feat: Updated site

Converts Vantage from a single-admin self-hosted app into a multi-tenant
SaaS. Org isolation is org_id row-scoping in one shared deployment and
database; each org gets a subdomain via wildcard DNS, but the hostname is
a routing hint and never an authorization boundary.

- Orgs, users and roles (owner|admin|member) with local password auth,
  first-run bootstrap, and per-org OIDC replacing the global provider
- Redis sessions carrying org and role; host/session mismatch guard
- Every tenant-scoped collection carries org_id; handlers take org from
  the session only, never from client input
- Agent gRPC path resolves org from the servers record, so agent configs
  and the shared gRPC host are unchanged
- Per-org settings and ESO read token, replacing global singletons
- Frontend: login, setup and org settings pages; org-aware AuthProvider
- Migrations 0001-0003 backfill an existing single-tenant instance

Reviewed per task plus a whole-branch and a migration-focused pass.

.gitea/workflows/agent-release.yml

@@ -86,22 +86,6 @@ jobs:
                   $env:GOOS = "windows"; $env:GOARCH = "amd64"
                   go build -ldflags="-s -w -X main.Version=$env:VERSION" -o ../installer/vantage-agent-windows-amd64.exe ./cmd
 
-            - name: Cache nssm
-              id: cache-nssm
-              uses: actions/cache@v4
-              with:
-                  path: installer/nssm.exe
-                  key: nssm-2.24-win64
-
-            - name: Fetch nssm
-              if: steps.cache-nssm.outputs.cache-hit != 'true'
-              working-directory: installer
-              shell: pwsh
-              run: |
-                  Invoke-WebRequest -Uri https://nssm.cc/release/nssm-2.24.zip -OutFile nssm.zip
-                  Expand-Archive -Path nssm.zip -DestinationPath nssm-extract -Force
-                  Copy-Item nssm-extract/nssm-2.24/win64/nssm.exe -Destination nssm.exe
-
             - name: Install WiX
               shell: pwsh
               run: dotnet tool install --global wix --version 5.*

.gitea/workflows/server-deploy.yml

@@ -35,3 +35,19 @@ jobs:
                     -t "$IMAGE" \
                     -f web/Dockerfile web/
                   docker push "$IMAGE"
+
+            - name: Build and push site image
+              run: |
+                  IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/site:latest"
+                  docker build \
+                    --build-arg NEXT_PUBLIC_SITE_API="${{ vars.SITE_API_URL }}" \
+                    --build-arg NEXT_PUBLIC_CONTACT_EMAIL="support@hostxtra.co.uk" \
+                    -t "$IMAGE" \
+                    -f site/Dockerfile site/
+                  docker push "$IMAGE"
+
+            - name: Build and push sitesvc image
+              run: |
+                  IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/sitesvc:latest"
+                  docker build -t "$IMAGE" -f sitesvc/Dockerfile sitesvc/
+                  docker push "$IMAGE"

.gitignore

@@ -4,8 +4,9 @@ build
 .env
 docs
 .superpowers
-installer/*.exe
+installer/vantage-agent-windows-amd64.exe
 installer/*.msi
 installer/nssm.zip
 installer/checksums-msi.txt
-.next
+.next
+*.tsbuildinfo

agent/internal/checker/checker.go

@@ -0,0 +1,222 @@
+package checker
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+)
+
+
+const (
+	TypeHTTP = "http"
+	TypeTCP  = "tcp"
+	TypeICMP = "icmp"
+	TypeTLS  = "tls"
+)
+
+
+type Spec struct {
+	Type           string
+	URL            string
+	Host           string
+	Port           int
+	Method         string
+	ExpectedStatus int
+	Keyword        string
+	TLSWarnDays    int
+	Insecure       bool 
+	TimeoutSec     int
+}
+
+
+type Result struct {
+	Up         bool
+	LatencyMs  int
+	Message    string
+	CertExpiry *time.Time
+}
+
+func (s Spec) timeout() time.Duration {
+	t := s.TimeoutSec
+	if t <= 0 || t > 10 {
+		t = 10
+	}
+	return time.Duration(t) * time.Second
+}
+
+
+func Run(ctx context.Context, s Spec) Result {
+	switch s.Type {
+	case TypeHTTP:
+		return runHTTP(ctx, s)
+	case TypeTCP:
+		return runTCP(ctx, s)
+	case TypeICMP:
+		return runICMP(ctx, s)
+	case TypeTLS:
+		return runTLS(ctx, s)
+	default:
+		return Result{Message: "unknown check type: " + s.Type}
+	}
+}
+
+func runHTTP(ctx context.Context, s Spec) Result {
+	method := s.Method
+	if method == "" {
+		method = http.MethodGet
+	}
+	expect := s.ExpectedStatus
+	if expect == 0 {
+		expect = 200
+	}
+	client := &http.Client{Timeout: s.timeout()}
+	if s.Insecure {
+		client.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} 
+	}
+	start := time.Now()
+	req, err := http.NewRequestWithContext(ctx, method, s.URL, nil)
+	if err != nil {
+		return Result{Message: err.Error()}
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	defer resp.Body.Close()
+	res := Result{LatencyMs: msSince(start), Up: true}
+	if resp.TLS != nil && len(resp.TLS.PeerCertificates) > 0 {
+		exp := resp.TLS.PeerCertificates[0].NotAfter
+		res.CertExpiry = &exp
+	}
+	if resp.StatusCode != expect {
+		return Result{LatencyMs: res.LatencyMs, CertExpiry: res.CertExpiry, Message: fmt.Sprintf("status %d (want %d)", resp.StatusCode, expect)}
+	}
+	if s.Keyword != "" {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+		if !strings.Contains(string(body), s.Keyword) {
+			return Result{LatencyMs: res.LatencyMs, CertExpiry: res.CertExpiry, Message: "keyword not found"}
+		}
+	}
+	return res
+}
+
+func runTCP(ctx context.Context, s Spec) Result {
+	addr := net.JoinHostPort(s.Host, fmt.Sprint(s.Port))
+	start := time.Now()
+	d := net.Dialer{Timeout: s.timeout()}
+	conn, err := d.DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	conn.Close()
+	return Result{Up: true, LatencyMs: msSince(start)}
+}
+
+func runTLS(ctx context.Context, s Spec) Result {
+	port := s.Port
+	if port == 0 {
+		port = 443
+	}
+	addr := net.JoinHostPort(s.Host, fmt.Sprint(port))
+	start := time.Now()
+	d := net.Dialer{Timeout: s.timeout()}
+	conn, err := tls.DialWithDialer(&d, "tcp", addr, &tls.Config{ServerName: s.Host})
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	defer conn.Close()
+	certs := conn.ConnectionState().PeerCertificates
+	if len(certs) == 0 {
+		return Result{LatencyMs: msSince(start), Message: "no peer certificate"}
+	}
+	exp := certs[0].NotAfter
+	res := Result{LatencyMs: msSince(start), CertExpiry: &exp}
+	warn := s.TLSWarnDays
+	if warn <= 0 {
+		warn = 14
+	}
+	remaining := time.Until(exp)
+	if remaining <= 0 {
+		res.Message = "certificate expired"
+		return res
+	}
+	if remaining <= time.Duration(warn)*24*time.Hour {
+		res.Message = fmt.Sprintf("certificate expires in %d days", int(remaining.Hours()/24))
+		return res
+	}
+	res.Up = true
+	return res
+}
+
+func msSince(t time.Time) int { return int(time.Since(t).Milliseconds()) }
+
+
+
+
+func runICMP(ctx context.Context, s Spec) Result {
+	dst, err := net.ResolveIPAddr("ip4", s.Host)
+	if err != nil {
+		return Result{Message: err.Error()}
+	}
+	conn, err := net.ListenPacket("ip4:icmp", "0.0.0.0")
+	if err != nil {
+		return Result{Message: "icmp socket: " + err.Error()}
+	}
+	defer conn.Close()
+
+	id := os.Getpid() & 0xffff
+	pkt := icmpEcho(id, 1)
+	deadline := time.Now().Add(s.timeout())
+	if d, ok := ctx.Deadline(); ok && d.Before(deadline) {
+		deadline = d
+	}
+	_ = conn.SetDeadline(deadline)
+
+	start := time.Now()
+	if _, err := conn.WriteTo(pkt, dst); err != nil {
+		return Result{Message: err.Error()}
+	}
+	reply := make([]byte, 1500)
+	for {
+		n, peer, err := conn.ReadFrom(reply)
+		if err != nil {
+			return Result{LatencyMs: msSince(start), Message: "no reply"}
+		}
+		
+		if n < 28 || peer.String() != dst.String() {
+			continue
+		}
+		if reply[20] == 0 { 
+			return Result{Up: true, LatencyMs: msSince(start)}
+		}
+	}
+}
+
+func icmpEcho(id, seq int) []byte {
+	
+	b := []byte{8, 0, 0, 0, byte(id >> 8), byte(id), byte(seq >> 8), byte(seq)}
+	cs := icmpChecksum(b)
+	b[2] = byte(cs >> 8)
+	b[3] = byte(cs)
+	return b
+}
+
+func icmpChecksum(b []byte) uint16 {
+	var sum uint32
+	for i := 0; i < len(b)-1; i += 2 {
+		sum += uint32(b[i])<<8 | uint32(b[i+1])
+	}
+	if len(b)%2 == 1 {
+		sum += uint32(b[len(b)-1]) << 8
+	}
+	for sum>>16 != 0 {
+		sum = (sum & 0xffff) + (sum >> 16)
+	}
+	return ^uint16(sum)
+}

agent/internal/config/config.go

@@ -9,7 +9,7 @@ import (
 	"gopkg.in/yaml.v3"
 )
 
-// ConfigDir returns the platform-specific config directory.
+
 func ConfigDir() string {
 	if runtime.GOOS == "windows" {
 		base := os.Getenv("ProgramData")

agent/internal/exec/exec.go

@@ -0,0 +1,164 @@
+package exec
+
+import (
+	"bufio"
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/mrhid6/vantage/agent/internal/grpc/pb"
+)
+
+
+
+
+type streamWriter struct {
+	mu   sync.Mutex
+	seq  uint64
+	emit func(seq uint64, data []byte)
+}
+
+func (w *streamWriter) Write(p []byte) (int, error) {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if w.emit != nil {
+		buf := make([]byte, len(p))
+		copy(buf, p)
+		w.emit(w.seq, buf)
+		w.seq++
+	}
+	return len(p), nil
+}
+
+
+
+func WorkspacePath(workspaceID string) string {
+	return filepath.Join(os.TempDir(), "vantage-run-"+workspaceID)
+}
+
+
+
+
+
+
+
+
+
+
+func RunStep(cmd *pb.RunStepCmd, emit func(seq uint64, data []byte)) *pb.StepResult {
+	res := &pb.StepResult{CommandId: "", OutputEnv: map[string]string{}}
+
+	dir, err := os.MkdirTemp("", "vantage-step-")
+	if err != nil {
+		res.ExitCode = 1
+		res.Stderr = "create temp dir: " + err.Error()
+		return res
+	}
+	defer os.RemoveAll(dir)
+
+	workDir := ""
+	if cmd.WorkspaceId != "" {
+		workDir = WorkspacePath(cmd.WorkspaceId)
+		if err := os.MkdirAll(workDir, 0700); err != nil {
+			res.ExitCode = 1
+			res.Stderr = "create workspace: " + err.Error()
+			return res
+		}
+	}
+
+	envFile := filepath.Join(dir, "workflow_env")
+	if err := os.WriteFile(envFile, nil, 0600); err != nil {
+		res.ExitCode = 1
+		res.Stderr = "create env file: " + err.Error()
+		return res
+	}
+
+	var scriptPath string
+	var c *exec.Cmd
+	timeout := time.Duration(cmd.TimeoutSeconds) * time.Second
+	if timeout <= 0 {
+		timeout = 30 * time.Minute
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+
+	switch cmd.Interpreter {
+	case "powershell":
+		scriptPath = filepath.Join(dir, "step.ps1")
+		if err := os.WriteFile(scriptPath, []byte(cmd.Script), 0600); err != nil {
+			res.ExitCode = 1
+			res.Stderr = err.Error()
+			return res
+		}
+		shell := "pwsh"
+		if runtime.GOOS == "windows" {
+			if _, err := exec.LookPath("pwsh"); err != nil {
+				shell = "powershell.exe"
+			}
+		}
+		c = exec.CommandContext(ctx, shell, "-NoProfile", "-NonInteractive", "-File", scriptPath)
+	default: 
+		scriptPath = filepath.Join(dir, "step.sh")
+		if err := os.WriteFile(scriptPath, []byte(cmd.Script), 0700); err != nil {
+			res.ExitCode = 1
+			res.Stderr = err.Error()
+			return res
+		}
+		c = exec.CommandContext(ctx, "bash", scriptPath)
+	}
+
+	if workDir != "" {
+		c.Dir = workDir
+	}
+
+	c.Env = append(os.Environ(), "WORKFLOW_ENV="+envFile)
+	for k, v := range cmd.Env {
+		c.Env = append(c.Env, k+"="+v)
+	}
+
+	sw := &streamWriter{emit: emit}
+	c.Stdout = sw
+	c.Stderr = sw
+	runErr := c.Run()
+
+	
+	if ctx.Err() == context.DeadlineExceeded {
+		res.ExitCode = 124
+		res.Stderr = "[vantage] step timed out"
+	} else if ee, ok := runErr.(*exec.ExitError); ok {
+		res.ExitCode = ee.ExitCode()
+	} else if runErr != nil {
+		res.ExitCode = 1
+		res.Stderr = "[vantage] " + runErr.Error()
+	}
+
+	res.OutputEnv = parseEnvFile(envFile)
+	return res
+}
+
+
+
+func parseEnvFile(path string) map[string]string {
+	out := map[string]string{}
+	f, err := os.Open(path)
+	if err != nil {
+		return out
+	}
+	defer f.Close()
+	sc := bufio.NewScanner(f)
+	sc.Buffer(make([]byte, 0, 64*1024), 1024*1024)
+	for sc.Scan() {
+		line := sc.Text()
+		i := strings.IndexByte(line, '=')
+		if i <= 0 {
+			continue
+		}
+		out[line[:i]] = line[i+1:]
+	}
+	return out
+}

agent/internal/grpc/client.go

@@ -27,8 +27,8 @@ func New(serverURL string, useTLS bool) (*Client, error) {
 	serverURL = strings.TrimPrefix(serverURL, "https://")
 	serverURL = strings.TrimPrefix(serverURL, "http://")
 
-	// Send a ping every 30s so proxies with a 60s idle timeout don't kill the
-	// long-lived CommandStream when no commands are flowing.
+	
+	
 	dialOpts := []grpc.DialOption{
 		grpc.WithKeepaliveParams(keepalive.ClientParameters{
 			Time:                30 * time.Second,
@@ -126,8 +126,32 @@ func (c *Client) ReportUpdates(serverID, agentToken string, updates []pb.Package
 	return err
 }
 
-// CommandStream opens a long-lived bidirectional stream for server-pushed commands.
-// The caller controls the stream lifetime via ctx.
+func (c *Client) ReportInventory(report *pb.InventoryReport) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	_, err := c.client.ReportInventory(ctx, report)
+	return err
+}
+
+func (c *Client) SyncMonitors(serverID, agentToken string) ([]pb.MonitorSpec, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	resp, err := c.client.SyncMonitors(ctx, &pb.SyncMonitorsRequest{ServerId: serverID, AgentToken: agentToken})
+	if err != nil {
+		return nil, err
+	}
+	return resp.Monitors, nil
+}
+
+func (c *Client) ReportChecks(serverID, agentToken string, results []pb.CheckResult) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	_, err := c.client.ReportChecks(ctx, &pb.ReportChecksRequest{ServerId: serverID, AgentToken: agentToken, Results: results})
+	return err
+}
+
+
+
 func (c *Client) CommandStream(ctx context.Context) (pb.Vantage_CommandStreamClient, error) {
 	return c.client.CommandStream(ctx)
 }

agent/internal/grpc/pb/vantage.pb.go

@@ -1,4 +1,4 @@
-// Hand-written gRPC bindings for vantage.proto (agent side, JSON codec).
+
 
 package pb
 
@@ -44,7 +44,7 @@ type UploadKeyResponse struct {
 	KeyId string `json:"key_id"`
 }
 
-// CommandStream message types
+
 
 type PackageUpdate struct {
 	Name           string `json:"name"`
@@ -60,14 +60,91 @@ type ReportUpdatesRequest struct {
 
 type ReportUpdatesResponse struct{}
 
+
+
+type CPUReport struct {
+	Model    string  `json:"model,omitempty"`
+	Cores    int     `json:"cores,omitempty"`
+	UsagePct float64 `json:"usage_pct"`
+	Load1    float64 `json:"load1,omitempty"`
+}
+type MemReport struct {
+	TotalBytes uint64 `json:"total_bytes"`
+	UsedBytes  uint64 `json:"used_bytes"`
+}
+type PartitionReport struct {
+	Device     string `json:"device"`
+	Mountpoint string `json:"mountpoint"`
+	Fstype     string `json:"fstype,omitempty"`
+	TotalBytes uint64 `json:"total_bytes"`
+	UsedBytes  uint64 `json:"used_bytes"`
+}
+type InventoryReport struct {
+	ServerId      string            `json:"server_id"`
+	AgentToken    string            `json:"agent_token"`
+	IncludeStatic bool              `json:"include_static"`
+	CPU           *CPUReport        `json:"cpu,omitempty"`
+	Memory        *MemReport        `json:"memory,omitempty"`
+	SwapTotal     uint64            `json:"swap_total"`
+	SwapUsed      uint64            `json:"swap_used"`
+	Partitions    []PartitionReport `json:"partitions,omitempty"`
+	Kernel        string            `json:"kernel,omitempty"`
+}
+type InventoryReportResponse struct{}
+
+
+
+type MonitorSpec struct {
+	MonitorId      string `json:"monitor_id"`
+	Type           string `json:"type"`
+	URL            string `json:"url,omitempty"`
+	Host           string `json:"host,omitempty"`
+	Port           int    `json:"port,omitempty"`
+	Method         string `json:"method,omitempty"`
+	ExpectedStatus int    `json:"expected_status,omitempty"`
+	Keyword        string `json:"keyword,omitempty"`
+	TLSWarnDays    int    `json:"tls_warn_days,omitempty"`
+	Insecure       bool   `json:"insecure,omitempty"`
+	IntervalSec    int    `json:"interval_sec"`
+	Retries        int    `json:"retries"`
+}
+type SyncMonitorsRequest struct {
+	ServerId   string `json:"server_id"`
+	AgentToken string `json:"agent_token"`
+}
+type SyncMonitorsResponse struct {
+	Monitors []MonitorSpec `json:"monitors,omitempty"`
+}
+type CheckResult struct {
+	MonitorId      string `json:"monitor_id"`
+	Up             bool   `json:"up"`
+	LatencyMs      int    `json:"latency_ms"`
+	Message        string `json:"message,omitempty"`
+	CertExpiryUnix int64  `json:"cert_expiry_unix,omitempty"`
+}
+type ReportChecksRequest struct {
+	ServerId   string        `json:"server_id"`
+	AgentToken string        `json:"agent_token"`
+	Results    []CheckResult `json:"results,omitempty"`
+}
+type ReportChecksResponse struct{}
+
 type ApplyUpdatesCmd struct{}
 
 type ServerCommand struct {
-	CommandId    string           `json:"command_id"`
-	GenerateKey  *GenerateKeyCmd  `json:"generate_key,omitempty"`
-	DeleteKey    *DeleteKeyCmd    `json:"delete_key,omitempty"`
-	UpdateAgent  *UpdateAgentCmd  `json:"update_agent,omitempty"`
-	ApplyUpdates *ApplyUpdatesCmd `json:"apply_updates,omitempty"`
+	CommandId        string               `json:"command_id"`
+	GenerateKey      *GenerateKeyCmd      `json:"generate_key,omitempty"`
+	DeleteKey        *DeleteKeyCmd        `json:"delete_key,omitempty"`
+	UpdateAgent      *UpdateAgentCmd      `json:"update_agent,omitempty"`
+	ApplyUpdates     *ApplyUpdatesCmd     `json:"apply_updates,omitempty"`
+	RunStep          *RunStepCmd          `json:"run_step,omitempty"`
+	CleanupWorkspace *CleanupWorkspaceCmd `json:"cleanup_workspace,omitempty"`
+}
+
+
+
+type CleanupWorkspaceCmd struct {
+	WorkspaceId string `json:"workspace_id"`
 }
 
 type DeleteKeyCmd struct {
@@ -88,10 +165,12 @@ type GenerateKeyCmd struct {
 }
 
 type AgentMessage struct {
-	ServerId   string         `json:"server_id"`
-	AgentToken string         `json:"agent_token"`
-	Ready      *AgentReady    `json:"ready,omitempty"`
-	Result     *CommandResult `json:"result,omitempty"`
+	ServerId   string            `json:"server_id"`
+	AgentToken string            `json:"agent_token"`
+	Ready      *AgentReady       `json:"ready,omitempty"`
+	Result     *CommandResult    `json:"result,omitempty"`
+	StepResult *StepResult       `json:"step_result,omitempty"`
+	StepOutput *StepOutputChunk  `json:"step_output,omitempty"`
 }
 
 type AgentReady struct{}
@@ -102,7 +181,32 @@ type CommandResult struct {
 	Message   string `json:"message"`
 }
 
-// CommandStream client-side interface
+type RunStepCmd struct {
+	Interpreter    string            `json:"interpreter"`
+	Script         string            `json:"script"`
+	Env            map[string]string `json:"env,omitempty"`
+	TimeoutSeconds int               `json:"timeout_seconds,omitempty"`
+	
+	
+	WorkspaceId string `json:"workspace_id,omitempty"`
+}
+
+type StepResult struct {
+	CommandId string            `json:"command_id"`
+	ExitCode  int               `json:"exit_code"`
+	Stdout    string            `json:"stdout,omitempty"`
+	Stderr    string            `json:"stderr,omitempty"`
+	OutputEnv map[string]string `json:"output_env,omitempty"`
+}
+
+type StepOutputChunk struct {
+	CommandId string `json:"command_id"`
+	Seq       uint64 `json:"seq"`
+	Data      []byte `json:"data,omitempty"`
+	Eof       bool   `json:"eof,omitempty"`
+}
+
+
 
 type Vantage_CommandStreamClient interface {
 	Send(*AgentMessage) error
@@ -126,7 +230,7 @@ func (c *vantageCommandStreamClient) Recv() (*ServerCommand, error) {
 	return m, nil
 }
 
-// CommandStream server-side interface (included for completeness)
+
 
 type Vantage_CommandStreamServer interface {
 	Send(*ServerCommand) error
@@ -155,6 +259,9 @@ type VantageClient interface {
 	SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error)
 	UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error)
 	ReportUpdates(ctx context.Context, in *ReportUpdatesRequest, opts ...grpc.CallOption) (*ReportUpdatesResponse, error)
+	ReportInventory(ctx context.Context, in *InventoryReport, opts ...grpc.CallOption) (*InventoryReportResponse, error)
+	SyncMonitors(ctx context.Context, in *SyncMonitorsRequest, opts ...grpc.CallOption) (*SyncMonitorsResponse, error)
+	ReportChecks(ctx context.Context, in *ReportChecksRequest, opts ...grpc.CallOption) (*ReportChecksResponse, error)
 	CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error)
 }
 
@@ -210,6 +317,30 @@ func (c *keyManagerClient) ReportUpdates(ctx context.Context, in *ReportUpdatesR
 	return out, nil
 }
 
+func (c *keyManagerClient) ReportInventory(ctx context.Context, in *InventoryReport, opts ...grpc.CallOption) (*InventoryReportResponse, error) {
+	out := new(InventoryReportResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/ReportInventory", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) SyncMonitors(ctx context.Context, in *SyncMonitorsRequest, opts ...grpc.CallOption) (*SyncMonitorsResponse, error) {
+	out := new(SyncMonitorsResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/SyncMonitors", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) ReportChecks(ctx context.Context, in *ReportChecksRequest, opts ...grpc.CallOption) (*ReportChecksResponse, error) {
+	out := new(ReportChecksResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/ReportChecks", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *keyManagerClient) CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error) {
 	desc := &grpc.StreamDesc{StreamName: "CommandStream", ServerStreams: true, ClientStreams: true}
 	stream, err := c.cc.NewStream(ctx, desc, "/vantage.v1.Vantage/CommandStream", opts...)

agent/internal/inventory/collect_linux.go

@@ -0,0 +1,157 @@
+
+
+package inventory
+
+import (
+	"bufio"
+	"os"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/mrhid6/vantage/agent/internal/grpc/pb"
+)
+
+func collect(r *pb.InventoryReport, includeStatic bool) {
+	r.CPU.UsagePct = cpuUsage()
+	r.CPU.Load1 = load1()
+	memTotal, memAvail, swapTotal, swapFree := meminfo()
+	if memTotal > memAvail {
+		r.Memory.UsedBytes = memTotal - memAvail
+	}
+	if swapTotal > swapFree {
+		r.SwapUsed = swapTotal - swapFree
+	}
+	if includeStatic {
+		r.Memory.TotalBytes = memTotal
+		r.SwapTotal = swapTotal
+		r.CPU.Model, r.CPU.Cores = cpuStatic()
+		r.Kernel = kernel()
+		r.Partitions = partitions()
+	}
+}
+
+func readProc(path string) string { b, _ := os.ReadFile(path); return string(b) }
+
+func cpuSample() (idle, total uint64) {
+	f, err := os.Open("/proc/stat")
+	if err != nil {
+		return
+	}
+	defer f.Close()
+	sc := bufio.NewScanner(f)
+	if sc.Scan() {
+		fields := strings.Fields(sc.Text()) 
+		for i, v := range fields[1:] {
+			n, _ := strconv.ParseUint(v, 10, 64)
+			total += n
+			if i == 3 { 
+				idle = n
+			}
+		}
+	}
+	return
+}
+
+func cpuUsage() float64 {
+	i1, t1 := cpuSample()
+	time.Sleep(100 * time.Millisecond)
+	i2, t2 := cpuSample()
+	dt := float64(t2 - t1)
+	if dt <= 0 {
+		return 0
+	}
+	return (1 - float64(i2-i1)/dt) * 100
+}
+
+func load1() float64 {
+	fields := strings.Fields(readProc("/proc/loadavg"))
+	if len(fields) > 0 {
+		v, _ := strconv.ParseFloat(fields[0], 64)
+		return v
+	}
+	return 0
+}
+
+func meminfo() (total, avail, swapTotal, swapFree uint64) {
+	f, err := os.Open("/proc/meminfo")
+	if err != nil {
+		return
+	}
+	defer f.Close()
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		fields := strings.Fields(sc.Text())
+		if len(fields) < 2 {
+			continue
+		}
+		kb, _ := strconv.ParseUint(fields[1], 10, 64)
+		b := kb * 1024
+		switch strings.TrimSuffix(fields[0], ":") {
+		case "MemTotal":
+			total = b
+		case "MemAvailable":
+			avail = b
+		case "SwapTotal":
+			swapTotal = b
+		case "SwapFree":
+			swapFree = b
+		}
+	}
+	return
+}
+
+func cpuStatic() (model string, cores int) {
+	f, err := os.Open("/proc/cpuinfo")
+	if err != nil {
+		return
+	}
+	defer f.Close()
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		line := sc.Text()
+		if strings.HasPrefix(line, "processor") {
+			cores++
+		} else if strings.HasPrefix(line, "model name") && model == "" {
+			if i := strings.Index(line, ":"); i >= 0 {
+				model = strings.TrimSpace(line[i+1:])
+			}
+		}
+	}
+	return
+}
+
+func kernel() string {
+	return strings.TrimSpace(readProc("/proc/sys/kernel/osrelease"))
+}
+
+func partitions() []pb.PartitionReport {
+	allowed := map[string]bool{"ext4": true, "xfs": true, "btrfs": true, "zfs": true, "vfat": true, "ntfs": true, "ext3": true}
+	f, err := os.Open("/proc/mounts")
+	if err != nil {
+		return nil
+	}
+	defer f.Close()
+	var out []pb.PartitionReport
+	seen := map[string]bool{}
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		fields := strings.Fields(sc.Text())
+		if len(fields) < 3 || !allowed[fields[2]] || seen[fields[1]] {
+			continue
+		}
+		seen[fields[1]] = true
+		var st syscall.Statfs_t
+		if syscall.Statfs(fields[1], &st) != nil {
+			continue
+		}
+		total := st.Blocks * uint64(st.Bsize)
+		free := st.Bavail * uint64(st.Bsize)
+		out = append(out, pb.PartitionReport{
+			Device: fields[0], Mountpoint: fields[1], Fstype: fields[2],
+			TotalBytes: total, UsedBytes: total - free,
+		})
+	}
+	return out
+}

agent/internal/inventory/collect_other.go

@@ -0,0 +1,8 @@
+
+
+package inventory
+
+import "github.com/mrhid6/vantage/agent/internal/grpc/pb"
+
+
+func collect(r *pb.InventoryReport, includeStatic bool) {}

agent/internal/inventory/inventory.go

@@ -0,0 +1,11 @@
+package inventory
+
+import "github.com/mrhid6/vantage/agent/internal/grpc/pb"
+
+
+
+func Collect(includeStatic bool) *pb.InventoryReport {
+	r := &pb.InventoryReport{IncludeStatic: includeStatic, CPU: &pb.CPUReport{}, Memory: &pb.MemReport{}}
+	collect(r, includeStatic)
+	return r
+}

agent/internal/keys/keys.go

@@ -96,16 +96,16 @@ func fingerprint(pubKey string) string {
 	return "MD5:" + strings.Join(pairs, ":")
 }
 
-// KeyGenOptions controls how ssh-keygen is invoked.
+
 type KeyGenOptions struct {
-	KeyType    string // ed25519 (default), rsa, ecdsa
-	KeySize    int    // bits; used for rsa and ecdsa
-	Passphrase string // empty = no passphrase
-	Comment    string // embedded in the public key
+	KeyType    string 
+	KeySize    int    
+	Passphrase string 
+	Comment    string 
 }
 
-// GenerateKeyPair generates an SSH keypair and returns the public key.
-// The private key is written to keyPath; keyPath+".pub" holds the public key.
+
+
 func GenerateKeyPair(keyPath string, opts KeyGenOptions) (string, error) {
 	if err := os.MkdirAll(filepath.Dir(keyPath), 0700); err != nil {
 		return "", err
@@ -139,8 +139,8 @@ func GenerateKeyPair(keyPath string, opts KeyGenOptions) (string, error) {
 	return strings.TrimSpace(string(pubData)), nil
 }
 
-// AddSSHIdentity writes an IdentityFile entry for keyPath into the managed
-// vantage.conf include file, and ensures ~/.ssh/config includes it.
+
+
 func AddSSHIdentity(keyPath string) error {
 	if err := os.MkdirAll(filepath.Dir(sshConfigPath), 0700); err != nil {
 		return fmt.Errorf("mkdir .ssh: %w", err)
@@ -150,7 +150,7 @@ func AddSSHIdentity(keyPath string) error {
 		return err
 	}
 
-	// Read existing managed config (it may not exist yet).
+	
 	var existing string
 	data, err := os.ReadFile(managedConfigPath)
 	if err != nil && !os.IsNotExist(err) {
@@ -161,7 +161,7 @@ func AddSSHIdentity(keyPath string) error {
 	line := "IdentityFile " + keyPath
 	for _, l := range strings.Split(existing, "\n") {
 		if strings.TrimSpace(l) == line {
-			return nil // already present
+			return nil 
 		}
 	}
 
@@ -176,7 +176,7 @@ func AddSSHIdentity(keyPath string) error {
 	return nil
 }
 
-// RemoveSSHIdentity removes the IdentityFile entry for keyPath from the managed config.
+
 func RemoveSSHIdentity(keyPath string) error {
 	data, err := os.ReadFile(managedConfigPath)
 	if os.IsNotExist(err) {
@@ -204,9 +204,9 @@ func RemoveSSHIdentity(keyPath string) error {
 	return nil
 }
 
-// ensureIncludeDirective adds "Include /root/.ssh/vantage.conf" to the top
-// of ~/.ssh/config if it is not already present. The Include must appear before
-// any Host stanzas to be effective for all connections.
+
+
+
 func ensureIncludeDirective() error {
 	data, err := os.ReadFile(sshConfigPath)
 	if err != nil && !os.IsNotExist(err) {
@@ -215,11 +215,11 @@ func ensureIncludeDirective() error {
 
 	for _, l := range strings.Split(string(data), "\n") {
 		if strings.TrimSpace(l) == includeDirective {
-			return nil // already present
+			return nil 
 		}
 	}
 
-	// Prepend the Include directive so it takes effect before any Host blocks.
+	
 	updated := includeDirective + "\n" + string(data)
 	if err := os.WriteFile(sshConfigPath, []byte(updated), 0600); err != nil {
 		return fmt.Errorf("write %s: %w", sshConfigPath, err)

agent/internal/monitors/monitors.go

@@ -0,0 +1,166 @@
+
+
+
+package monitors
+
+import (
+	"context"
+	"log"
+	"sync"
+	"time"
+
+	"github.com/mrhid6/vantage/agent/internal/checker"
+	"github.com/mrhid6/vantage/agent/internal/config"
+	grpcclient "github.com/mrhid6/vantage/agent/internal/grpc"
+	"github.com/mrhid6/vantage/agent/internal/grpc/pb"
+)
+
+
+const syncInterval = 30 * time.Second
+
+type runner struct {
+	intervalSec int
+	cancel      context.CancelFunc
+}
+
+
+func Run(ctx context.Context, cfg *config.Config) {
+	active := map[string]*runner{}
+	var mu sync.Mutex
+
+	
+	
+	results := make(chan pb.CheckResult, 64)
+	go reporter(ctx, cfg, results)
+
+	syncOnce := func() {
+		specs, err := fetchSpecs(cfg)
+		if err != nil {
+			log.Printf("monitors: sync: %v", err)
+			return
+		}
+		want := map[string]pb.MonitorSpec{}
+		for _, s := range specs {
+			want[s.MonitorId] = s
+		}
+
+		mu.Lock()
+		defer mu.Unlock()
+		for id, r := range active {
+			s, ok := want[id]
+			if !ok || s.IntervalSec != r.intervalSec {
+				r.cancel()
+				delete(active, id)
+			}
+		}
+		for id, s := range want {
+			if _, ok := active[id]; ok {
+				continue
+			}
+			rctx, cancel := context.WithCancel(ctx)
+			active[id] = &runner{intervalSec: s.IntervalSec, cancel: cancel}
+			go runSpec(rctx, s, results)
+		}
+	}
+
+	syncOnce()
+	t := time.NewTicker(syncInterval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			syncOnce()
+		}
+	}
+}
+
+func fetchSpecs(cfg *config.Config) ([]pb.MonitorSpec, error) {
+	client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+	if err != nil {
+		return nil, err
+	}
+	defer client.Close()
+	return client.SyncMonitors(cfg.ServerID, cfg.AgentToken)
+}
+
+func runSpec(ctx context.Context, s pb.MonitorSpec, out chan<- pb.CheckResult) {
+	interval := time.Duration(s.IntervalSec) * time.Second
+	if interval <= 0 {
+		interval = 60 * time.Second
+	}
+	spec := checker.Spec{
+		Type:           s.Type,
+		URL:            s.URL,
+		Host:           s.Host,
+		Port:           s.Port,
+		Method:         s.Method,
+		ExpectedStatus: s.ExpectedStatus,
+		Keyword:        s.Keyword,
+		TLSWarnDays:    s.TLSWarnDays,
+		Insecure:       s.Insecure,
+		TimeoutSec:     s.IntervalSec,
+	}
+
+	run := func() {
+		res := checker.Run(ctx, spec)
+		cr := pb.CheckResult{MonitorId: s.MonitorId, Up: res.Up, LatencyMs: res.LatencyMs, Message: res.Message}
+		if res.CertExpiry != nil {
+			cr.CertExpiryUnix = res.CertExpiry.Unix()
+		}
+		select {
+		case out <- cr:
+		case <-ctx.Done():
+		}
+	}
+
+	run()
+	t := time.NewTicker(interval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			run()
+		}
+	}
+}
+
+
+func reporter(ctx context.Context, cfg *config.Config, in <-chan pb.CheckResult) {
+	t := time.NewTicker(5 * time.Second)
+	defer t.Stop()
+	var batch []pb.CheckResult
+	flush := func() {
+		if len(batch) == 0 {
+			return
+		}
+		client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+		if err != nil {
+			log.Printf("monitors: report dial: %v", err)
+			batch = nil
+			return
+		}
+		if err := client.ReportChecks(cfg.ServerID, cfg.AgentToken, batch); err != nil {
+			log.Printf("monitors: report: %v", err)
+		}
+		client.Close()
+		batch = nil
+	}
+	for {
+		select {
+		case <-ctx.Done():
+			flush()
+			return
+		case r := <-in:
+			batch = append(batch, r)
+			if len(batch) >= 32 {
+				flush()
+			}
+		case <-t.C:
+			flush()
+		}
+	}
+}

agent/internal/sync/sync.go

@@ -14,12 +14,16 @@ import (
 	"path/filepath"
 	"runtime"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/mrhid6/vantage/agent/internal/config"
+	agentexec "github.com/mrhid6/vantage/agent/internal/exec"
 	grpcclient "github.com/mrhid6/vantage/agent/internal/grpc"
 	"github.com/mrhid6/vantage/agent/internal/grpc/pb"
+	"github.com/mrhid6/vantage/agent/internal/inventory"
 	"github.com/mrhid6/vantage/agent/internal/keys"
+	"github.com/mrhid6/vantage/agent/internal/monitors"
 	"github.com/mrhid6/vantage/agent/internal/updates"
 )
 
@@ -30,7 +34,7 @@ func Run(ctx context.Context, cfg *config.Config, version string) error {
 	}
 	defer client.Close()
 
-	// Register if we have a pre-reg token
+	
 	if cfg.PreRegToken != "" {
 		log.Println("registering with server...")
 		hostname, _ := os.Hostname()
@@ -57,19 +61,25 @@ func Run(ctx context.Context, cfg *config.Config, version string) error {
 	}
 
 	if cfg.AgentToken == "" {
-		return fmt.Errorf("no agent token available — registration required")
+		return fmt.Errorf("no agent token available registration required")
 	}
 
-	// Start the command stream alongside the poll loop.
+	
 	go runCommandStream(ctx, cfg)
 
-	// Check for OS updates on startup and then hourly.
+	
 	go runUpdateCheck(ctx, cfg)
 
+	
+	go runInventory(ctx, cfg)
+
+	
+	go monitors.Run(ctx, cfg)
+
 	ticker := time.NewTicker(cfg.PollInterval)
 	defer ticker.Stop()
 
-	// Run immediately on startup
+	
 	if err := poll(client, cfg, version); err != nil {
 		log.Printf("poll error: %v", err)
 	}
@@ -92,7 +102,6 @@ func poll(client *grpcclient.Client, cfg *config.Config, version string) error {
 		return fmt.Errorf("SyncKeys: %w", err)
 	}
 
-	// Windows agents register and heartbeat only — no authorized_keys management.
 	if runtime.GOOS != "linux" {
 		return nil
 	}
@@ -114,8 +123,8 @@ func poll(client *grpcclient.Client, cfg *config.Config, version string) error {
 	return nil
 }
 
-// runCommandStream maintains a persistent bidirectional stream with the server
-// for instant command delivery. Reconnects with exponential backoff on failure.
+
+
 func runCommandStream(ctx context.Context, cfg *config.Config) {
 	backoff := time.Second
 	const maxBackoff = 2 * time.Minute
@@ -168,6 +177,16 @@ func connectAndHandleStream(ctx context.Context, cfg *config.Config) error {
 
 	log.Println("command stream connected")
 
+	
+	
+	
+	var sendMu sync.Mutex
+	send := func(msg *pb.AgentMessage) error {
+		sendMu.Lock()
+		defer sendMu.Unlock()
+		return stream.Send(msg)
+	}
+
 	for {
 		cmd, err := stream.Recv()
 		if err != nil {
@@ -186,6 +205,34 @@ func connectAndHandleStream(ctx context.Context, cfg *config.Config) error {
 		if cmd.ApplyUpdates != nil {
 			go handleApplyUpdates(cfg, cmd)
 		}
+		if cmd.CleanupWorkspace != nil {
+			go handleCleanupWorkspace(cmd)
+		}
+		if cmd.RunStep != nil {
+			go func(rc *pb.RunStepCmd, cid string) {
+				emit := func(seq uint64, data []byte) {
+					_ = send(&pb.AgentMessage{
+						ServerId:   cfg.ServerID,
+						AgentToken: cfg.AgentToken,
+						StepOutput: &pb.StepOutputChunk{CommandId: cid, Seq: seq, Data: data},
+					})
+				}
+				res := agentexec.RunStep(rc, emit)
+				res.CommandId = cid
+				
+				_ = send(&pb.AgentMessage{
+					ServerId:   cfg.ServerID,
+					AgentToken: cfg.AgentToken,
+					StepOutput: &pb.StepOutputChunk{CommandId: cid, Eof: true},
+				})
+				_ = send(&pb.AgentMessage{
+					ServerId:   cfg.ServerID,
+					AgentToken: cfg.AgentToken,
+					StepResult: res,
+				})
+			}(cmd.RunStep, cmd.CommandId)
+			continue
+		}
 	}
 }
 
@@ -232,6 +279,40 @@ func runUpdateCheck(ctx context.Context, cfg *config.Config) {
 	}
 }
 
+
+
+func runInventory(ctx context.Context, cfg *config.Config) {
+	client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+	if err != nil {
+		log.Printf("inventory dial error: %v", err)
+		return
+	}
+	defer client.Close()
+
+	report := func(static bool) {
+		r := inventory.Collect(static)
+		r.ServerId = cfg.ServerID
+		r.AgentToken = cfg.AgentToken
+		if err := client.ReportInventory(r); err != nil {
+			log.Printf("report inventory: %v", err)
+		}
+	}
+
+	report(true) 
+	ticker := time.NewTicker(30 * time.Second)
+	defer ticker.Stop()
+	tick := 0
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			tick++
+			report(tick%30 == 0) 
+		}
+	}
+}
+
 func handleApplyUpdates(cfg *config.Config, cmd *pb.ServerCommand) {
 	log.Printf("applying OS updates (cmd=%s)…", cmd.CommandId)
 	if err := updates.ApplyAll(); err != nil {
@@ -240,7 +321,7 @@ func handleApplyUpdates(cfg *config.Config, cmd *pb.ServerCommand) {
 	}
 	log.Printf("OS updates applied successfully (cmd=%s)", cmd.CommandId)
 
-	// Re-report the (now empty) update list so the server reflects the new state.
+	
 	client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
 	if err != nil {
 		return
@@ -249,6 +330,16 @@ func handleApplyUpdates(cfg *config.Config, cmd *pb.ServerCommand) {
 	_ = client.ReportUpdates(cfg.ServerID, cfg.AgentToken, nil)
 }
 
+func handleCleanupWorkspace(cmd *pb.ServerCommand) {
+	id := cmd.CleanupWorkspace.WorkspaceId
+	dir := agentexec.WorkspacePath(id)
+	if err := os.RemoveAll(dir); err != nil {
+		log.Printf("cleanup workspace %s failed (cmd=%s): %v", dir, cmd.CommandId, err)
+		return
+	}
+	log.Printf("removed run workspace %s (cmd=%s)", dir, cmd.CommandId)
+}
+
 func handleDeleteKey(cmd *pb.ServerCommand) {
 	label := cmd.DeleteKey.Label
 	keyPath := fmt.Sprintf("/root/.ssh/vantage_%s", strings.ReplaceAll(label, " ", "_"))
@@ -272,21 +363,21 @@ func handleUpdateAgent(cmd *pb.ServerCommand) {
 	}
 
 	u := cmd.UpdateAgent
-	arch := runtime.GOARCH // "amd64" or "arm64"
+	arch := runtime.GOARCH 
 	tag := "agent%2Fv" + u.Version
 	binaryURL := fmt.Sprintf("%s/mrhid6/vantage/releases/download/%s/vantage-agent-linux-%s", u.GiteaBaseURL, tag, arch)
 	checksumURL := fmt.Sprintf("%s/mrhid6/vantage/releases/download/%s/checksums.txt", u.GiteaBaseURL, tag)
 
 	log.Printf("updating agent to v%s from %s (cmd=%s)", u.Version, u.GiteaBaseURL, cmd.CommandId)
 
-	// Download binary
+	
 	tmpBin := "/tmp/vantage-agent-update"
 	if err := downloadFile(binaryURL, tmpBin); err != nil {
 		log.Printf("update download failed (cmd=%s): %v", cmd.CommandId, err)
 		return
 	}
 
-	// Download and verify checksum
+	
 	checksumData, err := httpGetBytes(checksumURL)
 	if err != nil {
 		log.Printf("update checksum fetch failed (cmd=%s): %v", cmd.CommandId, err)
@@ -311,11 +402,11 @@ func handleUpdateAgent(cmd *pb.ServerCommand) {
 	exec.Command("systemctl", "restart", "vantage-agent").Run()
 }
 
-// handleUpdateAgentWindows downloads the latest MSI and launches msiexec to
-// perform a MajorUpgrade. msiexec is started DETACHED (via "cmd /c start") so
-// that when the upgrade stops the VantageAgent service, nssm's process-tree
-// kill of this agent does not also kill the installer mid-flight. Config
-// (server_id, agent_token) is preserved by setup.ps1 on upgrade.
+
+
+
+
+
 func handleUpdateAgentWindows(cmd *pb.ServerCommand) {
 	u := cmd.UpdateAgent
 	tag := "agent%2Fv" + u.Version
@@ -343,8 +434,8 @@ func handleUpdateAgentWindows(cmd *pb.ServerCommand) {
 
 	logPath := filepath.Join(os.TempDir(), "vantage-agent-msi.log")
 	log.Printf("launching msiexec for upgrade to v%s (cmd=%s)", u.Version, cmd.CommandId)
-	// "start" detaches msiexec from this process tree so the service stop
-	// during the upgrade does not terminate the installer.
+	
+	
 	up := exec.Command("cmd", "/c", "start", "", "/wait", "msiexec", "/i", msiPath, "/qn", "/norestart", "/l*v", logPath)
 	if err := up.Start(); err != nil {
 		log.Printf("failed to launch msiexec (cmd=%s): %v", cmd.CommandId, err)
@@ -353,7 +444,7 @@ func handleUpdateAgentWindows(cmd *pb.ServerCommand) {
 }
 
 func downloadFile(url, dest string) error {
-	resp, err := http.Get(url) //nolint:gosec
+	resp, err := http.Get(url) 
 	if err != nil {
 		return err
 	}
@@ -371,7 +462,7 @@ func downloadFile(url, dest string) error {
 }
 
 func httpGetBytes(url string) ([]byte, error) {
-	resp, err := http.Get(url) //nolint:gosec
+	resp, err := http.Get(url) 
 	if err != nil {
 		return nil, err
 	}
@@ -463,7 +554,7 @@ func localIP() string {
 	return ""
 }
 
-// GenerateAndUpload generates an SSH keypair and uploads the public key to the server.
+
 func GenerateAndUpload(cfg *config.Config, label string) error {
 	client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
 	if err != nil {

agent/internal/updates/updates.go

@@ -27,8 +27,8 @@ func detectPM() string {
 	return ""
 }
 
-// CheckAvailable returns the list of packages with available upgrades.
-// Returns nil, nil when no supported package manager is found.
+
+
 func CheckAvailable() ([]PackageUpdate, error) {
 	switch detectPM() {
 	case "apt":
@@ -48,11 +48,11 @@ func CheckAvailable() ([]PackageUpdate, error) {
 	}
 }
 
-// ApplyAll runs a full non-interactive upgrade using the detected package manager.
+
 func ApplyAll() error {
 	switch detectPM() {
 	case "apt":
-		// Refresh lists first, then upgrade.
+		
 		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 		defer cancel()
 		if err := exec.CommandContext(ctx, "apt-get", "update", "-qq").Run(); err != nil {
@@ -77,8 +77,8 @@ func ApplyAll() error {
 func checkApt() ([]PackageUpdate, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
 	defer cancel()
-	// Best-effort refresh; ignore errors (cached data is fine).
-	exec.CommandContext(ctx, "apt-get", "update", "-qq").Run() //nolint:errcheck
+	
+	exec.CommandContext(ctx, "apt-get", "update", "-qq").Run() 
 
 	out, err := exec.Command("apt", "list", "--upgradable").Output()
 	if err != nil {
@@ -88,7 +88,7 @@ func checkApt() ([]PackageUpdate, error) {
 	scanner := bufio.NewScanner(bytes.NewReader(out))
 	for scanner.Scan() {
 		line := scanner.Text()
-		// Format: package/suite version arch [upgradable from: old-ver]
+		
 		if !strings.Contains(line, "[upgradable from:") {
 			continue
 		}
@@ -111,7 +111,6 @@ func checkApt() ([]PackageUpdate, error) {
 func checkDnfYum(pm string) ([]PackageUpdate, error) {
 	cmd := exec.Command(pm, "check-update")
 	out, err := cmd.Output()
-	// Exit code 100 means updates are available — not an error.
 	if exitErr, ok := err.(*exec.ExitError); ok && exitErr.ExitCode() == 100 {
 		err = nil
 	}
@@ -133,7 +132,7 @@ func checkDnfYum(pm string) ([]PackageUpdate, error) {
 		if len(parts) < 2 {
 			continue
 		}
-		// name.arch  new-version  repo
+		
 		name := strings.SplitN(parts[0], ".", 2)[0]
 		updates = append(updates, PackageUpdate{Name: name, NewVersion: parts[1]})
 	}
@@ -146,7 +145,7 @@ func checkPacman() ([]PackageUpdate, error) {
 	scanner := bufio.NewScanner(bytes.NewReader(out))
 	for scanner.Scan() {
 		parts := strings.Fields(scanner.Text())
-		// Format: package old-version -> new-version
+		
 		if len(parts) < 4 {
 			continue
 		}
@@ -164,7 +163,7 @@ func checkZypper() ([]PackageUpdate, error) {
 	scanner := bufio.NewScanner(bytes.NewReader(out))
 	for scanner.Scan() {
 		line := scanner.Text()
-		// Data rows start with "v |" (available) or "i |" (installed but updatable).
+		
 		if !strings.HasPrefix(line, "v |") && !strings.HasPrefix(line, "i |") {
 			continue
 		}

claude.md

@@ -1,34 +1,38 @@
 # Vantage
 
-A self-hosted SSH key management system. A central server (Go + Next.js + MongoDB) manages public key assignments across servers. A lightweight Go agent runs on each managed server, polls the central server via gRPC, and atomically rewrites `/root/.ssh/authorized_keys` to match the desired state.
+A self-hosted, multi-tenant infrastructure control plane. It started as SSH key management and has grown into fleet management: SSH key assignment, workflow/script execution, service monitoring, a secrets vault, a browser console (SSH/RDP/VNC), and OS update management.
+
+A central server (Go + Next.js + MongoDB + Redis) drives a lightweight Go agent installed on each managed server. Agents poll over gRPC and also hold a bidirectional command stream for push-style commands.
 
