diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 958a45c1..00000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 10
-  - package-ecosystem: gomod
-    directory: /
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 10
diff --git a/.github/release-drafter.yml b/.github/release-drafter.yml
deleted file mode 100644
index 4c6112af..00000000
--- a/.github/release-drafter.yml
+++ /dev/null
@@ -1,60 +0,0 @@
-name-template: 'v$RESOLVED_VERSION'
-tag-template: 'v$RESOLVED_VERSION'
-
-categories:
-  - title: 'Breaking Changes'
-    labels:
-      - 'breaking-change'
-      - 'breaking'
-  - title: 'New Features'
-    labels:
-      - 'feature'
-      - 'enhancement'
-  - title: 'Bug Fixes'
-    labels:
-      - 'fix'
-      - 'bugfix'
-      - 'bug'
-  - title: 'Security'
-    labels:
-      - 'security'
-  - title: 'Documentation'
-    labels:
-      - 'documentation'
-      - 'docs'
-  - title: 'Maintenance'
-    labels:
-      - 'chore'
-      - 'maintenance'
-      - 'dependencies'
-      - 'ci'
-
-change-template: '- $TITLE @$AUTHOR (#$NUMBER)'
-change-title-escapes: '\<*_&'
-
-version-resolver:
-  major:
-    labels:
-      - 'breaking-change'
-      - 'breaking'
-  minor:
-    labels:
-      - 'feature'
-      - 'enhancement'
-  patch:
-    labels:
-      - 'fix'
-      - 'bugfix'
-      - 'bug'
-      - 'security'
-      - 'documentation'
-      - 'chore'
-      - 'maintenance'
-  default: patch
-
-template: |
-  ## Changes
-
-  $CHANGES
-
-  **Full Changelog**: https://github.com/$OWNER/$REPOSITORY/compare/$PREVIOUS_TAG...v$RESOLVED_VERSION
diff --git a/.github/trufflehog.yml b/.github/trufflehog.yml
deleted file mode 100644
index 64a6eb8f..00000000
--- a/.github/trufflehog.yml
+++ /dev/null
@@ -1,2 +0,0 @@
-rules:
-  - id: trufflehog-default
diff --git a/.github/workflows/alert-sync-issues.yml b/.github/workflows/alert-sync-issues.yml
deleted file mode 100644
index f773f52b..00000000
--- a/.github/workflows/alert-sync-issues.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-name: Alert sync issues
-
-permissions:
-  contents: read
-on:
-  schedule:
-    - cron: '17 * * * *'
-  workflow_dispatch:
-
-jobs:
-  sync:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Placeholder for custom alert sync logic
-        run: echo "TODO: implement custom alert sync logic (phenoShared reusable workflow removed)"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index dde88f1f..00000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,28 +0,0 @@
-name: CodeQL
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  schedule:
-    - cron: '27 4 * * 1'
-permissions:
-  contents: read
-  security-events: write
-  actions: read
-jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        language: ["go", "javascript-typescript", "python", "actions"]
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - uses: github/codeql-action/init@v3
-        with:
-          languages: ${{ matrix.language }}
-      - uses: github/codeql-action/analyze@v3
-        with:
-          category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/coderabbit-rate-limit-retry.yml b/.github/workflows/coderabbit-rate-limit-retry.yml
deleted file mode 100644
index 0dba68f7..00000000
--- a/.github/workflows/coderabbit-rate-limit-retry.yml
+++ /dev/null
@@ -1,229 +0,0 @@
-name: coderabbit-rate-limit-retry
-
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-  schedule:
-    - cron: '*/20 * * * *'
-  workflow_dispatch:
-
-permissions:
-  checks: write
-  contents: read
-  pull-requests: write
-  issues: write
-
-jobs:
-  retrigger:
-    name: retrigger-coderabbit-on-rate-limit
-    runs-on: ubuntu-latest
-    steps:
-      - name: Re-request CodeRabbit when backlog is high and check is stale
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b
-        with:
-          script: |
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-            const STALE_MINUTES = 20;
-            const BACKLOG_THRESHOLD = 10;
-            const BYPASS_LABEL = "ci:coderabbit-bypass";
-            const GATE_CHECK_NAME = "CodeRabbit Gate";
-            const MARKER = "<!-- codex:coderabbit-rate-limit-retry -->";
-
-            const nowMs = Date.now();
-
-            async function listOpenPRs() {
-              const all = await github.paginate(github.rest.pulls.list, {
-                owner,
-                repo,
-                state: "open",
-                per_page: 100,
-              });
-              return all;
-            }
-
-            async function getCodeRabbitState(prNumber) {
-              const checks = await github.graphql(
-                `query($owner:String!,$repo:String!,$number:Int!){
-                  repository(owner:$owner,name:$repo){
-                    pullRequest(number:$number){
-                      commits(last:1){
-                        nodes{
-                          commit{
-                            statusCheckRollup{
-                              contexts(first:50){
