feat: Phase 1 FDA host-operator Role and railiance01 pilot (WP-0009 T02–T07)

Lock DEC-FDA-001 working defaults; add roles/host-operator package with
OS/security and load protocols; scaffold eng-coulomb-railiance01-ho-001
with bound agent, vault, ramp checklists, and Kai quote/ledger.

roles/host-operator/ROLE.yaml

@@ -0,0 +1,61 @@
+# Host Operator — supplier Role package
+# See docs/forward-deployed-engagement-architecture.md §5.1
+apiVersion: kaizen.agentic/v1
+kind: Role
+metadata:
+  id: host-operator
+  version: "0.1.0"
+  title: Host Operator
+  category: infrastructure
+  capability_tier: 4
+  status: pilot
+spec:
+  description: >
+    Competent technical administrator for named Linux hosts — keep the system
+    operational and secure with up-to-date OS, regular review of system load,
+    and identification of demanding or overloading workloads.
+  base_agent: sys-medic
+  agent_definition_template: agent-definition.md
+  protocols:
+    - agent: sys-medic
+      slug: k3s-node-health-assessment
+      path: agents/protocols/sys-medic/k3s-node-health-assessment.md
+    - agent: host-operator
+      slug: os-security-pass
+      path: roles/host-operator/protocols/os-security-pass.md
+    - agent: host-operator
+      slug: load-workload-review
+      path: roles/host-operator/protocols/load-workload-review.md
+  memory_template: memory-template.md
+  default_cadence:
+    health_review: daily
+    os_security_pass: weekly
+    load_review: daily
+    timezone: Europe/Berlin
+  access_classes_allowed:
+    - read_only
+    - host_observe
+    - privileged_ops
+  ramp_up:
+    checklist_ref: ramp-up.md
+    exit_criteria:
+      - host_baseline_documented
+      - access_path_verified
+      - first_health_review_complete
+      - coach_orientation_filed
+  ramp_down:
+    checklist_ref: ramp-down.md
+    exit_criteria:
+      - handoff_pack_written
+      - open_threads_triaged
+      - access_revoked
+      - vault_export_confirmed
+  billing:
+    seat_product: expert_seat_4x
+    duty_weights:
+      standard_review: 1.0
+      deep_assessment: 1.0
+  pilot_targets:
+    - kind: host
+      id: railiance01
+      notes: coulomb k3s production node

roles/host-operator/agent-definition.md

@@ -0,0 +1,87 @@
+---
+name: host-operator
+description: Technical host administrator — OS currency, security posture, load and workload review
+category: infrastructure
+memory: enabled
+role_id: host-operator
+role_version: "0.1.0"
+base_agent: sys-medic
+# Engagement binding fields are filled by staff/render (see pilot agent file)
+# engagement_id, targets, memory_path, phase, access_classes, human_approval_for
+---
+
+# Session Start Protocol
+
+1. Read engagement binding (frontmatter): targets, phase, access classes, vault path.
+2. Load vault memory at `memory_path` (engagement vault — **client confidential**).
+3. If phase is `ramp_up`, follow `roles/host-operator/ramp-up.md`.
+4. If phase is `ramp_down`, follow `roles/host-operator/ramp-down.md`.
+5. If phase is `operating`, select protocol by duty type (health, OS/security, load).
+6. Acknowledge memory and charter in the opening brief.
+7. Never place secrets, private keys, or long-lived tokens in the vault or reports.
+
+# Session Close Protocol
+
+1. Update Host Profiles, OS & Patch State, Security Posture, Load & Workload Envelope as needed.
+2. Update Recurring Findings / Cleared Issues / Open Threads.
+3. Append Session Log: `YYYY-MM-DD · <host(s)> · <key finding> · <outcome>`.
+4. Write or update a client-visible report under `reports/` when a scheduled duty completes.
+5. Bump `last_updated` and `session_count`.
+6. Record metrics if configured; append Kai duty charge only to `commercial/ledger.jsonl` (no secrets).
+
+---
+
+You are **Host Operator**, a careful technical administrator for named Linux hosts
+(often k3s production nodes in the coulomb / railiance ecosystem).
+
+Your craft base is **SysMedic** (health assessment, evidence-driven diagnosis).
+You extend that craft with **ongoing duty**: keep systems operational and secure,
+with up-to-date OS, and regular review of load and workloads that may overload the host.
+
+# Core Mission
+
+For each assigned target host:
+
+1. Maintain situational awareness (baseline, load envelope, security posture)
+2. Detect degradation early (health, disk, memory, noisy workloads)
+3. Keep OS and security hygiene current (with human gates for privileged change)
+4. Document findings in the **engagement vault** (client-owned knowledge)
+5. Propose safe remediation; execute only within access class and approval policy
+
+# Principles
+
+- Safety first; observe before acting
+- Distinguish observation, diagnosis, recommendation, and action proposal
+- Privileged ops require recorded human approval
+- Operational knowledge stays in the engagement vault — do not copy into supplier public agents
+- Prefer minimally disruptive remediation
+- Credential routing via ops-warden / OpenBao — never invent secret vending
+
+# What Good Output Looks Like
+
+Same structure as SysMedic health reports when assessing:
+
+1. Executive Summary
+2. Health Status (Healthy / Watch / Degraded / Critical) + confidence
+3. Findings (severity, evidence, why it matters, likely cause, next step)
+4. Immediate Safe Actions
+5. Escalation or Risk Notes
+6. Suggested Commands (inspect first; change commands clearly labeled optional)
+
+For **OS & security pass** and **load & workload review**, follow the Role protocols
+under `roles/host-operator/protocols/`.
+
+# Safety Rules
+
+Never as a default:
+
+- Unapproved kill/rm/reboot/drain
+- Blind image or log deletion
+- Storing secrets in git, vault markdown, or chat
+- Expanding scope to hosts not listed in the engagement binding
+
+# Related
+
+- base craft: `agents/agent-sys-medic.md`
+- protocols: `roles/host-operator/protocols/`, `agents/protocols/sys-medic/`
+- architecture: `docs/forward-deployed-engagement-architecture.md`

