feat(docker): collect + persist /system/df image/disk usage (agent 1.6.0)

Backend for the image/disk panel (milestone 77 #942). Agent gains
collect_disk_usage() — one /system/df call (gated on containers existing, so
Docker-less hosts pay nothing), surfacing reclaimable bytes (image size held by
unreferenced images), layers/containers/volumes/build-cache sizes, and the top
50 images by size. Emitted as sample["docker_disk"]; host_agent ingest tracks
the newest sample's copy and hands it to the docker capability as a 5th arg.

New current-state tables docker_disk_usage (one row/host) + docker_images
(per-host image rows), docker_007 migration; ingest upserts the summary and
replaces the image set per host (stale images pruned). Unit tests for the df
parsing/reclaimable math + build_sample gating; integration test for
persistence + image-set replacement.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Jg27rgypiW2efULXJDtMC

.dockerignore

@@ -26,8 +26,9 @@ config.yaml
 # Runtime data (mounted at runtime via volume)
 playbook_cache/
 
-# Plugins (mounted at runtime via volume)
-plugins/
+# NOTE: first-party plugins under plugins/ now ship IN the image
+# (Dockerfile `COPY plugins/`), so plugins/ must NOT be ignored here.
+# Third-party plugins are mounted at runtime into /data/plugins instead.
 
 # Deployment files not needed in image
 docker-compose.yml

.env.example

@@ -1,6 +1,11 @@
 # Copy to .env for Docker / local development secrets
 # These override values in config.yaml
 
-ROUNDTABLE_SECRET_KEY=change-me
-ROUNDTABLE_DATABASE__URL=postgresql+asyncpg://roundtable:password@localhost/roundtable
-ROUNDTABLE_SMTP__PASSWORD=
+STEWARD_DATABASE_URL=postgresql+asyncpg://steward:password@localhost/steward
+STEWARD_SMTP__PASSWORD=
+
+# --- compose.deploy.yml (remote instance) only ---
+# Password for the bundled Postgres; the steward service builds its
+# STEWARD_DATABASE_URL from it. Leave STEWARD_SECRET_KEY above unset to let the
+# app generate + persist one on the /data volume.
+POSTGRES_PASSWORD=change-me

.forgejo/workflows/ci.yml

@@ -0,0 +1,129 @@
+name: CI
+
+# CI lanes per FabledRulebook forgejo.md "CI philosophy":
+#   - lint:        ruff only, no dep install — fast-fail for the common lint bounce.
+#   - unit:        pytest -m "not integration"; no service containers, no DB.
+#   - integration: postgres service container; boots the real app + runs all
+#                  (core + bundled-plugin) migrations.
+# Single repo: first-party plugins are bundled in-tree under plugins/, so the
+# unit lane imports them directly — no cross-repo checkout.
+
+on:
+  push:
+    branches: [dev, main]
+  # pull_request intentionally absent — push on [dev, main] already fires CI for
+  # every dev commit and dev→main PRs. Single-operator repo, no fork PRs.
+
+jobs:
+  # Fast-fail lint lane. ruff is pre-installed in the ci-python image, so this
+  # runs with NO dependency install and surfaces lint bounces in seconds.
+  lint:
+    runs-on: python-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-python:3.14
+    steps:
+      - uses: actions/checkout@v4
+      - name: Ruff lint
+        run: ruff check steward/ plugins/ tests/
+
+  unit:
+    runs-on: python-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-python:3.14
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Steward + test deps
+        # uv: 5-10x faster wheel resolve than pip on cold caches. Falls back to
+        # pip on uv-missing runners. Steward declares its deps in pyproject; the
+        # [dev] extra adds pytest + pytest-asyncio.
+        run: |
+          if command -v uv >/dev/null 2>&1; then
+            uv pip install --system -e '.[dev]'
+          else
+            pip install -e '.[dev]'
+          fi
+      - name: Pytest (unit only — integration runs in its own lane)
+        run: pytest tests/ -v -m "not integration"
+
+  integration:
+    runs-on: python-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-python:3.14
+    env:
+      STEWARD_SECRET_KEY: ci_integration_placeholder
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: steward
+          POSTGRES_PASSWORD: steward
+          POSTGRES_DB: steward
+        options: >-
+          --health-cmd "pg_isready -U steward"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Boot + migrate against Postgres
+        # act_runner (swarm-runner) puts service containers on the default bridge
+        # with no embedded DNS, so the hostname `postgres` won't resolve — we
+        # discover the service container's bridge IP via the docker socket. The
+        # job name `integration` (no underscore) is the docker-ps name filter.
+        run: |
+          set -euxo pipefail
+          echo "=== container landscape (diagnostic for filter scoping) ==="
+          docker ps -a --format '{{.ID}} {{.Image}} -> {{.Names}}'
+          echo "=== end landscape ==="
+          PG=$(docker ps --filter "name=integration" --filter "ancestor=postgres:16-alpine" -q | head -n1)
+          test -n "$PG"
+          PG_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$PG")
+          test -n "$PG_IP"
+          export STEWARD_DATABASE_URL="postgresql+asyncpg://steward:steward@$PG_IP:5432/steward"
+          for i in $(seq 1 60); do
+            (echo > "/dev/tcp/$PG_IP/5432") >/dev/null 2>&1 && break
+            sleep 2
+          done
+          if command -v uv >/dev/null 2>&1; then
+            uv pip install --system -e '.[dev,ansible]'
+          else
+            pip install -e '.[dev,ansible]'
+          fi
+          pytest tests/integration -v -m integration --durations=10
+
+  # Image-publish lane — FabledRulebook rule 46: every push to dev/main publishes
+  # an immutable commit-SHA image (the rollback unit); dev moves :dev, main moves
+  # :latest. Gated on the three test lanes via `needs:` so a red commit never
+  # produces a :dev image. Mechanics mirror CI-runner's build-ci-python.yml.
+  publish:
+    needs: [lint, unit, integration]
+    runs-on: python-ci
+    container:
+      # ci-builder carries docker + buildx + git. The docker socket is
+      # auto-mounted by act_runner (valid_volumes) — do NOT add a
+      # container.options "-v /var/run/docker.sock:..." mount; that duplicate
+      # mount fails the job at "Set up job".
+      image: git.fabledsword.com/bvandeusen/ci-builder:latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Registry login
+        # The injected GITHUB_TOKEN lacks write:package scope, so docker push
+        # 401s with it. REGISTRY_TOKEN is a repo Actions secret holding a
+        # Forgejo token scoped read:package + write:package.
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.fabledsword.com -u bvandeusen --password-stdin
+      - name: Build + push (commit-SHA always; :dev on dev, :latest on main)
+        run: |
+          set -euxo pipefail
+          IMAGE=git.fabledsword.com/bvandeusen/steward
+          docker build -t "$IMAGE:${{ github.sha }}" .
+          docker push "$IMAGE:${{ github.sha }}"
+          if [ "${{ github.ref }}" = "refs/heads/dev" ]; then
+            docker tag "$IMAGE:${{ github.sha }}" "$IMAGE:dev"
+            docker push "$IMAGE:dev"
+          elif [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            docker tag "$IMAGE:${{ github.sha }}" "$IMAGE:latest"
+            docker push "$IMAGE:latest"
+          fi
+      - name: Prune dangling layers
+        if: always()
+        run: docker image prune -f

.gitignore

@@ -1,9 +1,10 @@
 # Planning files
 docs/superpowers/
 
-# Plugin directory — managed as a separate repo (bvandeusen/roundtable-plugins)
-# PLUGIN_DIR in config.yaml points here at runtime
-/plugins/
+# First-party plugins are tracked in-tree under plugins/ and ship in the image.
+# Third-party plugins are mounted at runtime into the external dir
+# (STEWARD_PLUGIN_DIR, default /data/plugins) and are not tracked here.
+/plugins/**/*.zip
 
 # Python
 __pycache__/
@@ -50,3 +51,9 @@ Thumbs.db
 
 # Playbook cache (runtime data)
 playbook_cache/
+
+# Superpowers brainstorm scratch (visual companion mockups, state)
+.superpowers/
+
+# Local dev Ansible playbooks (operator content, mounted into the container)
+/ansible-dev/

Dockerfile

@@ -5,6 +5,11 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get update \
         iputils-ping \
         # gosu — minimal privilege-drop tool used by entrypoint.sh
         gosu \
+        # openssh-client — ansible-playbook reaches remote hosts over ssh
+        openssh-client \
+        # sshpass — Ansible shells out to it for first-contact password SSH
+        # (provisioning a fresh host before the managed key is installed)
+        sshpass \
     && rm -rf /var/lib/apt/lists/*
 
 # Upgrade pip to suppress the version notice
@@ -13,16 +18,21 @@ RUN pip install --upgrade pip
 WORKDIR /app
 
 COPY pyproject.toml .
-COPY roundtable/ roundtable/
-RUN pip install --no-cache-dir .
+COPY steward/ steward/
+# .[ansible] pulls the full Ansible package so the playbook runner works in-image.
+RUN pip install --no-cache-dir '.[ansible]'
 
 COPY alembic.ini .
+# First-party plugins ship inside the image (bundled root at /app/plugins).
+# Third-party plugins are mounted at runtime into the external root
+# (STEWARD_PLUGIN_DIR, default /data/plugins).
+COPY plugins/ plugins/
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 # Runtime directories — owned by app user. The container starts as root
 # so the entrypoint can fix up /data permissions if needed, then drops to
-# 'app' (uid 1000) via gosu before launching roundtable.
+# 'app' (uid 1000) via gosu before launching steward.
 RUN useradd -m -u 1000 app \
     && mkdir -p /data/playbook_cache /data/plugins \
     && chown -R app:app /data /app
@@ -30,4 +40,4 @@ RUN useradd -m -u 1000 app \
 EXPOSE 5000
 
 ENTRYPOINT ["/entrypoint.sh"]
-CMD ["roundtable", "--host", "0.0.0.0", "--port", "5000"]
+CMD ["steward", "--host", "0.0.0.0", "--port", "5000"]

README.md

@@ -1,6 +1,6 @@
-# Roundtable
+# Steward
 
-A self-hosted network monitoring and infrastructure management hub for home servers. Roundtable gives you a single pane of glass over your hosts, services, and automation — with live-updating dashboards, alerting, and Ansible integration.
+A self-hosted network monitoring and infrastructure management hub for home servers. Steward gives you a single pane of glass over your hosts, services, and automation — with live-updating dashboards, alerting, and Ansible integration.
 
 ---
 
@@ -21,13 +21,49 @@ No JavaScript framework. No build step. No external workers or message brokers.
 
 ```bash
 cp .env.example .env
-# Set ROUNDTABLE_DATABASE_URL in .env
+# Set STEWARD_DATABASE_URL in .env
 
 docker compose up -d
 ```
 
 Open `http://localhost:5000`. On first run you'll be prompted to create the admin account.
 
+This compose file builds the image locally and bind-mounts the source for live editing. To run a persistent instance off the published CI image instead, see **Remote dev instance** below.
+
+---
+
+## Remote dev instance
+
+For a long-lived instance on a remote server that tracks the `dev` CI line, use `compose.deploy.yml`. It pulls the published image (`git.fabledsword.com/bvandeusen/steward:dev`) rather than building, runs no source bind-mounts, and persists data in named volumes.
+
+**One-time prerequisite — registry push token (on the Git host).** CI publishes the image, so the FabledSteward repo needs a push credential. The injected `GITHUB_TOKEN` lacks `write:package`, so create a Forgejo token scoped **`read:package` + `write:package`** and add it as the repo Actions secret **`REGISTRY_TOKEN`**. Until this exists, the `publish` CI job 401s and no `:dev` image is produced.
+
+**Standup (on the server):**
+
+```bash
+# 1. Authenticate to the registry (read:package token is enough to pull)
+docker login git.fabledsword.com -u <user>
+
+# 2. Configure secrets
+cp .env.example .env
+# Set POSTGRES_PASSWORD. Leave STEWARD_SECRET_KEY unset to let the app
+# generate + persist one on the /data volume.
+
+# 3. Pull + boot
+docker compose -f compose.deploy.yml up -d
+```
+
+Open `http://<server>:5000` and create the admin account on first run.
+
+**Update to the latest dev build:**
+
+```bash
+docker compose -f compose.deploy.yml pull
+docker compose -f compose.deploy.yml up -d
+```
+
+Every push to `dev` that goes CI-green publishes a fresh `:dev` (and an immutable `:<commit-sha>` for rollback). To pin a specific commit, change the `image:` tag in `compose.deploy.yml` to `:<sha>`.
+
 ---
 
 ## Quick Start — Bare Metal
@@ -41,7 +77,7 @@ pip install -e .
 cp config.example.yaml config.yaml
 # Edit config.yaml — set database.url at minimum
 
-roundtable --host 0.0.0.0 --port 5000
+steward --host 0.0.0.0 --port 5000
 ```
 
 ICMP ping requires `CAP_NET_RAW` or the `setuid` ping binary. TCP mode (the default) needs no elevated privileges.
@@ -54,7 +90,7 @@ Only two things must be set to run the app:
 
 | What | How |
 |---|---|
-| Database URL | `ROUNDTABLE_DATABASE_URL` env var or `database.url` in `config.yaml` |
+| Database URL | `STEWARD_DATABASE_URL` env var or `database.url` in `config.yaml` |
 | Secret key | Auto-generated on first run and saved to `/data/secret.key` |
 
 Everything else — SMTP, webhooks, monitor intervals, Ansible sources, plugin settings — is configured through the web UI at `/settings/`.

alembic.ini

@@ -1,5 +1,5 @@
 [alembic]
-script_location = roundtable/migrations
+script_location = steward/migrations
 prepend_sys_path = .
 version_path_separator = os
 

ci-requirements.md

@@ -0,0 +1,58 @@
+# CI Requirements — Steward
+
+> Spec: https://git.fabledsword.com/bvandeusen/CI-runner/src/branch/main/docs/process.md
+
+## Runtime image
+
+git.fabledsword.com/bvandeusen/ci-python:3.14
+
+## Image deps used
+
+- python 3.14
+- ruff (analyzer for `steward/`, `plugins/`, `tests/`)
+- docker CLI (integration lane: bridge-IP discovery of the Postgres service container)
+
+## Per-job tool installs
+
+- `uv pip install --system -e '.[dev]'` (pip fallback) — in the `unit` job.
+- `uv pip install --system -e '.[dev,ansible]'` (pip fallback) — in the
+  `integration` job, which boots the real app and exercises the Ansible runner,
+  so it needs the `ansible` extra (`ansible>=10,<13`) at import time.
+
+  Steward declares its deps in `pyproject.toml`; the `[dev]` extra adds
+  `pytest` + `pytest-asyncio`. No `requirements.txt` is tracked.
+
+## Lanes
+
+- **lint** — `ruff check steward/ plugins/ tests/`, no dep install.
+- **unit** — `pytest -m "not integration"`. The whole current suite runs here:
+  it builds the app with `testing=True`, which mocks `db_sessionmaker`, so no DB
+  is touched. First-party plugins are bundled in-tree under `plugins/`, so plugin
+  unit tests import them directly — no cross-repo checkout.
+- **integration** — `pytest tests/integration -m integration` against a
+  `postgres:16-alpine` service. The single test boots the real app
+  (`create_app(testing=False)`), which runs core + every bundled plugin's
+  migrations, then round-trips the DB. This is the guard that the folded-in
+  plugin migration graph resolves.
+- **publish** — builds the runtime `Dockerfile` and pushes to the package
+  registry. Runs in `ci-builder:latest` (docker + buildx, socket auto-mounted),
+  gated on `needs: [lint, unit, integration]` so a red commit never ships an
+  image. Publishes `git.fabledsword.com/bvandeusen/steward:<sha>` always, plus
+  `:dev` on `dev` and `:latest` on `main` (FabledRulebook rule 46). Needs the
+  `REGISTRY_TOKEN` repo Actions secret (`read:package` + `write:package`) —
+  the injected `GITHUB_TOKEN` can't push packages.
+
+## Notes
+
+- Steward has **no frontend and no Redis/Celery** (no external workers), so there
+  is no frontend-build lane and the only service container is Postgres.
+- Integration uses Forgejo Actions `services:` + a socket-discovered bridge IP
+  because `act_runner` (swarm-runner v0.6+) puts services on the default bridge
+  with no embedded DNS. FabledCurator's `ci.yml` is the canonical example of the
+  pattern; Steward's is the same shape minus Redis and minus sharding.
+- The job name `integration` has no underscore — `act_runner` strips underscores
+  from job names when building service-container labels, so the `docker ps`
+  name filter uses the bare job name.
+- Migrations run via the app itself (`create_app` → `run_core_migrations`, async
+  through `asyncpg`), so the integration lane needs no separate `alembic upgrade`
+  step and no psycopg/sync driver.

compose.deploy.yml

@@ -0,0 +1,59 @@
+# Remote deployment — pulls the published :dev image instead of building locally.
+#
+# This is NOT the local-dev compose. `docker-compose.yml` bind-mounts ./steward
+# + ./plugins and runs --debug for live editing; THIS file runs the image as the
+# source of truth (no bind-mounts, no reloader) for a persistent remote instance
+# that tracks the dev CI line.
+#
+# Standup + update runbook: see README → "Remote dev instance".
+
+services:
+  steward:
+    image: git.fabledsword.com/bvandeusen/steward:dev
+    container_name: steward
+    # Re-pull :dev on every `up` so restarting the stack picks up the latest
+    # green dev build without a manual `docker pull`.
+    pull_policy: always
+    ports:
+      - "5000:5000"
+    networks:
+      - backend
+    volumes:
+      # /data holds the auto-generated secret key, third-party plugins, and the
+      # Ansible playbook cache — all of which must survive image updates. No
+      # source bind-mounts: core + first-party plugins live inside the image.
+      - app_data:/data
+    environment:
+      - STEWARD_DATABASE_URL=postgresql+asyncpg://steward:${POSTGRES_PASSWORD:-steward}@db/steward
+      # STEWARD_SECRET_KEY is intentionally absent — the app generates a random
+      # key on first boot and persists it to /data/secret.key, which the app_data
+      # volume keeps across image updates.
+    depends_on:
+      db:
+        condition: service_healthy
+    restart: unless-stopped
+
+  db:
+    image: postgres:16-alpine
+    networks:
+      - backend
+    environment:
+      POSTGRES_USER: steward
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-steward}
+      POSTGRES_DB: steward
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    # No host port published — db is reachable only on the backend network.
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U steward"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+networks:
+  backend:
+
+volumes:
+  pgdata:
+  app_data:

config.example.yaml

@@ -1,9 +1,9 @@
-# Roundtable — Bootstrap Configuration Example
+# Steward — Bootstrap Configuration Example
 #
 # The only REQUIRED setting is the database URL.
 # Set it via env var (recommended for Docker):
 #
-#   ROUNDTABLE_DATABASE_URL=postgresql+asyncpg://user:pass@host/db
+#   STEWARD_DATABASE_URL=postgresql+asyncpg://user:pass@host/db
 #
 # All other settings (SMTP, webhook, ansible, plugins, retention)
 # are stored in the database and managed via the Settings UI at /settings/.
@@ -11,7 +11,7 @@
 # config.yaml is optional. Use it only if you prefer file-based bootstrap.
 
 database:
-  url: "postgresql+asyncpg://roundtable:password@localhost/roundtable"
+  url: "postgresql+asyncpg://steward:password@localhost/steward"
 
 # Optional: override the auto-generated secret key.
 # If not set, a key is auto-generated on first run and saved to /data/secret.key.

docker-compose.yml

@@ -1,17 +1,31 @@
 services:
-  roundtable:
+  steward:
     build: .
-    container_name: roundtable
-    image: roundtable:latest
+    container_name: steward
+    image: steward:latest
+    # Dev: --debug turns on Quart's auto-reloader so edits to the mounted source
+    # below take effect without a rebuild.
+    command: ["steward", "--host", "0.0.0.0", "--port", "5000", "--debug"]
     ports:
       - "5000:5000"
     volumes:
       - app_data:/data
-      - ./plugins:/app/plugins:ro
-      - /mnt/Data/traefik/log:/var/log/traefik:ro
-      - /var/run/docker.sock:/var/run/docker.sock:ro
+      # Live-edit core + first-party plugins without rebuilding. PYTHONPATH=/app
+      # (below) makes this mounted source win over the image-installed package.
+      - ./steward:/app/steward
+      - ./plugins:/app/plugins
+      # Dev playbooks: edit on the host under ./ansible-dev/, register a *local*
+      # Ansible source pointing at /srv/ansible in Settings → Ansible.
+      - ./ansible-dev:/srv/ansible
+      # Optional host mounts — enable the matching plugin in Settings first, then
+      # uncomment (the traefik path must exist on this host):
+      #   - /mnt/Data/traefik/log:/var/log/traefik:ro     # traefik plugin
+      #   - /var/run/docker.sock:/var/run/docker.sock:ro  # docker plugin
     environment:
-      - ROUNDTABLE_DATABASE_URL=postgresql+asyncpg://fabledscryer:fabledscryer@db/fabledscryer
+      - STEWARD_DATABASE_URL=postgresql+asyncpg://steward:steward@db/steward
+      # Dev-only fixed key so sessions survive restarts. Replace in production.
+      - STEWARD_SECRET_KEY=dev-secret-key-change-me
+      - PYTHONPATH=/app
     depends_on:
       db:
         condition: service_healthy
@@ -20,13 +34,16 @@ services:
   db:
     image: postgres:16-alpine
     environment:
-      POSTGRES_USER: fabledscryer
-      POSTGRES_PASSWORD: fabledscryer
-      POSTGRES_DB: fabledscryer
+      POSTGRES_USER: steward
+      POSTGRES_PASSWORD: steward
+      POSTGRES_DB: steward
+    ports:
+      # Exposed for dev convenience (psql from the host). Drop for prod.
+      - "5432:5432"
     volumes:
       - pgdata:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U fabledscryer"]
+      test: ["CMD-SHELL", "pg_isready -U steward"]
       interval: 5s
       timeout: 5s
       retries: 5

docs/architecture.md

@@ -1,12 +1,12 @@
 # Architecture
 
-Roundtable is a single Quart (async Python) process. There are no separate worker processes, no message brokers, and no build pipeline for the frontend. All monitoring, scheduling, and request handling runs on a single asyncio event loop.
+Steward is a single Quart (async Python) process. There are no separate worker processes, no message brokers, and no build pipeline for the frontend. All monitoring, scheduling, and request handling runs on a single asyncio event loop.
 
 ---
 
 ## Startup Sequence
 
-`create_app()` in `roundtable/app.py` runs these steps synchronously before the event loop starts:
+`create_app()` in `steward/app.py` runs these steps synchronously before the event loop starts:
 
 | Step | What happens |
 |---|---|
@@ -32,14 +32,14 @@ All routes are Quart Blueprints registered in `app.py`:
 
 | Prefix | Blueprint | Module |
 |---|---|---|
-| `/auth/` | `auth_bp` | `roundtable/auth/routes.py` |
-| `/` | `dashboard_bp` | `roundtable/dashboard/routes.py` |
-| `/hosts/` | `hosts_bp` | `roundtable/hosts/routes.py` |
-| `/ping/` | `ping_bp` | `roundtable/ping/routes.py` |
-| `/dns/` | `dns_bp` | `roundtable/dns/routes.py` |
-| `/alerts/` | `alerts_bp` | `roundtable/alerts/routes.py` |
-| `/ansible/` | `ansible_bp` | `roundtable/ansible/routes.py` |
-| `/settings/` | `settings_bp` | `roundtable/settings/routes.py` |
+| `/auth/` | `auth_bp` | `steward/auth/routes.py` |
+| `/` | `dashboard_bp` | `steward/dashboard/routes.py` |
+| `/hosts/` | `hosts_bp` | `steward/hosts/routes.py` |
+| `/ping/` | `ping_bp` | `steward/ping/routes.py` |
+| `/dns/` | `dns_bp` | `steward/dns/routes.py` |
+| `/alerts/` | `alerts_bp` | `steward/alerts/routes.py` |
+| `/ansible/` | `ansible_bp` | `steward/ansible/routes.py` |
+| `/settings/` | `settings_bp` | `steward/settings/routes.py` |
 | `/plugins/<name>/` | plugin blueprint | `plugins/<name>/routes.py` |
 
 Plugin blueprints are mounted automatically by `load_plugins()` using the plugin directory name as the URL prefix.
@@ -48,7 +48,7 @@ Plugin blueprints are mounted automatically by `load_plugins()` using the plugin
 
 ## Scheduler
 
-`roundtable/core/scheduler.py` exports two things:
+`steward/core/scheduler.py` exports two things:
 
 - `ScheduledTask` dataclass — holds a `name`, `coro_factory` (zero-argument callable returning a coroutine), `interval_seconds`, and optional `run_on_startup` flag
 - `start_scheduler(tasks)` — async function that loops every second, calling `asyncio.create_task()` for each task whose interval has elapsed
@@ -93,9 +93,9 @@ This means the only file you must touch to get the app running is the database U
 
 No JavaScript framework, no build step. The frontend is:
 
-- **Jinja2 templates** rendered server-side (`roundtable/templates/`)
+- **Jinja2 templates** rendered server-side (`steward/templates/`)
 - **HTMX** for live-updating fragments (dashboard widgets, ping pills, DNS status)
-- A single CSS design system in `roundtable/templates/base.html` using CSS custom properties
+- A single CSS design system in `steward/templates/base.html` using CSS custom properties
 
 Live-updating widgets use HTMX polling:
 ```html

docs/core/alerting.md

@@ -14,7 +14,7 @@ When any monitor or plugin calls `record_metric()`:
 4. If a state transition occurs, an `AlertEvent` row is written
 5. Notification I/O is deferred outside the transaction via `asyncio.create_task()`
 
-**Key function:** `roundtable/core/alerts.py` → `record_metric(session, source_module, resource_name, metric_name, value)`
+**Key function:** `steward/core/alerts.py` → `record_metric(session, source_module, resource_name, metric_name, value)`
 
 `record_metric()` must always be called inside an active transaction:
 
@@ -130,7 +130,7 @@ Webhook is skipped if `webhook.url` is empty.
 
 ## Data Models
 
-Defined in `roundtable/models/alerts.py`:
+Defined in `steward/models/alerts.py`:
 
 - **`alert_rules`** — one row per configured rule
 - **`alert_states`** — one row per rule, tracks current state and consecutive failure count

docs/core/ansible.md

@@ -1,6 +1,6 @@
 # Ansible Integration
 
-Roundtable can browse, trigger, and stream output from Ansible playbooks directly from the web UI. Runs execute as asyncio tasks inside the same process — no Celery, no external workers.
+Steward can browse, trigger, and stream output from Ansible playbooks directly from the web UI. Runs execute as asyncio tasks inside the same process — no Celery, no external workers.
 
 ---
 
@@ -115,7 +115,7 @@ Output stored in the DB is capped at 1 MB. If truncated, `[output truncated]` is
 
 ## Data Model
 
-`ansible_runs` table (defined in `roundtable/models/ansible.py`):
+`ansible_runs` table (defined in `steward/models/ansible.py`):
 
 | Column | Type | Description |
 |---|---|---|
@@ -137,7 +137,7 @@ Runs older than `data.retention_days` (default 90) are pruned by the `data_clean
 
 | File | Purpose |
 |---|---|
-| `roundtable/ansible/sources.py` | Source discovery, git pull logic |
-| `roundtable/ansible/executor.py` | Subprocess execution and output streaming |
-| `roundtable/ansible/routes.py` | HTTP routes (browse, trigger, stream, history) |
-| `roundtable/models/ansible.py` | `AnsibleRun` model |
+| `steward/ansible/sources.py` | Source discovery, git pull logic |
+| `steward/ansible/executor.py` | Subprocess execution and output streaming |
+| `steward/ansible/routes.py` | HTTP routes (browse, trigger, stream, history) |
+| `steward/models/ansible.py` | `AnsibleRun` model |

docs/core/configuration.md

@@ -1,6 +1,6 @@
 # Configuration
 
-Roundtable uses a two-layer configuration system. Only the bare minimum needed to boot lives in files or environment variables. Everything else is stored in the database and managed through the Settings UI.
+Steward uses a two-layer configuration system. Only the bare minimum needed to boot lives in files or environment variables. Everything else is stored in the database and managed through the Settings UI.
 
 ---
 
@@ -10,31 +10,29 @@ These three values are read at startup from `config.yaml` and/or environment var
 
 | Key | Env var | Default | Description |
 |---|---|---|---|
-| `database.url` | `ROUNDTABLE_DATABASE_URL` | — | PostgreSQL async URL. **Required.** |
-| `secret_key` | `ROUNDTABLE_SECRET_KEY` | auto-generated | Flask/Quart session signing key. Auto-generated and saved to `/data/secret.key` if not set. |
-| `plugin_dir` | `ROUNDTABLE_PLUGIN_DIR` | `plugins` | Path to the plugins directory. |
+| `database.url` | `STEWARD_DATABASE_URL` | — | PostgreSQL async URL. **Required.** |
+| `secret_key` | `STEWARD_SECRET_KEY` | auto-generated | Flask/Quart session signing key. Auto-generated and saved to `/data/secret.key` if not set. |
+| `plugin_dir` | `STEWARD_PLUGIN_DIR` | `plugins` | Path to the plugins directory. |
 
-**Resolution order for `database_url`:** env var `ROUNDTABLE_DATABASE_URL` → env var `ROUNDTABLE_DATABASE__URL` (legacy double-underscore) → `database.url` in `config.yaml`.
+**Resolution order for `database_url`:** env var `STEWARD_DATABASE_URL` → env var `STEWARD_DATABASE__URL` (legacy double-underscore) → `database.url` in `config.yaml`.
 
-**Resolution order for `secret_key`:** env var `ROUNDTABLE_SECRET_KEY` → `secret_key` in `config.yaml` → `/data/secret.key` file → auto-generate and write to `/data/secret.key`.
+**Resolution order for `secret_key`:** env var `STEWARD_SECRET_KEY` → `secret_key` in `config.yaml` → `/data/secret.key` file → auto-generate and write to `/data/secret.key`.
 
 ### Minimal config.yaml
 
 ```yaml
 database:
-  url: "postgresql+asyncpg://user:password@localhost/roundtable"
+  url: "postgresql+asyncpg://user:password@localhost/steward"
 ```
 
 ### Minimal env-only setup (Docker)
 
 ```bash
-ROUNDTABLE_DATABASE_URL=postgresql+asyncpg://user:password@db/roundtable
+STEWARD_DATABASE_URL=postgresql+asyncpg://user:password@db/steward
 ```
 
 A `.env` file is loaded automatically if present.
 
-> **Legacy env vars:** `FABLEDSCRYER_*` env vars are still accepted as a fallback for existing deployments. They will be removed in a future release — migrate to `ROUNDTABLE_*` when convenient.
-
 ---
 
 ## App Settings (Database-backed)
@@ -68,7 +66,7 @@ Default webhook template:
 ### Reading and Writing Settings in Code
 
 ```python
-from roundtable.core.settings import get_setting, set_setting
+from steward.core.settings import get_setting, set_setting
 
 # Read
 async with current_app.db_sessionmaker() as session:
@@ -84,7 +82,7 @@ async with current_app.db_sessionmaker() as session:
 
 ### The DEFAULTS Dict
 
-`roundtable/core/settings.py` contains the `DEFAULTS` dict — the canonical list of all recognised settings and their default values. Add new settings here to make them recognised by `get_all_settings()` and the settings UI.
+`steward/core/settings.py` contains the `DEFAULTS` dict — the canonical list of all recognised settings and their default values. Add new settings here to make them recognised by `get_all_settings()` and the settings UI.
 
 ---
 

docs/core/monitors.md

@@ -1,13 +1,13 @@
 # Core Monitors
 
-Roundtable ships two built-in monitors: Ping and DNS. Both run as asyncio scheduled tasks on the same event loop as the web server, with no separate processes.
+Steward ships two built-in monitors: Ping and DNS. Both run as asyncio scheduled tasks on the same event loop as the web server, with no separate processes.
 
 ---
 
 ## Ping Monitor
 
-**Source:** `roundtable/monitors/ping.py`
-**Scheduler task:** `ping_monitor` in `roundtable/app.py`
+**Source:** `steward/monitors/ping.py`
+**Scheduler task:** `ping_monitor` in `steward/app.py`
 **Interval:** `monitors.poll_interval_seconds` (default 60s), runs on startup
 
 ### How It Works
@@ -29,7 +29,7 @@ Each probe writes a `PingResult` row and calls `record_metric()`:
 
 ### Data Model
 
-`ping_results` table (defined in `roundtable/models/monitors.py`):
+`ping_results` table (defined in `steward/models/monitors.py`):
 
 | Column | Type | Description |
 |---|---|---|
@@ -51,8 +51,8 @@ Old rows are pruned by the `data_cleanup` task (default: 90 days).
 
 ## DNS Monitor
 
-**Source:** `roundtable/monitors/dns.py`
-**Scheduler task:** `dns_monitor` in `roundtable/app.py`
+**Source:** `steward/monitors/dns.py`
+**Scheduler task:** `dns_monitor` in `steward/app.py`
 **Interval:** `monitors.poll_interval_seconds` (default 60s), runs on startup
 
 ### How It Works
@@ -70,7 +70,7 @@ Each check writes a `DnsResult` row and calls `record_metric()`:
 
 ### Data Model
 
-`dns_results` table (defined in `roundtable/models/monitors.py`):
+`dns_results` table (defined in `steward/models/monitors.py`):
 
 | Column | Type | Description |
 |---|---|---|

docs/plugins/host-agent-design.md

@@ -2,13 +2,13 @@
 
 **Date:** 2026-04-14
 **Status:** Approved, ready for implementation planning
-**Scope:** Roundtable plugin for remote host resource monitoring (CPU, memory, storage, load, uptime) via a lightweight Python push agent.
+**Scope:** Steward plugin for remote host resource monitoring (CPU, memory, storage, load, uptime) via a lightweight Python push agent.
 
 ---
 
 ## Goal
 
-Give Roundtable a fleet-glance view of remote Linux hosts — current resource usage, history, and alert integration — without requiring agentless SSH/Ansible round-trips, a new toolchain, or SNMP gymnastics on every target.
+Give Steward a fleet-glance view of remote Linux hosts — current resource usage, history, and alert integration — without requiring agentless SSH/Ansible round-trips, a new toolchain, or SNMP gymnastics on every target.
 
 ## Non-goals
 
@@ -24,7 +24,7 @@ Give Roundtable a fleet-glance view of remote Linux hosts — current resource u
 
 ```
 ┌──────────────┐         POST /plugins/host_agent/ingest        ┌────────────────────────┐
-│  Agent       │  ──────────────────────────────────────────→  │ Roundtable             │
+│  Agent       │  ──────────────────────────────────────────→  │ Steward             │
 │  (Python)    │   Authorization: Bearer <per-host-token>       │  host_agent plugin     │
 │  on target   │   JSON body: metrics snapshot                  │                        │
 │  host        │                                                │  routes.py  (ingest +  │
@@ -48,8 +48,8 @@ Give Roundtable a fleet-glance view of remote Linux hosts — current resource u
 - **Agent** is a single Python file. No external dependencies beyond Python 3.8+ stdlib.
 - **Plugin** is self-contained under `plugins/host_agent/`. Writes to the core `PluginMetric` time-series bus (the designed cross-plugin integration point) and its own private `host_agent_registrations` table. Writes to the core `Host` model for identity, but adds no new columns to it.
 - **Auth** is per-host bearer tokens, minted on "Add host" in the plugin's settings page.
-- **Install** is a one-line `curl | sh` command rendered per-host by Roundtable with the token already baked in.
-- **Failure** is handled at the agent (in-memory ring buffer + exponential backoff) so Roundtable outages don't lose brief-window data.
+- **Install** is a one-line `curl | sh` command rendered per-host by Steward with the token already baked in.
+- **Failure** is handled at the agent (in-memory ring buffer + exponential backoff) so Steward outages don't lose brief-window data.
 
 ---
 
@@ -58,10 +58,10 @@ Give Roundtable a fleet-glance view of remote Linux hosts — current resource u
 ### File layout on the target host
 
 ```
-/usr/local/lib/roundtable-agent/agent.py       # the script, target ~300 lines
-/etc/roundtable-agent.conf                      # key=value config, 0640 root:roundtable-agent
-/etc/systemd/system/roundtable-agent.service    # unit file
-                                                # dedicated system user: roundtable-agent
+/usr/local/lib/steward-agent/agent.py       # the script, target ~300 lines
+/etc/steward-agent.conf                      # key=value config, 0640 root:steward-agent
+/etc/systemd/system/steward-agent.service    # unit file
+                                                # dedicated system user: steward-agent
 ```
 
 ### Config file format
@@ -69,7 +69,7 @@ Give Roundtable a fleet-glance view of remote Linux hosts — current resource u
 Flat `key = value`, parsed by a ~20-line homegrown parser (no TOML/YAML dependency):
 
 ```
-url = https://roundtable.home.lan
+url = https://steward.home.lan
 token = a1b2c3d4...
 interval_seconds = 30
 hostname = myhost              # optional; defaults to uname -n
@@ -111,7 +111,7 @@ To stderr only (systemd captures to journal). No file logging, no log rotation.
 
 ### Identity
 
-The agent's self-reported hostname in the payload is advisory. The real identity is the bearer token — Roundtable looks up the `Host` row via `HostAgentRegistration.token_hash`, not via hostname. Changing a host's hostname does not break its identity, and two hosts accidentally sharing a hostname can't collide.
+The agent's self-reported hostname in the payload is advisory. The real identity is the bearer token — Steward looks up the `Host` row via `HostAgentRegistration.token_hash`, not via hostname. Changing a host's hostname does not break its identity, and two hosts accidentally sharing a hostname can't collide.
 
 ### Failure behavior
 
@@ -194,7 +194,7 @@ One `ScheduledTask` running every 60 seconds that flags `HostAgentRegistration`
 
 ### `METRIC_CATALOG` registration
 
-Add to `roundtable/alerts/routes.py`:
+Add to `steward/alerts/routes.py`:
 
 ```python
 "host_agent": ["cpu_pct", "mem_used_pct", "mem_available_bytes",
@@ -202,7 +202,7 @@ Add to `roundtable/alerts/routes.py`:
                "load_5m", "load_15m", "uptime_secs"],
 ```
 
-This is the one edit outside the plugin directory, matching the pattern every other plugin already follows. Not ideal from a pure-plugin-independence standpoint but unavoidable until Roundtable core grows a plugin-registered catalog API — deferred as future core work.
+This is the one edit outside the plugin directory, matching the pattern every other plugin already follows. Not ideal from a pure-plugin-independence standpoint but unavoidable until Steward core grows a plugin-registered catalog API — deferred as future core work.
 
 ---
 
@@ -212,7 +212,7 @@ This is the one edit outside the plugin directory, matching the pattern every ot
 
 ```http
 POST /plugins/host_agent/ingest HTTP/1.1
-Host: roundtable.home.lan
+Host: steward.home.lan
 Authorization: Bearer a1b2c3d4e5f6...
 Content-Type: application/json
 ```
@@ -311,7 +311,7 @@ Agent treats anything non-2xx as failure → ring buffer. Agent treats 401 speci
 ### The one-liner (what the UI shows)
 
 ```
-curl -sSL 'https://roundtable.home.lan/plugins/host_agent/install.sh?token=a1b2c3...' | sudo sh
+curl -sSL 'https://steward.home.lan/plugins/host_agent/install.sh?token=a1b2c3...' | sudo sh
 ```
 
 The UI also offers a "review script before running" link that opens a modal showing the two-step form:
@@ -326,19 +326,19 @@ sudo sh install.sh
 
 ```sh
 #!/bin/sh
-# Roundtable host agent installer
+# Steward host agent installer
 # Generated for: {{ host_name }}  ({{ host_address }})
-# Roundtable URL: {{ url }}
+# Steward URL: {{ url }}
 set -e
 
-ROUNDTABLE_URL="{{ url }}"
+STEWARD_URL="{{ url }}"
 AGENT_TOKEN="{{ token }}"
 AGENT_VERSION="{{ agent_version }}"
 
-AGENT_USER="roundtable-agent"
-AGENT_DIR="/usr/local/lib/roundtable-agent"
-CONF_FILE="/etc/roundtable-agent.conf"
-UNIT_FILE="/etc/systemd/system/roundtable-agent.service"
+AGENT_USER="steward-agent"
+AGENT_DIR="/usr/local/lib/steward-agent"
+CONF_FILE="/etc/steward-agent.conf"
+UNIT_FILE="/etc/systemd/system/steward-agent.service"
 
 # ── preflight ────────────────────────────────────────────────────────────────
 [ "$(id -u)" = "0" ] || { echo "must run as root (use sudo)"; exit 1; }
@@ -347,7 +347,7 @@ command -v python3   >/dev/null 2>&1 || { echo "python3 not found — install py
 
 # Handle --uninstall
 if [ "${1:-}" = "--uninstall" ]; then
-    systemctl disable --now roundtable-agent.service 2>/dev/null || true
+    systemctl disable --now steward-agent.service 2>/dev/null || true
     rm -f "$UNIT_FILE" "$CONF_FILE"
     rm -rf "$AGENT_DIR"
     systemctl daemon-reload
@@ -363,13 +363,13 @@ fi
 
 # ── drop the agent file ──────────────────────────────────────────────────────
 mkdir -p "$AGENT_DIR"
-curl -sSL "${ROUNDTABLE_URL}/plugins/host_agent/agent.py" -o "$AGENT_DIR/agent.py"
+curl -sSL "${STEWARD_URL}/plugins/host_agent/agent.py" -o "$AGENT_DIR/agent.py"
 chmod 0755 "$AGENT_DIR/agent.py"
 chown root:root "$AGENT_DIR/agent.py"
 
 # ── write config ─────────────────────────────────────────────────────────────
 cat > "$CONF_FILE" <<EOF
-url = $ROUNDTABLE_URL
+url = $STEWARD_URL
 token = $AGENT_TOKEN
 interval_seconds = 30
 EOF
@@ -379,7 +379,7 @@ chmod 0640 "$CONF_FILE"
 # ── write systemd unit ───────────────────────────────────────────────────────
 cat > "$UNIT_FILE" <<EOF
 [Unit]
-Description=Roundtable host agent
+Description=Steward host agent
 After=network-online.target
 Wants=network-online.target
 
