replica-omnisciente/.aurelio/plans/2026-07-30_aurelio-consolidation-execution-plan.md

Aurelio Consolidation — Execution Plan

30/07/2026. Decisions locked. This is the execution document.

DECISIONS (locked by Maestro)

Decision	Resolution
Hetzner specs	Agent decides — see sizing below
CT223 future	Stays as LAN fallback, ready to receive snapshots
Git remote	Forgejo = primary, GitHub = mirror
GBrain DB	Stays local (MVP phase), not on Hetzner
Kimi swarm	Remove from CT223, restructure as reusable sub-agent harness
Aurelio identity	Aurelio is a harness — sub-agents feed into bot, Theia, VS Code

BLOCKER: Hetzner API Token

The token is in nervura-electrica/infrastructure/proxmox/iac/tofu/secrets.enc.yaml, encrypted with age key age1m56h5m2hra70uppj5jn8w7prynjw8gtjfxpp0tucvgydnnu3u9esaplg9g. The age private key is NOT on: laptop, pf-edge, ASUS, or CT223.

To provision new Hetzner VMs, we need either:

1. The age private key (where was it created?)
2. OR a fresh Hetzner API token from console.hetzner.cloud

---

TARGET ARCHITECTURE

Sizing Decision

CT223 currently runs 30+ services on 2GB RAM — it's at the breaking point. Only the compute-intensive AI layer goes to Hetzner. Git forge and gateway stay on LAN (Dell/Gigabyte) for data sovereignty, but are IaC-packaged so they can deploy to any cloud in one command.

LAN resources:

• Dell .41: 31Gi RAM, 47GB disk free — 6 CTs running, ample headroom
• Gigabyte .104: 46Gi RAM, 86% disk (15GB free) — tight, CT223 is the hog

New VMs / CTs:

VM/CT	Host	Type	Specs	Monthly	Purpose
pf-aurelio	Hetzner	CPX31	2 ded AMD vCPU, 4GB, 160GB	€8.50	Gabinete, Bot-rs, fabricd, MCP gateway, sub-agent harness
pf-forge	Dell .41	LXC 238	4 vCPU, 8GB, 80GB	€0	Forgejo + Woodpecker CI + GitHub mirror
pf-stage	Dell .41	LXC 239	2 vCPU, 4GB, 40GB	€0	Hermes gateway 24/7

Total cloud cost: €8.50/month (only pf-aurelio is cloud). pf-edge (existing CX22) stays as media edge — €4.50/month. Grand total Hetzner: €13/month.

GBrain stays on CT223 (local, per decision). pf-aurelio connects to it via WireGuard. pf-forge and pf-stage are LAN-local (no WG needed for GBrain access).

Service Separation Target

HETZNER (public cloud — €13/mo total)
│
├── pf-edge (94.130.24.119, CX22 — EXISTS)
│   ├── Caddy media reverse proxy → LAN via WG
│   └── WireGuard → 10.99.0.1 (ASUS)
│
├── pf-aurelio (NEW, CPX31)
│   ├── aurelio-gabinete-rs    :18000  → API central
│   ├── aurelio-bot-rs                 → Telegram bot
│   ├── aurelio-fabricd       :8081   → model gateway
│   ├── aurelio-engineering-gw :8090  → federated MCP
│   ├── aurelio-subagent-harness      → Kimi swarm redesign
│   ├── aurelio-web                   → Olhos-de-Orpheu
│   └── brain-sync (→ CT223 GBrain via WG 10.99.0.1)
│
LAN (Proxmox cluster — data sovereignty, zero cloud cost)
│
├── DELL .41 (PVE 9.2.2, 31Gi RAM, 47GB free)
│   ├── CT213  pf-immich
│   ├── CT231  pf-homeassistant
│   ├── CT234  pf-marketplace
│   ├── CT235  pf-orchestrator :8200
│   ├── CT236  pf-savearth
│   ├── CT237  pf-iot-stack
│   ├── CT238  pf-forge (NEW) — Forgejo :3001 + Woodpecker :8001
│   │           ↑ IaC-packaged: swap LXC→cloud in one tofu apply
│   └── CT239  pf-stage (NEW) — Hermes gateway 24/7
│                ↑ IaC-packaged: swap LXC→cloud in one tofu apply
│
├── GIGABYTE .104 (46Gi RAM, 86% disk)
│   ├── CT223  pf-forja-do-conhecimento — DATA LAYER
│   │   ├── pf-gbrain            :18001  → STAYS (MVP, local DB)
│   │   ├── gbrain-rest-proxy    :18002  → STAYS
│   │   ├── PostgreSQL (Docker)  :5433   → STAYS (GBrain backend)
│   │   ├── Docker services              → STAYS (Plane, Outline, MinIO)
│   │   ├── lifestream-userbot           → STAYS (Telethon session)
│   │   ├── pf-identity         :9091   → STAYS (CA)
│   │   └── [snapshot target for pf-aurelio]
│   ├── CT237  (old Forgejo — migrate to CT238 Dell, then retire)
│   └── Other media CTs (200-222)
│
├── ASUS .38 (31Gi, PVE cluster primary)
│   ├── CT215  pf-matrix (Matrix Synapse)
│   ├── CT208  OLD HUB — STOPPED
│   ├── Cloudflare tunnel pf-tunnel-v2
│   └── WireGuard server 10.99.0.1
│
WIREGUARD MESH (ASUS = hub, 10.99.0.1):
  pf-edge     10.99.0.2  ↔ ASUS 10.99.0.1  (media proxy)
  pf-aurelio  10.99.0.3  ↔ ASUS 10.99.0.1  (→ CT223 GBrain)
  Dell CTs               LAN-direct         (no WG needed)

