systems-manager 2.2.3__tar.gz → 2.2.4__tar.gz

{systems_manager-2.2.3 → systems_manager-2.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: systems-manager
-Version: 2.2.3
+Version: 2.2.4
 Summary: Systems Manager will update your system and install/upgrade applications. Additionally, as allow AI to perform these activities as an MCP Server
 Author-email: Project Maintainers <maintainers@users.noreply.github.com>
 License: MIT
@@ -28,7 +28,7 @@ Dynamic: license-file
 
 # systems-manager
 
-Version: 2.2.3
+Version: 2.2.4
 
 `systems-manager` is the typed host-operations provider for Agent Connector SDK and
 Arbora. It exposes cross-platform package, service, process, network, disk,

{systems_manager-2.2.3 → systems_manager-2.2.4}/README.md

@@ -1,6 +1,6 @@
 # systems-manager
 
-Version: 2.2.3
+Version: 2.2.4
 
 `systems-manager` is the typed host-operations provider for Agent Connector SDK and
 Arbora. It exposes cross-platform package, service, process, network, disk,

{systems_manager-2.2.3 → systems_manager-2.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "systems-manager"
-version = "2.2.3"
+version = "2.2.4"
 description = "Systems Manager will update your system and install/upgrade applications. Additionally, as allow AI to perform these activities as an MCP Server"
 readme = "README.md"
 classifiers = [ "Development Status :: 5 - Production/Stable", "License :: Public Domain", "Environment :: Console", "Operating System :: POSIX :: Linux", "Programming Language :: Python :: 3",]