-                                nodes{
-                                  __typename
-                                  ... on CheckRun {
-                                    name
-                                    conclusion
-                                    status
-                                    completedAt
-                                  }
-                                  ... on StatusContext {
-                                    context
-                                    state
-                                    createdAt
-                                  }
-                                }
-                              }
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }`,
-                { owner, repo, number: prNumber },
-              );
-
-              const nodes = checks.repository.pullRequest.commits.nodes[0]?.commit?.statusCheckRollup?.contexts?.nodes || [];
-              for (const n of nodes) {
-                if (n.__typename === "CheckRun" && n.name === "CodeRabbit") {
-                  return {
-                    state: (n.conclusion || n.status || "UNKNOWN").toUpperCase(),
-                    at: n.completedAt ? new Date(n.completedAt).getTime() : nowMs,
-                  };
-                }
-                if (n.__typename === "StatusContext" && n.context === "CodeRabbit") {
-                  return {
-                    state: (n.state || "UNKNOWN").toUpperCase(),
-                    at: n.createdAt ? new Date(n.createdAt).getTime() : nowMs,
-                  };
-                }
-              }
-              return { state: "MISSING", at: nowMs };
-            }
-
-            async function hasRecentRetryComment(prNumber) {
-              const comments = await github.paginate(github.rest.issues.listComments, {
-                owner,
-                repo,
-                issue_number: prNumber,
-                per_page: 100,
-              });
-
-              const latest = comments
-                .filter((c) => c.user?.login === "github-actions[bot]" && c.body?.includes(MARKER))
-                .sort((a, b) => new Date(b.created_at) - new Date(a.created_at))[0];
-
-              if (!latest) return false;
-              const ageMin = (nowMs - new Date(latest.created_at).getTime()) / 60000;
-              return ageMin < STALE_MINUTES;
-            }
-
-            async function ensureBypassLabelExists() {
-              try {
-                await github.rest.issues.getLabel({
-                  owner,
-                  repo,
-                  name: BYPASS_LABEL,
-                });
-              } catch (error) {
-                if (error.status !== 404) throw error;
-                await github.rest.issues.createLabel({
-                  owner,
-                  repo,
-                  name: BYPASS_LABEL,
-                  color: "B60205",
-                  description: "Temporary bypass for CodeRabbit rate-limit under high PR backlog.",
-                });
-              }
-            }
-
-            async function hasLabel(prNumber, name) {
-              const labels = await github.paginate(github.rest.issues.listLabelsOnIssue, {
-                owner,
-                repo,
-                issue_number: prNumber,
-                per_page: 100,
-              });
-              return labels.some((l) => l.name === name);
-            }
-
-            async function setBypassLabel(prNumber, enable) {
-              const present = await hasLabel(prNumber, BYPASS_LABEL);
-              if (enable && !present) {
-                await github.rest.issues.addLabels({
-                  owner,
-                  repo,
-                  issue_number: prNumber,
-                  labels: [BYPASS_LABEL],
-                });
-                core.notice(`PR #${prNumber}: applied label '${BYPASS_LABEL}'.`);
-              }
-              if (!enable && present) {
-                await github.rest.issues.removeLabel({
-                  owner,
-                  repo,
-                  issue_number: prNumber,
-                  name: BYPASS_LABEL,
-                });
-                core.notice(`PR #${prNumber}: removed label '${BYPASS_LABEL}'.`);
-              }
-            }
-
-            async function publishGate(pr, pass, summary) {
-              await github.rest.checks.create({
-                owner,
-                repo,
-                name: GATE_CHECK_NAME,
-                head_sha: pr.head.sha,
-                status: "completed",
-                conclusion: pass ? "success" : "failure",
-                output: {
-                  title: pass ? "CodeRabbit gate passed" : "CodeRabbit gate blocked",
-                  summary,
-                },
-              });
-            }
-
-            async function processPR(pr) {
-              const state = await getCodeRabbitState(pr.number);
-              const ageMin = (nowMs - state.at) / 60000;