What Moves Off CT223

Service	From	To	Route
aurelio-gabinete-rs	CT223 :18000	pf-aurelio (Hetzner)	direct on VM
aurelio-bot-rs	CT223	pf-aurelio (Hetzner)	direct on VM
aurelio-fabricd	CT223 :8081	pf-aurelio (Hetzner)	direct on VM
aurelio-engineering-gw	CT223 :8090	pf-aurelio (Hetzner)	direct on VM
aurelio-native-engine-gw	CT223	pf-aurelio (Hetzner)	direct on VM
aurelio-web	CT223	pf-aurelio (Hetzner)	direct on VM
aurelio-webhook	CT223	pf-aurelio (Hetzner)	direct on VM
Hermes gateway	CT217	CT239 Dell (pf-stage)	LAN-direct
Forgejo + Woodpecker	CT237 Gigabyte	CT238 Dell (pf-forge)	LAN-direct

What Stays on CT223

Service	Why it stays
pf-gbrain :18001	GBrain DB stays local (Maestro decision)
gbrain-rest-proxy :18002	Pairs with local GBrain
PostgreSQL Docker :5433	GBrain backend DB
Plane/Outline/MinIO/Redis	Docker stack, heavy data
lifestream-userbot	Telethon session, LAN-dependent
pf-identity :9091	CA + identity management
brain-sync :8095	Syncs to local GBrain
All pf-*-scribe-208 services	Legacy naming, lightweight

CT223 After Migration

CT223 drops from 30+ services to ~12. RAM goes from 976Mi used → ~400Mi. It becomes the data layer + fallback. pf-aurelio can snapshot its config to CT223 for disaster recovery.

---

IaC PORTABILITY — LXC TODAY, CLOUD TOMORROW

pf-forge and pf-stage deploy as Proxmox LXC containers on Dell today. The OpenTofu definitions use a provider-agnostic pattern: swap one variable and the same service deploys to Hetzner/AWS/bare-metal.

Structure (extends existing nervura-electrica IaC)

nervura-electrica/infrastructure/proxmox/iac/tofu/
├── edge_node.tf          ← pf-edge (Hetzner, exists)
├── aurelio_node.tf       ← pf-aurelio (Hetzner CPX31, new)
├── forge_node.tf         ← pf-forge (Dell LXC 238, new)
├── stage_node.tf         ← pf-stage (Dell LXC 239, new)
├── providers.tf
└── secrets.enc.yaml

Each node file follows this pattern:

# forge_node.tf
# Deploys as LXC on Dell today. Set deploy_target="hcloud" to move to cloud.

variable "forge_deploy_target" {
  description = "LXC (LAN) or hcloud (Hetzner)"
  type        = string
  default     = "lxc"    # ← change this one line to go cloud
}

# LXC variant (Dell .41, zero cost)
resource "proxmox_lxc" "forge" {
  count       = var.forge_deploy_target == "lxc" ? 1 : 0
  vmid        = 238
  target_node = "dell"
  ...
}

# Cloud variant (Hetzner, if needed later)
resource "hcloud_server" "forge" {
  count       = var.forge_deploy_target == "hcloud" ? 1 : 0
  name        = "pf-forge"
  server_type = "cx22"
  ...
}

Ansible roles handle the service config regardless of where the container/VM runs — same Forgejo config, same Hermes config, same WireGuard mesh entry.

---

KIMI SWARM → AURELIO SUB-AGENT HARNESS

Current State (CT223)

6 Kimi swarm services, all named pf-*-208.service:

• orchestrator, log-processor, ota-validator, regression-detector, report-synthesizer, dashboard

These are Python services in .aurelio/swarm/ that dispatch Kimi API calls as specialized agents. They're alive but isolated — only used by the old swarm dashboard.

