feat: multi-tenant SaaS — orgs, auth, per-org isolation

Converts Vantage from a single-admin self-hosted app into a multi-tenant
SaaS. Org isolation is org_id row-scoping in one shared deployment and
database; each org gets a subdomain via wildcard DNS, but the hostname is
a routing hint and never an authorization boundary.

- Orgs, users and roles (owner|admin|member) with local password auth,
  first-run bootstrap, and per-org OIDC replacing the global provider
- Redis sessions carrying org and role; host/session mismatch guard
- Every tenant-scoped collection carries org_id; handlers take org from
  the session only, never from client input
- Agent gRPC path resolves org from the servers record, so agent configs
  and the shared gRPC host are unchanged
- Per-org settings and ESO read token, replacing global singletons
- Frontend: login, setup and org settings pages; org-aware AuthProvider
- Migrations 0001-0003 backfill an existing single-tenant instance

Reviewed per task plus a whole-branch and a migration-focused pass.

.gitea/workflows/agent-release.yml

@@ -86,22 +86,6 @@ jobs:
                   $env:GOOS = "windows"; $env:GOARCH = "amd64"
                   go build -ldflags="-s -w -X main.Version=$env:VERSION" -o ../installer/vantage-agent-windows-amd64.exe ./cmd
 
-            - name: Cache nssm
-              id: cache-nssm
-              uses: actions/cache@v4
-              with:
-                  path: installer/nssm.exe
-                  key: nssm-2.24-win64
-
-            - name: Fetch nssm
-              if: steps.cache-nssm.outputs.cache-hit != 'true'
-              working-directory: installer
-              shell: pwsh
-              run: |
-                  Invoke-WebRequest -Uri https://nssm.cc/release/nssm-2.24.zip -OutFile nssm.zip
-                  Expand-Archive -Path nssm.zip -DestinationPath nssm-extract -Force
-                  Copy-Item nssm-extract/nssm-2.24/win64/nssm.exe -Destination nssm.exe
-
             - name: Install WiX
               shell: pwsh
               run: dotnet tool install --global wix --version 5.*

.gitignore

@@ -4,7 +4,7 @@ build
 .env
 docs
 .superpowers
-installer/*.exe
+installer/vantage-agent-windows-amd64.exe
 installer/*.msi
 installer/nssm.zip
 installer/checksums-msi.txt

agent/internal/checker/checker.go

@@ -0,0 +1,226 @@
+// Package checker runs service checks (http/tcp/icmp/tls) and returns a uniform
+// Result. It has no dependency on models or pb so it can be duplicated verbatim
+// into the agent module (agent-run monitors) — callers map their own monitor
+// representation onto Spec.
+package checker
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+)
+
+// Check types (mirror models.Monitor* constants).
+const (
+	TypeHTTP = "http"
+	TypeTCP  = "tcp"
+	TypeICMP = "icmp"
+	TypeTLS  = "tls"
+)
+
+// Spec is a self-contained description of a single check.
+type Spec struct {
+	Type           string
+	URL            string
+	Host           string
+	Port           int
+	Method         string
+	ExpectedStatus int
+	Keyword        string
+	TLSWarnDays    int
+	Insecure       bool // skip TLS certificate verification (HTTP checks)
+	TimeoutSec     int
+}
+
+// Result is the uniform outcome of running a check.
+type Result struct {
+	Up         bool
+	LatencyMs  int
+	Message    string
+	CertExpiry *time.Time
+}
+
+func (s Spec) timeout() time.Duration {
+	t := s.TimeoutSec
+	if t <= 0 || t > 10 {
+		t = 10
+	}
+	return time.Duration(t) * time.Second
+}
+
+// Run executes the check described by s.
+func Run(ctx context.Context, s Spec) Result {
+	switch s.Type {
+	case TypeHTTP:
+		return runHTTP(ctx, s)
+	case TypeTCP:
+		return runTCP(ctx, s)
+	case TypeICMP:
+		return runICMP(ctx, s)
+	case TypeTLS:
+		return runTLS(ctx, s)
+	default:
+		return Result{Message: "unknown check type: " + s.Type}
+	}
+}
+
+func runHTTP(ctx context.Context, s Spec) Result {
+	method := s.Method
+	if method == "" {
+		method = http.MethodGet
+	}
+	expect := s.ExpectedStatus
+	if expect == 0 {
+		expect = 200
+	}
+	client := &http.Client{Timeout: s.timeout()}
+	if s.Insecure {
+		client.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec // opt-in per monitor
+	}
+	start := time.Now()
+	req, err := http.NewRequestWithContext(ctx, method, s.URL, nil)
+	if err != nil {
+		return Result{Message: err.Error()}
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	defer resp.Body.Close()
+	res := Result{LatencyMs: msSince(start), Up: true}
+	if resp.TLS != nil && len(resp.TLS.PeerCertificates) > 0 {
+		exp := resp.TLS.PeerCertificates[0].NotAfter
+		res.CertExpiry = &exp
+	}
+	if resp.StatusCode != expect {
+		return Result{LatencyMs: res.LatencyMs, CertExpiry: res.CertExpiry, Message: fmt.Sprintf("status %d (want %d)", resp.StatusCode, expect)}
+	}
+	if s.Keyword != "" {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+		if !strings.Contains(string(body), s.Keyword) {
+			return Result{LatencyMs: res.LatencyMs, CertExpiry: res.CertExpiry, Message: "keyword not found"}
+		}
+	}
+	return res
+}
+
+func runTCP(ctx context.Context, s Spec) Result {
+	addr := net.JoinHostPort(s.Host, fmt.Sprint(s.Port))
+	start := time.Now()
+	d := net.Dialer{Timeout: s.timeout()}
+	conn, err := d.DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	conn.Close()
+	return Result{Up: true, LatencyMs: msSince(start)}
+}
+
+func runTLS(ctx context.Context, s Spec) Result {
+	port := s.Port
+	if port == 0 {
+		port = 443
+	}
+	addr := net.JoinHostPort(s.Host, fmt.Sprint(port))
+	start := time.Now()
+	d := net.Dialer{Timeout: s.timeout()}
+	conn, err := tls.DialWithDialer(&d, "tcp", addr, &tls.Config{ServerName: s.Host})
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	defer conn.Close()
+	certs := conn.ConnectionState().PeerCertificates
+	if len(certs) == 0 {
+		return Result{LatencyMs: msSince(start), Message: "no peer certificate"}
+	}
+	exp := certs[0].NotAfter
+	res := Result{LatencyMs: msSince(start), CertExpiry: &exp}
+	warn := s.TLSWarnDays
+	if warn <= 0 {
+		warn = 14
+	}
+	remaining := time.Until(exp)
+	if remaining <= 0 {
+		res.Message = "certificate expired"
+		return res
+	}
+	if remaining <= time.Duration(warn)*24*time.Hour {
+		res.Message = fmt.Sprintf("certificate expires in %d days", int(remaining.Hours()/24))
+		return res
+	}
+	res.Up = true
+	return res
+}
+
+func msSince(t time.Time) int { return int(time.Since(t).Milliseconds()) }
+
+// runICMP sends a single ICMP echo request and waits for the reply. Requires
+// raw-socket privileges (the agent and server run as root). Returns down with a
+// descriptive message when the socket cannot be opened or no reply arrives.
+func runICMP(ctx context.Context, s Spec) Result {
+	dst, err := net.ResolveIPAddr("ip4", s.Host)
+	if err != nil {
+		return Result{Message: err.Error()}
+	}
+	conn, err := net.ListenPacket("ip4:icmp", "0.0.0.0")
+	if err != nil {
+		return Result{Message: "icmp socket: " + err.Error()}
+	}
+	defer conn.Close()
+
+	id := os.Getpid() & 0xffff
+	pkt := icmpEcho(id, 1)
+	deadline := time.Now().Add(s.timeout())
+	if d, ok := ctx.Deadline(); ok && d.Before(deadline) {
+		deadline = d
+	}
+	_ = conn.SetDeadline(deadline)
+
+	start := time.Now()
+	if _, err := conn.WriteTo(pkt, dst); err != nil {
+		return Result{Message: err.Error()}
+	}
+	reply := make([]byte, 1500)
+	for {
+		n, peer, err := conn.ReadFrom(reply)
+		if err != nil {
+			return Result{LatencyMs: msSince(start), Message: "no reply"}
+		}
+		// Skip the IPv4 header (20 bytes) to reach the ICMP message.
+		if n < 28 || peer.String() != dst.String() {
+			continue
+		}
+		if reply[20] == 0 { // ICMP echo reply type
+			return Result{Up: true, LatencyMs: msSince(start)}
+		}
+	}
+}
+
+func icmpEcho(id, seq int) []byte {
+	// Type(8)=echo request, Code=0, Checksum, ID, Seq, no payload.
+	b := []byte{8, 0, 0, 0, byte(id >> 8), byte(id), byte(seq >> 8), byte(seq)}
+	cs := icmpChecksum(b)
+	b[2] = byte(cs >> 8)
+	b[3] = byte(cs)
+	return b
+}
+
+func icmpChecksum(b []byte) uint16 {
+	var sum uint32
+	for i := 0; i < len(b)-1; i += 2 {
+		sum += uint32(b[i])<<8 | uint32(b[i+1])
+	}
+	if len(b)%2 == 1 {
+		sum += uint32(b[len(b)-1]) << 8
+	}
+	for sum>>16 != 0 {
+		sum = (sum & 0xffff) + (sum >> 16)
+	}
+	return ^uint16(sum)
+}

agent/internal/exec/exec.go

@@ -0,0 +1,164 @@
+package exec
+
+import (
+	"bufio"
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/mrhid6/vantage/agent/internal/grpc/pb"
+)
+
+// streamWriter forwards every write to emit() as an ordered chunk. Used as both
+// Stdout and Stderr so output interleaves in real execution order. The mutex
+// ensures a single stdout/stderr write is not interleaved mid-slice with another.
+type streamWriter struct {
+	mu   sync.Mutex
+	seq  uint64
+	emit func(seq uint64, data []byte)
+}
+
+func (w *streamWriter) Write(p []byte) (int, error) {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if w.emit != nil {
+		buf := make([]byte, len(p))
+		copy(buf, p)
+		w.emit(w.seq, buf)
+		w.seq++
+	}
+	return len(p), nil
+}
+
+// WorkspacePath returns the per-run working directory for a workspace id. The
+// same id always maps to the same path so RunStep and the cleanup command agree.
+func WorkspacePath(workspaceID string) string {
+	return filepath.Join(os.TempDir(), "vantage-run-"+workspaceID)
+}
+
+// RunStep writes the script to a temp file, provides a WORKFLOW_ENV file for
+// the script to append KEY=value output to, executes it under the requested
+// interpreter, and streams output via emit, returning the terminal result
+// with empty stdout/stderr but populated exit_code/output_env.
+//
+// When the command carries a WorkspaceId the step runs with that per-run working
+// directory as its cwd (created here if missing); the server removes it once the
+// run finishes. The script and env files always live in a private temp dir so
+// they never leak into the shared workspace.
+func RunStep(cmd *pb.RunStepCmd, emit func(seq uint64, data []byte)) *pb.StepResult {
+	res := &pb.StepResult{CommandId: "", OutputEnv: map[string]string{}}
+
+	dir, err := os.MkdirTemp("", "vantage-step-")
+	if err != nil {
+		res.ExitCode = 1
+		res.Stderr = "create temp dir: " + err.Error()
+		return res
+	}
+	defer os.RemoveAll(dir)
+
+	workDir := ""
+	if cmd.WorkspaceId != "" {
+		workDir = WorkspacePath(cmd.WorkspaceId)
+		if err := os.MkdirAll(workDir, 0700); err != nil {
+			res.ExitCode = 1
+			res.Stderr = "create workspace: " + err.Error()
+			return res
+		}
+	}
+
+	envFile := filepath.Join(dir, "workflow_env")
+	if err := os.WriteFile(envFile, nil, 0600); err != nil {
+		res.ExitCode = 1
+		res.Stderr = "create env file: " + err.Error()
+		return res
+	}
+
+	var scriptPath string
+	var c *exec.Cmd
+	timeout := time.Duration(cmd.TimeoutSeconds) * time.Second
+	if timeout <= 0 {
+		timeout = 30 * time.Minute
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+
+	switch cmd.Interpreter {
+	case "powershell":
+		scriptPath = filepath.Join(dir, "step.ps1")
+		if err := os.WriteFile(scriptPath, []byte(cmd.Script), 0600); err != nil {
+			res.ExitCode = 1
+			res.Stderr = err.Error()
+			return res
+		}
+		shell := "pwsh"
+		if runtime.GOOS == "windows" {
+			if _, err := exec.LookPath("pwsh"); err != nil {
+				shell = "powershell.exe"
+			}
+		}
+		c = exec.CommandContext(ctx, shell, "-NoProfile", "-NonInteractive", "-File", scriptPath)
+	default: // "bash"
+		scriptPath = filepath.Join(dir, "step.sh")
+		if err := os.WriteFile(scriptPath, []byte(cmd.Script), 0700); err != nil {
+			res.ExitCode = 1
+			res.Stderr = err.Error()
+			return res
+		}
+		c = exec.CommandContext(ctx, "bash", scriptPath)
+	}
+
+	if workDir != "" {
+		c.Dir = workDir
+	}
+
+	c.Env = append(os.Environ(), "WORKFLOW_ENV="+envFile)
+	for k, v := range cmd.Env {
+		c.Env = append(c.Env, k+"="+v)
+	}
+
+	sw := &streamWriter{emit: emit}
+	c.Stdout = sw
+	c.Stderr = sw
+	runErr := c.Run()
+
+	// stdout/stderr are streamed via emit, not returned in the result.
+	if ctx.Err() == context.DeadlineExceeded {
+		res.ExitCode = 124
+		res.Stderr = "[vantage] step timed out"
+	} else if ee, ok := runErr.(*exec.ExitError); ok {
+		res.ExitCode = ee.ExitCode()
+	} else if runErr != nil {
+		res.ExitCode = 1
+		res.Stderr = "[vantage] " + runErr.Error()
+	}
+
+	res.OutputEnv = parseEnvFile(envFile)
+	return res
+}
+
+// parseEnvFile reads KEY=value lines (last write wins). Blank lines and lines
+// without '=' are ignored.
+func parseEnvFile(path string) map[string]string {
+	out := map[string]string{}
+	f, err := os.Open(path)
+	if err != nil {
+		return out
+	}
+	defer f.Close()
+	sc := bufio.NewScanner(f)
+	sc.Buffer(make([]byte, 0, 64*1024), 1024*1024)
+	for sc.Scan() {
+		line := sc.Text()
+		i := strings.IndexByte(line, '=')
+		if i <= 0 {
+			continue
+		}
+		out[line[:i]] = line[i+1:]
+	}
+	return out
+}

agent/internal/grpc/client.go

@@ -126,6 +126,30 @@ func (c *Client) ReportUpdates(serverID, agentToken string, updates []pb.Package
 	return err
 }
 
+func (c *Client) ReportInventory(report *pb.InventoryReport) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	_, err := c.client.ReportInventory(ctx, report)
+	return err
+}
+
+func (c *Client) SyncMonitors(serverID, agentToken string) ([]pb.MonitorSpec, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	resp, err := c.client.SyncMonitors(ctx, &pb.SyncMonitorsRequest{ServerId: serverID, AgentToken: agentToken})
+	if err != nil {
+		return nil, err
+	}
+	return resp.Monitors, nil
+}
+
+func (c *Client) ReportChecks(serverID, agentToken string, results []pb.CheckResult) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	_, err := c.client.ReportChecks(ctx, &pb.ReportChecksRequest{ServerId: serverID, AgentToken: agentToken, Results: results})
+	return err
+}
+
 // CommandStream opens a long-lived bidirectional stream for server-pushed commands.
 // The caller controls the stream lifetime via ctx.
 func (c *Client) CommandStream(ctx context.Context) (pb.Vantage_CommandStreamClient, error) {

agent/internal/grpc/pb/vantage.pb.go

@@ -60,14 +60,91 @@ type ReportUpdatesRequest struct {
 
 type ReportUpdatesResponse struct{}
 
+// Inventory report message types
+
+type CPUReport struct {
+	Model    string  `json:"model,omitempty"`
+	Cores    int     `json:"cores,omitempty"`
+	UsagePct float64 `json:"usage_pct"`
+	Load1    float64 `json:"load1,omitempty"`
+}
+type MemReport struct {
+	TotalBytes uint64 `json:"total_bytes"`
+	UsedBytes  uint64 `json:"used_bytes"`
+}
+type PartitionReport struct {
+	Device     string `json:"device"`
+	Mountpoint string `json:"mountpoint"`
+	Fstype     string `json:"fstype,omitempty"`
+	TotalBytes uint64 `json:"total_bytes"`
+	UsedBytes  uint64 `json:"used_bytes"`
+}
+type InventoryReport struct {
+	ServerId      string            `json:"server_id"`
+	AgentToken    string            `json:"agent_token"`
+	IncludeStatic bool              `json:"include_static"`
+	CPU           *CPUReport        `json:"cpu,omitempty"`
+	Memory        *MemReport        `json:"memory,omitempty"`
+	SwapTotal     uint64            `json:"swap_total"`
+	SwapUsed      uint64            `json:"swap_used"`
+	Partitions    []PartitionReport `json:"partitions,omitempty"`
+	Kernel        string            `json:"kernel,omitempty"`
+}
+type InventoryReportResponse struct{}
+
+// Monitor sync / check report message types
+
+type MonitorSpec struct {
+	MonitorId      string `json:"monitor_id"`
+	Type           string `json:"type"`
+	URL            string `json:"url,omitempty"`
+	Host           string `json:"host,omitempty"`
+	Port           int    `json:"port,omitempty"`
+	Method         string `json:"method,omitempty"`
+	ExpectedStatus int    `json:"expected_status,omitempty"`
+	Keyword        string `json:"keyword,omitempty"`
+	TLSWarnDays    int    `json:"tls_warn_days,omitempty"`
+	Insecure       bool   `json:"insecure,omitempty"`
+	IntervalSec    int    `json:"interval_sec"`
+	Retries        int    `json:"retries"`
+}
+type SyncMonitorsRequest struct {
+	ServerId   string `json:"server_id"`
+	AgentToken string `json:"agent_token"`
+}
+type SyncMonitorsResponse struct {
+	Monitors []MonitorSpec `json:"monitors,omitempty"`
+}
+type CheckResult struct {
+	MonitorId      string `json:"monitor_id"`
+	Up             bool   `json:"up"`
+	LatencyMs      int    `json:"latency_ms"`
+	Message        string `json:"message,omitempty"`
+	CertExpiryUnix int64  `json:"cert_expiry_unix,omitempty"`
+}
+type ReportChecksRequest struct {
+	ServerId   string        `json:"server_id"`
+	AgentToken string        `json:"agent_token"`
+	Results    []CheckResult `json:"results,omitempty"`
+}
+type ReportChecksResponse struct{}
+
 type ApplyUpdatesCmd struct{}
 
 type ServerCommand struct {
-	CommandId    string           `json:"command_id"`
-	GenerateKey  *GenerateKeyCmd  `json:"generate_key,omitempty"`
-	DeleteKey    *DeleteKeyCmd    `json:"delete_key,omitempty"`
-	UpdateAgent  *UpdateAgentCmd  `json:"update_agent,omitempty"`
-	ApplyUpdates *ApplyUpdatesCmd `json:"apply_updates,omitempty"`
+	CommandId        string               `json:"command_id"`
+	GenerateKey      *GenerateKeyCmd      `json:"generate_key,omitempty"`
+	DeleteKey        *DeleteKeyCmd        `json:"delete_key,omitempty"`
+	UpdateAgent      *UpdateAgentCmd      `json:"update_agent,omitempty"`
+	ApplyUpdates     *ApplyUpdatesCmd     `json:"apply_updates,omitempty"`
+	RunStep          *RunStepCmd          `json:"run_step,omitempty"`
+	CleanupWorkspace *CleanupWorkspaceCmd `json:"cleanup_workspace,omitempty"`
+}
+
+// CleanupWorkspaceCmd tells the agent to recursively remove the run's working
+// directory once all steps on that server have finished.
+type CleanupWorkspaceCmd struct {
+	WorkspaceId string `json:"workspace_id"`
 }
 
 type DeleteKeyCmd struct {
@@ -88,10 +165,12 @@ type GenerateKeyCmd struct {
 }
 
 type AgentMessage struct {
-	ServerId   string         `json:"server_id"`
-	AgentToken string         `json:"agent_token"`
-	Ready      *AgentReady    `json:"ready,omitempty"`
-	Result     *CommandResult `json:"result,omitempty"`
+	ServerId   string            `json:"server_id"`
+	AgentToken string            `json:"agent_token"`
+	Ready      *AgentReady       `json:"ready,omitempty"`
+	Result     *CommandResult    `json:"result,omitempty"`
+	StepResult *StepResult       `json:"step_result,omitempty"`
+	StepOutput *StepOutputChunk  `json:"step_output,omitempty"`
 }
 
 type AgentReady struct{}
@@ -102,6 +181,31 @@ type CommandResult struct {
 	Message   string `json:"message"`
 }
 
+type RunStepCmd struct {
+	Interpreter    string            `json:"interpreter"`
+	Script         string            `json:"script"`
+	Env            map[string]string `json:"env,omitempty"`
+	TimeoutSeconds int               `json:"timeout_seconds,omitempty"`
+	// WorkspaceId names the per-run working directory the agent creates and uses
+	// as the step's cwd. Empty means run in the agent's default directory.
+	WorkspaceId string `json:"workspace_id,omitempty"`
+}
+
+type StepResult struct {
+	CommandId string            `json:"command_id"`
+	ExitCode  int               `json:"exit_code"`
+	Stdout    string            `json:"stdout,omitempty"`
+	Stderr    string            `json:"stderr,omitempty"`
+	OutputEnv map[string]string `json:"output_env,omitempty"`
+}
+
+type StepOutputChunk struct {
+	CommandId string `json:"command_id"`
+	Seq       uint64 `json:"seq"`
+	Data      []byte `json:"data,omitempty"`
+	Eof       bool   `json:"eof,omitempty"`
+}
+
 // CommandStream client-side interface
 
 type Vantage_CommandStreamClient interface {
@@ -155,6 +259,9 @@ type VantageClient interface {
 	SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error)
 	UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error)
 	ReportUpdates(ctx context.Context, in *ReportUpdatesRequest, opts ...grpc.CallOption) (*ReportUpdatesResponse, error)
+	ReportInventory(ctx context.Context, in *InventoryReport, opts ...grpc.CallOption) (*InventoryReportResponse, error)
+	SyncMonitors(ctx context.Context, in *SyncMonitorsRequest, opts ...grpc.CallOption) (*SyncMonitorsResponse, error)
+	ReportChecks(ctx context.Context, in *ReportChecksRequest, opts ...grpc.CallOption) (*ReportChecksResponse, error)
 	CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error)
 }
 
@@ -210,6 +317,30 @@ func (c *keyManagerClient) ReportUpdates(ctx context.Context, in *ReportUpdatesR
 	return out, nil
 }
 
+func (c *keyManagerClient) ReportInventory(ctx context.Context, in *InventoryReport, opts ...grpc.CallOption) (*InventoryReportResponse, error) {
+	out := new(InventoryReportResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/ReportInventory", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) SyncMonitors(ctx context.Context, in *SyncMonitorsRequest, opts ...grpc.CallOption) (*SyncMonitorsResponse, error) {
+	out := new(SyncMonitorsResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/SyncMonitors", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) ReportChecks(ctx context.Context, in *ReportChecksRequest, opts ...grpc.CallOption) (*ReportChecksResponse, error) {
+	out := new(ReportChecksResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/ReportChecks", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *keyManagerClient) CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error) {
 	desc := &grpc.StreamDesc{StreamName: "CommandStream", ServerStreams: true, ClientStreams: true}
 	stream, err := c.cc.NewStream(ctx, desc, "/vantage.v1.Vantage/CommandStream", opts...)

agent/internal/inventory/collect_linux.go

@@ -0,0 +1,157 @@
+//go:build linux
+
+package inventory
+
+import (
+	"bufio"
+	"os"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/mrhid6/vantage/agent/internal/grpc/pb"
+)
+
+func collect(r *pb.InventoryReport, includeStatic bool) {
+	r.CPU.UsagePct = cpuUsage()
+	r.CPU.Load1 = load1()
+	memTotal, memAvail, swapTotal, swapFree := meminfo()
+	if memTotal > memAvail {
+		r.Memory.UsedBytes = memTotal - memAvail
+	}
+	if swapTotal > swapFree {
+		r.SwapUsed = swapTotal - swapFree
+	}
+	if includeStatic {
+		r.Memory.TotalBytes = memTotal
+		r.SwapTotal = swapTotal
+		r.CPU.Model, r.CPU.Cores = cpuStatic()
+		r.Kernel = kernel()
+		r.Partitions = partitions()
+	}
+}
+
+func readProc(path string) string { b, _ := os.ReadFile(path); return string(b) }
+
+func cpuSample() (idle, total uint64) {
+	f, err := os.Open("/proc/stat")
+	if err != nil {
+		return
+	}
+	defer f.Close()
+	sc := bufio.NewScanner(f)
+	if sc.Scan() {
+		fields := strings.Fields(sc.Text()) // cpu user nice system idle iowait ...
+		for i, v := range fields[1:] {
+			n, _ := strconv.ParseUint(v, 10, 64)
+			total += n
+			if i == 3 { // idle
+				idle = n
+			}
+		}
+	}
+	return
+}
+
+func cpuUsage() float64 {
+	i1, t1 := cpuSample()
+	time.Sleep(100 * time.Millisecond)
+	i2, t2 := cpuSample()
+	dt := float64(t2 - t1)
+	if dt <= 0 {
+		return 0
+	}
+	return (1 - float64(i2-i1)/dt) * 100
+}
+
+func load1() float64 {
+	fields := strings.Fields(readProc("/proc/loadavg"))
+	if len(fields) > 0 {
+		v, _ := strconv.ParseFloat(fields[0], 64)
+		return v
+	}
+	return 0
+}
+
+func meminfo() (total, avail, swapTotal, swapFree uint64) {
+	f, err := os.Open("/proc/meminfo")
+	if err != nil {
+		return
+	}
+	defer f.Close()
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		fields := strings.Fields(sc.Text())
+		if len(fields) < 2 {
+			continue
+		}
+		kb, _ := strconv.ParseUint(fields[1], 10, 64)
+		b := kb * 1024
+		switch strings.TrimSuffix(fields[0], ":") {
+		case "MemTotal":
+			total = b
+		case "MemAvailable":
+			avail = b
+		case "SwapTotal":
+			swapTotal = b
+		case "SwapFree":
+			swapFree = b
+		}
+	}
+	return
+}
+
+func cpuStatic() (model string, cores int) {
+	f, err := os.Open("/proc/cpuinfo")
+	if err != nil {
+		return
+	}
+	defer f.Close()
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		line := sc.Text()
+		if strings.HasPrefix(line, "processor") {
+			cores++
+		} else if strings.HasPrefix(line, "model name") && model == "" {
+			if i := strings.Index(line, ":"); i >= 0 {
+				model = strings.TrimSpace(line[i+1:])
+			}
+		}
+	}
+	return
+}
+
+func kernel() string {
+	return strings.TrimSpace(readProc("/proc/sys/kernel/osrelease"))
+}
+
+func partitions() []pb.PartitionReport {
+	allowed := map[string]bool{"ext4": true, "xfs": true, "btrfs": true, "zfs": true, "vfat": true, "ntfs": true, "ext3": true}
+	f, err := os.Open("/proc/mounts")
+	if err != nil {
+		return nil
+	}
+	defer f.Close()
+	var out []pb.PartitionReport
+	seen := map[string]bool{}
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		fields := strings.Fields(sc.Text())
+		if len(fields) < 3 || !allowed[fields[2]] || seen[fields[1]] {
+			continue
+		}
+		seen[fields[1]] = true
+		var st syscall.Statfs_t
+		if syscall.Statfs(fields[1], &st) != nil {
+			continue
+		}
+		total := st.Blocks * uint64(st.Bsize)
+		free := st.Bavail * uint64(st.Bsize)
+		out = append(out, pb.PartitionReport{
+			Device: fields[0], Mountpoint: fields[1], Fstype: fields[2],
+			TotalBytes: total, UsedBytes: total - free,
+		})
+	}
+	return out
+}

agent/internal/inventory/collect_other.go

@@ -0,0 +1,8 @@
+//go:build !linux
+
+package inventory
+
+import "github.com/mrhid6/vantage/agent/internal/grpc/pb"
+
+// collect is a no-op best-effort stub on non-Linux platforms.
+func collect(r *pb.InventoryReport, includeStatic bool) {}

agent/internal/inventory/inventory.go

@@ -0,0 +1,11 @@
+package inventory
+
+import "github.com/mrhid6/vantage/agent/internal/grpc/pb"
+
+// Collect gathers metrics always and static hardware info when includeStatic.
+// Platform specifics are provided by collect_linux.go / collect_other.go.
+func Collect(includeStatic bool) *pb.InventoryReport {
+	r := &pb.InventoryReport{IncludeStatic: includeStatic, CPU: &pb.CPUReport{}, Memory: &pb.MemReport{}}
+	collect(r, includeStatic)
+	return r
+}

agent/internal/monitors/monitors.go

@@ -0,0 +1,166 @@
+// Package monitors runs agent-side service checks. It polls the server for the
+// monitors assigned to this agent (SyncMonitors), runs each on its own interval
+// using the local checker package, and reports results back (ReportChecks).
+package monitors
+
+import (
+	"context"
+	"log"
+	"sync"
+	"time"
+
+	"github.com/mrhid6/vantage/agent/internal/checker"
+	"github.com/mrhid6/vantage/agent/internal/config"
+	grpcclient "github.com/mrhid6/vantage/agent/internal/grpc"
+	"github.com/mrhid6/vantage/agent/internal/grpc/pb"
+)
+
+// syncInterval controls how often the agent re-fetches its assigned monitors.
+const syncInterval = 30 * time.Second
+
+type runner struct {
+	intervalSec int
+	cancel      context.CancelFunc
+}
+
+// Run starts the agent monitor loop and blocks until ctx is cancelled.
+func Run(ctx context.Context, cfg *config.Config) {
+	active := map[string]*runner{}
+	var mu sync.Mutex
+
+	// results is a shared channel every check writes to; a single reporter
+	// goroutine batches and ships them so we make one ReportChecks call per tick.
+	results := make(chan pb.CheckResult, 64)
+	go reporter(ctx, cfg, results)
+
+	syncOnce := func() {
+		specs, err := fetchSpecs(cfg)
+		if err != nil {
+			log.Printf("monitors: sync: %v", err)
+			return
+		}
+		want := map[string]pb.MonitorSpec{}
+		for _, s := range specs {
+			want[s.MonitorId] = s
+		}
+
+		mu.Lock()
+		defer mu.Unlock()
+		for id, r := range active {
+			s, ok := want[id]
+			if !ok || s.IntervalSec != r.intervalSec {
+				r.cancel()
+				delete(active, id)
+			}
+		}
+		for id, s := range want {
+			if _, ok := active[id]; ok {
+				continue
+			}
+			rctx, cancel := context.WithCancel(ctx)
+			active[id] = &runner{intervalSec: s.IntervalSec, cancel: cancel}
+			go runSpec(rctx, s, results)
+		}
+	}
+
+	syncOnce()
+	t := time.NewTicker(syncInterval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			syncOnce()
+		}
+	}
+}
+
+func fetchSpecs(cfg *config.Config) ([]pb.MonitorSpec, error) {
+	client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+	if err != nil {
+		return nil, err
+	}
+	defer client.Close()
+	return client.SyncMonitors(cfg.ServerID, cfg.AgentToken)
+}
+
+func runSpec(ctx context.Context, s pb.MonitorSpec, out chan<- pb.CheckResult) {
+	interval := time.Duration(s.IntervalSec) * time.Second
+	if interval <= 0 {
+		interval = 60 * time.Second
+	}
+	spec := checker.Spec{
+		Type:           s.Type,
+		URL:            s.URL,
+		Host:           s.Host,
+		Port:           s.Port,
+		Method:         s.Method,
+		ExpectedStatus: s.ExpectedStatus,
+		Keyword:        s.Keyword,
+		TLSWarnDays:    s.TLSWarnDays,
+		Insecure:       s.Insecure,
+		TimeoutSec:     s.IntervalSec,
+	}
+
+	run := func() {
+		res := checker.Run(ctx, spec)
+		cr := pb.CheckResult{MonitorId: s.MonitorId, Up: res.Up, LatencyMs: res.LatencyMs, Message: res.Message}
+		if res.CertExpiry != nil {
+			cr.CertExpiryUnix = res.CertExpiry.Unix()
+		}
+		select {
+		case out <- cr:
+		case <-ctx.Done():
+		}
+	}
+
+	run()
+	t := time.NewTicker(interval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			run()
+		}
+	}
+}
+
+// reporter batches results on a short interval and ships each batch in one call.
+func reporter(ctx context.Context, cfg *config.Config, in <-chan pb.CheckResult) {
+	t := time.NewTicker(5 * time.Second)
+	defer t.Stop()
+	var batch []pb.CheckResult
+	flush := func() {
+		if len(batch) == 0 {
+			return
+		}
+		client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+		if err != nil {
+			log.Printf("monitors: report dial: %v", err)
+			batch = nil
+			return
+		}
+		if err := client.ReportChecks(cfg.ServerID, cfg.AgentToken, batch); err != nil {
+			log.Printf("monitors: report: %v", err)
+		}
+		client.Close()
+		batch = nil
+	}
+	for {
+		select {
+		case <-ctx.Done():
+			flush()
+			return
+		case r := <-in:
+			batch = append(batch, r)
+			if len(batch) >= 32 {
+				flush()
+			}
+		case <-t.C:
+			flush()
+		}
+	}
+}

agent/internal/sync/sync.go

@@ -14,12 +14,16 @@ import (
 	"path/filepath"
 	"runtime"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/mrhid6/vantage/agent/internal/config"
+	agentexec "github.com/mrhid6/vantage/agent/internal/exec"
 	grpcclient "github.com/mrhid6/vantage/agent/internal/grpc"
 	"github.com/mrhid6/vantage/agent/internal/grpc/pb"
+	"github.com/mrhid6/vantage/agent/internal/inventory"
 	"github.com/mrhid6/vantage/agent/internal/keys"
+	"github.com/mrhid6/vantage/agent/internal/monitors"
 	"github.com/mrhid6/vantage/agent/internal/updates"
 )
 
@@ -66,6 +70,12 @@ func Run(ctx context.Context, cfg *config.Config, version string) error {
 	// Check for OS updates on startup and then hourly.
 	go runUpdateCheck(ctx, cfg)
 
+	// Report host inventory: metrics every 30s, full static snapshot every 15 min.
+	go runInventory(ctx, cfg)
+
+	// Run agent-side service monitors assigned to this server.
+	go monitors.Run(ctx, cfg)
+
 	ticker := time.NewTicker(cfg.PollInterval)
 	defer ticker.Stop()
 
@@ -168,6 +178,16 @@ func connectAndHandleStream(ctx context.Context, cfg *config.Config) error {
 
 	log.Println("command stream connected")
 
+	// grpc streams are not safe for concurrent Send; RunStep results are sent
+	// from per-command goroutines, so all sends on this stream must go through
+	// this mutex-protected helper.
+	var sendMu sync.Mutex
+	send := func(msg *pb.AgentMessage) error {
+		sendMu.Lock()
+		defer sendMu.Unlock()
+		return stream.Send(msg)
+	}
+
 	for {
 		cmd, err := stream.Recv()
 		if err != nil {
@@ -186,6 +206,34 @@ func connectAndHandleStream(ctx context.Context, cfg *config.Config) error {
 		if cmd.ApplyUpdates != nil {
 			go handleApplyUpdates(cfg, cmd)
 		}
+		if cmd.CleanupWorkspace != nil {
+			go handleCleanupWorkspace(cmd)
+		}
+		if cmd.RunStep != nil {
+			go func(rc *pb.RunStepCmd, cid string) {
+				emit := func(seq uint64, data []byte) {
+					_ = send(&pb.AgentMessage{
+						ServerId:   cfg.ServerID,
+						AgentToken: cfg.AgentToken,
+						StepOutput: &pb.StepOutputChunk{CommandId: cid, Seq: seq, Data: data},
+					})
+				}
+				res := agentexec.RunStep(rc, emit)
+				res.CommandId = cid
+				// Final eof marker so the server closes the log file.
+				_ = send(&pb.AgentMessage{
+					ServerId:   cfg.ServerID,
+					AgentToken: cfg.AgentToken,
+					StepOutput: &pb.StepOutputChunk{CommandId: cid, Eof: true},
+				})
+				_ = send(&pb.AgentMessage{
+					ServerId:   cfg.ServerID,
+					AgentToken: cfg.AgentToken,
+					StepResult: res,
+				})
+			}(cmd.RunStep, cmd.CommandId)
+			continue
+		}
 	}
 }
 
@@ -232,6 +280,40 @@ func runUpdateCheck(ctx context.Context, cfg *config.Config) {
 	}
 }
 
+// runInventory reports host metrics every 30s and a full static snapshot every
+// 15 min (and once immediately on startup so static fields populate without delay).
+func runInventory(ctx context.Context, cfg *config.Config) {
+	client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+	if err != nil {
+		log.Printf("inventory dial error: %v", err)
+		return
+	}
+	defer client.Close()
+
+	report := func(static bool) {
+		r := inventory.Collect(static)
+		r.ServerId = cfg.ServerID
+		r.AgentToken = cfg.AgentToken
+		if err := client.ReportInventory(r); err != nil {
+			log.Printf("report inventory: %v", err)
+		}
+	}
+
+	report(true) // full snapshot on startup
+	ticker := time.NewTicker(30 * time.Second)
+	defer ticker.Stop()
+	tick := 0
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			tick++
+			report(tick%30 == 0) // every 30th tick = 15 min → include static
+		}
+	}
+}
+
 func handleApplyUpdates(cfg *config.Config, cmd *pb.ServerCommand) {
 	log.Printf("applying OS updates (cmd=%s)…", cmd.CommandId)
 	if err := updates.ApplyAll(); err != nil {
@@ -249,6 +331,16 @@ func handleApplyUpdates(cfg *config.Config, cmd *pb.ServerCommand) {
 	_ = client.ReportUpdates(cfg.ServerID, cfg.AgentToken, nil)
 }
 
+func handleCleanupWorkspace(cmd *pb.ServerCommand) {
+	id := cmd.CleanupWorkspace.WorkspaceId
+	dir := agentexec.WorkspacePath(id)
+	if err := os.RemoveAll(dir); err != nil {
+		log.Printf("cleanup workspace %s failed (cmd=%s): %v", dir, cmd.CommandId, err)
+		return
+	}
+	log.Printf("removed run workspace %s (cmd=%s)", dir, cmd.CommandId)
+}
+
 func handleDeleteKey(cmd *pb.ServerCommand) {
 	label := cmd.DeleteKey.Label
 	keyPath := fmt.Sprintf("/root/.ssh/vantage_%s", strings.ReplaceAll(label, " ", "_"))

deploy/docker-compose.yml

@@ -36,10 +36,13 @@ services:
       OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
       OIDC_REDIRECT_URL: ${OIDC_REDIRECT_URL:-}
       KEY_ENCRYPTION_KEY: ${KEY_ENCRYPTION_KEY:-}
+      VANTAGE_WORKFLOW_LOG_DIR: ${VANTAGE_WORKFLOW_LOG_DIR:-}
       GUACD_ADDR: guacd:4822
     depends_on:
       redis:
         condition: service_healthy
+    volumes:
+      - ./data:/data
   web:
     image: gitea.hostxtra.co.uk/mrhid6/vantage/web:latest
     restart: unless-stopped

docs/superpowers/specs/2026-07-17-web-console-design.md

@@ -1,241 +0,0 @@
-# Vantage Web Console (Guacamole Replacement) — Design
-
-**Date:** 2026-07-17
-**Status:** Approved design, pre-implementation
-
-## Goal
-
-Add a browser-based remote-access console to Vantage — SSH, RDP, and VNC into
-managed servers — as a self-hosted Guacamole replacement. Users select an SSH
-key to connect over SSH. RDP targets are reachable from a new Windows agent that
-registers the host and reports status. Windows agent ships as an MSI installer
-produced by CI.
-
-## Non-Goals (YAGNI)
-
-- Session recording / replay (may be added later).
-- Native Go RDP implementation (guacd handles protocol translation).
-- Per-user Linux/Windows account management from the agent.
-- Tunneling console traffic through the agent (direct network path assumed).
-
----
-
-## Architecture
-
-```
-Browser (guacamole-common-js, vendored — no CDN)
-   │  Guacamole protocol over WebSocket
-   ▼
-Go server: /api/console/tunnel   (github.com/wwt/guac)
-   │  Guacamole protocol over TCP :4822
-   ▼
-guacd container (Apache Guacamole daemon)
-   │  SSH :22 / RDP :3389 / VNC :5900  — direct to target IP
-   ▼
-Target host (LAN / VPN line-of-sight from server)
-```
-
-- **Browser:** loads vendored `guacamole-common-js`, renders RDP/VNC display and
-  SSH terminal. No external CDN (matches existing infra rules).
-- **Go server:** exposes a WebSocket tunnel endpoint using `github.com/wwt/guac`
-  (Go Guacamole tunnel library). No Java `guacamole-client` required.
-- **guacd:** new container in `deploy/docker-compose.yml`, bound to the internal
-  docker network only, reachable by the server on `:4822`.
-- **Network path:** guacd connects **directly** to the target IP. Requires the
-  central server to have network line-of-sight to hosts (homelab LAN / VPN). The
-  agent's outbound-only guarantee is unchanged — the console path is
-  server→target, not agent-mediated.
-
----
-
-## Data Model Changes
-
-### `keys` — extend to hold private material
-
-```json
-{
-  "key_id": "uuid",
-  "label": "dom-macbook",
-  "public_key": "ssh-ed25519 AAAA...",
-  "private_key_enc": "<AES-256-GCM ciphertext | null>",
-  "has_private": true,
-  "passphrase_enc": "<AES-256-GCM ciphertext | null>",
-  "fingerprint": "SHA256:...",
-  "source": "uploaded|generated",
-  "created_at": "ISODate"
-}
-```
-
-- A key may be created from an uploaded **private+public** pair, upload of a
-  public key only, or agent generation.
-- Agent key generation now also uploads `private_key_enc` (reuses the existing
-  AES-256 key used for at-rest encryption). Private key no longer stays local
-  only — it is stored encrypted so the console can reuse it.
-- Optional `passphrase_enc` for passphrase-protected private keys.
-- Console lists only keys where `has_private = true`.
-
-### `servers` — extend with console metadata
-
-```json
-{
-  "...": "...existing fields...",
-  "os_type": "linux|windows",
-  "console_protocols": ["ssh"],
-  "ssh_port": 22,
-  "rdp_port": 3389
-}
-```
-
-- `os_type` set at registration from the agent.
-- `console_protocols` lists enabled protocols per server (`ssh`, `rdp`, `vnc`).
-- Port fields default to standard ports, overridable in the UI.
-
-### `console_sessions` — new collection (audit)
-
-```json
-{
-  "session_id": "uuid",
-  "server_id": "uuid",
-  "protocol": "ssh|rdp|vnc",
-  "key_id": "uuid | null",
-  "user": "who opened it",
-  "started_at": "ISODate",
-  "ended_at": "ISODate | null",
-  "client_ip": "string"
-}
-```
-
----
-
-## Session Broker + Connection Flow
-
-New service: `server/internal/services/console.go`.
-
-1. Browser `POST /api/console/connect`
-   `{ server_id, protocol, key_id?, rdp_username?, rdp_password? }`.
-2. Broker validates request, loads the server (host IP, port for protocol),
-   loads the key and **decrypts `private_key_enc` in memory only**.
-3. Builds the guacd connection parameter map:
-   - **SSH:** `hostname`, `port`, `username`, `private-key` (decrypted),
-     `passphrase` (if any).
-   - **RDP:** `hostname`, `port`, `username`, `password`, `security=any`,
-     `ignore-cert=true`.
-   - **VNC:** `hostname`, `port`, `password`.
-4. Creates a `console_sessions` document, returns a short-lived signed session
-   token.
-5. Browser opens WebSocket `/api/console/tunnel?token=…`. The `wwt/guac` handler
-   validates the token, dials guacd `:4822`, and pipes bytes in both directions.
-6. On socket close, the broker sets `ended_at` on the session doc.
-
-### Security
-
-- Decrypted private keys and RDP passwords are **never persisted, never logged,
-  never sent to the browser** — passed only to guacd.
-- Session token: short TTL (~60s to open the WebSocket), single-use,
-  HMAC-signed, bound to the authenticated user.
-- guacd is bound to the internal docker network only; not exposed publicly.
-- At-rest encryption (`private_key_enc`, `passphrase_enc`) reuses the existing
-  AES-256 key already used for agent-generated private keys.
-
----
-
-## Windows Agent
-
-Same Go codebase as the Linux agent, with a reduced role: **register +
-heartbeat + status only**. No `authorized_keys` management (meaningless on
-Windows).
-
-- Build target: `GOOS=windows GOARCH=amd64` → `vantage-agent-windows-amd64.exe`.
-- Agent detects OS at registration and sends `os_type=windows`.
-- The key-sync loop is disabled on Windows via a runtime OS check (or build tag)
-  — no `authorized_keys` writes are ever attempted.
-- Config file: `C:\ProgramData\vantage\config.yaml`, locked down via ACL to the
-  equivalent of `0600`.
-- Runs as a Windows service via **nssm**.
-
----
-
-## Windows Installer (MSI)
-
-Agent ships as a WiX v4 MSI produced in CI.
-
-- **WiX v4** chosen because it is a dotnet tool that builds MSIs
-  **cross-platform** — runs on the Linux Gitea act_runner. (Inno Setup is
-  Windows-only and does not fit the runner.)
-- MSI bundles `vantage-agent.exe`, installs it to `C:\Program Files\Vantage\`,
-  and registers the nssm service (ships nssm or uses a CustomAction).
-- Accepts install parameters as MSI properties for silent/headless install:
-  ```
-  msiexec /i vantage-agent.msi /qn SERVERID=<id> TOKEN=<token> SERVERURL=vantage..:9090
-  ```
-- GUI install (double-click) prompts for server-id / token / server-url via a
-  dialog.
-
-### Two install paths
-
-1. **Installer direct** — user downloads `vantage-agent.msi`, double-clicks,
-   fills the dialog. No script required.
-2. **PowerShell one-liner** — served dynamically (like the existing bash
-   `/install`). Script downloads the `.msi`, verifies SHA-256, then runs
-   `msiexec /qn` with injected `SERVERID` / `TOKEN` / `SERVERURL`. Used by the
-   copy-paste "Add Server" flow.
-
-The PowerShell script (`/install.ps1`) steps:
-1. Detect arch.
-2. Download `vantage-agent.msi` from the latest Gitea `agent/v*` release.
-3. Verify SHA-256 against `checksums.txt`.
-4. Run `msiexec /i vantage-agent.msi /qn SERVERID=.. TOKEN=.. SERVERURL=..`.
-
----
-
-## Frontend Routes
-
-| Route                     | Change                                                        |
-| ------------------------- | ------------------------------------------------------------- |
-| `/servers`                | Show `os_type` badge, enabled console protocols               |
-| `/servers/[id]`           | Add **Connect** button(s) per enabled protocol                |
-| `/servers/[id]/console`   | New — full-screen console (guacamole-common-js), key picker   |
-| `/servers/new`            | Offer Windows (MSI) vs Linux (bash) install instructions      |
-
-Console page: select protocol + SSH key (SSH) or enter RDP credentials, call
-`/api/console/connect`, open the tunnel WebSocket, mount the Guacamole client.
-
----
-
-## CI/CD Changes
-
-### `agent-release.yml`
-
-- Add `windows/amd64` build: `vantage-agent-windows-amd64.exe`.
-- Add WiX v4 MSI build job → `vantage-agent.msi`.
-- Add both to `checksums.txt` and release assets.
-
-Release assets become:
-- `vantage-agent-linux-amd64`
-- `vantage-agent-linux-arm64`
-- `vantage-agent-windows-amd64.exe`
-- `vantage-agent.msi`
-- `checksums.txt`
-
-### `server-deploy.yml`
-
-- Add guacd service to `deploy/docker-compose.yml` (deployed alongside server).
-
----
-
-## New Dependencies
-
-- **Go:** `github.com/wwt/guac` (Guacamole tunnel/WebSocket in Go).
-- **Container:** `guacamole/guacd` official image.
-- **Frontend:** vendored `guacamole-common-js` (no CDN).
-- **CI:** WiX v4 dotnet tool; nssm binary bundled for the MSI.
-
----
-
-## Open Implementation Notes
-
-- Confirm `wwt/guac` API surface for connection-parameter passing and token auth
-  binding during implementation.
-- nssm packaging inside MSI: bundle the nssm binary as a payload + CustomAction,
-  or run `sc.exe`-based service install if nssm proves awkward in WiX.
-- ACL hardening of `C:\ProgramData\vantage\config.yaml` in the MSI CustomAction.

