chore(lint): adopt the canonical .golangci.yml from infra/ci-templates

Estate had 26 Go repos, 3 with a lint config, all three different; the other 23 ran golangci-lint v2 defaults, which enable NO formatter -- the hole that let gofmt drift rot undetected until it was found by hand (dma-cli#12). Canonical lives at infra ci-templates/golangci.yml and is distributed by the infra#309 pattern: byte-identical copies, checksum drift gate in infra. Do not edit this file here -- edit the canonical and run `task ci:sync`. Verified locally before pushing, not pushed-and-hoped: golangci-lint v2.11.4 run against a Go 1.26.1 toolchain (matching CI) reports 0 issues in this repo with this config.
fix(context): sync to the estate canonical context-sync.sh (ADR-0019)
2026-09-05 12:51:05 +02:00 · 2026-09-05 08:29:45 +02:00 · 2026-08-28 22:01:48 +02:00
23 changed files with 665 additions and 854 deletions
@@ -1,2 +0,0 @@
 read: .aider.conventions.md
 auto-commits: false
@@ -1,372 +0,0 @@
 # Agent context — Mathias workspace
 <!-- Canonical root context for all AI coding agents.
     Lives at: ~/dev/.context/AGENT.md
     Applies to every project under ~/dev/ unless overridden.
     Run `task context:sync` from ~/dev/ to regenerate harness-specific files.
     Project-level context in .context/PROJECT.md layers on top of this. -->
 ## Who I am
 I'm Mathias, a digital product manager and technology consultant based in Sweden.
 I build software, research emerging tech, and deliver consulting engagements
 for clients under NDA. I work across AI/ML, financial automation, web applications,
 and climate/sustainability tech.
 ## How I work with agents
 - I think like a product manager — I care about *why* before *how*
 - I want agents to be opinionated and push back, not just execute blindly
 - I prefer concise responses; skip ceremony and get to the point
 - When I say "build this", I mean production-quality with tests, not a demo
 - Ask me before making irreversible changes or adding heavy dependencies
 - I work with confidential client data — never send it to cloud APIs unless I explicitly say it's OK
 ## Behavior rules
 These rules apply to every task across every project, regardless of harness.
 0. **Pre-task ritual — before ANY implementation (non-negotiable).** Run this before writing a single line:
   - **Query the brain** (`brain_query`) for the domain + symptom. If the result changes your approach, surface it before acting. 5 seconds beats 5 hours.
   - **Load the relevant skill** — see trigger table in *Engineering Skills* below.
   - **Write the failing test first.** Name the test before the function. If the target is untestable (e.g. `main()` wiring), extract the logic into a testable function first. No implementation without a red test.
   - **State the observable success criterion** — what specific behavior, output, or passing test proves this is done?
   **TDD is non-negotiable.** "Tests pass" is not proof of correctness — only proof the tests ran. Write tests that would catch the bug before writing code that fixes it.
 1. **No assumptions.** Don't hide confusion — surface it. Surface tradeoffs explicitly.
   Think before coding; if the problem is unclear, ask or state assumptions before acting.
 2. **Minimum viable code.** Solve with the smallest change that works. Nothing
   speculative, no "while we're here" cleanups, no premature abstractions. Simplicity first.
 3. **Surgical changes.** Touch only what the task requires. Leave unrelated code,
   files, and formatting alone. Diffs should be small and reviewable.
 4. **Goal-driven execution.** Define clear success criteria up front for every task.
   Loop — implement, verify, refine — until those criteria are met. Don't claim
   completion without evidence (tests pass, command output, observed behavior).
 5. **Trunk-Based Development — commit directly to main.** Every commit is one
   logical change (one tool, one fix, one test) with passing tests. Main is always
   deployable. Never create long-lived feature branches.
   **Exception — parallel agents on same repo:** If another agent is known to be
   actively working on the same repo simultaneously, create a short-lived branch
   (`agent/<description>`), finish the task, and merge to main within the same
   session. Do not leave agent branches open between sessions.
   **Exception — external contributor or client four-eyes requirement:** Use
   PR flow only when a human reviewer outside the project is required. Document
   the reason in PROJECT.md.
 6. **Close the loop — every substantive task ends with the same ritual.** Shipping
   the code is not the end of the task; capturing it is. Run this unprompted:
   - **Tag + bump SemVer** on the change (annotated tag; minor for a feature or
     new/changed ADR, patch for a fix; docs in the same commit). Check the repo's
     actual last tag — stated versions in docs drift stale.
   - **Push** main and the tag (CI is the gate).
   - **Persist generalizable learnings to the brain** (`brain_write`, wing/hall) —
     the reusable patterns and the footguns that would bite anyone again, never
     project status. See *Knowledge base — when to write* below.
   - **File discovered-but-deferred work as tracker issues** on the project's own
     repo — token-budget gaps, recorded ADR limitations, v2 follow-ups. Don't let
     "out of scope, recorded" rot in a commit message; make it a ticket with a
     source pointer.
   - Surface the brain entries and issue numbers in the closing summary so the
     trail is auditable.
 ## Default stack
 | Layer | Default | Fallback | Last resort |
 |-------|---------|----------|-------------|
 | Language | Go | Python | TypeScript, Java, C |
 | UI | HTMX + Templ | Server-rendered HTML | React (only if SPA is justified) |
 | Build | Task (taskfile.dev) | Make | — |
 | Containers | Docker Compose (dev), k3s (prod) | — | — |
 | DB | PostgreSQL + sqlc | SQLite | — |
 | Search | pgvector (vector), BM25 | Qdrant (when >1M vectors or hybrid retrieval) | — |
 | Logging | slog (structured) | — | — |
 | Testing | Table-driven, testify | — | — |
 | Agents (Go) | google.golang.org/adk + pkg/litellm adapter | — | — |
 Exploratory: Rust, Zig — I'll tell you when I want these.
 ## Code conventions
 - **Go style**: golines, gofumpt, golangci-lint
 - **Errors**: `fmt.Errorf("operation: %w", err)` — never naked, never log-and-return
 - **Naming**: stdlib conventions, no stuttering
 - **Architecture**: prefer stdlib over frameworks, constructor injection, env-var config parsed into typed structs
 - **Git**: conventional commits (`feat:`, `fix:`, `chore:`), commit directly to main,
  one logical change per commit, CI is the quality gate
 - **Never**: long-lived feature branches, PRs for solo work, direct push without
  passing `task check` locally first
 - **Security**: no secrets in code, govulncheck before adding deps, SOPS for encrypted config
 - **Dependencies**: prefer stdlib. testify, slog, templ, sqlc, google.golang.org/adk (agent projects only) are pre-approved; anything else needs justification in the commit message
 ## Secret handling (every harness, every command)
 Tool output is persisted: terminal → `~/.claude/projects` transcripts →
 claudewatcher → brain/wiki → gitea history. A secret printed once is
 searchable forever, and clearing it means rotating the key. So:
 1. **Never print, echo, log, or transform a secret to inspect it.** No
   `base64`/`xxd`/`cat` of a key, and never pipe a secret through a transform
   to defeat `op run`'s output masking (it masks raw values; base64 hides them
   from the mask — that exact trick leaked a key on 2026-06-11).
 2. **Secrets stay in the subprocess.** Reference them only as env vars consumed
   *inside* `op run --env-file ~/.op-env -- <cmd>`. Never place a literal secret
   in a command's argv (it lands in the tool call and the transcript).
 3. **Existence check without revealing the value:** `[ -n "$X" ] && echo set` —
   never `${X:-...}` (returns the value when set) and never echo a substring of it.
 4. **Cross-host secrets:** run the secret-consuming command on the host that has
   the secret; do not forward a raw key over ssh argv/stdout.
 5. If a secret does leak into output, say so immediately and flag it for rotation —
   don't bury it.
 ## Infrastructure
 Three machines on Tailscale:
 | Machine | Role | Key specs |
 |---------|------|-----------|
 | koala | GPU inference, heavy compute | RTX 5070, runs k3s + llama-swap + shared postgres18/pgvector |
 | iguana | Services, builds | M2 Ultra Mac |
 | flamingo | Daily driver, edge | Mac mini, ~/dev is here |
 - **Model routing**: LiteLLM in front of llama-swap (local) + cloud APIs (when permitted)
 - **Orchestration**: k3s cluster across all three machines
 - **Networking**: Tailscale mesh
 ## Project landscape
 All development repos live at `~/dev/` (softlink from `~/Documents/local-dev/`).
 Organized in thematic folders:
 | Folder | Focus | Count |
 |--------|-------|-------|
 | `GO/` | Go web frameworks, API integrations, learning projects | ~10 |
 | `AI/` | ML research, AI frameworks (FinRL, DSPy, crawl4ai) | ~6 |
 | `AGENTS/` | Autonomous agents, coding agents, MCP servers, infra | ~15 |
 | `QKX/` | Invoice processing, financial automation, payment systems | ~13 |
 | `XT/` | Climate data, sustainability (Klimatkollen, Garbo) | ~2 |
 See `~/dev/PROJECT_SUMMARY.md` for detailed descriptions of each project.
 ### Key active projects
 - **super-koala** (`AGENTS/`) — multi-component agent stack with LangGraph, DSPy, MCP
 - **azure-tiger** (`QKX/`) — invoice extraction → ISO 20022 payment instructions
 - **gocrwl** (`AGENTS/`) — Go web crawler with containerized deployment
 - **koala-ai-stack** (`AGENTS/`) — local AI server infrastructure management
 - **klimatkollen** (`XT/`) — Swedish municipal climate data platform
 ## Knowledge base — actively use it
 A persistent brain (BM25 search + LLM-synthesised Q&A) survives across sessions,
 hosts, and harnesses. It holds 100+ hard-won entries: infra incident postmortems,
 Go pitfalls, framework gotchas, design principles, ADRs. **It is not optional
 reference material — query it actively, not just when explicitly told.**
 ### When to query (treat as a reflex)
 - **Before** starting a non-trivial task — search for prior art with the symptom
  AND the system component ("how did we solve X in Y?"). 5 seconds beats 5 hours.
 - **When debugging** — search for the error string, the stack frame, the affected
  service. Past you may have already paid this tax.
 - **Before adopting** a pattern, library, framework, or model name — check if it
  was tried and rejected, or what the integration footguns are.
 - **When making architectural decisions** — search for the domain + "ADR" or
  "decision" to find prior reasoning before re-deriving it.
 - **When a recommendation feels novel** — challenge yourself: "has this been
  documented?" The brain often has it.
 ### When to write
 After you discover something that **future-you would forget** and that **isn't
 recoverable from the code, git log, or PR description alone**:
 - Bugs whose root cause is non-obvious and generalisable beyond this project.
 - Framework / library / model-name quirks that bit you and would bite anyone.
 - Design principles validated under fire (e.g. "every `_get` needs a `_list`").
 - Postmortems for incidents: what broke, why, how diagnosed, what to do next time.
 DON'T write project status, sprint progress, PR summaries, or "what I did this
 session" — those rot fast and the originals are in git/gitea anyway. Brain
 entries that age well are about *why*, *how to avoid*, and *what to do when*.
 ### How to access (per harness)
 | Harness | Query | Write |
 |---------|-------|-------|
 | **Claude Code, Claude Desktop** | `brain_query` (BM25), `brain_answer` (LLM-synth + sources) MCP tools | `brain_write` MCP tool |
 | **Crush, Pi, Antigravity, other MCP-capable** | same MCP server: `ingestion-brain` (via the `mcp__*_brain__*` namespace once authenticated) | same |
 | **Anything HTTP-only (curl, scripts)** | `POST https://brain-mcp.d-ma.be/query` with `{"query":"..."}` (auth via `BRAIN_MCP_TOKEN`) | `POST .../write` with `{"content":"...","filename":"..."}` |
 | **Browser / human inspection** | `https://git.d-ma.be/mathias/hyperguild` → `knowledge/` and `wiki/` markdown files |
 - **Scoping**: defaults to `public` collection; client projects filter to `{client}` + `public`.