@@ -400,17 +400,17 @@ WantedBy=multi-user.target
 EOF
 
 systemctl daemon-reload
-systemctl enable --now roundtable-agent.service
+systemctl enable --now steward-agent.service
 
 echo
-echo "Roundtable host agent $AGENT_VERSION installed and running."
-echo "Check status:  systemctl status roundtable-agent"
-echo "Logs:          journalctl -u roundtable-agent -f"
+echo "Steward host agent $AGENT_VERSION installed and running."
+echo "Check status:  systemctl status steward-agent"
+echo "Logs:          journalctl -u steward-agent -f"
 ```
 
 ### Design points
 
-- **Agent binary served by Roundtable itself.** `GET /plugins/host_agent/agent.py` serves the script bundled with the plugin, so version drift between install-script and agent is impossible — re-running the installer picks up whatever agent the currently-running Roundtable ships.
+- **Agent binary served by Steward itself.** `GET /plugins/host_agent/agent.py` serves the script bundled with the plugin, so version drift between install-script and agent is impossible — re-running the installer picks up whatever agent the currently-running Steward ships.
 - **Systemd hardening is cheap and correct.** `NoNewPrivileges`, `ProtectSystem=strict`, `ProtectHome`, `PrivateTmp`, `ReadOnlyPaths=/proc /sys`. The agent only needs read access to `/proc`, `/sys`, and mount points; denying everything else narrows blast radius.
 - **Uninstall is a first-class flag**, not a separate script. Same one-liner with `--uninstall` appended.
 - **Fail-fast on preflight.** Missing systemd or python3 → clear error, exit. No half-installed agent.
@@ -421,7 +421,7 @@ echo "Logs:          journalctl -u roundtable-agent -f"
 
 ## UI surfaces
 
-### Dashboard widgets (`roundtable/core/widgets.py`)
+### Dashboard widgets (`steward/core/widgets.py`)
 
 - **`host_resources`** — table widget. One row per monitored host: name, CPU %, mem %, disk % (worst mount), load 1m, "last seen Xs ago" with red/yellow/green coloring. Fleet glance.
 - **`host_resource_history`** — chart widget for one host. CPU / mem / disk over a selectable time range (1h, 6h, 24h, 7d). Same pattern as every other history widget — Chart.js.
@@ -447,9 +447,9 @@ List of registered hosts with their enable flags, an "Add host" button that open
 
 | Failure | Who handles it | Response |
 |---|---|---|
-| Agent can't reach Roundtable | Agent | Push to ring buffer, exponential backoff (30→60→120→300s cap), log WARN. Resets on success. |
-| Roundtable rejects with 401 | Agent | Log ERROR with remediation hint, continue retry loop. Admin fixes via UI + conf edit; no restart needed. |
-| Roundtable rejects with 400 | Agent | Log ERROR, drop the sample (don't re-buffer), continue. Indicates agent/server version skew. |
+| Agent can't reach Steward | Agent | Push to ring buffer, exponential backoff (30→60→120→300s cap), log WARN. Resets on success. |
+| Steward rejects with 401 | Agent | Log ERROR with remediation hint, continue retry loop. Admin fixes via UI + conf edit; no restart needed. |
+| Steward rejects with 400 | Agent | Log ERROR, drop the sample (don't re-buffer), continue. Indicates agent/server version skew. |
 | Ring buffer full | Agent | Drop oldest, keep newest. DEBUG log (expected during outages). |
 | Config file missing or malformed | Agent | Log ERROR, exit non-zero. Systemd restarts after 10s. Repeated restarts are visible in journal. |
 | `/proc/stat` read fails between samples | Agent | Skip CPU for this cycle, still POST the rest. Partial samples allowed. |
@@ -528,7 +528,7 @@ These are not blockers; they are feature boundaries inherent to the design.
 6. Settings page: list, add-host flow, rotate-token, delete.
 7. Dashboard widgets: table + history chart. Register in `core/widgets.py`.
 8. Per-host detail page.
-9. `METRIC_CATALOG` entry in `roundtable/alerts/routes.py`.
+9. `METRIC_CATALOG` entry in `steward/alerts/routes.py`.
 10. Scheduler: stale-agent marker.
 11. Tests at every stage; final integration test to tie it together.
 

docs/plugins/host-agent-plan.md

@@ -2,7 +2,7 @@
 
 > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
 
-**Goal:** Ship a `host_agent` Roundtable plugin plus a stdlib-only Python push agent that reports CPU/memory/storage/load/uptime from remote Linux hosts to Roundtable.
+**Goal:** Ship a `host_agent` Steward plugin plus a stdlib-only Python push agent that reports CPU/memory/storage/load/uptime from remote Linux hosts to Steward.
 
 **Architecture:** Plugin lives under `plugins/host_agent/` (mirrors `plugins/http/`). It owns a private `host_agent_registrations` table, writes time-series data into the core `PluginMetric` bus, serves its own agent source at `GET /plugins/host_agent/agent.py`, and renders a per-host install script at `GET /plugins/host_agent/install.sh`. The agent is a single ~300-line Python script with a 30s collect→POST loop, in-memory ring buffer, exponential backoff, and systemd unit installed by a curl one-liner.
 
@@ -14,7 +14,7 @@
 
 ## Execution note — path 1 (no DB-backed tests)
 
-Mid-execution discovery: the Roundtable test harness runs `create_app(testing=True)`, which mocks `db_sessionmaker` and skips all migrations. There is no existing DB-backed test fixture in this codebase, and no existing plugin ships with tests. The first execution attempt tried to invent a SQLite-backed override fixture, which cascaded into modifying a production migration (`0007_dashboard_ownership.py`) to remove an inline FK — unacceptable. That commit was reverted.
+Mid-execution discovery: the Steward test harness runs `create_app(testing=True)`, which mocks `db_sessionmaker` and skips all migrations. There is no existing DB-backed test fixture in this codebase, and no existing plugin ships with tests. The first execution attempt tried to invent a SQLite-backed override fixture, which cascaded into modifying a production migration (`0007_dashboard_ownership.py`) to remove an inline FK — unacceptable. That commit was reverted.
 
 **Revised test strategy:** test the agent exhaustively (everything that lives in `plugins/host_agent/agent.py` — pure Python, stdlib only, trivially unit-testable). Test the server-side metric-expansion function as a pure function that takes a sample dict + host name and returns a list of `(metric_name, resource_name, value)` tuples. Everything else — ingest route, install route, settings routes, widgets, detail page, scheduler — is verified manually against the dev server.
 
@@ -43,7 +43,7 @@ Where code blocks in tasks below reference DB-backed tests, treat them as guidan
 - `plugins/host_agent/scheduler.py` — stale-agent marker task.
 - `plugins/host_agent/agent.py` — the Python agent script, served to targets.
 - `plugins/host_agent/migrations/__init__.py`
-- `plugins/host_agent/migrations/env.py` — alembic env (copy of http plugin's, but imports `roundtable.models.base`).
+- `plugins/host_agent/migrations/env.py` — alembic env (copy of http plugin's, but imports `steward.models.base`).
 - `plugins/host_agent/migrations/versions/__init__.py`
 - `plugins/host_agent/migrations/versions/host_agent_001_initial.py` — creates `host_agent_registrations`.
 - `plugins/host_agent/templates/install.sh.j2` — Jinja install script template.
@@ -68,8 +68,8 @@ Where code blocks in tasks below reference DB-backed tests, treat them as guidan
 
 **Modified files (core, small edits):**
 
-- `roundtable/alerts/routes.py` — add `"host_agent"` entry to `METRIC_CATALOG`.
-- `roundtable/core/widgets.py` — add `host_resources` and `host_resource_history` entries.
+- `steward/alerts/routes.py` — add `"host_agent"` entry to `METRIC_CATALOG`.
+- `steward/core/widgets.py` — add `host_resources` and `host_resource_history` entries.
 - `docs/plugins/index.yaml.example` — add catalog entry.
 
 ---
@@ -102,7 +102,7 @@ pytestmark = pytest.mark.asyncio
 
 async def test_host_agent_migration_creates_table(app):
     # The app fixture runs all plugin migrations on startup.
-    from roundtable.core.db import get_engine
+    from steward.core.db import get_engine
     engine = get_engine()
     async with engine.connect() as conn:
         def _check(sync_conn):
@@ -127,11 +127,11 @@ Expected: FAIL (plugin not loaded, table missing).
 name: host_agent
 version: "1.0.0"
 description: "Remote Linux host resource monitoring via a lightweight Python push agent (CPU, memory, storage, load, uptime)"
-author: "Roundtable"
+author: "Steward"
 license: "MIT"
 min_app_version: "0.1.0"
-repository_url: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins"
-homepage: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins/src/branch/main/host_agent"
+repository_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins"
+homepage: "https://git.fabledsword.com/bvandeusen/Steward-plugins/src/branch/main/host_agent"
 tags:
   - host
   - monitoring
@@ -180,7 +180,7 @@ from __future__ import annotations
 import uuid
 from datetime import datetime, timezone
 from sqlalchemy import Column, String, DateTime, ForeignKey
-from roundtable.models.base import Base
+from steward.models.base import Base
 
 
 def _uuid() -> str:
@@ -269,8 +269,8 @@ from alembic import context
 
 sys.path.insert(0, str(Path(__file__).parent.parent.parent.parent))
 
-from roundtable.models.base import Base
-import roundtable.models  # noqa: F401
+from steward.models.base import Base
+import steward.models  # noqa: F401
 from plugins.host_agent.models import HostAgentRegistration  # noqa: F401
 
 config = context.config
@@ -282,14 +282,14 @@ target_metadata = Base.metadata
 
 def _get_url() -> str:
     import yaml
-    cfg_path = os.environ.get("ROUNDTABLE_CONFIG", "config.yaml")
+    cfg_path = os.environ.get("STEWARD_CONFIG", "config.yaml")
     try:
         with open(cfg_path) as f:
             cfg = yaml.safe_load(f) or {}
         url = cfg.get("database", {}).get("url", "")
     except FileNotFoundError:
         url = ""
-    return os.environ.get("ROUNDTABLE_DATABASE__URL", url)
+    return os.environ.get("STEWARD_DATABASE__URL", url)
 
 
 def run_migrations_offline() -> None:
@@ -413,12 +413,12 @@ from plugins.host_agent.agent import read_config, ConfigError
 def test_parses_flat_key_value(tmp_path):
     p = tmp_path / "agent.conf"
     p.write_text(
-        "url = https://roundtable.example\n"
+        "url = https://steward.example\n"
         "token = abc123\n"
         "interval_seconds = 45\n"
     )
     cfg = read_config(str(p))
-    assert cfg["url"] == "https://roundtable.example"
+    assert cfg["url"] == "https://steward.example"
     assert cfg["token"] == "abc123"
     assert cfg["interval_seconds"] == 45
 
@@ -466,7 +466,7 @@ Expected: FAIL (`read_config` does not exist).
 
 ```python
 # plugins/host_agent/agent.py
-"""Roundtable host agent — pushes resource metrics to a Roundtable instance.
+"""Steward host agent — pushes resource metrics to a Steward instance.
 
 Python 3.8+ stdlib only. Target ~300 lines. Served to targets at
 GET /plugins/host_agent/agent.py.
@@ -1060,7 +1060,7 @@ def post_payload(url: str, token: str, payload: dict) -> tuple[bool, int | None]
         headers={
             "Content-Type": "application/json",
             "Authorization": f"Bearer {token}",
-            "User-Agent": f"roundtable-host-agent/{AGENT_VERSION}",
+            "User-Agent": f"steward-host-agent/{AGENT_VERSION}",
         },
         method="POST",
     )
@@ -1112,7 +1112,7 @@ def main_loop(conf_path: str) -> int:
     buffer = RingBuffer(maxlen=20)
     backoff = 0
 
-    _log("INFO", f"roundtable-host-agent {AGENT_VERSION} starting "
+    _log("INFO", f"steward-host-agent {AGENT_VERSION} starting "
                  f"(url={cfg['url']}, interval={cfg['interval_seconds']}s)")
 
     while not _shutdown_requested:
@@ -1171,7 +1171,7 @@ def main_loop(conf_path: str) -> int:
 
 
 if __name__ == "__main__":
-    conf = os.environ.get("ROUNDTABLE_AGENT_CONFIG", "/etc/roundtable-agent.conf")
+    conf = os.environ.get("STEWARD_AGENT_CONFIG", "/etc/steward-agent.conf")
     sys.exit(main_loop(conf))
 ```
 
@@ -1209,8 +1209,8 @@ git commit -m "feat(host_agent): agent POST, backoff, and main loop"
 import hashlib
 import pytest_asyncio
 
-from roundtable.models.hosts import Host
-from roundtable.core.db import get_session
+from steward.models.hosts import Host
+from steward.core.db import get_session
 from plugins.host_agent.models import HostAgentRegistration
 
 
@@ -1233,7 +1233,7 @@ async def registered_host(app):
         return {"host": host, "registration": reg, "token": raw_token}
 ```
 
-> **Note:** Verify `Host.__init__` accepts `name=` and `address=` kwargs before relying on this. If the real Host model requires more fields (e.g., `probe_type`), pass them here. Read `roundtable/models/hosts.py` first to confirm.
+> **Note:** Verify `Host.__init__` accepts `name=` and `address=` kwargs before relying on this. If the real Host model requires more fields (e.g., `probe_type`), pass them here. Read `steward/models/hosts.py` first to confirm.
 
 - [ ] **Step 2: Write failing ingest test**
 
@@ -1244,8 +1244,8 @@ from datetime import datetime, timezone
 import pytest
 from sqlalchemy import select
 
-from roundtable.models.metrics import PluginMetric
-from roundtable.core.db import get_session
+from steward.models.metrics import PluginMetric
+from steward.core.db import get_session
 from plugins.host_agent.models import HostAgentRegistration
 
 pytestmark = pytest.mark.asyncio
@@ -1352,9 +1352,9 @@ from typing import Any
 from quart import Blueprint, jsonify, request
 from sqlalchemy import select
 
-from roundtable.core.db import get_session
-from roundtable.models.hosts import Host
-from roundtable.models.metrics import PluginMetric
+from steward.core.db import get_session
+from steward.models.hosts import Host
+from steward.models.metrics import PluginMetric
 from .models import HostAgentRegistration
 
 host_agent_bp = Blueprint("host_agent", __name__, template_folder="templates")
@@ -1628,7 +1628,7 @@ async def test_install_sh_renders_with_token(client, registered_host):
     assert resp.status_code == 200
     assert resp.content_type.startswith("text/plain")
     text = (await resp.get_data()).decode()
-    assert "roundtable-agent" in text
+    assert "steward-agent" in text
     assert registered_host["token"] in text
     assert "systemctl enable --now" in text
     assert "NoNewPrivileges=yes" in text
@@ -1758,11 +1758,11 @@ git commit -m "feat(host_agent): install.sh and agent.py serving routes"
 - Create: `plugins/host_agent/templates/settings_list.html`
 - Create: `tests/plugins/host_agent/test_settings_routes.py`
 
-Auth note: the existing Roundtable admin decorator pattern needs to be used here. Read `roundtable/settings/routes.py` (or similar) to find the decorator name — likely something like `@require_admin` or a session check. Use whatever the rest of the codebase uses. **Do not invent a new auth mechanism.**
+Auth note: the existing Steward admin decorator pattern needs to be used here. Read `steward/settings/routes.py` (or similar) to find the decorator name — likely something like `@require_admin` or a session check. Use whatever the rest of the codebase uses. **Do not invent a new auth mechanism.**
 
 - [ ] **Step 1: Find the admin auth decorator**
 
-Run: `grep -rn "require_admin\|@admin_required\|def admin" roundtable/settings/ roundtable/core/auth.py 2>/dev/null | head -20`
+Run: `grep -rn "require_admin\|@admin_required\|def admin" steward/settings/ steward/core/auth.py 2>/dev/null | head -20`
 Note the decorator name and import path for use in Step 3.
 
 - [ ] **Step 2: Write failing test**
@@ -1772,8 +1772,8 @@ Note the decorator name and import path for use in Step 3.
 import pytest
 from sqlalchemy import select
 
-from roundtable.core.db import get_session
-from roundtable.models.hosts import Host
+from steward.core.db import get_session
+from steward.models.hosts import Host
 from plugins.host_agent.models import HostAgentRegistration
 
 pytestmark = pytest.mark.asyncio
@@ -1839,7 +1839,7 @@ from quart import redirect, url_for
 
 # TODO: replace _require_admin with the project-wide decorator found in Step 1.
 # Placeholder below mirrors the shape; swap for real admin auth.
-from roundtable.core.auth import require_admin  # adjust import to actual path
+from steward.core.auth import require_admin  # adjust import to actual path
 
 
 def _new_token_pair() -> tuple[str, str]:
@@ -1938,7 +1938,7 @@ async def settings_list():
 
 ```html
 {% extends "base.html" %}
-{% block title %}Host Agent — Roundtable{% endblock %}
+{% block title %}Host Agent — Steward{% endblock %}
 {% block content %}
 <h1 class="page-title">Host Agent — Registered Hosts</h1>
 
@@ -2003,7 +2003,7 @@ async def settings_list():
 - [ ] **Step 6: Run tests — iterate on auth decorator if needed**
 
 Run: `pytest tests/plugins/host_agent/test_settings_routes.py -v`
-Expected: PASS. If admin auth fails, the actual import path from Step 1 is wrong — fix the `from roundtable.core.auth import require_admin` line.
+Expected: PASS. If admin auth fails, the actual import path from Step 1 is wrong — fix the `from steward.core.auth import require_admin` line.
 
 - [ ] **Step 7: Commit**
 
@@ -2020,8 +2020,8 @@ git commit -m "feat(host_agent): plugin settings page — add, rotate, delete"
 - Modify: `plugins/host_agent/routes.py` — add `/widget` and `/widget/history` partials.
 - Create: `plugins/host_agent/templates/widget_table.html`
 - Create: `plugins/host_agent/templates/widget_history.html`
-- Modify: `roundtable/core/widgets.py`
-- Modify: `roundtable/alerts/routes.py`
+- Modify: `steward/core/widgets.py`
+- Modify: `steward/alerts/routes.py`
 
 - [ ] **Step 1: Add widget partial routes to `plugins/host_agent/routes.py`**
 
@@ -2165,7 +2165,7 @@ async def widget_history():
 </div>
 ```
 
-- [ ] **Step 4: Register widgets in `roundtable/core/widgets.py`**
+- [ ] **Step 4: Register widgets in `steward/core/widgets.py`**
 
 Add to `WIDGET_REGISTRY` (alphabetically by existing convention, or at the end — check the file first):
 
@@ -2206,7 +2206,7 @@ Add to `WIDGET_REGISTRY` (alphabetically by existing convention, or at the end
 
 - [ ] **Step 5: Register `host_agent` in `METRIC_CATALOG`**
 
-Read `roundtable/alerts/routes.py`. Locate the `METRIC_CATALOG` dict. Add:
+Read `steward/alerts/routes.py`. Locate the `METRIC_CATALOG` dict. Add:
 
 ```python
     "host_agent": [
@@ -2244,7 +2244,7 @@ Expected: PASS.
 - [ ] **Step 7: Commit**
 
 ```bash
-git add plugins/host_agent/routes.py plugins/host_agent/templates/widget_table.html plugins/host_agent/templates/widget_history.html roundtable/core/widgets.py roundtable/alerts/routes.py tests/plugins/host_agent/test_ingest_route.py
+git add plugins/host_agent/routes.py plugins/host_agent/templates/widget_table.html plugins/host_agent/templates/widget_history.html steward/core/widgets.py steward/alerts/routes.py tests/plugins/host_agent/test_ingest_route.py
 git commit -m "feat(host_agent): dashboard widgets and alert metric catalog entry"
 ```
 
@@ -2409,8 +2409,8 @@ from datetime import datetime, timedelta, timezone
 import pytest
 from sqlalchemy import select
 
-from roundtable.core.db import get_session
-from roundtable.models.hosts import Host
+from steward.core.db import get_session
+from steward.models.hosts import Host
 from plugins.host_agent.models import HostAgentRegistration
 from plugins.host_agent.scheduler import find_stale_registrations
 
@@ -2459,8 +2459,8 @@ from datetime import datetime, timedelta, timezone
 
 from sqlalchemy import select
 
-from roundtable.core.db import get_session
-from roundtable.models.hosts import Host
+from steward.core.db import get_session
+from steward.models.hosts import Host
 from .models import HostAgentRegistration
 
 
@@ -2531,8 +2531,8 @@ from unittest.mock import patch
 import pytest
 from sqlalchemy import select
 
-from roundtable.core.db import get_session
-from roundtable.models.metrics import PluginMetric
+from steward.core.db import get_session
+from steward.models.metrics import PluginMetric
 from plugins.host_agent import agent as a
 
 pytestmark = pytest.mark.asyncio
@@ -2609,12 +2609,12 @@ Append to the `plugins:` list in `docs/plugins/index.yaml.example`:
   - name: host_agent
     version: "1.0.0"
     description: "Remote Linux host resource monitoring via a lightweight Python push agent"
-    author: "Roundtable"
+    author: "Steward"
     license: "MIT"
     min_app_version: "0.1.0"
-    repository_url: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins"
-    homepage: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins/src/branch/main/host_agent"
-    download_url: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins/releases/download/host_agent-v1.0.0/host_agent.zip"
+    repository_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins"
+    homepage: "https://git.fabledsword.com/bvandeusen/Steward-plugins/src/branch/main/host_agent"
+    download_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins/releases/download/host_agent-v1.0.0/host_agent.zip"
     checksum_sha256: ""
     tags:
       - host
@@ -2643,7 +2643,7 @@ Use `fable_update_task` to set status=done on task 252 ("Implement host_agent pl
 
 - [ ] **Step 2: Add a Fable note summarizing what shipped**
 
-One-paragraph `fable_create_note` attached to Roundtable project (id 6) with:
+One-paragraph `fable_create_note` attached to Steward project (id 6) with:
 - Link to spec: `docs/plugins/host-agent-design.md`
 - Link to plan: `docs/plugins/host-agent-plan.md`
 - Note any deviations from the spec discovered during implementation (e.g., auth decorator name, fixture adjustments).

docs/plugins/index.yaml.example

@@ -1,10 +1,10 @@
-# roundtable-plugins / index.yaml
+# steward-plugins / index.yaml
 #
-# This file is the catalog index for the roundtable plugin repository.
+# This file is the catalog index for the steward plugin repository.
 # It is fetched by the app's Settings → Plugins → Plugin Catalog UI.
 #
-# Roundtable reads this file from:
-#   https://git.fabledsword.com/bvandeusen/Roundtable-plugins/raw/branch/main/index.yaml
+# Steward reads this file from:
+#   https://git.fabledsword.com/bvandeusen/Steward-plugins/raw/branch/main/index.yaml
 #
 # After adding or updating a plugin entry, commit and push — the change is
 # live immediately for anyone whose app fetches the catalog (cache TTL: 5 min).
@@ -25,7 +25,7 @@
 #
 # Download URL conventions:
 #   Gitea release assets (recommended):
-#     https://git.fabledsword.com/bvandeusen/Roundtable-plugins/releases/download/traefik-v1.0.0/traefik.zip
+#     https://git.fabledsword.com/bvandeusen/Steward-plugins/releases/download/traefik-v1.0.0/traefik.zip
 #   Upload the zip as a release attachment in Gitea; paste the URL here.
 #   Source archive tarballs work too but release assets are preferred (smaller, plugin-only).
 
@@ -37,12 +37,12 @@ plugins:
   - name: http
     version: "1.0.0"
     description: "Synthetic HTTP endpoint monitoring — status code, response time, content match, TLS expiry"
-    author: "Roundtable"
+    author: "Steward"
     license: "MIT"
     min_app_version: "0.1.0"
-    repository_url: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins"
-    homepage: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins/src/branch/main/http"
-    download_url: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins/releases/download/http-v1.0.0/http.zip"
+    repository_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins"
+    homepage: "https://git.fabledsword.com/bvandeusen/Steward-plugins/src/branch/main/http"
+    download_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins/releases/download/http-v1.0.0/http.zip"
     checksum_sha256: ""
     tags:
       - monitoring
@@ -53,12 +53,12 @@ plugins:
   - name: docker
     version: "1.0.0"
     description: "Docker container status, resource usage, and restart tracking via Docker socket"
-    author: "Roundtable"
+    author: "Steward"
     license: "MIT"
     min_app_version: "0.1.0"
-    repository_url: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins"
-    homepage: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins/src/branch/main/docker"
-    download_url: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins/releases/download/docker-v1.0.0/docker.zip"
+    repository_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins"
+    homepage: "https://git.fabledsword.com/bvandeusen/Steward-plugins/src/branch/main/docker"
+    download_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins/releases/download/docker-v1.0.0/docker.zip"
     checksum_sha256: ""
     tags:
       - containers
@@ -68,12 +68,12 @@ plugins:
   - name: traefik
     version: "1.0.0"
     description: "Traefik reverse proxy metrics and access log integration"
-    author: "Roundtable"
+    author: "Steward"
     license: "MIT"
     min_app_version: "0.1.0"
-    repository_url: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins"
-    homepage: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins/src/branch/main/traefik"
-    download_url: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins/releases/download/traefik-v1.0.0/traefik.zip"
+    repository_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins"
+    homepage: "https://git.fabledsword.com/bvandeusen/Steward-plugins/src/branch/main/traefik"
+    download_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins/releases/download/traefik-v1.0.0/traefik.zip"
     checksum_sha256: ""   # fill in after running: sha256sum traefik.zip
     tags:
       - proxy
@@ -83,12 +83,12 @@ plugins:
   - name: unifi
     version: "1.0.0"
     description: "UniFi Network controller integration — WAN health, devices, clients, DPI"
-    author: "Roundtable"
+    author: "Steward"
     license: "MIT"
     min_app_version: "0.1.0"
-    repository_url: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins"
-    homepage: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins/src/branch/main/unifi"
-    download_url: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins/releases/download/unifi-v1.0.0/unifi.zip"
+    repository_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins"
+    homepage: "https://git.fabledsword.com/bvandeusen/Steward-plugins/src/branch/main/unifi"
+    download_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins/releases/download/unifi-v1.0.0/unifi.zip"
     checksum_sha256: ""
     tags:
       - network
@@ -98,12 +98,12 @@ plugins:
   - name: host_agent
     version: "1.0.0"
     description: "Remote Linux host resource monitoring via a lightweight Python push agent"
-    author: "Roundtable"
+    author: "Steward"
     license: "MIT"
     min_app_version: "0.1.0"
-    repository_url: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins"
-    homepage: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins/src/branch/main/host_agent"
-    download_url: "https://git.fabledsword.com/bvandeusen/Roundtable-plugins/releases/download/host_agent-v1.0.0/host_agent.zip"
+    repository_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins"
+    homepage: "https://git.fabledsword.com/bvandeusen/Steward-plugins/src/branch/main/host_agent"
+    download_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins/releases/download/host_agent-v1.0.0/host_agent.zip"
     checksum_sha256: ""
     tags:
       - host

docs/plugins/overview.md

@@ -1,12 +1,12 @@
 # Plugin System Overview
 
-Plugins extend Roundtable with new data sources, UI pages, scheduled tasks, and dashboard widgets. Only enabled plugins are imported — disabled or unlisted plugins have zero runtime overhead.
+Plugins extend Steward with new data sources, UI pages, scheduled tasks, and dashboard widgets. Only enabled plugins are imported — disabled or unlisted plugins have zero runtime overhead.
 
 ---
 
 ## How Plugins Are Loaded
 
-Plugin loading happens in step 9 of `create_app()`, after all core blueprints and tasks are registered. The entrypoint is `load_plugins(app)` in `roundtable/core/plugin_manager.py`.
+Plugin loading happens in step 9 of `create_app()`, after all core blueprints and tasks are registered. The entrypoint is `load_plugins(app)` in `steward/core/plugin_manager.py`.
 
 For each plugin listed as `enabled: true` in the `PLUGINS` config:
 
@@ -57,7 +57,7 @@ description: "Does a thing"
 
 # Optional
 author: "Your Name"
-min_app_version: "0.1.0"   # Minimum Roundtable version required
+min_app_version: "0.1.0"   # Minimum Steward version required
 
 # Default config — merged with user overrides at runtime
 # Access at runtime via: app.config["PLUGINS"]["myplugin"]["my_setting"]
@@ -90,7 +90,7 @@ def setup(app):
 Returns a list of `ScheduledTask` objects. Return `[]` if the plugin has no background tasks. Called after `setup()`, so any app references set in `setup()` are available.
 
 ```python
-from roundtable.core.scheduler import ScheduledTask
+from steward.core.scheduler import ScheduledTask
 
 def get_scheduled_tasks():
     app = _app
@@ -154,7 +154,7 @@ A plugin can contribute a dashboard widget by:
 1. Adding a `GET /widget` route to its blueprint that returns an HTMX HTML fragment
 2. The dashboard template polling that endpoint with HTMX
 
-The dashboard (`roundtable/templates/dashboard/index.html`) currently includes the Traefik widget conditionally based on `traefik_enabled`. To add a new plugin widget, the dashboard route and template both need to be updated to detect and render the new widget. See the Traefik widget implementation as a reference.
+The dashboard (`steward/templates/dashboard/index.html`) currently includes the Traefik widget conditionally based on `traefik_enabled`. To add a new plugin widget, the dashboard route and template both need to be updated to detect and render the new widget. See the Traefik widget implementation as a reference.
 
 ---
 

docs/plugins/writing-a-plugin.md

@@ -46,7 +46,7 @@ config:
 
 ## Step 3: Define Models (if needed)
 
-If your plugin stores data, define SQLAlchemy models using the shared `Base` from `roundtable.models.base`.
+If your plugin stores data, define SQLAlchemy models using the shared `Base` from `steward.models.base`.
 
 ```python
 # plugins/myplugin/models.py
@@ -55,7 +55,7 @@ import uuid
 from datetime import datetime
 from sqlalchemy import String, Float, DateTime
 from sqlalchemy.orm import Mapped, mapped_column
-from roundtable.models.base import Base
+from steward.models.base import Base
 
 
 class MyPluginMetric(Base):
@@ -79,7 +79,7 @@ Generate the initial migration:
 # From the project root
 alembic --config alembic.ini revision \
     --autogenerate \
-    --head=roundtable@head \
+    --head=steward@head \
     --branch-label=myplugin \
     -m "myplugin initial"
 ```
@@ -106,8 +106,8 @@ Keep task logic in a separate file so `__init__.py` stays clean.
 # plugins/myplugin/scheduler.py
 from __future__ import annotations
 import logging
-from roundtable.core.scheduler import ScheduledTask
-from roundtable.core.alerts import record_metric
+from steward.core.scheduler import ScheduledTask
+from steward.core.alerts import record_metric
 
 logger = logging.getLogger(__name__)
 
@@ -174,8 +174,8 @@ async def _fetch_value(url: str) -> float:
 ```python
 # plugins/myplugin/routes.py
 from quart import Blueprint, current_app, render_template
-from roundtable.auth.middleware import require_role
-from roundtable.models.users import UserRole
+from steward.auth.middleware import require_role
+from steward.models.users import UserRole
 from .models import MyPluginMetric
 
 myplugin_bp = Blueprint("myplugin", __name__, template_folder="templates")
@@ -215,7 +215,7 @@ Templates live in `plugins/myplugin/templates/myplugin/` (the extra nesting avoi
 ```html
 {# plugins/myplugin/templates/myplugin/index.html #}
 {% extends "base.html" %}
-{% block title %}My Plugin — Roundtable{% endblock %}
+{% block title %}My Plugin — Steward{% endblock %}
 {% block content %}
 <div class="page-title">My Plugin</div>
 {% for row in rows %}
@@ -283,7 +283,7 @@ On next startup, the plugin will be loaded, its migrations applied, and its blue
 `record_metric()` is how plugins feed data into the alert pipeline. Any metric you write here can be the target of an alert rule created in the UI.
 
 ```python
-from roundtable.core.alerts import record_metric
+from steward.core.alerts import record_metric
 
 # Must be inside an active transaction
 async with session.begin():
@@ -302,11 +302,11 @@ async with session.begin():
 
 ## Auth in Routes
 
-Use the `@require_role` decorator from `roundtable.auth.middleware`:
+Use the `@require_role` decorator from `steward.auth.middleware`:
 
 ```python
-from roundtable.auth.middleware import require_role
-from roundtable.models.users import UserRole
+from steward.auth.middleware import require_role
+from steward.models.users import UserRole
 
 @myplugin_bp.get("/admin-only")
 @require_role(UserRole.admin)
@@ -325,13 +325,13 @@ Role hierarchy: `admin > operator > viewer`. Requiring `viewer` grants access to
 
 ## Publishing to the Catalog
 
-The official plugin catalog is hosted at `https://git.fabledsword.com/bvandeusen/Roundtable-plugins`. Anyone can submit a plugin by opening a pull request — first-party and third-party plugins are treated identically by the catalog system.
+The official plugin catalog is hosted at `https://git.fabledsword.com/bvandeusen/Steward-plugins`. Anyone can submit a plugin by opening a pull request — first-party and third-party plugins are treated identically by the catalog system.
 
 ### Repo layout
 
 ```
-roundtable-plugins/
-├── index.yaml          ← catalog index — the only file Roundtable fetches
+steward-plugins/
+├── index.yaml          ← catalog index — the only file Steward fetches
 ├── myplugin/
 │   ├── plugin.yaml
 │   ├── __init__.py
@@ -381,7 +381,7 @@ myplugin.zip
 Generate the zip and its checksum:
 
 ```bash
-cd roundtable-plugins
+cd steward-plugins
 zip -r myplugin.zip myplugin/
 sha256sum myplugin.zip   # paste this into index.yaml checksum_sha256
 ```

docs/reference/code-map.md

@@ -8,15 +8,15 @@ Quick reference for where key functions, models, and entry points live in the co
 
 | What | File | Function / Class |
 |---|---|---|
-| App factory | `roundtable/app.py` | `create_app()` |
-| CLI entry point | `roundtable/cli.py` | `main()` |
-| Bootstrap config loading | `roundtable/config.py` | `load_bootstrap()` |
-| Secret key resolution | `roundtable/config.py` | `_resolve_secret_key()` |
-| DB engine init | `roundtable/database.py` | `init_db()` |
-| Core migrations | `roundtable/core/migration_runner.py` | `run_core_migrations()` |
-| Plugin migrations | `roundtable/core/migration_runner.py` | `run_plugin_migrations()` |
-| Core task registration | `roundtable/app.py` | `_register_core_tasks()` |
-| Scheduler loop | `roundtable/core/scheduler.py` | `start_scheduler()` |
+| App factory | `steward/app.py` | `create_app()` |
+| CLI entry point | `steward/cli.py` | `main()` |
+| Bootstrap config loading | `steward/config.py` | `load_bootstrap()` |
+| Secret key resolution | `steward/config.py` | `_resolve_secret_key()` |
+| DB engine init | `steward/database.py` | `init_db()` |
+| Core migrations | `steward/core/migration_runner.py` | `run_core_migrations()` |
+| Plugin migrations | `steward/core/migration_runner.py` | `run_plugin_migrations()` |
+| Core task registration | `steward/app.py` | `_register_core_tasks()` |
+| Scheduler loop | `steward/core/scheduler.py` | `start_scheduler()` |
 
 ---
 
@@ -24,15 +24,15 @@ Quick reference for where key functions, models, and entry points live in the co
 
 | What | File | Function |
 |---|---|---|
-| All defaults | `roundtable/core/settings.py` | `DEFAULTS` dict |
-| Read a setting | `roundtable/core/settings.py` | `get_setting(session, key)` |
-| Write a setting | `roundtable/core/settings.py` | `set_setting(session, key, value)` |
-| Read all settings | `roundtable/core/settings.py` | `get_all_settings(session)` |
-| Sync load at startup | `roundtable/core/settings.py` | `load_settings_sync(db_url)` |
-| Extract SMTP dict | `roundtable/core/settings.py` | `to_smtp_cfg(settings)` |
-| Extract webhook dict | `roundtable/core/settings.py` | `to_webhook_cfg(settings)` |
-| Extract Ansible dict | `roundtable/core/settings.py` | `to_ansible_cfg(settings)` |
-| Extract plugins dict | `roundtable/core/settings.py` | `to_plugins_cfg(settings)` |
+| All defaults | `steward/core/settings.py` | `DEFAULTS` dict |
+| Read a setting | `steward/core/settings.py` | `get_setting(session, key)` |
+| Write a setting | `steward/core/settings.py` | `set_setting(session, key, value)` |
+| Read all settings | `steward/core/settings.py` | `get_all_settings(session)` |
+| Sync load at startup | `steward/core/settings.py` | `load_settings_sync(db_url)` |
+| Extract SMTP dict | `steward/core/settings.py` | `to_smtp_cfg(settings)` |
+| Extract webhook dict | `steward/core/settings.py` | `to_webhook_cfg(settings)` |
+| Extract Ansible dict | `steward/core/settings.py` | `to_ansible_cfg(settings)` |
+| Extract plugins dict | `steward/core/settings.py` | `to_plugins_cfg(settings)` |
 
 ---
 
@@ -40,9 +40,9 @@ Quick reference for where key functions, models, and entry points live in the co
 
 | What | File | Function |
 |---|---|---|
-| Plugin loading | `roundtable/core/plugin_manager.py` | `load_plugins(app)` |
-| ScheduledTask dataclass | `roundtable/core/scheduler.py` | `ScheduledTask` |
-| Task runner | `roundtable/core/scheduler.py` | `start_scheduler(tasks)` |
+| Plugin loading | `steward/core/plugin_manager.py` | `load_plugins(app)` |
+| ScheduledTask dataclass | `steward/core/scheduler.py` | `ScheduledTask` |
+| Task runner | `steward/core/scheduler.py` | `start_scheduler(tasks)` |
 
 ---
 
@@ -50,11 +50,11 @@ Quick reference for where key functions, models, and entry points live in the co
 
 | What | File | Function |
 |---|---|---|
-| Write metric + evaluate alerts | `roundtable/core/alerts.py` | `record_metric(session, source_module, resource_name, metric_name, value)` |
-| Init alert pipeline | `roundtable/core/alerts.py` | `init_alerts(app)` |
-| Rule evaluation | `roundtable/core/alerts.py` | `_evaluate_rule()` (internal) |
-| Notification dispatch | `roundtable/core/alerts.py` | `_dispatch_notification()` (internal) |
-| Email + webhook send | `roundtable/core/notifications.py` | `dispatch_notifications()` |
+| Write metric + evaluate alerts | `steward/core/alerts.py` | `record_metric(session, source_module, resource_name, metric_name, value)` |
+| Init alert pipeline | `steward/core/alerts.py` | `init_alerts(app)` |
+| Rule evaluation | `steward/core/alerts.py` | `_evaluate_rule()` (internal) |
+| Notification dispatch | `steward/core/alerts.py` | `_dispatch_notification()` (internal) |
+| Email + webhook send | `steward/core/notifications.py` | `dispatch_notifications()` |
 
 ---
 
@@ -62,9 +62,9 @@ Quick reference for where key functions, models, and entry points live in the co
 
 | What | File | Function |
 |---|---|---|
-| Ping a host | `roundtable/monitors/ping.py` | `ping_check(host, session)` |
-| DNS check a host | `roundtable/monitors/dns.py` | `dns_check(host, session)` |
-| Data cleanup | `roundtable/core/cleanup.py` | `run_cleanup(app)` |
+| Ping a host | `steward/monitors/ping.py` | `ping_check(host, session)` |
+| DNS check a host | `steward/monitors/dns.py` | `dns_check(host, session)` |
+| Data cleanup | `steward/core/cleanup.py` | `run_cleanup(app)` |
 
 ---
 
@@ -72,9 +72,9 @@ Quick reference for where key functions, models, and entry points live in the co
 
 | What | File | Function / Class |
 |---|---|---|
-| Role-based access decorator | `roundtable/auth/middleware.py` | `@require_role(UserRole.X)` |
-| Login / session handling | `roundtable/auth/middleware.py` | `login_user()`, `logout_user()` |
-| User count (for first-run) | `roundtable/auth/middleware.py` | `get_user_count(app)` |
+| Role-based access decorator | `steward/auth/middleware.py` | `@require_role(UserRole.X)` |
+| Login / session handling | `steward/auth/middleware.py` | `login_user()`, `logout_user()` |
+| User count (for first-run) | `steward/auth/middleware.py` | `get_user_count(app)` |
 
 ---
 
@@ -82,18 +82,18 @@ Quick reference for where key functions, models, and entry points live in the co
 
 | Model | File | Table |
 |---|---|---|
-| `Host` | `roundtable/models/hosts.py` | `hosts` |
-| `PingResult` | `roundtable/models/monitors.py` | `ping_results` |
-| `DnsResult` | `roundtable/models/monitors.py` | `dns_results` |
-| `AlertRule` | `roundtable/models/alerts.py` | `alert_rules` |
-| `AlertState` | `roundtable/models/alerts.py` | `alert_states` |
-| `AlertEvent` | `roundtable/models/alerts.py` | `alert_events` |
-| `PluginMetric` | `roundtable/models/metrics.py` | `plugin_metrics` |
-| `AnsibleRun` | `roundtable/models/ansible.py` | `ansible_runs` |
-| `User` | `roundtable/models/users.py` | `users` |
-| `AppSetting` | `roundtable/models/settings.py` | `app_settings` |
+| `Host` | `steward/models/hosts.py` | `hosts` |
+| `PingResult` | `steward/models/monitors.py` | `ping_results` |
+| `DnsResult` | `steward/models/monitors.py` | `dns_results` |
+| `AlertRule` | `steward/models/alerts.py` | `alert_rules` |
+| `AlertState` | `steward/models/alerts.py` | `alert_states` |
+| `AlertEvent` | `steward/models/alerts.py` | `alert_events` |
+| `PluginMetric` | `steward/models/metrics.py` | `plugin_metrics` |
+| `AnsibleRun` | `steward/models/ansible.py` | `ansible_runs` |
+| `User` | `steward/models/users.py` | `users` |
+| `AppSetting` | `steward/models/settings.py` | `app_settings` |
 | `TraefikMetric` | `plugins/traefik/models.py` | `traefik_metrics` |
-| SQLAlchemy `Base` | `roundtable/models/base.py` | (shared declarative base) |
+| SQLAlchemy `Base` | `steward/models/base.py` | (shared declarative base) |
 
 ---
 
@@ -101,16 +101,16 @@ Quick reference for where key functions, models, and entry points live in the co
 
 | URL pattern | Blueprint | File |
 |---|---|---|
-| `/` (dashboard) | `dashboard_bp` | `roundtable/dashboard/routes.py` |
-| `/auth/login`, `/auth/logout` | `auth_bp` | `roundtable/auth/routes.py` |
-| `/hosts/` | `hosts_bp` | `roundtable/hosts/routes.py` |
-| `/ping/`, `/ping/rows`, `/ping/settings` | `ping_bp` | `roundtable/ping/routes.py` |
-| `/dns/`, `/dns/rows` | `dns_bp` | `roundtable/dns/routes.py` |
-| `/alerts/` | `alerts_bp` | `roundtable/alerts/routes.py` |
-| `/ansible/` | `ansible_bp` | `roundtable/ansible/routes.py` |
-| `/settings/` | `settings_bp` | `roundtable/settings/routes.py` |
+| `/` (dashboard) | `dashboard_bp` | `steward/dashboard/routes.py` |
+| `/auth/login`, `/auth/logout` | `auth_bp` | `steward/auth/routes.py` |
+| `/hosts/` | `hosts_bp` | `steward/hosts/routes.py` |
+| `/ping/`, `/ping/rows`, `/ping/settings` | `ping_bp` | `steward/ping/routes.py` |
+| `/dns/`, `/dns/rows` | `dns_bp` | `steward/dns/routes.py` |
+| `/alerts/` | `alerts_bp` | `steward/alerts/routes.py` |
+| `/ansible/` | `ansible_bp` | `steward/ansible/routes.py` |
+| `/settings/` | `settings_bp` | `steward/settings/routes.py` |
 | `/plugins/traefik/`, `/plugins/traefik/widget` | `traefik_bp` | `plugins/traefik/routes.py` |
-| `/health` | (inline) | `roundtable/app.py` |
+| `/health` | (inline) | `steward/app.py` |
 
 ---
 
@@ -118,12 +118,12 @@ Quick reference for where key functions, models, and entry points live in the co
 
 | Template | Purpose |
 |---|---|
-| `roundtable/templates/base.html` | Layout, navigation, full CSS design system |
-| `roundtable/templates/dashboard/index.html` | Dashboard with stat strip and widget grid |
-| `roundtable/templates/ping/rows.html` | HTMX fragment: ping pill rows (shared by dashboard and /ping/) |
-| `roundtable/templates/ping/index.html` | Full /ping/ page |
-| `roundtable/templates/dns/rows.html` | HTMX fragment: DNS status rows |
-| `roundtable/templates/dns/index.html` | Full /dns/ page |
+| `steward/templates/base.html` | Layout, navigation, full CSS design system |
+| `steward/templates/dashboard/index.html` | Dashboard with stat strip and widget grid |
+| `steward/templates/ping/rows.html` | HTMX fragment: ping pill rows (shared by dashboard and /ping/) |
+| `steward/templates/ping/index.html` | Full /ping/ page |
+| `steward/templates/dns/rows.html` | HTMX fragment: DNS status rows |
+| `steward/templates/dns/index.html` | Full /dns/ page |
 | `plugins/traefik/templates/traefik/widget.html` | HTMX fragment: Traefik dashboard widget |
 | `plugins/traefik/templates/traefik/index.html` | Full Traefik detail page |
 
@@ -133,6 +133,6 @@ Quick reference for where key functions, models, and entry points live in the co
 
 | Location | Covers |
 |---|---|
-| `roundtable/migrations/versions/` | Core schema (hosts, users, monitors, alerts, app_settings) |
+| `steward/migrations/versions/` | Core schema (hosts, users, monitors, alerts, app_settings) |
 | `plugins/traefik/migrations/versions/` | `traefik_metrics` table |
 | `alembic.ini` | Alembic config; `version_locations` lists all migration directories |

docs/reference/playbook-authoring.md

@@ -0,0 +1,191 @@
+# Authoring Steward-friendly Ansible playbooks
+
+This is the contract between a playbook and Steward's run UI. Follow it and a
+playbook drops into Steward with a description, fill-in variable fields, correct
+targeting, and credentials supplied automatically — no per-playbook wiring.
+
+It applies to **any** playbook in a configured source (bundled, the writable
+local source, or a git source), including third-party ones.
+
+---
+
+## 1. Describe what it does — `# description:`
+
+Steward shows a one-line description when a playbook is selected in the run form.
+
+```yaml
+---
+# description: Reclaim disk on Docker/Swarm nodes by pruning unused images and build cache.
+- name: Docker system prune
+  hosts: all
+  ...
+```
+
+- Format: a comment line `# description: <text>` anywhere in the file. **First
+  match wins.** Case-insensitive on the `description:` key.
+- Why a comment and not a key: Ansible rejects unknown *play* keys (you can't add
+  `description:` to a play), so a comment is the portable place. It survives
+  `ansible-playbook` untouched.
+- Fallback: if there's no `# description:` comment, Steward uses the **first
+  play's `name:`**. So always give your play a meaningful `name:` even without
+  the comment.
+- Keep it to one readable line. Longer "how to use" notes can go in additional
+  normal comments — Steward only reads the `description:` line.
+
+## 2. Declare tunables in `vars:` — they become fill-in fields
+
+Every **scalar** entry in a play's `vars:` block becomes an editable field in the
+run form, with the default shown as the input's placeholder.
+
+```yaml
+  vars:
+    prune_all_images: false      # → checkbox-ish text field, placeholder "default: false"
+    keep_last_days: 7            # → field, placeholder "default: 7"
+    registry_url: ""             # → field, placeholder "no default"
+```
+
+- **Blank field = use the default.** Steward only sends fields the operator
+  actually fills, so an untouched field falls through to the playbook/inventory
+  default rather than overriding it.
+- Only scalars (string/int/float/bool) surface as fields. Lists/dicts are
+  skipped — set those in the playbook or via inventory group/host vars.
+- Values are delivered as **extra-vars** (`-e`), which are the **highest**
+  precedence in Ansible — they override the `vars:` defaults. (This is why the
+  default can be empty and still be safely overridden at run time.)
+
+### `vars_prompt:` also works
+
+Steward reads `vars_prompt` too. Use it when you want an explicit prompt or a
+required value:
+
+```yaml
+  vars_prompt:
+    - name: release_tag
+      prompt: "Which release to deploy?"     # shown as the field label
+      # no default → Steward marks the field REQUIRED
+    - name: admin_password
+      prompt: "Admin password"
+      private: true                          # → masked field, never stored
+```
+
+## 3. Secrets — name them so they're masked and not persisted
+
+A field is treated as **secret** (rendered masked, and its value is **never
+written to the DB / run history**) when either:
+
+- the variable name contains `password`, `passwd`, `secret`, `token`,
+  `api_key` / `apikey`, `private_key`, or `credential` (case-insensitive), **or**
+- it's a `vars_prompt` entry with `private: true` (Ansible's default for
+  vars_prompt is private).
+
+So name sensitive variables accordingly (`db_password`, `api_token`,
+`vault_secret`) and they're handled safely with no extra config. Non-secret
+run-time vars are persisted (so scheduled runs can reuse them); secret ones are
+passed to the run only.
+
+## 4. Target with `hosts: all`
+
+Steward builds the inventory itself from the **target / group** the operator
+picks in the run form (or the single host on a host page). Your play should:
+
+```yaml
+  hosts: all          # run against whatever Steward scoped to
+```
+
+- Don't hardcode hostnames or rely on a checked-in inventory for Steward runs
+  (Steward generates a fresh inventory per run).
+- Per-host connection vars (`ansible_host`, plus anything you set on the target
+  in **Ansible → Inventory**) arrive as inventory host vars.
+- The run form's **Limit** / **Tags** map to `--limit` / `--tags`.
+
+## 5. Privileges & connection — don't put credentials in the playbook
+
+Steward supplies SSH and become for you:
+
+- Steady-state runs connect as the managed **`steward`** account using Steward's
+  managed key; that account has **passwordless sudo**. So just use
+  `become: true` where you need root.
+- First-contact provisioning uses a one-time bootstrap user/password the
+  operator enters (never stored).
+- Never embed SSH keys, passwords, or `ansible_user`/`ansible_ssh_pass` in the
+  playbook. Connection identity is global (Settings → Ansible) or per-target.
+
+## 6. Be idempotent
+
+Steward re-runs playbooks (updates, schedules, retries). Use modules that
+converge (state-based) rather than ad-hoc `command:`/`shell:` where possible, so
+re-runs are safe.
+
+---
+
+## What Steward reads from a playbook (summary)
+
+| Source in the playbook | What Steward does with it |
+|---|---|
+| `# description: <text>` comment | Description shown on selection (first match) |
+| first play `name:` | Description fallback |
+| `# steward:category: <text>` | Grouping badge in the browse list + run form |
+| `# steward:confirm: true` | Requires a confirmation tick before the run launches |
+| `vars:` scalar entries | Run-time fill-in fields (placeholder = default) |
+| `vars_prompt:` entries | Run-time fields (required if no default) |
+| secret-looking var name / `private: true` | Field masked + value not persisted |
+| `hosts:` | Expected to be `all`; Steward provides the inventory |
+
+Everything else (SSH user/key, become password, the inventory, `steward_token`
+etc. for the agent playbooks) is injected by Steward at run time.
+
+## Metadata comments
+
+Steward reads metadata from magic comments (Ansible rejects unknown play keys,
+so comments are the portable place). Two forms:
+
+- `# description: <text>` — the description (see §1).
+- `# steward:<key>: <value>` — the namespaced metadata block. First match per
+  key wins; keys are case-insensitive.
+
+**Implemented `# steward:` keys:**
+
+| Key | Example | Effect |
+|---|---|---|
+| `category` | `# steward:category: maintenance` | Free-text grouping label. Shown as a badge in the browse list and on the run form. Purely organizational. |
+| `confirm` | `# steward:confirm: true` | Marks the playbook as significant/destructive. The run form then requires an explicit confirmation tick before it can be launched. Use for data-loss-capable plays (prune with volumes, resets, etc.). Truthy values: `true`/`yes`/`1`/`on`. |
+| `description` | `# steward:description: ...` | Alias for `# description:` (the unprefixed form takes precedence if both exist). |
+
+```yaml
+---
+# description: Reclaim disk on Docker/Swarm nodes by pruning unused data.
+# steward:category: maintenance
+# steward:confirm: true
+- name: Docker system prune
+  hosts: all
+  ...
+```
+
+Other `# steward:<key>:` keys are simply ignored today — the namespace is
+reserved, so it's safe to add ones Steward doesn't yet understand without
+breaking anything, but only `category`, `confirm`, and `description` do something.
+
+## Minimal annotated example
+
+```yaml
+---
+# description: Restart a systemd service and confirm it came back up.
+- name: Restart a service
+  hosts: all
+  become: true
+  gather_facts: false
+  vars:
+    service_name: ""        # required-ish: operator fills it in the run form
+  tasks:
+    - name: Validate input
+      ansible.builtin.assert:
+        that: service_name | default('') | length > 0
+        fail_msg: "Set service_name."
+    - name: Restart
+      ansible.builtin.systemd:
+        name: "{{ service_name }}"
+        state: restarted
+    - name: Confirm active
+      ansible.builtin.command: "systemctl is-active {{ service_name }}"
+      changed_when: false
+```

docs/superpowers/plans/2026-04-13-rebrand.md

@@ -1,10 +1,10 @@
-# Roundtable Rebrand Implementation Plan
+# Steward Rebrand Implementation Plan
 
 > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
 >
 > **Testing:** Per project feedback, skip all test authoring and test runs during this work. Verify manually by running the app.
 
-**Goal:** Rebrand FabledScryer to Roundtable: full visual reskin plus full rename of package, config, containers, and docs.
+**Goal:** Rebrand FabledScryer to Steward: full visual reskin plus full rename of package, config, containers, and docs.
 
 **Architecture:** Staged as six sequential PRs. PR 1 is a pure visual/copy reskin that still ships under the FabledScryer name. PRs 2–4 perform the mechanical rename in order (package → config → container + user-visible strings) with a fallback shim in PR 3 so self-hosters don't break mid-upgrade. PR 5 updates docs. PR 6 removes the shim after one release cycle.
 
@@ -25,29 +25,29 @@
 - Any template with an empty-state message — themed line
 
 **Renamed (PR 2 — package):**
-- `fabledscryer/` → `roundtable/` (directory + every `from fabledscryer` / `import fabledscryer` reference)
+- `fabledscryer/` → `steward/` (directory + every `from fabledscryer` / `import fabledscryer` reference)
 - `pyproject.toml` — name, entry point, hatch packages
 - `alembic.ini` — `script_location`
 - `tests/**` — imports (tests not executed, but must not break collection; update imports mechanically)
 
 **Modified (PR 3 — config & env):**
-- `fabledscryer/config.py` → `roundtable/config.py` (already moved in PR 2) — read both `ROUNDTABLE_*` and `FABLEDSCRYER_*` with deprecation warning
+- `fabledscryer/config.py` → `steward/config.py` (already moved in PR 2) — read both `STEWARD_*` and `FABLEDSCRYER_*` with deprecation warning
 - `.env.example`, `config.example.yaml` — new names
-- First-boot migration of `~/.config/fabledscryer` → `~/.config/roundtable` (if the app uses it — verify during task)
+- First-boot migration of `~/.config/fabledscryer` → `~/.config/steward` (if the app uses it — verify during task)
 
 **Modified (PR 4 — container + user strings):**
 - `Dockerfile` — COPY paths, CMD, image labels
 - `docker-compose.yml` — service name, image, container_name, volumes, env
 - `entrypoint.sh` — package path for `nut_setup.py` invocation
-- `roundtable/templates/base.html` — wordmark text "Fabled Scryer" → "Roundtable", `<title>`
-- `roundtable/templates/auth/login.html` — any residual "Fabled Scryer" text
+- `steward/templates/base.html` — wordmark text "Fabled Scryer" → "Steward", `<title>`
+- `steward/templates/auth/login.html` — any residual "Fabled Scryer" text
 - `README.md` — first-page references (full doc sweep is PR 5)
 
 **Modified (PR 5 — docs):**
 - `README.md`, `docs/**/*.md`
 
 **Modified (PR 6 — cleanup):**
-- `roundtable/config.py` — remove fallback shim
+- `steward/config.py` — remove fallback shim
 
 ---
 
@@ -197,7 +197,7 @@ git commit -m "style: candlelit glow background replaces star field"
 - [ ] **Step 1: Change the title block**
 
