Wiki Index

Read this file first when navigating the wiki.

Core

• homepage - Public-facing entry point and orientation page for the rendered wiki.
• overview - Top-level purpose, scope, and current shape of the wiki.
• log - Append-only history of ingests, durable queries, lint passes, and structural changes.

Sources

• sources/blog-zero-credentials-on-disk - TazPod migration toward AWS SSO and S3-backed encrypted vault recovery.
• sources/blog-tailscale-secure-backbone - Tailscale as declarative network backbone managed in ephemeral-castle.
• sources/blog-lushycorp-vault-security-architecture - Design-first rationale for the Hetzner Vault runtime security model.
• sources/blog-terraforming-the-cloud-vault-hetzner - Execution chronicle for the Hetzner Vault local lifecycle and remote durability runtime.
• sources/blog-recursive-memory-compact-context - Explanation of the recursive memory layer and why it was added after contexts.
• sources/research-proxmox-and-talos-iac - Proxmox, Talos, and Terraform provisioning research.
• sources/research-tailscale-and-networking - Tailscale, Talos networking, VIP, and MetalLB research.
• sources/research-talos-storage-and-persistence - Longhorn, Talos storage, and Kubernetes persistence research.
• sources/research-kubernetes-core-models - Kubernetes controllers and storage primitive research.
• sources/research-kubernetes-secrets-and-sops - Talos security, Vault, Infisical, and SOPS research.
• sources/research-terminal-tooling - Operator terminal productivity stack research.

Entities

• entities/agents-ctx - OMP skills governance hub: /workspace/AGENTS.md loader + /workspace/SKILLS/.
• entities/agent-company - Org chart of the Paperclip agent company (running in the CT108 container): CEO + five reports, single-writer surfaces, project leads, governance (budgets, hire gate, read-only Reviewer); notes the separate, Git-declared Multica team.
• entities/tazpod - Operator environment layer hub.
• entities/ambrogio-memory - The lab’s memory service: one Go binary, SQLite, the API the agents read and write, the internal summary agent, the backup pushed to git.
• entities/ephemeral-castle - Provider-specific infrastructure layer hub.
• entities/tazlab-k8s - Provider-agnostic Flux GitOps desired-state layer hub.
• entities/mnemosyne-mcp-server - Semantic memory service hub.
• entities/hindsight — Hindsight multi-agent memory platform hub (deployment, banks, migration).
• entities/blog-src - Hugo blog source.
• entities/wiki-tazlab-net - Wiki repository hub.
• entities/hermes - Hermes Agent KVM VM 501 deployment hub — decommissioned 2026-09-26, data disk preserved (standalone repo tazzo/hermes-agent).
• entities/hashicorp-vault - Vault secret-management platform, Hetzner runtime, cluster integration status.
• entities/lxc-storage-infra — Proxmox LXC container for shared storage (Samba+NFS-Ganesha), CT 107, Terraform+Ansible.

Concepts

• concepts/tazlab-knowledge-layers - Roles of memory, mnemosyne, and wiki.tazlab.net.
• concepts/zero-trust-architecture — Security model across all TazLab layers.
• concepts/nomadic-operator — Portable operator identity across environments.

Topics

• topics/ambrogio-memory-contract - The memory service’s model: rows, the boot bundle, asynchronous compaction, the internal agent, backup and restore, and the seven defects an independent test found.

Knowledge Systems (mnemosyne-mcp-server)

• topics/mnemosyne-architecture — Architecture, component map, data flow, design decisions.
• topics/mnemosyne-mcp-tools — 5 MCP tools: ingest, retrieve, get, list, delete.
• topics/mnemosyne-embedding-model — Gemini embedding integration and TD-002 dimension mismatch.
• topics/mnemosyne-async-ingestion — Background worker pool, dedup, silent failure risks.
• topics/mnemosyne-database-schema — PostgreSQL memories table, pgvector, dimension auto-detection.

Multi-Agent Memory (hindsight)

• topics/hindsight-architecture — 3-pod stateless architecture, bank model, LLM/embedding quota pacing, migration protocols.
• topics/hindsight-migration-status — Live migration state: 754 docs imported, TD-058 closure, backlog (chronicles/reports/doctrine).

Agent Skills Governance (SKILLS)

• topics/agents-ctx-context-system - Skill loading mechanism: AGENTS.md loader, SKILL.md frontmatter, skill:// dispatch.
• topics/agents-ctx-memory-system - Memory workspace (SKILLS/memory/): chronicle, system-state, debts, reports, archive cycle.
• topics/agents-ctx-crisp-methodology - C-R-I-S-P phases, project hierarchy, split rules (skills crisp + crisp-build).

Legacy, retired (kept for history):

• topics/agents-ctx-pi-council — Roles, rounds, orchestration (legacy, not migrated).
• topics/agents-ctx-wiki-archivist — Fractal wiki, survey workflow, depth model (legacy; successor SKILLS/wiki).