docs/superpowers/specs/2026-07-20-saas-auth-orgs-design.md

@@ -0,0 +1,158 @@
+# SaaS: Auth + Organizations — Design
+
+**Date:** 2026-07-20
+**Status:** Approved (design) — ready for implementation planning
+**Scope:** Local auth + organizations + per-org OIDC, and org-scoping of existing data. Billing/plan-limits explicitly deferred. Fleet Inventory and Server Workflows are separate sub-projects.
+
+---
+
+## 1. Summary
+
+Turn Vantage from a single-admin, single global-OIDC tool into a multi-tenant app:
+
+1. **Replace** the global Authentik/env-based OIDC with **local email/password accounts** as the primary login.
+2. **Organizations** — every user belongs to an org; every domain object (servers, keys, secrets, assignments, workflows, steps, runs, audit logs, monitors, notification channels, console sessions, incidents, uptime rollups) carries an `org_id` and all queries are scoped to the caller's org.
+3. **Per-org OpenID** — an org admin can configure their own OIDC provider (issuer/client id/secret); users in that org can then sign in through it.
+
+No billing, no seat/server limits this iteration (schema leaves room).
+
+---
+
+## 2. Locked decisions
+
+| Topic | Decision |
+|-------|----------|
+| Primary auth | Local email + password (bcrypt). Replaces global Authentik. |
+| Org SSO | Per-org OIDC provider, configured by org admin, resolved dynamically at login. |
+| Isolation | `org_id` on every collection; every service query filtered by org. Enforced in the request layer via session→org. |
+| Roles | `owner`, `admin`, `member` (v1: owner/admin can manage users + org OIDC + all resources; member can use resources). Keep minimal. |
+| Bootstrapping | First-run creates the initial org + owner account (setup flow) when no users exist. |
+| Sessions | Keep existing Redis session store; session now carries `user_id`, `org_id`, `role`, `email`. |
+| Agent auth | Unchanged (per-server agent tokens). Servers gain `org_id`; agent RPCs resolve org from the server record. |
+| gRPC endpoint | Single shared `grpc-vantage.hostxtra.co.uk` — no per-org subdomain. Org resolved from `server_id`/token, never from host. Agent configs unchanged. |
+
+---
+
+## 3. Data model
+
+### `orgs`
+```json
+{ "_id":"ObjectId", "org_id":"uuid", "name":"Doms Org", "slug":"doms-org", "created_at":"ISODate" }
+```
+- `slug` derived from `name` at creation: lowercase, spaces/underscores → `-`, strip non `[a-z0-9-]`, collapse repeat `-`, trim leading/trailing `-`. `Doms Org` → `doms-org`.
+- **Unique index on `slug`** (global). On collision append `-2`, `-3`, … or reject and ask user to pick.
+- Length 3–40. Reserved slugs blocked: `www`, `api`, `app`, `admin`, `auth`, `install`, `static`, `_next`, plus the bare apex.
+- Slug is the DNS label → `doms-org.vantage.hostxtra.co.uk`. Treat as **immutable in v1** (rename breaks bookmarks, cookies, OIDC redirect URLs). Renaming deferred.
+
+### `users`
+```json
+{
+  "_id":"ObjectId", "user_id":"uuid", "org_id":"uuid",
+  "email":"a@b.com", "password_hash":"bcrypt...", "role":"owner|admin|member",
+  "auth_source":"local|oidc", "created_at":"ISODate", "last_login":"ISODate|null"
+}
+```
+Unique index on `email` (global — email identifies the account and its org).
+
+### `org_oidc` (per-org provider config)
+```json
+{
+  "_id":"ObjectId", "org_id":"uuid",
+  "issuer":"https://id.acme.com", "client_id":"...",
+  "client_secret_enc":"AES...",         // encrypted with existing crypto.go
+  "enabled": true, "updated_at":"ISODate"
+}
+```
+
+### Existing collections — add `org_id`
+`servers`, `keys`, `assignments`, `secrets`, `workflows`, `workflow_steps`, `workflow_runs`, `audit_logs`, `monitors`, `notification_channels`, `console_sessions`, `incidents`, `monitor_rollups` each gain `org_id string`. A **migration** backfills all existing documents into a default org (see §7).
+
+> The audit collection is named `audit_logs` and the notification channel collection `notification_channels`. Earlier drafts of this document called them `audit` and `channels`; those names were copied verbatim into the migration's scoped-collection list and silently skipped both collections. Use the real names.
+
+---
+
+## 4. Auth flows
+
+### Local
+- `POST /auth/register` — only allowed during first-run bootstrap (creates org + owner) OR by an org admin inviting a user (see below). Not open self-serve.
+- `POST /auth/login` — email + password → verify bcrypt → create session with `{user_id, org_id, role, email}`.
+- `POST /auth/logout` — destroy session.
+- `GET /auth/me` — returns current user + org.
+
+### Org-admin user management
+- `GET /api/org/users` / `POST /api/org/users` (create local user in caller's org) / `PUT /api/org/users/:id/role` / `DELETE /api/org/users/:id`.
+
+### Per-org OIDC
+- `GET/PUT /api/org/oidc` — read/save the caller org's provider config (admin only). Secret stored encrypted. UI shows the exact redirect URL the admin must register with their provider: `https://<slug>.vantage.hostxtra.co.uk/auth/oidc/callback`.
+- `GET /auth/oidc/start` — org resolved from host (subdomain slug). Look up org's `org_oidc`, build provider on demand (cache per org). Redirect URL **derived from host** (`https://<host>/auth/oidc/callback`), not stored. State carries `org_id`. The per-org provider cache is evicted when the org's OIDC config is saved, so a rotated issuer takes effect without a restart; the oauth2 config is built per request (its redirect URL is host-derived) and never cached.
+- `GET /auth/oidc/callback` — exchange code, match/provision the user by email **within that org**, create session.
+  - If the email exists in the org → log in. If not → provision a `member` with `auth_source=oidc` (org admin can promote). Reject if email belongs to a different org.
+
+### First-run bootstrap
+- `GET /auth/bootstrap-status` → `{ needs_setup: bool }` (true when `users` is empty).
+- Setup page collects org name + owner email/password → creates org + owner → session.
+
+---
+
+## 5. Request scoping
+
+- `auth.Middleware` already loads the session; extend `Session` to include `OrgID`, `UserID`, `Role`. Add helper `auth.OrgID(c) string`.
+- **Every service function that reads/writes a scoped collection takes an `orgID` argument** and adds `"org_id": orgID` to its filter and on insert. Handlers pass `auth.OrgID(c)`.
+- Add a `requireRole(role)` gin middleware for admin-only routes (org user mgmt, org OIDC).
+- Agent-facing gRPC: resolve `org_id` from the `servers` record (already tied to `server_id`); inventory/keys/sync operate on that org implicitly.
+
+### Host-based org resolution (per-org subdomain)
+- Wildcard DNS `*.vantage.hostxtra.co.uk` + wildcard TLS cert (Let's Encrypt DNS-01). One record, one cert, no per-org ops.
+- Middleware extracts subdomain label from `Host` header → look up `orgs.slug` → org. Cache slug→org_id (hits only; misses are never cached so a freshly bootstrapped org resolves immediately). The app root label (the `vantage` in `<slug>.vantage.<tld>`) is read from `APP_ROOT_LABEL`, defaulting to `vantage` — deployments on another root must set it or no host resolves to an org.
+- **Hostname is a routing/UX hint, NOT an authorization boundary.** Authorization stays session `org_id` (spec §9). If session org ≠ host org → reject (or redirect to correct host). Never trust `Host` to grant access.
+- `/auth/oidc/start` reads org from host — drops the "type your org" box.
+- Session cookie set on the **exact host** (`doms-org.vantage...`), not parent `.vantage...`, so cookies don't leak across orgs.
+- Apex `vantage.hostxtra.co.uk` (no subdomain): serves bootstrap + login-by-email fallback; after login redirect to the user's org host.
+
+---
+
+## 6. Removing global Authentik
+
+- Delete/retire env-driven `InitOIDC` global provider (`OIDC_ISSUER` etc.). Keep the `go-oidc`/`oauth2` machinery but move it behind the per-org resolver.
+- `authEnabled` global replaced by "auth always on" (there is always local auth). Update `middleware.go` accordingly (no more `if !authEnabled { next }` bypass — except the bootstrap endpoints and login/register which are unauthenticated).
+- Login page (`web/app/login` or existing) offers: email/password form + "Sign in with your organization's SSO" (enter org, redirect to `/auth/oidc/start`).
+
+---
+
+## 7. Migration
+
+One-shot migration run at startup (idempotent):
+1. If any scoped collection contains documents without `org_id`: reuse the org with slug `default`, creating it ("Default") if absent. Note this is looser than "`orgs` is empty AND ..." — the implementation is the authoritative and safer form, since an instance can have an org already (created by first-run bootstrap) while legacy documents still lack `org_id`; the stricter condition would skip the backfill and strand that data.
+2. Set `org_id = <default>` on all existing `servers`, `keys`, `assignments`, `secrets`, `workflows`, `workflow_steps`, `workflow_runs`, `audit_logs`, `monitors`, `notification_channels` documents missing it.
+   - `console_sessions`, `incidents` and `monitor_rollups` are also scoped, but their org is derived from the owning `servers`/`monitors` record rather than defaulted (migration `0003`), since defaulting them would mix one org's console history and incident timeline into another's.
+   - Migration `0003` also re-runs step 2 for `audit_logs` and `notification_channels`: the original `0001` listed them under the wrong names (`audit`, `channels`) and wrote its marker regardless, so those documents need a second, separately-markered pass to converge.
+3. If `OIDC_ISSUER` env was set previously and an admin email is known, optionally seed an owner user (documented manual step) — otherwise first-run bootstrap handles owner creation.
+Guard with a marker (e.g. a `migrations` collection entry) so it runs once.
+
+---
+
+## 8. Frontend
+
+- **Login/Setup:** `web/app/login/page.tsx` (email/password + org SSO entry) and `web/app/setup/page.tsx` (first-run). Redirect logic based on `bootstrap-status` and `auth/me`.
+- **Org settings:** `web/app/settings/org/` — members list + invite/create user + role management; OIDC provider form (issuer/client id/secret/enabled).
+- Existing pages unchanged functionally but now implicitly org-scoped by the backend. Show current org + user in the sidebar/header.
+
+---
+
+## 9. Security
+
+- Passwords: bcrypt (cost ≥ 12). Never returned.
+- Org OIDC client secret encrypted at rest (reuse `services/crypto.go` AES).
+- Cross-org access prevented at the service layer (org_id in every filter) — the primary isolation boundary. Handlers must never accept an `org_id` from the client; always derive from session.
+- OIDC callback must bind the returned identity to the org that initiated the flow (state carries org_id) to prevent org-mixing.
+- Role checks on all org-admin mutations.
+
+---
+
+## 10. Out of scope
+
+- Billing, plans, seat/server limits.
+- Cross-org resource sharing, org switching for a single user (one user = one org in v1).
+- SCIM / directory sync, SAML.
+- Email delivery for invites (create-user sets a password or invite token; email sending deferred — document as manual/console output).
+- Tests (skipped, consistent with prior iterations).

installer/setup.ps1

@@ -32,6 +32,10 @@ function Invoke-Native {
 function Invoke-NativeSoft {
   param([string]$File, [string[]]$Arguments)
   Write-Log ("RUN(soft): {0} {1}" -f $File, ($Arguments -join " "))
+  # Native stderr merged via 2>&1 becomes terminating errors under
+  # ErrorActionPreference=Stop; force Continue in this scope so a benign nssm
+  # message (e.g. "service has not been started") never aborts setup.
+  $ErrorActionPreference = "Continue"
   $out = & $File @Arguments 2>&1
   if ($out) { Write-Log ("OUT: {0}" -f ($out -join "`n")) }
   Write-Log ("EXIT: {0}" -f $LASTEXITCODE)
@@ -121,8 +125,10 @@ tls: true
   Invoke-Native -File $nssm -Arguments @("set", "VantageAgent", "AppRotateOnline", "1")
   Invoke-Native -File $nssm -Arguments @("set", "VantageAgent", "AppRotateBytes", "1048576")
 
-  # restart (not just start) so an upgrade picks up the new binary
-  Invoke-NativeSoft -File $nssm -Arguments @("restart", "VantageAgent")
+  # Service is freshly (re)installed and stopped here (teardown removed the old
+  # one on upgrade), so start it. "restart" would try to stop a not-running
+  # service and emit a stderr error.
+  Invoke-NativeSoft -File $nssm -Arguments @("start", "VantageAgent")
 
   Write-Log "=== setup ok ==="
   exit 0

installer/vantage-agent.wxs

@@ -6,7 +6,8 @@
   <Package Name="Vantage Agent" Manufacturer="Vantage"
            Version="$(var.Version)" UpgradeCode="7d1e6d2c-2a5f-4b3e-9c3a-8a1b2c3d4e5f"
            Scope="perMachine">
-    <MajorUpgrade DowngradeErrorMessage="A newer version is already installed." />
+    <MajorUpgrade DowngradeErrorMessage="A newer version is already installed."
+                  Schedule="afterInstallInitialize" />
     <MediaTemplate EmbedCab="yes" />
 
     <!-- Public properties settable via msiexec: SERVERID, TOKEN, SERVERURL -->

proto/vantage/v1/vantage.proto

@@ -9,6 +9,9 @@ service Vantage {
   rpc SyncKeys(SyncRequest)                    returns (SyncResponse);
   rpc UploadGeneratedKey(UploadKeyRequest)      returns (UploadKeyResponse);
   rpc ReportUpdates(ReportUpdatesRequest)       returns (ReportUpdatesResponse);
+  rpc ReportInventory(InventoryReport)          returns (InventoryReportResponse);
+  rpc SyncMonitors(SyncMonitorsRequest)         returns (SyncMonitorsResponse);
+  rpc ReportChecks(ReportChecksRequest)         returns (ReportChecksResponse);
   // Bidirectional stream: agent sends auth once, server pushes commands.
   rpc CommandStream(stream AgentMessage)        returns (stream ServerCommand);
 }
@@ -55,6 +58,8 @@ message AgentMessage {
   oneof payload {
     AgentReady    ready  = 3;
     CommandResult result = 4;
+    StepResult step_result = 5;
+    StepOutputChunk step_output = 6;
   }
 }
 
@@ -80,6 +85,80 @@ message ReportUpdatesRequest {
 
 message ReportUpdatesResponse {}
 
+message CPUReport {
+  string model     = 1;
+  int32  cores     = 2;
+  double usage_pct = 3;
+  double load1     = 4;
+}
+
+message MemReport {
+  uint64 total_bytes = 1;
+  uint64 used_bytes  = 2;
+}
+
+message PartitionReport {
+  string device      = 1;
+  string mountpoint  = 2;
+  string fstype      = 3;
+  uint64 total_bytes = 4;
+  uint64 used_bytes  = 5;
+}
+
+message InventoryReport {
+  string server_id      = 1;
+  string agent_token    = 2;
+  bool   include_static = 3;
+  CPUReport cpu         = 4;
+  MemReport memory      = 5;
+  uint64 swap_total     = 6;
+  uint64 swap_used      = 7;
+  repeated PartitionReport partitions = 8;
+  string kernel         = 9;
+}
+
+message InventoryReportResponse {}
+
+message MonitorSpec {
+  string monitor_id      = 1;
+  string type            = 2;
+  string url             = 3;
+  string host            = 4;
+  int32  port            = 5;
+  string method          = 6;
+  int32  expected_status = 7;
+  string keyword         = 8;
+  int32  tls_warn_days   = 9;
+  int32  interval_sec    = 10;
+  int32  retries         = 11;
+  bool   insecure        = 12;
+}
+
+message SyncMonitorsRequest {
+  string server_id   = 1;
+  string agent_token = 2;
+}
+
+message SyncMonitorsResponse {
+  repeated MonitorSpec monitors = 1;
+}
+
+message CheckResult {
+  string monitor_id       = 1;
+  bool   up               = 2;
+  int32  latency_ms       = 3;
+  string message          = 4;
+  int64  cert_expiry_unix = 5;
+}
+
+message ReportChecksRequest {
+  string server_id   = 1;
+  string agent_token = 2;
+  repeated CheckResult results = 3;
+}
+
+message ReportChecksResponse {}
+
 message ApplyUpdatesCmd {}
 
 message ServerCommand {
@@ -89,9 +168,17 @@ message ServerCommand {
     DeleteKeyCmd    delete_key    = 3;
     UpdateAgentCmd  update_agent  = 4;
     ApplyUpdatesCmd apply_updates = 5;
+    RunStepCmd      run_step      = 6;
+    CleanupWorkspaceCmd cleanup_workspace = 7;
   }
 }
 
+// CleanupWorkspaceCmd tells the agent to recursively remove the run's working
+// directory once all steps on that server have finished.
+message CleanupWorkspaceCmd {
+  string workspace_id = 1;
+}
+
 message DeleteKeyCmd {
   string label = 1;
 }
@@ -108,3 +195,26 @@ message GenerateKeyCmd {
   string passphrase = 4; // empty = no passphrase
   string comment    = 5; // embedded in public key
 }
+
+message RunStepCmd {
+  string interpreter      = 1; // "bash" | "powershell"
+  string script           = 2;
+  map<string, string> env = 3;
+  int32  timeout_seconds  = 4;
+  string workspace_id     = 5; // per-run working dir the agent creates & uses as cwd
+}
+
+message StepResult {
+  string command_id             = 1;
+  int32  exit_code              = 2;
+  string stdout                 = 3;
+  string stderr                 = 4;
+  map<string, string> output_env = 5;
+}
+
+message StepOutputChunk {
+  string command_id = 1;
+  uint64 seq        = 2;
+  bytes  data       = 3;
+  bool   eof        = 4;
+}

server/cmd/main.go

@@ -11,6 +11,7 @@ import (
 	"github.com/mrhid6/vantage/server/internal/auth"
 	"github.com/mrhid6/vantage/server/internal/db"
 	grpcserver "github.com/mrhid6/vantage/server/internal/grpc"
+	"github.com/mrhid6/vantage/server/internal/monitorsched"
 	"github.com/mrhid6/vantage/server/internal/services"
 )
 
@@ -23,20 +24,61 @@ func main() {
 	}
 	log.Println("connected to MongoDB")
 
+	// The unique indexes are a security property: GetUserByEmail does an
+	// unscoped FindOne, so duplicate (or blank) emails let the OIDC callback's
+	// cross-org guard compare against an arbitrary user, and duplicate org slugs
+	// make host-based org resolution pick one at random.
+	if err := services.EnsureAuthIndexes(); err != nil {
+		log.Fatalf("failed to ensure auth indexes: %v", err)
+	}
+	if err := services.RunMigrations(); err != nil {
+		log.Fatalf("migration failed: %v", err)
+	}
+	// Must run before the unique settings indexes are built, and before 0003:
+	// 0003 can create a "default" org, which would push 0002 into its ambiguous
+	// multi-org branch and leave the settings doc unstamped.
+	if err := services.MigrateSettingsOrg(); err != nil {
+		log.Fatalf("settings org migration failed: %v", err)
+	}
+	if err := services.MigrateMissedOrgScopes(); err != nil {
+		log.Fatalf("missed org scope migration failed: %v", err)
+	}
+
 	if err := services.EnsureSecretIndexes(); err != nil {
 		log.Printf("warning: failed to ensure secret indexes: %v", err)
 	}
 
+	// The unique indexes are a security property: duplicate settings docs make
+	// GetSettings return an arbitrary one, and duplicate ESO token hashes make
+	// ResolveSecretsReadToken pick an arbitrary org.
+	if err := services.EnsureSettingsIndexes(); err != nil {
+		log.Fatalf("failed to ensure settings indexes: %v", err)
+	}
+
+	if err := services.EnsureWorkflowIndexes(); err != nil {
+		log.Printf("warning: failed to ensure workflow indexes: %v", err)
+	}
+
+	if orgIDs, err := services.ListOrgIDs(); err != nil {
+		log.Printf("warning: failed to list orgs for default step seeding: %v", err)
+	} else {
+		for _, orgID := range orgIDs {
+			if created, updated, err := services.SeedDefaultSteps(orgID); err != nil {
+				log.Printf("warning: failed to seed default steps for org %s: %v", orgID, err)
+			} else {
+				log.Printf("default steps seeded for org %s: %d created, %d updated", orgID, created, updated)
+			}
+		}
+	}
+
+	services.StartLogSweeper()
+
 	redisAddr := getEnv("REDIS_ADDR", "localhost:6379")
 	if err := auth.InitRedis(redisAddr); err != nil {
 		log.Fatalf("failed to connect to Redis: %v", err)
 	}
 	log.Println("connected to Redis")
 
-	if err := auth.InitOIDC(context.Background()); err != nil {
-		log.Fatalf("failed to initialise OIDC: %v", err)
-	}
-
 	// Background goroutine to mark offline servers
 	go func() {
 		ticker := time.NewTicker(2 * time.Minute)
@@ -55,6 +97,9 @@ func main() {
 		}
 	}()
 
+	// Start the server-side monitor scheduler.
+	monitorsched.Start(context.Background())
+
 	// Start REST server
 	r := gin.New()
 	r.Use(gin.Recovery())

server/internal/api/channels.go

@@ -0,0 +1,97 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/auth"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+func registerChannelRoutes(g *gin.RouterGroup) {
+	g.GET("/channels", listChannels)
+	g.POST("/channels", createChannel)
+	g.PUT("/channels/:id", updateChannel)
+	g.DELETE("/channels/:id", deleteChannel)
+	g.POST("/channels/:id/test", testChannel)
+}
+
+func listChannels(c *gin.Context) {
+	channels, err := services.ListChannels(auth.OrgID(c))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, channels)
+}
+
+func createChannel(c *gin.Context) {
+	var ch models.NotificationChannel
+	if err := c.ShouldBindJSON(&ch); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if ch.Name == "" || ch.Type == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "name and type are required"})
+		return
+	}
+	created, err := services.CreateChannel(auth.OrgID(c), &ch)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusCreated, created)
+}
+
+func updateChannel(c *gin.Context) {
+	var body struct {
+		Name    *string            `json:"name"`
+		Type    *string            `json:"type"`
+		Config  *map[string]string `json:"config"`
+		Enabled *bool              `json:"enabled"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	upd := bson.M{}
+	if body.Name != nil {
+		upd["name"] = *body.Name
+	}
+	if body.Type != nil {
+		upd["type"] = *body.Type
+	}
+	if body.Config != nil {
+		upd["config"] = *body.Config
+	}
+	if body.Enabled != nil {
+		upd["enabled"] = *body.Enabled
+	}
+	if len(upd) == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "no fields to update"})
+		return
+	}
+	if err := services.UpdateChannel(auth.OrgID(c), c.Param("id"), upd); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func deleteChannel(c *gin.Context) {
+	if err := services.DeleteChannel(auth.OrgID(c), c.Param("id")); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func testChannel(c *gin.Context) {
+	if err := services.TestChannel(auth.OrgID(c), c.Param("id")); err != nil {
+		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"status": "sent"})
+}

server/internal/api/console.go

@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/auth"
 	"github.com/mrhid6/vantage/server/internal/services"
 	"github.com/wwt/guac"
 )
@@ -29,13 +30,13 @@ func consoleConnect(c *gin.Context) {
 		return
 	}
 
-	srv, err := services.GetServer(body.ServerID)
+	srv, err := services.GetServer(auth.OrgID(c), body.ServerID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
 		return
 	}
 
-	sess, err := services.CreateConsoleSession(body.ServerID, body.Protocol, body.KeyID, actorFromCtx(c), c.ClientIP())
+	sess, err := services.CreateConsoleSession(auth.OrgID(c), body.ServerID, body.Protocol, body.KeyID, actorFromCtx(c), c.ClientIP())
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -47,20 +48,20 @@ func consoleConnect(c *gin.Context) {
 	}
 
 	if (body.Protocol == "rdp" || body.Protocol == "vnc") && (body.RDPUsername != "" || body.RDPPassword != "") {
-		if err := services.StashConsoleRDPCreds(sess.SessionID, body.RDPUsername, body.RDPPassword); err != nil {
+		if err := services.StashConsoleRDPCreds(auth.OrgID(c), sess.SessionID, body.RDPUsername, body.RDPPassword); err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return
 		}
 	}
 
 	if body.Protocol == "ssh" {
-		if err := services.SetConsoleSSHUser(sess.SessionID, body.SSHUsername); err != nil {
+		if err := services.SetConsoleSSHUser(auth.OrgID(c), sess.SessionID, body.SSHUsername); err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return
 		}
 	}
 
-	services.LogEvent("console.opened", actorFromCtx(c), srv.ServerID, "",
+	services.LogEvent(auth.OrgID(c), "console.opened", actorFromCtx(c), srv.ServerID, "",
 		"console session opened ("+body.Protocol+")")
 
 	c.JSON(http.StatusOK, gin.H{
@@ -88,7 +89,8 @@ func consoleTunnel(c *gin.Context) {
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
 		return
 	}
-	sess, err := services.GetConsoleSession(sessionID)
+	orgID := auth.OrgID(c)
+	sess, err := services.GetConsoleSession(orgID, sessionID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "session not found"})
 		return
@@ -102,12 +104,12 @@ func consoleTunnel(c *gin.Context) {
 	}
 
 	// Single-use: atomically spend the token so a replay within its TTL is rejected.
-	if err := services.ConsumeSessionToken(sessionID); err != nil {
+	if err := services.ConsumeSessionToken(orgID, sessionID); err != nil {
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "token already used"})
 		return
 	}
 
-	srv, err := services.GetServer(sess.ServerID)
+	srv, err := services.GetServer(auth.OrgID(c), sess.ServerID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
 		return
@@ -116,7 +118,7 @@ func consoleTunnel(c *gin.Context) {
 	// Decrypt private key + passphrase in-memory only (ssh).
 	var privKey, passphrase string
 	if sess.Protocol == "ssh" && sess.KeyID != "" {
-		privKey, err = services.GetPrivateKey(sess.KeyID)
+		privKey, err = services.GetPrivateKey(auth.OrgID(c), sess.KeyID)
 		if err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "selected key has no private material"})
 			return
@@ -126,7 +128,7 @@ func consoleTunnel(c *gin.Context) {
 
 	var rdpUser, rdpPass string
 	if sess.Protocol == "rdp" || sess.Protocol == "vnc" {
-		rdpUser, rdpPass, err = services.ConsumeConsoleRDPCreds(sessionID)
+		rdpUser, rdpPass, err = services.ConsumeConsoleRDPCreds(orgID, sessionID)
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": "could not load credentials"})
 			return
@@ -171,7 +173,7 @@ func consoleTunnel(c *gin.Context) {
 
 	wsServer := guac.NewWebsocketServer(connect)
 	wsServer.OnDisconnect = func(id string, r *http.Request, t guac.Tunnel) {
-		_ = services.EndConsoleSession(sessionID)
+		_ = services.EndConsoleSession(orgID, sessionID)
 	}
 	wsServer.ServeHTTP(c.Writer, c.Request)
 }

server/internal/api/handlers.go

@@ -32,11 +32,14 @@ func RegisterRoutes(r *gin.Engine) {
 	// group as flat JSON.
 	r.GET("/api/secrets/:group/values", secretsReadAuth(), esoGetGroup)
 
-	// Auth endpoints (no session required)
-	r.GET("/auth/login", auth.HandleLogin)
-	r.GET("/auth/callback", auth.HandleCallback)
-	r.GET("/auth/logout", auth.HandleLogout)
+	// Unauthenticated auth endpoints
+	r.GET("/auth/bootstrap-status", auth.HandleBootstrapStatus)
+	r.POST("/auth/bootstrap", auth.HandleBootstrap)
+	r.POST("/auth/login", auth.HandleLocalLogin)
+	r.POST("/auth/logout", auth.HandleLogout)
 	r.GET("/auth/me", auth.HandleMe)
+	r.GET("/auth/oidc/start", auth.HandleOIDCStart)
+	r.GET("/auth/oidc/callback", auth.HandleOIDCCallback)
 
 	// API endpoints protected by session middleware
 	apiGroup := r.Group("/api")
@@ -56,9 +59,13 @@ func RegisterRoutes(r *gin.Engine) {
 
 		apiGroup.GET("/audit", listAuditEvents)
 
-		apiGroup.GET("/settings", getSettings)
-		apiGroup.PUT("/settings", saveSettings)
-		apiGroup.POST("/settings/secrets-token", rotateSecretsToken)
+		settings := apiGroup.Group("/settings")
+		settings.Use(auth.RequireRole("owner", "admin"))
+		{
+			settings.GET("", getSettings)
+			settings.PUT("", saveSettings)
+			settings.POST("/secrets-token", rotateSecretsToken)
+		}
 
 		apiGroup.GET("/secrets", listSecretGroups)
 		apiGroup.POST("/secrets", createSecretGroup)
@@ -78,11 +85,26 @@ func RegisterRoutes(r *gin.Engine) {
 
 		apiGroup.POST("/console/connect", consoleConnect)
 		apiGroup.GET("/console/tunnel", consoleTunnel)
+
+		registerWorkflowRoutes(apiGroup)
+		registerMonitorRoutes(apiGroup)
+		registerChannelRoutes(apiGroup)
+
+		org := apiGroup.Group("/org")
+		org.Use(auth.RequireRole("owner", "admin"))
+		{
+			org.GET("/users", listOrgUsers)
+			org.POST("/users", createOrgUser)
+			org.PUT("/users/:id/role", updateOrgUserRole)
+			org.DELETE("/users/:id", deleteOrgUser)
+			org.GET("/oidc", getOrgOIDC)
+			org.PUT("/oidc", putOrgOIDC)
+		}
 	}
 }
 
 func listServers(c *gin.Context) {
-	servers, err := services.ListServers()
+	servers, err := services.ListServers(auth.OrgID(c))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -91,7 +113,7 @@ func listServers(c *gin.Context) {
 }
 
 func createServer(c *gin.Context) {
-	s, token, err := services.CreateServer()
+	s, token, err := services.CreateServer(auth.OrgID(c))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -104,12 +126,12 @@ func createServer(c *gin.Context) {
 }
 
 func newServer(c *gin.Context) {
-	s, token, err := services.CreateServer()
+	s, token, err := services.CreateServer(auth.OrgID(c))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("server.created", actorFromCtx(c), s.ServerID, "", "pre-registration token issued")
+	services.LogEvent(auth.OrgID(c), "server.created", actorFromCtx(c), s.ServerID, "", "pre-registration token issued")
 
 	giteaHost := os.Getenv("GITEA_HOST")
 	if giteaHost == "" {
@@ -140,13 +162,13 @@ func newServer(c *gin.Context) {
 
 func getServer(c *gin.Context) {
 	id := c.Param("id")
-	s, err := services.GetServer(id)
+	s, err := services.GetServer(auth.OrgID(c), id)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
 		return
 	}
 
-	assignments, _ := services.GetAssignmentsWithKeysForServer(id)
+	assignments, _ := services.GetAssignmentsWithKeysForServer(auth.OrgID(c), id)
 
 	// Build response matching ServerWithKeys shape expected by frontend
 	type serverResponse struct {
@@ -161,8 +183,8 @@ func getServer(c *gin.Context) {
 
 func deleteServer(c *gin.Context) {
 	id := c.Param("id")
-	s, _ := services.GetServer(id)
-	if err := services.DeleteServer(id); err != nil {
+	s, _ := services.GetServer(auth.OrgID(c), id)
+	if err := services.DeleteServer(auth.OrgID(c), id); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
@@ -170,7 +192,7 @@ func deleteServer(c *gin.Context) {
 	if s != nil {
 		hostname = s.Hostname
 	}
-	services.LogEvent("server.deleted", actorFromCtx(c), id, "", fmt.Sprintf("server %s deleted", hostname))
+	services.LogEvent(auth.OrgID(c), "server.deleted", actorFromCtx(c), id, "", fmt.Sprintf("server %s deleted", hostname))
 	c.JSON(http.StatusOK, gin.H{"deleted": true})
 }
 
@@ -189,7 +211,7 @@ func generateKey(c *gin.Context) {
 		body.Label = "generated"
 	}
 
-	s, err := services.GetServer(id)
+	s, err := services.GetServer(auth.OrgID(c), id)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
 		return
@@ -207,7 +229,7 @@ func generateKey(c *gin.Context) {
 		return
 	}
 
-	services.LogEvent("key.generation_dispatched", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("key generation dispatched (label=%s type=%s)", body.Label, body.KeyType))
+	services.LogEvent(auth.OrgID(c), "key.generation_dispatched", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("key generation dispatched (label=%s type=%s)", body.Label, body.KeyType))
 	c.JSON(http.StatusAccepted, gin.H{
 		"message":    "key generation command sent to agent",
 		"command_id": cmdID,
@@ -216,7 +238,7 @@ func generateKey(c *gin.Context) {
 }
 
 func listKeys(c *gin.Context) {
-	keys, err := services.ListKeys()
+	keys, err := services.ListKeys(auth.OrgID(c))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -236,18 +258,18 @@ func createKey(c *gin.Context) {
 		return
 	}
 
-	key, err := services.CreateKey(body.Label, body.PublicKey, "uploaded", "", body.PrivateKey, body.Passphrase)
+	key, err := services.CreateKey(auth.OrgID(c), body.Label, body.PublicKey, "uploaded", "", body.PrivateKey, body.Passphrase)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("key.uploaded", actorFromCtx(c), "", key.KeyID, fmt.Sprintf("key '%s' uploaded", key.Label))
+	services.LogEvent(auth.OrgID(c), "key.uploaded", actorFromCtx(c), "", key.KeyID, fmt.Sprintf("key '%s' uploaded", key.Label))
 	c.JSON(http.StatusCreated, key)
 }
 
 func getPrivateKey(c *gin.Context) {
 	id := c.Param("id")
-	plaintext, err := services.GetPrivateKey(id)
+	plaintext, err := services.GetPrivateKey(auth.OrgID(c), id)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
 		return
@@ -257,13 +279,13 @@ func getPrivateKey(c *gin.Context) {
 
 func getKey(c *gin.Context) {
 	id := c.Param("id")
-	key, err := services.GetKey(id)
+	key, err := services.GetKey(auth.OrgID(c), id)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "key not found"})
 		return
 	}
 
-	assignments, _ := services.GetAssignmentsWithServers(id)
+	assignments, _ := services.GetAssignmentsWithServers(auth.OrgID(c), id)
 
 	type keyResponse struct {
 		*models.Key
@@ -277,8 +299,8 @@ func getKey(c *gin.Context) {
 
 func deleteKey(c *gin.Context) {
 	id := c.Param("id")
-	k, _ := services.GetKey(id)
-	if err := services.DeleteKey(id); err != nil {
+	k, _ := services.GetKey(auth.OrgID(c), id)
+	if err := services.DeleteKey(auth.OrgID(c), id); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
@@ -286,7 +308,7 @@ func deleteKey(c *gin.Context) {
 	if k != nil {
 		label = k.Label
 	}
-	services.LogEvent("key.deleted", actorFromCtx(c), "", id, fmt.Sprintf("key '%s' deleted", label))
+	services.LogEvent(auth.OrgID(c), "key.deleted", actorFromCtx(c), "", id, fmt.Sprintf("key '%s' deleted", label))
 	c.JSON(http.StatusOK, gin.H{"deleted": true})
 }
 
@@ -300,12 +322,12 @@ func assignKey(c *gin.Context) {
 		return
 	}
 
-	a, err := services.AssignKey(keyID, body.ServerID)
+	a, err := services.AssignKey(auth.OrgID(c), keyID, body.ServerID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("key.assigned", actorFromCtx(c), body.ServerID, keyID, fmt.Sprintf("key %s assigned to server %s", keyID, body.ServerID))
+	services.LogEvent(auth.OrgID(c), "key.assigned", actorFromCtx(c), body.ServerID, keyID, fmt.Sprintf("key %s assigned to server %s", keyID, body.ServerID))
 	c.JSON(http.StatusCreated, a)
 }
 
@@ -313,11 +335,11 @@ func revokeAssignment(c *gin.Context) {
 	keyID := c.Param("id")
 	serverID := c.Param("serverId")
 
-	if err := services.RevokeAssignment(keyID, serverID); err != nil {
+	if err := services.RevokeAssignment(auth.OrgID(c), keyID, serverID); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("key.revoked", actorFromCtx(c), serverID, keyID, fmt.Sprintf("key %s revoked from server %s", keyID, serverID))
+	services.LogEvent(auth.OrgID(c), "key.revoked", actorFromCtx(c), serverID, keyID, fmt.Sprintf("key %s revoked from server %s", keyID, serverID))
 	c.JSON(http.StatusOK, gin.H{"revoked": true})
 }
 
@@ -332,7 +354,7 @@ func getLatestAgentVersion(c *gin.Context) {
 
 func updateAgent(c *gin.Context) {
 	id := c.Param("id")
-	s, err := services.GetServer(id)
+	s, err := services.GetServer(auth.OrgID(c), id)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
 		return
@@ -343,7 +365,7 @@ func updateAgent(c *gin.Context) {
 		c.JSON(http.StatusServiceUnavailable, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("agent.update_dispatched", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("agent update dispatched to %s (version %s)", s.Hostname, version))
+	services.LogEvent(auth.OrgID(c), "agent.update_dispatched", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("agent update dispatched to %s (version %s)", s.Hostname, version))
 	c.JSON(http.StatusAccepted, gin.H{
 		"message": "update command sent to agent",
 		"version": version,
@@ -352,7 +374,7 @@ func updateAgent(c *gin.Context) {
 
 func applyUpdates(c *gin.Context) {
 	id := c.Param("id")
-	s, err := services.GetServer(id)
+	s, err := services.GetServer(auth.OrgID(c), id)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
 		return
@@ -362,7 +384,7 @@ func applyUpdates(c *gin.Context) {
 		c.JSON(http.StatusServiceUnavailable, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("updates.applied", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("package update command dispatched to %s", s.Hostname))
+	services.LogEvent(auth.OrgID(c), "updates.applied", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("package update command dispatched to %s", s.Hostname))
 	c.JSON(http.StatusAccepted, gin.H{"message": "apply updates command sent to agent"})
 }
 