{systems_manager-2.2.3 → systems_manager-2.2.4}/release-readiness.json

@@ -1376,7 +1376,7 @@
   },
   "index": "https://pypi.org/simple",
   "scope": "all-runtime-dependencies",
-  "source_commit": "7a47499055fa25b31cbab0fed091e0177617d9b7",
+  "source_commit": "3ef9a3035bfc16654133b4081b5ee5564a1b5084",
   "contract_commit": "6a8f62af68a6972dc3d76bca9051738c6fe9389e",
   "interpreter": {
     "implementation": "CPython",
@@ -1387,11 +1387,11 @@
   "source_builds": [],
   "wheels": [
     {
-      "file": "systems_manager-2.2.3-py3-none-any.whl",
-      "sha256": "3acc024bbf04f65397b3bf43b0dd1fd52c75bc793c9bac4375e9c62106293449",
+      "file": "systems_manager-2.2.4-py3-none-any.whl",
+      "sha256": "d42f931b1c789c0072c8bc5b708f2a69c9fda5614f183d660e94612e8c7893ab",
       "metadata": {
         "name": "systems-manager",
-        "version": "2.2.3",
+        "version": "2.2.4",
         "requires_python": "<3.15,>=3.12",
         "provides_extra": [
           "mcp",
@@ -1424,11 +1424,11 @@
             "install": [
               {
                 "download_info": {
-                  "url": "file:///tmp/wheel-readiness-ls5igx0b/systems_manager-2.2.3-py3-none-any.whl",
+                  "url": "file:///tmp/wheel-readiness-7xfy_mz8/systems_manager-2.2.4-py3-none-any.whl",
                   "archive_info": {
-                    "hash": "sha256=3acc024bbf04f65397b3bf43b0dd1fd52c75bc793c9bac4375e9c62106293449",
+                    "hash": "sha256=d42f931b1c789c0072c8bc5b708f2a69c9fda5614f183d660e94612e8c7893ab",
                     "hashes": {
-                      "sha256": "3acc024bbf04f65397b3bf43b0dd1fd52c75bc793c9bac4375e9c62106293449"
+                      "sha256": "d42f931b1c789c0072c8bc5b708f2a69c9fda5614f183d660e94612e8c7893ab"
                     }
                   }
                 },
@@ -1438,12 +1438,12 @@
                 "metadata": {
                   "metadata_version": "2.4",
                   "name": "systems-manager",
-                  "version": "2.2.3",
+                  "version": "2.2.4",
                   "dynamic": [
                     "license-file"
                   ],
                   "summary": "Systems Manager will update your system and install/upgrade applications. Additionally, as allow AI to perform these activities as an MCP Server",
-                  "description": "# systems-manager\n\nVersion: 2.2.3\n\n`systems-manager` is the typed host-operations provider for Agent Connector SDK and\nArbora. It exposes cross-platform package, service, process, network, disk,\nmanaged-file, firewall, physical-storage, Agent OS, and privacy-safe host-ingestion\ncapabilities without exposing a raw command tool.\n\nThe current package requires Python 3.11\u20133.14 and\n`agent-connector-sdk>=2.0.0,<3.0.0`.\n\n## Install and run\n\nInstall only the interface the operator need:\n\n```bash\npip install \"systems-manager[mcp]\"\nsystems-manager-mcp --transport stdio\n```\n\nThe optional extras are:\n\n| Extra | Capability |\n| --- | --- |\n| `mcp` | FastMCP provider runtime |\n| `agent` | Agent server and Logfire integration |\n| `all` | MCP plus agent runtime |\n| `test` | Test dependencies |\n\nFor an ephemeral MCP start:\n\n```bash\nuvx --from \"systems-manager[mcp]\" systems-manager-mcp --transport stdio\n```\n\nThe checked-in `mcp_config.json` is a reference-only client catalog. It contains\n`env://` references and safe deny defaults, never deployment endpoints, credentials,\ncertificate paths, filesystem paths, hostnames, or identities. Project-specific values\nbelong in AgentConfig or the process launcher.\n\n## Security contract\n\n- Network MCP listeners require configured authentication. Non-loopback listeners also\n  require direct TLS or a trusted TLS-stop proxy, exact allowed hosts, and the\n  current Agent Connector SDK transport checks.\n- Host mutations are denied unless `SYSTEMS_MANAGER_ALLOW_HOST_MUTATIONS=true` and the\n  individual request receives destructive-operation approval.\n- Managed-file writes also require\n  `SYSTEMS_MANAGER_ALLOW_FILESYSTEM_MUTATIONS=true`.\n- Sensitive reads and active probes have independent default-deny gates.\n- Managed paths are confined beneath an explicit\n  `SYSTEMS_MANAGER_FILESYSTEM_ROOT`; there is no working-directory fallback.\n- Raw shell, arbitrary commands, plaintext credentials, model-authored cron creation,\n  and compatibility command aliases are not capabilities.\n- Logs and observability are metadata-only. Keep `LANGFUSE_CAPTURE_CONTENT=false`.\n\n## AgentConfig, secrets, and TLS\n\nUse `TLS_PROFILE` / `TLS_PROFILE_REF` with `TLS_PROFILES_REF` for shared checked\noutbound trust. Service-specific profiles such as `OIDC_TLS_PROFILE_REF`,\n`MODEL_TLS_PROFILE_REF`, and `LANGFUSE_TLS_PROFILE_REF` may select entries from the\nsame runtime catalog. Do not hardcode CA paths or verification flags in application\ncode, and do not disable verification for incomplete certificate chains.\n\nOut-of-band BMC health reads consume one runtime secret projection from\n`SYSTEMS_MANAGER_BMC_CREDENTIALS`. AgentConfig resolves the checked `env://` or secret\nreference before start; the provider accepts exactly a JSON object with `host`, `user`,\nand `password`. No secret-store vendor, secret path, token, or credential value is\nembedded in this package.\n\nThe MCP listener's own certificate or trusted-proxy boundary uses the current Agent\nUtilities `MCP_TLS_*` configuration. The optional agent listener uses `SERVER_TLS_*`\nand requires JWT configuration for non-loopback serving.\n\n## MCP tools\n\nThe default `MCP_TOOL_MODE=intent` exposes the small intent-verb surface. Backing\naction-routed tools stay available for governed discovery and on-demand loading. Tool\nand tag filters can further reduce the visible surface.\n\n_Auto-generated from the live MCP server; do not edit between the markers._\n\n<!-- MCP-TOOLS-TABLE:START -->\n\n#### Condensed action-routed tools (`MCP_TOOL_MODE=condensed`)\n\n| MCP Tool | Toggle Env Var | Description |\n|----------|----------------|-------------|\n| `capture_system_snapshot` | `OS_PROVIDERTOOL` | Takes a point-in-time snapshot of the system state (CPU, RAM, Processes). |\n| `get_management_capabilities` | \u2014 |  |\n| `get_network_connections` | `OS_PROVIDERTOOL` | Maps active TCP/UDP endpoints directly to owning processes. |\n| `get_process_details` | `OS_PROVIDERTOOL` | Retrieves deep cross-platform process details (threads, modules, memory). |\n| `health_check` | \u2014 |  |\n| `list_kernel_modules` | `OS_PROVIDERTOOL` | List loaded drivers/modules (lsmod or driverquery). |\n| `list_services` | `OS_PROVIDERTOOL` | Cross-platform service enumeration (systemctl or Get-Service). |\n| `manage_service` | `OS_PROVIDERTOOL` | Start/Stop/Restart/Enable/Disable services cross-platform. |\n| `query_system_logs` | `OS_PROVIDERTOOL` | Cross-platform log querying (journalctl or Get-WinEvent). |\n| `sm_advanced_operations` | \u2014 | Operations for SSH and specialized managers |\n| `sm_agent_identity_operations` | `IDENTITYTOOL` | Issues or verifies privacy-preserving agent identities. |\n| `sm_agent_scheduler_operations` | `AGENT_HEALTHTOOL` | Manages the cognitive scheduler: get stats, list processes, preempt, or reset quota. |\n| `sm_agent_specialist_operations` | `SPECIALIST_REGISTRYTOOL` | Manages specialist packages: install, uninstall, list, or search. |\n| `sm_agent_watchdog_operations` | `WATCHDOGTOOL` | Manages file watchdog triggers: check file change, list active watchers, or drain triggers. |\n| `sm_cron_operations` | \u2014 | Operations for cron jobs |\n| `sm_disk_operations` | \u2014 | Operations for managing system disks |\n| `sm_file_operations` | \u2014 | Operations for file and log management |\n| `sm_firewall_operations` | \u2014 | Operations for firewall management |\n| `sm_network_operations` | \u2014 | Operations for network analysis |\n| `sm_process_operations` | \u2014 | Operations for managing system processes |\n| `sm_service_operations` | \u2014 | Operations for managing system services |\n| `sm_storage_health` | `STORAGE_HEALTHTOOL` | Physical disk + BMC drive-fault health: SMART (incl. megaraid passthrough), |\n| `sm_system_operations` | \u2014 | System operations for managing packages, system health, and updates |\n| `sm_user_operations` | \u2014 | Operations for user and group management |\n| `start_system_trace` | `OS_PROVIDERTOOL` | Start a kernel-level event trace (ETW on Windows, or strace on Linux). |\n| `stop_system_trace` | `OS_PROVIDERTOOL` | Stop a kernel-level event trace. |\n| `systems_ingest_host` | \u2014 | Ingest a keyed host telemetry projection through the governed ChangeEnvelope boundary as typed HardwareNode, NetworkInterface, and DiskVolume nodes. |\n\n_27 action-routed tool(s) \u00b7 0 verbose 1:1 tool(s). Each is enabled unless its `<DOMAIN>TOOL` toggle is set false; `MCP_TOOL_MODE` selects the surface (**`intent` default** \u2014 the six verb-tools, granular set loaded on demand \u00b7 `condensed` action-routed \u00b7 `verbose` 1:1 \u00b7 `both`). Auto-generated \u2014 do not edit._\n<!-- MCP-TOOLS-TABLE:END -->\n\nTypical backing domains include OS/package lifecycle, services, processes, networks,\ndisks, managed files, cron removal, structured firewall rules, storage/BMC diagnostics,\nAgent OS administration, and governed host telemetry ingestion. Discover an action\nschema before calling it; unavailable operations must not be emulated with another\ntool.\n\n## Knowledge-graph ingestion\n\n`systems_ingest_host` reads local typed telemetry and submits an allowlisted projection\nthrough the Agent Connector SDK native governed ingestion boundary. It emits only:\n\n- `HardwareNode`, `NetworkInterface`, and `DiskVolume` nodes;\n- `hasInterface` and `hasVolume` relationships;\n- HMAC-SHA-256 opaque identifiers derived with the deployment-owned\n  `SYSTEMS_MANAGER_PSEUDONYMIZATION_KEY`.\n\nHostnames, network addresses, hardware addresses, usernames, local paths, credentials,\nand arbitrary extra fields are rejected or excluded. Missing graph authority, invalid\ncontent, and unavailable ingestion fail explicitly; they are not silent no-ops.\n\n## Arbora delegation\n\nHost operations run inside the service's local operating-system boundary. For\nfleet work, Arbora delegates to an authenticated systems-manager service on the target\nboundary. Inventory, endpoints, credentials, TLS profiles, and target aliases remain\nexternal deployment configuration. Persist only opaque, non-personal references.\n\nThe bundled `systems-manager-operations` skill covers every current provider workflow.\nOlder BMC command and NIC-bond script skills were consolidated because those raw-script\nsurfaces are not part of the typed current contract.\n\n## Agent server\n\nInstall the agent extra and start:\n\n```bash\nsystems-manager-agent --help\n```\n\nWorkspace, MCP catalog, and custom-skill paths are accepted only when explicitly\nconfigured and present. There is no packaged-config or current-directory fallback.\nA non-loopback listener requires an explicit allow gate, direct or trusted-proxy TLS,\nJWT issuer/JWKS/audience configuration, and debug mode disabled.\n\n## Environment variables\n\nThe generated table is sourced from the value-free `.env.example` plus the inherited\nAgent Connector SDK contract.\n\n<!-- ENV-VARS-TABLE:START -->\n\n#### Package environment variables\n\n| Variable | Example | Description |\n|----------|---------|-------------|\n| `SYSTEMS_MANAGER_FILESYSTEM_ROOT` | \u2014 | Required managed filesystem boundary |\n| `SYSTEMS_MANAGER_TEMP_ROOT` | \u2014 | Optional cleanup root beneath the managed boundary |\n| `SYSTEMS_MANAGER_PSEUDONYMIZATION_KEY` | secret-injected | Deployment-owned secret, at least 32 bytes |\n| `SYSTEMS_MANAGER_BMC_CREDENTIALS` | \u2014 | Secret-projected JSON with host/user/password |\n| `TLS_PROFILE` | \u2014 | Shared mandatory-verification transport profile |\n| `TLS_PROFILES_REF` | \u2014 | Runtime reference to the transport profile catalog |\n| `LANGFUSE_TLS_PROFILE_REF` | \u2014 | Runtime reference to verified Langfuse trust |\n| `MCP_TOOL_MODE` | `intent` | Current intent-first tool surface |\n| `SYSTEMS_MANAGER_ALLOW_HOST_MUTATIONS` | `false` | Default-deny host mutations |\n| `SYSTEMS_MANAGER_ALLOW_FILESYSTEM_MUTATIONS` | `false` | Default-deny file mutations |\n| `SYSTEMS_MANAGER_ALLOW_SENSITIVE_READS` | `false` | Default-deny sensitive inventory |\n| `SYSTEMS_MANAGER_ALLOW_NETWORK_PROBES` | `false` | Default-deny active probes |\n| `SYSTEMS_MANAGER_MAX_BLOCKING_OPERATIONS` | `2` | Bounded host-operation concurrency |\n| `SYSTEMS_MANAGER_HEALTH_INGEST` | `true` | Enable governed health trend ingestion |\n| `SYSTEMS_MANAGER_HEALTH_AGGREGATE_S` | `3600` | Health trend aggregation window |\n| `SYSTEMS_MANAGER_NODE_REF` | \u2014 | Runtime node alias; only a keyed digest persists |\n| `SYSTEMS_MANAGER_NOTIFY_TLS_PROFILE` | \u2014 | Optional inline mandatory-verification notification TLS profile |\n| `SYSTEMS_MANAGER_NOTIFY_TLS_PROFILE_REF` | \u2014 | Runtime reference to the notification TLS profile |\n| `SYSTEMS_MANAGER_MCP_IMAGE_DIGEST` | \u2014 | Required immutable MCP image digest |\n| `SYSTEMS_MANAGER_REPOSITORY_ALLOWLIST_JSON` | `[]` | Approved credential-free repositories |\n| `SYSTEMS_MANAGER_LOCAL_PACKAGE_SHA256_MAP` | `{}` | Approved package paths and digests |\n| `SYSTEMS_MANAGER_COMMAND_TIMEOUT_SECONDS` | `120` | Default command timeout |\n| `SYSTEMS_MANAGER_ENV_METADATA_ALLOWLIST` | \u2014 | Non-sensitive environment names readable as metadata |\n| `SYSTEMS_MANAGER_UV_VERSION` | \u2014 | Exact approved uv release |\n| `SYSTEMS_MANAGER_NVM_COMMIT` | \u2014 | Exact approved NVM commit |\n| `SYSTEMS_MANAGER_NVM_DIR` | \u2014 | NVM directory beneath the managed filesystem root |\n| `ALLOW_UPDATE_ON_K8S` | `false` | Keep Kubernetes lifecycle guard enabled |\n| `MISCTOOL` | `true` | Register base health/readiness tools |\n| `OS_PROVIDERTOOL` | `true` | Register operating-system provider tools |\n| `STORAGE_HEALTHTOOL` | `true` | Register storage health tools |\n| `TRANSPORT` | `stdio` | Local MCP transport |\n| `HOST` | `127.0.0.1` | Loopback bind for HTTP transports |\n| `PORT` | `8000` | Bind port for HTTP transports |\n| `ENABLE_OTEL` | `false` | Enable only with an approved collector |\n\n#### Inherited agent-connector-sdk variables (apply to every connector)\n\n| Variable | Example | Description |\n|----------|---------|-------------|\n| `MCP_ENABLED_TOOLS` | \u2014 | Comma-separated tool allow-list |\n| `MCP_DISABLED_TOOLS` | \u2014 | Comma-separated tool deny-list |\n| `MCP_ENABLED_TAGS` | \u2014 | Comma-separated tag allow-list |\n| `MCP_DISABLED_TAGS` | \u2014 | Comma-separated tag deny-list |\n| `EUNOMIA_TYPE` | `none` | Authorization mode: `none` \\| `embedded` \\| `remote` |\n| `EUNOMIA_POLICY_FILE` | `mcp_policies.json` | Embedded Eunomia policy file |\n| `EUNOMIA_REMOTE_URL` | \u2014 | Remote Eunomia authorization server URL |\n| `OTEL_EXPORTER_OTLP_ENDPOINT` | \u2014 | OTLP collector endpoint |\n| `MCP_CLIENT_AUTH` | \u2014 | Outbound MCP child auth: `oidc-client-credentials` \\| `basic` \\| `none` |\n| `OIDC_CLIENT_ID` | \u2014 | OIDC client id (service-account auth) |\n| `OIDC_CLIENT_SECRET_REF` | `secret://identity/oidc-client-secret` | Runtime secret reference for the OIDC service account |\n| `MCP_BASIC_AUTH_USERNAME` | \u2014 | HTTP Basic username (`MCP_CLIENT_AUTH=basic`) |\n| `MCP_BASIC_AUTH_PASSWORD_REF` | `secret://identity/mcp-basic-password` | Runtime secret reference for HTTP Basic auth (`MCP_CLIENT_AUTH=basic`) |\n| `DEBUG` | `False` | Verbose logging |\n| `PYTHONUNBUFFERED` | `1` | Unbuffered stdout (recommended in containers) |\n| `MCP_URL` | `http://localhost:8000/mcp` | URL of the MCP server the agent connects to |\n| `PROVIDER` | `openai` | LLM provider for the agent |\n| `MODEL_ID` | `gpt-4o` | Model id for the agent |\n| `ENABLE_WEB_UI` | `True` | Serve the AG-UI web interface |\n\n_51 package + 19 inherited variable(s). Auto-generated from `.env.example` + the shared agent-connector-sdk set \u2014 do not edit._\n<!-- ENV-VARS-TABLE:END -->\n\n## Development and release gates\n\n```bash\npytest -q\nruff check systems_manager tests\nblack --check systems_manager tests\nmkdocs build --strict\npre-commit run --all-files\n```\n\nRun host operations only through mocks during tests. Do not run native builds or live\nhost mutations as a validation shortcut. The source dependency floor is intentionally\n`agent-connector-sdk>=2.0.0`; regenerate and commit a neutral lock only after that release\nis available from the configured package index. Never commit an editable local source\nor a stale dependency resolution.\n\nSee [the documentation](docs/index.md) for installation, deployment, configuration,\nusage, multi-host delegation, and security details.\n\n\n\n<!-- GOVERNED-CAPABILITY:START -->\n## Governed capability contract\n\nThis package ships a compact canonical skill surface with specialist procedures\nkept as referenced workflows. The current MCP tools, skill metadata,\n`connector_manifest.yml`, ontology, mappings, shapes, fixtures, migrations,\ntool-schema fingerprints, and certification metadata form one versioned\ncapability contract. Validate them together; do not rely on stale tool names or\nhistorical per-task skill wrappers.\n\nRuntime endpoints, credentials, certificate trust, tenant identity, retention,\nand observability policy are deployment inputs and are never packaged values.\nSee [Configuration, trust, and privacy](docs/configuration.md) before enabling a\nnetwork transport, connector ingestion, Arbora delegation, or trace export.\n<!-- GOVERNED-CAPABILITY:END -->\n",
