Native daemon migration: Docker → systemd on .13, host pi, real FS paths, updated diagram/map/README

docs/system.architecture.json

@@ -2,7 +2,7 @@
   "schema_version": 1,
   "diagram_type": "architecture",
   "meta": {
-    "title": "Paseo on the Home Lab",
+    "title": "Paseo — Native Daemon on .13",
     "quality_profile": "showcase",
     "viewBox": [1120, 600]
   },
@@ -19,34 +19,34 @@
       "type": "frontend",
       "label": "Web UI / mobile",
       "sublabel": "browser :6767",
-      "pos": [120, 240]
+      "pos": [120, 250]
     },
     {
       "id": "daemon",
       "type": "backend",
       "label": "Paseo daemon",
-      "sublabel": "0.7.2 · :6767 · auth",
+      "sublabel": "0.7.2 · systemd · :6767",
       "pos": [420, 120]
     },
     {
       "id": "pi",
       "type": "backend",
       "label": "pi agent",
-      "sublabel": "0.82.1 · --mode rpc",
-      "pos": [420, 300]
+      "sublabel": "0.82.1 Nix · --mode rpc",
+      "pos": [420, 290]
     },
     {
       "id": "cfg",
       "type": "database",
       "label": "pi config",
-      "sublabel": "paseo-home/.pi",
-      "pos": [700, 300]
+      "sublabel": "host ~/.pi + ~/.agents",
+      "pos": [700, 290]
     },
     {
-      "id": "ws",
+      "id": "fs",
       "type": "database",
-      "label": "workspace",
-      "sublabel": "/workspace/demo",
+      "label": "host filesystem",
+      "sublabel": "projects · vault · photos",
       "pos": [700, 440]
     },
     {
@@ -54,14 +54,14 @@
       "type": "backend",
       "label": "OmniRoute",
       "sublabel": ".13:20129",
-      "pos": [760, 120]
+      "pos": [780, 120]
     },
     {
       "id": "llm",
       "type": "external",
       "label": "LLM providers",
       "sublabel": "combo routing",
-      "pos": [940, 120]
+      "pos": [950, 120]
     }
   ],
   "boundaries": [
@@ -72,8 +72,8 @@
     },
     {
       "kind": "region",
-      "label": "Paseo daemon (.13 Docker)",
-      "wraps": ["daemon", "pi", "cfg", "ws"]
+      "label": "native .13 host (no container)",
+      "wraps": ["daemon", "pi", "cfg", "fs"]
     }
   ],
   "connections": [
@@ -88,7 +88,7 @@
       "id": "web-to-daemon",
       "from": "web",
       "to": "daemon",
-      "label": "https :6767"
+      "label": "Tailscale / LAN :6767"
     },
     {
       "id": "daemon-to-pi",
@@ -103,15 +103,15 @@
       "id": "pi-to-cfg",
       "from": "pi",
       "to": "cfg",
-      "label": "reads settings + models",
-      "labelAt": [700, 370]
+      "label": "host pi config + skills",
+      "labelAt": [640, 285]
     },
     {
-      "id": "pi-to-ws",
+      "id": "pi-to-fs",
       "from": "pi",
-      "to": "ws",
-      "label": "works in",
-      "labelAt": [700, 520]
+      "to": "fs",
+      "label": "direct access as sam",
+      "labelAt": [640, 450]
     },
     {
       "id": "pi-to-omni",
@@ -127,37 +127,36 @@
       "from": "omni",
       "to": "llm",
       "label": "combo routing",
-      "labelAt": [910, 194]
+      "labelAt": [915, 194]
     }
   ],
   "cards": [
     {
       "dot": "cyan",
-      "title": "Proven end-to-end",
+      "title": "Native daemon (2026-09-16)",
       "items": [
-        "paseo run --provider pi → agent 560ffca0 (pi/omni/openrouter/qwen/qwen3.7-flash)",
-        "Agent read HELLO.txt, wrote DEMO_SUMMARY.md into /workspace/demo",
-        "paseo logs shows full timeline (user → thought → shell → read)",
-        "Web UI http://192.168.20.13:6767 → HTTP 200"
+        "Runs as systemd user service on .13: paseo.service, enabled, 0.0.0.0:6767",
+        "Uses the host Nix pi 0.82.1 directly — no baked image, no sandbox",
+        "Full filesystem access as user sam: no /mnt mounts needed",
+        "NixOS firewall: port 6767 added (configuration.nix)"
       ]
     },
     {
       "dot": "emerald",
-      "title": "Deployment facts",
+      "title": "Verified end-to-end",
       "items": [
-        "Container: /home/sam/Docker/Containers/paseo/ (restart: always)",
-        "pi + omniroute ext baked at build time (USER root) — image runs as paseo (uid 1000)",
-        "pi 0.82.1 in container; host Nix pi untouched",
-        "Secrets only in .env (chmod 600)"
+        "Agent ran in /home/sam/paseo/projects/obsidian_cleanup_tool (NEWPATH_OK)",
+        "Model: omni/default-opencode-go-ds-flash (combo, healthy)",
+        "Clients: .27 CLl + .51 CLl + mobile web UI all reach daemon over LAN/Tailscale"
       ]
     },
     {
       "dot": "amber",
-      "title": "Findings",
+      "title": "Migrated from Docker",
       "items": [
-        "OmniRoute default combo (default-opencode-go-ds-flash) → 400 x-opencode-session issue",
-        "Working models: openrouter/qwen/qwen3.7-flash, openrouter/openai/gpt-5.6-sol, aug/claude-haiku-4.5",
-        "Fix combo/credentials on OmniRoute to restore the default path"
+        "Old Docker container removed; legacy backup in ~/paseo/docker-legacy-backup-…",
+        "PASEO_PASSWORD preserved in .13 10-secrets.conf",
+        "Docker limitation gone: projects live at ~/paseo/projects/ with real paths"
       ]
     }
   ]