 - **Routing**: brain_answer's LLM uses berget.ai as primary, iguana ollama as
  fallback. Both are configurable in the `supervisor/ingestion-deployment.yaml`
  on the koala k3s cluster; don't hardcode local-only model names into the
  berget URL (see knowledge entry on namespace mismatches).
 ### Quick reflex checks
 If you find yourself about to say any of these out loud, you owe yourself a brain query first:
 - "I think the issue might be..."
 - "Let me try X and see..."
 - "I'll just write a script to..."
 - "This is probably a new bug..."
 - "Has anyone done this before?" — *yes, probably, go check.*
 ## Client work rules
 When working on a project tagged with a client name:
 1. Never send code, data, or context to cloud APIs — use local models only
 2. Never reference other client projects or their data
 3. Keep all artifacts within the client's git org / directory
 4. Treat everything as confidential unless told otherwise
 ## Harness-agnostic principles
 This context is designed to work with any AI coding tool:
 - Claude Code, Cursor, Aider, Open WebUI, Charmbracelet Mods/Crush
 - Pi Coding Agent, Mistral Vibe, Antigravity
 - Any tool that accepts a system prompt or reads a markdown context file
 The canonical source is always `.context/AGENT.md` (root) and `.context/PROJECT.md` (per-project).
 Derived files are committed (see *How context propagates* below) so a `git pull` on any host yields full agent context with no setup.
 ## How context propagates
 Canonical sources of truth:
 - Universal: `~/dev/.context/AGENT.md` (this file)
 - Project: `<repo>/.context/PROJECT.md` (per-repo)
 Derived files (committed, regenerated by `task context:sync`):
 - `CLAUDE.md`, `AGENTS.md`, `.cursorrules`, `.aider.conventions.md`,
  `.context/system-prompt.txt`
 Workflow:
 1. Edit a canonical file. Run `task context:sync`. Commit canonical and
   derived together. Push.
 2. On any other host, `git pull` brings both. Claude Code (tree-walking)
   uses `CLAUDE.md`; Crush / Pi / Antigravity (cwd-only) use `AGENTS.md`;
   Cursor uses `.cursorrules`; Aider uses `.aider.conventions.md`.
 3. `task check` runs `context:sync` then asserts `git status --porcelain`
   is empty over the derived files (catches both modified-tracked drift
   and missing-untracked adapters). A drift fails the check with a
   message telling you to stage the regenerated files.
 Behavior rules in this file and per-project rules in `PROJECT.md` apply
 unconditionally on every host, every harness.
 ## Engineering Skills
 Shared engineering skills live in the **`mathias/skills`** repo (`git.d-ma.be/mathias/skills`). Clone it to `~/dev/skills/` and run `SKILLS_CHECKOUT_DIR="$PWD" bash install.sh` there to wire every skill into your harnesses (Claude Code, Crush, Antigravity, Mistral Vibe) as native, on-demand skills. (Use `install.sh`, not `task install` — the latter is currently broken, skills#7.) Load at task start — not "on demand" but on schedule, before writing code. Browse `~/dev/skills/SKILLS_INDEX.md` for the full list.
 **Skill trigger table — load before starting, not after getting stuck:**
 | Task type | Load |
 |-----------|------|
 | Any feature or bug fix | `tdd` |
 | Refactor or design | `clean-code` or `solid` |
 | Debug | `problem-analysis` |
 | Review code or PRs | `code-review` |
 | Frame a problem before coding | `problem-analysis` |
 ---
 # cad-atlas
 ## Identity
 - **Name**: cad-atlas
 - **Owner**: Mathias
 - **Client**: personal
 - **Repo**: git.d-ma.be/mathias/cad-atlas
 - **Status**: active
 - **Stack**: Go + Templ + HTMX + CDN Tailwind (template-go-web). Cross-project conventions: `~/dev/.context/AGENT.md`.
 ## What this is
 A visual **atlas of the Continuous Agentic Development (CAD) workflow** — the full path
 from a captured signal to a deployed k3s pod, one screen, reel-style ("From Signal to Pod").
 It exists to (a) make the homelab's agentic delivery pipeline legible to a human, and
 (b) render the CAD **audit chain** — which doubles as the regulated-industry audit artifact.
 > **Core thesis:** the CAD audit chain *is* the visualization data.
 > `TELOS → goal → spec → issue → execution → attestation → deploy` is both the trace and
 > the audit package. Phase C renders it once and serves two masters (observability + compliance).
 ## Phases
 - **Phase A — static hero viz** (current). Self-contained `internal/web/static/cad-atlas.html`,
  data-driven from a hand-authored `STAGES` array (ground-truth snapshot from brain, 2026-07-19).
  Served at `/` by `internal/web/handler.go` via `go:embed`. Reel-parity: SVG spine with
  arrowheads, animated pulse, dashed **feedback bus** (stage 08 → TELOS), replay + slow-mo.
 - **Phase B — generated-from-source**. Parse brain docs + `.gitea/workflows` + infra manifests
  → render the graph so it can't drift from config.
 - **Phase C — live trace viewer**. Replace the static `STAGES` array with live reads of the
  `assessor-loop` attestation ledger + brain `session_log` + Gitea run API + Flux events.
  This is the prize: a real signal→pod trace viewer that is also the audit package.
 ## The workflow it visualizes (9 stages)
 `00 Signals` (Applied AI Radar → mathias/signals) → `01 TELOS` (intention substrate) →
 `02 Strategic session` (claude.ai frontier + LLM Council + Autoresearch Council) →
 `03 Spec → Gitea issue` (agent-ready contract; Ed25519 admission #36; **var-go Oath**) →
 `04 Human dispatch gate` (the only checkpoint; session-dispatch bridge → cad-dispatch.yml) →
 `05 Execute · agentsquad` (serve/taskqueue, exec+review loop, risk LOW/MED/HIGH, dma-cli routing,
 assessor-loop ledger) → `06 PR → CI` (go test/vet/lint/govulncheck + **var-go/oath gate**) →
 `07 CD → pod` (Flux GitOps → k3s on koala) → `08 Loop back` (outcome scored vs TELOS goal).
 ### Three orthogonal governance gates
 | Gate | Guards | Where |
 |---|---|---|
 | Ed25519 admission controller (#36) | spec **integrity** (issue untampered) | stage 03 |
 | dispatch-allow (`.dispatch-allow` + `mathias/dispatch` allowlist) | repo **eligibility** (may agents run here) | stage 04/05 |
 | **var-go Oath** (`cmd/vargo-gate`, commit status `var-go/oath`) | output **correctness** (PR satisfies the Oath; floor over reviewer, anti-rubber-stamp #55) | stage 06 |
 ## Dogfooding
 This repo is built *through* the workflow it depicts. It is `dispatch-allow`-enabled, and its
 own build increments are governed by a **var-go Oath** embedded in their spec issues (see the
 Stage-03 tracking issue). Bootstrapping honesty (per swedsl honest-stub discipline): the Oath is
 **defined** but `cmd/vargo-gate` is **not yet wired** into this repo's CI — until it is, the Oath
 is advisory here. Wiring it is a first tracked task; disclosed in code, this doc, and CI config.
 ## Brain references (source of truth — `brain_get <path>`)
 - `wiki/homelab/decisions/cad-atlas-audit-chain-is-viz-data.md` — **this project's genesis note**: the audit-chain-is-viz-data thesis, the three gates, template-go-web footguns
 - `wiki/homelab/decisions/inception-sprint-and-oath.md` — the Inception Sprint + Oath methodology (this repo's birth is the worked example); see [`docs/INCEPTION-OATH.md`](docs/INCEPTION-OATH.md) for the kept Oath
 - `knowledge/workflow-idea-to-running-service.md` — Double Diamond idea→service workflow
 - `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16.md` — CAD definition
 - `wiki/agentsquad/decisions/cad-dispatch-bridge.md` — claude.ai → agentsquad trigger path
 - `wiki/agentsquad/facts/llm-council-design-and-first-runs-2026-06-21.md` — LLM Council
 - `wiki/agentsquad/decisions/autoresearch-council-sibling-pipe.md` — Autoresearch Council
 - `wiki/agentsquad/decisions/serve-http-task-api.md` — agentsquad serve/taskqueue
 - `knowledge/var-go-anchor-to-span-spike-verdict.md` — var-go runner + CAD gate seam
 - `knowledge/swedsl-vargo-sprint1-enforcement-teeth-verdict.md` — vargo-gate enforcement teeth
 - `wiki/assessor-loop/decisions/assessor-loop-genesis.md` — attestation ledger (Phase C source)
 - `wiki/homelab/facts/homelab-network-topology-reference.md` — koala/iguana/flamingo/piguard
 ## External references
 - Inspiration reel — "From Inbox to Shipped" pipeline viz: https://www.instagram.com/reel/DY92L7bu27j/
 - karpathy/llm-council — origin of the Council pattern
 - Double Diamond design process (Discover/Define/Develop/Deliver)
 ## Run
 ```bash
 task check      # lint + vet + test (CI gate)
 task run        # build + serve at http://localhost:8080  → the atlas
 ```
 ## Deploy note
 CD (`.gitea/workflows/cd.yml`) deploys to k3s namespace `cad-atlas` via Flux. Per the known
 template-go-agent CD gap: the `deploy` job stays RED until `mathias/infra` has
 `k3s/apps/cad-atlas/deployment.yaml`. `check` + `build` are the real bootstrap gate.
@@ -53,14 +53,30 @@ These rules apply to every task across every project, regardless of harness.
   logical change (one tool, one fix, one test) with passing tests. Main is always
   deployable. Never create long-lived feature branches.
-   **Exception — parallel agents on same repo:** If another agent is known to be
+   **The PR trigger is RISK, not concurrency.** `risk/low` work commits straight to
-   actively working on the same repo simultaneously, create a short-lived branch
+   main with CI as the gate — that is most work and is unchanged. `risk/medium` and
-   (`agent/<description>`), finish the task, and merge to main within the same
+   above opens a PR, even solo, even with nobody waiting to review it. This mirrors
-   session. Do not leave agent branches open between sessions.
+   the tiered merge model in `assessor-loop`
   `method/transfer-to-a-regulated-organisation.md` §4.1, so the estate practises
   what it sells instead of merging everything on green and claiming otherwise.
-   **Exception — external contributor or client four-eyes requirement:** Use
+   **Concurrency is NOT a reason to branch.** Measured 2026-08-29 across three real
-   PR flow only when a human reviewer outside the project is required. Document
+   collisions between parallel sessions: two were not branching problems at all — a
-   the reason in PROJECT.md.
+   generated artifact written to the same path by both (branching turns that into a
   merge conflict on a 33k-line JSON), and uncommitted work in a shared checkout
   (a per-session worktree fixes it) — and the third was an ordinary non-fast-forward
   push resolved by rebase in seconds. Use a worktree per session on shared repos and
   timestamp generated artifacts. Do not reach for a branch.
   Branch+PR flow carries documented costs on solo repos: merging auto-closes gated
   issues, review comments live on a thread separate from the issue's, and a
   merged-and-deleted branch cannot be amended (brain:
   `gitea-pr-merge-autoclose-and-review-comment-footguns`). Those are the price of
   the `risk/medium`+ lane — paid deliberately, not incurred by accident.
   **Exception — external contributor or client four-eyes requirement:** Use PR flow
   when a human reviewer outside the project is required. Document the reason in
   PROJECT.md.
 6. **Close the loop — every substantive task ends with the same ritual.** Shipping
   the code is not the end of the task; capturing it is. Run this unprompted:
@@ -78,6 +94,26 @@ These rules apply to every task across every project, regardless of harness.
   - Surface the brain entries and issue numbers in the closing summary so the
     trail is auditable.
   **Chat is not a durable store. Never rely on Mathias remembering anything.**
   Every gap, caveat, risk, open question and next step must land in one of four
   places before the turn ends: **the brain**, **a repo** (code, docs, ADR),
   **a tracker issue**, or **a plan file**. A finding stated only in conversation is
   lost the moment the session closes — and this estate has repeatedly proved that a
   remembered convention is an unreliable control.
   This applies hardest to what is tempting to leave as a closing remark: "worth
   knowing X isn't enforced yet", "this is a convention, not a gate", "we should
   revisit Y". Those are exactly the items that need a locator. If it is worth
   saying in a summary, it is worth writing where it can be found again without you.
