered scripts.
+Verifies: LiteLLM keys (agent-specific), GPU port conflicts, agent Zulip streaming,
-Verifies: LiteLLM keys, GPU port conflicts, agent Zulip streaming,
+gateway liveness, gateway log health, CT liveness, config YAML integrity,
-gateway liveness, and gateway log health. NEVER restarts anything.
+wrapper/CLI integrity, vault secret non-emptiness. NEVER restarts anything.
 Usage:
  python3 /root/scripts/agent-health-check.py          # Full check
@@ -12,59 +12,39 @@ Usage:
  python3 /root/scripts/agent-health-check.py --quiet  # Only output on failure
 Cron: */10 * * * * python3 /root/scripts/agent-health-check.py --quiet
 Changelog:
  v2 (2026-07-26): Added CT liveness, config validation, wrapper integrity,
    vault secret emptiness check. Fixed Koby/Koonimo SSH hosts and agent key
    name format ({NAME}_LITELLM_API_KEY not LITELLM_API_KEY_{NAME}).
    Fleet roster: tanko (.122), mumuni (.24, inside abiba CT100), koby (.129), koonimo (.114),
    abiba (.24).
 """
 import subprocess, json, sys, os, time
 from datetime import datetime
 LITELLM = "http://192.168.68.116:80"
 INFISICAL_PROJECT = "322fceab-39da-4854-a55a-568e76c0f13f"
 INFISICAL_ENV = "prod"
-def _get_agent_key(agent_name):
+# PVE node IPs for CT liveness checks
-    """Retrieve agent key from Infisical vault."""
+PVE_NODES = {
-    try:
+    "hwepve":  "192.168.68.4",
-        result = subprocess.run(
+    "amdpve":  "192.168.68.15",
-            ["infisical", "secrets", "get", "LITELLM_API_KEY",
+    "minipve": "192.168.68.12",
-             "--project=agents", "--env=production", "--plain"],
+    "storepve": "192.168.68.6",
-            capture_output=True, text=True, timeout=10
+    "acerpve": "192.168.68.9",
-        )
+    "ocupve":  "192.168.68.5",
        if result.returncode == 0:
            return result.stdout.strip()
    except Exception:
        pass
    # Fallback: try exporting all secrets
    try:
        result = subprocess.run(
            ["infisical", "export", "--project=agents", "--env=production",
             "--format=dotenv"],
            capture_output=True, text=True, timeout=10
        )
        if result.returncode == 0:
            for line in result.stdout.splitlines():
                if line.startswith(f"LITELLM_API_KEY_{agent_name.upper()}") or \
                   (line.startswith("LITELLM_API_KEY=") and agent_name == os.uname().nodename):
                    return line.split("=", 1)[1].strip().strip('"').strip("'")
    except Exception:
        pass
    return None
 # Agent keys are pulled from Infisical vault at runtime.
 # The 'key' field is populated dynamically below.
 AGENTS = {
    "tanko":   {"ct": 112, "host": "192.168.68.122", "user": "jerome"},
    "mumuni":  {"ct": 114, "host": "192.168.68.123", "user": "root"},
    "koby":    {"ct": 111, "host": None,              "user": None},
    "koonimo": {"ct": 113, "host": None,              "user": None},
 }
-# Inject keys from vault
+# Agent definitions: ct, host, user, pve_node, vault_key_name
-for agent_name in AGENTS:
+AGENTS = {
-    key = _get_agent_key(agent_name)
+    "tanko":   {"ct": 112, "host": "192.168.68.122", "user": "jerome", "pve": "amdpve",  "vault_key": "TANKO_LITELLM_API_KEY"},
-    if key:
+    "abiba":   {"ct": 100, "host": "192.168.68.24",  "user": "root",   "pve": "hwepve",  "vault_key": None},  # Pi agent + Mumuni Zulip, no vault key
-        AGENTS[agent_name]["key"] = key
+    "koby":    {"ct": 111, "host": "192.168.68.129", "user": "root",   "pve": "amdpve",  "vault_key": "KOBY_LITELLM_API_KEY"},
-    else:
+    "koonimo": {"ct": 113, "host": "192.168.68.114", "user": "root",   "pve": "amdpve",  "vault_key": "KOONIMO_LITELLM_API_KEY"},
-        AGENTS[agent_name]["key"] = None
+}
 GPU_HOSTS = {
    "gpu-rtx3090 (.8)":     {"host": "192.168.68.8",   "port": 8080, "service": "llama-server"},
@@ -74,6 +54,11 @@ GPU_HOSTS = {
 FAIL = []
 INFISICAL_TOKEN = os.environ.get("INFISICAL_TOKEN")
 INFISICAL_API_URL = os.environ.get("INFISICAL_API_URL", "https://vault.sysloggh.net")
 # ── Helpers ──────────────────────────────────────────────────────────
 def ssh(host, cmd, user="root"):
    """Execute a command on a remote host, return stdout or None."""