 ---
 
 ## Architecture Overview
 
 ```
-┌─────────────────────────────────┐
-│  Next.js Frontend               │
-│  - Upload/manage keys           │
-│  - Add servers (install script) │
-│  - Assign/revoke per server     │
-└────────────┬────────────────────┘
-             │ REST
-┌────────────▼────────────────────┐
-│  Go Backend                     │
-│  - REST API for frontend        │
-│  - gRPC server for agents       │
-│  - MongoDB                      │
-└────────────┬────────────────────┘
-             │ gRPC (TLS)
-┌────────────▼────────────────────┐
-│  Go Agent (per server)          │
-│  - Polls every 30s              │
-│  - Rewrites authorized_keys     │
-│  - Can generate SSH keypairs    │
-└─────────────────────────────────┘
+┌──────────────────────────────────────────────┐
+│  Next.js 16 Frontend (web, :3000)            │
+│  servers · keys · workflows · monitors       │
+│  secrets · audit · console · settings        │
+└───────────────┬──────────────────────────────┘
+                │ REST + cookie session
+┌───────────────▼──────────────────────────────┐
+│  Go Backend (server)                         │
+│  :8080 REST (gin)   :9090 gRPC (agents)      │
+│  MongoDB (state) · Redis (sessions)          │
+│  monitor scheduler · workflow runner         │
+│  guacd tunnel proxy for browser console      │
+└───────────────┬──────────────────────────────┘
+                │ gRPC (TLS) — outbound from agent only
+┌───────────────▼──────────────────────────────┐
+│  Go Agent (per server, Linux + Windows)      │
+│  polls SyncKeys · CommandStream              │
+│  rewrites authorized_keys (Linux only)       │
+│  runs workflow steps · monitors · inventory  │
+└──────────────────────────────────────────────┘
 ```
 
+Multi-tenancy: every domain document carries `org_id`, and every service query is scoped by it. Org is resolved from the session, and optionally cross-checked against the request host (`<slug>.vantage.<tld>`).
+
 ---
 
 ## Repository Structure
@@ -36,143 +40,245 @@ A self-hosted SSH key management system. A central server (Go + Next.js + MongoD
 ```
 vantage/
 ├── agent/
-│   ├── cmd/main.go
+│   ├── cmd/main.go                  # flags: -generate-key
 │   └── internal/
-│       ├── config/
-│       ├── grpc/
-│       ├── keys/
-│       └── sync/
+│       ├── checker/                 # monitor check execution
+│       ├── config/                  # config.yaml load/save
+│       ├── exec/                    # workflow step execution
+│       ├── grpc/                    # client + generated pb
+│       ├── inventory/               # CPU/mem/disk collection (linux/other)
+│       ├── keys/                    # authorized_keys read/diff/write
+│       ├── monitors/                # agent-run monitor loop
+│       ├── sync/                    # poll loop + command stream
+│       └── updates/                 # OS package update check/apply
 ├── server/
 │   ├── cmd/main.go
 │   └── internal/
-│       ├── api/          # REST handlers for Next.js
-│       ├── grpc/         # gRPC server implementation
-│       ├── models/       # MongoDB models
-│       └── services/
-│           ├── keys.go
-│           ├── servers.go
-│           └── sync.go   # builds desired state per server
-├── web/
-│   ├── app/
-│   └── components/
-├── proto/
-│   └── vantage/v1/vantage.proto
-├── deploy/
-│   ├── docker-compose.yml
-│   └── agent.service
-└── .gitea/
-    └── workflows/
-        ├── agent-release.yml
-        └── server-deploy.yml
+│       ├── api/                     # REST handlers
+│       ├── auth/                    # local, OIDC, session, middleware, orghost
+│       ├── checker/                 # server-run monitor checks
+│       ├── db/                      # mongo connect + Col()
+│       ├── grpc/                    # gRPC server + generated pb
+│       ├── models/                  # MongoDB documents
+│       ├── monitorsched/            # server-side monitor scheduler
+│       ├── notify/                  # smtp, http, templating, dispatch
+│       └── services/                # business logic + migrations
+├── web/                             # the application UI (authenticated)
+│   ├── app/(app)/                   # authed routes
+│   ├── app/login, app/setup         # unauthed routes
+│   ├── components/                  # ui/, workflows/, monitors/, Sidebar
+│   └── lib/                         # api client, guac console, query client
+├── site/                            # public marketing site
+│   ├── app/                         # one directory per route
+│   ├── components/                  # Nav, Footer, Logo, InstrumentPanel, forms
+│   ├── assets/                      # image sources, not served
+│   └── Dockerfile                   # same shape as web/: standalone, node, 3000
+├── sitesvc/                         # public forms: contact mail + signup
+│   ├── cmd/main.go
+│   └── internal/
+│       ├── api/                     # contact, signup, verify
+│       ├── mail/                    # SMTP
+│       ├── models/                  # mirrors server org/user + pending signup
+│       ├── provision/               # slug rules mirrored from the control plane
+│       └── store/                   # mongo: pending signups, org/user creation
+├── proto/vantage/v1/vantage.proto
+├── installer/                       # Windows: setup.ps1, nssm.exe, WiX .wxs
+├── deploy/                          # docker-compose.yml, agent.service
+└── .gitea/workflows/                # agent-release.yml, server-deploy.yml
 ```
 
 ---
 
+## Subsystems
+
+### SSH keys
+
+Upload a public key, assign it per server, revoke softly. The agent diffs desired vs on-disk state and rewrites `/root/.ssh/authorized_keys` atomically. Keys can also be generated _on_ a server by the agent; the private half can optionally be uploaded and is stored AES-256-GCM encrypted.
+
+### Workflows
+
+A library of reusable **steps** (bash or PowerShell scripts with declared inputs, outputs, and secret refs) composed into **workflows** targeting a set of servers. Running one snapshots the resolved steps into a `WorkflowRun`, then dispatches `RunStepCmd` over the agent command stream. Step stdout/stderr streams back as `StepOutputChunk` and is written to a log file on disk; the UI streams it live. Steps support `on_failure: stop|continue|retry`, per-run env passed between steps via `output_env`, and a per-run workspace directory the agent cleans up at the end.
+
+Default steps are seeded per org at boot (`SeedDefaultSteps`). Logs are swept by retention (`workflow_log_retention_days`; nil = 30 days, 0 = forever).
+
+### Monitors
+
+HTTP, TCP, ICMP and TLS checks. Each monitor has a `runner`: `"server"` (executed by the server-side scheduler) or a `server_id` (pushed to that agent, which runs it locally and reports results). Consecutive failures beyond `retries` flip state to `down`, open an `Incident`, and notify. Hourly `Rollup` documents back the uptime graphs.
+
+### Notification channels
+
+Per-org outbound destinations: `webhook`, `smtp`, `discord`, `slack`, `telegram`. Monitors reference channels by ID. Channels are testable from the UI.
+
+### Secrets vault
+
+Key/value pairs grouped by name, encrypted at rest with AES-256-GCM. Consumed two ways: referenced by workflow steps via `secret_refs` (injected as env at execution), and read by Kubernetes External Secrets Operator via `GET /api/secrets/:group/values` using a bearer token whose SHA-256 hash is stored in settings.
+
+### Browser console
+
+`POST /api/console/connect` mints a one-time session token; `GET /api/console/tunnel` upgrades to a WebSocket and proxies to **guacd** (Apache Guacamole daemon) using `github.com/wwt/guac`. SSH connections authenticate with a stored private key; RDP/VNC credentials are encrypted, single-use, and consumed when the tunnel opens.
+
+### Inventory and OS updates
+
+Agents report CPU/memory/swap/partitions/kernel — metrics every 30s, full static snapshot every 15 min. They also check for pending OS package updates hourly and can apply them on command (`ApplyUpdatesCmd`).
+
+### Agent self-update
+
+`UpdateAgentCmd` carries a target version and Gitea base URL; the agent downloads and replaces itself.
+
+### Marketing site and sitesvc
+
+`site/` is a separate Next.js app built exactly like `web/` — `output: "standalone"`, run by Node in a `node:26-alpine` image, listening on `3000` and published as `3001`. Both of its forms post to `sitesvc`; the control plane is not involved and has no public signup endpoint.
+
+`sitesvc/` (port `8082`) owns both flows end to end:
+
+| Form                | Endpoint                  | Effect                                                                  |
+| ------------------- | ------------------------- | ----------------------------------------------------------------------- |
+| Contact             | `POST /api/contact`       | Emails `support@hostxtra.co.uk`, `Reply-To` the sender. Nothing stored. |
+| Create organisation | `POST /api/signup`        | Records a pending signup and emails a verification link.                |
+| Verification link   | `GET /api/verify?token=…` | Creates the org and its owner, then redirects to the org's sign-in page (`APP_LOGIN_URL` with `{slug}` filled in). |
+
+All three are deliberately **excluded from the self-hosted deployment**: `deploy/docker-compose.yml` mentions none of them, and they live in `deploy/docker-compose.site.yml` instead.
+
+```bash
+# self-hosted install — no marketing site, no sitesvc
+docker compose up -d
+
+# vantage.hostxtra.co.uk — control plane plus the public site
+docker compose -f docker-compose.yml -f docker-compose.site.yml up -d
+```
+
+### Signup and verification
+
+**Nothing is written to `orgs` or `users` until the emailed link is opened.** A signup lands in sitesvc's own `site_pending_signups` collection holding the org name, the address, and the password already bcrypt-hashed at cost 12. The consequence is worth stating: an address nobody controls can never occupy an email, hold an organisation slug, or produce an account that can sign in. It also means the control plane's login path needs no concept of "unverified".
+
+- The token is 32 random bytes; only its **SHA-256 hash** is stored, so a leaked database yields no working links.
+- `Verify` deletes the pending record **atomically before provisioning** (`FindOneAndDelete`), so a double-clicked link cannot create two organisations — the second delete matches nothing.
+- Links expire after 24 hours, and a **TTL index** lets Mongo drop abandoned signups so password hashes do not linger.
+- Re-submitting the form for the same address replaces the previous pending record, so only the newest link works.
+- If the owner insert fails after the org is created, the org is rolled back rather than stranded holding a slug. The rollback refuses to touch an org that has users.
+- Rate limited to 3 signups per client IP per hour, plus a honeypot field.
+
+### The one piece of duplicated logic
+
+`sitesvc/internal/provision` and `sitesvc/internal/models` mirror the control plane's slug rules, reserved names, bcrypt cost and document shapes. They are duplicated rather than imported because sitesvc is a separate module that deliberately does not depend on the server.
+
+**Nothing enforces the match automatically.** If the control plane's `Slugify`, `reservedSlugs`, `CreateOrg` or `CreateUser` change, update `sitesvc/internal/provision` in the same commit — a divergence would provision tenants under rules the app does not agree with.
+
+sitesvc also (re)declares the unique indexes on `users.email` and `orgs.slug` at boot so it does not depend on the server having started first. Creating an existing index is a no-op.
+
+---
+
+## Auth and Orgs
+
+- **Bootstrap** — first run has no users. `GET /auth/bootstrap-status` drives `/setup`, `POST /auth/bootstrap` creates the first org plus its owner.
+- **Local auth** — email + password (bcrypt), `POST /auth/login`.
+- **OIDC** — configured _per org_ (`org_oidc`), issuer + client ID + encrypted client secret. `/auth/oidc/start` → `/auth/oidc/callback`.
+- **Sessions** — opaque 32-byte hex ID in the `km_session` cookie, session body stored in Redis with a 24h TTL.
+- **Roles** — `owner`, `admin`, `member`. `/api/settings` and `/api/org/*` require owner or admin.
+- **Host/org guard** — `APP_ROOT_LABEL` (default `vantage`) defines the app root label. A request to `<slug>.vantage.<tld>` resolves that org from the slug and rejects sessions belonging to a different one. Org lookups are cached for 60s.
+
+Unique indexes on user email and org slug are a **security property**, not an optimisation: `GetUserByEmail` does an unscoped `FindOne`, so duplicates would let the OIDC cross-org guard compare against an arbitrary user. Same for duplicate settings docs and duplicate ESO token hashes.
+
+---
+
 ## gRPC API
 
 ```protobuf
-syntax = "proto3";
-package vantage.v1;
-
 service Vantage {
-  rpc Register(RegisterRequest)           returns (RegisterResponse);
-  rpc SyncKeys(SyncRequest)               returns (SyncResponse);
-  rpc UploadGeneratedKey(UploadKeyRequest) returns (UploadKeyResponse);
-}
-
-message RegisterRequest {
-  string server_id      = 1;
-  string pre_reg_token  = 2;
-  string hostname       = 3;
-  string ip_address     = 4;
-  string os_info        = 5;
-}
-message RegisterResponse {
-  string agent_token = 1;
-}
-
-message SyncRequest {
-  string server_id   = 1;
-  string agent_token = 2;
-}
-message SyncResponse {
-  repeated string public_keys = 1; // full authorized_keys lines
-}
-
-message UploadKeyRequest {
-  string server_id   = 1;
-  string agent_token = 2;
-  string public_key  = 3;
-  string label       = 4;
-}
-message UploadKeyResponse {
-  string key_id = 1;
+  rpc Register(RegisterRequest)              returns (RegisterResponse);
+  rpc SyncKeys(SyncRequest)                  returns (SyncResponse);
+  rpc UploadGeneratedKey(UploadKeyRequest)   returns (UploadKeyResponse);
+  rpc ReportUpdates(ReportUpdatesRequest)    returns (ReportUpdatesResponse);
+  rpc ReportInventory(InventoryReport)       returns (InventoryReportResponse);
+  rpc SyncMonitors(SyncMonitorsRequest)      returns (SyncMonitorsResponse);
+  rpc ReportChecks(ReportChecksRequest)      returns (ReportChecksResponse);
+  rpc CommandStream(stream AgentMessage)     returns (stream ServerCommand);
 }
 ```
 
-No streaming — polling only. Poll interval: **30 seconds**.
+`CommandStream` is the only streaming RPC: the agent authenticates once with `AgentReady`, then the server pushes `ServerCommand`s and the agent replies with `CommandResult`, `StepResult`, or `StepOutputChunk`.
+
+`ServerCommand` variants: `GenerateKeyCmd`, `DeleteKeyCmd`, `UpdateAgentCmd`, `ApplyUpdatesCmd`, `RunStepCmd`, `CleanupWorkspaceCmd`.
+
+Key-state polling stays on the 30s `SyncKeys` interval. Full message definitions live in `proto/vantage/v1/vantage.proto`.
+
+---
+
+## REST API
+
+Unauthenticated:
+
+```
+GET  /install            /install.ps1        # dynamic agent install scripts
+GET  /update             /update.ps1
+GET  /auth/bootstrap-status
+POST /auth/bootstrap     /auth/login  /auth/logout
+GET  /auth/me            /auth/oidc/start    /auth/oidc/callback
+GET  /api/secrets/:group/values               # bearer token (ESO)
+```
+
+Session-authed under `/api`:
+
+```
+servers      GET,POST /servers · GET,POST /servers/new · GET,DELETE /servers/:id
+             POST /servers/:id/{generate-key,update-agent,apply-updates}
+keys         GET,POST /keys · GET,DELETE /keys/:id · GET /keys/:id/private-key
+             POST /keys/:id/assign · DELETE /keys/:id/assign/:serverId
+workflows    GET,POST /steps · PUT,DELETE /steps/:id · GET /steps/:id/export
+             POST /steps/{import,seed-defaults,parse} · GET /steps/usage
+             GET,POST /workflows · GET,PUT,DELETE /workflows/:id
+             POST /workflows/:id/run · GET /workflows/:id/runs
+             GET /runs/:runId · POST /runs/:runId/cancel
+             GET /runs/:runId/servers/:serverId/logs[/stream]
+monitors     GET,POST /monitors · GET,PUT,DELETE /monitors/:id
+             GET /monitors/:id/{incidents,uptime}
+channels     GET,POST /channels · PUT,DELETE /channels/:id · POST /channels/:id/test
+secrets      GET,POST /secrets · GET,PUT,DELETE /secrets/:group
+             POST /secrets/:group/reveal · DELETE /secrets/:group/:key
+console      POST /console/connect · GET /console/tunnel (websocket)
+audit        GET /audit
+agent        GET /agent/latest-version
+settings     GET,PUT /settings · POST /settings/secrets-token       (owner|admin)
+org          GET,POST /org/users · PUT /org/users/:id/role · DELETE /org/users/:id
+             GET,PUT /org/oidc                                       (owner|admin)
+```
 
 ---
 
 ## MongoDB Collections
 
-### `servers`
+`servers` · `keys` · `assignments` · `orgs` · `users` · `org_oidc` · `settings` · `secrets` · `workflows` · `workflow_steps` · `workflow_runs` · `monitors` · `incidents` · `monitor_rollups` · `notification_channels` · `console_sessions` · `audit_logs` · `migrations`
 
-```json
-{
-    "_id": "ObjectId",
-    "server_id": "uuid",
-    "hostname": "proxmox-node-1",
-    "ip_address": "10.10.10.5",
-    "os_info": "Ubuntu 24.04",
-    "pre_reg_token": "abc123",
-    "pre_reg_expires": "ISODate",
-    "agent_token_hash": "sha256...",
-    "status": "pending|active|offline",
-    "last_seen": "ISODate",
-    "created_at": "ISODate"
-}
-```
+Every document except `migrations` carries `org_id`. Struct definitions are the source of truth — see `server/internal/models/`.
 
-- `pre_reg_token` is cleared after the agent successfully calls `Register()`
-- `agent_token_hash` stores SHA-256 of the token — never plaintext
-- `status` transitions: `pending` → `active` on first `Register()`, `offline` if last_seen exceeds threshold
+`site_pending_signups` is written only by sitesvc and holds unverified signups; the control plane neither reads nor knows about it.
 
-### `keys`
+Notes that are not obvious from the structs:
 
-```json
-{
-    "_id": "ObjectId",
-    "key_id": "uuid",
-    "label": "dom-macbook",
-    "public_key": "ssh-ed25519 AAAA...",
-    "fingerprint": "SHA256:...",
-    "source": "uploaded|generated",
-    "generated_by_server_id": "uuid",
-    "created_at": "ISODate"
-}
-```
+- `servers.agent_token_hash` stores SHA-256 of the token, never plaintext. `pre_reg_token` is cleared after `Register()`. `status` is `pending` → `active` on register, `offline` when `last_seen` passes the threshold (swept every 2 min).
+- `servers.inventory` holds the latest metrics snapshot with separate `metrics_at` / `static_at` timestamps.
+- `keys.private_key_enc` and `passphrase_enc` are AES-256-GCM; the JSON form exposes only `has_private_key` / `has_passphrase`.
+- `assignments.revoked_at: null` means active. Revocation is soft, preserving audit history.
+- `workflow_runs.steps_snapshot` freezes the resolved steps so editing the library never rewrites history.
+- `console_sessions.token_consumed_at` is set atomically to enforce one-time use.
 
-### `assignments`
+### Migrations
 
-```json
-{
-    "_id": "ObjectId",
-    "key_id": "uuid",
-    "server_id": "uuid",
-    "assigned_at": "ISODate",
-    "revoked_at": "ISODate | null"
-}
-```
+`services.RunMigrations()` runs at boot, recording markers in `migrations`:
 
-- `revoked_at: null` = key is active on that server
-- Revocation is soft — set `revoked_at`, agent picks it up on next poll
+- `0001_default_org_backfill`
+- `0002_settings_org_backfill` (must run before 0003 — 0003 can create a `default` org, which pushes 0002 into its ambiguous multi-org branch)
+- `0003_missed_org_scopes`
+
+Index builders (`EnsureAuthIndexes`, `EnsureSettingsIndexes`) are fatal on failure; `EnsureSecretIndexes` and `EnsureWorkflowIndexes` only warn.
 
 ---
 
 ## Agent Lifecycle
 
-### Config file — `/etc/vantage/config.yaml`
+### Config file
+
+Linux `/etc/vantage/config.yaml`, Windows `%ProgramData%\vantage\config.yaml`. Directory `0700`, file `0600`.
 
 ```yaml
 server_url: "vantage.yourdomain.com:9090"
@@ -183,117 +289,119 @@ poll_interval: 30s
 tls: true
 ```
 
-Config file permissions: `0600`. Config directory: `0700`.
-
-### Startup flow
+### Startup
 
 ```
 1. Load config
-2. If pre_reg_token present:
-     → call Register(server_id, pre_reg_token, hostname, ip, os_info)
-     → save returned agent_token to config
-     → delete pre_reg_token from config
-3. Enter poll loop
+2. If pre_reg_token present → Register() → save agent_token, clear pre_reg_token, reconnect
+3. Start goroutines: command stream · update check (hourly) · inventory · monitors
+4. Enter SyncKeys poll loop (default 30s)
 ```
 
-### Poll loop (every 30s)
+### Poll loop
 
 ```
-1. Call SyncKeys(server_id, agent_token)
-2. Receive []public_keys
-3. Compute fingerprints of current /root/.ssh/authorized_keys
-4. If state unchanged → skip write
-5. If changed:
-     → write to /root/.ssh/authorized_keys.tmp
-     → os.Rename() to /root/.ssh/authorized_keys  (atomic)
-     → chmod 0600
+1. SyncKeys(server_id, agent_token, agent_version)
+2. Non-Linux hosts stop here — Windows agents register and heartbeat only
+3. Diff desired keys against /root/.ssh/authorized_keys; unchanged → no write
+4. Changed → write .tmp, os.Rename() over the real file, chmod 0600
 ```
 
-### Key generation (on demand)
+### Install
 
-- Triggered by a flag or API call from the server
-- Runs `ssh-keygen` via `exec.Command`
-- Uploads public key via `UploadGeneratedKey()`
-- Private key stays local on the machine
-
-### Systemd unit — `/etc/systemd/system/vantage-agent.service`
-
-```ini
-[Unit]
-Description=Vantage Agent
-After=network.target
-
-[Service]
-ExecStart=/usr/local/bin/vantage-agent
-Restart=always
-RestartSec=10
-User=root
-
-[Install]
-WantedBy=multi-user.target
-```
+Linux: systemd unit at `/etc/systemd/system/vantage-agent.service`, `Restart=always`, runs as root.
+Windows: MSI built by CI (WiX), or `installer/setup.ps1` registering the agent as a service via NSSM.
 
 ---
 
 ## Server Registration Flow
 
-1. Click **Add Server** in the UI
-2. Backend generates a short-lived pre-registration token (TTL: 1 hour) and a `server_id`
-3. UI displays a one-liner install command with copy button:
+1. **Add Server** in the UI calls `POST /api/servers/new`, which generates a `server_id` and a pre-registration token (TTL 1 hour, single-use).
+2. The UI shows a one-liner:
     ```bash
     curl -fsSL https://vantage.yourdomain.com/install | \
       bash -s -- --server-id=<id> --token=<token>
     ```
-4. Install script:
-    - Detects arch (`amd64` / `arm64`)
-    - Downloads agent binary from Gitea release
-    - Verifies SHA-256 checksum
-    - Writes `/etc/vantage/config.yaml`
-    - Installs and starts systemd unit
-5. On first `SyncKeys` call, server marks status as `active`
+    Windows gets the `/install.ps1` equivalent.
+3. The script detects arch, downloads the agent from the Gitea release, verifies the SHA-256 checksum, writes the config, installs and starts the service.
+4. The server flips to `active` on first sync.
 
-The backend serves `/install` dynamically, injecting the latest agent version by querying the Gitea API for the most recent `agent/v*` release tag.
+`/install` is served dynamically, injecting the latest agent version from the Gitea API.
+
+---
+
+## Environment Variables (server)
+
+| Name                       | Required        | Notes                                                                                                                                                      |
+| -------------------------- | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `GRPC_HOST`                | **yes**         | `host:port` agents dial. Boot fails without it — there is no safe default; falling back to the web host would hand agents a port that does not speak gRPC. |
+| `MONGO_URI`                | no              | default `mongodb://localhost:27017`                                                                                                                        |
+| `MONGO_DB`                 | no              | default `vantage`                                                                                                                                          |
+| `REDIS_ADDR`               | no              | default `localhost:6379`                                                                                                                                   |
+| `KEY_ENCRYPTION_KEY`       | yes in practice | 64-char hex (32 bytes) for AES-256-GCM. Required for private keys, secrets, OIDC secrets, RDP credentials.                                                 |
+| `GITEA_HOST`               | yes             | used to build install scripts and agent download URLs                                                                                                      |
+| `GUACD_ADDR`               | no              | default `guacd:4822`                                                                                                                                       |
+| `APP_ROOT_LABEL`           | no              | default `vantage`; wrong value disables the host/session org guard                                                                                         |
+| `VANTAGE_WORKFLOW_LOG_DIR` | no              | where run logs are written                                                                                                                                 |
+
+**sitesvc** (`deploy/docker-compose.site.yml` only):
+
+| Name                              | Required        | Notes                                                                                                                                                                                                                                                                                                                                            |
+| --------------------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `MONGO_URI`                       | yes             | **must point at the control plane's database**, or the app will not see organisations created here. The database name is read from the URI path (`mongodb://user:pass@host:27017/vantage?authSource=vantage`); a URI without one is refused at boot rather than defaulted. Note this differs from the server, which takes `MONGO_DB` separately. |
+| `PUBLIC_URL`                      | yes             | sitesvc's own public base URL; verification links are built from it                                                                                                                                                                                                                                                                              |
+| `APP_LOGIN_URL`                   | no              | template for the org sign-in URL a verified owner is redirected to. `{slug}` is replaced with the new org's slug (each org has its own subdomain), e.g. `https://{slug}.vantage.hostxtra.co.uk/login`. A value without `{slug}` is used verbatim; empty means a plain confirmation page.                                                             |
+| `SMTP_HOST` / `SMTP_FROM`         | yes             | without them both forms refuse (503) rather than silently dropping                                                                                                                                                                                                                                                                               |
+| `SMTP_TO`                         | no              | default `support@hostxtra.co.uk`; contact enquiries only                                                                                                                                                                                                                                                                                         |
+| `SMTP_PORT`                       | no              | default `587`; `465` uses implicit TLS                                                                                                                                                                                                                                                                                                           |
+| `SMTP_USERNAME` / `SMTP_PASSWORD` | no              | auth skipped when username is empty                                                                                                                                                                                                                                                                                                              |
+| `SITE_ORIGIN`                     | yes in practice | comma-separated allowed origins; unset refuses every cross-origin browser request                                                                                                                                                                                                                                                                |
+| `TRUST_PROXY`                     | no              | only `true` behind a proxy that overwrites `X-Forwarded-For`, or clients spoof past the rate limiter                                                                                                                                                                                                                                             |
+
+`deploy/docker-compose.yml` runs four services: `redis`, `guacd`, `server` (8080 + 9090), `web` (3000). MongoDB is external. `deploy/docker-compose.site.yml` adds the public marketing site on `3001` and is only used on vantage.hostxtra.co.uk.
 
 ---
 
 ## Security
 
-- gRPC over TLS (Let's Encrypt or self-signed with cert pinning on the agent)
-- Agent authenticates with a per-server token stored at `/etc/vantage/config.yaml` (`0600`)
-- Server stores `SHA-256(agent_token)` — never the plaintext token
-- Private keys generated by agents are encrypted at rest in MongoDB (AES-256)
-- `authorized_keys` written as `0600`, owned by root
-- Pre-registration tokens are short-lived (1 hour) and single-use
-- Agent runs as `root` (required for `/root/.ssh/authorized_keys` writes)
+- gRPC over TLS; agents connect outbound only, no inbound firewall holes on managed servers.
+- Per-server agent token stored as SHA-256 on the server, plaintext only in the agent's `0600` config.
+- Pre-registration tokens are short-lived (1 hour) and single-use.
+- AES-256-GCM at rest for private keys, key passphrases, vault secrets, OIDC client secrets, RDP/VNC credentials.
+- Console session tokens are one-time; RDP credentials are consumed on tunnel open.
+- ESO read token stored as a SHA-256 hash and rotatable.
+- Unique indexes on user email, org slug, settings org, and ESO token hash are load-bearing for tenant isolation.
+- `authorized_keys` written `0600`, owned by root. The agent runs as root because it must.
+- Every mutating API path writes an audit event.
 
 ---
 
-## Frontend Routes
+## Frontend
 
-| Route           | Purpose                                                              |
-| --------------- | -------------------------------------------------------------------- |
-| `/servers`      | List all servers, online/offline status badge, last seen timestamp   |
-| `/servers/new`  | Displays the one-liner install script with copy button               |
-| `/servers/[id]` | Keys installed on this server, trigger key generation, remove server |
-| `/keys`         | All keys — label, fingerprint, source, assigned count                |
-| `/keys/[id]`    | Assign key to servers, revoke per server                             |
+Next.js 16 (App Router) + React 18, Tailwind 3, TanStack Query. Guacamole client bundled locally in `web/lib/guacamole-common.js`.
+
+| Route                                                           | Purpose                                                                 |
+| --------------------------------------------------------------- | ----------------------------------------------------------------------- |
+| `/setup`                                                        | First-run bootstrap: create the first org and owner                     |
+| `/login`                                                        | Local or OIDC sign-in                                                   |
+| `/`                                                             | Fleet dashboard                                                         |
+| `/servers`, `/servers/new`, `/servers/[id]`                     | Fleet list, install one-liner, server detail (keys, inventory, updates) |
+| `/servers/[id]/console`                                         | Browser SSH/RDP/VNC session                                             |
+| `/keys`, `/keys/[id]`                                           | Key library; assign and revoke per server                               |
+| `/workflows`, `/workflows/[id]`, `/workflows/[id]/runs[/runId]` | Compose, run, and follow live logs                                      |
+| `/steps`                                                        | Reusable step library                                                   |
+| `/monitors`, `/monitors/new`, `/monitors/[id][/edit]`           | Checks, uptime, incidents                                               |
+| `/secrets`, `/secrets/[group]`                                  | Vault                                                                   |
+| `/audit`                                                        | Audit log                                                               |
+| `/settings`, `/settings/org`, `/settings/notifications`         | Alerts, members, OIDC, channels                                         |
 
 ---
 
 ## CI/CD — Gitea Actions
 
-### Agent release — `.gitea/workflows/agent-release.yml`
+### `agent-release.yml` — triggered by `agent/v*` tags
 
-Triggered by a `agent/v*` tag. Cross-compiles for `linux/amd64` and `linux/arm64`, creates a Gitea release with binaries and checksums.
-
-```yaml
-on:
-    push:
-        tags:
-            - "agent/v*"
-```
-
-Build command:
+Builds `linux/amd64`, `linux/arm64`, `windows/amd64`, writes `checksums.txt`, creates a Gitea release. A second `msi` job on `windows-2022` packages the WiX installer.
 
 ```bash
 GOOS=linux GOARCH=amd64 go build \
@@ -301,51 +409,51 @@ GOOS=linux GOARCH=amd64 go build \
   -o dist/vantage-agent-linux-amd64 ./cmd
 ```
 
-Release assets:
+### `server-deploy.yml` — triggered on every push to `main`
 
-- `vantage-agent-linux-amd64`
-- `vantage-agent-linux-arm64`
-- `checksums.txt`
+Builds and pushes four images to the Gitea container registry: `server`, `web`, `site` and `sitesvc`.
 
-### Server deploy — `.gitea/workflows/server-deploy.yml`
-
-Triggered on pushes to `main` touching `server/**`, `web/**`, or `proto/**`. Builds and pushes Docker images to the Gitea container registry, then deploys via SSH:
+Note that despite the name, **this workflow does not deploy** — it only builds and pushes. There is no SSH step and no path filter; every push to `main` rebuilds all three images. Rolling them out is a separate manual step on the host:
 
 ```bash
-cd /opt/vantage && docker compose pull && docker compose up -d --remove-orphans
+cd /opt/vantage && docker compose -f docker-compose.yml -f docker-compose.site.yml pull && \
+  docker compose -f docker-compose.yml -f docker-compose.site.yml up -d --remove-orphans
 ```
 
-### Tagging convention
+### Tagging
 
 ```bash
-# Release a new agent version
-git tag agent/v1.0.0 && git push origin agent/v1.0.0
-
-# Server + web deploy automatically on push to main
-git push origin main
+git tag agent/v1.0.0 && git push origin agent/v1.0.0   # agent release
+git push origin main                                    # server + web deploy
 ```
 
-### Required Gitea secrets / variables
+### Secrets / variables
 
-| Name                | Type     | Value                                      |
-| ------------------- | -------- | ------------------------------------------ |
-| `RELEASE_TOKEN`     | Secret   | Gitea API token with `write:release` scope |
-| `REGISTRY_USER`     | Secret   | Gitea username                             |
-| `REGISTRY_PASSWORD` | Secret   | Gitea token with `write:packages` scope    |
-| `DEPLOY_HOST`       | Secret   | IP/hostname of the server VM               |
-| `DEPLOY_USER`       | Secret   | SSH user for deploy                        |
-| `DEPLOY_SSH_KEY`    | Secret   | Private key for deploy SSH                 |
-| `GITEA_HOST`        | Variable | `gitea.hostxtra.co.uk`                     |
+| Name                 | Type     | Value                                                                                                                                                                               |
+| -------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `RELEASE_TOKEN`      | Secret   | Gitea API token, `write:release`                                                                                                                                                    |
+| `REGISTRY_USER`      | Secret   | Gitea username                                                                                                                                                                      |
+| `REGISTRY_PASSWORD`  | Secret   | Gitea token, `write:packages`                                                                                                                                                       |
+| `GITEA_HOST`         | Variable | `gitea.hostxtra.co.uk`                                                                                                                                                              |
+| `DOCKER_HOST`        | Variable | registry host used for image tags                                                                                                                                                   |
+| `API_URL`            | Variable | baked into the `web` image at build time                                                                                                                                            |
+| `SITE_API_URL`       | Variable | **browser-reachable** sitesvc URL, baked into the `site` image. Required — if empty, both forms report "not connected" and submit nowhere. Must also be in sitesvc's `SITE_ORIGIN`. |
+| `SITE_CONTACT_EMAIL` | Variable | optional; address shown when a form is misconfigured                                                                                                                                |
 
 ---
 
 ## Design Decisions
 
-- **gRPC over REST for agent communication** — strong typing, easy versioning, bi-directional streaming available later if push-based updates are needed
-- **Poll-only, no streaming** — 30s interval is sufficient for a homelab; simplifies agent implementation
-- **Outbound-only agent connections** — no inbound firewall holes required on managed servers
-- **Atomic `authorized_keys` rewrite** — write to `.tmp` then `os.Rename()` prevents partial writes
-- **Fingerprint diffing before write** — avoids unnecessary disk writes on unchanged state
-- **Soft revocation** — `revoked_at` timestamp rather than hard deletes; preserves audit history
-- **root only** — manages `/root/.ssh/authorized_keys` only; no per-user key management
-- **Gitea releases for agent binaries** — slots into existing act_runner CI pipeline; install script queries Gitea API for latest version at serve time
+- **gRPC for agent traffic** — strong typing and cheap versioning; polling for state, one bidirectional stream for commands.
+- **Outbound-only agents** — no inbound ports on managed servers, works behind NAT.
+- **Poll for keys, push for commands** — a 30s key poll is fine, but running a workflow step should not wait up to 30s.
+- **Atomic `authorized_keys` rewrite** — temp file plus `os.Rename()`; a machine that dies mid-write keeps the old file.
+- **Fingerprint diffing before write** — no disk churn on unchanged state.
+- **Soft revocation** — `revoked_at` rather than deletes; preserves audit history.
+- **Run snapshots** — workflow runs freeze their resolved steps so editing a step never rewrites past runs.
+- **Monitors run in two places** — server-side for external endpoints, agent-side for anything only reachable from inside the target network.
+- **Redis for sessions only** — all durable state stays in MongoDB; losing Redis logs everyone out and nothing else.
+- **guacd for console** — protocol handling is Guacamole's problem, not ours; we proxy the WebSocket and manage credentials.
+- **`org_id` on every document** — isolation enforced at the query layer, not by separate databases.
+- **root only** — manages `/root/.ssh/authorized_keys`; no per-user key management.
+- **Windows agents are second-class by design** — register, heartbeat, run steps, report inventory; no `authorized_keys` management.

deploy/docker-compose.site.yml

@@ -0,0 +1,27 @@
+services:
+    site:
+        image: gitea.hostxtra.co.uk/mrhid6/vantage/site:latest
+        restart: unless-stopped
+        ports:
+            - 3001:3000
+        depends_on:
+            - sitesvc
+
+    sitesvc:
+        image: gitea.hostxtra.co.uk/mrhid6/vantage/sitesvc:latest
+        restart: unless-stopped
+        ports:
+            - 8082:8082
+        environment:
+            PORT: "8082"
+            MONGO_URI: ${MONGO_URI:-}
+            PUBLIC_URL: ${SITE_PUBLIC_URL:-}
+            APP_LOGIN_URL: ${SITE_APP_LOGIN_URL:-}
+            SITE_ORIGIN: ${SITE_ORIGIN:-}
+            TRUST_PROXY: ${SITE_TRUST_PROXY:-false}
+            SMTP_HOST: ${SITE_SMTP_HOST:-}
+            SMTP_PORT: ${SITE_SMTP_PORT:-587}
+            SMTP_USERNAME: ${SITE_SMTP_USERNAME:-}
+            SMTP_PASSWORD: ${SITE_SMTP_PASSWORD:-}
+            SMTP_FROM: ${SITE_SMTP_FROM:-}
+            SMTP_TO: ${SITE_SMTP_TO:-support@hostxtra.co.uk}

deploy/docker-compose.yml

@@ -27,19 +27,17 @@ services:
       MONGO_URI: ${MONGO_URI:-}
       REDIS_ADDR: redis:6379
       GITEA_HOST: ${GITEA_HOST}
-      PUBLIC_HOST: ${PUBLIC_HOST}
       GRPC_HOST: ${GRPC_HOST}
       GRPC_PORT: "9090"
       HTTP_PORT: "8080"
-      OIDC_ISSUER: ${OIDC_ISSUER:-}
-      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
-      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
-      OIDC_REDIRECT_URL: ${OIDC_REDIRECT_URL:-}
       KEY_ENCRYPTION_KEY: ${KEY_ENCRYPTION_KEY:-}
+      VANTAGE_WORKFLOW_LOG_DIR: ${VANTAGE_WORKFLOW_LOG_DIR:-}
       GUACD_ADDR: guacd:4822
     depends_on:
       redis:
         condition: service_healthy
+    volumes:
+      - ./data:/data
   web:
     image: gitea.hostxtra.co.uk/mrhid6/vantage/web:latest
     restart: unless-stopped

docs/superpowers/specs/2026-07-17-web-console-design.md

@@ -1,241 +0,0 @@
-# Vantage Web Console (Guacamole Replacement) — Design
-
-**Date:** 2026-07-17
-**Status:** Approved design, pre-implementation
-
-## Goal
-
-Add a browser-based remote-access console to Vantage — SSH, RDP, and VNC into
-managed servers — as a self-hosted Guacamole replacement. Users select an SSH
-key to connect over SSH. RDP targets are reachable from a new Windows agent that
-registers the host and reports status. Windows agent ships as an MSI installer
-produced by CI.
-
-## Non-Goals (YAGNI)
-
-- Session recording / replay (may be added later).
-- Native Go RDP implementation (guacd handles protocol translation).
-- Per-user Linux/Windows account management from the agent.
-- Tunneling console traffic through the agent (direct network path assumed).
-
----
-
-## Architecture
-
-```
-Browser (guacamole-common-js, vendored — no CDN)
-   │  Guacamole protocol over WebSocket
-   ▼
-Go server: /api/console/tunnel   (github.com/wwt/guac)
-   │  Guacamole protocol over TCP :4822
-   ▼
-guacd container (Apache Guacamole daemon)
-   │  SSH :22 / RDP :3389 / VNC :5900  — direct to target IP
-   ▼
-Target host (LAN / VPN line-of-sight from server)
-```
-
-- **Browser:** loads vendored `guacamole-common-js`, renders RDP/VNC display and
-  SSH terminal. No external CDN (matches existing infra rules).
-- **Go server:** exposes a WebSocket tunnel endpoint using `github.com/wwt/guac`
-  (Go Guacamole tunnel library). No Java `guacamole-client` required.
-- **guacd:** new container in `deploy/docker-compose.yml`, bound to the internal
-  docker network only, reachable by the server on `:4822`.
-- **Network path:** guacd connects **directly** to the target IP. Requires the
-  central server to have network line-of-sight to hosts (homelab LAN / VPN). The
-  agent's outbound-only guarantee is unchanged — the console path is
-  server→target, not agent-mediated.
-
----
-
-## Data Model Changes
-
-### `keys` — extend to hold private material
-
-```json
-{
-  "key_id": "uuid",
-  "label": "dom-macbook",
-  "public_key": "ssh-ed25519 AAAA...",
-  "private_key_enc": "<AES-256-GCM ciphertext | null>",
-  "has_private": true,
-  "passphrase_enc": "<AES-256-GCM ciphertext | null>",
-  "fingerprint": "SHA256:...",
-  "source": "uploaded|generated",
-  "created_at": "ISODate"
-}
-```
-
-- A key may be created from an uploaded **private+public** pair, upload of a
-  public key only, or agent generation.
-- Agent key generation now also uploads `private_key_enc` (reuses the existing
-  AES-256 key used for at-rest encryption). Private key no longer stays local
-  only — it is stored encrypted so the console can reuse it.
-- Optional `passphrase_enc` for passphrase-protected private keys.
-- Console lists only keys where `has_private = true`.
-
-### `servers` — extend with console metadata
-
-```json
-{
-  "...": "...existing fields...",
-  "os_type": "linux|windows",
-  "console_protocols": ["ssh"],
-  "ssh_port": 22,
-  "rdp_port": 3389
-}
-```
-
-- `os_type` set at registration from the agent.
-- `console_protocols` lists enabled protocols per server (`ssh`, `rdp`, `vnc`).
-- Port fields default to standard ports, overridable in the UI.
-
-### `console_sessions` — new collection (audit)
-
-```json
-{
-  "session_id": "uuid",
-  "server_id": "uuid",
-  "protocol": "ssh|rdp|vnc",
-  "key_id": "uuid | null",
-  "user": "who opened it",
-  "started_at": "ISODate",
-  "ended_at": "ISODate | null",
-  "client_ip": "string"
-}
-```
-
----
-
-## Session Broker + Connection Flow
-
-New service: `server/internal/services/console.go`.
-
-1. Browser `POST /api/console/connect`
-   `{ server_id, protocol, key_id?, rdp_username?, rdp_password? }`.
-2. Broker validates request, loads the server (host IP, port for protocol),
-   loads the key and **decrypts `private_key_enc` in memory only**.
-3. Builds the guacd connection parameter map:
-   - **SSH:** `hostname`, `port`, `username`, `private-key` (decrypted),
-     `passphrase` (if any).
-   - **RDP:** `hostname`, `port`, `username`, `password`, `security=any`,
-     `ignore-cert=true`.
-   - **VNC:** `hostname`, `port`, `password`.
-4. Creates a `console_sessions` document, returns a short-lived signed session
-   token.
-5. Browser opens WebSocket `/api/console/tunnel?token=…`. The `wwt/guac` handler
-   validates the token, dials guacd `:4822`, and pipes bytes in both directions.
-6. On socket close, the broker sets `ended_at` on the session doc.
-
-### Security
-
-- Decrypted private keys and RDP passwords are **never persisted, never logged,
-  never sent to the browser** — passed only to guacd.
-- Session token: short TTL (~60s to open the WebSocket), single-use,
-  HMAC-signed, bound to the authenticated user.
-- guacd is bound to the internal docker network only; not exposed publicly.
-- At-rest encryption (`private_key_enc`, `passphrase_enc`) reuses the existing
-  AES-256 key already used for agent-generated private keys.
-
----
-
-## Windows Agent
-
-Same Go codebase as the Linux agent, with a reduced role: **register +
-heartbeat + status only**. No `authorized_keys` management (meaningless on
-Windows).
-
-- Build target: `GOOS=windows GOARCH=amd64` → `vantage-agent-windows-amd64.exe`.
-- Agent detects OS at registration and sends `os_type=windows`.
-- The key-sync loop is disabled on Windows via a runtime OS check (or build tag)
-  — no `authorized_keys` writes are ever attempted.
-- Config file: `C:\ProgramData\vantage\config.yaml`, locked down via ACL to the
-  equivalent of `0600`.
-- Runs as a Windows service via **nssm**.
-
----
-
-## Windows Installer (MSI)
-
-Agent ships as a WiX v4 MSI produced in CI.
-
-- **WiX v4** chosen because it is a dotnet tool that builds MSIs
-  **cross-platform** — runs on the Linux Gitea act_runner. (Inno Setup is
-  Windows-only and does not fit the runner.)
-- MSI bundles `vantage-agent.exe`, installs it to `C:\Program Files\Vantage\`,
-  and registers the nssm service (ships nssm or uses a CustomAction).
-- Accepts install parameters as MSI properties for silent/headless install:
-  ```
-  msiexec /i vantage-agent.msi /qn SERVERID=<id> TOKEN=<token> SERVERURL=vantage..:9090
-  ```
-- GUI install (double-click) prompts for server-id / token / server-url via a
-  dialog.
-
-### Two install paths
-
-1. **Installer direct** — user downloads `vantage-agent.msi`, double-clicks,
-   fills the dialog. No script required.
-2. **PowerShell one-liner** — served dynamically (like the existing bash
-   `/install`). Script downloads the `.msi`, verifies SHA-256, then runs
-   `msiexec /qn` with injected `SERVERID` / `TOKEN` / `SERVERURL`. Used by the
-   copy-paste "Add Server" flow.
-
-The PowerShell script (`/install.ps1`) steps:
-1. Detect arch.
-2. Download `vantage-agent.msi` from the latest Gitea `agent/v*` release.
-3. Verify SHA-256 against `checksums.txt`.
-4. Run `msiexec /i vantage-agent.msi /qn SERVERID=.. TOKEN=.. SERVERURL=..`.
-
----
-
-## Frontend Routes
-
-| Route                     | Change                                                        |
-| ------------------------- | ------------------------------------------------------------- |
-| `/servers`                | Show `os_type` badge, enabled console protocols               |
-| `/servers/[id]`           | Add **Connect** button(s) per enabled protocol                |
-| `/servers/[id]/console`   | New — full-screen console (guacamole-common-js), key picker   |
-| `/servers/new`            | Offer Windows (MSI) vs Linux (bash) install instructions      |
-
-Console page: select protocol + SSH key (SSH) or enter RDP credentials, call
-`/api/console/connect`, open the tunnel WebSocket, mount the Guacamole client.
-
----
-
-## CI/CD Changes
-
-### `agent-release.yml`
-
-- Add `windows/amd64` build: `vantage-agent-windows-amd64.exe`.
-- Add WiX v4 MSI build job → `vantage-agent.msi`.
-- Add both to `checksums.txt` and release assets.
-
-Release assets become:
-- `vantage-agent-linux-amd64`
-- `vantage-agent-linux-arm64`
-- `vantage-agent-windows-amd64.exe`
-- `vantage-agent.msi`
-- `checksums.txt`
-
-### `server-deploy.yml`
-
-- Add guacd service to `deploy/docker-compose.yml` (deployed alongside server).
-
----
-
-## New Dependencies
-
-- **Go:** `github.com/wwt/guac` (Guacamole tunnel/WebSocket in Go).
-- **Container:** `guacamole/guacd` official image.
-- **Frontend:** vendored `guacamole-common-js` (no CDN).
-- **CI:** WiX v4 dotnet tool; nssm binary bundled for the MSI.
-
----
-
-## Open Implementation Notes
-
-- Confirm `wwt/guac` API surface for connection-parameter passing and token auth
-  binding during implementation.
-- nssm packaging inside MSI: bundle the nssm binary as a payload + CustomAction,
-  or run `sc.exe`-based service install if nssm proves awkward in WiX.
-- ACL hardening of `C:\ProgramData\vantage\config.yaml` in the MSI CustomAction.