 ## CAD sprint patterns
 Two CAD sprint archetypes (defs: brain `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16`):
 - **Inception Sprint** — birth a new repo. Oath-gated close; tag only once every clause holds. Brain: `.../inception-sprint-and-oath`.
 - **Sweep Sprint** — clear an existing backlog. Parallel read-only research per issue → sequential one-issue-per-commit execution. Brain: `.../sweep-sprint-and-oath`.
 Shared: decisions that are yours, not the agent's, surface as `DECISION NEEDED` (question/options/recommendation/blocks) — ask live if you're present, else comment and wait, never act past it. Live-breaking regressions get `git revert`, never forward-fixed; host-network work skips even read-only research (solo, synchronous, you present). Rule 6's closing ritual only fires once every Oath clause genuinely holds — blocked = descoped-and-tracked, never marked done.
 ## Default stack
 | Layer | Default | Fallback | Last resort |
@@ -88,7 +124,7 @@ These rules apply to every task across every project, regardless of harness.
 | Containers | Docker Compose (dev), k3s (prod) | — | — |
 | DB | PostgreSQL + sqlc | SQLite | — |
 | Search | pgvector (vector), BM25 | Qdrant (when >1M vectors or hybrid retrieval) | — |
-| Logging | slog (structured) | — | — |
+| Logging | slog (structured) | stdlib `logging` w/ structured `extra=` (or structlog) | — |
 | Testing | Table-driven, testify | — | — |
 | Agents (Go) | google.golang.org/adk + pkg/litellm adapter | — | — |
@@ -97,7 +133,12 @@ Exploratory: Rust, Zig — I'll tell you when I want these.
 ## Code conventions
 - **Go style**: golines, gofumpt, golangci-lint
- **Errors**: `fmt.Errorf("operation: %w", err)` — never naked, never log-and-return
+- **Python style** (fallback language): ruff (format+lint, one tool), mypy --strict (non-negotiable,
  matches Go's static typing discipline), pytest + pytest-cov (table-driven via
  `@pytest.mark.parametrize`), uv (venv+deps+lock, one tool), pydantic-settings (typed env-var config
  — same principle as Go's typed structs), src-layout + `pyproject.toml` only (no `setup.py`)
 - **Errors**: `fmt.Errorf("operation: %w", err)` — never naked, never log-and-return.
  Python: `raise X from e` (exception chaining, same principle) — never bare `except`, never silent `pass`
 - **Naming**: stdlib conventions, no stuttering
 - **Architecture**: prefer stdlib over frameworks, constructor injection, env-var config parsed into typed structs
 - **Git**: conventional commits (`feat:`, `fix:`, `chore:`), commit directly to main,
@@ -135,10 +176,10 @@ Three machines on Tailscale:
 |---------|------|-----------|
 | koala | GPU inference, heavy compute | RTX 5070, runs k3s + llama-swap + shared postgres18/pgvector |
 | iguana | Services, builds | M2 Ultra Mac |
-| flamingo | Daily driver, edge | Mac mini, ~/dev is here |
+| flamingo | Daily driver, edge | Apple Silicon Mac, ~/dev is here |
 - **Model routing**: LiteLLM in front of llama-swap (local) + cloud APIs (when permitted)
- **Orchestration**: k3s cluster across all three machines
+- **Orchestration**: k3s on koala only — single control-plane node, no workers (verified 2026-08-30). iguana and flamingo are on the tailnet but are not cluster members
 - **Networking**: Tailscale mesh
 ## Project landscape
@@ -234,10 +275,11 @@ When working on a project tagged with a client name:
 ## Harness-agnostic principles
-This context is designed to work with any AI coding tool:
+Supported harnesses (2026-09-01) — Cursor and Aider were dropped; do not
- Claude Code, Cursor, Aider, Open WebUI, Charmbracelet Mods/Crush
+re-add adapters for them:
- Pi Coding Agent, Mistral Vibe, Antigravity
+- Claude Code, Antigravity, OpenCode, Mistral Vibe, Crush, Pi Coding Agent
- Any tool that accepts a system prompt or reads a markdown context file
+- Open WebUI, Charmbracelet Mods, or any tool that takes a system prompt string
 - Any other tool that reads `AGENTS.md`, which is the de facto convention
 The canonical source is always `.context/AGENT.md` (root) and `.context/PROJECT.md` (per-project).
 Derived files are committed (see *How context propagates* below) so a `git pull` on any host yields full agent context with no setup.
@@ -249,15 +291,29 @@ Canonical sources of truth:
 - Project: `<repo>/.context/PROJECT.md` (per-repo)
 Derived files (committed, regenerated by `task context:sync`):
- `CLAUDE.md`, `AGENTS.md`, `.cursorrules`, `.aider.conventions.md`,
+- `CLAUDE.md`, `AGENTS.md`, `.context/system-prompt.txt`
-  `.context/system-prompt.txt`
+
 Repos still carrying `.cursorrules`, `.aider.conventions.md` or
 `.aider.conf.yml` are stale: nothing regenerates them. Delete them the next time
 you touch the repo, along with their entries in that repo's `task check`
 assertion.
 Workflow:
 1. Edit a canonical file. Run `task context:sync`. Commit canonical and
   derived together. Push.
-2. On any other host, `git pull` brings both. Claude Code (tree-walking)
+2. On any other host, `git pull` brings both. Which file a harness reads does
-   uses `CLAUDE.md`; Crush / Pi / Antigravity (cwd-only) use `AGENTS.md`;
+   NOT split cleanly by lookup strategy, so do not reason from the strategy:
-   Cursor uses `.cursorrules`; Aider uses `.aider.conventions.md`.
+   - `CLAUDE.md` — Claude Code (walks up the tree)
   - `AGENTS.md` — Crush, Pi, Antigravity (cwd-only), OpenCode (project root,
     global at `~/.config/opencode/AGENTS.md`), and Mistral Vibe, which **walks
     up** from cwd and takes the first `AGENTS.md` it finds
     (user-level `~/.vibe/AGENTS.md`)
   - `.context/system-prompt.txt` — Open WebUI, Mods, raw API calls; not read by
     any harness, it is for pasting
   Vibe tree-walks for `AGENTS.md`, so "tree-walkers use CLAUDE.md" is false.
   Each repo's `AGENTS.md` embeds the canonical and is the first one found from
   inside that repo, so this works — but by construction, not by luck.
 3. `task check` runs `context:sync` then asserts `git status --porcelain`
   is empty over the derived files (catches both modified-tracked drift
   and missing-untracked adapters). A drift fails the check with a
@@ -268,7 +324,20 @@ unconditionally on every host, every harness.
 ## Engineering Skills
-Shared engineering skills live in the **`mathias/skills`** repo (`git.d-ma.be/mathias/skills`). Clone it to `~/dev/skills/` and run `SKILLS_CHECKOUT_DIR="$PWD" bash install.sh` there to wire every skill into your harnesses (Claude Code, Crush, Antigravity, Mistral Vibe) as native, on-demand skills. (Use `install.sh`, not `task install` — the latter is currently broken, skills#7.) Load at task start — not "on demand" but on schedule, before writing code. Browse `~/dev/skills/SKILLS_INDEX.md` for the full list.
+Shared engineering skills live in the **`mathias/skills`** repo (`git.d-ma.be/mathias/skills`). Load at task start — not "on demand" but on schedule, before writing code. Browse `SKILLS_INDEX.md` for the full list.
 **Claude Code** installs the repo as a plugin from the marketplace the same repo hosts. That path also carries the `secret-guard` and `pre-task-ritual` hooks and the brain/gitea/infra MCP servers, which symlinks cannot:
 ```
 /plugin marketplace add https://git.d-ma.be/mathias/skills.git
 /plugin install skills@mathias
 ```
 Skills are **namespaced** under Claude Code: load `tdd` as `skills:tdd`. The trigger table below uses bare names — prefix them.
 **Crush, Pi and OpenCode** have no plugin system and are wired by `install.sh` as one directory symlink per harness via `~/.agents/skills`. Do not clone the checkout into `~/dev`: that folder is iCloud-shared between the Macs and spans two path roots (`/Users/mathias` vs `/home/mathias` on koala), so a checkout there is a git working tree with two concurrent writers, and any absolute symlink stored in it is broken on one side by construction (skills#23). Leave `SKILLS_CHECKOUT_DIR` at its host-local default.
 Check a host with `task doctor` in the skills repo; it also runs automatically at session start via the plugin.
 **Skill trigger table — load before starting, not after getting stuck:**
@@ -338,9 +407,16 @@ assessor-loop ledger) → `06 PR → CI` (go test/vet/lint/govulncheck + **var-g
 This repo is built *through* the workflow it depicts. It is `dispatch-allow`-enabled, and its
 own build increments are governed by a **var-go Oath** embedded in their spec issues (see the
-Stage-03 tracking issue). Bootstrapping honesty (per swedsl honest-stub discipline): the Oath is
+Stage-03 tracking issue). `cmd/vargo-gate` is wired into `.gitea/workflows/cd.yml`'s `oath` job —
-**defined** but `cmd/vargo-gate` is **not yet wired** into this repo's CI — until it is, the Oath
+on every pull_request it fetches the linked issue's oath and gates cad-atlas's **own real
-is advisory here. Wiring it is a first tracked task; disclosed in code, this doc, and CI config.
+candidate** (`oathcandidate/`, #8): it parses the committed `.gitea/workflows/cd.yml` and checks
 the `oath` job actually exists and invokes `cmd/vargo-gate`, then posts the `var-go/oath` commit
 status. This is a real check (TDD'd: passes on the real file, fails closed on a fixture missing
 the job), not swedsl's toy self-test stub — swedsl#35 (import path) and swedsl#38 (real-candidate
 subprocess gating) unblocked it. **Required by branch protection on `main`** (#8, closed
 2026-07-20), confirmed holding on a real PR. Direct pushes remain allowlisted for `mathias` per
 this repo's TBD convention. Disclosed in the CI config comment, this doc, and
 `docs/INCEPTION-OATH.md`.
 ## Brain references (source of truth — `brain_get <path>`)
@@ -1,375 +0,0 @@
 # Cursor rules — auto-generated
 # Do not edit. Run: task context:sync
 # Agent context — Mathias workspace
 <!-- Canonical root context for all AI coding agents.
     Lives at: ~/dev/.context/AGENT.md
     Applies to every project under ~/dev/ unless overridden.
     Run `task context:sync` from ~/dev/ to regenerate harness-specific files.
     Project-level context in .context/PROJECT.md layers on top of this. -->
 ## Who I am
 I'm Mathias, a digital product manager and technology consultant based in Sweden.
 I build software, research emerging tech, and deliver consulting engagements
 for clients under NDA. I work across AI/ML, financial automation, web applications,
 and climate/sustainability tech.
 ## How I work with agents
 - I think like a product manager — I care about *why* before *how*
 - I want agents to be opinionated and push back, not just execute blindly
 - I prefer concise responses; skip ceremony and get to the point
 - When I say "build this", I mean production-quality with tests, not a demo
 - Ask me before making irreversible changes or adding heavy dependencies
 - I work with confidential client data — never send it to cloud APIs unless I explicitly say it's OK
 ## Behavior rules
 These rules apply to every task across every project, regardless of harness.
 0. **Pre-task ritual — before ANY implementation (non-negotiable).** Run this before writing a single line:
   - **Query the brain** (`brain_query`) for the domain + symptom. If the result changes your approach, surface it before acting. 5 seconds beats 5 hours.
   - **Load the relevant skill** — see trigger table in *Engineering Skills* below.
   - **Write the failing test first.** Name the test before the function. If the target is untestable (e.g. `main()` wiring), extract the logic into a testable function first. No implementation without a red test.
   - **State the observable success criterion** — what specific behavior, output, or passing test proves this is done?
   **TDD is non-negotiable.** "Tests pass" is not proof of correctness — only proof the tests ran. Write tests that would catch the bug before writing code that fixes it.
 1. **No assumptions.** Don't hide confusion — surface it. Surface tradeoffs explicitly.