-              const stateOk = state.state === "SUCCESS" || state.state === "NEUTRAL";
-              const stale = ageMin >= STALE_MINUTES;
-              const backlogHigh = openPRs.length > BACKLOG_THRESHOLD;
-              const bypassEligible = backlogHigh && stale && !stateOk;
-
-              await setBypassLabel(pr.number, bypassEligible);
-
-              if (bypassEligible && !(await hasRecentRetryComment(pr.number))) {
-                const body = [
-                  MARKER,
-                  "@coderabbitai full review",
-                  "",
-                  `Automated retrigger: backlog > ${BACKLOG_THRESHOLD}, CodeRabbit state=${state.state}, age=${ageMin.toFixed(1)}m.`,
-                ].join("\n");
-
-                await github.rest.issues.createComment({
-                  owner,
-                  repo,
-                  issue_number: pr.number,
-                  body,
-                });
-
-                core.notice(`PR #${pr.number}: posted CodeRabbit retrigger comment.`);
-              }
-
-              const gatePass = stateOk || bypassEligible;
-              const summary = [
-                `CodeRabbit state: ${state.state}`,
-                `Age minutes: ${ageMin.toFixed(1)}`,
-                `Open PR backlog: ${openPRs.length}`,
-                `Bypass eligible: ${bypassEligible}`,
-              ].join("\n");
-              await publishGate(pr, gatePass, summary);
-            }
-
-            const openPRs = await listOpenPRs();
-            core.info(`Open PR count: ${openPRs.length}`);
-            await ensureBypassLabelExists();
-
-            const targetPRs = context.eventName === "pull_request_target"
-              ? openPRs.filter((p) => p.number === context.payload.pull_request.number)
-              : openPRs;
-
-            for (const pr of targetPRs) {
-              await processPR(pr);
-            }
diff --git a/.github/workflows/docs-site.yml b/.github/workflows/docs-site.yml
deleted file mode 100644
index 9086273e..00000000
--- a/.github/workflows/docs-site.yml
+++ /dev/null
@@ -1,63 +0,0 @@
-name: Docs Site
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'docs/**'
-      - '.github/workflows/docs-site.yml'
-  pull_request:
-    paths:
-      - 'docs/**'
-      - '.github/workflows/docs-site.yml'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
-concurrency:
-  group: pages
-  cancel-in-progress: true
-
-jobs:
-  docs-build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-
-      - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
-        with:
-          node-version: '20'
-          cache: 'npm'
-          cache-dependency-path: docs/package.json
-
-      - name: Install deps
-        working-directory: docs
-        run: npm install
-
-      - name: Build docs
-        working-directory: docs
-        env:
-          DOCS_BASE: /agentapi-plusplus/
-        run: npm run docs:build
-
-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa
-        with:
-          path: docs/.vitepress/dist
-
-  deploy:
-    needs: docs-build
-    if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    steps:
-      - name: Deploy to GitHub Pages
-        id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e
diff --git a/.github/workflows/fuzzing.yml b/.github/workflows/fuzzing.yml
deleted file mode 100644
index c1850f57..00000000
--- a/.github/workflows/fuzzing.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-name: Fuzzing
-
-permissions:
-  contents: read
-
-on:
-  push:
-    paths:
-      - '**.rs'
-      - '**.go'
-  schedule:
-    - cron: '0 0 * * *'
-
-jobs:
-  cargo-fuzz:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-      - name: Install cargo-fuzz
-        run: cargo install cargo-fuzz || true
-      - name: Run fuzzing
-        run: cargo fuzz run all || true
-        continue-on-error: true
diff --git a/.github/workflows/generate-sdks.yaml b/.github/workflows/generate-sdks.yaml
deleted file mode 100644
index fad27599..00000000
--- a/.github/workflows/generate-sdks.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-name: Generate All SDKs
-
-permissions:
-  contents: read
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'api/openapi.yaml'
-      - 'internal/**/*.go'
-  workflow_dispatch:
-
-jobs:
-  generate-sdks:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      
-      - name: Setup Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
-      
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-      
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.23'
-      
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
-      
-      - name: Install generators
-        run: |
-          npm install @openapitools/openapi-generator-cli -g
-          pip install openapi-python-client
-      
-      - name: Generate Python SDK
-        run: |
-          openapi-generator generate -i api/openapi.yaml -g python -o sdk/python --package-name agentapi
-      
-      - name: Generate TypeScript SDK