+                  "description": "# systems-manager\n\nVersion: 2.2.4\n\n`systems-manager` is the typed host-operations provider for Agent Connector SDK and\nArbora. It exposes cross-platform package, service, process, network, disk,\nmanaged-file, firewall, physical-storage, Agent OS, and privacy-safe host-ingestion\ncapabilities without exposing a raw command tool.\n\nThe current package requires Python 3.11\u20133.14 and\n`agent-connector-sdk>=2.0.0,<3.0.0`.\n\n## Install and run\n\nInstall only the interface the operator need:\n\n```bash\npip install \"systems-manager[mcp]\"\nsystems-manager-mcp --transport stdio\n```\n\nThe optional extras are:\n\n| Extra | Capability |\n| --- | --- |\n| `mcp` | FastMCP provider runtime |\n| `agent` | Agent server and Logfire integration |\n| `all` | MCP plus agent runtime |\n| `test` | Test dependencies |\n\nFor an ephemeral MCP start:\n\n```bash\nuvx --from \"systems-manager[mcp]\" systems-manager-mcp --transport stdio\n```\n\nThe checked-in `mcp_config.json` is a reference-only client catalog. It contains\n`env://` references and safe deny defaults, never deployment endpoints, credentials,\ncertificate paths, filesystem paths, hostnames, or identities. Project-specific values\nbelong in AgentConfig or the process launcher.\n\n## Security contract\n\n- Network MCP listeners require configured authentication. Non-loopback listeners also\n  require direct TLS or a trusted TLS-stop proxy, exact allowed hosts, and the\n  current Agent Connector SDK transport checks.\n- Host mutations are denied unless `SYSTEMS_MANAGER_ALLOW_HOST_MUTATIONS=true` and the\n  individual request receives destructive-operation approval.\n- Managed-file writes also require\n  `SYSTEMS_MANAGER_ALLOW_FILESYSTEM_MUTATIONS=true`.\n- Sensitive reads and active probes have independent default-deny gates.\n- Managed paths are confined beneath an explicit\n  `SYSTEMS_MANAGER_FILESYSTEM_ROOT`; there is no working-directory fallback.\n- Raw shell, arbitrary commands, plaintext credentials, model-authored cron creation,\n  and compatibility command aliases are not capabilities.\n- Logs and observability are metadata-only. Keep `LANGFUSE_CAPTURE_CONTENT=false`.\n\n## AgentConfig, secrets, and TLS\n\nUse `TLS_PROFILE` / `TLS_PROFILE_REF` with `TLS_PROFILES_REF` for shared checked\noutbound trust. Service-specific profiles such as `OIDC_TLS_PROFILE_REF`,\n`MODEL_TLS_PROFILE_REF`, and `LANGFUSE_TLS_PROFILE_REF` may select entries from the\nsame runtime catalog. Do not hardcode CA paths or verification flags in application\ncode, and do not disable verification for incomplete certificate chains.\n\nOut-of-band BMC health reads consume one runtime secret projection from\n`SYSTEMS_MANAGER_BMC_CREDENTIALS`. AgentConfig resolves the checked `env://` or secret\nreference before start; the provider accepts exactly a JSON object with `host`, `user`,\nand `password`. No secret-store vendor, secret path, token, or credential value is\nembedded in this package.\n\nThe MCP listener's own certificate or trusted-proxy boundary uses the current Agent\nUtilities `MCP_TLS_*` configuration. The optional agent listener uses `SERVER_TLS_*`\nand requires JWT configuration for non-loopback serving.\n\n## MCP tools\n\nThe default `MCP_TOOL_MODE=intent` exposes the small intent-verb surface. Backing\naction-routed tools stay available for governed discovery and on-demand loading. Tool\nand tag filters can further reduce the visible surface.\n\n_Auto-generated from the live MCP server; do not edit between the markers._\n\n<!-- MCP-TOOLS-TABLE:START -->\n\n#### Condensed action-routed tools (`MCP_TOOL_MODE=condensed`)\n\n| MCP Tool | Toggle Env Var | Description |\n|----------|----------------|-------------|\n| `capture_system_snapshot` | `OS_PROVIDERTOOL` | Takes a point-in-time snapshot of the system state (CPU, RAM, Processes). |\n| `get_management_capabilities` | \u2014 |  |\n| `get_network_connections` | `OS_PROVIDERTOOL` | Maps active TCP/UDP endpoints directly to owning processes. |\n| `get_process_details` | `OS_PROVIDERTOOL` | Retrieves deep cross-platform process details (threads, modules, memory). |\n| `health_check` | \u2014 |  |\n| `list_kernel_modules` | `OS_PROVIDERTOOL` | List loaded drivers/modules (lsmod or driverquery). |\n| `list_services` | `OS_PROVIDERTOOL` | Cross-platform service enumeration (systemctl or Get-Service). |\n| `manage_service` | `OS_PROVIDERTOOL` | Start/Stop/Restart/Enable/Disable services cross-platform. |\n| `query_system_logs` | `OS_PROVIDERTOOL` | Cross-platform log querying (journalctl or Get-WinEvent). |\n| `sm_advanced_operations` | \u2014 | Operations for SSH and specialized managers |\n| `sm_agent_identity_operations` | `IDENTITYTOOL` | Issues or verifies privacy-preserving agent identities. |\n| `sm_agent_scheduler_operations` | `AGENT_HEALTHTOOL` | Manages the cognitive scheduler: get stats, list processes, preempt, or reset quota. |\n| `sm_agent_specialist_operations` | `SPECIALIST_REGISTRYTOOL` | Manages specialist packages: install, uninstall, list, or search. |\n| `sm_agent_watchdog_operations` | `WATCHDOGTOOL` | Manages file watchdog triggers: check file change, list active watchers, or drain triggers. |\n| `sm_cron_operations` | \u2014 | Operations for cron jobs |\n| `sm_disk_operations` | \u2014 | Operations for managing system disks |\n| `sm_file_operations` | \u2014 | Operations for file and log management |\n| `sm_firewall_operations` | \u2014 | Operations for firewall management |\n| `sm_network_operations` | \u2014 | Operations for network analysis |\n| `sm_process_operations` | \u2014 | Operations for managing system processes |\n| `sm_service_operations` | \u2014 | Operations for managing system services |\n| `sm_storage_health` | `STORAGE_HEALTHTOOL` | Physical disk + BMC drive-fault health: SMART (incl. megaraid passthrough), |\n| `sm_system_operations` | \u2014 | System operations for managing packages, system health, and updates |\n| `sm_user_operations` | \u2014 | Operations for user and group management |\n| `start_system_trace` | `OS_PROVIDERTOOL` | Start a kernel-level event trace (ETW on Windows, or strace on Linux). |\n| `stop_system_trace` | `OS_PROVIDERTOOL` | Stop a kernel-level event trace. |\n| `systems_ingest_host` | \u2014 | Ingest a keyed host telemetry projection through the governed ChangeEnvelope boundary as typed HardwareNode, NetworkInterface, and DiskVolume nodes. |\n\n_27 action-routed tool(s) \u00b7 0 verbose 1:1 tool(s). Each is enabled unless its `<DOMAIN>TOOL` toggle is set false; `MCP_TOOL_MODE` selects the surface (**`intent` default** \u2014 the six verb-tools, granular set loaded on demand \u00b7 `condensed` action-routed \u00b7 `verbose` 1:1 \u00b7 `both`). Auto-generated \u2014 do not edit._\n<!-- MCP-TOOLS-TABLE:END -->\n\nTypical backing domains include OS/package lifecycle, services, processes, networks,\ndisks, managed files, cron removal, structured firewall rules, storage/BMC diagnostics,\nAgent OS administration, and governed host telemetry ingestion. Discover an action\nschema before calling it; unavailable operations must not be emulated with another\ntool.\n\n## Knowledge-graph ingestion\n\n`systems_ingest_host` reads local typed telemetry and submits an allowlisted projection\nthrough the Agent Connector SDK native governed ingestion boundary. It emits only:\n\n- `HardwareNode`, `NetworkInterface`, and `DiskVolume` nodes;\n- `hasInterface` and `hasVolume` relationships;\n- HMAC-SHA-256 opaque identifiers derived with the deployment-owned\n  `SYSTEMS_MANAGER_PSEUDONYMIZATION_KEY`.\n\nHostnames, network addresses, hardware addresses, usernames, local paths, credentials,\nand arbitrary extra fields are rejected or excluded. Missing graph authority, invalid\ncontent, and unavailable ingestion fail explicitly; they are not silent no-ops.\n\n## Arbora delegation\n\nHost operations run inside the service's local operating-system boundary. For\nfleet work, Arbora delegates to an authenticated systems-manager service on the target\nboundary. Inventory, endpoints, credentials, TLS profiles, and target aliases remain\nexternal deployment configuration. Persist only opaque, non-personal references.\n\nThe bundled `systems-manager-operations` skill covers every current provider workflow.\nOlder BMC command and NIC-bond script skills were consolidated because those raw-script\nsurfaces are not part of the typed current contract.\n\n## Agent server\n\nInstall the agent extra and start:\n\n```bash\nsystems-manager-agent --help\n```\n\nWorkspace, MCP catalog, and custom-skill paths are accepted only when explicitly\nconfigured and present. There is no packaged-config or current-directory fallback.\nA non-loopback listener requires an explicit allow gate, direct or trusted-proxy TLS,\nJWT issuer/JWKS/audience configuration, and debug mode disabled.\n\n## Environment variables\n\nThe generated table is sourced from the value-free `.env.example` plus the inherited\nAgent Connector SDK contract.\n\n<!-- ENV-VARS-TABLE:START -->\n\n#### Package environment variables\n\n| Variable | Example | Description |\n|----------|---------|-------------|\n| `SYSTEMS_MANAGER_FILESYSTEM_ROOT` | \u2014 | Required managed filesystem boundary |\n| `SYSTEMS_MANAGER_TEMP_ROOT` | \u2014 | Optional cleanup root beneath the managed boundary |\n| `SYSTEMS_MANAGER_PSEUDONYMIZATION_KEY` | secret-injected | Deployment-owned secret, at least 32 bytes |\n| `SYSTEMS_MANAGER_BMC_CREDENTIALS` | \u2014 | Secret-projected JSON with host/user/password |\n| `TLS_PROFILE` | \u2014 | Shared mandatory-verification transport profile |\n| `TLS_PROFILES_REF` | \u2014 | Runtime reference to the transport profile catalog |\n| `LANGFUSE_TLS_PROFILE_REF` | \u2014 | Runtime reference to verified Langfuse trust |\n| `MCP_TOOL_MODE` | `intent` | Current intent-first tool surface |\n| `SYSTEMS_MANAGER_ALLOW_HOST_MUTATIONS` | `false` | Default-deny host mutations |\n| `SYSTEMS_MANAGER_ALLOW_FILESYSTEM_MUTATIONS` | `false` | Default-deny file mutations |\n| `SYSTEMS_MANAGER_ALLOW_SENSITIVE_READS` | `false` | Default-deny sensitive inventory |\n| `SYSTEMS_MANAGER_ALLOW_NETWORK_PROBES` | `false` | Default-deny active probes |\n| `SYSTEMS_MANAGER_MAX_BLOCKING_OPERATIONS` | `2` | Bounded host-operation concurrency |\n| `SYSTEMS_MANAGER_HEALTH_INGEST` | `true` | Enable governed health trend ingestion |\n| `SYSTEMS_MANAGER_HEALTH_AGGREGATE_S` | `3600` | Health trend aggregation window |\n| `SYSTEMS_MANAGER_NODE_REF` | \u2014 | Runtime node alias; only a keyed digest persists |\n| `SYSTEMS_MANAGER_NOTIFY_TLS_PROFILE` | \u2014 | Optional inline mandatory-verification notification TLS profile |\n| `SYSTEMS_MANAGER_NOTIFY_TLS_PROFILE_REF` | \u2014 | Runtime reference to the notification TLS profile |\n| `SYSTEMS_MANAGER_MCP_IMAGE_DIGEST` | \u2014 | Required immutable MCP image digest |\n| `SYSTEMS_MANAGER_REPOSITORY_ALLOWLIST_JSON` | `[]` | Approved credential-free repositories |\n| `SYSTEMS_MANAGER_LOCAL_PACKAGE_SHA256_MAP` | `{}` | Approved package paths and digests |\n| `SYSTEMS_MANAGER_COMMAND_TIMEOUT_SECONDS` | `120` | Default command timeout |\n| `SYSTEMS_MANAGER_ENV_METADATA_ALLOWLIST` | \u2014 | Non-sensitive environment names readable as metadata |\n| `SYSTEMS_MANAGER_UV_VERSION` | \u2014 | Exact approved uv release |\n| `SYSTEMS_MANAGER_NVM_COMMIT` | \u2014 | Exact approved NVM commit |\n| `SYSTEMS_MANAGER_NVM_DIR` | \u2014 | NVM directory beneath the managed filesystem root |\n| `ALLOW_UPDATE_ON_K8S` | `false` | Keep Kubernetes lifecycle guard enabled |\n| `MISCTOOL` | `true` | Register base health/readiness tools |\n| `OS_PROVIDERTOOL` | `true` | Register operating-system provider tools |\n| `STORAGE_HEALTHTOOL` | `true` | Register storage health tools |\n| `TRANSPORT` | `stdio` | Local MCP transport |\n| `HOST` | `127.0.0.1` | Loopback bind for HTTP transports |\n| `PORT` | `8000` | Bind port for HTTP transports |\n| `ENABLE_OTEL` | `false` | Enable only with an approved collector |\n\n#### Inherited agent-connector-sdk variables (apply to every connector)\n\n| Variable | Example | Description |\n|----------|---------|-------------|\n| `MCP_ENABLED_TOOLS` | \u2014 | Comma-separated tool allow-list |\n| `MCP_DISABLED_TOOLS` | \u2014 | Comma-separated tool deny-list |\n| `MCP_ENABLED_TAGS` | \u2014 | Comma-separated tag allow-list |\n| `MCP_DISABLED_TAGS` | \u2014 | Comma-separated tag deny-list |\n| `EUNOMIA_TYPE` | `none` | Authorization mode: `none` \\| `embedded` \\| `remote` |\n| `EUNOMIA_POLICY_FILE` | `mcp_policies.json` | Embedded Eunomia policy file |\n| `EUNOMIA_REMOTE_URL` | \u2014 | Remote Eunomia authorization server URL |\n| `OTEL_EXPORTER_OTLP_ENDPOINT` | \u2014 | OTLP collector endpoint |\n| `MCP_CLIENT_AUTH` | \u2014 | Outbound MCP child auth: `oidc-client-credentials` \\| `basic` \\| `none` |\n| `OIDC_CLIENT_ID` | \u2014 | OIDC client id (service-account auth) |\n| `OIDC_CLIENT_SECRET_REF` | `secret://identity/oidc-client-secret` | Runtime secret reference for the OIDC service account |\n| `MCP_BASIC_AUTH_USERNAME` | \u2014 | HTTP Basic username (`MCP_CLIENT_AUTH=basic`) |\n| `MCP_BASIC_AUTH_PASSWORD_REF` | `secret://identity/mcp-basic-password` | Runtime secret reference for HTTP Basic auth (`MCP_CLIENT_AUTH=basic`) |\n| `DEBUG` | `False` | Verbose logging |\n| `PYTHONUNBUFFERED` | `1` | Unbuffered stdout (recommended in containers) |\n| `MCP_URL` | `http://localhost:8000/mcp` | URL of the MCP server the agent connects to |\n| `PROVIDER` | `openai` | LLM provider for the agent |\n| `MODEL_ID` | `gpt-4o` | Model id for the agent |\n| `ENABLE_WEB_UI` | `True` | Serve the AG-UI web interface |\n\n_51 package + 19 inherited variable(s). Auto-generated from `.env.example` + the shared agent-connector-sdk set \u2014 do not edit._\n<!-- ENV-VARS-TABLE:END -->\n\n## Development and release gates\n\n```bash\npytest -q\nruff check systems_manager tests\nblack --check systems_manager tests\nmkdocs build --strict\npre-commit run --all-files\n```\n\nRun host operations only through mocks during tests. Do not run native builds or live\nhost mutations as a validation shortcut. The source dependency floor is intentionally\n`agent-connector-sdk>=2.0.0`; regenerate and commit a neutral lock only after that release\nis available from the configured package index. Never commit an editable local source\nor a stale dependency resolution.\n\nSee [the documentation](docs/index.md) for installation, deployment, configuration,\nusage, multi-host delegation, and security details.\n\n\n\n<!-- GOVERNED-CAPABILITY:START -->\n## Governed capability contract\n\nThis package ships a compact canonical skill surface with specialist procedures\nkept as referenced workflows. The current MCP tools, skill metadata,\n`connector_manifest.yml`, ontology, mappings, shapes, fixtures, migrations,\ntool-schema fingerprints, and certification metadata form one versioned\ncapability contract. Validate them together; do not rely on stale tool names or\nhistorical per-task skill wrappers.\n\nRuntime endpoints, credentials, certificate trust, tenant identity, retention,\nand observability policy are deployment inputs and are never packaged values.\nSee [Configuration, trust, and privacy](docs/configuration.md) before enabling a\nnetwork transport, connector ingestion, Arbora delegation, or trace export.\n<!-- GOVERNED-CAPABILITY:END -->\n",