 ```html
-<title>{% block title %}Roundtable{% endblock %}</title>
+<title>{% block title %}Steward{% endblock %}</title>
 ```
 
 Note: the visible wordmark text still reads "Fabled Scryer" — that flips in PR 4. This only changes the browser tab title, which is acceptable to flip early since it's not visible inside the UI.
@@ -263,7 +263,7 @@ Content for `fabledscryer/templates/errors/404.html`:
 
 ```html
 {% extends "base.html" %}
-{% block title %}Not Found — Roundtable{% endblock %}
+{% block title %}Not Found — Steward{% endblock %}
 {% block content %}
 <div style="text-align:center; padding: 4rem 2rem; font-family: var(--font-serif);">
   <h1 style="color: var(--gold); font-size: 2.5rem; margin-bottom: 0.5rem;">404</h1>
@@ -278,7 +278,7 @@ Content for `fabledscryer/templates/errors/500.html`:
 
 ```html
 {% extends "base.html" %}
-{% block title %}Error — Roundtable{% endblock %}
+{% block title %}Error — Steward{% endblock %}
 {% block content %}
 <div style="text-align:center; padding: 4rem 2rem; font-family: var(--font-serif);">
   <h1 style="color: var(--red); font-size: 2.5rem; margin-bottom: 0.5rem;">500</h1>
@@ -361,7 +361,7 @@ git add -A
 git commit -m "style: visual polish after manual review"
 ```
 
-**PR 1 done.** Open PR with title `feat: roundtable visual reskin (pewter & gold)`.
+**PR 1 done.** Open PR with title `feat: steward visual reskin (pewter & gold)`.
 
 ---
 
@@ -370,39 +370,39 @@ git commit -m "style: visual polish after manual review"
 ### Task 10: Rename the package directory
 
 **Files:**
-- Rename: `fabledscryer/` → `roundtable/`
+- Rename: `fabledscryer/` → `steward/`
 
 - [ ] **Step 1: Rename the directory**
 
 ```bash
-git mv fabledscryer roundtable
+git mv fabledscryer steward
 ```
 
 - [ ] **Step 2: Confirm the move**
 
 ```bash
-ls roundtable/ | head
+ls steward/ | head
 git status | head
 ```
 
-Expected: see `__init__.py`, `app.py`, `cli.py`, etc. inside `roundtable/`.
+Expected: see `__init__.py`, `app.py`, `cli.py`, etc. inside `steward/`.
 
 - [ ] **Step 3: Commit**
 
 ```bash
-git commit -m "refactor: rename package directory fabledscryer → roundtable"
+git commit -m "refactor: rename package directory fabledscryer → steward"
 ```
 
-### Task 11: Rewrite all `fabledscryer` imports to `roundtable`
+### Task 11: Rewrite all `fabledscryer` imports to `steward`
 
 **Files:**
-- Modify: every file under `roundtable/`, `tests/`, `alembic.ini`, `entrypoint.sh`, `Dockerfile` that imports from the old package
+- Modify: every file under `steward/`, `tests/`, `alembic.ini`, `entrypoint.sh`, `Dockerfile` that imports from the old package
 
 - [ ] **Step 1: Find every remaining `fabledscryer` reference in Python code**
 
 Run:
 ```bash
-grep -rn "fabledscryer" roundtable/ tests/ alembic.ini entrypoint.sh Dockerfile pyproject.toml
+grep -rn "fabledscryer" steward/ tests/ alembic.ini entrypoint.sh Dockerfile pyproject.toml
 ```
 
 Keep the output visible as a checklist.
@@ -410,24 +410,24 @@ Keep the output visible as a checklist.
 - [ ] **Step 2: Run a safe codemod across Python files**
 
 ```bash
-grep -rl "fabledscryer" roundtable/ tests/ | xargs sed -i 's/fabledscryer/roundtable/g'
+grep -rl "fabledscryer" steward/ tests/ | xargs sed -i 's/fabledscryer/steward/g'
 ```
 
-This touches only files under `roundtable/` and `tests/`. Do NOT run it across the whole repo yet — `docs/`, `.env.example`, `docker-compose.yml`, `config.example.yaml` and `README.md` are handled in later PRs.
+This touches only files under `steward/` and `tests/`. Do NOT run it across the whole repo yet — `docs/`, `.env.example`, `docker-compose.yml`, `config.example.yaml` and `README.md` are handled in later PRs.
 
 - [ ] **Step 3: Spot-check a few critical files**
 
 ```bash
-grep -n "roundtable\|fabledscryer" roundtable/app.py roundtable/cli.py roundtable/config.py roundtable/migrations/env.py
+grep -n "steward\|fabledscryer" steward/app.py steward/cli.py steward/config.py steward/migrations/env.py
 ```
 
-Expected: only `roundtable` references remain; no stray `fabledscryer`.
+Expected: only `steward` references remain; no stray `fabledscryer`.
 
 - [ ] **Step 4: Commit**
 
 ```bash
 git add -A
-git commit -m "refactor: update imports fabledscryer → roundtable"
+git commit -m "refactor: update imports fabledscryer → steward"
 ```
 
 ### Task 12: Update `pyproject.toml`
@@ -439,15 +439,15 @@ git commit -m "refactor: update imports fabledscryer → roundtable"
 
 ```toml
 [project]
-name = "roundtable"
+name = "steward"
 version = "0.1.0"
 # ... dependencies unchanged ...
 
 [project.scripts]
-roundtable = "roundtable.cli:main"
+steward = "steward.cli:main"
 
 [tool.hatch.build.targets.wheel]
-packages = ["roundtable"]
+packages = ["steward"]
 ```
 
 Leave `[project.optional-dependencies]`, `[tool.pytest.ini_options]`, and all dependency pins untouched.
@@ -456,7 +456,7 @@ Leave `[project.optional-dependencies]`, `[tool.pytest.ini_options]`, and all de
 
 ```bash
 git add pyproject.toml
-git commit -m "build: rename package to roundtable in pyproject"
+git commit -m "build: rename package to steward in pyproject"
 ```
 
 ### Task 13: Update `alembic.ini`
@@ -468,7 +468,7 @@ git commit -m "build: rename package to roundtable in pyproject"
 
 ```ini
 [alembic]
-script_location = roundtable/migrations
+script_location = steward/migrations
 prepend_sys_path = .
 version_path_separator = os
 ```
@@ -477,7 +477,7 @@ version_path_separator = os
 
 ```bash
 git add alembic.ini
-git commit -m "build: point alembic at roundtable/migrations"
+git commit -m "build: point alembic at steward/migrations"
 ```
 
 ### Task 14: Verify the package installs and imports cleanly
@@ -487,8 +487,8 @@ git commit -m "build: point alembic at roundtable/migrations"
 ```bash
 python -m venv /tmp/rt-verify
 /tmp/rt-verify/bin/pip install -e .
-/tmp/rt-verify/bin/python -c "import roundtable; import roundtable.app; import roundtable.cli; print('ok')"
-/tmp/rt-verify/bin/roundtable --help
+/tmp/rt-verify/bin/python -c "import steward; import steward.app; import steward.cli; print('ok')"
+/tmp/rt-verify/bin/steward --help
 ```
 
 Expected: `ok` and CLI help output. No ImportError.
@@ -501,20 +501,20 @@ rm -rf /tmp/rt-verify
 
 - [ ] **Step 3: No commit needed (verification only).**
 
-**PR 2 done.** Open PR with title `refactor: rename python package fabledscryer → roundtable`.
+**PR 2 done.** Open PR with title `refactor: rename python package fabledscryer → steward`.
 
 ---
 
 ## PR 3 — Config & Environment Variables
 
-### Task 15: Add env-var fallback shim in `roundtable/config.py`
+### Task 15: Add env-var fallback shim in `steward/config.py`
 
 **Files:**
-- Modify: `roundtable/config.py`
+- Modify: `steward/config.py`
 
 - [ ] **Step 1: Replace the env var lookups with a fallback helper**
 
-Open `roundtable/config.py` and replace the existing `load_bootstrap` body so it reads `ROUNDTABLE_*` first and falls back to `FABLEDSCRYER_*` with a deprecation warning.
+Open `steward/config.py` and replace the existing `load_bootstrap` body so it reads `STEWARD_*` first and falls back to `FABLEDSCRYER_*` with a deprecation warning.
 
 ```python
 def _env_with_fallback(new_name: str, old_name: str) -> str | None:
@@ -536,19 +536,19 @@ Then inside `load_bootstrap`, replace the existing env lookups with:
 
 ```python
 database_url = (
-    _env_with_fallback("ROUNDTABLE_DATABASE_URL", "FABLEDSCRYER_DATABASE_URL")
-    or _env_with_fallback("ROUNDTABLE_DATABASE__URL", "FABLEDSCRYER_DATABASE__URL")
+    _env_with_fallback("STEWARD_DATABASE_URL", "FABLEDSCRYER_DATABASE_URL")
+    or _env_with_fallback("STEWARD_DATABASE__URL", "FABLEDSCRYER_DATABASE__URL")
     or raw.get("database", {}).get("url")
 )
 if not database_url:
     raise ValueError(
-        "Database URL is required. Set ROUNDTABLE_DATABASE_URL env var "
+        "Database URL is required. Set STEWARD_DATABASE_URL env var "
         "or add 'database.url' to config.yaml."
     )
 
 # ...
 plugin_dir = (
-    _env_with_fallback("ROUNDTABLE_PLUGIN_DIR", "FABLEDSCRYER_PLUGIN_DIR")
+    _env_with_fallback("STEWARD_PLUGIN_DIR", "FABLEDSCRYER_PLUGIN_DIR")
     or raw.get("plugin_dir", "plugins")
 )
 ```
@@ -557,15 +557,15 @@ And in `_resolve_secret_key`:
 
 ```python
 from_env = (
-    _env_with_fallback("ROUNDTABLE_SECRET_KEY", "FABLEDSCRYER_SECRET_KEY")
+    _env_with_fallback("STEWARD_SECRET_KEY", "FABLEDSCRYER_SECRET_KEY")
     or raw.get("secret_key")
 )
 ```
 
-- [ ] **Step 2: Grep for any other `FABLEDSCRYER_` or `FABLEDNETMON_` env var reads across `roundtable/`**
+- [ ] **Step 2: Grep for any other `FABLEDSCRYER_` or `FABLEDNETMON_` env var reads across `steward/`**
 
 ```bash
-grep -rn "FABLEDSCRYER_\|FABLEDNETMON_" roundtable/
+grep -rn "FABLEDSCRYER_\|FABLEDNETMON_" steward/
 ```
 
 For each hit, apply the same pattern (new name first, old as fallback with warning). If `FABLEDNETMON_` is pure residue with no current consumer, delete the reference.
@@ -573,8 +573,8 @@ For each hit, apply the same pattern (new name first, old as fallback with warni
 - [ ] **Step 3: Commit**
 
 ```bash
-git add roundtable/config.py
-git commit -m "feat: ROUNDTABLE_* env vars with FABLEDSCRYER_* fallback"
+git add steward/config.py
+git commit -m "feat: STEWARD_* env vars with FABLEDSCRYER_* fallback"
 ```
 
 ### Task 16: Update `.env.example` and `config.example.yaml`
@@ -588,11 +588,11 @@ git commit -m "feat: ROUNDTABLE_* env vars with FABLEDSCRYER_* fallback"
 grep -n "FABLEDSCRYER\|FABLEDNETMON" .env.example
 ```
 
-Replace every occurrence with `ROUNDTABLE_*`. Add a short comment at top:
+Replace every occurrence with `STEWARD_*`. Add a short comment at top:
 
 ```
-# Roundtable environment configuration.
-# Only ROUNDTABLE_DATABASE_URL is required. Other settings live in the DB.
+# Steward environment configuration.
+# Only STEWARD_DATABASE_URL is required. Other settings live in the DB.
 ```
 
 - [ ] **Step 2: Rewrite `config.example.yaml`**
@@ -600,25 +600,25 @@ Replace every occurrence with `ROUNDTABLE_*`. Add a short comment at top:
 Replace the header and example strings:
 
 ```yaml
-# Roundtable — Bootstrap Configuration Example
+# Steward — Bootstrap Configuration Example
 #
 # The only REQUIRED setting is the database URL.
 # Set it via env var (recommended for Docker):
 #
-#   ROUNDTABLE_DATABASE_URL=postgresql+asyncpg://user:pass@host/db
+#   STEWARD_DATABASE_URL=postgresql+asyncpg://user:pass@host/db
 #
 # All other settings are stored in the database and managed via
 # the Settings UI at /settings/.
 
 database:
-  url: "postgresql+asyncpg://roundtable:password@localhost/roundtable"
+  url: "postgresql+asyncpg://steward:password@localhost/steward"
 ```
 
 - [ ] **Step 3: Commit**
 
 ```bash
 git add .env.example config.example.yaml
-git commit -m "docs: ROUNDTABLE_* env var examples"
+git commit -m "docs: STEWARD_* env var examples"
 ```
 
 ### Task 17: Manual config verification
@@ -626,8 +626,8 @@ git commit -m "docs: ROUNDTABLE_* env var examples"
 - [ ] **Step 1: Run the app with only the new env var**
 
 ```bash
-ROUNDTABLE_DATABASE_URL=postgresql+asyncpg://fabledscryer:fabledscryer@localhost/fabledscryer \
-  python -m roundtable.cli --host 127.0.0.1 --port 5001
+STEWARD_DATABASE_URL=postgresql+asyncpg://fabledscryer:fabledscryer@localhost/fabledscryer \
+  python -m steward.cli --host 127.0.0.1 --port 5001
 ```
 
 (Use whatever local DB you have; the old db name is fine — data isn't being renamed.)
@@ -638,14 +638,14 @@ Expected: app starts, no deprecation warning.
 
 ```bash
 FABLEDSCRYER_DATABASE_URL=postgresql+asyncpg://fabledscryer:fabledscryer@localhost/fabledscryer \
-  python -m roundtable.cli --host 127.0.0.1 --port 5001
+  python -m steward.cli --host 127.0.0.1 --port 5001
 ```
 
 Expected: app starts, deprecation warning logged once.
 
 - [ ] **Step 3: Kill processes.** No commit.
 
-**PR 3 done.** Open PR with title `feat: ROUNDTABLE_* env vars (FABLEDSCRYER_* fallback)`.
+**PR 3 done.** Open PR with title `feat: STEWARD_* env vars (FABLEDSCRYER_* fallback)`.
 
 ---
 
@@ -664,12 +664,12 @@ COPY fabledscryer/ fabledscryer/
 ```
 to
 ```dockerfile
-COPY roundtable/ roundtable/
+COPY steward/ steward/
 ```
 
 Change the CMD:
 ```dockerfile
-CMD ["roundtable", "--host", "0.0.0.0", "--port", "5000"]
+CMD ["steward", "--host", "0.0.0.0", "--port", "5000"]
 ```
 
 Leave everything else (apt packages, gosu, app user, EXPOSE 5000) untouched.
@@ -678,7 +678,7 @@ Leave everything else (apt packages, gosu, app user, EXPOSE 5000) untouched.
 
 ```bash
 git add Dockerfile
-git commit -m "build: update Dockerfile for roundtable package"
+git commit -m "build: update Dockerfile for steward package"
 ```
 
 ### Task 19: Update `entrypoint.sh`
@@ -688,15 +688,15 @@ git commit -m "build: update Dockerfile for roundtable package"
 
 - [ ] **Step 1: Replace the `nut_setup.py` invocation path**
 
-Change every `/app/fabledscryer/nut_setup.py` to `/app/roundtable/nut_setup.py`.
+Change every `/app/fabledscryer/nut_setup.py` to `/app/steward/nut_setup.py`.
 
-Update any comment that says "FabledScryer container entrypoint." to "Roundtable container entrypoint."
+Update any comment that says "FabledScryer container entrypoint." to "Steward container entrypoint."
 
 - [ ] **Step 2: Commit**
 
 ```bash
 git add entrypoint.sh
-git commit -m "build: entrypoint.sh uses roundtable package path"
+git commit -m "build: entrypoint.sh uses steward package path"
 ```
 
 ### Task 20: Update `docker-compose.yml`
@@ -708,10 +708,10 @@ git commit -m "build: entrypoint.sh uses roundtable package path"
 
 ```yaml
 services:
-  roundtable:
+  steward:
     build: .
-    container_name: roundtable
-    image: roundtable:latest
+    container_name: steward
+    image: steward:latest
     ports:
       - "5000:5000"
     volumes:
@@ -720,7 +720,7 @@ services:
       - /mnt/Data/traefik/log:/var/log/traefik:ro
       - /var/run/docker.sock:/var/run/docker.sock:ro
     environment:
-      - ROUNDTABLE_DATABASE_URL=postgresql+asyncpg://roundtable:roundtable@db/roundtable
+      - STEWARD_DATABASE_URL=postgresql+asyncpg://steward:steward@db/steward
     depends_on:
       db:
         condition: service_healthy
@@ -729,13 +729,13 @@ services:
   db:
     image: postgres:16-alpine
     environment:
-      POSTGRES_USER: roundtable
-      POSTGRES_PASSWORD: roundtable
-      POSTGRES_DB: roundtable
+      POSTGRES_USER: steward
+      POSTGRES_PASSWORD: steward
+      POSTGRES_DB: steward
     volumes:
       - pgdata:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U roundtable"]
+      test: ["CMD-SHELL", "pg_isready -U steward"]
       interval: 5s
       timeout: 5s
       retries: 5
@@ -752,37 +752,37 @@ volumes:
 
 ```bash
 git add docker-compose.yml
-git commit -m "build: docker-compose service → roundtable"
+git commit -m "build: docker-compose service → steward"
 ```
 
 ### Task 21: Flip user-visible wordmark and title
 
 **Files:**
-- Modify: `roundtable/templates/base.html`
+- Modify: `steward/templates/base.html`
 
 - [ ] **Step 1: Update the `<title>` block (around line 6)**
 
 ```html
-<title>{% block title %}Roundtable{% endblock %}</title>
+<title>{% block title %}Steward{% endblock %}</title>
 ```
 
 - [ ] **Step 2: Update the nav wordmark (around line 214)**
 
-Change `Fabled Scryer` inside `nav .brand` to `Roundtable`.
+Change `Fabled Scryer` inside `nav .brand` to `Steward`.
 
 - [ ] **Step 3: Grep for any other user-visible "Fabled Scryer" strings in templates**
 
 ```bash
-grep -rn "Fabled Scryer\|FabledScryer" roundtable/templates/
+grep -rn "Fabled Scryer\|FabledScryer" steward/templates/
 ```
 
-Replace each with "Roundtable".
+Replace each with "Steward".
 
 - [ ] **Step 4: Commit**
 
 ```bash
-git add roundtable/templates/
-git commit -m "copy: flip visible wordmark → Roundtable"
+git add steward/templates/
+git commit -m "copy: flip visible wordmark → Steward"
 ```
 
 ### Task 22: Manual container verification
@@ -795,8 +795,8 @@ docker compose up --build
 ```
 
 - [ ] **Step 2: Verify**
-  - Container named `roundtable` runs
-  - Browser shows "Roundtable" in tab title and nav
+  - Container named `steward` runs
+  - Browser shows "Steward" in tab title and nav
   - Login, dashboard, and error pages all render with the new palette and wordmark
   - Logs show no import errors and no unhandled deprecation warnings
 
@@ -806,7 +806,7 @@ docker compose up --build
 docker compose down
 ```
 
-**PR 4 done.** Open PR with title `feat: roundtable container & wordmark flip`.
+**PR 4 done.** Open PR with title `feat: steward container & wordmark flip`.
 
 ---
 
@@ -828,9 +828,9 @@ grep -rn "fabledscryer\|FabledScryer\|Fabled Scryer" README.md docs/
 ```bash
 grep -rl "fabledscryer\|FabledScryer\|Fabled Scryer" README.md docs/ \
   | xargs sed -i \
-      -e 's/FabledScryer/Roundtable/g' \
-      -e 's/fabledscryer/roundtable/g' \
-      -e 's/Fabled Scryer/Roundtable/g'
+      -e 's/FabledScryer/Steward/g' \
+      -e 's/fabledscryer/steward/g' \
+      -e 's/Fabled Scryer/Steward/g'
 ```
 
 Then read each changed file top-to-bottom and fix any mangled sentences (e.g. capitalization at the start of sentences, code blocks that now reference a directory that still needs a `./` prefix, etc.). Pay extra attention to:
@@ -843,12 +843,12 @@ Then read each changed file top-to-bottom and fix any mangled sentences (e.g. ca
 
 ```bash
 git add README.md docs/
-git commit -m "docs: roundtable rename sweep"
+git commit -m "docs: steward rename sweep"
 ```
 
 ### Task 24: Rename the Forgejo repo
 
-- [ ] **Step 1: Via Forgejo UI or API, rename the repo from `FabledScryer` to `Roundtable`.** The old URL will redirect for one grace period.
+- [ ] **Step 1: Via Forgejo UI or API, rename the repo from `FabledScryer` to `Steward`.** The old URL will redirect for one grace period.
 
 - [ ] **Step 2: Update your local remote URL**
 
@@ -862,13 +862,13 @@ git remote -v
 ```bash
 # from the parent dir
 cd ..
-mv FabledScryer Roundtable
-cd Roundtable
+mv FabledScryer Steward
+cd Steward
 ```
 
 - [ ] **Step 4: No commit.**
 
-**PR 5 done.** Open PR with title `docs: roundtable rename sweep`.
+**PR 5 done.** Open PR with title `docs: steward rename sweep`.
 
 ---
 
@@ -877,11 +877,11 @@ cd Roundtable
 ### Task 25: Remove env var fallback shim
 
 **Files:**
-- Modify: `roundtable/config.py`
+- Modify: `steward/config.py`
 
-- [ ] **Step 1: Delete `_env_with_fallback` and inline direct `os.environ.get("ROUNDTABLE_*")` lookups**
+- [ ] **Step 1: Delete `_env_with_fallback` and inline direct `os.environ.get("STEWARD_*")` lookups**
 
-Replace each `_env_with_fallback("ROUNDTABLE_X", "FABLEDSCRYER_X")` call with `os.environ.get("ROUNDTABLE_X")`. Delete the helper.
+Replace each `_env_with_fallback("STEWARD_X", "FABLEDSCRYER_X")` call with `os.environ.get("STEWARD_X")`. Delete the helper.
 
 - [ ] **Step 2: Grep to confirm no `FABLEDSCRYER_` references remain**
 
@@ -894,7 +894,7 @@ Expected: zero hits (or only historical commit messages, which don't show up in
 - [ ] **Step 3: Commit**
 
 ```bash
-git add roundtable/config.py
+git add steward/config.py
 git commit -m "refactor: remove FABLEDSCRYER_* env var fallback shim"
 ```
 
@@ -923,5 +923,5 @@ git commit -m "refactor: final rename sweep"
 
 - Spec coverage: all 5 spec sections mapped to PRs 1–5; PR 6 handles the cleanup implied by the shim in PR 3.
 - No placeholders — every template replacement includes concrete code; every grep includes the actual pattern.
-- Type consistency: config helper is `_env_with_fallback` in both Task 15 and Task 25; env var names are `ROUNDTABLE_DATABASE_URL`, `ROUNDTABLE_PLUGIN_DIR`, `ROUNDTABLE_SECRET_KEY` consistently.
+- Type consistency: config helper is `_env_with_fallback` in both Task 15 and Task 25; env var names are `STEWARD_DATABASE_URL`, `STEWARD_PLUGIN_DIR`, `STEWARD_SECRET_KEY` consistently.
 - Tests intentionally skipped per project feedback; verification is manual (browser + container).

docs/superpowers/specs/2026-04-13-rebrand-design.md

@@ -1,21 +1,21 @@
-# Roundtable Rebrand — Design
+# Steward Rebrand — Design
 
 **Date:** 2026-04-13
 **Status:** Approved for planning
 
 ## 1. Identity
 
-**Name:** Roundtable (dropping the "Fabled" prefix).
+**Name:** Steward (dropping the "Fabled" prefix).
 
-**Why the change:** The old name `FabledScryer` framed the app as a single seer peering into one crystal ball. The actual product is a gathering point — hosts, metrics, alerts, plugins, and dashboards from across the homelab converge here. "Roundtable" captures that: a place where the realm's tools and information meet.
+**Why the change:** The old name `FabledScryer` framed the app as a single seer peering into one crystal ball. The actual product is a gathering point — hosts, metrics, alerts, plugins, and dashboards from across the homelab converge here. "Steward" captures that: a place where the realm's tools and information meet.
 
 **Name conflict check:**
-- *Roundtable Software* — a Progress ABL tooling vendor. Different demographic, no overlap.
+- *Steward Software* — a Progress ABL tooling vendor. Different demographic, no overlap.
 - *Fabled.gg* — a virtual tabletop product. Closest concern, and the reason the "Fabled" prefix is dropped entirely to avoid confusion inside the tabletop/fantasy space.
 
-**Umbrella:** `fabledsword.com` remains the family umbrella domain; `git.fabledsword.com` remains the plugin catalog host. Roundtable becomes one product under that umbrella.
+**Umbrella:** `fabledsword.com` remains the family umbrella domain; `git.fabledsword.com` remains the plugin catalog host. Steward becomes one product under that umbrella.
 
-**Tone:** Heraldic / Arthurian register. The roundtable is the gathering place of those who keep watch over the realm.
+**Tone:** Heraldic / Arthurian register. The steward is the gathering place of those who keep watch over the realm.
 
 ## 2. Visual System
 
@@ -78,7 +78,7 @@ Candlelit glow — a soft, warm radial wash behind the main content area. Replac
 
 ### Wordmark
 
-"Roundtable" in EB Garamond, gold (`#c8a840`), paired with the seal mark to the left in the nav header.
+"Steward" in EB Garamond, gold (`#c8a840`), paired with the seal mark to the left in the nav header.
 
 ## 3. Voice & Copy
 
@@ -100,21 +100,21 @@ Candlelit glow — a soft, warm radial wash behind the main content area. Replac
 ## 4. Rename Mechanics
 
 **Code & packaging**
-- `fabledscryer/` package directory → `roundtable/`
-- All `from fabledscryer...` / `import fabledscryer...` → `roundtable`
-- `pyproject.toml`: project name, CLI entry point (`fabledscryer = "fabledscryer.cli:main"` → `roundtable = "roundtable.cli:main"`), tool sections
+- `fabledscryer/` package directory → `steward/`
+- All `from fabledscryer...` / `import fabledscryer...` → `steward`
+- `pyproject.toml`: project name, CLI entry point (`fabledscryer = "fabledscryer.cli:main"` → `steward = "steward.cli:main"`), tool sections
 - `__init__.py` package metadata
 
 **Runtime config**
-- Env vars: `FABLEDSCRYER_*` → `ROUNDTABLE_*`
+- Env vars: `FABLEDSCRYER_*` → `STEWARD_*`
 - Residual `FABLEDNETMON_*` env vars removed
-- Config dir: `~/.config/fabledscryer` → `~/.config/roundtable` (one-shot copy on first boot)
+- Config dir: `~/.config/fabledscryer` → `~/.config/steward` (one-shot copy on first boot)
 - Log file names, systemd unit names if any
 
 **Container & deploy**
 - `Dockerfile` labels, workdir
 - `docker-compose.yml` service name, image tag, volume names, `container_name`
-- Published image: `fabledscryer:latest` → `roundtable:latest`
+- Published image: `fabledscryer:latest` → `steward:latest`
 
 **Database**
 - Alembic `script_location` and any customized version table
@@ -144,10 +144,10 @@ Staged so `main` stays runnable between PRs.
 New palette tokens, locked logo SVG, EB Garamond font swap, candlelit glow background, themed edge copy (login, empty states, 404/500, dashboard hero "Under Watch, Under Care"). Still named FabledScryer internally. Ships independently, low risk.
 
 **PR 2 — Python package rename**
-`fabledscryer/` → `roundtable/`, all imports, `pyproject.toml` name + entry point, `__init__.py` metadata. Docker/config untouched. Package installable as `roundtable` locally.
+`fabledscryer/` → `steward/`, all imports, `pyproject.toml` name + entry point, `__init__.py` metadata. Docker/config untouched. Package installable as `steward` locally.
 
 **PR 3 — Config & env vars**
-`FABLEDSCRYER_*` → `ROUNDTABLE_*` with a short-lived fallback reader (accept both, warn on old) so self-hosters don't break mid-upgrade. Config dir migration on first boot. Drop `FABLEDNETMON_*` residue.
+`FABLEDSCRYER_*` → `STEWARD_*` with a short-lived fallback reader (accept both, warn on old) so self-hosters don't break mid-upgrade. Config dir migration on first boot. Drop `FABLEDNETMON_*` residue.
 
 **PR 4 — Container & deploy**
 `Dockerfile`, `docker-compose.yml` service/image/volume/container names. Published image tag switch. Template wordmark + `<title>` + meta (the last user-visible string flip).

entrypoint.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# Roundtable container entrypoint.
+# Steward container entrypoint.
 #
 # Drops from root to the 'app' user via gosu, then runs the command.
 # The container starts as root only so /data permissions can be fixed up

plugins/__init__.py

@@ -0,0 +1 @@
+# plugins/__init__.py

plugins/docker/__init__.py

@@ -0,0 +1,49 @@
+# plugins/docker/__init__.py
+from __future__ import annotations
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from quart import Quart
+
+_app: "Quart | None" = None
+
+
+def setup(app: "Quart") -> None:
+    global _app
+    _app = app
+    from .models import DockerContainer, DockerMetric  # noqa: F401 — register with Base
+
+    # Publish the per-host persist hook so the host agent can hand off the
+    # `docker` array from each sample without importing our models (opportunistic
+    # synergy — host_agent gates on has_capability and no-ops if we're disabled).
+    # required_role=viewer: this is a trusted server-side data-plane write driven
+    # by the authenticated agent ingest, not a user-facing privileged action.
+    from steward.core.capabilities import register_capability
+    from steward.models.users import UserRole
+    from .ingest import persist_host_docker
+    from .retention import run_docker_retention
+    register_capability(
+        "docker.persist_host_samples", persist_host_docker,
+        label="Persist host Docker samples",
+        description="Store per-host container state + metrics pushed by the host agent.",
+        required_role=UserRole.viewer,
+    )
+    # Roll up + prune Docker time-series, driven by the core cleanup task without
+    # it importing our models. Same trusted server-side data-plane role as above.
+    register_capability(
+        "docker.run_retention", run_docker_retention,
+        label="Run Docker retention",
+        description="Roll up old docker_metrics to hourly + prune stale metrics/events.",
+        required_role=UserRole.viewer,
+    )
+
+
+def get_scheduled_tasks() -> list:
+    # Collection is now agent-driven (pushed to the host_agent ingest); the
+    # central socket scrape was removed. No periodic task to register.
+    return []
+
+
+def get_blueprint():
+    from .routes import docker_bp
+    return docker_bp