@@ -429,7 +451,7 @@ func listAuditEvents(c *gin.Context) {
 			limit = n
 		}
 	}
-	events, err := services.ListAuditEvents(limit)
+	events, err := services.ListAuditEvents(auth.OrgID(c), limit)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -438,7 +460,7 @@ func listAuditEvents(c *gin.Context) {
 }
 
 func getSettings(c *gin.Context) {
-	s, err := services.GetSettings()
+	s, err := services.GetSettings(auth.OrgID(c))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -448,18 +470,19 @@ func getSettings(c *gin.Context) {
 
 func saveSettings(c *gin.Context) {
 	var body struct {
-		Alerts models.AlertSettings `json:"alerts"`
-		Email  models.EmailSettings `json:"email"`
+		Alerts                   models.AlertSettings `json:"alerts"`
+		Email                    models.EmailSettings `json:"email"`
+		WorkflowLogRetentionDays *int                 `json:"workflow_log_retention_days"`
 	}
 	if err := c.ShouldBindJSON(&body); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
-	if err := services.SaveSettings(body.Alerts, body.Email); err != nil {
+	if err := services.SaveSettings(auth.OrgID(c), body.Alerts, body.Email, body.WorkflowLogRetentionDays); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("settings.updated", actorFromCtx(c), "", "", "alert settings updated")
+	services.LogEvent(auth.OrgID(c), "settings.updated", actorFromCtx(c), "", "", "alert settings updated")
 	c.JSON(http.StatusOK, gin.H{"saved": true})
 }
 

server/internal/api/monitors.go

@@ -0,0 +1,158 @@
+package api
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/auth"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+func registerMonitorRoutes(g *gin.RouterGroup) {
+	g.GET("/monitors", listMonitors)
+	g.POST("/monitors", createMonitor)
+	g.GET("/monitors/:id", getMonitor)
+	g.PUT("/monitors/:id", updateMonitor)
+	g.DELETE("/monitors/:id", deleteMonitor)
+	g.GET("/monitors/:id/incidents", getMonitorIncidents)
+	g.GET("/monitors/:id/uptime", getMonitorUptime)
+}
+
+func listMonitors(c *gin.Context) {
+	monitors, err := services.ListMonitors(auth.OrgID(c))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, monitors)
+}
+
+func createMonitor(c *gin.Context) {
+	var m models.Monitor
+	if err := c.ShouldBindJSON(&m); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if m.Name == "" || m.Type == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "name and type are required"})
+		return
+	}
+	created, err := services.CreateMonitor(auth.OrgID(c), &m)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusCreated, created)
+}
+
+func getMonitor(c *gin.Context) {
+	m, err := services.GetMonitor(auth.OrgID(c), c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if m == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "monitor not found"})
+		return
+	}
+	c.JSON(http.StatusOK, m)
+}
+
+func updateMonitor(c *gin.Context) {
+	var body struct {
+		Name        *string               `json:"name"`
+		Type        *string               `json:"type"`
+		Target      *models.MonitorTarget `json:"target"`
+		IntervalSec *int                  `json:"interval_sec"`
+		Runner      *string               `json:"runner"`
+		Retries     *int                  `json:"retries"`
+		Enabled     *bool                 `json:"enabled"`
+		ChannelIDs  *[]string             `json:"channel_ids"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	upd := bson.M{}
+	if body.Name != nil {
+		upd["name"] = *body.Name
+	}
+	if body.Type != nil {
+		upd["type"] = *body.Type
+	}
+	if body.Target != nil {
+		upd["target"] = *body.Target
+	}
+	if body.IntervalSec != nil {
+		upd["interval_sec"] = *body.IntervalSec
+	}
+	if body.Runner != nil {
+		upd["runner"] = *body.Runner
+	}
+	if body.Retries != nil {
+		upd["retries"] = *body.Retries
+	}
+	if body.Enabled != nil {
+		upd["enabled"] = *body.Enabled
+	}
+	if body.ChannelIDs != nil {
+		upd["channel_ids"] = *body.ChannelIDs
+	}
+	if len(upd) == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "no fields to update"})
+		return
+	}
+	if err := services.UpdateMonitor(auth.OrgID(c), c.Param("id"), upd); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func deleteMonitor(c *gin.Context) {
+	if err := services.DeleteMonitor(auth.OrgID(c), c.Param("id")); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func getMonitorIncidents(c *gin.Context) {
+	m, err := services.GetMonitor(auth.OrgID(c), c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if m == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "monitor not found"})
+		return
+	}
+	incidents, err := services.ListIncidents(auth.OrgID(c), c.Param("id"), 50)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, incidents)
+}
+
+func getMonitorUptime(c *gin.Context) {
+	m, err := services.GetMonitor(auth.OrgID(c), c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if m == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "monitor not found"})
+		return
+	}
+	since := time.Now().Add(-30 * 24 * time.Hour)
+	rollups, err := services.UptimeRollups(auth.OrgID(c), c.Param("id"), since)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, rollups)
+}

server/internal/api/org.go

@@ -0,0 +1,162 @@
+package api
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/auth"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+)
+
+func listOrgUsers(c *gin.Context) {
+	users, err := services.ListUsers(auth.OrgID(c))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, users)
+}
+
+// Granting or removing the owner role is reserved to owners: an admin must
+// never be able to mint an owner (and log in as it) or strip the owners above
+// them. Everything below derives the actor from the session, never the body.
+func actorMayGrantOwner(c *gin.Context) bool {
+	return auth.Role(c) == models.RoleOwner
+}
+
+func createOrgUser(c *gin.Context) {
+	var body struct {
+		Email    string `json:"email"`
+		Password string `json:"password"`
+		Role     string `json:"role"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil || body.Email == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "email required"})
+		return
+	}
+	if body.Role == "" {
+		body.Role = models.RoleMember
+	}
+	if !models.ValidRole(body.Role) {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "role must be one of owner, admin, or member"})
+		return
+	}
+	if body.Role == models.RoleOwner && !actorMayGrantOwner(c) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "only an owner can create another owner"})
+		return
+	}
+	u, err := services.CreateUser(auth.OrgID(c), body.Email, body.Password, body.Role, "local")
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusCreated, u)
+}
+
+func updateOrgUserRole(c *gin.Context) {
+	var body struct {
+		Role string `json:"role"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil || body.Role == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "role required"})
+		return
+	}
+	if !models.ValidRole(body.Role) {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "role must be one of owner, admin, or member"})
+		return
+	}
+
+	orgID, targetID := auth.OrgID(c), c.Param("id")
+	if targetID == auth.UserID(c) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "you cannot change your own role"})
+		return
+	}
+	target, err := services.GetUserInOrg(orgID, targetID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
+		return
+	}
+	if (body.Role == models.RoleOwner || target.Role == models.RoleOwner) && !actorMayGrantOwner(c) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "only an owner can change owner roles"})
+		return
+	}
+
+	if err := services.UpdateUserRole(orgID, targetID, body.Role); err != nil {
+		c.JSON(orgUserErrStatus(err), gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"ok": true})
+}
+
+func deleteOrgUser(c *gin.Context) {
+	orgID, targetID := auth.OrgID(c), c.Param("id")
+	if targetID == auth.UserID(c) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "you cannot remove your own account"})
+		return
+	}
+	target, err := services.GetUserInOrg(orgID, targetID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
+		return
+	}
+	if target.Role == models.RoleOwner && !actorMayGrantOwner(c) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "only an owner can remove another owner"})
+		return
+	}
+
+	if err := services.DeleteUser(orgID, targetID); err != nil {
+		c.JSON(orgUserErrStatus(err), gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"deleted": true})
+}
+
+// The last-owner guard is a rejected request, not a server fault — surface it
+// as 409 so the UI shows the message rather than a generic failure.
+func orgUserErrStatus(err error) int {
+	if errors.Is(err, services.ErrLastOwner) {
+		return http.StatusConflict
+	}
+	return http.StatusInternalServerError
+}
+
+func getOrgOIDC(c *gin.Context) {
+	cfg, err := services.GetOrgOIDC(auth.OrgID(c))
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{"enabled": false, "client_secret_set": false})
+		return
+	}
+	// The client secret itself is write-only (never serialized); expose only
+	// whether one is stored so the UI can say so without leaking it.
+	c.JSON(http.StatusOK, gin.H{
+		"org_id":            cfg.OrgID,
+		"issuer":            cfg.Issuer,
+		"client_id":         cfg.ClientID,
+		"enabled":           cfg.Enabled,
+		"updated_at":        cfg.UpdatedAt,
+		"client_secret_set": cfg.ClientSecretEnc != "",
+	})
+}
+
+func putOrgOIDC(c *gin.Context) {
+	var body struct {
+		Issuer       string `json:"issuer"`
+		ClientID     string `json:"client_id"`
+		ClientSecret string `json:"client_secret"`
+		Enabled      bool   `json:"enabled"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if err := services.SaveOrgOIDC(auth.OrgID(c), body.Issuer, body.ClientID, body.ClientSecret, body.Enabled); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	// Drop the cached provider so a rotated issuer takes effect immediately —
+	// an admin moving off a compromised IdP must not keep authenticating there.
+	auth.EvictOIDCProvider(auth.OrgID(c))
+	c.JSON(http.StatusOK, gin.H{"saved": true})
+}

server/internal/api/secrets.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/auth"
 	"github.com/mrhid6/vantage/server/internal/services"
 )
 
@@ -18,19 +19,29 @@ func validName(s string) bool {
 	return s != "" && len(s) <= 128 && groupNamePattern.MatchString(s)
 }
 
-// secretsReadAuth validates the ESO bearer token on the public read endpoint.
+// ctxSecretsOrgKey carries the org resolved from the ESO bearer token.
+const ctxSecretsOrgKey = "km_secrets_org"
+
+// secretsReadAuth validates the ESO bearer token on the public read endpoint
+// and stashes the org the token belongs to.
+//
+// This is the one endpoint whose org does NOT come from the session or the
+// host: External Secrets Operator calls it machine-to-machine with no session,
+// so the token itself is the org-bearing credential.
 func secretsReadAuth() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		const prefix = "Bearer "
-		auth := c.GetHeader("Authorization")
-		if len(auth) <= len(prefix) || !strings.EqualFold(auth[:len(prefix)], prefix) {
+		authHeader := c.GetHeader("Authorization")
+		if len(authHeader) <= len(prefix) || !strings.EqualFold(authHeader[:len(prefix)], prefix) {
 			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "missing bearer token"})
 			return
 		}
-		if !services.VerifySecretsReadToken(auth[len(prefix):]) {
+		orgID, ok := services.ResolveSecretsReadToken(authHeader[len(prefix):])
+		if !ok {
 			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
 			return
 		}
+		c.Set(ctxSecretsOrgKey, orgID)
 		c.Next()
 	}
 }
@@ -40,7 +51,14 @@ func secretsReadAuth() gin.HandlerFunc {
 // (ESO treats 404 as "deleted").
 func esoGetGroup(c *gin.Context) {
 	group := c.Param("group")
-	values, err := services.GetSecretGroupDecrypted(group)
+	// Org comes from the bearer token (set by secretsReadAuth), not a session.
+	orgID := c.GetString(ctxSecretsOrgKey)
+	if orgID == "" {
+		// Defence in depth: never query the store unscoped.
+		c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
+		return
+	}
+	values, err := services.GetSecretGroupDecrypted(orgID, group)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "store error"})
 		return
@@ -53,7 +71,7 @@ func esoGetGroup(c *gin.Context) {
 }
 
 func listSecretGroups(c *gin.Context) {
-	groups, err := services.ListSecretGroups()
+	groups, err := services.ListSecretGroups(auth.OrgID(c))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -86,17 +104,17 @@ func createSecretGroup(c *gin.Context) {
 			return
 		}
 	}
-	if err := services.UpsertSecrets(body.Group, body.Values); err != nil {
+	if err := services.UpsertSecrets(auth.OrgID(c), body.Group, body.Values); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("secret.updated", actorFromCtx(c), "", "", fmt.Sprintf("group '%s' created with keys: %s", body.Group, strings.Join(services.SortedKeys(body.Values), ", ")))
+	services.LogEvent(auth.OrgID(c), "secret.updated", actorFromCtx(c), "", "", fmt.Sprintf("group '%s' created with keys: %s", body.Group, strings.Join(services.SortedKeys(body.Values), ", ")))
 	c.JSON(http.StatusCreated, gin.H{"group": body.Group})
 }
 
 func getSecretGroup(c *gin.Context) {
 	group := c.Param("group")
-	secrets, err := services.GetSecretGroup(group)
+	secrets, err := services.GetSecretGroup(auth.OrgID(c), group)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -130,11 +148,11 @@ func putSecretGroup(c *gin.Context) {
 			return
 		}
 	}
-	if err := services.UpsertSecrets(group, values); err != nil {
+	if err := services.UpsertSecrets(auth.OrgID(c), group, values); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("secret.updated", actorFromCtx(c), "", "", fmt.Sprintf("group '%s' keys updated: %s", group, strings.Join(services.SortedKeys(values), ", ")))
+	services.LogEvent(auth.OrgID(c), "secret.updated", actorFromCtx(c), "", "", fmt.Sprintf("group '%s' keys updated: %s", group, strings.Join(services.SortedKeys(values), ", ")))
 	c.JSON(http.StatusOK, gin.H{"saved": true})
 }
 
@@ -147,42 +165,42 @@ func revealSecret(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
-	value, err := services.RevealSecret(group, body.Key)
+	value, err := services.RevealSecret(auth.OrgID(c), group, body.Key)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("secret.revealed", actorFromCtx(c), "", "", fmt.Sprintf("value of '%s/%s' revealed", group, body.Key))
+	services.LogEvent(auth.OrgID(c), "secret.revealed", actorFromCtx(c), "", "", fmt.Sprintf("value of '%s/%s' revealed", group, body.Key))
 	c.JSON(http.StatusOK, gin.H{"value": value})
 }
 
 func deleteSecretKey(c *gin.Context) {
 	group := c.Param("group")
 	key := c.Param("key")
-	if err := services.DeleteSecret(group, key); err != nil {
+	if err := services.DeleteSecret(auth.OrgID(c), group, key); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("secret.deleted", actorFromCtx(c), "", "", fmt.Sprintf("key '%s' deleted from group '%s'", key, group))
+	services.LogEvent(auth.OrgID(c), "secret.deleted", actorFromCtx(c), "", "", fmt.Sprintf("key '%s' deleted from group '%s'", key, group))
 	c.JSON(http.StatusOK, gin.H{"deleted": true})
 }
 
 func deleteSecretGroup(c *gin.Context) {
 	group := c.Param("group")
-	if err := services.DeleteSecretGroup(group); err != nil {
+	if err := services.DeleteSecretGroup(auth.OrgID(c), group); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("secretgroup.deleted", actorFromCtx(c), "", "", fmt.Sprintf("group '%s' deleted", group))
+	services.LogEvent(auth.OrgID(c), "secretgroup.deleted", actorFromCtx(c), "", "", fmt.Sprintf("group '%s' deleted", group))
 	c.JSON(http.StatusOK, gin.H{"deleted": true})
 }
 
 func rotateSecretsToken(c *gin.Context) {
-	token, err := services.RotateSecretsReadToken()
+	token, err := services.RotateSecretsReadToken(auth.OrgID(c))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	services.LogEvent("secrets.token_rotated", actorFromCtx(c), "", "", "ESO read token rotated")
+	services.LogEvent(auth.OrgID(c), "secrets.token_rotated", actorFromCtx(c), "", "", "ESO read token rotated")
 	c.JSON(http.StatusOK, gin.H{"token": token})
 }

server/internal/api/workflows.go

@@ -0,0 +1,364 @@
+package api
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/auth"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+)
+
+func registerWorkflowRoutes(g *gin.RouterGroup) {
+	g.GET("/steps", listSteps)
+	g.POST("/steps", createStep)
+	g.PUT("/steps/:id", updateStep)
+	g.DELETE("/steps/:id", deleteStep)
+	g.GET("/steps/:id/export", exportStep)
+	g.POST("/steps/import", importStep)
+	g.POST("/steps/seed-defaults", seedDefaults)
+	g.GET("/steps/usage", stepUsage)
+	g.POST("/steps/parse", parseStep)
+
+	g.GET("/workflows", listWorkflows)
+	g.POST("/workflows", createWorkflow)
+	g.GET("/workflows/:id", getWorkflow)
+	g.PUT("/workflows/:id", updateWorkflow)
+	g.DELETE("/workflows/:id", deleteWorkflow)
+	g.POST("/workflows/:id/run", runWorkflow)
+	g.GET("/workflows/:id/runs", listWorkflowRuns)
+
+	g.GET("/runs/:runId", getRun)
+	g.POST("/runs/:runId/cancel", cancelRun)
+	g.GET("/runs/:runId/servers/:serverId/logs", getServerRunLog)
+	g.GET("/runs/:runId/servers/:serverId/logs/stream", streamServerRunLog)
+}
+
+var uuidLike = regexp.MustCompile(`^[a-zA-Z0-9-]{1,64}$`)
+
+func getServerRunLog(c *gin.Context) {
+	runID, serverID := c.Param("runId"), c.Param("serverId")
+	if !uuidLike.MatchString(runID) || !uuidLike.MatchString(serverID) {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid id"})
+		return
+	}
+	path := services.ServerRunLogPath(runID, serverID)
+	b, err := os.ReadFile(path)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "no logs"})
+		return
+	}
+	c.Data(http.StatusOK, "text/plain; charset=utf-8", b)
+}
+
+func streamServerRunLog(c *gin.Context) {
+	runID, serverID := c.Param("runId"), c.Param("serverId")
+	if !uuidLike.MatchString(runID) || !uuidLike.MatchString(serverID) {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid id"})
+		return
+	}
+	path := services.ServerRunLogPath(runID, serverID)
+
+	c.Writer.Header().Set("Content-Type", "text/event-stream")
+	c.Writer.Header().Set("Cache-Control", "no-cache")
+	c.Writer.Header().Set("Connection", "keep-alive")
+	c.Writer.Header().Set("X-Accel-Buffering", "no")
+
+	flusher, ok := c.Writer.(http.Flusher)
+	if !ok {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "stream unsupported"})
+		return
+	}
+
+	var offset int64
+	sendNew := func() {
+		f, err := os.Open(path)
+		if err != nil {
+			return // file may not exist yet; keep waiting
+		}
+		defer f.Close()
+		if _, err := f.Seek(offset, 0); err != nil {
+			return
+		}
+		buf := make([]byte, 32*1024)
+		for {
+			n, _ := f.Read(buf)
+			if n <= 0 {
+				break
+			}
+			offset += int64(n)
+			// SSE data frame; split on newlines to keep frames well-formed.
+			for _, line := range splitSSE(buf[:n]) {
+				_, _ = c.Writer.WriteString("data: " + line + "\n")
+			}
+			_, _ = c.Writer.WriteString("\n")
+			flusher.Flush()
+		}
+	}
+
+	ctx := c.Request.Context()
+	ticker := time.NewTicker(500 * time.Millisecond)
+	defer ticker.Stop()
+	orgID := auth.OrgID(c)
+	for {
+		sendNew()
+		if serverRunTerminal(orgID, runID, serverID) {
+			sendNew() // final drain
+			_, _ = c.Writer.WriteString("event: done\ndata: end\n\n")
+			flusher.Flush()
+			return
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		}
+	}
+}
+
+// serverRunTerminal reports whether the given server-run has reached a terminal status.
+func serverRunTerminal(orgID, runID, serverID string) bool {
+	r, err := services.GetRun(orgID, runID)
+	if err != nil {
+		return true
+	}
+	for _, sr := range r.ServerRuns {
+		if sr.ServerID == serverID {
+			switch sr.Status {
+			case "success", "failed", "skipped", "cancelled":
+				return true
+			}
+			return false
+		}
+	}
+	return true
+}
+
+// splitSSE turns a raw byte slice into SSE-safe payload lines (newlines become
+// separate data lines; carriage returns stripped).
+func splitSSE(b []byte) []string {
+	s := strings.ReplaceAll(string(b), "\r", "")
+	return strings.Split(s, "\n")
+}
+
+func listSteps(c *gin.Context) {
+	steps, err := services.ListSteps(auth.OrgID(c))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, steps)
+}
+
+func stepUsage(c *gin.Context) {
+	counts, err := services.StepUsageCounts(auth.OrgID(c))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, counts)
+}
+
+func createStep(c *gin.Context) {
+	var s models.WorkflowStep
+	if err := c.ShouldBindJSON(&s); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	out, err := services.CreateStep(auth.OrgID(c), s)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.step_created", actorFromCtx(c), "", out.StepID, fmt.Sprintf("step '%s' created", out.Name))
+	c.JSON(http.StatusCreated, out)
+}
+
+func updateStep(c *gin.Context) {
+	var s models.WorkflowStep
+	if err := c.ShouldBindJSON(&s); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if err := services.UpdateStep(auth.OrgID(c), c.Param("id"), s); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.step_updated", actorFromCtx(c), "", c.Param("id"), "step updated")
+	c.JSON(http.StatusOK, gin.H{"updated": true})
+}
+
+func deleteStep(c *gin.Context) {
+	if err := services.DeleteStep(auth.OrgID(c), c.Param("id")); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.step_deleted", actorFromCtx(c), "", c.Param("id"), "step deleted")
+	c.JSON(http.StatusOK, gin.H{"deleted": true})
+}
+
+func exportStep(c *gin.Context) {
+	b, err := services.ExportStep(auth.OrgID(c), c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+	c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=step-%s.json", c.Param("id")))
+	c.Data(http.StatusOK, "application/json", b)
+}
+
+func seedDefaults(c *gin.Context) {
+	created, updated, err := services.SeedDefaultSteps(auth.OrgID(c))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.defaults_synced", actorFromCtx(c), "", "", fmt.Sprintf("default steps synced: %d created, %d updated", created, updated))
+	c.JSON(http.StatusOK, gin.H{"created": created, "updated": updated})
+}
+
+const maxStepBodyBytes = 1 << 20 // 1 MiB
+
+func importStep(c *gin.Context) {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, maxStepBodyBytes)
+	body, err := io.ReadAll(c.Request.Body)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	out, err := services.ImportStepToLibrary(auth.OrgID(c), body)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.step_imported", actorFromCtx(c), "", out.StepID, fmt.Sprintf("step '%s' imported", out.Name))
+	c.JSON(http.StatusCreated, out)
+}
+
+// parseStep validates a step doc and returns the normalized step WITHOUT
+// persisting — used by the editor to insert an imported ad-hoc (inline) step.
+func parseStep(c *gin.Context) {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, maxStepBodyBytes)
+	body, err := io.ReadAll(c.Request.Body)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	s, err := services.ParseStepDoc(body)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, s)
+}
+
+func listWorkflows(c *gin.Context) {
+	wfs, err := services.ListWorkflows(auth.OrgID(c))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, wfs)
+}
+
+func createWorkflow(c *gin.Context) {
+	var w models.Workflow
+	if err := c.ShouldBindJSON(&w); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	out, err := services.CreateWorkflow(auth.OrgID(c), w)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.created", actorFromCtx(c), "", out.WorkflowID, fmt.Sprintf("workflow '%s' created", out.Name))
+	c.JSON(http.StatusCreated, out)
+}
+
+func getWorkflow(c *gin.Context) {
+	w, err := services.GetWorkflow(auth.OrgID(c), c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, w)
+}
+
+func updateWorkflow(c *gin.Context) {
+	var w models.Workflow
+	if err := c.ShouldBindJSON(&w); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if err := services.UpdateWorkflow(auth.OrgID(c), c.Param("id"), w); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.updated", actorFromCtx(c), "", c.Param("id"), "workflow updated")
+	updated, err := services.GetWorkflow(auth.OrgID(c), c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, updated)
+}
+
+func deleteWorkflow(c *gin.Context) {
+	if err := services.DeleteWorkflow(auth.OrgID(c), c.Param("id")); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.deleted", actorFromCtx(c), "", c.Param("id"), "workflow deleted")
+	c.JSON(http.StatusOK, gin.H{"deleted": true})
+}
+
+func runWorkflow(c *gin.Context) {
+	runID, err := services.TriggerWorkflow(auth.OrgID(c), c.Param("id"), actorFromCtx(c))
+	if err != nil {
+		c.JSON(http.StatusServiceUnavailable, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.run_triggered", actorFromCtx(c), "", c.Param("id"), fmt.Sprintf("run %s triggered", runID))
+	c.JSON(http.StatusAccepted, gin.H{"run_id": runID})
+}
+
+func listWorkflowRuns(c *gin.Context) {
+	limit := int64(50)
+	if l := c.Query("limit"); l != "" {
+		if n, err := strconv.ParseInt(l, 10, 64); err == nil && n > 0 {
+			limit = n
+		}
+	}
+	runs, err := services.ListRuns(auth.OrgID(c), c.Param("id"), limit)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, runs)
+}
+
+func getRun(c *gin.Context) {
+	r, err := services.GetRun(auth.OrgID(c), c.Param("runId"))
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, r)
+}
+
+func cancelRun(c *gin.Context) {
+	if err := services.CancelRun(auth.OrgID(c), c.Param("runId")); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent(auth.OrgID(c), "workflow.run_cancelled", actorFromCtx(c), "", c.Param("runId"), "run cancelled")
+	c.JSON(http.StatusOK, gin.H{"cancelled": true})
+}

server/internal/auth/local.go

@@ -0,0 +1,165 @@
+package auth
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+)
+
+func SetSessionCookie(c *gin.Context, sessionID string) {
+	secure := c.Request.TLS != nil || c.GetHeader("X-Forwarded-Proto") == "https"
+	http.SetCookie(c.Writer, &http.Cookie{
+		Name:     sessionCookieName,
+		Value:    sessionID,
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   secure,
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   int(sessionTTL.Seconds()),
+	})
+}
+
+func HandleLocalLogin(c *gin.Context) {
+	var body struct {
+		Email    string `json:"email"`
+		Password string `json:"password"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "email and password required"})
+		return
+	}
+	u, err := services.GetUserByEmail(body.Email)
+	if err != nil || !services.VerifyPassword(u, body.Password) {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid credentials"})
+		return
+	}
+	sessionID, err := SaveSession(c.Request.Context(), &Session{
+		UserID: u.UserID, OrgID: u.OrgID, Role: u.Role, Email: u.Email,
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "session save failed"})
+		return
+	}
+	_ = services.TouchLastLogin(u.UserID)
+	SetSessionCookie(c, sessionID)
+	c.JSON(http.StatusOK, gin.H{"ok": true})
+}
+
+// HandleBootstrapStatus answers "does the caller need to run setup". It is
+// unauthenticated, so it must not report instance-wide state to whoever asks:
+// on an org host the answer is scoped to that org, and only the apex — the
+// genuine first-run entry point — gets the global "no users anywhere" answer.
+func HandleBootstrapStatus(c *gin.Context) {
+	var (
+		n   int64
+		err error
+	)
+	if org, ok := OrgFromHost(c); ok {
+		n, err = services.CountOrgUsers(org.OrgID)
+	} else {
+		n, err = services.CountUsers()
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"needs_setup": n == 0})
+}
+
+// HandleBootstrap creates the very first org and its owner, so its guard stays
+// deliberately global: it may run once on an empty instance and never again,
+// regardless of which host it is called on.
+func HandleBootstrap(c *gin.Context) {
+	n, err := services.CountUsers()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if n > 0 {
+		c.JSON(http.StatusConflict, gin.H{"error": "setup already complete"})
+		return
+	}
+	var body struct {
+		OrgName  string `json:"org_name"`
+		Email    string `json:"email"`
+		Password string `json:"password"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil || body.OrgName == "" || body.Email == "" || len(body.Password) < 8 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "org_name, email, and password (>=8 chars) required"})
+		return
+	}
+	// An upgrade from single-tenant arrives here with no users but with the org
+	// the migrations created and stamped onto every legacy document. Creating a
+	// second org would put the owner somewhere else entirely, and since every
+	// org-scoped read filters on org_id, the operator would land in an empty
+	// Vantage with all their real data still under the migrated org — silent,
+	// total-looking data loss. So adopt the existing org instead, and only
+	// create when there genuinely is none. Same `switch orgCount` shape as
+	// migration 0002.
+	orgCount, err := services.CountOrgs()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	var org *models.Org
+	switch orgCount {
+	case 0:
+		org, err = services.CreateOrg(body.OrgName)
+	case 1:
+		var existing *models.Org
+		existing, err = services.FirstOrg()
+		if err == nil {
+			org, err = services.AdoptOrg(existing.OrgID, body.OrgName)
+		}
+	default:
+		c.JSON(http.StatusConflict, gin.H{"error": fmt.Sprintf(
+			"cannot bootstrap: %d organizations already exist but no users do; "+
+				"create the owner against the intended org rather than through setup, "+
+				"or remove the unintended orgs and retry", orgCount)})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	u, err := services.CreateUser(org.OrgID, body.Email, body.Password, "owner", "local")
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	sessionID, err := SaveSession(c.Request.Context(), &Session{
+		UserID: u.UserID, OrgID: u.OrgID, Role: u.Role, Email: u.Email,
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "session save failed"})
+		return
+	}
+	SetSessionCookie(c, sessionID)
+	c.JSON(http.StatusCreated, gin.H{"org": org, "slug": org.Slug})
+}
+
+func HandleMe(c *gin.Context) {
+	cookie, err := c.Request.Cookie(sessionCookieName)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "not authenticated"})
+		return
+	}
+	sess, err := GetSession(c.Request.Context(), cookie.Value)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "session expired"})
+		return
+	}
+	// /auth/me is registered outside Middleware, so it repeats the middleware's
+	// host/org match itself. Without this, a session for org A presented on org
+	// B's host would render the shell while every /api call 403s.
+	if hostOrg, ok := OrgFromHost(c); ok && hostOrg.OrgID != sess.OrgID {
+		c.JSON(http.StatusForbidden, gin.H{"error": "org host mismatch"})
+		return
+	}
+
+	org, _ := services.GetOrg(sess.OrgID)
+	c.JSON(http.StatusOK, gin.H{"user": sess, "org": org})
+}

server/internal/auth/middleware.go

@@ -14,13 +14,42 @@ func GetSessionFromContext(c *gin.Context) *Session {
 	return sess
 }
 
+func OrgID(c *gin.Context) string {
+	if s := GetSessionFromContext(c); s != nil {
+		return s.OrgID
+	}
+	return ""
+}
+
+func Role(c *gin.Context) string {
+	if s := GetSessionFromContext(c); s != nil {
+		return s.Role
+	}
+	return ""
+}
+
+func UserID(c *gin.Context) string {
+	if s := GetSessionFromContext(c); s != nil {
+		return s.UserID
+	}
+	return ""
+}
+
+func RequireRole(roles ...string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		r := Role(c)
+		for _, want := range roles {
+			if r == want {
+				c.Next()
+				return
+			}
+		}
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "insufficient role"})
+	}
+}
+
 func Middleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
-		if !authEnabled {
-			c.Next()
-			return
-		}
-
 		cookie, err := c.Request.Cookie(sessionCookieName)
 		if err != nil {
 			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "not authenticated"})
@@ -33,7 +62,20 @@ func Middleware() gin.HandlerFunc {
 			return
 		}
 
+			// An org-less session would turn every downstream scope into
+		// {"org_id": ""} — fail closed rather than query across tenants.
+		if sess.OrgID == "" {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "session has no organization"})
+			return
+		}
+
 		c.Set(ctxSessionKey, sess)
+
+		if hostOrg, ok := OrgFromHost(c); ok && hostOrg.OrgID != sess.OrgID {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "org host mismatch"})
+			return
+		}
+
 		c.Next()
 	}
 }

server/internal/auth/oidc.go

@@ -2,123 +2,155 @@ package auth
 
 import (
 	"context"
-	"log"
+	"fmt"
 	"net/http"
-	"os"
+	"strings"
+	"sync"
 
 	"github.com/coreos/go-oidc/v3/oidc"
 	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/services"
 	"golang.org/x/oauth2"
 )
 
 var (
-	oidcProvider *oidc.Provider
-	oauth2Cfg    *oauth2.Config
-	authEnabled  bool
+	provMu    sync.Mutex
+	provCache = map[string]*oidc.Provider{}
 )
 
-func InitOIDC(ctx context.Context) error {
-	issuer := os.Getenv("OIDC_ISSUER")
-	if issuer == "" {
-		log.Println("OIDC_ISSUER not set; authentication disabled")
-		return nil
-	}
-
-	p, err := oidc.NewProvider(ctx, issuer)
-	if err != nil {
-		return err
-	}
-	oidcProvider = p
-	oauth2Cfg = &oauth2.Config{
-		ClientID:     os.Getenv("OIDC_CLIENT_ID"),
-		ClientSecret: os.Getenv("OIDC_CLIENT_SECRET"),
-		RedirectURL:  os.Getenv("OIDC_REDIRECT_URL"),
-		Endpoint:     p.Endpoint(),
-		Scopes:       []string{oidc.ScopeOpenID, "profile", "email"},
-	}
-	authEnabled = true
-	log.Println("OIDC authentication enabled")
-	return nil
+// EvictOIDCProvider drops an org's cached provider so the next login rediscovers
+// it from the (possibly changed) issuer. Called by the API layer after the org's
+// OIDC config is saved — services cannot import auth, so the handler wires it.
+func EvictOIDCProvider(orgID string) {
+	provMu.Lock()
+	delete(provCache, orgID)
+	provMu.Unlock()
 }
 
-func Enabled() bool { return authEnabled }
+func redirectURL(c *gin.Context) string {
+	scheme := "https"
+	if c.Request.TLS == nil && c.GetHeader("X-Forwarded-Proto") != "https" {
+		scheme = "http"
+	}
+	return fmt.Sprintf("%s://%s/auth/oidc/callback", scheme, c.Request.Host)
+}
 
-func HandleLogin(c *gin.Context) {
-	state, err := randomHex(16)
+// providerForOrg returns the org's (cached) OIDC provider plus a request-local
+// oauth2 config. The config is never stored on the cached entry: RedirectURL is
+// derived from this request's Host, so sharing it would let one in-flight login
+// overwrite another's redirect URI.
+func providerForOrg(ctx context.Context, c *gin.Context, orgID string) (*oidc.Provider, *oauth2.Config, error) {
+	cfg, err := services.GetOrgOIDC(orgID)
+	if err != nil || !cfg.Enabled {
+		return nil, nil, fmt.Errorf("org SSO not configured")
+	}
+	secret, err := services.GetOrgOIDCSecret(orgID)
 	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "state generation failed"})
+		return nil, nil, err
+	}
+	provMu.Lock()
+	p := provCache[orgID]
+	provMu.Unlock()
+	if p == nil {
+		p, err = oidc.NewProvider(ctx, cfg.Issuer)
+		if err != nil {
+			return nil, nil, err
+		}
+		provMu.Lock()
+		provCache[orgID] = p
+		provMu.Unlock()
+	}
+	return p, &oauth2.Config{
+		ClientID: cfg.ClientID, ClientSecret: secret,
+		RedirectURL: redirectURL(c), Endpoint: p.Endpoint(),
+		Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
+	}, nil
+}
+
+func HandleOIDCStart(c *gin.Context) {
+	org, ok := OrgFromHost(c)
+	if !ok {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "unknown organization host"})
 		return
 	}
-	if err := SaveState(c.Request.Context(), state); err != nil {
+	ctx := c.Request.Context()
+	_, oauthCfg, err := providerForOrg(ctx, c, org.OrgID)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	state, err := randomHex(16)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "state gen failed"})
+		return
+	}
+	if err := SaveStateOrg(ctx, state, org.OrgID); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "state save failed"})
 		return
 	}
-	c.Redirect(http.StatusFound, oauth2Cfg.AuthCodeURL(state))
+	c.Redirect(http.StatusFound, oauthCfg.AuthCodeURL(state))
 }
 
-func HandleCallback(c *gin.Context) {
+func HandleOIDCCallback(c *gin.Context) {
 	ctx := c.Request.Context()
-
-	if !ConsumeState(ctx, c.Query("state")) {
+	orgID, ok := ConsumeStateOrg(ctx, c.Query("state"))
+	if !ok {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid state"})
 		return
 	}
-
-	token, err := oauth2Cfg.Exchange(ctx, c.Query("code"))
+	provider, oauthCfg, err := providerForOrg(ctx, c, orgID)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	token, err := oauthCfg.Exchange(ctx, c.Query("code"))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "token exchange failed"})
 		return
 	}
-
 	rawIDToken, ok := token.Extra("id_token").(string)
 	if !ok {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "missing id_token"})
 		return
 	}
-
-	verifier := oidcProvider.Verifier(&oidc.Config{ClientID: oauth2Cfg.ClientID})
-	idToken, err := verifier.Verify(ctx, rawIDToken)
+	idToken, err := provider.Verifier(&oidc.Config{ClientID: oauthCfg.ClientID}).Verify(ctx, rawIDToken)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "token verification failed"})
 		return
 	}
-
 	var claims struct {
-		Sub   string `json:"sub"`
 		Email string `json:"email"`
 		Name  string `json:"name"`
 	}
-	if err := idToken.Claims(&claims); err != nil {
+	if err := idToken.Claims(&claims); err != nil || claims.Email == "" {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "claims extraction failed"})
 		return
 	}
 
+	email := strings.ToLower(claims.Email)
+	u, err := services.GetUserByEmail(email)
+	if err != nil {
+		// provision new member in THIS org
+		u, err = services.CreateUser(orgID, email, "", "member", "oidc")
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "provisioning failed"})
+			return
+		}
+	} else if u.OrgID != orgID {
+		c.JSON(http.StatusForbidden, gin.H{"error": "email belongs to a different organization"})
+		return
+	}
+
 	sessionID, err := SaveSession(ctx, &Session{
-		UserID: claims.Sub,
-		Email:  claims.Email,
-		Name:   claims.Name,
+		UserID: u.UserID, OrgID: u.OrgID, Role: u.Role, Email: u.Email, Name: claims.Name,
 	})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "session save failed"})
 		return
 	}
-
-	secure := c.Request.TLS != nil || c.GetHeader("X-Forwarded-Proto") == "https"
-	http.SetCookie(c.Writer, &http.Cookie{
-		Name:     sessionCookieName,
-		Value:    sessionID,
-		Path:     "/",
-		HttpOnly: true,
-		Secure:   secure,
-		SameSite: http.SameSiteLaxMode,
-		MaxAge:   int(sessionTTL.Seconds()),
-	})
-
-	frontendURL := os.Getenv("PUBLIC_HOST")
-	if frontendURL == "" {
-		frontendURL = "/"
-	}
-	c.Redirect(http.StatusFound, frontendURL)
+	_ = services.TouchLastLogin(u.UserID)
+	SetSessionCookie(c, sessionID)
+	c.Redirect(http.StatusFound, "/")
 }
 
 func HandleLogout(c *gin.Context) {
@@ -134,21 +166,3 @@ func HandleLogout(c *gin.Context) {
 	})
 	c.Redirect(http.StatusFound, "/")
 }
-
-func HandleMe(c *gin.Context) {
-	if !authEnabled {
-		c.JSON(http.StatusOK, gin.H{"auth_enabled": false})
-		return
-	}
-	cookie, err := c.Request.Cookie(sessionCookieName)
-	if err != nil {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "not authenticated"})
-		return
-	}
-	sess, err := GetSession(c.Request.Context(), cookie.Value)
-	if err != nil {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "session expired"})
-		return
-	}
-	c.JSON(http.StatusOK, sess)
-}

server/internal/auth/orghost.go

@@ -0,0 +1,80 @@
+package auth
+
+import (
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+)
+
+type cachedOrg struct {
+	org *models.Org
+	at  time.Time
+}
+
+var (
+	orgCacheMu sync.Mutex
+	orgCache   = map[string]cachedOrg{}
+)
+
+const orgCacheTTL = 60 * time.Second
+
+// appRootLabel is the DNS label the app is deployed under, i.e. the "vantage"
+// in <slug>.vantage.<tld>. Deployments on another root must set APP_ROOT_LABEL
+// or every host resolves to no org, disabling the host/session mismatch guard.
+func appRootLabel() string {
+	if v := os.Getenv("APP_ROOT_LABEL"); v != "" {
+		return strings.ToLower(v)
+	}
+	return "vantage"
+}
+
+// hostSlug extracts the leftmost DNS label if the host is a subdomain of the
+// app root. Returns "" for the apex or an unknown host shape.
+func hostSlug(host string) string {
+	host = strings.ToLower(host)
+	if i := strings.IndexByte(host, ':'); i >= 0 {
+		host = host[:i]
+	}
+	root := appRootLabel()
+	// Expect <slug>.<root>.<...>; apex is <root>.<...>
+	parts := strings.Split(host, ".")
+	if len(parts) < 3 {
+		return ""
+	}
+	if parts[1] != root {
+		return ""
+	}
+	if parts[0] == root || parts[0] == "www" {
+		return ""
+	}
+	return parts[0]
+}
+
+func OrgFromHost(c *gin.Context) (*models.Org, bool) {
+	slug := hostSlug(c.Request.Host)
+	if slug == "" {
+		return nil, false
+	}
+	orgCacheMu.Lock()
+	if e, ok := orgCache[slug]; ok && time.Since(e.at) < orgCacheTTL {
+		orgCacheMu.Unlock()
+		return e.org, e.org != nil
+	}
+	orgCacheMu.Unlock()
+
+	org, err := services.GetOrgBySlug(slug)
+	if err != nil || org == nil {
+		// Never cache a miss: a just-bootstrapped org would otherwise 404 on its
+		// own subdomain for the rest of the TTL. Misses are cheap and rare.
+		return nil, false
+	}
+	orgCacheMu.Lock()
+	orgCache[slug] = cachedOrg{org: org, at: time.Now()}
+	orgCacheMu.Unlock()
+	return org, true
+}

server/internal/auth/session.go

@@ -17,6 +17,8 @@ const statePrefix = "km:state:"
 
 type Session struct {
 	UserID string `json:"user_id"`
+	OrgID  string `json:"org_id"`
+	Role   string `json:"role"`
 	Email  string `json:"email"`
 	Name   string `json:"name"`
 }
@@ -69,11 +71,14 @@ func DeleteSession(ctx context.Context, id string) error {
 	return rdb.Del(ctx, sessionPrefix+id).Err()
 }
 
-func SaveState(ctx context.Context, state string) error {
-	return rdb.Set(ctx, statePrefix+state, "1", 10*time.Minute).Err()
+func SaveStateOrg(ctx context.Context, state, orgID string) error {
+	return rdb.Set(ctx, statePrefix+state, orgID, 10*time.Minute).Err()
 }
 
-func ConsumeState(ctx context.Context, state string) bool {
-	n, err := rdb.Del(ctx, statePrefix+state).Result()
-	return err == nil && n > 0
+func ConsumeStateOrg(ctx context.Context, state string) (string, bool) {
+	orgID, err := rdb.GetDel(ctx, statePrefix+state).Result()
+	if err != nil || orgID == "" {
+		return "", false
+	}
+	return orgID, true
 }

server/internal/checker/checker.go

@@ -0,0 +1,226 @@
+// Package checker runs service checks (http/tcp/icmp/tls) and returns a uniform
+// Result. It has no dependency on models or pb so it can be duplicated verbatim
+// into the agent module (agent-run monitors) — callers map their own monitor
+// representation onto Spec.
+package checker
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+)
+
+// Check types (mirror models.Monitor* constants).
+const (
+	TypeHTTP = "http"
+	TypeTCP  = "tcp"
+	TypeICMP = "icmp"
+	TypeTLS  = "tls"
+)
+
+// Spec is a self-contained description of a single check.
+type Spec struct {
+	Type           string
+	URL            string
+	Host           string
+	Port           int
+	Method         string
+	ExpectedStatus int
+	Keyword        string
+	TLSWarnDays    int
+	Insecure       bool // skip TLS certificate verification (HTTP checks)
+	TimeoutSec     int
+}
+
+// Result is the uniform outcome of running a check.
+type Result struct {
+	Up         bool
+	LatencyMs  int
+	Message    string
+	CertExpiry *time.Time
+}
+
+func (s Spec) timeout() time.Duration {
+	t := s.TimeoutSec
+	if t <= 0 || t > 10 {
+		t = 10
+	}
+	return time.Duration(t) * time.Second
+}
+
+// Run executes the check described by s.
+func Run(ctx context.Context, s Spec) Result {
+	switch s.Type {
+	case TypeHTTP:
+		return runHTTP(ctx, s)
+	case TypeTCP:
+		return runTCP(ctx, s)
+	case TypeICMP:
+		return runICMP(ctx, s)
+	case TypeTLS:
+		return runTLS(ctx, s)
+	default:
+		return Result{Message: "unknown check type: " + s.Type}
+	}
+}
+
+func runHTTP(ctx context.Context, s Spec) Result {
+	method := s.Method
+	if method == "" {
+		method = http.MethodGet
+	}
+	expect := s.ExpectedStatus
+	if expect == 0 {
+		expect = 200
+	}
+	client := &http.Client{Timeout: s.timeout()}
+	if s.Insecure {
+		client.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec // opt-in per monitor
+	}
+	start := time.Now()
+	req, err := http.NewRequestWithContext(ctx, method, s.URL, nil)
+	if err != nil {
+		return Result{Message: err.Error()}
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	defer resp.Body.Close()
+	res := Result{LatencyMs: msSince(start), Up: true}
+	if resp.TLS != nil && len(resp.TLS.PeerCertificates) > 0 {
+		exp := resp.TLS.PeerCertificates[0].NotAfter
+		res.CertExpiry = &exp
+	}
+	if resp.StatusCode != expect {
+		return Result{LatencyMs: res.LatencyMs, CertExpiry: res.CertExpiry, Message: fmt.Sprintf("status %d (want %d)", resp.StatusCode, expect)}
+	}
+	if s.Keyword != "" {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+		if !strings.Contains(string(body), s.Keyword) {
+			return Result{LatencyMs: res.LatencyMs, CertExpiry: res.CertExpiry, Message: "keyword not found"}
+		}
+	}
+	return res
+}
+
+func runTCP(ctx context.Context, s Spec) Result {
+	addr := net.JoinHostPort(s.Host, fmt.Sprint(s.Port))
+	start := time.Now()
+	d := net.Dialer{Timeout: s.timeout()}
+	conn, err := d.DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	conn.Close()
+	return Result{Up: true, LatencyMs: msSince(start)}
+}
+
+func runTLS(ctx context.Context, s Spec) Result {
+	port := s.Port
+	if port == 0 {
+		port = 443
+	}
+	addr := net.JoinHostPort(s.Host, fmt.Sprint(port))
+	start := time.Now()
+	d := net.Dialer{Timeout: s.timeout()}
+	conn, err := tls.DialWithDialer(&d, "tcp", addr, &tls.Config{ServerName: s.Host})
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	defer conn.Close()
+	certs := conn.ConnectionState().PeerCertificates
+	if len(certs) == 0 {
+		return Result{LatencyMs: msSince(start), Message: "no peer certificate"}
+	}
+	exp := certs[0].NotAfter
+	res := Result{LatencyMs: msSince(start), CertExpiry: &exp}
+	warn := s.TLSWarnDays
+	if warn <= 0 {
+		warn = 14
+	}
+	remaining := time.Until(exp)
+	if remaining <= 0 {
+		res.Message = "certificate expired"
+		return res
+	}
+	if remaining <= time.Duration(warn)*24*time.Hour {
+		res.Message = fmt.Sprintf("certificate expires in %d days", int(remaining.Hours()/24))
+		return res
+	}
+	res.Up = true
+	return res
+}
+
+func msSince(t time.Time) int { return int(time.Since(t).Milliseconds()) }
+
+// runICMP sends a single ICMP echo request and waits for the reply. Requires
+// raw-socket privileges (the agent and server run as root). Returns down with a
+// descriptive message when the socket cannot be opened or no reply arrives.
+func runICMP(ctx context.Context, s Spec) Result {
+	dst, err := net.ResolveIPAddr("ip4", s.Host)
+	if err != nil {
+		return Result{Message: err.Error()}
+	}
+	conn, err := net.ListenPacket("ip4:icmp", "0.0.0.0")
+	if err != nil {
+		return Result{Message: "icmp socket: " + err.Error()}
+	}
+	defer conn.Close()
+
+	id := os.Getpid() & 0xffff
+	pkt := icmpEcho(id, 1)
+	deadline := time.Now().Add(s.timeout())
+	if d, ok := ctx.Deadline(); ok && d.Before(deadline) {
+		deadline = d
+	}
+	_ = conn.SetDeadline(deadline)
+
+	start := time.Now()
+	if _, err := conn.WriteTo(pkt, dst); err != nil {
+		return Result{Message: err.Error()}
+	}
+	reply := make([]byte, 1500)
+	for {
+		n, peer, err := conn.ReadFrom(reply)
+		if err != nil {
+			return Result{LatencyMs: msSince(start), Message: "no reply"}
+		}
+		// Skip the IPv4 header (20 bytes) to reach the ICMP message.
+		if n < 28 || peer.String() != dst.String() {
+			continue
+		}
+		if reply[20] == 0 { // ICMP echo reply type
+			return Result{Up: true, LatencyMs: msSince(start)}
+		}
+	}
+}
+
+func icmpEcho(id, seq int) []byte {
+	// Type(8)=echo request, Code=0, Checksum, ID, Seq, no payload.
+	b := []byte{8, 0, 0, 0, byte(id >> 8), byte(id), byte(seq >> 8), byte(seq)}
+	cs := icmpChecksum(b)
+	b[2] = byte(cs >> 8)
+	b[3] = byte(cs)
+	return b
+}
+
+func icmpChecksum(b []byte) uint16 {
+	var sum uint32
+	for i := 0; i < len(b)-1; i += 2 {
+		sum += uint32(b[i])<<8 | uint32(b[i+1])
+	}
+	if len(b)%2 == 1 {
+		sum += uint32(b[len(b)-1]) << 8
+	}
+	for sum>>16 != 0 {
+		sum = (sum & 0xffff) + (sum >> 16)
+	}
+	return ^uint16(sum)
+}

server/internal/grpc/pb/vantage.pb.go

@@ -63,14 +63,91 @@ type ReportUpdatesRequest struct {
 
 type ReportUpdatesResponse struct{}
 
+// Inventory report message types
+
+type CPUReport struct {
+	Model    string  `json:"model,omitempty"`
+	Cores    int     `json:"cores,omitempty"`
+	UsagePct float64 `json:"usage_pct"`
+	Load1    float64 `json:"load1,omitempty"`
+}
+type MemReport struct {
+	TotalBytes uint64 `json:"total_bytes"`
+	UsedBytes  uint64 `json:"used_bytes"`
+}
+type PartitionReport struct {
+	Device     string `json:"device"`
+	Mountpoint string `json:"mountpoint"`
+	Fstype     string `json:"fstype,omitempty"`
+	TotalBytes uint64 `json:"total_bytes"`
+	UsedBytes  uint64 `json:"used_bytes"`
+}
+type InventoryReport struct {
+	ServerId      string            `json:"server_id"`
+	AgentToken    string            `json:"agent_token"`
+	IncludeStatic bool              `json:"include_static"`
+	CPU           *CPUReport        `json:"cpu,omitempty"`
+	Memory        *MemReport        `json:"memory,omitempty"`
+	SwapTotal     uint64            `json:"swap_total"`
+	SwapUsed      uint64            `json:"swap_used"`
+	Partitions    []PartitionReport `json:"partitions,omitempty"`
+	Kernel        string            `json:"kernel,omitempty"`
+}
+type InventoryReportResponse struct{}
+
+// Monitor sync / check report message types
+
+type MonitorSpec struct {
+	MonitorId      string `json:"monitor_id"`
+	Type           string `json:"type"`
+	URL            string `json:"url,omitempty"`
+	Host           string `json:"host,omitempty"`
+	Port           int    `json:"port,omitempty"`
+	Method         string `json:"method,omitempty"`
+	ExpectedStatus int    `json:"expected_status,omitempty"`
+	Keyword        string `json:"keyword,omitempty"`
+	TLSWarnDays    int    `json:"tls_warn_days,omitempty"`
+	Insecure       bool   `json:"insecure,omitempty"`
+	IntervalSec    int    `json:"interval_sec"`
+	Retries        int    `json:"retries"`
+}
+type SyncMonitorsRequest struct {
+	ServerId   string `json:"server_id"`
+	AgentToken string `json:"agent_token"`
+}
+type SyncMonitorsResponse struct {
+	Monitors []MonitorSpec `json:"monitors,omitempty"`
+}
+type CheckResult struct {
+	MonitorId     string `json:"monitor_id"`
+	Up            bool   `json:"up"`
+	LatencyMs     int    `json:"latency_ms"`
+	Message       string `json:"message,omitempty"`
+	CertExpiryUnix int64 `json:"cert_expiry_unix,omitempty"`
+}
+type ReportChecksRequest struct {
+	ServerId   string        `json:"server_id"`
+	AgentToken string        `json:"agent_token"`
+	Results    []CheckResult `json:"results,omitempty"`
+}
+type ReportChecksResponse struct{}
+
 type ApplyUpdatesCmd struct{}
 
 type ServerCommand struct {
-	CommandId    string           `json:"command_id"`
-	GenerateKey  *GenerateKeyCmd  `json:"generate_key,omitempty"`
-	DeleteKey    *DeleteKeyCmd    `json:"delete_key,omitempty"`
-	UpdateAgent  *UpdateAgentCmd  `json:"update_agent,omitempty"`
-	ApplyUpdates *ApplyUpdatesCmd `json:"apply_updates,omitempty"`
+	CommandId        string               `json:"command_id"`
+	GenerateKey      *GenerateKeyCmd      `json:"generate_key,omitempty"`
+	DeleteKey        *DeleteKeyCmd        `json:"delete_key,omitempty"`
+	UpdateAgent      *UpdateAgentCmd      `json:"update_agent,omitempty"`
+	ApplyUpdates     *ApplyUpdatesCmd     `json:"apply_updates,omitempty"`
+	RunStep          *RunStepCmd          `json:"run_step,omitempty"`
+	CleanupWorkspace *CleanupWorkspaceCmd `json:"cleanup_workspace,omitempty"`
+}
+
+// CleanupWorkspaceCmd tells the agent to recursively remove the run's working
+// directory once all steps on that server have finished.
+type CleanupWorkspaceCmd struct {
+	WorkspaceId string `json:"workspace_id"`
 }
 
 type DeleteKeyCmd struct {
@@ -91,10 +168,12 @@ type GenerateKeyCmd struct {
 }
 
 type AgentMessage struct {
-	ServerId   string         `json:"server_id"`
-	AgentToken string         `json:"agent_token"`
-	Ready      *AgentReady    `json:"ready,omitempty"`
-	Result     *CommandResult `json:"result,omitempty"`
+	ServerId   string            `json:"server_id"`
+	AgentToken string            `json:"agent_token"`
+	Ready      *AgentReady       `json:"ready,omitempty"`
+	Result     *CommandResult    `json:"result,omitempty"`
+	StepResult *StepResult       `json:"step_result,omitempty"`
+	StepOutput *StepOutputChunk  `json:"step_output,omitempty"`
 }
 
 type AgentReady struct{}
@@ -105,6 +184,31 @@ type CommandResult struct {
 	Message   string `json:"message"`
 }
 