-        run: |
-          openapi-generator generate -i api/openapi.yaml -g typescript-fetch -o sdk/typescript
-      
-      - name: Generate Go SDK
-        run: |
-          openapi-generator generate -i api/openapi.yaml -g go -o sdk/go
-      
-      - name: Generate Rust SDK
-        run: |
-          openapi-generator generate -i api/openapi.yaml -g rust -o sdk/rust
-      
-      - name: Commit and push
-        run: |
-          git add sdk/
-          git commit -m "chore: generate all SDKs" || echo "No changes to commit"
-          git push
diff --git a/.github/workflows/go-test.yml b/.github/workflows/go-test.yml
deleted file mode 100644
index c2a9fb15..00000000
--- a/.github/workflows/go-test.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-name: Go Tests
-
-permissions:
-  contents: read
-
-on:
-    push:
-        branches: [main]
-    pull_request:
-
-jobs:
-    test:
-        runs-on: ubuntu-latest
-        steps:
-            - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-
-            - name: Set up Go
-              uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
-              with:
-                  go-version: "stable"
-
-            - name: Test
-              run: CGO_ENABLED=0 go test -count=1 -v ./...
-
-    lint:
-        runs-on: ubuntu-latest
-        steps:
-            - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-
-            - name: Set up Go
-              uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
-              with:
-                  go-version: "stable"
-
-            - name: Set up Bun
-              uses: oven-sh/setup-bun@v2
-
-            - name: Install Chat Dependencies
-              run: cd chat && bun install
-
-            - name: run linters
-              run: make lint
-
-            - name: Check for unstaged changes
-              run: |
-                  make gen
-                  ./check_unstaged.sh
diff --git a/.github/workflows/iac-scan.yml b/.github/workflows/iac-scan.yml
deleted file mode 100644
index d072e9e4..00000000
--- a/.github/workflows/iac-scan.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-name: IaC Scanning
-
-permissions:
-  contents: read
-
-on:
-  push:
-    paths:
-      - '**.tf'
-      - '**.yaml'
-      - '**.json'
-  schedule:
-    - cron: '0 0 * * *'
-
-jobs:
-  tfsec:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - name: Install tfsec
-        run: |
-          curl -sSfL https://github.com/aquasecurity/tfsec/releases/latest/download/tfsec-linux-amd64 -o /usr/local/bin/tfsec
-          chmod +x /usr/local/bin/tfsec
-      - name: Run tfsec
-        run: tfsec . || true
-        continue-on-error: true
-
-  checkov:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - name: Install checkov
-        run: pip install checkov
-      - name: Run checkov
-        run: checkov -d . -o sarif || true
-        continue-on-error: true
diff --git a/.github/workflows/journey-gate.yml b/.github/workflows/journey-gate.yml
deleted file mode 100644
index 6615ec1e..00000000
--- a/.github/workflows/journey-gate.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Journey Gate
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-jobs:
-  journey-validate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: echo "Journey gate: stub"
diff --git a/.github/workflows/license-compliance.yml b/.github/workflows/license-compliance.yml
deleted file mode 100644
index b14ed069..00000000
--- a/.github/workflows/license-compliance.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-name: License Compliance
-
-permissions:
-  contents: read
-
-on:
-  push:
-    paths:
-      - 'Cargo.toml'
-      - 'go.mod'
-      - 'package.json'
-  schedule:
-    - cron: '0 0 * * *'
-
-jobs:
-  cargo-deny:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - name: Install cargo-deny
-        run: cargo install cargo-deny
-      - name: Run cargo-deny
-        run: cargo deny check
-        continue-on-error: true
-
-  fossa:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - name: Install FOSSA
-        run: |
-          curl -sSfL https://raw.githubusercontent.com/fossa-foss/fossa-cli/master/install.sh | sh
-      - name: Run FOSSA
-        run: fossa scan repository
-        continue-on-error: true
diff --git a/.github/workflows/lint-test.yml b/.github/workflows/lint-test.yml
deleted file mode 100644
index 649e3c69..00000000
--- a/.github/workflows/lint-test.yml
+++ /dev/null
@@ -1,45 +0,0 @@
-name: Lint & Test
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-permissions:
-  contents: read
-
-jobs:
-  lint-test:
-    name: lint-test
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-
-      # Inlined real Go lint+test. The previous
-      # `KooshaPari/phenotypeActions/actions/lint-test` reference pointed at a
-      # reusable-actions repo that does not exist, so this job failed on every
-      # PR at "Set up job". Mirrors the conventions in go-test.yml.