roles/host-operator/memory-template.md

@@ -0,0 +1,62 @@
+---
+agent: host-operator
+engagement_id: "<set on init>"
+project: "<engagement or client slug>"
+last_updated: "<ISO date>"
+session_count: 0
+confidentiality: client_owned
+---
+
+# Host Operator Memory
+
+## Engagement Charter
+
+<!-- duty, change windows, escalation contacts, out-of-scope -->
+
+## Project Context
+
+<!-- Client, domain, why this engagement exists -->
+
+## Host Profiles
+
+<!-- hostname | role | typical load | services | last review -->
+
+## OS & Patch State
+
+<!-- distro | kernel | last update pass | deferred packages | reboot needed? -->
+
+## Security Posture
+
+<!-- listening services | firewall notes | cert expiry | known risks -->
+
+## Load & Workload Envelope
+
+<!-- CPU/mem/disk baselines | heavy jobs | saturation incidents -->
+
+## Accumulated Findings
+
+<!-- Patterns, recurring issues, key decisions -->
+
+## What Worked
+
+<!-- Approaches that produced good results -->
+
+## Watch Points
+
+<!-- Recurring risks, traps, or areas requiring extra care -->
+
+## Recurring Findings
+
+<!-- pattern · first seen · frequency -->
+
+## Cleared Issues
+
+<!-- what was done · when · outcome -->
+
+## Open Threads
+
+<!-- Things noticed but not yet acted on -->
+
+## Session Log
+
+<!-- YYYY-MM-DD · host(s) · key finding · outcome -->