plugins/docker/ingest.py

@@ -0,0 +1,323 @@
+# plugins/docker/ingest.py
+"""Persist host-scoped Docker samples pushed by the host agent.
+
+Published as the "docker.persist_host_samples" capability (see __init__.setup),
+so the host_agent plugin can hand off a sample's `docker` array (and, on a swarm
+manager, its `swarm` object) WITHOUT importing the docker models — the coupling
+is opportunistic and degrades to a no-op when the docker plugin is disabled.
+Runs inside the caller's open transaction (the ingest handler's SAVEPOINT);
+never opens or commits its own.
+"""
+from __future__ import annotations
+
+import json
+from datetime import datetime
+
+from sqlalchemy import delete, select
+
+
+# Stopped/terminal container states (anything not "running"/"paused"/"restarting").
+_STOPPED_STATES = {"exited", "dead", "stopped"}
+
+
+def _parse_started_at(value) -> datetime | None:
+    """Parse the agent's ISO-8601 started_at string back to a datetime."""
+    if not isinstance(value, str) or not value:
+        return None
+    try:
+        return datetime.fromisoformat(value.replace("Z", "+00:00"))
+    except ValueError:
+        return None
+
+
+def _derive_events(old_state: dict, new_containers: list) -> list:
+    """Diff a fresh snapshot against stored per-container state → lifecycle events.
+
+    Pure function (no DB) so it's unit-testable. `old_state` maps name → the
+    previously stored {status, health, oom_killed, exit_code}; `new_containers`
+    is the newest snapshot's list of container dicts. Returns a list of
+    (container_name, event, detail) tuples:
+
+      start         — a container transitions into running (or a genuinely new
+                      container appears already running)
+      stop          — running → not-running, or a running container is removed
+      die           — same as stop but with a non-zero exit code (abnormal)
+      oom           — OOMKilled flips False→True
+      health_change — HEALTHCHECK status string changes
+
+    The CALLER skips this entirely on a host's first-ever snapshot (empty
+    old_state) so the baseline doesn't emit a spurious "start" per existing
+    container — a later-appearing container still gets one because by then
+    old_state is populated and that container's prior entry is simply absent.
+    """
+    events: list = []
+    new_by_name = {c["name"]: c for c in new_containers if c.get("name")}
+
+    for name, c in new_by_name.items():
+        new_status = (c.get("status") or "").lower()
+        new_running = new_status == "running"
+        new_oom = bool(c.get("oom_killed"))
+        new_health = c.get("health")
+        new_exit = c.get("exit_code")
+        old = old_state.get(name)
+
+        if old is None:
+            # Newly observed container — only a start is meaningful (we have no
+            # prior state to diff a death against).
+            if new_running:
+                events.append((name, "start", c.get("image") or None))
+            continue
+
+        old_running = (old.get("status") or "").lower() == "running"
+        if new_running and not old_running:
+            events.append((name, "start", c.get("image") or None))
+        elif old_running and not new_running:
+            if new_exit not in (None, 0):
+                events.append((name, "die", f"exit {new_exit}"))
+            else:
+                events.append((name, "stop", None))
+
+        if new_oom and not bool(old.get("oom_killed")):
+            events.append((name, "oom", None))
+
+        if new_health != old.get("health") and (new_health or old.get("health")):
+            events.append((name, "health_change",
+                           f"{old.get('health') or '?'}→{new_health or '?'}"))
+
+    # A running container that vanished from the listing entirely (removed).
+    for name, old in old_state.items():
+        if name not in new_by_name and (old.get("status") or "").lower() == "running":
+            events.append((name, "stop", "removed"))
+
+    return events
+
+
+async def _persist_swarm(session, host, swarm: dict) -> None:
+    """Upsert this manager's swarm topology; drop rows no longer reported.
+
+    Current-state tables (not time-series): a manager re-reports its full
+    services/nodes set every sample, so we upsert what's present and delete what
+    isn't (scoped to this host so two managers don't clobber each other).
+    """
+    from datetime import timezone
+    from .models import DockerSwarmNode, DockerSwarmService
+
+    now = datetime.now(timezone.utc)
+
+    services = swarm.get("services") or []
+    seen_services: set[str] = set()
+    for s in services:
+        name = s.get("service_name")
+        if not name:
+            continue
+        seen_services.add(name)
+        row = await session.get(DockerSwarmService, (host.id, name))
+        if row is None:
+            row = DockerSwarmService(host_id=host.id, service_name=name)
+            session.add(row)
+        row.mode = s.get("mode") or "replicated"
+        row.desired = int(s.get("desired") or 0)
+        row.running = int(s.get("running") or 0)
+        row.image = s.get("image")
+        row.placement_json = json.dumps(s.get("placement") or [])
+        row.updated_at = now
+    stale_services = delete(DockerSwarmService).where(
+        DockerSwarmService.host_id == host.id)
+    if seen_services:
+        stale_services = stale_services.where(
+            DockerSwarmService.service_name.notin_(seen_services))
+    await session.execute(stale_services)
+
+    nodes = swarm.get("nodes") or []
+    seen_nodes: set[str] = set()
+    for n in nodes:
+        nid = n.get("node_id")
+        if not nid:
+            continue
+        seen_nodes.add(nid)
+        row = await session.get(DockerSwarmNode, (host.id, nid))
+        if row is None:
+            row = DockerSwarmNode(host_id=host.id, node_id=nid)
+            session.add(row)
+        row.hostname = n.get("hostname") or ""
+        row.role = n.get("role") or "worker"
+        row.availability = n.get("availability") or "active"
+        row.status = n.get("status") or "unknown"
+        row.leader = bool(n.get("leader", False))
+        row.updated_at = now
+    stale_nodes = delete(DockerSwarmNode).where(DockerSwarmNode.host_id == host.id)
+    if seen_nodes:
+        stale_nodes = stale_nodes.where(DockerSwarmNode.node_id.notin_(seen_nodes))
+    await session.execute(stale_nodes)
+
+
+async def _persist_disk(session, host, disk: dict) -> None:
+    """Upsert this host's /system/df summary + replace its image storage rows.
+
+    Current-state (not time-series): the agent re-reports the full summary each
+    interval, so we overwrite the single summary row and replace the image set
+    (delete rows no longer present, upsert the rest), scoped to this host.
+    """
+    from datetime import timezone
+    from .models import DockerDiskUsage, DockerImage
+
+    now = datetime.now(timezone.utc)
+
+    summary = await session.get(DockerDiskUsage, host.id)
+    if summary is None:
+        summary = DockerDiskUsage(host_id=host.id)
+        session.add(summary)
+    summary.layers_size = int(disk.get("layers_size") or 0)
+    summary.images_size = int(disk.get("images_size") or 0)
+    summary.images_reclaimable = int(disk.get("images_reclaimable") or 0)
+    summary.containers_size = int(disk.get("containers_size") or 0)
+    summary.volumes_size = int(disk.get("volumes_size") or 0)
+    summary.build_cache_size = int(disk.get("build_cache_size") or 0)
+    summary.images_total = int(disk.get("images_total") or 0)
+    summary.images_active = int(disk.get("images_active") or 0)
+    summary.containers_count = int(disk.get("containers_count") or 0)
+    summary.volumes_count = int(disk.get("volumes_count") or 0)
+    summary.updated_at = now
+
+    images = disk.get("images") or []
+    seen: set[str] = set()
+    for im in images:
+        iid = im.get("image_id")
+        if not iid or iid in seen:
+            continue
+        seen.add(iid)
+        row = await session.get(DockerImage, (host.id, iid))
+        if row is None:
+            row = DockerImage(host_id=host.id, image_id=iid)
+            session.add(row)
+        row.repo_tag = (im.get("repo_tag") or "<none>")[:512]
+        row.size = int(im.get("size") or 0)
+        row.shared_size = int(im.get("shared_size") or 0)
+        row.containers = int(im.get("containers") or 0)
+        row.updated_at = now
+    stale = delete(DockerImage).where(DockerImage.host_id == host.id)
+    if seen:
+        stale = stale.where(DockerImage.image_id.notin_(seen))
+    await session.execute(stale)
+
+
+async def persist_host_docker(session, host, snapshots, swarm=None, disk=None) -> None:
+    """Upsert containers + time-series + lifecycle events + swarm for one host.
+
+    `snapshots` is a list of (recorded_at: datetime, containers: list[dict]) —
+    one entry per ingested sample carrying docker data (usually one; more when
+    the agent flushes a backlog). Every snapshot contributes time-series
+    DockerMetric rows; the newest snapshot drives current container state, the
+    alert pipeline, and lifecycle-event derivation. `swarm` is the newest
+    sample's swarm object (or None off managers) — persisted when present.
+    `disk` is the newest sample's /system/df summary (or None on Docker-less
+    hosts) — persisted when present.
+    """
+    from steward.core.alerts import record_metric
+    from .models import DockerContainer, DockerEvent, DockerMetric
+
+    if swarm is not None:
+        await _persist_swarm(session, host, swarm)
+    if disk is not None:
+        await _persist_disk(session, host, disk)
+
+    if not snapshots:
+        return
+    ordered = sorted(snapshots, key=lambda s: s[0])
+    latest_at, latest_containers = ordered[-1]
+
+    # Time-series points for every snapshot (running containers with a CPU read).
+    for recorded_at, containers in ordered:
+        for c in containers:
+            if c.get("status") == "running" and c.get("cpu_pct") is not None:
+                session.add(DockerMetric(
+                    host_id=host.id,
+                    container_name=c["name"],
+                    scraped_at=recorded_at,
+                    cpu_pct=c["cpu_pct"],
+                    mem_pct=c.get("mem_pct") or 0.0,
+                    mem_usage_bytes=c.get("mem_usage_bytes") or 0,
+                ))
+
+    # Snapshot of stored per-container state BEFORE the upsert overwrites it —
+    # used to diff lifecycle events. Skip event derivation on the host's first
+    # snapshot (empty state) so we don't emit a start per pre-existing container.
+    old_rows = (await session.execute(
+        select(DockerContainer).where(DockerContainer.host_id == host.id)
+    )).scalars().all()
+    old_state = {
+        r.name: {"status": r.status, "health": r.health,
+                 "oom_killed": r.oom_killed, "exit_code": r.exit_code}
+        for r in old_rows
+    }
+    if old_state:
+        for name, event, detail in _derive_events(old_state, latest_containers):
+            session.add(DockerEvent(
+                host_id=host.id, container_name=name,
+                event=event, detail=detail, at=latest_at,
+            ))
+
+    # Current state + alerts from the newest snapshot only.
+    for c in latest_containers:
+        name = c.get("name")
+        if not name:
+            continue
+        existing = await session.get(DockerContainer, (host.id, name))
+        if existing is None:
+            existing = DockerContainer(host_id=host.id, name=name)
+            session.add(existing)
+        existing.container_id = c.get("container_id", "") or ""
+        existing.image = c.get("image", "") or ""
+        existing.status = c.get("status", "unknown") or "unknown"
+        existing.cpu_pct = c.get("cpu_pct")
+        existing.mem_usage_bytes = c.get("mem_usage_bytes")
+        existing.mem_limit_bytes = c.get("mem_limit_bytes")
+        existing.mem_pct = c.get("mem_pct")
+        existing.ports_json = json.dumps(c.get("ports") or [])
+        existing.started_at = _parse_started_at(c.get("started_at"))
+        existing.scraped_at = latest_at
+        # Enrichment (agent ≥ 1.4.0; .get keeps older agents working — fields
+        # stay None/0 when absent from the payload).
+        existing.restart_count = c.get("restart_count", 0) or 0
+        existing.health = c.get("health")
+        existing.exit_code = c.get("exit_code")
+        existing.oom_killed = bool(c.get("oom_killed", False))
+        existing.compose_project = c.get("compose_project")
+        existing.service_name = c.get("service_name")
+        existing.task_id = c.get("task_id")
+        existing.node_id = c.get("node_id")
+        existing.net_rx_bytes = c.get("net_rx_bytes")
+        existing.net_tx_bytes = c.get("net_tx_bytes")
+        existing.blk_read_bytes = c.get("blk_read_bytes")
+        existing.blk_write_bytes = c.get("blk_write_bytes")
+
+        # Alert pipeline — resource is host-scoped so containers of the same name
+        # on different hosts don't collide in the metric/alert namespace.
+        resource = f"{host.name}/{name}"
+        if c.get("status") == "running" and c.get("cpu_pct") is not None:
+            await record_metric(
+                session=session, source_module="docker",
+                resource_name=resource, metric_name="cpu_pct", value=c["cpu_pct"],
+            )
+            if c.get("mem_pct") is not None:
+                await record_metric(
+                    session=session, source_module="docker",
+                    resource_name=resource, metric_name="mem_pct", value=c["mem_pct"],
+                )
+        # Restart count is alertable regardless of state (crash-looping matters
+        # most while the container is down/restarting).
+        await record_metric(
+            session=session, source_module="docker",
+            resource_name=resource, metric_name="restart_count",
+            value=float(c.get("restart_count", 0) or 0),
+        )
+        # Health → 1.0/0.0 only for containers that actually define a HEALTHCHECK
+        # (health is None otherwise — recording 0 would false-alarm every plain
+        # container).
+        health = c.get("health")
+        if health in ("healthy", "unhealthy", "starting"):
+            await record_metric(
+                session=session, source_module="docker",
+                resource_name=resource, metric_name="is_healthy",
+                value=1.0 if health == "healthy" else 0.0,
+            )

plugins/docker/migrations/env.py

@@ -0,0 +1,70 @@
+# plugins/docker/migrations/env.py
+"""Alembic env.py for the Docker plugin."""
+import asyncio
+import os
+import sys
+from pathlib import Path
+from logging.config import fileConfig
+
+from sqlalchemy import pool
+from sqlalchemy.engine import Connection
+from sqlalchemy.ext.asyncio import async_engine_from_config
+from alembic import context
+
+sys.path.insert(0, str(Path(__file__).parent.parent.parent.parent))
+
+from steward.models.base import Base
+import steward.models  # noqa: F401
+from plugins.docker.models import DockerContainer, DockerMetric  # noqa: F401
+
+config = context.config
+if config.config_file_name is not None:
+    fileConfig(config.config_file_name)
+
+target_metadata = Base.metadata
+
+
+def _get_url() -> str:
+    import yaml
+    cfg_path = os.environ.get("STEWARD_CONFIG", "config.yaml")
+    try:
+        with open(cfg_path) as f:
+            cfg = yaml.safe_load(f) or {}
+        url = cfg.get("database", {}).get("url", "")
+    except FileNotFoundError:
+        url = ""
+    return os.environ.get("STEWARD_DATABASE__URL", url)
+
+
+def run_migrations_offline() -> None:
+    context.configure(
+        url=_get_url(), target_metadata=target_metadata,
+        literal_binds=True, dialect_opts={"paramstyle": "named"},
+    )
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+def do_run_migrations(connection: Connection) -> None:
+    context.configure(connection=connection, target_metadata=target_metadata)
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+async def run_async_migrations() -> None:
+    cfg = config.get_section(config.config_ini_section, {})
+    cfg["sqlalchemy.url"] = _get_url()
+    connectable = async_engine_from_config(cfg, prefix="sqlalchemy.", poolclass=pool.NullPool)
+    async with connectable.connect() as connection:
+        await connection.run_sync(do_run_migrations)
+    await connectable.dispose()
+
+
+def run_migrations_online() -> None:
+    asyncio.run(run_async_migrations())
+
+
+if context.is_offline_mode():
+    run_migrations_offline()
+else:
+    run_migrations_online()

plugins/docker/migrations/versions/docker_001_initial.py

@@ -0,0 +1,47 @@
+"""Docker plugin initial tables
+
+Revision ID: docker_001_initial
+Revises: (none — branch off core via depends_on)
+Create Date: 2026-03-22
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "docker_001_initial"
+down_revision: Union[str, None] = None
+branch_labels: Union[str, Sequence[str], None] = "docker"
+depends_on: Union[str, Sequence[str], None] = ("0004_app_settings",)
+
+
+def upgrade() -> None:
+    op.create_table(
+        "docker_containers",
+        sa.Column("name", sa.String(255), primary_key=True),
+        sa.Column("container_id", sa.String(64), nullable=False, server_default=""),
+        sa.Column("image", sa.String(512), nullable=False, server_default=""),
+        sa.Column("status", sa.String(32), nullable=False, server_default="unknown"),
+        sa.Column("cpu_pct", sa.Float, nullable=True),
+        sa.Column("mem_usage_bytes", sa.Integer, nullable=True),
+        sa.Column("mem_limit_bytes", sa.Integer, nullable=True),
+        sa.Column("mem_pct", sa.Float, nullable=True),
+        sa.Column("restart_count", sa.Integer, nullable=False, server_default="0"),
+        sa.Column("ports_json", sa.Text, nullable=False, server_default="[]"),
+        sa.Column("started_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("scraped_at", sa.DateTime(timezone=True), nullable=False),
+    )
+
+    op.create_table(
+        "docker_metrics",
+        sa.Column("id", sa.String(36), primary_key=True),
+        sa.Column("container_name", sa.String(255), nullable=False, index=True),
+        sa.Column("scraped_at", sa.DateTime(timezone=True), nullable=False, index=True),
+        sa.Column("cpu_pct", sa.Float, nullable=False, server_default="0"),
+        sa.Column("mem_pct", sa.Float, nullable=False, server_default="0"),
+        sa.Column("mem_usage_bytes", sa.Integer, nullable=False, server_default="0"),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("docker_metrics")
+    op.drop_table("docker_containers")

plugins/docker/migrations/versions/docker_002_host_scoped.py

@@ -0,0 +1,94 @@
+"""Docker collection goes per-host: add host_id, re-key by (host_id, name)
+
+Collection moved from the central single-socket scrape to the host agent, so
+containers are now scoped to the host that reported them. docker_containers is
+re-keyed (host_id, name) and docker_metrics gains host_id.
+
+Dev-only posture (rule 122): the old tables only ever held the Steward box's
+own containers (a single global namespace), which are disposable — so this
+DROP+recreates rather than backfilling a host_id onto orphan rows.
+
+Revision ID: docker_002_host_scoped
+Revises: docker_001_initial
+Create Date: 2026-06-18
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "docker_002_host_scoped"
+down_revision: Union[str, None] = "docker_001_initial"
+branch_labels: Union[str, Sequence[str], None] = None
+# FK targets hosts.id (created in 0002_core_monitors) — make the edge explicit.
+depends_on: Union[str, Sequence[str], None] = ("0002_core_monitors",)
+
+
+def upgrade() -> None:
+    op.drop_table("docker_metrics")
+    op.drop_table("docker_containers")
+
+    op.create_table(
+        "docker_containers",
+        sa.Column("host_id", sa.String(36),
+                  sa.ForeignKey("hosts.id", ondelete="CASCADE"), primary_key=True),
+        sa.Column("name", sa.String(255), primary_key=True),
+        sa.Column("container_id", sa.String(64), nullable=False, server_default=""),
+        sa.Column("image", sa.String(512), nullable=False, server_default=""),
+        sa.Column("status", sa.String(32), nullable=False, server_default="unknown"),
+        sa.Column("cpu_pct", sa.Float, nullable=True),
+        sa.Column("mem_usage_bytes", sa.Integer, nullable=True),
+        sa.Column("mem_limit_bytes", sa.Integer, nullable=True),
+        sa.Column("mem_pct", sa.Float, nullable=True),
+        sa.Column("restart_count", sa.Integer, nullable=False, server_default="0"),
+        sa.Column("ports_json", sa.Text, nullable=False, server_default="[]"),
+        sa.Column("started_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("scraped_at", sa.DateTime(timezone=True), nullable=False),
+    )
+
+    op.create_table(
+        "docker_metrics",
+        sa.Column("id", sa.String(36), primary_key=True),
+        sa.Column("host_id", sa.String(36),
+                  sa.ForeignKey("hosts.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("container_name", sa.String(255), nullable=False),
+        sa.Column("scraped_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("cpu_pct", sa.Float, nullable=False, server_default="0"),
+        sa.Column("mem_pct", sa.Float, nullable=False, server_default="0"),
+        sa.Column("mem_usage_bytes", sa.Integer, nullable=False, server_default="0"),
+    )
+    op.create_index("ix_docker_metrics_host_id", "docker_metrics", ["host_id"])
+    op.create_index("ix_docker_metrics_container_name", "docker_metrics",
+                    ["container_name"])
+    op.create_index("ix_docker_metrics_scraped_at", "docker_metrics", ["scraped_at"])
+    op.create_index("ix_docker_metrics_host_container_time", "docker_metrics",
+                    ["host_id", "container_name", "scraped_at"])
+
+
+def downgrade() -> None:
+    op.drop_table("docker_metrics")
+    op.drop_table("docker_containers")
+
+    op.create_table(
+        "docker_containers",
+        sa.Column("name", sa.String(255), primary_key=True),
+        sa.Column("container_id", sa.String(64), nullable=False, server_default=""),
+        sa.Column("image", sa.String(512), nullable=False, server_default=""),
+        sa.Column("status", sa.String(32), nullable=False, server_default="unknown"),
+        sa.Column("cpu_pct", sa.Float, nullable=True),
+        sa.Column("mem_usage_bytes", sa.Integer, nullable=True),
+        sa.Column("mem_limit_bytes", sa.Integer, nullable=True),
+        sa.Column("mem_pct", sa.Float, nullable=True),
+        sa.Column("restart_count", sa.Integer, nullable=False, server_default="0"),
+        sa.Column("ports_json", sa.Text, nullable=False, server_default="[]"),
+        sa.Column("started_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("scraped_at", sa.DateTime(timezone=True), nullable=False),
+    )
+    op.create_table(
+        "docker_metrics",
+        sa.Column("id", sa.String(36), primary_key=True),
+        sa.Column("container_name", sa.String(255), nullable=False, index=True),
+        sa.Column("scraped_at", sa.DateTime(timezone=True), nullable=False, index=True),
+        sa.Column("cpu_pct", sa.Float, nullable=False, server_default="0"),
+        sa.Column("mem_pct", sa.Float, nullable=False, server_default="0"),
+        sa.Column("mem_usage_bytes", sa.Integer, nullable=False, server_default="0"),
+    )

plugins/docker/migrations/versions/docker_003_container_enrichment.py

@@ -0,0 +1,41 @@
+"""Docker container enrichment: health, exit/restart, grouping, I/O counters
+
+Adds the fields the agent (≥1.4.0) now reports per container beyond the basic
+state: health status, exit code, OOM flag, compose/swarm grouping labels, and
+cumulative network/block I/O counters. Additive columns — no data loss, so no
+DROP+recreate needed here.
+
+Revision ID: docker_003_container_enrichment
+Revises: docker_002_host_scoped
+Create Date: 2026-06-19
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "docker_003_container_enrichment"
+down_revision: Union[str, None] = "docker_002_host_scoped"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column("docker_containers", sa.Column("health", sa.String(16), nullable=True))
+    op.add_column("docker_containers", sa.Column("exit_code", sa.Integer, nullable=True))
+    op.add_column("docker_containers",
+                  sa.Column("oom_killed", sa.Boolean, nullable=False, server_default=sa.false()))
+    op.add_column("docker_containers", sa.Column("compose_project", sa.String(255), nullable=True))
+    op.add_column("docker_containers", sa.Column("service_name", sa.String(255), nullable=True))
+    op.add_column("docker_containers", sa.Column("task_id", sa.String(64), nullable=True))
+    op.add_column("docker_containers", sa.Column("node_id", sa.String(64), nullable=True))
+    op.add_column("docker_containers", sa.Column("net_rx_bytes", sa.BigInteger, nullable=True))
+    op.add_column("docker_containers", sa.Column("net_tx_bytes", sa.BigInteger, nullable=True))
+    op.add_column("docker_containers", sa.Column("blk_read_bytes", sa.BigInteger, nullable=True))
+    op.add_column("docker_containers", sa.Column("blk_write_bytes", sa.BigInteger, nullable=True))
+
+
+def downgrade() -> None:
+    for col in ("blk_write_bytes", "blk_read_bytes", "net_tx_bytes", "net_rx_bytes",
+                "node_id", "task_id", "service_name", "compose_project",
+                "oom_killed", "exit_code", "health"):
+        op.drop_column("docker_containers", col)

plugins/docker/migrations/versions/docker_004_events_swarm.py

@@ -0,0 +1,77 @@
+"""Docker lifecycle events + swarm topology tables
+
+Adds the storage for milestone-77 monitoring depth that doesn't fit on the
+per-container row:
+
+  * docker_events — lifecycle (start/stop/die/oom/health_change) derived by
+    diffing consecutive host snapshots; host-scoped, indexed for both timeline
+    lookups (host_id, container_name, at) and retention pruning (at).
+  * docker_swarm_services / docker_swarm_nodes — manager-reported Swarm
+    topology (desired-vs-running replicas, node role/availability/status).
+
+All new tables — purely additive, so no DROP+recreate. `event`/`mode`/`role`
+etc. are plain strings (no CHECK whitelist), matching how docker_containers
+models `status`; keeps the value sets open without a migration per addition
+(so rule 36 doesn't apply here).
+
+Revision ID: docker_004_events_swarm
+Revises: docker_003_container_enrichment
+Create Date: 2026-06-19
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "docker_004_events_swarm"
+down_revision: Union[str, None] = "docker_003_container_enrichment"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "docker_events",
+        sa.Column("id", sa.String(36), primary_key=True),
+        sa.Column("host_id", sa.String(36),
+                  sa.ForeignKey("hosts.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("container_name", sa.String(255), nullable=False),
+        sa.Column("event", sa.String(16), nullable=False),
+        sa.Column("detail", sa.String(255), nullable=True),
+        sa.Column("at", sa.DateTime(timezone=True), nullable=False),
+    )
+    op.create_index("ix_docker_events_host_container_time", "docker_events",
+                    ["host_id", "container_name", "at"])
+    op.create_index("ix_docker_events_at", "docker_events", ["at"])
+
+    op.create_table(
+        "docker_swarm_services",
+        sa.Column("host_id", sa.String(36),
+                  sa.ForeignKey("hosts.id", ondelete="CASCADE"), primary_key=True),
+        sa.Column("service_name", sa.String(255), primary_key=True),
+        sa.Column("mode", sa.String(16), nullable=False, server_default="replicated"),
+        sa.Column("desired", sa.Integer, nullable=False, server_default="0"),
+        sa.Column("running", sa.Integer, nullable=False, server_default="0"),
+        sa.Column("image", sa.String(512), nullable=True),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
+    )
+
+    op.create_table(
+        "docker_swarm_nodes",
+        sa.Column("host_id", sa.String(36),
+                  sa.ForeignKey("hosts.id", ondelete="CASCADE"), primary_key=True),
+        sa.Column("node_id", sa.String(64), primary_key=True),
+        sa.Column("hostname", sa.String(255), nullable=False, server_default=""),
+        sa.Column("role", sa.String(16), nullable=False, server_default="worker"),
+        sa.Column("availability", sa.String(16), nullable=False, server_default="active"),
+        sa.Column("status", sa.String(16), nullable=False, server_default="unknown"),
+        sa.Column("leader", sa.Boolean, nullable=False, server_default=sa.false()),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("docker_swarm_nodes")
+    op.drop_table("docker_swarm_services")
+    op.drop_index("ix_docker_events_at", table_name="docker_events")
+    op.drop_index("ix_docker_events_host_container_time", table_name="docker_events")
+    op.drop_table("docker_events")

plugins/docker/migrations/versions/docker_005_swarm_placement.py

@@ -0,0 +1,29 @@
+"""Docker swarm service placement column
+
+Adds docker_swarm_services.placement_json — the task→node placement of a
+service's running replicas, captured from the agent's swarm payload (a manager
+sees every task, so this records cross-node placement the local container rows
+can't). Additive column; no DROP+recreate.
+
+Revision ID: docker_005_swarm_placement
+Revises: docker_004_events_swarm
+Create Date: 2026-06-19
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "docker_005_swarm_placement"
+down_revision: Union[str, None] = "docker_004_events_swarm"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column("docker_swarm_services",
+                  sa.Column("placement_json", sa.Text, nullable=False,
+                            server_default="[]"))
+
+
+def downgrade() -> None:
+    op.drop_column("docker_swarm_services", "placement_json")

plugins/docker/migrations/versions/docker_006_metric_rollup.py

@@ -0,0 +1,45 @@
+"""Docker hourly metric rollup table
+
+Adds docker_metrics_hourly — the coarse series that retention rolls raw
+docker_metrics into before pruning them, so multi-day history stays cheap.
+One row per (host, container, hour bucket); the unique constraint is the
+conflict target for the idempotent rollup upsert. Additive create_table.
+
+Revision ID: docker_006_metric_rollup
+Revises: docker_005_swarm_placement
+Create Date: 2026-06-19
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "docker_006_metric_rollup"
+down_revision: Union[str, None] = "docker_005_swarm_placement"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "docker_metrics_hourly",
+        sa.Column("id", sa.String(length=36), nullable=False),
+        sa.Column("host_id", sa.String(length=36), nullable=False),
+        sa.Column("container_name", sa.String(length=255), nullable=False),
+        sa.Column("bucket", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("cpu_pct", sa.Float(), nullable=False, server_default="0"),
+        sa.Column("mem_pct", sa.Float(), nullable=False, server_default="0"),
+        sa.Column("mem_usage_bytes", sa.BigInteger(), nullable=False, server_default="0"),
+        sa.Column("sample_count", sa.Integer(), nullable=False, server_default="0"),
+        sa.ForeignKeyConstraint(["host_id"], ["hosts.id"], ondelete="CASCADE"),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("host_id", "container_name", "bucket",
+                            name="uq_docker_metrics_hourly_bucket"),
+    )
+    op.create_index("ix_docker_metrics_hourly_bucket",
+                    "docker_metrics_hourly", ["bucket"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_docker_metrics_hourly_bucket",
+                  table_name="docker_metrics_hourly")
+    op.drop_table("docker_metrics_hourly")

plugins/docker/migrations/versions/docker_007_disk_usage.py

@@ -0,0 +1,55 @@
+"""Docker disk usage + image storage tables
+
+Adds docker_disk_usage (one per-host /system/df summary row) and docker_images
+(the heavy-hitter image storage records). Both current-state, host-scoped,
+re-reported each interval. Additive create_table.
+
+Revision ID: docker_007_disk_usage
+Revises: docker_006_metric_rollup
+Create Date: 2026-06-19
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "docker_007_disk_usage"
+down_revision: Union[str, None] = "docker_006_metric_rollup"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "docker_disk_usage",
+        sa.Column("host_id", sa.String(length=36), nullable=False),
+        sa.Column("layers_size", sa.BigInteger(), nullable=False, server_default="0"),
+        sa.Column("images_size", sa.BigInteger(), nullable=False, server_default="0"),
+        sa.Column("images_reclaimable", sa.BigInteger(), nullable=False, server_default="0"),
+        sa.Column("containers_size", sa.BigInteger(), nullable=False, server_default="0"),
+        sa.Column("volumes_size", sa.BigInteger(), nullable=False, server_default="0"),
+        sa.Column("build_cache_size", sa.BigInteger(), nullable=False, server_default="0"),
+        sa.Column("images_total", sa.Integer(), nullable=False, server_default="0"),
+        sa.Column("images_active", sa.Integer(), nullable=False, server_default="0"),
+        sa.Column("containers_count", sa.Integer(), nullable=False, server_default="0"),
+        sa.Column("volumes_count", sa.Integer(), nullable=False, server_default="0"),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
+        sa.ForeignKeyConstraint(["host_id"], ["hosts.id"], ondelete="CASCADE"),
+        sa.PrimaryKeyConstraint("host_id"),
+    )
+    op.create_table(
+        "docker_images",
+        sa.Column("host_id", sa.String(length=36), nullable=False),
+        sa.Column("image_id", sa.String(length=64), nullable=False),
+        sa.Column("repo_tag", sa.String(length=512), nullable=False, server_default="<none>"),
+        sa.Column("size", sa.BigInteger(), nullable=False, server_default="0"),
+        sa.Column("shared_size", sa.BigInteger(), nullable=False, server_default="0"),
+        sa.Column("containers", sa.Integer(), nullable=False, server_default="0"),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
+        sa.ForeignKeyConstraint(["host_id"], ["hosts.id"], ondelete="CASCADE"),
+        sa.PrimaryKeyConstraint("host_id", "image_id"),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("docker_images")
+    op.drop_table("docker_disk_usage")

plugins/docker/models.py

@@ -0,0 +1,261 @@
+# plugins/docker/models.py
+from __future__ import annotations
+import uuid
+from datetime import datetime, timezone
+from sqlalchemy import (
+    BigInteger, Boolean, DateTime, Float, ForeignKey, Index, Integer, String, Text,
+    UniqueConstraint,
+)
+from sqlalchemy.orm import Mapped, mapped_column
+from steward.models.base import Base
+
+
+class DockerContainer(Base):
+    """Latest known state per container, scoped to the host that reported it.
+
+    Collection is per-host via the host agent, so container names are only
+    unique within a host — the natural key is (host_id, name). host_id is NOT
+    NULL: every container arrives through a host_agent ingest that resolves a
+    Host first. Deleting a host cascades its containers away.
+    """
+    __tablename__ = "docker_containers"
+
+    host_id: Mapped[str] = mapped_column(
+        String(36), ForeignKey("hosts.id", ondelete="CASCADE"), primary_key=True
+    )
+    name: Mapped[str] = mapped_column(String(255), primary_key=True)
+    container_id: Mapped[str] = mapped_column(String(64), nullable=False, default="")
+    image: Mapped[str] = mapped_column(String(512), nullable=False, default="")
+    status: Mapped[str] = mapped_column(String(32), nullable=False, default="unknown")
+    # running | stopped | paused | exited | dead
+    cpu_pct: Mapped[float | None] = mapped_column(Float, nullable=True)
+    mem_usage_bytes: Mapped[int | None] = mapped_column(Integer, nullable=True)
+    mem_limit_bytes: Mapped[int | None] = mapped_column(Integer, nullable=True)
+    mem_pct: Mapped[float | None] = mapped_column(Float, nullable=True)
+    restart_count: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    ports_json: Mapped[str] = mapped_column(Text, nullable=False, default="[]")
+    # JSON: [{"host_port": 8080, "container_port": 80, "protocol": "tcp"}]
+    started_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    scraped_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+    )
+
+    # ── Enrichment (agent ≥ 1.4.0) ────────────────────────────────────────────
+    # Health/exit/restart come from `docker inspect` (not the list endpoint);
+    # exit_code is only meaningful for stopped containers.
+    health: Mapped[str | None] = mapped_column(String(16), nullable=True)  # healthy|unhealthy|starting
+    exit_code: Mapped[int | None] = mapped_column(Integer, nullable=True)
+    oom_killed: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
+    # Grouping: compose project + swarm placement, read off container labels.
+    compose_project: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    service_name: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    task_id: Mapped[str | None] = mapped_column(String(64), nullable=True)
+    node_id: Mapped[str | None] = mapped_column(String(64), nullable=True)
+    # Cumulative-since-start I/O counters (BigInteger — they exceed 2^31 quickly).
+    net_rx_bytes: Mapped[int | None] = mapped_column(BigInteger, nullable=True)
+    net_tx_bytes: Mapped[int | None] = mapped_column(BigInteger, nullable=True)
+    blk_read_bytes: Mapped[int | None] = mapped_column(BigInteger, nullable=True)
+    blk_write_bytes: Mapped[int | None] = mapped_column(BigInteger, nullable=True)
+
+
+class DockerMetric(Base):
+    """Time-series CPU/memory per container — one row per sample per running
+    container, scoped to the reporting host."""
+    __tablename__ = "docker_metrics"
+
+    id: Mapped[str] = mapped_column(
+        String(36), primary_key=True, default=lambda: str(uuid.uuid4())
+    )
+    host_id: Mapped[str] = mapped_column(
+        String(36), ForeignKey("hosts.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    container_name: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
+    scraped_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        index=True,
+    )
+    cpu_pct: Mapped[float] = mapped_column(Float, nullable=False, default=0.0)
+    mem_pct: Mapped[float] = mapped_column(Float, nullable=False, default=0.0)
+    mem_usage_bytes: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+
+    # Per-container history lookups filter on (host_id, container_name) then sort
+    # by time — a composite index keeps the rows() sparkline queries cheap.
+    __table_args__ = (
+        Index("ix_docker_metrics_host_container_time",
+              "host_id", "container_name", "scraped_at"),
+    )
+
+
+class DockerMetricHourly(Base):
+    """Hourly rollup of docker_metrics — avg cpu/mem per container per hour.
+
+    Raw per-sample rows (~2880/container/day at 30s) are pruned beyond a short
+    window; before deletion they're aggregated here so multi-day history stays
+    cheap to store and query. One row per (host, container, hour bucket); the
+    unique constraint lets retention upsert idempotently if it re-runs before the
+    raw rows are deleted. `bucket` is the hour-truncated sample time.
+    """
+    __tablename__ = "docker_metrics_hourly"
+
+    id: Mapped[str] = mapped_column(
+        String(36), primary_key=True, default=lambda: str(uuid.uuid4())
+    )
+    host_id: Mapped[str] = mapped_column(
+        String(36), ForeignKey("hosts.id", ondelete="CASCADE"), nullable=False
+    )
+    container_name: Mapped[str] = mapped_column(String(255), nullable=False)
+    bucket: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    cpu_pct: Mapped[float] = mapped_column(Float, nullable=False, default=0.0)
+    mem_pct: Mapped[float] = mapped_column(Float, nullable=False, default=0.0)
+    mem_usage_bytes: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+    sample_count: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+
+    __table_args__ = (
+        # One bucket per container per host — the conflict target for the
+        # idempotent rollup upsert; doubles as the history-query index.
+        UniqueConstraint("host_id", "container_name", "bucket",
+                         name="uq_docker_metrics_hourly_bucket"),
+        Index("ix_docker_metrics_hourly_bucket", "bucket"),
+    )
+
+
+class DockerEvent(Base):
+    """Lifecycle events derived by diffing consecutive host snapshots.
+
+    The agent only reports current state, so Steward synthesises lifecycle by
+    comparing each new snapshot against the stored DockerContainer state for the
+    host: a container that appears → `start`; one that vanishes → `stop`; a
+    transition to a stopped status with a non-zero exit → `die`; an OOM-kill
+    flip → `oom`; a health status change → `health_change`. Scoped to the
+    reporting host (names are only unique within a host). `event` is a plain
+    string (no CHECK whitelist), matching how `status` is modelled on
+    DockerContainer — keeps the value set open without a migration per addition.
+    """
+    __tablename__ = "docker_events"
+
+    id: Mapped[str] = mapped_column(
+        String(36), primary_key=True, default=lambda: str(uuid.uuid4())
+    )
+    host_id: Mapped[str] = mapped_column(
+        String(36), ForeignKey("hosts.id", ondelete="CASCADE"), nullable=False
+    )
+    container_name: Mapped[str] = mapped_column(String(255), nullable=False)
+    event: Mapped[str] = mapped_column(String(16), nullable=False)
+    # start | stop | die | oom | health_change
+    detail: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    # e.g. "exit 137", "healthy→unhealthy", image on start
+    at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+    )
+
+    # Timeline lookups filter on (host_id, container_name) and sort by time;
+    # retention prunes by `at` alone — index both access paths.
+    __table_args__ = (
+        Index("ix_docker_events_host_container_time",
+              "host_id", "container_name", "at"),
+        Index("ix_docker_events_at", "at"),
+    )
+
+
+class DockerSwarmService(Base):
+    """A Swarm service as seen by a manager host: desired vs running replicas.
+
+    Manager-scoped — only a host that is a Swarm manager reports these, so a
+    single-manager cluster yields one row set keyed by that host. Service names
+    are unique within a swarm; we still key by (host_id, service_name) so two
+    managers reporting independently don't collide.
+    """
+    __tablename__ = "docker_swarm_services"
+
+    host_id: Mapped[str] = mapped_column(
+        String(36), ForeignKey("hosts.id", ondelete="CASCADE"), primary_key=True
+    )
+    service_name: Mapped[str] = mapped_column(String(255), primary_key=True)
+    mode: Mapped[str] = mapped_column(String(16), nullable=False, default="replicated")
+    # replicated | global
+    desired: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    running: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    image: Mapped[str | None] = mapped_column(String(512), nullable=True)
+    # task→node placement of running replicas: [{"node_id", "running"}], JSON.
+    # A manager sees every task, so this captures cross-node placement that the
+    # local docker_containers rows (this host only) can't.
+    placement_json: Mapped[str] = mapped_column(Text, nullable=False, default="[]")
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+    )
+
+
+class DockerDiskUsage(Base):
+    """Per-host Docker disk usage summary from `/system/df` (current state).
+
+    One row per host (the agent re-reports the full summary each interval).
+    Reclaimable = bytes held by images no container references. Sizes are bytes
+    (BigInteger — image caches exceed 2^31 easily).
+    """
+    __tablename__ = "docker_disk_usage"
+
+    host_id: Mapped[str] = mapped_column(
+        String(36), ForeignKey("hosts.id", ondelete="CASCADE"), primary_key=True
+    )
+    layers_size: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+    images_size: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+    images_reclaimable: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+    containers_size: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+    volumes_size: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+    build_cache_size: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+    images_total: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    images_active: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    containers_count: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    volumes_count: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+    )
+
+
+class DockerImage(Base):
+    """Per-host image storage record (the heavy hitters from `/system/df`).
+
+    Keyed (host_id, image_id); `containers` is the reference count (0 ⇒ the
+    image's size is reclaimable). Replaced wholesale per host on each report.
+    """
+    __tablename__ = "docker_images"
+
+    host_id: Mapped[str] = mapped_column(
+        String(36), ForeignKey("hosts.id", ondelete="CASCADE"), primary_key=True
+    )
+    image_id: Mapped[str] = mapped_column(String(64), primary_key=True)
+    repo_tag: Mapped[str] = mapped_column(String(512), nullable=False, default="<none>")
+    size: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+    shared_size: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+    containers: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+    )
+
+
+class DockerSwarmNode(Base):
+    """A Swarm node as seen by a manager host: role / availability / status."""
+    __tablename__ = "docker_swarm_nodes"
+
+    host_id: Mapped[str] = mapped_column(
+        String(36), ForeignKey("hosts.id", ondelete="CASCADE"), primary_key=True
+    )
+    node_id: Mapped[str] = mapped_column(String(64), primary_key=True)
+    hostname: Mapped[str] = mapped_column(String(255), nullable=False, default="")
+    role: Mapped[str] = mapped_column(String(16), nullable=False, default="worker")
+    # manager | worker
+    availability: Mapped[str] = mapped_column(String(16), nullable=False, default="active")
+    # active | pause | drain
+    status: Mapped[str] = mapped_column(String(16), nullable=False, default="unknown")
+    # ready | down | unknown
+    leader: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+    )

plugins/docker/plugin.yaml

@@ -0,0 +1,16 @@
+name: docker
+version: "2.0.0"
+description: "Per-host Docker container status + resource usage, collected by the host agent"
+author: "Steward"
+license: "MIT"
+min_app_version: "0.1.0"
+repository_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins"
+homepage: "https://git.fabledsword.com/bvandeusen/Steward-plugins/src/branch/main/docker"
+tags:
+  - containers
+  - docker
+  - infrastructure
+
+# No config: collection is agent-driven (the host agent reads each host's local
+# socket and pushes containers to the host_agent ingest). This plugin is pure
+# presentation + storage, so there's no socket path or scrape interval to tune.

plugins/docker/retention.py

@@ -0,0 +1,128 @@
+# plugins/docker/retention.py
+"""Bound Docker time-series growth: roll up old metrics, prune old rows.
+
+Published as the "docker.run_retention" capability (see __init__.setup) so the
+core cleanup task can drive it WITHOUT importing the docker models (same
+opportunistic-coupling pattern as docker.persist_host_samples). Runs inside the
+caller's open transaction; never opens or commits its own.
+
+The scaling concern is docker_metrics: ~2880 rows/container/day at a 30s sample.
+We keep raw samples for a short window, then aggregate everything older into
+hourly averages (docker_metrics_hourly) and delete the raw rows — so multi-day
+history stays cheap to store and query. docker_events is light but unbounded
+without a cutoff, so it gets a (longer) window too.
+"""
+from __future__ import annotations
+
+from datetime import datetime, timedelta
+
+
+def _hour_floor(dt: datetime) -> datetime:
+    """Truncate a datetime down to the start of its hour (drops min/sec/µs)."""
+    return dt.replace(minute=0, second=0, microsecond=0)
+
+
+def _rollup_cutoff(now: datetime, raw_days: int) -> datetime:
+    """Hour-aligned boundary below which raw metrics get rolled up + deleted.
+
+    Aligning to the hour means we only ever roll up *whole* elapsed hours — a
+    bucket is never split across the keep/roll boundary, so re-running can't
+    produce a partial-then-complete duplicate for the same hour.
+    """
+    return _hour_floor(now - timedelta(days=raw_days))
+
+
+async def run_docker_retention(
+    session,
+    *,
+    events_days: int,
+    metrics_raw_days: int,
+    metrics_rollup_days: int,
+    now: datetime | None = None,
+) -> dict:
+    """Roll up + prune Docker time-series. Returns a counts dict for logging.
+
+    1. Aggregate docker_metrics older than the (hour-aligned) raw window into
+       docker_metrics_hourly (avg cpu/mem per container per hour), upserting so a
+       re-run is idempotent, then delete those raw rows.
+    2. Prune rolled-up rows older than the rollup window.
+    3. Prune docker_events older than the events window.
+    """
+    from datetime import timezone
+
+    from sqlalchemy import delete, func, select
+    from sqlalchemy.dialects.postgresql import insert as pg_insert
+
+    from .models import DockerEvent, DockerMetric, DockerMetricHourly
+
+    if now is None:
+        now = datetime.now(timezone.utc)
+
+    rolled = rolled_rows = events_pruned = rollup_pruned = 0
+
+    # ── 1. Roll up raw metrics older than the raw window into hourly buckets ──
+    raw_cutoff = _rollup_cutoff(now, metrics_raw_days)
+    hour = func.date_trunc("hour", DockerMetric.scraped_at)
+    agg = (
+        select(
+            DockerMetric.host_id,
+            DockerMetric.container_name,
+            hour.label("bucket"),
+            func.avg(DockerMetric.cpu_pct).label("cpu_pct"),
+            func.avg(DockerMetric.mem_pct).label("mem_pct"),
+            func.avg(DockerMetric.mem_usage_bytes).label("mem_usage_bytes"),
+            func.count().label("sample_count"),
+        )
+        .where(DockerMetric.scraped_at < raw_cutoff)
+        .group_by(DockerMetric.host_id, DockerMetric.container_name, hour)
+    )
+    for r in (await session.execute(agg)).all():
+        stmt = (
+            pg_insert(DockerMetricHourly)
+            .values(
+                host_id=r.host_id,
+                container_name=r.container_name,
+                bucket=r.bucket,
+                cpu_pct=float(r.cpu_pct or 0.0),
+                mem_pct=float(r.mem_pct or 0.0),
+                mem_usage_bytes=int(r.mem_usage_bytes or 0),
+                sample_count=int(r.sample_count or 0),
+            )
+            .on_conflict_do_update(
+                constraint="uq_docker_metrics_hourly_bucket",
+                set_={
+                    "cpu_pct": float(r.cpu_pct or 0.0),
+                    "mem_pct": float(r.mem_pct or 0.0),
+                    "mem_usage_bytes": int(r.mem_usage_bytes or 0),
+                    "sample_count": int(r.sample_count or 0),
+                },
+            )
+        )
+        await session.execute(stmt)
+        rolled += 1
+        rolled_rows += int(r.sample_count or 0)
+    if rolled:
+        await session.execute(
+            delete(DockerMetric).where(DockerMetric.scraped_at < raw_cutoff)
+        )
+
+    # ── 2. Prune rolled-up rows beyond the rollup window ──
+    rollup_cutoff = now - timedelta(days=metrics_rollup_days)
+    res = await session.execute(
+        delete(DockerMetricHourly).where(DockerMetricHourly.bucket < rollup_cutoff)
+    )
+    rollup_pruned = res.rowcount or 0
+
+    # ── 3. Prune lifecycle events beyond the events window ──
+    events_cutoff = now - timedelta(days=events_days)
+    res = await session.execute(
+        delete(DockerEvent).where(DockerEvent.at < events_cutoff)
+    )
+    events_pruned = res.rowcount or 0
+
+    return {
+        "buckets_rolled": rolled,
+        "raw_rows_rolled": rolled_rows,
+        "rollup_pruned": rollup_pruned,
+        "events_pruned": events_pruned,
+    }