installer/setup.ps1

@@ -27,11 +27,13 @@ function Invoke-Native {
   }
 }
 
-# Like Invoke-Native but never throws — for teardown, where a missing/stopped
-# service must not abort the uninstall.
 function Invoke-NativeSoft {
   param([string]$File, [string[]]$Arguments)
   Write-Log ("RUN(soft): {0} {1}" -f $File, ($Arguments -join " "))
+  # Native stderr merged via 2>&1 becomes terminating errors under
+  # ErrorActionPreference=Stop; force Continue in this scope so a benign nssm
+  # message (e.g. "service has not been started") never aborts setup.
+  $ErrorActionPreference = "Continue"
   $out = & $File @Arguments 2>&1
   if ($out) { Write-Log ("OUT: {0}" -f ($out -join "`n")) }
   Write-Log ("EXIT: {0}" -f $LASTEXITCODE)
@@ -121,8 +123,10 @@ tls: true
   Invoke-Native -File $nssm -Arguments @("set", "VantageAgent", "AppRotateOnline", "1")
   Invoke-Native -File $nssm -Arguments @("set", "VantageAgent", "AppRotateBytes", "1048576")
 
-  # restart (not just start) so an upgrade picks up the new binary
-  Invoke-NativeSoft -File $nssm -Arguments @("restart", "VantageAgent")
+  # Service is freshly (re)installed and stopped here (teardown removed the old
+  # one on upgrade), so start it. "restart" would try to stop a not-running
+  # service and emit a stderr error.
+  Invoke-NativeSoft -File $nssm -Arguments @("start", "VantageAgent")
 
   Write-Log "=== setup ok ==="
   exit 0

installer/vantage-agent.wxs

@@ -1,10 +1,13 @@
 <?xml version="1.0" encoding="UTF-8"?>
+<?ifndef Version ?>
 <?define Version = "0.0.0.0" ?>
+<?endif?>
 <Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
   <Package Name="Vantage Agent" Manufacturer="Vantage"
            Version="$(var.Version)" UpgradeCode="7d1e6d2c-2a5f-4b3e-9c3a-8a1b2c3d4e5f"
            Scope="perMachine">
-    <MajorUpgrade DowngradeErrorMessage="A newer version is already installed." />
+    <MajorUpgrade DowngradeErrorMessage="A newer version is already installed."
+                  Schedule="afterInstallInitialize" />
     <MediaTemplate EmbedCab="yes" />
 
     <!-- Public properties settable via msiexec: SERVERID, TOKEN, SERVERURL -->

proto/vantage/v1/vantage.proto

@@ -9,6 +9,9 @@ service Vantage {
   rpc SyncKeys(SyncRequest)                    returns (SyncResponse);
   rpc UploadGeneratedKey(UploadKeyRequest)      returns (UploadKeyResponse);
   rpc ReportUpdates(ReportUpdatesRequest)       returns (ReportUpdatesResponse);
+  rpc ReportInventory(InventoryReport)          returns (InventoryReportResponse);
+  rpc SyncMonitors(SyncMonitorsRequest)         returns (SyncMonitorsResponse);
+  rpc ReportChecks(ReportChecksRequest)         returns (ReportChecksResponse);
   // Bidirectional stream: agent sends auth once, server pushes commands.
   rpc CommandStream(stream AgentMessage)        returns (stream ServerCommand);
 }
@@ -55,6 +58,8 @@ message AgentMessage {
   oneof payload {
     AgentReady    ready  = 3;
     CommandResult result = 4;
+    StepResult step_result = 5;
+    StepOutputChunk step_output = 6;
   }
 }
 
@@ -80,6 +85,80 @@ message ReportUpdatesRequest {
 
 message ReportUpdatesResponse {}
 
+message CPUReport {
+  string model     = 1;
+  int32  cores     = 2;
+  double usage_pct = 3;
+  double load1     = 4;
+}
+
+message MemReport {
+  uint64 total_bytes = 1;
+  uint64 used_bytes  = 2;
+}
+
+message PartitionReport {
+  string device      = 1;
+  string mountpoint  = 2;
+  string fstype      = 3;
+  uint64 total_bytes = 4;
+  uint64 used_bytes  = 5;
+}
+
+message InventoryReport {
+  string server_id      = 1;
+  string agent_token    = 2;
+  bool   include_static = 3;
+  CPUReport cpu         = 4;
+  MemReport memory      = 5;
+  uint64 swap_total     = 6;
+  uint64 swap_used      = 7;
+  repeated PartitionReport partitions = 8;
+  string kernel         = 9;
+}
+
+message InventoryReportResponse {}
+
+message MonitorSpec {
+  string monitor_id      = 1;
+  string type            = 2;
+  string url             = 3;
+  string host            = 4;
+  int32  port            = 5;
+  string method          = 6;
+  int32  expected_status = 7;
+  string keyword         = 8;
+  int32  tls_warn_days   = 9;
+  int32  interval_sec    = 10;
+  int32  retries         = 11;
+  bool   insecure        = 12;
+}
+
+message SyncMonitorsRequest {
+  string server_id   = 1;
+  string agent_token = 2;
+}
+
+message SyncMonitorsResponse {
+  repeated MonitorSpec monitors = 1;
+}
+
+message CheckResult {
+  string monitor_id       = 1;
+  bool   up               = 2;
+  int32  latency_ms       = 3;
+  string message          = 4;
+  int64  cert_expiry_unix = 5;
+}
+
+message ReportChecksRequest {
+  string server_id   = 1;
+  string agent_token = 2;
+  repeated CheckResult results = 3;
+}
+
+message ReportChecksResponse {}
+
 message ApplyUpdatesCmd {}
 
 message ServerCommand {
@@ -89,9 +168,17 @@ message ServerCommand {
     DeleteKeyCmd    delete_key    = 3;
     UpdateAgentCmd  update_agent  = 4;
     ApplyUpdatesCmd apply_updates = 5;
+    RunStepCmd      run_step      = 6;
+    CleanupWorkspaceCmd cleanup_workspace = 7;
   }
 }
 
+// CleanupWorkspaceCmd tells the agent to recursively remove the run's working
+// directory once all steps on that server have finished.
+message CleanupWorkspaceCmd {
+  string workspace_id = 1;
+}
+
 message DeleteKeyCmd {
   string label = 1;
 }
@@ -108,3 +195,26 @@ message GenerateKeyCmd {
   string passphrase = 4; // empty = no passphrase
   string comment    = 5; // embedded in public key
 }
+
+message RunStepCmd {
+  string interpreter      = 1; // "bash" | "powershell"
+  string script           = 2;
+  map<string, string> env = 3;
+  int32  timeout_seconds  = 4;
+  string workspace_id     = 5; // per-run working dir the agent creates & uses as cwd
+}
+
+message StepResult {
+  string command_id             = 1;
+  int32  exit_code              = 2;
+  string stdout                 = 3;
+  string stderr                 = 4;
+  map<string, string> output_env = 5;
+}
+
+message StepOutputChunk {
+  string command_id = 1;
+  uint64 seq        = 2;
+  bytes  data       = 3;
+  bool   eof        = 4;
+}

server/cmd/main.go

@@ -11,6 +11,7 @@ import (
 	"github.com/mrhid6/vantage/server/internal/auth"
 	"github.com/mrhid6/vantage/server/internal/db"
 	grpcserver "github.com/mrhid6/vantage/server/internal/grpc"
+	"github.com/mrhid6/vantage/server/internal/monitorsched"
 	"github.com/mrhid6/vantage/server/internal/services"
 )
 
@@ -18,26 +19,74 @@ func main() {
 	mongoURI := getEnv("MONGO_URI", "mongodb://localhost:27017")
 	dbName := getEnv("MONGO_DB", "vantage")
 
+	
+	
+	
+	if os.Getenv("GRPC_HOST") == "" {
+		log.Fatal("GRPC_HOST is required (host:port agents dial for gRPC)")
+	}
+
 	if err := db.Connect(mongoURI, dbName); err != nil {
 		log.Fatalf("failed to connect to MongoDB: %v", err)
 	}
 	log.Println("connected to MongoDB")
 
+	
+	
+	
+	
+	if err := services.EnsureAuthIndexes(); err != nil {
+		log.Fatalf("failed to ensure auth indexes: %v", err)
+	}
+	if err := services.RunMigrations(); err != nil {
+		log.Fatalf("migration failed: %v", err)
+	}
+	
+	
+	
+	if err := services.MigrateSettingsOrg(); err != nil {
+		log.Fatalf("settings org migration failed: %v", err)
+	}
+	if err := services.MigrateMissedOrgScopes(); err != nil {
+		log.Fatalf("missed org scope migration failed: %v", err)
+	}
+
 	if err := services.EnsureSecretIndexes(); err != nil {
 		log.Printf("warning: failed to ensure secret indexes: %v", err)
 	}
 
+	
+	
+	
+	if err := services.EnsureSettingsIndexes(); err != nil {
+		log.Fatalf("failed to ensure settings indexes: %v", err)
+	}
+
+	if err := services.EnsureWorkflowIndexes(); err != nil {
+		log.Printf("warning: failed to ensure workflow indexes: %v", err)
+	}
+
+	if orgIDs, err := services.ListOrgIDs(); err != nil {
+		log.Printf("warning: failed to list orgs for default step seeding: %v", err)
+	} else {
+		for _, orgID := range orgIDs {
+			if created, updated, err := services.SeedDefaultSteps(orgID); err != nil {
+				log.Printf("warning: failed to seed default steps for org %s: %v", orgID, err)
+			} else {
+				log.Printf("default steps seeded for org %s: %d created, %d updated", orgID, created, updated)
+			}
+		}
+	}
+
+	services.StartLogSweeper()
+
 	redisAddr := getEnv("REDIS_ADDR", "localhost:6379")
 	if err := auth.InitRedis(redisAddr); err != nil {
 		log.Fatalf("failed to connect to Redis: %v", err)
 	}
 	log.Println("connected to Redis")
 
-	if err := auth.InitOIDC(context.Background()); err != nil {
-		log.Fatalf("failed to initialise OIDC: %v", err)
-	}
-
-	// Background goroutine to mark offline servers
+	
 	go func() {
 		ticker := time.NewTicker(2 * time.Minute)
 		defer ticker.Stop()
@@ -48,14 +97,17 @@ func main() {
 		}
 	}()
 
-	// Start gRPC server
+	
 	go func() {
 		if err := grpcserver.StartGRPC(9090); err != nil {
 			log.Fatalf("gRPC server error: %v", err)
 		}
 	}()
 
-	// Start REST server
+	
+	monitorsched.Start(context.Background())
+
+	
 	r := gin.New()
 	r.Use(gin.Recovery())
 	r.Use(gin.LoggerWithConfig(gin.LoggerConfig{SkipPaths: []string{"/api/console/tunnel"}}))

server/internal/api/channels.go

@@ -0,0 +1,97 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/auth"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+func registerChannelRoutes(g *gin.RouterGroup) {
+	g.GET("/channels", listChannels)
+	g.POST("/channels", createChannel)
+	g.PUT("/channels/:id", updateChannel)
+	g.DELETE("/channels/:id", deleteChannel)
+	g.POST("/channels/:id/test", testChannel)
+}
+
+func listChannels(c *gin.Context) {
+	channels, err := services.ListChannels(auth.OrgID(c))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, channels)
+}
+
+func createChannel(c *gin.Context) {
+	var ch models.NotificationChannel
+	if err := c.ShouldBindJSON(&ch); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if ch.Name == "" || ch.Type == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "name and type are required"})
+		return
+	}
+	created, err := services.CreateChannel(auth.OrgID(c), &ch)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusCreated, created)
+}
+
+func updateChannel(c *gin.Context) {
+	var body struct {
+		Name    *string            `json:"name"`
+		Type    *string            `json:"type"`
+		Config  *map[string]string `json:"config"`
+		Enabled *bool              `json:"enabled"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	upd := bson.M{}
+	if body.Name != nil {
+		upd["name"] = *body.Name
+	}
+	if body.Type != nil {
+		upd["type"] = *body.Type
+	}
+	if body.Config != nil {
+		upd["config"] = *body.Config
+	}
+	if body.Enabled != nil {
+		upd["enabled"] = *body.Enabled
+	}
+	if len(upd) == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "no fields to update"})
+		return
+	}
+	if err := services.UpdateChannel(auth.OrgID(c), c.Param("id"), upd); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func deleteChannel(c *gin.Context) {
+	if err := services.DeleteChannel(auth.OrgID(c), c.Param("id")); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func testChannel(c *gin.Context) {
+	if err := services.TestChannel(auth.OrgID(c), c.Param("id")); err != nil {
+		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"status": "sent"})
+}

server/internal/api/console.go

@@ -8,13 +8,14 @@ import (
 	"time"
 
 	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/auth"
 	"github.com/mrhid6/vantage/server/internal/services"
 	"github.com/wwt/guac"
 )
 
-// POST /api/console/connect
-// Body: { server_id, protocol, key_id?, rdp_username?, rdp_password? }
-// Returns: { session_id, token, ws_path }
+
+
+
 func consoleConnect(c *gin.Context) {
 	var body struct {
 		ServerID    string `json:"server_id" binding:"required"`
@@ -29,13 +30,13 @@ func consoleConnect(c *gin.Context) {
 		return
 	}
 
-	srv, err := services.GetServer(body.ServerID)
+	srv, err := services.GetServer(auth.OrgID(c), body.ServerID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
 		return
 	}
 
-	sess, err := services.CreateConsoleSession(body.ServerID, body.Protocol, body.KeyID, actorFromCtx(c), c.ClientIP())
+	sess, err := services.CreateConsoleSession(auth.OrgID(c), body.ServerID, body.Protocol, body.KeyID, actorFromCtx(c), c.ClientIP())
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -47,20 +48,20 @@ func consoleConnect(c *gin.Context) {
 	}
 
 	if (body.Protocol == "rdp" || body.Protocol == "vnc") && (body.RDPUsername != "" || body.RDPPassword != "") {
-		if err := services.StashConsoleRDPCreds(sess.SessionID, body.RDPUsername, body.RDPPassword); err != nil {
+		if err := services.StashConsoleRDPCreds(auth.OrgID(c), sess.SessionID, body.RDPUsername, body.RDPPassword); err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return
 		}
 	}
 
 	if body.Protocol == "ssh" {
-		if err := services.SetConsoleSSHUser(sess.SessionID, body.SSHUsername); err != nil {
+		if err := services.SetConsoleSSHUser(auth.OrgID(c), sess.SessionID, body.SSHUsername); err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return
 		}
 	}
 
-	services.LogEvent("console.opened", actorFromCtx(c), srv.ServerID, "",
+	services.LogEvent(auth.OrgID(c), "console.opened", actorFromCtx(c), srv.ServerID, "",
 		"console session opened ("+body.Protocol+")")
 
 	c.JSON(http.StatusOK, gin.H{
@@ -70,8 +71,8 @@ func consoleConnect(c *gin.Context) {
 	})
 }
 
-// queryIntDefault reads a positive integer query param, falling back to def
-// when absent, unparseable, or non-positive.
+
+
 func queryIntDefault(r *http.Request, key string, def int) int {
 	v, err := strconv.Atoi(r.URL.Query().Get(key))
 	if err != nil || v <= 0 {
@@ -80,7 +81,7 @@ func queryIntDefault(r *http.Request, key string, def int) int {
 	return v
 }
 
-// GET /api/console/tunnel?token=... (WebSocket upgrade)
+
 func consoleTunnel(c *gin.Context) {
 	token := c.Query("token")
 	sessionID, err := services.VerifySessionToken(token)
@@ -88,35 +89,36 @@ func consoleTunnel(c *gin.Context) {
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
 		return
 	}
-	sess, err := services.GetConsoleSession(sessionID)
+	orgID := auth.OrgID(c)
+	sess, err := services.GetConsoleSession(orgID, sessionID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "session not found"})
 		return
 	}
 
-	// User-bound: the caller (authenticated via session cookie) must be the same
-	// user who opened the session. Blocks a leaked token being used by someone else.
+	
+	
 	if actor := actorFromCtx(c); actor != sess.User {
 		c.JSON(http.StatusForbidden, gin.H{"error": "session belongs to another user"})
 		return
 	}
 
-	// Single-use: atomically spend the token so a replay within its TTL is rejected.
-	if err := services.ConsumeSessionToken(sessionID); err != nil {
+	
+	if err := services.ConsumeSessionToken(orgID, sessionID); err != nil {
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "token already used"})
 		return
 	}
 
-	srv, err := services.GetServer(sess.ServerID)
+	srv, err := services.GetServer(auth.OrgID(c), sess.ServerID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
 		return
 	}
 
-	// Decrypt private key + passphrase in-memory only (ssh).
+	
 	var privKey, passphrase string
 	if sess.Protocol == "ssh" && sess.KeyID != "" {
-		privKey, err = services.GetPrivateKey(sess.KeyID)
+		privKey, err = services.GetPrivateKey(auth.OrgID(c), sess.KeyID)
 		if err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "selected key has no private material"})
 			return
@@ -126,7 +128,7 @@ func consoleTunnel(c *gin.Context) {
 
 	var rdpUser, rdpPass string
 	if sess.Protocol == "rdp" || sess.Protocol == "vnc" {
-		rdpUser, rdpPass, err = services.ConsumeConsoleRDPCreds(sessionID)
+		rdpUser, rdpPass, err = services.ConsumeConsoleRDPCreds(orgID, sessionID)
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": "could not load credentials"})
 			return
@@ -143,7 +145,7 @@ func consoleTunnel(c *gin.Context) {
 		guacdAddr = "guacd:4822"
 	}
 
-	// Build a guac tunnel config from our params.
+	
 	connect := func(r *http.Request) (guac.Tunnel, error) {
 		config := guac.NewGuacamoleConfiguration()
 		config.Protocol = gp.Protocol
@@ -171,7 +173,7 @@ func consoleTunnel(c *gin.Context) {
 
 	wsServer := guac.NewWebsocketServer(connect)
 	wsServer.OnDisconnect = func(id string, r *http.Request, t guac.Tunnel) {
-		_ = services.EndConsoleSession(sessionID)
+		_ = services.EndConsoleSession(orgID, sessionID)
 	}
 	wsServer.ServeHTTP(c.Writer, c.Request)
 }

server/internal/api/handlers.go

@@ -25,20 +25,18 @@ func RegisterRoutes(r *gin.Engine) {
 	r.GET("/update", handleUpdateScript)
 	r.GET("/update.ps1", handleUpdateScriptWindows)
 
-	// ESO read endpoint — bearer-token auth, not session auth, so Kubernetes
-	// External Secrets Operator can call it. Lives under /api (so the reverse
-	// proxy routes it to the backend) but on a distinct subpath to avoid
-	// colliding with the session-authed GET /api/secrets/:group. Returns a
-	// group as flat JSON.
 	r.GET("/api/secrets/:group/values", secretsReadAuth(), esoGetGroup)
 
-	// Auth endpoints (no session required)
-	r.GET("/auth/login", auth.HandleLogin)
-	r.GET("/auth/callback", auth.HandleCallback)
-	r.GET("/auth/logout", auth.HandleLogout)
+	
+	r.GET("/auth/bootstrap-status", auth.HandleBootstrapStatus)
+	r.POST("/auth/bootstrap", auth.HandleBootstrap)
+	r.POST("/auth/login", auth.HandleLocalLogin)
+	r.POST("/auth/logout", auth.HandleLogout)
 	r.GET("/auth/me", auth.HandleMe)
+	r.GET("/auth/oidc/start", auth.HandleOIDCStart)
+	r.GET("/auth/oidc/callback", auth.HandleOIDCCallback)
 
-	// API endpoints protected by session middleware
+	
 	apiGroup := r.Group("/api")
 	apiGroup.Use(auth.Middleware())
 	{
@@ -56,9 +54,13 @@ func RegisterRoutes(r *gin.Engine) {
 
 		apiGroup.GET("/audit", listAuditEvents)
 
-		apiGroup.GET("/settings", getSettings)
-		apiGroup.PUT("/settings", saveSettings)
-		apiGroup.POST("/settings/secrets-token", rotateSecretsToken)
+		settings := apiGroup.Group("/settings")
+		settings.Use(auth.RequireRole("owner", "admin"))
+		{
+			settings.GET("", getSettings)
+			settings.PUT("", saveSettings)
+			settings.POST("/secrets-token", rotateSecretsToken)
+		}
 
 		apiGroup.GET("/secrets", listSecretGroups)
 		apiGroup.POST("/secrets", createSecretGroup)
@@ -78,11 +80,26 @@ func RegisterRoutes(r *gin.Engine) {
 
 		apiGroup.POST("/console/connect", consoleConnect)
 		apiGroup.GET("/console/tunnel", consoleTunnel)
+
+		registerWorkflowRoutes(apiGroup)
+		registerMonitorRoutes(apiGroup)
+		registerChannelRoutes(apiGroup)
+
+		org := apiGroup.Group("/org")
+		org.Use(auth.RequireRole("owner", "admin"))
+		{
+			org.GET("/users", listOrgUsers)
+			org.POST("/users", createOrgUser)
+			org.PUT("/users/:id/role", updateOrgUserRole)
+			org.DELETE("/users/:id", deleteOrgUser)
+			org.GET("/oidc", getOrgOIDC)
+			org.PUT("/oidc", putOrgOIDC)
+		}
 	}
 }
 
 func listServers(c *gin.Context) {
-	servers, err := services.ListServers()
+	servers, err := services.ListServers(auth.OrgID(c))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -91,7 +108,7 @@ func listServers(c *gin.Context) {
 }
 
 func createServer(c *gin.Context) {
-	s, token, err := services.CreateServer()
+	s, token, err := services.CreateServer(auth.OrgID(c))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -104,21 +121,19 @@ func createServer(c *gin.Context) {
 }
 
 func newServer(c *gin.Context) {
-	s, token, err := services.CreateServer()
+	s, token, err := services.CreateServer(auth.OrgID(c))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("server.created", actorFromCtx(c), s.ServerID, "", "pre-registration token issued")
+	services.LogEvent(auth.OrgID(c), "server.created", actorFromCtx(c), s.ServerID, "", "pre-registration token issued")
 
 	giteaHost := os.Getenv("GITEA_HOST")
 	if giteaHost == "" {
 		giteaHost = "gitea.example.com"
 	}
-	host := os.Getenv("PUBLIC_HOST")
-	if host == "" {
-		host = "https://vantage.example.com"
-	}
+
+	host := publicHostFromRequest(c)
 
 	installCmd := fmt.Sprintf(
 		`curl -fsSL "%s/install?server_id=%s&token=%s" | bash`,
@@ -140,15 +155,15 @@ func newServer(c *gin.Context) {
 
 func getServer(c *gin.Context) {
 	id := c.Param("id")
-	s, err := services.GetServer(id)
+	s, err := services.GetServer(auth.OrgID(c), id)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
 		return
 	}
 
-	assignments, _ := services.GetAssignmentsWithKeysForServer(id)
+	assignments, _ := services.GetAssignmentsWithKeysForServer(auth.OrgID(c), id)
 
-	// Build response matching ServerWithKeys shape expected by frontend
+	
 	type serverResponse struct {
 		*models.Server
 		Keys interface{} `json:"keys"`
@@ -161,8 +176,8 @@ func getServer(c *gin.Context) {
 
 func deleteServer(c *gin.Context) {
 	id := c.Param("id")
-	s, _ := services.GetServer(id)
-	if err := services.DeleteServer(id); err != nil {
+	s, _ := services.GetServer(auth.OrgID(c), id)
+	if err := services.DeleteServer(auth.OrgID(c), id); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
@@ -170,7 +185,7 @@ func deleteServer(c *gin.Context) {
 	if s != nil {
 		hostname = s.Hostname
 	}
-	services.LogEvent("server.deleted", actorFromCtx(c), id, "", fmt.Sprintf("server %s deleted", hostname))
+	services.LogEvent(auth.OrgID(c), "server.deleted", actorFromCtx(c), id, "", fmt.Sprintf("server %s deleted", hostname))
 	c.JSON(http.StatusOK, gin.H{"deleted": true})
 }
 
@@ -189,7 +204,7 @@ func generateKey(c *gin.Context) {
 		body.Label = "generated"
 	}
 
-	s, err := services.GetServer(id)
+	s, err := services.GetServer(auth.OrgID(c), id)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
 		return
@@ -207,7 +222,7 @@ func generateKey(c *gin.Context) {
 		return
 	}
 
-	services.LogEvent("key.generation_dispatched", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("key generation dispatched (label=%s type=%s)", body.Label, body.KeyType))
+	services.LogEvent(auth.OrgID(c), "key.generation_dispatched", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("key generation dispatched (label=%s type=%s)", body.Label, body.KeyType))
 	c.JSON(http.StatusAccepted, gin.H{
 		"message":    "key generation command sent to agent",
 		"command_id": cmdID,
@@ -216,7 +231,7 @@ func generateKey(c *gin.Context) {
 }
 
 func listKeys(c *gin.Context) {
-	keys, err := services.ListKeys()
+	keys, err := services.ListKeys(auth.OrgID(c))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -236,18 +251,18 @@ func createKey(c *gin.Context) {
 		return
 	}
 
-	key, err := services.CreateKey(body.Label, body.PublicKey, "uploaded", "", body.PrivateKey, body.Passphrase)
+	key, err := services.CreateKey(auth.OrgID(c), body.Label, body.PublicKey, "uploaded", "", body.PrivateKey, body.Passphrase)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("key.uploaded", actorFromCtx(c), "", key.KeyID, fmt.Sprintf("key '%s' uploaded", key.Label))
+	services.LogEvent(auth.OrgID(c), "key.uploaded", actorFromCtx(c), "", key.KeyID, fmt.Sprintf("key '%s' uploaded", key.Label))
 	c.JSON(http.StatusCreated, key)
 }
 
 func getPrivateKey(c *gin.Context) {
 	id := c.Param("id")
-	plaintext, err := services.GetPrivateKey(id)
+	plaintext, err := services.GetPrivateKey(auth.OrgID(c), id)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
 		return
@@ -257,13 +272,13 @@ func getPrivateKey(c *gin.Context) {
 
 func getKey(c *gin.Context) {
 	id := c.Param("id")
-	key, err := services.GetKey(id)
+	key, err := services.GetKey(auth.OrgID(c), id)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "key not found"})
 		return
 	}
 
-	assignments, _ := services.GetAssignmentsWithServers(id)
+	assignments, _ := services.GetAssignmentsWithServers(auth.OrgID(c), id)
 
 	type keyResponse struct {
 		*models.Key
@@ -277,8 +292,8 @@ func getKey(c *gin.Context) {
 
 func deleteKey(c *gin.Context) {
 	id := c.Param("id")
-	k, _ := services.GetKey(id)
-	if err := services.DeleteKey(id); err != nil {
+	k, _ := services.GetKey(auth.OrgID(c), id)
+	if err := services.DeleteKey(auth.OrgID(c), id); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
@@ -286,7 +301,7 @@ func deleteKey(c *gin.Context) {
 	if k != nil {
 		label = k.Label
 	}
-	services.LogEvent("key.deleted", actorFromCtx(c), "", id, fmt.Sprintf("key '%s' deleted", label))
+	services.LogEvent(auth.OrgID(c), "key.deleted", actorFromCtx(c), "", id, fmt.Sprintf("key '%s' deleted", label))
 	c.JSON(http.StatusOK, gin.H{"deleted": true})
 }
 
@@ -300,12 +315,12 @@ func assignKey(c *gin.Context) {
 		return
 	}
 
-	a, err := services.AssignKey(keyID, body.ServerID)
+	a, err := services.AssignKey(auth.OrgID(c), keyID, body.ServerID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("key.assigned", actorFromCtx(c), body.ServerID, keyID, fmt.Sprintf("key %s assigned to server %s", keyID, body.ServerID))
+	services.LogEvent(auth.OrgID(c), "key.assigned", actorFromCtx(c), body.ServerID, keyID, fmt.Sprintf("key %s assigned to server %s", keyID, body.ServerID))
 	c.JSON(http.StatusCreated, a)
 }
 
@@ -313,11 +328,11 @@ func revokeAssignment(c *gin.Context) {
 	keyID := c.Param("id")
 	serverID := c.Param("serverId")
 
-	if err := services.RevokeAssignment(keyID, serverID); err != nil {
+	if err := services.RevokeAssignment(auth.OrgID(c), keyID, serverID); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("key.revoked", actorFromCtx(c), serverID, keyID, fmt.Sprintf("key %s revoked from server %s", keyID, serverID))
+	services.LogEvent(auth.OrgID(c), "key.revoked", actorFromCtx(c), serverID, keyID, fmt.Sprintf("key %s revoked from server %s", keyID, serverID))
 	c.JSON(http.StatusOK, gin.H{"revoked": true})
 }
 
@@ -332,7 +347,7 @@ func getLatestAgentVersion(c *gin.Context) {
 
 func updateAgent(c *gin.Context) {
 	id := c.Param("id")
-	s, err := services.GetServer(id)
+	s, err := services.GetServer(auth.OrgID(c), id)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
 		return
@@ -343,7 +358,7 @@ func updateAgent(c *gin.Context) {
 		c.JSON(http.StatusServiceUnavailable, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("agent.update_dispatched", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("agent update dispatched to %s (version %s)", s.Hostname, version))
+	services.LogEvent(auth.OrgID(c), "agent.update_dispatched", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("agent update dispatched to %s (version %s)", s.Hostname, version))
 	c.JSON(http.StatusAccepted, gin.H{
 		"message": "update command sent to agent",
 		"version": version,
@@ -352,7 +367,7 @@ func updateAgent(c *gin.Context) {
 
 func applyUpdates(c *gin.Context) {
 	id := c.Param("id")
-	s, err := services.GetServer(id)
+	s, err := services.GetServer(auth.OrgID(c), id)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
 		return
@@ -362,7 +377,7 @@ func applyUpdates(c *gin.Context) {
 		c.JSON(http.StatusServiceUnavailable, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("updates.applied", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("package update command dispatched to %s", s.Hostname))
+	services.LogEvent(auth.OrgID(c), "updates.applied", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("package update command dispatched to %s", s.Hostname))
 	c.JSON(http.StatusAccepted, gin.H{"message": "apply updates command sent to agent"})
 }
 
@@ -394,7 +409,7 @@ if [ -z "$LATEST" ]; then
 fi
 
 VERSION="${LATEST#agent/}"
-LATEST_ENCODED="${LATEST/\//%%2F}"
+LATEST_ENCODED="${LATEST/\
 BINARY_URL="https://${GITEA_HOST}/mrhid6/vantage/releases/download/${LATEST_ENCODED}/vantage-agent-linux-${ARCH}"
 CHECKSUM_URL="https://${GITEA_HOST}/mrhid6/vantage/releases/download/${LATEST_ENCODED}/checksums.txt"
 
@@ -429,7 +444,7 @@ func listAuditEvents(c *gin.Context) {
 			limit = n
 		}
 	}
-	events, err := services.ListAuditEvents(limit)
+	events, err := services.ListAuditEvents(auth.OrgID(c), limit)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -438,7 +453,7 @@ func listAuditEvents(c *gin.Context) {
 }
 
 func getSettings(c *gin.Context) {
-	s, err := services.GetSettings()
+	s, err := services.GetSettings(auth.OrgID(c))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -448,18 +463,19 @@ func getSettings(c *gin.Context) {
 
 func saveSettings(c *gin.Context) {
 	var body struct {
-		Alerts models.AlertSettings `json:"alerts"`
-		Email  models.EmailSettings `json:"email"`
+		Alerts                   models.AlertSettings `json:"alerts"`
+		Email                    models.EmailSettings `json:"email"`
+		WorkflowLogRetentionDays *int                 `json:"workflow_log_retention_days"`
 	}
 	if err := c.ShouldBindJSON(&body); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
-	if err := services.SaveSettings(body.Alerts, body.Email); err != nil {
+	if err := services.SaveSettings(auth.OrgID(c), body.Alerts, body.Email, body.WorkflowLogRetentionDays); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("settings.updated", actorFromCtx(c), "", "", "alert settings updated")
+	services.LogEvent(auth.OrgID(c), "settings.updated", actorFromCtx(c), "", "", "alert settings updated")
 	c.JSON(http.StatusOK, gin.H{"saved": true})
 }
 
@@ -471,14 +487,7 @@ func handleInstallScript(c *gin.Context) {
 	if giteaHost == "" {
 		giteaHost = "gitea.example.com"
 	}
-	publicHost := os.Getenv("PUBLIC_HOST")
-	if publicHost == "" {
-		publicHost = "vantage.example.com"
-	}
 	grpcHost := os.Getenv("GRPC_HOST")
-	if grpcHost == "" {
-		grpcHost = publicHost
-	}
 
 	script := fmt.Sprintf(`#!/usr/bin/env bash
 set -euo pipefail
@@ -486,9 +495,6 @@ set -euo pipefail
 SERVER_ID="%s"
 TOKEN="%s"
 GITEA_HOST="%s"
-KM_HOST="%s"
-KM_HOST="${KM_HOST#https://}"
-KM_HOST="${KM_HOST#http://}"
 GRPC_HOST="%s"
 GRPC_HOST="${GRPC_HOST#https://}"
 GRPC_HOST="${GRPC_HOST#http://}"
@@ -510,7 +516,7 @@ if [ -z "$LATEST" ]; then
 fi
 
 VERSION="${LATEST#agent/}"
-LATEST_ENCODED="${LATEST/\//%%2F}"
+LATEST_ENCODED="${LATEST/\
 BINARY_URL="https://${GITEA_HOST}/mrhid6/vantage/releases/download/${LATEST_ENCODED}/vantage-agent-linux-${ARCH}"
 CHECKSUM_URL="https://${GITEA_HOST}/mrhid6/vantage/releases/download/${LATEST_ENCODED}/checksums.txt"
 
@@ -561,7 +567,7 @@ systemctl daemon-reload
 systemctl enable --now vantage-agent
 
 echo "vantage-agent installed and started."
-`, serverID, token, giteaHost, publicHost, grpcHost)
+`, serverID, token, giteaHost, grpcHost)
 
 	c.Header("Content-Type", "text/x-shellscript")
 	c.String(http.StatusOK, script)

server/internal/api/install_ps1.go

@@ -16,13 +16,8 @@ func handleInstallScriptWindows(c *gin.Context) {
 	if giteaHost == "" {
 		giteaHost = "gitea.example.com"
 	}
+	
 	grpcHost := os.Getenv("GRPC_HOST")
-	if grpcHost == "" {
-		grpcHost = os.Getenv("PUBLIC_HOST")
-	}
-	if grpcHost == "" {
-		grpcHost = "vantage.example.com"
-	}
 
 	script := fmt.Sprintf(
 		"#Requires -RunAsAdministrator\n"+
@@ -55,9 +50,9 @@ func handleInstallScriptWindows(c *gin.Context) {
 	c.String(http.StatusOK, script)
 }
 
-// handleUpdateScriptWindows serves a PowerShell one-liner that upgrades an
-// already-installed Windows agent. No server_id/token needed: the MSI is a
-// MajorUpgrade and setup.ps1 preserves the existing config on upgrade.
+
+
+
 func handleUpdateScriptWindows(c *gin.Context) {
 	giteaHost := os.Getenv("GITEA_HOST")
 	if giteaHost == "" {

server/internal/api/monitors.go

@@ -0,0 +1,158 @@
+package api
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/auth"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+func registerMonitorRoutes(g *gin.RouterGroup) {
+	g.GET("/monitors", listMonitors)
+	g.POST("/monitors", createMonitor)
+	g.GET("/monitors/:id", getMonitor)
+	g.PUT("/monitors/:id", updateMonitor)
+	g.DELETE("/monitors/:id", deleteMonitor)
+	g.GET("/monitors/:id/incidents", getMonitorIncidents)
+	g.GET("/monitors/:id/uptime", getMonitorUptime)
+}
+
+func listMonitors(c *gin.Context) {
+	monitors, err := services.ListMonitors(auth.OrgID(c))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, monitors)
+}
+
+func createMonitor(c *gin.Context) {
+	var m models.Monitor
+	if err := c.ShouldBindJSON(&m); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if m.Name == "" || m.Type == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "name and type are required"})
+		return
+	}
+	created, err := services.CreateMonitor(auth.OrgID(c), &m)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusCreated, created)
+}
+
+func getMonitor(c *gin.Context) {
+	m, err := services.GetMonitor(auth.OrgID(c), c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if m == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "monitor not found"})
+		return
+	}
+	c.JSON(http.StatusOK, m)
+}
+
+func updateMonitor(c *gin.Context) {
+	var body struct {
+		Name        *string               `json:"name"`
+		Type        *string               `json:"type"`
+		Target      *models.MonitorTarget `json:"target"`
+		IntervalSec *int                  `json:"interval_sec"`
+		Runner      *string               `json:"runner"`
+		Retries     *int                  `json:"retries"`
+		Enabled     *bool                 `json:"enabled"`
+		ChannelIDs  *[]string             `json:"channel_ids"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	upd := bson.M{}
+	if body.Name != nil {
+		upd["name"] = *body.Name
+	}
+	if body.Type != nil {
+		upd["type"] = *body.Type
+	}
+	if body.Target != nil {
+		upd["target"] = *body.Target
+	}
+	if body.IntervalSec != nil {
+		upd["interval_sec"] = *body.IntervalSec
+	}
+	if body.Runner != nil {
+		upd["runner"] = *body.Runner
+	}
+	if body.Retries != nil {
+		upd["retries"] = *body.Retries
+	}
+	if body.Enabled != nil {
+		upd["enabled"] = *body.Enabled
+	}
+	if body.ChannelIDs != nil {
+		upd["channel_ids"] = *body.ChannelIDs
+	}
+	if len(upd) == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "no fields to update"})
+		return
+	}
+	if err := services.UpdateMonitor(auth.OrgID(c), c.Param("id"), upd); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func deleteMonitor(c *gin.Context) {
+	if err := services.DeleteMonitor(auth.OrgID(c), c.Param("id")); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func getMonitorIncidents(c *gin.Context) {
+	m, err := services.GetMonitor(auth.OrgID(c), c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if m == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "monitor not found"})
+		return
+	}
+	incidents, err := services.ListIncidents(auth.OrgID(c), c.Param("id"), 50)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, incidents)
+}
+
+func getMonitorUptime(c *gin.Context) {
+	m, err := services.GetMonitor(auth.OrgID(c), c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if m == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "monitor not found"})
+		return
+	}
+	since := time.Now().Add(-30 * 24 * time.Hour)
+	rollups, err := services.UptimeRollups(auth.OrgID(c), c.Param("id"), since)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, rollups)
+}

server/internal/api/org.go

@@ -0,0 +1,159 @@
+package api
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/auth"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+)
+
+func listOrgUsers(c *gin.Context) {
+	users, err := services.ListUsers(auth.OrgID(c))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, users)
+}
+
+
+
+
+func actorMayGrantOwner(c *gin.Context) bool {
+	return auth.Role(c) == models.RoleOwner
+}
+
+func createOrgUser(c *gin.Context) {
+	var body struct {
+		Email    string `json:"email"`
+		Password string `json:"password"`
+		Role     string `json:"role"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil || body.Email == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "email required"})
+		return
+	}
+	if body.Role == "" {
+		body.Role = models.RoleMember
+	}
+	if !models.ValidRole(body.Role) {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "role must be one of owner, admin, or member"})
+		return
+	}
+	if body.Role == models.RoleOwner && !actorMayGrantOwner(c) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "only an owner can create another owner"})
+		return
+	}
+	u, err := services.CreateUser(auth.OrgID(c), body.Email, body.Password, body.Role, "local")
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusCreated, u)
+}
+
+func updateOrgUserRole(c *gin.Context) {
+	var body struct {
+		Role string `json:"role"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil || body.Role == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "role required"})
+		return
+	}
+	if !models.ValidRole(body.Role) {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "role must be one of owner, admin, or member"})
+		return
+	}
+
+	orgID, targetID := auth.OrgID(c), c.Param("id")
+	if targetID == auth.UserID(c) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "you cannot change your own role"})
+		return
+	}
+	target, err := services.GetUserInOrg(orgID, targetID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
+		return
+	}
+	if (body.Role == models.RoleOwner || target.Role == models.RoleOwner) && !actorMayGrantOwner(c) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "only an owner can change owner roles"})
+		return
+	}
+
+	if err := services.UpdateUserRole(orgID, targetID, body.Role); err != nil {
+		c.JSON(orgUserErrStatus(err), gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"ok": true})
+}
+
+func deleteOrgUser(c *gin.Context) {
+	orgID, targetID := auth.OrgID(c), c.Param("id")
+	if targetID == auth.UserID(c) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "you cannot remove your own account"})
+		return
+	}
+	target, err := services.GetUserInOrg(orgID, targetID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
+		return
+	}
+	if target.Role == models.RoleOwner && !actorMayGrantOwner(c) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "only an owner can remove another owner"})
+		return
+	}
+
+	if err := services.DeleteUser(orgID, targetID); err != nil {
+		c.JSON(orgUserErrStatus(err), gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"deleted": true})
+}
+
+func orgUserErrStatus(err error) int {
+	if errors.Is(err, services.ErrLastOwner) {
+		return http.StatusConflict
+	}
+	return http.StatusInternalServerError
+}
+
+func getOrgOIDC(c *gin.Context) {
+	cfg, err := services.GetOrgOIDC(auth.OrgID(c))
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{"enabled": false, "client_secret_set": false})
+		return
+	}
+	
+	
+	c.JSON(http.StatusOK, gin.H{
+		"org_id":            cfg.OrgID,
+		"issuer":            cfg.Issuer,
+		"client_id":         cfg.ClientID,
+		"enabled":           cfg.Enabled,
+		"updated_at":        cfg.UpdatedAt,
+		"client_secret_set": cfg.ClientSecretEnc != "",
+	})
+}
+
+func putOrgOIDC(c *gin.Context) {
+	var body struct {
+		Issuer       string `json:"issuer"`
+		ClientID     string `json:"client_id"`
+		ClientSecret string `json:"client_secret"`
+		Enabled      bool   `json:"enabled"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if err := services.SaveOrgOIDC(auth.OrgID(c), body.Issuer, body.ClientID, body.ClientSecret, body.Enabled); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	auth.EvictOIDCProvider(auth.OrgID(c))
+	c.JSON(http.StatusOK, gin.H{"saved": true})
+}

server/internal/api/publichost.go

@@ -0,0 +1,51 @@
+package api
+
+import (
+	"net"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+func publicHostFromRequest(c *gin.Context) string {
+	host := c.Request.Host
+	if h := firstForwarded(c.GetHeader("X-Forwarded-Host")); h != "" {
+		host = h
+	}
+	if host == "" {
+		return "https://vantage.example.com"
+	}
+	return schemeFor(c, host) + "://" + host
+}
+
+func schemeFor(c *gin.Context, host string) string {
+	if p := firstForwarded(c.GetHeader("X-Forwarded-Proto")); p != "" {
+		return p
+	}
+	if c.Request.TLS != nil {
+		return "https"
+	}
+	if isLoopback(host) {
+		return "http"
+	}
+	return "https"
+}
+
+func firstForwarded(v string) string {
+	if v == "" {
+		return ""
+	}
+	return strings.TrimSpace(strings.Split(v, ",")[0])
+}
+
+func isLoopback(host string) bool {
+	h, _, err := net.SplitHostPort(host)
+	if err != nil {
+		h = host
+	}
+	if h == "localhost" || strings.HasSuffix(h, ".localhost") {
+		return true
+	}
+	ip := net.ParseIP(h)
+	return ip != nil && ip.IsLoopback()
+}

server/internal/api/secrets.go

@@ -7,40 +7,58 @@ import (
 	"strings"
 
 	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/auth"
 	"github.com/mrhid6/vantage/server/internal/services"
 )
 
-// groupNamePattern restricts group and key names to characters that are safe
-// in URLs and Kubernetes/env contexts.
+
+
 var groupNamePattern = regexp.MustCompile(`^[A-Za-z0-9._-]+$`)
 
 func validName(s string) bool {
 	return s != "" && len(s) <= 128 && groupNamePattern.MatchString(s)
 }
 
-// secretsReadAuth validates the ESO bearer token on the public read endpoint.
+
+const ctxSecretsOrgKey = "km_secrets_org"
+
+
+
+
+
+
+
 func secretsReadAuth() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		const prefix = "Bearer "
-		auth := c.GetHeader("Authorization")
-		if len(auth) <= len(prefix) || !strings.EqualFold(auth[:len(prefix)], prefix) {
+		authHeader := c.GetHeader("Authorization")
+		if len(authHeader) <= len(prefix) || !strings.EqualFold(authHeader[:len(prefix)], prefix) {
 			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "missing bearer token"})
 			return
 		}
-		if !services.VerifySecretsReadToken(auth[len(prefix):]) {
+		orgID, ok := services.ResolveSecretsReadToken(authHeader[len(prefix):])
+		if !ok {
 			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
 			return
 		}
+		c.Set(ctxSecretsOrgKey, orgID)
 		c.Next()
 	}
 }
 
-// esoGetGroup handles GET /secrets/:group for the External Secrets Operator.
-// Returns a flat JSON object { "KEY": "value", ... }; 404 if the group is empty
-// (ESO treats 404 as "deleted").
+
+
+
 func esoGetGroup(c *gin.Context) {
 	group := c.Param("group")
-	values, err := services.GetSecretGroupDecrypted(group)
+	
+	orgID := c.GetString(ctxSecretsOrgKey)
+	if orgID == "" {
+		
+		c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
+		return
+	}
+	values, err := services.GetSecretGroupDecrypted(orgID, group)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "store error"})
 		return
@@ -53,7 +71,7 @@ func esoGetGroup(c *gin.Context) {
 }
 
 func listSecretGroups(c *gin.Context) {
-	groups, err := services.ListSecretGroups()
+	groups, err := services.ListSecretGroups(auth.OrgID(c))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -61,8 +79,8 @@ func listSecretGroups(c *gin.Context) {
 	c.JSON(http.StatusOK, groups)
 }
 