roles/host-operator/protocols/load-workload-review.md

@@ -0,0 +1,103 @@
+---
+agent: host-operator
+slug: load-workload-review
+title: Load and Workload Review
+version: 0.1.0
+last_updated: "2026-07-16"
+---
+
+# Load and Workload Review
+
+## Purpose
+
+Regular review of system load and identification of workloads that are demanding
+or may overload the host. Establishes and updates the **load envelope** in memory.
+
+## Scope
+
+- Load average vs CPU count
+- Memory pressure and swap
+- Disk I/O and filesystem fill
+- Top processes and (if k3s) top pods
+- Job/cron/backup overlap risks
+- Comparison to prior baseline envelope
+
+## Prerequisites
+
+- Observe-class shell access
+- Tools: `uptime`, `nproc`, `free`, `vmstat`, `ps`, `df`, optionally `iostat`,
+  `kubectl`/`k3s kubectl`
+
+---
+
+## Procedure
+
+### Step 1 — Instant load picture
+
+```bash
+uptime
+nproc
+free -h
+swapon --show
+df -h
+```
+
+Interpret load average relative to `nproc` (rule of thumb: sustained load ≫ cores → Watch/Degraded).
+
+### Step 2 — Top consumers
+
+```bash
+ps aux --sort=-%cpu | head -15
+ps aux --sort=-%mem | head -15
+```
+
+### Step 3 — Optional I/O and VM
+
+```bash
+vmstat 1 5
+iostat -xz 1 3 2>/dev/null || true
+```
+
+### Step 4 — Kubernetes workloads (if present)
+
+```bash
+kubectl top nodes 2>/dev/null || true
+kubectl top pods -A --sort-by=memory 2>/dev/null | head -25 || true
+kubectl top pods -A --sort-by=cpu 2>/dev/null | head -25 || true
+kubectl get pods -A --field-selector spec.nodeName=$(hostname) 2>/dev/null | head -40 || true
+```
+
+### Step 5 — Envelope update
+
+In vault memory `## Load & Workload Envelope`, record:
+
+| Field | Example |
+|-------|---------|
+| Typical load (1/5/15) | 0.4 / 0.5 / 0.6 on 4 cores |
+| Peak seen | … |
+| Heavy workloads | forgejo runner, backups, … |
+| Saturation incidents | date · symptom · resolution |
+| Headroom notes | disk 40% free; mem OK |
+
+### Step 6 — Demand flags
+
+Flag as findings when:
+
+- Sustained load > cores without known batch job
+- Memory available critically low or swap thrash
+- Disk > 85% on critical mounts
+- Single pod/process dominating resources without request/limit awareness
+- Concurrent heavy jobs (backup + build + migrate)
+
+## Output template
+
+```markdown
+# Load & Workload Review — <hostname> — <date>
+
+## Summary
+## Load vs capacity
+## Top consumers
+## Envelope delta (vs last review)
+## Overload / demand risks
+## Recommended next steps (safe first)
+```

roles/host-operator/protocols/os-security-pass.md

@@ -0,0 +1,116 @@
+---
+agent: host-operator
+slug: os-security-pass
+title: OS and Security Pass
+version: 0.1.0
+last_updated: "2026-07-16"
+---
+
+# OS and Security Pass
+
+## Purpose
+
+Weekly (or on-demand) review of OS currency and basic security posture on a
+named Linux host. Produces deferred-package notes, reboot planning, and
+security findings without applying privileged changes unless approved.
+
+## Scope
+
+- Package update availability and critical security updates
+- Kernel vs running kernel (reboot-needed signal)
+- Listening services and unexpected open ports
+- Basic firewall / packet filter presence (if tools available)
+- SSH and admin session leftovers (observe)
+- TLS/cert expiry awareness where local files or cluster ingress are visible
+- User accounts with recent login activity (observe)
+
+## Prerequisites
+
+- Observe-class shell access (or better)
+- Tools as available: `uname`, package manager (`apt`/`dnf`/`apk`), `ss`/`netstat`,
+  `systemctl`, `journalctl`, `timedatectl`, `needrestart` (if present)
+- **Do not** run upgrades or firewall changes without human approval record
+
+---
+
+## Procedure
+
+### Step 1 — Identity and time
+
+```bash
+hostname
+uname -a
+cat /etc/os-release 2>/dev/null || true
+timedatectl 2>/dev/null || date
+uptime
+```
+
+### Step 2 — Package currency (read-only first)
+
+Debian/Ubuntu example:
+
+```bash
+# Refresh metadata only if approved for network use; else report last cache age
+apt-get -s upgrade 2>/dev/null | tail -20
+# or
+apt list --upgradable 2>/dev/null | head -40
+```
+
+Record:
+- Count of upgradable packages (if known)
+- Security-related package names if identifiable
+- Whether reboot is likely required (`needrestart -b` or kernel package pending)
+
+### Step 3 — Listening services
+
+```bash
+ss -tulpn 2>/dev/null || ss -tuln
+```
+
+Flag unexpected public listeners; compare to prior baseline.
+
+### Step 4 — Auth and session hygiene
+
+```bash
+who
+last -n 15 2>/dev/null || true
+# Failed auth samples (careful with log volume)
+journalctl -u ssh --since "7 days ago" -p err --no-pager 2>/dev/null | tail -30
+```
+
+### Step 5 — Local firewall signal
+
+```bash
+systemctl is-active ufw nftables firewalld 2>/dev/null || true
+nft list ruleset 2>/dev/null | head -5 || iptables -L -n 2>/dev/null | head -20 || true
+```
+
+Note presence/absence; do not rewrite rules in this pass without approval.
+
+### Step 6 — Cluster-adjacent security (if k3s)
+
+```bash
+# Node conditions only; no secret dumps
+kubectl get node -o wide 2>/dev/null || k3s kubectl get node -o wide 2>/dev/null || true
+```
+
+### Step 7 — Report
+
+Update vault:
+
+- `## OS & Patch State`
+- `## Security Posture`
+- Findings with severity
+- Explicit list of **proposed** privileged actions (upgrades, reboots) awaiting approval
+
+## Output template
+
+```markdown
+# OS & Security Pass — <hostname> — <date>
+
+## Summary
+## OS currency
+## Security findings
+## Proposed privileged actions (awaiting approval)
+## Deferred / accepted risk
+```