                   "description_content_type": "text/markdown",
                   "author_email": "Project Maintainers <maintainers@users.noreply.github.com>",
                   "license": "MIT",
@@ -6786,11 +6786,11 @@
             "install": [
               {
                 "download_info": {
-                  "url": "file:///tmp/wheel-readiness-ls5igx0b/systems_manager-2.2.3-py3-none-any.whl",
+                  "url": "file:///tmp/wheel-readiness-7xfy_mz8/systems_manager-2.2.4-py3-none-any.whl",
                   "archive_info": {
-                    "hash": "sha256=3acc024bbf04f65397b3bf43b0dd1fd52c75bc793c9bac4375e9c62106293449",
+                    "hash": "sha256=d42f931b1c789c0072c8bc5b708f2a69c9fda5614f183d660e94612e8c7893ab",
                     "hashes": {
-                      "sha256": "3acc024bbf04f65397b3bf43b0dd1fd52c75bc793c9bac4375e9c62106293449"
+                      "sha256": "d42f931b1c789c0072c8bc5b708f2a69c9fda5614f183d660e94612e8c7893ab"
                     }
                   }
                 },
@@ -6800,12 +6800,12 @@
                 "metadata": {
                   "metadata_version": "2.4",
                   "name": "systems-manager",
-                  "version": "2.2.3",
+                  "version": "2.2.4",
                   "dynamic": [
                     "license-file"
                   ],
                   "summary": "Systems Manager will update your system and install/upgrade applications. Additionally, as allow AI to perform these activities as an MCP Server",
-                  "description": "# systems-manager\n\nVersion: 2.2.3\n\n`systems-manager` is the typed host-operations provider for Agent Connector SDK and\nArbora. It exposes cross-platform package, service, process, network, disk,\nmanaged-file, firewall, physical-storage, Agent OS, and privacy-safe host-ingestion\ncapabilities without exposing a raw command tool.\n\nThe current package requires Python 3.11\u20133.14 and\n`agent-connector-sdk>=2.0.0,<3.0.0`.\n\n## Install and run\n\nInstall only the interface the operator need:\n\n```bash\npip install \"systems-manager[mcp]\"\nsystems-manager-mcp --transport stdio\n```\n\nThe optional extras are:\n\n| Extra | Capability |\n| --- | --- |\n| `mcp` | FastMCP provider runtime |\n| `agent` | Agent server and Logfire integration |\n| `all` | MCP plus agent runtime |\n| `test` | Test dependencies |\n\nFor an ephemeral MCP start:\n\n```bash\nuvx --from \"systems-manager[mcp]\" systems-manager-mcp --transport stdio\n```\n\nThe checked-in `mcp_config.json` is a reference-only client catalog. It contains\n`env://` references and safe deny defaults, never deployment endpoints, credentials,\ncertificate paths, filesystem paths, hostnames, or identities. Project-specific values\nbelong in AgentConfig or the process launcher.\n\n## Security contract\n\n- Network MCP listeners require configured authentication. Non-loopback listeners also\n  require direct TLS or a trusted TLS-stop proxy, exact allowed hosts, and the\n  current Agent Connector SDK transport checks.\n- Host mutations are denied unless `SYSTEMS_MANAGER_ALLOW_HOST_MUTATIONS=true` and the\n  individual request receives destructive-operation approval.\n- Managed-file writes also require\n  `SYSTEMS_MANAGER_ALLOW_FILESYSTEM_MUTATIONS=true`.\n- Sensitive reads and active probes have independent default-deny gates.\n- Managed paths are confined beneath an explicit\n  `SYSTEMS_MANAGER_FILESYSTEM_ROOT`; there is no working-directory fallback.\n- Raw shell, arbitrary commands, plaintext credentials, model-authored cron creation,\n  and compatibility command aliases are not capabilities.\n- Logs and observability are metadata-only. Keep `LANGFUSE_CAPTURE_CONTENT=false`.\n\n## AgentConfig, secrets, and TLS\n\nUse `TLS_PROFILE` / `TLS_PROFILE_REF` with `TLS_PROFILES_REF` for shared checked\noutbound trust. Service-specific profiles such as `OIDC_TLS_PROFILE_REF`,\n`MODEL_TLS_PROFILE_REF`, and `LANGFUSE_TLS_PROFILE_REF` may select entries from the\nsame runtime catalog. Do not hardcode CA paths or verification flags in application\ncode, and do not disable verification for incomplete certificate chains.\n\nOut-of-band BMC health reads consume one runtime secret projection from\n`SYSTEMS_MANAGER_BMC_CREDENTIALS`. AgentConfig resolves the checked `env://` or secret\nreference before start; the provider accepts exactly a JSON object with `host`, `user`,\nand `password`. No secret-store vendor, secret path, token, or credential value is\nembedded in this package.\n\nThe MCP listener's own certificate or trusted-proxy boundary uses the current Agent\nUtilities `MCP_TLS_*` configuration. The optional agent listener uses `SERVER_TLS_*`\nand requires JWT configuration for non-loopback serving.\n\n## MCP tools\n\nThe default `MCP_TOOL_MODE=intent` exposes the small intent-verb surface. Backing\naction-routed tools stay available for governed discovery and on-demand loading. Tool\nand tag filters can further reduce the visible surface.\n\n_Auto-generated from the live MCP server; do not edit between the markers._\n\n<!-- MCP-TOOLS-TABLE:START -->\n\n#### Condensed action-routed tools (`MCP_TOOL_MODE=condensed`)\n\n| MCP Tool | Toggle Env Var | Description |\n|----------|----------------|-------------|\n| `capture_system_snapshot` | `OS_PROVIDERTOOL` | Takes a point-in-time snapshot of the system state (CPU, RAM, Processes). |\n| `get_management_capabilities` | \u2014 |  |\n| `get_network_connections` | `OS_PROVIDERTOOL` | Maps active TCP/UDP endpoints directly to owning processes. |\n| `get_process_details` | `OS_PROVIDERTOOL` | Retrieves deep cross-platform process details (threads, modules, memory). |\n| `health_check` | \u2014 |  |\n| `list_kernel_modules` | `OS_PROVIDERTOOL` | List loaded drivers/modules (lsmod or driverquery). |\n| `list_services` | `OS_PROVIDERTOOL` | Cross-platform service enumeration (systemctl or Get-Service). |\n| `manage_service` | `OS_PROVIDERTOOL` | Start/Stop/Restart/Enable/Disable services cross-platform. |\n| `query_system_logs` | `OS_PROVIDERTOOL` | Cross-platform log querying (journalctl or Get-WinEvent). |\n| `sm_advanced_operations` | \u2014 | Operations for SSH and specialized managers |\n| `sm_agent_identity_operations` | `IDENTITYTOOL` | Issues or verifies privacy-preserving agent identities. |\n| `sm_agent_scheduler_operations` | `AGENT_HEALTHTOOL` | Manages the cognitive scheduler: get stats, list processes, preempt, or reset quota. |\n| `sm_agent_specialist_operations` | `SPECIALIST_REGISTRYTOOL` | Manages specialist packages: install, uninstall, list, or search. |\n| `sm_agent_watchdog_operations` | `WATCHDOGTOOL` | Manages file watchdog triggers: check file change, list active watchers, or drain triggers. |\n| `sm_cron_operations` | \u2014 | Operations for cron jobs |\n| `sm_disk_operations` | \u2014 | Operations for managing system disks |\n| `sm_file_operations` | \u2014 | Operations for file and log management |\n| `sm_firewall_operations` | \u2014 | Operations for firewall management |\n| `sm_network_operations` | \u2014 | Operations for network analysis |\n| `sm_process_operations` | \u2014 | Operations for managing system processes |\n| `sm_service_operations` | \u2014 | Operations for managing system services |\n| `sm_storage_health` | `STORAGE_HEALTHTOOL` | Physical disk + BMC drive-fault health: SMART (incl. megaraid passthrough), |\n| `sm_system_operations` | \u2014 | System operations for managing packages, system health, and updates |\n| `sm_user_operations` | \u2014 | Operations for user and group management |\n| `start_system_trace` | `OS_PROVIDERTOOL` | Start a kernel-level event trace (ETW on Windows, or strace on Linux). |\n| `stop_system_trace` | `OS_PROVIDERTOOL` | Stop a kernel-level event trace. |\n| `systems_ingest_host` | \u2014 | Ingest a keyed host telemetry projection through the governed ChangeEnvelope boundary as typed HardwareNode, NetworkInterface, and DiskVolume nodes. |\n\n_27 action-routed tool(s) \u00b7 0 verbose 1:1 tool(s). Each is enabled unless its `<DOMAIN>TOOL` toggle is set false; `MCP_TOOL_MODE` selects the surface (**`intent` default** \u2014 the six verb-tools, granular set loaded on demand \u00b7 `condensed` action-routed \u00b7 `verbose` 1:1 \u00b7 `both`). Auto-generated \u2014 do not edit._\n<!-- MCP-TOOLS-TABLE:END -->\n\nTypical backing domains include OS/package lifecycle, services, processes, networks,\ndisks, managed files, cron removal, structured firewall rules, storage/BMC diagnostics,\nAgent OS administration, and governed host telemetry ingestion. Discover an action\nschema before calling it; unavailable operations must not be emulated with another\ntool.\n\n## Knowledge-graph ingestion\n\n`systems_ingest_host` reads local typed telemetry and submits an allowlisted projection\nthrough the Agent Connector SDK native governed ingestion boundary. It emits only:\n\n- `HardwareNode`, `NetworkInterface`, and `DiskVolume` nodes;\n- `hasInterface` and `hasVolume` relationships;\n- HMAC-SHA-256 opaque identifiers derived with the deployment-owned\n  `SYSTEMS_MANAGER_PSEUDONYMIZATION_KEY`.\n\nHostnames, network addresses, hardware addresses, usernames, local paths, credentials,\nand arbitrary extra fields are rejected or excluded. Missing graph authority, invalid\ncontent, and unavailable ingestion fail explicitly; they are not silent no-ops.\n\n## Arbora delegation\n\nHost operations run inside the service's local operating-system boundary. For\nfleet work, Arbora delegates to an authenticated systems-manager service on the target\nboundary. Inventory, endpoints, credentials, TLS profiles, and target aliases remain\nexternal deployment configuration. Persist only opaque, non-personal references.\n\nThe bundled `systems-manager-operations` skill covers every current provider workflow.\nOlder BMC command and NIC-bond script skills were consolidated because those raw-script\nsurfaces are not part of the typed current contract.\n\n## Agent server\n\nInstall the agent extra and start:\n\n```bash\nsystems-manager-agent --help\n```\n\nWorkspace, MCP catalog, and custom-skill paths are accepted only when explicitly\nconfigured and present. There is no packaged-config or current-directory fallback.\nA non-loopback listener requires an explicit allow gate, direct or trusted-proxy TLS,\nJWT issuer/JWKS/audience configuration, and debug mode disabled.\n\n## Environment variables\n\nThe generated table is sourced from the value-free `.env.example` plus the inherited\nAgent Connector SDK contract.\n\n<!-- ENV-VARS-TABLE:START -->\n\n#### Package environment variables\n\n| Variable | Example | Description |\n|----------|---------|-------------|\n| `SYSTEMS_MANAGER_FILESYSTEM_ROOT` | \u2014 | Required managed filesystem boundary |\n| `SYSTEMS_MANAGER_TEMP_ROOT` | \u2014 | Optional cleanup root beneath the managed boundary |\n| `SYSTEMS_MANAGER_PSEUDONYMIZATION_KEY` | secret-injected | Deployment-owned secret, at least 32 bytes |\n| `SYSTEMS_MANAGER_BMC_CREDENTIALS` | \u2014 | Secret-projected JSON with host/user/password |\n| `TLS_PROFILE` | \u2014 | Shared mandatory-verification transport profile |\n| `TLS_PROFILES_REF` | \u2014 | Runtime reference to the transport profile catalog |\n| `LANGFUSE_TLS_PROFILE_REF` | \u2014 | Runtime reference to verified Langfuse trust |\n| `MCP_TOOL_MODE` | `intent` | Current intent-first tool surface |\n| `SYSTEMS_MANAGER_ALLOW_HOST_MUTATIONS` | `false` | Default-deny host mutations |\n| `SYSTEMS_MANAGER_ALLOW_FILESYSTEM_MUTATIONS` | `false` | Default-deny file mutations |\n| `SYSTEMS_MANAGER_ALLOW_SENSITIVE_READS` | `false` | Default-deny sensitive inventory |\n| `SYSTEMS_MANAGER_ALLOW_NETWORK_PROBES` | `false` | Default-deny active probes |\n| `SYSTEMS_MANAGER_MAX_BLOCKING_OPERATIONS` | `2` | Bounded host-operation concurrency |\n| `SYSTEMS_MANAGER_HEALTH_INGEST` | `true` | Enable governed health trend ingestion |\n| `SYSTEMS_MANAGER_HEALTH_AGGREGATE_S` | `3600` | Health trend aggregation window |\n| `SYSTEMS_MANAGER_NODE_REF` | \u2014 | Runtime node alias; only a keyed digest persists |\n| `SYSTEMS_MANAGER_NOTIFY_TLS_PROFILE` | \u2014 | Optional inline mandatory-verification notification TLS profile |\n| `SYSTEMS_MANAGER_NOTIFY_TLS_PROFILE_REF` | \u2014 | Runtime reference to the notification TLS profile |\n| `SYSTEMS_MANAGER_MCP_IMAGE_DIGEST` | \u2014 | Required immutable MCP image digest |\n| `SYSTEMS_MANAGER_REPOSITORY_ALLOWLIST_JSON` | `[]` | Approved credential-free repositories |\n| `SYSTEMS_MANAGER_LOCAL_PACKAGE_SHA256_MAP` | `{}` | Approved package paths and digests |\n| `SYSTEMS_MANAGER_COMMAND_TIMEOUT_SECONDS` | `120` | Default command timeout |\n| `SYSTEMS_MANAGER_ENV_METADATA_ALLOWLIST` | \u2014 | Non-sensitive environment names readable as metadata |\n| `SYSTEMS_MANAGER_UV_VERSION` | \u2014 | Exact approved uv release |\n| `SYSTEMS_MANAGER_NVM_COMMIT` | \u2014 | Exact approved NVM commit |\n| `SYSTEMS_MANAGER_NVM_DIR` | \u2014 | NVM directory beneath the managed filesystem root |\n| `ALLOW_UPDATE_ON_K8S` | `false` | Keep Kubernetes lifecycle guard enabled |\n| `MISCTOOL` | `true` | Register base health/readiness tools |\n| `OS_PROVIDERTOOL` | `true` | Register operating-system provider tools |\n| `STORAGE_HEALTHTOOL` | `true` | Register storage health tools |\n| `TRANSPORT` | `stdio` | Local MCP transport |\n| `HOST` | `127.0.0.1` | Loopback bind for HTTP transports |\n| `PORT` | `8000` | Bind port for HTTP transports |\n| `ENABLE_OTEL` | `false` | Enable only with an approved collector |\n\n#### Inherited agent-connector-sdk variables (apply to every connector)\n\n| Variable | Example | Description |\n|----------|---------|-------------|\n| `MCP_ENABLED_TOOLS` | \u2014 | Comma-separated tool allow-list |\n| `MCP_DISABLED_TOOLS` | \u2014 | Comma-separated tool deny-list |\n| `MCP_ENABLED_TAGS` | \u2014 | Comma-separated tag allow-list |\n| `MCP_DISABLED_TAGS` | \u2014 | Comma-separated tag deny-list |\n| `EUNOMIA_TYPE` | `none` | Authorization mode: `none` \\| `embedded` \\| `remote` |\n| `EUNOMIA_POLICY_FILE` | `mcp_policies.json` | Embedded Eunomia policy file |\n| `EUNOMIA_REMOTE_URL` | \u2014 | Remote Eunomia authorization server URL |\n| `OTEL_EXPORTER_OTLP_ENDPOINT` | \u2014 | OTLP collector endpoint |\n| `MCP_CLIENT_AUTH` | \u2014 | Outbound MCP child auth: `oidc-client-credentials` \\| `basic` \\| `none` |\n| `OIDC_CLIENT_ID` | \u2014 | OIDC client id (service-account auth) |\n| `OIDC_CLIENT_SECRET_REF` | `secret://identity/oidc-client-secret` | Runtime secret reference for the OIDC service account |\n| `MCP_BASIC_AUTH_USERNAME` | \u2014 | HTTP Basic username (`MCP_CLIENT_AUTH=basic`) |\n| `MCP_BASIC_AUTH_PASSWORD_REF` | `secret://identity/mcp-basic-password` | Runtime secret reference for HTTP Basic auth (`MCP_CLIENT_AUTH=basic`) |\n| `DEBUG` | `False` | Verbose logging |\n| `PYTHONUNBUFFERED` | `1` | Unbuffered stdout (recommended in containers) |\n| `MCP_URL` | `http://localhost:8000/mcp` | URL of the MCP server the agent connects to |\n| `PROVIDER` | `openai` | LLM provider for the agent |\n| `MODEL_ID` | `gpt-4o` | Model id for the agent |\n| `ENABLE_WEB_UI` | `True` | Serve the AG-UI web interface |\n\n_51 package + 19 inherited variable(s). Auto-generated from `.env.example` + the shared agent-connector-sdk set \u2014 do not edit._\n<!-- ENV-VARS-TABLE:END -->\n\n## Development and release gates\n\n```bash\npytest -q\nruff check systems_manager tests\nblack --check systems_manager tests\nmkdocs build --strict\npre-commit run --all-files\n```\n\nRun host operations only through mocks during tests. Do not run native builds or live\nhost mutations as a validation shortcut. The source dependency floor is intentionally\n`agent-connector-sdk>=2.0.0`; regenerate and commit a neutral lock only after that release\nis available from the configured package index. Never commit an editable local source\nor a stale dependency resolution.\n\nSee [the documentation](docs/index.md) for installation, deployment, configuration,\nusage, multi-host delegation, and security details.\n\n\n\n<!-- GOVERNED-CAPABILITY:START -->\n## Governed capability contract\n\nThis package ships a compact canonical skill surface with specialist procedures\nkept as referenced workflows. The current MCP tools, skill metadata,\n`connector_manifest.yml`, ontology, mappings, shapes, fixtures, migrations,\ntool-schema fingerprints, and certification metadata form one versioned\ncapability contract. Validate them together; do not rely on stale tool names or\nhistorical per-task skill wrappers.\n\nRuntime endpoints, credentials, certificate trust, tenant identity, retention,\nand observability policy are deployment inputs and are never packaged values.\nSee [Configuration, trust, and privacy](docs/configuration.md) before enabling a\nnetwork transport, connector ingestion, Arbora delegation, or trace export.\n<!-- GOVERNED-CAPABILITY:END -->\n",