TazLab Ecosystem

• topics/tazlab-system-map - High-level system map.
• topics/tazlab-repository-map - Boundaries and relationships across repositories.
• topics/tazlab-operating-model - How repositories fit together in daily work.
• topics/tazlab-cluster-delivery-flow - Bootstrap to GitOps handoff.
• topics/tazlab-secret-and-identity-flow - Secret-management strategy.
• topics/tazlab-crisp-program-map - Map of the main CRISP workstreams.
• topics/tazlab-infrastructure-tech-stack - Technology reference stack.

GitOps & Cluster (tazlab-k8s)

• topics/tazlab-k8s-flux-dag - Flux dependency graph (DAG) and synchronization logic.
• topics/tazlab-k8s-repository-mapping - Directory structure, file types, and variable substitution.
• topics/tazlab-k8s-operators-inventory - List and roles of all cluster controllers.
• topics/tazlab-k8s-bootstrap-logic - Cluster cold-start handling and wait-for-db pattern.
• topics/tazlab-k8s-conventions - Coding standards, naming, and manifest purity.
• topics/tazlab-k8s-structure - Kustomize layering pattern (apps/base vs apps/cluster).
• topics/tazlab-k8s-image-automation - Flux image update policy and setter markers.
• topics/tazlab-k8s-secrets-mapping - Vault secret mapping to cluster consumers (VSO era).
• topics/tazlab-k8s-monitoring - Grafana and Prometheus observability, Alertmanager receivers state (TD-057).
• topics/tazlab-k8s-homepage — Homepage dashboard app: architecture, 2026-08 outage fix, image automation.
• topics/tazlab-k8s-layers - Functional split of cluster resources.

Tailscale Networking

• topics/tailscale-iac-management — Terraform provider, ACL as code, OAuth client model.
• topics/tailscale-operator-connectivity — Userspace daemon (deprecated) and hostnet+TUN mode, auth key minting, socket auto-detection.
• topics/tailscale-service-exposure — Ingress and LoadBalancer via Tailscale Operator, replacing MetalLB and public Traefik.
• topics/tailscale-cluster-integration — Talos System Extension, raw IP vs DNS gap.
• topics/tailscale-vault-contract — Vault MagicDNS convergence, custom alias debt.

Infrastructure (ephemeral-castle)

• topics/ephemeral-castle-architecture - Philosophy and Terragrunt structure.
• topics/ephemeral-castle-terragrunt-layers - The 6 sequential/parallel layers.
• topics/ephemeral-castle-rebirth-protocol - Create/Destroy lifecycle.
• topics/ephemeral-castle-vault-runtime-architecture - Hetzner Vault unseal and storage details.
• topics/ephemeral-castle-vault-bootstrap-and-restore - State classification and restore flow.
• topics/ephemeral-castle-tailnet-security - Tags, ACLs, and OAuth bootstrap.
• topics/ephemeral-castle-tailscale-bridge - Talos node integration into mesh.

Blog & Publishing (blog-src)

• topics/blog-publication-pipeline — Multi-step chain: Git → GitHub Action → Docker → Flux → cluster.
• topics/blog-content-structure — Article organization, front matter, bilingual model.
• topics/blog-comments-system — Cusdis Cloud integration, bilingual threads.
• topics/blog-theme-management — Blowfish versioning, pinning, overrides.

Operator Tooling (tazpod)

• topics/tazpod-image-hierarchy - Docker layering and build policy.
• topics/tazpod-vault-security - RAM enclave, AES encryption, and AWS bridging.
• topics/tazpod-nomadic-workflow - Smart recovery path, local bootstrap, and host-to-host restoration via S3 and Vault.
• topics/tazpod-provisioning-and-dotfiles - Bashrc logic, persistence symlinks, and auto-init.
• topics/tazpod-sync-daemon - Background save/push mechanics.
• topics/tazpod-lxc-orchestration-host — Where create.sh must run (tazlab, 192.168.1.200), the from= pin that forces it, control-host prerequisites and the TAZ-19 acceptance checks (tazpod@e38dc17).

AI Agent Services (hermes) — decommissioned

• topics/hermes-vm-deployment — KVM VM 501 deployment architecture, lvrename persistence, dashboard auth; VM decommissioned 2026-09-26 with the data disk preserved.
• topics/hermes-lxc-deployment — ⚠️ SUPERSEDED: historical CT 105 LXC deployment (destroyed 2026-08-12).

LXC Storage Service

• topics/lxc-storage-crisp-design — CRISP design, 3 review cycles, architecture, VSO ca.crt fix.

Gopass Migration (NEW)

• topics/tazpod-gopass-migration — Migration from TazPod vault to gopass GPG-encrypted store.
• topics/tazlab-secret-and-identity-flow — Current secret flow across all TazLab layers (updated for gopass).