-      #
-      # The whole tree now builds + vets (the lib/httpapi duplicate-declaration
-      # merge breakage was repaired). `go test` covers the packages with stable,
-      # hermetic tests. A few pre-existing env-sensitive/flaky tests are excluded
-      # for now and tracked separately: e2e (needs a real agent binary),
-      # cmd/server TestPIDFileOperations, internal/routing session-expiry timing,
-      # lib/screentracker + lib/msgfmt golden-string tests.
-      - name: Set up Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
-        with:
-          go-version: "stable"
-
-      - name: go build (whole module)
-        run: go build ./...
-
-      - name: go vet (whole module)
-        run: go vet ./...
-
-      - name: go test (stable packages)
-        run: >-
-          CGO_ENABLED=0 go test -count=1
-          ./cmd/bifrost/...
-          ./internal/server/... ./internal/version/... ./internal/config/...
-          ./lib/httpapi/... ./lib/util/... ./x/acpio/...
diff --git a/.github/workflows/pages-deploy.yml b/.github/workflows/pages-deploy.yml
deleted file mode 100644
index e111f59e..00000000
--- a/.github/workflows/pages-deploy.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: pages-deploy
-on:
-  push:
-    branches: [main]
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-jobs:
-  deploy:
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - uses: actions/configure-pages@1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d
-      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa
-        with:
-          path: '.'
-      - id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e
diff --git a/.github/workflows/policy-gate.yml b/.github/workflows/policy-gate.yml
deleted file mode 100644
index 66ff18e2..00000000
--- a/.github/workflows/policy-gate.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-name: Policy Gate
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, edited, labeled, unlabeled]
-
-permissions:
-  contents: read
-  pull-requests: read
-
-jobs:
-  policy-gate:
-    name: policy-gate
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-        with:
-          fetch-depth: 0
-
-      - uses: KooshaPari/phenotypeActions/actions/policy-gate@0000000000000000000000000000000000000000 # placeholder SHA; source 404s; replace when reachable
-        with:
-          base_branch: main
-          block_merge_commits: true
-          require_layered_fix: true
diff --git a/.github/workflows/pr-preview-build.yml b/.github/workflows/pr-preview-build.yml
deleted file mode 100644
index 9826ebef..00000000
--- a/.github/workflows/pr-preview-build.yml
+++ /dev/null
@@ -1,79 +0,0 @@
-name: PR Preview Build
-
-permissions:
-  contents: read
-
-on:
-  pull_request:
-  workflow_dispatch:
-    inputs:
-      pr_number:
-        description: "PR number for manual runs (optional)"
-        required: false
-        type: string
-
-jobs:
-  build:
-    name: Build Release Binaries
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-    env:
-      PR_ID: ${{ github.event.pull_request.number || inputs.pr_number || github.run_id }}
-
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-
-      - name: Set up Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
-        with:
-          go-version: 'stable'
-
-      - name: Set up Bun
-        uses: oven-sh/setup-bun@v2
-
-      - name: Install Chat Dependencies
-        run: cd chat && bun install
-
-      - name: Run make gen and check for unstaged changes
-        run: |
-          make gen
-          ./check_unstaged.sh
-
-      - name: Build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        shell: bash
-        run: |
-          build_variants=(
-            "linux amd64 agentapi-linux-amd64"
-            "linux arm64 agentapi-linux-arm64"
-            "darwin amd64 agentapi-darwin-amd64"
-            "darwin arm64 agentapi-darwin-arm64"
-            "windows amd64 agentapi-windows-amd64.exe"
-          )
-          
-          for variant in "${build_variants[@]}"; do
-            read -r goos goarch artifact_name <<< "$variant"
-          
-            echo "Building for GOOS=$goos GOARCH=$goarch..."