   Think before coding; if the problem is unclear, ask or state assumptions before acting.
 2. **Minimum viable code.** Solve with the smallest change that works. Nothing
   speculative, no "while we're here" cleanups, no premature abstractions. Simplicity first.
 3. **Surgical changes.** Touch only what the task requires. Leave unrelated code,
   files, and formatting alone. Diffs should be small and reviewable.
 4. **Goal-driven execution.** Define clear success criteria up front for every task.
   Loop — implement, verify, refine — until those criteria are met. Don't claim
   completion without evidence (tests pass, command output, observed behavior).
 5. **Trunk-Based Development — commit directly to main.** Every commit is one
   logical change (one tool, one fix, one test) with passing tests. Main is always
   deployable. Never create long-lived feature branches.
   **Exception — parallel agents on same repo:** If another agent is known to be
   actively working on the same repo simultaneously, create a short-lived branch
   (`agent/<description>`), finish the task, and merge to main within the same
   session. Do not leave agent branches open between sessions.
   **Exception — external contributor or client four-eyes requirement:** Use
   PR flow only when a human reviewer outside the project is required. Document
   the reason in PROJECT.md.
 6. **Close the loop — every substantive task ends with the same ritual.** Shipping
   the code is not the end of the task; capturing it is. Run this unprompted:
   - **Tag + bump SemVer** on the change (annotated tag; minor for a feature or
     new/changed ADR, patch for a fix; docs in the same commit). Check the repo's
     actual last tag — stated versions in docs drift stale.
   - **Push** main and the tag (CI is the gate).
   - **Persist generalizable learnings to the brain** (`brain_write`, wing/hall) —
     the reusable patterns and the footguns that would bite anyone again, never
     project status. See *Knowledge base — when to write* below.
   - **File discovered-but-deferred work as tracker issues** on the project's own
     repo — token-budget gaps, recorded ADR limitations, v2 follow-ups. Don't let
     "out of scope, recorded" rot in a commit message; make it a ticket with a
     source pointer.
   - Surface the brain entries and issue numbers in the closing summary so the
     trail is auditable.
 ## Default stack
 | Layer | Default | Fallback | Last resort |
 |-------|---------|----------|-------------|
 | Language | Go | Python | TypeScript, Java, C |
 | UI | HTMX + Templ | Server-rendered HTML | React (only if SPA is justified) |
 | Build | Task (taskfile.dev) | Make | — |
 | Containers | Docker Compose (dev), k3s (prod) | — | — |
 | DB | PostgreSQL + sqlc | SQLite | — |
 | Search | pgvector (vector), BM25 | Qdrant (when >1M vectors or hybrid retrieval) | — |
 | Logging | slog (structured) | — | — |
 | Testing | Table-driven, testify | — | — |
 | Agents (Go) | google.golang.org/adk + pkg/litellm adapter | — | — |
 Exploratory: Rust, Zig — I'll tell you when I want these.
 ## Code conventions
 - **Go style**: golines, gofumpt, golangci-lint
 - **Errors**: `fmt.Errorf("operation: %w", err)` — never naked, never log-and-return
 - **Naming**: stdlib conventions, no stuttering
 - **Architecture**: prefer stdlib over frameworks, constructor injection, env-var config parsed into typed structs
 - **Git**: conventional commits (`feat:`, `fix:`, `chore:`), commit directly to main,
  one logical change per commit, CI is the quality gate
 - **Never**: long-lived feature branches, PRs for solo work, direct push without
  passing `task check` locally first
 - **Security**: no secrets in code, govulncheck before adding deps, SOPS for encrypted config
 - **Dependencies**: prefer stdlib. testify, slog, templ, sqlc, google.golang.org/adk (agent projects only) are pre-approved; anything else needs justification in the commit message
 ## Secret handling (every harness, every command)
 Tool output is persisted: terminal → `~/.claude/projects` transcripts →
 claudewatcher → brain/wiki → gitea history. A secret printed once is
 searchable forever, and clearing it means rotating the key. So:
 1. **Never print, echo, log, or transform a secret to inspect it.** No
   `base64`/`xxd`/`cat` of a key, and never pipe a secret through a transform
   to defeat `op run`'s output masking (it masks raw values; base64 hides them
   from the mask — that exact trick leaked a key on 2026-06-11).
 2. **Secrets stay in the subprocess.** Reference them only as env vars consumed
   *inside* `op run --env-file ~/.op-env -- <cmd>`. Never place a literal secret
   in a command's argv (it lands in the tool call and the transcript).
 3. **Existence check without revealing the value:** `[ -n "$X" ] && echo set` —
   never `${X:-...}` (returns the value when set) and never echo a substring of it.
 4. **Cross-host secrets:** run the secret-consuming command on the host that has
   the secret; do not forward a raw key over ssh argv/stdout.
 5. If a secret does leak into output, say so immediately and flag it for rotation —
   don't bury it.
 ## Infrastructure
 Three machines on Tailscale:
 | Machine | Role | Key specs |
 |---------|------|-----------|
 | koala | GPU inference, heavy compute | RTX 5070, runs k3s + llama-swap + shared postgres18/pgvector |
 | iguana | Services, builds | M2 Ultra Mac |
 | flamingo | Daily driver, edge | Mac mini, ~/dev is here |
 - **Model routing**: LiteLLM in front of llama-swap (local) + cloud APIs (when permitted)
 - **Orchestration**: k3s cluster across all three machines
 - **Networking**: Tailscale mesh
 ## Project landscape
 All development repos live at `~/dev/` (softlink from `~/Documents/local-dev/`).
 Organized in thematic folders:
 | Folder | Focus | Count |
 |--------|-------|-------|
 | `GO/` | Go web frameworks, API integrations, learning projects | ~10 |
 | `AI/` | ML research, AI frameworks (FinRL, DSPy, crawl4ai) | ~6 |
 | `AGENTS/` | Autonomous agents, coding agents, MCP servers, infra | ~15 |
 | `QKX/` | Invoice processing, financial automation, payment systems | ~13 |
 | `XT/` | Climate data, sustainability (Klimatkollen, Garbo) | ~2 |
 See `~/dev/PROJECT_SUMMARY.md` for detailed descriptions of each project.
 ### Key active projects
 - **super-koala** (`AGENTS/`) — multi-component agent stack with LangGraph, DSPy, MCP
 - **azure-tiger** (`QKX/`) — invoice extraction → ISO 20022 payment instructions
 - **gocrwl** (`AGENTS/`) — Go web crawler with containerized deployment
 - **koala-ai-stack** (`AGENTS/`) — local AI server infrastructure management
 - **klimatkollen** (`XT/`) — Swedish municipal climate data platform
 ## Knowledge base — actively use it
 A persistent brain (BM25 search + LLM-synthesised Q&A) survives across sessions,
 hosts, and harnesses. It holds 100+ hard-won entries: infra incident postmortems,
 Go pitfalls, framework gotchas, design principles, ADRs. **It is not optional
 reference material — query it actively, not just when explicitly told.**
 ### When to query (treat as a reflex)
 - **Before** starting a non-trivial task — search for prior art with the symptom
  AND the system component ("how did we solve X in Y?"). 5 seconds beats 5 hours.
 - **When debugging** — search for the error string, the stack frame, the affected
  service. Past you may have already paid this tax.
 - **Before adopting** a pattern, library, framework, or model name — check if it
  was tried and rejected, or what the integration footguns are.
 - **When making architectural decisions** — search for the domain + "ADR" or
  "decision" to find prior reasoning before re-deriving it.
 - **When a recommendation feels novel** — challenge yourself: "has this been
  documented?" The brain often has it.
 ### When to write
 After you discover something that **future-you would forget** and that **isn't
 recoverable from the code, git log, or PR description alone**:
 - Bugs whose root cause is non-obvious and generalisable beyond this project.
 - Framework / library / model-name quirks that bit you and would bite anyone.
 - Design principles validated under fire (e.g. "every `_get` needs a `_list`").
 - Postmortems for incidents: what broke, why, how diagnosed, what to do next time.
 DON'T write project status, sprint progress, PR summaries, or "what I did this
 session" — those rot fast and the originals are in git/gitea anyway. Brain
 entries that age well are about *why*, *how to avoid*, and *what to do when*.
 ### How to access (per harness)
 | Harness | Query | Write |
 |---------|-------|-------|
 | **Claude Code, Claude Desktop** | `brain_query` (BM25), `brain_answer` (LLM-synth + sources) MCP tools | `brain_write` MCP tool |
 | **Crush, Pi, Antigravity, other MCP-capable** | same MCP server: `ingestion-brain` (via the `mcp__*_brain__*` namespace once authenticated) | same |
 | **Anything HTTP-only (curl, scripts)** | `POST https://brain-mcp.d-ma.be/query` with `{"query":"..."}` (auth via `BRAIN_MCP_TOKEN`) | `POST .../write` with `{"content":"...","filename":"..."}` |
 | **Browser / human inspection** | `https://git.d-ma.be/mathias/hyperguild` → `knowledge/` and `wiki/` markdown files |
 - **Scoping**: defaults to `public` collection; client projects filter to `{client}` + `public`.
 - **Routing**: brain_answer's LLM uses berget.ai as primary, iguana ollama as
  fallback. Both are configurable in the `supervisor/ingestion-deployment.yaml`
  on the koala k3s cluster; don't hardcode local-only model names into the
  berget URL (see knowledge entry on namespace mismatches).
 ### Quick reflex checks
 If you find yourself about to say any of these out loud, you owe yourself a brain query first:
 - "I think the issue might be..."
 - "Let me try X and see..."
 - "I'll just write a script to..."
 - "This is probably a new bug..."
 - "Has anyone done this before?" — *yes, probably, go check.*
 ## Client work rules
 When working on a project tagged with a client name:
 1. Never send code, data, or context to cloud APIs — use local models only
 2. Never reference other client projects or their data
 3. Keep all artifacts within the client's git org / directory
 4. Treat everything as confidential unless told otherwise
 ## Harness-agnostic principles
 This context is designed to work with any AI coding tool:
 - Claude Code, Cursor, Aider, Open WebUI, Charmbracelet Mods/Crush
 - Pi Coding Agent, Mistral Vibe, Antigravity
 - Any tool that accepts a system prompt or reads a markdown context file
 The canonical source is always `.context/AGENT.md` (root) and `.context/PROJECT.md` (per-project).
 Derived files are committed (see *How context propagates* below) so a `git pull` on any host yields full agent context with no setup.
 ## How context propagates
 Canonical sources of truth:
 - Universal: `~/dev/.context/AGENT.md` (this file)
 - Project: `<repo>/.context/PROJECT.md` (per-repo)
 Derived files (committed, regenerated by `task context:sync`):
 - `CLAUDE.md`, `AGENTS.md`, `.cursorrules`, `.aider.conventions.md`,
  `.context/system-prompt.txt`
 Workflow:
 1. Edit a canonical file. Run `task context:sync`. Commit canonical and
   derived together. Push.
 2. On any other host, `git pull` brings both. Claude Code (tree-walking)
   uses `CLAUDE.md`; Crush / Pi / Antigravity (cwd-only) use `AGENTS.md`;
   Cursor uses `.cursorrules`; Aider uses `.aider.conventions.md`.
 3. `task check` runs `context:sync` then asserts `git status --porcelain`
   is empty over the derived files (catches both modified-tracked drift
   and missing-untracked adapters). A drift fails the check with a
   message telling you to stage the regenerated files.
 Behavior rules in this file and per-project rules in `PROJECT.md` apply
 unconditionally on every host, every harness.
 ## Engineering Skills
 Shared engineering skills live in the **`mathias/skills`** repo (`git.d-ma.be/mathias/skills`). Clone it to `~/dev/skills/` and run `SKILLS_CHECKOUT_DIR="$PWD" bash install.sh` there to wire every skill into your harnesses (Claude Code, Crush, Antigravity, Mistral Vibe) as native, on-demand skills. (Use `install.sh`, not `task install` — the latter is currently broken, skills#7.) Load at task start — not "on demand" but on schedule, before writing code. Browse `~/dev/skills/SKILLS_INDEX.md` for the full list.