    try:
@@ -112,15 +97,81 @@ def http_json(url, headers=None, timeout=5):
    except:
        return None
 def run_infisical(args, quiet=True):
    """Run infisical CLI with env-based auth, return stdout or None."""
    env = os.environ.copy()
    env["INFISICAL_API_URL"] = INFISICAL_API_URL
    if INFISICAL_TOKEN:
        env["INFISICAL_TOKEN"] = INFISICAL_TOKEN
    try:
        result = subprocess.run(
            ["/usr/bin/infisical"] + args,
            capture_output=True, text=True, timeout=15, env=env
        )
        return result.stdout.strip() if result.returncode == 0 else None
    except:
        return None
 # ── KEY LOOKUP FIX ───────────────────────────────────────────────────
 def _get_agent_key(agent_name, vault_key_name):
    """Retrieve agent-specific key from Infisical vault.
    Uses {NAME}_LITELLM_API_KEY format (e.g., TANKO_LITELLM_API_KEY,
    KOONIMO_LITELLM_API_KEY) which matches actual vault key names.
    """
    if not vault_key_name:
        return None
    # Primary: get the agent-specific key by name
    key = run_infisical([
        "secrets", "get", vault_key_name,
        "--projectId=" + INFISICAL_PROJECT,
        "--env=" + INFISICAL_ENV,
        "--plain",
    ])
    if key and key.startswith("sk-"):
        return key
    # Fallback: export all and search for the key name
    try:
        export = run_infisical([
            "export",
            "--projectId=" + INFISICAL_PROJECT,
            "--env=" + INFISICAL_ENV,
            "--format=dotenv",
        ])
        if export:
            for line in export.splitlines():
                if line.startswith(vault_key_name + "="):
                    value = line.split("=", 1)[1].strip().strip('"').strip("'")
                    if value.startswith("sk-"):
                        return value
    except:
        pass
    return None
 # Inject keys from vault for each agent
 for agent_name in AGENTS:
    info = AGENTS[agent_name]
    key = _get_agent_key(agent_name, info.get("vault_key"))
    AGENTS[agent_name]["key"] = key
 # ═══════════════════════════════════════════════════════════════════
-# CHECK 1: LiteLLM Key Validation
+# CHECK 1: LiteLLM Key Validation (agent-specific keys)
 # ═══════════════════════════════════════════════════════════════════
 def check_keys():
    for name, agent in AGENTS.items():
        key = agent.get("key")
        if not key:
            print(f"  ❌ {name}: NO KEY FOUND (vault empty or unreachable)")
            FAIL.append(f"key:{name}:no-key")
            continue
        data = http_json(f"{LITELLM}/v1/models",
-                         headers={"Authorization": f"Bearer {agent['key']}"})
+                         headers={"Authorization": f"Bearer {key}"})
        if data and data.get("data"):
            model = data["data"][0].get("id", "?")
            print(f"  ✅ {name}: key valid → {model}")
@@ -130,7 +181,7 @@ def check_keys():
 # ═══════════════════════════════════════════════════════════════════
-# CHECK 2: GPU Port Conflict Detection
+# CHECK 2: GPU Port Conflict Detection (unchanged)
 # ═══════════════════════════════════════════════════════════════════
 def check_gpu_ports():
@@ -158,7 +209,6 @@ def check_gpu_ports():
            else:
                print(f"  ⚠️  {label}: svc={svc_status}, port owned by {port_owner}")
        else:
            # Verify health endpoint
            health = ssh(host, f"curl -s --max-time 5 http://localhost:{port}/health")
            if health and '"status":"ok"' in health:
                print(f"  ✅ {label}: healthy (pid={port_owner})")
@@ -171,7 +221,7 @@ def check_gpu_ports():
 # ═══════════════════════════════════════════════════════════════════
-# CHECK 3: Agent Gateway Liveness + Streaming
+# CHECK 3: Agent Gateway Liveness + Streaming (now covers all agents)
 # ═══════════════════════════════════════════════════════════════════
 def check_agents():
@@ -185,7 +235,10 @@ def check_agents():
            continue
        # Gateway process
-        pid = ssh(host, "pgrep -f 'hermes_cli.main gateway run' | head -1", user=user)
+        pid = ssh(host, "pgrep -f 'hermes_cli.main gateway run' | grep -v infisical | head -1", user=user)
        if not pid:
            # Try alternate binary name
            pid = ssh(host, "pgrep -f 'hermes.*gateway' | grep -v infisical | grep -v bash | head -1", user=user)
        if not pid:
            print(f"  ❌ {name}: GATEWAY NOT RUNNING")
            FAIL.append(f"gateway-down:{name}")
@@ -203,7 +256,7 @@ def check_agents():
        else:
            gw_state, zulip = "no-state-file", "?"
-        # Zulip streaming: does adapter have edit_message?