-// createSecretGroup handles POST /api/secrets. A group is implicit, so it must
-// be created with at least one key/value pair.
+
+
 func createSecretGroup(c *gin.Context) {
 	var body struct {
 		Group  string            `json:"group" binding:"required"`
@@ -86,17 +104,17 @@ func createSecretGroup(c *gin.Context) {
 			return
 		}
 	}
-	if err := services.UpsertSecrets(body.Group, body.Values); err != nil {
+	if err := services.UpsertSecrets(auth.OrgID(c), body.Group, body.Values); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("secret.updated", actorFromCtx(c), "", "", fmt.Sprintf("group '%s' created with keys: %s", body.Group, strings.Join(services.SortedKeys(body.Values), ", ")))
+	services.LogEvent(auth.OrgID(c), "secret.updated", actorFromCtx(c), "", "", fmt.Sprintf("group '%s' created with keys: %s", body.Group, strings.Join(services.SortedKeys(body.Values), ", ")))
 	c.JSON(http.StatusCreated, gin.H{"group": body.Group})
 }
 
 func getSecretGroup(c *gin.Context) {
 	group := c.Param("group")
-	secrets, err := services.GetSecretGroup(group)
+	secrets, err := services.GetSecretGroup(auth.OrgID(c), group)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -108,7 +126,7 @@ func getSecretGroup(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"group": group, "secrets": secrets})
 }
 
-// putSecretGroup upserts one or more keys into an existing (or new) group.
+
 func putSecretGroup(c *gin.Context) {
 	group := c.Param("group")
 	if !validName(group) {
@@ -130,11 +148,11 @@ func putSecretGroup(c *gin.Context) {
 			return
 		}
 	}
-	if err := services.UpsertSecrets(group, values); err != nil {
+	if err := services.UpsertSecrets(auth.OrgID(c), group, values); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("secret.updated", actorFromCtx(c), "", "", fmt.Sprintf("group '%s' keys updated: %s", group, strings.Join(services.SortedKeys(values), ", ")))
+	services.LogEvent(auth.OrgID(c), "secret.updated", actorFromCtx(c), "", "", fmt.Sprintf("group '%s' keys updated: %s", group, strings.Join(services.SortedKeys(values), ", ")))
 	c.JSON(http.StatusOK, gin.H{"saved": true})
 }
 
@@ -147,42 +165,42 @@ func revealSecret(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
-	value, err := services.RevealSecret(group, body.Key)
+	value, err := services.RevealSecret(auth.OrgID(c), group, body.Key)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("secret.revealed", actorFromCtx(c), "", "", fmt.Sprintf("value of '%s/%s' revealed", group, body.Key))
+	services.LogEvent(auth.OrgID(c), "secret.revealed", actorFromCtx(c), "", "", fmt.Sprintf("value of '%s/%s' revealed", group, body.Key))
 	c.JSON(http.StatusOK, gin.H{"value": value})
 }
 
 func deleteSecretKey(c *gin.Context) {
 	group := c.Param("group")
 	key := c.Param("key")
-	if err := services.DeleteSecret(group, key); err != nil {
+	if err := services.DeleteSecret(auth.OrgID(c), group, key); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("secret.deleted", actorFromCtx(c), "", "", fmt.Sprintf("key '%s' deleted from group '%s'", key, group))
+	services.LogEvent(auth.OrgID(c), "secret.deleted", actorFromCtx(c), "", "", fmt.Sprintf("key '%s' deleted from group '%s'", key, group))
 	c.JSON(http.StatusOK, gin.H{"deleted": true})
 }
 
 func deleteSecretGroup(c *gin.Context) {
 	group := c.Param("group")
-	if err := services.DeleteSecretGroup(group); err != nil {
+	if err := services.DeleteSecretGroup(auth.OrgID(c), group); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("secretgroup.deleted", actorFromCtx(c), "", "", fmt.Sprintf("group '%s' deleted", group))
+	services.LogEvent(auth.OrgID(c), "secretgroup.deleted", actorFromCtx(c), "", "", fmt.Sprintf("group '%s' deleted", group))
 	c.JSON(http.StatusOK, gin.H{"deleted": true})
 }
 
 func rotateSecretsToken(c *gin.Context) {
-	token, err := services.RotateSecretsReadToken()
+	token, err := services.RotateSecretsReadToken(auth.OrgID(c))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("secrets.token_rotated", actorFromCtx(c), "", "", "ESO read token rotated")
+	services.LogEvent(auth.OrgID(c), "secrets.token_rotated", actorFromCtx(c), "", "", "ESO read token rotated")
 	c.JSON(http.StatusOK, gin.H{"token": token})
 }

server/internal/api/workflows.go

@@ -0,0 +1,362 @@
+package api
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/auth"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+)
+
+func registerWorkflowRoutes(g *gin.RouterGroup) {
+	g.GET("/steps", listSteps)
+	g.POST("/steps", createStep)
+	g.PUT("/steps/:id", updateStep)
+	g.DELETE("/steps/:id", deleteStep)
+	g.GET("/steps/:id/export", exportStep)
+	g.POST("/steps/import", importStep)
+	g.POST("/steps/seed-defaults", seedDefaults)
+	g.GET("/steps/usage", stepUsage)
+	g.POST("/steps/parse", parseStep)
+
+	g.GET("/workflows", listWorkflows)
+	g.POST("/workflows", createWorkflow)
+	g.GET("/workflows/:id", getWorkflow)
+	g.PUT("/workflows/:id", updateWorkflow)
+	g.DELETE("/workflows/:id", deleteWorkflow)
+	g.POST("/workflows/:id/run", runWorkflow)
+	g.GET("/workflows/:id/runs", listWorkflowRuns)
+
+	g.GET("/runs/:runId", getRun)
+	g.POST("/runs/:runId/cancel", cancelRun)
+	g.GET("/runs/:runId/servers/:serverId/logs", getServerRunLog)
+	g.GET("/runs/:runId/servers/:serverId/logs/stream", streamServerRunLog)
+}
+
+var uuidLike = regexp.MustCompile(`^[a-zA-Z0-9-]{1,64}$`)
+
+func getServerRunLog(c *gin.Context) {
+	runID, serverID := c.Param("runId"), c.Param("serverId")
+	if !uuidLike.MatchString(runID) || !uuidLike.MatchString(serverID) {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid id"})
+		return
+	}
+	path := services.ServerRunLogPath(runID, serverID)
+	b, err := os.ReadFile(path)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "no logs"})
+		return
+	}
+	c.Data(http.StatusOK, "text/plain; charset=utf-8", b)
+}
+
+func streamServerRunLog(c *gin.Context) {
+	runID, serverID := c.Param("runId"), c.Param("serverId")
+	if !uuidLike.MatchString(runID) || !uuidLike.MatchString(serverID) {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid id"})
+		return
+	}
+	path := services.ServerRunLogPath(runID, serverID)
+
+	c.Writer.Header().Set("Content-Type", "text/event-stream")
+	c.Writer.Header().Set("Cache-Control", "no-cache")
+	c.Writer.Header().Set("Connection", "keep-alive")
+	c.Writer.Header().Set("X-Accel-Buffering", "no")
+
+	flusher, ok := c.Writer.(http.Flusher)
+	if !ok {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "stream unsupported"})
+		return
+	}
+
+	var offset int64
+	sendNew := func() {
+		f, err := os.Open(path)
+		if err != nil {
+			return 
+		}
+		defer f.Close()
+		if _, err := f.Seek(offset, 0); err != nil {
+			return
+		}
+		buf := make([]byte, 32*1024)
+		for {
+			n, _ := f.Read(buf)
+			if n <= 0 {
+				break
+			}
+			offset += int64(n)
+			
+			for _, line := range splitSSE(buf[:n]) {
+				_, _ = c.Writer.WriteString("data: " + line + "\n")
+			}
+			_, _ = c.Writer.WriteString("\n")
+			flusher.Flush()
+		}
+	}
+
+	ctx := c.Request.Context()
+	ticker := time.NewTicker(500 * time.Millisecond)
+	defer ticker.Stop()
+	orgID := auth.OrgID(c)
+	for {
+		sendNew()
+		if serverRunTerminal(orgID, runID, serverID) {
+			sendNew() 
+			_, _ = c.Writer.WriteString("event: done\ndata: end\n\n")
+			flusher.Flush()
+			return
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		}
+	}
+}
+
+
+func serverRunTerminal(orgID, runID, serverID string) bool {
+	r, err := services.GetRun(orgID, runID)
+	if err != nil {
+		return true
+	}
+	for _, sr := range r.ServerRuns {
+		if sr.ServerID == serverID {
+			switch sr.Status {
+			case "success", "failed", "skipped", "cancelled":
+				return true
+			}
+			return false
+		}
+	}
+	return true
+}
+
+
+
+func splitSSE(b []byte) []string {
+	s := strings.ReplaceAll(string(b), "\r", "")
+	return strings.Split(s, "\n")
+}
+
+func listSteps(c *gin.Context) {
+	steps, err := services.ListSteps(auth.OrgID(c))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, steps)
+}
+
+func stepUsage(c *gin.Context) {
+	counts, err := services.StepUsageCounts(auth.OrgID(c))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, counts)
+}
+
+func createStep(c *gin.Context) {
+	var s models.WorkflowStep
+	if err := c.ShouldBindJSON(&s); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	out, err := services.CreateStep(auth.OrgID(c), s)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.step_created", actorFromCtx(c), "", out.StepID, fmt.Sprintf("step '%s' created", out.Name))
+	c.JSON(http.StatusCreated, out)
+}
+
+func updateStep(c *gin.Context) {
+	var s models.WorkflowStep
+	if err := c.ShouldBindJSON(&s); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if err := services.UpdateStep(auth.OrgID(c), c.Param("id"), s); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.step_updated", actorFromCtx(c), "", c.Param("id"), "step updated")
+	c.JSON(http.StatusOK, gin.H{"updated": true})
+}
+
+func deleteStep(c *gin.Context) {
+	if err := services.DeleteStep(auth.OrgID(c), c.Param("id")); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.step_deleted", actorFromCtx(c), "", c.Param("id"), "step deleted")
+	c.JSON(http.StatusOK, gin.H{"deleted": true})
+}
+
+func exportStep(c *gin.Context) {
+	b, err := services.ExportStep(auth.OrgID(c), c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+	c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=step-%s.json", c.Param("id")))
+	c.Data(http.StatusOK, "application/json", b)
+}
+
+func seedDefaults(c *gin.Context) {
+	created, updated, err := services.SeedDefaultSteps(auth.OrgID(c))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.defaults_synced", actorFromCtx(c), "", "", fmt.Sprintf("default steps synced: %d created, %d updated", created, updated))
+	c.JSON(http.StatusOK, gin.H{"created": created, "updated": updated})
+}
+
+const maxStepBodyBytes = 1 << 20 
+
+func importStep(c *gin.Context) {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, maxStepBodyBytes)
+	body, err := io.ReadAll(c.Request.Body)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	out, err := services.ImportStepToLibrary(auth.OrgID(c), body)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.step_imported", actorFromCtx(c), "", out.StepID, fmt.Sprintf("step '%s' imported", out.Name))
+	c.JSON(http.StatusCreated, out)
+}
+
+func parseStep(c *gin.Context) {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, maxStepBodyBytes)
+	body, err := io.ReadAll(c.Request.Body)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	s, err := services.ParseStepDoc(body)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, s)
+}
+
+func listWorkflows(c *gin.Context) {
+	wfs, err := services.ListWorkflows(auth.OrgID(c))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, wfs)
+}
+
+func createWorkflow(c *gin.Context) {
+	var w models.Workflow
+	if err := c.ShouldBindJSON(&w); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	out, err := services.CreateWorkflow(auth.OrgID(c), w)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.created", actorFromCtx(c), "", out.WorkflowID, fmt.Sprintf("workflow '%s' created", out.Name))
+	c.JSON(http.StatusCreated, out)
+}
+
+func getWorkflow(c *gin.Context) {
+	w, err := services.GetWorkflow(auth.OrgID(c), c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, w)
+}
+
+func updateWorkflow(c *gin.Context) {
+	var w models.Workflow
+	if err := c.ShouldBindJSON(&w); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if err := services.UpdateWorkflow(auth.OrgID(c), c.Param("id"), w); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.updated", actorFromCtx(c), "", c.Param("id"), "workflow updated")
+	updated, err := services.GetWorkflow(auth.OrgID(c), c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, updated)
+}
+
+func deleteWorkflow(c *gin.Context) {
+	if err := services.DeleteWorkflow(auth.OrgID(c), c.Param("id")); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.deleted", actorFromCtx(c), "", c.Param("id"), "workflow deleted")
+	c.JSON(http.StatusOK, gin.H{"deleted": true})
+}
+
+func runWorkflow(c *gin.Context) {
+	runID, err := services.TriggerWorkflow(auth.OrgID(c), c.Param("id"), actorFromCtx(c))
+	if err != nil {
+		c.JSON(http.StatusServiceUnavailable, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.run_triggered", actorFromCtx(c), "", c.Param("id"), fmt.Sprintf("run %s triggered", runID))
+	c.JSON(http.StatusAccepted, gin.H{"run_id": runID})
+}
+
+func listWorkflowRuns(c *gin.Context) {
+	limit := int64(50)
+	if l := c.Query("limit"); l != "" {
+		if n, err := strconv.ParseInt(l, 10, 64); err == nil && n > 0 {
+			limit = n
+		}
+	}
+	runs, err := services.ListRuns(auth.OrgID(c), c.Param("id"), limit)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, runs)
+}
+
+func getRun(c *gin.Context) {
+	r, err := services.GetRun(auth.OrgID(c), c.Param("runId"))
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, r)
+}
+
+func cancelRun(c *gin.Context) {
+	if err := services.CancelRun(auth.OrgID(c), c.Param("runId")); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.run_cancelled", actorFromCtx(c), "", c.Param("runId"), "run cancelled")
+	c.JSON(http.StatusOK, gin.H{"cancelled": true})
+}

server/internal/auth/local.go

@@ -0,0 +1,156 @@
+package auth
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+)
+
+func SetSessionCookie(c *gin.Context, sessionID string) {
+	secure := c.Request.TLS != nil || c.GetHeader("X-Forwarded-Proto") == "https"
+	http.SetCookie(c.Writer, &http.Cookie{
+		Name:     sessionCookieName,
+		Value:    sessionID,
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   secure,
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   int(sessionTTL.Seconds()),
+	})
+}
+
+func HandleLocalLogin(c *gin.Context) {
+	var body struct {
+		Email    string `json:"email"`
+		Password string `json:"password"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "email and password required"})
+		return
+	}
+	u, err := services.GetUserByEmail(body.Email)
+	if err != nil || !services.VerifyPassword(u, body.Password) {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid credentials"})
+		return
+	}
+	sessionID, err := SaveSession(c.Request.Context(), &Session{
+		UserID: u.UserID, OrgID: u.OrgID, Role: u.Role, Email: u.Email,
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "session save failed"})
+		return
+	}
+	_ = services.TouchLastLogin(u.UserID)
+	SetSessionCookie(c, sessionID)
+	c.JSON(http.StatusOK, gin.H{"ok": true})
+}
+
+func HandleBootstrapStatus(c *gin.Context) {
+	var (
+		n       int64
+		err     error
+		orgName string
+	)
+	if org, ok := OrgFromHost(c); ok {
+		n, err = services.CountOrgUsers(org.OrgID)
+		orgName = org.Name
+	} else {
+		n, err = services.CountUsers()
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"needs_setup": n == 0, "org_name": orgName})
+}
+
+
+
+
+func HandleBootstrap(c *gin.Context) {
+	n, err := services.CountUsers()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if n > 0 {
+		c.JSON(http.StatusConflict, gin.H{"error": "setup already complete"})
+		return
+	}
+	var body struct {
+		OrgName  string `json:"org_name"`
+		Email    string `json:"email"`
+		Password string `json:"password"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil || body.OrgName == "" || body.Email == "" || len(body.Password) < 8 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "org_name, email, and password (>=8 chars) required"})
+		return
+	}
+
+	orgCount, err := services.CountOrgs()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	var org *models.Org
+	switch orgCount {
+	case 0:
+		org, err = services.CreateOrg(body.OrgName)
+	case 1:
+		var existing *models.Org
+		existing, err = services.FirstOrg()
+		if err == nil {
+			org, err = services.AdoptOrg(existing.OrgID, body.OrgName)
+		}
+	default:
+		c.JSON(http.StatusConflict, gin.H{"error": fmt.Sprintf(
+			"cannot bootstrap: %d organizations already exist but no users do; "+
+				"create the owner against the intended org rather than through setup, "+
+				"or remove the unintended orgs and retry", orgCount)})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	u, err := services.CreateUser(org.OrgID, body.Email, body.Password, "owner", "local")
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	sessionID, err := SaveSession(c.Request.Context(), &Session{
+		UserID: u.UserID, OrgID: u.OrgID, Role: u.Role, Email: u.Email,
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "session save failed"})
+		return
+	}
+	SetSessionCookie(c, sessionID)
+	c.JSON(http.StatusCreated, gin.H{"org": org, "slug": org.Slug})
+}
+
+func HandleMe(c *gin.Context) {
+	cookie, err := c.Request.Cookie(sessionCookieName)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "not authenticated"})
+		return
+	}
+	sess, err := GetSession(c.Request.Context(), cookie.Value)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "session expired"})
+		return
+	}
+	
+	
+	
+	if hostOrg, ok := OrgFromHost(c); ok && hostOrg.OrgID != sess.OrgID {
+		c.JSON(http.StatusForbidden, gin.H{"error": "org host mismatch"})
+		return
+	}
+
+	org, _ := services.GetOrg(sess.OrgID)
+	c.JSON(http.StatusOK, gin.H{"user": sess, "org": org})
+}

server/internal/auth/middleware.go

@@ -14,13 +14,42 @@ func GetSessionFromContext(c *gin.Context) *Session {
 	return sess
 }
 
+func OrgID(c *gin.Context) string {
+	if s := GetSessionFromContext(c); s != nil {
+		return s.OrgID
+	}
+	return ""
+}
+
+func Role(c *gin.Context) string {
+	if s := GetSessionFromContext(c); s != nil {
+		return s.Role
+	}
+	return ""
+}
+
+func UserID(c *gin.Context) string {
+	if s := GetSessionFromContext(c); s != nil {
+		return s.UserID
+	}
+	return ""
+}
+
+func RequireRole(roles ...string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		r := Role(c)
+		for _, want := range roles {
+			if r == want {
+				c.Next()
+				return
+			}
+		}
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "insufficient role"})
+	}
+}
+
 func Middleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
-		if !authEnabled {
-			c.Next()
-			return
-		}
-
 		cookie, err := c.Request.Cookie(sessionCookieName)
 		if err != nil {
 			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "not authenticated"})
@@ -33,7 +62,18 @@ func Middleware() gin.HandlerFunc {
 			return
 		}
 
+		if sess.OrgID == "" {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "session has no organization"})
+			return
+		}
+
 		c.Set(ctxSessionKey, sess)
+
+		if hostOrg, ok := OrgFromHost(c); ok && hostOrg.OrgID != sess.OrgID {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "org host mismatch"})
+			return
+		}
+
 		c.Next()
 	}
 }

server/internal/auth/oidc.go

@@ -2,123 +2,148 @@ package auth
 
 import (
 	"context"
-	"log"
+	"fmt"
 	"net/http"
-	"os"
+	"strings"
+	"sync"
 
 	"github.com/coreos/go-oidc/v3/oidc"
 	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/services"
 	"golang.org/x/oauth2"
 )
 
 var (
-	oidcProvider *oidc.Provider
-	oauth2Cfg    *oauth2.Config
-	authEnabled  bool
+	provMu    sync.Mutex
+	provCache = map[string]*oidc.Provider{}
 )
 
-func InitOIDC(ctx context.Context) error {
-	issuer := os.Getenv("OIDC_ISSUER")
-	if issuer == "" {
-		log.Println("OIDC_ISSUER not set; authentication disabled")
-		return nil
-	}
-
-	p, err := oidc.NewProvider(ctx, issuer)
-	if err != nil {
-		return err
-	}
-	oidcProvider = p
-	oauth2Cfg = &oauth2.Config{
-		ClientID:     os.Getenv("OIDC_CLIENT_ID"),
-		ClientSecret: os.Getenv("OIDC_CLIENT_SECRET"),
-		RedirectURL:  os.Getenv("OIDC_REDIRECT_URL"),
-		Endpoint:     p.Endpoint(),
-		Scopes:       []string{oidc.ScopeOpenID, "profile", "email"},
-	}
-	authEnabled = true
-	log.Println("OIDC authentication enabled")
-	return nil
+func EvictOIDCProvider(orgID string) {
+	provMu.Lock()
+	delete(provCache, orgID)
+	provMu.Unlock()
 }
 
-func Enabled() bool { return authEnabled }
+func redirectURL(c *gin.Context) string {
+	scheme := "https"
+	if c.Request.TLS == nil && c.GetHeader("X-Forwarded-Proto") != "https" {
+		scheme = "http"
+	}
+	return fmt.Sprintf("%s://%s/auth/oidc/callback", scheme, c.Request.Host)
+}
 
-func HandleLogin(c *gin.Context) {
-	state, err := randomHex(16)
+func providerForOrg(ctx context.Context, c *gin.Context, orgID string) (*oidc.Provider, *oauth2.Config, error) {
+	cfg, err := services.GetOrgOIDC(orgID)
+	if err != nil || !cfg.Enabled {
+		return nil, nil, fmt.Errorf("org SSO not configured")
+	}
+	secret, err := services.GetOrgOIDCSecret(orgID)
 	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "state generation failed"})
+		return nil, nil, err
+	}
+	provMu.Lock()
+	p := provCache[orgID]
+	provMu.Unlock()
+	if p == nil {
+		p, err = oidc.NewProvider(ctx, cfg.Issuer)
+		if err != nil {
+			return nil, nil, err
+		}
+		provMu.Lock()
+		provCache[orgID] = p
+		provMu.Unlock()
+	}
+	return p, &oauth2.Config{
+		ClientID: cfg.ClientID, ClientSecret: secret,
+		RedirectURL: redirectURL(c), Endpoint: p.Endpoint(),
+		Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
+	}, nil
+}
+
+func HandleOIDCStart(c *gin.Context) {
+	org, ok := OrgFromHost(c)
+	if !ok {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "unknown organization host"})
 		return
 	}
-	if err := SaveState(c.Request.Context(), state); err != nil {
+	ctx := c.Request.Context()
+	_, oauthCfg, err := providerForOrg(ctx, c, org.OrgID)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	state, err := randomHex(16)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "state gen failed"})
+		return
+	}
+	if err := SaveStateOrg(ctx, state, org.OrgID); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "state save failed"})
 		return
 	}
-	c.Redirect(http.StatusFound, oauth2Cfg.AuthCodeURL(state))
+	c.Redirect(http.StatusFound, oauthCfg.AuthCodeURL(state))
 }
 
-func HandleCallback(c *gin.Context) {
+func HandleOIDCCallback(c *gin.Context) {
 	ctx := c.Request.Context()
-
-	if !ConsumeState(ctx, c.Query("state")) {
+	orgID, ok := ConsumeStateOrg(ctx, c.Query("state"))
+	if !ok {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid state"})
 		return
 	}
-
-	token, err := oauth2Cfg.Exchange(ctx, c.Query("code"))
+	provider, oauthCfg, err := providerForOrg(ctx, c, orgID)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	token, err := oauthCfg.Exchange(ctx, c.Query("code"))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "token exchange failed"})
 		return
 	}
-
 	rawIDToken, ok := token.Extra("id_token").(string)
 	if !ok {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "missing id_token"})
 		return
 	}
-
-	verifier := oidcProvider.Verifier(&oidc.Config{ClientID: oauth2Cfg.ClientID})
-	idToken, err := verifier.Verify(ctx, rawIDToken)
+	idToken, err := provider.Verifier(&oidc.Config{ClientID: oauthCfg.ClientID}).Verify(ctx, rawIDToken)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "token verification failed"})
 		return
 	}
-
 	var claims struct {
-		Sub   string `json:"sub"`
 		Email string `json:"email"`
 		Name  string `json:"name"`
 	}
-	if err := idToken.Claims(&claims); err != nil {
+	if err := idToken.Claims(&claims); err != nil || claims.Email == "" {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "claims extraction failed"})
 		return
 	}
 
+	email := strings.ToLower(claims.Email)
+	u, err := services.GetUserByEmail(email)
+	if err != nil {
+		
+		u, err = services.CreateUser(orgID, email, "", "member", "oidc")
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "provisioning failed"})
+			return
+		}
+	} else if u.OrgID != orgID {
+		c.JSON(http.StatusForbidden, gin.H{"error": "email belongs to a different organization"})
+		return
+	}
+
 	sessionID, err := SaveSession(ctx, &Session{
-		UserID: claims.Sub,
-		Email:  claims.Email,
-		Name:   claims.Name,
+		UserID: u.UserID, OrgID: u.OrgID, Role: u.Role, Email: u.Email, Name: claims.Name,
 	})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "session save failed"})
 		return
 	}
-
-	secure := c.Request.TLS != nil || c.GetHeader("X-Forwarded-Proto") == "https"
-	http.SetCookie(c.Writer, &http.Cookie{
-		Name:     sessionCookieName,
-		Value:    sessionID,
-		Path:     "/",
-		HttpOnly: true,
-		Secure:   secure,
-		SameSite: http.SameSiteLaxMode,
-		MaxAge:   int(sessionTTL.Seconds()),
-	})
-
-	frontendURL := os.Getenv("PUBLIC_HOST")
-	if frontendURL == "" {
-		frontendURL = "/"
-	}
-	c.Redirect(http.StatusFound, frontendURL)
+	_ = services.TouchLastLogin(u.UserID)
+	SetSessionCookie(c, sessionID)
+	c.Redirect(http.StatusFound, "/")
 }
 
 func HandleLogout(c *gin.Context) {
@@ -134,21 +159,3 @@ func HandleLogout(c *gin.Context) {
 	})
 	c.Redirect(http.StatusFound, "/")
 }
-
-func HandleMe(c *gin.Context) {
-	if !authEnabled {
-		c.JSON(http.StatusOK, gin.H{"auth_enabled": false})
-		return
-	}
-	cookie, err := c.Request.Cookie(sessionCookieName)
-	if err != nil {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "not authenticated"})
-		return
-	}
-	sess, err := GetSession(c.Request.Context(), cookie.Value)
-	if err != nil {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "session expired"})
-		return
-	}
-	c.JSON(http.StatusOK, sess)
-}

server/internal/auth/orghost.go

@@ -0,0 +1,80 @@
+package auth
+
+import (
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+)
+
+type cachedOrg struct {
+	org *models.Org
+	at  time.Time
+}
+
+var (
+	orgCacheMu sync.Mutex
+	orgCache   = map[string]cachedOrg{}
+)
+
+const orgCacheTTL = 60 * time.Second
+
+
+
+
+func appRootLabel() string {
+	if v := os.Getenv("APP_ROOT_LABEL"); v != "" {
+		return strings.ToLower(v)
+	}
+	return "vantage"
+}
+
+
+
+func hostSlug(host string) string {
+	host = strings.ToLower(host)
+	if i := strings.IndexByte(host, ':'); i >= 0 {
+		host = host[:i]
+	}
+	root := appRootLabel()
+	
+	parts := strings.Split(host, ".")
+	if len(parts) < 3 {
+		return ""
+	}
+	if parts[1] != root {
+		return ""
+	}
+	if parts[0] == root || parts[0] == "www" {
+		return ""
+	}
+	return parts[0]
+}
+
+func OrgFromHost(c *gin.Context) (*models.Org, bool) {
+	slug := hostSlug(c.Request.Host)
+	if slug == "" {
+		return nil, false
+	}
+	orgCacheMu.Lock()
+	if e, ok := orgCache[slug]; ok && time.Since(e.at) < orgCacheTTL {
+		orgCacheMu.Unlock()
+		return e.org, e.org != nil
+	}
+	orgCacheMu.Unlock()
+
+	org, err := services.GetOrgBySlug(slug)
+	if err != nil || org == nil {
+		
+		
+		return nil, false
+	}
+	orgCacheMu.Lock()
+	orgCache[slug] = cachedOrg{org: org, at: time.Now()}
+	orgCacheMu.Unlock()
+	return org, true
+}

server/internal/auth/session.go

@@ -17,6 +17,8 @@ const statePrefix = "km:state:"
 
 type Session struct {
 	UserID string `json:"user_id"`
+	OrgID  string `json:"org_id"`
+	Role   string `json:"role"`
 	Email  string `json:"email"`
 	Name   string `json:"name"`
 }
@@ -69,11 +71,14 @@ func DeleteSession(ctx context.Context, id string) error {
 	return rdb.Del(ctx, sessionPrefix+id).Err()
 }
 
-func SaveState(ctx context.Context, state string) error {
-	return rdb.Set(ctx, statePrefix+state, "1", 10*time.Minute).Err()
+func SaveStateOrg(ctx context.Context, state, orgID string) error {
+	return rdb.Set(ctx, statePrefix+state, orgID, 10*time.Minute).Err()
 }
 
-func ConsumeState(ctx context.Context, state string) bool {
-	n, err := rdb.Del(ctx, statePrefix+state).Result()
-	return err == nil && n > 0
+func ConsumeStateOrg(ctx context.Context, state string) (string, bool) {
+	orgID, err := rdb.GetDel(ctx, statePrefix+state).Result()
+	if err != nil || orgID == "" {
+		return "", false
+	}
+	return orgID, true
 }

server/internal/checker/checker.go

@@ -0,0 +1,222 @@
+package checker
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+)
+
+
+const (
+	TypeHTTP = "http"
+	TypeTCP  = "tcp"
+	TypeICMP = "icmp"
+	TypeTLS  = "tls"
+)
+
+
+type Spec struct {
+	Type           string
+	URL            string
+	Host           string
+	Port           int
+	Method         string
+	ExpectedStatus int
+	Keyword        string
+	TLSWarnDays    int
+	Insecure       bool 
+	TimeoutSec     int
+}
+
+
+type Result struct {
+	Up         bool
+	LatencyMs  int
+	Message    string
+	CertExpiry *time.Time
+}
+
+func (s Spec) timeout() time.Duration {
+	t := s.TimeoutSec
+	if t <= 0 || t > 10 {
+		t = 10
+	}
+	return time.Duration(t) * time.Second
+}
+
+
+func Run(ctx context.Context, s Spec) Result {
+	switch s.Type {
+	case TypeHTTP:
+		return runHTTP(ctx, s)
+	case TypeTCP:
+		return runTCP(ctx, s)
+	case TypeICMP:
+		return runICMP(ctx, s)
+	case TypeTLS:
+		return runTLS(ctx, s)
+	default:
+		return Result{Message: "unknown check type: " + s.Type}
+	}
+}
+
+func runHTTP(ctx context.Context, s Spec) Result {
+	method := s.Method
+	if method == "" {
+		method = http.MethodGet
+	}
+	expect := s.ExpectedStatus
+	if expect == 0 {
+		expect = 200
+	}
+	client := &http.Client{Timeout: s.timeout()}
+	if s.Insecure {
+		client.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} 
+	}
+	start := time.Now()
+	req, err := http.NewRequestWithContext(ctx, method, s.URL, nil)
+	if err != nil {
+		return Result{Message: err.Error()}
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	defer resp.Body.Close()
+	res := Result{LatencyMs: msSince(start), Up: true}
+	if resp.TLS != nil && len(resp.TLS.PeerCertificates) > 0 {
+		exp := resp.TLS.PeerCertificates[0].NotAfter
+		res.CertExpiry = &exp
+	}
+	if resp.StatusCode != expect {
+		return Result{LatencyMs: res.LatencyMs, CertExpiry: res.CertExpiry, Message: fmt.Sprintf("status %d (want %d)", resp.StatusCode, expect)}
+	}
+	if s.Keyword != "" {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+		if !strings.Contains(string(body), s.Keyword) {
+			return Result{LatencyMs: res.LatencyMs, CertExpiry: res.CertExpiry, Message: "keyword not found"}
+		}
+	}
+	return res
+}
+
+func runTCP(ctx context.Context, s Spec) Result {
+	addr := net.JoinHostPort(s.Host, fmt.Sprint(s.Port))
+	start := time.Now()
+	d := net.Dialer{Timeout: s.timeout()}
+	conn, err := d.DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	conn.Close()
+	return Result{Up: true, LatencyMs: msSince(start)}
+}
+
+func runTLS(ctx context.Context, s Spec) Result {
+	port := s.Port
+	if port == 0 {
+		port = 443
+	}
+	addr := net.JoinHostPort(s.Host, fmt.Sprint(port))
+	start := time.Now()
+	d := net.Dialer{Timeout: s.timeout()}
+	conn, err := tls.DialWithDialer(&d, "tcp", addr, &tls.Config{ServerName: s.Host})
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	defer conn.Close()
+	certs := conn.ConnectionState().PeerCertificates
+	if len(certs) == 0 {
+		return Result{LatencyMs: msSince(start), Message: "no peer certificate"}
+	}
+	exp := certs[0].NotAfter
+	res := Result{LatencyMs: msSince(start), CertExpiry: &exp}
+	warn := s.TLSWarnDays
+	if warn <= 0 {
+		warn = 14
+	}
+	remaining := time.Until(exp)
+	if remaining <= 0 {
+		res.Message = "certificate expired"
+		return res
+	}
+	if remaining <= time.Duration(warn)*24*time.Hour {
+		res.Message = fmt.Sprintf("certificate expires in %d days", int(remaining.Hours()/24))
+		return res
+	}
+	res.Up = true
+	return res
+}
+
+func msSince(t time.Time) int { return int(time.Since(t).Milliseconds()) }
+
+
+
+
+func runICMP(ctx context.Context, s Spec) Result {
+	dst, err := net.ResolveIPAddr("ip4", s.Host)
+	if err != nil {
+		return Result{Message: err.Error()}
+	}
+	conn, err := net.ListenPacket("ip4:icmp", "0.0.0.0")
+	if err != nil {
+		return Result{Message: "icmp socket: " + err.Error()}
+	}
+	defer conn.Close()
+
+	id := os.Getpid() & 0xffff
+	pkt := icmpEcho(id, 1)
+	deadline := time.Now().Add(s.timeout())
+	if d, ok := ctx.Deadline(); ok && d.Before(deadline) {
+		deadline = d
+	}
+	_ = conn.SetDeadline(deadline)
+
+	start := time.Now()
+	if _, err := conn.WriteTo(pkt, dst); err != nil {
+		return Result{Message: err.Error()}
+	}
+	reply := make([]byte, 1500)
+	for {
+		n, peer, err := conn.ReadFrom(reply)
+		if err != nil {
+			return Result{LatencyMs: msSince(start), Message: "no reply"}
+		}
+		
+		if n < 28 || peer.String() != dst.String() {
+			continue
+		}
+		if reply[20] == 0 { 
+			return Result{Up: true, LatencyMs: msSince(start)}
+		}
+	}
+}
+
+func icmpEcho(id, seq int) []byte {
+	
+	b := []byte{8, 0, 0, 0, byte(id >> 8), byte(id), byte(seq >> 8), byte(seq)}
+	cs := icmpChecksum(b)
+	b[2] = byte(cs >> 8)
+	b[3] = byte(cs)
+	return b
+}
+
+func icmpChecksum(b []byte) uint16 {
+	var sum uint32
+	for i := 0; i < len(b)-1; i += 2 {
+		sum += uint32(b[i])<<8 | uint32(b[i+1])
+	}
+	if len(b)%2 == 1 {
+		sum += uint32(b[len(b)-1]) << 8
+	}
+	for sum>>16 != 0 {
+		sum = (sum & 0xffff) + (sum >> 16)
+	}
+	return ^uint16(sum)
+}

server/internal/grpc/codec.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 )
 
-// JSONCodec is a gRPC codec that uses JSON encoding.
+
 type JSONCodec struct{}
 
 func (JSONCodec) Marshal(v interface{}) ([]byte, error) {
@@ -16,5 +16,5 @@ func (JSONCodec) Unmarshal(data []byte, v interface{}) error {
 }
 
 func (JSONCodec) Name() string {
-	return "proto" // override default proto codec name so gRPC uses it
+	return "proto" 
 }

server/internal/grpc/pb/vantage.pb.go

@@ -1,5 +1,5 @@
-// Hand-written gRPC bindings for vantage.proto using JSON codec.
-// To use: register the JSON codec before creating gRPC servers/clients.
+
+
 
 package pb
 
@@ -11,7 +11,7 @@ import (
 	"google.golang.org/grpc/status"
 )
 
-// Message types
+
 
 type RegisterRequest struct {
 	ServerId    string `json:"server_id"`
@@ -47,7 +47,7 @@ type UploadKeyResponse struct {
 	KeyId string `json:"key_id"`
 }
 
-// CommandStream message types
+
 
 type PackageUpdate struct {
 	Name           string `json:"name"`
@@ -63,14 +63,91 @@ type ReportUpdatesRequest struct {
 
 type ReportUpdatesResponse struct{}
 
+
+
+type CPUReport struct {
+	Model    string  `json:"model,omitempty"`
+	Cores    int     `json:"cores,omitempty"`
+	UsagePct float64 `json:"usage_pct"`
+	Load1    float64 `json:"load1,omitempty"`
+}
+type MemReport struct {
+	TotalBytes uint64 `json:"total_bytes"`
+	UsedBytes  uint64 `json:"used_bytes"`
+}
+type PartitionReport struct {
+	Device     string `json:"device"`
+	Mountpoint string `json:"mountpoint"`
+	Fstype     string `json:"fstype,omitempty"`
+	TotalBytes uint64 `json:"total_bytes"`
+	UsedBytes  uint64 `json:"used_bytes"`
+}
+type InventoryReport struct {
+	ServerId      string            `json:"server_id"`
+	AgentToken    string            `json:"agent_token"`
+	IncludeStatic bool              `json:"include_static"`
+	CPU           *CPUReport        `json:"cpu,omitempty"`
+	Memory        *MemReport        `json:"memory,omitempty"`
+	SwapTotal     uint64            `json:"swap_total"`
+	SwapUsed      uint64            `json:"swap_used"`
+	Partitions    []PartitionReport `json:"partitions,omitempty"`
+	Kernel        string            `json:"kernel,omitempty"`
+}
+type InventoryReportResponse struct{}
+
+
+
+type MonitorSpec struct {
+	MonitorId      string `json:"monitor_id"`
+	Type           string `json:"type"`
+	URL            string `json:"url,omitempty"`
+	Host           string `json:"host,omitempty"`
+	Port           int    `json:"port,omitempty"`
+	Method         string `json:"method,omitempty"`
+	ExpectedStatus int    `json:"expected_status,omitempty"`
+	Keyword        string `json:"keyword,omitempty"`
+	TLSWarnDays    int    `json:"tls_warn_days,omitempty"`
+	Insecure       bool   `json:"insecure,omitempty"`
+	IntervalSec    int    `json:"interval_sec"`
+	Retries        int    `json:"retries"`
+}
+type SyncMonitorsRequest struct {
+	ServerId   string `json:"server_id"`
+	AgentToken string `json:"agent_token"`
+}
+type SyncMonitorsResponse struct {
+	Monitors []MonitorSpec `json:"monitors,omitempty"`
+}
+type CheckResult struct {
+	MonitorId     string `json:"monitor_id"`
+	Up            bool   `json:"up"`
+	LatencyMs     int    `json:"latency_ms"`
+	Message       string `json:"message,omitempty"`
+	CertExpiryUnix int64 `json:"cert_expiry_unix,omitempty"`
+}
+type ReportChecksRequest struct {
+	ServerId   string        `json:"server_id"`
+	AgentToken string        `json:"agent_token"`
+	Results    []CheckResult `json:"results,omitempty"`
+}
+type ReportChecksResponse struct{}
+
 type ApplyUpdatesCmd struct{}
 
 type ServerCommand struct {
-	CommandId    string           `json:"command_id"`
-	GenerateKey  *GenerateKeyCmd  `json:"generate_key,omitempty"`
-	DeleteKey    *DeleteKeyCmd    `json:"delete_key,omitempty"`
-	UpdateAgent  *UpdateAgentCmd  `json:"update_agent,omitempty"`
-	ApplyUpdates *ApplyUpdatesCmd `json:"apply_updates,omitempty"`
+	CommandId        string               `json:"command_id"`
+	GenerateKey      *GenerateKeyCmd      `json:"generate_key,omitempty"`
+	DeleteKey        *DeleteKeyCmd        `json:"delete_key,omitempty"`
+	UpdateAgent      *UpdateAgentCmd      `json:"update_agent,omitempty"`
+	ApplyUpdates     *ApplyUpdatesCmd     `json:"apply_updates,omitempty"`
+	RunStep          *RunStepCmd          `json:"run_step,omitempty"`
+	CleanupWorkspace *CleanupWorkspaceCmd `json:"cleanup_workspace,omitempty"`
+}
+
+
+
+type CleanupWorkspaceCmd struct {
+	WorkspaceId string `json:"workspace_id"`
 }
 
 type DeleteKeyCmd struct {
@@ -91,10 +168,12 @@ type GenerateKeyCmd struct {
 }
 
 type AgentMessage struct {
-	ServerId   string         `json:"server_id"`
-	AgentToken string         `json:"agent_token"`
-	Ready      *AgentReady    `json:"ready,omitempty"`
-	Result     *CommandResult `json:"result,omitempty"`
+	ServerId   string            `json:"server_id"`
+	AgentToken string            `json:"agent_token"`
+	Ready      *AgentReady       `json:"ready,omitempty"`
+	Result     *CommandResult    `json:"result,omitempty"`
+	StepResult *StepResult       `json:"step_result,omitempty"`
+	StepOutput *StepOutputChunk  `json:"step_output,omitempty"`
 }
 
 type AgentReady struct{}
@@ -105,7 +184,32 @@ type CommandResult struct {
 	Message   string `json:"message"`
 }
 
-// CommandStream server-side interface
+type RunStepCmd struct {
+	Interpreter    string            `json:"interpreter"`
+	Script         string            `json:"script"`
+	Env            map[string]string `json:"env,omitempty"`
+	TimeoutSeconds int               `json:"timeout_seconds,omitempty"`
+	
+	
+	WorkspaceId string `json:"workspace_id,omitempty"`
+}
+
+type StepResult struct {
+	CommandId string            `json:"command_id"`
+	ExitCode  int               `json:"exit_code"`
+	Stdout    string            `json:"stdout,omitempty"`
+	Stderr    string            `json:"stderr,omitempty"`
+	OutputEnv map[string]string `json:"output_env,omitempty"`
+}
+
+type StepOutputChunk struct {
+	CommandId string `json:"command_id"`
+	Seq       uint64 `json:"seq"`
+	Data      []byte `json:"data,omitempty"`
+	Eof       bool   `json:"eof,omitempty"`
+}
+
+
 
 type Vantage_CommandStreamServer interface {
 	Send(*ServerCommand) error
@@ -129,7 +233,7 @@ func (s *keyManagerCommandStreamServer) Recv() (*AgentMessage, error) {
 	return m, nil
 }
 
-// CommandStream client-side interface
+
 
 type Vantage_CommandStreamClient interface {
 	Send(*AgentMessage) error
@@ -153,13 +257,16 @@ func (c *vantageCommandStreamClient) Recv() (*ServerCommand, error) {
 	return m, nil
 }
 
-// Server interface
+
 
 type VantageServer interface {
 	Register(context.Context, *RegisterRequest) (*RegisterResponse, error)
 	SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error)
 	UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error)
 	ReportUpdates(context.Context, *ReportUpdatesRequest) (*ReportUpdatesResponse, error)
+	ReportInventory(context.Context, *InventoryReport) (*InventoryReportResponse, error)
+	SyncMonitors(context.Context, *SyncMonitorsRequest) (*SyncMonitorsResponse, error)
+	ReportChecks(context.Context, *ReportChecksRequest) (*ReportChecksResponse, error)
 	CommandStream(Vantage_CommandStreamServer) error
 }
 
@@ -181,17 +288,32 @@ func (UnimplementedVantageServer) ReportUpdates(context.Context, *ReportUpdatesR
 	return nil, status.Errorf(codes.Unimplemented, "method ReportUpdates not implemented")
 }
 
+func (UnimplementedVantageServer) ReportInventory(context.Context, *InventoryReport) (*InventoryReportResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ReportInventory not implemented")
+}
+
+func (UnimplementedVantageServer) SyncMonitors(context.Context, *SyncMonitorsRequest) (*SyncMonitorsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SyncMonitors not implemented")
+}
+
+func (UnimplementedVantageServer) ReportChecks(context.Context, *ReportChecksRequest) (*ReportChecksResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ReportChecks not implemented")
+}
+
 func (UnimplementedVantageServer) CommandStream(Vantage_CommandStreamServer) error {
 	return status.Errorf(codes.Unimplemented, "method CommandStream not implemented")
 }
 
-// Client interface
+
 
 type VantageClient interface {
 	Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error)
 	SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error)
 	UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error)
 	ReportUpdates(ctx context.Context, in *ReportUpdatesRequest, opts ...grpc.CallOption) (*ReportUpdatesResponse, error)
+	ReportInventory(ctx context.Context, in *InventoryReport, opts ...grpc.CallOption) (*InventoryReportResponse, error)
+	SyncMonitors(ctx context.Context, in *SyncMonitorsRequest, opts ...grpc.CallOption) (*SyncMonitorsResponse, error)
+	ReportChecks(ctx context.Context, in *ReportChecksRequest, opts ...grpc.CallOption) (*ReportChecksResponse, error)
 	CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error)
 }
 
@@ -235,6 +357,30 @@ func (c *keyManagerClient) ReportUpdates(ctx context.Context, in *ReportUpdatesR
 	return out, nil
 }
 
+func (c *keyManagerClient) ReportInventory(ctx context.Context, in *InventoryReport, opts ...grpc.CallOption) (*InventoryReportResponse, error) {
+	out := new(InventoryReportResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/ReportInventory", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) SyncMonitors(ctx context.Context, in *SyncMonitorsRequest, opts ...grpc.CallOption) (*SyncMonitorsResponse, error) {
+	out := new(SyncMonitorsResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/SyncMonitors", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) ReportChecks(ctx context.Context, in *ReportChecksRequest, opts ...grpc.CallOption) (*ReportChecksResponse, error) {
+	out := new(ReportChecksResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/ReportChecks", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *keyManagerClient) CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error) {
 	stream, err := c.cc.NewStream(ctx, &Vantage_ServiceDesc.Streams[0], "/vantage.v1.Vantage/CommandStream", opts...)
 	if err != nil {
@@ -243,7 +389,7 @@ func (c *keyManagerClient) CommandStream(ctx context.Context, opts ...grpc.CallO
 	return &vantageCommandStreamClient{stream}, nil
 }
 
-// Server registration
+
 
 func RegisterVantageServer(s grpc.ServiceRegistrar, srv VantageServer) {
 	s.RegisterService(&Vantage_ServiceDesc, srv)
@@ -257,6 +403,9 @@ var Vantage_ServiceDesc = grpc.ServiceDesc{
 		{MethodName: "SyncKeys", Handler: _Vantage_SyncKeys_Handler},
 		{MethodName: "UploadGeneratedKey", Handler: _Vantage_UploadGeneratedKey_Handler},
 		{MethodName: "ReportUpdates", Handler: _Vantage_ReportUpdates_Handler},
+		{MethodName: "ReportInventory", Handler: _Vantage_ReportInventory_Handler},
+		{MethodName: "SyncMonitors", Handler: _Vantage_SyncMonitors_Handler},
+		{MethodName: "ReportChecks", Handler: _Vantage_ReportChecks_Handler},
 	},
 	Streams: []grpc.StreamDesc{
 		{
@@ -329,6 +478,51 @@ func _Vantage_ReportUpdates_Handler(srv interface{}, ctx context.Context, dec fu
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Vantage_ReportInventory_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(InventoryReport)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).ReportInventory(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/ReportInventory"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).ReportInventory(ctx, req.(*InventoryReport))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Vantage_SyncMonitors_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SyncMonitorsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).SyncMonitors(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/SyncMonitors"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).SyncMonitors(ctx, req.(*SyncMonitorsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Vantage_ReportChecks_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ReportChecksRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).ReportChecks(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/ReportChecks"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).ReportChecks(ctx, req.(*ReportChecksRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Vantage_CommandStream_Handler(srv interface{}, stream grpc.ServerStream) error {
 	return srv.(VantageServer).CommandStream(&keyManagerCommandStreamServer{stream})
 }

server/internal/grpc/server.go

@@ -7,6 +7,7 @@ import (
 	"net"
 	"time"
 