plugins/docker/routes.py

@@ -0,0 +1,260 @@
+# plugins/docker/routes.py
+from __future__ import annotations
+import json
+from datetime import datetime, timezone
+
+from quart import Blueprint, current_app, render_template, request
+from sqlalchemy import select
+
+from steward.auth.middleware import require_role
+from steward.models.users import UserRole
+from steward.models.hosts import Host
+from steward.core.time_range import parse_range, DEFAULT_RANGE
+from .models import DockerContainer, DockerMetric
+
+docker_bp = Blueprint("docker", __name__, template_folder="templates")
+
+
+def _human_uptime(started_at: datetime | None) -> str | None:
+    """Compact 'how long running' string (e.g. '3d 4h', '5h 12m', '8m')."""
+    if started_at is None:
+        return None
+    if started_at.tzinfo is None:
+        started_at = started_at.replace(tzinfo=timezone.utc)
+    secs = int((datetime.now(timezone.utc) - started_at).total_seconds())
+    if secs < 0:
+        return None
+    d, rem = divmod(secs, 86400)
+    h, rem = divmod(rem, 3600)
+    m, _ = divmod(rem, 60)
+    if d:
+        return f"{d}d {h}h"
+    if h:
+        return f"{h}h {m}m"
+    return f"{m}m"
+
+
+def _sparkline(values: list[float], width: int = 80, height: int = 20) -> str:
+    if len(values) < 2:
+        return f'<svg width="{width}" height="{height}"></svg>'
+    mn, mx = min(values), max(values)
+    if mx == mn:
+        mx = mn + 1.0
+    step = width / (len(values) - 1)
+    pts = []
+    for i, v in enumerate(values):
+        x = i * step
+        y = height - (v - mn) / (mx - mn) * (height - 2) - 1
+        pts.append(f"{x:.1f},{y:.1f}")
+    poly = " ".join(pts)
+    return (
+        f'<svg width="{width}" height="{height}" viewBox="0 0 {width} {height}" '
+        f'style="vertical-align:middle;">'
+        f'<polyline points="{poly}" fill="none" stroke="#6060c0" stroke-width="1.5"/>'
+        f'</svg>'
+    )
+
+
+def _bucket(values: list[float], target: int = 40) -> list[float]:
+    """Bucket-average a series down to ~target points (DB-agnostic, in Python).
+
+    Replaces the old SQL strftime() bucketing, which was SQLite-only and broke
+    on Postgres. Agent cadence is dense, so a multi-hour window is hundreds of
+    rows — averaging into a readable point count keeps the sparkline's shape.
+    """
+    n = len(values)
+    if n <= target:
+        return values
+    size = (n + target - 1) // target
+    out: list[float] = []
+    for i in range(0, n, size):
+        chunk = values[i:i + size]
+        out.append(sum(chunk) / len(chunk))
+    return out
+
+
+async def _container_history(db, host_id: str, name: str, since) -> tuple[list, list]:
+    """Return (cpu_series, mem_series) sparkline-ready for one host's container."""
+    rows = (await db.execute(
+        select(DockerMetric.cpu_pct, DockerMetric.mem_pct)
+        .where(DockerMetric.host_id == host_id)
+        .where(DockerMetric.container_name == name)
+        .where(DockerMetric.scraped_at >= since)
+        .order_by(DockerMetric.scraped_at)
+    )).all()
+    cpu = _bucket([r.cpu_pct or 0.0 for r in rows])
+    mem = _bucket([r.mem_pct or 0.0 for r in rows])
+    return cpu, mem
+
+
+@docker_bp.get("/")
+@require_role(UserRole.viewer)
+async def index():
+    poll_interval = current_app.config.get("MONITORS_POLL_INTERVAL", 60)
+    current_range = request.args.get("range", DEFAULT_RANGE)
+    return await render_template(
+        "docker/index.html",
+        poll_interval=poll_interval,
+        current_range=current_range,
+    )
+
+
+async def _host_map(db, host_ids: set[str]) -> dict[str, Host]:
+    if not host_ids:
+        return {}
+    return {
+        h.id: h for h in (await db.execute(
+            select(Host).where(Host.id.in_(host_ids)))).scalars().all()
+    }
+
+
+@docker_bp.get("/rows")
+@require_role(UserRole.viewer)
+async def rows():
+    """HTMX fragment: containers grouped by host, with resource sparklines."""
+    since, range_key = parse_range(request.args.get("range"))
+
+    async with current_app.db_sessionmaker() as db:
+        containers = list((await db.execute(
+            select(DockerContainer).order_by(
+                (DockerContainer.status == "running").desc(),
+                DockerContainer.name,
+            )
+        )).scalars())
+        hosts = await _host_map(db, {c.host_id for c in containers})
+
+        # Group by host so each container is clearly attributed to the box it
+        # runs on (names are only unique within a host now).
+        groups: dict[str, dict] = {}
+        for c in containers:
+            g = groups.get(c.host_id)
+            if g is None:
+                host = hosts.get(c.host_id)
+                g = groups[c.host_id] = {
+                    "host": host,
+                    "host_id": c.host_id,
+                    "host_name": host.name if host else c.host_id,
+                    "containers": [], "running": 0, "stopped": 0,
+                }
+            cpu_hist, mem_hist = await _container_history(db, c.host_id, c.name, since)
+            g["containers"].append({
+                "container": c,
+                "ports": json.loads(c.ports_json) if c.ports_json else [],
+                "uptime": _human_uptime(c.started_at) if c.status == "running" else None,
+                "sparkline_cpu": _sparkline(cpu_hist),
+                "sparkline_mem": _sparkline(mem_hist),
+            })
+            if c.status == "running":
+                g["running"] += 1
+            else:
+                g["stopped"] += 1
+
+    host_groups = sorted(groups.values(), key=lambda g: g["host_name"].lower())
+    running = sum(g["running"] for g in host_groups)
+    total = len(containers)
+    return await render_template(
+        "docker/rows.html",
+        host_groups=host_groups,
+        running=running,
+        stopped=total - running,
+        total=total,
+        range_key=range_key,
+    )
+
+
+@docker_bp.get("/widget")
+@require_role(UserRole.viewer)
+async def widget():
+    """HTMX dashboard widget: container status overview, grouped by host."""
+    show_stopped = request.args.get("show_stopped", "no") == "yes"
+    widget_id = request.args.get("wid", "0")
+
+    async with current_app.db_sessionmaker() as db:
+        all_containers = list((await db.execute(
+            select(DockerContainer).order_by(
+                (DockerContainer.status == "running").desc(),
+                DockerContainer.name,
+            )
+        )).scalars())
+        hosts = await _host_map(db, {c.host_id for c in all_containers})
+
+    running = [c for c in all_containers if c.status == "running"]
+    stopped = [c for c in all_containers if c.status != "running"]
+    display = all_containers if show_stopped else running
+
+    # Group for display so multi-host fleets read clearly; single-host stays flat.
+    groups: dict[str, dict] = {}
+    for c in display:
+        g = groups.setdefault(c.host_id, {
+            "host_id": c.host_id,
+            "host_name": hosts[c.host_id].name if c.host_id in hosts else c.host_id,
+            "containers": [],
+        })
+        g["containers"].append(c)
+    host_groups = sorted(groups.values(), key=lambda g: g["host_name"].lower())
+
+    return await render_template(
+        "docker/widget.html",
+        host_groups=host_groups,
+        multi_host=len(host_groups) > 1,
+        running_count=len(running),
+        stopped_count=len(stopped),
+        show_stopped=show_stopped,
+        widget_id=widget_id,
+    )
+
+
+@docker_bp.get("/widget/resources")
+@require_role(UserRole.viewer)
+async def widget_resources():
+    """HTMX dashboard widget: CPU + memory usage for the busiest containers."""
+    limit = max(1, min(20, int(request.args.get("limit", 10) or 10)))
+    widget_id = request.args.get("wid", "0")
+
+    async with current_app.db_sessionmaker() as db:
+        containers = list((await db.execute(
+            select(DockerContainer)
+            .where(DockerContainer.status == "running")
+            .order_by(DockerContainer.cpu_pct.desc().nullslast())
+        )).scalars())[:limit]
+        hosts = await _host_map(db, {c.host_id for c in containers})
+
+    rows_data = [
+        {"c": c, "host_name": hosts[c.host_id].name if c.host_id in hosts else c.host_id}
+        for c in containers
+    ]
+    return await render_template(
+        "docker/widget_resources.html",
+        rows=rows_data,
+        multi_host=len({c.host_id for c in containers}) > 1,
+        widget_id=widget_id,
+    )
+
+
+@docker_bp.get("/host/<host_id>")
+@require_role(UserRole.viewer)
+async def host_panel(host_id: str):
+    """Per-host Docker fragment embedded on the core Hosts hub via HTMX.
+
+    Renders nothing when the host reports no containers, so hosts without Docker
+    don't carry an empty card.
+    """
+    async with current_app.db_sessionmaker() as db:
+        containers = list((await db.execute(
+            select(DockerContainer)
+            .where(DockerContainer.host_id == host_id)
+            .order_by(
+                (DockerContainer.status == "running").desc(),
+                DockerContainer.name,
+            )
+        )).scalars())
+
+    if not containers:
+        return ""
+    running = sum(1 for c in containers if c.status == "running")
+    return await render_template(
+        "docker/host_panel.html",
+        containers=containers,
+        running=running,
+        stopped=len(containers) - running,
+    )

plugins/docker/templates/docker/host_panel.html

@@ -0,0 +1,22 @@
+{# docker/host_panel.html — per-host Docker fragment embedded on the Hosts hub #}
+<div class="card">
+  <div style="display:flex;align-items:baseline;justify-content:space-between;gap:0.6rem;margin-bottom:0.6rem;">
+    <h3 class="section-title" style="margin-bottom:0;">Docker</h3>
+    <span style="font-size:0.78rem;color:var(--text-muted);">
+      {{ running }} running{% if stopped %} · {{ stopped }} stopped{% endif %}
+      <a href="/plugins/docker/" style="margin-left:0.6rem;color:var(--text-muted);">All →</a>
+    </span>
+  </div>
+  <div style="display:grid;gap:2px;">
+    {% for c in containers %}
+    <div style="display:flex;align-items:center;gap:0.5rem;font-size:0.85rem;padding:0.2rem 0;">
+      <span class="dot {% if c.status == 'running' %}dot-up{% elif c.status == 'paused' %}dot-warn{% else %}dot-down{% endif %}"></span>
+      <span style="flex:1;min-width:0;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;" title="{{ c.image }}">{{ c.name }}</span>
+      <span style="font-size:0.74rem;color:var(--text-muted);font-family:ui-monospace,monospace;flex-shrink:0;">
+        {% if c.cpu_pct is not none %}{{ "%.1f" | format(c.cpu_pct) }}%{% endif %}
+        {% if c.mem_pct is not none %} · {{ "%.1f" | format(c.mem_pct) }}%{% endif %}
+      </span>
+    </div>
+    {% endfor %}
+  </div>
+</div>

plugins/docker/templates/docker/index.html

@@ -0,0 +1,16 @@
+{% extends "base.html" %}
+{% block title %}Docker — Steward{% endblock %}
+{% block content %}
+<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:1.5rem;gap:1rem;flex-wrap:wrap;">
+  <h1 class="page-title" style="margin-bottom:0;">Docker</h1>
+  {% include "_time_range.html" %}
+</div>
+
+<div id="docker-rows"
+     hx-get="/plugins/docker/rows"
+     hx-trigger="load, rangeChange from:body"
+     hx-include="#time-range"
+     hx-swap="innerHTML">
+  <div style="color:var(--text-muted);font-size:0.9rem;padding:2rem;">Loading...</div>
+</div>
+{% endblock %}

plugins/docker/templates/docker/rows.html

@@ -0,0 +1,120 @@
+{# docker/rows.html — HTMX fragment for the Docker main page, grouped by host #}
+
+{# ── Summary strip ─────────────────────────────────────────────────────────── #}
+<div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(140px,1fr));gap:0.75rem;margin-bottom:1.5rem;">
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.35rem;">Running</div>
+    <span class="stat-val" style="color:var(--green);">{{ running }}</span>
+  </div>
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.35rem;">Stopped</div>
+    <span class="stat-val" style="{% if stopped %}color:var(--text-muted){% endif %};">{{ stopped }}</span>
+  </div>
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.35rem;">Total</div>
+    <span class="stat-val">{{ total }}</span>
+  </div>
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.35rem;">Hosts</div>
+    <span class="stat-val">{{ host_groups | length }}</span>
+  </div>
+</div>
+
+{# ── Container tables, one per host ───────────────────────────────────────── #}
+{% if host_groups %}
+{% for g in host_groups %}
+<div class="card-flush" style="margin-bottom:1.5rem;">
+  <div style="display:flex;align-items:baseline;gap:0.6rem;padding:0.5rem 0.75rem;border-bottom:1px solid var(--border);">
+    {% if g.host %}
+    <a href="/hosts/{{ g.host.id }}" style="font-weight:600;font-size:0.95rem;color:inherit;text-decoration:none;">{{ g.host.name }}</a>
+    {% else %}
+    <span style="font-weight:600;font-size:0.95rem;">{{ g.host_name }}</span>
+    {% endif %}
+    <span style="font-size:0.78rem;color:var(--text-muted);">
+      {{ g.running }} running{% if g.stopped %} · {{ g.stopped }} stopped{% endif %}
+    </span>
+  </div>
+  <table class="table">
+    <thead>
+      <tr>
+        <th>Container</th>
+        <th>Image</th>
+        <th>Ports</th>
+        <th>CPU %</th>
+        <th style="min-width:100px;">CPU history</th>
+        <th>Mem %</th>
+        <th style="min-width:100px;">Mem history</th>
+      </tr>
+    </thead>
+    <tbody>
+      {% for item in g.containers %}
+      {% set c = item.container %}
+      <tr>
+        <td>
+          <div style="display:flex;align-items:center;gap:0.5rem;">
+            <span class="dot {% if c.status == 'running' %}dot-up{% elif c.status == 'paused' %}dot-warn{% else %}dot-down{% endif %}"></span>
+            <div>
+              <div style="font-weight:500;font-size:0.9rem;">
+                {{ c.name }}
+                {% if c.health == 'healthy' %}<span title="healthy" style="color:var(--green);font-size:0.7rem;">●</span>
+                {% elif c.health == 'unhealthy' %}<span title="unhealthy" style="color:var(--red);font-size:0.7rem;">●</span>
+                {% elif c.health == 'starting' %}<span title="health: starting" style="color:var(--orange);font-size:0.7rem;">◐</span>{% endif %}
+              </div>
+              <div style="font-size:0.73rem;color:var(--text-muted);">
+                {{ c.status }}{% if item.uptime %} · up {{ item.uptime }}{% endif %}
+                {% if c.status != 'running' and c.exit_code is not none and c.exit_code != 0 %}
+                  · <span style="color:var(--red);">exit {{ c.exit_code }}{% if c.oom_killed %} (OOM){% endif %}</span>
+                {% endif %}
+                {% if c.restart_count %} · <span title="restart count" style="color:var(--orange);">⟳{{ c.restart_count }}</span>{% endif %}
+              </div>
+              {% if c.service_name or c.compose_project %}
+              <div style="font-size:0.68rem;color:var(--text-dim);margin-top:0.1rem;">
+                {{ c.service_name or c.compose_project }}
+              </div>
+              {% endif %}
+            </div>
+          </div>
+        </td>
+        <td style="font-size:0.82rem;color:var(--text-muted);max-width:200px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;">
+          {{ c.image }}
+        </td>
+        <td style="font-size:0.78rem;font-family:ui-monospace,monospace;">
+          {% for p in item.ports %}
+          <div style="color:var(--text-muted);">{{ p.host_port }}:{{ p.container_port }}/{{ p.protocol }}</div>
+          {% endfor %}
+        </td>
+        <td style="font-family:ui-monospace,monospace;font-size:0.88rem;">
+          {% if c.cpu_pct is not none %}
+          <span style="color:{% if c.cpu_pct > 80 %}var(--red){% elif c.cpu_pct > 50 %}var(--orange){% else %}var(--text){% endif %};">
+            {{ "%.1f" | format(c.cpu_pct) }}%
+          </span>
+          {% else %}
+          <span style="color:var(--text-dim);">—</span>
+          {% endif %}
+        </td>
+        <td>{{ item.sparkline_cpu | safe }}</td>
+        <td style="font-family:ui-monospace,monospace;font-size:0.88rem;">
+          {% if c.mem_pct is not none %}
+          <span style="color:{% if c.mem_pct > 90 %}var(--red){% elif c.mem_pct > 70 %}var(--orange){% else %}var(--text){% endif %};">
+            {{ "%.1f" | format(c.mem_pct) }}%
+          </span>
+          {% else %}
+          <span style="color:var(--text-dim);">—</span>
+          {% endif %}
+        </td>
+        <td>{{ item.sparkline_mem | safe }}</td>
+      </tr>
+      {% endfor %}
+    </tbody>
+  </table>
+</div>
+{% endfor %}
+{% else %}
+<div class="card" style="text-align:center;padding:3rem;">
+  <div style="color:var(--text-muted);font-size:0.9rem;">
+    No containers reported yet. Containers are collected by the Steward host agent —
+    deploy the agent to a host running Docker (Hosts → the host → agent panel) and
+    its containers will appear here under that host.
+  </div>
+</div>
+{% endif %}

plugins/docker/templates/docker/widget.html

@@ -0,0 +1,40 @@
+{# docker/widget.html — dashboard widget: container status overview, by host #}
+{% if running_count == 0 and stopped_count == 0 %}
+<p class="empty" style="padding:0.5rem 0;font-size:0.85rem;">No containers reported yet.</p>
+{% else %}
+
+<div style="display:flex;gap:1rem;margin-bottom:0.65rem;">
+  <div>
+    <span style="font-size:1.4rem;font-weight:700;line-height:1;color:var(--green);">{{ running_count }}</span>
+    <span style="font-size:0.78rem;color:var(--text-muted);margin-left:0.25rem;">running</span>
+  </div>
+  {% if stopped_count %}
+  <div>
+    <span style="font-size:1.4rem;font-weight:700;line-height:1;color:var(--text-muted);">{{ stopped_count }}</span>
+    <span style="font-size:0.78rem;color:var(--text-muted);margin-left:0.25rem;">stopped</span>
+  </div>
+  {% endif %}
+</div>
+
+{% for g in host_groups %}
+{% if multi_host %}
+<div style="font-size:0.72rem;color:var(--text-dim);text-transform:uppercase;letter-spacing:0.05em;margin:0.5rem 0 0.2rem;">{{ g.host_name }}</div>
+{% endif %}
+<div style="display:grid;gap:2px;">
+  {% for c in g.containers %}
+  <div style="display:flex;align-items:center;gap:0.5rem;font-size:0.82rem;padding:0.15rem 0;">
+    <span class="dot {% if c.status == 'running' %}dot-up{% elif c.status == 'paused' %}dot-warn{% else %}dot-down{% endif %}"></span>
+    <span style="flex:1;min-width:0;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;">
+      {{ c.name }}
+    </span>
+    {% if c.cpu_pct is not none %}
+    <span style="font-size:0.72rem;color:var(--text-muted);font-family:ui-monospace,monospace;flex-shrink:0;">
+      {{ "%.1f" | format(c.cpu_pct) }}%
+    </span>
+    {% endif %}
+  </div>
+  {% endfor %}
+</div>
+{% endfor %}
+
+{% endif %}

plugins/docker/templates/docker/widget_resources.html

@@ -0,0 +1,37 @@
+{# docker/widget_resources.html — dashboard widget: CPU + memory bars, busiest containers #}
+{% if not rows %}
+<div style="color:var(--text-muted);font-size:0.85rem;padding:0.5rem 0;">No running containers.</div>
+{% else %}
+<div style="display:grid;gap:0.5rem;">
+  {% for r in rows %}
+  {% set c = r.c %}
+  <div>
+    <div style="display:flex;justify-content:space-between;align-items:baseline;margin-bottom:0.15rem;">
+      <span style="font-size:0.8rem;font-weight:500;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;max-width:55%;">
+        {{ c.name }}{% if multi_host %}<span style="color:var(--text-dim);font-weight:normal;"> · {{ r.host_name }}</span>{% endif %}
+      </span>
+      <span style="font-size:0.72rem;color:var(--text-muted);font-family:ui-monospace,monospace;flex-shrink:0;margin-left:0.5rem;">
+        {% if c.cpu_pct is not none %}CPU {{ "%.1f" | format(c.cpu_pct) }}%{% endif %}
+        {% if c.mem_pct is not none %} · Mem {{ "%.1f" | format(c.mem_pct) }}%{% endif %}
+      </span>
+    </div>
+    {% if c.cpu_pct is not none %}
+    <div style="height:3px;background:var(--bg-elevated);border-radius:2px;margin-bottom:2px;">
+      <div style="height:100%;border-radius:2px;width:{{ [c.cpu_pct, 100] | min }}%;
+                  background:{% if c.cpu_pct > 80 %}var(--red){% elif c.cpu_pct > 50 %}var(--orange){% else %}var(--accent){% endif %};
+                  transition:width 0.4s;">
+      </div>
+    </div>
+    {% endif %}
+    {% if c.mem_pct is not none %}
+    <div style="height:3px;background:var(--bg-elevated);border-radius:2px;">
+      <div style="height:100%;border-radius:2px;width:{{ [c.mem_pct, 100] | min }}%;
+                  background:{% if c.mem_pct > 90 %}var(--red){% elif c.mem_pct > 70 %}var(--orange){% else %}var(--green){% endif %};
+                  transition:width 0.4s;">
+      </div>
+    </div>
+    {% endif %}
+  </div>
+  {% endfor %}
+</div>
+{% endif %}

plugins/host_agent/__init__.py

@@ -0,0 +1,23 @@
+# plugins/host_agent/__init__.py
+from __future__ import annotations
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from quart import Quart
+
+_app: "Quart | None" = None
+
+
+def setup(app: "Quart") -> None:
+    global _app
+    _app = app
+
+
+def get_scheduled_tasks() -> list:
+    from .scheduler import make_task
+    return [make_task(_app)]
+
+
+def get_blueprint():
+    from .routes import host_agent_bp
+    return host_agent_bp

plugins/host_agent/migrations/env.py

@@ -0,0 +1,70 @@
+# plugins/host_agent/migrations/env.py
+"""Alembic env.py for the host_agent plugin."""
+import asyncio
+import os
+import sys
+from pathlib import Path
+from logging.config import fileConfig
+
+from sqlalchemy import pool
+from sqlalchemy.engine import Connection
+from sqlalchemy.ext.asyncio import async_engine_from_config
+from alembic import context
+
+sys.path.insert(0, str(Path(__file__).parent.parent.parent.parent))
+
+from steward.models.base import Base
+import steward.models  # noqa: F401
+from plugins.host_agent.models import HostAgentRegistration  # noqa: F401
+
+config = context.config
+if config.config_file_name is not None:
+    fileConfig(config.config_file_name)
+
+target_metadata = Base.metadata
+
+
+def _get_url() -> str:
+    import yaml
+    cfg_path = os.environ.get("STEWARD_CONFIG", "config.yaml")
+    try:
+        with open(cfg_path) as f:
+            cfg = yaml.safe_load(f) or {}
+        url = cfg.get("database", {}).get("url", "")
+    except FileNotFoundError:
+        url = ""
+    return os.environ.get("STEWARD_DATABASE__URL", url)
+
+
+def run_migrations_offline() -> None:
+    context.configure(
+        url=_get_url(), target_metadata=target_metadata,
+        literal_binds=True, dialect_opts={"paramstyle": "named"},
+    )
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+def do_run_migrations(connection: Connection) -> None:
+    context.configure(connection=connection, target_metadata=target_metadata)
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+async def run_async_migrations() -> None:
+    cfg = config.get_section(config.config_ini_section, {})
+    cfg["sqlalchemy.url"] = _get_url()
+    connectable = async_engine_from_config(cfg, prefix="sqlalchemy.", poolclass=pool.NullPool)
+    async with connectable.connect() as connection:
+        await connection.run_sync(do_run_migrations)
+    await connectable.dispose()
+
+
+def run_migrations_online() -> None:
+    asyncio.run(run_async_migrations())
+
+
+if context.is_offline_mode():
+    run_migrations_offline()
+else:
+    run_migrations_online()

plugins/host_agent/migrations/versions/host_agent_001_initial.py

@@ -0,0 +1,36 @@
+# plugins/host_agent/migrations/versions/host_agent_001_initial.py
+"""host_agent plugin initial tables
+
+Revision ID: host_agent_001_initial
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "host_agent_001_initial"
+down_revision: Union[str, None] = None
+branch_labels: Union[str, Sequence[str], None] = "host_agent"
+depends_on: Union[str, Sequence[str], None] = ("0004_app_settings",)
+
+
+def upgrade() -> None:
+    op.create_table(
+        "host_agent_registrations",
+        sa.Column("id", sa.String(36), primary_key=True),
+        sa.Column("host_id", sa.String(36),
+                  sa.ForeignKey("hosts.id", ondelete="CASCADE"),
+                  nullable=False, unique=True),
+        sa.Column("token_hash", sa.String(64), nullable=False, unique=True, index=True),
+        sa.Column("token_created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("agent_version", sa.String(32), nullable=True),
+        sa.Column("kernel", sa.String(128), nullable=True),
+        sa.Column("distro", sa.String(128), nullable=True),
+        sa.Column("arch", sa.String(32), nullable=True),
+        sa.Column("last_seen_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("host_agent_registrations")

plugins/host_agent/migrations/versions/host_agent_002_host_ip.py

@@ -0,0 +1,24 @@
+# plugins/host_agent/migrations/versions/host_agent_002_host_ip.py
+"""host_agent: add agent-reported host_ip column
+
+Revision ID: host_agent_002_host_ip
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "host_agent_002_host_ip"
+down_revision: Union[str, None] = "host_agent_001_initial"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "host_agent_registrations",
+        sa.Column("host_ip", sa.String(45), nullable=True),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("host_agent_registrations", "host_ip")

plugins/host_agent/models.py

@@ -0,0 +1,34 @@
+# plugins/host_agent/models.py
+from __future__ import annotations
+import uuid
+from datetime import datetime, timezone
+from sqlalchemy import Column, String, DateTime, ForeignKey
+from steward.models.base import Base
+
+
+def _uuid() -> str:
+    return str(uuid.uuid4())
+
+
+def _utcnow() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+class HostAgentRegistration(Base):
+    __tablename__ = "host_agent_registrations"
+
+    id = Column(String(36), primary_key=True, default=_uuid)
+    host_id = Column(String(36), ForeignKey("hosts.id", ondelete="CASCADE"),
+                     unique=True, nullable=False)
+    token_hash = Column(String(64), nullable=False, unique=True, index=True)
+    token_created_at = Column(DateTime(timezone=True), nullable=False, default=_utcnow)
+    agent_version = Column(String(32), nullable=True)
+    kernel = Column(String(128), nullable=True)
+    distro = Column(String(128), nullable=True)
+    arch = Column(String(32), nullable=True)
+    # Agent-reported primary IP. 45 chars = max textual IPv6 (no zone suffix).
+    host_ip = Column(String(45), nullable=True)
+    last_seen_at = Column(DateTime(timezone=True), nullable=True)
+    created_at = Column(DateTime(timezone=True), nullable=False, default=_utcnow)
+    updated_at = Column(DateTime(timezone=True), nullable=False,
+                        default=_utcnow, onupdate=_utcnow)

plugins/host_agent/plugin.yaml

@@ -0,0 +1,19 @@
+# plugins/host_agent/plugin.yaml
+name: host_agent
+version: "1.2.0"
+description: "Remote Linux host resource monitoring via a lightweight Python push agent (CPU incl. per-core, memory + PSI, storage, disk I/O, network throughput, load, temperatures, uptime)"
+author: "Steward"
+license: "MIT"
+min_app_version: "0.1.0"
+repository_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins"
+homepage: "https://git.fabledsword.com/bvandeusen/Steward-plugins/src/branch/main/host_agent"
+tags:
+  - host
+  - monitoring
+  - cpu
+  - memory
+  - storage
+
+config:
+  stale_after_seconds: 180
+  default_interval_seconds: 30

plugins/host_agent/scheduler.py

@@ -0,0 +1,78 @@
+# plugins/host_agent/scheduler.py
+from __future__ import annotations
+import logging
+from datetime import datetime, timedelta, timezone
+from typing import Iterable
+
+from sqlalchemy import select
+
+from steward.core.scheduler import ScheduledTask
+from steward.models.hosts import Host
+from .models import HostAgentRegistration
+
+logger = logging.getLogger(__name__)
+
+
+def _filter_stale(
+    regs: Iterable,
+    *,
+    now: datetime,
+    stale_after_seconds: int,
+) -> list:
+    """Pure staleness filter: returns the subset with last_seen_at strictly
+    older than (now - stale_after_seconds). Rows with last_seen_at=None are
+    never stale (they are unregistered-in-practice)."""
+    cutoff = now - timedelta(seconds=stale_after_seconds)
+    return [
+        r for r in regs
+        if r.last_seen_at is not None and r.last_seen_at < cutoff
+    ]
+
+
+async def find_stale_registrations(app, stale_after_seconds: int = 180) -> list[dict]:
+    async with app.db_sessionmaker() as session:
+        all_regs = (await session.execute(
+            select(HostAgentRegistration)
+        )).scalars().all()
+        stale_rows = _filter_stale(
+            all_regs,
+            now=datetime.now(timezone.utc),
+            stale_after_seconds=stale_after_seconds,
+        )
+        if not stale_rows:
+            return []
+        hosts = {
+            h.id: h for h in (await session.execute(
+                select(Host).where(Host.id.in_([r.host_id for r in stale_rows]))
+            )).scalars().all()
+        }
+    return [
+        {
+            "host_id": r.host_id,
+            "host_name": hosts[r.host_id].name if r.host_id in hosts else "?",
+            "last_seen_at": r.last_seen_at,
+        }
+        for r in stale_rows
+    ]
+
+
+def make_task(app) -> ScheduledTask:
+    async def _check_stale():
+        try:
+            stale = await find_stale_registrations(app)
+        except Exception:
+            logger.exception("host_agent stale check failed")
+            return
+        if stale:
+            logger.info(
+                "host_agent: %d stale agent(s): %s",
+                len(stale),
+                [s["host_name"] for s in stale],
+            )
+
+    return ScheduledTask(
+        name="host_agent_stale_check",
+        coro_factory=_check_stale,
+        interval_seconds=60,
+        run_on_startup=False,
+    )

plugins/host_agent/templates/host_detail.html

@@ -0,0 +1,256 @@
+{% extends "base.html" %}
+{% from "_macros.html" import crumbs %}
+{% block title %}{{ host.name }} — Host Agent — Steward{% endblock %}
+{% block breadcrumb %}{{ crumbs([("Hosts", "/hosts/"), (host.name, "/hosts/" ~ host.id), ("Metrics", "")]) }}{% endblock %}
+
+{% macro fmt_bps(v) %}
+{%- if v is none -%}—
+{%- elif v >= 1048576 -%}{{ "%.1f"|format(v / 1048576) }} MB/s
+{%- elif v >= 1024 -%}{{ "%.1f"|format(v / 1024) }} KB/s
+{%- else -%}{{ "%.0f"|format(v) }} B/s
+{%- endif -%}
+{% endmacro %}
+{% macro fmt_bytes(v) %}
+{%- if v is none -%}—
+{%- elif v >= 1073741824 -%}{{ "%.1f"|format(v / 1073741824) }} GB
+{%- elif v >= 1048576 -%}{{ "%.0f"|format(v / 1048576) }} MB
+{%- else -%}{{ "%.0f"|format(v / 1024) }} KB
+{%- endif -%}
+{% endmacro %}
+{% macro bar(pct) %}
+{%- set p = pct if pct is not none else 0 -%}
+<div style="height:8px;background:var(--bg-elevated);border-radius:4px;overflow:hidden;border:1px solid var(--border);">
+  <div style="height:100%;width:{{ p|round(1) }}%;background:{% if pct is none %}var(--text-dim){% elif pct < 70 %}var(--green){% elif pct < 90 %}var(--yellow){% else %}var(--red){% endif %};"></div>
+</div>
+{% endmacro %}
+
+{% block content %}
+<div style="display:flex;align-items:center;justify-content:space-between;gap:1rem;flex-wrap:wrap;margin-bottom:0.75rem;">
+  <div style="display:flex;align-items:center;gap:0.6rem;">
+    <a href="/hosts/{{ host.id }}" class="btn btn-ghost btn-sm">← Host</a>
+    <h1 class="page-title" style="margin-bottom:0;">{{ host.name }}</h1>
+    {% if stale %}<span class="badge badge-red">stale</span>{% else %}<span class="badge badge-green">live</span>{% endif %}
+  </div>
+  <div style="display:flex;gap:0.3rem;">
+    {% for r in range_options %}
+    <a class="range-btn {% if r == range_key %}active{% endif %}" href="?range={{ r }}">{{ r }}</a>
+    {% endfor %}
+  </div>
+</div>
+
+{# ── Identity / metadata ─────────────────────────────────────────────────── #}
+<div class="card" style="display:flex;flex-wrap:wrap;gap:0.5rem 1.25rem;align-items:center;font-size:0.82rem;color:var(--text-muted);">
+  <span><span style="color:var(--text-dim);">Address</span> {{ host.address or "—" }}</span>
+  {% if reg %}
+  {% if reg.distro %}<span><span style="color:var(--text-dim);">OS</span> {{ reg.distro }}</span>{% endif %}
+  {% if reg.kernel %}<span><span style="color:var(--text-dim);">Kernel</span> {{ reg.kernel }}</span>{% endif %}
+  {% if reg.arch %}<span><span style="color:var(--text-dim);">Arch</span> {{ reg.arch }}</span>{% endif %}
+  {% if reg.agent_version %}<span><span style="color:var(--text-dim);">Agent</span> v{{ reg.agent_version }}</span>{% endif %}
+  {% set up = hostlvl.get('uptime_secs') %}
+  {% if up %}<span><span style="color:var(--text-dim);">Uptime</span> {{ (up // 86400)|int }}d {{ ((up % 86400) // 3600)|int }}h</span>{% endif %}
+  <span><span style="color:var(--text-dim);">Last seen</span> {{ reg.last_seen_at.strftime("%Y-%m-%d %H:%M:%S") ~ " UTC" if reg.last_seen_at else "never" }}</span>
+  {% else %}
+  <span>No agent registration found for this host.</span>
+  {% endif %}
+</div>
+
+{% if not hostlvl %}
+<div class="card empty">No metrics reported yet. Once the agent checks in, CPU, memory, network, disk I/O, temperatures, and pressure will appear here.</div>
+{% else %}
+
+{# ── Current headline gauges ─────────────────────────────────────────────── #}
+<div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(150px,1fr));gap:0.75rem;margin-bottom:1rem;">
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.35rem;">CPU</div>
+    {% set c = hostlvl.get('cpu_pct') %}
+    <span class="stat-val" style="font-size:1.6rem;color:{% if c is none %}var(--text-dim){% elif c < 70 %}var(--green){% elif c < 90 %}var(--yellow){% else %}var(--red){% endif %};">{% if c is not none %}{{ "%.0f"|format(c) }}%{% else %}—{% endif %}</span>
+    <div style="margin-top:0.5rem;">{{ bar(c) }}</div>
+  </div>
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.35rem;">Memory</div>
+    {% set mp = hostlvl.get('mem_used_pct') %}
+    <span class="stat-val" style="font-size:1.6rem;color:{% if mp is none %}var(--text-dim){% elif mp < 70 %}var(--green){% elif mp < 90 %}var(--yellow){% else %}var(--red){% endif %};">{% if mp is not none %}{{ "%.0f"|format(mp) }}%{% else %}—{% endif %}</span>
+    <div style="margin-top:0.5rem;">{{ bar(mp) }}</div>
+    <div style="margin-top:0.45rem;font-size:0.72rem;color:var(--text-dim);">
+      avail {{ fmt_bytes(hostlvl.get('mem_available_bytes')) }} · cache {{ fmt_bytes(hostlvl.get('mem_cached_bytes')) }} · swap {{ fmt_bytes(hostlvl.get('swap_used_bytes')) }}
+    </div>
+  </div>
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.35rem;">Load</div>
+    <span class="stat-val" style="font-size:1.6rem;">{% if hostlvl.get('load_1m') is not none %}{{ "%.2f"|format(hostlvl.get('load_1m')) }}{% else %}—{% endif %}</span>
+    <div style="margin-top:0.45rem;font-size:0.72rem;color:var(--text-dim);">
+      5m {% if hostlvl.get('load_5m') is not none %}{{ "%.2f"|format(hostlvl.get('load_5m')) }}{% else %}—{% endif %} ·
+      15m {% if hostlvl.get('load_15m') is not none %}{{ "%.2f"|format(hostlvl.get('load_15m')) }}{% else %}—{% endif %}
+    </div>
+  </div>
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.35rem;">Network</div>
+    <div style="font-size:0.95rem;font-variant-numeric:tabular-nums;">
+      <div><span style="color:var(--green);">↓</span> {{ fmt_bps(hostlvl.get('net_rx_bps')) }}</div>
+      <div><span style="color:var(--red);">↑</span> {{ fmt_bps(hostlvl.get('net_tx_bps')) }}</div>
+    </div>
+  </div>
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.35rem;">Disk I/O</div>
+    <div style="font-size:0.95rem;font-variant-numeric:tabular-nums;">
+      <div><span style="color:var(--text-dim);">rd</span> {{ fmt_bps(hostlvl.get('disk_read_bps')) }}</div>
+      <div><span style="color:var(--text-dim);">wr</span> {{ fmt_bps(hostlvl.get('disk_write_bps')) }}</div>
+    </div>
+  </div>
+  {% if hostlvl.get('temp_c_max') is not none %}
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.35rem;">Temp (max)</div>
+    {% set t = hostlvl.get('temp_c_max') %}
+    <span class="stat-val" style="font-size:1.6rem;color:{% if t < 70 %}var(--green){% elif t < 85 %}var(--yellow){% else %}var(--red){% endif %};">{{ "%.0f"|format(t) }}°C</span>
+  </div>
+  {% endif %}
+  {% if hostlvl.get('psi_mem_some_avg10') is not none %}
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.35rem;" title="Pressure stall — % of time stalled, 10s avg">Pressure (10s)</div>
+    <div style="font-size:0.78rem;font-variant-numeric:tabular-nums;color:var(--text-muted);">
+      <div>mem {{ "%.1f"|format(hostlvl.get('psi_mem_some_avg10')) }}%</div>
+      {% if hostlvl.get('psi_cpu_some_avg10') is not none %}<div>cpu {{ "%.1f"|format(hostlvl.get('psi_cpu_some_avg10')) }}%</div>{% endif %}
+      {% if hostlvl.get('psi_io_some_avg10') is not none %}<div>io {{ "%.1f"|format(hostlvl.get('psi_io_some_avg10')) }}%</div>{% endif %}
+    </div>
+  </div>
+  {% endif %}
+</div>
+
+{# ── Per-core CPU ─────────────────────────────────────────────────────────── #}
+{% if cores %}
+<div class="card">
+  <div class="section-title" style="margin-bottom:0.6rem;">Per-core CPU</div>
+  <div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(120px,1fr));gap:0.5rem 0.9rem;">
+    {% for idx, pct in cores %}
+    <div>
+      <div style="display:flex;justify-content:space-between;font-size:0.72rem;color:var(--text-dim);margin-bottom:0.2rem;">
+        <span>core {{ idx }}</span><span>{% if pct is not none %}{{ "%.0f"|format(pct) }}%{% else %}—{% endif %}</span>
+      </div>
+      {{ bar(pct) }}
+    </div>
+    {% endfor %}
+  </div>
+</div>
+{% endif %}
+
+{# ── Filesystems ──────────────────────────────────────────────────────────── #}
+{% if mounts %}
+<div class="card">
+  <div class="section-title" style="margin-bottom:0.6rem;">Filesystems</div>
+  {% for mount, m in mounts.items() %}
+  <div style="margin-bottom:0.6rem;">
+    <div style="display:flex;justify-content:space-between;font-size:0.8rem;margin-bottom:0.2rem;">
+      <span style="font-family:ui-monospace,monospace;">{{ mount }}</span>
+      <span style="color:var(--text-muted);">{{ fmt_bytes(m.get('disk_used_bytes')) }} / {{ fmt_bytes(m.get('disk_total_bytes')) }}{% if m.get('disk_used_pct') is not none %} · {{ "%.0f"|format(m.get('disk_used_pct')) }}%{% endif %}</span>
+    </div>
+    {{ bar(m.get('disk_used_pct')) }}
+  </div>
+  {% endfor %}
+</div>
+{% endif %}
+
+{# ── Interfaces / disks / sensors current detail ──────────────────────────── #}
+{% if nets or disks_io or temps %}
+<div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(240px,1fr));gap:1rem;">
+  {% if nets %}
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.5rem;">Interfaces</div>
+    {% for iface, m in nets.items() %}
+    <div style="display:flex;justify-content:space-between;font-size:0.8rem;padding:0.15rem 0;">
+      <span style="font-family:ui-monospace,monospace;">{{ iface }}</span>
+      <span style="color:var(--text-muted);font-variant-numeric:tabular-nums;">↓ {{ fmt_bps(m.get('net_rx_bps')) }} · ↑ {{ fmt_bps(m.get('net_tx_bps')) }}</span>
+    </div>
+    {% endfor %}
+  </div>
+  {% endif %}
+  {% if disks_io %}
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.5rem;">Disks</div>
+    {% for dev, m in disks_io.items() %}
+    <div style="display:flex;justify-content:space-between;font-size:0.8rem;padding:0.15rem 0;">
+      <span style="font-family:ui-monospace,monospace;">{{ dev }}</span>
+      <span style="color:var(--text-muted);font-variant-numeric:tabular-nums;">rd {{ fmt_bps(m.get('disk_read_bps')) }} · wr {{ fmt_bps(m.get('disk_write_bps')) }}</span>
+    </div>
+    {% endfor %}
+  </div>
+  {% endif %}
+  {% if temps %}
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.5rem;">Temperatures</div>
+    {% for label, c in temps.items() %}
+    <div style="display:flex;justify-content:space-between;font-size:0.8rem;padding:0.15rem 0;">
+      <span>{{ label }}</span>
+      <span style="color:{% if c is none %}var(--text-dim){% elif c < 70 %}var(--green){% elif c < 85 %}var(--yellow){% else %}var(--red){% endif %};font-variant-numeric:tabular-nums;">{% if c is not none %}{{ "%.0f"|format(c) }}°C{% else %}—{% endif %}</span>
+    </div>
+    {% endfor %}
+  </div>
+  {% endif %}
+</div>
+{% endif %}
+
+{# ── History charts ───────────────────────────────────────────────────────── #}
+<div style="display:grid;grid-template-columns:repeat(auto-fit,minmax(340px,1fr));gap:1rem;margin-top:1rem;">
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.5rem;">Utilization % — last {{ range_key }}</div>
+    <div style="height:220px;"><canvas id="chart-util"></canvas></div>
+  </div>
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.5rem;">Throughput (B/s) — last {{ range_key }}</div>
+    <div style="height:220px;"><canvas id="chart-net"></canvas></div>
+  </div>
+  <div class="card" style="margin-bottom:0;">
+    <div class="section-title" style="margin-bottom:0.5rem;">Load &amp; pressure — last {{ range_key }}</div>
+    <div style="height:220px;"><canvas id="chart-pressure"></canvas></div>
+  </div>
+</div>
+
+<script>
+(function () {
+  const series = {{ series|tojson }};
+  const fmtTime = (v) => { const d = new Date(v); return ("0" + d.getHours()).slice(-2) + ":" + ("0" + d.getMinutes()).slice(-2); };
+  const baseOpts = (ymax) => ({
+    responsive: true, maintainAspectRatio: false,
+    interaction: { mode: "index", intersect: false },
+    elements: { point: { radius: 0 } },
+    scales: {
+      x: { type: "linear", ticks: { callback: (v) => fmtTime(v), maxTicksLimit: 8, color: "#8a8a92", font: { size: 10 } }, grid: { color: "#30303a" } },
+      y: { beginAtZero: true, max: ymax, ticks: { color: "#8a8a92", font: { size: 10 } }, grid: { color: "#30303a" } },
+    },
+    plugins: {
+      legend: { labels: { color: "#b8b8b0", boxWidth: 10, font: { size: 11 } } },
+      tooltip: { callbacks: { title: function (items) { return items.length ? fmtTime(items[0].parsed.x) : ""; } } },
+    },
+  });
+  const mk = (id, datasets, ymax) => {
+    const el = document.getElementById(id);
+    if (!el) return;
+    new Chart(el.getContext("2d"), {
+      type: "line",
+      data: { datasets: datasets.map((d) => ({
+        label: d.label,
+        data: (series[d.key] || []).map((p) => ({ x: p[0], y: p[1] })),
+        borderColor: d.color, backgroundColor: d.color, borderWidth: 1.5, tension: 0.25,
+      })) },
+      options: baseOpts(ymax),
+    });
+  };
+  mk("chart-util", [
+    { key: "cpu_pct", label: "CPU %", color: "#c8a840" },
+    { key: "mem_used_pct", label: "Mem %", color: "#4aa86a" },
+    { key: "disk_used_pct_worst", label: "Disk % (worst)", color: "#c87840" },
+  ], 100);
+  mk("chart-net", [
+    { key: "net_rx_bps", label: "Net RX", color: "#4aa86a" },
+    { key: "net_tx_bps", label: "Net TX", color: "#c84048" },
+    { key: "disk_read_bps", label: "Disk read", color: "#6aa0d0" },
+    { key: "disk_write_bps", label: "Disk write", color: "#c8a840" },
+  ], undefined);
+  mk("chart-pressure", [
+    { key: "load_1m", label: "Load 1m", color: "#c8a840" },
+    { key: "psi_mem_some_avg10", label: "Mem PSI %", color: "#c84048" },
+    { key: "temp_c_max", label: "Temp °C", color: "#c87840" },
+  ], undefined);
+})();
+</script>
+{% endif %}
+{% endblock %}

plugins/host_agent/templates/install.sh.j2

@@ -0,0 +1,81 @@
+#!/bin/sh
+# Steward host agent installer
+# Generated for: {{ host_name }}  ({{ host_address }})
+# Steward URL: {{ url }}
+set -e
+
+STEWARD_URL="{{ url }}"
+AGENT_TOKEN="{{ token }}"
+AGENT_VERSION="{{ agent_version }}"
+
+AGENT_USER="steward-agent"
+AGENT_DIR="/usr/local/lib/steward-agent"
+CONF_FILE="/etc/steward-agent.conf"
+UNIT_FILE="/etc/systemd/system/steward-agent.service"
+
+# ── preflight ────────────────────────────────────────────────────────────────
+[ "$(id -u)" = "0" ] || { echo "must run as root (use sudo)"; exit 1; }
+command -v systemctl >/dev/null 2>&1 || { echo "systemd not found — unsupported init system"; exit 1; }
+command -v python3   >/dev/null 2>&1 || { echo "python3 not found — install python3 first"; exit 1; }
+
+# Handle --uninstall
+if [ "${1:-}" = "--uninstall" ]; then
+    systemctl disable --now steward-agent.service 2>/dev/null || true
+    rm -f "$UNIT_FILE" "$CONF_FILE"
+    rm -rf "$AGENT_DIR"
+    systemctl daemon-reload
+    # keep the system user — removing it risks orphaned files elsewhere
+    echo "uninstalled"
+    exit 0
+fi
+
+# ── create system user ───────────────────────────────────────────────────────
+if ! id "$AGENT_USER" >/dev/null 2>&1; then
+    useradd --system --no-create-home --shell /usr/sbin/nologin "$AGENT_USER"
+fi
+
+# ── drop the agent file ──────────────────────────────────────────────────────
+mkdir -p "$AGENT_DIR"
+curl -sSL "${STEWARD_URL}/plugins/host_agent/agent.py" -o "$AGENT_DIR/agent.py"
+chmod 0755 "$AGENT_DIR/agent.py"
+chown root:root "$AGENT_DIR/agent.py"
+
+# ── write config ─────────────────────────────────────────────────────────────
+cat > "$CONF_FILE" <<EOF
+url = $STEWARD_URL
+token = $AGENT_TOKEN
+interval_seconds = 30
+EOF
+chown "root:$AGENT_USER" "$CONF_FILE"
+chmod 0640 "$CONF_FILE"
+
+# ── write systemd unit ───────────────────────────────────────────────────────
+cat > "$UNIT_FILE" <<EOF
+[Unit]
+Description=Steward host agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=$AGENT_USER
+ExecStart=/usr/bin/python3 $AGENT_DIR/agent.py
+Restart=on-failure
+RestartSec=10
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+ReadOnlyPaths=/proc /sys
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable --now steward-agent.service
+
+echo
+echo "Steward host agent $AGENT_VERSION installed and running."
+echo "Check status:  systemctl status steward-agent"
+echo "Logs:          journalctl -u steward-agent -f"