+        # Zulip streaming check
        adapter_paths = [
            "~/.hermes/plugins/zulip-platform/adapter.py",
            "~/.hermes/plugins/platforms/zulip/adapter.py",
@@ -220,13 +273,183 @@ def check_agents():
            r"journalctl --user -u hermes-gateway --since '10 min ago' -o cat --no-pager 2>/dev/null "
            r"| grep -ci 'error\|traceback\|exception\|401\|403\|500' || echo 0",
            user=user)
-        recent_errors = (recent_errors or "0").strip().split("\n")[-1]  # take last line
+        recent_errors = (recent_errors or "0").strip().split("\n")[-1]
        print(f"  {'✅' if gw_state == 'running' and zulip == 'connected' else '⚠️'} "
              f"{name}: gw={gw_state} zulip={zulip} streaming={streaming} "
              f"errors_10m={recent_errors.strip() or '0'} pid={pid}")
 # ═══════════════════════════════════════════════════════════════════
 # CHECK 4: CT Liveness (NEW)
 # ═══════════════════════════════════════════════════════════════════
 def check_ct_liveness():
    """Check that all agent CTs are running on their PVE nodes."""
    for name, agent in AGENTS.items():
        ct = agent["ct"]
        pve_node = agent.get("pve")
        if not pve_node:
            print(f"  ⬜ {name} (CT {ct}): no PVE node mapped — skip")
            continue
        pve_ip = PVE_NODES.get(pve_node)
        if not pve_ip:
            print(f"  ⬜ {name}: unknown PVE node '{pve_node}' — skip")
            continue
        status = ssh(pve_ip, f"pct status {ct} 2>/dev/null", user="root")
        if not status:
            print(f"  ❌ {name} (CT {ct} on {pve_node}): PVE UNREACHABLE")
            FAIL.append(f"ct-unreachable:{name}:{pve_ip}")
        elif "running" in status:
            print(f"  ✅ {name} (CT {ct} on {pve_node}): running")
        elif "stopped" in status:
            print(f"  ❌ {name} (CT {ct} on {pve_node}): STOPPED")
            FAIL.append(f"ct-stopped:{name}")
        else:
            print(f"  ⚠️  {name} (CT {ct} on {pve_node}): {status.strip()}")
 # ═══════════════════════════════════════════════════════════════════
 # CHECK 5: Config YAML Integrity (NEW)
 # ═══════════════════════════════════════════════════════════════════
 def check_config_integrity():
    """Verify agent config.yaml parses as valid YAML."""
    for name, agent in AGENTS.items():
        host = agent.get("host")
        user = agent.get("user")
        if not host or not user:
            print(f"  ⬜ {name}: cannot SSH — skip config check")
            continue
        # Check YAML parses
        yaml_ok = ssh(host,
            "python3 -c "
            '"import yaml; yaml.safe_load(open(\'/root/.hermes/config.yaml\')); print(\'OK\')" '
            "2>&1 || echo 'FAIL'",
            user=user)
        if not yaml_ok:
            print(f"  ❌ {name}: SSH UNREACHABLE (config check skipped)")
            FAIL.append(f"config-unreachable:{name}")
        elif "OK" in yaml_ok:
            print(f"  ✅ {name}: config.yaml valid YAML")
        else:
            print(f"  ❌ {name}: config.yaml YAML ERROR — {yaml_ok[:120]}")
            FAIL.append(f"config-yaml-error:{name}")
 # ═══════════════════════════════════════════════════════════════════
 # CHECK 6: Wrapper/CLI Integrity (NEW)
 # ═══════════════════════════════════════════════════════════════════
 def check_wrapper_integrity():
    """Verify the hermes CLI wrapper exists and can reach hermes-real."""