+                  "description": "# systems-manager\n\nVersion: 2.2.4\n\n`systems-manager` is the typed host-operations provider for Agent Connector SDK and\nArbora. It exposes cross-platform package, service, process, network, disk,\nmanaged-file, firewall, physical-storage, Agent OS, and privacy-safe host-ingestion\ncapabilities without exposing a raw command tool.\n\nThe current package requires Python 3.11\u20133.14 and\n`agent-connector-sdk>=2.0.0,<3.0.0`.\n\n## Install and run\n\nInstall only the interface the operator need:\n\n```bash\npip install \"systems-manager[mcp]\"\nsystems-manager-mcp --transport stdio\n```\n\nThe optional extras are:\n\n| Extra | Capability |\n| --- | --- |\n| `mcp` | FastMCP provider runtime |\n| `agent` | Agent server and Logfire integration |\n| `all` | MCP plus agent runtime |\n| `test` | Test dependencies |\n\nFor an ephemeral MCP start:\n\n```bash\nuvx --from \"systems-manager[mcp]\" systems-manager-mcp --transport stdio\n```\n\nThe checked-in `mcp_config.json` is a reference-only client catalog. It contains\n`env://` references and safe deny defaults, never deployment endpoints, credentials,\ncertificate paths, filesystem paths, hostnames, or identities. Project-specific values\nbelong in AgentConfig or the process launcher.\n\n## Security contract\n\n- Network MCP listeners require configured authentication. Non-loopback listeners also\n  require direct TLS or a trusted TLS-stop proxy, exact allowed hosts, and the\n  current Agent Connector SDK transport checks.\n- Host mutations are denied unless `SYSTEMS_MANAGER_ALLOW_HOST_MUTATIONS=true` and the\n  individual request receives destructive-operation approval.\n- Managed-file writes also require\n  `SYSTEMS_MANAGER_ALLOW_FILESYSTEM_MUTATIONS=true`.\n- Sensitive reads and active probes have independent default-deny gates.\n- Managed paths are confined beneath an explicit\n  `SYSTEMS_MANAGER_FILESYSTEM_ROOT`; there is no working-directory fallback.\n- Raw shell, arbitrary commands, plaintext credentials, model-authored cron creation,\n  and compatibility command aliases are not capabilities.\n- Logs and observability are metadata-only. Keep `LANGFUSE_CAPTURE_CONTENT=false`.\n\n## AgentConfig, secrets, and TLS\n\nUse `TLS_PROFILE` / `TLS_PROFILE_REF` with `TLS_PROFILES_REF` for shared checked\noutbound trust. Service-specific profiles such as `OIDC_TLS_PROFILE_REF`,\n`MODEL_TLS_PROFILE_REF`, and `LANGFUSE_TLS_PROFILE_REF` may select entries from the\nsame runtime catalog. Do not hardcode CA paths or verification flags in application\ncode, and do not disable verification for incomplete certificate chains.\n\nOut-of-band BMC health reads consume one runtime secret projection from\n`SYSTEMS_MANAGER_BMC_CREDENTIALS`. AgentConfig resolves the checked `env://` or secret\nreference before start; the provider accepts exactly a JSON object with `host`, `user`,\nand `password`. No secret-store vendor, secret path, token, or credential value is\nembedded in this package.\n\nThe MCP listener's own certificate or trusted-proxy boundary uses the current Agent\nUtilities `MCP_TLS_*` configuration. The optional agent listener uses `SERVER_TLS_*`\nand requires JWT configuration for non-loopback serving.\n\n## MCP tools\n\nThe default `MCP_TOOL_MODE=intent` exposes the small intent-verb surface. Backing\naction-routed tools stay available for governed discovery and on-demand loading. Tool\nand tag filters can further reduce the visible surface.\n\n_Auto-generated from the live MCP server; do not edit between the markers._\n\n<!-- MCP-TOOLS-TABLE:START -->\n\n#### Condensed action-routed tools (`MCP_TOOL_MODE=condensed`)\n\n| MCP Tool | Toggle Env Var | Description |\n|----------|----------------|-------------|\n| `capture_system_snapshot` | `OS_PROVIDERTOOL` | Takes a point-in-time snapshot of the system state (CPU, RAM, Processes). |\n| `get_management_capabilities` | \u2014 |  |\n| `get_network_connections` | `OS_PROVIDERTOOL` | Maps active TCP/UDP endpoints directly to owning processes. |\n| `get_process_details` | `OS_PROVIDERTOOL` | Retrieves deep cross-platform process details (threads, modules, memory). |\n| `health_check` | \u2014 |  |\n| `list_kernel_modules` | `OS_PROVIDERTOOL` | List loaded drivers/modules (lsmod or driverquery). |\n| `list_services` | `OS_PROVIDERTOOL` | Cross-platform service enumeration (systemctl or Get-Service). |\n| `manage_service` | `OS_PROVIDERTOOL` | Start/Stop/Restart/Enable/Disable services cross-platform. |\n| `query_system_logs` | `OS_PROVIDERTOOL` | Cross-platform log querying (journalctl or Get-WinEvent). |\n| `sm_advanced_operations` | \u2014 | Operations for SSH and specialized managers |\n| `sm_agent_identity_operations` | `IDENTITYTOOL` | Issues or verifies privacy-preserving agent identities. |\n| `sm_agent_scheduler_operations` | `AGENT_HEALTHTOOL` | Manages the cognitive scheduler: get stats, list processes, preempt, or reset quota. |\n| `sm_agent_specialist_operations` | `SPECIALIST_REGISTRYTOOL` | Manages specialist packages: install, uninstall, list, or search. |\n| `sm_agent_watchdog_operations` | `WATCHDOGTOOL` | Manages file watchdog triggers: check file change, list active watchers, or drain triggers. |\n| `sm_cron_operations` | \u2014 | Operations for cron jobs |\n| `sm_disk_operations` | \u2014 | Operations for managing system disks |\n| `sm_file_operations` | \u2014 | Operations for file and log management |\n| `sm_firewall_operations` | \u2014 | Operations for firewall management |\n| `sm_network_operations` | \u2014 | Operations for network analysis |\n| `sm_process_operations` | \u2014 | Operations for managing system processes |\n| `sm_service_operations` | \u2014 | Operations for managing system services |\n| `sm_storage_health` | `STORAGE_HEALTHTOOL` | Physical disk + BMC drive-fault health: SMART (incl. megaraid passthrough), |\n| `sm_system_operations` | \u2014 | System operations for managing packages, system health, and updates |\n| `sm_user_operations` | \u2014 | Operations for user and group management |\n| `start_system_trace` | `OS_PROVIDERTOOL` | Start a kernel-level event trace (ETW on Windows, or strace on Linux). |\n| `stop_system_trace` | `OS_PROVIDERTOOL` | Stop a kernel-level event trace. |\n| `systems_ingest_host` | \u2014 | Ingest a keyed host telemetry projection through the governed ChangeEnvelope boundary as typed HardwareNode, NetworkInterface, and DiskVolume nodes. |\n\n_27 action-routed tool(s) \u00b7 0 verbose 1:1 tool(s). Each is enabled unless its `<DOMAIN>TOOL` toggle is set false; `MCP_TOOL_MODE` selects the surface (**`intent` default** \u2014 the six verb-tools, granular set loaded on demand \u00b7 `condensed` action-routed \u00b7 `verbose` 1:1 \u00b7 `both`). Auto-generated \u2014 do not edit._\n<!-- MCP-TOOLS-TABLE:END -->\n\nTypical backing domains include OS/package lifecycle, services, processes, networks,\ndisks, managed files, cron removal, structured firewall rules, storage/BMC diagnostics,\nAgent OS administration, and governed host telemetry ingestion. Discover an action\nschema before calling it; unavailable operations must not be emulated with another\ntool.\n\n## Knowledge-graph ingestion\n\n`systems_ingest_host` reads local typed telemetry and submits an allowlisted projection\nthrough the Agent Connector SDK native governed ingestion boundary. It emits only:\n\n- `HardwareNode`, `NetworkInterface`, and `DiskVolume` nodes;\n- `hasInterface` and `hasVolume` relationships;\n- HMAC-SHA-256 opaque identifiers derived with the deployment-owned\n  `SYSTEMS_MANAGER_PSEUDONYMIZATION_KEY`.\n\nHostnames, network addresses, hardware addresses, usernames, local paths, credentials,\nand arbitrary extra fields are rejected or excluded. Missing graph authority, invalid\ncontent, and unavailable ingestion fail explicitly; they are not silent no-ops.\n\n## Arbora delegation\n\nHost operations run inside the service's local operating-system boundary. For\nfleet work, Arbora delegates to an authenticated systems-manager service on the target\nboundary. Inventory, endpoints, credentials, TLS profiles, and target aliases remain\nexternal deployment configuration. Persist only opaque, non-personal references.\n\nThe bundled `systems-manager-operations` skill covers every current provider workflow.\nOlder BMC command and NIC-bond script skills were consolidated because those raw-script\nsurfaces are not part of the typed current contract.\n\n## Agent server\n\nInstall the agent extra and start:\n\n```bash\nsystems-manager-agent --help\n```\n\nWorkspace, MCP catalog, and custom-skill paths are accepted only when explicitly\nconfigured and present. There is no packaged-config or current-directory fallback.\nA non-loopback listener requires an explicit allow gate, direct or trusted-proxy TLS,\nJWT issuer/JWKS/audience configuration, and debug mode disabled.\n\n## Environment variables\n\nThe generated table is sourced from the value-free `.env.example` plus the inherited\nAgent Connector SDK contract.\n\n<!-- ENV-VARS-TABLE:START -->\n\n#### Package environment variables\n\n| Variable | Example | Description |\n|----------|---------|-------------|\n| `SYSTEMS_MANAGER_FILESYSTEM_ROOT` | \u2014 | Required managed filesystem boundary |\n| `SYSTEMS_MANAGER_TEMP_ROOT` | \u2014 | Optional cleanup root beneath the managed boundary |\n| `SYSTEMS_MANAGER_PSEUDONYMIZATION_KEY` | secret-injected | Deployment-owned secret, at least 32 bytes |\n| `SYSTEMS_MANAGER_BMC_CREDENTIALS` | \u2014 | Secret-projected JSON with host/user/password |\n| `TLS_PROFILE` | \u2014 | Shared mandatory-verification transport profile |\n| `TLS_PROFILES_REF` | \u2014 | Runtime reference to the transport profile catalog |\n| `LANGFUSE_TLS_PROFILE_REF` | \u2014 | Runtime reference to verified Langfuse trust |\n| `MCP_TOOL_MODE` | `intent` | Current intent-first tool surface |\n| `SYSTEMS_MANAGER_ALLOW_HOST_MUTATIONS` | `false` | Default-deny host mutations |\n| `SYSTEMS_MANAGER_ALLOW_FILESYSTEM_MUTATIONS` | `false` | Default-deny file mutations |\n| `SYSTEMS_MANAGER_ALLOW_SENSITIVE_READS` | `false` | Default-deny sensitive inventory |\n| `SYSTEMS_MANAGER_ALLOW_NETWORK_PROBES` | `false` | Default-deny active probes |\n| `SYSTEMS_MANAGER_MAX_BLOCKING_OPERATIONS` | `2` | Bounded host-operation concurrency |\n| `SYSTEMS_MANAGER_HEALTH_INGEST` | `true` | Enable governed health trend ingestion |\n| `SYSTEMS_MANAGER_HEALTH_AGGREGATE_S` | `3600` | Health trend aggregation window |\n| `SYSTEMS_MANAGER_NODE_REF` | \u2014 | Runtime node alias; only a keyed digest persists |\n| `SYSTEMS_MANAGER_NOTIFY_TLS_PROFILE` | \u2014 | Optional inline mandatory-verification notification TLS profile |\n| `SYSTEMS_MANAGER_NOTIFY_TLS_PROFILE_REF` | \u2014 | Runtime reference to the notification TLS profile |\n| `SYSTEMS_MANAGER_MCP_IMAGE_DIGEST` | \u2014 | Required immutable MCP image digest |\n| `SYSTEMS_MANAGER_REPOSITORY_ALLOWLIST_JSON` | `[]` | Approved credential-free repositories |\n| `SYSTEMS_MANAGER_LOCAL_PACKAGE_SHA256_MAP` | `{}` | Approved package paths and digests |\n| `SYSTEMS_MANAGER_COMMAND_TIMEOUT_SECONDS` | `120` | Default command timeout |\n| `SYSTEMS_MANAGER_ENV_METADATA_ALLOWLIST` | \u2014 | Non-sensitive environment names readable as metadata |\n| `SYSTEMS_MANAGER_UV_VERSION` | \u2014 | Exact approved uv release |\n| `SYSTEMS_MANAGER_NVM_COMMIT` | \u2014 | Exact approved NVM commit |\n| `SYSTEMS_MANAGER_NVM_DIR` | \u2014 | NVM directory beneath the managed filesystem root |\n| `ALLOW_UPDATE_ON_K8S` | `false` | Keep Kubernetes lifecycle guard enabled |\n| `MISCTOOL` | `true` | Register base health/readiness tools |\n| `OS_PROVIDERTOOL` | `true` | Register operating-system provider tools |\n| `STORAGE_HEALTHTOOL` | `true` | Register storage health tools |\n| `TRANSPORT` | `stdio` | Local MCP transport |\n| `HOST` | `127.0.0.1` | Loopback bind for HTTP transports |\n| `PORT` | `8000` | Bind port for HTTP transports |\n| `ENABLE_OTEL` | `false` | Enable only with an approved collector |\n\n#### Inherited agent-connector-sdk variables (apply to every connector)\n\n| Variable | Example | Description |\n|----------|---------|-------------|\n| `MCP_ENABLED_TOOLS` | \u2014 | Comma-separated tool allow-list |\n| `MCP_DISABLED_TOOLS` | \u2014 | Comma-separated tool deny-list |\n| `MCP_ENABLED_TAGS` | \u2014 | Comma-separated tag allow-list |\n| `MCP_DISABLED_TAGS` | \u2014 | Comma-separated tag deny-list |\n| `EUNOMIA_TYPE` | `none` | Authorization mode: `none` \\| `embedded` \\| `remote` |\n| `EUNOMIA_POLICY_FILE` | `mcp_policies.json` | Embedded Eunomia policy file |\n| `EUNOMIA_REMOTE_URL` | \u2014 | Remote Eunomia authorization server URL |\n| `OTEL_EXPORTER_OTLP_ENDPOINT` | \u2014 | OTLP collector endpoint |\n| `MCP_CLIENT_AUTH` | \u2014 | Outbound MCP child auth: `oidc-client-credentials` \\| `basic` \\| `none` |\n| `OIDC_CLIENT_ID` | \u2014 | OIDC client id (service-account auth) |\n| `OIDC_CLIENT_SECRET_REF` | `secret://identity/oidc-client-secret` | Runtime secret reference for the OIDC service account |\n| `MCP_BASIC_AUTH_USERNAME` | \u2014 | HTTP Basic username (`MCP_CLIENT_AUTH=basic`) |\n| `MCP_BASIC_AUTH_PASSWORD_REF` | `secret://identity/mcp-basic-password` | Runtime secret reference for HTTP Basic auth (`MCP_CLIENT_AUTH=basic`) |\n| `DEBUG` | `False` | Verbose logging |\n| `PYTHONUNBUFFERED` | `1` | Unbuffered stdout (recommended in containers) |\n| `MCP_URL` | `http://localhost:8000/mcp` | URL of the MCP server the agent connects to |\n| `PROVIDER` | `openai` | LLM provider for the agent |\n| `MODEL_ID` | `gpt-4o` | Model id for the agent |\n| `ENABLE_WEB_UI` | `True` | Serve the AG-UI web interface |\n\n_51 package + 19 inherited variable(s). Auto-generated from `.env.example` + the shared agent-connector-sdk set \u2014 do not edit._\n<!-- ENV-VARS-TABLE:END -->\n\n## Development and release gates\n\n```bash\npytest -q\nruff check systems_manager tests\nblack --check systems_manager tests\nmkdocs build --strict\npre-commit run --all-files\n```\n\nRun host operations only through mocks during tests. Do not run native builds or live\nhost mutations as a validation shortcut. The source dependency floor is intentionally\n`agent-connector-sdk>=2.0.0`; regenerate and commit a neutral lock only after that release\nis available from the configured package index. Never commit an editable local source\nor a stale dependency resolution.\n\nSee [the documentation](docs/index.md) for installation, deployment, configuration,\nusage, multi-host delegation, and security details.\n\n\n\n<!-- GOVERNED-CAPABILITY:START -->\n## Governed capability contract\n\nThis package ships a compact canonical skill surface with specialist procedures\nkept as referenced workflows. The current MCP tools, skill metadata,\n`connector_manifest.yml`, ontology, mappings, shapes, fixtures, migrations,\ntool-schema fingerprints, and certification metadata form one versioned\ncapability contract. Validate them together; do not rely on stale tool names or\nhistorical per-task skill wrappers.\n\nRuntime endpoints, credentials, certificate trust, tenant identity, retention,\nand observability policy are deployment inputs and are never packaged values.\nSee [Configuration, trust, and privacy](docs/configuration.md) before enabling a\nnetwork transport, connector ingestion, Arbora delegation, or trace export.\n<!-- GOVERNED-CAPABILITY:END -->\n",
