deploy: sync config, workspace, and workflows

.github/workflows/ghcr.yml

@@ -1,11 +1,10 @@
-# Build and push container image to GHCR on main branch pushes.
-# Copy this to .github/workflows/ghcr.yml in each agent repo.
+# Build and push Nix-built container image to GHCR on main branch pushes.
+# For repos that use `nix build .#container` instead of Dockerfile.
 #
 # Tags:
 #   sha-<commit>  — immutable, Renovate tracks these
 #   edge          — rolling latest from main branch
 #   latest        — alias for edge on main
-#   v*            — semver release tags
 #
 # Usage:
 #   1. Copy to repo's .github/workflows/ghcr.yml
@@ -16,13 +15,11 @@ name: GHCR Build
 on:
   push:
     branches: [main]
-    tags: ['v*']
   workflow_dispatch:
 
 env:
   REGISTRY: ghcr.io
   OWNER: tinyland-inc
-  # Change this per repo: ironclaw, picoclaw, or hexstrike-ai
   REPO_NAME: hexstrike-ai
 
 permissions:
@@ -37,8 +34,13 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Install Nix
+        uses: cachix/install-nix-action@v30
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+
+      - name: Build container image
+        run: nix build .#container --print-build-logs
 
       - name: Log in to GHCR
         uses: docker/login-action@v3
@@ -47,24 +49,23 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}
-          tags: |
-            type=sha,prefix=sha-,format=short
-            type=edge,branch=main
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
-            type=semver,pattern=v{{version}}
+      - name: Load and tag image
+        run: |
+          # Nix produces a tarball at ./result
+          docker load < ./result
 
-      - name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          platforms: linux/amd64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          # The image is tagged as defined in flake.nix (usually <name>:edge)
+          SOURCE="${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:edge"
+          SHA_SHORT=$(echo "${{ github.sha }}" | cut -c1-7)
+
+          # Tag with sha, edge, and latest
+          docker tag "$SOURCE" "${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:sha-${SHA_SHORT}"
+          docker tag "$SOURCE" "${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:edge"
+          docker tag "$SOURCE" "${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:latest"
+
+      - name: Push all tags
+        run: |
+          SHA_SHORT=$(echo "${{ github.sha }}" | cut -c1-7)
+          docker push "${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:sha-${SHA_SHORT}"
+          docker push "${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:edge"
+          docker push "${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:latest"

tinyland/workspace/AGENT.md

@@ -35,18 +35,13 @@ __findings__[
 
 ## Available Tools
 
-### Security Tools (42 via MCP protocol)
-Native tools dispatched through the Go gateway to the OCaml MCP server:
-- `smart_scan` -- AI-driven scan with automatic tool selection
-- `target_profile` -- multi-phase reconnaissance and profiling
-- `port_scan`, `nmap_scan`, `host_discovery` -- network recon
-- `tls_check` -- TLS/SSL verification
-- `credential_scan`, `sops_rotation_check` -- credential auditing
-- `container_scan`, `k8s_audit` -- cloud/container security
-- `vuln_scan`, `sqli_test`, `xss_test` -- web security
-- See TOOLS.md for the full 42-tool inventory
-
-### Platform Tools (via adapter sidecar)
+### Security Tools (Flask API)
+- `/api/command` -- execute security commands (nmap, curl, etc.)
+- `/api/intelligence/smart-scan` -- AI-driven scan with automatic tool selection
+- `/api/intelligence/analyze-target` -- target profiling and reconnaissance
+- `/api/error-handling/execute-with-recovery` -- commands with retry/recovery
+
+### Platform Tools (via adapter)
 - `juggler_resolve_composite` -- resolve credentials from multiple sources
 - `juggler_setec_list` / `juggler_setec_get` / `juggler_setec_put` -- secret store
 - `juggler_audit_log` -- query audit trail

tinyland/workspace/TOOLS.md

@@ -1,27 +1,17 @@
 # HexStrike-AI Tool Reference
 
-## Native Security Tools (42 tools via MCP)
-
-HexStrike-AI exposes 42 verified security tools via JSON-RPC 2.0 (MCP protocol).
-The Go gateway proxies MCP requests to the OCaml server over stdio.
-
-| Domain | Tools | Count |
-|--------|-------|-------|
-| WebSecurity | dir_discovery, vuln_scan, sqli_test, xss_test, waf_detect, web_crawl | 6 |
-| NetworkRecon | port_scan, host_discovery, nmap_scan, network_posture | 4 |
-| Forensics | memory_forensics, file_carving, steganography, metadata_extract | 4 |
-| CredentialAudit | credential_scan, sops_rotation_check, brute_force, hash_crack | 4 |
-| CloudSecurity | cloud_posture, container_scan, iac_scan, k8s_audit | 4 |
-| BinaryAnalysis | disassemble, debug, gadget_search, firmware_analyze | 4 |
-| SMBEnum | smb_enum, network_exec, rpc_enum | 3 |
-| Intelligence | cve_monitor, exploit_gen, threat_correlate | 3 |
-| APITesting | api_fuzz, graphql_scan, jwt_analyze | 3 |
-| Orchestration | smart_scan, target_profile | 2 |
-| Meta | server_health, execute_command | 2 |
-| DNSRecon | subdomain_enum, dns_recon | 2 |
-| CryptoAnalysis | tls_check | 1 |
-
-## Platform Tools via Adapter Proxy
+## Native Security Tools (Flask API on port 8888)
+
+HexStrike-AI exposes security tools via its Flask REST API:
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/api/command` | POST | Execute security commands (nmap, curl, etc.) |
+| `/api/intelligence/smart-scan` | POST | AI-driven scan with automatic tool selection |
+| `/api/intelligence/analyze-target` | POST | Target profiling and reconnaissance |
+| `/api/error-handling/execute-with-recovery` | POST | Commands with retry/recovery |
+
+## Platform Tools via Adapter Proxy (51 total: 15 gateway + 36 Chapel)
 
 Platform tools provided by the adapter sidecar, proxied from rj-gateway.
 
@@ -123,7 +113,7 @@ Gateway endpoint: `http://rj-gateway.fuzzy-dev.svc.cluster.local:8080/mcp`
 - **GitHub token**: Automatically resolved by gateway
 - **NET_RAW/NET_ADMIN**: Container has network capabilities for security scanning
 - **Rate limits**: GitHub API has rate limits. Space out bulk fetches
-- **Tool timeouts**: MCP tools have per-tool timeouts (5s-600s); see Dhall schemas
+- **Tool timeouts**: MCP tools have a 30s default timeout
 - **Scope**: Only scan tinyland-inc infrastructure and authorized targets
 - **Credentials**: Never store raw credentials in findings — reference by name only