    for name, agent in AGENTS.items():
        host = agent.get("host")
        user = agent.get("user")
        if not host or not user:
            print(f"  ⬜ {name}: cannot SSH — skip wrapper check")
            continue
        # Check wrapper exists
        wrapper = ssh(host, "ls -la /root/.local/bin/hermes 2>/dev/null", user=user)
        if not wrapper:
            # Check alternate wrapper locations
            wrapper = ssh(host, "which hermes 2>/dev/null; command -v hermes 2>/dev/null", user=user)
            if not wrapper:
                print(f"  ❌ {name}: NO HERMES CLI WRAPPER FOUND")
                FAIL.append(f"wrapper-missing:{name}")
                continue
            else:
                print(f"  ⚠️  {name}: hermes at {wrapper.strip()} (not ~/.local/bin/hermes)")
        # Check wrapper has correct infisical path
        infisical_path_valid = ssh(host,
            "head -20 /root/.local/bin/hermes 2>/dev/null | grep -q '/usr/bin/infisical' && echo OK || echo MISS",
            user=user)
        if infisical_path_valid == "MISS":
            # Check if infisical exists on path
            inf_actual = ssh(host, "command -v infisical 2>/dev/null", user=user)
            if not inf_actual:
                print(f"  ❌ {name}: INFISICAL NOT INSTALLED (wrapper broken)")
                FAIL.append(f"wrapper-no-infisical:{name}")
            else:
                print(f"  ⚠️  {name}: wrapper infisical path may be wrong (infisical at {inf_actual})")
                FAIL.append(f"wrapper-infisical-path:{name}")
        # Check hermes-real exists
        hermes_real = ssh(host,
            "ls -la /root/.local/bin/hermes-real 2>/dev/null || echo MISS",
            user=user)
        if not hermes_real or hermes_real.strip() == "MISS":
            # Check venv path
            hermes_real = ssh(host,
                "ls -la /usr/local/lib/hermes-agent/venv/bin/hermes 2>/dev/null || echo MISS",
                user=user)
            if not hermes_real or hermes_real.strip() == "MISS":
                print(f"  ❌ {name}: hermes-real NOT FOUND (wrapper broken)")
                FAIL.append(f"wrapper-no-hermes-real:{name}")
            else:
                print(f"  ✅ {name}: hermes-real at alt path")
        # Check the .env file has the key
        env_has_key = ssh(host,
            "grep -c 'LITELLM_API_KEY' /root/.hermes/.env 2>/dev/null || echo 0",
            user=user)
        if env_has_key and env_has_key.strip() not in ("", "0"):
            print(f"  ✅ {name}: wrapper + .env key present")
        else:
            print(f"  ⚠️  {name}: .env may be missing LITELLM_API_KEY entry")
 # ═══════════════════════════════════════════════════════════════════
 # CHECK 7: Vault Secret Non-Emptiness (NEW)
 # ═══════════════════════════════════════════════════════════════════
 def check_vault_secrets():
    """Verify agent-specific vault secrets are non-empty and start with sk-."""
    for name, agent in AGENTS.items():
        vault_key_name = agent.get("vault_key")
        if not vault_key_name:
            continue
        key = agent.get("key")
        if not key:
            print(f"  ❌ {name}: vault secret {vault_key_name} MISSING or EMPTY")
            FAIL.append(f"vault-empty:{name}:{vault_key_name}")
        elif not key.startswith("sk-"):
            print(f"  ❌ {name}: vault secret {vault_key_name} WRONG FORMAT (starts '{key[:8]}...')")
            FAIL.append(f"vault-bad-format:{name}:{vault_key_name}")
        else:
            print(f"  ✅ {name}: vault {vault_key_name}=sk-...{key[-4:]}")
 # ═══════════════════════════════════════════════════════════════════
 # DEPLOY: copy updated script to /root/scripts/ on local host
 # ═══════════════════════════════════════════════════════════════════
 def deploy_self():
    """Copy this script to /root/scripts/agent-health-check.py if out of date."""
    dest = "/root/scripts/agent-health-check.py"
    try:
        with open(__file__, "r") as f:
            current = f.read()
        if os.path.isfile(dest):
            with open(dest, "r") as f:
                existing = f.read()
            if current == existing:
                return  # Already deployed
        # Write new version
        with open(dest, "w") as f:
            f.write(current)
        os.chmod(dest, 0o755)
        print(f"  📦 Deployed updated script to {dest}")
    except:
        pass  # Not fatal if deploy fails
 # ═══════════════════════════════════════════════════════════════════
 # MAIN
 # ═══════════════════════════════════════════════════════════════════
@@ -235,8 +458,12 @@ def main():
    quiet = "--quiet" in sys.argv
    as_json = "--json" in sys.argv
    # Self-deploy to canonical location
    if not quiet and "--no-deploy" not in sys.argv:
        deploy_self()
    if not quiet:
-        print(f"🏥 Agent Health Check — {datetime.now().strftime('%Y-%m-%d %H:%M UTC')}")
+        print(f"🏥 Agent Health Check v2 — {datetime.now().strftime('%Y-%m-%d %H:%M UTC')}")
        print()
    print("🔑 LiteLLM Keys:")
@@ -249,11 +476,26 @@ def main():
    print("🤖 Agent Gateways:")
    check_agents()
    print()
    print("🖥️  CT Liveness:")
    check_ct_liveness()
    print()
    print("📝 Config Integrity:")
    check_config_integrity()
    print()
    print("🔌 Wrapper/CLI Integrity:")
    check_wrapper_integrity()
    print()
    print("🔐 Vault Secrets:")
    check_vault_secrets()
    if FAIL:
        print(f"\n❌ {len(FAIL)} FAILURE(S): {' | '.join(FAIL)}")
        if quiet:
            # In quiet mode, only print failures as a single alert line
            print(f"ALERT agent-health:{','.join(FAIL)}")
    elif not quiet:
        print("\n✅ All checks passed")