-            CGO_ENABLED=0 GOOS=$goos GOARCH=$goarch BINPATH="out/$artifact_name" make build
-          done
-
-      - name: Upload Build Artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: agentapi-build-${{ env.PR_ID }}
-          path: ${{ github.workspace }}/out
-          retention-days: 7
-
-      - name: Save PR number
-        run: |
-          mkdir -p ./pr
-          printf '%s\n' "${{ env.PR_ID }}" > ./pr/number
-
-      - name: Upload PR number
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
-        with:
-          name: pr-number
-          path: pr/
diff --git a/.github/workflows/pr-preview-cleanup.yml b/.github/workflows/pr-preview-cleanup.yml
deleted file mode 100644
index 9a00c873..00000000
--- a/.github/workflows/pr-preview-cleanup.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: PR Preview Cleanup
-
-on:
-  pull_request:
-    types: [closed]
-
-permissions: read-all
-
-concurrency:
-  group: pr-preview-cleanup-${{ github.event.pull_request.number }}
-  cancel-in-progress: false
-
-jobs:
-  cleanup:
-    name: Delete PR Release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Delete PR Release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RELEASE_TAG: 'agentapi_${{ github.event.pull_request.number }}'
-        run: |
-          gh release delete "$RELEASE_TAG" --cleanup-tag --yes --repo ${{ github.repository }} || true
diff --git a/.github/workflows/pr-preview-release.yml b/.github/workflows/pr-preview-release.yml
deleted file mode 100644
index 28677f6d..00000000
--- a/.github/workflows/pr-preview-release.yml
+++ /dev/null
@@ -1,75 +0,0 @@
-name: PR Preview Release
-
-on:
-    workflow_run:
-        workflows: ["PR Preview Build"]
-        types:
-            - completed
-
-permissions:
-    contents: write
-    pull-requests: write
-
-jobs:
-    release:
-        name: Create Release
-        runs-on: ubuntu-latest
-        if: ${{ github.event.workflow_run.conclusion == 'success' }}
-
-        steps:
-            - name: Download PR number
-              uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
-              with:
-                  name: pr-number
-                  github-token: ${{ secrets.GITHUB_TOKEN }}
-                  run-id: ${{ github.event.workflow_run.id }}
-
-            - name: Read PR number
-              id: pr
-              run: echo "number=$(cat number)" >> "${GITHUB_OUTPUT}"
-
-            - name: Download Build Artifacts
-              uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
-              with:
-                  name: agentapi-build-${{ steps.pr.outputs.number }}
-                  path: ./out
-                  github-token: ${{ secrets.GITHUB_TOKEN }}
-                  run-id: ${{ github.event.workflow_run.id }}
-
-            - name: Create or Update PR Release
-              id: release
-              env:
-                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-                  RELEASE_TAG: "agentapi_${{ steps.pr.outputs.number }}"
-                  PR_NUMBER: ${{ steps.pr.outputs.number }}
-              run: |
-                  # Check if release exists
-                  if gh release view "$RELEASE_TAG" --repo ${{ github.repository }} &>/dev/null; then
-                    echo "Updating release $RELEASE_TAG"
-                    gh release upload "$RELEASE_TAG" ./out/* --clobber --repo ${{ github.repository }}
-                    echo "should_comment=false" >> "${GITHUB_OUTPUT}"
-                  else
-                    echo "Creating release $RELEASE_TAG"
-                    gh release create "$RELEASE_TAG" ./out/* \
-                      --title "$RELEASE_TAG" \
-                      --notes "Preview release for PR #${PR_NUMBER}" \
-                      --repo ${{ github.repository }} \
-                      --latest=false \
-                      --prerelease
-                    echo "should_comment=true" >> "${GITHUB_OUTPUT}"
-                  fi
-
-            - name: Comment on PR
-              if: steps.release.outputs.should_comment == 'true'
-              uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b
-              with:
-                  script: |
-                      const prNumber = ${{ steps.pr.outputs.number }};
-                      const releaseTag = `agentapi_${prNumber}`;
-                      const repoUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}`;