 **Skill trigger table — load before starting, not after getting stuck:**
 | Task type | Load |
 |-----------|------|
 | Any feature or bug fix | `tdd` |
 | Refactor or design | `clean-code` or `solid` |
 | Debug | `problem-analysis` |
 | Review code or PRs | `code-review` |
 | Frame a problem before coding | `problem-analysis` |
 ---
 # cad-atlas
 ## Identity
 - **Name**: cad-atlas
 - **Owner**: Mathias
 - **Client**: personal
 - **Repo**: git.d-ma.be/mathias/cad-atlas
 - **Status**: active
 - **Stack**: Go + Templ + HTMX + CDN Tailwind (template-go-web). Cross-project conventions: `~/dev/.context/AGENT.md`.
 ## What this is
 A visual **atlas of the Continuous Agentic Development (CAD) workflow** — the full path
 from a captured signal to a deployed k3s pod, one screen, reel-style ("From Signal to Pod").
 It exists to (a) make the homelab's agentic delivery pipeline legible to a human, and
 (b) render the CAD **audit chain** — which doubles as the regulated-industry audit artifact.
 > **Core thesis:** the CAD audit chain *is* the visualization data.
 > `TELOS → goal → spec → issue → execution → attestation → deploy` is both the trace and
 > the audit package. Phase C renders it once and serves two masters (observability + compliance).
 ## Phases
 - **Phase A — static hero viz** (current). Self-contained `internal/web/static/cad-atlas.html`,
  data-driven from a hand-authored `STAGES` array (ground-truth snapshot from brain, 2026-07-19).
  Served at `/` by `internal/web/handler.go` via `go:embed`. Reel-parity: SVG spine with
  arrowheads, animated pulse, dashed **feedback bus** (stage 08 → TELOS), replay + slow-mo.
 - **Phase B — generated-from-source**. Parse brain docs + `.gitea/workflows` + infra manifests
  → render the graph so it can't drift from config.
 - **Phase C — live trace viewer**. Replace the static `STAGES` array with live reads of the
  `assessor-loop` attestation ledger + brain `session_log` + Gitea run API + Flux events.
  This is the prize: a real signal→pod trace viewer that is also the audit package.
 ## The workflow it visualizes (9 stages)
 `00 Signals` (Applied AI Radar → mathias/signals) → `01 TELOS` (intention substrate) →
 `02 Strategic session` (claude.ai frontier + LLM Council + Autoresearch Council) →
 `03 Spec → Gitea issue` (agent-ready contract; Ed25519 admission #36; **var-go Oath**) →
 `04 Human dispatch gate` (the only checkpoint; session-dispatch bridge → cad-dispatch.yml) →
 `05 Execute · agentsquad` (serve/taskqueue, exec+review loop, risk LOW/MED/HIGH, dma-cli routing,
 assessor-loop ledger) → `06 PR → CI` (go test/vet/lint/govulncheck + **var-go/oath gate**) →
 `07 CD → pod` (Flux GitOps → k3s on koala) → `08 Loop back` (outcome scored vs TELOS goal).
 ### Three orthogonal governance gates
 | Gate | Guards | Where |
 |---|---|---|
 | Ed25519 admission controller (#36) | spec **integrity** (issue untampered) | stage 03 |
 | dispatch-allow (`.dispatch-allow` + `mathias/dispatch` allowlist) | repo **eligibility** (may agents run here) | stage 04/05 |
 | **var-go Oath** (`cmd/vargo-gate`, commit status `var-go/oath`) | output **correctness** (PR satisfies the Oath; floor over reviewer, anti-rubber-stamp #55) | stage 06 |
 ## Dogfooding
 This repo is built *through* the workflow it depicts. It is `dispatch-allow`-enabled, and its
 own build increments are governed by a **var-go Oath** embedded in their spec issues (see the
 Stage-03 tracking issue). Bootstrapping honesty (per swedsl honest-stub discipline): the Oath is
 **defined** but `cmd/vargo-gate` is **not yet wired** into this repo's CI — until it is, the Oath
 is advisory here. Wiring it is a first tracked task; disclosed in code, this doc, and CI config.
 ## Brain references (source of truth — `brain_get <path>`)
 - `wiki/homelab/decisions/cad-atlas-audit-chain-is-viz-data.md` — **this project's genesis note**: the audit-chain-is-viz-data thesis, the three gates, template-go-web footguns
 - `wiki/homelab/decisions/inception-sprint-and-oath.md` — the Inception Sprint + Oath methodology (this repo's birth is the worked example); see [`docs/INCEPTION-OATH.md`](docs/INCEPTION-OATH.md) for the kept Oath
 - `knowledge/workflow-idea-to-running-service.md` — Double Diamond idea→service workflow
 - `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16.md` — CAD definition
 - `wiki/agentsquad/decisions/cad-dispatch-bridge.md` — claude.ai → agentsquad trigger path
 - `wiki/agentsquad/facts/llm-council-design-and-first-runs-2026-06-21.md` — LLM Council
 - `wiki/agentsquad/decisions/autoresearch-council-sibling-pipe.md` — Autoresearch Council
 - `wiki/agentsquad/decisions/serve-http-task-api.md` — agentsquad serve/taskqueue
 - `knowledge/var-go-anchor-to-span-spike-verdict.md` — var-go runner + CAD gate seam
 - `knowledge/swedsl-vargo-sprint1-enforcement-teeth-verdict.md` — vargo-gate enforcement teeth
 - `wiki/assessor-loop/decisions/assessor-loop-genesis.md` — attestation ledger (Phase C source)
 - `wiki/homelab/facts/homelab-network-topology-reference.md` — koala/iguana/flamingo/piguard
 ## External references
 - Inspiration reel — "From Inbox to Shipped" pipeline viz: https://www.instagram.com/reel/DY92L7bu27j/
 - karpathy/llm-council — origin of the Council pattern
 - Double Diamond design process (Discover/Define/Develop/Deliver)
 ## Run
 ```bash
 task check      # lint + vet + test (CI gate)
 task run        # build + serve at http://localhost:8080  → the atlas
 ```
 ## Deploy note
 CD (`.gitea/workflows/cd.yml`) deploys to k3s namespace `cad-atlas` via Flux. Per the known
 template-go-agent CD gap: the `deploy` job stays RED until `mathias/infra` has
 `k3s/apps/cad-atlas/deployment.yaml`. `check` + `build` are the real bootstrap gate.
@@ -0,0 +1,52 @@
 # Canonical golangci-lint configuration for the estate's Go repos (infra#309
 # pattern: one canonical file here, a byte-identical copy in each adopter,
 # and the drift gate in THIS repo comparing sha256).
 #
 # Why this exists: 26 Go repos, 3 had a lint config, and all three were
 # different. The 23 without one ran golangci-lint's v2 default set, which
 # does NOT include a formatter -- so gofmt/gofumpt drift went uncaught until
 # it was found by hand (dma-cli#12: two files drifted, nothing flagged them).
 #
 # The two configs this replaces (cobalt-dingo, coo-agent) were near-identical
 # copies of each other AND both invalid under v2: they carried v1-style
 # `linters-settings` and `issues.exclude-rules` keys, which `golangci-lint
 # config verify` rejects outright. Their revive settings and test exclusions
 # were therefore not in effect. Consolidating fixes that too.
 #
 # Per-repo variation does NOT belong here -- this file must stay byte-identical
 # across adopters so the gate is a checksum, not a diff a human has to judge.
 # A repo with a genuine exception (agentsquad excludes its seeded-bug fixture
 # tree, which exists precisely to contain broken code) keeps its own config and
 # is not listed as an adopter.
 version: "2"
 linters:
  default: none
  enable:
    - errcheck # unchecked errors
    - govet # suspicious constructs
    - staticcheck # broad static analysis
    - unused # unused code
    - misspell # spelling
    - revive # idiomatic Go
    - exhaustive # exhaustive switch on enums
  settings:
    revive:
      rules:
        - name: var-naming
          severity: warning
  exclusions:
    rules:
      # Test files: table-driven cases legitimately carry unused struct fields
      # and long functions.
      - path: _test\.go
        linters:
          - revive
          - unused
 formatters:
  enable:
    - gofumpt
@@ -48,14 +48,30 @@ These rules apply to every task across every project, regardless of harness.
   logical change (one tool, one fix, one test) with passing tests. Main is always
   deployable. Never create long-lived feature branches.
-   **Exception — parallel agents on same repo:** If another agent is known to be
+   **The PR trigger is RISK, not concurrency.** `risk/low` work commits straight to
-   actively working on the same repo simultaneously, create a short-lived branch
+   main with CI as the gate — that is most work and is unchanged. `risk/medium` and
-   (`agent/<description>`), finish the task, and merge to main within the same
+   above opens a PR, even solo, even with nobody waiting to review it. This mirrors
-   session. Do not leave agent branches open between sessions.
+   the tiered merge model in `assessor-loop`
   `method/transfer-to-a-regulated-organisation.md` §4.1, so the estate practises
   what it sells instead of merging everything on green and claiming otherwise.
-   **Exception — external contributor or client four-eyes requirement:** Use
+   **Concurrency is NOT a reason to branch.** Measured 2026-08-29 across three real
-   PR flow only when a human reviewer outside the project is required. Document
+   collisions between parallel sessions: two were not branching problems at all — a
-   the reason in PROJECT.md.
+   generated artifact written to the same path by both (branching turns that into a
   merge conflict on a 33k-line JSON), and uncommitted work in a shared checkout
   (a per-session worktree fixes it) — and the third was an ordinary non-fast-forward
   push resolved by rebase in seconds. Use a worktree per session on shared repos and
   timestamp generated artifacts. Do not reach for a branch.
   Branch+PR flow carries documented costs on solo repos: merging auto-closes gated
   issues, review comments live on a thread separate from the issue's, and a
   merged-and-deleted branch cannot be amended (brain:
   `gitea-pr-merge-autoclose-and-review-comment-footguns`). Those are the price of
   the `risk/medium`+ lane — paid deliberately, not incurred by accident.
   **Exception — external contributor or client four-eyes requirement:** Use PR flow
   when a human reviewer outside the project is required. Document the reason in
   PROJECT.md.
 6. **Close the loop — every substantive task ends with the same ritual.** Shipping
   the code is not the end of the task; capturing it is. Run this unprompted:
@@ -73,6 +89,26 @@ These rules apply to every task across every project, regardless of harness.
   - Surface the brain entries and issue numbers in the closing summary so the
     trail is auditable.
   **Chat is not a durable store. Never rely on Mathias remembering anything.**
   Every gap, caveat, risk, open question and next step must land in one of four
   places before the turn ends: **the brain**, **a repo** (code, docs, ADR),
   **a tracker issue**, or **a plan file**. A finding stated only in conversation is
   lost the moment the session closes — and this estate has repeatedly proved that a
   remembered convention is an unreliable control.
   This applies hardest to what is tempting to leave as a closing remark: "worth
   knowing X isn't enforced yet", "this is a convention, not a gate", "we should
   revisit Y". Those are exactly the items that need a locator. If it is worth
   saying in a summary, it is worth writing where it can be found again without you.
 ## CAD sprint patterns
 Two CAD sprint archetypes (defs: brain `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16`):
 - **Inception Sprint** — birth a new repo. Oath-gated close; tag only once every clause holds. Brain: `.../inception-sprint-and-oath`.
 - **Sweep Sprint** — clear an existing backlog. Parallel read-only research per issue → sequential one-issue-per-commit execution. Brain: `.../sweep-sprint-and-oath`.
 Shared: decisions that are yours, not the agent's, surface as `DECISION NEEDED` (question/options/recommendation/blocks) — ask live if you're present, else comment and wait, never act past it. Live-breaking regressions get `git revert`, never forward-fixed; host-network work skips even read-only research (solo, synchronous, you present). Rule 6's closing ritual only fires once every Oath clause genuinely holds — blocked = descoped-and-tracked, never marked done.