@@ -0,0 +1,65 @@
 #!/bin/bash
 # Netbird Reverse Proxy — Add a new domain route
 #
 # Usage: netbird-add-domain.sh <domain> <backend_ip> [port] [protocol]
 #
 # Example:
 #   netbird-add-domain.sh dns.sysloggh.net 192.168.68.10 80
 #
 # This script adds a domain to the Netbird proxy by inserting records
 # directly into the management server's SQLite database, then restarting
 # the proxy stack.
 #
 # Prerequisites: SSH root access to 72.61.0.17
 #                sqlite3 available on VPS
 #
 # Requires: The domain must already have a DNS CNAME to netbird.sysloggh.net
 #           pointing to 72.61.0.17.
 set -euo pipefail
 DOMAIN="${1:?Usage: netbird-add-domain.sh <domain> <backend_ip> [port] [protocol]}"
 BACKEND_IP="${2:?Usage: netbird-add-domain.sh <domain> <backend_ip> [port] [protocol]}"
 PORT="${3:-80}"
 PROTOCOL="${4:-http}"
 VPS="root@72.61.0.17"
 DB_VOLUME="/var/lib/docker/volumes/root_netbird_data/_data"
 DB="$DB_VOLUME/store.db"
 echo "=== Adding Netbird proxy route ==="
 echo "Domain:    $DOMAIN"
 echo "Backend:   $BACKEND_IP:$PORT ($PROTOCOL)"
 echo ""
 ssh "$VPS" bash << REMOTESCRIPT
 set -euo pipefail
 # Generate unique ID using timestamp hash (Netbird format)
 ID_SUFFIX=\$(date +%s | md5sum | head -c 16)
 SVC_ID="d9\${ID_SUFFIX}ptsnc73\$(date +%s | md5sum | head -c 10)"
 TGT_ID=\$(sqlite3 "$DB" "SELECT COALESCE(MAX(id), 100) + 1 FROM targets;")
 ACCOUNT_ID="d88av3aptsnc73clmogg"
 ZONE_ID="d8adqjaptsnc73fro5g0"
 echo "Service ID: \$SVC_ID"
 echo "Target ID:  \$TGT_ID"
 # Insert service
 sqlite3 "$DB" "INSERT INTO services (id, account_id, name, domain, proxy_cluster, enabled, terminated, pass_host_header, rewrite_redirects, mode, source, port_auto_assigned, private) VALUES (\"\$SVC_ID\", \"\$ACCOUNT_ID\", \"$DOMAIN\", \"$DOMAIN\", \"netbird.sysloggh.net\", 1, 0, 1, 0, \"http\", \"permanent\", 0, 0);"
 echo "Service: OK"
 # Insert target
 sqlite3 "$DB" "INSERT INTO targets (id, account_id, service_id, host, port, protocol, target_id, target_type, enabled, skip_tls_verify, request_timeout, session_idle_timeout, agent_network, disable_access_log) VALUES (\$TGT_ID, \"\$ACCOUNT_ID\", \"\$SVC_ID\", \"$BACKEND_IP\", $PORT, \"$PROTOCOL\", \"\$ZONE_ID\", \"subnet\", 1, 0, 0, 0, 0, 0);"
 echo "Target:  OK"
 # Verify
 sqlite3 -column "$DB" "SELECT s.name, t.host, t.port, t.protocol FROM services s JOIN targets t ON s.id=t.service_id WHERE s.name=\"$DOMAIN\";"
 echo ""
 echo "Restarting proxy stack..."
 cd /root && docker compose restart netbird-server 2>/dev/null
 sleep 15
 docker compose restart proxy 2>/dev/null
 echo "Done. Verify with: curl -sI https://$DOMAIN"
 REMOTESCRIPT
@@ -11,31 +11,33 @@ set -euo pipefail
 # ── CT ID → PVE Node mapping (maintained HERE, not in prose contracts) ──
 declare -A CT_NODES=(
    # amdpve (192.168.68.15)
    [100]=amdpve    # abiba
    [105]=amdpve    # kagentz
    [111]=amdpve    # tdunna
    [112]=amdpve    # tanko
    [113]=amdpve    # baggy
    [115]=amdpve    # scottdenya
    # minipve (192.168.68.12)
    [102]=minipve   # adguard (was acerpve)
    [104]=minipve   # authentik
    [110]=minipve   # gitea
    [114]=minipve   # mumuni
    [116]=minipve   # syslog-api
    [119]=minipve   # infisical-vault
    # storepve (192.168.68.6)
    [106]=storepve  # ra-h-os
    [107]=storepve  # proxmox-backup
    [108]=storepve  # media
    [117]=storepve  # zulip
-    # acerpve (192.168.68.9)
+    [118]=storepve  # jdownloader
-    [102]=acerpve   # adguard
+    # acerpve (192.168.68.9) — no CTs (bare metal GPU .8)
    # hwepve (192.168.68.4)
    [100]=hwepve    # abiba (was amdpve)
    [105]=hwepve    # kagentz (was amdpve)
    [114]=hwepve    # mumuni (was minipve)
    # ocupve (192.168.68.5) — no CTs (bare metal GPU .110)
    #
    # REMOVED CTs (migrated to bare metal, decommissioned, or VMs):