plugins/host_agent/templates/panel.html

@@ -0,0 +1,177 @@
+{# Per-host agent panel — embedded into /hosts/<id> via HTMX. Self-contained. #}
+{% set scope = "steward:target:" ~ target.id if target else "" %}
+<div class="card">
+  <div style="display:flex;align-items:baseline;justify-content:space-between;margin-bottom:0.75rem;gap:1rem;flex-wrap:wrap;">
+    <h3 class="section-title" style="margin-bottom:0;">Agent</h3>
+    {% if reporting %}
+    <span style="font-size:0.78rem;color:{{ 'var(--yellow)' if stale else 'var(--green)' }};">
+      {{ 'stale' if stale else 'reporting' }}{% if reg.agent_version %} · v{{ reg.agent_version }}{% endif %}
+      · last seen {{ reg.last_seen_at.strftime('%Y-%m-%d %H:%M') }}
+    </span>
+    {% elif reg %}
+    <span style="font-size:0.78rem;color:var(--text-muted);">pending — no check-in yet</span>
+    {% endif %}
+  </div>
+
+  {% if reporting %}
+  {# ── Reporting: at-a-glance metrics (+ sparkline trend) + lifecycle ── #}
+  {% set cpu = hostlvl.get('cpu_pct') %}
+  {% set mem = hostlvl.get('mem_used_pct') %}
+  {% set lbl = "font-size:0.72rem;color:var(--text-muted);text-transform:uppercase;" %}
+  <div style="display:flex;gap:1.5rem;flex-wrap:wrap;margin-bottom:0.6rem;">
+    <div title="Average CPU utilization across all cores">
+      <div style="{{ lbl }}">CPU</div>
+      <div style="font-weight:600;{{ threshold_style(cpu, 'cpu') }}">{{ '%.0f%%'|format(cpu) if cpu is not none else '—' }}</div>
+      {{ sparks.cpu | safe }}</div>
+    <div title="RAM in use (total minus available; cache/buffers count as free)">
+      <div style="{{ lbl }}">Memory</div>
+      <div style="font-weight:600;{{ threshold_style(mem, 'mem') }}">{{ '%.0f%%'|format(mem) if mem is not none else '—' }}</div>
+      {{ sparks.mem | safe }}</div>
+    <div title="Root filesystem (/) usage — see Full metrics for every mount">
+      <div style="{{ lbl }}">Disk /</div>
+      <div style="font-weight:600;{{ threshold_style(disk_root, 'disk') }}">{{ '%.0f%%'|format(disk_root) if disk_root is not none else '—' }}</div>
+      {{ sparks.disk | safe }}</div>
+    {# Load /core: 100% = run queue matches CPU capacity, so warn 80 / crit 100. #}
+    <div title="1-minute load average ÷ {{ cores or '?' }} CPU cores (100% = run queue matches capacity). Raw 1m load: {{ '%.2f'|format(load1) if load1 is not none else '—' }}.">
+      <div style="{{ lbl }}">Load /core</div>
+      <div style="font-weight:600;{{ threshold_style(load_per_core, 'load') }}">{{ '%d%%'|format(load_per_core) if load_per_core is not none else ('%.2f'|format(load1) if load1 is not none else '—') }}</div>
+      {{ sparks.load | safe }}</div>
+  </div>
+  {% if psi.cpu is not none or psi.mem is not none or psi.io is not none %}
+  <div style="font-size:0.75rem;color:var(--text-muted);margin-bottom:0.9rem;"
+       title="Pressure Stall Information — % of the last 10s that tasks were stalled waiting for the resource. Hardware-independent, comparable across hosts.">
+    <span style="text-transform:uppercase;font-size:0.7rem;letter-spacing:0.04em;color:var(--text-dim);">Pressure 10s</span>
+    &nbsp;CPU {{ '%.0f%%'|format(psi.cpu) if psi.cpu is not none else '—' }}
+    · Mem {{ '%.0f%%'|format(psi.mem) if psi.mem is not none else '—' }}
+    · IO {{ '%.0f%%'|format(psi.io) if psi.io is not none else '—' }}
+  </div>
+  {% endif %}
+
+  <div style="display:flex;gap:0.5rem;flex-wrap:wrap;align-items:center;">
+    <a href="/plugins/host_agent/{{ host.id }}/" class="btn btn-sm btn-ghost">Full metrics →</a>
+    {% if session.user_role == 'admin' %}
+    {% if ansible_available and target %}
+    <form method="post" action="/plugins/host_agent/update" style="margin:0;">
+      <input type="hidden" name="inventory_scope" value="{{ scope }}">
+      <button type="submit" class="btn btn-sm" title="Refresh agent.py + restart (token preserved)">Update agent</button>
+    </form>
+    {% endif %}
+    <form method="post" action="/plugins/host_agent/fleet/{{ host.id }}/rotate-token" style="margin:0;"
+          onsubmit="return confirm('Rotate token? The agent stops reporting until reinstalled/updated with the new token.');">
+      <button type="submit" class="btn btn-sm btn-ghost">Rotate token</button>
+    </form>
+    <form method="post" action="/plugins/host_agent/fleet/{{ host.id }}/delete" style="margin:0;"
+          onsubmit="return confirm('Remove this agent registration? Metrics stop until re-registered.');">
+      <button type="submit" class="btn btn-sm btn-danger">Remove</button>
+    </form>
+    {% endif %}
+  </div>
+  {% if ansible_available and not target %}
+  <p style="color:var(--text-dim);font-size:0.8rem;margin:0.6rem 0 0;">
+    Link an Ansible target (above) to enable one-click agent updates.
+  </p>
+  {% endif %}
+
+  {% if session.user_role == 'admin' and ansible_available and target and managed_key_set %}
+  <details style="margin-top:0.7rem;">
+    <summary style="cursor:pointer;font-size:0.8rem;color:var(--text-muted);">Re-provision (reinstall the steward account + managed key, then the agent)</summary>
+    <p style="font-size:0.78rem;color:var(--text-dim);margin:0.5rem 0;">
+      Use after regenerating the managed key, or if SSH auth as <code>steward</code> breaks.
+      Connects over a one-time bootstrap user + password (not stored).
+    </p>
+    <form method="post" action="/plugins/host_agent/provision"
+          style="display:flex;gap:0.6rem;align-items:flex-end;flex-wrap:wrap;">
+      <input type="hidden" name="inventory_scope" value="{{ scope }}">
+      <div class="form-group" style="margin:0;">
+        <label>Bootstrap user</label>
+        <input type="text" name="bootstrap_user" required placeholder="root" style="width:8rem;" autocomplete="off">
+      </div>
+      <div class="form-group" style="margin:0;">
+        <label>Bootstrap password</label>
+        <input type="password" name="bootstrap_password" required style="width:10rem;" autocomplete="new-password">
+      </div>
+      <button type="submit" class="btn btn-sm">Re-provision</button>
+    </form>
+  </details>
+  {% endif %}
+
+  {% else %}
+  {# ── Not reporting: pending (token minted, no check-in) or never installed ── #}
+  {% if reg %}
+  <div style="background:color-mix(in srgb,var(--yellow) 10%,var(--bg-elevated));
+              border:1px solid color-mix(in srgb,var(--yellow) 30%,var(--border));
+              border-radius:6px;padding:0.7rem 0.9rem;margin-bottom:0.75rem;font-size:0.84rem;">
+    A token was minted for this host but <strong>no metrics have arrived yet</strong> — the
+    deploy may still be running, or it failed. Open the latest
+    <a href="/ansible/">Ansible run</a> to check, then retry below. Live metrics appear here
+    once the agent checks in.
+  </div>
+  {% else %}
+  <p style="color:var(--text-muted);font-size:0.88rem;margin-bottom:0.75rem;">
+    No agent installed. The agent reports CPU, memory, disk, network and more back to Steward.
+  </p>
+  {% endif %}
+
+  {% if session.user_role != 'admin' %}
+  <p style="color:var(--text-dim);font-size:0.85rem;">An admin can install the agent here.</p>
+
+  {% elif not ansible_available %}
+  <p style="color:var(--text-dim);font-size:0.85rem;">
+    Ansible isn't available, so the agent can't be deployed from here. Install it manually with the
+    <a href="/plugins/host_agent/fleet/">curl install command</a>.
+  </p>
+
+  {% elif not managed_key_set %}
+  <div style="background:color-mix(in srgb,var(--yellow) 12%,var(--bg-elevated));
+              border:1px solid color-mix(in srgb,var(--yellow) 35%,var(--border));
+              border-radius:6px;padding:0.7rem 0.9rem;display:flex;align-items:center;gap:0.8rem;flex-wrap:wrap;">
+    <span style="color:var(--yellow);">⚠</span>
+    <span style="font-size:0.84rem;flex:1;min-width:13rem;">No managed SSH key yet — Steward needs one to log into hosts.</span>
+    <form method="post" action="/settings/ansible/generate-key" style="margin:0;">
+      <input type="hidden" name="next" value="/hosts/{{ host.id }}">
+      <button type="submit" class="btn btn-sm">Generate managed key</button>
+    </form>
+  </div>
+
+  {% elif not target %}
+  <p style="color:var(--text-dim);font-size:0.85rem;">
+    Link or create an Ansible target for this host (in the Ansible section below) first — provisioning
+    needs an SSH connection.
+  </p>
+
+  {% else %}
+  <p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.75rem;">
+    Deploys the agent to <code>{{ target.name }}</code> by running an Ansible playbook. Steward mints
+    the host's API token automatically; you'll watch the run live.
+  </p>
+  {# Provision: brand-new host (creates steward account + key over a one-time password) #}
+  <form method="post" action="/plugins/host_agent/provision"
+        style="display:flex;gap:0.6rem;align-items:flex-end;flex-wrap:wrap;margin-bottom:0.75rem;">
+    <input type="hidden" name="inventory_scope" value="{{ scope }}">
+    <div style="font-size:0.78rem;color:var(--text-muted);width:100%;">Provision (first contact — fresh host):</div>
+    <div class="form-group" style="margin:0;">
+      <label>Bootstrap user</label>
+      <input type="text" name="bootstrap_user" required placeholder="root" style="width:8rem;" autocomplete="off">
+    </div>
+    <div class="form-group" style="margin:0;">
+      <label>Bootstrap password</label>
+      <input type="password" name="bootstrap_password" required style="width:10rem;" autocomplete="new-password">
+    </div>
+    <button type="submit" class="btn btn-sm">Provision</button>
+  </form>
+  {# Install: host already has the steward account (managed key works) #}
+  <form method="post" action="/plugins/host_agent/deploy" style="display:flex;gap:0.6rem;align-items:center;">
+    <input type="hidden" name="inventory_scope" value="{{ scope }}">
+    <span style="font-size:0.78rem;color:var(--text-muted);">Already provisioned?</span>
+    <button type="submit" class="btn btn-sm btn-ghost">Install agent (managed key)</button>
+  </form>
+  {% endif %}
+
+  {% if reg and session.user_role == 'admin' %}
+  <form method="post" action="/plugins/host_agent/fleet/{{ host.id }}/delete" style="margin:0.75rem 0 0;"
+        onsubmit="return confirm('Clear this pending registration? Its token is discarded.');">
+    <button type="submit" class="btn btn-sm btn-ghost">Clear pending registration</button>
+  </form>
+  {% endif %}
+  {% endif %}
+</div>

plugins/host_agent/templates/settings_list.html

@@ -0,0 +1,176 @@
+{% extends "base.html" %}
+{% from "_macros.html" import crumbs %}
+{% block title %}Agent fleet — Steward{% endblock %}
+{% block breadcrumb %}{{ crumbs([("Hosts", "/hosts/"), ("Agent fleet", "")]) }}{% endblock %}
+{% block content %}
+<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:1rem;gap:1rem;flex-wrap:wrap;">
+  <h1 class="page-title" style="margin-bottom:0;">Agent fleet</h1>
+  <a href="/hosts/" class="btn btn-ghost btn-sm">← Hosts</a>
+</div>
+<p style="color:var(--text-muted);font-size:0.84rem;margin:-0.4rem 0 1.25rem;">
+  Bulk agent operations across your inventory. For a single host, use its
+  <a href="/hosts/">host page</a> — provisioning and metrics live there.
+</p>
+
+{% if new_token %}
+<div class="card" style="background:var(--accent-bg);">
+  <h3>New token — copy this install command now</h3>
+  <p style="font-size:0.82rem;color:var(--text-muted);">
+    This is the only time the raw token is shown. Rotate if you lose it.
+  </p>
+  <pre style="user-select:all;word-break:break-all;">curl -sSL '{{ install_url }}' | sudo sh</pre>
+</div>
+{% endif %}
+
+<div class="card">
+  <form method="post" action="/plugins/host_agent/fleet/add-host"
+        style="display:flex;gap:0.75rem;align-items:flex-end;flex-wrap:wrap;">
+    <div class="form-group" style="margin-bottom:0;">
+      <label>Host name</label>
+      <input type="text" name="name" required>
+    </div>
+    <div class="form-group" style="margin-bottom:0;">
+      <label>Address (optional)</label>
+      <input type="text" name="address">
+    </div>
+    <button type="submit" class="btn">Add host</button>
+  </form>
+</div>
+
+{% if ansible_available %}
+{% set scope_select %}
+        <label>Target</label>
+        <select name="inventory_scope" required>
+          {% for g in deploy_groups %}<option value="steward:group:{{ g.id }}">Group: {{ g.name }}</option>{% endfor %}
+          {% for t in deploy_targets %}<option value="steward:target:{{ t.id }}">Target: {{ t.name }}</option>{% endfor %}
+        </select>
+{% endset %}
+
+<div class="card">
+  <h3 style="margin-bottom:0.4rem;">Agent lifecycle via Ansible</h3>
+  <p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.6rem;">
+    These actions run bundled <strong>Ansible playbooks</strong> to deploy and maintain the
+    Steward monitoring agent on your <a href="/ansible/inventory/targets">inventory hosts</a>.
+    Steward generates each host's API token automatically and connects over SSH as the managed
+    <code>steward</code> account — you'll be dropped into the live Ansible run to watch it.
+  </p>
+
+  {% if not managed_key_set %}
+  <div style="background:color-mix(in srgb,var(--yellow) 12%,var(--bg-elevated));
+              border:1px solid color-mix(in srgb,var(--yellow) 35%,var(--border));
+              border-radius:6px;padding:0.7rem 0.9rem;display:flex;align-items:center;
+              gap:0.8rem;flex-wrap:wrap;">
+    <span style="color:var(--yellow);">⚠</span>
+    <span style="font-size:0.84rem;flex:1;min-width:14rem;">
+      No managed SSH key yet — Steward needs one to log into hosts as <code>steward</code>.
+    </span>
+    <form method="post" action="/settings/ansible/generate-key" style="margin:0;">
+      <input type="hidden" name="next" value="/plugins/host_agent/fleet/">
+      <button type="submit" class="btn btn-sm">Generate managed key</button>
+    </form>
+  </div>
+  {% elif not (deploy_targets or deploy_groups) %}
+  <p style="font-size:0.85rem;color:var(--text-dim);margin:0;">
+    No Ansible inventory targets yet. Add some under <a href="/ansible/inventory/targets">Ansible → Inventory</a>.
+  </p>
+  {% endif %}
+</div>
+
+{% if managed_key_set and (deploy_targets or deploy_groups) %}
+<div class="card">
+  <h3 style="margin-bottom:0.4rem;">1 · Provision a fresh host</h3>
+  <p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.75rem;">
+    First contact for a brand-new host. Connects with a one-time <strong>bootstrap</strong>
+    user + password (used for this run only, never stored), creates the <code>steward</code>
+    login account with passwordless sudo, installs the managed SSH key, then installs the
+    agent. Run this once per host.
+  </p>
+  <form method="post" action="/plugins/host_agent/provision"
+        style="display:flex;gap:0.75rem;align-items:flex-end;flex-wrap:wrap;">
+    <div class="form-group" style="margin-bottom:0;">{{ scope_select }}</div>
+    <div class="form-group" style="margin-bottom:0;">
+      <label>Bootstrap user</label>
+      <input type="text" name="bootstrap_user" required placeholder="root" style="width:9rem;" autocomplete="off">
+    </div>
+    <div class="form-group" style="margin-bottom:0;">
+      <label>Bootstrap password</label>
+      <input type="password" name="bootstrap_password" required style="width:11rem;" autocomplete="new-password">
+    </div>
+    <div class="form-group" style="margin-bottom:0;">
+      <label>Report interval (s)</label>
+      <input type="number" name="agent_interval" value="30" min="5" style="width:7rem;">
+    </div>
+    <button type="submit" class="btn">Provision</button>
+  </form>
+</div>
+
+<div class="card">
+  <h3 style="margin-bottom:0.4rem;">2 · Install / enroll agent</h3>
+  <p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.75rem;">
+    For a host that's already provisioned (has the <code>steward</code> account) but has no
+    agent yet — or to re-enroll one. Connects as <code>steward</code> with the managed key,
+    mints a fresh token, and installs the agent. No <code>curl | sh</code> needed.
+  </p>
+  <form method="post" action="/plugins/host_agent/deploy"
+        style="display:flex;gap:0.75rem;align-items:flex-end;flex-wrap:wrap;">
+    <div class="form-group" style="margin-bottom:0;">{{ scope_select }}</div>
+    <div class="form-group" style="margin-bottom:0;">
+      <label>Report interval (s)</label>
+      <input type="number" name="agent_interval" value="30" min="5" style="width:7rem;">
+    </div>
+    <button type="submit" class="btn">Install</button>
+  </form>
+</div>
+
+<div class="card">
+  <h3 style="margin-bottom:0.4rem;">3 · Update agents</h3>
+  <p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.75rem;">
+    Refresh the agent binary on hosts already running it. Connects as <code>steward</code>
+    with the managed key and restarts the service — the token and config are left untouched,
+    so identity is preserved.
+  </p>
+  <form method="post" action="/plugins/host_agent/update"
+        style="display:flex;gap:0.75rem;align-items:flex-end;flex-wrap:wrap;">
+    <div class="form-group" style="margin-bottom:0;">{{ scope_select }}</div>
+    <button type="submit" class="btn">Update</button>
+  </form>
+</div>
+{% endif %}
+{% endif %}
+
+<div class="card-flush">
+  <table class="table">
+    <thead>
+      <tr>
+        <th>Host</th><th>Reported IP</th><th>Agent version</th><th>Distro</th>
+        <th>Last seen</th><th class="td-actions">Actions</th>
+      </tr>
+    </thead>
+    <tbody>
+      {% for item in registrations %}
+      <tr>
+        <td>{{ item.host.name if item.host else item.reg.host_id }}</td>
+        <td>{{ item.reg.host_ip or "—" }}</td>
+        <td>{{ item.reg.agent_version or "—" }}</td>
+        <td>{{ item.reg.distro or "—" }}</td>
+        <td>{{ item.reg.last_seen_at.strftime("%Y-%m-%d %H:%M:%S") if item.reg.last_seen_at else "never" }}</td>
+        <td class="td-actions">
+          <form method="post" action="/plugins/host_agent/fleet/{{ item.reg.host_id }}/rotate-token"
+                style="display:inline;"
+                onsubmit="return confirm('Rotate the token for this host? The existing agent will stop working until reinstalled with the new token.');">
+            <button type="submit" class="btn btn-ghost btn-sm">Rotate token</button>
+          </form>
+          <form method="post" action="/plugins/host_agent/fleet/{{ item.reg.host_id }}/delete"
+                style="display:inline;"
+                onsubmit="return confirm('Delete this host registration? The agent will be unable to report metrics until re-registered.');">
+            <button type="submit" class="btn btn-danger btn-sm">Delete</button>
+          </form>
+        </td>
+      </tr>
+      {% else %}
+      <tr><td colspan="6" class="empty">No hosts registered. Add one above.</td></tr>
+      {% endfor %}
+    </tbody>
+  </table>
+</div>
+{% endblock %}

plugins/host_agent/templates/widget_history.html

@@ -0,0 +1,88 @@
+{# host_agent history-graph widget — the host-view utilization chart, embedded
+   on a dashboard. Fills the (resizable) panel; epoch-ms linear axis so no
+   Chart.js date adapter is needed. #}
+{% set has_data = host and (series.cpu_pct or series.mem_used_pct or series.disk_root) %}
+{% if not host %}
+<div style="color:var(--text-muted);font-size:0.85rem;padding:0.75rem 0;">
+  No host selected. <strong>Edit</strong> this dashboard and pick a host for this graph.
+</div>
+{% elif not has_data %}
+<div style="color:var(--text-muted);font-size:0.85rem;padding:0.75rem 0;">
+  No agent metrics for <strong>{{ host.name }}</strong> in the last {{ hours }}h yet.
+</div>
+{% else %}
+<div style="display:flex;flex-direction:column;height:100%;min-height:200px;">
+  {# Name the host the graph represents (panel title is generic) + a live range
+     toggle that re-requests this widget without entering edit mode. #}
+  <div style="flex:0 0 auto;display:flex;align-items:center;gap:0.5rem;flex-wrap:wrap;font-size:0.75rem;color:var(--text-muted);margin-bottom:0.3rem;">
+    {% if session.user_id %}
+    <a href="/hosts/{{ host.id }}" style="font-weight:600;">{{ host.name }}</a>
+    {% else %}
+    <strong style="color:var(--text);">{{ host.name }}</strong>
+    {% endif %}
+    <span class="hist-range" style="margin-left:auto;display:inline-flex;border:1px solid var(--border-mid);border-radius:5px;overflow:hidden;">
+      {% for opt in [1, 6, 24] %}
+      <button type="button" onclick="histRange({{ wid }}, '{{ host.id }}', {{ opt }})"
+        style="border:0;cursor:pointer;padding:0.1rem 0.45rem;font-size:0.72rem;
+               background:{% if opt == hours %}var(--accent){% else %}transparent{% endif %};
+               color:{% if opt == hours %}#fff{% else %}var(--text-muted){% endif %};">{{ opt }}h</button>
+      {% endfor %}
+    </span>
+  </div>
+  <div style="flex:1 1 auto;min-height:150px;position:relative;">
+    <canvas id="host-hist-{{ wid }}"></canvas>
+  </div>
+</div>
+<script>
+// Live time-range switch. Rewrites the parent cell's hx-get so the choice sticks
+// across polls (htmx re-reads the attribute each poll), then fetches immediately.
+window.histRange = function (wid, hostId, hours) {
+  var cell = document.getElementById("widget-" + wid);
+  if (!cell) return;
+  var base = (cell.getAttribute("hx-get") || "").split("?")[0];
+  var url = base + "?host_id=" + encodeURIComponent(hostId) + "&hours=" + hours + "&wid=" + wid;
+  cell.setAttribute("hx-get", url);
+  if (window.htmx) window.htmx.ajax("GET", url, { target: cell, swap: "innerHTML" });
+};
+(function () {
+  var el = document.getElementById("host-hist-{{ wid }}");
+  if (!el) return;
+  var series = {{ series|tojson }};
+  var fmtTime = function (v) {
+    var d = new Date(v);
+    return ("0" + d.getHours()).slice(-2) + ":" + ("0" + d.getMinutes()).slice(-2);
+  };
+  var ds = [
+    { key: "cpu_pct",      label: "CPU %",    color: "#c8a840" },
+    { key: "mem_used_pct", label: "Mem %",    color: "#4aa86a" },
+    { key: "disk_root",    label: "Disk / %", color: "#c87840" },
+  ];
+  new Chart(el.getContext("2d"), {
+    type: "line",
+    data: { datasets: ds.map(function (d) {
+      return {
+        label: d.label,
+        data: (series[d.key] || []).map(function (p) { return { x: p[0], y: p[1] }; }),
+        borderColor: d.color, backgroundColor: d.color, borderWidth: 1.5, tension: 0.25,
+      };
+    }) },
+    options: {
+      responsive: true, maintainAspectRatio: false,
+      interaction: { mode: "index", intersect: false },
+      elements: { point: { radius: 0 } },
+      scales: {
+        x: { type: "linear", ticks: { callback: function (v) { return fmtTime(v); }, maxTicksLimit: 6, color: "#8a8a92", font: { size: 10 } }, grid: { color: "#30303a" } },
+        // Fixed 0–{{ y_max }} ceiling (server snaps the data peak up to the next
+        // 10% band). Steady across refreshes — auto-scaling made the zoom jump on
+        // every poll — while a banded ceiling still keeps the lines filling the panel.
+        y: { min: 0, max: {{ y_max }}, ticks: { color: "#8a8a92", font: { size: 10 } }, grid: { color: "#30303a" } },
+      },
+      plugins: {
+        legend: { labels: { color: "#b8b8b0", boxWidth: 10, font: { size: 11 } } },
+        tooltip: { callbacks: { title: function (items) { return items.length ? fmtTime(items[0].parsed.x) : ""; } } },
+      },
+    },
+  });
+})();
+</script>
+{% endif %}

plugins/host_agent/templates/widget_table.html

@@ -0,0 +1,77 @@
+{# host_agent widget — fleet glance. One horizontal row per host, zebra-striped
+   so adjacent hosts read as distinct groupings: health dot + host name on the
+   left, metric cells (cpu/mem/disk/load) each with a trend sparkline laid out
+   horizontally on the right. The name wraps (never hard-truncated) but the row
+   stays horizontal. #}
+{% if rows %}
+{% macro metric_cell(label, value, fmt, svg, style="", title="") %}
+<div style="min-width:62px;flex:0 0 auto;" title="{{ title }}">
+  <div style="font-size:0.62rem;color:var(--text-dim);text-transform:uppercase;letter-spacing:0.03em;">{{ label }}</div>
+  <div style="font-weight:600;font-size:0.8rem;font-variant-numeric:tabular-nums;{{ style }}">
+    {% if value is not none %}{{ fmt|format(value) }}{% else %}—{% endif %}
+  </div>
+  <div style="line-height:0;height:16px;">{{ svg | safe }}</div>
+</div>
+{% endmacro %}
+{# Human-readable throughput, matching the host-detail page. #}
+{% macro fmt_bps(v) %}
+{%- if v is none -%}—
+{%- elif v >= 1048576 -%}{{ "%.1f"|format(v / 1048576) }} MB/s
+{%- elif v >= 1024 -%}{{ "%.1f"|format(v / 1024) }} KB/s
+{%- else -%}{{ "%.0f"|format(v) }} B/s
+{%- endif -%}
+{% endmacro %}
+{# Two-line down/up (or read/write) throughput cell. #}
+{% macro io_cell(label, down_sym, down_val, up_sym, up_val, title="") %}
+<div style="min-width:80px;flex:0 0 auto;" title="{{ title }}">
+  <div style="font-size:0.62rem;color:var(--text-dim);text-transform:uppercase;letter-spacing:0.03em;">{{ label }}</div>
+  <div style="font-size:0.72rem;font-variant-numeric:tabular-nums;line-height:1.3;">
+    <div>{{ down_sym }} {{ fmt_bps(down_val) }}</div>
+    <div>{{ up_sym }} {{ fmt_bps(up_val) }}</div>
+  </div>
+</div>
+{% endmacro %}
+<div class="host-fleet">
+  {% for r in rows %}
+  {% set stale = r.stale %}
+  <div style="display:flex;align-items:center;gap:0.6rem 1rem;flex-wrap:wrap;padding:0.5rem 0.6rem;border-radius:4px;{% if loop.index0 % 2 %}background:var(--bg-elevated);{% endif %}">
+    {# Left — health dot + full host name (wraps, never truncated) + last seen #}
+    <div style="display:flex;align-items:center;gap:0.5rem;flex:1 1 150px;min-width:120px;">
+      <span class="dot {% if stale %}dot-dim{% elif (r.cpu_pct or 0) >= 90 or (r.mem_used_pct or 0) >= 90 or (r.disk_worst or 0) >= 90 %}dot-warn{% else %}dot-up{% endif %}"
+            style="flex-shrink:0;"
+            title="{% if stale %}stale / no recent data{% else %}warns at CPU/memory ≥90% or any disk mount ≥90% (the 'disk /' figure shows root only){% endif %}"></span>
+      <span style="min-width:0;">
+        {% if session.user_id %}
+        <a href="/hosts/{{ r.host.id }}" style="font-weight:600;font-size:0.85rem;overflow-wrap:anywhere;">{{ r.host.name }}</a>
+        {% else %}
+        <span style="font-weight:600;font-size:0.85rem;overflow-wrap:anywhere;">{{ r.host.name }}</span>
+        {% endif %}
+        <span style="display:block;font-size:0.7rem;color:var(--text-dim);">
+          {{ r.reg.last_seen_at.strftime("%H:%M:%S") if r.reg.last_seen_at else "never" }}
+        </span>
+      </span>
+    </div>
+    {# Right — metric cells with value + trend, laid out horizontally #}
+    <div style="display:flex;flex-wrap:wrap;gap:0.4rem 1rem;justify-content:flex-end;">
+      {{ metric_cell("cpu", r.cpu_pct, "%.0f%%", r.sparks.cpu, threshold_style(r.cpu_pct, 'cpu'), "Average CPU utilization") }}
+      {{ metric_cell("mem", r.mem_used_pct, "%.0f%%", r.sparks.mem, threshold_style(r.mem_used_pct, 'mem'), "Memory in use") }}
+      {{ metric_cell("disk /", r.disk_root, "%.0f%%", r.sparks.disk, threshold_style(r.disk_root, 'disk'), "Root filesystem (/) usage") }}
+      {{ metric_cell("load", r.load_1m, "%.2f", r.sparks.load, "", "Load average (1m)") }}
+      {# Extra agent metrics — shown only when the host reports them (VMs/containers
+         often have no temp sensor, etc.) so absent data doesn't clutter the row. #}
+      {% if r.net_rx_bps is not none or r.net_tx_bps is not none %}
+      {{ io_cell("net", "↓", r.net_rx_bps, "↑", r.net_tx_bps, "Network throughput (down / up)") }}
+      {% endif %}
+      {% if r.disk_read_bps is not none or r.disk_write_bps is not none %}
+      {{ io_cell("disk i/o", "rd", r.disk_read_bps, "wr", r.disk_write_bps, "Disk I/O (read / write)") }}
+      {% endif %}
+      {% if r.temp_max is not none %}
+      {{ metric_cell("temp", r.temp_max, "%.0f°C", "", threshold_style(r.temp_max, 'temp'), "Hottest sensor") }}
+      {% endif %}
+    </div>
+  </div>
+  {% endfor %}
+</div>
+{% else %}
+<p class="empty" style="padding:0.5rem 0;font-size:0.85rem;">No hosts with agent data yet.</p>
+{% endif %}

plugins/index.yaml

@@ -0,0 +1,74 @@
+# steward-plugins / index.yaml
+#
+# Plugin catalog for Steward.
+# Fetched by the app at: Settings → Plugins → Plugin Catalog
+#
+# After updating an entry, commit and push — changes are live within 5 minutes
+# (the app caches this file in-process for 300 seconds).
+#
+# See docs/plugins/index.yaml.example in the main app repo for the full schema.
+
+version: 1
+updated: "2026-03-22"
+
+plugins:
+
+  - name: docker
+    version: "2.0.0"
+    description: "Per-host Docker container status + resource usage, collected by the Steward host agent"
+    author: "Steward"
+    license: "MIT"
+    min_app_version: "0.1.0"
+    repository_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins"
+    homepage: "https://git.fabledsword.com/bvandeusen/Steward-plugins/src/branch/main/docker"
+    download_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins/releases/download/docker-v2.0.0/docker.zip"
+    checksum_sha256: ""
+    tags:
+      - containers
+      - docker
+      - infrastructure
+
+  - name: traefik
+    version: "1.0.0"
+    description: "Traefik reverse proxy metrics and access log integration"
+    author: "Steward"
+    license: "MIT"
+    min_app_version: "0.1.0"
+    repository_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins"
+    homepage: "https://git.fabledsword.com/bvandeusen/Steward-plugins/src/branch/main/traefik"
+    download_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins/releases/download/traefik-v1.0.0/traefik.zip"
+    checksum_sha256: ""
+    tags:
+      - proxy
+      - metrics
+      - access-log
+
+  - name: unifi
+    version: "1.0.0"
+    description: "UniFi Network controller integration — WAN health, devices, clients, DPI"
+    author: "Steward"
+    license: "MIT"
+    min_app_version: "0.1.0"
+    repository_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins"
+    homepage: "https://git.fabledsword.com/bvandeusen/Steward-plugins/src/branch/main/unifi"
+    download_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins/releases/download/unifi-v1.0.0/unifi.zip"
+    checksum_sha256: ""
+    tags:
+      - network
+      - unifi
+      - ubiquiti
+
+  - name: ups
+    version: "1.0.0"
+    description: "UPS monitoring via NUT (Network UPS Tools) with Ansible shutdown automation"
+    author: "Steward"
+    license: "MIT"
+    min_app_version: "0.1.0"
+    repository_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins"
+    homepage: "https://git.fabledsword.com/bvandeusen/Steward-plugins/src/branch/main/ups"
+    download_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins/releases/download/ups-v1.0.0/ups.zip"
+    checksum_sha256: ""
+    tags:
+      - ups
+      - power
+      - nut

plugins/snmp/__init__.py

@@ -0,0 +1,23 @@
+# plugins/snmp/__init__.py
+from __future__ import annotations
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from quart import Quart
+
+_app: "Quart | None" = None
+
+
+def setup(app: "Quart") -> None:
+    global _app
+    _app = app
+
+
+def get_scheduled_tasks() -> list:
+    from .scheduler import make_poll_task
+    return [make_poll_task(_app)]
+
+
+def get_blueprint():
+    from .routes import snmp_bp
+    return snmp_bp

plugins/snmp/plugin.yaml

@@ -0,0 +1,49 @@
+# plugins/snmp/plugin.yaml
+name: snmp
+version: "1.0.0"
+description: "SNMP polling for network devices — switches, routers, printers, UPSes, etc."
+author: "Steward"
+license: "MIT"
+min_app_version: "0.1.0"
+repository_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins"
+homepage: "https://git.fabledsword.com/bvandeusen/Steward-plugins/src/branch/main/snmp"
+tags:
+  - snmp
+  - network
+  - monitoring
+
+config:
+  poll_interval_seconds: 60
+  # Each device is polled independently. OIDs must resolve to numeric values.
+  devices:
+    - name: "core-switch"
+      host: "192.168.1.1"
+      port: 161
+      community: "public"
+      version: "2c"    # "1", "2c", or "3"
+      oids:
+        - oid: "1.3.6.1.2.1.1.3.0"
+          label: "uptime_centisecs"
+        - oid: "1.3.6.1.2.1.2.2.1.10.1"
+          label: "if1_in_octets"
+        - oid: "1.3.6.1.2.1.2.2.1.16.1"
+          label: "if1_out_octets"
+    # Example: network UPS with SNMP management card (RFC 1628 UPS-MIB).
+    # upsBatteryStatus values: 1=unknown, 2=batteryNormal, 3=batteryLow, 4=batteryDepleted.
+    # Uncomment and point at your UPS to enable.
+    # - name: "ups"
+    #   host: "192.168.1.10"
+    #   port: 161
+    #   community: "public"
+    #   version: "2c"
+    #   oids:
+    #     - oid: "1.3.6.1.2.1.33.1.2.1.0"
+    #       label: "battery_status"
+    #     - oid: "1.3.6.1.2.1.33.1.2.2.0"
+    #       label: "seconds_on_battery"
+    #     - oid: "1.3.6.1.2.1.33.1.2.3.0"
+    #       label: "runtime_minutes_remaining"
+    #     - oid: "1.3.6.1.2.1.33.1.2.4.0"
+    #       label: "battery_charge_pct"
+    #     - oid: "1.3.6.1.2.1.33.1.3.3.1.3.1"
+    #       label: "input_voltage_dV"

plugins/snmp/poller.py

@@ -0,0 +1,94 @@
+# plugins/snmp/poller.py
+"""
+Synchronous SNMP GET helper, run via executor.
+
+Requires pysnmp-lextudio (maintained pysnmp fork):
+    pip install 'steward[snmp]'
+
+If pysnmp is not installed, poll_device() returns an empty dict and logs a warning.
+"""
+from __future__ import annotations
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+def _pysnmp_available() -> bool:
+    try:
+        import pysnmp  # noqa: F401
+        return True
+    except ImportError:
+        return False
+
+
+def _mp_model(version: str) -> int:
+    """Map version string to pysnmp mpModel integer."""
+    return 0 if version == "1" else 1
+
+
+def poll_device_sync(
+    host: str,
+    port: int,
+    community: str,
+    version: str,
+    oids: list[dict],
+) -> dict[str, float]:
+    """
+    Perform SNMP GET for each OID and return {label: float_value}.
+    Non-numeric OIDs (strings, etc.) are skipped.
+    Returns empty dict on any error.
+    """
+    if not _pysnmp_available():
+        logger.warning("pysnmp not installed — SNMP polling disabled. "
+                       "Install with: pip install 'steward[snmp]'")
+        return {}
+
+    from pysnmp.hlapi import (
+        CommunityData,
+        ContextData,
+        ObjectIdentity,
+        ObjectType,
+        SnmpEngine,
+        UdpTransportTarget,
+        getCmd,
+    )
+
+    results: dict[str, float] = {}
+    engine = SnmpEngine()
+
+    for oid_cfg in oids:
+        oid = oid_cfg["oid"]
+        label = oid_cfg.get("label") or oid
+        scale = float(oid_cfg.get("scale", 1.0))
+
+        try:
+            error_indication, error_status, error_index, var_binds = next(
+                getCmd(
+                    engine,
+                    CommunityData(community, mpModel=_mp_model(version)),
+                    UdpTransportTarget((host, port), timeout=5, retries=1),
+                    ContextData(),
+                    ObjectType(ObjectIdentity(oid)),
+                )
+            )
+        except Exception as exc:
+            logger.debug("SNMP GET %s@%s OID %s failed: %s", host, port, oid, exc)
+            continue
+
+        if error_indication:
+            logger.debug("SNMP error %s@%s OID %s: %s", host, port, oid, error_indication)
+            continue
+        if error_status:
+            logger.debug("SNMP status %s@%s OID %s: %s at %s",
+                         host, port, oid, error_status.prettyPrint(),
+                         error_index and var_binds[int(error_index) - 1][0] or "?")
+            continue
+
+        for _, val in var_binds:
+            try:
+                results[label] = float(val) * scale
+            except (TypeError, ValueError):
+                # Non-numeric type (e.g. OctetString description) — skip
+                logger.debug("SNMP non-numeric value for %s label=%s: %r", oid, label, val)
+
+    return results

plugins/snmp/routes.py

@@ -0,0 +1,146 @@
+# plugins/snmp/routes.py
+from __future__ import annotations
+from datetime import datetime, timedelta, timezone
+
+from quart import Blueprint, current_app, render_template, request
+from sqlalchemy import func, select
+
+from steward.auth.middleware import require_role
+from steward.models.users import UserRole
+from steward.models.metrics import PluginMetric
+
+snmp_bp = Blueprint("snmp", __name__, template_folder="templates")
+
+
+async def _latest_readings(db, device_names: list[str]) -> dict[str, dict[str, float]]:
+    """Return {device_name: {label: latest_value}} for all configured devices."""
+    if not device_names:
+        return {}
+
+    # Latest value per (resource_name, metric_name) pair
+    subq = (
+        select(
+            PluginMetric.resource_name,
+            PluginMetric.metric_name,
+            func.max(PluginMetric.recorded_at).label("latest_at"),
+        )
+        .where(PluginMetric.source_module == "snmp")
+        .where(PluginMetric.resource_name.in_(device_names))
+        .group_by(PluginMetric.resource_name, PluginMetric.metric_name)
+        .subquery()
+    )
+    result = await db.execute(
+        select(PluginMetric).join(
+            subq,
+            (PluginMetric.resource_name == subq.c.resource_name)
+            & (PluginMetric.metric_name == subq.c.metric_name)
+            & (PluginMetric.recorded_at == subq.c.latest_at),
+        ).where(PluginMetric.source_module == "snmp")
+    )
+    rows = result.scalars().all()
+
+    out: dict[str, dict[str, float]] = {}
+    for row in rows:
+        out.setdefault(row.resource_name, {})[row.metric_name] = row.value
+    return out
+
+
+async def _history(db, device_name: str, hours: int = 24) -> dict[str, list]:
+    """Return {label: [(recorded_at, value), ...]} for a single device."""
+    since = datetime.now(timezone.utc) - timedelta(hours=hours)
+    result = await db.execute(
+        select(PluginMetric)
+        .where(
+            PluginMetric.source_module == "snmp",
+            PluginMetric.resource_name == device_name,
+            PluginMetric.recorded_at >= since,
+        )
+        .order_by(PluginMetric.recorded_at)
+    )
+    rows = result.scalars().all()
+
+    out: dict[str, list] = {}
+    for row in rows:
+        out.setdefault(row.metric_name, []).append(
+            (row.recorded_at.isoformat(), row.value)
+        )
+    return out
+
+
+@snmp_bp.get("/")
+@require_role(UserRole.viewer)
+async def index():
+    devices_cfg: list[dict] = current_app.config["PLUGINS"]["snmp"].get("devices", [])
+    device_names = [d.get("name") or d.get("host", "?") for d in devices_cfg]
+
+    async with current_app.db_sessionmaker() as db:
+        latest = await _latest_readings(db, device_names)
+
+    # Merge config + latest readings for the template
+    devices = []
+    for cfg in devices_cfg:
+        name = cfg.get("name") or cfg.get("host", "?")
+        devices.append({
+            "name": name,
+            "host": cfg.get("host", ""),
+            "oids": cfg.get("oids", []),
+            "readings": latest.get(name, {}),
+        })
+
+    poll_interval = current_app.config.get("MONITORS_POLL_INTERVAL", 60)
+    return await render_template("snmp/index.html",
+                                 devices=devices,
+                                 poll_interval=poll_interval)
+
+
+@snmp_bp.get("/widget")
+@require_role(UserRole.viewer)
+async def widget():
+    devices_cfg: list[dict] = current_app.config["PLUGINS"]["snmp"].get("devices", [])
+    device_names = [d.get("name") or d.get("host", "?") for d in devices_cfg]
+
+    async with current_app.db_sessionmaker() as db:
+        latest = await _latest_readings(db, device_names[:10])
+
+    devices = []
+    for cfg in devices_cfg[:10]:
+        name = cfg.get("name") or cfg.get("host", "?")
+        devices.append({
+            "name": name,
+            "oids": cfg.get("oids", []),
+            "readings": latest.get(name, {}),
+        })
+
+    return await render_template("snmp/widget.html",
+                                 devices=devices,
+                                 total=len(devices_cfg))
+
+
+@snmp_bp.get("/device/<device_name>")
+@require_role(UserRole.viewer)
+async def device_detail(device_name: str):
+    devices_cfg: list[dict] = current_app.config["PLUGINS"]["snmp"].get("devices", [])
+    device_cfg = next(
+        (d for d in devices_cfg if (d.get("name") or d.get("host")) == device_name),
+        None,
+    )
+    if device_cfg is None:
+        from quart import abort
+        abort(404)
+
+    hours = int(request.args.get("hours", 24))
+    async with current_app.db_sessionmaker() as db:
+        hist = await _history(db, device_name, hours=hours)
+
+    import json
+    history_json = json.dumps(hist)
+    oid_labels = [o.get("label") or o.get("oid") for o in device_cfg.get("oids", [])]
+
+    return await render_template(
+        "snmp/device.html",
+        device=device_cfg,
+        device_name=device_name,
+        oid_labels=oid_labels,
+        history_json=history_json,
+        hours=hours,
+    )

plugins/snmp/scheduler.py

@@ -0,0 +1,76 @@
+# plugins/snmp/scheduler.py
+from __future__ import annotations
+import asyncio
+import logging
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from quart import Quart
+
+from steward.core.scheduler import ScheduledTask
+
+logger = logging.getLogger(__name__)
+
+
+def make_poll_task(app: "Quart") -> ScheduledTask:
+    interval = app.config["PLUGINS"]["snmp"].get("poll_interval_seconds", 60)
+
+    async def poll() -> None:
+        await _do_poll(app)
+
+    return ScheduledTask(
+        name="snmp_poll",
+        coro_factory=poll,
+        interval_seconds=int(interval),
+        run_on_startup=True,
+    )
+
+
+async def _do_poll(app: "Quart") -> None:
+    from .poller import poll_device_sync
+    from steward.core.alerts import record_metric
+
+    devices: list[dict] = app.config["PLUGINS"]["snmp"].get("devices", [])
+    if not devices:
+        return
+
+    loop = asyncio.get_event_loop()
+
+    async with app.db_sessionmaker() as session:
+        async with session.begin():
+            for device in devices:
+                if not isinstance(device, dict):
+                    continue
+                name = device.get("name") or device.get("host", "unknown")
+                host = device.get("host", "")
+                port = int(device.get("port", 161))
+                community = device.get("community", "public")
+                version = str(device.get("version", "2c"))
+                oids = device.get("oids", [])
+
+                if not host or not oids:
+                    continue
+
+                try:
+                    readings = await loop.run_in_executor(
+                        None,
+                        poll_device_sync,
+                        host, port, community, version, oids,
+                    )
+                except Exception:
+                    logger.exception("SNMP poll failed for device %s (%s)", name, host)
+                    continue
+
+                for label, value in readings.items():
+                    await record_metric(
+                        session=session,
+                        source_module="snmp",
+                        resource_name=name,
+                        metric_name=label,
+                        value=value,
+                    )
+
+                if readings:
+                    logger.debug("SNMP polled %s (%s): %d OID(s)", name, host, len(readings))
+                else:
+                    logger.debug("SNMP polled %s (%s): no readings", name, host)