+type RunStepCmd struct {
+	Interpreter    string            `json:"interpreter"`
+	Script         string            `json:"script"`
+	Env            map[string]string `json:"env,omitempty"`
+	TimeoutSeconds int               `json:"timeout_seconds,omitempty"`
+	// WorkspaceId names the per-run working directory the agent creates and uses
+	// as the step's cwd. Empty means run in the agent's default directory.
+	WorkspaceId string `json:"workspace_id,omitempty"`
+}
+
+type StepResult struct {
+	CommandId string            `json:"command_id"`
+	ExitCode  int               `json:"exit_code"`
+	Stdout    string            `json:"stdout,omitempty"`
+	Stderr    string            `json:"stderr,omitempty"`
+	OutputEnv map[string]string `json:"output_env,omitempty"`
+}
+
+type StepOutputChunk struct {
+	CommandId string `json:"command_id"`
+	Seq       uint64 `json:"seq"`
+	Data      []byte `json:"data,omitempty"`
+	Eof       bool   `json:"eof,omitempty"`
+}
+
 // CommandStream server-side interface
 
 type Vantage_CommandStreamServer interface {
@@ -160,6 +264,9 @@ type VantageServer interface {
 	SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error)
 	UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error)
 	ReportUpdates(context.Context, *ReportUpdatesRequest) (*ReportUpdatesResponse, error)
+	ReportInventory(context.Context, *InventoryReport) (*InventoryReportResponse, error)
+	SyncMonitors(context.Context, *SyncMonitorsRequest) (*SyncMonitorsResponse, error)
+	ReportChecks(context.Context, *ReportChecksRequest) (*ReportChecksResponse, error)
 	CommandStream(Vantage_CommandStreamServer) error
 }
 
@@ -181,6 +288,18 @@ func (UnimplementedVantageServer) ReportUpdates(context.Context, *ReportUpdatesR
 	return nil, status.Errorf(codes.Unimplemented, "method ReportUpdates not implemented")
 }
 
+func (UnimplementedVantageServer) ReportInventory(context.Context, *InventoryReport) (*InventoryReportResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ReportInventory not implemented")
+}
+
+func (UnimplementedVantageServer) SyncMonitors(context.Context, *SyncMonitorsRequest) (*SyncMonitorsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SyncMonitors not implemented")
+}
+
+func (UnimplementedVantageServer) ReportChecks(context.Context, *ReportChecksRequest) (*ReportChecksResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ReportChecks not implemented")
+}
+
 func (UnimplementedVantageServer) CommandStream(Vantage_CommandStreamServer) error {
 	return status.Errorf(codes.Unimplemented, "method CommandStream not implemented")
 }
@@ -192,6 +311,9 @@ type VantageClient interface {
 	SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error)
 	UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error)
 	ReportUpdates(ctx context.Context, in *ReportUpdatesRequest, opts ...grpc.CallOption) (*ReportUpdatesResponse, error)
+	ReportInventory(ctx context.Context, in *InventoryReport, opts ...grpc.CallOption) (*InventoryReportResponse, error)
+	SyncMonitors(ctx context.Context, in *SyncMonitorsRequest, opts ...grpc.CallOption) (*SyncMonitorsResponse, error)
+	ReportChecks(ctx context.Context, in *ReportChecksRequest, opts ...grpc.CallOption) (*ReportChecksResponse, error)
 	CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error)
 }
 
@@ -235,6 +357,30 @@ func (c *keyManagerClient) ReportUpdates(ctx context.Context, in *ReportUpdatesR
 	return out, nil
 }
 
+func (c *keyManagerClient) ReportInventory(ctx context.Context, in *InventoryReport, opts ...grpc.CallOption) (*InventoryReportResponse, error) {
+	out := new(InventoryReportResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/ReportInventory", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) SyncMonitors(ctx context.Context, in *SyncMonitorsRequest, opts ...grpc.CallOption) (*SyncMonitorsResponse, error) {
+	out := new(SyncMonitorsResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/SyncMonitors", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) ReportChecks(ctx context.Context, in *ReportChecksRequest, opts ...grpc.CallOption) (*ReportChecksResponse, error) {
+	out := new(ReportChecksResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/ReportChecks", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *keyManagerClient) CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error) {
 	stream, err := c.cc.NewStream(ctx, &Vantage_ServiceDesc.Streams[0], "/vantage.v1.Vantage/CommandStream", opts...)
 	if err != nil {
@@ -257,6 +403,9 @@ var Vantage_ServiceDesc = grpc.ServiceDesc{
 		{MethodName: "SyncKeys", Handler: _Vantage_SyncKeys_Handler},
 		{MethodName: "UploadGeneratedKey", Handler: _Vantage_UploadGeneratedKey_Handler},
 		{MethodName: "ReportUpdates", Handler: _Vantage_ReportUpdates_Handler},
+		{MethodName: "ReportInventory", Handler: _Vantage_ReportInventory_Handler},
+		{MethodName: "SyncMonitors", Handler: _Vantage_SyncMonitors_Handler},
+		{MethodName: "ReportChecks", Handler: _Vantage_ReportChecks_Handler},
 	},
 	Streams: []grpc.StreamDesc{
 		{
@@ -329,6 +478,51 @@ func _Vantage_ReportUpdates_Handler(srv interface{}, ctx context.Context, dec fu
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Vantage_ReportInventory_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(InventoryReport)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).ReportInventory(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/ReportInventory"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).ReportInventory(ctx, req.(*InventoryReport))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Vantage_SyncMonitors_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SyncMonitorsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).SyncMonitors(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/SyncMonitors"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).SyncMonitors(ctx, req.(*SyncMonitorsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Vantage_ReportChecks_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ReportChecksRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).ReportChecks(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/ReportChecks"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).ReportChecks(ctx, req.(*ReportChecksRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Vantage_CommandStream_Handler(srv interface{}, stream grpc.ServerStream) error {
 	return srv.(VantageServer).CommandStream(&keyManagerCommandStreamServer{stream})
 }

server/internal/grpc/server.go

@@ -7,6 +7,7 @@ import (
 	"net"
 	"time"
 
+	"github.com/mrhid6/vantage/server/internal/checker"
 	"github.com/mrhid6/vantage/server/internal/grpc/pb"
 	"github.com/mrhid6/vantage/server/internal/models"
 	"github.com/mrhid6/vantage/server/internal/services"
@@ -62,13 +63,13 @@ func (s *vantageServer) UploadGeneratedKey(ctx context.Context, req *pb.UploadKe
 	}
 
 	// Agent-generated keys carry no passphrase over the wire (proto has no field).
-	key, err := services.CreateKey(req.Label, req.PublicKey, "generated", srv.ServerID, req.PrivateKey, "")
+	key, err := services.CreateKey(srv.OrgID, req.Label, req.PublicKey, "generated", srv.ServerID, req.PrivateKey, "")
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, "failed to store key: %v", err)
 	}
 
 	// Auto-assign to the generating server
-	if _, err := services.AssignKey(key.KeyID, srv.ServerID); err != nil {
+	if _, err := services.AssignKey(srv.OrgID, key.KeyID, srv.ServerID); err != nil {
 		log.Printf("failed to auto-assign generated key: %v", err)
 	}
 
@@ -95,6 +96,66 @@ func (s *vantageServer) ReportUpdates(ctx context.Context, req *pb.ReportUpdates
 	return &pb.ReportUpdatesResponse{}, nil
 }
 
+func (s *vantageServer) ReportInventory(ctx context.Context, req *pb.InventoryReport) (*pb.InventoryReportResponse, error) {
+	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
+	if err != nil {
+		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
+	}
+	if err := services.StoreInventory(srv.ServerID, req); err != nil {
+		log.Printf("store inventory for %s: %v", srv.ServerID, err)
+	}
+	return &pb.InventoryReportResponse{}, nil
+}
+
+func (s *vantageServer) SyncMonitors(ctx context.Context, req *pb.SyncMonitorsRequest) (*pb.SyncMonitorsResponse, error) {
+	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
+	if err != nil {
+		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
+	}
+	monitors, err := services.ListMonitorsForRunner(srv.OrgID, srv.ServerID)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "list monitors")
+	}
+	specs := make([]pb.MonitorSpec, 0, len(monitors))
+	for _, m := range monitors {
+		specs = append(specs, pb.MonitorSpec{
+			MonitorId:      m.MonitorID,
+			Type:           m.Type,
+			URL:            m.Target.URL,
+			Host:           m.Target.Host,
+			Port:           m.Target.Port,
+			Method:         m.Target.Method,
+			ExpectedStatus: m.Target.ExpectedStatus,
+			Keyword:        m.Target.Keyword,
+			TLSWarnDays:    m.Target.TLSWarnDays,
+			Insecure:       m.Target.Insecure,
+			IntervalSec:    m.IntervalSec,
+			Retries:        m.Retries,
+		})
+	}
+	return &pb.SyncMonitorsResponse{Monitors: specs}, nil
+}
+
+func (s *vantageServer) ReportChecks(ctx context.Context, req *pb.ReportChecksRequest) (*pb.ReportChecksResponse, error) {
+	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
+	if err != nil {
+		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
+	}
+	for _, r := range req.Results {
+		res := checker.Result{Up: r.Up, LatencyMs: r.LatencyMs, Message: r.Message}
+		if r.CertExpiryUnix > 0 {
+			t := time.Unix(r.CertExpiryUnix, 0)
+			res.CertExpiry = &t
+		}
+		// A rejected monitor (wrong org, or not run by this agent) is skipped,
+		// not fatal — the rest of the batch is still legitimate.
+		if err := services.IngestResult(srv.OrgID, srv.ServerID, r.MonitorId, res); err != nil {
+			log.Printf("ingest check %s: %v", r.MonitorId, err)
+		}
+	}
+	return &pb.ReportChecksResponse{}, nil
+}
+
 func (s *vantageServer) CommandStream(stream pb.Vantage_CommandStreamServer) error {
 	// First message authenticates the agent and signals readiness.
 	msg, err := stream.Recv()
@@ -129,6 +190,16 @@ func (s *vantageServer) CommandStream(stream pb.Vantage_CommandStreamServer) err
 				r := m.Result
 				log.Printf("agent %s cmd %s: success=%v %s", srv.ServerID, r.CommandId, r.Success, r.Message)
 			}
+			if m.StepResult != nil {
+				services.StepResults.Deliver(m.StepResult)
+			}
+			if m.StepOutput != nil {
+				if m.StepOutput.Eof {
+					services.StepLogs.Close(m.StepOutput.CommandId)
+				} else {
+					services.StepLogs.Append(m.StepOutput.CommandId, m.StepOutput.Data)
+				}
+			}
 		}
 	}()
 

server/internal/models/assignment.go

@@ -8,8 +8,9 @@ import (
 
 type Assignment struct {
 	ID         bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
-	KeyID      string             `bson:"key_id" json:"key_id"`
-	ServerID   string             `bson:"server_id" json:"server_id"`
-	AssignedAt time.Time          `bson:"assigned_at" json:"assigned_at"`
-	RevokedAt  *time.Time         `bson:"revoked_at,omitempty" json:"revoked_at,omitempty"`
+	OrgID      string        `bson:"org_id" json:"org_id"`
+	KeyID      string        `bson:"key_id" json:"key_id"`
+	ServerID   string        `bson:"server_id" json:"server_id"`
+	AssignedAt time.Time     `bson:"assigned_at" json:"assigned_at"`
+	RevokedAt  *time.Time    `bson:"revoked_at,omitempty" json:"revoked_at,omitempty"`
 }

server/internal/models/audit.go

@@ -8,6 +8,7 @@ import (
 
 type AuditEvent struct {
 	ID        bson.ObjectID `bson:"_id,omitempty" json:"id"`
+	OrgID     string        `bson:"org_id" json:"org_id"`
 	EventType string        `bson:"event_type" json:"event_type"`
 	Actor     string        `bson:"actor" json:"actor"`
 	ServerID  string        `bson:"server_id,omitempty" json:"server_id,omitempty"`

server/internal/models/channel.go

@@ -0,0 +1,30 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+// Notification channel types.
+const (
+	ChannelWebhook  = "webhook"
+	ChannelSMTP     = "smtp"
+	ChannelDiscord  = "discord"
+	ChannelSlack    = "slack"
+	ChannelTelegram = "telegram"
+)
+
+// NotificationChannel is an outbound alert destination. Config holds
+// type-specific settings (e.g. url; or smtp host/port/username/password/from/to;
+// or telegram token/chat_id).
+type NotificationChannel struct {
+	ID        bson.ObjectID     `bson:"_id,omitempty" json:"_id,omitempty"`
+	OrgID     string            `bson:"org_id" json:"org_id"`
+	ChannelID string            `bson:"channel_id" json:"channel_id"`
+	Name      string            `bson:"name" json:"name"`
+	Type      string            `bson:"type" json:"type"`
+	Config    map[string]string `bson:"config" json:"config"`
+	Enabled   bool              `bson:"enabled" json:"enabled"`
+	CreatedAt time.Time         `bson:"created_at" json:"created_at"`
+}

server/internal/models/console_session.go

@@ -8,6 +8,7 @@ import (
 
 type ConsoleSession struct {
 	ID        bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	OrgID     string        `bson:"org_id" json:"org_id"`
 	SessionID string        `bson:"session_id" json:"session_id"`
 	ServerID  string        `bson:"server_id" json:"server_id"`
 	Protocol  string        `bson:"protocol" json:"protocol"` // ssh | rdp | vnc

server/internal/models/key.go

@@ -8,6 +8,7 @@ import (
 
 type Key struct {
 	ID                  bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	OrgID               string        `bson:"org_id" json:"org_id"`
 	KeyID               string        `bson:"key_id" json:"key_id"`
 	Label               string        `bson:"label" json:"label"`
 	PublicKey           string        `bson:"public_key" json:"public_key"`

server/internal/models/monitor.go

@@ -0,0 +1,81 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+// Monitor check types.
+const (
+	MonitorHTTP = "http"
+	MonitorTCP  = "tcp"
+	MonitorICMP = "icmp"
+	MonitorTLS  = "tls"
+)
+
+// Monitor status values.
+const (
+	StatusUp      = "up"
+	StatusDown    = "down"
+	StatusPending = "pending"
+)
+
+// RunnerServer is the reserved Runner value for server-run monitors. Any other
+// value is treated as a server_id whose agent runs the check locally.
+const RunnerServer = "server"
+
+type MonitorTarget struct {
+	URL            string `bson:"url,omitempty" json:"url,omitempty"`
+	Host           string `bson:"host,omitempty" json:"host,omitempty"`
+	Port           int    `bson:"port,omitempty" json:"port,omitempty"`
+	Method         string `bson:"method,omitempty" json:"method,omitempty"`
+	ExpectedStatus int    `bson:"expected_status,omitempty" json:"expected_status,omitempty"`
+	Keyword        string `bson:"keyword,omitempty" json:"keyword,omitempty"`
+	TLSWarnDays    int    `bson:"tls_warn_days,omitempty" json:"tls_warn_days,omitempty"`
+	Insecure       bool   `bson:"insecure,omitempty" json:"insecure,omitempty"` // skip TLS cert verification (HTTP monitors)
+}
+
+type MonitorState struct {
+	Status         string     `bson:"status" json:"status"` // up|down|pending
+	LastCheckAt    *time.Time `bson:"last_check_at,omitempty" json:"last_check_at,omitempty"`
+	LatencyMs      int        `bson:"latency_ms" json:"latency_ms"`
+	Message        string     `bson:"message,omitempty" json:"message,omitempty"`
+	CertExpiryAt   *time.Time `bson:"cert_expiry_at,omitempty" json:"cert_expiry_at,omitempty"`
+	Fails          int        `bson:"fails" json:"fails"` // consecutive failures
+	LastNotifiedAt *time.Time `bson:"last_notified_at,omitempty" json:"last_notified_at,omitempty"`
+}
+
+type Monitor struct {
+	ID          bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	OrgID       string        `bson:"org_id" json:"org_id"`
+	MonitorID   string        `bson:"monitor_id" json:"monitor_id"`
+	Name        string        `bson:"name" json:"name"`
+	Type        string        `bson:"type" json:"type"` // http|tcp|icmp|tls
+	Target      MonitorTarget `bson:"target" json:"target"`
+	IntervalSec int           `bson:"interval_sec" json:"interval_sec"`
+	Runner      string        `bson:"runner" json:"runner"`   // "server" or a server_id
+	Retries     int           `bson:"retries" json:"retries"` // consecutive fails before down
+	Enabled     bool          `bson:"enabled" json:"enabled"`
+	ChannelIDs  []string      `bson:"channel_ids,omitempty" json:"channel_ids,omitempty"`
+	State       MonitorState  `bson:"state" json:"state"`
+	CreatedAt   time.Time     `bson:"created_at" json:"created_at"`
+}
+
+type Incident struct {
+	OrgID      string     `bson:"org_id" json:"org_id"`
+	IncidentID string     `bson:"incident_id" json:"incident_id"`
+	MonitorID  string     `bson:"monitor_id" json:"monitor_id"`
+	StartedAt  time.Time  `bson:"started_at" json:"started_at"`
+	ResolvedAt *time.Time `bson:"resolved_at,omitempty" json:"resolved_at,omitempty"`
+	Cause      string     `bson:"cause,omitempty" json:"cause,omitempty"`
+}
+
+type Rollup struct {
+	OrgID       string    `bson:"org_id" json:"org_id"`
+	MonitorID   string    `bson:"monitor_id" json:"monitor_id"`
+	PeriodStart time.Time `bson:"period_start" json:"period_start"` // hour bucket
+	Checks      int       `bson:"checks" json:"checks"`
+	UpCount     int       `bson:"up_count" json:"up_count"`
+	SumLatency  int64     `bson:"sum_latency" json:"sum_latency"`
+}

server/internal/models/org.go

@@ -0,0 +1,15 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+type Org struct {
+	ID        bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	OrgID     string        `bson:"org_id" json:"org_id"`
+	Name      string        `bson:"name" json:"name"`
+	Slug      string        `bson:"slug" json:"slug"`
+	CreatedAt time.Time     `bson:"created_at" json:"created_at"`
+}

server/internal/models/org_oidc.go

@@ -0,0 +1,17 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+type OrgOIDC struct {
+	ID              bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	OrgID           string        `bson:"org_id" json:"org_id"`
+	Issuer          string        `bson:"issuer" json:"issuer"`
+	ClientID        string        `bson:"client_id" json:"client_id"`
+	ClientSecretEnc string        `bson:"client_secret_enc,omitempty" json:"-"`
+	Enabled         bool          `bson:"enabled" json:"enabled"`
+	UpdatedAt       time.Time     `bson:"updated_at" json:"updated_at"`
+}

server/internal/models/secret.go

@@ -10,6 +10,7 @@ import (
 // encrypted (AES-256-GCM) and is never serialized to JSON.
 type Secret struct {
 	ID             bson.ObjectID `bson:"_id,omitempty" json:"-"`
+	OrgID          string        `bson:"org_id" json:"org_id"`
 	Group          string        `bson:"group" json:"group"`
 	Key            string        `bson:"key" json:"key"`
 	EncryptedValue string        `bson:"encrypted_value" json:"-"`

server/internal/models/server.go

@@ -12,23 +12,56 @@ type PackageUpdate struct {
 	NewVersion     string `bson:"new_version" json:"new_version"`
 }
 
-type Server struct {
-	ID               bson.ObjectID  `bson:"_id,omitempty" json:"_id,omitempty"`
-	ServerID         string         `bson:"server_id" json:"server_id"`
-	Hostname         string         `bson:"hostname" json:"hostname"`
-	IPAddress        string         `bson:"ip_address" json:"ip_address"`
-	OSInfo           string         `bson:"os_info" json:"os_info"`
-	OSType           string         `bson:"os_type,omitempty" json:"os_type,omitempty"`
-	ConsoleProtocols []string       `bson:"console_protocols,omitempty" json:"console_protocols,omitempty"`
-	SSHPort          int            `bson:"ssh_port,omitempty" json:"ssh_port,omitempty"`
-	RDPPort          int            `bson:"rdp_port,omitempty" json:"rdp_port,omitempty"`
-	PreRegToken      string         `bson:"pre_reg_token,omitempty" json:"pre_reg_token,omitempty"`
-	PreRegExpires    *time.Time     `bson:"pre_reg_expires,omitempty" json:"pre_reg_expires,omitempty"`
-	AgentTokenHash   string         `bson:"agent_token_hash,omitempty" json:"-"`
-	Status           string         `bson:"status" json:"status"`
-	AgentVersion     string         `bson:"agent_version,omitempty" json:"agent_version,omitempty"`
-	LastSeen         *time.Time     `bson:"last_seen,omitempty" json:"last_seen,omitempty"`
-	AvailableUpdates []PackageUpdate `bson:"available_updates,omitempty" json:"available_updates,omitempty"`
-	UpdatesCheckedAt *time.Time     `bson:"updates_checked_at,omitempty" json:"updates_checked_at,omitempty"`
-	CreatedAt        time.Time      `bson:"created_at" json:"created_at"`
+type CPUInfo struct {
+	Model    string  `bson:"model,omitempty" json:"model,omitempty"`
+	Cores    int     `bson:"cores,omitempty" json:"cores,omitempty"`
+	UsagePct float64 `bson:"usage_pct" json:"usage_pct"`
+	Load1    float64 `bson:"load1,omitempty" json:"load1,omitempty"`
+}
+
+type MemInfo struct {
+	TotalBytes uint64 `bson:"total_bytes" json:"total_bytes"`
+	UsedBytes  uint64 `bson:"used_bytes" json:"used_bytes"`
+}
+
+type Partition struct {
+	Device     string `bson:"device" json:"device"`
+	Mountpoint string `bson:"mountpoint" json:"mountpoint"`
+	Fstype     string `bson:"fstype,omitempty" json:"fstype,omitempty"`
+	TotalBytes uint64 `bson:"total_bytes" json:"total_bytes"`
+	UsedBytes  uint64 `bson:"used_bytes" json:"used_bytes"`
+}
+
+type Inventory struct {
+	CPU            CPUInfo     `bson:"cpu" json:"cpu"`
+	Memory         MemInfo     `bson:"memory" json:"memory"`
+	SwapTotalBytes uint64      `bson:"swap_total_bytes" json:"swap_total_bytes"`
+	SwapUsedBytes  uint64      `bson:"swap_used_bytes" json:"swap_used_bytes"`
+	Partitions     []Partition `bson:"partitions,omitempty" json:"partitions,omitempty"`
+	Kernel         string      `bson:"kernel,omitempty" json:"kernel,omitempty"`
+	MetricsAt      *time.Time  `bson:"metrics_at,omitempty" json:"metrics_at,omitempty"`
+	StaticAt       *time.Time  `bson:"static_at,omitempty" json:"static_at,omitempty"`
+}
+
+type Server struct {
+	ID               bson.ObjectID   `bson:"_id,omitempty" json:"_id,omitempty"`
+	OrgID            string          `bson:"org_id" json:"org_id"`
+	ServerID         string          `bson:"server_id" json:"server_id"`
+	Hostname         string          `bson:"hostname" json:"hostname"`
+	IPAddress        string          `bson:"ip_address" json:"ip_address"`
+	OSInfo           string          `bson:"os_info" json:"os_info"`
+	OSType           string          `bson:"os_type,omitempty" json:"os_type,omitempty"`
+	ConsoleProtocols []string        `bson:"console_protocols,omitempty" json:"console_protocols,omitempty"`
+	SSHPort          int             `bson:"ssh_port,omitempty" json:"ssh_port,omitempty"`
+	RDPPort          int             `bson:"rdp_port,omitempty" json:"rdp_port,omitempty"`
+	PreRegToken      string          `bson:"pre_reg_token,omitempty" json:"pre_reg_token,omitempty"`
+	PreRegExpires    *time.Time      `bson:"pre_reg_expires,omitempty" json:"pre_reg_expires,omitempty"`
+	AgentTokenHash   string          `bson:"agent_token_hash,omitempty" json:"-"`
+	Status           string          `bson:"status" json:"status"`
+	AgentVersion     string          `bson:"agent_version,omitempty" json:"agent_version,omitempty"`
+	LastSeen         *time.Time      `bson:"last_seen,omitempty" json:"last_seen,omitempty"`
+	AvailableUpdates []PackageUpdate `bson:"available_updates,omitempty" json:"available_updates,omitempty"`
+	UpdatesCheckedAt *time.Time      `bson:"updates_checked_at,omitempty" json:"updates_checked_at,omitempty"`
+	Inventory        *Inventory      `bson:"inventory,omitempty" json:"inventory,omitempty"`
+	CreatedAt        time.Time       `bson:"created_at" json:"created_at"`
 }

server/internal/models/settings.go

@@ -33,7 +33,10 @@ type SecretsSettings struct {
 
 type Settings struct {
 	ID      bson.ObjectID   `bson:"_id,omitempty" json:"-"`
+	OrgID   string          `bson:"org_id" json:"org_id"`
 	Alerts  AlertSettings   `bson:"alerts" json:"alerts"`
 	Email   EmailSettings   `bson:"email" json:"email"`
 	Secrets SecretsSettings `bson:"secrets" json:"secrets"`
+	// WorkflowLogRetentionDays: nil = default 30, 0 = keep forever, N = N days.
+	WorkflowLogRetentionDays *int `bson:"workflow_log_retention_days,omitempty" json:"workflow_log_retention_days,omitempty"`
 }

server/internal/models/user.go

@@ -0,0 +1,35 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+// Org membership roles. These are the only values ever written to User.Role;
+// anything arriving from a client must be checked with ValidRole first.
+const (
+	RoleOwner  = "owner"
+	RoleAdmin  = "admin"
+	RoleMember = "member"
+)
+
+func ValidRole(role string) bool {
+	switch role {
+	case RoleOwner, RoleAdmin, RoleMember:
+		return true
+	}
+	return false
+}
+
+type User struct {
+	ID           bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	UserID       string        `bson:"user_id" json:"user_id"`
+	OrgID        string        `bson:"org_id" json:"org_id"`
+	Email        string        `bson:"email" json:"email"`
+	PasswordHash string        `bson:"password_hash,omitempty" json:"-"`
+	Role         string        `bson:"role" json:"role"`               // owner|admin|member
+	AuthSource   string        `bson:"auth_source" json:"auth_source"` // local|oidc
+	CreatedAt    time.Time     `bson:"created_at" json:"created_at"`
+	LastLogin    *time.Time    `bson:"last_login,omitempty" json:"last_login,omitempty"`
+}

server/internal/models/workflow.go

@@ -0,0 +1,104 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+type InputParam struct {
+	Name        string `bson:"name" json:"name"`
+	Default     string `bson:"default" json:"default"`
+	Description string `bson:"description" json:"description"`
+}
+
+type WorkflowStep struct {
+	ID              bson.ObjectID `bson:"_id,omitempty" json:"-"`
+	OrgID           string        `bson:"org_id" json:"org_id"`
+	StepID          string        `bson:"step_id" json:"step_id"`
+	Name            string        `bson:"name" json:"name"`
+	Description     string        `bson:"description" json:"description"`
+	Interpreter     string        `bson:"interpreter" json:"interpreter"` // "bash" | "powershell"
+	Script          string        `bson:"script" json:"script"`
+	DeclaredOutputs []string      `bson:"declared_outputs" json:"declared_outputs"`
+	DeclaredInputs  []InputParam  `bson:"declared_inputs" json:"declared_inputs"`
+	SecretRefs      []string      `bson:"secret_refs" json:"secret_refs"`
+	Source          string        `bson:"source" json:"source"` // "user" | "default"
+	Slug            string        `bson:"slug,omitempty" json:"slug,omitempty"`
+	CreatedAt       time.Time     `bson:"created_at" json:"created_at"`
+	UpdatedAt       time.Time     `bson:"updated_at" json:"updated_at"`
+}
+
+type WorkflowStepRef struct {
+	StepID     string            `bson:"step_id,omitempty" json:"step_id,omitempty"`
+	Inline     *WorkflowStep     `bson:"inline,omitempty" json:"inline,omitempty"`
+	Order      int               `bson:"order" json:"order"`
+	OnFailure  string            `bson:"on_failure" json:"on_failure"` // "stop" | "continue" | "retry"
+	MaxRetries int               `bson:"max_retries" json:"max_retries"`
+	Overrides  *StepOverride     `bson:"overrides,omitempty" json:"overrides,omitempty"`
+	Inputs     map[string]string `bson:"inputs,omitempty" json:"inputs,omitempty"`
+}
+
+type StepOverride struct {
+	Script     *string  `bson:"script,omitempty" json:"script,omitempty"`
+	SecretRefs []string `bson:"secret_refs,omitempty" json:"secret_refs,omitempty"`
+}
+
+type Workflow struct {
+	ID              bson.ObjectID     `bson:"_id,omitempty" json:"-"`
+	OrgID           string            `bson:"org_id" json:"org_id"`
+	WorkflowID      string            `bson:"workflow_id" json:"workflow_id"`
+	Name            string            `bson:"name" json:"name"`
+	TargetServerIDs []string          `bson:"target_server_ids" json:"target_server_ids"`
+	Steps           []WorkflowStepRef `bson:"steps" json:"steps"`
+	CreatedAt       time.Time         `bson:"created_at" json:"created_at"`
+	UpdatedAt       time.Time         `bson:"updated_at" json:"updated_at"`
+}
+
+// ResolvedStep is a step frozen into a run snapshot (library step + overrides applied).
+type ResolvedStep struct {
+	Order       int               `bson:"order" json:"order"`
+	Name        string            `bson:"name" json:"name"`
+	Interpreter string            `bson:"interpreter" json:"interpreter"`
+	Script      string            `bson:"script" json:"script"`
+	SecretRefs  []string          `bson:"secret_refs" json:"secret_refs"`
+	OnFailure   string            `bson:"on_failure" json:"on_failure"`
+	MaxRetries  int               `bson:"max_retries" json:"max_retries"`
+	Inputs      map[string]string `bson:"inputs" json:"inputs"`
+}
+
+type StepRun struct {
+	Order      int               `bson:"order" json:"order"`
+	Name       string            `bson:"name" json:"name"`
+	Status     string            `bson:"status" json:"status"` // queued|running|success|failed|skipped
+	Attempts   int               `bson:"attempts" json:"attempts"`
+	ExitCode   int               `bson:"exit_code" json:"exit_code"`
+	LogOffset  int64             `bson:"log_offset" json:"log_offset"`
+	OutputEnv  map[string]string `bson:"output_env" json:"output_env"`
+	StartedAt  *time.Time        `bson:"started_at,omitempty" json:"started_at,omitempty"`
+	FinishedAt *time.Time        `bson:"finished_at,omitempty" json:"finished_at,omitempty"`
+}
+
+type ServerRun struct {
+	ServerID   string            `bson:"server_id" json:"server_id"`
+	Hostname   string            `bson:"hostname" json:"hostname"`
+	Status     string            `bson:"status" json:"status"` // queued|running|success|failed|skipped
+	StartedAt  *time.Time        `bson:"started_at,omitempty" json:"started_at,omitempty"`
+	FinishedAt *time.Time        `bson:"finished_at,omitempty" json:"finished_at,omitempty"`
+	RunEnv     map[string]string `bson:"run_env" json:"run_env"`
+	Steps      []StepRun         `bson:"steps" json:"steps"`
+}
+
+type WorkflowRun struct {
+	ID          bson.ObjectID  `bson:"_id,omitempty" json:"-"`
+	OrgID       string         `bson:"org_id" json:"org_id"`
+	RunID       string         `bson:"run_id" json:"run_id"`
+	WorkflowID  string         `bson:"workflow_id" json:"workflow_id"`
+	Name        string         `bson:"name" json:"name"`
+	Steps       []ResolvedStep `bson:"steps_snapshot" json:"steps_snapshot"`
+	Status      string         `bson:"status" json:"status"` // running|success|failed|cancelled
+	TriggeredBy string         `bson:"triggered_by" json:"triggered_by"`
+	StartedAt   time.Time      `bson:"started_at" json:"started_at"`
+	FinishedAt  *time.Time     `bson:"finished_at,omitempty" json:"finished_at,omitempty"`
+	ServerRuns  []ServerRun    `bson:"server_runs" json:"server_runs"`
+}

server/internal/monitorsched/scheduler.go

@@ -0,0 +1,107 @@
+// Package monitorsched runs server-side monitors on their configured interval
+// and funnels results through services.IngestResult. Agent-run monitors
+// (runner != "server") are excluded — those execute on the agent.
+package monitorsched
+
+import (
+	"context"
+	"log"
+	"sync"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/checker"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+)
+
+// reloadInterval controls how often the scheduler re-reads monitor definitions
+// so CRUD changes (new/removed/edited monitors) take effect.
+const reloadInterval = 30 * time.Second
+
+type runner struct {
+	monitorID   string
+	intervalSec int
+	cancel      context.CancelFunc
+}
+
+// Start launches the scheduler loop. It returns immediately; the loop runs until
+// ctx is cancelled.
+func Start(ctx context.Context) {
+	go loop(ctx)
+}
+
+func loop(ctx context.Context) {
+	active := map[string]*runner{}
+	var mu sync.Mutex
+
+	sync := func() {
+		monitors, err := services.ListServerScheduledMonitors()
+		if err != nil {
+			log.Printf("monitorsched: list monitors: %v", err)
+			return
+		}
+		want := map[string]models.Monitor{}
+		for _, m := range monitors {
+			want[m.MonitorID] = m
+		}
+
+		mu.Lock()
+		defer mu.Unlock()
+		// Stop runners for monitors that vanished or changed interval.
+		for id, r := range active {
+			m, ok := want[id]
+			if !ok || m.IntervalSec != r.intervalSec {
+				r.cancel()
+				delete(active, id)
+			}
+		}
+		// Start runners for new/changed monitors.
+		for id, m := range want {
+			if _, ok := active[id]; ok {
+				continue
+			}
+			rctx, cancel := context.WithCancel(ctx)
+			active[id] = &runner{monitorID: id, intervalSec: m.IntervalSec, cancel: cancel}
+			go runMonitor(rctx, m)
+		}
+	}
+
+	sync()
+	t := time.NewTicker(reloadInterval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			sync()
+		}
+	}
+}
+
+func runMonitor(ctx context.Context, m models.Monitor) {
+	interval := time.Duration(m.IntervalSec) * time.Second
+	if interval <= 0 {
+		interval = 60 * time.Second
+	}
+	spec := services.SpecFor(&m)
+
+	run := func() {
+		res := checker.Run(ctx, spec)
+		if err := services.IngestServerScheduledResult(m.MonitorID, res); err != nil {
+			log.Printf("monitorsched: ingest %s: %v", m.MonitorID, err)
+		}
+	}
+
+	run() // check immediately on (re)start
+	t := time.NewTicker(interval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			run()
+		}
+	}
+}

server/internal/notify/dispatch.go

@@ -0,0 +1,64 @@
+// Package notify formats and delivers monitor state-change alerts to
+// notification channels. It depends only on models so services can call it
+// without an import cycle.
+package notify
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+// Event describes a monitor state transition worth alerting on.
+type Event struct {
+	MonitorName string
+	Type        string
+	OldStatus   string
+	NewStatus   string
+	Message     string
+	Time        time.Time
+}
+
+// title is a short one-line summary used by the text-based channels.
+func (e Event) title() string {
+	verb := "recovered"
+	if e.NewStatus == models.StatusDown {
+		verb = "is DOWN"
+	}
+	s := fmt.Sprintf("[Vantage] %s (%s) %s", e.MonitorName, e.Type, verb)
+	if e.Message != "" {
+		s += ": " + e.Message
+	}
+	return s
+}
+
+// Dispatch delivers ev to a single channel, formatting per channel type.
+func Dispatch(ch models.NotificationChannel, ev Event) error {
+	switch ch.Type {
+	case models.ChannelWebhook:
+		return dispatchWebhook(ch, ev)
+	case models.ChannelDiscord:
+		return dispatchDiscord(ch, ev)
+	case models.ChannelSlack:
+		return dispatchSlack(ch, ev)
+	case models.ChannelTelegram:
+		return dispatchTelegram(ch, ev)
+	case models.ChannelSMTP:
+		return dispatchSMTP(ch, ev)
+	default:
+		return fmt.Errorf("unknown channel type: %s", ch.Type)
+	}
+}
+
+// Test delivers a synthetic event so users can verify a channel's configuration.
+func Test(ch models.NotificationChannel) error {
+	return Dispatch(ch, Event{
+		MonitorName: "Test monitor",
+		Type:        "http",
+		OldStatus:   models.StatusUp,
+		NewStatus:   models.StatusDown,
+		Message:     "this is a test alert from Vantage",
+		Time:        time.Now(),
+	})
+}

server/internal/notify/http.go

@@ -0,0 +1,71 @@
+package notify
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+var httpClient = &http.Client{Timeout: 10 * time.Second}
+
+func postJSON(target string, payload any) error {
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return err
+	}
+	resp, err := httpClient.Post(target, "application/json", bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 300 {
+		return fmt.Errorf("HTTP %d from %s", resp.StatusCode, target)
+	}
+	return nil
+}
+
+// dispatchWebhook posts the full event as JSON to a user-supplied URL.
+func dispatchWebhook(ch models.NotificationChannel, ev Event) error {
+	target := ch.Config["url"]
+	if target == "" {
+		return fmt.Errorf("webhook: missing url")
+	}
+	return postJSON(target, map[string]any{
+		"monitor":    ev.MonitorName,
+		"type":       ev.Type,
+		"old_status": ev.OldStatus,
+		"new_status": ev.NewStatus,
+		"message":    ev.Message,
+		"time":       ev.Time.Format(time.RFC3339),
+	})
+}
+
+func dispatchDiscord(ch models.NotificationChannel, ev Event) error {
+	target := ch.Config["url"]
+	if target == "" {
+		return fmt.Errorf("discord: missing url")
+	}
+	return postJSON(target, map[string]string{"content": ev.title()})
+}
+
+func dispatchSlack(ch models.NotificationChannel, ev Event) error {
+	target := ch.Config["url"]
+	if target == "" {
+		return fmt.Errorf("slack: missing url")
+	}
+	return postJSON(target, map[string]string{"text": ev.title()})
+}
+
+func dispatchTelegram(ch models.NotificationChannel, ev Event) error {
+	token := ch.Config["token"]
+	chatID := ch.Config["chat_id"]
+	if token == "" || chatID == "" {
+		return fmt.Errorf("telegram: missing token or chat_id")
+	}
+	api := fmt.Sprintf("https://api.telegram.org/bot%s/sendMessage", token)
+	return postJSON(api, map[string]string{"chat_id": chatID, "text": ev.title()})
+}