Details

• details/ambrogio-memory-verbs-detail - Every verb of ambrogio-memory, its parameters, its refusals, and the two secret files.

• details/hindsight-deployment-detail — Hindsight manifests file-by-file, API env contract, 4 gotchas, VSO PKI recipe.

• details/mnemosyne-mcp-debts-detail — Known issues, code gaps, and technical debt for the semantic memory service (TD-002 and related findings).

• details/mnemosyne-ingest-memory-detail — Step-by-step ingestion pipeline: MCP handler, async worker, dedup, embed, DB insert.

• details/mnemosyne-retrieve-memories-detail — Semantic search flow: query embedding, cosine similarity, temporal filter gap.

• details/mnemosyne-deployment-detail — Docker build, GitHub Actions, env vars, Flux automation, cluster manifests.

• details/mnemosyne-python-tools-detail — chronicler.py and gather_sessions.py session archiving tools.

• details/tazlab-k8s-flux-kustomizations-detail — All 12 Flux Kustomizations with exact spec, dependencies, and health checks.

• details/tazlab-k8s-image-automation-detail — all image automation pipelines with tag patterns and commit strategy.

• details/tazlab-k8s-cert-manager-detail — Certificate lifecycle, ClusterIssuers, DNS01 integration.

• details/tazlab-k8s-traefik-detail — Edge routing, LoadBalancer, middlewares, ingress.

• details/tazlab-k8s-external-secrets-detail — ESO ClusterSecretStore and all ExternalSecret manifests.

• details/tazlab-k8s-tazlab-db-detail — PostgreSQL 17.2 cluster (PGO 5.7.2), databases and users, the 17 major upgrade, pg_hba rules, S3 backup.

• details/tazlab-k8s-dex-oauth2-detail — Dex OIDC, OAuth2 Proxy, ForwardAuth flow.

• details/tazlab-k8s-hugo-blog-detail — Blog deployment, ingress redirects, image automation.

• details/tazlab-k8s-hugo-wiki-detail — Wiki deployment, TLS, image automation.

• details/tazlab-k8s-teaching-detail — Didactics app at teaching.tazlab.net: namespace, 8080 runtime contract, redirect Ingress, Vault-delivered LLM key, image automation, the random-graph kinematics page (cinematica-grafici-lettura) with its three-file configurator contract, and the frontend test gate (21 vitest tests over web/src/, fixtures pinned to /api/pages).

• details/tazlab-k8s-halloween-detail — Halloween party game at halloween.tazlab.net: namespace, emptyDir state (no PVC/Longhorn), 1-replica/Recreate, TLS + redirect, image automation, master-only story voice, one-shot QR scanner.

• details/tazlab-k8s-multica-detail — Historical (removed 2026-10-20): Multica agent-orchestration control plane: chart 0.5.3 values and the four rendered-output patches, LAN exposure through the frontend proxy, certificate database identity, the seven-key Secret, the Git-declared agent team, and the daemon on CT106 (headless login, provider key, runtimes).

• details/tazlab-k8s-paperclip-observer-detail — The read-only Kubernetes identity granted to the agent container: ClusterRole paperclip-observer (view ∪ flux-view, get/list/watch only, no Secrets, no exec), the legacy token and how it reaches the guest.

• details/tazlab-k8s-monitoring-detail — Prometheus, Grafana, dashboards as code.

• details/tazpod-smart-entry-detail — No-args guided flow through container, vault, and shell.

• details/paperclip-container-detail — CT108 paperclip, the dedicated container the agent company runs in: guest shape, five Ansible layers, its own gopass store and GPG key, the carry from CT106, the Proxmox/observer/Vault identities, the egress chokepoint (mitmproxy + nftables) and the rollback.

• details/paperclip-tazpod-detail — Historical (CT106, 2026-09-25 → 2026-09-26): Paperclip inside the TazPod container — managed install, external PostgreSQL over TLS with a password identity, secrets in gopass, unit hardening, the CLI traps, and the blast radius of running it in the operator environment.

• details/tazpod-proxmox-runtime-detail — CT106 LXC runtime: Terraform/Ansible provisioning, idempotency rules and re-run assessment, the pet-backed ~/.pi state directory, legacy nginx/sync-daemon removal, dsh Web UI decommissioned 2026-09-25.

• details/tazpod-vault-lifecycle-detail — Unlock, lock, save, push, pull step-by-step.

• details/tazpod-sync-daemon-detail — Background 5-min save/push cycle with SIGTERM handling.

• details/tazpod-container-lifecycle-detail — Docker create, start, stop, remove with exact flags.

• details/tazpod-dotfiles-detail — bashrc, tmux, starship, OpenCode auto-seeding.