+	"github.com/mrhid6/vantage/server/internal/checker"
 	"github.com/mrhid6/vantage/server/internal/grpc/pb"
 	"github.com/mrhid6/vantage/server/internal/models"
 	"github.com/mrhid6/vantage/server/internal/services"
@@ -61,14 +62,14 @@ func (s *vantageServer) UploadGeneratedKey(ctx context.Context, req *pb.UploadKe
 		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
 	}
 
-	// Agent-generated keys carry no passphrase over the wire (proto has no field).
-	key, err := services.CreateKey(req.Label, req.PublicKey, "generated", srv.ServerID, req.PrivateKey, "")
+	
+	key, err := services.CreateKey(srv.OrgID, req.Label, req.PublicKey, "generated", srv.ServerID, req.PrivateKey, "")
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, "failed to store key: %v", err)
 	}
 
-	// Auto-assign to the generating server
-	if _, err := services.AssignKey(key.KeyID, srv.ServerID); err != nil {
+	
+	if _, err := services.AssignKey(srv.OrgID, key.KeyID, srv.ServerID); err != nil {
 		log.Printf("failed to auto-assign generated key: %v", err)
 	}
 
@@ -95,8 +96,66 @@ func (s *vantageServer) ReportUpdates(ctx context.Context, req *pb.ReportUpdates
 	return &pb.ReportUpdatesResponse{}, nil
 }
 
+func (s *vantageServer) ReportInventory(ctx context.Context, req *pb.InventoryReport) (*pb.InventoryReportResponse, error) {
+	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
+	if err != nil {
+		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
+	}
+	if err := services.StoreInventory(srv.ServerID, req); err != nil {
+		log.Printf("store inventory for %s: %v", srv.ServerID, err)
+	}
+	return &pb.InventoryReportResponse{}, nil
+}
+
+func (s *vantageServer) SyncMonitors(ctx context.Context, req *pb.SyncMonitorsRequest) (*pb.SyncMonitorsResponse, error) {
+	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
+	if err != nil {
+		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
+	}
+	monitors, err := services.ListMonitorsForRunner(srv.OrgID, srv.ServerID)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "list monitors")
+	}
+	specs := make([]pb.MonitorSpec, 0, len(monitors))
+	for _, m := range monitors {
+		specs = append(specs, pb.MonitorSpec{
+			MonitorId:      m.MonitorID,
+			Type:           m.Type,
+			URL:            m.Target.URL,
+			Host:           m.Target.Host,
+			Port:           m.Target.Port,
+			Method:         m.Target.Method,
+			ExpectedStatus: m.Target.ExpectedStatus,
+			Keyword:        m.Target.Keyword,
+			TLSWarnDays:    m.Target.TLSWarnDays,
+			Insecure:       m.Target.Insecure,
+			IntervalSec:    m.IntervalSec,
+			Retries:        m.Retries,
+		})
+	}
+	return &pb.SyncMonitorsResponse{Monitors: specs}, nil
+}
+
+func (s *vantageServer) ReportChecks(ctx context.Context, req *pb.ReportChecksRequest) (*pb.ReportChecksResponse, error) {
+	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
+	if err != nil {
+		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
+	}
+	for _, r := range req.Results {
+		res := checker.Result{Up: r.Up, LatencyMs: r.LatencyMs, Message: r.Message}
+		if r.CertExpiryUnix > 0 {
+			t := time.Unix(r.CertExpiryUnix, 0)
+			res.CertExpiry = &t
+		}
+		if err := services.IngestResult(srv.OrgID, srv.ServerID, r.MonitorId, res); err != nil {
+			log.Printf("ingest check %s: %v", r.MonitorId, err)
+		}
+	}
+	return &pb.ReportChecksResponse{}, nil
+}
+
 func (s *vantageServer) CommandStream(stream pb.Vantage_CommandStreamServer) error {
-	// First message authenticates the agent and signals readiness.
+	
 	msg, err := stream.Recv()
 	if err != nil {
 		return status.Errorf(codes.InvalidArgument, "expected initial auth message: %v", err)
@@ -117,8 +176,8 @@ func (s *vantageServer) CommandStream(stream pb.Vantage_CommandStreamServer) err
 	log.Printf("agent %s connected command stream", srv.ServerID)
 	defer log.Printf("agent %s disconnected command stream", srv.ServerID)
 
-	// Drain inbound results in the background so client Send calls never block.
-	// UploadGeneratedKey handles the real storage; these are just confirmation logs.
+	
+	
 	go func() {
 		for {
 			m, err := stream.Recv()
@@ -129,6 +188,16 @@ func (s *vantageServer) CommandStream(stream pb.Vantage_CommandStreamServer) err
 				r := m.Result
 				log.Printf("agent %s cmd %s: success=%v %s", srv.ServerID, r.CommandId, r.Success, r.Message)
 			}
+			if m.StepResult != nil {
+				services.StepResults.Deliver(m.StepResult)
+			}
+			if m.StepOutput != nil {
+				if m.StepOutput.Eof {
+					services.StepLogs.Close(m.StepOutput.CommandId)
+				} else {
+					services.StepLogs.Append(m.StepOutput.CommandId, m.StepOutput.Data)
+				}
+			}
 		}
 	}()
 
@@ -155,15 +224,15 @@ func StartGRPC(port int) error {
 	}
 
 	s := grpc.NewServer(
-		// Accept client keepalive pings as fast as every 20s so the 30s agent
-		// ping interval is always within the allowed window.
+		
+		
 		grpc.KeepaliveEnforcementPolicy(keepalive.EnforcementPolicy{
 			MinTime:             20 * time.Second,
 			PermitWithoutStream: false,
 		}),
 		grpc.KeepaliveParams(keepalive.ServerParameters{
-			// Server also pings the client after 45s of inactivity so both
-			// sides can detect a dead connection without waiting for a timeout.
+			
+			
 			Time:    45 * time.Second,
 			Timeout: 10 * time.Second,
 		}),

server/internal/models/assignment.go

@@ -8,8 +8,9 @@ import (
 
 type Assignment struct {
 	ID         bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
-	KeyID      string             `bson:"key_id" json:"key_id"`
-	ServerID   string             `bson:"server_id" json:"server_id"`
-	AssignedAt time.Time          `bson:"assigned_at" json:"assigned_at"`
-	RevokedAt  *time.Time         `bson:"revoked_at,omitempty" json:"revoked_at,omitempty"`
+	OrgID      string        `bson:"org_id" json:"org_id"`
+	KeyID      string        `bson:"key_id" json:"key_id"`
+	ServerID   string        `bson:"server_id" json:"server_id"`
+	AssignedAt time.Time     `bson:"assigned_at" json:"assigned_at"`
+	RevokedAt  *time.Time    `bson:"revoked_at,omitempty" json:"revoked_at,omitempty"`
 }

server/internal/models/audit.go

@@ -8,6 +8,7 @@ import (
 
 type AuditEvent struct {
 	ID        bson.ObjectID `bson:"_id,omitempty" json:"id"`
+	OrgID     string        `bson:"org_id" json:"org_id"`
 	EventType string        `bson:"event_type" json:"event_type"`
 	Actor     string        `bson:"actor" json:"actor"`
 	ServerID  string        `bson:"server_id,omitempty" json:"server_id,omitempty"`

server/internal/models/channel.go

@@ -0,0 +1,30 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+
+const (
+	ChannelWebhook  = "webhook"
+	ChannelSMTP     = "smtp"
+	ChannelDiscord  = "discord"
+	ChannelSlack    = "slack"
+	ChannelTelegram = "telegram"
+)
+
+
+
+
+type NotificationChannel struct {
+	ID        bson.ObjectID     `bson:"_id,omitempty" json:"_id,omitempty"`
+	OrgID     string            `bson:"org_id" json:"org_id"`
+	ChannelID string            `bson:"channel_id" json:"channel_id"`
+	Name      string            `bson:"name" json:"name"`
+	Type      string            `bson:"type" json:"type"`
+	Config    map[string]string `bson:"config" json:"config"`
+	Enabled   bool              `bson:"enabled" json:"enabled"`
+	CreatedAt time.Time         `bson:"created_at" json:"created_at"`
+}

server/internal/models/console_session.go

@@ -8,17 +8,18 @@ import (
 
 type ConsoleSession struct {
 	ID        bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	OrgID     string        `bson:"org_id" json:"org_id"`
 	SessionID string        `bson:"session_id" json:"session_id"`
 	ServerID  string        `bson:"server_id" json:"server_id"`
-	Protocol  string        `bson:"protocol" json:"protocol"` // ssh | rdp | vnc
+	Protocol  string        `bson:"protocol" json:"protocol"` 
 	KeyID     string        `bson:"key_id,omitempty" json:"key_id,omitempty"`
 	User      string        `bson:"user" json:"user"`
 	StartedAt time.Time     `bson:"started_at" json:"started_at"`
 	EndedAt   *time.Time    `bson:"ended_at,omitempty" json:"ended_at,omitempty"`
 	ClientIP  string        `bson:"client_ip,omitempty" json:"client_ip,omitempty"`
 
-	// TokenConsumedAt marks the one-time session token as spent. Set atomically
-	// when the tunnel opens; a second open with the same token is rejected.
+	
+	
 	TokenConsumedAt *time.Time `bson:"token_consumed_at,omitempty" json:"-"`
 
 	SSHUsername string `bson:"ssh_username,omitempty" json:"ssh_username,omitempty"`

server/internal/models/key.go

@@ -8,11 +8,12 @@ import (
 
 type Key struct {
 	ID                  bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	OrgID               string        `bson:"org_id" json:"org_id"`
 	KeyID               string        `bson:"key_id" json:"key_id"`
 	Label               string        `bson:"label" json:"label"`
 	PublicKey           string        `bson:"public_key" json:"public_key"`
 	Fingerprint         string        `bson:"fingerprint" json:"fingerprint"`
-	Source              string        `bson:"source" json:"source"` // uploaded | generated
+	Source              string        `bson:"source" json:"source"` 
 	GeneratedByServerID string        `bson:"generated_by_server_id,omitempty" json:"generated_by_server_id,omitempty"`
 	PrivateKeyEncrypted string        `bson:"private_key_enc,omitempty" json:"-"`
 	HasPrivateKey       bool          `bson:"-" json:"has_private_key"`

server/internal/models/monitor.go

@@ -0,0 +1,81 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+
+const (
+	MonitorHTTP = "http"
+	MonitorTCP  = "tcp"
+	MonitorICMP = "icmp"
+	MonitorTLS  = "tls"
+)
+
+
+const (
+	StatusUp      = "up"
+	StatusDown    = "down"
+	StatusPending = "pending"
+)
+
+
+
+const RunnerServer = "server"
+
+type MonitorTarget struct {
+	URL            string `bson:"url,omitempty" json:"url,omitempty"`
+	Host           string `bson:"host,omitempty" json:"host,omitempty"`
+	Port           int    `bson:"port,omitempty" json:"port,omitempty"`
+	Method         string `bson:"method,omitempty" json:"method,omitempty"`
+	ExpectedStatus int    `bson:"expected_status,omitempty" json:"expected_status,omitempty"`
+	Keyword        string `bson:"keyword,omitempty" json:"keyword,omitempty"`
+	TLSWarnDays    int    `bson:"tls_warn_days,omitempty" json:"tls_warn_days,omitempty"`
+	Insecure       bool   `bson:"insecure,omitempty" json:"insecure,omitempty"` 
+}
+
+type MonitorState struct {
+	Status         string     `bson:"status" json:"status"` 
+	LastCheckAt    *time.Time `bson:"last_check_at,omitempty" json:"last_check_at,omitempty"`
+	LatencyMs      int        `bson:"latency_ms" json:"latency_ms"`
+	Message        string     `bson:"message,omitempty" json:"message,omitempty"`
+	CertExpiryAt   *time.Time `bson:"cert_expiry_at,omitempty" json:"cert_expiry_at,omitempty"`
+	Fails          int        `bson:"fails" json:"fails"` 
+	LastNotifiedAt *time.Time `bson:"last_notified_at,omitempty" json:"last_notified_at,omitempty"`
+}
+
+type Monitor struct {
+	ID          bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	OrgID       string        `bson:"org_id" json:"org_id"`
+	MonitorID   string        `bson:"monitor_id" json:"monitor_id"`
+	Name        string        `bson:"name" json:"name"`
+	Type        string        `bson:"type" json:"type"` 
+	Target      MonitorTarget `bson:"target" json:"target"`
+	IntervalSec int           `bson:"interval_sec" json:"interval_sec"`
+	Runner      string        `bson:"runner" json:"runner"`   
+	Retries     int           `bson:"retries" json:"retries"` 
+	Enabled     bool          `bson:"enabled" json:"enabled"`
+	ChannelIDs  []string      `bson:"channel_ids,omitempty" json:"channel_ids,omitempty"`
+	State       MonitorState  `bson:"state" json:"state"`
+	CreatedAt   time.Time     `bson:"created_at" json:"created_at"`
+}
+
+type Incident struct {
+	OrgID      string     `bson:"org_id" json:"org_id"`
+	IncidentID string     `bson:"incident_id" json:"incident_id"`
+	MonitorID  string     `bson:"monitor_id" json:"monitor_id"`
+	StartedAt  time.Time  `bson:"started_at" json:"started_at"`
+	ResolvedAt *time.Time `bson:"resolved_at,omitempty" json:"resolved_at,omitempty"`
+	Cause      string     `bson:"cause,omitempty" json:"cause,omitempty"`
+}
+
+type Rollup struct {
+	OrgID       string    `bson:"org_id" json:"org_id"`
+	MonitorID   string    `bson:"monitor_id" json:"monitor_id"`
+	PeriodStart time.Time `bson:"period_start" json:"period_start"` 
+	Checks      int       `bson:"checks" json:"checks"`
+	UpCount     int       `bson:"up_count" json:"up_count"`
+	SumLatency  int64     `bson:"sum_latency" json:"sum_latency"`
+}

server/internal/models/org.go

@@ -0,0 +1,15 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+type Org struct {
+	ID        bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	OrgID     string        `bson:"org_id" json:"org_id"`
+	Name      string        `bson:"name" json:"name"`
+	Slug      string        `bson:"slug" json:"slug"`
+	CreatedAt time.Time     `bson:"created_at" json:"created_at"`
+}

server/internal/models/org_oidc.go

@@ -0,0 +1,17 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+type OrgOIDC struct {
+	ID              bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	OrgID           string        `bson:"org_id" json:"org_id"`
+	Issuer          string        `bson:"issuer" json:"issuer"`
+	ClientID        string        `bson:"client_id" json:"client_id"`
+	ClientSecretEnc string        `bson:"client_secret_enc,omitempty" json:"-"`
+	Enabled         bool          `bson:"enabled" json:"enabled"`
+	UpdatedAt       time.Time     `bson:"updated_at" json:"updated_at"`
+}

server/internal/models/secret.go

@@ -6,17 +6,18 @@ import (
 	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
-// Secret is a single key/value pair within a group. The value is stored
-// encrypted (AES-256-GCM) and is never serialized to JSON.
+
+
 type Secret struct {
 	ID             bson.ObjectID `bson:"_id,omitempty" json:"-"`
+	OrgID          string        `bson:"org_id" json:"org_id"`
 	Group          string        `bson:"group" json:"group"`
 	Key            string        `bson:"key" json:"key"`
 	EncryptedValue string        `bson:"encrypted_value" json:"-"`
 	UpdatedAt      time.Time     `bson:"updated_at" json:"updated_at"`
 }
 
-// GroupSummary describes a group in the list view.
+
 type GroupSummary struct {
 	Group     string    `json:"group"`
 	KeyCount  int       `json:"key_count"`

server/internal/models/server.go

@@ -12,23 +12,56 @@ type PackageUpdate struct {
 	NewVersion     string `bson:"new_version" json:"new_version"`
 }
 
-type Server struct {
-	ID               bson.ObjectID  `bson:"_id,omitempty" json:"_id,omitempty"`
-	ServerID         string         `bson:"server_id" json:"server_id"`
-	Hostname         string         `bson:"hostname" json:"hostname"`
-	IPAddress        string         `bson:"ip_address" json:"ip_address"`
-	OSInfo           string         `bson:"os_info" json:"os_info"`
-	OSType           string         `bson:"os_type,omitempty" json:"os_type,omitempty"`
-	ConsoleProtocols []string       `bson:"console_protocols,omitempty" json:"console_protocols,omitempty"`
-	SSHPort          int            `bson:"ssh_port,omitempty" json:"ssh_port,omitempty"`
-	RDPPort          int            `bson:"rdp_port,omitempty" json:"rdp_port,omitempty"`
-	PreRegToken      string         `bson:"pre_reg_token,omitempty" json:"pre_reg_token,omitempty"`
-	PreRegExpires    *time.Time     `bson:"pre_reg_expires,omitempty" json:"pre_reg_expires,omitempty"`
-	AgentTokenHash   string         `bson:"agent_token_hash,omitempty" json:"-"`
-	Status           string         `bson:"status" json:"status"`
-	AgentVersion     string         `bson:"agent_version,omitempty" json:"agent_version,omitempty"`
-	LastSeen         *time.Time     `bson:"last_seen,omitempty" json:"last_seen,omitempty"`
-	AvailableUpdates []PackageUpdate `bson:"available_updates,omitempty" json:"available_updates,omitempty"`
-	UpdatesCheckedAt *time.Time     `bson:"updates_checked_at,omitempty" json:"updates_checked_at,omitempty"`
-	CreatedAt        time.Time      `bson:"created_at" json:"created_at"`
+type CPUInfo struct {
+	Model    string  `bson:"model,omitempty" json:"model,omitempty"`
+	Cores    int     `bson:"cores,omitempty" json:"cores,omitempty"`
+	UsagePct float64 `bson:"usage_pct" json:"usage_pct"`
+	Load1    float64 `bson:"load1,omitempty" json:"load1,omitempty"`
+}
+
+type MemInfo struct {
+	TotalBytes uint64 `bson:"total_bytes" json:"total_bytes"`
+	UsedBytes  uint64 `bson:"used_bytes" json:"used_bytes"`
+}
+
+type Partition struct {
+	Device     string `bson:"device" json:"device"`
+	Mountpoint string `bson:"mountpoint" json:"mountpoint"`
+	Fstype     string `bson:"fstype,omitempty" json:"fstype,omitempty"`
+	TotalBytes uint64 `bson:"total_bytes" json:"total_bytes"`
+	UsedBytes  uint64 `bson:"used_bytes" json:"used_bytes"`
+}
+
+type Inventory struct {
+	CPU            CPUInfo     `bson:"cpu" json:"cpu"`
+	Memory         MemInfo     `bson:"memory" json:"memory"`
+	SwapTotalBytes uint64      `bson:"swap_total_bytes" json:"swap_total_bytes"`
+	SwapUsedBytes  uint64      `bson:"swap_used_bytes" json:"swap_used_bytes"`
+	Partitions     []Partition `bson:"partitions,omitempty" json:"partitions,omitempty"`
+	Kernel         string      `bson:"kernel,omitempty" json:"kernel,omitempty"`
+	MetricsAt      *time.Time  `bson:"metrics_at,omitempty" json:"metrics_at,omitempty"`
+	StaticAt       *time.Time  `bson:"static_at,omitempty" json:"static_at,omitempty"`
+}
+
+type Server struct {
+	ID               bson.ObjectID   `bson:"_id,omitempty" json:"_id,omitempty"`
+	OrgID            string          `bson:"org_id" json:"org_id"`
+	ServerID         string          `bson:"server_id" json:"server_id"`
+	Hostname         string          `bson:"hostname" json:"hostname"`
+	IPAddress        string          `bson:"ip_address" json:"ip_address"`
+	OSInfo           string          `bson:"os_info" json:"os_info"`
+	OSType           string          `bson:"os_type,omitempty" json:"os_type,omitempty"`
+	ConsoleProtocols []string        `bson:"console_protocols,omitempty" json:"console_protocols,omitempty"`
+	SSHPort          int             `bson:"ssh_port,omitempty" json:"ssh_port,omitempty"`
+	RDPPort          int             `bson:"rdp_port,omitempty" json:"rdp_port,omitempty"`
+	PreRegToken      string          `bson:"pre_reg_token,omitempty" json:"pre_reg_token,omitempty"`
+	PreRegExpires    *time.Time      `bson:"pre_reg_expires,omitempty" json:"pre_reg_expires,omitempty"`
+	AgentTokenHash   string          `bson:"agent_token_hash,omitempty" json:"-"`
+	Status           string          `bson:"status" json:"status"`
+	AgentVersion     string          `bson:"agent_version,omitempty" json:"agent_version,omitempty"`
+	LastSeen         *time.Time      `bson:"last_seen,omitempty" json:"last_seen,omitempty"`
+	AvailableUpdates []PackageUpdate `bson:"available_updates,omitempty" json:"available_updates,omitempty"`
+	UpdatesCheckedAt *time.Time      `bson:"updates_checked_at,omitempty" json:"updates_checked_at,omitempty"`
+	Inventory        *Inventory      `bson:"inventory,omitempty" json:"inventory,omitempty"`
+	CreatedAt        time.Time       `bson:"created_at" json:"created_at"`
 }

server/internal/models/settings.go

@@ -23,8 +23,8 @@ type EmailSettings struct {
 	UseTLS   bool     `bson:"use_tls" json:"use_tls"`
 }
 
-// SecretsSettings holds configuration for the secrets vault / ESO integration.
-// The read token is stored as a SHA-256 hash and never returned to clients.
+
+
 type SecretsSettings struct {
 	ReadTokenHash string    `bson:"read_token_hash,omitempty" json:"-"`
 	ReadTokenSet  bool      `bson:"-" json:"read_token_set"`
@@ -33,7 +33,10 @@ type SecretsSettings struct {
 
 type Settings struct {
 	ID      bson.ObjectID   `bson:"_id,omitempty" json:"-"`
+	OrgID   string          `bson:"org_id" json:"org_id"`
 	Alerts  AlertSettings   `bson:"alerts" json:"alerts"`
 	Email   EmailSettings   `bson:"email" json:"email"`
 	Secrets SecretsSettings `bson:"secrets" json:"secrets"`
+	
+	WorkflowLogRetentionDays *int `bson:"workflow_log_retention_days,omitempty" json:"workflow_log_retention_days,omitempty"`
 }

server/internal/models/user.go

@@ -0,0 +1,35 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+
+
+const (
+	RoleOwner  = "owner"
+	RoleAdmin  = "admin"
+	RoleMember = "member"
+)
+
+func ValidRole(role string) bool {
+	switch role {
+	case RoleOwner, RoleAdmin, RoleMember:
+		return true
+	}
+	return false
+}
+
+type User struct {
+	ID           bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	UserID       string        `bson:"user_id" json:"user_id"`
+	OrgID        string        `bson:"org_id" json:"org_id"`
+	Email        string        `bson:"email" json:"email"`
+	PasswordHash string        `bson:"password_hash,omitempty" json:"-"`
+	Role         string        `bson:"role" json:"role"`               
+	AuthSource   string        `bson:"auth_source" json:"auth_source"` 
+	CreatedAt    time.Time     `bson:"created_at" json:"created_at"`
+	LastLogin    *time.Time    `bson:"last_login,omitempty" json:"last_login,omitempty"`
+}

server/internal/models/workflow.go

@@ -0,0 +1,104 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+type InputParam struct {
+	Name        string `bson:"name" json:"name"`
+	Default     string `bson:"default" json:"default"`
+	Description string `bson:"description" json:"description"`
+}
+
+type WorkflowStep struct {
+	ID              bson.ObjectID `bson:"_id,omitempty" json:"-"`
+	OrgID           string        `bson:"org_id" json:"org_id"`
+	StepID          string        `bson:"step_id" json:"step_id"`
+	Name            string        `bson:"name" json:"name"`
+	Description     string        `bson:"description" json:"description"`
+	Interpreter     string        `bson:"interpreter" json:"interpreter"` 
+	Script          string        `bson:"script" json:"script"`
+	DeclaredOutputs []string      `bson:"declared_outputs" json:"declared_outputs"`
+	DeclaredInputs  []InputParam  `bson:"declared_inputs" json:"declared_inputs"`
+	SecretRefs      []string      `bson:"secret_refs" json:"secret_refs"`
+	Source          string        `bson:"source" json:"source"` 
+	Slug            string        `bson:"slug,omitempty" json:"slug,omitempty"`
+	CreatedAt       time.Time     `bson:"created_at" json:"created_at"`
+	UpdatedAt       time.Time     `bson:"updated_at" json:"updated_at"`
+}
+
+type WorkflowStepRef struct {
+	StepID     string            `bson:"step_id,omitempty" json:"step_id,omitempty"`
+	Inline     *WorkflowStep     `bson:"inline,omitempty" json:"inline,omitempty"`
+	Order      int               `bson:"order" json:"order"`
+	OnFailure  string            `bson:"on_failure" json:"on_failure"` 
+	MaxRetries int               `bson:"max_retries" json:"max_retries"`
+	Overrides  *StepOverride     `bson:"overrides,omitempty" json:"overrides,omitempty"`
+	Inputs     map[string]string `bson:"inputs,omitempty" json:"inputs,omitempty"`
+}
+
+type StepOverride struct {
+	Script     *string  `bson:"script,omitempty" json:"script,omitempty"`
+	SecretRefs []string `bson:"secret_refs,omitempty" json:"secret_refs,omitempty"`
+}
+
+type Workflow struct {
+	ID              bson.ObjectID     `bson:"_id,omitempty" json:"-"`
+	OrgID           string            `bson:"org_id" json:"org_id"`
+	WorkflowID      string            `bson:"workflow_id" json:"workflow_id"`
+	Name            string            `bson:"name" json:"name"`
+	TargetServerIDs []string          `bson:"target_server_ids" json:"target_server_ids"`
+	Steps           []WorkflowStepRef `bson:"steps" json:"steps"`
+	CreatedAt       time.Time         `bson:"created_at" json:"created_at"`
+	UpdatedAt       time.Time         `bson:"updated_at" json:"updated_at"`
+}
+
+
+type ResolvedStep struct {
+	Order       int               `bson:"order" json:"order"`
+	Name        string            `bson:"name" json:"name"`
+	Interpreter string            `bson:"interpreter" json:"interpreter"`
+	Script      string            `bson:"script" json:"script"`
+	SecretRefs  []string          `bson:"secret_refs" json:"secret_refs"`
+	OnFailure   string            `bson:"on_failure" json:"on_failure"`
+	MaxRetries  int               `bson:"max_retries" json:"max_retries"`
+	Inputs      map[string]string `bson:"inputs" json:"inputs"`
+}
+
+type StepRun struct {
+	Order      int               `bson:"order" json:"order"`
+	Name       string            `bson:"name" json:"name"`
+	Status     string            `bson:"status" json:"status"` 
+	Attempts   int               `bson:"attempts" json:"attempts"`
+	ExitCode   int               `bson:"exit_code" json:"exit_code"`
+	LogOffset  int64             `bson:"log_offset" json:"log_offset"`
+	OutputEnv  map[string]string `bson:"output_env" json:"output_env"`
+	StartedAt  *time.Time        `bson:"started_at,omitempty" json:"started_at,omitempty"`
+	FinishedAt *time.Time        `bson:"finished_at,omitempty" json:"finished_at,omitempty"`
+}
+
+type ServerRun struct {
+	ServerID   string            `bson:"server_id" json:"server_id"`
+	Hostname   string            `bson:"hostname" json:"hostname"`
+	Status     string            `bson:"status" json:"status"` 
+	StartedAt  *time.Time        `bson:"started_at,omitempty" json:"started_at,omitempty"`
+	FinishedAt *time.Time        `bson:"finished_at,omitempty" json:"finished_at,omitempty"`
+	RunEnv     map[string]string `bson:"run_env" json:"run_env"`
+	Steps      []StepRun         `bson:"steps" json:"steps"`
+}
+
+type WorkflowRun struct {
+	ID          bson.ObjectID  `bson:"_id,omitempty" json:"-"`
+	OrgID       string         `bson:"org_id" json:"org_id"`
+	RunID       string         `bson:"run_id" json:"run_id"`
+	WorkflowID  string         `bson:"workflow_id" json:"workflow_id"`
+	Name        string         `bson:"name" json:"name"`
+	Steps       []ResolvedStep `bson:"steps_snapshot" json:"steps_snapshot"`
+	Status      string         `bson:"status" json:"status"` 
+	TriggeredBy string         `bson:"triggered_by" json:"triggered_by"`
+	StartedAt   time.Time      `bson:"started_at" json:"started_at"`
+	FinishedAt  *time.Time     `bson:"finished_at,omitempty" json:"finished_at,omitempty"`
+	ServerRuns  []ServerRun    `bson:"server_runs" json:"server_runs"`
+}

server/internal/monitorsched/scheduler.go

@@ -0,0 +1,100 @@
+package monitorsched
+
+import (
+	"context"
+	"log"
+	"sync"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/checker"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+)
+
+const reloadInterval = 30 * time.Second
+
+type runner struct {
+	monitorID   string
+	intervalSec int
+	cancel      context.CancelFunc
+}
+
+func Start(ctx context.Context) {
+	go loop(ctx)
+}
+
+func loop(ctx context.Context) {
+	active := map[string]*runner{}
+	var mu sync.Mutex
+
+	sync := func() {
+		monitors, err := services.ListServerScheduledMonitors()
+		if err != nil {
+			log.Printf("monitorsched: list monitors: %v", err)
+			return
+		}
+		want := map[string]models.Monitor{}
+		for _, m := range monitors {
+			want[m.MonitorID] = m
+		}
+
+		mu.Lock()
+		defer mu.Unlock()
+		
+		for id, r := range active {
+			m, ok := want[id]
+			if !ok || m.IntervalSec != r.intervalSec {
+				r.cancel()
+				delete(active, id)
+			}
+		}
+		
+		for id, m := range want {
+			if _, ok := active[id]; ok {
+				continue
+			}
+			rctx, cancel := context.WithCancel(ctx)
+			active[id] = &runner{monitorID: id, intervalSec: m.IntervalSec, cancel: cancel}
+			go runMonitor(rctx, m)
+		}
+	}
+
+	sync()
+	t := time.NewTicker(reloadInterval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			sync()
+		}
+	}
+}
+
+func runMonitor(ctx context.Context, m models.Monitor) {
+	interval := time.Duration(m.IntervalSec) * time.Second
+	if interval <= 0 {
+		interval = 60 * time.Second
+	}
+	spec := services.SpecFor(&m)
+
+	run := func() {
+		res := checker.Run(ctx, spec)
+		if err := services.IngestServerScheduledResult(m.MonitorID, res); err != nil {
+			log.Printf("monitorsched: ingest %s: %v", m.MonitorID, err)
+		}
+	}
+
+	run() 
+	t := time.NewTicker(interval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			run()
+		}
+	}
+}

server/internal/notify/dispatch.go

@@ -0,0 +1,64 @@
+
+
+
+package notify
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+
+type Event struct {
+	MonitorName string
+	Type        string
+	OldStatus   string
+	NewStatus   string
+	Message     string
+	Time        time.Time
+}
+
+
+func (e Event) title() string {
+	verb := "recovered"
+	if e.NewStatus == models.StatusDown {
+		verb = "is DOWN"
+	}
+	s := fmt.Sprintf("[Vantage] %s (%s) %s", e.MonitorName, e.Type, verb)
+	if e.Message != "" {
+		s += ": " + e.Message
+	}
+	return s
+}
+
+
+func Dispatch(ch models.NotificationChannel, ev Event) error {
+	switch ch.Type {
+	case models.ChannelWebhook:
+		return dispatchWebhook(ch, ev)
+	case models.ChannelDiscord:
+		return dispatchDiscord(ch, ev)
+	case models.ChannelSlack:
+		return dispatchSlack(ch, ev)
+	case models.ChannelTelegram:
+		return dispatchTelegram(ch, ev)
+	case models.ChannelSMTP:
+		return dispatchSMTP(ch, ev)
+	default:
+		return fmt.Errorf("unknown channel type: %s", ch.Type)
+	}
+}
+
+
+func Test(ch models.NotificationChannel) error {
+	return Dispatch(ch, Event{
+		MonitorName: "Test monitor",
+		Type:        "http",
+		OldStatus:   models.StatusUp,
+		NewStatus:   models.StatusDown,
+		Message:     "this is a test alert from Vantage",
+		Time:        time.Now(),
+	})
+}

server/internal/notify/http.go

@@ -0,0 +1,71 @@
+package notify
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+var httpClient = &http.Client{Timeout: 10 * time.Second}
+
+func postJSON(target string, payload any) error {
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return err
+	}
+	resp, err := httpClient.Post(target, "application/json", bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 300 {
+		return fmt.Errorf("HTTP %d from %s", resp.StatusCode, target)
+	}
+	return nil
+}
+
+
+func dispatchWebhook(ch models.NotificationChannel, ev Event) error {
+	target := ch.Config["url"]
+	if target == "" {
+		return fmt.Errorf("webhook: missing url")
+	}
+	return postJSON(target, map[string]any{
+		"monitor":    ev.MonitorName,
+		"type":       ev.Type,
+		"old_status": ev.OldStatus,
+		"new_status": ev.NewStatus,
+		"message":    ev.Message,
+		"time":       ev.Time.Format(time.RFC3339),
+	})
+}
+
+func dispatchDiscord(ch models.NotificationChannel, ev Event) error {
+	target := ch.Config["url"]
+	if target == "" {
+		return fmt.Errorf("discord: missing url")
+	}
+	return postJSON(target, map[string]string{"content": ev.title()})
+}
+
+func dispatchSlack(ch models.NotificationChannel, ev Event) error {
+	target := ch.Config["url"]
+	if target == "" {
+		return fmt.Errorf("slack: missing url")
+	}
+	return postJSON(target, map[string]string{"text": ev.title()})
+}
+
+func dispatchTelegram(ch models.NotificationChannel, ev Event) error {
+	token := ch.Config["token"]
+	chatID := ch.Config["chat_id"]
+	if token == "" || chatID == "" {
+		return fmt.Errorf("telegram: missing token or chat_id")
+	}
+	api := fmt.Sprintf("https://api.telegram.org/bot%s/sendMessage", token)
+	return postJSON(api, map[string]string{"chat_id": chatID, "text": ev.title()})
+}

server/internal/notify/smtp.go

@@ -0,0 +1,98 @@
+package notify
+
+import (
+	"crypto/tls"
+	"fmt"
+	"net"
+	"net/smtp"
+	"strings"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+const smtpTimeout = 15 * time.Second
+
+
+
+
+
+
+
+
+func dispatchSMTP(ch models.NotificationChannel, ev Event) error {
+	host := ch.Config["host"]
+	port := ch.Config["port"]
+	from := ch.Config["from"]
+	to := ch.Config["to"]
+	if host == "" || port == "" || from == "" || to == "" {
+		return fmt.Errorf("smtp: missing host/port/from/to")
+	}
+
+	addr := net.JoinHostPort(host, port)
+	conn, err := net.DialTimeout("tcp", addr, smtpTimeout)
+	if err != nil {
+		return fmt.Errorf("smtp: dial %s: %w", addr, err)
+	}
+	_ = conn.SetDeadline(time.Now().Add(smtpTimeout))
+
+	
+	if port == "465" {
+		conn = tls.Client(conn, &tls.Config{ServerName: host})
+	}
+
+	c, err := smtp.NewClient(conn, host)
+	if err != nil {
+		conn.Close()
+		return fmt.Errorf("smtp: client: %w", err)
+	}
+	defer c.Close()
+
+	if port != "465" {
+		if ok, _ := c.Extension("STARTTLS"); ok {
+			if err := c.StartTLS(&tls.Config{ServerName: host}); err != nil {
+				return fmt.Errorf("smtp: starttls: %w", err)
+			}
+		}
+	}
+
+	if user := ch.Config["username"]; user != "" {
+		if err := c.Auth(smtp.PlainAuth("", user, ch.Config["password"], host)); err != nil {
+			return fmt.Errorf("smtp: auth: %w", err)
+		}
+	}
+
+	recipients := strings.Split(to, ",")
+	for i := range recipients {
+		recipients[i] = strings.TrimSpace(recipients[i])
+	}
+
+	if err := c.Mail(from); err != nil {
+		return fmt.Errorf("smtp: mail from: %w", err)
+	}
+	for _, rcpt := range recipients {
+		if rcpt == "" {
+			continue
+		}
+		if err := c.Rcpt(rcpt); err != nil {
+			return fmt.Errorf("smtp: rcpt %s: %w", rcpt, err)
+		}
+	}
+
+	msg, err := buildMIME(from, to, ev.title(), textEmail(ev), htmlEmail(ev))
+	if err != nil {
+		return fmt.Errorf("smtp: build message: %w", err)
+	}
+
+	w, err := c.Data()
+	if err != nil {
+		return fmt.Errorf("smtp: data: %w", err)
+	}
+	if _, err := w.Write(msg); err != nil {
+		return fmt.Errorf("smtp: write: %w", err)
+	}
+	if err := w.Close(); err != nil {
+		return fmt.Errorf("smtp: close data: %w", err)
+	}
+	return c.Quit()
+}

server/internal/notify/template.go

@@ -0,0 +1,166 @@
+package notify
+
+import (
+	"fmt"
+	"html"
+	"mime/multipart"
+	"net/textproto"
+	"strings"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+
+const (
+	colBg        = "#0f1117"
+	colSurface   = "#1a1d27"
+	colSurface2  = "#232635"
+	colBorder    = "#2e3147"
+	colText      = "#e8eaf0"
+	colTextMuted = "#9095a8"
+	colAccent    = "#6366f1"
+	colSuccess   = "#22c55e"
+	colDanger    = "#ef4444"
+)
+
+
+func statusColor(status string) string {
+	switch status {
+	case models.StatusUp:
+		return colSuccess
+	case models.StatusDown:
+		return colDanger
+	default:
+		return colTextMuted
+	}
+}
+
+
+
+func buildMIME(from, to, subject, text, htmlBody string) ([]byte, error) {
+	var buf strings.Builder
+	w := multipart.NewWriter(&buf)
+
+	var head strings.Builder
+	head.WriteString("From: " + from + "\r\n")
+	head.WriteString("To: " + to + "\r\n")
+	head.WriteString("Subject: " + subject + "\r\n")
+	head.WriteString("MIME-Version: 1.0\r\n")
+	head.WriteString(fmt.Sprintf("Content-Type: multipart/alternative; boundary=%s\r\n\r\n", w.Boundary()))
+
+	textPart, err := w.CreatePart(textproto.MIMEHeader{"Content-Type": {"text/plain; charset=UTF-8"}})
+	if err != nil {
+		return nil, err
+	}
+	textPart.Write([]byte(text))
+
+	htmlPart, err := w.CreatePart(textproto.MIMEHeader{"Content-Type": {"text/html; charset=UTF-8"}})
+	if err != nil {
+		return nil, err
+	}
+	htmlPart.Write([]byte(htmlBody))
+
+	if err := w.Close(); err != nil {
+		return nil, err
+	}
+	return []byte(head.String() + buf.String()), nil
+}
+
+func htmlEmail(ev Event) string {
+	accent := statusColor(ev.NewStatus)
+	label := "Recovered"
+	if ev.NewStatus == models.StatusDown {
+		label = "Down"
+	}
+
+	esc := html.EscapeString
+	row := func(k, v string) string {
+		if v == "" {
+			v = ""
+		}
+		return fmt.Sprintf(
+			`<tr>`+
+				`<td style="padding:8px 0;color:%s;font-size:13px;width:120px;">%s</td>`+
+				`<td style="padding:8px 0;color:%s;font-size:13px;font-weight:500;">%s</td>`+
+				`</tr>`,
+			colTextMuted, k, colText, esc(v))
+	}
+
+	message := ""
+	if ev.Message != "" {
+		message = fmt.Sprintf(
+			`<p style="margin:0 0 20px;padding:12px 14px;background:%s;border:1px solid %s;border-radius:8px;color:%s;font-size:13px;">%s</p>`,
+			colSurface2, colBorder, colText, esc(ev.Message))
+	}
+
+	transition := esc(ev.OldStatus) + " → " + esc(ev.NewStatus)
+
+	return fmt.Sprintf(`<!DOCTYPE html>
+<html>
+<body style="margin:0;padding:0;background:%s;">
+  <table role="presentation" width="100%%" cellpadding="0" cellspacing="0" style="background:%s;padding:32px 0;">
+    <tr>
+      <td align="center">
+        <table role="presentation" width="480" cellpadding="0" cellspacing="0" style="max-width:480px;background:%s;border:1px solid %s;border-radius:12px;overflow:hidden;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
+          <tr><td style="height:4px;background:%s;"></td></tr>
+          <tr>
+            <td style="padding:28px 28px 20px;">
+              <table role="presentation" cellpadding="0" cellspacing="0" style="margin-bottom:18px;">
+                <tr>
+                  <td style="font-size:18px;font-weight:700;color:%s;">Vantage</td>
+                </tr>
+              </table>
+              <span style="display:inline-block;padding:4px 12px;border-radius:9999px;background:%s22;color:%s;font-size:12px;font-weight:600;letter-spacing:.02em;">%s</span>
+              <h1 style="margin:14px 0 6px;font-size:20px;font-weight:700;color:%s;">%s</h1>
+              <p style="margin:0 0 20px;color:%s;font-size:13px;">%s check</p>
+              %s
+              <table role="presentation" width="100%%" cellpadding="0" cellspacing="0" style="border-top:1px solid %s;">
+                %s
+                %s
+                %s
+              </table>
+            </td>
+          </tr>
+          <tr>
+            <td style="padding:16px 28px;border-top:1px solid %s;">
+              <p style="margin:0;color:%s;font-size:12px;">Sent by Vantage · self-hosted service monitoring</p>
+            </td>
+          </tr>
+        </table>
+      </td>
+    </tr>
+  </table>
+</body>
+</html>`,
+		colBg,
+		colBg,
+		colSurface, colBorder,
+		accent,
+		colText,
+		accent, accent, label,
+		colText, esc(ev.MonitorName),
+		colTextMuted, esc(ev.Type),
+		message,
+		colBorder,
+		row("Status", transition),
+		row("Type", ev.Type),
+		row("Time", ev.Time.Format("2006-01-02 15:04:05 MST")),
+		colBorder,
+		colTextMuted,
+	)
+}
+
+
+func textEmail(ev Event) string {
+	return strings.Join([]string{
+		ev.title(),
+		"",
+		"Monitor: " + ev.MonitorName,
+		"Type:    " + ev.Type,
+		"Status:  " + ev.OldStatus + " -> " + ev.NewStatus,
+		"Message: " + ev.Message,
+		"Time:    " + ev.Time.Format("2006-01-02 15:04:05 MST"),
+		"",
+		"Sent by Vantage · self-hosted service monitoring",
+	}, "\r\n")
+}

server/internal/services/audit.go

@@ -11,11 +11,12 @@ import (
 	"go.mongodb.org/mongo-driver/v2/mongo/options"
 )
 
-func LogEvent(eventType, actor, serverID, keyID, details string) {
+func LogEvent(orgID, eventType, actor, serverID, keyID, details string) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	event := models.AuditEvent{
+		OrgID:     orgID,
 		EventType: eventType,
 		Actor:     actor,
 		ServerID:  serverID,
@@ -28,7 +29,7 @@ func LogEvent(eventType, actor, serverID, keyID, details string) {
 	}
 }
 
-func ListAuditEvents(limit int64) ([]models.AuditEvent, error) {
+func ListAuditEvents(orgID string, limit int64) ([]models.AuditEvent, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
@@ -36,7 +37,7 @@ func ListAuditEvents(limit int64) ([]models.AuditEvent, error) {
 		SetSort(bson.D{{Key: "created_at", Value: -1}}).
 		SetLimit(limit)
 
-	cursor, err := db.Col("audit_logs").Find(ctx, bson.M{}, opts)
+	cursor, err := db.Col("audit_logs").Find(ctx, bson.M{"org_id": orgID}, opts)
 	if err != nil {
 		return nil, err
 	}

server/internal/services/channels.go

@@ -0,0 +1,116 @@
+package services
+
+import (
+	"errors"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/notify"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+func ListChannels(orgID string) ([]models.NotificationChannel, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	cur, err := db.Col("notification_channels").Find(ctx, bson.M{"org_id": orgID}, options.Find().SetSort(bson.M{"created_at": 1}))
+	if err != nil {
+		return nil, err
+	}
+	var out []models.NotificationChannel
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func GetChannel(orgID, channelID string) (*models.NotificationChannel, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	var ch models.NotificationChannel
+	err := db.Col("notification_channels").FindOne(ctx, bson.M{"channel_id": channelID, "org_id": orgID}).Decode(&ch)
+	if errors.Is(err, mongo.ErrNoDocuments) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &ch, nil
+}
+
+
+func GetChannels(orgID string, channelIDs []string) ([]models.NotificationChannel, error) {
+	if len(channelIDs) == 0 {
+		return nil, nil
+	}
+	ctx, cancel := monCtx()
+	defer cancel()
+	cur, err := db.Col("notification_channels").Find(ctx, bson.M{"org_id": orgID, "channel_id": bson.M{"$in": channelIDs}})
+	if err != nil {
+		return nil, err
+	}
+	var out []models.NotificationChannel
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+
+
+func validateChannelIDs(orgID string, channelIDs []string) error {
+	for _, id := range channelIDs {
+		ch, err := GetChannel(orgID, id)
+		if err != nil {
+			return err
+		}
+		if ch == nil {
+			return errors.New("channel " + id + " not found")
+		}
+	}
+	return nil
+}
+
+func CreateChannel(orgID string, ch *models.NotificationChannel) (*models.NotificationChannel, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	ch.OrgID = orgID
+	ch.ChannelID = uuid.NewString()
+	ch.CreatedAt = time.Now()
+	if ch.Config == nil {
+		ch.Config = map[string]string{}
+	}
+	if _, err := db.Col("notification_channels").InsertOne(ctx, ch); err != nil {
+		return nil, err
+	}
+	return ch, nil
+}
+
+func UpdateChannel(orgID, channelID string, upd bson.M) error {
+	ctx, cancel := monCtx()
+	defer cancel()
+	_, err := db.Col("notification_channels").UpdateOne(ctx, bson.M{"channel_id": channelID, "org_id": orgID}, bson.M{"$set": upd})
+	return err
+}
+
+func DeleteChannel(orgID, channelID string) error {
+	ctx, cancel := monCtx()
+	defer cancel()
+	_, err := db.Col("notification_channels").DeleteOne(ctx, bson.M{"channel_id": channelID, "org_id": orgID})
+	return err
+}
+
+
+func TestChannel(orgID, channelID string) error {
+	ch, err := GetChannel(orgID, channelID)
+	if err != nil {
+		return err
+	}
+	if ch == nil {
+		return errors.New("channel not found")
+	}
+	return notify.Test(*ch)
+}

server/internal/services/console.go

@@ -17,7 +17,7 @@ import (
 )
 
 func sessionHMACKey() ([]byte, error) {
-	// Reuse the AES key material as the HMAC secret. Distinct domain via prefix.
+	
 	k, err := encryptionKey()
 	if err != nil {
 		return nil, err
@@ -29,7 +29,7 @@ func sessionHMACKey() ([]byte, error) {
 
 func b64(b []byte) string { return base64.RawURLEncoding.EncodeToString(b) }
 
-// SignSessionToken returns a signed, expiring token binding a session id.
+
 func SignSessionToken(sessionID string, ttl time.Duration) (string, error) {
 	key, err := sessionHMACKey()
 	if err != nil {
@@ -42,7 +42,7 @@ func SignSessionToken(sessionID string, ttl time.Duration) (string, error) {
 	return payload + "." + b64(mac.Sum(nil)), nil
 }
 
-// VerifySessionToken checks signature + expiry and returns the session id.
+
 func VerifySessionToken(token string) (string, error) {
 	parts := strings.Split(token, ".")
 	if len(parts) != 3 {
@@ -86,10 +86,10 @@ func portOr(v, def int) string {
 	return strconv.Itoa(v)
 }
 