    #   101 llm-gpu   → bare metal 192.168.68.8   (RTX 3090)
    #   103 ocu-llm   → bare metal 192.168.68.110 (RTX 5070)
    #   109 docker-vm → KVM VM 192.168.68.7       (use direct SSH)
    #   118 jitsi     → stopped, not in service
 )
 # Each node must be root-accessible via SSH hostname
@@ -48,6 +50,7 @@ declare -A NODE_IPS=(
    [storepve]=192.168.68.6
    [acerpve]=192.168.68.9
    [ocupve]=192.168.68.5
    [hwepve]=192.168.68.4
 )
 resolve_node() {
@@ -46,17 +46,19 @@ You are a code reviewer for OpenProse infrastructure contracts in the Syslog Sol
 The infrastructure-control.prose.md contract is the canonical reference for the cluster topology:
-**Proxmox Cluster "Tabiri" (5 nodes):**
+**Proxmox Cluster "Tabiri" (6 nodes):**
- amdpve (192.168.68.15): abiba, kagentz, tanko, tdunna, baggy, scottdenya
+- amdpve (192.168.68.15): tanko, tdunna, baggy, scottdenya
- minipve (192.168.68.12): authentik, gitea, mumuni, syslog-api, jitsi
+- minipve (192.168.68.12): adguard, authentik, gitea, syslog-api, infisical-vault
- storepve (192.168.68.6): docker-vm, ra-h-os, PBS, media, zulip
+- storepve (192.168.68.6): docker-vm, ra-h-os, PBS, media, jdownloader, zulip
- acerpve (192.168.68.9): llm-gpu, adguard
+- acerpve (192.168.68.9): llm-gpu
 - ocupve (192.168.68.5): ocu-llm
 - hwepve (192.168.68.4): abiba, kagentz, mumuni
-**CT IDs (verified 2026-07-04 against PVE API):**
+**CT IDs (verified 2026-07-24 against PVE API):**
 100:abiba  102:adguard  104:authentik  105:kagentz  106:ra-h-os
 107:pbs    108:media    110:gitea      111:tdunna   112:tanko
 113:baggy  114:mumuni   115:scottdenya  116:syslog-api 117:zulip
 118:jdownloader  119:infisical-vault
 **NO CT 122, CT 123, or .19 exist in the cluster.**
@@ -0,0 +1,91 @@
 #!/bin/bash
 # swap-gpu-dense-model.sh — Swap RTX 3090 from qwen3.6-27B-code to SmartCode-Fable-5
 # Run when download completes: ssh root@192.168.68.8 'bash -s' < this script
 #
 # Usage: bash swap-gpu-dense-model.sh
 # Requires: new model at /home/llmuser/models/SmartCode-Fable-5-27B-UD-Q4_K_XL.gguf
 set -e
 MODEL_PATH="/home/llmuser/models/SmartCode-Fable-5-27B-UD-Q4_K_XL.gguf"
 OLD_WRAPPER="/home/llmuser/llama-wrapper.sh"
 echo "═══ Swapping gpu-dense to SmartCode-Fable-5 ═══"
 # 1. Verify model file
 if [ ! -f "$MODEL_PATH" ]; then
    echo "❌ Model not found at $MODEL_PATH"
    echo "   Download: curl -L -o $MODEL_PATH <huggingface-url>"
    exit 1
 fi
 MODEL_SIZE=$(ls -lh "$MODEL_PATH" | awk '{print $5}')
 echo "✅ Model found: $MODEL_SIZE"
 # 2. Create new wrapper script for SmartCode-Fable-5
 cat > /home/llmuser/llama-fable-wrapper.sh << 'WRAPPER'
 #!/bin/bash
 # SmartCode-Fable-5 llama-server wrapper for RTX 3090
 # Sampler settings from model card: temp 0.9, top-p 0.95, top-k 60, repeat-penalty off
 PORT=8080
 GHOST_PID=$(ss -tlnp 2>/dev/null | grep -Po ":${PORT}\s+.*pid=\K[0-9]+" | head -1)
 if [ -n "$GHOST_PID" ] && [ "$GHOST_PID" != "$$" ]; then
    echo "[wrapper] Port $PORT occupied by ghost pid $GHOST_PID — cleaning up" >&2
    kill -9 "$GHOST_PID" 2>/dev/null
    sleep 2
 fi
 exec /usr/local/bin/llama-server \
    --model /home/llmuser/models/SmartCode-Fable-5-27B-UD-Q4_K_XL.gguf \
    --ctx-size 131072 \
    --cache-type-k q4_0 \
    --cache-type-v q4_0 \
    --flash-attn 1 \
    --cont-batching \
    --parallel 1 \
    --batch-size 2048 \
    --ubatch-size 1024 \
    --n-gpu-layers 99 \
    --temp 0.9 \
    --top-p 0.95 \
    --top-k 60 \
    --min-p 0.0 \
    --repeat-penalty 1.0 \
    --api-key not-needed \
    --port 8080 \
    --host 0.0.0.0
 WRAPPER
 chmod 755 /home/llmuser/llama-fable-wrapper.sh
 echo "✅ Created /home/llmuser/llama-fable-wrapper.sh"
 # 3. Update systemd service to use new wrapper
 echo "📝 Updating systemd service..."