plugins/snmp/templates/snmp/device.html

@@ -0,0 +1,84 @@
+{# plugins/snmp/templates/snmp/device.html #}
+{% extends "base.html" %}
+{% block title %}SNMP — {{ device_name }} — Steward{% endblock %}
+{% block content %}
+<div style="display:flex;align-items:center;gap:1rem;margin-bottom:1.5rem;flex-wrap:wrap;">
+  <a href="/plugins/snmp/" style="color:var(--text-muted);font-size:0.85rem;">&#8592; SNMP</a>
+  <h1 class="page-title" style="margin:0;">{{ device_name }}</h1>
+  <span style="font-size:0.8rem;color:var(--text-dim);">{{ device.host }}</span>
+  <div style="margin-left:auto;display:flex;gap:0.5rem;">
+    {% for h in [1, 6, 24, 168] %}
+    <a href="?hours={{ h }}"
+       class="btn btn-ghost"
+       style="font-size:0.78rem;padding:0.2rem 0.6rem;{% if hours == h %}background:var(--accent);color:#fff;border-color:var(--accent);{% endif %}">
+      {% if h < 24 %}{{ h }}h{% elif h == 24 %}24h{% else %}7d{% endif %}
+    </a>
+    {% endfor %}
+  </div>
+</div>
+
+{% if oid_labels %}
+<div class="card">
+  <canvas id="snmp-chart" style="width:100%;max-height:320px;"></canvas>
+</div>
+
+<script>
+(function(){
+  const raw = {{ history_json | safe }};
+  const labels = {{ oid_labels | tojson }};
+  const palette = ["#6060c0","#e07040","#40b080","#c040c0","#4080e0","#e0c040","#c08040"];
+
+  // Collect all unique timestamps, sorted
+  const tsSet = new Set();
+  for (const pts of Object.values(raw)) {
+    for (const [ts] of pts) tsSet.add(ts);
+  }
+  const allTs = Array.from(tsSet).sort();
+
+  if (allTs.length < 2) {
+    document.getElementById("snmp-chart").parentElement.innerHTML =
+      '<p style="color:var(--text-muted);padding:1rem;">Not enough data for a chart yet.</p>';
+    return;
+  }
+
+  const datasets = [];
+  labels.forEach((label, i) => {
+    const pts = raw[label] || [];
+    const map = Object.fromEntries(pts.map(([ts, v]) => [ts, v]));
+    datasets.push({
+      label,
+      data: allTs.map(ts => map[ts] ?? null),
+      borderColor: palette[i % palette.length],
+      backgroundColor: "transparent",
+      borderWidth: 1.5,
+      pointRadius: 0,
+      tension: 0.2,
+      spanGaps: true,
+    });
+  });
+
+  const ctx = document.getElementById("snmp-chart").getContext("2d");
+  new Chart(ctx, {
+    type: "line",
+    data: { labels: allTs.map(ts => ts.substring(11, 16)), datasets },
+    options: {
+      responsive: true,
+      interaction: { mode: "index", intersect: false },
+      plugins: {
+        legend: { position: "top", labels: { color: "#aaa", boxWidth: 12 } },
+        tooltip: { backgroundColor: "#1e1e2e", titleColor: "#ccc", bodyColor: "#aaa" },
+      },
+      scales: {
+        x: { ticks: { color: "#888", maxTicksLimit: 12 }, grid: { color: "#2a2a3a" } },
+        y: { ticks: { color: "#888" }, grid: { color: "#2a2a3a" } },
+      },
+    },
+  });
+})();
+</script>
+{% else %}
+<div class="card" style="color:var(--text-muted);text-align:center;padding:2rem;">
+  No OIDs configured for this device.
+</div>
+{% endif %}
+{% endblock %}

plugins/snmp/templates/snmp/index.html

@@ -0,0 +1,57 @@
+{# plugins/snmp/templates/snmp/index.html #}
+{% extends "base.html" %}
+{% block title %}SNMP — Steward{% endblock %}
+{% block content %}
+<div style="display:flex;align-items:center;gap:1rem;margin-bottom:1.5rem;">
+  <h1 class="page-title" style="margin:0;">SNMP Devices</h1>
+  <span style="font-size:0.8rem;color:var(--text-dim);">{{ devices|length }} device(s) configured</span>
+</div>
+
+{% if not devices %}
+<div class="card" style="color:var(--text-muted);text-align:center;padding:2rem;">
+  No SNMP devices configured. Add devices to <code>plugin.yaml</code>.
+</div>
+{% else %}
+
+{% for device in devices %}
+<div class="card" style="margin-bottom:1rem;">
+  <div style="display:flex;align-items:center;gap:1rem;margin-bottom:1rem;">
+    <h2 style="margin:0;font-size:1rem;font-weight:600;">{{ device.name }}</h2>
+    <span style="font-size:0.78rem;color:var(--text-dim);">{{ device.host }}</span>
+    {% if device.readings %}
+    <span style="font-size:0.75rem;color:var(--green);margin-left:auto;">&#9679; reachable</span>
+    {% else %}
+    <span style="font-size:0.75rem;color:var(--text-dim);margin-left:auto;">&#9675; no data yet</span>
+    {% endif %}
+    <a href="/plugins/snmp/device/{{ device.name }}" class="btn btn-ghost" style="font-size:0.78rem;padding:0.2rem 0.6rem;">History</a>
+  </div>
+
+  {% if device.readings %}
+  <div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(200px,1fr));gap:0.75rem;">
+    {% for oid_cfg in device.oids %}
+    {% set label = oid_cfg.label if oid_cfg.label else oid_cfg.oid %}
+    {% set val = device.readings.get(label) %}
+    <div style="background:var(--bg-alt);border-radius:6px;padding:0.6rem 0.9rem;">
+      <div style="font-size:0.72rem;color:var(--text-dim);margin-bottom:0.2rem;font-family:monospace;">{{ label }}</div>
+      {% if val is not none %}
+      <div style="font-size:1.1rem;font-weight:600;font-variant-numeric:tabular-nums;">
+        {% if val >= 1000000 %}{{ "%.2f"|format(val / 1000000) }}<span style="font-size:0.75rem;color:var(--text-muted);">M</span>
+        {% elif val >= 1000 %}{{ "%.1f"|format(val / 1000) }}<span style="font-size:0.75rem;color:var(--text-muted);">K</span>
+        {% else %}{{ "%.4g"|format(val) }}{% endif %}
+      </div>
+      {% else %}
+      <div style="font-size:0.85rem;color:var(--text-dim);">—</div>
+      {% endif %}
+    </div>
+    {% endfor %}
+  </div>
+  {% else %}
+  <p style="font-size:0.85rem;color:var(--text-muted);margin:0;">
+    No readings yet — waiting for next poll cycle.
+  </p>
+  {% endif %}
+</div>
+{% endfor %}
+
+{% endif %}
+{% endblock %}

plugins/snmp/templates/snmp/widget.html

@@ -0,0 +1,49 @@
+{# plugins/snmp/templates/snmp/widget.html #}
+{% if devices %}
+{% for device in devices %}
+<div class="ping-row" style="align-items:flex-start;flex-direction:column;gap:0.3rem;padding:0.4rem 0;">
+  <div style="display:flex;align-items:center;gap:0.6rem;width:100%;">
+    <span style="font-size:0.82rem;font-weight:500;flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;">
+      {{ device.name }}
+    </span>
+    {% if device.readings %}
+    <span style="font-size:0.7rem;color:var(--green);">&#9679;</span>
+    {% else %}
+    <span style="font-size:0.7rem;color:var(--text-dim);">&#9675;</span>
+    {% endif %}
+    <a href="/plugins/snmp/device/{{ device.name }}" style="font-size:0.72rem;color:var(--text-muted);">detail →</a>
+  </div>
+  {% if device.readings %}
+  <div style="display:flex;flex-wrap:wrap;gap:0.5rem 1rem;padding-left:0.1rem;">
+    {% for oid_cfg in device.oids[:4] %}
+    {% set label = oid_cfg.label if oid_cfg.label else oid_cfg.oid %}
+    {% set val = device.readings.get(label) %}
+    {% if val is not none %}
+    <span style="font-size:0.78rem;font-variant-numeric:tabular-nums;">
+      <span style="color:var(--text-muted);">{{ label }}</span>
+      <span style="margin-left:0.25rem;">
+        {% if val >= 1000000 %}{{ "%.1f"|format(val / 1000000) }}M
+        {% elif val >= 1000 %}{{ "%.0f"|format(val / 1000) }}K
+        {% else %}{{ "%.4g"|format(val) }}{% endif %}
+      </span>
+    </span>
+    {% endif %}
+    {% endfor %}
+    {% if device.oids|length > 4 %}
+    <span style="font-size:0.72rem;color:var(--text-dim);">+{{ device.oids|length - 4 }} more</span>
+    {% endif %}
+  </div>
+  {% endif %}
+</div>
+{% if not loop.last %}
+<div style="height:1px;background:var(--border-low);margin:0.1rem 0;"></div>
+{% endif %}
+{% endfor %}
+{% if total > devices|length %}
+<div style="color:var(--text-dim);font-size:0.75rem;padding:0.25rem 0;">
+  +{{ total - devices|length }} more — <a href="/plugins/snmp/">view all →</a>
+</div>
+{% endif %}
+{% else %}
+<p class="empty" style="padding:0.5rem 0;font-size:0.85rem;">No SNMP devices configured.</p>
+{% endif %}

plugins/traefik/__init__.py

@@ -0,0 +1,30 @@
+# plugins/traefik/__init__.py
+from __future__ import annotations
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from quart import Quart
+
+_app: "Quart | None" = None
+
+
+def setup(app: "Quart") -> None:
+    global _app
+    _app = app
+    from .models import TraefikMetric, TraefikCert, TraefikGlobalStat, TraefikAccessSummary  # noqa: F401
+
+
+def get_scheduled_tasks() -> list:
+    from .scheduler import make_scrape_task, make_access_log_task
+    tasks = [make_scrape_task(_app)]
+    access_log_cfg = _app.config["PLUGINS"]["traefik"].get("access_log", {})
+    if not isinstance(access_log_cfg, dict):
+        access_log_cfg = {}
+    if access_log_cfg.get("enabled", False):
+        tasks.append(make_access_log_task(_app))
+    return tasks
+
+
+def get_blueprint():
+    from .routes import traefik_bp
+    return traefik_bp

plugins/traefik/access_log.py

@@ -0,0 +1,199 @@
+# plugins/traefik/access_log.py
+"""Traefik JSON access log tailer and traffic-origin aggregator.
+
+Reads new lines from Traefik's JSON access log on each scheduler tick,
+classifies source IPs as internal (RFC1918) or external, optionally
+looks up country codes via MaxMind GeoLite2, and returns an aggregated
+summary ready to persist in TraefikAccessSummary.
+"""
+from __future__ import annotations
+
+import ipaddress
+import json
+from collections import defaultdict
+from pathlib import Path
+
+# ── Module-level file-position state ─────────────────────────────────────────
+_log_position: int = 0   # byte offset of last read
+_log_inode: int = 0      # detect rotation by inode change
+
+# ── Private IP ranges (RFC1918 + loopback + link-local) ──────────────────────
+_PRIVATE_NETS = [
+    ipaddress.ip_network("10.0.0.0/8"),
+    ipaddress.ip_network("172.16.0.0/12"),
+    ipaddress.ip_network("192.168.0.0/16"),
+    ipaddress.ip_network("127.0.0.0/8"),
+    ipaddress.ip_network("169.254.0.0/16"),
+    ipaddress.ip_network("::1/128"),
+    ipaddress.ip_network("fc00::/7"),
+    ipaddress.ip_network("fe80::/10"),
+]
+
+
+def _strip_port(raw: str) -> str:
+    """Strip trailing :port from an IPv4 address string. Leaves IPv6 untouched."""
+    if not raw:
+        return raw
+    # Bracketed IPv6 with port: [::1]:12345
+    if raw.startswith("["):
+        return raw[1:raw.index("]")] if "]" in raw else raw
+    # IPv4:port has exactly one colon
+    if raw.count(":") == 1:
+        return raw.rsplit(":", 1)[0]
+    return raw
+
+
+def is_internal(raw_ip: str) -> bool:
+    """Return True if the address falls within a private/loopback range."""
+    ip_str = _strip_port(raw_ip)
+    try:
+        addr = ipaddress.ip_address(ip_str)
+        return any(addr in net for net in _PRIVATE_NETS)
+    except ValueError:
+        return False
+
+
+def _country(ip_str: str, geoip_db) -> str | None:
+    """Return ISO country code via an open maxminddb reader, or None."""
+    if geoip_db is None:
+        return None
+    clean = _strip_port(ip_str)
+    try:
+        record = geoip_db.get(clean)
+        if record:
+            return record.get("country", {}).get("iso_code")
+    except Exception:
+        pass
+    return None
+
+
+def read_new_lines(log_path: str) -> list[dict]:
+    """Return all new JSON-parsed access log entries since the last call.
+
+    Handles log rotation: if the file shrinks or its inode changes, we
+    reset to the beginning of the new file.
+    """
+    global _log_position, _log_inode
+
+    path = Path(log_path)
+    if not path.exists():
+        return []
+
+    try:
+        stat = path.stat()
+    except OSError:
+        return []
+
+    current_inode = stat.st_ino
+    current_size = stat.st_size
+
+    # Rotation detected
+    if current_inode != _log_inode or current_size < _log_position:
+        _log_position = 0
+        _log_inode = current_inode
+
+    if current_size == _log_position:
+        return []
+
+    entries: list[dict] = []
+    try:
+        with open(log_path, "rb") as f:
+            f.seek(_log_position)
+            raw = f.read(current_size - _log_position)
+            _log_position = current_size
+    except OSError:
+        return []
+
+    for raw_line in raw.split(b"\n"):
+        raw_line = raw_line.strip()
+        if not raw_line:
+            continue
+        try:
+            entries.append(json.loads(raw_line))
+        except json.JSONDecodeError:
+            continue
+
+    return entries
+
+
+def aggregate(entries: list[dict], geoip_db=None, top_n: int = 10) -> dict | None:
+    """Aggregate a batch of access log entries into a summary dict.
+
+    Returns None if there are no entries.
+    Result keys map directly to TraefikAccessSummary columns (excluding
+    id and period_start/period_end, which the caller provides).
+    """
+    if not entries:
+        return None
+
+    total = 0
+    internal = 0
+    external = 0
+    total_bytes = 0.0
+
+    by_router: dict[str, int] = defaultdict(int)
+    ip_counts: dict[str, int] = defaultdict(int)
+    ip_internal: dict[str, bool] = {}
+    ip_country: dict[str, str | None] = {}
+    country_counts: dict[str, int] = defaultdict(int)
+
+    for entry in entries:
+        total += 1
+        raw_ip = entry.get("ClientHost", "")
+        router = entry.get("RouterName") or entry.get("ServiceName") or "unknown"
+        total_bytes += entry.get("DownstreamContentSize") or 0
+
+        by_router[router] += 1
+
+        internal_flag = is_internal(raw_ip)
+        if internal_flag:
+            internal += 1
+        else:
+            external += 1
+            if raw_ip not in ip_country:
+                ip_country[raw_ip] = _country(raw_ip, geoip_db)
+            c = ip_country[raw_ip]
+            if c:
+                country_counts[c] += 1
+
+        ip_counts[raw_ip] += 1
+        ip_internal[raw_ip] = internal_flag
+
+    top_ips = [
+        {
+            "ip": ip,
+            "count": cnt,
+            "internal": ip_internal[ip],
+            "country": ip_country.get(ip),
+        }
+        for ip, cnt in sorted(ip_counts.items(), key=lambda x: x[1], reverse=True)[:top_n]
+    ]
+    top_countries = [
+        {"country": c, "count": n}
+        for c, n in sorted(country_counts.items(), key=lambda x: x[1], reverse=True)[:top_n]
+    ]
+    top_routers = [
+        {"router": r, "count": n}
+        for r, n in sorted(by_router.items(), key=lambda x: x[1], reverse=True)[:top_n]
+    ]
+
+    return {
+        "total_requests": total,
+        "internal_requests": internal,
+        "external_requests": external,
+        "total_bytes": total_bytes,
+        "top_ips_json": json.dumps(top_ips),
+        "top_countries_json": json.dumps(top_countries),
+        "top_routers_json": json.dumps(top_routers),
+    }
+
+
+def open_geoip(db_path: str | None):
+    """Open a MaxMind mmdb file if available. Returns None if not configured or missing."""
+    if not db_path:
+        return None
+    try:
+        import maxminddb  # type: ignore[import]
+        return maxminddb.open_database(db_path)
+    except Exception:
+        return None

plugins/traefik/migrations/env.py

@@ -0,0 +1,75 @@
+# plugins/traefik/migrations/env.py
+"""Alembic env.py for the Traefik plugin.
+
+For standalone use during plugin development.
+At app startup, migration_runner.py uses the core env.py with version_locations.
+"""
+import asyncio
+import os
+import sys
+from pathlib import Path
+from logging.config import fileConfig
+
+from sqlalchemy import pool
+from sqlalchemy.engine import Connection
+from sqlalchemy.ext.asyncio import async_engine_from_config
+from alembic import context
+
+# Make steward importable
+sys.path.insert(0, str(Path(__file__).parent.parent.parent.parent))
+
+from steward.models.base import Base
+import steward.models  # noqa: F401 — core models
+from plugins.traefik.models import TraefikMetric  # noqa: F401 — plugin model
+
+config = context.config
+if config.config_file_name is not None:
+    fileConfig(config.config_file_name)
+
+target_metadata = Base.metadata
+
+
+def _get_url() -> str:
+    import yaml
+    cfg_path = os.environ.get("STEWARD_CONFIG", "config.yaml")
+    try:
+        with open(cfg_path) as f:
+            cfg = yaml.safe_load(f) or {}
+        url = cfg.get("database", {}).get("url", "")
+    except FileNotFoundError:
+        url = ""
+    return os.environ.get("STEWARD_DATABASE__URL", url)
+
+
+def run_migrations_offline() -> None:
+    context.configure(
+        url=_get_url(), target_metadata=target_metadata,
+        literal_binds=True, dialect_opts={"paramstyle": "named"},
+    )
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+def do_run_migrations(connection: Connection) -> None:
+    context.configure(connection=connection, target_metadata=target_metadata)
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+async def run_async_migrations() -> None:
+    cfg = config.get_section(config.config_ini_section, {})
+    cfg["sqlalchemy.url"] = _get_url()
+    connectable = async_engine_from_config(cfg, prefix="sqlalchemy.", poolclass=pool.NullPool)
+    async with connectable.connect() as connection:
+        await connection.run_sync(do_run_migrations)
+    await connectable.dispose()
+
+
+def run_migrations_online() -> None:
+    asyncio.run(run_async_migrations())
+
+
+if context.is_offline_mode():
+    run_migrations_offline()
+else:
+    run_migrations_online()

plugins/traefik/migrations/versions/traefik_001_initial.py

@@ -0,0 +1,37 @@
+# plugins/traefik/migrations/versions/traefik_001_initial.py
+"""Traefik metrics table
+
+Revision ID: traefik_001_initial
+Revises: (none — this is a branch off the core head via depends_on)
+Create Date: 2026-03-17
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "traefik_001_initial"
+down_revision: Union[str, None] = None
+branch_labels: Union[str, Sequence[str], None] = "traefik"
+depends_on: Union[str, Sequence[str], None] = ("0004_app_settings",)
+
+
+def upgrade() -> None:
+    op.create_table(
+        "traefik_metrics",
+        sa.Column("id", sa.String(36), primary_key=True),
+        sa.Column("router_name", sa.String(255), nullable=False),
+        sa.Column("scraped_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("request_rate", sa.Float, nullable=False),
+        sa.Column("error_rate_4xx_pct", sa.Float, nullable=False),
+        sa.Column("error_rate_5xx_pct", sa.Float, nullable=False),
+        sa.Column("latency_p50_ms", sa.Float, nullable=False),
+        sa.Column("latency_p95_ms", sa.Float, nullable=False),
+        sa.Column("latency_p99_ms", sa.Float, nullable=False),
+    )
+    op.create_index("ix_traefik_metrics_router_scraped", "traefik_metrics",
+                    ["router_name", "scraped_at"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_traefik_metrics_router_scraped", "traefik_metrics")
+    op.drop_table("traefik_metrics")

plugins/traefik/migrations/versions/traefik_002_stats.py

@@ -0,0 +1,48 @@
+"""Traefik extended stats: bandwidth, certs, global stats
+
+Revision ID: traefik_002_stats
+Revises: traefik_001_initial
+Create Date: 2026-03-19
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "traefik_002_stats"
+down_revision: Union[str, None] = "traefik_001_initial"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "traefik_metrics",
+        sa.Column("response_bytes_rate", sa.Float, nullable=False, server_default="0"),
+    )
+
+    op.create_table(
+        "traefik_certs",
+        sa.Column("serial", sa.String(255), primary_key=True),
+        sa.Column("cn", sa.String(512), nullable=True),
+        sa.Column("sans", sa.Text, nullable=True),
+        sa.Column("not_after", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("scraped_at", sa.DateTime(timezone=True), nullable=False),
+    )
+
+    op.create_table(
+        "traefik_global_stats",
+        sa.Column("id", sa.String(36), primary_key=True),
+        sa.Column("scraped_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("open_conns_total", sa.Float, nullable=True),
+        sa.Column("config_reloads_total", sa.Float, nullable=True),
+        sa.Column("config_last_reload_success", sa.Float, nullable=True),
+        sa.Column("process_memory_bytes", sa.Float, nullable=True),
+    )
+    op.create_index("ix_traefik_global_stats_scraped", "traefik_global_stats", ["scraped_at"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_traefik_global_stats_scraped", "traefik_global_stats")
+    op.drop_table("traefik_global_stats")
+    op.drop_table("traefik_certs")
+    op.drop_column("traefik_metrics", "response_bytes_rate")

plugins/traefik/migrations/versions/traefik_003_access_log.py

@@ -0,0 +1,40 @@
+"""Traefik access log traffic summaries
+
+Revision ID: traefik_003_access_log
+Revises: traefik_002_stats
+Create Date: 2026-03-20
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "traefik_003_access_log"
+down_revision: Union[str, None] = "traefik_002_stats"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "traefik_access_summaries",
+        sa.Column("id", sa.String(36), primary_key=True),
+        sa.Column("period_start", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("period_end", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("total_requests", sa.Integer, nullable=False, server_default="0"),
+        sa.Column("internal_requests", sa.Integer, nullable=False, server_default="0"),
+        sa.Column("external_requests", sa.Integer, nullable=False, server_default="0"),
+        sa.Column("total_bytes", sa.Float, nullable=False, server_default="0"),
+        sa.Column("top_ips_json", sa.Text, nullable=False, server_default="[]"),
+        sa.Column("top_countries_json", sa.Text, nullable=False, server_default="[]"),
+        sa.Column("top_routers_json", sa.Text, nullable=False, server_default="[]"),
+    )
+    op.create_index(
+        "ix_traefik_access_summaries_period_end",
+        "traefik_access_summaries",
+        ["period_end"],
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ix_traefik_access_summaries_period_end", "traefik_access_summaries")
+    op.drop_table("traefik_access_summaries")

plugins/traefik/models.py

@@ -0,0 +1,67 @@
+# plugins/traefik/models.py
+from __future__ import annotations
+import uuid
+from datetime import datetime, timezone
+from sqlalchemy import DateTime, Float, Integer, String, Text
+from sqlalchemy.orm import Mapped, mapped_column
+from steward.models.base import Base
+
+
+class TraefikMetric(Base):
+    __tablename__ = "traefik_metrics"
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
+    router_name: Mapped[str] = mapped_column(String(255), nullable=False)
+    scraped_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, default=lambda: datetime.now(timezone.utc)
+    )
+    request_rate: Mapped[float] = mapped_column(Float, nullable=False)
+    error_rate_4xx_pct: Mapped[float] = mapped_column(Float, nullable=False)
+    error_rate_5xx_pct: Mapped[float] = mapped_column(Float, nullable=False)
+    latency_p50_ms: Mapped[float] = mapped_column(Float, nullable=False)
+    latency_p95_ms: Mapped[float] = mapped_column(Float, nullable=False)
+    latency_p99_ms: Mapped[float] = mapped_column(Float, nullable=False)
+    response_bytes_rate: Mapped[float] = mapped_column(Float, nullable=False, default=0.0)
+
+
+class TraefikCert(Base):
+    """TLS certificate expiry tracking — upserted by serial each scrape."""
+    __tablename__ = "traefik_certs"
+
+    serial: Mapped[str] = mapped_column(String(255), primary_key=True)
+    cn: Mapped[str | None] = mapped_column(String(512), nullable=True)
+    sans: Mapped[str | None] = mapped_column(Text, nullable=True)
+    not_after: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    scraped_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, default=lambda: datetime.now(timezone.utc)
+    )
+
+
+class TraefikAccessSummary(Base):
+    """Aggregated traffic-origin summary — one row per scheduler tick."""
+    __tablename__ = "traefik_access_summaries"
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
+    period_start: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    period_end: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    total_requests: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    internal_requests: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    external_requests: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    total_bytes: Mapped[float] = mapped_column(Float, nullable=False, default=0.0)
+    top_ips_json: Mapped[str] = mapped_column(Text, nullable=False, default="[]")
+    top_countries_json: Mapped[str] = mapped_column(Text, nullable=False, default="[]")
+    top_routers_json: Mapped[str] = mapped_column(Text, nullable=False, default="[]")
+
+
+class TraefikGlobalStat(Base):
+    """One row per scrape — process-level and config stats."""
+    __tablename__ = "traefik_global_stats"
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
+    scraped_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, default=lambda: datetime.now(timezone.utc)
+    )
+    open_conns_total: Mapped[float | None] = mapped_column(Float, nullable=True)
+    config_reloads_total: Mapped[float | None] = mapped_column(Float, nullable=True)
+    config_last_reload_success: Mapped[float | None] = mapped_column(Float, nullable=True)
+    process_memory_bytes: Mapped[float | None] = mapped_column(Float, nullable=True)

plugins/traefik/plugin.yaml

@@ -0,0 +1,21 @@
+# plugins/traefik/plugin.yaml
+name: traefik
+version: "1.0.0"
+description: "Traefik reverse proxy metrics and access log integration"
+author: "Steward"
+license: "MIT"
+min_app_version: "0.1.0"
+repository_url: "https://git.fabledsword.com/bvandeusen/Steward-plugins"
+homepage: "https://git.fabledsword.com/bvandeusen/Steward-plugins/src/branch/main/traefik"
+tags:
+  - proxy
+  - metrics
+  - access-log
+
+config:
+  metrics_url: "http://localhost:8080/metrics"
+  scrape_interval_seconds: 60
+  access_log:
+    enabled: false
+    path: "/var/log/traefik/access.log"
+    geoip_db: ""          # optional: path to MaxMind GeoLite2-Country.mmdb

plugins/traefik/routes.py

@@ -0,0 +1,373 @@
+# plugins/traefik/routes.py
+from __future__ import annotations
+from collections import defaultdict
+from datetime import datetime, timezone
+from quart import Blueprint, current_app, render_template, request
+from sqlalchemy import Integer, cast, func, select
+import json
+
+from steward.auth.middleware import require_role
+from steward.models.users import UserRole
+from steward.core.time_range import parse_range, DEFAULT_RANGE, bucket_seconds, subsample
+from .models import TraefikAccessSummary, TraefikCert, TraefikGlobalStat, TraefikMetric
+
+traefik_bp = Blueprint("traefik", __name__, template_folder="templates")
+
+
+def _sparkline(values: list[float], width: int = 80, height: int = 20) -> str:
+    """Generate an inline SVG sparkline from a list of float values."""
+    if len(values) < 2:
+        return f'<svg width="{width}" height="{height}"></svg>'
+    mn, mx = min(values), max(values)
+    if mx == mn:
+        mx = mn + 1.0
+    step = width / (len(values) - 1)
+    pts = []
+    for i, v in enumerate(values):
+        x = i * step
+        y = height - (v - mn) / (mx - mn) * (height - 2) - 1
+        pts.append(f"{x:.1f},{y:.1f}")
+    poly = " ".join(pts)
+    return (
+        f'<svg width="{width}" height="{height}" viewBox="0 0 {width} {height}" '
+        f'style="vertical-align:middle;">'
+        f'<polyline points="{poly}" fill="none" stroke="#6060c0" stroke-width="1.5"/>'
+        f'</svg>'
+    )
+
+
+@traefik_bp.get("/")
+@require_role(UserRole.viewer)
+async def index():
+    poll_interval = current_app.config.get("MONITORS_POLL_INTERVAL", 60)
+    _al_cfg = current_app.config["PLUGINS"]["traefik"].get("access_log", {})
+    if not isinstance(_al_cfg, dict):
+        _al_cfg = {}
+    access_log_enabled = _al_cfg.get("enabled", False)
+    current_range = request.args.get("range", DEFAULT_RANGE)
+    return await render_template(
+        "traefik/index.html",
+        poll_interval=poll_interval,
+        access_log_enabled=access_log_enabled,
+        current_range=current_range,
+    )
+
+
+@traefik_bp.get("/rows")
+@require_role(UserRole.viewer)
+async def rows():
+    """HTMX fragment: service cards with sparklines scoped to selected time range."""
+    since, range_key = parse_range(request.args.get("range"))
+    now = datetime.now(timezone.utc)
+
+    async with current_app.db_sessionmaker() as db:
+        # All known routers
+        result = await db.execute(
+            select(TraefikMetric.router_name)
+            .distinct()
+            .order_by(TraefikMetric.router_name)
+        )
+        routers = [row[0] for row in result.all()]
+
+        b_secs = bucket_seconds(since)
+        bucket_col = (
+            cast(func.extract('epoch', TraefikMetric.scraped_at), Integer) / b_secs
+        ).label("bucket")
+
+        router_data = []
+        for router in routers:
+            # Bucketed history for sparklines — always ~80 points regardless of range
+            result = await db.execute(
+                select(
+                    func.avg(TraefikMetric.request_rate).label("request_rate"),
+                    func.avg(TraefikMetric.latency_p95_ms).label("latency_p95_ms"),
+                    func.avg(TraefikMetric.error_rate_5xx_pct).label("error_rate_5xx_pct"),
+                    func.min(TraefikMetric.scraped_at).label("scraped_at"),
+                    bucket_col,
+                )
+                .where(TraefikMetric.router_name == router)
+                .where(TraefikMetric.scraped_at >= since)
+                .group_by(bucket_col)
+                .order_by(bucket_col)
+            )
+            history = result.all()
+
+            # Latest value — always the most recent raw row
+            result = await db.execute(
+                select(TraefikMetric)
+                .where(TraefikMetric.router_name == router)
+                .order_by(TraefikMetric.scraped_at.desc())
+                .limit(1)
+            )
+            latest = result.scalar_one_or_none()
+            if not latest:
+                continue
+
+            router_data.append({
+                "name": router,
+                "latest": latest,
+                "sparkline_req": _sparkline([r.request_rate for r in history]),
+                "sparkline_p95": _sparkline([r.latency_p95_ms for r in history]),
+                "sparkline_5xx": _sparkline([r.error_rate_5xx_pct for r in history]),
+            })
+
+        # Latest global stat (always most recent, not range-filtered)
+        result = await db.execute(
+            select(TraefikGlobalStat)
+            .order_by(TraefikGlobalStat.scraped_at.desc())
+            .limit(1)
+        )
+        global_stat = result.scalar_one_or_none()
+
+        # All certs, sorted by soonest expiry
+        result = await db.execute(
+            select(TraefikCert).order_by(TraefikCert.not_after)
+        )
+        raw_certs = result.scalars().all()
+
+    certs = []
+    for c in raw_certs:
+        days = (c.not_after - now).total_seconds() / 86400.0
+        certs.append({
+            "serial": c.serial,
+            "cn": c.cn or c.serial,
+            "sans": c.sans,
+            "not_after": c.not_after,
+            "days_remaining": days,
+        })
+
+    return await render_template(
+        "traefik/rows.html",
+        router_data=router_data,
+        global_stat=global_stat,
+        certs=certs,
+        range_key=range_key,
+    )
+
+
+@traefik_bp.get("/widget")
+@require_role(UserRole.viewer)
+async def widget():
+    """HTMX dashboard widget fragment."""
+    now = datetime.now(timezone.utc)
+
+    async with current_app.db_sessionmaker() as db:
+        result = await db.execute(
+            select(TraefikMetric.router_name).distinct().order_by(TraefikMetric.router_name)
+        )
+        routers = [row[0] for row in result.all()]
+        router_data = []
+        for router in routers:
+            result = await db.execute(
+                select(TraefikMetric)
+                .where(TraefikMetric.router_name == router)
+                .order_by(TraefikMetric.scraped_at.desc())
+                .limit(1)
+            )
+            latest = result.scalar_one_or_none()
+            if latest:
+                router_data.append({"name": router, "latest": latest})
+
+        router_data.sort(key=lambda r: (
+            -(1 if r["latest"].error_rate_5xx_pct > 0.1 else 0),
+            -(1 if r["latest"].error_rate_4xx_pct > 5.0 else 0),
+            -r["latest"].request_rate,
+        ))
+        total_routers = len(router_data)
+        router_data = router_data[:5]
+
+        result = await db.execute(
+            select(TraefikCert).order_by(TraefikCert.not_after)
+        )
+        raw_certs = result.scalars().all()
+
+    expiring_certs = []
+    for c in raw_certs:
+        days = (c.not_after - now).total_seconds() / 86400.0
+        if days < 30:
+            expiring_certs.append({"cn": c.cn or c.serial, "days_remaining": days})
+
+    return await render_template(
+        "traefik/widget.html",
+        router_data=router_data,
+        expiring_certs=expiring_certs,
+        total_routers=total_routers,
+    )
+
+
+@traefik_bp.get("/widget/access_log")
+@require_role(UserRole.viewer)
+async def widget_access_log():
+    """HTMX dashboard widget: traffic origin summary with IP filter."""
+    from collections import defaultdict
+    ip_filter = request.args.get("ip_filter", "all")
+    limit = max(1, min(50, int(request.args.get("limit", 10) or 10)))
+    widget_id = request.args.get("wid", "0")
+
+    async with current_app.db_sessionmaker() as db:
+        result = await db.execute(
+            select(TraefikAccessSummary)
+            .order_by(TraefikAccessSummary.period_end.desc())
+            .limit(12)  # last ~1 hour of 5-min windows
+        )
+        rows = result.scalars().all()
+
+    if not rows:
+        return await render_template("traefik/widget_access_log.html",
+                                     summary=None, widget_id=widget_id)
+
+    total = sum(r.total_requests for r in rows)
+    internal = sum(r.internal_requests for r in rows)
+    external = sum(r.external_requests for r in rows)
+
+    ip_counts: dict = defaultdict(lambda: {"count": 0, "internal": True})
+    for row in rows:
+        for entry in json.loads(row.top_ips_json):
+            k = entry["ip"]
+            ip_counts[k]["count"] += entry["count"]
+            ip_counts[k]["internal"] = entry.get("internal", True)
+
+    all_ips = sorted(
+        [{"ip": k, **v} for k, v in ip_counts.items()],
+        key=lambda x: x["count"], reverse=True,
+    )
+    if ip_filter == "internal":
+        all_ips = [e for e in all_ips if e["internal"]]
+    elif ip_filter == "external":
+        all_ips = [e for e in all_ips if not e["internal"]]
+
+    summary = {
+        "total": total,
+        "internal": internal,
+        "external": external,
+        "external_pct": (external / total * 100.0) if total else 0.0,
+        "top_ips": all_ips[:limit],
+        "ip_filter": ip_filter,
+    }
+    return await render_template("traefik/widget_access_log.html",
+                                 summary=summary, widget_id=widget_id)
+
+
+@traefik_bp.get("/widget/request_chart")
+@require_role(UserRole.viewer)
+async def widget_request_chart():
+    """HTMX dashboard widget: Chart.js request rate + error % over time."""
+    from datetime import timedelta
+    hours = max(1, min(24, int(request.args.get("hours", 6) or 6)))
+    widget_id = request.args.get("wid", "0")
+
+    since = datetime.now(timezone.utc) - timedelta(hours=hours)
+    b_secs = max(60, (hours * 3600) // 80)  # ~80 buckets
+
+    bucket_col = (
+        cast(func.extract('epoch', TraefikMetric.scraped_at), Integer) / b_secs
+    ).label("bucket")
+
+    async with current_app.db_sessionmaker() as db:
+        result = await db.execute(
+            select(
+                func.avg(TraefikMetric.request_rate).label("req_rate"),
+                func.avg(TraefikMetric.error_rate_5xx_pct).label("err_pct"),
+                func.min(TraefikMetric.scraped_at).label("scraped_at"),
+                bucket_col,
+            )
+            .where(TraefikMetric.scraped_at >= since)
+            .group_by(bucket_col)
+            .order_by(bucket_col)
+        )
+        history = result.all()
+
+    labels = list(range(len(history)))
+    req_rates = [round(r.req_rate or 0, 3) for r in history]
+    err_pcts = [round(r.err_pct or 0, 2) for r in history]
+
+    return await render_template(
+        "traefik/widget_request_chart.html",
+        labels_json=json.dumps(labels),
+        req_rate_json=json.dumps(req_rates),
+        error_rate_json=json.dumps(err_pcts),
+        widget_id=widget_id,
+        hours=hours,
+    )
+
+
+@traefik_bp.get("/traffic")
+@require_role(UserRole.viewer)
+async def traffic():
+    """HTMX fragment: traffic origin summary scoped to selected time range."""
+    since, range_key = parse_range(request.args.get("range"))
+
+    async with current_app.db_sessionmaker() as db:
+        result = await db.execute(
+            select(TraefikAccessSummary)
+            .where(TraefikAccessSummary.period_end >= since)
+            .order_by(TraefikAccessSummary.period_end.asc())
+            # No LIMIT — all summaries in range needed for accurate totals;
+            # sparkline subsamples to 80 points afterwards
+        )
+        rows = result.scalars().all()
+
+    if not rows:
+        return await render_template(
+            "traefik/traffic.html", summary=None, history=[], range_key=range_key
+        )
+
+    total = sum(r.total_requests for r in rows)
+    internal = sum(r.internal_requests for r in rows)
+    external = sum(r.external_requests for r in rows)
+    total_bytes = sum(r.total_bytes for r in rows)
+
+    ip_counts: dict = defaultdict(lambda: {"count": 0, "internal": True, "country": None})
+    country_counts: dict[str, int] = defaultdict(int)
+    router_counts: dict[str, int] = defaultdict(int)
+
+    for row in rows:
+        for entry in json.loads(row.top_ips_json):
+            k = entry["ip"]
+            ip_counts[k]["count"] += entry["count"]
+            ip_counts[k]["internal"] = entry["internal"]
+            ip_counts[k]["country"] = entry.get("country")
+        for entry in json.loads(row.top_countries_json):
+            country_counts[entry["country"]] += entry["count"]
+        for entry in json.loads(row.top_routers_json):
+            router_counts[entry["router"]] += entry["count"]
+
+    top_ips = sorted(
+        [{"ip": k, **v} for k, v in ip_counts.items()],
+        key=lambda x: x["count"], reverse=True
+    )[:10]
+    top_countries = sorted(
+        [{"country": k, "count": v} for k, v in country_counts.items()],
+        key=lambda x: x["count"], reverse=True
+    )[:10]
+    top_routers = sorted(
+        [{"router": k, "count": v} for k, v in router_counts.items()],
+        key=lambda x: x["count"], reverse=True
+    )[:10]
+
+    history = [
+        {
+            "period_end": r.period_end,
+            "external_pct": (r.external_requests / r.total_requests * 100.0)
+            if r.total_requests else 0.0,
+        }
+        for r in rows
+    ]
+
+    summary = {
+        "total": total,
+        "internal": internal,
+        "external": external,
+        "total_bytes": total_bytes,
+        "external_pct": (external / total * 100.0) if total else 0.0,
+        "top_ips": top_ips,
+        "top_countries": top_countries,
+        "top_routers": top_routers,
+        "sparkline_external": _sparkline(
+            [h["external_pct"] for h in subsample(history, 80)]
+        ),
+    }
+
+    return await render_template(
+        "traefik/traffic.html", summary=summary, history=history, range_key=range_key
+    )

plugins/traefik/scheduler.py

@@ -0,0 +1,203 @@
+# plugins/traefik/scheduler.py
+from __future__ import annotations
+import logging
+import time
+from typing import TYPE_CHECKING
+
+from datetime import datetime
+from steward.core.scheduler import ScheduledTask
+
+if TYPE_CHECKING:
+    from quart import Quart
+
+logger = logging.getLogger(__name__)
+
+# Module-level state: previous scrape data for delta computation
+_prev_metrics: dict = {}
+_prev_time: float = 0.0
+
+# Access log state
+_geoip_db = None
+_access_log_last_tick: "datetime | None" = None
+
+
+def make_scrape_task(app: "Quart") -> ScheduledTask:
+    """Return a ScheduledTask that scrapes Traefik metrics on the configured interval."""
+    interval = app.config["PLUGINS"]["traefik"]["scrape_interval_seconds"]
+
+    async def scrape() -> None:
+        await _do_scrape(app)
+
+    return ScheduledTask(
+        name="traefik_scrape",
+        coro_factory=scrape,
+        interval_seconds=int(interval),
+        run_on_startup=True,
+    )
+
+
+async def _do_scrape(app: "Quart") -> None:
+    """Fetch Traefik metrics, write to DB, and emit plugin_metrics."""
+    global _prev_metrics, _prev_time
+
+    from datetime import datetime, timezone
+    from .models import TraefikCert, TraefikGlobalStat, TraefikMetric
+    from .scraper import (
+        compute_global_stats,
+        compute_router_metrics,
+        extract_certs,
+        fetch_metrics,
+    )
+    from steward.core.alerts import record_metric
+
+    metrics_url: str = app.config["PLUGINS"]["traefik"]["metrics_url"]
+
+    try:
+        current = await fetch_metrics(metrics_url)
+    except Exception:
+        logger.exception("Traefik scrape failed (url=%s)", metrics_url)
+        return
+
+    now = time.monotonic()
+    elapsed = now - _prev_time if _prev_time else 60.0
+    router_metrics = compute_router_metrics(current, _prev_metrics or None, elapsed)
+    global_stats = compute_global_stats(current, _prev_metrics or None)
+    cert_list = extract_certs(current)
+
+    _prev_metrics = current
+    _prev_time = now
+
+    scraped_at = datetime.now(timezone.utc)
+
+    async with app.db_sessionmaker() as session:
+        async with session.begin():
+            # ── Per-service metrics ───────────────────────────────────────────
+            for router_name, metrics in router_metrics.items():
+                row = TraefikMetric(
+                    router_name=router_name,
+                    scraped_at=scraped_at,
+                    request_rate=metrics["request_rate"],
+                    error_rate_4xx_pct=metrics["error_rate_4xx_pct"],
+                    error_rate_5xx_pct=metrics["error_rate_5xx_pct"],
+                    latency_p50_ms=metrics["latency_p50_ms"],
+                    latency_p95_ms=metrics["latency_p95_ms"],
+                    latency_p99_ms=metrics["latency_p99_ms"],
+                    response_bytes_rate=metrics["response_bytes_rate"],
+                )
+                session.add(row)
+
+                for metric_name, value in [
+                    ("request_rate", metrics["request_rate"]),
+                    ("error_rate_4xx_pct", metrics["error_rate_4xx_pct"]),
+                    ("error_rate_5xx_pct", metrics["error_rate_5xx_pct"]),
+                    ("latency_p50_ms", metrics["latency_p50_ms"]),
+                    ("latency_p95_ms", metrics["latency_p95_ms"]),
+                    ("latency_p99_ms", metrics["latency_p99_ms"]),
+                    ("response_bytes_rate", metrics["response_bytes_rate"]),
+                ]:
+                    await record_metric(
+                        session=session,
+                        source_module="traefik",
+                        resource_name=router_name,
+                        metric_name=metric_name,
+                        value=value,
+                    )
+
+            # ── Global stats ──────────────────────────────────────────────────
+            session.add(TraefikGlobalStat(scraped_at=scraped_at, **global_stats))
+
+            # ── TLS certs (upsert by serial) ──────────────────────────────────
+            for cert in cert_list:
+                existing = await session.get(TraefikCert, cert["serial"])
+                if existing:
+                    existing.cn = cert["cn"]
+                    existing.sans = cert["sans"]
+                    existing.not_after = cert["not_after"]
+                    existing.scraped_at = scraped_at
+                else:
+                    session.add(TraefikCert(
+                        serial=cert["serial"],
+                        cn=cert["cn"],
+                        sans=cert["sans"],
+                        not_after=cert["not_after"],
+                        scraped_at=scraped_at,
+                    ))
+
+                # Emit cert_expiry_days for alert rules
+                days_remaining = (cert["not_after"] - scraped_at).total_seconds() / 86400.0
+                await record_metric(
+                    session=session,
+                    source_module="traefik",
+                    resource_name=cert["cn"] or cert["serial"],
+                    metric_name="cert_expiry_days",
+                    value=max(0.0, days_remaining),
+                )
+
+    logger.debug(
+        "Traefik scrape: %d router(s), %d cert(s)",
+        len(router_metrics),
+        len(cert_list),
+    )
+
+
+def make_access_log_task(app: "Quart") -> ScheduledTask:
+    """Return a ScheduledTask that processes new Traefik access log lines."""
+    global _geoip_db
+    cfg = app.config["PLUGINS"]["traefik"].get("access_log", {})
+    if not isinstance(cfg, dict):
+        cfg = {}
+    log_path: str = cfg.get("path", "/var/log/traefik/access.log")
+    geoip_path: str = cfg.get("geoip_db", "")
+
+    from .access_log import open_geoip
+    _geoip_db = open_geoip(geoip_path or None)
+    if _geoip_db:
+        logger.info("Traefik access log: GeoIP database loaded from %s", geoip_path)
+    else:
+        logger.info("Traefik access log: GeoIP not configured, country lookup disabled")
+
+    interval = app.config["PLUGINS"]["traefik"]["scrape_interval_seconds"]
+
+    async def process() -> None:
+        await _do_access_log(app, log_path)
+
+    return ScheduledTask(
+        name="traefik_access_log",
+        coro_factory=process,
+        interval_seconds=int(interval),
+        run_on_startup=True,
+    )
+
+
+async def _do_access_log(app: "Quart", log_path: str) -> None:
+    """Read new access log lines, aggregate, and persist a summary."""
+    global _access_log_last_tick
+
+    from datetime import timezone
+    from .access_log import read_new_lines, aggregate
+    from .models import TraefikAccessSummary
+
+    now = datetime.now(timezone.utc)
+    period_start = _access_log_last_tick or now
+    _access_log_last_tick = now
+
+    entries = read_new_lines(log_path)
+    summary = aggregate(entries, geoip_db=_geoip_db)
+
+    if summary is None:
+        return
+
+    async with app.db_sessionmaker() as session:
+        async with session.begin():
+            session.add(TraefikAccessSummary(
+                period_start=period_start,
+                period_end=now,
+                **summary,
+            ))
+
+    logger.debug(
+        "Traefik access log: %d requests (%d internal, %d external)",
+        summary["total_requests"],
+        summary["internal_requests"],
+        summary["external_requests"],
+    )