server/internal/notify/smtp.go

@@ -0,0 +1,98 @@
+package notify
+
+import (
+	"crypto/tls"
+	"fmt"
+	"net"
+	"net/smtp"
+	"strings"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+const smtpTimeout = 15 * time.Second
+
+// dispatchSMTP sends the alert as a plain-text email. Config keys: host, port,
+// username, password, from, to. Auth is skipped when username is empty. Port 465
+// uses implicit TLS; other ports use STARTTLS when the server advertises it.
+//
+// It dials with a timeout and sets a connection deadline so an unreachable or
+// misconfigured SMTP host fails fast instead of hanging the request until the OS
+// TCP timeout (which resets the upstream proxy connection).
+func dispatchSMTP(ch models.NotificationChannel, ev Event) error {
+	host := ch.Config["host"]
+	port := ch.Config["port"]
+	from := ch.Config["from"]
+	to := ch.Config["to"]
+	if host == "" || port == "" || from == "" || to == "" {
+		return fmt.Errorf("smtp: missing host/port/from/to")
+	}
+
+	addr := net.JoinHostPort(host, port)
+	conn, err := net.DialTimeout("tcp", addr, smtpTimeout)
+	if err != nil {
+		return fmt.Errorf("smtp: dial %s: %w", addr, err)
+	}
+	_ = conn.SetDeadline(time.Now().Add(smtpTimeout))
+
+	// Implicit TLS on 465; otherwise start plain and upgrade via STARTTLS.
+	if port == "465" {
+		conn = tls.Client(conn, &tls.Config{ServerName: host})
+	}
+
+	c, err := smtp.NewClient(conn, host)
+	if err != nil {
+		conn.Close()
+		return fmt.Errorf("smtp: client: %w", err)
+	}
+	defer c.Close()
+
+	if port != "465" {
+		if ok, _ := c.Extension("STARTTLS"); ok {
+			if err := c.StartTLS(&tls.Config{ServerName: host}); err != nil {
+				return fmt.Errorf("smtp: starttls: %w", err)
+			}
+		}
+	}
+
+	if user := ch.Config["username"]; user != "" {
+		if err := c.Auth(smtp.PlainAuth("", user, ch.Config["password"], host)); err != nil {
+			return fmt.Errorf("smtp: auth: %w", err)
+		}
+	}
+
+	recipients := strings.Split(to, ",")
+	for i := range recipients {
+		recipients[i] = strings.TrimSpace(recipients[i])
+	}
+
+	if err := c.Mail(from); err != nil {
+		return fmt.Errorf("smtp: mail from: %w", err)
+	}
+	for _, rcpt := range recipients {
+		if rcpt == "" {
+			continue
+		}
+		if err := c.Rcpt(rcpt); err != nil {
+			return fmt.Errorf("smtp: rcpt %s: %w", rcpt, err)
+		}
+	}
+
+	msg, err := buildMIME(from, to, ev.title(), textEmail(ev), htmlEmail(ev))
+	if err != nil {
+		return fmt.Errorf("smtp: build message: %w", err)
+	}
+
+	w, err := c.Data()
+	if err != nil {
+		return fmt.Errorf("smtp: data: %w", err)
+	}
+	if _, err := w.Write(msg); err != nil {
+		return fmt.Errorf("smtp: write: %w", err)
+	}
+	if err := w.Close(); err != nil {
+		return fmt.Errorf("smtp: close data: %w", err)
+	}
+	return c.Quit()
+}

server/internal/notify/template.go

@@ -0,0 +1,167 @@
+package notify
+
+import (
+	"fmt"
+	"html"
+	"mime/multipart"
+	"net/textproto"
+	"strings"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+// App theme colors (mirrors web/tailwind.config.ts).
+const (
+	colBg        = "#0f1117"
+	colSurface   = "#1a1d27"
+	colSurface2  = "#232635"
+	colBorder    = "#2e3147"
+	colText      = "#e8eaf0"
+	colTextMuted = "#9095a8"
+	colAccent    = "#6366f1"
+	colSuccess   = "#22c55e"
+	colDanger    = "#ef4444"
+)
+
+// statusColor returns the accent color for a monitor status.
+func statusColor(status string) string {
+	switch status {
+	case models.StatusUp:
+		return colSuccess
+	case models.StatusDown:
+		return colDanger
+	default:
+		return colTextMuted
+	}
+}
+
+// buildMIME assembles a multipart/alternative message (plain + HTML) with the
+// standard email headers, ready to hand to the SMTP DATA command.
+func buildMIME(from, to, subject, text, htmlBody string) ([]byte, error) {
+	var buf strings.Builder
+	w := multipart.NewWriter(&buf)
+
+	var head strings.Builder
+	head.WriteString("From: " + from + "\r\n")
+	head.WriteString("To: " + to + "\r\n")
+	head.WriteString("Subject: " + subject + "\r\n")
+	head.WriteString("MIME-Version: 1.0\r\n")
+	head.WriteString(fmt.Sprintf("Content-Type: multipart/alternative; boundary=%s\r\n\r\n", w.Boundary()))
+
+	textPart, err := w.CreatePart(textproto.MIMEHeader{"Content-Type": {"text/plain; charset=UTF-8"}})
+	if err != nil {
+		return nil, err
+	}
+	textPart.Write([]byte(text))
+
+	htmlPart, err := w.CreatePart(textproto.MIMEHeader{"Content-Type": {"text/html; charset=UTF-8"}})
+	if err != nil {
+		return nil, err
+	}
+	htmlPart.Write([]byte(htmlBody))
+
+	if err := w.Close(); err != nil {
+		return nil, err
+	}
+	return []byte(head.String() + buf.String()), nil
+}
+
+// htmlEmail renders the alert as a dark-themed HTML email matching the app.
+func htmlEmail(ev Event) string {
+	accent := statusColor(ev.NewStatus)
+	label := "Recovered"
+	if ev.NewStatus == models.StatusDown {
+		label = "Down"
+	}
+
+	esc := html.EscapeString
+	row := func(k, v string) string {
+		if v == "" {
+			v = "—"
+		}
+		return fmt.Sprintf(
+			`<tr>`+
+				`<td style="padding:8px 0;color:%s;font-size:13px;width:120px;">%s</td>`+
+				`<td style="padding:8px 0;color:%s;font-size:13px;font-weight:500;">%s</td>`+
+				`</tr>`,
+			colTextMuted, k, colText, esc(v))
+	}
+
+	message := ""
+	if ev.Message != "" {
+		message = fmt.Sprintf(
+			`<p style="margin:0 0 20px;padding:12px 14px;background:%s;border:1px solid %s;border-radius:8px;color:%s;font-size:13px;">%s</p>`,
+			colSurface2, colBorder, colText, esc(ev.Message))
+	}
+
+	transition := esc(ev.OldStatus) + " → " + esc(ev.NewStatus)
+
+	return fmt.Sprintf(`<!DOCTYPE html>
+<html>
+<body style="margin:0;padding:0;background:%s;">
+  <table role="presentation" width="100%%" cellpadding="0" cellspacing="0" style="background:%s;padding:32px 0;">
+    <tr>
+      <td align="center">
+        <table role="presentation" width="480" cellpadding="0" cellspacing="0" style="max-width:480px;background:%s;border:1px solid %s;border-radius:12px;overflow:hidden;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
+          <tr><td style="height:4px;background:%s;"></td></tr>
+          <tr>
+            <td style="padding:28px 28px 20px;">
+              <table role="presentation" cellpadding="0" cellspacing="0" style="margin-bottom:18px;">
+                <tr>
+                  <td style="font-size:18px;font-weight:700;color:%s;">Vantage</td>
+                </tr>
+              </table>
+              <span style="display:inline-block;padding:4px 12px;border-radius:9999px;background:%s22;color:%s;font-size:12px;font-weight:600;letter-spacing:.02em;">%s</span>
+              <h1 style="margin:14px 0 6px;font-size:20px;font-weight:700;color:%s;">%s</h1>
+              <p style="margin:0 0 20px;color:%s;font-size:13px;">%s check</p>
+              %s
+              <table role="presentation" width="100%%" cellpadding="0" cellspacing="0" style="border-top:1px solid %s;">
+                %s
+                %s
+                %s
+              </table>
+            </td>
+          </tr>
+          <tr>
+            <td style="padding:16px 28px;border-top:1px solid %s;">
+              <p style="margin:0;color:%s;font-size:12px;">Sent by Vantage · self-hosted service monitoring</p>
+            </td>
+          </tr>
+        </table>
+      </td>
+    </tr>
+  </table>
+</body>
+</html>`,
+		colBg,
+		colBg,
+		colSurface, colBorder,
+		accent,
+		colText,
+		accent, accent, label,
+		colText, esc(ev.MonitorName),
+		colTextMuted, esc(ev.Type),
+		message,
+		colBorder,
+		row("Status", transition),
+		row("Type", ev.Type),
+		row("Time", ev.Time.Format("2006-01-02 15:04:05 MST")),
+		colBorder,
+		colTextMuted,
+	)
+}
+
+// textEmail renders the plain-text fallback.
+func textEmail(ev Event) string {
+	return strings.Join([]string{
+		ev.title(),
+		"",
+		"Monitor: " + ev.MonitorName,
+		"Type:    " + ev.Type,
+		"Status:  " + ev.OldStatus + " -> " + ev.NewStatus,
+		"Message: " + ev.Message,
+		"Time:    " + ev.Time.Format("2006-01-02 15:04:05 MST"),
+		"",
+		"Sent by Vantage · self-hosted service monitoring",
+	}, "\r\n")
+}

server/internal/services/audit.go

@@ -11,11 +11,12 @@ import (
 	"go.mongodb.org/mongo-driver/v2/mongo/options"
 )
 
-func LogEvent(eventType, actor, serverID, keyID, details string) {
+func LogEvent(orgID, eventType, actor, serverID, keyID, details string) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	event := models.AuditEvent{
+		OrgID:     orgID,
 		EventType: eventType,
 		Actor:     actor,
 		ServerID:  serverID,
@@ -28,7 +29,7 @@ func LogEvent(eventType, actor, serverID, keyID, details string) {
 	}
 }
 
-func ListAuditEvents(limit int64) ([]models.AuditEvent, error) {
+func ListAuditEvents(orgID string, limit int64) ([]models.AuditEvent, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
@@ -36,7 +37,7 @@ func ListAuditEvents(limit int64) ([]models.AuditEvent, error) {
 		SetSort(bson.D{{Key: "created_at", Value: -1}}).
 		SetLimit(limit)
 
-	cursor, err := db.Col("audit_logs").Find(ctx, bson.M{}, opts)
+	cursor, err := db.Col("audit_logs").Find(ctx, bson.M{"org_id": orgID}, opts)
 	if err != nil {
 		return nil, err
 	}

server/internal/services/channels.go

@@ -0,0 +1,116 @@
+package services
+
+import (
+	"errors"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/notify"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+func ListChannels(orgID string) ([]models.NotificationChannel, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	cur, err := db.Col("notification_channels").Find(ctx, bson.M{"org_id": orgID}, options.Find().SetSort(bson.M{"created_at": 1}))
+	if err != nil {
+		return nil, err
+	}
+	var out []models.NotificationChannel
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func GetChannel(orgID, channelID string) (*models.NotificationChannel, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	var ch models.NotificationChannel
+	err := db.Col("notification_channels").FindOne(ctx, bson.M{"channel_id": channelID, "org_id": orgID}).Decode(&ch)
+	if errors.Is(err, mongo.ErrNoDocuments) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &ch, nil
+}
+
+// GetChannels loads multiple channels by ID within an org, skipping any not found.
+func GetChannels(orgID string, channelIDs []string) ([]models.NotificationChannel, error) {
+	if len(channelIDs) == 0 {
+		return nil, nil
+	}
+	ctx, cancel := monCtx()
+	defer cancel()
+	cur, err := db.Col("notification_channels").Find(ctx, bson.M{"org_id": orgID, "channel_id": bson.M{"$in": channelIDs}})
+	if err != nil {
+		return nil, err
+	}
+	var out []models.NotificationChannel
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// validateChannelIDs rejects any channel that does not belong to the org.
+// Channel IDs arrive from the client as data on monitor writes.
+func validateChannelIDs(orgID string, channelIDs []string) error {
+	for _, id := range channelIDs {
+		ch, err := GetChannel(orgID, id)
+		if err != nil {
+			return err
+		}
+		if ch == nil {
+			return errors.New("channel " + id + " not found")
+		}
+	}
+	return nil
+}
+
+func CreateChannel(orgID string, ch *models.NotificationChannel) (*models.NotificationChannel, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	ch.OrgID = orgID
+	ch.ChannelID = uuid.NewString()
+	ch.CreatedAt = time.Now()
+	if ch.Config == nil {
+		ch.Config = map[string]string{}
+	}
+	if _, err := db.Col("notification_channels").InsertOne(ctx, ch); err != nil {
+		return nil, err
+	}
+	return ch, nil
+}
+
+func UpdateChannel(orgID, channelID string, upd bson.M) error {
+	ctx, cancel := monCtx()
+	defer cancel()
+	_, err := db.Col("notification_channels").UpdateOne(ctx, bson.M{"channel_id": channelID, "org_id": orgID}, bson.M{"$set": upd})
+	return err
+}
+
+func DeleteChannel(orgID, channelID string) error {
+	ctx, cancel := monCtx()
+	defer cancel()
+	_, err := db.Col("notification_channels").DeleteOne(ctx, bson.M{"channel_id": channelID, "org_id": orgID})
+	return err
+}
+
+// TestChannel sends a synthetic alert to verify configuration.
+func TestChannel(orgID, channelID string) error {
+	ch, err := GetChannel(orgID, channelID)
+	if err != nil {
+		return err
+	}
+	if ch == nil {
+		return errors.New("channel not found")
+	}
+	return notify.Test(*ch)
+}

server/internal/services/console.go

@@ -129,11 +129,12 @@ func BuildGuacParams(srv *models.Server, protocol, sshUser, privateKey, passphra
 	}
 }
 
-func CreateConsoleSession(serverID, protocol, keyID, user, clientIP string) (*models.ConsoleSession, error) {
+func CreateConsoleSession(orgID, serverID, protocol, keyID, user, clientIP string) (*models.ConsoleSession, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	s := &models.ConsoleSession{
+		OrgID:     orgID,
 		SessionID: uuid.NewString(),
 		ServerID:  serverID,
 		Protocol:  protocol,
@@ -148,11 +149,11 @@ func CreateConsoleSession(serverID, protocol, keyID, user, clientIP string) (*mo
 	return s, nil
 }
 
-func GetConsoleSession(sessionID string) (*models.ConsoleSession, error) {
+func GetConsoleSession(orgID, sessionID string) (*models.ConsoleSession, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	var s models.ConsoleSession
-	if err := db.Col("console_sessions").FindOne(ctx, bson.M{"session_id": sessionID}).Decode(&s); err != nil {
+	if err := db.Col("console_sessions").FindOne(ctx, bson.M{"session_id": sessionID, "org_id": orgID}).Decode(&s); err != nil {
 		return nil, err
 	}
 	return &s, nil
@@ -160,7 +161,7 @@ func GetConsoleSession(sessionID string) (*models.ConsoleSession, error) {
 
 // StashConsoleRDPCreds encrypts and stores single-use RDP credentials on the
 // session document. They are consumed (and cleared) when the tunnel opens.
-func StashConsoleRDPCreds(sessionID, username, password string) error {
+func StashConsoleRDPCreds(orgID, sessionID, username, password string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	u, err := encryptString(username)
@@ -172,7 +173,7 @@ func StashConsoleRDPCreds(sessionID, username, password string) error {
 		return err
 	}
 	_, err = db.Col("console_sessions").UpdateOne(ctx,
-		bson.M{"session_id": sessionID},
+		bson.M{"session_id": sessionID, "org_id": orgID},
 		bson.M{"$set": bson.M{"rdp_user_enc": u, "rdp_pass_enc": p}},
 	)
 	return err
@@ -181,8 +182,8 @@ func StashConsoleRDPCreds(sessionID, username, password string) error {
 // ConsumeConsoleRDPCreds decrypts and returns the stored RDP credentials, then
 // clears them from the session document (single-use). Returns empty strings if
 // none were stored.
-func ConsumeConsoleRDPCreds(sessionID string) (username, password string, err error) {
-	s, err := GetConsoleSession(sessionID)
+func ConsumeConsoleRDPCreds(orgID, sessionID string) (username, password string, err error) {
+	s, err := GetConsoleSession(orgID, sessionID)
 	if err != nil {
 		return "", "", err
 	}
@@ -202,18 +203,18 @@ func ConsumeConsoleRDPCreds(sessionID string) (username, password string, err er
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	_, _ = db.Col("console_sessions").UpdateOne(ctx,
-		bson.M{"session_id": sessionID},
+		bson.M{"session_id": sessionID, "org_id": orgID},
 		bson.M{"$unset": bson.M{"rdp_user_enc": "", "rdp_pass_enc": ""}},
 	)
 	return username, password, nil
 }
 
 // SetConsoleSSHUser persists the SSH username to use on the session doc.
-func SetConsoleSSHUser(sessionID, username string) error {
+func SetConsoleSSHUser(orgID, sessionID, username string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	_, err := db.Col("console_sessions").UpdateOne(ctx,
-		bson.M{"session_id": sessionID},
+		bson.M{"session_id": sessionID, "org_id": orgID},
 		bson.M{"$set": bson.M{"ssh_username": username}})
 	return err
 }
@@ -221,12 +222,12 @@ func SetConsoleSSHUser(sessionID, username string) error {
 // ConsumeSessionToken atomically marks a session's one-time token as spent.
 // It returns an error if the token was already consumed (replay) or the session
 // does not exist, so the tunnel can be opened at most once per issued token.
-func ConsumeSessionToken(sessionID string) error {
+func ConsumeSessionToken(orgID, sessionID string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	now := time.Now()
 	res, err := db.Col("console_sessions").UpdateOne(ctx,
-		bson.M{"session_id": sessionID, "token_consumed_at": nil},
+		bson.M{"session_id": sessionID, "org_id": orgID, "token_consumed_at": nil},
 		bson.M{"$set": bson.M{"token_consumed_at": now}},
 	)
 	if err != nil {
@@ -238,12 +239,12 @@ func ConsumeSessionToken(sessionID string) error {
 	return nil
 }
 
-func EndConsoleSession(sessionID string) error {
+func EndConsoleSession(orgID, sessionID string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	now := time.Now()
 	_, err := db.Col("console_sessions").UpdateOne(ctx,
-		bson.M{"session_id": sessionID, "ended_at": nil},
+		bson.M{"session_id": sessionID, "org_id": orgID, "ended_at": nil},
 		bson.M{"$set": bson.M{"ended_at": now}},
 	)
 	return err

server/internal/services/console_test.go

@@ -1,111 +0,0 @@
-package services
-
-import (
-	"testing"
-	"time"
-
-	"github.com/mrhid6/vantage/server/internal/models"
-)
-
-func TestSessionTokenRoundTrip(t *testing.T) {
-	t.Setenv("KEY_ENCRYPTION_KEY", "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")
-
-	tok, err := SignSessionToken("sess-123", time.Minute)
-	if err != nil {
-		t.Fatalf("sign: %v", err)
-	}
-	got, err := VerifySessionToken(tok)
-	if err != nil {
-		t.Fatalf("verify: %v", err)
-	}
-	if got != "sess-123" {
-		t.Fatalf("got %q want sess-123", got)
-	}
-}
-
-func TestSessionTokenExpired(t *testing.T) {
-	t.Setenv("KEY_ENCRYPTION_KEY", "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")
-
-	tok, err := SignSessionToken("sess-123", -time.Second)
-	if err != nil {
-		t.Fatalf("sign: %v", err)
-	}
-	if _, err := VerifySessionToken(tok); err == nil {
-		t.Fatalf("expected expiry error, got nil")
-	}
-}
-
-func TestSessionTokenTampered(t *testing.T) {
-	t.Setenv("KEY_ENCRYPTION_KEY", "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")
-
-	tok, _ := SignSessionToken("sess-123", time.Minute)
-	if _, err := VerifySessionToken(tok + "x"); err == nil {
-		t.Fatalf("expected signature error, got nil")
-	}
-}
-
-func TestBuildGuacParamsSSH(t *testing.T) {
-	srv := &models.Server{IPAddress: "10.0.0.5", SSHPort: 22}
-	p, err := BuildGuacParams(srv, "ssh", "", "PRIVATE-KEY-DATA", "", "", "")
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	if p.Protocol != "ssh" {
-		t.Fatalf("protocol %q", p.Protocol)
-	}
-	if p.Params["hostname"] != "10.0.0.5" || p.Params["port"] != "22" {
-		t.Fatalf("bad host/port: %+v", p.Params)
-	}
-	if p.Params["private-key"] != "PRIVATE-KEY-DATA" {
-		t.Fatalf("missing private-key")
-	}
-	if p.Params["username"] != "root" {
-		t.Fatalf("expected default username root, got %q", p.Params["username"])
-	}
-}
-
-func TestBuildGuacParamsRDP(t *testing.T) {
-	srv := &models.Server{IPAddress: "10.0.0.9", RDPPort: 3389}
-	p, err := BuildGuacParams(srv, "rdp", "", "", "", "administrator", "s3cret")
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	if p.Params["port"] != "3389" || p.Params["username"] != "administrator" || p.Params["password"] != "s3cret" {
-		t.Fatalf("bad rdp params: %+v", p.Params)
-	}
-	if p.Params["ignore-cert"] != "true" {
-		t.Fatalf("expected ignore-cert=true")
-	}
-}
-
-func TestBuildGuacParamsUnknownProtocol(t *testing.T) {
-	srv := &models.Server{IPAddress: "10.0.0.9"}
-	if _, err := BuildGuacParams(srv, "telnet", "", "", "", "", ""); err == nil {
-		t.Fatalf("expected error for unknown protocol")
-	}
-}
-
-func TestBuildGuacParamsSSHPassphrase(t *testing.T) {
-	srv := &models.Server{IPAddress: "10.0.0.5", SSHPort: 22}
-	p, err := BuildGuacParams(srv, "ssh", "deploy", "PK", "s3cret-phrase", "", "")
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	if p.Params["username"] != "deploy" {
-		t.Fatalf("username %q", p.Params["username"])
-	}
-	if p.Params["passphrase"] != "s3cret-phrase" {
-		t.Fatalf("missing passphrase: %+v", p.Params)
-	}
-}
-
-func TestBuildGuacParamsVNC(t *testing.T) {
-	srv := &models.Server{IPAddress: "10.0.0.7"}
-	p, err := BuildGuacParams(srv, "vnc", "", "", "", "", "vncpass")
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
-	if p.Protocol != "vnc" || p.Params["hostname"] != "10.0.0.7" || p.Params["port"] != "5900" || p.Params["password"] != "vncpass" {
-		t.Fatalf("bad vnc params: %+v", p.Params)
-	}
-}

server/internal/services/defaults.go

@@ -0,0 +1,95 @@
+package services
+
+import (
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+// DefaultStepsDir returns the directory holding default step JSON files.
+func DefaultStepsDir() string {
+	dir := os.Getenv("VANTAGE_DEFAULT_STEPS_DIR")
+	if dir == "" {
+		dir = filepath.Join("data", "default-steps")
+	}
+	_ = os.MkdirAll(dir, 0700)
+	return dir
+}
+
+// readDefaultStepFiles parses every *.json in the defaults dir into
+// source=default library steps (with slug set). Non-json and invalid files are
+// skipped silently; a slug is derived from the step name.
+func readDefaultStepFiles() ([]models.WorkflowStep, error) {
+	matches, err := filepath.Glob(filepath.Join(DefaultStepsDir(), "*.json"))
+	if err != nil {
+		return nil, err
+	}
+	out := []models.WorkflowStep{}
+	for _, path := range matches {
+		b, err := os.ReadFile(path)
+		if err != nil {
+			continue
+		}
+		s, err := ParseStepDoc(b)
+		if err != nil {
+			continue
+		}
+		s.Source = "default"
+		s.Slug = Slugify(s.Name)
+		if s.Slug == "" {
+			continue
+		}
+		out = append(out, s)
+	}
+	return out, nil
+}
+
+// SeedDefaultSteps upserts default steps from disk keyed on {slug, source}.
+// Re-sync overwrites default-step content; user steps are never touched.
+func SeedDefaultSteps(orgID string) (created, updated int, err error) {
+	steps, err := readDefaultStepFiles()
+	if err != nil {
+		return 0, 0, err
+	}
+	ctx, cancel := wfCtx()
+	defer cancel()
+	col := db.Col("workflow_steps")
+	for _, s := range steps {
+		filter := bson.M{"org_id": orgID, "slug": s.Slug, "source": "default"}
+		set := bson.M{
+			"name":             s.Name,
+			"description":      s.Description,
+			"interpreter":      s.Interpreter,
+			"script":           s.Script,
+			"declared_outputs": s.DeclaredOutputs,
+			"declared_inputs":  s.DeclaredInputs,
+			"secret_refs":      s.SecretRefs,
+			"updated_at":       time.Now(),
+		}
+		res, uerr := col.UpdateOne(ctx, filter, bson.M{
+			"$set": set,
+			"$setOnInsert": bson.M{
+				"org_id":     orgID,
+				"step_id":    uuid.New().String(),
+				"slug":       s.Slug,
+				"source":     "default",
+				"created_at": time.Now(),
+			},
+		}, options.UpdateOne().SetUpsert(true))
+		if uerr != nil {
+			return created, updated, uerr
+		}
+		if res.UpsertedCount > 0 {
+			created++
+		} else if res.ModifiedCount > 0 {
+			updated++
+		}
+	}
+	return created, updated, nil
+}

server/internal/services/dispatch.go

@@ -62,6 +62,25 @@ func (d *commandDispatcher) dispatch(serverID string, cmd *pb.ServerCommand) err
 	}
 }
 
+// DispatchRunStep pushes a RunStepCmd to a server's agent. Caller must have
+// registered StepResults.Await(commandID) first.
+func DispatchRunStep(serverID, commandID string, cmd *pb.RunStepCmd) error {
+	return Dispatcher.dispatch(serverID, &pb.ServerCommand{CommandId: commandID, RunStep: cmd})
+}
+
+// DispatchCleanupWorkspace tells a server's agent to remove a run's working
+// directory. Best-effort and fire-and-forget: if the agent is gone the temp dir
+// is reclaimed by the OS on reboot anyway.
+func DispatchCleanupWorkspace(serverID, workspaceID string) {
+	if !Dispatcher.IsConnected(serverID) {
+		return
+	}
+	_ = Dispatcher.dispatch(serverID, &pb.ServerCommand{
+		CommandId:        uuid.New().String(),
+		CleanupWorkspace: &pb.CleanupWorkspaceCmd{WorkspaceId: workspaceID},
+	})
+}
+
 // KeyGenParams carries all options for a generate-key command.
 type KeyGenParams struct {
 	Label      string

server/internal/services/inventory.go

@@ -0,0 +1,52 @@
+package services
+
+import (
+	"context"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/grpc/pb"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+// StoreInventory upserts the latest inventory snapshot onto the server document.
+// Metrics fields update every call; static fields only when r.IncludeStatic.
+func StoreInventory(serverID string, r *pb.InventoryReport) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	now := time.Now()
+	set := bson.M{"inventory.metrics_at": now}
+	if r.CPU != nil {
+		set["inventory.cpu.usage_pct"] = r.CPU.UsagePct
+		set["inventory.cpu.load1"] = r.CPU.Load1
+	}
+	if r.Memory != nil {
+		set["inventory.memory.used_bytes"] = r.Memory.UsedBytes
+	}
+	set["inventory.swap_used_bytes"] = r.SwapUsed
+
+	if r.IncludeStatic {
+		set["inventory.static_at"] = now
+		set["inventory.swap_total_bytes"] = r.SwapTotal
+		set["inventory.kernel"] = r.Kernel
+		if r.CPU != nil {
+			set["inventory.cpu.model"] = r.CPU.Model
+			set["inventory.cpu.cores"] = r.CPU.Cores
+		}
+		if r.Memory != nil {
+			set["inventory.memory.total_bytes"] = r.Memory.TotalBytes
+		}
+		parts := make([]bson.M, 0, len(r.Partitions))
+		for _, p := range r.Partitions {
+			parts = append(parts, bson.M{
+				"device": p.Device, "mountpoint": p.Mountpoint, "fstype": p.Fstype,
+				"total_bytes": p.TotalBytes, "used_bytes": p.UsedBytes,
+			})
+		}
+		set["inventory.partitions"] = parts
+	}
+
+	_, err := db.Col("servers").UpdateOne(ctx, bson.M{"server_id": serverID}, bson.M{"$set": set})
+	return err
+}

server/internal/services/keys.go

@@ -36,8 +36,9 @@ func setKeyMeta(k *models.Key) {
 	k.HasPassphrase = k.PassphraseEncrypted != ""
 }
 
-func CreateKey(label, publicKey, source, generatedByServerID, privateKey, passphrase string) (*models.Key, error) {
+func CreateKey(orgID, label, publicKey, source, generatedByServerID, privateKey, passphrase string) (*models.Key, error) {
 	key := &models.Key{
+		OrgID:               orgID,
 		KeyID:               uuid.NewString(),
 		Label:               label,
 		PublicKey:           publicKey,
@@ -71,12 +72,12 @@ func CreateKey(label, publicKey, source, generatedByServerID, privateKey, passph
 	return key, nil
 }
 
-func GetKey(keyID string) (*models.Key, error) {
+func GetKey(orgID, keyID string) (*models.Key, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	var key models.Key
-	err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID}).Decode(&key)
+	err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID, "org_id": orgID}).Decode(&key)
 	if err != nil {
 		return nil, err
 	}
@@ -84,12 +85,12 @@ func GetKey(keyID string) (*models.Key, error) {
 	return &key, nil
 }
 
-func GetPrivateKey(keyID string) (string, error) {
+func GetPrivateKey(orgID, keyID string) (string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	var key models.Key
-	if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID}).Decode(&key); err != nil {
+	if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID, "org_id": orgID}).Decode(&key); err != nil {
 		return "", err
 	}
 	if key.PrivateKeyEncrypted == "" {
@@ -99,7 +100,8 @@ func GetPrivateKey(keyID string) (string, error) {
 }
 
 // GetPassphrase returns the decrypted passphrase for a key, or an empty string
-// if the key has none stored.
+// if the key has none stored. Agent-path (keyed by unique key_id from an
+// assignment lookup) — no org filter.
 func GetPassphrase(keyID string) (string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
@@ -119,11 +121,11 @@ type KeyWithCount struct {
 	AssignedCount int `bson:"-" json:"assigned_count"`
 }
 
-func ListKeys() ([]KeyWithCount, error) {
+func ListKeys(orgID string) ([]KeyWithCount, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	cursor, err := db.Col("keys").Find(ctx, bson.M{})
+	cursor, err := db.Col("keys").Find(ctx, bson.M{"org_id": orgID})
 	if err != nil {
 		return nil, err
 	}
@@ -138,6 +140,7 @@ func ListKeys() ([]KeyWithCount, error) {
 	for _, k := range keys {
 		setKeyMeta(&k)
 		count, _ := db.Col("assignments").CountDocuments(ctx, bson.M{
+			"org_id":     orgID,
 			"key_id":     k.KeyID,
 			"revoked_at": nil,
 		})
@@ -146,19 +149,19 @@ func ListKeys() ([]KeyWithCount, error) {
 	return result, nil
 }
 
-func DeleteKey(keyID string) error {
+func DeleteKey(orgID, keyID string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	var key models.Key
-	if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID}).Decode(&key); err != nil {
+	if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID, "org_id": orgID}).Decode(&key); err != nil {
 		return err
 	}
 
-	if _, err := db.Col("keys").DeleteOne(ctx, bson.M{"key_id": keyID}); err != nil {
+	if _, err := db.Col("keys").DeleteOne(ctx, bson.M{"key_id": keyID, "org_id": orgID}); err != nil {
 		return err
 	}
-	if _, err := db.Col("assignments").DeleteMany(ctx, bson.M{"key_id": keyID}); err != nil {
+	if _, err := db.Col("assignments").DeleteMany(ctx, bson.M{"key_id": keyID, "org_id": orgID}); err != nil {
 		return err
 	}
 
@@ -168,13 +171,23 @@ func DeleteKey(keyID string) error {
 	return nil
 }
 
-func AssignKey(keyID, serverID string) (*models.Assignment, error) {
+func AssignKey(orgID, keyID, serverID string) (*models.Assignment, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
+	// Both sides must belong to the caller's org — the IDs arrive from the
+	// client as data and are consumed by unscoped agent-path queries later.
+	if _, err := GetKey(orgID, keyID); err != nil {
+		return nil, fmt.Errorf("key not found")
+	}
+	if _, err := GetServer(orgID, serverID); err != nil {
+		return nil, fmt.Errorf("server not found")
+	}
+
 	// Check if already assigned and active
 	var existing models.Assignment
 	err := db.Col("assignments").FindOne(ctx, bson.M{
+		"org_id":     orgID,
 		"key_id":     keyID,
 		"server_id":  serverID,
 		"revoked_at": nil,
@@ -184,6 +197,7 @@ func AssignKey(keyID, serverID string) (*models.Assignment, error) {
 	}
 
 	a := &models.Assignment{
+		OrgID:      orgID,
 		KeyID:      keyID,
 		ServerID:   serverID,
 		AssignedAt: time.Now(),
@@ -195,23 +209,23 @@ func AssignKey(keyID, serverID string) (*models.Assignment, error) {
 	return a, nil
 }
 
-func RevokeAssignment(keyID, serverID string) error {
+func RevokeAssignment(orgID, keyID, serverID string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	now := time.Now()
 	_, err := db.Col("assignments").UpdateOne(ctx,
-		bson.M{"key_id": keyID, "server_id": serverID, "revoked_at": nil},
+		bson.M{"org_id": orgID, "key_id": keyID, "server_id": serverID, "revoked_at": nil},
 		bson.M{"$set": bson.M{"revoked_at": now}},
 	)
 	return err
 }
 
-func GetAssignmentsForKey(keyID string) ([]models.Assignment, error) {
+func GetAssignmentsForKey(orgID, keyID string) ([]models.Assignment, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	cursor, err := db.Col("assignments").Find(ctx, bson.M{"key_id": keyID, "revoked_at": nil})
+	cursor, err := db.Col("assignments").Find(ctx, bson.M{"org_id": orgID, "key_id": keyID, "revoked_at": nil})
 	if err != nil {
 		return nil, err
 	}
@@ -229,11 +243,11 @@ type AssignmentWithServer struct {
 	Server            *models.Server `json:"server,omitempty"`
 }
 
-func GetAssignmentsWithServers(keyID string) ([]AssignmentWithServer, error) {
+func GetAssignmentsWithServers(orgID, keyID string) ([]AssignmentWithServer, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	cursor, err := db.Col("assignments").Find(ctx, bson.M{"key_id": keyID})
+	cursor, err := db.Col("assignments").Find(ctx, bson.M{"org_id": orgID, "key_id": keyID})
 	if err != nil {
 		return nil, err
 	}
@@ -248,7 +262,7 @@ func GetAssignmentsWithServers(keyID string) ([]AssignmentWithServer, error) {
 	for _, a := range assignments {
 		item := AssignmentWithServer{Assignment: a}
 		var srv models.Server
-		if err := db.Col("servers").FindOne(ctx, bson.M{"server_id": a.ServerID}).Decode(&srv); err == nil {
+		if err := db.Col("servers").FindOne(ctx, bson.M{"server_id": a.ServerID, "org_id": orgID}).Decode(&srv); err == nil {
 			item.Server = &srv
 		}
 		result = append(result, item)
@@ -261,11 +275,11 @@ type AssignmentWithKey struct {
 	Key               *models.Key `json:"key,omitempty"`
 }
 
-func GetAssignmentsWithKeysForServer(serverID string) ([]AssignmentWithKey, error) {
+func GetAssignmentsWithKeysForServer(orgID, serverID string) ([]AssignmentWithKey, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	cursor, err := db.Col("assignments").Find(ctx, bson.M{"server_id": serverID})
+	cursor, err := db.Col("assignments").Find(ctx, bson.M{"org_id": orgID, "server_id": serverID})
 	if err != nil {
 		return nil, err
 	}
@@ -279,7 +293,7 @@ func GetAssignmentsWithKeysForServer(serverID string) ([]AssignmentWithKey, erro
 	result := make([]AssignmentWithKey, 0, len(assignments))
 	for _, a := range assignments {
 		var key models.Key
-		if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": a.KeyID}).Decode(&key); err != nil {
+		if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": a.KeyID, "org_id": orgID}).Decode(&key); err != nil {
 			continue
 		}
 		setKeyMeta(&key)

server/internal/services/migrate.go

@@ -0,0 +1,269 @@
+package services
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+var scopedCollections = []string{
+	"servers", "keys", "assignments", "secrets",
+	"workflows", "workflow_steps", "workflow_runs",
+	"audit_logs", "monitors", "notification_channels",
+	"console_sessions", "incidents", "monitor_rollups",
+}
+
+// EnsureAuthIndexes creates unique indexes for the new auth collections.
+func EnsureAuthIndexes() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	if _, err := db.Col("users").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys:    bson.D{{Key: "email", Value: 1}},
+		Options: options.Index().SetUnique(true),
+	}); err != nil {
+		return err
+	}
+	if _, err := db.Col("orgs").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys:    bson.D{{Key: "slug", Value: 1}},
+		Options: options.Index().SetUnique(true),
+	}); err != nil {
+		return err
+	}
+	if _, err := db.Col("org_oidc").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys:    bson.D{{Key: "org_id", Value: 1}},
+		Options: options.Index().SetUnique(true),
+	}); err != nil {
+		return err
+	}
+	return nil
+}
+
+// defaultBackfillOrg resolves the org that org-less legacy documents belong to:
+// the "default" org, created if absent. Shared by 0001 and 0003 so an instance
+// that ran either one converges on the same org.
+func defaultBackfillOrg(ctx context.Context) (*models.Org, error) {
+	var org models.Org
+	err := db.Col("orgs").FindOne(ctx, bson.M{"slug": "default"}).Decode(&org)
+	switch {
+	case err == nil:
+	case errors.Is(err, mongo.ErrNoDocuments):
+		// Only a genuine absence justifies an insert. Treating a timeout or a
+		// decode failure as "absent" would race the fatal unique orgs.slug index
+		// and turn a transient blip into a boot crash.
+		org = models.Org{OrgID: uuid.NewString(), Name: "Default", Slug: "default", CreatedAt: time.Now()}
+		if _, err := db.Col("orgs").InsertOne(ctx, org); err != nil {
+			return nil, err
+		}
+	default:
+		return nil, err
+	}
+	return &org, nil
+}
+
+// RunMigrations backfills a default org onto pre-existing documents. Idempotent
+// via a marker in the migrations collection.
+func RunMigrations() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	const marker = "0001_default_org_backfill"
+	if n, _ := db.Col("migrations").CountDocuments(ctx, bson.M{"_id": marker}); n > 0 {
+		return nil
+	}
+
+	// Only backfill if there is legacy data lacking org_id.
+	needs := false
+	for _, col := range scopedCollections {
+		n, _ := db.Col(col).CountDocuments(ctx, bson.M{"org_id": bson.M{"$exists": false}})
+		if n > 0 {
+			needs = true
+			break
+		}
+	}
+
+	if needs {
+		org, err := defaultBackfillOrg(ctx)
+		if err != nil {
+			return err
+		}
+		for _, col := range scopedCollections {
+			if _, err := db.Col(col).UpdateMany(ctx,
+				bson.M{"org_id": bson.M{"$exists": false}},
+				bson.M{"$set": bson.M{"org_id": org.OrgID}},
+			); err != nil {
+				return err
+			}
+		}
+	}
+
+	_, err := db.Col("migrations").InsertOne(ctx, bson.M{"_id": marker, "applied_at": time.Now()})
+	return err
+}
+
+// MigrateMissedOrgScopes repairs collections that migration 0001 could not
+// reach. 0001 originally listed "audit" and "channels", but the real collections
+// are audit_logs and notification_channels, so on any instance that ran that
+// version those documents were left without org_id — invisible to org-filtered
+// reads, and in the channels' case silently non-firing. The 0001 marker is
+// already written there, so renaming alone does not repair them; this migration
+// converges both the never-migrated and the incorrectly-migrated case.
+//
+// It also stamps console_sessions, incidents and monitor_rollups, which gained
+// an org_id only after 0001 shipped. Those carry an owning monitor/server whose
+// org is authoritative, so they are derived rather than defaulted. Idempotent
+// via a marker in the migrations collection.
+func MigrateMissedOrgScopes() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	const marker = "0003_missed_org_scopes"
+	if n, _ := db.Col("migrations").CountDocuments(ctx, bson.M{"_id": marker}); n > 0 {
+		return nil
+	}
+
+	// Same org resolution 0001 uses, for the collections it meant to cover.
+	missed := []string{"audit_logs", "notification_channels"}
+	needs := false
+	for _, col := range missed {
+		n, _ := db.Col(col).CountDocuments(ctx, bson.M{"org_id": bson.M{"$exists": false}})
+		if n > 0 {
+			needs = true
+			break
+		}
+	}
+	if needs {
+		org, err := defaultBackfillOrg(ctx)
+		if err != nil {
+			return err
+		}
+		for _, col := range missed {
+			if _, err := db.Col(col).UpdateMany(ctx,
+				bson.M{"org_id": bson.M{"$exists": false}},
+				bson.M{"$set": bson.M{"org_id": org.OrgID}},
+			); err != nil {
+				return err
+			}
+		}
+	}
+
+	// Derived from the owning record — defaulting these would hand one org
+	// another org's console history and incident timeline.
+	if err := backfillOrgFromOwner(ctx, "console_sessions", "server_id", "servers", "server_id"); err != nil {
+		return err
+	}
+	if err := backfillOrgFromOwner(ctx, "incidents", "monitor_id", "monitors", "monitor_id"); err != nil {
+		return err
+	}
+	if err := backfillOrgFromOwner(ctx, "monitor_rollups", "monitor_id", "monitors", "monitor_id"); err != nil {
+		return err
+	}
+
+	_, err := db.Col("migrations").InsertOne(ctx, bson.M{"_id": marker, "applied_at": time.Now()})
+	return err
+}
+
+// backfillOrgFromOwner stamps org_id on every doc in col that lacks one, taking
+// the org from the record in ownerCol it points at. Orphans (owner already
+// deleted) are left alone; they are unreachable either way.
+func backfillOrgFromOwner(ctx context.Context, col, localField, ownerCol, ownerField string) error {
+	// Decoded loosely: a single null or non-string value in the collection would
+	// fail a []string decode and abort the migration — and therefore boot — over
+	// one unusable document. Skip what we cannot use instead.
+	var raw []bson.RawValue
+	if err := db.Col(col).Distinct(ctx, localField,
+		bson.M{"org_id": bson.M{"$exists": false}}).Decode(&raw); err != nil {
+		return err
+	}
+	for _, rv := range raw {
+		id, ok := rv.StringValueOK()
+		if !ok || id == "" {
+			continue
+		}
+		var owner struct {
+			OrgID string `bson:"org_id"`
+		}
+		if err := db.Col(ownerCol).FindOne(ctx, bson.M{ownerField: id}).Decode(&owner); err != nil {
+			continue
+		}
+		if owner.OrgID == "" {
+			continue
+		}
+		if _, err := db.Col(col).UpdateMany(ctx,
+			bson.M{localField: id, "org_id": bson.M{"$exists": false}},
+			bson.M{"$set": bson.M{"org_id": owner.OrgID}},
+		); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// MigrateSettingsOrg stamps the legacy global settings singleton with the
+// default org's ID. Without it an upgrade would orphan the existing SMTP
+// config, alert config, retention setting, and ESO read token. Idempotent via
+// a marker in the migrations collection.
+func MigrateSettingsOrg() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	const marker = "0002_settings_org_backfill"
+	if n, _ := db.Col("migrations").CountDocuments(ctx, bson.M{"_id": marker}); n > 0 {
+		return nil
+	}
+
+	n, _ := db.Col("settings").CountDocuments(ctx, bson.M{"org_id": bson.M{"$exists": false}})
+	if n > 0 {
+		// The org-less settings doc belongs to whichever org already exists —
+		// migration 0001 only creates a "default" org when there was legacy
+		// data to backfill, so keying off that slug would invent a phantom org
+		// and move the real org's config onto it.
+		var org models.Org
+		orgCount, err := db.Col("orgs").CountDocuments(ctx, bson.M{})
+		if err != nil {
+			return err
+		}
+		switch orgCount {
+		case 1:
+			if err := db.Col("orgs").FindOne(ctx, bson.M{}).Decode(&org); err != nil {
+				return err
+			}
+		case 0:
+			org = models.Org{OrgID: uuid.NewString(), Name: "Default", Slug: "default", CreatedAt: time.Now()}
+			if _, err := db.Col("orgs").InsertOne(ctx, org); err != nil {
+				return err
+			}
+		default:
+			// Ambiguous: several orgs but an unstamped settings doc. Guessing
+			// would hand one org another's SMTP config and ESO token. Continuing
+			// is not an option either: the unique settings.org_id index built
+			// straight after this indexes every unstamped doc as null, so two or
+			// more of them collide and boot fails there instead — with a far less
+			// useful message. Stop here, where we can name the remedy.
+			return fmt.Errorf(
+				"settings org migration: %d settings document(s) have no org_id but %d orgs exist; "+
+					"cannot infer the owner. Set org_id manually on each settings document "+
+					"(db.settings.updateOne({_id:<id>},{$set:{org_id:\"<org uuid>\"}})), deleting any "+
+					"duplicates, then restart", n, orgCount)
+		}
+		if org.OrgID != "" {
+			if _, err := db.Col("settings").UpdateMany(ctx,
+				bson.M{"org_id": bson.M{"$exists": false}},
+				bson.M{"$set": bson.M{"org_id": org.OrgID}},
+			); err != nil {
+				return err
+			}
+		}
+	}
+
+	_, err := db.Col("migrations").InsertOne(ctx, bson.M{"_id": marker, "applied_at": time.Now()})
+	return err
+}