 sed -i 's|ExecStart=/home/llmuser/llama-wrapper.sh|ExecStart=/home/llmuser/llama-fable-wrapper.sh|' /etc/systemd/system/llama-server.service
 systemctl daemon-reload
 # 4. Stop old server, start new
 echo "🔄 Restarting llama-server..."
 systemctl stop llama-server
 sleep 3
 systemctl start llama-server
 sleep 8
 # 5. Verify
 echo ""
 echo "═══ Verification ═══"
 systemctl is-active llama-server
 echo ""
 echo "Port 8080:"
 ss -tlnp 2>/dev/null | grep ":8080" | head -1
 echo ""
 echo "GPU VRAM:"
 nvidia-smi --query-gpu=memory.used,memory.total,utilization.gpu --format=csv,noheader 2>/dev/null
 echo ""
 echo "=== Health check ==="
 curl -s --max-time 5 http://localhost:8080/health 2>/dev/null
 echo ""
 echo ""
 echo "✅ Swap complete. Test via LiteLLM:"
 echo "  curl -s http://192.168.68.116/v1/chat/completions -H 'Authorization: Bearer <key>' -H 'Content-Type: application/json' -d '{\"model\":\"gpu-dense\",\"messages\":[{\"role\":\"user\",\"content\":\"write hello world in python\"}],\"max_tokens\":100}'"
@@ -16,7 +16,7 @@ Runs every 15 minutes in the background. Also triggers on session start.
 ## Requires
 - **Zulip API key** for `abiba-bot@chat.sysloggh.net` in `$ZULIP_API_KEY`
- **SSH access** to Tanko (192.168.68.122), Mumuni (192.168.68.123), and Agent Zero Docker host (192.168.68.14)
+- **SSH access** to Tanko (192.168.68.122), Mumuni (192.168.68.24, inside Abiba CT100 on hwepve), and Agent Zero Docker host (192.168.68.14)
 - **PM2** on localhost for pi process management
 - **Network access** to `chat.sysloggh.net`, `localhost:9200`
 - **Write access** to `/root/zulip-health-monitor.log` and `/tmp/zulip-monitor-debounce`
@@ -182,13 +182,13 @@ grep -a "Finalized\|Failed to finalize" /root/.pm2/logs/abiba-zulip-out.log | ta
 | `last_error` set | Log and monitor |
 | Crash loop >10/h | Alert user |
-### Step 3: Platform B — Hermes (Tanko .122, Mumuni .123)
+### Step 3: Platform B — Hermes (Tanko .122, Mumuni .24)
 **B1: Gateway State**
 ```bash
 ssh root@192.168.68.122 "cat ~/.hermes/gateway_state.json"
-ssh root@192.168.68.123 "cat ~/.hermes/gateway_state.json"
+ssh root@192.168.68.24 "cat ~/.hermes/gateway_state.json"  # Mumuni inside Abiba CT100
 ```
 Check `platforms.zulip.state`: `connected` ✅ | `disconnected` ❌ | `error` ❌ | missing → not installed.
@@ -199,7 +199,7 @@ Check `platforms.zulip.state`: `connected` ✅ | `disconnected` ❌ | `error`
 ssh root@<CT> "ps aux | grep 'gateway run' | grep -v grep"
 ```
-Gateway PID should exist with uptime > 60s.
+Gateway PID should exist with uptime > 60s. **Dual-gateway detection**: if more than one `gateway run` process is found, the gateway has a collision (typically one `--force` and one `--replace` process). Kill the newer/duplicate process, then restart the remaining gateway via PM2 (`pm2 restart mumuni-zulip`). Check gateway log for "Gateway running with 2 platform(s)" (not 1) to confirm Zulip reloaded.
 **B3: Heartbeat Verification**
@@ -409,3 +409,68 @@ Backup v2 before starting: `cp index.js index.js.v2-backup-$(date +%Y%m%d-%H%M%S
 | Queue expiry handling | Crash | Auto re-register |
 | Busy worker deadlock | Router death | Worker SIGKILL + error DM |
 | PM2 restart exhaustion | Yes (max_restarts=10) | No (max_restarts=100 + watchdog) |
 ---
 ## Incident Log — 2026-07-18 Fleet-Wide Audit
 ### Fleet State After Audit
 | Agent | Platform | Zulip State | Issues Found | Fix Applied |
 |-------|----------|-------------|--------------|-------------|
 | **Abiba** | pi (CT 100) | ✅ Connected | API key missing from Infisical injection; poll timeout noise | Added .env fallback; AbortError treated as empty poll (no retry); poll timeout 65s→90s |
 | **Tanko** | Hermes (CT 112) | ✅ Connected | Gateway disconnected since Jul 11; watchdog restart didn't re-establish Zulip | Full gateway restart (kill wrapper, let infisical-gateway.sh respawn) |
 | **Mumuni** | Hermes (CT 114) | ✅ Connected | No issues found | None needed |
 ### Key Fixes Applied
 **1. Abiba — Credential Fallback (L4 Pattern)**
 - Root cause: `zulip.api_key` in config.yaml is `""` (expected from Infisical). Infisical vault `ABIBA_ZULIP_API_KEY` wasn't being injected into the process environment.