-                      github.rest.issues.createComment({
-                        issue_number: prNumber,
-                        owner: context.repo.owner,
-                        repo: context.repo.repo,
-                        body: `✅ Preview binaries are ready!\n\nTo test with modules: \`\`\`agentapi_version = "agentapi_${prNumber}"\`\`\` or download from: ${repoUrl}/releases/tag/${releaseTag}`
-                      });
diff --git a/.github/workflows/quality-gate.yml b/.github/workflows/quality-gate.yml
deleted file mode 100644
index 942e6328..00000000
--- a/.github/workflows/quality-gate.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: quality-gate
-
-permissions:
-  contents: read
-on: [pull_request]
-jobs:
-  verify:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - name: Run quality checks
-        run: ./scripts/quality-gate.sh verify
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
deleted file mode 100644
index 8d513c1b..00000000
--- a/.github/workflows/release-drafter.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-name: Release Drafter
-
-permissions:
-  contents: read
-on:
-  push:
-    branches:
-      - main
-jobs:
-  update_release_draft:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: release-drafter/release-drafter@v6
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release-goreleaser.yml b/.github/workflows/release-goreleaser.yml
deleted file mode 100644
index 0e0bcbd1..00000000
--- a/.github/workflows/release-goreleaser.yml
+++ /dev/null
@@ -1,41 +0,0 @@
-name: Release (goreleaser)
-
-on:
-  push:
-    tags:
-      - 'v*'
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-jobs:
-  goreleaser:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-
-      - name: Set up Bun
-        uses: oven-sh/setup-bun@v2
-
-      - name: Install chat dependencies
-        run: cd chat && bun install
-        continue-on-error: true
-
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
-        with:
-          distribution: goreleaser
-          version: '~> v2'
-          args: release --clean
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
deleted file mode 100644
index 601cd4d5..00000000
--- a/.github/workflows/scorecard.yml
+++ /dev/null
@@ -1,40 +0,0 @@
-name: OpenSSF Scorecard
-on:
-  branch_protection_rule:
-  schedule:
-    - cron: '17 3 * * 6'
-  push:
-    branches: [main]
-
-permissions: read-all
-
-jobs:
-  analysis:
-    name: Scorecard analysis
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-      id-token: write
-      contents: read
-      actions: read
-
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-        with:
-          persist-credentials: false
-
-      - uses: ossf/scorecard-action@v2.4.2
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          publish_results: true
-
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
-        with:
-          name: SARIF file
-          path: results.sarif
-          retention-days: 5
-
-      - uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: results.sarif
diff --git a/.github/workflows/secrets-scan.yml b/.github/workflows/secrets-scan.yml
deleted file mode 100644
index 26d90e31..00000000
--- a/.github/workflows/secrets-scan.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: Secrets Scan
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  schedule:
-    - cron: '27 4 * * 1'
-permissions:
-  contents: read
-jobs:
-  trufflehog:
-    name: TruffleHog
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-        with:
-          fetch-depth: 0
-      - uses: trufflesecurity/trufflehog@3fc0c2aa6648d54242e4af6fbfde0701796e4fb0  # was: @main
-        with:
-          path: ./
-          extra_args: --only-verified
diff --git a/.github/workflows/security-guard.yml b/.github/workflows/security-guard.yml
deleted file mode 100644
index 1c3f1e07..00000000
--- a/.github/workflows/security-guard.yml
+++ /dev/null
@@ -1,31 +0,0 @@
-name: Security Guard
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-  push:
-    branches:
-      - "**"
-
-permissions: read-all
-
-concurrency:
-  group: security-guard-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  guard:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-
-      - name: Install ggshield
-        run: python -m pip install --quiet "ggshield==1.35.0"
-
-      - name: Run pre-commit guard checks
-        uses: pre-commit/action@3a8a4b01de6bcb06e97da70c185e2e9c1f1dabd7 # v3.0.1