server/internal/services/monitors.go

@@ -0,0 +1,407 @@
+package services
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/checker"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/notify"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+func monCtx() (context.Context, context.CancelFunc) {
+	return context.WithTimeout(context.Background(), 5*time.Second)
+}
+
+// SpecFor maps a monitor onto a checker.Spec.
+func SpecFor(m *models.Monitor) checker.Spec {
+	return checker.Spec{
+		Type:           m.Type,
+		URL:            m.Target.URL,
+		Host:           m.Target.Host,
+		Port:           m.Target.Port,
+		Method:         m.Target.Method,
+		ExpectedStatus: m.Target.ExpectedStatus,
+		Keyword:        m.Target.Keyword,
+		TLSWarnDays:    m.Target.TLSWarnDays,
+		Insecure:       m.Target.Insecure,
+		TimeoutSec:     m.IntervalSec,
+	}
+}
+
+func ListMonitors(orgID string) ([]models.Monitor, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	cur, err := db.Col("monitors").Find(ctx, bson.M{"org_id": orgID}, options.Find().SetSort(bson.M{"created_at": 1}))
+	if err != nil {
+		return nil, err
+	}
+	var out []models.Monitor
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ListMonitorsForRunner returns enabled monitors whose Runner matches runner,
+// scoped to orgID. Runner is client-supplied at write time, so an agent fetching
+// its own work must scope by the org of its authenticated server record —
+// otherwise another org could point a monitor at that server_id and have it run
+// their checks. An empty orgID is rejected: it would silently widen the query to
+// every org.
+func ListMonitorsForRunner(orgID, runner string) ([]models.Monitor, error) {
+	if orgID == "" {
+		return nil, errors.New("org id required")
+	}
+	return listMonitorsForRunner(orgID, runner)
+}
+
+// ListServerScheduledMonitors returns every enabled server-run monitor across
+// all orgs. This is the in-process scheduler's entry point (mirrors the cross-org
+// MarkOfflineServers sweep) and must never be called from a request-driven path —
+// it performs no org scoping at all.
+func ListServerScheduledMonitors() ([]models.Monitor, error) {
+	return listMonitorsForRunner("", models.RunnerServer)
+}
+
+// listMonitorsForRunner is the shared query. An empty orgID means no org filter
+// and is only reachable via ListServerScheduledMonitors.
+func listMonitorsForRunner(orgID, runner string) ([]models.Monitor, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	filter := bson.M{"runner": runner, "enabled": true}
+	if orgID != "" {
+		filter["org_id"] = orgID
+	}
+	cur, err := db.Col("monitors").Find(ctx, filter)
+	if err != nil {
+		return nil, err
+	}
+	var out []models.Monitor
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// GetMonitor looks up a monitor scoped to an org (handler/session use).
+func GetMonitor(orgID, monitorID string) (*models.Monitor, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	var m models.Monitor
+	err := db.Col("monitors").FindOne(ctx, bson.M{"monitor_id": monitorID, "org_id": orgID}).Decode(&m)
+	if errors.Is(err, mongo.ErrNoDocuments) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &m, nil
+}
+
+// getMonitorByID looks up a monitor by its unique monitor_id with no org
+// filter. For agent/scheduler use only (IngestResult), which has no session.
+func getMonitorByID(monitorID string) (*models.Monitor, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	var m models.Monitor
+	err := db.Col("monitors").FindOne(ctx, bson.M{"monitor_id": monitorID}).Decode(&m)
+	if errors.Is(err, mongo.ErrNoDocuments) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &m, nil
+}
+
+// validateRunner rejects a runner that is neither the reserved server-scheduler
+// value nor a server in the org. The value is client-supplied and is later
+// consumed by an agent's own monitor fetch, so ownership has to be proven at
+// the write boundary.
+func validateRunner(orgID, runner string) error {
+	if runner == "" || runner == models.RunnerServer {
+		return nil
+	}
+	if _, err := GetServer(orgID, runner); err != nil {
+		return fmt.Errorf("runner server %s not found", runner)
+	}
+	return nil
+}
+
+func CreateMonitor(orgID string, m *models.Monitor) (*models.Monitor, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	if err := validateChannelIDs(orgID, m.ChannelIDs); err != nil {
+		return nil, err
+	}
+	if err := validateRunner(orgID, m.Runner); err != nil {
+		return nil, err
+	}
+	m.OrgID = orgID
+	m.MonitorID = uuid.NewString()
+	m.CreatedAt = time.Now()
+	if m.IntervalSec <= 0 {
+		m.IntervalSec = 60
+	}
+	if m.Retries <= 0 {
+		m.Retries = 1
+	}
+	if m.Runner == "" {
+		m.Runner = models.RunnerServer
+	}
+	m.State = models.MonitorState{Status: models.StatusPending}
+	if _, err := db.Col("monitors").InsertOne(ctx, m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func UpdateMonitor(orgID, monitorID string, upd bson.M) error {
+	ctx, cancel := monCtx()
+	defer cancel()
+	// A present-but-wrong-type value is a hard error: silently skipping the
+	// check would still let the unvalidated value through to the $set.
+	if raw, present := upd["channel_ids"]; present {
+		ids, ok := raw.([]string)
+		if !ok {
+			return fmt.Errorf("channel_ids must be a string array")
+		}
+		if err := validateChannelIDs(orgID, ids); err != nil {
+			return err
+		}
+	}
+	if raw, present := upd["runner"]; present {
+		runner, ok := raw.(string)
+		if !ok {
+			return fmt.Errorf("runner must be a string")
+		}
+		if err := validateRunner(orgID, runner); err != nil {
+			return err
+		}
+		// Match CreateMonitor: an empty runner means the server scheduler.
+		// Storing "" would match no runner at all and silently stop the
+		// monitor being checked.
+		if runner == "" {
+			upd["runner"] = models.RunnerServer
+		}
+	}
+	_, err := db.Col("monitors").UpdateOne(ctx, bson.M{"monitor_id": monitorID, "org_id": orgID}, bson.M{"$set": upd})
+	return err
+}
+
+func DeleteMonitor(orgID, monitorID string) error {
+	ctx, cancel := monCtx()
+	defer cancel()
+	res, err := db.Col("monitors").DeleteOne(ctx, bson.M{"monitor_id": monitorID, "org_id": orgID})
+	if err != nil {
+		return err
+	}
+	// Only cascade when the org-scoped delete actually removed a monitor.
+	if res.DeletedCount == 0 {
+		return nil
+	}
+	db.Col("incidents").DeleteMany(ctx, bson.M{"monitor_id": monitorID, "org_id": orgID})
+	db.Col("monitor_rollups").DeleteMany(ctx, bson.M{"monitor_id": monitorID, "org_id": orgID})
+	return nil
+}
+
+func ListIncidents(orgID, monitorID string, limit int64) ([]models.Incident, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	if limit <= 0 {
+		limit = 50
+	}
+	cur, err := db.Col("incidents").Find(ctx, bson.M{"monitor_id": monitorID, "org_id": orgID},
+		options.Find().SetSort(bson.M{"started_at": -1}).SetLimit(limit))
+	if err != nil {
+		return nil, err
+	}
+	var out []models.Incident
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// UptimeRollups returns hourly rollups for a monitor since the cutoff, oldest first.
+func UptimeRollups(orgID, monitorID string, since time.Time) ([]models.Rollup, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	cur, err := db.Col("monitor_rollups").Find(ctx,
+		bson.M{"monitor_id": monitorID, "org_id": orgID, "period_start": bson.M{"$gte": since}},
+		options.Find().SetSort(bson.M{"period_start": 1}))
+	if err != nil {
+		return nil, err
+	}
+	var out []models.Rollup
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// IngestResult applies a check result to a monitor: updates state, opens/resolves
+// incidents on up<->down transitions, rolls up the hourly bucket, and fires
+// notifications on transition. Both the server scheduler and agent-reported
+// results funnel through here.
+//
+// monitorID is client-supplied on the agent path, so the caller passes the org
+// and runner it is authenticated as: orgID is the reporting agent's server org
+// and runner is its server_id. A result is only applied to a monitor owned by
+// that org and assigned to that runner. An empty orgID is rejected — it would
+// skip the ownership check entirely.
+func IngestResult(orgID, runner, monitorID string, res checker.Result) error {
+	if orgID == "" {
+		return errors.New("org id required")
+	}
+	return ingestResult(orgID, runner, monitorID, res)
+}
+
+// IngestServerScheduledResult applies a result produced by the in-process server
+// scheduler, which has no org context of its own. This is the scheduler's entry
+// point and must never be called from a request-driven path — it skips the org
+// ownership check.
+func IngestServerScheduledResult(monitorID string, res checker.Result) error {
+	return ingestResult("", models.RunnerServer, monitorID, res)
+}
+
+// ingestResult is the shared implementation. An empty orgID skips the org
+// ownership check and is only reachable via IngestServerScheduledResult.
+func ingestResult(orgID, runner, monitorID string, res checker.Result) error {
+	ctx, cancel := monCtx()
+	defer cancel()
+
+	m, err := getMonitorByID(monitorID)
+	if err != nil {
+		return err
+	}
+	// Report not-found the same way as a cross-org hit, so probing an unknown
+	// monitor_id is no quieter than probing a foreign one and stale monitors
+	// stay visible to operators.
+	if m == nil {
+		return fmt.Errorf("monitor %s not found", monitorID)
+	}
+	if orgID != "" && m.OrgID != orgID {
+		return fmt.Errorf("monitor %s belongs to another org", monitorID)
+	}
+	if m.Runner != runner {
+		return fmt.Errorf("monitor %s is not run by %s", monitorID, runner)
+	}
+
+	now := time.Now()
+	prev := m.State.Status
+	retries := m.Retries
+	if retries < 1 {
+		retries = 1
+	}
+
+	newStatus := prev
+	fails := m.State.Fails
+	if res.Up {
+		fails = 0
+		newStatus = models.StatusUp
+	} else {
+		fails++
+		if fails >= retries {
+			newStatus = models.StatusDown
+		} else if prev == "" || prev == models.StatusPending {
+			newStatus = models.StatusPending
+		}
+	}
+
+	state := bson.M{
+		"state.status":        newStatus,
+		"state.last_check_at": now,
+		"state.latency_ms":    res.LatencyMs,
+		"state.message":       res.Message,
+		"state.fails":         fails,
+	}
+	if res.CertExpiry != nil {
+		state["state.cert_expiry_at"] = *res.CertExpiry
+	}
+	if _, err := db.Col("monitors").UpdateOne(ctx, bson.M{"monitor_id": monitorID}, bson.M{"$set": state}); err != nil {
+		return err
+	}
+
+	// Hourly rollup.
+	bucket := now.Truncate(time.Hour)
+	up := 0
+	if res.Up {
+		up = 1
+	}
+	// org_id via $setOnInsert rather than the filter: a legacy bucket written
+	// before rollups were tenanted must keep accumulating, not fork in two.
+	db.Col("monitor_rollups").UpdateOne(ctx,
+		bson.M{"monitor_id": monitorID, "period_start": bucket},
+		bson.M{
+			"$inc":         bson.M{"checks": 1, "up_count": up, "sum_latency": int64(res.LatencyMs)},
+			"$setOnInsert": bson.M{"org_id": m.OrgID},
+		},
+		options.UpdateOne().SetUpsert(true))
+
+	// Transition handling.
+	if newStatus != prev {
+		switch newStatus {
+		case models.StatusDown:
+			inc := models.Incident{
+				OrgID:      m.OrgID,
+				IncidentID: uuid.NewString(),
+				MonitorID:  monitorID,
+				StartedAt:  now,
+				Cause:      res.Message,
+			}
+			db.Col("incidents").InsertOne(ctx, inc)
+			notifyTransition(m, newStatus, res.Message)
+		case models.StatusUp:
+			if prev == models.StatusDown {
+				db.Col("incidents").UpdateOne(ctx,
+					bson.M{"monitor_id": monitorID, "org_id": m.OrgID, "resolved_at": nil},
+					bson.M{"$set": bson.M{"resolved_at": now}})
+				notifyTransition(m, newStatus, res.Message)
+			}
+		}
+	}
+	return nil
+}
+
+// notifyTransition dispatches notifications on an up<->down transition to each
+// enabled channel bound to the monitor. Deliveries run in the background;
+// failures are logged, not fatal.
+func notifyTransition(m *models.Monitor, newStatus, message string) {
+	if len(m.ChannelIDs) == 0 {
+		return
+	}
+	channels, err := GetChannels(m.OrgID, m.ChannelIDs)
+	if err != nil {
+		log.Printf("notify: load channels for %s: %v", m.MonitorID, err)
+		return
+	}
+	ev := notify.Event{
+		MonitorName: m.Name,
+		Type:        m.Type,
+		OldStatus:   m.State.Status,
+		NewStatus:   newStatus,
+		Message:     message,
+		Time:        time.Now(),
+	}
+	for _, ch := range channels {
+		if !ch.Enabled {
+			continue
+		}
+		go func(c models.NotificationChannel) {
+			if err := notify.Dispatch(c, ev); err != nil {
+				log.Printf("notify: dispatch to %s (%s): %v", c.Name, c.Type, err)
+			}
+		}(ch)
+	}
+	_ = UpdateMonitor(m.OrgID, m.MonitorID, bson.M{"state.last_notified_at": time.Now()})
+}

server/internal/services/org_oidc.go

@@ -0,0 +1,52 @@
+package services
+
+import (
+	"context"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+func GetOrgOIDC(orgID string) (*models.OrgOIDC, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var o models.OrgOIDC
+	err := db.Col("org_oidc").FindOne(ctx, bson.M{"org_id": orgID}).Decode(&o)
+	if err != nil {
+		return nil, err
+	}
+	return &o, nil
+}
+
+func GetOrgOIDCSecret(orgID string) (string, error) {
+	o, err := GetOrgOIDC(orgID)
+	if err != nil {
+		return "", err
+	}
+	return decryptString(o.ClientSecretEnc)
+}
+
+// SaveOrgOIDC upserts the org's provider config. An empty clientSecret keeps the
+// stored secret (so the UI need not resend it).
+func SaveOrgOIDC(orgID, issuer, clientID, clientSecret string, enabled bool) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	set := bson.M{
+		"org_id": orgID, "issuer": issuer, "client_id": clientID,
+		"enabled": enabled, "updated_at": time.Now(),
+	}
+	if clientSecret != "" {
+		enc, err := encryptString(clientSecret)
+		if err != nil {
+			return err
+		}
+		set["client_secret_enc"] = enc
+	}
+	_, err := db.Col("org_oidc").UpdateOne(ctx,
+		bson.M{"org_id": orgID}, bson.M{"$set": set},
+		options.UpdateOne().SetUpsert(true))
+	return err
+}

server/internal/services/orgs.go

@@ -0,0 +1,168 @@
+package services
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+)
+
+var reservedSlugs = map[string]bool{
+	"www": true, "api": true, "app": true, "admin": true, "auth": true,
+	"install": true, "static": true, "_next": true, "default": true,
+}
+
+func GetOrg(orgID string) (*models.Org, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var o models.Org
+	err := db.Col("orgs").FindOne(ctx, bson.M{"org_id": orgID}).Decode(&o)
+	if err != nil {
+		return nil, err
+	}
+	return &o, nil
+}
+
+func GetOrgBySlug(slug string) (*models.Org, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var o models.Org
+	err := db.Col("orgs").FindOne(ctx, bson.M{"slug": slug}).Decode(&o)
+	if err != nil {
+		return nil, err
+	}
+	return &o, nil
+}
+
+// ListOrgIDs returns the org_id of every organization. Used by startup tasks
+// (e.g. seeding default workflow steps) that must run once per org.
+func ListOrgIDs() ([]string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	cursor, err := db.Col("orgs").Find(ctx, bson.M{})
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close(ctx)
+	var orgs []models.Org
+	if err := cursor.All(ctx, &orgs); err != nil {
+		return nil, err
+	}
+	ids := make([]string, 0, len(orgs))
+	for _, o := range orgs {
+		ids = append(ids, o.OrgID)
+	}
+	return ids, nil
+}
+
+// CountOrgs returns the number of organizations on the instance. Used by
+// first-run bootstrap to tell "empty instance" from "upgraded single-tenant
+// instance whose data already sits under a migration-created org".
+func CountOrgs() (int64, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	return db.Col("orgs").CountDocuments(ctx, bson.M{})
+}
+
+// FirstOrg returns the sole/earliest org. Callers must have established that
+// exactly one exists before treating it as authoritative.
+func FirstOrg() (*models.Org, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var o models.Org
+	if err := db.Col("orgs").FindOne(ctx, bson.M{}).Decode(&o); err != nil {
+		return nil, err
+	}
+	return &o, nil
+}
+
+// AdoptOrg renames an existing org to name, re-slugging it when the new slug is
+// clean to take. It exists for the upgrade path: migration 0001 stamps every
+// legacy document with the "default" org's ID, so bootstrap must claim that org
+// rather than mint a second one — otherwise the operator signs in to an empty
+// instance while all their servers and keys stay behind under "default".
+//
+// The slug is only changed when the derived one is usable and free; anything
+// else keeps the current slug, including the reserved "default", which stays
+// valid because it is pre-existing rather than newly chosen.
+func AdoptOrg(orgID, name string) (*models.Org, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	set := bson.M{"name": name}
+
+	slug := Slugify(name)
+	if len(slug) > 40 {
+		slug = slug[:40]
+	}
+	if len(slug) >= 3 && !reservedSlugs[slug] {
+		n, err := db.Col("orgs").CountDocuments(ctx, bson.M{"slug": slug, "org_id": bson.M{"$ne": orgID}})
+		if err != nil {
+			return nil, err
+		}
+		if n == 0 {
+			set["slug"] = slug
+		}
+	}
+
+	if _, err := db.Col("orgs").UpdateOne(ctx, bson.M{"org_id": orgID}, bson.M{"$set": set}); err != nil {
+		if mongo.IsDuplicateKeyError(err) {
+			return nil, fmt.Errorf("organization slug already taken")
+		}
+		return nil, err
+	}
+	return GetOrg(orgID)
+}
+
+func CreateOrg(name string) (*models.Org, error) {
+	base := Slugify(name)
+	if len(base) < 3 {
+		return nil, fmt.Errorf("organization name too short (slug must be >= 3 chars)")
+	}
+	if len(base) > 40 {
+		base = base[:40]
+	}
+	if reservedSlugs[base] {
+		return nil, fmt.Errorf("organization name is reserved")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	// Resolve slug collision by suffixing -2, -3, ...
+	slug := base
+	for i := 2; ; i++ {
+		n, err := db.Col("orgs").CountDocuments(ctx, bson.M{"slug": slug})
+		if err != nil {
+			return nil, err
+		}
+		if n == 0 {
+			break
+		}
+		slug = fmt.Sprintf("%s-%d", base, i)
+	}
+
+	o := &models.Org{OrgID: uuid.NewString(), Name: name, Slug: slug, CreatedAt: time.Now()}
+	if _, err := db.Col("orgs").InsertOne(ctx, o); err != nil {
+		if mongo.IsDuplicateKeyError(err) {
+			return nil, fmt.Errorf("organization slug already taken")
+		}
+		return nil, err
+	}
+
+	// Boot-time seeding only covers orgs that already existed, so an org created
+	// at runtime would have an empty step library until the next restart. Not
+	// fatal: the org is usable without it and seeding is retried on boot.
+	if created, updated, err := SeedDefaultSteps(o.OrgID); err != nil {
+		log.Printf("warning: failed to seed default steps for new org %s: %v", o.OrgID, err)
+	} else {
+		log.Printf("default steps seeded for new org %s: %d created, %d updated", o.OrgID, created, updated)
+	}
+	return o, nil
+}

server/internal/services/secrets.go

@@ -2,6 +2,7 @@ package services
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"sort"
 	"time"
@@ -13,25 +14,47 @@ import (
 	"go.mongodb.org/mongo-driver/v2/mongo/options"
 )
 
-// EnsureSecretIndexes creates the unique compound index on (group, key).
+// EnsureSecretIndexes creates the unique compound index on (org_id, group, key).
+// The pre-multi-tenant index was on (group, key) alone, which made a second org
+// collide on the same group/key — drop it if a live DB still carries it.
 func EnsureSecretIndexes() error {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
+	if err := db.Col("secrets").Indexes().DropOne(ctx, "group_1_key_1"); err != nil && !isIndexNotFound(err) {
+		return err
+	}
+
 	_, err := db.Col("secrets").Indexes().CreateOne(ctx, mongo.IndexModel{
-		Keys:    bson.D{{Key: "group", Value: 1}, {Key: "key", Value: 1}},
+		Keys:    bson.D{{Key: "org_id", Value: 1}, {Key: "group", Value: 1}, {Key: "key", Value: 1}},
 		Options: options.Index().SetUnique(true),
 	})
 	return err
 }
 
+// isIndexNotFound reports whether err is Mongo's IndexNotFound (27), returned
+// when dropping an index that was never created, or NamespaceNotFound (26),
+// returned when the collection itself does not exist yet. Both mean "there is
+// no legacy index to drop" — on a fresh install nothing has written to these
+// collections, so the drop must be tolerated or the index creation that follows
+// it never runs and a brand-new deployment crash-loops at startup.
+func isIndexNotFound(err error) bool {
+	var ce mongo.CommandError
+	if errors.As(err, &ce) {
+		return ce.Code == 27 || ce.Name == "IndexNotFound" ||
+			ce.Code == 26 || ce.Name == "NamespaceNotFound"
+	}
+	return false
+}
+
 // ListSecretGroups returns a summary of every group with its key count and
 // most recent update time.
-func ListSecretGroups() ([]models.GroupSummary, error) {
+func ListSecretGroups(orgID string) ([]models.GroupSummary, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	pipeline := mongo.Pipeline{
+		{{Key: "$match", Value: bson.D{{Key: "org_id", Value: orgID}}}},
 		{{Key: "$group", Value: bson.D{
 			{Key: "_id", Value: "$group"},
 			{Key: "key_count", Value: bson.D{{Key: "$sum", Value: 1}}},
@@ -68,11 +91,11 @@ func ListSecretGroups() ([]models.GroupSummary, error) {
 
 // GetSecretGroup returns the keys within a group, sorted by key name, without
 // decrypted values.
-func GetSecretGroup(group string) ([]models.Secret, error) {
+func GetSecretGroup(orgID, group string) ([]models.Secret, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	cursor, err := db.Col("secrets").Find(ctx, bson.M{"group": group},
+	cursor, err := db.Col("secrets").Find(ctx, bson.M{"org_id": orgID, "group": group},
 		options.Find().SetSort(bson.D{{Key: "key", Value: 1}}))
 	if err != nil {
 		return nil, err
@@ -87,9 +110,10 @@ func GetSecretGroup(group string) ([]models.Secret, error) {
 }
 
 // GetSecretGroupDecrypted returns a flat map of key → plaintext value for a
-// group. Used by the ESO read endpoint.
-func GetSecretGroupDecrypted(group string) (map[string]string, error) {
-	docs, err := GetSecretGroup(group)
+// group. Also used by the ESO read endpoint, which resolves its org from the
+// per-org bearer token rather than from a session.
+func GetSecretGroupDecrypted(orgID, group string) (map[string]string, error) {
+	docs, err := GetSecretGroup(orgID, group)
 	if err != nil {
 		return nil, err
 	}
@@ -105,12 +129,12 @@ func GetSecretGroupDecrypted(group string) (map[string]string, error) {
 }
 
 // RevealSecret returns the decrypted value of a single key.
-func RevealSecret(group, key string) (string, error) {
+func RevealSecret(orgID, group, key string) (string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	var doc models.Secret
-	err := db.Col("secrets").FindOne(ctx, bson.M{"group": group, "key": key}).Decode(&doc)
+	err := db.Col("secrets").FindOne(ctx, bson.M{"org_id": orgID, "group": group, "key": key}).Decode(&doc)
 	if err == mongo.ErrNoDocuments {
 		return "", fmt.Errorf("secret not found")
 	}
@@ -121,7 +145,7 @@ func RevealSecret(group, key string) (string, error) {
 }
 
 // UpsertSecrets encrypts and writes each key/value pair into the group.
-func UpsertSecrets(group string, values map[string]string) error {
+func UpsertSecrets(orgID, group string, values map[string]string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
@@ -131,8 +155,9 @@ func UpsertSecrets(group string, values map[string]string) error {
 			return fmt.Errorf("encrypt %s: %w", key, err)
 		}
 		_, err = db.Col("secrets").UpdateOne(ctx,
-			bson.M{"group": group, "key": key},
+			bson.M{"org_id": orgID, "group": group, "key": key},
 			bson.M{"$set": bson.M{
+				"org_id":          orgID,
 				"encrypted_value": encrypted,
 				"updated_at":      time.Now(),
 			}},
@@ -156,19 +181,19 @@ func SortedKeys(m map[string]string) []string {
 }
 
 // DeleteSecret removes a single key from a group.
-func DeleteSecret(group, key string) error {
+func DeleteSecret(orgID, group, key string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	_, err := db.Col("secrets").DeleteOne(ctx, bson.M{"group": group, "key": key})
+	_, err := db.Col("secrets").DeleteOne(ctx, bson.M{"org_id": orgID, "group": group, "key": key})
 	return err
 }
 
 // DeleteSecretGroup removes an entire group and all its keys.
-func DeleteSecretGroup(group string) error {
+func DeleteSecretGroup(orgID, group string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	_, err := db.Col("secrets").DeleteMany(ctx, bson.M{"group": group})
+	_, err := db.Col("secrets").DeleteMany(ctx, bson.M{"org_id": orgID, "group": group})
 	return err
 }

server/internal/services/servers.go

@@ -6,6 +6,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"fmt"
+	"log"
 	"strings"
 	"time"
 
@@ -29,13 +30,14 @@ func HashToken(token string) string {
 	return hex.EncodeToString(sum[:])
 }
 
-func CreateServer() (*models.Server, string, error) {
+func CreateServer(orgID string) (*models.Server, string, error) {
 	token, err := generateToken(32)
 	if err != nil {
 		return nil, "", err
 	}
 	expires := time.Now().Add(time.Hour)
 	s := &models.Server{
+		OrgID:         orgID,
 		ServerID:      uuid.NewString(),
 		PreRegToken:   token,
 		PreRegExpires: &expires,
@@ -52,7 +54,22 @@ func CreateServer() (*models.Server, string, error) {
 	return s, token, nil
 }
 
-func GetServer(serverID string) (*models.Server, error) {
+// GetServer looks up a server scoped to an org (handler/session use).
+func GetServer(orgID, serverID string) (*models.Server, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var s models.Server
+	err := db.Col("servers").FindOne(ctx, bson.M{"server_id": serverID, "org_id": orgID}).Decode(&s)
+	if err != nil {
+		return nil, err
+	}
+	return &s, nil
+}
+
+// getServerByID looks up a server by its unique server_id with no org filter.
+// For agent/internal use only (e.g. workflow runner resolving org from a run).
+func getServerByID(serverID string) (*models.Server, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
@@ -164,6 +181,11 @@ func ValidateAgentToken(serverID, agentToken string) (*models.Server, error) {
 	if err != nil {
 		return nil, fmt.Errorf("invalid agent token")
 	}
+	// Defence in depth: every agent-path caller scopes its work by this OrgID,
+	// so a blank one would widen those queries instead of narrowing them.
+	if s.OrgID == "" {
+		return nil, fmt.Errorf("server %s has no org", serverID)
+	}
 	return &s, nil
 }
 
@@ -214,12 +236,12 @@ func UpdateServerLastSeen(serverID, agentVersion string) error {
 	return err
 }
 
-func ListServers() ([]models.Server, error) {
+func ListServers(orgID string) ([]models.Server, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	opts := options.Find().SetSort(bson.D{{Key: "created_at", Value: -1}})
-	cursor, err := db.Col("servers").Find(ctx, bson.M{}, opts)
+	cursor, err := db.Col("servers").Find(ctx, bson.M{"org_id": orgID}, opts)
 	if err != nil {
 		return nil, err
 	}
@@ -232,16 +254,16 @@ func ListServers() ([]models.Server, error) {
 	return servers, nil
 }
 
-func DeleteServer(serverID string) error {
+func DeleteServer(orgID, serverID string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	_, err := db.Col("servers").DeleteOne(ctx, bson.M{"server_id": serverID})
+	_, err := db.Col("servers").DeleteOne(ctx, bson.M{"server_id": serverID, "org_id": orgID})
 	if err != nil {
 		return err
 	}
 	// Also remove assignments
-	_, err = db.Col("assignments").DeleteMany(ctx, bson.M{"server_id": serverID})
+	_, err = db.Col("assignments").DeleteMany(ctx, bson.M{"server_id": serverID, "org_id": orgID})
 	return err
 }
 
@@ -261,39 +283,73 @@ func StoreAvailableUpdates(serverID string, pkgs []models.PackageUpdate) error {
 }
 
 func MarkOfflineServers() error {
-	settings, _ := GetSettings()
-	thresholdMinutes := 5
-	if settings != nil && settings.Alerts.OfflineThresholdMinutes > 0 {
-		thresholdMinutes = settings.Alerts.OfflineThresholdMinutes
-	}
-	threshold := time.Duration(thresholdMinutes) * time.Minute
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	cutoff := time.Now().Add(-threshold)
-
-	// Find servers about to transition to offline so we can alert on them.
-	cursor, err := db.Col("servers").Find(ctx, bson.M{
-		"status":    "active",
-		"last_seen": bson.M{"$lt": cutoff},
-	})
+	orgIDs, err := ListOrgIDs()
 	if err != nil {
 		return err
 	}
-	defer cursor.Close(ctx)
 
-	var goingOffline []models.Server
-	if err := cursor.All(ctx, &goingOffline); err != nil {
-		return err
+	// No session here, so the sweep runs per-org and each org's threshold and
+	// alert config come from that org's own settings doc. Each org gets its own
+	// deadline so a slow org can't starve the ones after it, and a failure on
+	// one org is logged rather than aborting the whole sweep.
+	for _, orgID := range orgIDs {
+		if err := markOfflineForFilter(bson.M{"org_id": orgID}, orgID); err != nil {
+			log.Printf("offline sweep failed for org %s: %v", orgID, err)
+		}
 	}
 
+	// Servers whose org_id matches no existing org (org deleted, or the doc
+	// predates the backfill) would otherwise never be swept, where the old
+	// global query caught them. Sweep them with the default threshold; there is
+	// no org settings doc to read, and no org to alert.
+	if err := markOfflineForFilter(bson.M{"org_id": bson.M{"$nin": orgIDs}}, ""); err != nil {
+		log.Printf("offline sweep failed for orphaned servers: %v", err)
+	}
+	return nil
+}
+
+// markOfflineForFilter transitions active-but-stale servers matching scope to
+// offline. orgID selects whose settings supply the threshold and alert config;
+// empty means defaults with no alerting (orphaned servers).
+func markOfflineForFilter(scope bson.M, orgID string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	var settings *models.Settings
+	thresholdMinutes := 5
+	if orgID != "" {
+		settings, _ = GetSettings(orgID)
+		if settings != nil && settings.Alerts.OfflineThresholdMinutes > 0 {
+			thresholdMinutes = settings.Alerts.OfflineThresholdMinutes
+		}
+	}
+	cutoff := time.Now().Add(-time.Duration(thresholdMinutes) * time.Minute)
+
+	filter := bson.M{
+		"status":    "active",
+		"last_seen": bson.M{"$lt": cutoff},
+	}
+	for k, v := range scope {
+		filter[k] = v
+	}
+
+	// Find servers about to transition to offline so we can alert on them.
+	cursor, err := db.Col("servers").Find(ctx, filter)
+	if err != nil {
+		return err
+	}
+	var goingOffline []models.Server
+	err = cursor.All(ctx, &goingOffline)
+	cursor.Close(ctx)
+	if err != nil {
+		return err
+	}
 	if len(goingOffline) == 0 {
 		return nil
 	}
 
 	for _, s := range goingOffline {
-		LogEvent("server.offline", "system", s.ServerID, "", fmt.Sprintf("%s (%s) went offline", s.Hostname, s.IPAddress))
+		LogEvent(s.OrgID, "server.offline", "system", s.ServerID, "", fmt.Sprintf("%s (%s) went offline", s.Hostname, s.IPAddress))
 		if settings != nil && settings.Alerts.Enabled && settings.Alerts.WebhookURL != "" {
 			go SendOfflineWebhook(settings.Alerts.WebhookURL, s.Hostname, s.ServerID, s.IPAddress)
 		}
@@ -302,11 +358,7 @@ func MarkOfflineServers() error {
 		}
 	}
 
-	_, err = db.Col("servers").UpdateMany(ctx,
-		bson.M{
-			"status":    "active",
-			"last_seen": bson.M{"$lt": cutoff},
-		},
+	_, err = db.Col("servers").UpdateMany(ctx, filter,
 		bson.M{"$set": bson.M{"status": "offline"}},
 	)
 	return err

server/internal/services/servers_console_test.go

@@ -1,18 +0,0 @@
-package services
-
-import "testing"
-
-func TestOSTypeFromInfo(t *testing.T) {
-	cases := map[string]string{
-		"windows amd64": "windows",
-		"linux amd64":   "linux",
-		"linux arm64":   "linux",
-		"":              "linux",
-		"darwin arm64":  "linux",
-	}
-	for in, want := range cases {
-		if got := OSTypeFromInfo(in); got != want {
-			t.Errorf("OSTypeFromInfo(%q) = %q, want %q", in, got, want)
-		}
-	}
-}

server/internal/services/settings.go

@@ -34,14 +34,47 @@ var defaultSettings = models.Settings{
 	},
 }
 
-func GetSettings() (*models.Settings, error) {
+// EnsureSettingsIndexes creates the per-org uniqueness constraints on settings.
+// Pre-multi-tenant deployments had a single global settings doc and no indexes;
+// drop any legacy index if a live DB still carries one.
+func EnsureSettingsIndexes() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	if err := db.Col("settings").Indexes().DropOne(ctx, "secrets.read_token_hash_1"); err != nil && !isIndexNotFound(err) {
+		return err
+	}
+
+	if _, err := db.Col("settings").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys:    bson.D{{Key: "org_id", Value: 1}},
+		Options: options.Index().SetUnique(true),
+	}); err != nil {
+		return err
+	}
+
+	// Partial so the many settings docs with no ESO token set don't collide on
+	// a missing (or empty) field. Explicitly named so it does not share Mongo's
+	// default name with the legacy index dropped above, which would make every
+	// restart drop and rebuild the enforcing index.
+	_, err := db.Col("settings").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys: bson.D{{Key: "secrets.read_token_hash", Value: 1}},
+		Options: options.Index().SetUnique(true).SetName("settings_read_token_hash_unique").
+			SetPartialFilterExpression(bson.M{
+				"secrets.read_token_hash": bson.M{"$type": "string", "$gt": ""},
+			}),
+	})
+	return err
+}
+
+func GetSettings(orgID string) (*models.Settings, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	var s models.Settings
-	err := db.Col("settings").FindOne(ctx, bson.M{}).Decode(&s)
+	err := db.Col("settings").FindOne(ctx, bson.M{"org_id": orgID}).Decode(&s)
 	if err == mongo.ErrNoDocuments {
 		cp := defaultSettings
+		cp.OrgID = orgID
 		return &cp, nil
 	}
 	if err != nil {
@@ -58,7 +91,7 @@ func hashToken(token string) string {
 
 // RotateSecretsReadToken generates a new ESO read token, stores its SHA-256
 // hash, and returns the plaintext token exactly once.
-func RotateSecretsReadToken() (string, error) {
+func RotateSecretsReadToken(orgID string) (string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
@@ -69,11 +102,14 @@ func RotateSecretsReadToken() (string, error) {
 	token := hex.EncodeToString(raw)
 
 	_, err := db.Col("settings").UpdateOne(ctx,
-		bson.M{},
-		bson.M{"$set": bson.M{
-			"secrets.read_token_hash": hashToken(token),
-			"secrets.rotated_at":      time.Now(),
-		}},
+		bson.M{"org_id": orgID},
+		bson.M{
+			"$set": bson.M{
+				"secrets.read_token_hash": hashToken(token),
+				"secrets.rotated_at":      time.Now(),
+			},
+			"$setOnInsert": bson.M{"org_id": orgID},
+		},
 		options.UpdateOne().SetUpsert(true),
 	)
 	if err != nil {
@@ -82,25 +118,33 @@ func RotateSecretsReadToken() (string, error) {
 	return token, nil
 }
 
-// VerifySecretsReadToken reports whether the supplied token matches the stored
-// hash, using a constant-time comparison.
-func VerifySecretsReadToken(token string) bool {
+// ResolveSecretsReadToken looks the presented token's hash up directly and
+// returns the owning org. This is the ESO machine-to-machine path: the org is
+// carried by the token itself, since there is no session to scope it.
+func ResolveSecretsReadToken(token string) (string, bool) {
 	if token == "" {
-		return false
+		return "", false
 	}
-	s, err := GetSettings()
-	if err != nil || s.Secrets.ReadTokenHash == "" {
-		return false
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var s models.Settings
+	err := db.Col("settings").FindOne(ctx, bson.M{"secrets.read_token_hash": hashToken(token)}).Decode(&s)
+	if err != nil || s.Secrets.ReadTokenHash == "" || s.OrgID == "" {
+		return "", false
 	}
 	expected, err := hex.DecodeString(s.Secrets.ReadTokenHash)
 	if err != nil {
-		return false
+		return "", false
 	}
 	got := sha256.Sum256([]byte(token))
-	return subtle.ConstantTimeCompare(expected, got[:]) == 1
+	if subtle.ConstantTimeCompare(expected, got[:]) != 1 {
+		return "", false
+	}
+	return s.OrgID, true
 }
 
-func SaveSettings(alerts models.AlertSettings, email models.EmailSettings) error {
+func SaveSettings(orgID string, alerts models.AlertSettings, email models.EmailSettings, retentionDays *int) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
@@ -111,14 +155,31 @@ func SaveSettings(alerts models.AlertSettings, email models.EmailSettings) error
 		email.SMTPPort = 587
 	}
 
+	set := bson.M{"alerts": alerts, "email": email}
+	if retentionDays != nil {
+		set["workflow_log_retention_days"] = *retentionDays
+	}
 	_, err := db.Col("settings").UpdateOne(ctx,
-		bson.M{},
-		bson.M{"$set": bson.M{"alerts": alerts, "email": email}},
+		bson.M{"org_id": orgID},
+		bson.M{"$set": set, "$setOnInsert": bson.M{"org_id": orgID}},
 		options.UpdateOne().SetUpsert(true),
 	)
 	return err
 }
 
+// GetWorkflowLogRetentionDays returns the log retention in days: 30 when unset,
+// 0 for keep-forever, or the configured value.
+func GetWorkflowLogRetentionDays(orgID string) (int, error) {
+	s, err := GetSettings(orgID)
+	if err != nil {
+		return 30, err
+	}
+	if s.WorkflowLogRetentionDays == nil {
+		return 30, nil
+	}
+	return *s.WorkflowLogRetentionDays, nil
+}
+
 func SendOfflineWebhook(webhookURL, hostname, serverID, ipAddress string) {
 	payload := map[string]any{
 		"event":      "server.offline",

server/internal/services/stepio.go

@@ -0,0 +1,86 @@
+package services
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+const StepDocKind = "vantage.step/v1"
+
+// StepDoc is the portable, id-free representation of a step.
+type StepDoc struct {
+	Kind            string              `json:"kind"`
+	Name            string              `json:"name"`
+	Description     string              `json:"description"`
+	Interpreter     string              `json:"interpreter"`
+	Script          string              `json:"script"`
+	DeclaredOutputs []string            `json:"declared_outputs"`
+	DeclaredInputs  []models.InputParam `json:"declared_inputs"`
+	SecretRefs      []string            `json:"secret_refs"`
+}
+
+// ExportStepDoc builds a portable doc from a library step (ids/source stripped).
+func ExportStepDoc(s models.WorkflowStep) StepDoc {
+	return StepDoc{
+		Kind:            StepDocKind,
+		Name:            s.Name,
+		Description:     s.Description,
+		Interpreter:     s.Interpreter,
+		Script:          s.Script,
+		DeclaredOutputs: s.DeclaredOutputs,
+		DeclaredInputs:  s.DeclaredInputs,
+		SecretRefs:      s.SecretRefs,
+	}
+}
+
+// ParseStepDoc validates a v1 doc and returns a normalized (id-free) step with
+// declared_outputs recomputed from the script.
+func ParseStepDoc(b []byte) (models.WorkflowStep, error) {
+	var d StepDoc
+	if err := json.Unmarshal(b, &d); err != nil {
+		return models.WorkflowStep{}, fmt.Errorf("invalid step JSON: %w", err)
+	}
+	if d.Kind != StepDocKind {
+		return models.WorkflowStep{}, fmt.Errorf("unsupported kind %q (want %q)", d.Kind, StepDocKind)
+	}
+	if d.Name == "" || d.Interpreter == "" {
+		return models.WorkflowStep{}, fmt.Errorf("step name and interpreter are required")
+	}
+	if d.SecretRefs == nil {
+		d.SecretRefs = []string{}
+	}
+	if d.DeclaredInputs == nil {
+		d.DeclaredInputs = []models.InputParam{}
+	}
+	return models.WorkflowStep{
+		Name:            d.Name,
+		Description:     d.Description,
+		Interpreter:     d.Interpreter,
+		Script:          d.Script,
+		DeclaredOutputs: DeriveOutputs(d.Script),
+		DeclaredInputs:  d.DeclaredInputs,
+		SecretRefs:      d.SecretRefs,
+	}, nil
+}
+
+// ImportStepToLibrary parses a doc and persists it as a new user library step.
+func ImportStepToLibrary(orgID string, b []byte) (*models.WorkflowStep, error) {
+	s, err := ParseStepDoc(b)
+	if err != nil {
+		return nil, err
+	}
+	return CreateStep(orgID, s)
+}
+
+// ExportStep loads a library step and marshals it to a portable doc.
+func ExportStep(orgID, stepID string) ([]byte, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	s, err := getStep(ctx, orgID, stepID)
+	if err != nil {
+		return nil, err
+	}
+	return json.MarshalIndent(ExportStepDoc(*s), "", "  ")
+}

server/internal/services/steplogs.go

@@ -0,0 +1,249 @@
+package services
+
+import (
+	"bytes"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/db"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+)
+
+// WorkflowLogDir returns the base directory for workflow step logs, creating it.
+func WorkflowLogDir() string {
+	dir := os.Getenv("VANTAGE_WORKFLOW_LOG_DIR")
+	if dir == "" {
+		dir = filepath.Join("data", "workflow-logs")
+	}
+	_ = os.MkdirAll(dir, 0700)
+	return dir
+}
+
+// ServerRunLogPath is the per-server-run log file path.
+func ServerRunLogPath(runID, serverID string) string {
+	return filepath.Join(WorkflowLogDir(), runID, serverID+".log")
+}
+
+// logTS is the UTC timestamp prefix stamped on every log line. Stored in UTC
+// (RFC3339, millisecond precision); the UI renders it in the viewer's timezone.
+func logTS() string {
+	return time.Now().UTC().Format("2006-01-02T15:04:05.000") + "Z"
+}
+
+// AppendMarker writes a timestamped event line to the server-run log and returns
+// the byte offset at which the write began (used as a step's log_offset).
+func AppendMarker(runID, serverID, text string) (int64, error) {
+	path := ServerRunLogPath(runID, serverID)
+	if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
+		return 0, err
+	}
+	f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
+	if err != nil {
+		return 0, err
+	}
+	defer f.Close()
+	off, _ := f.Seek(0, 2) // current end = offset before write
+	if _, err := f.WriteString("[" + logTS() + "] " + text + "\n"); err != nil {
+		return off, err
+	}
+	return off, nil
+}
+
+// ---- streamed chunk writer, boundary-safe secret masking ----
+
+type stepLogWriter struct {
+	mu      sync.Mutex
+	f       *os.File
+	carry   []byte // bytes of an as-yet-unterminated line
+	secrets []string
+}
+
+type stepLogRegistry struct {
+	mu      sync.Mutex
+	writers map[string]*stepLogWriter
+}
+
+var StepLogs = &stepLogRegistry{writers: make(map[string]*stepLogWriter)}
+
+// Open opens (append) the server-run file for a step's streamed chunks.
+func (r *stepLogRegistry) Open(commandID, path string, secrets []string) error {
+	if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
+		return err
+	}
+	f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
+	if err != nil {
+		return err
+	}
+	w := &stepLogWriter{f: f, secrets: secrets}
+	r.mu.Lock()
+	r.writers[commandID] = w
+	r.mu.Unlock()
+	return nil
+}
+
+func (r *stepLogRegistry) get(commandID string) *stepLogWriter {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.writers[commandID]
+}
+
+// Append buffers chunks into whole lines, then writes each complete line with a
+// UTC timestamp prefix and secret masking applied. Buffering by line means a
+// secret split across a chunk boundary is always masked (the whole line is
+// assembled first) and every line carries its own timestamp.
+func (r *stepLogRegistry) Append(commandID string, data []byte) {
+	w := r.get(commandID)
+	if w == nil {
+		return
+	}
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	buf := append(w.carry, data...)
+	for {
+		i := bytes.IndexByte(buf, '\n')
+		if i < 0 {
+			break
+		}
+		w.writeLine(buf[:i])
+		buf = buf[i+1:]
+	}
+	w.carry = append([]byte{}, buf...)
+}
+
+// writeLine emits one masked, timestamped log line. Caller holds w.mu.
+func (w *stepLogWriter) writeLine(line []byte) {
+	masked := maskBytes(line, w.secrets)
+	_, _ = w.f.WriteString("[" + logTS() + "] ")
+	_, _ = w.f.Write(masked)
+	_, _ = w.f.WriteString("\n")
+}
+
+// Close flushes any trailing partial line and closes the file.
+func (r *stepLogRegistry) Close(commandID string) {
+	r.mu.Lock()
+	w := r.writers[commandID]
+	delete(r.writers, commandID)
+	r.mu.Unlock()
+	if w == nil {
+		return
+	}
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if len(w.carry) > 0 {
+		w.writeLine(w.carry)
+		w.carry = nil
+	}
+	_ = w.f.Close()
+}
+
+func maskBytes(b []byte, secrets []string) []byte {
+	s := string(b)
+	for _, v := range secrets {
+		if v == "" {
+			continue
+		}
+		s = strings.ReplaceAll(s, v, "***")
+	}
+	return []byte(s)
+}
+
+// ---- retention sweeper ----
+
+// StartLogSweeper sweeps expired run-log dirs hourly (and once now).
+func StartLogSweeper() {
+	go func() {
+		sweepLogs()
+		t := time.NewTicker(time.Hour)
+		defer t.Stop()
+		for range t.C {
+			sweepLogs()
+		}
+	}()
+}
+
+// sweepLogs walks the run-log dirs on disk. Log dirs are keyed by run ID, not
+// by org, and this runs with no session — so retention is resolved per run from
+// the owning org of that run's doc, with the per-org values cached for the
+// sweep. Runs whose doc is gone fall back to the default retention.
+func sweepLogs() {
+	base := WorkflowLogDir()
+	entries, err := os.ReadDir(base)
+	if err != nil {
+		return
+	}
+	cache := map[string]int{}
+	now := time.Now()
+
+	for _, e := range entries {
+		if !e.IsDir() {
+			continue
+		}
+		runID := e.Name()
+		dir := filepath.Join(base, runID)
+
+		orgID, finishedAt, found, err := runRetentionInfo(runID)
+		if err != nil {
+			// A transient lookup failure is not evidence the run is gone —
+			// purging at the default retention here would delete logs an org
+			// had set to keep longer, or forever.
+			log.Printf("log sweep: retention lookup failed for run %s: %v", runID, err)
+			continue
+		}
+		if found && finishedAt == nil {
+			continue // still running / never finished — keep
+		}
+
+		days, ok := cache[orgID]
+		if !ok {
+			days = defaultRetentionDays
+			if orgID != "" {
+				if v, err := GetWorkflowLogRetentionDays(orgID); err == nil {
+					days = v
+				}
+			}
+			cache[orgID] = days
+		}
+		if days <= 0 {
+			continue // keep forever
+		}
+		cutoff := now.AddDate(0, 0, -days)
+
+		if found {
+			if finishedAt.Before(cutoff) {
+				_ = os.RemoveAll(dir)
+			}
+			continue
+		}
+		// run doc gone: use dir mtime
+		if fi, e := os.Stat(dir); e == nil && fi.ModTime().Before(cutoff) {
+			_ = os.RemoveAll(dir)
+		}
+	}
+}
+
+const defaultRetentionDays = 30
+
+// runRetentionInfo returns the owning org and finish time of a run, and whether
+// the run doc still exists. A non-nil error means the lookup itself failed and
+// says nothing about whether the run doc exists.
+func runRetentionInfo(runID string) (string, *time.Time, bool, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	var run struct {
+		OrgID      string     `bson:"org_id"`
+		FinishedAt *time.Time `bson:"finished_at"`
+	}
+	err := db.Col("workflow_runs").FindOne(ctx, bson.M{"run_id": runID}).Decode(&run)
+	if err == mongo.ErrNoDocuments {
+		return "", nil, false, nil
+	}
+	if err != nil {
+		return "", nil, false, err
+	}
+	return run.OrgID, run.FinishedAt, true, nil
+}