• details/tazpod-config-detail — .tazpod/config.yaml fields and struct definitions.

• details/tazpod-crypto-detail — AES-256-GCM encryption, PBKDF2, output format.

• details/tazpod-s3-detail — S3 client for vault persistence, lineage concept.

• details/tazpod-ci-detail — Conditional CI pipeline per Docker layer.

• details/tazpod-code-structure-detail — Package tree, file-by-file function inventory, call chains, cross-file dependencies.

• details/tailscale-terraform-root-detail — tailscale/ module resources and variables.

• details/tailscale-acl-policy-detail — Tag ownership, ACL rules, SSH access.

• details/tailscale-oauth-client-detail — OAuth client flow, key minting, lifecycle.

• details/tailscale-talos-bridge-detail — System Extension, AuthKey injection, connectivity.

• details/tailscale-magicdns-detail — Naming contracts, custom alias pitfalls.

• details/ephemeral-castle-create-destroy-detail — 6-stage Hetzner Vault pipeline and destroy process.

• details/ephemeral-castle-ansible-vault-detail — Classification, PKI, bootstrap, restore orchestration.

• details/ephemeral-castle-terraform-modules-detail — 6 reusable Terraform modules for cluster provisioning.

• details/ephemeral-castle-terragrunt-layers-detail — Dependency chain, env.hcl variables, secret injection.

• details/ephemeral-castle-vault-ansible-scripts-detail — 4 shell scripts: bootstrap, unseal, backup, restore.

• details/ephemeral-castle-vault-systemd-detail — 5 systemd units, Quadlet issue (TD-016).

• details/ephemeral-castle-golden-image-detail — Builder pipeline, v1-v4 history.

• details/ephemeral-castle-proxmox-cluster-detail — Create/destroy/nuclear-wipe scripts.

• details/agents-ctx-archive-flow-detail — Archive script and regeneration phases.

• details/agents-ctx-crisp-workflow-detail — Project lifecycle, split integrity, registry updates.

• details/agents-ctx-memory-files-detail — Roles of chronicle, system-state, debts, past-summary.

• details/blog-post-workflow-detail — Writing flow, translation rules, image processing.

• details/blog-hugo-config-detail — Site, language, theme configuration reference.

• details/blog-ci-detail — GitHub Actions build pipeline, tags, delivery chain.

References

• references/tazlab-k8s/flux-kustomization-example — Annotated Kustomization YAML with field explanations.

• references/tazlab-k8s/image-policy-example — ImageRepository + ImagePolicy + ImageUpdateAutomation example.

• references/tazlab-k8s/external-secret-example — ExternalSecret variants: simple, TLS template, S3 template.

• references/tazlab-k8s/kustomize-layering — Base vs cluster overlay pattern explanation.

• references/tazpod/config-yaml-example — Annotated .tazpod/config.yaml.

• references/tazpod/dockerfile-base — TazPod base image with dev tools and shell tools.

• references/tazpod/dockerfile-aws — AWS CLI v2 layer.

• references/tazpod/dockerfile-k8s — Kubernetes tools layer with exact versions.

• references/tazpod/dockerfile-ai — AI coding agents layer.

• references/tazpod/bashrc-full — Annotated .bashrc with persistence symlinks.

• references/tazpod/taskfile-yml — Build tasks reference.

• references/tailscale/acl-json — Current Tailscale ACL policy.

• references/tailscale/terraform-main-tf — Terraform root module for tailscale.

• references/tailscale/start-sh — Operator-side daemon start script.

• references/ephemeral-castle/vault-hcl-template — Annotated Vault HCL configuration template.

• references/ephemeral-castle/create-sh-stages — Stage-by-stage breakdown with failure modes.

• references/ephemeral-castle/ansible-inventory — Generated inventory format.

• references/ephemeral-castle/env-hcl — Cluster variables reference.

• references/ephemeral-castle/vault-certs-fetch — PKI fetch-back from VM to controller.

• references/tazlab-k8s/flux-kustomization-example — Annotated Kustomization YAML with field explanations.

• references/tazlab-k8s/image-policy-example — ImageRepository + ImagePolicy + ImageUpdateAutomation example.

• references/tazlab-k8s/external-secret-example — ExternalSecret variants: simple, TLS template, S3 template.

• references/tazlab-k8s/kustomize-layering — Base vs cluster overlay pattern explanation.

Analyses

• analyses/ephemeral-castle-topology-drift - Notes the current 1 CP + 1 worker code truth versus older 2-worker prose.

Operations

• operations/tazlab-flux-dag-troubleshooting - Flux runbook.
• operations/ephemeral-castle-commands - Infrastructure cheat sheet.
• operations/tazpod-cli-reference - TazPod command guide.

Contexts

• contexts/INDEX — Legacy static catalog of pre-built operational contexts from the retired root context system (kept for history).