                   "description_content_type": "text/markdown",
                   "author_email": "Project Maintainers <maintainers@users.noreply.github.com>",
                   "license": "MIT",
@@ -12145,11 +12145,11 @@
             "install": [
               {
                 "download_info": {
-                  "url": "file:///tmp/wheel-readiness-ls5igx0b/systems_manager-2.2.3-py3-none-any.whl",
+                  "url": "file:///tmp/wheel-readiness-7xfy_mz8/systems_manager-2.2.4-py3-none-any.whl",
                   "archive_info": {
-                    "hash": "sha256=3acc024bbf04f65397b3bf43b0dd1fd52c75bc793c9bac4375e9c62106293449",
+                    "hash": "sha256=d42f931b1c789c0072c8bc5b708f2a69c9fda5614f183d660e94612e8c7893ab",
                     "hashes": {
-                      "sha256": "3acc024bbf04f65397b3bf43b0dd1fd52c75bc793c9bac4375e9c62106293449"
+                      "sha256": "d42f931b1c789c0072c8bc5b708f2a69c9fda5614f183d660e94612e8c7893ab"
                     }
                   }
                 },
@@ -12159,12 +12159,12 @@
                 "metadata": {
                   "metadata_version": "2.4",
                   "name": "systems-manager",
-                  "version": "2.2.3",
+                  "version": "2.2.4",
                   "dynamic": [
                     "license-file"
                   ],
                   "summary": "Systems Manager will update your system and install/upgrade applications. Additionally, as allow AI to perform these activities as an MCP Server",
-                  "description": "# systems-manager\n\nVersion: 2.2.3\n\n`systems-manager` is the typed host-operations provider for Agent Connector SDK and\nArbora. It exposes cross-platform package, service, process, network, disk,\nmanaged-file, firewall, physical-storage, Agent OS, and privacy-safe host-ingestion\ncapabilities without exposing a raw command tool.\n\nThe current package requires Python 3.11\u20133.14 and\n`agent-connector-sdk>=2.0.0,<3.0.0`.\n\n## Install and run\n\nInstall only the interface the operator need:\n\n```bash\npip install \"systems-manager[mcp]\"\nsystems-manager-mcp --transport stdio\n```\n\nThe optional extras are:\n\n| Extra | Capability |\n| --- | --- |\n| `mcp` | FastMCP provider runtime |\n| `agent` | Agent server and Logfire integration |\n| `all` | MCP plus agent runtime |\n| `test` | Test dependencies |\n\nFor an ephemeral MCP start:\n\n```bash\nuvx --from \"systems-manager[mcp]\" systems-manager-mcp --transport stdio\n```\n\nThe checked-in `mcp_config.json` is a reference-only client catalog. It contains\n`env://` references and safe deny defaults, never deployment endpoints, credentials,\ncertificate paths, filesystem paths, hostnames, or identities. Project-specific values\nbelong in AgentConfig or the process launcher.\n\n## Security contract\n\n- Network MCP listeners require configured authentication. Non-loopback listeners also\n  require direct TLS or a trusted TLS-stop proxy, exact allowed hosts, and the\n  current Agent Connector SDK transport checks.\n- Host mutations are denied unless `SYSTEMS_MANAGER_ALLOW_HOST_MUTATIONS=true` and the\n  individual request receives destructive-operation approval.\n- Managed-file writes also require\n  `SYSTEMS_MANAGER_ALLOW_FILESYSTEM_MUTATIONS=true`.\n- Sensitive reads and active probes have independent default-deny gates.\n- Managed paths are confined beneath an explicit\n  `SYSTEMS_MANAGER_FILESYSTEM_ROOT`; there is no working-directory fallback.\n- Raw shell, arbitrary commands, plaintext credentials, model-authored cron creation,\n  and compatibility command aliases are not capabilities.\n- Logs and observability are metadata-only. Keep `LANGFUSE_CAPTURE_CONTENT=false`.\n\n## AgentConfig, secrets, and TLS\n\nUse `TLS_PROFILE` / `TLS_PROFILE_REF` with `TLS_PROFILES_REF` for shared checked\noutbound trust. Service-specific profiles such as `OIDC_TLS_PROFILE_REF`,\n`MODEL_TLS_PROFILE_REF`, and `LANGFUSE_TLS_PROFILE_REF` may select entries from the\nsame runtime catalog. Do not hardcode CA paths or verification flags in application\ncode, and do not disable verification for incomplete certificate chains.\n\nOut-of-band BMC health reads consume one runtime secret projection from\n`SYSTEMS_MANAGER_BMC_CREDENTIALS`. AgentConfig resolves the checked `env://` or secret\nreference before start; the provider accepts exactly a JSON object with `host`, `user`,\nand `password`. No secret-store vendor, secret path, token, or credential value is\nembedded in this package.\n\nThe MCP listener's own certificate or trusted-proxy boundary uses the current Agent\nUtilities `MCP_TLS_*` configuration. The optional agent listener uses `SERVER_TLS_*`\nand requires JWT configuration for non-loopback serving.\n\n## MCP tools\n\nThe default `MCP_TOOL_MODE=intent` exposes the small intent-verb surface. Backing\naction-routed tools stay available for governed discovery and on-demand loading. Tool\nand tag filters can further reduce the visible surface.\n\n_Auto-generated from the live MCP server; do not edit between the markers._\n\n<!-- MCP-TOOLS-TABLE:START -->\n\n#### Condensed action-routed tools (`MCP_TOOL_MODE=condensed`)\n\n| MCP Tool | Toggle Env Var | Description |\n|----------|----------------|-------------|\n| `capture_system_snapshot` | `OS_PROVIDERTOOL` | Takes a point-in-time snapshot of the system state (CPU, RAM, Processes). |\n| `get_management_capabilities` | \u2014 |  |\n| `get_network_connections` | `OS_PROVIDERTOOL` | Maps active TCP/UDP endpoints directly to owning processes. |\n| `get_process_details` | `OS_PROVIDERTOOL` | Retrieves deep cross-platform process details (threads, modules, memory). |\n| `health_check` | \u2014 |  |\n| `list_kernel_modules` | `OS_PROVIDERTOOL` | List loaded drivers/modules (lsmod or driverquery). |\n| `list_services` | `OS_PROVIDERTOOL` | Cross-platform service enumeration (systemctl or Get-Service). |\n| `manage_service` | `OS_PROVIDERTOOL` | Start/Stop/Restart/Enable/Disable services cross-platform. |\n| `query_system_logs` | `OS_PROVIDERTOOL` | Cross-platform log querying (journalctl or Get-WinEvent). |\n| `sm_advanced_operations` | \u2014 | Operations for SSH and specialized managers |\n| `sm_agent_identity_operations` | `IDENTITYTOOL` | Issues or verifies privacy-preserving agent identities. |\n| `sm_agent_scheduler_operations` | `AGENT_HEALTHTOOL` | Manages the cognitive scheduler: get stats, list processes, preempt, or reset quota. |\n| `sm_agent_specialist_operations` | `SPECIALIST_REGISTRYTOOL` | Manages specialist packages: install, uninstall, list, or search. |\n| `sm_agent_watchdog_operations` | `WATCHDOGTOOL` | Manages file watchdog triggers: check file change, list active watchers, or drain triggers. |\n| `sm_cron_operations` | \u2014 | Operations for cron jobs |\n| `sm_disk_operations` | \u2014 | Operations for managing system disks |\n| `sm_file_operations` | \u2014 | Operations for file and log management |\n| `sm_firewall_operations` | \u2014 | Operations for firewall management |\n| `sm_network_operations` | \u2014 | Operations for network analysis |\n| `sm_process_operations` | \u2014 | Operations for managing system processes |\n| `sm_service_operations` | \u2014 | Operations for managing system services |\n| `sm_storage_health` | `STORAGE_HEALTHTOOL` | Physical disk + BMC drive-fault health: SMART (incl. megaraid passthrough), |\n| `sm_system_operations` | \u2014 | System operations for managing packages, system health, and updates |\n| `sm_user_operations` | \u2014 | Operations for user and group management |\n| `start_system_trace` | `OS_PROVIDERTOOL` | Start a kernel-level event trace (ETW on Windows, or strace on Linux). |\n| `stop_system_trace` | `OS_PROVIDERTOOL` | Stop a kernel-level event trace. |\n| `systems_ingest_host` | \u2014 | Ingest a keyed host telemetry projection through the governed ChangeEnvelope boundary as typed HardwareNode, NetworkInterface, and DiskVolume nodes. |\n\n_27 action-routed tool(s) \u00b7 0 verbose 1:1 tool(s). Each is enabled unless its `<DOMAIN>TOOL` toggle is set false; `MCP_TOOL_MODE` selects the surface (**`intent` default** \u2014 the six verb-tools, granular set loaded on demand \u00b7 `condensed` action-routed \u00b7 `verbose` 1:1 \u00b7 `both`). Auto-generated \u2014 do not edit._\n<!-- MCP-TOOLS-TABLE:END -->\n\nTypical backing domains include OS/package lifecycle, services, processes, networks,\ndisks, managed files, cron removal, structured firewall rules, storage/BMC diagnostics,\nAgent OS administration, and governed host telemetry ingestion. Discover an action\nschema before calling it; unavailable operations must not be emulated with another\ntool.\n\n## Knowledge-graph ingestion\n\n`systems_ingest_host` reads local typed telemetry and submits an allowlisted projection\nthrough the Agent Connector SDK native governed ingestion boundary. It emits only:\n\n- `HardwareNode`, `NetworkInterface`, and `DiskVolume` nodes;\n- `hasInterface` and `hasVolume` relationships;\n- HMAC-SHA-256 opaque identifiers derived with the deployment-owned\n  `SYSTEMS_MANAGER_PSEUDONYMIZATION_KEY`.\n\nHostnames, network addresses, hardware addresses, usernames, local paths, credentials,\nand arbitrary extra fields are rejected or excluded. Missing graph authority, invalid\ncontent, and unavailable ingestion fail explicitly; they are not silent no-ops.\n\n## Arbora delegation\n\nHost operations run inside the service's local operating-system boundary. For\nfleet work, Arbora delegates to an authenticated systems-manager service on the target\nboundary. Inventory, endpoints, credentials, TLS profiles, and target aliases remain\nexternal deployment configuration. Persist only opaque, non-personal references.\n\nThe bundled `systems-manager-operations` skill covers every current provider workflow.\nOlder BMC command and NIC-bond script skills were consolidated because those raw-script\nsurfaces are not part of the typed current contract.\n\n## Agent server\n\nInstall the agent extra and start:\n\n```bash\nsystems-manager-agent --help\n```\n\nWorkspace, MCP catalog, and custom-skill paths are accepted only when explicitly\nconfigured and present. There is no packaged-config or current-directory fallback.\nA non-loopback listener requires an explicit allow gate, direct or trusted-proxy TLS,\nJWT issuer/JWKS/audience configuration, and debug mode disabled.\n\n## Environment variables\n\nThe generated table is sourced from the value-free `.env.example` plus the inherited\nAgent Connector SDK contract.\n\n<!-- ENV-VARS-TABLE:START -->\n\n#### Package environment variables\n\n| Variable | Example | Description |\n|----------|---------|-------------|\n| `SYSTEMS_MANAGER_FILESYSTEM_ROOT` | \u2014 | Required managed filesystem boundary |\n| `SYSTEMS_MANAGER_TEMP_ROOT` | \u2014 | Optional cleanup root beneath the managed boundary |\n| `SYSTEMS_MANAGER_PSEUDONYMIZATION_KEY` | secret-injected | Deployment-owned secret, at least 32 bytes |\n| `SYSTEMS_MANAGER_BMC_CREDENTIALS` | \u2014 | Secret-projected JSON with host/user/password |\n| `TLS_PROFILE` | \u2014 | Shared mandatory-verification transport profile |\n| `TLS_PROFILES_REF` | \u2014 | Runtime reference to the transport profile catalog |\n| `LANGFUSE_TLS_PROFILE_REF` | \u2014 | Runtime reference to verified Langfuse trust |\n| `MCP_TOOL_MODE` | `intent` | Current intent-first tool surface |\n| `SYSTEMS_MANAGER_ALLOW_HOST_MUTATIONS` | `false` | Default-deny host mutations |\n| `SYSTEMS_MANAGER_ALLOW_FILESYSTEM_MUTATIONS` | `false` | Default-deny file mutations |\n| `SYSTEMS_MANAGER_ALLOW_SENSITIVE_READS` | `false` | Default-deny sensitive inventory |\n| `SYSTEMS_MANAGER_ALLOW_NETWORK_PROBES` | `false` | Default-deny active probes |\n| `SYSTEMS_MANAGER_MAX_BLOCKING_OPERATIONS` | `2` | Bounded host-operation concurrency |\n| `SYSTEMS_MANAGER_HEALTH_INGEST` | `true` | Enable governed health trend ingestion |\n| `SYSTEMS_MANAGER_HEALTH_AGGREGATE_S` | `3600` | Health trend aggregation window |\n| `SYSTEMS_MANAGER_NODE_REF` | \u2014 | Runtime node alias; only a keyed digest persists |\n| `SYSTEMS_MANAGER_NOTIFY_TLS_PROFILE` | \u2014 | Optional inline mandatory-verification notification TLS profile |\n| `SYSTEMS_MANAGER_NOTIFY_TLS_PROFILE_REF` | \u2014 | Runtime reference to the notification TLS profile |\n| `SYSTEMS_MANAGER_MCP_IMAGE_DIGEST` | \u2014 | Required immutable MCP image digest |\n| `SYSTEMS_MANAGER_REPOSITORY_ALLOWLIST_JSON` | `[]` | Approved credential-free repositories |\n| `SYSTEMS_MANAGER_LOCAL_PACKAGE_SHA256_MAP` | `{}` | Approved package paths and digests |\n| `SYSTEMS_MANAGER_COMMAND_TIMEOUT_SECONDS` | `120` | Default command timeout |\n| `SYSTEMS_MANAGER_ENV_METADATA_ALLOWLIST` | \u2014 | Non-sensitive environment names readable as metadata |\n| `SYSTEMS_MANAGER_UV_VERSION` | \u2014 | Exact approved uv release |\n| `SYSTEMS_MANAGER_NVM_COMMIT` | \u2014 | Exact approved NVM commit |\n| `SYSTEMS_MANAGER_NVM_DIR` | \u2014 | NVM directory beneath the managed filesystem root |\n| `ALLOW_UPDATE_ON_K8S` | `false` | Keep Kubernetes lifecycle guard enabled |\n| `MISCTOOL` | `true` | Register base health/readiness tools |\n| `OS_PROVIDERTOOL` | `true` | Register operating-system provider tools |\n| `STORAGE_HEALTHTOOL` | `true` | Register storage health tools |\n| `TRANSPORT` | `stdio` | Local MCP transport |\n| `HOST` | `127.0.0.1` | Loopback bind for HTTP transports |\n| `PORT` | `8000` | Bind port for HTTP transports |\n| `ENABLE_OTEL` | `false` | Enable only with an approved collector |\n\n#### Inherited agent-connector-sdk variables (apply to every connector)\n\n| Variable | Example | Description |\n|----------|---------|-------------|\n| `MCP_ENABLED_TOOLS` | \u2014 | Comma-separated tool allow-list |\n| `MCP_DISABLED_TOOLS` | \u2014 | Comma-separated tool deny-list |\n| `MCP_ENABLED_TAGS` | \u2014 | Comma-separated tag allow-list |\n| `MCP_DISABLED_TAGS` | \u2014 | Comma-separated tag deny-list |\n| `EUNOMIA_TYPE` | `none` | Authorization mode: `none` \\| `embedded` \\| `remote` |\n| `EUNOMIA_POLICY_FILE` | `mcp_policies.json` | Embedded Eunomia policy file |\n| `EUNOMIA_REMOTE_URL` | \u2014 | Remote Eunomia authorization server URL |\n| `OTEL_EXPORTER_OTLP_ENDPOINT` | \u2014 | OTLP collector endpoint |\n| `MCP_CLIENT_AUTH` | \u2014 | Outbound MCP child auth: `oidc-client-credentials` \\| `basic` \\| `none` |\n| `OIDC_CLIENT_ID` | \u2014 | OIDC client id (service-account auth) |\n| `OIDC_CLIENT_SECRET_REF` | `secret://identity/oidc-client-secret` | Runtime secret reference for the OIDC service account |\n| `MCP_BASIC_AUTH_USERNAME` | \u2014 | HTTP Basic username (`MCP_CLIENT_AUTH=basic`) |\n| `MCP_BASIC_AUTH_PASSWORD_REF` | `secret://identity/mcp-basic-password` | Runtime secret reference for HTTP Basic auth (`MCP_CLIENT_AUTH=basic`) |\n| `DEBUG` | `False` | Verbose logging |\n| `PYTHONUNBUFFERED` | `1` | Unbuffered stdout (recommended in containers) |\n| `MCP_URL` | `http://localhost:8000/mcp` | URL of the MCP server the agent connects to |\n| `PROVIDER` | `openai` | LLM provider for the agent |\n| `MODEL_ID` | `gpt-4o` | Model id for the agent |\n| `ENABLE_WEB_UI` | `True` | Serve the AG-UI web interface |\n\n_51 package + 19 inherited variable(s). Auto-generated from `.env.example` + the shared agent-connector-sdk set \u2014 do not edit._\n<!-- ENV-VARS-TABLE:END -->\n\n## Development and release gates\n\n```bash\npytest -q\nruff check systems_manager tests\nblack --check systems_manager tests\nmkdocs build --strict\npre-commit run --all-files\n```\n\nRun host operations only through mocks during tests. Do not run native builds or live\nhost mutations as a validation shortcut. The source dependency floor is intentionally\n`agent-connector-sdk>=2.0.0`; regenerate and commit a neutral lock only after that release\nis available from the configured package index. Never commit an editable local source\nor a stale dependency resolution.\n\nSee [the documentation](docs/index.md) for installation, deployment, configuration,\nusage, multi-host delegation, and security details.\n\n\n\n<!-- GOVERNED-CAPABILITY:START -->\n## Governed capability contract\n\nThis package ships a compact canonical skill surface with specialist procedures\nkept as referenced workflows. The current MCP tools, skill metadata,\n`connector_manifest.yml`, ontology, mappings, shapes, fixtures, migrations,\ntool-schema fingerprints, and certification metadata form one versioned\ncapability contract. Validate them together; do not rely on stale tool names or\nhistorical per-task skill wrappers.\n\nRuntime endpoints, credentials, certificate trust, tenant identity, retention,\nand observability policy are deployment inputs and are never packaged values.\nSee [Configuration, trust, and privacy](docs/configuration.md) before enabling a\nnetwork transport, connector ingestion, Arbora delegation, or trace export.\n<!-- GOVERNED-CAPABILITY:END -->\n",