-        with:
-          extra_args: --hook-stage pre-commit --config .pre-commit-config.yaml --show-diff-on-failure
diff --git a/.github/workflows/self-merge-gate.yml b/.github/workflows/self-merge-gate.yml
deleted file mode 100644
index 1d4b42bb..00000000
--- a/.github/workflows/self-merge-gate.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: self-merge-gate
-
-permissions:
-  contents: read
-on: [pull_request_review]
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    if: github.event.review.state == 'approved'
-    steps:
-      - name: Check self-merge eligibility
-        run: ./scripts/self-merge-gate.sh
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
deleted file mode 100644
index b06d587e..00000000
--- a/.github/workflows/sonarcloud.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-name: SonarCloud
-
-permissions:
-  contents: read
-
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  sonar:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - name: Set up JDK 17
-        uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62
-        with:
-          java-version: '17'
-      - name: Install SonarScanner
-        run: |
-          curl -sSfL https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-4.9.0.2725-linux.zip -o sonar.zip
-          unzip sonar.zip
-          export PATH=$PATH:$PWD/sonar-scanner-4.9.0.2725/bin
-      - name: Run SonarCloud
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        run: |
-          sonar-scanner \
-            -Dsonar.projectKey=${{ github.repository }} \
-            -Dsonar.organization=kooshapari \
-            -Dsonar.login=${{ secrets.SONAR_TOKEN }}
diff --git a/.github/workflows/tag-automation.yml b/.github/workflows/tag-automation.yml
deleted file mode 100644
index 1eb787f5..00000000
--- a/.github/workflows/tag-automation.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-name: Tag Automation
-
-permissions:
-  contents: read
-on:
-  push:
-    tags:
-      - 'v*'
-jobs:
-  tag:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - name: Create release tag
-        run: echo "Creating release for ${{ github.ref_name }}"
diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml
deleted file mode 100644
index 512fd40a..00000000
--- a/.github/workflows/trivy-scan.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-name: Trivy Scan
-
-permissions:
-  contents: read
-
-on:
-  push:
-    branches:
-      - main
-  schedule:
-    - cron: '0 0 * * *'
-
-jobs:
-  trivy-fs:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - name: Run Trivy filesystem scan
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # was: @master
-        with:
-          scan-type: 'fs'
-          scan-ref: '.'
-          format: 'sarif'
-          output: 'trivy-results.sarif'
-          severity: 'CRITICAL,HIGH'
-      - name: Upload Trivy results
-        uses: github/codeql-action/upload-sarif@v2
-        with:
-          sarif_file: 'trivy-results.sarif'
-        continue-on-error: true
diff --git a/.github/workflows/trufflehog.yml b/.github/workflows/trufflehog.yml
deleted file mode 100644
index 5c1ce95c..00000000
--- a/.github/workflows/trufflehog.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-name: Trufflehog Secrets Scan
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-jobs:
-  trufflehog:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-        with:
-          fetch-depth: 0
-      - uses: trufflehog/actions/setup@3fc0c2a225a9d249aea9b97a1c40c40a5ff7e0c0 # pinned from @main
-      - run: trufflehog github --only-verified --no-update
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/zap-dast.yml b/.github/workflows/zap-dast.yml
deleted file mode 100644
index 8134ba02..00000000
--- a/.github/workflows/zap-dast.yml
+++ /dev/null
@@ -1,26 +0,0 @@
-name: ZAP DAST
-
-permissions:
-  contents: read
-
-on:
-  push:
-    paths:
-      - 'docs/**'
-      - 'src/**'
-
-jobs:
-  zap:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - name: Install ZAP
-        run: |
-          wget https://github.com/zaproxy/zap-full-bin/releases/download/2.15.0/zap-full-linux-amd64.tar.gz
-          tar -xzf zap-full-linux-amd64.tar.gz
-          mv zap-full-linux-amd64 zap
-      - name: Run ZAP
-        run: |
-          zap/wrapper.sh \
-            -t http://localhost:8080 \
-            -g https://github.com/kooshapari/phenotype-infrakit