 ## Default stack
 | Layer | Default | Fallback | Last resort |
@@ -83,7 +119,7 @@ These rules apply to every task across every project, regardless of harness.
 | Containers | Docker Compose (dev), k3s (prod) | — | — |
 | DB | PostgreSQL + sqlc | SQLite | — |
 | Search | pgvector (vector), BM25 | Qdrant (when >1M vectors or hybrid retrieval) | — |
-| Logging | slog (structured) | — | — |
+| Logging | slog (structured) | stdlib `logging` w/ structured `extra=` (or structlog) | — |
 | Testing | Table-driven, testify | — | — |
 | Agents (Go) | google.golang.org/adk + pkg/litellm adapter | — | — |
@@ -92,7 +128,12 @@ Exploratory: Rust, Zig — I'll tell you when I want these.
 ## Code conventions
 - **Go style**: golines, gofumpt, golangci-lint
- **Errors**: `fmt.Errorf("operation: %w", err)` — never naked, never log-and-return
+- **Python style** (fallback language): ruff (format+lint, one tool), mypy --strict (non-negotiable,
  matches Go's static typing discipline), pytest + pytest-cov (table-driven via
  `@pytest.mark.parametrize`), uv (venv+deps+lock, one tool), pydantic-settings (typed env-var config
  — same principle as Go's typed structs), src-layout + `pyproject.toml` only (no `setup.py`)
 - **Errors**: `fmt.Errorf("operation: %w", err)` — never naked, never log-and-return.
  Python: `raise X from e` (exception chaining, same principle) — never bare `except`, never silent `pass`
 - **Naming**: stdlib conventions, no stuttering
 - **Architecture**: prefer stdlib over frameworks, constructor injection, env-var config parsed into typed structs
 - **Git**: conventional commits (`feat:`, `fix:`, `chore:`), commit directly to main,
@@ -130,10 +171,10 @@ Three machines on Tailscale:
 |---------|------|-----------|
 | koala | GPU inference, heavy compute | RTX 5070, runs k3s + llama-swap + shared postgres18/pgvector |
 | iguana | Services, builds | M2 Ultra Mac |
-| flamingo | Daily driver, edge | Mac mini, ~/dev is here |
+| flamingo | Daily driver, edge | Apple Silicon Mac, ~/dev is here |
 - **Model routing**: LiteLLM in front of llama-swap (local) + cloud APIs (when permitted)
- **Orchestration**: k3s cluster across all three machines
+- **Orchestration**: k3s on koala only — single control-plane node, no workers (verified 2026-08-30). iguana and flamingo are on the tailnet but are not cluster members
 - **Networking**: Tailscale mesh
 ## Project landscape
@@ -229,10 +270,11 @@ When working on a project tagged with a client name:
 ## Harness-agnostic principles
-This context is designed to work with any AI coding tool:
+Supported harnesses (2026-09-01) — Cursor and Aider were dropped; do not
- Claude Code, Cursor, Aider, Open WebUI, Charmbracelet Mods/Crush
+re-add adapters for them:
- Pi Coding Agent, Mistral Vibe, Antigravity
+- Claude Code, Antigravity, OpenCode, Mistral Vibe, Crush, Pi Coding Agent
- Any tool that accepts a system prompt or reads a markdown context file
+- Open WebUI, Charmbracelet Mods, or any tool that takes a system prompt string
 - Any other tool that reads `AGENTS.md`, which is the de facto convention
 The canonical source is always `.context/AGENT.md` (root) and `.context/PROJECT.md` (per-project).
 Derived files are committed (see *How context propagates* below) so a `git pull` on any host yields full agent context with no setup.
@@ -244,15 +286,29 @@ Canonical sources of truth:
 - Project: `<repo>/.context/PROJECT.md` (per-repo)
 Derived files (committed, regenerated by `task context:sync`):
- `CLAUDE.md`, `AGENTS.md`, `.cursorrules`, `.aider.conventions.md`,
+- `CLAUDE.md`, `AGENTS.md`, `.context/system-prompt.txt`
-  `.context/system-prompt.txt`
+
 Repos still carrying `.cursorrules`, `.aider.conventions.md` or
 `.aider.conf.yml` are stale: nothing regenerates them. Delete them the next time
 you touch the repo, along with their entries in that repo's `task check`
 assertion.
 Workflow:
 1. Edit a canonical file. Run `task context:sync`. Commit canonical and
   derived together. Push.
-2. On any other host, `git pull` brings both. Claude Code (tree-walking)
+2. On any other host, `git pull` brings both. Which file a harness reads does
-   uses `CLAUDE.md`; Crush / Pi / Antigravity (cwd-only) use `AGENTS.md`;
+   NOT split cleanly by lookup strategy, so do not reason from the strategy:
-   Cursor uses `.cursorrules`; Aider uses `.aider.conventions.md`.
+   - `CLAUDE.md` — Claude Code (walks up the tree)
   - `AGENTS.md` — Crush, Pi, Antigravity (cwd-only), OpenCode (project root,
     global at `~/.config/opencode/AGENTS.md`), and Mistral Vibe, which **walks
     up** from cwd and takes the first `AGENTS.md` it finds
     (user-level `~/.vibe/AGENTS.md`)
   - `.context/system-prompt.txt` — Open WebUI, Mods, raw API calls; not read by
     any harness, it is for pasting
   Vibe tree-walks for `AGENTS.md`, so "tree-walkers use CLAUDE.md" is false.
   Each repo's `AGENTS.md` embeds the canonical and is the first one found from
   inside that repo, so this works — but by construction, not by luck.
 3. `task check` runs `context:sync` then asserts `git status --porcelain`
   is empty over the derived files (catches both modified-tracked drift
   and missing-untracked adapters). A drift fails the check with a
@@ -263,7 +319,20 @@ unconditionally on every host, every harness.
 ## Engineering Skills
-Shared engineering skills live in the **`mathias/skills`** repo (`git.d-ma.be/mathias/skills`). Clone it to `~/dev/skills/` and run `SKILLS_CHECKOUT_DIR="$PWD" bash install.sh` there to wire every skill into your harnesses (Claude Code, Crush, Antigravity, Mistral Vibe) as native, on-demand skills. (Use `install.sh`, not `task install` — the latter is currently broken, skills#7.) Load at task start — not "on demand" but on schedule, before writing code. Browse `~/dev/skills/SKILLS_INDEX.md` for the full list.
+Shared engineering skills live in the **`mathias/skills`** repo (`git.d-ma.be/mathias/skills`). Load at task start — not "on demand" but on schedule, before writing code. Browse `SKILLS_INDEX.md` for the full list.
 **Claude Code** installs the repo as a plugin from the marketplace the same repo hosts. That path also carries the `secret-guard` and `pre-task-ritual` hooks and the brain/gitea/infra MCP servers, which symlinks cannot:
 ```
 /plugin marketplace add https://git.d-ma.be/mathias/skills.git
 /plugin install skills@mathias
 ```
 Skills are **namespaced** under Claude Code: load `tdd` as `skills:tdd`. The trigger table below uses bare names — prefix them.
 **Crush, Pi and OpenCode** have no plugin system and are wired by `install.sh` as one directory symlink per harness via `~/.agents/skills`. Do not clone the checkout into `~/dev`: that folder is iCloud-shared between the Macs and spans two path roots (`/Users/mathias` vs `/home/mathias` on koala), so a checkout there is a git working tree with two concurrent writers, and any absolute symlink stored in it is broken on one side by construction (skills#23). Leave `SKILLS_CHECKOUT_DIR` at its host-local default.
 Check a host with `task doctor` in the skills repo; it also runs automatically at session start via the plugin.
 **Skill trigger table — load before starting, not after getting stuck:**
@@ -333,9 +402,16 @@ assessor-loop ledger) → `06 PR → CI` (go test/vet/lint/govulncheck + **var-g
 This repo is built *through* the workflow it depicts. It is `dispatch-allow`-enabled, and its
 own build increments are governed by a **var-go Oath** embedded in their spec issues (see the
-Stage-03 tracking issue). Bootstrapping honesty (per swedsl honest-stub discipline): the Oath is
+Stage-03 tracking issue). `cmd/vargo-gate` is wired into `.gitea/workflows/cd.yml`'s `oath` job —
-**defined** but `cmd/vargo-gate` is **not yet wired** into this repo's CI — until it is, the Oath
+on every pull_request it fetches the linked issue's oath and gates cad-atlas's **own real
-is advisory here. Wiring it is a first tracked task; disclosed in code, this doc, and CI config.
+candidate** (`oathcandidate/`, #8): it parses the committed `.gitea/workflows/cd.yml` and checks
 the `oath` job actually exists and invokes `cmd/vargo-gate`, then posts the `var-go/oath` commit
 status. This is a real check (TDD'd: passes on the real file, fails closed on a fixture missing
 the job), not swedsl's toy self-test stub — swedsl#35 (import path) and swedsl#38 (real-candidate
 subprocess gating) unblocked it. **Required by branch protection on `main`** (#8, closed
 2026-07-20), confirmed holding on a real PR. Direct pushes remain allowlisted for `mathias` per
 this repo's TBD convention. Disclosed in the CI config comment, this doc, and
 `docs/INCEPTION-OATH.md`.
 ## Brain references (source of truth — `brain_get <path>`)
@@ -54,9 +54,16 @@ assessor-loop ledger) → `06 PR → CI` (go test/vet/lint/govulncheck + **var-g
 This repo is built *through* the workflow it depicts. It is `dispatch-allow`-enabled, and its
 own build increments are governed by a **var-go Oath** embedded in their spec issues (see the
-Stage-03 tracking issue). Bootstrapping honesty (per swedsl honest-stub discipline): the Oath is
+Stage-03 tracking issue). `cmd/vargo-gate` is wired into `.gitea/workflows/cd.yml`'s `oath` job —
-**defined** but `cmd/vargo-gate` is **not yet wired** into this repo's CI — until it is, the Oath
+on every pull_request it fetches the linked issue's oath and gates cad-atlas's **own real
-is advisory here. Wiring it is a first tracked task; disclosed in code, this doc, and CI config.
+candidate** (`oathcandidate/`, #8): it parses the committed `.gitea/workflows/cd.yml` and checks
 the `oath` job actually exists and invokes `cmd/vargo-gate`, then posts the `var-go/oath` commit
 status. This is a real check (TDD'd: passes on the real file, fails closed on a fixture missing
 the job), not swedsl's toy self-test stub — swedsl#35 (import path) and swedsl#38 (real-candidate
 subprocess gating) unblocked it. **Required by branch protection on `main`** (#8, closed
 2026-07-20), confirmed holding on a real PR. Direct pushes remain allowlisted for `mathias` per
 this repo's TBD convention. Disclosed in the CI config comment, this doc, and
 `docs/INCEPTION-OATH.md`.