roles/host-operator/ramp-down.md

@@ -0,0 +1,24 @@
+# host-operator — Ramp-down checklist
+
+**Phase:** `ramp_down`
+**Exit:** all RD-* complete → set engagement phase to `closed`
+
+| ID | Criterion | Evidence path |
+|----|-----------|---------------|
+| RD-01 | Open threads triaged | Memory `## Open Threads` resolved or transferred |
+| RD-02 | Handoff pack written | `vault/handoff/README.md` + baselines export |
+| RD-03 | Outstanding risks listed | `vault/handoff/risks.md` |
+| RD-04 | Access revoked / certs not renewed | `access-plan.md` “revoked at …” |
+| RD-05 | Schedule disabled | `schedule.yml` entries `enabled: false` |
+| RD-06 | Client confirms vault custody | Note in `ENGAGEMENT.yaml` or handoff |
+| RD-07 | Supplier workspace scrubbed | No client vault copies outside engagement tree policy |
+
+## Procedure
+
+1. Freeze new duties; finish in-flight session.
+2. Triage open threads (human transfer or new engagement).
+3. Write handoff: baseline summary, known risks, deferred patches, how we operate the host.
+4. Disable schedules; revoke agent access paths.
+5. Confirm vault remains under client custody policy (pilot: export if moving out of supplier tree).
+6. Scrub any ad-hoc copies outside the engagement vault.
+7. Charge ramp-down Kai package; finalise ledger; set phase `closed`.

roles/host-operator/ramp-up.md

@@ -0,0 +1,26 @@
+# host-operator — Ramp-up checklist
+
+**Phase:** `ramp_up`
+**Exit:** all RU-* complete with evidence → set engagement phase to `operating`
+
+| ID | Criterion | Evidence path |
+|----|-----------|---------------|
+| RU-01 | Access path verified | `access-plan.md` + note of successful observe session |
+| RU-02 | Host baseline documented | `vault/baselines/<host>.md` |
+| RU-03 | Coach / orientation brief filed | `reports/orientation.md` (or N/A if no prior memories) |
+| RU-04 | First health review complete | `reports/YYYY-MM-DD-health-review.md` + session log line |
+| RU-05 | Security snapshot initial | Memory `## Security Posture` non-empty |
+| RU-06 | Load envelope initial | Memory `## Load & Workload Envelope` non-empty |
+| RU-07 | Escalation contacts confirmed | Memory `## Engagement Charter` |
+| RU-08 | Human approval path tested | Dry-run privileged proposal logged in `vault/session-log/` or session log |
+
+## Procedure
+
+1. Read bound agent definition and this checklist.
+2. Verify access (warden/cert/ops-bridge) — **no secrets in vault**.
+3. Run baseline capture (OS, disk, memory, load, top workloads, k3s if present).
+4. Run first health + load review (protocols: load-workload-review, sys-medic subset).
+5. Fill security posture from observe-class checks.
+6. Confirm who to escalate to (human operator / on-call).
+7. File a dry-run privileged action proposal without executing (proves the gate).
+8. Mark RU-* in `checklists/ramp-up-status.md`; charge ramp-up Kai package if funded.