 - Fix: Added `.env` file fallback at `/root/.pi/agent/extensions/zulip/.env` with known-working key, sourced before the Infisical `exec`.
 - Lesson: Per L4 from gpu-self-heal, Infisical is not always available — always keep a local `.env` fallback.
 **2. Abiba — Poll Timeout Handling**
 - Root cause: Zulip long-poll uses `AbortSignal.timeout(65000)`. Zulip's default `event_queue_longpoll_timeout_seconds` can exceed 65s. When the signal fires, an `AbortError` is thrown and caught by the circuit breaker as a failure.
 - Fix: Caught `AbortError` inside `poll()` and return empty array (no events) instead of throwing. Extended timeout to 90s to match Zulip server default.
 - Reference: [Zulip Events System — long-poll timeout](https://zulip.readthedocs.io/en/11.6/subsystems/events-system.html)
 **3. Tanko — Gateway Restart**
 - Root cause: Gateway process was running but Zulip platform stayed in "disconnected" state since Jul 11, 2026. The wrapper script (`infisical-gateway.sh`) restarts on crash but the gateway wasn't re-establishing Zulip on restart.
 - Fix: Killed gateway PID to trigger wrapper restart. New gateway (PID 331991) established Zulip connection successfully.
 ### Fleet-Wide Zulip Health Metrics (as of 2026-07-18)
 | Metric | Value |
 |--------|-------|
 | Zulip server | ✅ HTTP 200 |
 | Agents connected | 3/3 (Abiba, Tanko, Mumuni) |
 | Abiba circuit breaker | CLOSED (0 failures) |
 | Abiba uptime | 2D (post-restart) |
 | Tanko gateway uptime | Ongoing |
 | Mumuni gateway uptime | Ongoing |
 | Watchdog status | ✅ Online (2D uptime) |
 ### Hermes Agent Zulip Plugin Improvements
 Based on the audit, improvements that should be ported to all Hermes Zulip adapters:
 1. **Circuit breaker pattern** — Already in Abiba's pi extension. Hermes adapters should add the same CLOSED→OPEN→HALF_OPEN state machine with exponential backoff.
 2. **Credential fallback** — All Hermes agents use Infisical for credentials. Add `.env` local fallback per L4 pattern for `ZULIP_API_KEY`.
 3. **Queue re-registration** — Handle `BAD_EVENT_QUEUE_ID` with automatic re-registration instead of gateway restart.
 4. **Supervisor watchdog** — Hermes uses PM2 which auto-restarts on crash, but has no health-check watchdog. Add lightweight external health checks.
 5. **Streaming** — All agents have `streaming: true` in their zulip config. Verify `edit_message()` is implemented in each adapter.
 ### Abiba pi Zulip Extension v2 — Implemented Resilience Summary
 | Feature | Status | Notes |
 |---------|--------|-------|
 | Circuit breaker | ✅ | CLOSED→OPEN→HALF_OPEN; 50% failure threshold; 30s reset timeout |
 | Retry with jitter | ✅ | 2 attempts, 200ms base, 50-100% jitter |
 | Queue lifecycle | ✅ | 10min idle_queue_timeout; BAD_EVENT_QUEUE_ID handling |
 | Crash prevention | ✅ | uncaughtException + unhandledRejection recovery |
 | Worker timeout | ✅ | 5min busy timeout → SIGKILL + error DM |
 | Health endpoint | ✅ | :9200 with circuit breaker metrics |
 | Echo prevention | ✅ | Dynamic bot user resolution |
 | Poll timeout (AbortError) | ✅ v2.1 | Normal timeout returns [] instead of error |
 | Credential fallback | ✅ v2.1 | .env file before Infisical exec |
 | Provider auto-fix | ✅ | Detects reasoning_content models, switches to compatible |
@@ -65,7 +65,7 @@ triggers:
 |------|----|------|---------|
 | Zulip server | 192.168.68.19 | root | Docker: `zulip-zulip-1` |
 | Abiba (pi) | localhost | root | PM2: `abiba-zulip` |
-| Mumuni | 192.168.68.123 | root | `hermes gateway restart` |
+| Mumuni | 192.168.68.24 (CT100 abiba) | root | `hermes gateway restart` |
 | Tanko | 192.168.68.122 | jerome | `PATH=$PATH:/home/jerome/.hermes/hermes-agent hermes gateway restart` |
 ## Debounce