 ## Brain references (source of truth — `brain_get <path>`)
@@ -33,5 +33,3 @@ tasks:
    cmds: [bash scripts/context-sync.sh claude]
  context:sync:agents:
    cmds: [bash scripts/context-sync.sh agents]
  context:sync:cursor:
    cmds: [bash scripts/context-sync.sh cursor]
@@ -34,7 +34,7 @@
      {"t":"Human triggers execution","plain_t":"The go button","plain":"A person confirms the plan and its risk level, then releases the work — nothing runs until they do.","cls":"gateway","pill":"var(--amber)","d":"Ratify proposed-plan + risk tier, then dispatch.","gate":true},
      {"t":"Session-Dispatch bridge","plain_t":"Hand-off to agents","plain":"The approval flips a switch that hands the signed work order over to the agents to start execution.","cls":"bridge","pill":"var(--blue)","d":"claude.ai MCP → gitea:workflow_run_trigger → cad-dispatch.yml → agentsquad. The final design→execution bridge.","tags":["workflow_dispatch"]}
    ]},
-    {"no":"STAGE 05","short":"Build","cls":"exec","title":"Execute · agentsquad + dispatch","plain_title":"Agents do the work","plain":"AI agents actually build the thing — one writes, a second independent one reviews it to avoid marking its own homework — and every step is logged for the audit trail. Two execution paths run today: agentsquad for orchestrated multi-agent jobs, and dispatch for headless single-issue work.","path":"koala · agentsquad-serve + dispatch CronJob","generate":"stuck-badges",
+    {"no":"STAGE 05","short":"Build","cls":"exec","title":"Execute · agentsquad + dispatch","plain_title":"Agents do the work","plain":"AI agents actually build the thing — one writes, a second independent one reviews it to avoid marking its own homework — and every step is logged for the audit trail. Two execution paths run today: agentsquad for orchestrated multi-agent jobs, and dispatch for headless single-issue work.","path":"koala · agentsquad-serve + dispatch CronJob","generate":["stuck-badges","gitea-repos"],
     "trans_label":"Change proposed","trans":"Advances when the agents finish and open a proposed change (a PR) with its audit log attached. Until there's a concrete change to test, nothing moves.","nodes":[
      {"t":"Task API","plain_t":"Start a job","plain":"A request kicks off a job and hands back an id you can poll for progress.","pill":"var(--coral)","d":"POST /tasks → job id · GET /tasks/{id}. taskqueue + serve (v0.12+).","tags":["single agentsquad.yaml"]},
      {"t":"Executor + reviewer loop","plain_t":"Build + independent review","plain":"One agent does the work; a second, independent agent on a different model reviews it — so nothing marks its own homework.","cls":"win","pill":"var(--coral)","d":"ADK Go + LiteLLM. Frontier models (local qwen spirals). Reviewer on distinct tier — echo-chamber prevention.","risk":true},
@@ -53,7 +53,7 @@ func TestDefault_HasPlainLayerAndTransitions(t *testing.T) {
 		if s.TransLabel == "" {
 			t.Fatalf("stage %s missing trans_label", s.No)
 		}
-		if s.Generate == "ci-jobs" {
+		if s.Generate.Has("ci-jobs") {
 			continue // nodes are generated live, no authored plain
 		}
 		for _, n := range s.Nodes {
@@ -0,0 +1,63 @@
 package atlas
 import (
 	"bytes"
 	"encoding/json"
 	"fmt"
 )
 // GenerateKeys names the live sources a stage draws nodes from. A stage grew
 // past one source once stuck-badges landed alongside the existing overlays, so
 // this accepts either spelling in atlas.json:
 //
 //	"generate": "ci-jobs"
 //	"generate": ["stuck-badges", "gitea-repos"]
 //
 // The bare string is kept rather than migrated: most stages have exactly one
 // source, and a one-element list reads worse for no benefit.
 type GenerateKeys []string
 // Has reports whether the stage draws from the named source. The empty key
 // never matches, so a stage with no `generate` is inert.
 func (g GenerateKeys) Has(key string) bool {
 	if key == "" {
 		return false
 	}
 	for _, k := range g {
 		if k == key {
 			return true
 		}
 	}
 	return false
 }
 func (g *GenerateKeys) UnmarshalJSON(b []byte) error {
 	b = bytes.TrimSpace(b)
 	if len(b) == 0 || string(b) == "null" {
 		*g = nil
 		return nil
 	}
 	if b[0] == '"' {
 		var one string
 		if err := json.Unmarshal(b, &one); err != nil {
 			return fmt.Errorf("parse generate: %w", err)
 		}
 		*g = GenerateKeys{one}
 		return nil
 	}
 	var many []string
 	if err := json.Unmarshal(b, &many); err != nil {
 		return fmt.Errorf("parse generate: %w", err)
 	}
 	*g = many
 	return nil
 }
 // MarshalJSON writes a lone key back as a bare string, so a round-trip through
 // the API does not rewrite every authored stage into list form.
 func (g GenerateKeys) MarshalJSON() ([]byte, error) {
 	if len(g) == 1 {
 		return json.Marshal(g[0])
 	}
 	return json.Marshal([]string(g))
 }
@@ -0,0 +1,66 @@
 package atlas_test
 import (
 	"encoding/json"
 	"testing"
 	"git.d-ma.be/mathias/cad-atlas/internal/atlas"
 )
 // Every stage authored before this type existed spells `generate` as a bare
 // string. That spelling stays valid — this is additive, not a migration.
 func TestGenerateKeys_UnmarshalsBareString(t *testing.T) {
 	var s atlas.Stage
 	if err := json.Unmarshal([]byte(`{"no":"06","generate":"ci-jobs"}`), &s); err != nil {
 		t.Fatalf("unmarshal: %v", err)
 	}
 	if !s.Generate.Has("ci-jobs") {
 		t.Fatalf("Has(ci-jobs) false for %+v", s.Generate)
 	}
 	if s.Generate.Has("gitea-repos") {
 		t.Fatal("Has matched a key that is not present")
 	}
 }
 func TestGenerateKeys_UnmarshalsList(t *testing.T) {
 	var s atlas.Stage
 	if err := json.Unmarshal([]byte(`{"no":"05","generate":["stuck-badges","gitea-repos"]}`), &s); err != nil {
 		t.Fatalf("unmarshal: %v", err)
 	}
 	if !s.Generate.Has("stuck-badges") || !s.Generate.Has("gitea-repos") {
 		t.Fatalf("both keys should match, got %+v", s.Generate)
 	}
 }
 func TestGenerateKeys_AbsentMatchesNothing(t *testing.T) {
 	var s atlas.Stage
 	if err := json.Unmarshal([]byte(`{"no":"00"}`), &s); err != nil {
 		t.Fatalf("unmarshal: %v", err)
 	}
 	if s.Generate.Has("") || s.Generate.Has("ci-jobs") {
 		t.Fatalf("absent generate matched something: %+v", s.Generate)
 	}
 }
 // The frontend reads this JSON, so the round-trip must stay stable.
 func TestGenerateKeys_RoundTrips(t *testing.T) {
 	for _, raw := range []string{`{"generate":"ci-jobs"}`, `{"generate":["a","b"]}`} {
 		var s atlas.Stage
 		if err := json.Unmarshal([]byte(raw), &s); err != nil {
 			t.Fatalf("unmarshal %s: %v", raw, err)
 		}
 		out, err := json.Marshal(s)
 		if err != nil {
 			t.Fatalf("marshal: %v", err)
 		}
 		var back atlas.Stage
 		if err := json.Unmarshal(out, &back); err != nil {
 			t.Fatalf("re-unmarshal %s: %v", out, err)
 		}
 		for _, k := range []string{"ci-jobs", "a", "b"} {
 			if s.Generate.Has(k) != back.Generate.Has(k) {
 				t.Fatalf("round-trip lost %q: %s -> %s", k, raw, out)
 			}
 		}
 	}
 }
@@ -32,16 +32,16 @@ type Node struct {
 // moves work forward and what must be true to advance. When Generate is set,
 // Nodes are derived from a live source at Build time.
 type Stage struct {
-	No         string `json:"no"`
+	No         string       `json:"no"`
-	Short      string `json:"short,omitempty"`
+	Short      string       `json:"short,omitempty"`
-	Title      string `json:"title"`
+	Title      string       `json:"title"`
-	PlainTitle string `json:"plain_title,omitempty"`
+	PlainTitle string       `json:"plain_title,omitempty"`
-	Plain      string `json:"plain,omitempty"`
+	Plain      string       `json:"plain,omitempty"`
-	Path       string `json:"path,omitempty"`
+	Path       string       `json:"path,omitempty"`
-	Cls        string `json:"cls,omitempty"`
+	Cls        string       `json:"cls,omitempty"`
-	Generate   string `json:"generate,omitempty"`
+	Generate   GenerateKeys `json:"generate,omitempty"`
-	TransLabel string `json:"trans_label,omitempty"`
+	TransLabel string       `json:"trans_label,omitempty"`
-	Trans      string `json:"trans,omitempty"`
+	Trans      string       `json:"trans,omitempty"`
 	// StuckCount/AwaitingCount are set by ApplyStuckOverlay (cad-atlas#11) on
 	// stages marked `"generate":"stuck-badges"` — the two visual classes the
 	// issue asks for kept as separate counts so a functioning control
@@ -71,7 +71,7 @@ func Build(atlasJSON, workflow []byte) (Atlas, error) {
 		return Atlas{}, fmt.Errorf("parse atlas data: %w", err)
 	}
 	for i := range a.Stages {
-		if a.Stages[i].Generate != "ci-jobs" {
+		if !a.Stages[i].Generate.Has("ci-jobs") {
 			continue
 		}
 		jobs, err := JobsFromWorkflow(workflow)
@@ -0,0 +1,17 @@
 package atlas
 // PrependGenerated puts live nodes ahead of the authored ones on every stage
 // carrying the given `generate` key. Authored nodes are kept, never replaced:
 // they are the graceful-degradation path, and a live source that is
 // unavailable (no token, no network) must leave the atlas rendering exactly as
 // authored. Passing no nodes is therefore a no-op, not an erasure.
 func PrependGenerated(a *Atlas, generate string, nodes []Node) {
 	if a == nil || len(nodes) == 0 {
 		return
 	}
 	for i := range a.Stages {
 		if a.Stages[i].Generate.Has(generate) {
 			a.Stages[i].Nodes = append(append([]Node{}, nodes...), a.Stages[i].Nodes...)
 		}
 	}
 }
@@ -0,0 +1,66 @@
 package atlas_test
 import (
 	"testing"
 	"git.d-ma.be/mathias/cad-atlas/internal/atlas"
 )
 func stagedAtlas() *atlas.Atlas {
 	return &atlas.Atlas{Stages: []atlas.Stage{
 		{No: "STAGE 03", Generate: atlas.GenerateKeys{"gitea-issues"}, Nodes: []atlas.Node{{Title: "authored issue node"}}},
 		{No: "STAGE 05", Generate: atlas.GenerateKeys{"gitea-repos"}, Nodes: []atlas.Node{{Title: "authored repo node"}}},
 		{No: "STAGE 08", Nodes: []atlas.Node{{Title: "untouched"}}},
 	}}
 }
 func TestPrependGenerated_LiveNodesComeFirstAndAuthoredSurvive(t *testing.T) {
 	a := stagedAtlas()
 	atlas.PrependGenerated(a, "gitea-repos", []atlas.Node{{Title: "live repo"}})
 	got := a.Stages[1].Nodes
 	if len(got) != 2 {
 		t.Fatalf("want 2 nodes, got %d: %+v", len(got), got)
 	}
 	if got[0].Title != "live repo" || got[1].Title != "authored repo node" {
 		t.Fatalf("order wrong: %+v", got)
 	}
 }
 func TestPrependGenerated_OnlyTouchesMatchingStage(t *testing.T) {
 	a := stagedAtlas()
 	atlas.PrependGenerated(a, "gitea-repos", []atlas.Node{{Title: "live repo"}})
 	if len(a.Stages[0].Nodes) != 1 || a.Stages[0].Nodes[0].Title != "authored issue node" {
 		t.Fatalf("stage 03 disturbed: %+v", a.Stages[0].Nodes)
 	}
 	if len(a.Stages[2].Nodes) != 1 || a.Stages[2].Nodes[0].Title != "untouched" {
 		t.Fatalf("stage 08 disturbed: %+v", a.Stages[2].Nodes)
 	}
 }
 // The graceful-skip contract: with GITEA_TOKEN unset the overlay yields no
 // nodes, and the atlas must still render its authored placeholders unchanged.
 func TestPrependGenerated_NoLiveNodesLeavesAuthoredIntact(t *testing.T) {
 	a := stagedAtlas()
 	atlas.PrependGenerated(a, "gitea-repos", nil)
 	if len(a.Stages[1].Nodes) != 1 || a.Stages[1].Nodes[0].Title != "authored repo node" {
 		t.Fatalf("authored nodes lost on empty overlay: %+v", a.Stages[1].Nodes)
 	}
 }
 func TestPrependGenerated_UnknownKeyIsANoop(t *testing.T) {
 	a := stagedAtlas()
 	atlas.PrependGenerated(a, "no-such-key", []atlas.Node{{Title: "live"}})
 	for i, s := range a.Stages {
 		if len(s.Nodes) != 1 {
 			t.Fatalf("stage %d changed: %+v", i, s.Nodes)
 		}
 	}
 }
@@ -0,0 +1,40 @@
 package atlas
 import (
 	"encoding/json"
 	"fmt"
 )
 // RepoNodes parses a Gitea `/user/repos` response (the token owner's own
 // repositories) into one node per repo, linking out to the repo. Archived
 // repos are dropped: the atlas shows where work happens, and an archived repo
 // is by definition somewhere it does not.