-// BuildGuacParams assembles the guacd connection parameter map for a protocol.
-// privateKey/passphrase are the decrypted SSH private key and its optional
-// passphrase (ssh only); rdpUser/rdpPass are used for rdp, and rdpPass carries
-// the password for vnc. None of these values are persisted or logged by the caller.
+
+
+
+
 func BuildGuacParams(srv *models.Server, protocol, sshUser, privateKey, passphrase, rdpUser, rdpPass string) (*GuacParams, error) {
 	host := srv.IPAddress
 	switch protocol {
@@ -129,11 +129,12 @@ func BuildGuacParams(srv *models.Server, protocol, sshUser, privateKey, passphra
 	}
 }
 
-func CreateConsoleSession(serverID, protocol, keyID, user, clientIP string) (*models.ConsoleSession, error) {
+func CreateConsoleSession(orgID, serverID, protocol, keyID, user, clientIP string) (*models.ConsoleSession, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	s := &models.ConsoleSession{
+		OrgID:     orgID,
 		SessionID: uuid.NewString(),
 		ServerID:  serverID,
 		Protocol:  protocol,
@@ -148,19 +149,19 @@ func CreateConsoleSession(serverID, protocol, keyID, user, clientIP string) (*mo
 	return s, nil
 }
 
-func GetConsoleSession(sessionID string) (*models.ConsoleSession, error) {
+func GetConsoleSession(orgID, sessionID string) (*models.ConsoleSession, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	var s models.ConsoleSession
-	if err := db.Col("console_sessions").FindOne(ctx, bson.M{"session_id": sessionID}).Decode(&s); err != nil {
+	if err := db.Col("console_sessions").FindOne(ctx, bson.M{"session_id": sessionID, "org_id": orgID}).Decode(&s); err != nil {
 		return nil, err
 	}
 	return &s, nil
 }
 
-// StashConsoleRDPCreds encrypts and stores single-use RDP credentials on the
-// session document. They are consumed (and cleared) when the tunnel opens.
-func StashConsoleRDPCreds(sessionID, username, password string) error {
+
+
+func StashConsoleRDPCreds(orgID, sessionID, username, password string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	u, err := encryptString(username)
@@ -172,17 +173,17 @@ func StashConsoleRDPCreds(sessionID, username, password string) error {
 		return err
 	}
 	_, err = db.Col("console_sessions").UpdateOne(ctx,
-		bson.M{"session_id": sessionID},
+		bson.M{"session_id": sessionID, "org_id": orgID},
 		bson.M{"$set": bson.M{"rdp_user_enc": u, "rdp_pass_enc": p}},
 	)
 	return err
 }
 
-// ConsumeConsoleRDPCreds decrypts and returns the stored RDP credentials, then
-// clears them from the session document (single-use). Returns empty strings if
-// none were stored.
-func ConsumeConsoleRDPCreds(sessionID string) (username, password string, err error) {
-	s, err := GetConsoleSession(sessionID)
+
+
+
+func ConsumeConsoleRDPCreds(orgID, sessionID string) (username, password string, err error) {
+	s, err := GetConsoleSession(orgID, sessionID)
 	if err != nil {
 		return "", "", err
 	}
@@ -202,31 +203,31 @@ func ConsumeConsoleRDPCreds(sessionID string) (username, password string, err er
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	_, _ = db.Col("console_sessions").UpdateOne(ctx,
-		bson.M{"session_id": sessionID},
+		bson.M{"session_id": sessionID, "org_id": orgID},
 		bson.M{"$unset": bson.M{"rdp_user_enc": "", "rdp_pass_enc": ""}},
 	)
 	return username, password, nil
 }
 
-// SetConsoleSSHUser persists the SSH username to use on the session doc.
-func SetConsoleSSHUser(sessionID, username string) error {
+
+func SetConsoleSSHUser(orgID, sessionID, username string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	_, err := db.Col("console_sessions").UpdateOne(ctx,
-		bson.M{"session_id": sessionID},
+		bson.M{"session_id": sessionID, "org_id": orgID},
 		bson.M{"$set": bson.M{"ssh_username": username}})
 	return err
 }
 
-// ConsumeSessionToken atomically marks a session's one-time token as spent.
-// It returns an error if the token was already consumed (replay) or the session
-// does not exist, so the tunnel can be opened at most once per issued token.
-func ConsumeSessionToken(sessionID string) error {
+
+
+
+func ConsumeSessionToken(orgID, sessionID string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	now := time.Now()
 	res, err := db.Col("console_sessions").UpdateOne(ctx,
-		bson.M{"session_id": sessionID, "token_consumed_at": nil},
+		bson.M{"session_id": sessionID, "org_id": orgID, "token_consumed_at": nil},
 		bson.M{"$set": bson.M{"token_consumed_at": now}},
 	)
 	if err != nil {
@@ -238,12 +239,12 @@ func ConsumeSessionToken(sessionID string) error {
 	return nil
 }
 
-func EndConsoleSession(sessionID string) error {
+func EndConsoleSession(orgID, sessionID string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	now := time.Now()
 	_, err := db.Col("console_sessions").UpdateOne(ctx,
-		bson.M{"session_id": sessionID, "ended_at": nil},
+		bson.M{"session_id": sessionID, "org_id": orgID, "ended_at": nil},
 		bson.M{"$set": bson.M{"ended_at": now}},
 	)
 	return err

server/internal/services/console_test.go

@@ -1,111 +0,0 @@
-package services
-
-import (
-	"testing"
-	"time"
-
-	"github.com/mrhid6/vantage/server/internal/models"
-)
-
-func TestSessionTokenRoundTrip(t *testing.T) {
-	t.Setenv("KEY_ENCRYPTION_KEY", "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")
-
-	tok, err := SignSessionToken("sess-123", time.Minute)
-	if err != nil {
-		t.Fatalf("sign: %v", err)
-	}
-	got, err := VerifySessionToken(tok)
-	if err != nil {
-		t.Fatalf("verify: %v", err)
-	}
-	if got != "sess-123" {
-		t.Fatalf("got %q want sess-123", got)
-	}
-}
-
-func TestSessionTokenExpired(t *testing.T) {
-	t.Setenv("KEY_ENCRYPTION_KEY", "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")
-
-	tok, err := SignSessionToken("sess-123", -time.Second)
-	if err != nil {
-		t.Fatalf("sign: %v", err)
-	}
-	if _, err := VerifySessionToken(tok); err == nil {
-		t.Fatalf("expected expiry error, got nil")
-	}
-}
-
-func TestSessionTokenTampered(t *testing.T) {
-	t.Setenv("KEY_ENCRYPTION_KEY", "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")
-
-	tok, _ := SignSessionToken("sess-123", time.Minute)
-	if _, err := VerifySessionToken(tok + "x"); err == nil {
-		t.Fatalf("expected signature error, got nil")
-	}
-}
-
-func TestBuildGuacParamsSSH(t *testing.T) {
-	srv := &models.Server{IPAddress: "10.0.0.5", SSHPort: 22}
-	p, err := BuildGuacParams(srv, "ssh", "", "PRIVATE-KEY-DATA", "", "", "")
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	if p.Protocol != "ssh" {
-		t.Fatalf("protocol %q", p.Protocol)
-	}
-	if p.Params["hostname"] != "10.0.0.5" || p.Params["port"] != "22" {
-		t.Fatalf("bad host/port: %+v", p.Params)
-	}
-	if p.Params["private-key"] != "PRIVATE-KEY-DATA" {
-		t.Fatalf("missing private-key")
-	}
-	if p.Params["username"] != "root" {
-		t.Fatalf("expected default username root, got %q", p.Params["username"])
-	}
-}
-
-func TestBuildGuacParamsRDP(t *testing.T) {
-	srv := &models.Server{IPAddress: "10.0.0.9", RDPPort: 3389}
-	p, err := BuildGuacParams(srv, "rdp", "", "", "", "administrator", "s3cret")
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	if p.Params["port"] != "3389" || p.Params["username"] != "administrator" || p.Params["password"] != "s3cret" {
-		t.Fatalf("bad rdp params: %+v", p.Params)
-	}
-	if p.Params["ignore-cert"] != "true" {
-		t.Fatalf("expected ignore-cert=true")
-	}
-}
-
-func TestBuildGuacParamsUnknownProtocol(t *testing.T) {
-	srv := &models.Server{IPAddress: "10.0.0.9"}
-	if _, err := BuildGuacParams(srv, "telnet", "", "", "", "", ""); err == nil {
-		t.Fatalf("expected error for unknown protocol")
-	}
-}
-
-func TestBuildGuacParamsSSHPassphrase(t *testing.T) {
-	srv := &models.Server{IPAddress: "10.0.0.5", SSHPort: 22}
-	p, err := BuildGuacParams(srv, "ssh", "deploy", "PK", "s3cret-phrase", "", "")
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	if p.Params["username"] != "deploy" {
-		t.Fatalf("username %q", p.Params["username"])
-	}
-	if p.Params["passphrase"] != "s3cret-phrase" {
-		t.Fatalf("missing passphrase: %+v", p.Params)
-	}
-}
-
-func TestBuildGuacParamsVNC(t *testing.T) {
-	srv := &models.Server{IPAddress: "10.0.0.7"}
-	p, err := BuildGuacParams(srv, "vnc", "", "", "", "", "vncpass")
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	if p.Protocol != "vnc" || p.Params["hostname"] != "10.0.0.7" || p.Params["port"] != "5900" || p.Params["password"] != "vncpass" {
-		t.Fatalf("bad vnc params: %+v", p.Params)
-	}
-}

server/internal/services/crypto.go

@@ -22,8 +22,8 @@ func encryptionKey() ([]byte, error) {
 	return key, nil
 }
 
-// encryptString encrypts a plaintext value with AES-256-GCM using the
-// shared KEY_ENCRYPTION_KEY, returning hex(nonce + ciphertext).
+
+
 func encryptString(plaintext string) (string, error) {
 	key, err := encryptionKey()
 	if err != nil {
@@ -45,7 +45,7 @@ func encryptString(plaintext string) (string, error) {
 	return hex.EncodeToString(sealed), nil
 }
 
-// decryptString reverses encryptString.
+
 func decryptString(ciphertextHex string) (string, error) {
 	key, err := encryptionKey()
 	if err != nil {

server/internal/services/defaults.go

@@ -0,0 +1,95 @@
+package services
+
+import (
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+
+func DefaultStepsDir() string {
+	dir := os.Getenv("VANTAGE_DEFAULT_STEPS_DIR")
+	if dir == "" {
+		dir = filepath.Join("data", "default-steps")
+	}
+	_ = os.MkdirAll(dir, 0700)
+	return dir
+}
+
+
+
+
+func readDefaultStepFiles() ([]models.WorkflowStep, error) {
+	matches, err := filepath.Glob(filepath.Join(DefaultStepsDir(), "*.json"))
+	if err != nil {
+		return nil, err
+	}
+	out := []models.WorkflowStep{}
+	for _, path := range matches {
+		b, err := os.ReadFile(path)
+		if err != nil {
+			continue
+		}
+		s, err := ParseStepDoc(b)
+		if err != nil {
+			continue
+		}
+		s.Source = "default"
+		s.Slug = Slugify(s.Name)
+		if s.Slug == "" {
+			continue
+		}
+		out = append(out, s)
+	}
+	return out, nil
+}
+
+
+
+func SeedDefaultSteps(orgID string) (created, updated int, err error) {
+	steps, err := readDefaultStepFiles()
+	if err != nil {
+		return 0, 0, err
+	}
+	ctx, cancel := wfCtx()
+	defer cancel()
+	col := db.Col("workflow_steps")
+	for _, s := range steps {
+		filter := bson.M{"org_id": orgID, "slug": s.Slug, "source": "default"}
+		set := bson.M{
+			"name":             s.Name,
+			"description":      s.Description,
+			"interpreter":      s.Interpreter,
+			"script":           s.Script,
+			"declared_outputs": s.DeclaredOutputs,
+			"declared_inputs":  s.DeclaredInputs,
+			"secret_refs":      s.SecretRefs,
+			"updated_at":       time.Now(),
+		}
+		res, uerr := col.UpdateOne(ctx, filter, bson.M{
+			"$set": set,
+			"$setOnInsert": bson.M{
+				"org_id":     orgID,
+				"step_id":    uuid.New().String(),
+				"slug":       s.Slug,
+				"source":     "default",
+				"created_at": time.Now(),
+			},
+		}, options.UpdateOne().SetUpsert(true))
+		if uerr != nil {
+			return created, updated, uerr
+		}
+		if res.UpsertedCount > 0 {
+			created++
+		} else if res.ModifiedCount > 0 {
+			updated++
+		}
+	}
+	return created, updated, nil
+}

server/internal/services/dispatch.go

@@ -17,13 +17,13 @@ type commandDispatcher struct {
 	channels map[string]chan *pb.ServerCommand
 }
 
-// Dispatcher is the singleton command dispatcher used by both the gRPC server
-// and the REST API to push commands to connected agents.
+
+
 var Dispatcher = &commandDispatcher{
 	channels: make(map[string]chan *pb.ServerCommand),
 }
 
-// Connect registers an agent's command channel. Returns the channel to drain.
+
 func (d *commandDispatcher) Connect(serverID string) chan *pb.ServerCommand {
 	ch := make(chan *pb.ServerCommand, 16)
 	d.mu.Lock()
@@ -32,14 +32,14 @@ func (d *commandDispatcher) Connect(serverID string) chan *pb.ServerCommand {
 	return ch
 }
 
-// Disconnect removes the agent's channel on stream close.
+
 func (d *commandDispatcher) Disconnect(serverID string) {
 	d.mu.Lock()
 	delete(d.channels, serverID)
 	d.mu.Unlock()
 }
 
-// IsConnected reports whether an agent is currently holding a CommandStream.
+
 func (d *commandDispatcher) IsConnected(serverID string) bool {
 	d.mu.RLock()
 	_, ok := d.channels[serverID]
@@ -62,7 +62,26 @@ func (d *commandDispatcher) dispatch(serverID string, cmd *pb.ServerCommand) err
 	}
 }
 
-// KeyGenParams carries all options for a generate-key command.
+
+
+func DispatchRunStep(serverID, commandID string, cmd *pb.RunStepCmd) error {
+	return Dispatcher.dispatch(serverID, &pb.ServerCommand{CommandId: commandID, RunStep: cmd})
+}
+
+
+
+
+func DispatchCleanupWorkspace(serverID, workspaceID string) {
+	if !Dispatcher.IsConnected(serverID) {
+		return
+	}
+	_ = Dispatcher.dispatch(serverID, &pb.ServerCommand{
+		CommandId:        uuid.New().String(),
+		CleanupWorkspace: &pb.CleanupWorkspaceCmd{WorkspaceId: workspaceID},
+	})
+}
+
+
 type KeyGenParams struct {
 	Label      string
 	KeyType    string
@@ -71,15 +90,15 @@ type KeyGenParams struct {
 	Comment    string
 }
 
-// GetLatestAgentVersion queries the Gitea API for the latest agent/v* release tag
-// and returns just the version number (e.g. "1.2.3").
+
+
 func GetLatestAgentVersion() (string, error) {
 	giteaHost := os.Getenv("GITEA_HOST")
 	if giteaHost == "" {
 		giteaHost = "gitea.example.com"
 	}
 	url := fmt.Sprintf("https://%s/api/v1/repos/mrhid6/vantage/releases?limit=20", giteaHost)
-	resp, err := http.Get(url) //nolint:gosec
+	resp, err := http.Get(url) 
 	if err != nil {
 		return "", fmt.Errorf("fetch releases: %w", err)
 	}
@@ -103,8 +122,8 @@ func GetLatestAgentVersion() (string, error) {
 	return "", fmt.Errorf("no agent release found")
 }
 
-// DispatchUpdateAgent sends an update command to the named server's agent.
-// It fetches the latest version from Gitea and includes the download base URL.
+
+
 func DispatchUpdateAgent(serverID string) (string, error) {
 	if !Dispatcher.IsConnected(serverID) {
 		return "", fmt.Errorf("agent is not connected to the command stream")
@@ -134,7 +153,7 @@ func DispatchUpdateAgent(serverID string) (string, error) {
 	return version, nil
 }
 
-// DispatchApplyUpdates sends an apply-updates command to the named server's agent.
+
 func DispatchApplyUpdates(serverID string) error {
 	if !Dispatcher.IsConnected(serverID) {
 		return fmt.Errorf("agent is not connected to the command stream")
@@ -146,8 +165,8 @@ func DispatchApplyUpdates(serverID string) error {
 	return Dispatcher.dispatch(serverID, cmd)
 }
 
-// DispatchDeleteKey sends a delete-key command to the named server's agent.
-// It is best-effort: if the agent is offline the local files will remain until next connection.
+
+
 func DispatchDeleteKey(serverID, label string) {
 	if !Dispatcher.IsConnected(serverID) {
 		return
@@ -157,13 +176,13 @@ func DispatchDeleteKey(serverID, label string) {
 		DeleteKey: &pb.DeleteKeyCmd{Label: label},
 	}
 	if err := Dispatcher.dispatch(serverID, cmd); err != nil {
-		// Non-fatal: agent will clean up files on next manual intervention or reinstall.
+		
 		_ = err
 	}
 }
 
-// DispatchGenerateKey sends a generate-key command to the named server's agent.
-// Returns the command ID that can be used to correlate the agent's result.
+
+
 func DispatchGenerateKey(serverID string, p KeyGenParams) (string, error) {
 	if !Dispatcher.IsConnected(serverID) {
 		return "", fmt.Errorf("agent is not connected to the command stream")

server/internal/services/inventory.go

@@ -0,0 +1,52 @@
+package services
+
+import (
+	"context"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/grpc/pb"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+
+
+func StoreInventory(serverID string, r *pb.InventoryReport) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	now := time.Now()
+	set := bson.M{"inventory.metrics_at": now}
+	if r.CPU != nil {
+		set["inventory.cpu.usage_pct"] = r.CPU.UsagePct
+		set["inventory.cpu.load1"] = r.CPU.Load1
+	}
+	if r.Memory != nil {
+		set["inventory.memory.used_bytes"] = r.Memory.UsedBytes
+	}
+	set["inventory.swap_used_bytes"] = r.SwapUsed
+
+	if r.IncludeStatic {
+		set["inventory.static_at"] = now
+		set["inventory.swap_total_bytes"] = r.SwapTotal
+		set["inventory.kernel"] = r.Kernel
+		if r.CPU != nil {
+			set["inventory.cpu.model"] = r.CPU.Model
+			set["inventory.cpu.cores"] = r.CPU.Cores
+		}
+		if r.Memory != nil {
+			set["inventory.memory.total_bytes"] = r.Memory.TotalBytes
+		}
+		parts := make([]bson.M, 0, len(r.Partitions))
+		for _, p := range r.Partitions {
+			parts = append(parts, bson.M{
+				"device": p.Device, "mountpoint": p.Mountpoint, "fstype": p.Fstype,
+				"total_bytes": p.TotalBytes, "used_bytes": p.UsedBytes,
+			})
+		}
+		set["inventory.partitions"] = parts
+	}
+
+	_, err := db.Col("servers").UpdateOne(ctx, bson.M{"server_id": serverID}, bson.M{"$set": set})
+	return err
+}

server/internal/services/keys.go

@@ -36,8 +36,9 @@ func setKeyMeta(k *models.Key) {
 	k.HasPassphrase = k.PassphraseEncrypted != ""
 }
 
-func CreateKey(label, publicKey, source, generatedByServerID, privateKey, passphrase string) (*models.Key, error) {
+func CreateKey(orgID, label, publicKey, source, generatedByServerID, privateKey, passphrase string) (*models.Key, error) {
 	key := &models.Key{
+		OrgID:               orgID,
 		KeyID:               uuid.NewString(),
 		Label:               label,
 		PublicKey:           publicKey,
@@ -71,12 +72,12 @@ func CreateKey(label, publicKey, source, generatedByServerID, privateKey, passph
 	return key, nil
 }
 
-func GetKey(keyID string) (*models.Key, error) {
+func GetKey(orgID, keyID string) (*models.Key, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	var key models.Key
-	err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID}).Decode(&key)
+	err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID, "org_id": orgID}).Decode(&key)
 	if err != nil {
 		return nil, err
 	}
@@ -84,12 +85,12 @@ func GetKey(keyID string) (*models.Key, error) {
 	return &key, nil
 }
 
-func GetPrivateKey(keyID string) (string, error) {
+func GetPrivateKey(orgID, keyID string) (string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	var key models.Key
-	if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID}).Decode(&key); err != nil {
+	if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID, "org_id": orgID}).Decode(&key); err != nil {
 		return "", err
 	}
 	if key.PrivateKeyEncrypted == "" {
@@ -98,8 +99,6 @@ func GetPrivateKey(keyID string) (string, error) {
 	return decryptPrivateKey(key.PrivateKeyEncrypted)
 }
 
-// GetPassphrase returns the decrypted passphrase for a key, or an empty string
-// if the key has none stored.
 func GetPassphrase(keyID string) (string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
@@ -119,11 +118,11 @@ type KeyWithCount struct {
 	AssignedCount int `bson:"-" json:"assigned_count"`
 }
 
-func ListKeys() ([]KeyWithCount, error) {
+func ListKeys(orgID string) ([]KeyWithCount, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	cursor, err := db.Col("keys").Find(ctx, bson.M{})
+	cursor, err := db.Col("keys").Find(ctx, bson.M{"org_id": orgID})
 	if err != nil {
 		return nil, err
 	}
@@ -138,6 +137,7 @@ func ListKeys() ([]KeyWithCount, error) {
 	for _, k := range keys {
 		setKeyMeta(&k)
 		count, _ := db.Col("assignments").CountDocuments(ctx, bson.M{
+			"org_id":     orgID,
 			"key_id":     k.KeyID,
 			"revoked_at": nil,
 		})
@@ -146,19 +146,19 @@ func ListKeys() ([]KeyWithCount, error) {
 	return result, nil
 }
 
-func DeleteKey(keyID string) error {
+func DeleteKey(orgID, keyID string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	var key models.Key
-	if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID}).Decode(&key); err != nil {
+	if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID, "org_id": orgID}).Decode(&key); err != nil {
 		return err
 	}
 
-	if _, err := db.Col("keys").DeleteOne(ctx, bson.M{"key_id": keyID}); err != nil {
+	if _, err := db.Col("keys").DeleteOne(ctx, bson.M{"key_id": keyID, "org_id": orgID}); err != nil {
 		return err
 	}
-	if _, err := db.Col("assignments").DeleteMany(ctx, bson.M{"key_id": keyID}); err != nil {
+	if _, err := db.Col("assignments").DeleteMany(ctx, bson.M{"key_id": keyID, "org_id": orgID}); err != nil {
 		return err
 	}
 
@@ -168,13 +168,21 @@ func DeleteKey(keyID string) error {
 	return nil
 }
 
-func AssignKey(keyID, serverID string) (*models.Assignment, error) {
+func AssignKey(orgID, keyID, serverID string) (*models.Assignment, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	// Check if already assigned and active
+	if _, err := GetKey(orgID, keyID); err != nil {
+		return nil, fmt.Errorf("key not found")
+	}
+	if _, err := GetServer(orgID, serverID); err != nil {
+		return nil, fmt.Errorf("server not found")
+	}
+
+	
 	var existing models.Assignment
 	err := db.Col("assignments").FindOne(ctx, bson.M{
+		"org_id":     orgID,
 		"key_id":     keyID,
 		"server_id":  serverID,
 		"revoked_at": nil,
@@ -184,6 +192,7 @@ func AssignKey(keyID, serverID string) (*models.Assignment, error) {
 	}
 
 	a := &models.Assignment{
+		OrgID:      orgID,
 		KeyID:      keyID,
 		ServerID:   serverID,
 		AssignedAt: time.Now(),
@@ -195,23 +204,23 @@ func AssignKey(keyID, serverID string) (*models.Assignment, error) {
 	return a, nil
 }
 
-func RevokeAssignment(keyID, serverID string) error {
+func RevokeAssignment(orgID, keyID, serverID string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	now := time.Now()
 	_, err := db.Col("assignments").UpdateOne(ctx,
-		bson.M{"key_id": keyID, "server_id": serverID, "revoked_at": nil},
+		bson.M{"org_id": orgID, "key_id": keyID, "server_id": serverID, "revoked_at": nil},
 		bson.M{"$set": bson.M{"revoked_at": now}},
 	)
 	return err
 }
 
-func GetAssignmentsForKey(keyID string) ([]models.Assignment, error) {
+func GetAssignmentsForKey(orgID, keyID string) ([]models.Assignment, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	cursor, err := db.Col("assignments").Find(ctx, bson.M{"key_id": keyID, "revoked_at": nil})
+	cursor, err := db.Col("assignments").Find(ctx, bson.M{"org_id": orgID, "key_id": keyID, "revoked_at": nil})
 	if err != nil {
 		return nil, err
 	}
@@ -229,11 +238,11 @@ type AssignmentWithServer struct {
 	Server            *models.Server `json:"server,omitempty"`
 }
 
-func GetAssignmentsWithServers(keyID string) ([]AssignmentWithServer, error) {
+func GetAssignmentsWithServers(orgID, keyID string) ([]AssignmentWithServer, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	cursor, err := db.Col("assignments").Find(ctx, bson.M{"key_id": keyID})
+	cursor, err := db.Col("assignments").Find(ctx, bson.M{"org_id": orgID, "key_id": keyID})
 	if err != nil {
 		return nil, err
 	}
@@ -248,7 +257,7 @@ func GetAssignmentsWithServers(keyID string) ([]AssignmentWithServer, error) {
 	for _, a := range assignments {
 		item := AssignmentWithServer{Assignment: a}
 		var srv models.Server
-		if err := db.Col("servers").FindOne(ctx, bson.M{"server_id": a.ServerID}).Decode(&srv); err == nil {
+		if err := db.Col("servers").FindOne(ctx, bson.M{"server_id": a.ServerID, "org_id": orgID}).Decode(&srv); err == nil {
 			item.Server = &srv
 		}
 		result = append(result, item)
@@ -261,11 +270,11 @@ type AssignmentWithKey struct {
 	Key               *models.Key `json:"key,omitempty"`
 }
 
-func GetAssignmentsWithKeysForServer(serverID string) ([]AssignmentWithKey, error) {
+func GetAssignmentsWithKeysForServer(orgID, serverID string) ([]AssignmentWithKey, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	cursor, err := db.Col("assignments").Find(ctx, bson.M{"server_id": serverID})
+	cursor, err := db.Col("assignments").Find(ctx, bson.M{"org_id": orgID, "server_id": serverID})
 	if err != nil {
 		return nil, err
 	}
@@ -279,7 +288,7 @@ func GetAssignmentsWithKeysForServer(serverID string) ([]AssignmentWithKey, erro
 	result := make([]AssignmentWithKey, 0, len(assignments))
 	for _, a := range assignments {
 		var key models.Key
-		if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": a.KeyID}).Decode(&key); err != nil {
+		if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": a.KeyID, "org_id": orgID}).Decode(&key); err != nil {
 			continue
 		}
 		setKeyMeta(&key)

server/internal/services/migrate.go

@@ -0,0 +1,227 @@
+package services
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+var scopedCollections = []string{
+	"servers", "keys", "assignments", "secrets",
+	"workflows", "workflow_steps", "workflow_runs",
+	"audit_logs", "monitors", "notification_channels",
+	"console_sessions", "incidents", "monitor_rollups",
+}
+
+func EnsureAuthIndexes() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	if _, err := db.Col("users").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys:    bson.D{{Key: "email", Value: 1}},
+		Options: options.Index().SetUnique(true),
+	}); err != nil {
+		return err
+	}
+	if _, err := db.Col("orgs").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys:    bson.D{{Key: "slug", Value: 1}},
+		Options: options.Index().SetUnique(true),
+	}); err != nil {
+		return err
+	}
+	if _, err := db.Col("org_oidc").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys:    bson.D{{Key: "org_id", Value: 1}},
+		Options: options.Index().SetUnique(true),
+	}); err != nil {
+		return err
+	}
+	return nil
+}
+
+func defaultBackfillOrg(ctx context.Context) (*models.Org, error) {
+	var org models.Org
+	err := db.Col("orgs").FindOne(ctx, bson.M{"slug": "default"}).Decode(&org)
+	switch {
+	case err == nil:
+	case errors.Is(err, mongo.ErrNoDocuments):
+		org = models.Org{OrgID: uuid.NewString(), Name: "Default", Slug: "default", CreatedAt: time.Now()}
+		if _, err := db.Col("orgs").InsertOne(ctx, org); err != nil {
+			return nil, err
+		}
+	default:
+		return nil, err
+	}
+	return &org, nil
+}
+
+func RunMigrations() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	const marker = "0001_default_org_backfill"
+	if n, _ := db.Col("migrations").CountDocuments(ctx, bson.M{"_id": marker}); n > 0 {
+		return nil
+	}
+
+	
+	needs := false
+	for _, col := range scopedCollections {
+		n, _ := db.Col(col).CountDocuments(ctx, bson.M{"org_id": bson.M{"$exists": false}})
+		if n > 0 {
+			needs = true
+			break
+		}
+	}
+
+	if needs {
+		org, err := defaultBackfillOrg(ctx)
+		if err != nil {
+			return err
+		}
+		for _, col := range scopedCollections {
+			if _, err := db.Col(col).UpdateMany(ctx,
+				bson.M{"org_id": bson.M{"$exists": false}},
+				bson.M{"$set": bson.M{"org_id": org.OrgID}},
+			); err != nil {
+				return err
+			}
+		}
+	}
+
+	_, err := db.Col("migrations").InsertOne(ctx, bson.M{"_id": marker, "applied_at": time.Now()})
+	return err
+}
+
+func MigrateMissedOrgScopes() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	const marker = "0003_missed_org_scopes"
+	if n, _ := db.Col("migrations").CountDocuments(ctx, bson.M{"_id": marker}); n > 0 {
+		return nil
+	}
+
+	
+	missed := []string{"audit_logs", "notification_channels"}
+	needs := false
+	for _, col := range missed {
+		n, _ := db.Col(col).CountDocuments(ctx, bson.M{"org_id": bson.M{"$exists": false}})
+		if n > 0 {
+			needs = true
+			break
+		}
+	}
+	if needs {
+		org, err := defaultBackfillOrg(ctx)
+		if err != nil {
+			return err
+		}
+		for _, col := range missed {
+			if _, err := db.Col(col).UpdateMany(ctx,
+				bson.M{"org_id": bson.M{"$exists": false}},
+				bson.M{"$set": bson.M{"org_id": org.OrgID}},
+			); err != nil {
+				return err
+			}
+		}
+	}
+
+	if err := backfillOrgFromOwner(ctx, "console_sessions", "server_id", "servers", "server_id"); err != nil {
+		return err
+	}
+	if err := backfillOrgFromOwner(ctx, "incidents", "monitor_id", "monitors", "monitor_id"); err != nil {
+		return err
+	}
+	if err := backfillOrgFromOwner(ctx, "monitor_rollups", "monitor_id", "monitors", "monitor_id"); err != nil {
+		return err
+	}
+
+	_, err := db.Col("migrations").InsertOne(ctx, bson.M{"_id": marker, "applied_at": time.Now()})
+	return err
+}
+
+func backfillOrgFromOwner(ctx context.Context, col, localField, ownerCol, ownerField string) error {
+
+	var raw []bson.RawValue
+	if err := db.Col(col).Distinct(ctx, localField,
+		bson.M{"org_id": bson.M{"$exists": false}}).Decode(&raw); err != nil {
+		return err
+	}
+	for _, rv := range raw {
+		id, ok := rv.StringValueOK()
+		if !ok || id == "" {
+			continue
+		}
+		var owner struct {
+			OrgID string `bson:"org_id"`
+		}
+		if err := db.Col(ownerCol).FindOne(ctx, bson.M{ownerField: id}).Decode(&owner); err != nil {
+			continue
+		}
+		if owner.OrgID == "" {
+			continue
+		}
+		if _, err := db.Col(col).UpdateMany(ctx,
+			bson.M{localField: id, "org_id": bson.M{"$exists": false}},
+			bson.M{"$set": bson.M{"org_id": owner.OrgID}},
+		); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func MigrateSettingsOrg() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	const marker = "0002_settings_org_backfill"
+	if n, _ := db.Col("migrations").CountDocuments(ctx, bson.M{"_id": marker}); n > 0 {
+		return nil
+	}
+
+	n, _ := db.Col("settings").CountDocuments(ctx, bson.M{"org_id": bson.M{"$exists": false}})
+	if n > 0 {
+		var org models.Org
+		orgCount, err := db.Col("orgs").CountDocuments(ctx, bson.M{})
+		if err != nil {
+			return err
+		}
+		switch orgCount {
+		case 1:
+			if err := db.Col("orgs").FindOne(ctx, bson.M{}).Decode(&org); err != nil {
+				return err
+			}
+		case 0:
+			org = models.Org{OrgID: uuid.NewString(), Name: "Default", Slug: "default", CreatedAt: time.Now()}
+			if _, err := db.Col("orgs").InsertOne(ctx, org); err != nil {
+				return err
+			}
+		default:
+			return fmt.Errorf(
+				"settings org migration: %d settings document(s) have no org_id but %d orgs exist; "+
+					"cannot infer the owner. Set org_id manually on each settings document "+
+					"(db.settings.updateOne({_id:<id>},{$set:{org_id:\"<org uuid>\"}})), deleting any "+
+					"duplicates, then restart", n, orgCount)
+		}
+		if org.OrgID != "" {
+			if _, err := db.Col("settings").UpdateMany(ctx,
+				bson.M{"org_id": bson.M{"$exists": false}},
+				bson.M{"$set": bson.M{"org_id": org.OrgID}},
+			); err != nil {
+				return err
+			}
+		}
+	}
+
+	_, err := db.Col("migrations").InsertOne(ctx, bson.M{"_id": marker, "applied_at": time.Now()})
+	return err
+}

server/internal/services/monitors.go

@@ -0,0 +1,370 @@
+package services
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/checker"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/notify"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+func monCtx() (context.Context, context.CancelFunc) {
+	return context.WithTimeout(context.Background(), 5*time.Second)
+}
+
+
+func SpecFor(m *models.Monitor) checker.Spec {
+	return checker.Spec{
+		Type:           m.Type,
+		URL:            m.Target.URL,
+		Host:           m.Target.Host,
+		Port:           m.Target.Port,
+		Method:         m.Target.Method,
+		ExpectedStatus: m.Target.ExpectedStatus,
+		Keyword:        m.Target.Keyword,
+		TLSWarnDays:    m.Target.TLSWarnDays,
+		Insecure:       m.Target.Insecure,
+		TimeoutSec:     m.IntervalSec,
+	}
+}
+
+func ListMonitors(orgID string) ([]models.Monitor, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	cur, err := db.Col("monitors").Find(ctx, bson.M{"org_id": orgID}, options.Find().SetSort(bson.M{"created_at": 1}))
+	if err != nil {
+		return nil, err
+	}
+	var out []models.Monitor
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func ListMonitorsForRunner(orgID, runner string) ([]models.Monitor, error) {
+	if orgID == "" {
+		return nil, errors.New("org id required")
+	}
+	return listMonitorsForRunner(orgID, runner)
+}
+
+func ListServerScheduledMonitors() ([]models.Monitor, error) {
+	return listMonitorsForRunner("", models.RunnerServer)
+}
+
+func listMonitorsForRunner(orgID, runner string) ([]models.Monitor, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	filter := bson.M{"runner": runner, "enabled": true}
+	if orgID != "" {
+		filter["org_id"] = orgID
+	}
+	cur, err := db.Col("monitors").Find(ctx, filter)
+	if err != nil {
+		return nil, err
+	}
+	var out []models.Monitor
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+
+func GetMonitor(orgID, monitorID string) (*models.Monitor, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	var m models.Monitor
+	err := db.Col("monitors").FindOne(ctx, bson.M{"monitor_id": monitorID, "org_id": orgID}).Decode(&m)
+	if errors.Is(err, mongo.ErrNoDocuments) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &m, nil
+}
+
+func getMonitorByID(monitorID string) (*models.Monitor, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	var m models.Monitor
+	err := db.Col("monitors").FindOne(ctx, bson.M{"monitor_id": monitorID}).Decode(&m)
+	if errors.Is(err, mongo.ErrNoDocuments) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &m, nil
+}
+
+func validateRunner(orgID, runner string) error {
+	if runner == "" || runner == models.RunnerServer {
+		return nil
+	}
+	if _, err := GetServer(orgID, runner); err != nil {
+		return fmt.Errorf("runner server %s not found", runner)
+	}
+	return nil
+}
+
+func CreateMonitor(orgID string, m *models.Monitor) (*models.Monitor, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	if err := validateChannelIDs(orgID, m.ChannelIDs); err != nil {
+		return nil, err
+	}
+	if err := validateRunner(orgID, m.Runner); err != nil {
+		return nil, err
+	}
+	m.OrgID = orgID
+	m.MonitorID = uuid.NewString()
+	m.CreatedAt = time.Now()
+	if m.IntervalSec <= 0 {
+		m.IntervalSec = 60
+	}
+	if m.Retries <= 0 {
+		m.Retries = 1
+	}
+	if m.Runner == "" {
+		m.Runner = models.RunnerServer
+	}
+	m.State = models.MonitorState{Status: models.StatusPending}
+	if _, err := db.Col("monitors").InsertOne(ctx, m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func UpdateMonitor(orgID, monitorID string, upd bson.M) error {
+	ctx, cancel := monCtx()
+	defer cancel()
+	
+	
+	if raw, present := upd["channel_ids"]; present {
+		ids, ok := raw.([]string)
+		if !ok {
+			return fmt.Errorf("channel_ids must be a string array")
+		}
+		if err := validateChannelIDs(orgID, ids); err != nil {
+			return err
+		}
+	}
+	if raw, present := upd["runner"]; present {
+		runner, ok := raw.(string)
+		if !ok {
+			return fmt.Errorf("runner must be a string")
+		}
+		if err := validateRunner(orgID, runner); err != nil {
+			return err
+		}
+		
+		
+		
+		if runner == "" {
+			upd["runner"] = models.RunnerServer
+		}
+	}
+	_, err := db.Col("monitors").UpdateOne(ctx, bson.M{"monitor_id": monitorID, "org_id": orgID}, bson.M{"$set": upd})
+	return err
+}
+
+func DeleteMonitor(orgID, monitorID string) error {
+	ctx, cancel := monCtx()
+	defer cancel()
+	res, err := db.Col("monitors").DeleteOne(ctx, bson.M{"monitor_id": monitorID, "org_id": orgID})
+	if err != nil {
+		return err
+	}
+	
+	if res.DeletedCount == 0 {
+		return nil
+	}
+	db.Col("incidents").DeleteMany(ctx, bson.M{"monitor_id": monitorID, "org_id": orgID})
+	db.Col("monitor_rollups").DeleteMany(ctx, bson.M{"monitor_id": monitorID, "org_id": orgID})
+	return nil
+}
+
+func ListIncidents(orgID, monitorID string, limit int64) ([]models.Incident, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	if limit <= 0 {
+		limit = 50
+	}
+	cur, err := db.Col("incidents").Find(ctx, bson.M{"monitor_id": monitorID, "org_id": orgID},
+		options.Find().SetSort(bson.M{"started_at": -1}).SetLimit(limit))
+	if err != nil {
+		return nil, err
+	}
+	var out []models.Incident
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+
+func UptimeRollups(orgID, monitorID string, since time.Time) ([]models.Rollup, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	cur, err := db.Col("monitor_rollups").Find(ctx,
+		bson.M{"monitor_id": monitorID, "org_id": orgID, "period_start": bson.M{"$gte": since}},
+		options.Find().SetSort(bson.M{"period_start": 1}))
+	if err != nil {
+		return nil, err
+	}
+	var out []models.Rollup
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func IngestResult(orgID, runner, monitorID string, res checker.Result) error {
+	if orgID == "" {
+		return errors.New("org id required")
+	}
+	return ingestResult(orgID, runner, monitorID, res)
+}
+
+func IngestServerScheduledResult(monitorID string, res checker.Result) error {
+	return ingestResult("", models.RunnerServer, monitorID, res)
+}
+
+func ingestResult(orgID, runner, monitorID string, res checker.Result) error {
+	ctx, cancel := monCtx()
+	defer cancel()
+
+	m, err := getMonitorByID(monitorID)
+	if err != nil {
+		return err
+	}
+	if m == nil {
+		return fmt.Errorf("monitor %s not found", monitorID)
+	}
+	if orgID != "" && m.OrgID != orgID {
+		return fmt.Errorf("monitor %s belongs to another org", monitorID)
+	}
+	if m.Runner != runner {
+		return fmt.Errorf("monitor %s is not run by %s", monitorID, runner)
+	}
+
+	now := time.Now()
+	prev := m.State.Status
+	retries := m.Retries
+	if retries < 1 {
+		retries = 1
+	}
+
+	newStatus := prev
+	fails := m.State.Fails
+	if res.Up {
+		fails = 0
+		newStatus = models.StatusUp
+	} else {
+		fails++
+		if fails >= retries {
+			newStatus = models.StatusDown
+		} else if prev == "" || prev == models.StatusPending {
+			newStatus = models.StatusPending
+		}
+	}
+
+	state := bson.M{
+		"state.status":        newStatus,
+		"state.last_check_at": now,
+		"state.latency_ms":    res.LatencyMs,
+		"state.message":       res.Message,
+		"state.fails":         fails,
+	}
+	if res.CertExpiry != nil {
+		state["state.cert_expiry_at"] = *res.CertExpiry
+	}
+	if _, err := db.Col("monitors").UpdateOne(ctx, bson.M{"monitor_id": monitorID}, bson.M{"$set": state}); err != nil {
+		return err
+	}
+
+	
+	bucket := now.Truncate(time.Hour)
+	up := 0
+	if res.Up {
+		up = 1
+	}
+	
+	
+	db.Col("monitor_rollups").UpdateOne(ctx,
+		bson.M{"monitor_id": monitorID, "period_start": bucket},
+		bson.M{
+			"$inc":         bson.M{"checks": 1, "up_count": up, "sum_latency": int64(res.LatencyMs)},
+			"$setOnInsert": bson.M{"org_id": m.OrgID},
+		},
+		options.UpdateOne().SetUpsert(true))
+
+	
+	if newStatus != prev {
+		switch newStatus {
+		case models.StatusDown:
+			inc := models.Incident{
+				OrgID:      m.OrgID,
+				IncidentID: uuid.NewString(),
+				MonitorID:  monitorID,
+				StartedAt:  now,
+				Cause:      res.Message,
+			}
+			db.Col("incidents").InsertOne(ctx, inc)
+			notifyTransition(m, newStatus, res.Message)
+		case models.StatusUp:
+			if prev == models.StatusDown {
+				db.Col("incidents").UpdateOne(ctx,
+					bson.M{"monitor_id": monitorID, "org_id": m.OrgID, "resolved_at": nil},
+					bson.M{"$set": bson.M{"resolved_at": now}})
+				notifyTransition(m, newStatus, res.Message)
+			}
+		}
+	}
+	return nil
+}
+
+
+
+
+func notifyTransition(m *models.Monitor, newStatus, message string) {
+	if len(m.ChannelIDs) == 0 {
+		return
+	}
+	channels, err := GetChannels(m.OrgID, m.ChannelIDs)
+	if err != nil {
+		log.Printf("notify: load channels for %s: %v", m.MonitorID, err)
+		return
+	}
+	ev := notify.Event{
+		MonitorName: m.Name,
+		Type:        m.Type,
+		OldStatus:   m.State.Status,
+		NewStatus:   newStatus,
+		Message:     message,
+		Time:        time.Now(),
+	}
+	for _, ch := range channels {
+		if !ch.Enabled {
+			continue
+		}
+		go func(c models.NotificationChannel) {
+			if err := notify.Dispatch(c, ev); err != nil {
+				log.Printf("notify: dispatch to %s (%s): %v", c.Name, c.Type, err)
+			}
+		}(ch)
+	}
+	_ = UpdateMonitor(m.OrgID, m.MonitorID, bson.M{"state.last_notified_at": time.Now()})
+}

server/internal/services/org_oidc.go

@@ -0,0 +1,52 @@
+package services
+
+import (
+	"context"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+func GetOrgOIDC(orgID string) (*models.OrgOIDC, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var o models.OrgOIDC
+	err := db.Col("org_oidc").FindOne(ctx, bson.M{"org_id": orgID}).Decode(&o)
+	if err != nil {
+		return nil, err
+	}
+	return &o, nil
+}
+
+func GetOrgOIDCSecret(orgID string) (string, error) {
+	o, err := GetOrgOIDC(orgID)
+	if err != nil {
+		return "", err
+	}
+	return decryptString(o.ClientSecretEnc)
+}
+
+
+
+func SaveOrgOIDC(orgID, issuer, clientID, clientSecret string, enabled bool) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	set := bson.M{
+		"org_id": orgID, "issuer": issuer, "client_id": clientID,
+		"enabled": enabled, "updated_at": time.Now(),
+	}
+	if clientSecret != "" {
+		enc, err := encryptString(clientSecret)
+		if err != nil {
+			return err
+		}
+		set["client_secret_enc"] = enc
+	}
+	_, err := db.Col("org_oidc").UpdateOne(ctx,
+		bson.M{"org_id": orgID}, bson.M{"$set": set},
+		options.UpdateOne().SetUpsert(true))
+	return err
+}

server/internal/services/orgs.go

@@ -0,0 +1,157 @@
+package services
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+)
+
+var reservedSlugs = map[string]bool{
+	"www": true, "api": true, "app": true, "admin": true, "auth": true,
+	"install": true, "static": true, "_next": true, "default": true,
+}
+
+func GetOrg(orgID string) (*models.Org, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var o models.Org
+	err := db.Col("orgs").FindOne(ctx, bson.M{"org_id": orgID}).Decode(&o)
+	if err != nil {
+		return nil, err
+	}
+	return &o, nil
+}
+
+func GetOrgBySlug(slug string) (*models.Org, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var o models.Org
+	err := db.Col("orgs").FindOne(ctx, bson.M{"slug": slug}).Decode(&o)
+	if err != nil {
+		return nil, err
+	}
+	return &o, nil
+}
+
+
+
+func ListOrgIDs() ([]string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	cursor, err := db.Col("orgs").Find(ctx, bson.M{})
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close(ctx)
+	var orgs []models.Org
+	if err := cursor.All(ctx, &orgs); err != nil {
+		return nil, err
+	}
+	ids := make([]string, 0, len(orgs))
+	for _, o := range orgs {
+		ids = append(ids, o.OrgID)
+	}
+	return ids, nil
+}
+
+
+
+
+func CountOrgs() (int64, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	return db.Col("orgs").CountDocuments(ctx, bson.M{})
+}
+
+func FirstOrg() (*models.Org, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var o models.Org
+	if err := db.Col("orgs").FindOne(ctx, bson.M{}).Decode(&o); err != nil {
+		return nil, err
+	}
+	return &o, nil
+}
+
+func AdoptOrg(orgID, name string) (*models.Org, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	set := bson.M{"name": name}
+
+	slug := Slugify(name)
+	if len(slug) > 40 {
+		slug = slug[:40]
+	}
+	if len(slug) >= 3 && !reservedSlugs[slug] {
+		n, err := db.Col("orgs").CountDocuments(ctx, bson.M{"slug": slug, "org_id": bson.M{"$ne": orgID}})
+		if err != nil {
+			return nil, err
+		}
+		if n == 0 {
+			set["slug"] = slug
+		}
+	}
+
+	if _, err := db.Col("orgs").UpdateOne(ctx, bson.M{"org_id": orgID}, bson.M{"$set": set}); err != nil {
+		if mongo.IsDuplicateKeyError(err) {
+			return nil, fmt.Errorf("organization slug already taken")
+		}
+		return nil, err
+	}
+	return GetOrg(orgID)
+}
+
+func CreateOrg(name string) (*models.Org, error) {
+	base := Slugify(name)
+	if len(base) < 3 {
+		return nil, fmt.Errorf("organization name too short (slug must be >= 3 chars)")
+	}
+	if len(base) > 40 {
+		base = base[:40]
+	}
+	if reservedSlugs[base] {
+		return nil, fmt.Errorf("organization name is reserved")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	
+	slug := base
+	for i := 2; ; i++ {
+		n, err := db.Col("orgs").CountDocuments(ctx, bson.M{"slug": slug})
+		if err != nil {
+			return nil, err
+		}
+		if n == 0 {
+			break
+		}
+		slug = fmt.Sprintf("%s-%d", base, i)
+	}
+
+	o := &models.Org{OrgID: uuid.NewString(), Name: name, Slug: slug, CreatedAt: time.Now()}
+	if _, err := db.Col("orgs").InsertOne(ctx, o); err != nil {
+		if mongo.IsDuplicateKeyError(err) {
+			return nil, fmt.Errorf("organization slug already taken")
+		}
+		return nil, err
+	}
+
+	
+	
+	
+	if created, updated, err := SeedDefaultSteps(o.OrgID); err != nil {
+		log.Printf("warning: failed to seed default steps for new org %s: %v", o.OrgID, err)
+	} else {
+		log.Printf("default steps seeded for new org %s: %d created, %d updated", o.OrgID, created, updated)
+	}
+	return o, nil
+}

server/internal/services/secrets.go

@@ -2,6 +2,7 @@ package services
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"sort"
 	"time"
@@ -13,25 +14,36 @@ import (
 	"go.mongodb.org/mongo-driver/v2/mongo/options"
 )
 