server/internal/services/stepresults.go

@@ -0,0 +1,49 @@
+package services
+
+import (
+	"sync"
+
+	"github.com/mrhid6/vantage/server/internal/grpc/pb"
+)
+
+type stepResultRegistry struct {
+	mu      sync.Mutex
+	pending map[string]chan *pb.StepResult
+}
+
+// StepResults correlates agent StepResult replies back to the workflow runner
+// goroutine that dispatched the matching RunStepCmd, keyed by command_id.
+var StepResults = &stepResultRegistry{pending: make(map[string]chan *pb.StepResult)}
+
+// Await registers interest in a command's result BEFORE the command is
+// dispatched, and returns a buffered channel that receives the single result.
+func (r *stepResultRegistry) Await(commandID string) <-chan *pb.StepResult {
+	ch := make(chan *pb.StepResult, 1)
+	r.mu.Lock()
+	r.pending[commandID] = ch
+	r.mu.Unlock()
+	return ch
+}
+
+// Cancel removes a pending waiter (call on timeout to avoid leaks).
+func (r *stepResultRegistry) Cancel(commandID string) {
+	r.mu.Lock()
+	delete(r.pending, commandID)
+	r.mu.Unlock()
+}
+
+// Deliver routes an incoming StepResult to its waiter, if any.
+func (r *stepResultRegistry) Deliver(res *pb.StepResult) {
+	if res == nil {
+		return
+	}
+	r.mu.Lock()
+	ch, ok := r.pending[res.CommandId]
+	if ok {
+		delete(r.pending, res.CommandId)
+	}
+	r.mu.Unlock()
+	if ok {
+		ch <- res
+	}
+}

server/internal/services/stepscan.go

@@ -0,0 +1,44 @@
+package services
+
+import (
+	"regexp"
+	"strings"
+)
+
+// keyAssign matches an env-var assignment target: KEY= (captures KEY).
+var keyAssign = regexp.MustCompile(`([A-Za-z_][A-Za-z0-9_]*)=`)
+
+// DeriveOutputs scans a step script and returns the output keys it writes to
+// $WORKFLOW_ENV. Best-effort: only lines that reference WORKFLOW_ENV are
+// considered. Deduplicated, first-seen order preserved.
+func DeriveOutputs(script string) []string {
+	out := []string{}
+	seen := map[string]bool{}
+	for _, line := range strings.Split(script, "\n") {
+		if !strings.Contains(line, "WORKFLOW_ENV") {
+			continue
+		}
+		for _, m := range keyAssign.FindAllStringSubmatch(line, -1) {
+			key := m[1]
+			// Skip the sentinel itself (e.g. "WORKFLOW_ENV=..." assignments).
+			if key == "WORKFLOW_ENV" || key == "env" {
+				continue
+			}
+			if seen[key] {
+				continue
+			}
+			seen[key] = true
+			out = append(out, key)
+		}
+	}
+	return out
+}
+
+var slugStrip = regexp.MustCompile(`[^a-z0-9]+`)
+
+// Slugify converts a step name into a stable kebab-case slug.
+func Slugify(name string) string {
+	s := strings.ToLower(name)
+	s = slugStrip.ReplaceAllString(s, "-")
+	return strings.Trim(s, "-")
+}

server/internal/services/sync.go

@@ -13,7 +13,15 @@ func BuildAuthorizedKeys(serverID string) ([]string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
+	// Agent path — no session, so the org comes from the server record itself
+	// and both follow-up queries are scoped to it.
+	srv, err := getServerByID(serverID)
+	if err != nil {
+		return nil, err
+	}
+
 	cursor, err := db.Col("assignments").Find(ctx, bson.M{
+		"org_id":     srv.OrgID,
 		"server_id":  serverID,
 		"revoked_at": nil,
 	})
@@ -30,7 +38,7 @@ func BuildAuthorizedKeys(serverID string) ([]string, error) {
 	var lines []string
 	for _, a := range assignments {
 		var key models.Key
-		err := db.Col("keys").FindOne(ctx, bson.M{"key_id": a.KeyID}).Decode(&key)
+		err := db.Col("keys").FindOne(ctx, bson.M{"key_id": a.KeyID, "org_id": srv.OrgID}).Decode(&key)
 		if err != nil {
 			continue
 		}

server/internal/services/users.go

@@ -0,0 +1,183 @@
+package services
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// ErrLastOwner is returned when an operation would leave an org with no owner,
+// which would lock every remaining member out of org administration.
+var ErrLastOwner = errors.New("this is the organization's last owner — promote another member to owner first")
+
+// CountUsers counts users across the whole instance. It answers "is this a
+// brand new deployment", so it is deliberately unscoped; anything that asks
+// about a single tenant must use CountOrgUsers.
+func CountUsers() (int64, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	return db.Col("users").CountDocuments(ctx, bson.M{})
+}
+
+func CountOrgUsers(orgID string) (int64, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	return db.Col("users").CountDocuments(ctx, bson.M{"org_id": orgID})
+}
+
+// countOtherOwners counts owner-role users in the org excluding exceptUserID,
+// i.e. how many owners would remain if that user were removed or demoted.
+func countOtherOwners(orgID, exceptUserID string) (int64, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	return db.Col("users").CountDocuments(ctx, bson.M{
+		"org_id":  orgID,
+		"role":    models.RoleOwner,
+		"user_id": bson.M{"$ne": exceptUserID},
+	})
+}
+
+func GetUserInOrg(orgID, userID string) (*models.User, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var u models.User
+	err := db.Col("users").FindOne(ctx, bson.M{"user_id": userID, "org_id": orgID}).Decode(&u)
+	if err != nil {
+		return nil, err
+	}
+	return &u, nil
+}
+
+func CreateUser(orgID, email, password, role, authSource string) (*models.User, error) {
+	email = strings.ToLower(strings.TrimSpace(email))
+	if email == "" {
+		return nil, fmt.Errorf("email required")
+	}
+	if !models.ValidRole(role) {
+		return nil, fmt.Errorf("invalid role %q", role)
+	}
+	u := &models.User{
+		UserID:     uuid.NewString(),
+		OrgID:      orgID,
+		Email:      email,
+		Role:       role,
+		AuthSource: authSource,
+		CreatedAt:  time.Now(),
+	}
+	if password != "" {
+		hash, err := bcrypt.GenerateFromPassword([]byte(password), 12)
+		if err != nil {
+			return nil, err
+		}
+		u.PasswordHash = string(hash)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if _, err := db.Col("users").InsertOne(ctx, u); err != nil {
+		if mongo.IsDuplicateKeyError(err) {
+			return nil, fmt.Errorf("email already registered")
+		}
+		return nil, err
+	}
+	return u, nil
+}
+
+func GetUserByEmail(email string) (*models.User, error) {
+	email = strings.ToLower(strings.TrimSpace(email))
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var u models.User
+	err := db.Col("users").FindOne(ctx, bson.M{"email": email}).Decode(&u)
+	if err != nil {
+		return nil, err
+	}
+	return &u, nil
+}
+
+func VerifyPassword(u *models.User, password string) bool {
+	if u == nil || u.PasswordHash == "" {
+		return false
+	}
+	return bcrypt.CompareHashAndPassword([]byte(u.PasswordHash), []byte(password)) == nil
+}
+
+func TouchLastLogin(userID string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	now := time.Now()
+	_, err := db.Col("users").UpdateOne(ctx, bson.M{"user_id": userID},
+		bson.M{"$set": bson.M{"last_login": now}})
+	return err
+}
+
+func ListUsers(orgID string) ([]models.User, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	cursor, err := db.Col("users").Find(ctx, bson.M{"org_id": orgID})
+	if err != nil {
+		return nil, err
+	}
+	defer cursor.Close(ctx)
+	var users []models.User
+	if err := cursor.All(ctx, &users); err != nil {
+		return nil, err
+	}
+	return users, nil
+}
+
+func UpdateUserRole(orgID, userID, role string) error {
+	if !models.ValidRole(role) {
+		return fmt.Errorf("invalid role %q", role)
+	}
+	target, err := GetUserInOrg(orgID, userID)
+	if err != nil {
+		return fmt.Errorf("user not found")
+	}
+	// Demoting the final owner would leave nobody able to administer the org.
+	if target.Role == models.RoleOwner && role != models.RoleOwner {
+		others, err := countOtherOwners(orgID, userID)
+		if err != nil {
+			return err
+		}
+		if others == 0 {
+			return ErrLastOwner
+		}
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	_, err = db.Col("users").UpdateOne(ctx,
+		bson.M{"user_id": userID, "org_id": orgID},
+		bson.M{"$set": bson.M{"role": role}})
+	return err
+}
+
+func DeleteUser(orgID, userID string) error {
+	target, err := GetUserInOrg(orgID, userID)
+	if err != nil {
+		return fmt.Errorf("user not found")
+	}
+	if target.Role == models.RoleOwner {
+		others, err := countOtherOwners(orgID, userID)
+		if err != nil {
+			return err
+		}
+		if others == 0 {
+			return ErrLastOwner
+		}
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	_, err = db.Col("users").DeleteOne(ctx, bson.M{"user_id": userID, "org_id": orgID})
+	return err
+}

server/internal/services/validate.go

@@ -0,0 +1,19 @@
+package services
+
+import (
+	"fmt"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+// ValidateWorkflow checks each step ref sets exactly one of step_id / inline.
+func ValidateWorkflow(w models.Workflow) error {
+	for i, ref := range w.Steps {
+		hasLib := ref.StepID != ""
+		hasInline := ref.Inline != nil
+		if hasLib == hasInline {
+			return fmt.Errorf("step %d: exactly one of step_id or inline must be set", i)
+		}
+	}
+	return nil
+}

server/internal/services/workflow_runner.go

@@ -0,0 +1,526 @@
+package services
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/grpc/pb"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+const stepDispatchGrace = 15 * time.Second
+
+// TriggerWorkflow snapshots the workflow, creates a run doc, and starts a
+// background goroutine per target server (parallel fan-out). Returns run_id.
+func TriggerWorkflow(orgID, workflowID, actor string) (string, error) {
+	wf, err := GetWorkflow(orgID, workflowID)
+	if err != nil {
+		return "", err
+	}
+	if len(wf.TargetServerIDs) == 0 {
+		return "", fmt.Errorf("workflow has no target servers")
+	}
+	if len(wf.Steps) == 0 {
+		return "", fmt.Errorf("workflow has no steps")
+	}
+	// Re-check ownership at trigger time — targets may predate validation or a
+	// server may have been removed since the workflow was saved.
+	if err := validateTargetServers(orgID, wf.TargetServerIDs); err != nil {
+		return "", err
+	}
+
+	// Reject a concurrent run of the same workflow.
+	ctx, cancel := wfCtx()
+	running := db.Col("workflow_runs").FindOne(ctx, bson.M{"org_id": orgID, "workflow_id": workflowID, "status": "running"})
+	cancel()
+	if running.Err() == nil {
+		return "", fmt.Errorf("workflow already has a run in progress")
+	}
+
+	resolved, err := resolveSteps(orgID, wf)
+	if err != nil {
+		return "", err
+	}
+
+	run := models.WorkflowRun{
+		OrgID:       orgID,
+		RunID:       uuid.New().String(),
+		WorkflowID:  workflowID,
+		Name:        wf.Name,
+		Steps:       resolved,
+		Status:      "running",
+		TriggeredBy: actor,
+		StartedAt:   time.Now(),
+		ServerRuns:  make([]models.ServerRun, 0, len(wf.TargetServerIDs)),
+	}
+	for _, sid := range wf.TargetServerIDs {
+		hostname := sid
+		if s, e := getServerByID(sid); e == nil {
+			hostname = s.Hostname
+		}
+		sr := models.ServerRun{ServerID: sid, Hostname: hostname, Status: "queued", RunEnv: map[string]string{}}
+		for _, rs := range resolved {
+			sr.Steps = append(sr.Steps, models.StepRun{Order: rs.Order, Name: rs.Name, Status: "queued", OutputEnv: map[string]string{}})
+		}
+		run.ServerRuns = append(run.ServerRuns, sr)
+	}
+
+	ictx, icancel := wfCtx()
+	defer icancel()
+	if _, err := db.Col("workflow_runs").InsertOne(ictx, run); err != nil {
+		return "", err
+	}
+
+	go executeRun(run.RunID)
+	return run.RunID, nil
+}
+
+// resolveSteps freezes each workflow step ref into a ResolvedStep by loading the
+// library step and applying overrides.
+func resolveSteps(orgID string, wf *models.Workflow) ([]models.ResolvedStep, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	out := make([]models.ResolvedStep, 0, len(wf.Steps))
+	for _, ref := range wf.Steps {
+		if ref.Inline != nil {
+			out = append(out, resolveInlineStep(ref))
+			continue
+		}
+		lib, err := getStep(ctx, orgID, ref.StepID)
+		if err != nil {
+			return nil, err
+		}
+		inputs := map[string]string{}
+		for _, p := range lib.DeclaredInputs {
+			if ref.Inputs != nil {
+				if v, ok := ref.Inputs[p.Name]; ok {
+					inputs[p.Name] = v
+					continue
+				}
+			}
+			inputs[p.Name] = p.Default
+		}
+		rs := models.ResolvedStep{
+			Order:       ref.Order,
+			Name:        lib.Name,
+			Interpreter: lib.Interpreter,
+			Script:      lib.Script,
+			SecretRefs:  lib.SecretRefs,
+			OnFailure:   ref.OnFailure,
+			MaxRetries:  ref.MaxRetries,
+			Inputs:      inputs,
+		}
+		if ref.Overrides != nil {
+			if ref.Overrides.Script != nil {
+				rs.Script = *ref.Overrides.Script
+			}
+			if ref.Overrides.SecretRefs != nil {
+				rs.SecretRefs = ref.Overrides.SecretRefs
+			}
+		}
+		if rs.OnFailure == "" {
+			rs.OnFailure = "stop"
+		}
+		out = append(out, rs)
+	}
+	return out, nil
+}
+
+// resolveInlineStep freezes an ad-hoc (inline) step ref into a ResolvedStep.
+func resolveInlineStep(ref models.WorkflowStepRef) models.ResolvedStep {
+	in := ref.Inline
+	inputs := map[string]string{}
+	for _, p := range in.DeclaredInputs {
+		if ref.Inputs != nil {
+			if v, ok := ref.Inputs[p.Name]; ok {
+				inputs[p.Name] = v
+				continue
+			}
+		}
+		inputs[p.Name] = p.Default
+	}
+	onFailure := ref.OnFailure
+	if onFailure == "" {
+		onFailure = "stop"
+	}
+	return models.ResolvedStep{
+		Order:       ref.Order,
+		Name:        in.Name,
+		Interpreter: in.Interpreter,
+		Script:      in.Script,
+		SecretRefs:  in.SecretRefs,
+		OnFailure:   onFailure,
+		MaxRetries:  ref.MaxRetries,
+		Inputs:      inputs,
+	}
+}
+
+// executeRun fans out one goroutine per server run and waits for all to finish.
+func executeRun(runID string) {
+	run, err := getRunByID(runID)
+	if err != nil {
+		return
+	}
+	done := make(chan int, len(run.ServerRuns))
+	for i := range run.ServerRuns {
+		go func(idx int) {
+			runServer(run.OrgID, runID, idx, run.Steps, run.ServerRuns[idx].ServerID)
+			done <- idx
+		}(i)
+	}
+	for range run.ServerRuns {
+		<-done
+	}
+
+	// Aggregate status.
+	final, _ := getRunByID(runID)
+	status := "success"
+	for _, sr := range final.ServerRuns {
+		if sr.Status == "failed" {
+			status = "failed"
+		}
+	}
+	now := time.Now()
+	ctx, cancel := wfCtx()
+	defer cancel()
+	_, _ = db.Col("workflow_runs").UpdateOne(ctx, bson.M{"run_id": runID, "status": "running"},
+		bson.M{"$set": bson.M{"status": status, "finished_at": now}})
+}
+
+// runServer executes the resolved steps sequentially on one server, threading
+// output env forward and applying per-step failure policy.
+func runServer(orgID, runID string, srvIdx int, steps []models.ResolvedStep, serverID string) {
+	now := time.Now()
+	setServerRun(runID, srvIdx, bson.M{"server_runs.$.status": "running", "server_runs.$.started_at": now})
+
+	if !Dispatcher.IsConnected(serverID) {
+		fin := time.Now()
+		_, _ = AppendMarker(runID, serverID, "agent not connected — server skipped")
+		setServerRun(runID, srvIdx, bson.M{"server_runs.$.status": "skipped", "server_runs.$.finished_at": fin})
+		return
+	}
+
+	_, _ = AppendMarker(runID, serverID, fmt.Sprintf("run started on %s — %d step(s), workspace vantage-run-%s", serverID, len(steps), runID))
+
+	runEnv := map[string]string{}
+	allSecrets := map[string]string{}
+	serverFailed := false
+
+	for i, step := range steps {
+		startStep(runID, serverID, i, "running")
+		stepStart := time.Now()
+		var res *pb.StepResult
+		attempts := 0
+		maxAttempts := 1
+		if step.OnFailure == "retry" {
+			maxAttempts = step.MaxRetries + 1
+		}
+
+		// Merge secrets into command env (kept out of persisted logs).
+		secretVals := resolveSecrets(orgID, step.SecretRefs)
+		for k, v := range secretVals {
+			allSecrets[k] = v
+		}
+		// Input values may template earlier step outputs and secrets, e.g.
+		// URL="http://example.com/$VersionNumber". Expand against runEnv (outputs
+		// threaded from prior steps) and this step's secrets before dispatch.
+		subst := map[string]string{}
+		for k, v := range runEnv {
+			subst[k] = v
+		}
+		for k, v := range secretVals {
+			subst[k] = v
+		}
+		cmdEnv := map[string]string{}
+		for k, v := range step.Inputs {
+			cmdEnv[k] = expandVars(v, subst)
+		}
+		for k, v := range runEnv {
+			cmdEnv[k] = v
+		}
+		for k, v := range secretVals {
+			cmdEnv[k] = v
+		}
+
+		// Write the step marker to the server-run log and remember the offset so
+		// the UI can slice this step's output later.
+		marker := fmt.Sprintf("===== step %d/%d: %s (%s) =====", step.Order+1, len(steps), step.Name, step.Interpreter)
+		offset, _ := AppendMarker(runID, serverID, marker)
+		logPath := ServerRunLogPath(runID, serverID)
+		secretsSlice := secretValues(secretVals)
+
+		commandID := uuid.New().String()
+		for attempts < maxAttempts {
+			attempts++
+			if attempts > 1 {
+				_, _ = AppendMarker(runID, serverID, fmt.Sprintf("retry %d/%d after failure", attempts-1, maxAttempts-1))
+			}
+			// Open a fresh writer per attempt; the agent's eof closes it, and the
+			// defensive Close below covers a missing result.
+			_ = StepLogs.Open(commandID, logPath, secretsSlice)
+			res = dispatchAndWait(serverID, commandID, &pb.RunStepCmd{
+				Interpreter:    step.Interpreter,
+				Script:         step.Script,
+				Env:            cmdEnv,
+				TimeoutSeconds: 0,
+				WorkspaceId:    runID,
+			})
+			StepLogs.Close(commandID) // idempotent; no-op if eof already closed it
+			if res != nil && res.ExitCode == 0 {
+				break
+			}
+		}
+
+		exit := 1
+		outEnv := map[string]string{} // masked copy, safe to persist
+		if res != nil {
+			exit = res.ExitCode
+			for k, v := range res.OutputEnv {
+				runEnv[k] = v // real, unmasked value threads forward to later steps
+				outEnv[k] = maskSecrets(v, allSecrets)
+			}
+		} else {
+			_, _ = AppendMarker(runID, serverID, "agent did not return a result")
+		}
+
+		status := "success"
+		if exit != 0 {
+			status = "failed"
+		}
+		finishStep(runID, serverID, i, status, attempts, exit, offset, outEnv)
+
+		dur := time.Since(stepStart).Round(time.Millisecond)
+		_, _ = AppendMarker(runID, serverID, fmt.Sprintf("step %d/%d %s — exit %d, %d attempt(s), %s",
+			step.Order+1, len(steps), status, exit, attempts, dur))
+
+		if exit != 0 {
+			switch step.OnFailure {
+			case "continue":
+				_, _ = AppendMarker(runID, serverID, "on_failure=continue — proceeding to next step")
+			default: // "stop" or exhausted "retry"
+				serverFailed = true
+			}
+			if serverFailed {
+				_, _ = AppendMarker(runID, serverID, "stopping run — remaining steps skipped")
+				markRemainingSkipped(runID, serverID, i+1)
+				break
+			}
+		}
+	}
+
+	// Tell the agent to remove the run's working directory now that its steps are
+	// done (success or failure). Best-effort; the OS reclaims temp dirs anyway.
+	DispatchCleanupWorkspace(serverID, runID)
+
+	fin := time.Now()
+	status := "success"
+	if serverFailed {
+		status = "failed"
+	}
+	_, _ = AppendMarker(runID, serverID, fmt.Sprintf("run %s in %s — workspace removed",
+		status, fin.Sub(now).Round(time.Millisecond)))
+	// Persist only a masked copy of runEnv; the real (unmasked) runEnv was already
+	// used above to build cmdEnv for each step and must never be written to the DB.
+	maskedRunEnv := make(map[string]string, len(runEnv))
+	for k, v := range runEnv {
+		maskedRunEnv[k] = maskSecrets(v, allSecrets)
+	}
+	setServerRun(runID, srvIdx, bson.M{
+		"server_runs.$.status":      status,
+		"server_runs.$.finished_at": fin,
+		"server_runs.$.run_env":     maskedRunEnv,
+	})
+}
+
+// dispatchAndWait registers a waiter, dispatches the step, and blocks for the
+// result or a timeout.
+func dispatchAndWait(serverID, commandID string, cmd *pb.RunStepCmd) *pb.StepResult {
+	ch := StepResults.Await(commandID)
+	if err := DispatchRunStep(serverID, commandID, cmd); err != nil {
+		StepResults.Cancel(commandID)
+		return &pb.StepResult{ExitCode: 1, Stderr: "[vantage] dispatch failed: " + err.Error()}
+	}
+	wait := time.Duration(cmd.TimeoutSeconds)*time.Second + stepDispatchGrace
+	if cmd.TimeoutSeconds == 0 {
+		wait = 30*time.Minute + stepDispatchGrace
+	}
+	select {
+	case res := <-ch:
+		return res
+	case <-time.After(wait):
+		StepResults.Cancel(commandID)
+		return &pb.StepResult{ExitCode: 124, Stderr: "[vantage] timed out waiting for agent result"}
+	}
+}
+
+// expandVars substitutes $VAR and ${VAR} references in an input value from the
+// given lookup (prior step outputs and secrets). Unknown references expand to
+// empty, matching shell behaviour; a literal "$" is written as "$$".
+func expandVars(v string, lookup map[string]string) string {
+	return os.Expand(v, func(name string) string {
+		if name == "$" {
+			return "$"
+		}
+		return lookup[name]
+	})
+}
+
+func resolveSecrets(orgID string, refs []string) map[string]string {
+	out := map[string]string{}
+	for _, ref := range refs {
+		// ref format "group/KEY"; resolve via RevealSecret.
+		parts := strings.SplitN(ref, "/", 2)
+		if len(parts) != 2 {
+			continue
+		}
+		if v, err := RevealSecret(orgID, parts[0], parts[1]); err == nil {
+			out[parts[1]] = v
+		}
+	}
+	return out
+}
+
+func maskSecrets(s string, secrets map[string]string) string {
+	for _, v := range secrets {
+		if v == "" {
+			continue
+		}
+		s = strings.ReplaceAll(s, v, "***")
+	}
+	return s
+}
+
+// ---- run doc mutation helpers ----
+
+func setServerRun(runID string, srvIdx int, set bson.M) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	_, _ = db.Col("workflow_runs").UpdateOne(ctx,
+		bson.M{"run_id": runID, "server_runs.server_id": serverIDAt(runID, srvIdx)},
+		bson.M{"$set": set})
+}
+
+// serverIDAt returns the server_id at an index (positional operator needs a match).
+func serverIDAt(runID string, srvIdx int) string {
+	r, err := getRunByID(runID)
+	if err != nil || srvIdx >= len(r.ServerRuns) {
+		return ""
+	}
+	return r.ServerRuns[srvIdx].ServerID
+}
+
+func startStep(runID, serverID string, order int, status string) {
+	now := time.Now()
+	updateStep(runID, serverID, order, bson.M{
+		"server_runs.$[s].steps.$[t].status":     status,
+		"server_runs.$[s].steps.$[t].started_at": now,
+	})
+}
+
+func finishStep(runID, serverID string, order int, status string, attempts, exit int, logOffset int64, outEnv map[string]string) {
+	now := time.Now()
+	updateStep(runID, serverID, order, bson.M{
+		"server_runs.$[s].steps.$[t].status":      status,
+		"server_runs.$[s].steps.$[t].attempts":    attempts,
+		"server_runs.$[s].steps.$[t].exit_code":   exit,
+		"server_runs.$[s].steps.$[t].log_offset":  logOffset,
+		"server_runs.$[s].steps.$[t].output_env":  outEnv,
+		"server_runs.$[s].steps.$[t].finished_at": now,
+	})
+}
+
+// secretValues returns just the values of a secret map, for masking log output.
+func secretValues(m map[string]string) []string {
+	out := make([]string, 0, len(m))
+	for _, v := range m {
+		out = append(out, v)
+	}
+	return out
+}
+
+func markRemainingSkipped(runID, serverID string, fromOrder int) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	_, _ = db.Col("workflow_runs").UpdateMany(ctx,
+		bson.M{"run_id": runID},
+		bson.M{"$set": bson.M{"server_runs.$[s].steps.$[t].status": "skipped"}},
+		options.UpdateMany().SetArrayFilters([]interface{}{
+			bson.M{"s.server_id": serverID},
+			bson.M{"t.order": bson.M{"$gte": fromOrder}, "t.status": "queued"},
+		}),
+	)
+}
+
+func updateStep(runID, serverID string, order int, set bson.M) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	_, _ = db.Col("workflow_runs").UpdateOne(ctx,
+		bson.M{"run_id": runID},
+		bson.M{"$set": set},
+		options.UpdateOne().SetArrayFilters([]interface{}{
+			bson.M{"s.server_id": serverID},
+			bson.M{"t.order": order},
+		}),
+	)
+}
+
+// ---- reads ----
+
+// getRunByID looks up a run by its unique run_id with no org filter. For
+// agent/internal run-execution use only (executeRun/runServer, etc.), which
+// don't have a session and instead resolve org from the run doc itself.
+func getRunByID(runID string) (*models.WorkflowRun, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	var r models.WorkflowRun
+	err := db.Col("workflow_runs").FindOne(ctx, bson.M{"run_id": runID}).Decode(&r)
+	if err == mongo.ErrNoDocuments {
+		return nil, fmt.Errorf("run not found")
+	}
+	return &r, err
+}
+
+// GetRun looks up a run scoped to an org (handler/session use).
+func GetRun(orgID, runID string) (*models.WorkflowRun, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	var r models.WorkflowRun
+	err := db.Col("workflow_runs").FindOne(ctx, bson.M{"run_id": runID, "org_id": orgID}).Decode(&r)
+	if err == mongo.ErrNoDocuments {
+		return nil, fmt.Errorf("run not found")
+	}
+	return &r, err
+}
+
+func ListRuns(orgID, workflowID string, limit int64) ([]models.WorkflowRun, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	cur, err := db.Col("workflow_runs").Find(ctx, bson.M{"org_id": orgID, "workflow_id": workflowID},
+		options.Find().SetSort(bson.D{{Key: "started_at", Value: -1}}).SetLimit(limit))
+	if err != nil {
+		return nil, err
+	}
+	defer cur.Close(ctx)
+	runs := []models.WorkflowRun{}
+	if err := cur.All(ctx, &runs); err != nil {
+		return nil, err
+	}
+	return runs, nil
+}
+
+func CancelRun(orgID, runID string) error {
+	now := time.Now()
+	ctx, cancel := wfCtx()
+	defer cancel()
+	_, err := db.Col("workflow_runs").UpdateOne(ctx,
+		bson.M{"org_id": orgID, "run_id": runID, "status": "running"},
+		bson.M{"$set": bson.M{"status": "cancelled", "finished_at": now}})
+	return err
+}

server/internal/services/workflows.go

@@ -0,0 +1,296 @@
+package services
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+func wfCtx() (context.Context, context.CancelFunc) {
+	return context.WithTimeout(context.Background(), 10*time.Second)
+}
+
+func EnsureWorkflowIndexes() error {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	if _, err := db.Col("workflow_steps").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys: bson.D{{Key: "step_id", Value: 1}}, Options: options.Index().SetUnique(true),
+	}); err != nil {
+		return err
+	}
+	// The pre-multi-tenant index was on slug alone, so seeding defaults for a
+	// second org collided — drop it if a live DB still carries it.
+	if err := db.Col("workflow_steps").Indexes().DropOne(ctx, "slug_1"); err != nil && !isIndexNotFound(err) {
+		return err
+	}
+	if _, err := db.Col("workflow_steps").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys: bson.D{{Key: "org_id", Value: 1}, {Key: "slug", Value: 1}},
+		Options: options.Index().SetUnique(true).
+			SetPartialFilterExpression(bson.M{"source": "default"}),
+	}); err != nil {
+		return err
+	}
+	if _, err := db.Col("workflows").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys: bson.D{{Key: "workflow_id", Value: 1}}, Options: options.Index().SetUnique(true),
+	}); err != nil {
+		return err
+	}
+	_, err := db.Col("workflow_runs").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys: bson.D{{Key: "run_id", Value: 1}}, Options: options.Index().SetUnique(true),
+	})
+	return err
+}
+
+// ---- Steps ----
+
+func ListSteps(orgID string) ([]models.WorkflowStep, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	cur, err := db.Col("workflow_steps").Find(ctx, bson.M{"org_id": orgID},
+		options.Find().SetSort(bson.D{{Key: "name", Value: 1}}))
+	if err != nil {
+		return nil, err
+	}
+	defer cur.Close(ctx)
+	steps := []models.WorkflowStep{}
+	if err := cur.All(ctx, &steps); err != nil {
+		return nil, err
+	}
+	return steps, nil
+}
+
+// StepUsageCounts returns, per library step_id, the number of distinct
+// workflows that reference it. Inline steps have no step_id and are ignored.
+func StepUsageCounts(orgID string) (map[string]int, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	cur, err := db.Col("workflows").Find(ctx, bson.M{"org_id": orgID})
+	if err != nil {
+		return nil, err
+	}
+	defer cur.Close(ctx)
+	var wfs []models.Workflow
+	if err := cur.All(ctx, &wfs); err != nil {
+		return nil, err
+	}
+	counts := map[string]int{}
+	for _, w := range wfs {
+		seen := map[string]bool{}
+		for _, ref := range w.Steps {
+			if ref.StepID == "" || seen[ref.StepID] {
+				continue
+			}
+			seen[ref.StepID] = true
+			counts[ref.StepID]++
+		}
+	}
+	return counts, nil
+}
+
+func CreateStep(orgID string, s models.WorkflowStep) (*models.WorkflowStep, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	s.OrgID = orgID
+	s.StepID = uuid.New().String()
+	s.CreatedAt = time.Now()
+	s.UpdatedAt = s.CreatedAt
+	s.DeclaredOutputs = DeriveOutputs(s.Script)
+	if s.Source == "" {
+		s.Source = "user"
+	}
+	if s.SecretRefs == nil {
+		s.SecretRefs = []string{}
+	}
+	if s.DeclaredInputs == nil {
+		s.DeclaredInputs = []models.InputParam{}
+	}
+	if _, err := db.Col("workflow_steps").InsertOne(ctx, s); err != nil {
+		return nil, err
+	}
+	return &s, nil
+}
+
+func UpdateStep(orgID, stepID string, s models.WorkflowStep) error {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	_, err := db.Col("workflow_steps").UpdateOne(ctx, bson.M{"step_id": stepID, "org_id": orgID}, bson.M{"$set": bson.M{
+		"name":             s.Name,
+		"description":      s.Description,
+		"interpreter":      s.Interpreter,
+		"script":           s.Script,
+		"declared_outputs": DeriveOutputs(s.Script),
+		"declared_inputs":  s.DeclaredInputs,
+		"secret_refs":      s.SecretRefs,
+		"updated_at":       time.Now(),
+	}})
+	return err
+}
+
+func DeleteStep(orgID, stepID string) error {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	if _, err := db.Col("workflow_steps").DeleteOne(ctx, bson.M{"step_id": stepID, "org_id": orgID}); err != nil {
+		return err
+	}
+	// Cascade: remove this step from every workflow that references it, re-sequencing orders.
+	cur, err := db.Col("workflows").Find(ctx, bson.M{"steps.step_id": stepID, "org_id": orgID})
+	if err != nil {
+		return err
+	}
+	defer cur.Close(ctx)
+	var wfs []models.Workflow
+	if err := cur.All(ctx, &wfs); err != nil {
+		return err
+	}
+	for _, w := range wfs {
+		kept := make([]models.WorkflowStepRef, 0, len(w.Steps))
+		for _, ref := range w.Steps {
+			if ref.StepID == stepID {
+				continue
+			}
+			kept = append(kept, ref)
+		}
+		for i := range kept {
+			kept[i].Order = i
+		}
+		if _, err := db.Col("workflows").UpdateOne(ctx,
+			bson.M{"workflow_id": w.WorkflowID},
+			bson.M{"$set": bson.M{"steps": kept, "updated_at": time.Now()}},
+		); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func getStep(ctx context.Context, orgID, stepID string) (*models.WorkflowStep, error) {
+	var s models.WorkflowStep
+	err := db.Col("workflow_steps").FindOne(ctx, bson.M{"step_id": stepID, "org_id": orgID}).Decode(&s)
+	if err == mongo.ErrNoDocuments {
+		return nil, fmt.Errorf("step %s not found", stepID)
+	}
+	return &s, err
+}
+
+// ---- Workflows ----
+
+func ListWorkflows(orgID string) ([]models.Workflow, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	cur, err := db.Col("workflows").Find(ctx, bson.M{"org_id": orgID},
+		options.Find().SetSort(bson.D{{Key: "name", Value: 1}}))
+	if err != nil {
+		return nil, err
+	}
+	defer cur.Close(ctx)
+	wfs := []models.Workflow{}
+	if err := cur.All(ctx, &wfs); err != nil {
+		return nil, err
+	}
+	return wfs, nil
+}
+
+func GetWorkflow(orgID, id string) (*models.Workflow, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	var w models.Workflow
+	err := db.Col("workflows").FindOne(ctx, bson.M{"workflow_id": id, "org_id": orgID}).Decode(&w)
+	if err == mongo.ErrNoDocuments {
+		return nil, fmt.Errorf("workflow not found")
+	}
+	return &w, err
+}
+
+func CreateWorkflow(orgID string, w models.Workflow) (*models.Workflow, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	w.OrgID = orgID
+	w.WorkflowID = uuid.New().String()
+	w.CreatedAt = time.Now()
+	w.UpdatedAt = w.CreatedAt
+	if w.TargetServerIDs == nil {
+		w.TargetServerIDs = []string{}
+	}
+	if w.Steps == nil {
+		w.Steps = []models.WorkflowStepRef{}
+	}
+	if err := ValidateWorkflow(w); err != nil {
+		return nil, err
+	}
+	if err := validateTargetServers(orgID, w.TargetServerIDs); err != nil {
+		return nil, err
+	}
+	normalizeInlineSteps(&w)
+	if _, err := db.Col("workflows").InsertOne(ctx, w); err != nil {
+		return nil, err
+	}
+	return &w, nil
+}
+
+func UpdateWorkflow(orgID, id string, w models.Workflow) error {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	if err := ValidateWorkflow(w); err != nil {
+		return err
+	}
+	if err := validateTargetServers(orgID, w.TargetServerIDs); err != nil {
+		return err
+	}
+	normalizeInlineSteps(&w)
+	_, err := db.Col("workflows").UpdateOne(ctx, bson.M{"workflow_id": id, "org_id": orgID}, bson.M{"$set": bson.M{
+		"name":              w.Name,
+		"target_server_ids": w.TargetServerIDs,
+		"steps":             w.Steps,
+		"updated_at":        time.Now(),
+	}})
+	return err
+}
+
+// validateTargetServers rejects any target server that does not belong to the
+// org. The IDs are client-supplied and are later consumed by the runner's
+// unscoped lookups, so ownership has to be proven at the write boundary.
+func validateTargetServers(orgID string, serverIDs []string) error {
+	for _, sid := range serverIDs {
+		if _, err := GetServer(orgID, sid); err != nil {
+			return fmt.Errorf("target server %s not found", sid)
+		}
+	}
+	return nil
+}
+
+// normalizeInlineSteps derives outputs for inline steps and strips fields that
+// only belong to library steps.
+func normalizeInlineSteps(w *models.Workflow) {
+	for i := range w.Steps {
+		in := w.Steps[i].Inline
+		if in == nil {
+			continue
+		}
+		in.DeclaredOutputs = DeriveOutputs(in.Script)
+		in.StepID = ""
+		in.Slug = ""
+		in.Source = ""
+		in.CreatedAt = time.Time{}
+		in.UpdatedAt = time.Time{}
+		if in.SecretRefs == nil {
+			in.SecretRefs = []string{}
+		}
+		if in.DeclaredInputs == nil {
+			in.DeclaredInputs = []models.InputParam{}
+		}
+	}
+}
+
+func DeleteWorkflow(orgID, id string) error {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	_, err := db.Col("workflows").DeleteOne(ctx, bson.M{"workflow_id": id, "org_id": orgID})
+	return err
+}

web/app/(app)/layout.tsx

@@ -0,0 +1,17 @@
+import { AuthProvider } from "@/components/AuthProvider";
+import { Sidebar } from "@/components/Sidebar";
+
+export default function AppLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  return (
+    <AuthProvider>
+      <div className="flex h-screen overflow-hidden">
+        <Sidebar />
+        <main className="flex-1 overflow-y-auto">{children}</main>
+      </div>
+    </AuthProvider>
+  );
+}

web/app/(app)/monitors/[id]/edit/page.tsx

@@ -0,0 +1,58 @@
+"use client";
+
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import { useParams, useRouter } from "next/navigation";
+import Link from "next/link";
+import { api, MonitorInput } from "@/lib/api";
+import { Card } from "@/components/ui";
+import { MonitorForm } from "@/components/monitors/MonitorForm";
+
+export default function EditMonitorPage() {
+  const params = useParams();
+  const router = useRouter();
+  const queryClient = useQueryClient();
+  const monitorId = params.id as string;
+
+  const { data: monitor, isLoading } = useQuery({
+    queryKey: ["monitors", monitorId],
+    queryFn: () => api.getMonitor(monitorId),
+  });
+
+  const { mutate: update, isPending, error } = useMutation({
+    mutationFn: (input: MonitorInput) => api.updateMonitor(monitorId, input),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["monitors"] });
+      queryClient.invalidateQueries({ queryKey: ["monitors", monitorId] });
+      router.push(`/monitors/${monitorId}`);
+    },
+  });
+
+  if (isLoading) {
+    return (
+      <div className="flex h-full items-center justify-center">
+        <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+      </div>
+    );
+  }
+
+  if (!monitor) {
+    return (
+      <div className="p-8">
+        <div className="rounded-lg border border-danger/30 bg-danger/10 p-4 text-danger">Monitor not found.</div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="p-8">
+      <Link href={`/monitors/${monitorId}`} className="text-sm text-text-secondary hover:text-text-primary">
+        ← {monitor.name}
+      </Link>
+      <h1 className="mb-6 mt-2 text-2xl font-bold text-text-primary">Edit Monitor</h1>
+
+      <Card className="max-w-2xl">
+        <MonitorForm initial={monitor} submitLabel="Save Changes" onSubmit={update} isPending={isPending} error={error as Error | null} />
+      </Card>
+    </div>
+  );
+}