 func RepoNodes(listJSON []byte) ([]Node, error) {
 	var repos []struct {
 		Name        string `json:"name"`
 		Description string `json:"description"`
 		HTMLURL     string `json:"html_url"`
 		Archived    bool   `json:"archived"`
 		Language    string `json:"language"`
 	}
 	if err := json.Unmarshal(listJSON, &repos); err != nil {
 		return nil, fmt.Errorf("parse repos: %w", err)
 	}
 	nodes := make([]Node, 0, len(repos))
 	for _, r := range repos {
 		if r.Archived {
 			continue
 		}
 		tags := []string{"live · Gitea"}
 		if r.Language != "" {
 			tags = append(tags, r.Language)
 		}
 		nodes = append(nodes, Node{
 			Title: r.Name,
 			Desc:  r.Description,
 			Tags:  tags,
 			URL:   r.HTMLURL,
 		})
 	}
 	return nodes, nil
 }
@@ -0,0 +1,80 @@
 package atlas_test
 import (
 	"testing"
 	"git.d-ma.be/mathias/cad-atlas/internal/atlas"
 )
 // A Gitea /user/repos response, trimmed to the fields RepoNodes reads.
 const repoList = `[
  {"name":"cad-atlas","full_name":"mathias/cad-atlas","description":"Visualising the CAD workflow","html_url":"https://git.d-ma.be/mathias/cad-atlas","archived":false,"language":"Go"},
  {"name":"dispatch","full_name":"mathias/dispatch","description":"","html_url":"https://git.d-ma.be/mathias/dispatch","archived":false,"language":""},
  {"name":"old-thing","full_name":"mathias/old-thing","description":"retired","html_url":"https://git.d-ma.be/mathias/old-thing","archived":true,"language":"Go"}
 ]`
 func TestRepoNodes_OneNodePerRepoWithDescriptionAndURL(t *testing.T) {
 	nodes, err := atlas.RepoNodes([]byte(repoList))
 	if err != nil {
 		t.Fatalf("RepoNodes: %v", err)
 	}
 	if len(nodes) != 2 {
 		t.Fatalf("want 2 nodes (archived excluded), got %d", len(nodes))
 	}
 	if nodes[0].Title != "cad-atlas" {
 		t.Fatalf("title = %q, want %q", nodes[0].Title, "cad-atlas")
 	}
 	if nodes[0].URL != "https://git.d-ma.be/mathias/cad-atlas" {
 		t.Fatalf("url = %q", nodes[0].URL)
 	}
 	if nodes[0].Desc != "Visualising the CAD workflow" {
 		t.Fatalf("desc = %q", nodes[0].Desc)
 	}
 }
 // Mirrors IssueNodes' tagging so the two live slices read identically on stage.
 func TestRepoNodes_TagsCarryLiveMarkerAndLanguage(t *testing.T) {
 	nodes, err := atlas.RepoNodes([]byte(repoList))
 	if err != nil {
 		t.Fatalf("RepoNodes: %v", err)
 	}
 	if len(nodes) < 2 {
 		t.Fatalf("want at least 2 nodes, got %d", len(nodes))
 	}
 	if len(nodes[0].Tags) != 2 || nodes[0].Tags[0] != "live · Gitea" || nodes[0].Tags[1] != "Go" {
 		t.Fatalf("tags = %v, want [live · Gitea Go]", nodes[0].Tags)
 	}
 	// A repo with no language must not emit an empty tag pill.
 	if len(nodes[1].Tags) != 1 || nodes[1].Tags[0] != "live · Gitea" {
 		t.Fatalf("tags = %v, want [live · Gitea]", nodes[1].Tags)
 	}
 }
 // Load-bearing: archived repos are explicitly out of scope per the issue.
 func TestRepoNodes_ExcludesArchived(t *testing.T) {
 	nodes, err := atlas.RepoNodes([]byte(repoList))
 	if err != nil {
 		t.Fatalf("RepoNodes: %v", err)
 	}
 	for _, n := range nodes {
 		if n.Title == "old-thing" {
 			t.Fatalf("archived repo surfaced: %+v", n)
 		}
 	}
 }
 func TestRepoNodes_EmptyListReturnsEmptyNotNil(t *testing.T) {
 	nodes, err := atlas.RepoNodes([]byte(`[]`))
 	if err != nil {
 		t.Fatalf("RepoNodes: %v", err)
 	}
 	if nodes == nil || len(nodes) != 0 {
 		t.Fatalf("nodes = %+v, want empty non-nil slice", nodes)
 	}
 }
 func TestRepoNodes_MalformedJSONErrors(t *testing.T) {
 	if _, err := atlas.RepoNodes([]byte(`{`)); err == nil {
 		t.Fatal("want an error for malformed JSON, got nil")
 	}
 }
@@ -66,7 +66,7 @@ func ApplyStuckOverlay(stages []Stage, findings []caddomain.StuckFinding) []Stag
 	out := make([]Stage, len(stages))
 	copy(out, stages)
 	for i := range out {
-		if out[i].Generate != "stuck-badges" {
+		if !out[i].Generate.Has("stuck-badges") {
 			continue
 		}
 		assigned := byStage[out[i].No]
@@ -8,7 +8,11 @@ import (
 )
 func stage(no, generate string) atlas.Stage {
-	return atlas.Stage{No: no, Title: "example", Generate: generate}
+	s := atlas.Stage{No: no, Title: "example"}
 	if generate != "" {
 		s.Generate = atlas.GenerateKeys{generate}
 	}
 	return s
 }
 func finding(repo string, issue int, cat caddomain.StuckCategory, class caddomain.StuckClass) caddomain.StuckFinding {
@@ -40,6 +40,20 @@ func MyIssues() ([]byte, error) {
 	return get(url, token)
 }
 // MyRepos returns the raw /user/repos JSON for the token owner's own
 // repositories. Same PAT and same contract as MyIssues: returns an error if
 // GITEA_TOKEN is unset so callers can skip the overlay gracefully rather than
 // issue an unauthenticated request. Gitea's own visibility rules scope the
 // result, so no additional filtering is applied here.
 func MyRepos() ([]byte, error) {
 	token := os.Getenv("GITEA_TOKEN")
 	if token == "" {
 		return nil, fmt.Errorf("GITEA_TOKEN not set")
 	}
 	url := base() + "/api/v1/user/repos?limit=8"
 	return get(url, token)
 }
 // get performs a short-lived GET, optionally with a bearer token, and returns
 // the response body.
 func get(url, token string) ([]byte, error) {
@@ -0,0 +1,23 @@
 package gitea_test
 import (
 	"testing"
 	"git.d-ma.be/mathias/cad-atlas/internal/gitea"
 )
 // The unset path is the one that runs live right now: GITEA_TOKEN is still not
 // provisioned in prod (#4), so MyRepos must fail cleanly rather than issue an
 // unauthenticated request, letting liveOverlay skip and keep the authored
 // placeholder nodes.
 func TestMyRepos_ErrorsWhenTokenUnset(t *testing.T) {
 	t.Setenv("GITEA_TOKEN", "")
 	body, err := gitea.MyRepos()
 	if err == nil {
 		t.Fatal("want an error when GITEA_TOKEN is unset, got nil")
 	}
 	if body != nil {
 		t.Fatalf("want nil body on error, got %d bytes", len(body))
 	}
 }
@@ -58,19 +58,14 @@ func NewHandler() http.Handler {
 		if ld.run != nil {
 			nodes := atlas.RunNodes(*ld.run)
 			for i := range a.Stages {
-				if a.Stages[i].Generate == "ci-jobs" {
+				if a.Stages[i].Generate.Has("ci-jobs") {
 					a.Stages[i].Nodes = nodes
 				}
 			}
 			a.CIDurationS, a.CDDurationS = atlas.StageSeconds(*ld.run)
 		}
-		if ld.issues != nil {
+		atlas.PrependGenerated(&a, "gitea-issues", ld.issues)
-			for i := range a.Stages {
+		atlas.PrependGenerated(&a, "gitea-repos", ld.repos)
 				if a.Stages[i].Generate == "gitea-issues" {
 					a.Stages[i].Nodes = append(ld.issues, a.Stages[i].Nodes...)
 				}
 			}
 		}
 		// cad-atlas#11: overlay mathias/cad#14's cad-stuck findings as
 		// per-stage badges. Read-only — ApplyStuckOverlay only adds Nodes
 		// with a link out; it never writes anything back to Gitea.
@@ -84,7 +79,7 @@ func NewHandler() http.Handler {
 				live = append(live, atlas.FluxNode(*ld.flux))
 			}
 			for i := range a.Stages {
-				if a.Stages[i].Generate == "deploy-state" {
+				if a.Stages[i].Generate.Has("deploy-state") {
 					a.Stages[i].Nodes = append(live, a.Stages[i].Nodes...)
 				}
 			}
@@ -104,6 +99,7 @@ type liveOverlayData struct {
 	flux     *atlas.Flux
 	timeline []atlas.RunDot
 	issues   []atlas.Node
 	repos    []atlas.Node
 	stuck    []caddomain.StuckFinding
 }
@@ -172,6 +168,11 @@ func liveOverlay() liveOverlayData {
 			d.issues = nodes
 		}
 	}
 	if raw, err := gitea.MyRepos(); err == nil {
 		if nodes, err := atlas.RepoNodes(raw); err == nil {
 			d.repos = nodes
 		}
 	}
 	if raw, err := cluster.Deployment(); err == nil {
 		if dep, err := atlas.DeployState(raw); err == nil {
 			d.deploy = &dep
@@ -5,6 +5,11 @@
 # For Claude Code: generates project-only CLAUDE.md (it inherits root via tree walk)
 # For everything else: concatenates root AGENT.md + project PROJECT.md
 #
 # Cursor and Aider adapters removed 2026-09-01 — neither is a supported harness
 # any more. Supported: Claude Code, Antigravity, OpenCode, Mistral Vibe, Crush,
 # Pi. All read CLAUDE.md or AGENTS.md; system-prompt.txt remains for Open WebUI,
 # Mods and raw API use.
 #
 # Usage: ./scripts/context-sync.sh [--force] [adapter...]
 # Task:  task context:sync
 #
@@ -95,30 +100,6 @@ generate_agents() {
  echo "  → AGENTS.md (root + project; Crush, Pi, Antigravity)"
 }
 # ── Cursor ───────────────────────────────────────────────────
 generate_cursor() {
  {
    echo "# Cursor rules — auto-generated"
    echo "# Do not edit. Run: task context:sync"
    echo ""
    root_block
    cat "$PROJECT_FILE"
  } > .cursorrules
  echo "  → .cursorrules (root + project)"
 }
 # ── Aider ────────────────────────────────────────────────────
 generate_aider() {
  { root_block; cat "$PROJECT_FILE"; } > .aider.conventions.md
  if [ ! -f .aider.conf.yml ]; then
    cat > .aider.conf.yml << 'YAML'
 read: .aider.conventions.md
 auto-commits: false
 YAML
  fi
  echo "  → .aider.conventions.md (root + project)"
 }
 # ── Generic system prompt (Open WebUI, Mods, etc.) ──────────
 generate_system_prompt() {
  {
@@ -180,8 +161,6 @@ echo "Syncing project context from $PROJECT_FILE..."
 if [ ${#ADAPTERS[@]} -eq 0 ]; then
  generate_claude
  generate_agents
  generate_cursor
  generate_aider
  generate_system_prompt
  generate_mcp
 else
@@ -189,8 +168,6 @@ else
    case "$adapter" in
      claude)  generate_claude ;;
      agents)  generate_agents ;;
      cursor)  generate_cursor ;;
      aider)   generate_aider ;;
      prompt|system|openwebui|owui|generic) generate_system_prompt ;;
      mcp)     generate_mcp ;;
      *) echo "Unknown adapter: $adapter" >&2; exit 1 ;;
		`@@ -1,2 +0,0 @@`
			`read: .aider.conventions.md`
			`auto-commits: false`