Redesign: Aurelio Sub-Agent Harness

Aurelio is a harness. The swarm agents become a reusable sub-agent layer that any Aurelio surface can invoke:

AURELIO SURFACES (callers)
├── Bot-rs (Telegram)     → "analyze these logs" → dispatches sub-agent
├── Aurelio-Theia (IDE)   → user requests review → dispatches sub-agent  
├── Aurelio VS Code       → developer triggers analysis → dispatches sub-agent
└── Gabinete API          → programmatic dispatch

SUB-AGENT HARNESS (the swarm, restructured)
├── log-processor         → parse/stream device/firmware logs
├── ota-validator         → validate firmware OTA packages
├── regression-detector   → diff CI runs, flag regressions
├── report-synthesizer    → aggregate findings into reports
└── orchestrator          → route requests to the right agent

TRANSPORT: each surface calls the orchestrator via HTTP/gRPC
AUTH: fabricd gateway token (existing)

Implementation

1. Strip the pf-*-208 naming and systemd units from CT223
2. Package the swarm as a single deployable service (Rust or Python)
3. Expose via fabricd as an MCP tool: aurelio.subagent.dispatch
4. Any surface (bot, IDE, VS Code) calls it through the existing MCP gateway
5. Deploy on pf-aurelio alongside Gabinete/Bot-rs

---

REPO CLEANUP (executable now, no Hetzner dependency)

Phase 1: Immediate disk recovery

# Free 4.3GB of local Rust build artifacts
cd tilth && cargo clean
cd mycelium-rd && cargo clean
cd infrastructure/fabric/drift && cargo clean

Phase 2: Git hygiene

# Stop tracking brain sessions (runtime data, not source)
echo '.aurelio/brain/session-*/' >> .gitignore

# Remove binary blobs from working tree
git rm -r --cached infra/lab-gateway/MPFS_ICICLE_KIT_2025_07/
git rm -r --cached realms/tear-de-silicio/standard-app/models/

Phase 3: Purge git history (requires force-push)

# After Phase 2, purge from history (saves ~250MB from .git)
git filter-repo --path infra/lab-gateway/MPFS_ICICLE_KIT_2025_07 --invert-paths
git filter-repo --path realms/tear-de-silicio/standard-app/models --invert-paths
git filter-repo --path-glob '.aurelio/knowledge/*.pdf' --invert-paths

# Force push (coordinate with all checkouts)
git push forgejo main --force
git push origin main --force

Phase 4: Delete dead content

# 20 empty realm stubs
rm -rf realms/aprendiz-de-sensacoes realms/matriz-da-maquina ...

# Stale root docs
rm DESIGN.md task.md SETUP_API_KEYS.md vscode_extension_migration_guide.md
rm IMPLEMENTATION_SUMMARY.md PORTAL_CONSOLIDATION_SUMMARY.md NEXT_MONTH_ROADMAP.md
rm AGENT_INDEX.md DIRECTORY_GUIDE.md

Phase 5: Documentation rewrite

Rewrite these to match reality:

• AGENTS.md — update infra targets table (CT223 hub, not CT208)
• README.md — current repo overview
• New DIRECTORY_GUIDE.md — reflect .aurelio/ structure

---

GIT REMOTE STRATEGY

Current: dual primary

• origin = GitHub (fabiorafaelcoutada/replica-omnisciente)
• forgejo = Forgejo LAN (code.portugalfuturista.org)

Target: Forgejo primary, GitHub mirror

# Swap remotes
git remote rename origin github-mirror
git remote rename forgejo origin

# Set up mirror push (Forgejo → GitHub)
git remote set-url --add origin --push git@github.com:fabiorafaelcoutada/replica-omnisciente.git

Or configure Forgejo's push mirror feature (Forgejo pushes to GitHub automatically on each push).

---

EXECUTION SEQUENCE

Done (this session)

1. ✅ Full repo audit (5.7GB, 33 CTs, service topology, documentation drift)
2. ✅ Unified fleet inventory (infrastructure/fleet/fleet.yaml)
3. ✅ pfctl CLI — manages ALL nodes (Proxmox + Hetzner) with one command
4. ✅ Ansible inventory generator
5. ✅ Prometheus scrape config (all nodes)

What I can do NOW (no token needed, no destructive ops)

6. ✅ Repo cleanup Phase 1-2 (cargo clean, .gitignore)
7. ✅ Delete dead realms + stale docs
8. ✅ Rewrite AGENTS.md, DIRECTORY_GUIDE.md
9. ✅ Write OpenTofu for pf-aurelio (Hetzner, ready when token arrives)
10. ✅ Write OpenTofu for pf-forge CT238 + pf-stage CT239 (Dell LXC, deployable now)
11. ✅ Write Ansible roles for Forgejo + Hermes (provider-agnostic)

What needs the Hetzner token (only pf-aurelio)

12. ⏳ Provision pf-aurelio CPX31 on Hetzner
13. ⏳ Configure WireGuard pf-aurelio ↔ ASUS
14. ⏳ Migrate Gabinete/Bot-rs/fabricd/MCP services to pf-aurelio
15. ⏳ Cutover mcp.portugalfuturista.org → pf-aurelio

What needs Maestro confirmation (destructive)

16. Git history rewrite (force push) — coordinate timing
17. Kimi swarm systemd unit removal from CT223 — service interruption window
18. Forgejo data migration CT237→CT238 (git repos + DB dump/restore)