+                  "description": "# systems-manager\n\nVersion: 2.2.4\n\n`systems-manager` is the typed host-operations provider for Agent Connector SDK and\nArbora. It exposes cross-platform package, service, process, network, disk,\nmanaged-file, firewall, physical-storage, Agent OS, and privacy-safe host-ingestion\ncapabilities without exposing a raw command tool.\n\nThe current package requires Python 3.11\u20133.14 and\n`agent-connector-sdk>=2.0.0,<3.0.0`.\n\n## Install and run\n\nInstall only the interface the operator need:\n\n```bash\npip install \"systems-manager[mcp]\"\nsystems-manager-mcp --transport stdio\n```\n\nThe optional extras are:\n\n| Extra | Capability |\n| --- | --- |\n| `mcp` | FastMCP provider runtime |\n| `agent` | Agent server and Logfire integration |\n| `all` | MCP plus agent runtime |\n| `test` | Test dependencies |\n\nFor an ephemeral MCP start:\n\n```bash\nuvx --from \"systems-manager[mcp]\" systems-manager-mcp --transport stdio\n```\n\nThe checked-in `mcp_config.json` is a reference-only client catalog. It contains\n`env://` references and safe deny defaults, never deployment endpoints, credentials,\ncertificate paths, filesystem paths, hostnames, or identities. Project-specific values\nbelong in AgentConfig or the process launcher.\n\n## Security contract\n\n- Network MCP listeners require configured authentication. Non-loopback listeners also\n  require direct TLS or a trusted TLS-stop proxy, exact allowed hosts, and the\n  current Agent Connector SDK transport checks.\n- Host mutations are denied unless `SYSTEMS_MANAGER_ALLOW_HOST_MUTATIONS=true` and the\n  individual request receives destructive-operation approval.\n- Managed-file writes also require\n  `SYSTEMS_MANAGER_ALLOW_FILESYSTEM_MUTATIONS=true`.\n- Sensitive reads and active probes have independent default-deny gates.\n- Managed paths are confined beneath an explicit\n  `SYSTEMS_MANAGER_FILESYSTEM_ROOT`; there is no working-directory fallback.\n- Raw shell, arbitrary commands, plaintext credentials, model-authored cron creation,\n  and compatibility command aliases are not capabilities.\n- Logs and observability are metadata-only. Keep `LANGFUSE_CAPTURE_CONTENT=false`.\n\n## AgentConfig, secrets, and TLS\n\nUse `TLS_PROFILE` / `TLS_PROFILE_REF` with `TLS_PROFILES_REF` for shared checked\noutbound trust. Service-specific profiles such as `OIDC_TLS_PROFILE_REF`,\n`MODEL_TLS_PROFILE_REF`, and `LANGFUSE_TLS_PROFILE_REF` may select entries from the\nsame runtime catalog. Do not hardcode CA paths or verification flags in application\ncode, and do not disable verification for incomplete certificate chains.\n\nOut-of-band BMC health reads consume one runtime secret projection from\n`SYSTEMS_MANAGER_BMC_CREDENTIALS`. AgentConfig resolves the checked `env://` or secret\nreference before start; the provider accepts exactly a JSON object with `host`, `user`,\nand `password`. No secret-store vendor, secret path, token, or credential value is\nembedded in this package.\n\nThe MCP listener's own certificate or trusted-proxy boundary uses the current Agent\nUtilities `MCP_TLS_*` configuration. The optional agent listener uses `SERVER_TLS_*`\nand requires JWT configuration for non-loopback serving.\n\n## MCP tools\n\nThe default `MCP_TOOL_MODE=intent` exposes the small intent-verb surface. Backing\naction-routed tools stay available for governed discovery and on-demand loading. Tool\nand tag filters can further reduce the visible surface.\n\n_Auto-generated from the live MCP server; do not edit between the markers._\n\n<!-- MCP-TOOLS-TABLE:START -->\n\n#### Condensed action-routed tools (`MCP_TOOL_MODE=condensed`)\n\n| MCP Tool | Toggle Env Var | Description |\n|----------|----------------|-------------|\n| `capture_system_snapshot` | `OS_PROVIDERTOOL` | Takes a point-in-time snapshot of the system state (CPU, RAM, Processes). |\n| `get_management_capabilities` | \u2014 |  |\n| `get_network_connections` | `OS_PROVIDERTOOL` | Maps active TCP/UDP endpoints directly to owning processes. |\n| `get_process_details` | `OS_PROVIDERTOOL` | Retrieves deep cross-platform process details (threads, modules, memory). |\n| `health_check` | \u2014 |  |\n| `list_kernel_modules` | `OS_PROVIDERTOOL` | List loaded drivers/modules (lsmod or driverquery). |\n| `list_services` | `OS_PROVIDERTOOL` | Cross-platform service enumeration (systemctl or Get-Service). |\n| `manage_service` | `OS_PROVIDERTOOL` | Start/Stop/Restart/Enable/Disable services cross-platform. |\n| `query_system_logs` | `OS_PROVIDERTOOL` | Cross-platform log querying (journalctl or Get-WinEvent). |\n| `sm_advanced_operations` | \u2014 | Operations for SSH and specialized managers |\n| `sm_agent_identity_operations` | `IDENTITYTOOL` | Issues or verifies privacy-preserving agent identities. |\n| `sm_agent_scheduler_operations` | `AGENT_HEALTHTOOL` | Manages the cognitive scheduler: get stats, list processes, preempt, or reset quota. |\n| `sm_agent_specialist_operations` | `SPECIALIST_REGISTRYTOOL` | Manages specialist packages: install, uninstall, list, or search. |\n| `sm_agent_watchdog_operations` | `WATCHDOGTOOL` | Manages file watchdog triggers: check file change, list active watchers, or drain triggers. |\n| `sm_cron_operations` | \u2014 | Operations for cron jobs |\n| `sm_disk_operations` | \u2014 | Operations for managing system disks |\n| `sm_file_operations` | \u2014 | Operations for file and log management |\n| `sm_firewall_operations` | \u2014 | Operations for firewall management |\n| `sm_network_operations` | \u2014 | Operations for network analysis |\n| `sm_process_operations` | \u2014 | Operations for managing system processes |\n| `sm_service_operations` | \u2014 | Operations for managing system services |\n| `sm_storage_health` | `STORAGE_HEALTHTOOL` | Physical disk + BMC drive-fault health: SMART (incl. megaraid passthrough), |\n| `sm_system_operations` | \u2014 | System operations for managing packages, system health, and updates |\n| `sm_user_operations` | \u2014 | Operations for user and group management |\n| `start_system_trace` | `OS_PROVIDERTOOL` | Start a kernel-level event trace (ETW on Windows, or strace on Linux). |\n| `stop_system_trace` | `OS_PROVIDERTOOL` | Stop a kernel-level event trace. |\n| `systems_ingest_host` | \u2014 | Ingest a keyed host telemetry projection through the governed ChangeEnvelope boundary as typed HardwareNode, NetworkInterface, and DiskVolume nodes. |\n\n_27 action-routed tool(s) \u00b7 0 verbose 1:1 tool(s). Each is enabled unless its `<DOMAIN>TOOL` toggle is set false; `MCP_TOOL_MODE` selects the surface (**`intent` default** \u2014 the six verb-tools, granular set loaded on demand \u00b7 `condensed` action-routed \u00b7 `verbose` 1:1 \u00b7 `both`). Auto-generated \u2014 do not edit._\n<!-- MCP-TOOLS-TABLE:END -->\n\nTypical backing domains include OS/package lifecycle, services, processes, networks,\ndisks, managed files, cron removal, structured firewall rules, storage/BMC diagnostics,\nAgent OS administration, and governed host telemetry ingestion. Discover an action\nschema before calling it; unavailable operations must not be emulated with another\ntool.\n\n## Knowledge-graph ingestion\n\n`systems_ingest_host` reads local typed telemetry and submits an allowlisted projection\nthrough the Agent Connector SDK native governed ingestion boundary. It emits only:\n\n- `HardwareNode`, `NetworkInterface`, and `DiskVolume` nodes;\n- `hasInterface` and `hasVolume` relationships;\n- HMAC-SHA-256 opaque identifiers derived with the deployment-owned\n  `SYSTEMS_MANAGER_PSEUDONYMIZATION_KEY`.\n\nHostnames, network addresses, hardware addresses, usernames, local paths, credentials,\nand arbitrary extra fields are rejected or excluded. Missing graph authority, invalid\ncontent, and unavailable ingestion fail explicitly; they are not silent no-ops.\n\n## Arbora delegation\n\nHost operations run inside the service's local operating-system boundary. For\nfleet work, Arbora delegates to an authenticated systems-manager service on the target\nboundary. Inventory, endpoints, credentials, TLS profiles, and target aliases remain\nexternal deployment configuration. Persist only opaque, non-personal references.\n\nThe bundled `systems-manager-operations` skill covers every current provider workflow.\nOlder BMC command and NIC-bond script skills were consolidated because those raw-script\nsurfaces are not part of the typed current contract.\n\n## Agent server\n\nInstall the agent extra and start:\n\n```bash\nsystems-manager-agent --help\n```\n\nWorkspace, MCP catalog, and custom-skill paths are accepted only when explicitly\nconfigured and present. There is no packaged-config or current-directory fallback.\nA non-loopback listener requires an explicit allow gate, direct or trusted-proxy TLS,\nJWT issuer/JWKS/audience configuration, and debug mode disabled.\n\n## Environment variables\n\nThe generated table is sourced from the value-free `.env.example` plus the inherited\nAgent Connector SDK contract.\n\n<!-- ENV-VARS-TABLE:START -->\n\n#### Package environment variables\n\n| Variable | Example | Description |\n|----------|---------|-------------|\n| `SYSTEMS_MANAGER_FILESYSTEM_ROOT` | \u2014 | Required managed filesystem boundary |\n| `SYSTEMS_MANAGER_TEMP_ROOT` | \u2014 | Optional cleanup root beneath the managed boundary |\n| `SYSTEMS_MANAGER_PSEUDONYMIZATION_KEY` | secret-injected | Deployment-owned secret, at least 32 bytes |\n| `SYSTEMS_MANAGER_BMC_CREDENTIALS` | \u2014 | Secret-projected JSON with host/user/password |\n| `TLS_PROFILE` | \u2014 | Shared mandatory-verification transport profile |\n| `TLS_PROFILES_REF` | \u2014 | Runtime reference to the transport profile catalog |\n| `LANGFUSE_TLS_PROFILE_REF` | \u2014 | Runtime reference to verified Langfuse trust |\n| `MCP_TOOL_MODE` | `intent` | Current intent-first tool surface |\n| `SYSTEMS_MANAGER_ALLOW_HOST_MUTATIONS` | `false` | Default-deny host mutations |\n| `SYSTEMS_MANAGER_ALLOW_FILESYSTEM_MUTATIONS` | `false` | Default-deny file mutations |\n| `SYSTEMS_MANAGER_ALLOW_SENSITIVE_READS` | `false` | Default-deny sensitive inventory |\n| `SYSTEMS_MANAGER_ALLOW_NETWORK_PROBES` | `false` | Default-deny active probes |\n| `SYSTEMS_MANAGER_MAX_BLOCKING_OPERATIONS` | `2` | Bounded host-operation concurrency |\n| `SYSTEMS_MANAGER_HEALTH_INGEST` | `true` | Enable governed health trend ingestion |\n| `SYSTEMS_MANAGER_HEALTH_AGGREGATE_S` | `3600` | Health trend aggregation window |\n| `SYSTEMS_MANAGER_NODE_REF` | \u2014 | Runtime node alias; only a keyed digest persists |\n| `SYSTEMS_MANAGER_NOTIFY_TLS_PROFILE` | \u2014 | Optional inline mandatory-verification notification TLS profile |\n| `SYSTEMS_MANAGER_NOTIFY_TLS_PROFILE_REF` | \u2014 | Runtime reference to the notification TLS profile |\n| `SYSTEMS_MANAGER_MCP_IMAGE_DIGEST` | \u2014 | Required immutable MCP image digest |\n| `SYSTEMS_MANAGER_REPOSITORY_ALLOWLIST_JSON` | `[]` | Approved credential-free repositories |\n| `SYSTEMS_MANAGER_LOCAL_PACKAGE_SHA256_MAP` | `{}` | Approved package paths and digests |\n| `SYSTEMS_MANAGER_COMMAND_TIMEOUT_SECONDS` | `120` | Default command timeout |\n| `SYSTEMS_MANAGER_ENV_METADATA_ALLOWLIST` | \u2014 | Non-sensitive environment names readable as metadata |\n| `SYSTEMS_MANAGER_UV_VERSION` | \u2014 | Exact approved uv release |\n| `SYSTEMS_MANAGER_NVM_COMMIT` | \u2014 | Exact approved NVM commit |\n| `SYSTEMS_MANAGER_NVM_DIR` | \u2014 | NVM directory beneath the managed filesystem root |\n| `ALLOW_UPDATE_ON_K8S` | `false` | Keep Kubernetes lifecycle guard enabled |\n| `MISCTOOL` | `true` | Register base health/readiness tools |\n| `OS_PROVIDERTOOL` | `true` | Register operating-system provider tools |\n| `STORAGE_HEALTHTOOL` | `true` | Register storage health tools |\n| `TRANSPORT` | `stdio` | Local MCP transport |\n| `HOST` | `127.0.0.1` | Loopback bind for HTTP transports |\n| `PORT` | `8000` | Bind port for HTTP transports |\n| `ENABLE_OTEL` | `false` | Enable only with an approved collector |\n\n#### Inherited agent-connector-sdk variables (apply to every connector)\n\n| Variable | Example | Description |\n|----------|---------|-------------|\n| `MCP_ENABLED_TOOLS` | \u2014 | Comma-separated tool allow-list |\n| `MCP_DISABLED_TOOLS` | \u2014 | Comma-separated tool deny-list |\n| `MCP_ENABLED_TAGS` | \u2014 | Comma-separated tag allow-list |\n| `MCP_DISABLED_TAGS` | \u2014 | Comma-separated tag deny-list |\n| `EUNOMIA_TYPE` | `none` | Authorization mode: `none` \\| `embedded` \\| `remote` |\n| `EUNOMIA_POLICY_FILE` | `mcp_policies.json` | Embedded Eunomia policy file |\n| `EUNOMIA_REMOTE_URL` | \u2014 | Remote Eunomia authorization server URL |\n| `OTEL_EXPORTER_OTLP_ENDPOINT` | \u2014 | OTLP collector endpoint |\n| `MCP_CLIENT_AUTH` | \u2014 | Outbound MCP child auth: `oidc-client-credentials` \\| `basic` \\| `none` |\n| `OIDC_CLIENT_ID` | \u2014 | OIDC client id (service-account auth) |\n| `OIDC_CLIENT_SECRET_REF` | `secret://identity/oidc-client-secret` | Runtime secret reference for the OIDC service account |\n| `MCP_BASIC_AUTH_USERNAME` | \u2014 | HTTP Basic username (`MCP_CLIENT_AUTH=basic`) |\n| `MCP_BASIC_AUTH_PASSWORD_REF` | `secret://identity/mcp-basic-password` | Runtime secret reference for HTTP Basic auth (`MCP_CLIENT_AUTH=basic`) |\n| `DEBUG` | `False` | Verbose logging |\n| `PYTHONUNBUFFERED` | `1` | Unbuffered stdout (recommended in containers) |\n| `MCP_URL` | `http://localhost:8000/mcp` | URL of the MCP server the agent connects to |\n| `PROVIDER` | `openai` | LLM provider for the agent |\n| `MODEL_ID` | `gpt-4o` | Model id for the agent |\n| `ENABLE_WEB_UI` | `True` | Serve the AG-UI web interface |\n\n_51 package + 19 inherited variable(s). Auto-generated from `.env.example` + the shared agent-connector-sdk set \u2014 do not edit._\n<!-- ENV-VARS-TABLE:END -->\n\n## Development and release gates\n\n```bash\npytest -q\nruff check systems_manager tests\nblack --check systems_manager tests\nmkdocs build --strict\npre-commit run --all-files\n```\n\nRun host operations only through mocks during tests. Do not run native builds or live\nhost mutations as a validation shortcut. The source dependency floor is intentionally\n`agent-connector-sdk>=2.0.0`; regenerate and commit a neutral lock only after that release\nis available from the configured package index. Never commit an editable local source\nor a stale dependency resolution.\n\nSee [the documentation](docs/index.md) for installation, deployment, configuration,\nusage, multi-host delegation, and security details.\n\n\n\n<!-- GOVERNED-CAPABILITY:START -->\n## Governed capability contract\n\nThis package ships a compact canonical skill surface with specialist procedures\nkept as referenced workflows. The current MCP tools, skill metadata,\n`connector_manifest.yml`, ontology, mappings, shapes, fixtures, migrations,\ntool-schema fingerprints, and certification metadata form one versioned\ncapability contract. Validate them together; do not rely on stale tool names or\nhistorical per-task skill wrappers.\n\nRuntime endpoints, credentials, certificate trust, tenant identity, retention,\nand observability policy are deployment inputs and are never packaged values.\nSee [Configuration, trust, and privacy](docs/configuration.md) before enabling a\nnetwork transport, connector ingestion, Arbora delegation, or trace export.\n<!-- GOVERNED-CAPABILITY:END -->\n",
                   "description_content_type": "text/markdown",
                   "author_email": "Project Maintainers <maintainers@users.noreply.github.com>",
                   "license": "MIT",