-// EnsureSecretIndexes creates the unique compound index on (group, key).
 func EnsureSecretIndexes() error {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
+	if err := db.Col("secrets").Indexes().DropOne(ctx, "group_1_key_1"); err != nil && !isIndexNotFound(err) {
+		return err
+	}
+
 	_, err := db.Col("secrets").Indexes().CreateOne(ctx, mongo.IndexModel{
-		Keys:    bson.D{{Key: "group", Value: 1}, {Key: "key", Value: 1}},
+		Keys:    bson.D{{Key: "org_id", Value: 1}, {Key: "group", Value: 1}, {Key: "key", Value: 1}},
 		Options: options.Index().SetUnique(true),
 	})
 	return err
 }
 
-// ListSecretGroups returns a summary of every group with its key count and
-// most recent update time.
-func ListSecretGroups() ([]models.GroupSummary, error) {
+func isIndexNotFound(err error) bool {
+	var ce mongo.CommandError
+	if errors.As(err, &ce) {
+		return ce.Code == 27 || ce.Name == "IndexNotFound" ||
+			ce.Code == 26 || ce.Name == "NamespaceNotFound"
+	}
+	return false
+}
+
+func ListSecretGroups(orgID string) ([]models.GroupSummary, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	pipeline := mongo.Pipeline{
+		{{Key: "$match", Value: bson.D{{Key: "org_id", Value: orgID}}}},
 		{{Key: "$group", Value: bson.D{
 			{Key: "_id", Value: "$group"},
 			{Key: "key_count", Value: bson.D{{Key: "$sum", Value: 1}}},
@@ -66,13 +78,11 @@ func ListSecretGroups() ([]models.GroupSummary, error) {
 	return groups, nil
 }
 
-// GetSecretGroup returns the keys within a group, sorted by key name, without
-// decrypted values.
-func GetSecretGroup(group string) ([]models.Secret, error) {
+func GetSecretGroup(orgID, group string) ([]models.Secret, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	cursor, err := db.Col("secrets").Find(ctx, bson.M{"group": group},
+	cursor, err := db.Col("secrets").Find(ctx, bson.M{"org_id": orgID, "group": group},
 		options.Find().SetSort(bson.D{{Key: "key", Value: 1}}))
 	if err != nil {
 		return nil, err
@@ -86,10 +96,8 @@ func GetSecretGroup(group string) ([]models.Secret, error) {
 	return docs, nil
 }
 
-// GetSecretGroupDecrypted returns a flat map of key → plaintext value for a
-// group. Used by the ESO read endpoint.
-func GetSecretGroupDecrypted(group string) (map[string]string, error) {
-	docs, err := GetSecretGroup(group)
+func GetSecretGroupDecrypted(orgID, group string) (map[string]string, error) {
+	docs, err := GetSecretGroup(orgID, group)
 	if err != nil {
 		return nil, err
 	}
@@ -104,13 +112,12 @@ func GetSecretGroupDecrypted(group string) (map[string]string, error) {
 	return result, nil
 }
 
-// RevealSecret returns the decrypted value of a single key.
-func RevealSecret(group, key string) (string, error) {
+func RevealSecret(orgID, group, key string) (string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	var doc models.Secret
-	err := db.Col("secrets").FindOne(ctx, bson.M{"group": group, "key": key}).Decode(&doc)
+	err := db.Col("secrets").FindOne(ctx, bson.M{"org_id": orgID, "group": group, "key": key}).Decode(&doc)
 	if err == mongo.ErrNoDocuments {
 		return "", fmt.Errorf("secret not found")
 	}
@@ -120,8 +127,7 @@ func RevealSecret(group, key string) (string, error) {
 	return decryptString(doc.EncryptedValue)
 }
 
-// UpsertSecrets encrypts and writes each key/value pair into the group.
-func UpsertSecrets(group string, values map[string]string) error {
+func UpsertSecrets(orgID, group string, values map[string]string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
@@ -131,8 +137,9 @@ func UpsertSecrets(group string, values map[string]string) error {
 			return fmt.Errorf("encrypt %s: %w", key, err)
 		}
 		_, err = db.Col("secrets").UpdateOne(ctx,
-			bson.M{"group": group, "key": key},
+			bson.M{"org_id": orgID, "group": group, "key": key},
 			bson.M{"$set": bson.M{
+				"org_id":          orgID,
 				"encrypted_value": encrypted,
 				"updated_at":      time.Now(),
 			}},
@@ -145,7 +152,7 @@ func UpsertSecrets(group string, values map[string]string) error {
 	return nil
 }
 
-// SortedKeys returns the map keys sorted — handy for stable audit messages.
+
 func SortedKeys(m map[string]string) []string {
 	keys := make([]string, 0, len(m))
 	for k := range m {
@@ -155,20 +162,20 @@ func SortedKeys(m map[string]string) []string {
 	return keys
 }
 
-// DeleteSecret removes a single key from a group.
-func DeleteSecret(group, key string) error {
+
+func DeleteSecret(orgID, group, key string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	_, err := db.Col("secrets").DeleteOne(ctx, bson.M{"group": group, "key": key})
+	_, err := db.Col("secrets").DeleteOne(ctx, bson.M{"org_id": orgID, "group": group, "key": key})
 	return err
 }
 
-// DeleteSecretGroup removes an entire group and all its keys.
-func DeleteSecretGroup(group string) error {
+
+func DeleteSecretGroup(orgID, group string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	_, err := db.Col("secrets").DeleteMany(ctx, bson.M{"group": group})
+	_, err := db.Col("secrets").DeleteMany(ctx, bson.M{"org_id": orgID, "group": group})
 	return err
 }

server/internal/services/servers.go

@@ -6,6 +6,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"fmt"
+	"log"
 	"strings"
 	"time"
 
@@ -29,13 +30,14 @@ func HashToken(token string) string {
 	return hex.EncodeToString(sum[:])
 }
 
-func CreateServer() (*models.Server, string, error) {
+func CreateServer(orgID string) (*models.Server, string, error) {
 	token, err := generateToken(32)
 	if err != nil {
 		return nil, "", err
 	}
 	expires := time.Now().Add(time.Hour)
 	s := &models.Server{
+		OrgID:         orgID,
 		ServerID:      uuid.NewString(),
 		PreRegToken:   token,
 		PreRegExpires: &expires,
@@ -52,7 +54,22 @@ func CreateServer() (*models.Server, string, error) {
 	return s, token, nil
 }
 
-func GetServer(serverID string) (*models.Server, error) {
+
+func GetServer(orgID, serverID string) (*models.Server, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var s models.Server
+	err := db.Col("servers").FindOne(ctx, bson.M{"server_id": serverID, "org_id": orgID}).Decode(&s)
+	if err != nil {
+		return nil, err
+	}
+	return &s, nil
+}
+
+
+
+func getServerByID(serverID string) (*models.Server, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
@@ -79,9 +96,9 @@ func GetServerByPreRegToken(token string) (*models.Server, error) {
 	return &s, nil
 }
 
-// OSTypeFromInfo derives a coarse os_type ("windows" or "linux") from the
-// agent-reported os_info string, which is formatted "<GOOS> <GOARCH>".
-// Anything that is not explicitly windows defaults to linux.
+
+
+
 func OSTypeFromInfo(osInfo string) string {
 	if strings.HasPrefix(strings.ToLower(osInfo), "windows") {
 		return "windows"
@@ -89,8 +106,8 @@ func OSTypeFromInfo(osInfo string) string {
 	return "linux"
 }
 
-// defaultConsoleFields returns the initial console configuration for a newly
-// registered server based on its os_type.
+
+
 func defaultConsoleFields(osType string) (protocols []string, sshPort, rdpPort int) {
 	if osType == "windows" {
 		return []string{"rdp"}, 22, 3389
@@ -164,14 +181,19 @@ func ValidateAgentToken(serverID, agentToken string) (*models.Server, error) {
 	if err != nil {
 		return nil, fmt.Errorf("invalid agent token")
 	}
+	
+	
+	if s.OrgID == "" {
+		return nil, fmt.Errorf("server %s has no org", serverID)
+	}
 	return &s, nil
 }
 
-// BackfillConsoleConfig sets default console_protocols/ports for a server that
-// predates the console feature (or was updated without re-registering). Servers
-// register only once via a single-use pre_reg_token, so Register() never runs
-// again to populate these fields — this runs on every sync as a cheap no-op
-// once the fields are present.
+
+
+
+
+
 func BackfillConsoleConfig(srv *models.Server) error {
 	if srv == nil || len(srv.ConsoleProtocols) > 0 {
 		return nil
@@ -214,12 +236,12 @@ func UpdateServerLastSeen(serverID, agentVersion string) error {
 	return err
 }
 
-func ListServers() ([]models.Server, error) {
+func ListServers(orgID string) ([]models.Server, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	opts := options.Find().SetSort(bson.D{{Key: "created_at", Value: -1}})
-	cursor, err := db.Col("servers").Find(ctx, bson.M{}, opts)
+	cursor, err := db.Col("servers").Find(ctx, bson.M{"org_id": orgID}, opts)
 	if err != nil {
 		return nil, err
 	}
@@ -232,16 +254,16 @@ func ListServers() ([]models.Server, error) {
 	return servers, nil
 }
 
-func DeleteServer(serverID string) error {
+func DeleteServer(orgID, serverID string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	_, err := db.Col("servers").DeleteOne(ctx, bson.M{"server_id": serverID})
+	_, err := db.Col("servers").DeleteOne(ctx, bson.M{"server_id": serverID, "org_id": orgID})
 	if err != nil {
 		return err
 	}
-	// Also remove assignments
-	_, err = db.Col("assignments").DeleteMany(ctx, bson.M{"server_id": serverID})
+	
+	_, err = db.Col("assignments").DeleteMany(ctx, bson.M{"server_id": serverID, "org_id": orgID})
 	return err
 }
 
@@ -261,39 +283,73 @@ func StoreAvailableUpdates(serverID string, pkgs []models.PackageUpdate) error {
 }
 
 func MarkOfflineServers() error {
-	settings, _ := GetSettings()
-	thresholdMinutes := 5
-	if settings != nil && settings.Alerts.OfflineThresholdMinutes > 0 {
-		thresholdMinutes = settings.Alerts.OfflineThresholdMinutes
-	}
-	threshold := time.Duration(thresholdMinutes) * time.Minute
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	cutoff := time.Now().Add(-threshold)
-
-	// Find servers about to transition to offline so we can alert on them.
-	cursor, err := db.Col("servers").Find(ctx, bson.M{
-		"status":    "active",
-		"last_seen": bson.M{"$lt": cutoff},
-	})
+	orgIDs, err := ListOrgIDs()
 	if err != nil {
 		return err
 	}
-	defer cursor.Close(ctx)
 
-	var goingOffline []models.Server
-	if err := cursor.All(ctx, &goingOffline); err != nil {
-		return err
+	
+	
+	
+	
+	for _, orgID := range orgIDs {
+		if err := markOfflineForFilter(bson.M{"org_id": orgID}, orgID); err != nil {
+			log.Printf("offline sweep failed for org %s: %v", orgID, err)
+		}
 	}
 
+	
+	
+	
+	
+	if err := markOfflineForFilter(bson.M{"org_id": bson.M{"$nin": orgIDs}}, ""); err != nil {
+		log.Printf("offline sweep failed for orphaned servers: %v", err)
+	}
+	return nil
+}
+
+
+
+
+func markOfflineForFilter(scope bson.M, orgID string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	var settings *models.Settings
+	thresholdMinutes := 5
+	if orgID != "" {
+		settings, _ = GetSettings(orgID)
+		if settings != nil && settings.Alerts.OfflineThresholdMinutes > 0 {
+			thresholdMinutes = settings.Alerts.OfflineThresholdMinutes
+		}
+	}
+	cutoff := time.Now().Add(-time.Duration(thresholdMinutes) * time.Minute)
+
+	filter := bson.M{
+		"status":    "active",
+		"last_seen": bson.M{"$lt": cutoff},
+	}
+	for k, v := range scope {
+		filter[k] = v
+	}
+
+	
+	cursor, err := db.Col("servers").Find(ctx, filter)
+	if err != nil {
+		return err
+	}
+	var goingOffline []models.Server
+	err = cursor.All(ctx, &goingOffline)
+	cursor.Close(ctx)
+	if err != nil {
+		return err
+	}
 	if len(goingOffline) == 0 {
 		return nil
 	}
 
 	for _, s := range goingOffline {
-		LogEvent("server.offline", "system", s.ServerID, "", fmt.Sprintf("%s (%s) went offline", s.Hostname, s.IPAddress))
+		LogEvent(s.OrgID, "server.offline", "system", s.ServerID, "", fmt.Sprintf("%s (%s) went offline", s.Hostname, s.IPAddress))
 		if settings != nil && settings.Alerts.Enabled && settings.Alerts.WebhookURL != "" {
 			go SendOfflineWebhook(settings.Alerts.WebhookURL, s.Hostname, s.ServerID, s.IPAddress)
 		}
@@ -302,11 +358,7 @@ func MarkOfflineServers() error {
 		}
 	}
 
-	_, err = db.Col("servers").UpdateMany(ctx,
-		bson.M{
-			"status":    "active",
-			"last_seen": bson.M{"$lt": cutoff},
-		},
+	_, err = db.Col("servers").UpdateMany(ctx, filter,
 		bson.M{"$set": bson.M{"status": "offline"}},
 	)
 	return err

server/internal/services/servers_console_test.go

@@ -1,18 +0,0 @@
-package services
-
-import "testing"
-
-func TestOSTypeFromInfo(t *testing.T) {
-	cases := map[string]string{
-		"windows amd64": "windows",
-		"linux amd64":   "linux",
-		"linux arm64":   "linux",
-		"":              "linux",
-		"darwin arm64":  "linux",
-	}
-	for in, want := range cases {
-		if got := OSTypeFromInfo(in); got != want {
-			t.Errorf("OSTypeFromInfo(%q) = %q, want %q", in, got, want)
-		}
-	}
-}

server/internal/services/settings.go

@@ -34,14 +34,47 @@ var defaultSettings = models.Settings{
 	},
 }
 
-func GetSettings() (*models.Settings, error) {
+
+
+
+func EnsureSettingsIndexes() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	if err := db.Col("settings").Indexes().DropOne(ctx, "secrets.read_token_hash_1"); err != nil && !isIndexNotFound(err) {
+		return err
+	}
+
+	if _, err := db.Col("settings").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys:    bson.D{{Key: "org_id", Value: 1}},
+		Options: options.Index().SetUnique(true),
+	}); err != nil {
+		return err
+	}
+
+	
+	
+	
+	
+	_, err := db.Col("settings").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys: bson.D{{Key: "secrets.read_token_hash", Value: 1}},
+		Options: options.Index().SetUnique(true).SetName("settings_read_token_hash_unique").
+			SetPartialFilterExpression(bson.M{
+				"secrets.read_token_hash": bson.M{"$type": "string", "$gt": ""},
+			}),
+	})
+	return err
+}
+
+func GetSettings(orgID string) (*models.Settings, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	var s models.Settings
-	err := db.Col("settings").FindOne(ctx, bson.M{}).Decode(&s)
+	err := db.Col("settings").FindOne(ctx, bson.M{"org_id": orgID}).Decode(&s)
 	if err == mongo.ErrNoDocuments {
 		cp := defaultSettings
+		cp.OrgID = orgID
 		return &cp, nil
 	}
 	if err != nil {
@@ -56,9 +89,9 @@ func hashToken(token string) string {
 	return hex.EncodeToString(sum[:])
 }
 
-// RotateSecretsReadToken generates a new ESO read token, stores its SHA-256
-// hash, and returns the plaintext token exactly once.
-func RotateSecretsReadToken() (string, error) {
+
+
+func RotateSecretsReadToken(orgID string) (string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
@@ -69,11 +102,14 @@ func RotateSecretsReadToken() (string, error) {
 	token := hex.EncodeToString(raw)
 
 	_, err := db.Col("settings").UpdateOne(ctx,
-		bson.M{},
-		bson.M{"$set": bson.M{
-			"secrets.read_token_hash": hashToken(token),
-			"secrets.rotated_at":      time.Now(),
-		}},
+		bson.M{"org_id": orgID},
+		bson.M{
+			"$set": bson.M{
+				"secrets.read_token_hash": hashToken(token),
+				"secrets.rotated_at":      time.Now(),
+			},
+			"$setOnInsert": bson.M{"org_id": orgID},
+		},
 		options.UpdateOne().SetUpsert(true),
 	)
 	if err != nil {
@@ -82,25 +118,33 @@ func RotateSecretsReadToken() (string, error) {
 	return token, nil
 }
 
-// VerifySecretsReadToken reports whether the supplied token matches the stored
-// hash, using a constant-time comparison.
-func VerifySecretsReadToken(token string) bool {
+
+
+
+func ResolveSecretsReadToken(token string) (string, bool) {
 	if token == "" {
-		return false
+		return "", false
 	}
-	s, err := GetSettings()
-	if err != nil || s.Secrets.ReadTokenHash == "" {
-		return false
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var s models.Settings
+	err := db.Col("settings").FindOne(ctx, bson.M{"secrets.read_token_hash": hashToken(token)}).Decode(&s)
+	if err != nil || s.Secrets.ReadTokenHash == "" || s.OrgID == "" {
+		return "", false
 	}
 	expected, err := hex.DecodeString(s.Secrets.ReadTokenHash)
 	if err != nil {
-		return false
+		return "", false
 	}
 	got := sha256.Sum256([]byte(token))
-	return subtle.ConstantTimeCompare(expected, got[:]) == 1
+	if subtle.ConstantTimeCompare(expected, got[:]) != 1 {
+		return "", false
+	}
+	return s.OrgID, true
 }
 
-func SaveSettings(alerts models.AlertSettings, email models.EmailSettings) error {
+func SaveSettings(orgID string, alerts models.AlertSettings, email models.EmailSettings, retentionDays *int) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
@@ -111,14 +155,31 @@ func SaveSettings(alerts models.AlertSettings, email models.EmailSettings) error
 		email.SMTPPort = 587
 	}
 
+	set := bson.M{"alerts": alerts, "email": email}
+	if retentionDays != nil {
+		set["workflow_log_retention_days"] = *retentionDays
+	}
 	_, err := db.Col("settings").UpdateOne(ctx,
-		bson.M{},
-		bson.M{"$set": bson.M{"alerts": alerts, "email": email}},
+		bson.M{"org_id": orgID},
+		bson.M{"$set": set, "$setOnInsert": bson.M{"org_id": orgID}},
 		options.UpdateOne().SetUpsert(true),
 	)
 	return err
 }
 
+
+
+func GetWorkflowLogRetentionDays(orgID string) (int, error) {
+	s, err := GetSettings(orgID)
+	if err != nil {
+		return 30, err
+	}
+	if s.WorkflowLogRetentionDays == nil {
+		return 30, nil
+	}
+	return *s.WorkflowLogRetentionDays, nil
+}
+
 func SendOfflineWebhook(webhookURL, hostname, serverID, ipAddress string) {
 	payload := map[string]any{
 		"event":      "server.offline",
@@ -180,7 +241,7 @@ func SendOfflineEmail(cfg models.EmailSettings, hostname, serverID, ipAddress st
 	}
 }
 
-// sendMailTLS dials with implicit TLS (port 465) instead of STARTTLS.
+
 func sendMailTLS(addr, host string, auth smtp.Auth, from string, to []string, msg []byte) error {
 	conn, err := tls.Dial("tcp", addr, &tls.Config{ServerName: host})
 	if err != nil {

server/internal/services/stepio.go

@@ -0,0 +1,86 @@
+package services
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+const StepDocKind = "vantage.step/v1"
+
+
+type StepDoc struct {
+	Kind            string              `json:"kind"`
+	Name            string              `json:"name"`
+	Description     string              `json:"description"`
+	Interpreter     string              `json:"interpreter"`
+	Script          string              `json:"script"`
+	DeclaredOutputs []string            `json:"declared_outputs"`
+	DeclaredInputs  []models.InputParam `json:"declared_inputs"`
+	SecretRefs      []string            `json:"secret_refs"`
+}
+
+
+func ExportStepDoc(s models.WorkflowStep) StepDoc {
+	return StepDoc{
+		Kind:            StepDocKind,
+		Name:            s.Name,
+		Description:     s.Description,
+		Interpreter:     s.Interpreter,
+		Script:          s.Script,
+		DeclaredOutputs: s.DeclaredOutputs,
+		DeclaredInputs:  s.DeclaredInputs,
+		SecretRefs:      s.SecretRefs,
+	}
+}
+
+
+
+func ParseStepDoc(b []byte) (models.WorkflowStep, error) {
+	var d StepDoc
+	if err := json.Unmarshal(b, &d); err != nil {
+		return models.WorkflowStep{}, fmt.Errorf("invalid step JSON: %w", err)
+	}
+	if d.Kind != StepDocKind {
+		return models.WorkflowStep{}, fmt.Errorf("unsupported kind %q (want %q)", d.Kind, StepDocKind)
+	}
+	if d.Name == "" || d.Interpreter == "" {
+		return models.WorkflowStep{}, fmt.Errorf("step name and interpreter are required")
+	}
+	if d.SecretRefs == nil {
+		d.SecretRefs = []string{}
+	}
+	if d.DeclaredInputs == nil {
+		d.DeclaredInputs = []models.InputParam{}
+	}
+	return models.WorkflowStep{
+		Name:            d.Name,
+		Description:     d.Description,
+		Interpreter:     d.Interpreter,
+		Script:          d.Script,
+		DeclaredOutputs: DeriveOutputs(d.Script),
+		DeclaredInputs:  d.DeclaredInputs,
+		SecretRefs:      d.SecretRefs,
+	}, nil
+}
+
+
+func ImportStepToLibrary(orgID string, b []byte) (*models.WorkflowStep, error) {
+	s, err := ParseStepDoc(b)
+	if err != nil {
+		return nil, err
+	}
+	return CreateStep(orgID, s)
+}
+
+
+func ExportStep(orgID, stepID string) ([]byte, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	s, err := getStep(ctx, orgID, stepID)
+	if err != nil {
+		return nil, err
+	}
+	return json.MarshalIndent(ExportStepDoc(*s), "", "  ")
+}

server/internal/services/steplogs.go

@@ -0,0 +1,249 @@
+package services
+
+import (
+	"bytes"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/db"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+)
+
+
+func WorkflowLogDir() string {
+	dir := os.Getenv("VANTAGE_WORKFLOW_LOG_DIR")
+	if dir == "" {
+		dir = filepath.Join("data", "workflow-logs")
+	}
+	_ = os.MkdirAll(dir, 0700)
+	return dir
+}
+
+
+func ServerRunLogPath(runID, serverID string) string {
+	return filepath.Join(WorkflowLogDir(), runID, serverID+".log")
+}
+
+
+
+func logTS() string {
+	return time.Now().UTC().Format("2006-01-02T15:04:05.000") + "Z"
+}
+
+
+
+func AppendMarker(runID, serverID, text string) (int64, error) {
+	path := ServerRunLogPath(runID, serverID)
+	if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
+		return 0, err
+	}
+	f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
+	if err != nil {
+		return 0, err
+	}
+	defer f.Close()
+	off, _ := f.Seek(0, 2) 
+	if _, err := f.WriteString("[" + logTS() + "] " + text + "\n"); err != nil {
+		return off, err
+	}
+	return off, nil
+}
+
+
+
+type stepLogWriter struct {
+	mu      sync.Mutex
+	f       *os.File
+	carry   []byte 
+	secrets []string
+}
+
+type stepLogRegistry struct {
+	mu      sync.Mutex
+	writers map[string]*stepLogWriter
+}
+
+var StepLogs = &stepLogRegistry{writers: make(map[string]*stepLogWriter)}
+
+
+func (r *stepLogRegistry) Open(commandID, path string, secrets []string) error {
+	if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
+		return err
+	}
+	f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
+	if err != nil {
+		return err
+	}
+	w := &stepLogWriter{f: f, secrets: secrets}
+	r.mu.Lock()
+	r.writers[commandID] = w
+	r.mu.Unlock()
+	return nil
+}
+
+func (r *stepLogRegistry) get(commandID string) *stepLogWriter {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.writers[commandID]
+}
+
+
+
+
+
+func (r *stepLogRegistry) Append(commandID string, data []byte) {
+	w := r.get(commandID)
+	if w == nil {
+		return
+	}
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	buf := append(w.carry, data...)
+	for {
+		i := bytes.IndexByte(buf, '\n')
+		if i < 0 {
+			break
+		}
+		w.writeLine(buf[:i])
+		buf = buf[i+1:]
+	}
+	w.carry = append([]byte{}, buf...)
+}
+
+
+func (w *stepLogWriter) writeLine(line []byte) {
+	masked := maskBytes(line, w.secrets)
+	_, _ = w.f.WriteString("[" + logTS() + "] ")
+	_, _ = w.f.Write(masked)
+	_, _ = w.f.WriteString("\n")
+}
+
+
+func (r *stepLogRegistry) Close(commandID string) {
+	r.mu.Lock()
+	w := r.writers[commandID]
+	delete(r.writers, commandID)
+	r.mu.Unlock()
+	if w == nil {
+		return
+	}
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if len(w.carry) > 0 {
+		w.writeLine(w.carry)
+		w.carry = nil
+	}
+	_ = w.f.Close()
+}
+
+func maskBytes(b []byte, secrets []string) []byte {
+	s := string(b)
+	for _, v := range secrets {
+		if v == "" {
+			continue
+		}
+		s = strings.ReplaceAll(s, v, "***")
+	}
+	return []byte(s)
+}
+
+
+
+
+func StartLogSweeper() {
+	go func() {
+		sweepLogs()
+		t := time.NewTicker(time.Hour)
+		defer t.Stop()
+		for range t.C {
+			sweepLogs()
+		}
+	}()
+}
+
+
+
+
+
+func sweepLogs() {
+	base := WorkflowLogDir()
+	entries, err := os.ReadDir(base)
+	if err != nil {
+		return
+	}
+	cache := map[string]int{}
+	now := time.Now()
+
+	for _, e := range entries {
+		if !e.IsDir() {
+			continue
+		}
+		runID := e.Name()
+		dir := filepath.Join(base, runID)
+
+		orgID, finishedAt, found, err := runRetentionInfo(runID)
+		if err != nil {
+			
+			
+			
+			log.Printf("log sweep: retention lookup failed for run %s: %v", runID, err)
+			continue
+		}
+		if found && finishedAt == nil {
+			continue 
+		}
+
+		days, ok := cache[orgID]
+		if !ok {
+			days = defaultRetentionDays
+			if orgID != "" {
+				if v, err := GetWorkflowLogRetentionDays(orgID); err == nil {
+					days = v
+				}
+			}
+			cache[orgID] = days
+		}
+		if days <= 0 {
+			continue 
+		}
+		cutoff := now.AddDate(0, 0, -days)
+
+		if found {
+			if finishedAt.Before(cutoff) {
+				_ = os.RemoveAll(dir)
+			}
+			continue
+		}
+		
+		if fi, e := os.Stat(dir); e == nil && fi.ModTime().Before(cutoff) {
+			_ = os.RemoveAll(dir)
+		}
+	}
+}
+
+const defaultRetentionDays = 30
+
+
+
+
+func runRetentionInfo(runID string) (string, *time.Time, bool, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	var run struct {
+		OrgID      string     `bson:"org_id"`
+		FinishedAt *time.Time `bson:"finished_at"`
+	}
+	err := db.Col("workflow_runs").FindOne(ctx, bson.M{"run_id": runID}).Decode(&run)
+	if err == mongo.ErrNoDocuments {
+		return "", nil, false, nil
+	}
+	if err != nil {
+		return "", nil, false, err
+	}
+	return run.OrgID, run.FinishedAt, true, nil
+}

server/internal/services/stepresults.go

@@ -0,0 +1,49 @@
+package services
+
+import (
+	"sync"
+
+	"github.com/mrhid6/vantage/server/internal/grpc/pb"
+)
+
+type stepResultRegistry struct {
+	mu      sync.Mutex
+	pending map[string]chan *pb.StepResult
+}
+
+
+
+var StepResults = &stepResultRegistry{pending: make(map[string]chan *pb.StepResult)}
+
+
+
+func (r *stepResultRegistry) Await(commandID string) <-chan *pb.StepResult {
+	ch := make(chan *pb.StepResult, 1)
+	r.mu.Lock()
+	r.pending[commandID] = ch
+	r.mu.Unlock()
+	return ch
+}
+
+
+func (r *stepResultRegistry) Cancel(commandID string) {
+	r.mu.Lock()
+	delete(r.pending, commandID)
+	r.mu.Unlock()
+}
+
+
+func (r *stepResultRegistry) Deliver(res *pb.StepResult) {
+	if res == nil {
+		return
+	}
+	r.mu.Lock()
+	ch, ok := r.pending[res.CommandId]
+	if ok {
+		delete(r.pending, res.CommandId)
+	}
+	r.mu.Unlock()
+	if ok {
+		ch <- res
+	}
+}

server/internal/services/stepscan.go

@@ -0,0 +1,44 @@
+package services
+
+import (
+	"regexp"
+	"strings"
+)
+
+
+var keyAssign = regexp.MustCompile(`([A-Za-z_][A-Za-z0-9_]*)=`)
+
+
+
+
+func DeriveOutputs(script string) []string {
+	out := []string{}
+	seen := map[string]bool{}
+	for _, line := range strings.Split(script, "\n") {
+		if !strings.Contains(line, "WORKFLOW_ENV") {
+			continue
+		}
+		for _, m := range keyAssign.FindAllStringSubmatch(line, -1) {
+			key := m[1]
+			
+			if key == "WORKFLOW_ENV" || key == "env" {
+				continue
+			}
+			if seen[key] {
+				continue
+			}
+			seen[key] = true
+			out = append(out, key)
+		}
+	}
+	return out
+}
+
+var slugStrip = regexp.MustCompile(`[^a-z0-9]+`)
+
+
+func Slugify(name string) string {
+	s := strings.ToLower(name)
+	s = slugStrip.ReplaceAllString(s, "-")
+	return strings.Trim(s, "-")
+}

server/internal/services/sync.go

@@ -13,7 +13,15 @@ func BuildAuthorizedKeys(serverID string) ([]string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
+	
+	
+	srv, err := getServerByID(serverID)
+	if err != nil {
+		return nil, err
+	}
+
 	cursor, err := db.Col("assignments").Find(ctx, bson.M{
+		"org_id":     srv.OrgID,
 		"server_id":  serverID,
 		"revoked_at": nil,
 	})
@@ -30,7 +38,7 @@ func BuildAuthorizedKeys(serverID string) ([]string, error) {
 	var lines []string
 	for _, a := range assignments {
 		var key models.Key
-		err := db.Col("keys").FindOne(ctx, bson.M{"key_id": a.KeyID}).Decode(&key)
+		err := db.Col("keys").FindOne(ctx, bson.M{"key_id": a.KeyID, "org_id": srv.OrgID}).Decode(&key)
 		if err != nil {
 			continue
 		}

server/internal/services/users.go

@@ -0,0 +1,183 @@
+package services
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"golang.org/x/crypto/bcrypt"
+)
+
+
+
+var ErrLastOwner = errors.New("this is the organization's last owner promote another member to owner first")
+
+
+
+
+func CountUsers() (int64, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	return db.Col("users").CountDocuments(ctx, bson.M{})
+}
+
+func CountOrgUsers(orgID string) (int64, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	return db.Col("users").CountDocuments(ctx, bson.M{"org_id": orgID})
+}
+
+
+
+func countOtherOwners(orgID, exceptUserID string) (int64, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	return db.Col("users").CountDocuments(ctx, bson.M{
+		"org_id":  orgID,
+		"role":    models.RoleOwner,
+		"user_id": bson.M{"$ne": exceptUserID},
+	})
+}
+
+func GetUserInOrg(orgID, userID string) (*models.User, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var u models.User
+	err := db.Col("users").FindOne(ctx, bson.M{"user_id": userID, "org_id": orgID}).Decode(&u)
+	if err != nil {
+		return nil, err
+	}
+	return &u, nil
+}
+
+func CreateUser(orgID, email, password, role, authSource string) (*models.User, error) {
+	email = strings.ToLower(strings.TrimSpace(email))
+	if email == "" {
+		return nil, fmt.Errorf("email required")
+	}
+	if !models.ValidRole(role) {
+		return nil, fmt.Errorf("invalid role %q", role)
+	}
+	u := &models.User{
+		UserID:     uuid.NewString(),
+		OrgID:      orgID,
+		Email:      email,
+		Role:       role,
+		AuthSource: authSource,
+		CreatedAt:  time.Now(),
+	}
+	if password != "" {
+		hash, err := bcrypt.GenerateFromPassword([]byte(password), 12)
+		if err != nil {
+			return nil, err
+		}
+		u.PasswordHash = string(hash)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if _, err := db.Col("users").InsertOne(ctx, u); err != nil {
+		if mongo.IsDuplicateKeyError(err) {
+			return nil, fmt.Errorf("email already registered")
+		}
+		return nil, err
+	}
+	return u, nil
+}
+
+func GetUserByEmail(email string) (*models.User, error) {
+	email = strings.ToLower(strings.TrimSpace(email))
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var u models.User
+	err := db.Col("users").FindOne(ctx, bson.M{"email": email}).Decode(&u)
+	if err != nil {
+		return nil, err
+	}
+	return &u, nil
+}
+
+func VerifyPassword(u *models.User, password string) bool {
+	if u == nil || u.PasswordHash == "" {
+		return false
+	}
+	return bcrypt.CompareHashAndPassword([]byte(u.PasswordHash), []byte(password)) == nil
+}
+
+func TouchLastLogin(userID string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	now := time.Now()
+	_, err := db.Col("users").UpdateOne(ctx, bson.M{"user_id": userID},
+		bson.M{"$set": bson.M{"last_login": now}})
+	return err
+}
+
+func ListUsers(orgID string) ([]models.User, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	cursor, err := db.Col("users").Find(ctx, bson.M{"org_id": orgID})
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close(ctx)
+	var users []models.User
+	if err := cursor.All(ctx, &users); err != nil {
+		return nil, err
+	}
+	return users, nil
+}
+
+func UpdateUserRole(orgID, userID, role string) error {
+	if !models.ValidRole(role) {
+		return fmt.Errorf("invalid role %q", role)
+	}
+	target, err := GetUserInOrg(orgID, userID)
+	if err != nil {
+		return fmt.Errorf("user not found")
+	}
+	
+	if target.Role == models.RoleOwner && role != models.RoleOwner {
+		others, err := countOtherOwners(orgID, userID)
+		if err != nil {
+			return err
+		}
+		if others == 0 {
+			return ErrLastOwner
+		}
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	_, err = db.Col("users").UpdateOne(ctx,
+		bson.M{"user_id": userID, "org_id": orgID},
+		bson.M{"$set": bson.M{"role": role}})
+	return err
+}
+
+func DeleteUser(orgID, userID string) error {
+	target, err := GetUserInOrg(orgID, userID)
+	if err != nil {
+		return fmt.Errorf("user not found")
+	}
+	if target.Role == models.RoleOwner {
+		others, err := countOtherOwners(orgID, userID)
+		if err != nil {
+			return err
+		}
+		if others == 0 {
+			return ErrLastOwner
+		}
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	_, err = db.Col("users").DeleteOne(ctx, bson.M{"user_id": userID, "org_id": orgID})
+	return err
+}

server/internal/services/validate.go

@@ -0,0 +1,19 @@
+package services
+
+import (
+	"fmt"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+
+func ValidateWorkflow(w models.Workflow) error {
+	for i, ref := range w.Steps {
+		hasLib := ref.StepID != ""
+		hasInline := ref.Inline != nil
+		if hasLib == hasInline {
+			return fmt.Errorf("step %d: exactly one of step_id or inline must be set", i)
+		}
+	}
+	return nil
+}

server/internal/services/workflow_runner.go

@@ -0,0 +1,491 @@
+package services
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/grpc/pb"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+const stepDispatchGrace = 15 * time.Second
+
+func TriggerWorkflow(orgID, workflowID, actor string) (string, error) {
+	wf, err := GetWorkflow(orgID, workflowID)
+	if err != nil {
+		return "", err
+	}
+	if len(wf.TargetServerIDs) == 0 {
+		return "", fmt.Errorf("workflow has no target servers")
+	}
+	if len(wf.Steps) == 0 {
+		return "", fmt.Errorf("workflow has no steps")
+	}
+
+	if err := validateTargetServers(orgID, wf.TargetServerIDs); err != nil {
+		return "", err
+	}
+
+	ctx, cancel := wfCtx()
+	running := db.Col("workflow_runs").FindOne(ctx, bson.M{"org_id": orgID, "workflow_id": workflowID, "status": "running"})
+	cancel()
+	if running.Err() == nil {
+		return "", fmt.Errorf("workflow already has a run in progress")
+	}
+
+	resolved, err := resolveSteps(orgID, wf)
+	if err != nil {
+		return "", err
+	}
+
+	run := models.WorkflowRun{
+		OrgID:       orgID,
+		RunID:       uuid.New().String(),
+		WorkflowID:  workflowID,
+		Name:        wf.Name,
+		Steps:       resolved,
+		Status:      "running",
+		TriggeredBy: actor,
+		StartedAt:   time.Now(),
+		ServerRuns:  make([]models.ServerRun, 0, len(wf.TargetServerIDs)),
+	}
+	for _, sid := range wf.TargetServerIDs {
+		hostname := sid
+		if s, e := getServerByID(sid); e == nil {
+			hostname = s.Hostname
+		}
+		sr := models.ServerRun{ServerID: sid, Hostname: hostname, Status: "queued", RunEnv: map[string]string{}}
+		for _, rs := range resolved {
+			sr.Steps = append(sr.Steps, models.StepRun{Order: rs.Order, Name: rs.Name, Status: "queued", OutputEnv: map[string]string{}})
+		}
+		run.ServerRuns = append(run.ServerRuns, sr)
+	}
+
+	ictx, icancel := wfCtx()
+	defer icancel()
+	if _, err := db.Col("workflow_runs").InsertOne(ictx, run); err != nil {
+		return "", err
+	}
+
+	go executeRun(run.RunID)
+	return run.RunID, nil
+}
+
+func resolveSteps(orgID string, wf *models.Workflow) ([]models.ResolvedStep, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	out := make([]models.ResolvedStep, 0, len(wf.Steps))
+	for _, ref := range wf.Steps {
+		if ref.Inline != nil {
+			out = append(out, resolveInlineStep(ref))
+			continue
+		}
+		lib, err := getStep(ctx, orgID, ref.StepID)
+		if err != nil {
+			return nil, err
+		}
+		inputs := map[string]string{}
+		for _, p := range lib.DeclaredInputs {
+			if ref.Inputs != nil {
+				if v, ok := ref.Inputs[p.Name]; ok {
+					inputs[p.Name] = v
+					continue
+				}
+			}
+			inputs[p.Name] = p.Default
+		}
+		rs := models.ResolvedStep{
+			Order:       ref.Order,
+			Name:        lib.Name,
+			Interpreter: lib.Interpreter,
+			Script:      lib.Script,
+			SecretRefs:  lib.SecretRefs,
+			OnFailure:   ref.OnFailure,
+			MaxRetries:  ref.MaxRetries,
+			Inputs:      inputs,
+		}
+		if ref.Overrides != nil {
+			if ref.Overrides.Script != nil {
+				rs.Script = *ref.Overrides.Script
+			}
+			if ref.Overrides.SecretRefs != nil {
+				rs.SecretRefs = ref.Overrides.SecretRefs
+			}
+		}
+		if rs.OnFailure == "" {
+			rs.OnFailure = "stop"
+		}
+		out = append(out, rs)
+	}
+	return out, nil
+}
+
+func resolveInlineStep(ref models.WorkflowStepRef) models.ResolvedStep {
+	in := ref.Inline
+	inputs := map[string]string{}
+	for _, p := range in.DeclaredInputs {
+		if ref.Inputs != nil {
+			if v, ok := ref.Inputs[p.Name]; ok {
+				inputs[p.Name] = v
+				continue
+			}
+		}
+		inputs[p.Name] = p.Default
+	}
+	onFailure := ref.OnFailure
+	if onFailure == "" {
+		onFailure = "stop"
+	}
+	return models.ResolvedStep{
+		Order:       ref.Order,
+		Name:        in.Name,
+		Interpreter: in.Interpreter,
+		Script:      in.Script,
+		SecretRefs:  in.SecretRefs,
+		OnFailure:   onFailure,
+		MaxRetries:  ref.MaxRetries,
+		Inputs:      inputs,
+	}
+}
+
+func executeRun(runID string) {
+	run, err := getRunByID(runID)
+	if err != nil {
+		return
+	}
+	done := make(chan int, len(run.ServerRuns))
+	for i := range run.ServerRuns {
+		go func(idx int) {
+			runServer(run.OrgID, runID, idx, run.Steps, run.ServerRuns[idx].ServerID)
+			done <- idx
+		}(i)
+	}
+	for range run.ServerRuns {
+		<-done
+	}
+
+	final, _ := getRunByID(runID)
+	status := "success"
+	for _, sr := range final.ServerRuns {
+		if sr.Status == "failed" {
+			status = "failed"
+		}
+	}
+	now := time.Now()
+	ctx, cancel := wfCtx()
+	defer cancel()
+	_, _ = db.Col("workflow_runs").UpdateOne(ctx, bson.M{"run_id": runID, "status": "running"},
+		bson.M{"$set": bson.M{"status": status, "finished_at": now}})
+}
+
+func runServer(orgID, runID string, srvIdx int, steps []models.ResolvedStep, serverID string) {
+	now := time.Now()
+	setServerRun(runID, srvIdx, bson.M{"server_runs.$.status": "running", "server_runs.$.started_at": now})
+
+	if !Dispatcher.IsConnected(serverID) {
+		fin := time.Now()
+		_, _ = AppendMarker(runID, serverID, "agent not connected server skipped")
+		setServerRun(runID, srvIdx, bson.M{"server_runs.$.status": "skipped", "server_runs.$.finished_at": fin})
+		return
+	}
+
+	_, _ = AppendMarker(runID, serverID, fmt.Sprintf("run started on %s %d step(s), workspace vantage-run-%s", serverID, len(steps), runID))
+
+	runEnv := map[string]string{}
+	allSecrets := map[string]string{}
+	serverFailed := false
+
+	for i, step := range steps {
+		startStep(runID, serverID, i, "running")
+		stepStart := time.Now()
+		var res *pb.StepResult
+		attempts := 0
+		maxAttempts := 1
+		if step.OnFailure == "retry" {
+			maxAttempts = step.MaxRetries + 1
+		}
+
+		secretVals := resolveSecrets(orgID, step.SecretRefs)
+		for k, v := range secretVals {
+			allSecrets[k] = v
+		}
+
+		subst := map[string]string{}
+		for k, v := range runEnv {
+			subst[k] = v
+		}
+		for k, v := range secretVals {
+			subst[k] = v
+		}
+		cmdEnv := map[string]string{}
+		for k, v := range step.Inputs {
+			cmdEnv[k] = expandVars(v, subst)
+		}
+		for k, v := range runEnv {
+			cmdEnv[k] = v
+		}
+		for k, v := range secretVals {
+			cmdEnv[k] = v
+		}
+
+		marker := fmt.Sprintf("===== step %d/%d: %s (%s) =====", step.Order+1, len(steps), step.Name, step.Interpreter)
+		offset, _ := AppendMarker(runID, serverID, marker)
+		logPath := ServerRunLogPath(runID, serverID)
+		secretsSlice := secretValues(secretVals)
+
+		commandID := uuid.New().String()
+		for attempts < maxAttempts {
+			attempts++
+			if attempts > 1 {
+				_, _ = AppendMarker(runID, serverID, fmt.Sprintf("retry %d/%d after failure", attempts-1, maxAttempts-1))
+			}
+
+			_ = StepLogs.Open(commandID, logPath, secretsSlice)
+			res = dispatchAndWait(serverID, commandID, &pb.RunStepCmd{
+				Interpreter:    step.Interpreter,
+				Script:         step.Script,
+				Env:            cmdEnv,
+				TimeoutSeconds: 0,
+				WorkspaceId:    runID,
+			})
+			StepLogs.Close(commandID)
+			if res != nil && res.ExitCode == 0 {
+				break
+			}
+		}
+
+		exit := 1
+		outEnv := map[string]string{}
+		if res != nil {
+			exit = res.ExitCode
+			for k, v := range res.OutputEnv {
+				runEnv[k] = v
+				outEnv[k] = maskSecrets(v, allSecrets)
+			}
+		} else {
+			_, _ = AppendMarker(runID, serverID, "agent did not return a result")
+		}
+
+		status := "success"
+		if exit != 0 {
+			status = "failed"
+		}
+		finishStep(runID, serverID, i, status, attempts, exit, offset, outEnv)
+
+		dur := time.Since(stepStart).Round(time.Millisecond)
+		_, _ = AppendMarker(runID, serverID, fmt.Sprintf("step %d/%d %s exit %d, %d attempt(s), %s",
+			step.Order+1, len(steps), status, exit, attempts, dur))
+
+		if exit != 0 {
+			switch step.OnFailure {
+			case "continue":
+				_, _ = AppendMarker(runID, serverID, "on_failure=continue proceeding to next step")
+			default:
+				serverFailed = true
+			}
+			if serverFailed {
+				_, _ = AppendMarker(runID, serverID, "stopping run remaining steps skipped")
+				markRemainingSkipped(runID, serverID, i+1)
+				break
+			}
+		}
+	}
+
+	DispatchCleanupWorkspace(serverID, runID)
+
+	fin := time.Now()
+	status := "success"
+	if serverFailed {
+		status = "failed"
+	}
+	_, _ = AppendMarker(runID, serverID, fmt.Sprintf("run %s in %s workspace removed",
+		status, fin.Sub(now).Round(time.Millisecond)))
+
+	maskedRunEnv := make(map[string]string, len(runEnv))
+	for k, v := range runEnv {
+		maskedRunEnv[k] = maskSecrets(v, allSecrets)
+	}
+	setServerRun(runID, srvIdx, bson.M{
+		"server_runs.$.status":      status,
+		"server_runs.$.finished_at": fin,
+		"server_runs.$.run_env":     maskedRunEnv,
+	})
+}
+
+func dispatchAndWait(serverID, commandID string, cmd *pb.RunStepCmd) *pb.StepResult {
+	ch := StepResults.Await(commandID)
+	if err := DispatchRunStep(serverID, commandID, cmd); err != nil {
+		StepResults.Cancel(commandID)
+		return &pb.StepResult{ExitCode: 1, Stderr: "[vantage] dispatch failed: " + err.Error()}
+	}
+	wait := time.Duration(cmd.TimeoutSeconds)*time.Second + stepDispatchGrace
+	if cmd.TimeoutSeconds == 0 {
+		wait = 30*time.Minute + stepDispatchGrace
+	}
+	select {
+	case res := <-ch:
+		return res
+	case <-time.After(wait):
+		StepResults.Cancel(commandID)
+		return &pb.StepResult{ExitCode: 124, Stderr: "[vantage] timed out waiting for agent result"}
+	}
+}
+
+func expandVars(v string, lookup map[string]string) string {
+	return os.Expand(v, func(name string) string {
+		if name == "$" {
+			return "$"
+		}
+		return lookup[name]
+	})
+}
+
+func resolveSecrets(orgID string, refs []string) map[string]string {
+	out := map[string]string{}
+	for _, ref := range refs {
+
+		parts := strings.SplitN(ref, "/", 2)
+		if len(parts) != 2 {
+			continue
+		}
+		if v, err := RevealSecret(orgID, parts[0], parts[1]); err == nil {
+			out[parts[1]] = v
+		}
+	}
+	return out
+}
+
+func maskSecrets(s string, secrets map[string]string) string {
+	for _, v := range secrets {
+		if v == "" {
+			continue
+		}
+		s = strings.ReplaceAll(s, v, "***")
+	}
+	return s
+}
+
+func setServerRun(runID string, srvIdx int, set bson.M) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	_, _ = db.Col("workflow_runs").UpdateOne(ctx,
+		bson.M{"run_id": runID, "server_runs.server_id": serverIDAt(runID, srvIdx)},
+		bson.M{"$set": set})
+}
+
+func serverIDAt(runID string, srvIdx int) string {
+	r, err := getRunByID(runID)
+	if err != nil || srvIdx >= len(r.ServerRuns) {
+		return ""
+	}
+	return r.ServerRuns[srvIdx].ServerID
+}
+
+func startStep(runID, serverID string, order int, status string) {
+	now := time.Now()
+	updateStep(runID, serverID, order, bson.M{
+		"server_runs.$[s].steps.$[t].status":     status,
+		"server_runs.$[s].steps.$[t].started_at": now,
+	})
+}
+
+func finishStep(runID, serverID string, order int, status string, attempts, exit int, logOffset int64, outEnv map[string]string) {
+	now := time.Now()
+	updateStep(runID, serverID, order, bson.M{
+		"server_runs.$[s].steps.$[t].status":      status,
+		"server_runs.$[s].steps.$[t].attempts":    attempts,
+		"server_runs.$[s].steps.$[t].exit_code":   exit,
+		"server_runs.$[s].steps.$[t].log_offset":  logOffset,
+		"server_runs.$[s].steps.$[t].output_env":  outEnv,
+		"server_runs.$[s].steps.$[t].finished_at": now,
+	})
+}
+
+func secretValues(m map[string]string) []string {
+	out := make([]string, 0, len(m))
+	for _, v := range m {
+		out = append(out, v)
+	}
+	return out
+}
+
+func markRemainingSkipped(runID, serverID string, fromOrder int) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	_, _ = db.Col("workflow_runs").UpdateMany(ctx,
+		bson.M{"run_id": runID},
+		bson.M{"$set": bson.M{"server_runs.$[s].steps.$[t].status": "skipped"}},
+		options.UpdateMany().SetArrayFilters([]interface{}{
+			bson.M{"s.server_id": serverID},
+			bson.M{"t.order": bson.M{"$gte": fromOrder}, "t.status": "queued"},
+		}),
+	)
+}
+
+func updateStep(runID, serverID string, order int, set bson.M) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	_, _ = db.Col("workflow_runs").UpdateOne(ctx,
+		bson.M{"run_id": runID},
+		bson.M{"$set": set},
+		options.UpdateOne().SetArrayFilters([]interface{}{
+			bson.M{"s.server_id": serverID},
+			bson.M{"t.order": order},
+		}),
+	)
+}
+
+func getRunByID(runID string) (*models.WorkflowRun, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	var r models.WorkflowRun
+	err := db.Col("workflow_runs").FindOne(ctx, bson.M{"run_id": runID}).Decode(&r)
+	if err == mongo.ErrNoDocuments {
+		return nil, fmt.Errorf("run not found")
+	}
+	return &r, err
+}
+
+func GetRun(orgID, runID string) (*models.WorkflowRun, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	var r models.WorkflowRun
+	err := db.Col("workflow_runs").FindOne(ctx, bson.M{"run_id": runID, "org_id": orgID}).Decode(&r)
+	if err == mongo.ErrNoDocuments {
+		return nil, fmt.Errorf("run not found")
+	}
+	return &r, err
+}
+
+func ListRuns(orgID, workflowID string, limit int64) ([]models.WorkflowRun, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	cur, err := db.Col("workflow_runs").Find(ctx, bson.M{"org_id": orgID, "workflow_id": workflowID},
+		options.Find().SetSort(bson.D{{Key: "started_at", Value: -1}}).SetLimit(limit))
+	if err != nil {
+		return nil, err
+	}
+	defer cur.Close(ctx)
+	runs := []models.WorkflowRun{}
+	if err := cur.All(ctx, &runs); err != nil {
+		return nil, err
+	}
+	return runs, nil
+}
+
+func CancelRun(orgID, runID string) error {
+	now := time.Now()
+	ctx, cancel := wfCtx()
+	defer cancel()
+	_, err := db.Col("workflow_runs").UpdateOne(ctx,
+		bson.M{"org_id": orgID, "run_id": runID, "status": "running"},
+		bson.M{"$set": bson.M{"status": "cancelled", "finished_at": now}})
+	return err
+}