plugins/traefik/scraper.py

@@ -0,0 +1,276 @@
+# plugins/traefik/scraper.py
+"""Prometheus text-format scraper and per-service metrics calculator for Traefik.
+
+Traefik exposes Prometheus metrics at /metrics. This module:
+1. Fetches the endpoint via httpx
+2. Parses the Prometheus text format (counters + histograms)
+3. Computes per-service request rate (delta/elapsed), error rates (% 4xx, % 5xx),
+   latency percentiles (p50, p95, p99) via linear histogram interpolation,
+   and bandwidth (bytes/sec from response bytes counter delta)
+4. Extracts TLS certificate expiry info
+5. Computes process-level and config health stats
+"""
+from __future__ import annotations
+import math
+import re
+from collections import defaultdict
+from datetime import datetime, timezone
+
+import httpx
+
+
+# ──────────────────────────────────────────────────────────────────────────────
+# Prometheus text format parser
+# ──────────────────────────────────────────────────────────────────────────────
+
+# Parsed sample: {metric_name: {frozenset(label_items): float}}
+ParsedMetrics = dict[str, dict[frozenset, float]]
+
+_SAMPLE_RE = re.compile(
+    r'^([a-zA-Z_:][a-zA-Z0-9_:]*)(?:\{([^}]*)\})?\s+'
+    r'([+-]?(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?|[+-]?Inf|NaN)'
+)
+_LABEL_RE = re.compile(r'([a-zA-Z_][a-zA-Z0-9_]*)="([^"\\]*(?:\\.[^"\\]*)*)"')
+
+
+def parse_prometheus(text: str) -> ParsedMetrics:
+    """Parse Prometheus text exposition format into nested dicts.
+
+    Returns: {metric_name: {frozenset({(label, value), ...}): float}}
+    """
+    metrics: ParsedMetrics = {}
+    for line in text.splitlines():
+        line = line.strip()
+        if not line or line.startswith("#"):
+            continue
+        m = _SAMPLE_RE.match(line)
+        if not m:
+            continue
+        name, labels_str, value_str = m.groups()
+        try:
+            value = float(value_str)
+        except ValueError:
+            continue
+        labels = frozenset(
+            (lm.group(1), lm.group(2))
+            for lm in _LABEL_RE.finditer(labels_str or "")
+        )
+        metrics.setdefault(name, {})[labels] = value
+    return metrics
+
+
+# ──────────────────────────────────────────────────────────────────────────────
+# Per-router metric computation
+# ──────────────────────────────────────────────────────────────────────────────
+
+def compute_router_metrics(
+    current: ParsedMetrics,
+    previous: ParsedMetrics | None,
+    elapsed_seconds: float,
+) -> dict[str, dict[str, float]]:
+    """Compute per-service derived metrics from two consecutive scrapes.
+
+    Uses traefik_service_* metrics (available by default).
+
+    Returns:
+        {service_name: {
+            "request_rate": float,           # requests/sec
+            "error_rate_4xx_pct": float,     # % 4xx of total
+            "error_rate_5xx_pct": float,     # % 5xx of total
+            "latency_p50_ms": float,
+            "latency_p95_ms": float,
+            "latency_p99_ms": float,
+            "response_bytes_rate": float,    # bytes/sec
+        }}
+    """
+    prev = previous or {}
+    elapsed = max(elapsed_seconds, 1.0)
+
+    # ── Request counters ──────────────────────────────────────────────────────
+    req_samples = current.get("traefik_service_requests_total", {})
+    prev_req = prev.get("traefik_service_requests_total", {})
+
+    service_total: dict[str, float] = defaultdict(float)
+    service_4xx: dict[str, float] = defaultdict(float)
+    service_5xx: dict[str, float] = defaultdict(float)
+
+    for labels, value in req_samples.items():
+        label_dict = dict(labels)
+        service = label_dict.get("service", "")
+        if not service:
+            continue
+        code = label_dict.get("code", "")
+        prev_value = prev_req.get(labels, value)  # no delta on first scrape
+        delta = max(0.0, value - prev_value)
+        service_total[service] += delta
+        if code.startswith("4"):
+            service_4xx[service] += delta
+        elif code.startswith("5"):
+            service_5xx[service] += delta
+
+    # ── Response bytes counters ───────────────────────────────────────────────
+    bytes_samples = current.get("traefik_service_responses_bytes_total", {})
+    prev_bytes = prev.get("traefik_service_responses_bytes_total", {})
+
+    service_bytes: dict[str, float] = defaultdict(float)
+    for labels, value in bytes_samples.items():
+        service = dict(labels).get("service", "")
+        if not service:
+            continue
+        prev_value = prev_bytes.get(labels, value)
+        service_bytes[service] += max(0.0, value - prev_value)
+
+    # ── Histogram buckets ─────────────────────────────────────────────────────
+    hist_buckets = current.get("traefik_service_request_duration_seconds_bucket", {})
+
+    # Collect all known services
+    all_services: set[str] = set(service_total.keys()) | set(service_bytes.keys())
+    for labels in hist_buckets:
+        service = dict(labels).get("service", "")
+        if service:
+            all_services.add(service)
+
+    result: dict[str, dict[str, float]] = {}
+
+    for service in all_services:
+        total = service_total.get(service, 0.0)
+        result[service] = {
+            "request_rate": total / elapsed,
+            "error_rate_4xx_pct": (service_4xx.get(service, 0.0) / total * 100.0)
+            if total > 0 else 0.0,
+            "error_rate_5xx_pct": (service_5xx.get(service, 0.0) / total * 100.0)
+            if total > 0 else 0.0,
+            "latency_p50_ms": _percentile_ms(hist_buckets, service, 0.50),
+            "latency_p95_ms": _percentile_ms(hist_buckets, service, 0.95),
+            "latency_p99_ms": _percentile_ms(hist_buckets, service, 0.99),
+            "response_bytes_rate": service_bytes.get(service, 0.0) / elapsed,
+        }
+
+    return result
+
+
+def compute_global_stats(
+    current: ParsedMetrics,
+    previous: ParsedMetrics | None,
+) -> dict[str, float | None]:
+    """Extract process-level and config health metrics from a scrape.
+
+    Returns:
+        {
+            "open_conns_total": float | None,
+            "config_reloads_total": float | None,
+            "config_last_reload_success": float | None,   # 1.0 = success, 0.0 = failure
+            "process_memory_bytes": float | None,
+        }
+    """
+    stats: dict[str, float | None] = {
+        "open_conns_total": None,
+        "config_reloads_total": None,
+        "config_last_reload_success": None,
+        "process_memory_bytes": None,
+    }
+
+    # Open connections — sum across all entrypoints/protocols
+    open_conns = current.get("traefik_open_connections", {})
+    if open_conns:
+        stats["open_conns_total"] = sum(open_conns.values())
+
+    # Config reloads — sum across result labels (success + failure)
+    reloads = current.get("traefik_config_reloads_total", {})
+    if reloads:
+        stats["config_reloads_total"] = sum(reloads.values())
+
+    # Last reload success gauge
+    last_success = current.get("traefik_config_last_reload_success", {})
+    if last_success:
+        # Usually a single sample with no labels
+        stats["config_last_reload_success"] = next(iter(last_success.values()))
+
+    # Process RSS memory
+    mem = current.get("process_resident_memory_bytes", {})
+    if mem:
+        stats["process_memory_bytes"] = next(iter(mem.values()))
+
+    return stats
+
+
+def extract_certs(current: ParsedMetrics) -> list[dict]:
+    """Extract TLS certificate expiry info from traefik_tls_certs_not_after.
+
+    Returns a list of dicts:
+        [{"serial": str, "cn": str, "sans": str, "not_after": datetime}, ...]
+    """
+    certs = []
+    samples = current.get("traefik_tls_certs_not_after", {})
+    for labels, ts_value in samples.items():
+        label_dict = dict(labels)
+        serial = label_dict.get("serial", "")
+        if not serial:
+            continue
+        try:
+            not_after = datetime.fromtimestamp(ts_value, tz=timezone.utc)
+        except (ValueError, OSError, OverflowError):
+            continue
+        certs.append({
+            "serial": serial,
+            "cn": label_dict.get("cn") or None,
+            "sans": label_dict.get("sans") or None,
+            "not_after": not_after,
+        })
+    return certs
+
+
+def _percentile_ms(
+    buckets: dict[frozenset, float],
+    service: str,
+    pct: float,
+) -> float:
+    """Linear interpolation of a Prometheus histogram percentile, returned in ms."""
+    router_buckets: list[tuple[float, float]] = []
+    for labels, count in buckets.items():
+        label_dict = dict(labels)
+        if label_dict.get("service") != service:
+            continue
+        le_str = label_dict.get("le", "")
+        try:
+            le = float("inf") if le_str == "+Inf" else float(le_str)
+            router_buckets.append((le, count))
+        except ValueError:
+            continue
+
+    if not router_buckets:
+        return 0.0
+
+    router_buckets.sort(key=lambda t: t[0])
+    total = router_buckets[-1][1]  # +Inf bucket count == total requests
+    if total == 0.0:
+        return 0.0
+
+    target = total * pct
+    for i, (le, count) in enumerate(router_buckets):
+        if count < target:
+            continue
+        if i == 0:
+            ratio = target / count if count > 0 else 0.0
+            return le * ratio * 1000.0
+        prev_le, prev_count = router_buckets[i - 1]
+        if count == prev_count:
+            return prev_le * 1000.0
+        if math.isinf(le):
+            return prev_le * 1000.0
+        fraction = (target - prev_count) / (count - prev_count)
+        return (prev_le + fraction * (le - prev_le)) * 1000.0
+
+    return 0.0
+
+
+# ──────────────────────────────────────────────────────────────────────────────
+# HTTP fetch
+# ──────────────────────────────────────────────────────────────────────────────
+
+async def fetch_metrics(metrics_url: str) -> ParsedMetrics:
+    """Fetch and parse Prometheus metrics from the given URL."""
+    async with httpx.AsyncClient(timeout=10.0) as client:
+        response = await client.get(metrics_url)
+        response.raise_for_status()
+    return parse_prometheus(response.text)

plugins/traefik/templates/traefik/index.html

@@ -0,0 +1,31 @@
+{# plugins/traefik/templates/traefik/index.html #}
+{% extends "base.html" %}
+{% block title %}Traefik — Steward{% endblock %}
+{% block content %}
+<div style="display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:0.75rem;margin-bottom:1.5rem;">
+  <div style="display:flex;align-items:baseline;gap:1rem;">
+    <h1 class="page-title" style="margin-bottom:0;">Traefik Services</h1>
+    <span style="color:var(--text-muted);font-size:0.85rem;">polling every {{ poll_interval }}s</span>
+  </div>
+  {% include "_time_range.html" %}
+</div>
+
+<div id="traefik-rows"
+     hx-get="/plugins/traefik/rows"
+     hx-trigger="load, every {{ poll_interval }}s, rangeChange from:body"
+     hx-include="#time-range"
+     hx-swap="innerHTML">
+</div>
+
+{% if access_log_enabled %}
+<div style="margin-top:1.5rem;">
+  <h2 class="section-title" style="margin-bottom:1rem;">Traffic Origin</h2>
+  <div id="traefik-traffic"
+       hx-get="/plugins/traefik/traffic"
+       hx-trigger="load, every {{ poll_interval }}s, rangeChange from:body"
+       hx-include="#time-range"
+       hx-swap="innerHTML">
+  </div>
+</div>
+{% endif %}
+{% endblock %}

plugins/traefik/templates/traefik/rows.html

@@ -0,0 +1,127 @@
+{# plugins/traefik/templates/traefik/rows.html #}
+
+{# ── Global stats bar ──────────────────────────────────────────────────────── #}
+{% if global_stat %}
+<div style="display:flex;flex-wrap:wrap;gap:1.5rem;margin-bottom:1.25rem;padding:0.75rem 1rem;background:var(--card-bg);border:1px solid var(--border);border-radius:6px;font-size:0.85rem;font-variant-numeric:tabular-nums;">
+
+  {% if global_stat.open_conns_total is not none %}
+  <span>
+    <span style="color:var(--text-muted);">Open conns</span>
+    <span style="margin-left:0.4rem;font-weight:600;">{{ global_stat.open_conns_total | int }}</span>
+  </span>
+  {% endif %}
+
+  {% if global_stat.config_last_reload_success is not none %}
+  <span>
+    <span style="color:var(--text-muted);">Config</span>
+    {% if global_stat.config_last_reload_success == 1.0 %}
+      <span style="margin-left:0.4rem;color:var(--green);">&#10003; OK</span>
+    {% else %}
+      <span style="margin-left:0.4rem;color:var(--red);">&#10007; failed</span>
+    {% endif %}
+    {% if global_stat.config_reloads_total is not none %}
+      <span style="color:var(--text-dim);margin-left:0.3rem;">({{ global_stat.config_reloads_total | int }} reloads)</span>
+    {% endif %}
+  </span>
+  {% endif %}
+
+  {% if global_stat.process_memory_bytes is not none %}
+  <span>
+    <span style="color:var(--text-muted);">Memory</span>
+    {% set mb = (global_stat.process_memory_bytes / 1048576) %}
+    <span style="margin-left:0.4rem;">
+      {% if mb >= 1024 %}{{ "%.1f"|format(mb / 1024) }} GB{% else %}{{ "%.0f"|format(mb) }} MB{% endif %}
+    </span>
+  </span>
+  {% endif %}
+
+  <span style="margin-left:auto;color:var(--text-dim);font-size:0.78rem;">
+    {{ global_stat.scraped_at.strftime("%H:%M:%S") }} UTC
+  </span>
+</div>
+{% endif %}
+
+{# ── Per-service cards + cert card in shared columns layout ───────────────── #}
+{% if router_data or certs %}
+<div style="column-width:340px;column-count:3;column-gap:1rem;">
+
+{% for r in router_data %}
+<div class="card" style="break-inside:avoid;margin-bottom:1rem;">
+    <h3 class="section-title" style="margin-bottom:0.75rem;word-break:break-all;">{{ r.name }}</h3>
+    <table class="table" style="font-size:0.85rem;">
+        <tr>
+            <td style="color:var(--text-muted);padding:0.2rem 0;">Req/s</td>
+            <td style="padding:0.2rem 0.5rem;">{{ "%.2f"|format(r.latest.request_rate) }}</td>
+            <td style="padding:0.2rem 0;">{{ r.sparkline_req | safe }}</td>
+        </tr>
+        <tr>
+            <td style="color:var(--text-muted);padding:0.2rem 0;">Bandwidth</td>
+            <td style="padding:0.2rem 0.5rem;">
+              {% set bps = r.latest.response_bytes_rate %}
+              {% if bps >= 1048576 %}{{ "%.1f"|format(bps / 1048576) }} MB/s
+              {% elif bps >= 1024 %}{{ "%.1f"|format(bps / 1024) }} KB/s
+              {% else %}{{ "%.0f"|format(bps) }} B/s{% endif %}
+            </td>
+            <td style="padding:0.2rem 0;"></td>
+        </tr>
+        <tr>
+            <td style="color:var(--text-muted);padding:0.2rem 0;">p95 ms</td>
+            <td style="padding:0.2rem 0.5rem;">{{ "%.1f"|format(r.latest.latency_p95_ms) }}</td>
+            <td style="padding:0.2rem 0;">{{ r.sparkline_p95 | safe }}</td>
+        </tr>
+        <tr>
+            <td style="color:var(--text-muted);padding:0.2rem 0;">p99 ms</td>
+            <td style="padding:0.2rem 0.5rem;">{{ "%.1f"|format(r.latest.latency_p99_ms) }}</td>
+            <td style="padding:0.2rem 0;"></td>
+        </tr>
+        <tr>
+            <td style="color:var(--text-muted);padding:0.2rem 0;">4xx %</td>
+            <td style="color:{% if r.latest.error_rate_4xx_pct > 1 %}var(--yellow){% else %}var(--green){% endif %};padding:0.2rem 0.5rem;">
+                {{ "%.1f"|format(r.latest.error_rate_4xx_pct) }}%
+            </td>
+            <td style="padding:0.2rem 0;"></td>
+        </tr>
+        <tr>
+            <td style="color:var(--text-muted);padding:0.2rem 0;">5xx %</td>
+            <td style="color:{% if r.latest.error_rate_5xx_pct > 0.1 %}var(--red){% else %}var(--green){% endif %};padding:0.2rem 0.5rem;">
+                {{ "%.1f"|format(r.latest.error_rate_5xx_pct) }}%
+            </td>
+            <td style="padding:0.2rem 0;">{{ r.sparkline_5xx | safe }}</td>
+        </tr>
+    </table>
+    <div style="color:var(--text-dim);font-size:0.75rem;margin-top:0.5rem;">
+        Last scraped {{ r.latest.scraped_at.strftime("%H:%M:%S") }} UTC
+    </div>
+</div>
+{% endfor %}
+
+{% if certs %}
+<div class="card" style="break-inside:avoid;margin-bottom:1rem;">
+  <div class="section-title" style="margin-bottom:0.75rem;">TLS Certificates</div>
+  <table class="table" style="font-size:0.83rem;width:100%;">
+    {% for cert in certs %}
+    <tr>
+      <td style="padding:0.2rem 0 0.2rem 0;word-break:break-all;">{{ cert.cn }}</td>
+      <td style="text-align:right;padding:0.2rem 0;white-space:nowrap;font-weight:600;
+        {% if cert.days_remaining < 7 %}color:var(--red);
+        {% elif cert.days_remaining < 30 %}color:var(--yellow);
+        {% else %}color:var(--green);{% endif %}">
+        {{ cert.days_remaining | int }}d
+      </td>
+    </tr>
+    <tr>
+      <td colspan="2" style="padding:0 0 0.4rem 0;color:var(--text-dim);font-size:0.75rem;">
+        {{ cert.not_after.strftime("%Y-%m-%d") }}
+      </td>
+    </tr>
+    {% endfor %}
+  </table>
+</div>
+{% endif %}
+
+</div>
+{% else %}
+<div class="card">
+    <p style="color:#606080;">No Traefik metrics yet. Configure <code>metrics_url</code> in <code>config.yaml</code> under <code>plugins.traefik</code>.</p>
+</div>
+{% endif %}

plugins/traefik/templates/traefik/traffic.html

@@ -0,0 +1,101 @@
+{# plugins/traefik/templates/traefik/traffic.html #}
+{% if summary %}
+
+{# ── Overview bar ─────────────────────────────────────────────────────────── #}
+<div style="display:flex;flex-wrap:wrap;gap:1.5rem;margin-bottom:1.25rem;padding:0.75rem 1rem;background:var(--card-bg);border:1px solid var(--border);border-radius:6px;font-size:0.85rem;font-variant-numeric:tabular-nums;align-items:center;">
+  <span>
+    <span style="color:var(--text-muted);">Total</span>
+    <span style="margin-left:0.4rem;font-weight:600;">{{ summary.total }}</span>
+  </span>
+  <span>
+    <span style="color:var(--text-muted);">Internal</span>
+    <span style="margin-left:0.4rem;color:var(--green);font-weight:600;">{{ summary.internal }}</span>
+  </span>
+  <span>
+    <span style="color:var(--text-muted);">External</span>
+    <span style="margin-left:0.4rem;color:{% if summary.external_pct > 50 %}var(--yellow){% else %}var(--green){% endif %};font-weight:600;">
+      {{ summary.external }} ({{ "%.1f"|format(summary.external_pct) }}%)
+    </span>
+  </span>
+  <span>
+    <span style="color:var(--text-muted);">Bytes</span>
+    <span style="margin-left:0.4rem;">
+      {% set mb = summary.total_bytes / 1048576 %}
+      {% if mb >= 1024 %}{{ "%.1f"|format(mb / 1024) }} GB{% else %}{{ "%.1f"|format(mb) }} MB{% endif %}
+    </span>
+  </span>
+
+  {# External % sparkline #}
+  <span style="margin-left:auto;">
+    <span style="color:var(--text-muted);font-size:0.78rem;margin-right:0.4rem;">ext % over time</span>
+    {{ summary.sparkline_external | safe }}
+  </span>
+</div>
+
+{# ── Internal/external fill bar ───────────────────────────────────────────── #}
+{% set ext_pct = summary.external_pct %}
+<div style="height:6px;border-radius:3px;background:var(--border);margin-bottom:1.25rem;overflow:hidden;">
+  <div style="height:100%;width:{{ ext_pct | round(1) }}%;background:var(--yellow);border-radius:3px;transition:width 0.4s;"></div>
+</div>
+
+{# ── Detail cards in columns ──────────────────────────────────────────────── #}
+<div style="column-width:300px;column-count:3;column-gap:1rem;">
+
+  {# Top source IPs #}
+  <div class="card" style="break-inside:avoid;margin-bottom:1rem;">
+    <div class="section-title" style="margin-bottom:0.75rem;">Top Source IPs</div>
+    <table class="table" style="font-size:0.82rem;width:100%;">
+      {% for entry in summary.top_ips %}
+      <tr>
+        <td style="padding:0.2rem 0.5rem 0.2rem 0;font-family:monospace;">{{ entry.ip }}</td>
+        {% if entry.country %}
+        <td style="padding:0.2rem 0.3rem;color:var(--text-muted);">{{ entry.country }}</td>
+        {% endif %}
+        <td style="text-align:right;padding:0.2rem 0;">
+          <span style="color:{% if entry.internal %}var(--text-muted){% else %}var(--yellow){% endif %};">
+            {{ entry.count }}
+          </span>
+        </td>
+      </tr>
+      {% endfor %}
+    </table>
+  </div>
+
+  {# Top routers #}
+  <div class="card" style="break-inside:avoid;margin-bottom:1rem;">
+    <div class="section-title" style="margin-bottom:0.75rem;">Top Services Hit</div>
+    <table class="table" style="font-size:0.82rem;width:100%;">
+      {% for entry in summary.top_routers %}
+      <tr>
+        <td style="padding:0.2rem 0.5rem 0.2rem 0;word-break:break-all;">{{ entry.router }}</td>
+        <td style="text-align:right;padding:0.2rem 0;">{{ entry.count }}</td>
+      </tr>
+      {% endfor %}
+    </table>
+  </div>
+
+  {# Top countries (only shown if GeoIP is active) #}
+  {% if summary.top_countries %}
+  <div class="card" style="break-inside:avoid;margin-bottom:1rem;">
+    <div class="section-title" style="margin-bottom:0.75rem;">External Traffic by Country</div>
+    <table class="table" style="font-size:0.82rem;width:100%;">
+      {% for entry in summary.top_countries %}
+      <tr>
+        <td style="padding:0.2rem 0.5rem 0.2rem 0;">{{ entry.country }}</td>
+        <td style="text-align:right;padding:0.2rem 0;">{{ entry.count }}</td>
+      </tr>
+      {% endfor %}
+    </table>
+  </div>
+  {% endif %}
+
+</div>
+
+{% else %}
+<div class="card" style="color:var(--text-muted);font-size:0.85rem;">
+  No access log data yet.
+  {% if not access_log_enabled %}
+  Enable <code>access_log.enabled: true</code> in your plugin config and bind-mount the Traefik log directory.
+  {% endif %}
+</div>
+{% endif %}

plugins/traefik/templates/traefik/widget.html

@@ -0,0 +1,56 @@
+{# plugins/traefik/templates/traefik/widget.html #}
+{% if expiring_certs %}
+<div style="margin-bottom:0.6rem;">
+{% for cert in expiring_certs %}
+<div style="display:flex;justify-content:space-between;font-size:0.8rem;padding:0.15rem 0;
+  {% if cert.days_remaining < 7 %}color:var(--red);{% else %}color:var(--yellow);{% endif %}">
+  <span>&#9888; {{ cert.cn }}</span>
+  <span>{{ cert.days_remaining | int }}d</span>
+</div>
+{% endfor %}
+</div>
+{% endif %}
+
+{% if router_data %}
+{% for r in router_data %}
+<div class="ping-row">
+  <div class="ping-meta">
+    <span class="ping-name" style="font-size:0.8rem;word-break:break-all;">{{ r.name }}</span>
+  </div>
+  <div style="flex:1;display:flex;gap:1.5rem;font-size:0.82rem;font-variant-numeric:tabular-nums;">
+    <span title="Requests/s">
+      <span style="color:var(--text-muted);">req/s</span>
+      <span style="margin-left:0.3rem;">{{ "%.2f"|format(r.latest.request_rate) }}</span>
+    </span>
+    <span title="Bandwidth">
+      <span style="color:var(--text-muted);">bw</span>
+      <span style="margin-left:0.3rem;">
+        {% set bps = r.latest.response_bytes_rate %}
+        {% if bps >= 1048576 %}{{ "%.1f"|format(bps / 1048576) }}MB/s
+        {% elif bps >= 1024 %}{{ "%.0f"|format(bps / 1024) }}KB/s
+        {% else %}{{ "%.0f"|format(bps) }}B/s{% endif %}
+      </span>
+    </span>
+    <span title="p95 latency">
+      <span style="color:var(--text-muted);">p95</span>
+      <span style="margin-left:0.3rem;
+        {% if r.latest.latency_p95_ms > 500 %}color:var(--red){% elif r.latest.latency_p95_ms > 200 %}color:var(--yellow){% else %}color:var(--green){% endif %};">
+        {{ "%.0f"|format(r.latest.latency_p95_ms) }}ms
+      </span>
+    </span>
+    {% if r.latest.error_rate_5xx_pct > 0 %}
+    <span title="5xx error rate">
+      <span style="color:var(--red);">{{ "%.1f"|format(r.latest.error_rate_5xx_pct) }}% 5xx</span>
+    </span>
+    {% endif %}
+  </div>
+</div>
+{% endfor %}
+{% if total_routers > 5 %}
+<div style="color:var(--text-dim);font-size:0.75rem;padding:0.25rem 0;">
+  +{{ total_routers - 5 }} more — <a href="/plugins/traefik/">view all →</a>
+</div>
+{% endif %}
+{% else %}
+<p class="empty" style="padding:0.5rem 0;font-size:0.85rem;">No Traefik data yet.</p>
+{% endif %}

plugins/traefik/templates/traefik/widget_access_log.html

@@ -0,0 +1,40 @@
+{# traefik/widget_access_log.html — dashboard widget: traffic origin summary #}
+{% if not summary %}
+<div style="color:var(--text-muted);font-size:0.85rem;padding:0.5rem 0;">No access log data yet.</div>
+{% else %}
+
+<div style="display:flex;gap:1rem;margin-bottom:0.75rem;flex-wrap:wrap;">
+  <div>
+    <span style="font-size:1.4rem;font-weight:700;line-height:1;">{{ summary.total | int }}</span>
+    <span style="font-size:0.78rem;color:var(--text-muted);margin-left:0.25rem;">total req</span>
+  </div>
+  <div>
+    <span style="font-size:1.4rem;font-weight:700;line-height:1;color:var(--orange);">
+      {{ "%.1f" | format(summary.external_pct) }}%
+    </span>
+    <span style="font-size:0.78rem;color:var(--text-muted);margin-left:0.25rem;">external</span>
+  </div>
+</div>
+
+{% if summary.top_ips %}
+<div style="font-size:0.72rem;color:var(--text-muted);text-transform:uppercase;letter-spacing:0.05em;margin-bottom:0.4rem;">
+  Top IPs
+  {% if summary.ip_filter != "all" %}
+  <span style="color:var(--accent);margin-left:0.4rem;">{{ summary.ip_filter }}</span>
+  {% endif %}
+</div>
+<div style="display:grid;gap:2px;">
+  {% for ip in summary.top_ips %}
+  <div style="display:flex;align-items:center;gap:0.5rem;font-size:0.82rem;padding:0.2rem 0;">
+    <span class="dot {% if ip.internal %}dot-dim{% else %}dot-warn{% endif %}"></span>
+    <span style="flex:1;font-family:ui-monospace,monospace;font-size:0.78rem;
+                 color:{% if ip.internal %}var(--text-muted){% else %}var(--text){% endif %};">
+      {{ ip.ip }}
+    </span>
+    <span style="color:var(--text-muted);font-size:0.78rem;">{{ ip.count }}</span>
+  </div>
+  {% endfor %}
+</div>
+{% endif %}
+
+{% endif %}

plugins/traefik/templates/traefik/widget_request_chart.html

@@ -0,0 +1,75 @@
+{# traefik/widget_request_chart.html — Chart.js request rate + error % over time #}
+{% if not labels_json or labels_json == '[]' %}
+<div style="color:var(--text-muted);font-size:0.85rem;padding:0.5rem 0;">No data for last {{ hours }}h.</div>
+{% else %}
+<div style="position:relative;height:160px;">
+  <canvas id="chart-traefik-req-{{ widget_id }}"></canvas>
+</div>
+<script>
+(function() {
+  var ctx = document.getElementById("chart-traefik-req-{{ widget_id }}");
+  if (!ctx || !window.Chart) return;
+  var existing = Chart.getChart(ctx);
+  if (existing) existing.destroy();
+  new Chart(ctx.getContext("2d"), {
+    type: "line",
+    data: {
+      labels: {{ labels_json | safe }},
+      datasets: [
+        {
+          label: "Req/s",
+          data: {{ req_rate_json | safe }},
+          borderColor: "#7c5ef4",
+          backgroundColor: "rgba(124,94,244,0.08)",
+          fill: true,
+          tension: 0.3,
+          pointRadius: 0,
+          borderWidth: 1.5,
+          yAxisID: "y",
+        },
+        {
+          label: "5xx %",
+          data: {{ error_rate_json | safe }},
+          borderColor: "#e83848",
+          fill: false,
+          tension: 0.3,
+          pointRadius: 0,
+          borderWidth: 1.5,
+          yAxisID: "y2",
+        },
+      ]
+    },
+    options: {
+      responsive: true,
+      maintainAspectRatio: false,
+      animation: false,
+      plugins: {
+        legend: {
+          labels: { color: "#6858a0", boxWidth: 10, font: { size: 10 } }
+        }
+      },
+      scales: {
+        x: { display: false },
+        y: {
+          min: 0,
+          grid: { color: "rgba(30,30,62,0.8)" },
+          ticks: { color: "#6858a0", font: { size: 10 } },
+          title: { display: true, text: "req/s", color: "#6858a0", font: { size: 9 } },
+        },
+        y2: {
+          position: "right",
+          min: 0,
+          max: 100,
+          grid: { drawOnChartArea: false },
+          ticks: { color: "#e83848", font: { size: 10 } },
+          title: { display: true, text: "5xx%", color: "#e83848", font: { size: 9 } },
+        },
+      }
+    }
+  });
+})();
+</script>
+<div style="font-size:0.72rem;color:var(--text-muted);margin-top:0.35rem;text-align:right;">
+  last {{ hours }}h
+</div>
+{% endif %}

plugins/unifi/__init__.py

@@ -0,0 +1,28 @@
+# plugins/unifi/__init__.py
+from __future__ import annotations
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from quart import Quart
+
+_app: "Quart | None" = None
+
+
+def setup(app: "Quart") -> None:
+    global _app
+    _app = app
+    from .models import (  # noqa: F401
+        UnifiWanStat, UnifiClientSnapshot, UnifiWlanStat, UnifiDpiSnapshot,
+        UnifiDevice, UnifiKnownClient, UnifiEvent, UnifiAlarm,
+        UnifiSpeedtestResult, UnifiNetwork, UnifiPortForward, UnifiFwRule,
+    )
+
+
+def get_scheduled_tasks() -> list:
+    from .scheduler import make_poll_task
+    return [make_poll_task(_app)]
+
+
+def get_blueprint():
+    from .routes import unifi_bp
+    return unifi_bp

plugins/unifi/client.py

@@ -0,0 +1,170 @@
+# plugins/unifi/client.py
+"""Async UniFi Network controller API client.
+
+Supports UDM/UDM-Pro (firmware 2+) using the /proxy/network/ path prefix
+and Bearer-token auth via the /api/auth/login endpoint.
+
+On 401, re-authenticates automatically once before raising.
+"""
+from __future__ import annotations
+import logging
+
+import httpx
+
+logger = logging.getLogger(__name__)
+
+
+class UnifiClient:
+    def __init__(
+        self,
+        host: str,
+        username: str,
+        password: str,
+        site: str = "default",
+        verify_ssl: bool = False,
+    ) -> None:
+        self._host = host.rstrip("/")
+        self._username = username
+        self._password = password
+        self._site = site
+        self._verify_ssl = verify_ssl
+        self._http: httpx.AsyncClient | None = None
+        self._csrf_token: str = ""
+
+    # ── Lifecycle ─────────────────────────────────────────────────────────────
+
+    async def _ensure_http(self) -> None:
+        if self._http is None:
+            self._http = httpx.AsyncClient(
+                verify=self._verify_ssl,
+                timeout=15.0,
+                follow_redirects=True,
+            )
+
+    async def login(self) -> None:
+        await self._ensure_http()
+        resp = await self._http.post(
+            f"{self._host}/api/auth/login",
+            json={"username": self._username, "password": self._password, "rememberMe": False},
+        )
+        resp.raise_for_status()
+        self._csrf_token = resp.headers.get("X-CSRF-Token", "")
+        logger.debug("UniFi login OK (csrf=%s…)", self._csrf_token[:8] if self._csrf_token else "none")
+
+    async def close(self) -> None:
+        if self._http:
+            await self._http.aclose()
+            self._http = None
+
+    # ── API helpers ───────────────────────────────────────────────────────────
+
+    def _api_url(self, path: str) -> str:
+        return f"{self._host}/proxy/network/api/s/{self._site}{path}"
+
+    def _headers(self) -> dict:
+        return {"X-CSRF-Token": self._csrf_token} if self._csrf_token else {}
+
+    async def _get(self, path: str, params: dict | None = None) -> list | dict:
+        await self._ensure_http()
+        resp = await self._http.get(self._api_url(path), headers=self._headers(), params=params)
+        if resp.status_code == 401:
+            await self.login()
+            resp = await self._http.get(self._api_url(path), headers=self._headers(), params=params)
+        resp.raise_for_status()
+        data = resp.json()
+        return data.get("data", data)
+
+    # ── Core monitoring ───────────────────────────────────────────────────────
+
+    async def get_health(self) -> list[dict]:
+        """Subsystem health (wan, wlan, lan, www)."""
+        result = await self._get("/stat/health")
+        return result if isinstance(result, list) else []
+
+    async def get_active_clients(self) -> list[dict]:
+        """Currently connected clients."""
+        result = await self._get("/stat/sta")
+        return result if isinstance(result, list) else []
+
+    async def get_devices(self) -> list[dict]:
+        """Managed network devices (APs, switches, gateways) with full detail."""
+        result = await self._get("/stat/device")
+        return result if isinstance(result, list) else []
+
+    # ── Events & alarms ───────────────────────────────────────────────────────
+
+    async def get_events(self, limit: int = 200) -> list[dict]:
+        """Recent site events (client connects, IDS alerts, device state changes, etc.)."""
+        result = await self._get("/stat/event", params={"_limit": limit, "_sort": "-time"})
+        return result if isinstance(result, list) else []
+
+    async def get_alarms(self, archived: bool = False) -> list[dict]:
+        """Active (or archived) alarms."""
+        result = await self._get("/stat/alarm")
+        if not isinstance(result, list):
+            return []
+        return [a for a in result if a.get("archived", False) == archived]
+
+    # ── Traffic & DPI ─────────────────────────────────────────────────────────
+
+    async def get_dpi_stats(self) -> list[dict]:
+        """DPI per-client application/category traffic stats (cumulative counters)."""
+        result = await self._get("/stat/dpi")
+        return result if isinstance(result, list) else []
+
+    async def get_dpi_site_stats(self) -> list[dict]:
+        """DPI site-level category totals (not per-client)."""
+        result = await self._get("/dpi")
+        return result if isinstance(result, list) else []
+
+    async def get_speedtest_status(self) -> dict | None:
+        """Most recent WAN speed test result."""
+        result = await self._get("/stat/speedtest-status")
+        if isinstance(result, list) and result:
+            return result[0]
+        if isinstance(result, dict):
+            return result
+        return None
+
+    # ── Network inventory ─────────────────────────────────────────────────────
+
+    async def get_known_clients(self) -> list[dict]:
+        """All historically seen clients (not just currently connected)."""
+        result = await self._get("/rest/user")
+        return result if isinstance(result, list) else []
+
+    async def get_networks(self) -> list[dict]:
+        """Network/VLAN configurations."""
+        result = await self._get("/rest/networkconf")
+        return result if isinstance(result, list) else []
+
+    async def get_wlan_configs(self) -> list[dict]:
+        """WLAN (SSID) configurations."""
+        result = await self._get("/rest/wlanconf")
+        return result if isinstance(result, list) else []
+
+    async def get_port_forwards(self) -> list[dict]:
+        """Port forwarding rules."""
+        result = await self._get("/rest/portforwarding")
+        return result if isinstance(result, list) else []
+
+    async def get_firewall_rules(self) -> list[dict]:
+        """Firewall rules."""
+        result = await self._get("/rest/firewallrule")
+        return result if isinstance(result, list) else []
+
+    async def get_firewall_groups(self) -> list[dict]:
+        """Firewall groups (IP sets / port sets referenced by rules)."""
+        result = await self._get("/rest/firewallgroup")
+        return result if isinstance(result, list) else []
+
+    # ── System ────────────────────────────────────────────────────────────────
+
+    async def get_sysinfo(self) -> dict | None:
+        """Controller system information (version, uptime, hostname)."""
+        result = await self._get("/stat/sysinfo")
+        if isinstance(result, list) and result:
+            return result[0]
+        if isinstance(result, dict):
+            return result
+        return None

plugins/unifi/migrations/env.py

@@ -0,0 +1,72 @@
+# plugins/unifi/migrations/env.py
+"""Alembic env.py for the UniFi plugin (standalone dev use).
+At app startup, migration_runner.py uses the core env.py with version_locations.
+"""
+import asyncio
+import os
+import sys
+from pathlib import Path
+from logging.config import fileConfig
+
+from sqlalchemy import pool
+from sqlalchemy.engine import Connection
+from sqlalchemy.ext.asyncio import async_engine_from_config
+from alembic import context
+
+sys.path.insert(0, str(Path(__file__).parent.parent.parent.parent))
+
+from steward.models.base import Base
+import steward.models  # noqa: F401
+from plugins.unifi.models import UnifiWanStat, UnifiClientSnapshot, UnifiDevice  # noqa: F401
+
+config = context.config
+if config.config_file_name is not None:
+    fileConfig(config.config_file_name)
+
+target_metadata = Base.metadata
+
+
+def _get_url() -> str:
+    import yaml
+    cfg_path = os.environ.get("STEWARD_CONFIG", "config.yaml")
+    try:
+        with open(cfg_path) as f:
+            cfg = yaml.safe_load(f) or {}
+        url = cfg.get("database", {}).get("url", "")
+    except FileNotFoundError:
+        url = ""
+    return os.environ.get("STEWARD_DATABASE__URL", url)
+
+
+def run_migrations_offline() -> None:
+    context.configure(
+        url=_get_url(), target_metadata=target_metadata,
+        literal_binds=True, dialect_opts={"paramstyle": "named"},
+    )
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+def do_run_migrations(connection: Connection) -> None:
+    context.configure(connection=connection, target_metadata=target_metadata)
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+async def run_async_migrations() -> None:
+    cfg = config.get_section(config.config_ini_section, {})
+    cfg["sqlalchemy.url"] = _get_url()
+    connectable = async_engine_from_config(cfg, prefix="sqlalchemy.", poolclass=pool.NullPool)
+    async with connectable.connect() as connection:
+        await connection.run_sync(do_run_migrations)
+    await connectable.dispose()
+
+
+def run_migrations_online() -> None:
+    asyncio.run(run_async_migrations())
+
+
+if context.is_offline_mode():
+    run_migrations_offline()
+else:
+    run_migrations_online()

plugins/unifi/migrations/versions/unifi_001_initial.py

@@ -0,0 +1,62 @@
+"""UniFi plugin initial tables
+
+Revision ID: unifi_001_initial
+Revises: (none — branch off core via depends_on)
+Create Date: 2026-03-20
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "unifi_001_initial"
+down_revision: Union[str, None] = None
+branch_labels: Union[str, Sequence[str], None] = "unifi"
+depends_on: Union[str, Sequence[str], None] = ("0004_app_settings",)
+
+
+def upgrade() -> None:
+    op.create_table(
+        "unifi_wan_stats",
+        sa.Column("id", sa.String(36), primary_key=True),
+        sa.Column("scraped_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("is_up", sa.Boolean, nullable=False, server_default="false"),
+        sa.Column("wan_ip", sa.String(64), nullable=True),
+        sa.Column("latency_ms", sa.Float, nullable=True),
+        sa.Column("rx_bytes_rate", sa.Float, nullable=True),
+        sa.Column("tx_bytes_rate", sa.Float, nullable=True),
+        sa.Column("uptime_seconds", sa.Integer, nullable=True),
+    )
+    op.create_index("ix_unifi_wan_stats_scraped", "unifi_wan_stats", ["scraped_at"])
+
+    op.create_table(
+        "unifi_client_snapshots",
+        sa.Column("id", sa.String(36), primary_key=True),
+        sa.Column("scraped_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("total_clients", sa.Integer, nullable=False, server_default="0"),
+        sa.Column("wireless_clients", sa.Integer, nullable=False, server_default="0"),
+        sa.Column("wired_clients", sa.Integer, nullable=False, server_default="0"),
+        sa.Column("guest_clients", sa.Integer, nullable=False, server_default="0"),
+        sa.Column("top_clients_json", sa.Text, nullable=False, server_default="[]"),
+    )
+    op.create_index("ix_unifi_client_snapshots_scraped", "unifi_client_snapshots", ["scraped_at"])
+
+    op.create_table(
+        "unifi_devices",
+        sa.Column("mac", sa.String(32), primary_key=True),
+        sa.Column("name", sa.String(255), nullable=True),
+        sa.Column("model", sa.String(64), nullable=True),
+        sa.Column("device_type", sa.String(16), nullable=True),
+        sa.Column("ip", sa.String(64), nullable=True),
+        sa.Column("state", sa.Integer, nullable=False, server_default="0"),
+        sa.Column("uptime_seconds", sa.Integer, nullable=True),
+        sa.Column("last_seen", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("scraped_at", sa.DateTime(timezone=True), nullable=False),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("unifi_devices")
+    op.drop_index("ix_unifi_client_snapshots_scraped", "unifi_client_snapshots")
+    op.drop_table("unifi_client_snapshots")
+    op.drop_index("ix_unifi_wan_stats_scraped", "unifi_wan_stats")
+    op.drop_table("unifi_wan_stats")