{systems_manager-2.2.3 → systems_manager-2.2.4}/systems_manager/mcp_server.py

@@ -51,7 +51,7 @@ from systems_manager.systems_manager import (
     resolve_managed_path,
 )
 
-__version__ = "2.2.3"
+__version__ = "2.2.4"
 
 logging.basicConfig(
     level=logging.WARNING,

{systems_manager-2.2.3 → systems_manager-2.2.4}/systems_manager/systems_manager.py

@@ -32,7 +32,7 @@ from pydantic import BaseModel, ConfigDict, Field, field_validator, model_valida
 
 from systems_manager.k8s_detect import is_k8s_node
 
-__version__ = "2.2.3"
+__version__ = "2.2.4"
 
 _MAX_MANAGED_FILE_BYTES = 8 * 1024 * 1024
 _MAX_LOCAL_PACKAGE_BYTES = 2 * 1024 * 1024 * 1024

{systems_manager-2.2.3 → systems_manager-2.2.4}/systems_manager.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: systems-manager
-Version: 2.2.3
+Version: 2.2.4
 Summary: Systems Manager will update your system and install/upgrade applications. Additionally, as allow AI to perform these activities as an MCP Server
 Author-email: Project Maintainers <maintainers@users.noreply.github.com>
 License: MIT
@@ -28,7 +28,7 @@ Dynamic: license-file
 
 # systems-manager
 
-Version: 2.2.3
+Version: 2.2.4
 
 `systems-manager` is the typed host-operations provider for Agent Connector SDK and
 Arbora. It exposes cross-platform package, service, process, network, disk,

{systems_manager-2.2.3 → systems_manager-2.2.4}/systems_manager.egg-info/SOURCES.txt

@@ -63,6 +63,7 @@ systems_manager/skills/systems-manager-operations/references/catalog.md
 tests/__init__.py
 tests/conftest.py
 tests/health_check2.py
+tests/test_default_content_surfaces.py
 tests/test_file_manager.py
 tests/test_fleet_name.py
 tests/test_init.py

systems_manager-2.2.4/tests/test_default_content_surfaces.py

@@ -0,0 +1,43 @@
+"""CONN-SYSTEMS-MANAGER-CONNECTOR-CONTENT-R001: the server lists its packaged skills, ontology and prompts by default."""
+
+from __future__ import annotations
+
+import asyncio
+import importlib
+from pathlib import Path
+
+import pytest
+from fastmcp import Client
+
+PACKAGE = "systems_manager"
+ROOT = Path(list(importlib.import_module(PACKAGE).__path__)[0])
+
+pytestmark = pytest.mark.spec("CONN-SYSTEMS-MANAGER-CONNECTOR-CONTENT-R001")
+
+
+def _server():
+    namespace = {"__name__": PACKAGE + ".mcp_server"}
+    exec(
+        "from agent_connector_sdk.mcp.server import create_mcp_server\n"
+        "result = create_mcp_server('systems-manager-mcp', version='0', command_args=[])",
+        namespace,
+    )
+    return namespace["result"][1]
+
+
+async def _listings():
+    async with Client(_server()) as client:
+        resources = {str(r.uri) for r in await client.list_resources()}
+        prompts = {p.name for p in await client.list_prompts()}
+    return resources, prompts
+
+
+def test_default_content_surfaces() -> None:
+    resources, prompts = asyncio.run(_listings())
+    if list(ROOT.glob("skills/*/SKILL.md")):
+        assert any(u.startswith("skill://") for u in resources)
+    if list(ROOT.glob("ontology/*.ttl")):
+        assert any(u.startswith("ontology://systems-manager-mcp/") for u in resources)
+    for path in ROOT.glob("prompts/*.json"):
+        if not path.name.startswith("_"):
+            assert path.stem in prompts