server/internal/services/workflows.go

@@ -0,0 +1,296 @@
+package services
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+func wfCtx() (context.Context, context.CancelFunc) {
+	return context.WithTimeout(context.Background(), 10*time.Second)
+}
+
+func EnsureWorkflowIndexes() error {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	if _, err := db.Col("workflow_steps").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys: bson.D{{Key: "step_id", Value: 1}}, Options: options.Index().SetUnique(true),
+	}); err != nil {
+		return err
+	}
+	
+	
+	if err := db.Col("workflow_steps").Indexes().DropOne(ctx, "slug_1"); err != nil && !isIndexNotFound(err) {
+		return err
+	}
+	if _, err := db.Col("workflow_steps").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys: bson.D{{Key: "org_id", Value: 1}, {Key: "slug", Value: 1}},
+		Options: options.Index().SetUnique(true).
+			SetPartialFilterExpression(bson.M{"source": "default"}),
+	}); err != nil {
+		return err
+	}
+	if _, err := db.Col("workflows").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys: bson.D{{Key: "workflow_id", Value: 1}}, Options: options.Index().SetUnique(true),
+	}); err != nil {
+		return err
+	}
+	_, err := db.Col("workflow_runs").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys: bson.D{{Key: "run_id", Value: 1}}, Options: options.Index().SetUnique(true),
+	})
+	return err
+}
+
+
+
+func ListSteps(orgID string) ([]models.WorkflowStep, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	cur, err := db.Col("workflow_steps").Find(ctx, bson.M{"org_id": orgID},
+		options.Find().SetSort(bson.D{{Key: "name", Value: 1}}))
+	if err != nil {
+		return nil, err
+	}
+	defer cur.Close(ctx)
+	steps := []models.WorkflowStep{}
+	if err := cur.All(ctx, &steps); err != nil {
+		return nil, err
+	}
+	return steps, nil
+}
+
+
+
+func StepUsageCounts(orgID string) (map[string]int, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	cur, err := db.Col("workflows").Find(ctx, bson.M{"org_id": orgID})
+	if err != nil {
+		return nil, err
+	}
+	defer cur.Close(ctx)
+	var wfs []models.Workflow
+	if err := cur.All(ctx, &wfs); err != nil {
+		return nil, err
+	}
+	counts := map[string]int{}
+	for _, w := range wfs {
+		seen := map[string]bool{}
+		for _, ref := range w.Steps {
+			if ref.StepID == "" || seen[ref.StepID] {
+				continue
+			}
+			seen[ref.StepID] = true
+			counts[ref.StepID]++
+		}
+	}
+	return counts, nil
+}
+
+func CreateStep(orgID string, s models.WorkflowStep) (*models.WorkflowStep, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	s.OrgID = orgID
+	s.StepID = uuid.New().String()
+	s.CreatedAt = time.Now()
+	s.UpdatedAt = s.CreatedAt
+	s.DeclaredOutputs = DeriveOutputs(s.Script)
+	if s.Source == "" {
+		s.Source = "user"
+	}
+	if s.SecretRefs == nil {
+		s.SecretRefs = []string{}
+	}
+	if s.DeclaredInputs == nil {
+		s.DeclaredInputs = []models.InputParam{}
+	}
+	if _, err := db.Col("workflow_steps").InsertOne(ctx, s); err != nil {
+		return nil, err
+	}
+	return &s, nil
+}
+
+func UpdateStep(orgID, stepID string, s models.WorkflowStep) error {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	_, err := db.Col("workflow_steps").UpdateOne(ctx, bson.M{"step_id": stepID, "org_id": orgID}, bson.M{"$set": bson.M{
+		"name":             s.Name,
+		"description":      s.Description,
+		"interpreter":      s.Interpreter,
+		"script":           s.Script,
+		"declared_outputs": DeriveOutputs(s.Script),
+		"declared_inputs":  s.DeclaredInputs,
+		"secret_refs":      s.SecretRefs,
+		"updated_at":       time.Now(),
+	}})
+	return err
+}
+
+func DeleteStep(orgID, stepID string) error {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	if _, err := db.Col("workflow_steps").DeleteOne(ctx, bson.M{"step_id": stepID, "org_id": orgID}); err != nil {
+		return err
+	}
+	
+	cur, err := db.Col("workflows").Find(ctx, bson.M{"steps.step_id": stepID, "org_id": orgID})
+	if err != nil {
+		return err
+	}
+	defer cur.Close(ctx)
+	var wfs []models.Workflow
+	if err := cur.All(ctx, &wfs); err != nil {
+		return err
+	}
+	for _, w := range wfs {
+		kept := make([]models.WorkflowStepRef, 0, len(w.Steps))
+		for _, ref := range w.Steps {
+			if ref.StepID == stepID {
+				continue
+			}
+			kept = append(kept, ref)
+		}
+		for i := range kept {
+			kept[i].Order = i
+		}
+		if _, err := db.Col("workflows").UpdateOne(ctx,
+			bson.M{"workflow_id": w.WorkflowID},
+			bson.M{"$set": bson.M{"steps": kept, "updated_at": time.Now()}},
+		); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func getStep(ctx context.Context, orgID, stepID string) (*models.WorkflowStep, error) {
+	var s models.WorkflowStep
+	err := db.Col("workflow_steps").FindOne(ctx, bson.M{"step_id": stepID, "org_id": orgID}).Decode(&s)
+	if err == mongo.ErrNoDocuments {
+		return nil, fmt.Errorf("step %s not found", stepID)
+	}
+	return &s, err
+}
+
+
+
+func ListWorkflows(orgID string) ([]models.Workflow, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	cur, err := db.Col("workflows").Find(ctx, bson.M{"org_id": orgID},
+		options.Find().SetSort(bson.D{{Key: "name", Value: 1}}))
+	if err != nil {
+		return nil, err
+	}
+	defer cur.Close(ctx)
+	wfs := []models.Workflow{}
+	if err := cur.All(ctx, &wfs); err != nil {
+		return nil, err
+	}
+	return wfs, nil
+}
+
+func GetWorkflow(orgID, id string) (*models.Workflow, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	var w models.Workflow
+	err := db.Col("workflows").FindOne(ctx, bson.M{"workflow_id": id, "org_id": orgID}).Decode(&w)
+	if err == mongo.ErrNoDocuments {
+		return nil, fmt.Errorf("workflow not found")
+	}
+	return &w, err
+}
+
+func CreateWorkflow(orgID string, w models.Workflow) (*models.Workflow, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	w.OrgID = orgID
+	w.WorkflowID = uuid.New().String()
+	w.CreatedAt = time.Now()
+	w.UpdatedAt = w.CreatedAt
+	if w.TargetServerIDs == nil {
+		w.TargetServerIDs = []string{}
+	}
+	if w.Steps == nil {
+		w.Steps = []models.WorkflowStepRef{}
+	}
+	if err := ValidateWorkflow(w); err != nil {
+		return nil, err
+	}
+	if err := validateTargetServers(orgID, w.TargetServerIDs); err != nil {
+		return nil, err
+	}
+	normalizeInlineSteps(&w)
+	if _, err := db.Col("workflows").InsertOne(ctx, w); err != nil {
+		return nil, err
+	}
+	return &w, nil
+}
+
+func UpdateWorkflow(orgID, id string, w models.Workflow) error {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	if err := ValidateWorkflow(w); err != nil {
+		return err
+	}
+	if err := validateTargetServers(orgID, w.TargetServerIDs); err != nil {
+		return err
+	}
+	normalizeInlineSteps(&w)
+	_, err := db.Col("workflows").UpdateOne(ctx, bson.M{"workflow_id": id, "org_id": orgID}, bson.M{"$set": bson.M{
+		"name":              w.Name,
+		"target_server_ids": w.TargetServerIDs,
+		"steps":             w.Steps,
+		"updated_at":        time.Now(),
+	}})
+	return err
+}
+
+
+
+
+func validateTargetServers(orgID string, serverIDs []string) error {
+	for _, sid := range serverIDs {
+		if _, err := GetServer(orgID, sid); err != nil {
+			return fmt.Errorf("target server %s not found", sid)
+		}
+	}
+	return nil
+}
+
+
+
+func normalizeInlineSteps(w *models.Workflow) {
+	for i := range w.Steps {
+		in := w.Steps[i].Inline
+		if in == nil {
+			continue
+		}
+		in.DeclaredOutputs = DeriveOutputs(in.Script)
+		in.StepID = ""
+		in.Slug = ""
+		in.Source = ""
+		in.CreatedAt = time.Time{}
+		in.UpdatedAt = time.Time{}
+		if in.SecretRefs == nil {
+			in.SecretRefs = []string{}
+		}
+		if in.DeclaredInputs == nil {
+			in.DeclaredInputs = []models.InputParam{}
+		}
+	}
+}
+
+func DeleteWorkflow(orgID, id string) error {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	_, err := db.Col("workflows").DeleteOne(ctx, bson.M{"workflow_id": id, "org_id": orgID})
+	return err
+}

site/.dockerignore

@@ -0,0 +1,5 @@
+node_modules
+.next
+out
+.env*
+npm-debug.log*

site/Dockerfile

@@ -0,0 +1,51 @@
+# Dependencies stage
+FROM node:26-alpine AS deps
+
+WORKDIR /app
+
+COPY package.json package-lock.json* ./
+RUN npm install
+
+# Build stage
+FROM node:26-alpine AS builder
+
+WORKDIR /app
+
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+
+# Baked in at build time: NEXT_PUBLIC_* values are inlined into the client
+# bundle. SITE_API is the browser-reachable URL of sitesvc, which serves both
+# forms. It is effectively required: leave it empty and both forms report they
+# are not connected rather than submitting anywhere. Must be an origin the
+# browser can reach (not the internal sitesvc:8082) and be listed in sitesvc's
+# SITE_ORIGIN for CORS.
+ARG NEXT_PUBLIC_SITE_API=""
+ARG NEXT_PUBLIC_CONTACT_EMAIL="support@hostxtra.co.uk"
+ENV NEXT_PUBLIC_SITE_API=$NEXT_PUBLIC_SITE_API
+ENV NEXT_PUBLIC_CONTACT_EMAIL=$NEXT_PUBLIC_CONTACT_EMAIL
+
+RUN npm run build
+
+# Runtime stage
+FROM node:26-alpine AS runner
+
+WORKDIR /app
+
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+
+RUN addgroup --system --gid 1001 nodejs && \
+    adduser --system --uid 1001 nextjs
+
+COPY --from=builder /app/public ./public
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+
+USER nextjs
+
+EXPOSE 3000
+ENV PORT=3000
+ENV HOSTNAME="0.0.0.0"
+
+CMD ["node", "server.js"]

site/app/about/page.tsx

@@ -0,0 +1,131 @@
+import type { Metadata } from "next";
+
+export const metadata: Metadata = {
+  title: "About",
+  description:
+    "Vantage began as a weekend fix for a lost laptop and grew into a fleet control plane. How it is built, and what it deliberately does not do.",
+};
+
+export default function AboutPage() {
+  return (
+    <>
+      <section className="rail band band--open">
+        <span className="tag">About</span>
+        <h1 style={{ fontSize: "var(--s-3)", margin: "0.8rem 0 1.1rem", maxWidth: "20ch" }}>
+          Built for the fleet nobody was given a budget to manage.
+        </h1>
+
+        <div className="split" style={{ marginTop: "2.4rem" }}>
+          <div className="prose">
+            <p>
+              Vantage started as a weekend fix for a bad afternoon. A laptop was lost, and finding every server that
+              trusted its key meant SSHing into each one with a text editor open. The list lived in someone&apos;s head.
+              Two of the boxes were not on it.
+            </p>
+            <p>
+              The obvious tools were all heavier than the problem. A configuration management stack to write one file. A
+              bastion host that becomes the thing you now have to keep alive. A certificate authority with a rotation
+              story nobody wanted to own.
+            </p>
+            <p>
+              So it began with one job done properly: hold <code>authorized_keys</code> to a known state. Then the same
+              agent turned out to be the right place to run a deploy script, check whether a service was answering, and
+              open a shell when something was on fire. Each addition had to earn its place by riding the connection that
+              already existed.
+            </p>
+            <p>
+              Today it runs across homelabs, small hosting providers, and agencies who inherit client servers and need
+              to prove who can reach them.
+            </p>
+          </div>
+
+          <div>
+            <span className="tag">How it is built</span>
+            <div className="specs">
+              <div className="spec">
+                <span className="spec__k">SERVER</span>
+                <div>
+                  <h3>Go, MongoDB, Redis</h3>
+                  <p>
+                    One Go binary serving REST for the interface and gRPC for agents. MongoDB holds everything durable;
+                    Redis holds sessions and nothing else.
+                  </p>
+                </div>
+              </div>
+              <div className="spec">
+                <span className="spec__k">WEB</span>
+                <div>
+                  <h3>Next.js</h3>
+                  <p>
+                    An operations interface, not a brochure: dense tables, live log streams, and state you can read at a
+                    glance.
+                  </p>
+                </div>
+              </div>
+              <div className="spec">
+                <span className="spec__k">AGENT</span>
+                <div>
+                  <h3>Go, Linux and Windows</h3>
+                  <p>
+                    A single static binary under systemd or as a Windows service. No runtime, no dependencies, no
+                    package manager involved.
+                  </p>
+                </div>
+              </div>
+              <div className="spec">
+                <span className="spec__k">CONSOLE</span>
+                <div>
+                  <h3>Guacamole</h3>
+                  <p>
+                    Protocol handling is a solved problem. We proxy the connection and manage the credentials around it.
+                  </p>
+                </div>
+              </div>
+            </div>
+          </div>
+        </div>
+      </section>
+
+      <section className="rail band">
+        <span className="tag">Security posture</span>
+        <h2 style={{ fontSize: "var(--s-2)", marginTop: "0.7rem", maxWidth: "24ch" }}>
+          The parts worth being specific about.
+        </h2>
+        <div className="caps">
+          <article className="cap">
+            <span className="cap__k">Tokens</span>
+            <h3>Hashed, never stored plain</h3>
+            <p>
+              Agent tokens and the secrets read token are held as SHA-256 hashes. The plaintext exists on the
+              agent&apos;s own disk at 0600 and nowhere else.
+            </p>
+          </article>
+          <article className="cap">
+            <span className="cap__k">At rest</span>
+            <h3>AES-256-GCM</h3>
+            <p>
+              Private keys, passphrases, vault secrets, identity provider secrets and console credentials are encrypted
+              with a key held only by your deployment.
+            </p>
+          </article>
+          <article className="cap">
+            <span className="cap__k">One-time</span>
+            <h3>Tokens that expire and spend</h3>
+            <p>
+              Pre-registration tokens last an hour and work once. Console session tokens are consumed the moment the
+              tunnel opens.
+            </p>
+          </article>
+          <article className="cap">
+            <span className="cap__k">Recorded</span>
+            <h3>Every mutation is audited</h3>
+            <p>
+              Assignments, revocations, runs, console sessions, secret reveals and settings changes are attributed and
+              kept.
+            </p>
+          </article>
+        </div>
+      </section>
+    </>
+  );
+}

site/app/contact/page.tsx

@@ -0,0 +1,60 @@
+import type { Metadata } from "next";
+import { ContactForm } from "@/components/ContactForm";
+
+export const metadata: Metadata = {
+    title: "Contact",
+    description: "Sales questions, self-hosted licensing, security disclosures and bug reports.",
+};
+
+const CHANNELS = [
+    {
+        title: "Support",
+        body: "Everything else, including anything urgent.",
+        link: "support@hostxtra.co.uk",
+        href: "mailto:support@hostxtra.co.uk",
+    },
+    {
+        title: "Security disclosure",
+        body: "Encrypted reports, acknowledged within 72 hours.",
+        link: "support@hostxtra.co.uk",
+        href: "mailto:support@hostxtra.co.uk?subject=Security%20disclosure",
+    },
+    {
+        title: "Bugs and feature requests",
+        body: "Public tracker, read by the people who write the code.",
+        link: "git.vantage.hostxtra.co.uk/vantage",
+        href: "https://git.vantage.hostxtra.co.uk/vantage",
+    },
+    {
+        title: "Status",
+        body: "Control plane uptime and incident history.",
+        link: "status.vantage.hostxtra.co.uk",
+        href: "https://status.vantage.hostxtra.co.uk",
+    },
+];
+
+export default function ContactPage() {
+    return (
+        <section className="rail band band--open">
+            <span className="tag">Contact</span>
+            <h1 style={{ fontSize: "var(--s-3)", margin: "0.8rem 0 1rem", maxWidth: "15ch" }}>Tell us what your fleet looks like.</h1>
+
+            <div className="split" style={{ marginTop: "2.4rem" }}>
+                <div className="card">
+                    <ContactForm />
+                </div>
+
+                <div>
+                    <p className="prose">Pick the right door and you will get a faster answer.</p>
+                    {CHANNELS.map((channel) => (
+                        <div className="chan" key={channel.title}>
+                            <h3>{channel.title}</h3>
+                            <p>{channel.body}</p>
+                            <a href={channel.href}>{channel.link}</a>
+                        </div>
+                    ))}
+                </div>
+            </div>
+        </section>
+    );
+}

site/app/layout.tsx

@@ -0,0 +1,39 @@
+import type { Metadata } from "next";
+import "./globals.css";
+import { Footer } from "@/components/Footer";
+import { Nav } from "@/components/Nav";
+import { ThemeScript } from "@/components/ThemeScript";
+
+export const metadata: Metadata = {
+    metadataBase: new URL("https://vantage.hostxtra.co.uk"),
+    title: {
+        default: "Vantage  one control plane for the whole fleet",
+        template: "%s Vantage",
+    },
+    description: "Self-hosted fleet control: SSH key assignment, workflow execution, service monitoring, a secrets vault and a browser console, across every server you manage.",
+    openGraph: {
+        type: "website",
+        siteName: "Vantage",
+        title: "Vantage one control plane for the whole fleet",
+        description: "Self-hosted fleet control: SSH keys, workflows, monitors, secrets and consoles, over one outbound agent connection.",
+    },
+    icons: { icon: "/images/vantage_logo.svg" },
+};
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+    return (
+        <html lang="en-GB">
+            <head>
+                <ThemeScript />
+            </head>
+            <body>
+                <a className="skip" href="#main">
+                    Skip to content
+                </a>
+                <Nav />
+                <main id="main">{children}</main>
+                <Footer />
+            </body>
+        </html>
+    );
+}

site/app/page.tsx

@@ -0,0 +1,180 @@
+import Link from "next/link";
+import { InstrumentPanel } from "@/components/InstrumentPanel";
+
+export default function OverviewPage() {
+    return (
+        <>
+            <div className="heroband">
+                <section className="rail hero">
+                    <span className="tag">Self-hosted fleet control plane</span>
+                    <h1>Your servers, under one pane of glass you actually own.</h1>
+                    <p className="lede">
+                        Vantage holds SSH keys, runs scripts, watches services, stores secrets and opens consoles across every machine you manage. One agent per server, outbound connections only, all
+                        state in your own database.
+                    </p>
+                    <div className="hero__acts">
+                        <Link className="btn btn--solid" href="/start">
+                            Create your organisation
+                        </Link>
+                        <Link className="btn btn--line" href="/platform">
+                            What it does
+                        </Link>
+                    </div>
+                    <p className="hero__foot">Free for 3 servers · Linux and Windows agents · Self-host the whole stack</p>
+                </section>
+            </div>
+
+            <InstrumentPanel />
+
+            <section className="rail band band--open">
+                <span className="tag">The problem</span>
+                <h2 style={{ fontSize: "var(--s-2)", marginTop: "0.7rem", maxWidth: "24ch" }}>Six tools, six sources of truth, one afternoon lost.</h2>
+                <div className="split" style={{ marginTop: "2rem" }}>
+                    <p className="prose">
+                        Most small fleets end up with keys in a spreadsheet, scripts in someone&apos;s home directory, uptime checks in a separate service, secrets in a chat thread, and no record of
+                        who ran what. None of those systems know about each other, so every question who can reach this box, what ran on it last, is it even up gets answered by hand.
+                    </p>
+                    <div className="specs specs--flush">
+                        <div className="spec">
+                            <span className="spec__k">ONE AGENT</span>
+                            <div>
+                                <h3>Everything rides one connection</h3>
+                                <p>Keys, steps, checks and inventory all travel over the same outbound link. Installing a second thing is not the answer.</p>
+                            </div>
+                        </div>
+                        <div className="spec">
+                            <span className="spec__k">ONE RECORD</span>
+                            <div>
+                                <h3>Every change is an audit event</h3>
+                                <p>Assignments, revocations, runs, console sessions and settings changes all land in the same log, attributed to a person.</p>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </section>
+
+            <section className="rail band">
+                <span className="tag">Capabilities</span>
+                <h2 style={{ fontSize: "var(--s-2)", marginTop: "0.7rem", maxWidth: "22ch" }}>One control plane, six jobs.</h2>
+                <div className="caps">
+                    <article className="cap">
+                        <span className="cap__k">Access</span>
+                        <h3>SSH keys</h3>
+                        <p>
+                            Assign public keys per server and revoke them softly. The agent diffs desired state against the file and rewrites <code>authorized_keys</code> atomically.
+                        </p>
+                        <ul>
+                            <li>fingerprint deduplication</li>
+                            <li>agent-side keypair generation</li>
+                            <li>revocation history preserved</li>
+                        </ul>
+                    </article>
+
+                    <article className="cap">
+                        <span className="cap__k">Execution</span>
+                        <h3>Workflows</h3>
+                        <p>A library of bash and PowerShell steps with declared inputs, outputs and secret references, composed into workflows that target a set of servers.</p>
+                        <ul>
+                            <li>live streamed step logs</li>
+                            <li>stop, continue or retry on failure</li>
+                            <li>values passed between steps</li>
+                        </ul>
+                    </article>
+
+                    <article className="cap">
+                        <span className="cap__k">Uptime</span>
+                        <h3>Monitors</h3>
+                        <p>HTTP, TCP, ICMP and TLS checks, run either from the control plane or from an agent inside the target network.</p>
+                        <ul>
+                            <li>incidents and uptime history</li>
+                            <li>certificate expiry warnings</li>
+                            <li>alerts to five channel types</li>
+                        </ul>
+                    </article>
+
+                    <article className="cap">
+                        <span className="cap__k">Secrets</span>
+                        <h3>Vault</h3>
+                        <p>Grouped key/value secrets encrypted with AES-256-GCM, injected into workflow steps at execution and never written to logs.</p>
+                        <ul>
+                            <li>read token for External Secrets Operator</li>
+                            <li>rotatable, hashed at rest</li>
+                            <li>reveal is an audited action</li>
+                        </ul>
+                    </article>
+
+                    <article className="cap">
+                        <span className="cap__k">Access</span>
+                        <h3>Browser console</h3>
+                        <p>Open an SSH, RDP or VNC session in the browser. SSH authenticates with a stored key, and every session is recorded in the audit log.</p>
+                        <ul>
+                            <li>one-time session tokens</li>
+                            <li>credentials consumed on connect</li>
+                            <li>no client software</li>
+                        </ul>
+                    </article>
+
+                    <article className="cap">
+                        <span className="cap__k">Health</span>
+                        <h3>Inventory and updates</h3>
+                        <p>CPU, memory, swap, disks and kernel reported continuously, alongside pending OS package updates you can apply from the interface.</p>
+                        <ul>
+                            <li>metrics every 30 seconds</li>
+                            <li>one-click package updates</li>
+                            <li>agents update themselves</li>
+                        </ul>
+                    </article>
+                </div>
+            </section>
+
+            <section className="rail band">
+                <span className="tag">Getting started</span>
+                <h2 style={{ fontSize: "var(--s-2)", marginTop: "0.7rem", maxWidth: "20ch" }}>Four steps, and the first three take a minute.</h2>
+                <div className="flow">
+                    <div className="flow__c">
+                        <span className="flow__n">FIRST</span>
+                        <h3>Create an organisation</h3>
+                        <p>You become the owner. Everything inside is invisible to every other organisation.</p>
+                    </div>
+                    <div className="flow__c">
+                        <span className="flow__n">THEN</span>
+                        <h3>Add a server</h3>
+                        <p>Copy the install one-liner. It expires in an hour and works exactly once.</p>
+                    </div>
+                    <div className="flow__c">
+                        <span className="flow__n">THEN</span>
+                        <h3>Assign a key</h3>
+                        <p>Paste a public key and tick the servers. It lands inside 30 seconds.</p>
+                    </div>
+                    <div className="flow__c">
+                        <span className="flow__n">AFTER</span>
+                        <h3>Build from there</h3>
+                        <p>Add checks, write a step, invite the team, connect your identity provider.</p>
+                    </div>
+                </div>
+
+                <pre className="code" style={{ marginTop: "1.6rem" }}>
+                    <i># Linux</i>
+                    {"\n"}
+                    <b>curl</b> -fsSL https://vantage.hostxtra.co.uk/install | bash -s -- --server-id=<b>$ID</b> --token=<b>$TOKEN</b>
+                    {"\n\n"}
+                    <i># Windows</i>
+                    {"\n"}
+                    <b>irm</b> https://vantage.hostxtra.co.uk/install.ps1 | <b>iex</b>
+                </pre>
+            </section>
+
+            <section className="rail band band--flush">
+                <div className="card card--cta">
+                    <div style={{ maxWidth: "48ch" }}>
+                        <h2 style={{ fontSize: "var(--s-1)" }}>Three servers, free, no card.</h2>
+                        <p style={{ color: "var(--ink-2)", marginTop: "0.4rem", fontSize: "0.94rem" }}>Create an organisation, install one agent, and watch a key land on a real box.</p>
+                    </div>
+                    <Link className="btn btn--solid" href="/start">
+                        Get started
+                    </Link>
+                </div>
+            </section>
+        </>
+    );
+}

site/app/platform/page.tsx

@@ -0,0 +1,149 @@
+import type { Metadata } from "next";
+
+export const metadata: Metadata = {
+    title: "Platform",
+    description: "How Vantage fits together: a control plane you run, one agent per server, and a single outbound connection between them.",
+};
+
+export default function PlatformPage() {
+    return (
+        <>
+            <section className="rail band band--open">
+                <span className="tag">Platform</span>
+                <h1 style={{ fontSize: "var(--s-3)", margin: "0.8rem 0 1rem", maxWidth: "19ch" }}>How the pieces fit together.</h1>
+                <p className="lede">Three moving parts: a control plane you run, an agent on each server, and one outbound connection between them.</p>
+
+                <div className="split" style={{ marginTop: "3rem" }}>
+                    <div>
+                        <h2 style={{ fontSize: "var(--s-2)", maxWidth: "18ch" }}>The agent never listens.</h2>
+                        <div className="prose" style={{ marginTop: "1rem" }}>
+                            <p>
+                                Every agent dials out to the control plane over gRPC with TLS. Nothing needs an inbound port, nothing needs a static address, and a machine behind NAT is no different
+                                from one with a public IP.
+                            </p>
+                            <p>
+                                Key state is polled on a 30-second interval, because 30 seconds is fine for access control and polling is simple to reason about. Everything that should not wait
+                                running a step, opening a console, applying updates is pushed down a bidirectional command stream the agent holds open.
+                            </p>
+                        </div>
+                    </div>
+
+                    <div className="specs specs--flush">
+                        <div className="spec">
+                            <span className="spec__k">POLL</span>
+                            <div>
+                                <h3>SyncKeys, every 30s</h3>
+                                <p>The desired key set for this server. Unchanged state means no disk write at all.</p>
+                            </div>
+                        </div>
+                        <div className="spec">
+                            <span className="spec__k">PUSH</span>
+                            <div>
+                                <h3>Command stream</h3>
+                                <p>Generate a key, run a step, apply updates, update the agent, clean up a workspace.</p>
+                            </div>
+                        </div>
+                        <div className="spec">
+                            <span className="spec__k">REPORT</span>
+                            <div>
+                                <h3>Inventory and checks</h3>
+                                <p>Metrics every 30 seconds, a full hardware snapshot every 15 minutes, and monitor results as they complete.</p>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </section>
+
+            <section className="rail band">
+                <span className="tag">Write path</span>
+                <h2 style={{ fontSize: "var(--s-2)", marginTop: "0.7rem", maxWidth: "24ch" }}>The file is never half-written.</h2>
+                <div className="split split--even" style={{ marginTop: "2rem" }}>
+                    <p className="prose">
+                        The agent computes the desired <code>authorized_keys</code> content, compares it to what is on disk, and stops there if nothing changed. When it does need to write, it writes a
+                        temporary file in the same directory and renames it over the real one. A machine that loses power mid-write keeps the file it had.
+                    </p>
+                    <pre className="code">
+                        <i>// agent poll, simplified</i>
+                        {"\n"}
+                        desired := client.SyncKeys(serverID, token){"\n"}
+                        current := keys.ReadAuthorizedKeys(){"\n\n"}
+                        <b>if</b> !keys.StateChanged(current, desired) {"{"}
+                        {"\n    "}
+                        <i>// nothing to do</i>
+                        {"\n    "}
+                        <b>return</b> nil{"\n"}
+                        {"}"}
+                        {"\n\n"}
+                        keys.WriteAuthorizedKeys(desired){"\n"}
+                        <i>// write .tmp, os.Rename(), chmod 0600</i>
+                    </pre>
+                </div>
+            </section>
+
+            <section className="rail band">
+                <span className="tag">Tenancy and identity</span>
+                <h2 style={{ fontSize: "var(--s-2)", marginTop: "0.7rem", maxWidth: "22ch" }}>Organisations are the boundary.</h2>
+                <div className="caps">
+                    <article className="cap">
+                        <span className="cap__k">Isolation</span>
+                        <h3>Scoped at the query</h3>
+                        <p>
+                            Every server, key, workflow, monitor and secret belongs to an organisation, and every lookup is filtered by it. Uniqueness constraints are enforced by the database, not by
+                            application logic.
+                        </p>
+                    </article>
+                    <article className="cap">
+                        <span className="cap__k">Roles</span>
+                        <h3>Owner, admin, member</h3>
+                        <p>Members operate the fleet. Admins and owners manage people, identity settings and the secrets read token.</p>
+                    </article>
+                    <article className="cap">
+                        <span className="cap__k">Identity</span>
+                        <h3>Local or OIDC, per organisation</h3>
+                        <p>Sign in with email and password, or connect your own provider. Each organisation configures its own issuer and client.</p>
+                    </article>
+                    <article className="cap">
+                        <span className="cap__k">Sessions</span>
+                        <h3>Server-side, 24 hours</h3>
+                        <p>Cookies carry an opaque identifier and nothing else. Session bodies live in Redis, so losing it signs everyone out and costs no durable data.</p>
+                    </article>
+                </div>
+            </section>
+
+            <section className="rail band">
+                <span className="tag">What we do not build</span>
+                <h2 style={{ fontSize: "var(--s-2)", marginTop: "0.7rem", maxWidth: "22ch" }}>The scope is the feature.</h2>
+                <div className="specs" style={{ maxWidth: "70ch" }}>
+                    <div className="spec">
+                        <span className="spec__k">NOT A PROXY</span>
+                        <div>
+                            <h3>We are never in the SSH path</h3>
+                            <p>Vantage assigns keys; your client connects straight to the box. If our control plane is down, your SSH still works.</p>
+                        </div>
+                    </div>
+                    <div className="spec">
+                        <span className="spec__k">NO CUSTODY</span>
+                        <div>
+                            <h3>Private keys stay put by default</h3>
+                            <p>Keys generated on a server stay on it unless you explicitly upload the private half, and anything stored is encrypted with a key only your deployment holds.</p>
+                        </div>
+                    </div>
+                    <div className="spec">
+                        <span className="spec__k">NO PER-USER</span>
+                        <div>
+                            <h3>Root, not every account</h3>
+                            <p>Vantage manages one file per server. Per-user key management is a different product with a different failure mode.</p>
+                        </div>
+                    </div>
+                    <div className="spec">
+                        <span className="spec__k">NO PLUGINS</span>
+                        <div>
+                            <h3>An agent you can read in an evening</h3>
+                            <p>A few thousand lines of Go with no extension system. Auditability beats extensibility on a binary that runs as root.</p>
+                        </div>
+                    </div>
+                </div>
+            </section>
+        </>
+    );
+}

site/app/pricing/page.tsx

@@ -0,0 +1,154 @@
+import Link from "next/link";
+import type { Metadata } from "next";
+
+export const metadata: Metadata = {
+  title: "Pricing",
+  description:
+    "Priced per managed server. People, keys, workflows and secrets are free. Free for 3 servers, £4 per server per month, or £290 a year self-hosted.",
+};
+
+const COMPARISON: [string, string, string, string][] = [
+  ["Managed servers", "3", "Unlimited", "Unlimited"],
+  ["Members", "1", "Unlimited", "Unlimited"],
+  ["SSH key assignment", "Yes", "Yes", "Yes"],
+  ["Workflows and step library", "Yes", "Yes", "Yes"],
+  ["Monitors", "3", "Unlimited", "Unlimited"],
+  ["Secrets vault", "No", "Yes", "Yes"],
+  ["Browser console", "No", "Yes", "Yes"],
+  ["OIDC single sign-on", "No", "Yes", "Yes"],
+  ["Audit history", "30 days", "Forever", "Forever"],
+  ["Runs on your hardware", "No", "No", "Yes"],
+  ["Support", "Community", "Next business day", "Priority"],
+];
+
+export default function PricingPage() {
+  return (
+    <section className="rail band band--open">
+      <span className="tag">Pricing</span>
+      <h1 style={{ fontSize: "var(--s-3)", margin: "0.8rem 0 1rem", maxWidth: "17ch" }}>
+        Per managed server. Nothing else counts.
+      </h1>
+      <p className="lede">
+        People are free. Keys, workflows, monitors and secrets are free. You pay for servers running an agent, because
+        that is the only number that grows with you.
+      </p>
+
+      <div className="plans">
+        <div className="plan">
+          <div>
+            <div className="plan__n">Solo</div>
+            <p className="plan__d">A homelab, a couple of VPSes, and the keys on your own laptop.</p>
+          </div>
+          <div className="plan__p">
+            £0 <span>forever</span>
+          </div>
+          <ul>
+            <li>Up to 3 servers</li>
+            <li>Keys, workflows and monitors</li>
+            <li>One member, one organisation</li>
+            <li>Community support</li>
+          </ul>
+          <Link className="btn btn--line" href="/start">
+            Get started
+          </Link>
+        </div>
+
+        <div className="plan plan--pick">
+          <div>
+            <div className="plan__n">Fleet</div>
+            <p className="plan__d">Real infrastructure, and more than one person holding the keys.</p>
+          </div>
+          <div className="plan__p">
+            £4 <span>/ server / month</span>
+          </div>
+          <ul>
+            <li>Unlimited servers and members</li>
+            <li>Owner, admin and member roles</li>
+            <li>OIDC single sign-on</li>
+            <li>Browser console and secrets vault</li>
+            <li>Full audit history</li>
+            <li>Email support, next business day</li>
+          </ul>
+          <Link className="btn btn--solid" href="/start">
+            Start 14-day trial
+          </Link>
+        </div>
+
+        <div className="plan">
+          <div>
+            <div className="plan__n">Self-hosted</div>
+            <p className="plan__d">The whole stack on your metal, behind your own boundary.</p>
+          </div>
+          <div className="plan__p">
+            £290 <span>/ year, per install</span>
+          </div>
+          <ul>
+            <li>Everything in Fleet, no server cap</li>
+            <li>Your MongoDB, Redis and certificates</li>
+            <li>Mirror agent releases internally</li>
+            <li>Priority support and upgrade notes</li>
+          </ul>
+          <Link className="btn btn--line" href="/contact">
+            Talk to us
+          </Link>
+        </div>
+      </div>
+
+      <div className="scroll">
+        <table className="cmp">
+          <thead>
+            <tr>
+              <th>Capability</th>
+              <th>Solo</th>
+              <th>Fleet</th>
+              <th>Self-hosted</th>
+            </tr>
+          </thead>
+          <tbody>
+            {COMPARISON.map(([capability, solo, fleet, selfHosted]) => (
+              <tr key={capability}>
+                <td>{capability}</td>
+                <td>{solo}</td>
+                <td>{fleet}</td>
+                <td>{selfHosted}</td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      </div>
+
+      <div style={{ marginTop: "3.2rem", maxWidth: "66ch" }}>
+        <span className="tag">Fine print, in plain words</span>
+        <div className="specs">
+          <div className="spec">
+            <span className="spec__k">COUNTING</span>
+            <div>
+              <h3>What counts as a server</h3>
+              <p>One running agent, one server. Remove a box and it stops billing that day.</p>
+            </div>
+          </div>
+          <div className="spec">
+            <span className="spec__k">LIMITS</span>
+            <div>
+              <h3>Going over on Solo</h3>
+              <p>
+                Nothing is deleted. A fourth agent registers and heartbeats, but stops syncing keys until you upgrade or
+                remove a server.
+              </p>
+            </div>
+          </div>
+          <div className="spec">
+            <span className="spec__k">EXIT</span>
+            <div>
+              <h3>Leaving</h3>
+              <p>
+                Export every server, key, workflow and secret group as JSON whenever you like. Agents keep their last
+                synced state on disk, so nobody is locked out mid-migration.
+              </p>
+            </div>
+          </div>
+        </div>
+      </div>
+    </section>
+  );
+}

site/app/start/page.tsx

@@ -0,0 +1,69 @@
+import type { Metadata } from "next";
+import { OrgForm } from "@/components/OrgForm";
+
+export const metadata: Metadata = {
+    title: "Vantage Cloud",
+    description: "An organisation owns its servers, keys, workflows, monitors and secrets. Free for three servers, hosted or self-hosted.",
+};
+
+export default function StartPage() {
+    return (
+        <section className="rail band band--open">
+            <div className="split">
+                <div>
+                    <span className="tag">Vantage Cloud</span>
+                    <h1 style={{ fontSize: "var(--s-3)", margin: "0.8rem 0 1rem", maxWidth: "15ch" }}>Set up your organisation.</h1>
+                    <p className="lede" style={{ fontSize: "var(--s-0)" }}>
+                        An organisation owns its servers, keys, workflows, monitors and secrets. Nothing inside it is visible to any other organisation. Confirm your email and it is created with you
+                        as its owner.
+                    </p>
+
+                    <div className="card" style={{ marginTop: "1.9rem" }}>
+                        <OrgForm />
+                    </div>
+                </div>
+
+                <div>
+                    <span className="tag">What happens next</span>
+                    <div className="specs">
+                        <div className="spec">
+                            <span className="spec__k">FIRST</span>
+                            <div>
+                                <h3>Confirm your email</h3>
+                                <p>We send a link that works once. Your organisation is created when you open it, not before.</p>
+                            </div>
+                        </div>
+                        <div className="spec">
+                            <span className="spec__k">THEN</span>
+                            <div>
+                                <h3>Add a key</h3>
+                                <p>
+                                    Paste the contents of <code>~/.ssh/id_ed25519.pub</code>. Vantage fingerprints it and refuses duplicates.
+                                </p>
+                            </div>
+                        </div>
+                        <div className="spec">
+                            <span className="spec__k">THEN</span>
+                            <div>
+                                <h3>Add a server</h3>
+                                <p>Run the install command as root. It expires in an hour and works once.</p>
+                            </div>
+                        </div>
+                        <div className="spec">
+                            <span className="spec__k">THEN</span>
+                            <div>
+                                <h3>Watch it register</h3>
+                                <p>The server moves from pending to active on first sync, usually inside 30 seconds.</p>
+                            </div>
+                        </div>
+                    </div>
+
+                    <pre className="code" style={{ marginTop: "1.8rem" }}>
+                        <b>curl</b> -fsSL https://vantage.hostxtra.co.uk/install | \{"\n"}
+                        {"  "}bash -s -- --server-id=<b>$ID</b> --token=<b>$TOKEN</b>
+                    </pre>
+                </div>
+            </div>
+        </section>
+    );
+}

site/components/ContactForm.tsx

@@ -0,0 +1,111 @@
+"use client";
+
+import { useState } from "react";
+import { Honeypot } from "@/components/Honeypot";
+import { submitContact, type SubmitResult } from "@/lib/submit";
+
+export function ContactForm() {
+  const [result, setResult] = useState<SubmitResult>({ state: "idle" });
+  const sending = result.state === "sending";
+
+  async function onSubmit(event: React.FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    const data = new FormData(event.currentTarget);
+    setResult({ state: "sending" });
+    setResult(
+      await submitContact({
+        name: String(data.get("name") ?? ""),
+        email: String(data.get("email") ?? ""),
+        servers: String(data.get("servers") ?? ""),
+        topic: String(data.get("topic") ?? ""),
+        message: String(data.get("message") ?? ""),
+        website: String(data.get("website") ?? ""),
+      })
+    );
+  }
+
+  if (result.state === "sent") {
+    return (
+      <div role="status">
+        <h2 style={{ fontSize: "var(--s-1)" }}>Message sent.</h2>
+        <p style={{ color: "var(--ink-2)", marginTop: "0.5rem" }}>
+          We reply within one business day. If it is urgent, email support@hostxtra.co.uk directly.
+        </p>
+      </div>
+    );
+  }
+
+  const fieldError = (name: string) => result.fields?.[name];
+
+  return (
+    <form className="form" onSubmit={onSubmit} noValidate>
+      <Honeypot />
+
+      <div className="field">
+        <label htmlFor="c-name">Your name</label>
+        <input id="c-name" name="name" type="text" autoComplete="name" required aria-describedby="c-name-err" />
+        {fieldError("name") && (
+          <small id="c-name-err" className="field__err">
+            {fieldError("name")}
+          </small>
+        )}
+      </div>
+
+      <div className="field">
+        <label htmlFor="c-email">Work email</label>
+        <input id="c-email" name="email" type="email" autoComplete="email" required aria-describedby="c-email-err" />
+        {fieldError("email") && (
+          <small id="c-email-err" className="field__err">
+            {fieldError("email")}
+          </small>
+        )}
+      </div>
+
+      <div className="field">
+        <label htmlFor="c-servers">Roughly how many servers?</label>
+        <select id="c-servers" name="servers" defaultValue="4–25">
+          <option>1–3</option>
+          <option>4–25</option>
+          <option>26–100</option>
+          <option>More than 100</option>
+        </select>
+      </div>
+
+      <div className="field">
+        <label htmlFor="c-topic">What is this about?</label>
+        <select id="c-topic" name="topic" defaultValue="Evaluating Vantage">
+          <option>Evaluating Vantage</option>
+          <option>Self-hosted licensing</option>
+          <option>Migrating from something else</option>
+          <option>Security disclosure</option>
+        </select>
+      </div>
+
+      <div className="field">
+        <label htmlFor="c-message">What are you trying to solve?</label>
+        <textarea
+          id="c-message"
+          name="message"
+          required
+          placeholder="We inherit client servers and can never prove who still has access…"
+          aria-describedby="c-message-err"
+        />
+        {fieldError("message") && (
+          <small id="c-message-err" className="field__err">
+            {fieldError("message")}
+          </small>
+        )}
+      </div>
+
+      <button className="btn btn--solid" type="submit" style={{ alignSelf: "flex-start" }} disabled={sending}>
+        {sending ? "Sending…" : "Send message"}
+      </button>
+
+      {result.state === "error" && result.message && (
+        <p className="field__err" role="alert">
+          {result.message}
+        </p>
+      )}
+    </form>
+  );
+}

site/components/Footer.tsx

@@ -0,0 +1,18 @@
+import Link from "next/link";
+import { NAV_LINKS } from "@/components/nav-links";
+
+export function Footer() {
+  return (
+    <footer className="foot">
+      <div className="rail foot__in">
+        <p>Vantage self-hosted fleet control for people who own their servers.</p>
+        {NAV_LINKS.map((link) => (
+          <Link key={link.href} href={link.href}>
+            {link.label}
+          </Link>
+        ))}
+        <Link href="/start">Get started</Link>
+      </div>
+    </footer>
+  );
+}