web/app/(app)/monitors/[id]/page.tsx

@@ -0,0 +1,239 @@
+"use client";
+
+import { useState } from "react";
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import { useParams, useRouter } from "next/navigation";
+import Link from "next/link";
+import { api, Monitor, MonitorStatus, Rollup } from "@/lib/api";
+import { Badge, Button, Card, CardHeader, CardTitle, Table, Thead, Tbody, Tr, Th, Td } from "@/components/ui";
+
+function statusVariant(status: MonitorStatus) {
+  switch (status) {
+    case "up":
+      return "success";
+    case "down":
+      return "danger";
+    default:
+      return "warning";
+  }
+}
+
+function uptimePct(rollups: Rollup[]): number {
+  const checks = rollups.reduce((a, r) => a + r.checks, 0);
+  const up = rollups.reduce((a, r) => a + r.up_count, 0);
+  return checks > 0 ? (up / checks) * 100 : 0;
+}
+
+function Heartbeat({ rollups }: { rollups: Rollup[] }) {
+  const recent = rollups.slice(-48);
+  return (
+    <div className="flex items-end gap-0.5">
+      {recent.map((r) => {
+        const pct = r.checks > 0 ? (r.up_count / r.checks) * 100 : 0;
+        const color = r.checks === 0 ? "bg-surface-2" : pct >= 99 ? "bg-success" : pct >= 80 ? "bg-warning" : "bg-danger";
+        return (
+          <div
+            key={r.period_start}
+            className={`h-8 w-1.5 rounded-sm ${color}`}
+            title={`${new Date(r.period_start).toLocaleString()} — ${pct.toFixed(0)}% up`}
+          />
+        );
+      })}
+      {recent.length === 0 && <span className="text-xs text-text-secondary">No history yet.</span>}
+    </div>
+  );
+}
+
+export default function MonitorDetailPage() {
+  const params = useParams();
+  const router = useRouter();
+  const queryClient = useQueryClient();
+  const monitorId = params.id as string;
+  const [confirmDelete, setConfirmDelete] = useState(false);
+
+  const { data: monitor, isLoading } = useQuery({
+    queryKey: ["monitors", monitorId],
+    queryFn: () => api.getMonitor(monitorId),
+    refetchInterval: 30_000,
+  });
+
+  const { data: rollups } = useQuery({
+    queryKey: ["monitors", monitorId, "uptime"],
+    queryFn: () => api.getMonitorUptime(monitorId),
+    refetchInterval: 60_000,
+  });
+
+  const { data: incidents } = useQuery({
+    queryKey: ["monitors", monitorId, "incidents"],
+    queryFn: () => api.getMonitorIncidents(monitorId),
+    refetchInterval: 60_000,
+  });
+
+  const { mutate: deleteMonitor, isPending: isDeleting } = useMutation({
+    mutationFn: () => api.deleteMonitor(monitorId),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["monitors"] });
+      router.push("/monitors");
+    },
+  });
+
+  const { mutate: toggleEnabled } = useMutation({
+    mutationFn: (enabled: boolean) => api.updateMonitor(monitorId, { enabled }),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: ["monitors", monitorId] }),
+  });
+
+  if (isLoading) {
+    return (
+      <div className="flex h-full items-center justify-center">
+        <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+      </div>
+    );
+  }
+
+  if (!monitor) {
+    return (
+      <div className="p-8">
+        <div className="rounded-lg border border-danger/30 bg-danger/10 p-4 text-danger">Monitor not found.</div>
+      </div>
+    );
+  }
+
+  const all = rollups ?? [];
+  const last24 = all.slice(-24);
+
+  return (
+    <div className="p-8">
+      <div className="mb-6 flex items-start justify-between">
+        <div>
+          <Link href="/monitors" className="text-sm text-text-secondary hover:text-text-primary">
+            ← Monitors
+          </Link>
+          <div className="mt-2 flex items-center gap-3">
+            <h1 className="text-2xl font-bold text-text-primary">{monitor.name}</h1>
+            <Badge variant={statusVariant(monitor.state.status)}>{monitor.state.status}</Badge>
+            <Badge variant="neutral">{monitor.type}</Badge>
+            {!monitor.enabled && <Badge variant="warning">disabled</Badge>}
+          </div>
+          {monitor.state.message && <p className="mt-1 text-sm text-text-secondary">{monitor.state.message}</p>}
+        </div>
+        <div className="flex gap-2">
+          <Link href={`/monitors/${monitorId}/edit`}>
+            <Button variant="secondary">Edit</Button>
+          </Link>
+          <Button variant="secondary" onClick={() => toggleEnabled(!monitor.enabled)}>
+            {monitor.enabled ? "Disable" : "Enable"}
+          </Button>
+          {!confirmDelete ? (
+            <Button variant="danger" onClick={() => setConfirmDelete(true)}>
+              Delete
+            </Button>
+          ) : (
+            <div className="flex items-center gap-2">
+              <span className="text-sm text-danger">Are you sure?</span>
+              <Button variant="danger" loading={isDeleting} onClick={() => deleteMonitor()}>
+                Confirm
+              </Button>
+              <Button variant="ghost" onClick={() => setConfirmDelete(false)}>
+                Cancel
+              </Button>
+            </div>
+          )}
+        </div>
+      </div>
+
+      <div className="mb-6 grid grid-cols-2 gap-4 sm:grid-cols-4">
+        <Card>
+          <p className="text-xs text-text-secondary">Uptime (24h)</p>
+          <p className="mt-1 text-2xl font-bold text-text-primary">{uptimePct(last24).toFixed(1)}%</p>
+        </Card>
+        <Card>
+          <p className="text-xs text-text-secondary">Uptime (30d)</p>
+          <p className="mt-1 text-2xl font-bold text-text-primary">{uptimePct(all).toFixed(1)}%</p>
+        </Card>
+        <Card>
+          <p className="text-xs text-text-secondary">Latency</p>
+          <p className="mt-1 text-2xl font-bold text-text-primary">{monitor.state.latency_ms}ms</p>
+        </Card>
+        <Card>
+          <p className="text-xs text-text-secondary">Cert expiry</p>
+          <p className="mt-1 text-sm font-medium text-text-primary">
+            {monitor.state.cert_expiry_at ? new Date(monitor.state.cert_expiry_at).toLocaleDateString() : "—"}
+          </p>
+        </Card>
+      </div>
+
+      <Card className="mb-6">
+        <CardHeader>
+          <CardTitle>Heartbeat (last 48h)</CardTitle>
+        </CardHeader>
+        <Heartbeat rollups={all} />
+      </Card>
+
+      <div className="grid grid-cols-1 gap-6 lg:grid-cols-2">
+        <Card padding={false}>
+          <div className="border-b border-border px-6 py-4">
+            <h2 className="text-lg font-semibold text-text-primary">Incidents</h2>
+          </div>
+          {!incidents || incidents.length === 0 ? (
+            <div className="py-12 text-center text-sm text-text-secondary">No incidents recorded.</div>
+          ) : (
+            <Table>
+              <Thead>
+                <Tr>
+                  <Th>Started</Th>
+                  <Th>Resolved</Th>
+                  <Th>Cause</Th>
+                </Tr>
+              </Thead>
+              <Tbody>
+                {incidents.map((inc) => (
+                  <Tr key={inc.incident_id}>
+                    <Td>
+                      <span className="text-xs text-text-secondary">{new Date(inc.started_at).toLocaleString()}</span>
+                    </Td>
+                    <Td>
+                      {inc.resolved_at ? (
+                        <span className="text-xs text-text-secondary">{new Date(inc.resolved_at).toLocaleString()}</span>
+                      ) : (
+                        <Badge variant="danger">ongoing</Badge>
+                      )}
+                    </Td>
+                    <Td>
+                      <span className="text-xs text-text-primary">{inc.cause || "—"}</span>
+                    </Td>
+                  </Tr>
+                ))}
+              </Tbody>
+            </Table>
+          )}
+        </Card>
+
+        <Card>
+          <CardHeader>
+            <CardTitle>Configuration</CardTitle>
+          </CardHeader>
+          <dl className="space-y-3 text-sm">
+            <div>
+              <dt className="text-text-secondary">Runner</dt>
+              <dd className="mt-0.5 font-mono text-text-primary">{monitor.runner}</dd>
+            </div>
+            <div className="border-t border-border pt-3">
+              <dt className="text-text-secondary">Interval</dt>
+              <dd className="mt-0.5 text-text-primary">{monitor.interval_sec}s</dd>
+            </div>
+            <div className="border-t border-border pt-3">
+              <dt className="text-text-secondary">Retries before down</dt>
+              <dd className="mt-0.5 text-text-primary">{monitor.retries}</dd>
+            </div>
+            <div className="border-t border-border pt-3">
+              <dt className="text-text-secondary">Target</dt>
+              <dd className="mt-0.5 font-mono text-xs text-text-primary break-all">
+                {monitor.target.url || `${monitor.target.host ?? ""}${monitor.target.port ? `:${monitor.target.port}` : ""}`}
+              </dd>
+            </div>
+          </dl>
+        </Card>
+      </div>
+    </div>
+  );
+}

web/app/(app)/monitors/new/page.tsx

@@ -0,0 +1,34 @@
+"use client";
+
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { useRouter } from "next/navigation";
+import Link from "next/link";
+import { api, MonitorInput } from "@/lib/api";
+import { Card } from "@/components/ui";
+import { MonitorForm } from "@/components/monitors/MonitorForm";
+
+export default function NewMonitorPage() {
+  const router = useRouter();
+  const queryClient = useQueryClient();
+
+  const { mutate: create, isPending, error } = useMutation({
+    mutationFn: (input: MonitorInput) => api.createMonitor(input),
+    onSuccess: (m) => {
+      queryClient.invalidateQueries({ queryKey: ["monitors"] });
+      router.push(`/monitors/${m.monitor_id}`);
+    },
+  });
+
+  return (
+    <div className="p-8">
+      <Link href="/monitors" className="text-sm text-text-secondary hover:text-text-primary">
+        ← Monitors
+      </Link>
+      <h1 className="mb-6 mt-2 text-2xl font-bold text-text-primary">New Monitor</h1>
+
+      <Card className="max-w-2xl">
+        <MonitorForm submitLabel="Create Monitor" onSubmit={create} isPending={isPending} error={error as Error | null} />
+      </Card>
+    </div>
+  );
+}

web/app/(app)/monitors/page.tsx

@@ -0,0 +1,109 @@
+"use client";
+
+import { useQuery } from "@tanstack/react-query";
+import Link from "next/link";
+import { api, Monitor, MonitorStatus } from "@/lib/api";
+import { Badge, Button, Card, Table, Thead, Tbody, Tr, Th, Td } from "@/components/ui";
+
+function statusVariant(status: MonitorStatus) {
+  switch (status) {
+    case "up":
+      return "success";
+    case "down":
+      return "danger";
+    default:
+      return "warning";
+  }
+}
+
+function targetSummary(m: Monitor): string {
+  if (m.type === "http") return m.target.url ?? "";
+  if (m.type === "tls") return `${m.target.host ?? ""}:${m.target.port || 443}`;
+  if (m.type === "icmp") return m.target.host ?? "";
+  return `${m.target.host ?? ""}:${m.target.port ?? ""}`;
+}
+
+export default function MonitorsPage() {
+  const { data: monitors, isLoading } = useQuery({
+    queryKey: ["monitors"],
+    queryFn: () => api.listMonitors(),
+    refetchInterval: 30_000,
+  });
+
+  return (
+    <div className="p-8">
+      <div className="mb-6 flex items-center justify-between">
+        <div>
+          <h1 className="text-2xl font-bold text-text-primary">Monitors</h1>
+          <p className="mt-1 text-sm text-text-secondary">Service uptime and latency checks.</p>
+        </div>
+        <div className="flex gap-2">
+          <Link href="/settings/notifications">
+            <Button variant="secondary">Notifications</Button>
+          </Link>
+          <Link href="/monitors/new">
+            <Button variant="primary">New Monitor</Button>
+          </Link>
+        </div>
+      </div>
+
+      <Card padding={false}>
+        {isLoading ? (
+          <div className="flex justify-center py-16">
+            <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+          </div>
+        ) : !monitors || monitors.length === 0 ? (
+          <div className="py-16 text-center">
+            <p className="text-sm text-text-secondary">No monitors yet.</p>
+            <Link href="/monitors/new">
+              <Button variant="secondary" size="sm" className="mt-3">
+                Create your first monitor
+              </Button>
+            </Link>
+          </div>
+        ) : (
+          <Table>
+            <Thead>
+              <Tr>
+                <Th>Name</Th>
+                <Th>Type</Th>
+                <Th>Target</Th>
+                <Th>Status</Th>
+                <Th>Latency</Th>
+                <Th>Last check</Th>
+              </Tr>
+            </Thead>
+            <Tbody>
+              {monitors.map((m) => (
+                <Tr key={m.monitor_id}>
+                  <Td>
+                    <Link href={`/monitors/${m.monitor_id}`} className="font-medium text-text-primary hover:text-accent">
+                      {m.name}
+                    </Link>
+                  </Td>
+                  <Td>
+                    <Badge variant="neutral">{m.type}</Badge>
+                  </Td>
+                  <Td>
+                    <span className="font-mono text-xs text-text-secondary">{targetSummary(m)}</span>
+                  </Td>
+                  <Td>
+                    <Badge variant={statusVariant(m.state.status)}>{m.state.status}</Badge>
+                  </Td>
+                  <Td>
+                    <span className="text-sm text-text-secondary">{m.state.latency_ms}ms</span>
+                  </Td>
+                  <Td>
+                    <span className="text-xs text-text-secondary">
+                      {m.state.last_check_at ? new Date(m.state.last_check_at).toLocaleTimeString() : "—"}
+                    </span>
+                  </Td>
+                </Tr>
+              ))}
+            </Tbody>
+          </Table>
+        )}
+      </Card>
+    </div>
+  );
+}

web/app/(app)/servers/[id]/console/page.tsx

@@ -15,7 +15,11 @@ export default function ServerConsolePage() {
     const serverId = params.id as string;
 
     const containerRef = useRef<HTMLDivElement>(null);
-    const connectionRef = useRef<{ disconnect: () => void } | null>(null);
+    const connectionRef = useRef<{
+        disconnect: () => void;
+        setScale: (scale: number) => void;
+        resize: (width: number, height: number) => void;
+    } | null>(null);
 
     const [protocol, setProtocol] = useState<string>(searchParams.get("protocol") || "");
     const [keyId, setKeyId] = useState<string>("");
@@ -27,6 +31,8 @@ export default function ServerConsolePage() {
     const [connected, setConnected] = useState(false);
     const [error, setError] = useState<string | null>(null);
     const [pending, setPending] = useState<{ token: string; wsPath: string } | null>(null);
+    const [zoom, setZoom] = useState(1);
+    const dprRef = useRef(1);
 
     // Inject the vendored Guacamole client script once.
     useEffect(() => {
@@ -103,17 +109,36 @@ export default function ServerConsolePage() {
         const wsProto = location.protocol === "https:" ? "wss" : "ws";
         const wsUrl = `${wsProto}://${location.host}${pending.wsPath}`;
         const rect = containerRef.current.getBoundingClientRect();
-        const dpi = Math.round(96 * (window.devicePixelRatio || 1));
+        const dpr = window.devicePixelRatio || 1;
+        dprRef.current = dpr;
+        // Request the remote at device-pixel resolution with a fixed 96 dpi, then
+        // scale the display back down by dpr. Folding dpr into `dpi` instead makes
+        // the remote enlarge everything, which reads as a zoomed-in view.
         const connectData =
             `token=${encodeURIComponent(pending.token)}` +
-            `&width=${Math.floor(rect.width)}` +
-            `&height=${Math.floor(rect.height)}` +
-            `&dpi=${dpi}`;
+            `&width=${Math.floor(rect.width * dpr)}` +
+            `&height=${Math.floor(rect.height * dpr)}` +
+            `&dpi=96`;
 
         connectionRef.current = openConsole(containerRef.current, wsUrl, connectData);
+        connectionRef.current.setScale(zoom / dpr);
         setPending(null);
     }, [connected, pending]);
 
+    // Apply zoom live without reconnecting: resize the remote to a resolution
+    // that, once scaled to fit the container, yields the requested zoom. Higher
+    // zoom = fewer remote pixels rendered larger. Display always fits the
+    // container exactly, so no scrollbars appear.
+    useEffect(() => {
+        if (!connectionRef.current || !containerRef.current) return;
+        const rect = containerRef.current.getBoundingClientRect();
+        const dpr = dprRef.current;
+        const remoteW = Math.floor((rect.width * dpr) / zoom);
+        const remoteH = Math.floor((rect.height * dpr) / zoom);
+        connectionRef.current.resize(remoteW, remoteH);
+        connectionRef.current.setScale(zoom / dpr);
+    }, [zoom]);
+
     function handleDisconnect() {
         connectionRef.current?.disconnect();
         connectionRef.current = null;
@@ -246,12 +271,25 @@ export default function ServerConsolePage() {
                     <Button variant="danger" onClick={handleDisconnect}>
                         Disconnect
                     </Button>
+                    <label className="text-sm text-text-secondary">Scale</label>
+                    <select
+                        value={zoom}
+                        onChange={(e) => setZoom(Number(e.target.value))}
+                        className="rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                    >
+                        <option value={0.5}>50%</option>
+                        <option value={0.75}>75%</option>
+                        <option value={1}>100%</option>
+                        <option value={1.25}>125%</option>
+                        <option value={1.5}>150%</option>
+                        <option value={2}>200%</option>
+                    </select>
                 </div>
             )}
 
             <div
                 ref={containerRef}
-                className="min-h-[500px] flex-1 rounded-lg border border-border bg-black"
+                className="min-h-[500px] flex-1 overflow-hidden rounded-lg border border-border bg-black"
             />
         </div>
     );

web/app/(app)/servers/[id]/page.tsx

@@ -4,7 +4,7 @@ import { useState } from "react";
 import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
 import { useParams, useRouter } from "next/navigation";
 import Link from "next/link";
-import { api, ServerStatus, GenerateKeyOptions, PackageUpdate } from "@/lib/api";
+import { api, ServerStatus, GenerateKeyOptions, PackageUpdate, Inventory } from "@/lib/api";
 import { Badge, Button, Card, CardHeader, CardTitle } from "@/components/ui";
 import { Table, Thead, Tbody, Tr, Th, Td } from "@/components/ui";
 
@@ -23,6 +23,60 @@ function formatDate(dateStr: string) {
     return new Date(dateStr).toLocaleString();
 }
 
+function formatBytes(n: number): string {
+    if (!n) return "0 B";
+    const u = ["B", "KB", "MB", "GB", "TB"];
+    const i = Math.floor(Math.log(n) / Math.log(1024));
+    return `${(n / Math.pow(1024, i)).toFixed(1)} ${u[i]}`;
+}
+
+function UsageBar({ used, total }: { used: number; total: number }) {
+    const pct = total > 0 ? Math.min(100, (used / total) * 100) : 0;
+    return (
+        <div className="h-2 w-full overflow-hidden rounded-full bg-surface-2">
+            <div className={`h-full rounded-full ${pct > 90 ? "bg-danger" : "bg-accent"}`} style={{ width: `${pct}%` }} />
+        </div>
+    );
+}
+
+function InventoryPanel({ inv }: { inv: Inventory }) {
+    return (
+        <Card>
+            <h2 className="mb-4 text-lg font-semibold text-text-primary">Inventory</h2>
+            <div className="grid gap-4 sm:grid-cols-2">
+                <div>
+                    <div className="mb-1 flex justify-between text-sm"><span className="text-text-secondary">CPU</span><span className="text-text-primary">{inv.cpu.usage_pct.toFixed(0)}%</span></div>
+                    <UsageBar used={inv.cpu.usage_pct} total={100} />
+                    <p className="mt-1 text-xs text-text-secondary">{inv.cpu.model} · {inv.cpu.cores} cores · load {inv.cpu.load1?.toFixed(2)}</p>
+                </div>
+                <div>
+                    <div className="mb-1 flex justify-between text-sm"><span className="text-text-secondary">Memory</span><span className="text-text-primary">{formatBytes(inv.memory.used_bytes)} / {formatBytes(inv.memory.total_bytes)}</span></div>
+                    <UsageBar used={inv.memory.used_bytes} total={inv.memory.total_bytes} />
+                    <div className="mb-1 mt-3 flex justify-between text-sm"><span className="text-text-secondary">Swap</span><span className="text-text-primary">{formatBytes(inv.swap_used_bytes)} / {formatBytes(inv.swap_total_bytes)}</span></div>
+                    <UsageBar used={inv.swap_used_bytes} total={inv.swap_total_bytes} />
+                </div>
+            </div>
+            {inv.partitions && inv.partitions.length > 0 && (
+                <div className="mt-5">
+                    <h3 className="mb-2 text-sm font-medium text-text-secondary">Partitions</h3>
+                    <div className="space-y-3">
+                        {inv.partitions.map((p) => (
+                            <div key={p.mountpoint}>
+                                <div className="mb-1 flex justify-between text-xs">
+                                    <span className="font-mono text-text-primary">{p.mountpoint}</span>
+                                    <span className="text-text-secondary">{formatBytes(p.used_bytes)} / {formatBytes(p.total_bytes)} · {p.fstype}</span>
+                                </div>
+                                <UsageBar used={p.used_bytes} total={p.total_bytes} />
+                            </div>
+                        ))}
+                    </div>
+                </div>
+            )}
+            {inv.kernel && <p className="mt-4 text-xs text-text-secondary">Kernel {inv.kernel}</p>}
+        </Card>
+    );
+}
+
 const KEY_SIZES: Record<string, number[]> = {
     rsa: [2048, 3072, 4096],
     ecdsa: [256, 384, 521],
@@ -432,6 +486,12 @@ export default function ServerDetailPage() {
                 </Card>
             </div>
 
+            {server.inventory && (
+                <div className="mb-6">
+                    <InventoryPanel inv={server.inventory} />
+                </div>
+            )}
+
             <div className="grid grid-cols-1 gap-6 lg:grid-cols-3">
                 <Card className="lg:col-span-1">
                     <CardHeader>

web/app/(app)/settings/notifications/page.tsx

@@ -0,0 +1,187 @@
+"use client";
+
+import { useState } from "react";
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import Link from "next/link";
+import { api, ChannelInput, ChannelType, NotificationChannel } from "@/lib/api";
+import { Badge, Button, Card } from "@/components/ui";
+
+const inputClass =
+  "w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder:text-text-tertiary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30";
+const labelClass = "mb-1.5 block text-sm font-medium text-text-secondary";
+
+// Config fields required per channel type.
+const CONFIG_FIELDS: Record<ChannelType, string[]> = {
+  webhook: ["url"],
+  slack: ["url"],
+  discord: ["url"],
+  telegram: ["token", "chat_id"],
+  smtp: ["host", "port", "username", "password", "from", "to"],
+};
+
+function ChannelForm({ initial, onDone }: { initial?: NotificationChannel; onDone: () => void }) {
+  const queryClient = useQueryClient();
+  const [name, setName] = useState(initial?.name ?? "");
+  const [type, setType] = useState<ChannelType>(initial?.type ?? "webhook");
+  const [config, setConfig] = useState<Record<string, string>>(initial?.config ?? {});
+
+  const { mutate: submit, isPending, error } = useMutation({
+    mutationFn: (input: ChannelInput) =>
+      initial ? api.updateChannel(initial.channel_id, input) : api.createChannel(input).then(() => undefined),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["channels"] });
+      onDone();
+    },
+  });
+
+  return (
+    <form
+      onSubmit={(e) => {
+        e.preventDefault();
+        submit({ name, type, config, enabled: initial?.enabled ?? true });
+      }}
+      className="space-y-4"
+    >
+      <div>
+        <label className={labelClass}>Name</label>
+        <input className={inputClass} value={name} onChange={(e) => setName(e.target.value)} required />
+      </div>
+      <div>
+        <label className={labelClass}>Type</label>
+        <select
+          className={inputClass}
+          value={type}
+          onChange={(e) => {
+            setType(e.target.value as ChannelType);
+            setConfig({});
+          }}
+        >
+          {(["webhook", "smtp", "discord", "slack", "telegram"] as const).map((t) => (
+            <option key={t} value={t}>
+              {t}
+            </option>
+          ))}
+        </select>
+      </div>
+      {CONFIG_FIELDS[type].map((field) => (
+        <div key={field}>
+          <label className={labelClass}>{field}</label>
+          <input
+            className={inputClass}
+            type={field === "password" ? "password" : "text"}
+            value={config[field] ?? ""}
+            onChange={(e) => setConfig({ ...config, [field]: e.target.value })}
+          />
+        </div>
+      ))}
+      {error && <p className="text-sm text-danger">{(error as Error).message}</p>}
+      <div className="flex gap-3">
+        <Button type="submit" variant="primary" loading={isPending}>
+          {initial ? "Save Changes" : "Add Channel"}
+        </Button>
+        <Button type="button" variant="ghost" onClick={onDone}>
+          Cancel
+        </Button>
+      </div>
+    </form>
+  );
+}
+
+function ChannelRow({ ch }: { ch: NotificationChannel }) {
+  const queryClient = useQueryClient();
+  const [testMsg, setTestMsg] = useState<string | null>(null);
+  const [editing, setEditing] = useState(false);
+
+  const { mutate: remove } = useMutation({
+    mutationFn: () => api.deleteChannel(ch.channel_id),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: ["channels"] }),
+  });
+
+  const { mutate: test, isPending: testing } = useMutation({
+    mutationFn: () => api.testChannel(ch.channel_id),
+    onSuccess: () => setTestMsg("Sent!"),
+    onError: (e) => setTestMsg((e as Error).message),
+  });
+
+  const { mutate: toggle } = useMutation({
+    mutationFn: (enabled: boolean) => api.updateChannel(ch.channel_id, { enabled }),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: ["channels"] }),
+  });
+
+  if (editing) {
+    return (
+      <div className="border-b border-border p-4 last:border-0">
+        <ChannelForm initial={ch} onDone={() => setEditing(false)} />
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex items-center justify-between border-b border-border px-4 py-3 last:border-0">
+      <div>
+        <div className="flex items-center gap-2">
+          <span className="font-medium text-text-primary">{ch.name}</span>
+          <Badge variant="neutral">{ch.type}</Badge>
+          {!ch.enabled && <Badge variant="warning">disabled</Badge>}
+        </div>
+        {testMsg && <p className="mt-1 text-xs text-text-secondary">{testMsg}</p>}
+      </div>
+      <div className="flex items-center gap-2">
+        <Button variant="ghost" size="sm" loading={testing} onClick={() => test()}>
+          Test
+        </Button>
+        <Button variant="ghost" size="sm" onClick={() => setEditing(true)}>
+          Edit
+        </Button>
+        <Button variant="ghost" size="sm" onClick={() => toggle(!ch.enabled)}>
+          {ch.enabled ? "Disable" : "Enable"}
+        </Button>
+        <Button variant="danger" size="sm" onClick={() => remove()}>
+          Delete
+        </Button>
+      </div>
+    </div>
+  );
+}
+
+export default function NotificationSettingsPage() {
+  const [showForm, setShowForm] = useState(false);
+  const { data: channels, isLoading } = useQuery({ queryKey: ["channels"], queryFn: () => api.listChannels() });
+
+  return (
+    <div className="p-8">
+      <div className="mb-6 flex items-center justify-between">
+        <div>
+          <Link href="/monitors" className="text-sm text-text-secondary hover:text-text-primary">
+            ← Monitors
+          </Link>
+          <h1 className="mt-2 text-2xl font-bold text-text-primary">Notification Channels</h1>
+          <p className="mt-1 text-sm text-text-secondary">Alert destinations for monitor state changes.</p>
+        </div>
+        {!showForm && (
+          <Button variant="primary" onClick={() => setShowForm(true)}>
+            New Channel
+          </Button>
+        )}
+      </div>
+
+      {showForm && (
+        <Card className="mb-6 max-w-xl">
+          <ChannelForm onDone={() => setShowForm(false)} />
+        </Card>
+      )}
+
+      <Card padding={false}>
+        {isLoading ? (
+          <div className="flex justify-center py-16">
+            <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+          </div>
+        ) : !channels || channels.length === 0 ? (
+          <div className="py-16 text-center text-sm text-text-secondary">No channels configured.</div>
+        ) : (
+          channels.map((ch) => <ChannelRow key={ch.channel_id} ch={ch} />)
+        )}
+      </Card>
+    </div>
+  );
+}

web/app/(app)/settings/org/page.tsx

@@ -0,0 +1,418 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { api, auth as authApi, type OrgUser, type Role } from "@/lib/api";
+import { useAuth } from "@/components/AuthProvider";
+import { Badge, Button, Card, Modal, Table, Tbody, Td, Th, Thead, Tr } from "@/components/ui";
+
+const ROLES: Role[] = ["owner", "admin", "member"];
+
+const inputClass =
+  "w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30";
+
+function Field({ label, hint, children }: { label: string; hint?: string; children: React.ReactNode }) {
+  return (
+    <div>
+      <label className="mb-1.5 block text-sm font-medium text-text-secondary">{label}</label>
+      {children}
+      {hint && <p className="mt-1 text-xs text-text-tertiary">{hint}</p>}
+    </div>
+  );
+}
+
+function roleVariant(role: Role) {
+  if (role === "owner") return "accent" as const;
+  if (role === "admin") return "warning" as const;
+  return "neutral" as const;
+}
+
+function MembersCard() {
+  const queryClient = useQueryClient();
+  const { user } = useAuth();
+  const [addOpen, setAddOpen] = useState(false);
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [role, setRole] = useState<Role>("member");
+
+  const { data: users, isLoading, error } = useQuery({ queryKey: ["org-users"], queryFn: api.listOrgUsers });
+
+  const invalidate = () => queryClient.invalidateQueries({ queryKey: ["org-users"] });
+
+  const { mutate: createUser, isPending: creating, error: createError } = useMutation({
+    mutationFn: () => api.createOrgUser({ email, password, role }),
+    onSuccess: () => {
+      invalidate();
+      setAddOpen(false);
+      setEmail("");
+      setPassword("");
+      setRole("member");
+    },
+  });
+
+  const { mutate: changeRole, error: roleError } = useMutation({
+    mutationFn: ({ userId, next }: { userId: string; next: Role }) => api.updateOrgUserRole(userId, next),
+    onSuccess: invalidate,
+    // A rejected change (last owner, owner-only grant) leaves the select showing
+    // the value the server refused — refetch so the row snaps back to the truth.
+    onError: invalidate,
+  });
+
+  const { mutate: removeUser, error: removeError } = useMutation({
+    mutationFn: (userId: string) => api.deleteOrgUser(userId),
+    onSuccess: invalidate,
+  });
+
+  const actionError = (roleError ?? removeError) as Error | null;
+
+  // The server lets only an owner grant or change the owner role. Mirror that
+  // here so admins aren't offered controls that can only 403.
+  const isOwner = user?.role === "owner";
+  const assignableRoles = isOwner ? ROLES : ROLES.filter((r) => r !== "owner");
+
+  return (
+    <Card>
+      <div className="mb-4 flex items-start justify-between gap-3">
+        <div>
+          <h2 className="text-base font-semibold text-text-primary">Members</h2>
+          <p className="mt-0.5 text-sm text-text-secondary">
+            People with access to this organization. Owners and admins can manage settings.
+          </p>
+        </div>
+        <Button variant="primary" size="sm" onClick={() => setAddOpen(true)}>
+          Add Member
+        </Button>
+      </div>
+
+      {actionError && (
+        <div className="mb-4 rounded-lg border border-danger/30 bg-danger/10 px-3 py-2 text-sm text-danger">
+          {actionError.message}
+        </div>
+      )}
+
+      {isLoading ? (
+        <div className="flex justify-center py-8">
+          <div className="h-6 w-6 animate-spin rounded-full border-2 border-border border-t-accent" />
+        </div>
+      ) : error ? (
+        <p className="py-6 text-sm text-danger">{(error as Error).message}</p>
+      ) : !users || users.length === 0 ? (
+        <p className="py-6 text-sm text-text-secondary">No members yet.</p>
+      ) : (
+        <Table>
+          <Thead>
+            <Tr>
+              <Th>Email</Th>
+              <Th>Role</Th>
+              <Th>Sign-in</Th>
+              <Th>Last login</Th>
+              <Th className="text-right">Actions</Th>
+            </Tr>
+          </Thead>
+          <Tbody>
+            {users.map((u: OrgUser) => {
+              const isSelf = u.user_id === user?.user_id;
+              // Own row stays read-only, and only owners may act on owners.
+              const locked = isSelf || (u.role === "owner" && !isOwner);
+              return (
+                <Tr key={u.user_id}>
+                  <Td>
+                    <span className="font-medium">{u.email}</span>
+                    {isSelf && <span className="ml-2 text-xs text-text-tertiary">(you)</span>}
+                  </Td>
+                  <Td>
+                    {locked ? (
+                      <Badge variant={roleVariant(u.role)}>{u.role}</Badge>
+                    ) : (
+                      <select
+                        value={u.role}
+                        onChange={(e) => changeRole({ userId: u.user_id, next: e.target.value as Role })}
+                        className="rounded-lg border border-border bg-surface-2 px-2 py-1 text-sm text-text-primary focus:border-accent/50 focus:outline-none"
+                      >
+                        {assignableRoles.map((r) => (
+                          <option key={r} value={r}>
+                            {r}
+                          </option>
+                        ))}
+                      </select>
+                    )}
+                  </Td>
+                  <Td>
+                    <Badge variant="neutral">{u.auth_source === "oidc" ? "SSO" : "Password"}</Badge>
+                  </Td>
+                  <Td className="text-text-secondary">
+                    {u.last_login ? new Date(u.last_login).toLocaleString() : "Never"}
+                  </Td>
+                  <Td className="text-right">
+                    {!locked && (
+                      <Button
+                        variant="ghost"
+                        size="sm"
+                        onClick={() => {
+                          if (confirm(`Remove ${u.email} from this organization?`)) removeUser(u.user_id);
+                        }}
+                      >
+                        Remove
+                      </Button>
+                    )}
+                  </Td>
+                </Tr>
+              );
+            })}
+          </Tbody>
+        </Table>
+      )}
+
+      <Modal open={addOpen} title="Add Member" onClose={() => setAddOpen(false)}>
+        <form
+          onSubmit={(e) => {
+            e.preventDefault();
+            createUser();
+          }}
+          className="space-y-4"
+        >
+          <Field label="Email">
+            <input
+              type="email"
+              required
+              value={email}
+              onChange={(e) => setEmail(e.target.value)}
+              className={inputClass}
+            />
+          </Field>
+
+          <Field
+            label="Password"
+            hint="Leave blank if this member will sign in through SSO instead."
+          >
+            <input
+              type="password"
+              autoComplete="new-password"
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
+              className={inputClass}
+            />
+          </Field>
+
+          <Field label="Role">
+            <select value={role} onChange={(e) => setRole(e.target.value as Role)} className={inputClass}>
+              {assignableRoles.map((r) => (
+                <option key={r} value={r}>
+                  {r}
+                </option>
+              ))}
+            </select>
+          </Field>
+
+          {createError && (
+            <div className="rounded-lg border border-danger/30 bg-danger/10 px-3 py-2 text-sm text-danger">
+              {(createError as Error).message}
+            </div>
+          )}
+
+          <div className="flex justify-end gap-2">
+            <Button type="button" variant="ghost" onClick={() => setAddOpen(false)}>
+              Cancel
+            </Button>
+            <Button type="submit" variant="primary" loading={creating}>
+              Add Member
+            </Button>
+          </div>
+        </form>
+      </Modal>
+    </Card>
+  );
+}
+
+function OIDCCard() {
+  const queryClient = useQueryClient();
+  const { data: cfg, isLoading } = useQuery({ queryKey: ["org-oidc"], queryFn: api.getOrgOIDC });
+
+  const [issuer, setIssuer] = useState("");
+  const [clientId, setClientId] = useState("");
+  const [clientSecret, setClientSecret] = useState("");
+  const [enabled, setEnabled] = useState(false);
+  const [saved, setSaved] = useState(false);
+  const [copied, setCopied] = useState(false);
+
+  const redirectUrl = authApi.oidcRedirectUrl();
+
+  useEffect(() => {
+    if (!cfg) return;
+    setIssuer(cfg.issuer ?? "");
+    setClientId(cfg.client_id ?? "");
+    setEnabled(cfg.enabled);
+    // The secret is never returned; leave the field blank to mean "unchanged".
+    setClientSecret("");
+  }, [cfg]);
+
+  const { mutate: save, isPending, error } = useMutation({
+    mutationFn: () => api.saveOrgOIDC({ issuer, client_id: clientId, client_secret: clientSecret, enabled }),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["org-oidc"] });
+      setClientSecret("");
+      setSaved(true);
+      setTimeout(() => setSaved(false), 3000);
+    },
+  });
+
+  async function copyRedirect() {
+    await navigator.clipboard.writeText(redirectUrl);
+    setCopied(true);
+    setTimeout(() => setCopied(false), 2000);
+  }
+
+  if (isLoading) {
+    return (
+      <Card>
+        <div className="flex justify-center py-8">
+          <div className="h-6 w-6 animate-spin rounded-full border-2 border-border border-t-accent" />
+        </div>
+      </Card>
+    );
+  }
+
+  const secretSet = cfg?.client_secret_set ?? false;
+
+  return (
+    <Card>
+      <div className="mb-4">
+        <h2 className="text-base font-semibold text-text-primary">Single Sign-On (OIDC)</h2>
+        <p className="mt-0.5 text-sm text-text-secondary">
+          Let members sign in with your identity provider. Users are provisioned into this organization on
+          first sign-in.
+        </p>
+      </div>
+
+      <div className="mb-5 rounded-lg border border-border bg-surface-2 p-3">
+        <p className="mb-2 text-xs font-medium text-text-secondary">
+          Register this redirect URL with your provider:
+        </p>
+        <div className="flex items-center gap-2">
+          <code className="flex-1 overflow-x-auto rounded bg-background px-2 py-1.5 font-mono text-xs text-text-primary">
+            {redirectUrl}
+          </code>
+          <Button type="button" variant="ghost" size="sm" onClick={copyRedirect}>
+            {copied ? "Copied!" : "Copy"}
+          </Button>
+        </div>
+      </div>
+
+      <form
+        onSubmit={(e) => {
+          e.preventDefault();
+          save();
+        }}
+        className="space-y-4"
+      >
+        <Field label="Issuer URL" hint="The provider's OIDC discovery base, e.g. https://accounts.google.com">
+          <input
+            type="url"
+            required
+            value={issuer}
+            onChange={(e) => setIssuer(e.target.value)}
+            className={inputClass}
+          />
+        </Field>
+
+        <Field label="Client ID">
+          <input
+            type="text"
+            required
+            value={clientId}
+            onChange={(e) => setClientId(e.target.value)}
+            className={inputClass}
+          />
+        </Field>
+
+        <Field
+          label="Client Secret"
+          hint={
+            secretSet
+              ? "A secret is stored. Leave this blank to keep it, or enter a new one to replace it."
+              : "No secret stored yet."
+          }
+        >
+          <input
+            type="password"
+            autoComplete="new-password"
+            placeholder={secretSet ? "•••••••• (unchanged)" : "Enter client secret"}
+            value={clientSecret}
+            onChange={(e) => setClientSecret(e.target.value)}
+            className={inputClass}
+          />
+        </Field>
+
+        <div className="flex items-center gap-2 text-sm">
+          <span className={`inline-block h-2 w-2 rounded-full ${secretSet ? "bg-success" : "bg-text-tertiary"}`} />
+          <span className="text-text-secondary">
+            {secretSet ? "Client secret is configured" : "No client secret configured"}
+          </span>
+        </div>
+
+        <label className="flex items-center gap-2 text-sm text-text-secondary">
+          <input
+            type="checkbox"
+            checked={enabled}
+            onChange={(e) => setEnabled(e.target.checked)}
+            className="h-4 w-4 rounded border-border bg-surface-2 accent-accent"
+          />
+          Enable SSO sign-in for this organization
+        </label>
+
+        {enabled && !secretSet && !clientSecret && (
+          <div className="rounded-lg border border-warning/30 bg-warning/10 px-3 py-2 text-sm text-warning">
+            SSO cannot complete sign-in without a client secret.
+          </div>
+        )}
+
+        {error && (
+          <div className="rounded-lg border border-danger/30 bg-danger/10 px-3 py-2 text-sm text-danger">
+            {(error as Error).message}
+          </div>
+        )}
+
+        <div className="flex items-center gap-3">
+          <Button type="submit" variant="primary" loading={isPending}>
+            {saved ? "Saved!" : "Save SSO Settings"}
+          </Button>
+          {saved && <span className="text-sm text-success">SSO settings saved.</span>}
+        </div>
+      </form>
+    </Card>
+  );
+}
+
+export default function OrgSettingsPage() {
+  const { org, isAdmin } = useAuth();
+
+  if (!isAdmin) {
+    return (
+      <div className="p-8">
+        <Card className="max-w-lg">
+          <h1 className="text-base font-semibold text-text-primary">You don&apos;t have access</h1>
+          <p className="mt-1 text-sm text-text-secondary">
+            Organization settings are available to owners and admins only. Ask an administrator if you need
+            access.
+          </p>
+        </Card>
+      </div>
+    );
+  }
+
+  return (
+    <div className="p-8">
+      <div className="mb-8">
+        <h1 className="text-2xl font-bold text-text-primary">Organization</h1>
+        <p className="mt-1 text-sm text-text-secondary">
+          {org ? `Manage members and sign-in for ${org.name}.` : "Manage members and sign-in."}
+        </p>
+      </div>
+
+      <div className="space-y-6">
+        <MembersCard />
+        <OIDCCard />
+      </div>
+    </div>
+  );
+}

web/app/(app)/settings/page.tsx

@@ -0,0 +1,264 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import Link from "next/link";
+import { api } from "@/lib/api";
+import { useAuth } from "@/components/AuthProvider";
+import { Button, Card } from "@/components/ui";
+
+function SectionCard({ title, description, icon, children, className }: { title: string; description?: string; icon: React.ReactNode; children: React.ReactNode; className?: string }) {
+    return (
+        <Card className={className}>
+            <div className="mb-4 flex items-start gap-3">
+                <div className="mt-0.5 flex h-9 w-9 flex-shrink-0 items-center justify-center rounded-lg border border-border bg-surface-2 text-accent">{icon}</div>
+                <div>
+                    <h2 className="text-base font-semibold text-text-primary">{title}</h2>
+                    {description && <p className="mt-0.5 text-sm text-text-secondary">{description}</p>}
+                </div>
+            </div>
+            {children}
+        </Card>
+    );
+}
+
+function Field({ label, hint, children }: { label: string; hint?: string; children: React.ReactNode }) {
+    return (
+        <div>
+            <label className="mb-1.5 block text-sm font-medium text-text-secondary">{label}</label>
+            {children}
+            {hint && <p className="mt-1 text-xs text-text-tertiary">{hint}</p>}
+        </div>
+    );
+}
+
+function BellIcon() {
+    return (
+        <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+            <path
+                strokeLinecap="round"
+                strokeLinejoin="round"
+                d="M14.857 17.082a23.848 23.848 0 005.454-1.31A8.967 8.967 0 0118 9.75V9A6 6 0 006 9v.75a8.967 8.967 0 01-2.312 6.022c1.733.64 3.56 1.085 5.455 1.31m5.714 0a24.255 24.255 0 01-5.714 0m5.714 0a3 3 0 11-5.714 0"
+            />
+        </svg>
+    );
+}
+
+function ServerIcon() {
+    return (
+        <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+            <path
+                strokeLinecap="round"
+                strokeLinejoin="round"
+                d="M21.75 17.25v-.228a4.5 4.5 0 00-.12-1.03l-2.268-9.64a3.375 3.375 0 00-3.285-2.602H7.923a3.375 3.375 0 00-3.285 2.602l-2.268 9.64a4.5 4.5 0 00-.12 1.03v.228m19.5 0a3 3 0 01-3 3H5.25a3 3 0 01-3-3m19.5 0a3 3 0 00-3-3H5.25a3 3 0 00-3 3m16.5 0h.008v.008h-.008v-.008zm-3 0h.008v.008h-.008v-.008z"
+            />
+        </svg>
+    );
+}
+
+function DocumentIcon() {
+    return (
+        <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+            <path
+                strokeLinecap="round"
+                strokeLinejoin="round"
+                d="M19.5 14.25v-2.625a3.375 3.375 0 00-3.375-3.375h-1.5A1.125 1.125 0 0113.5 7.125v-1.5a3.375 3.375 0 00-3.375-3.375H8.25m2.25 0H5.625c-.621 0-1.125.504-1.125 1.125v17.25c0 .621.504 1.125 1.125 1.125h12.75c.621 0 1.125-.504 1.125-1.125V11.25a9 9 0 00-9-9z"
+            />
+        </svg>
+    );
+}
+
+function KeyIcon() {
+    return (
+        <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+            <path
+                strokeLinecap="round"
+                strokeLinejoin="round"
+                d="M15.75 5.25a3 3 0 013 3m3 0a6 6 0 01-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1121.75 8.25z"
+            />
+        </svg>
+    );
+}
+
+function SecretsTokenCard({ tokenSet, rotatedAt }: { tokenSet: boolean; rotatedAt?: string }) {
+    const queryClient = useQueryClient();
+    const [token, setToken] = useState<string | null>(null);
+    const [copied, setCopied] = useState(false);
+    const readUrl = typeof window !== "undefined" ? `${window.location.origin}/api/secrets/<group>/values` : "/api/secrets/<group>/values";
+
+    const { mutate: rotate, isPending } = useMutation({
+        mutationFn: api.rotateSecretsToken,
+        onSuccess: (res) => {
+            setToken(res.token);
+            queryClient.invalidateQueries({ queryKey: ["settings"] });
+        },
+    });
+
+    async function copy() {
+        if (!token) return;
+        await navigator.clipboard.writeText(token);
+        setCopied(true);
+        setTimeout(() => setCopied(false), 2000);
+    }
+
+    return (
+        <SectionCard title="Secrets Read Token (ESO)" description="Kubernetes External Secrets Operator authenticates to the read endpoint with this bearer token." icon={<KeyIcon />}>
+            <p className="mb-4 text-sm text-text-secondary">
+                Point your <span className="font-mono">ClusterSecretStore</span> at <span className="font-mono text-text-primary">{readUrl}</span>.
+            </p>
+
+            <div className="mb-4 flex items-center gap-2 text-sm">
+                <span className={`inline-block h-2 w-2 rounded-full ${tokenSet ? "bg-success" : "bg-text-tertiary"}`} />
+                <span className="text-text-secondary">
+                    {tokenSet ? "A read token is configured" : "No read token configured yet"}
+                    {tokenSet && rotatedAt && ` · rotated ${new Date(rotatedAt).toLocaleString()}`}
+                </span>
+            </div>
+
+            {token && (
+                <div className="mb-4 rounded-lg border border-warning/30 bg-warning/10 p-3">
+                    <p className="mb-2 text-xs font-medium text-warning">Copy this token now — it will not be shown again.</p>
+                    <div className="flex items-center gap-2">
+                        <code className="flex-1 overflow-x-auto rounded bg-surface-2 px-2 py-1.5 font-mono text-xs text-text-primary">{token}</code>
+                        <Button type="button" variant="ghost" size="sm" onClick={copy}>
+                            {copied ? "Copied!" : "Copy"}
+                        </Button>
+                    </div>
+                </div>
+            )}
+
+            <Button type="button" variant="primary" loading={isPending} onClick={() => rotate()}>
+                {tokenSet ? "Rotate Token" : "Generate Token"}
+            </Button>
+            {tokenSet && <p className="mt-2 text-xs text-text-tertiary">Rotating invalidates the previous token. Update the Kubernetes secret afterwards.</p>}
+        </SectionCard>
+    );
+}
+
+export default function SettingsPage() {
+    const queryClient = useQueryClient();
+    const { isAdmin } = useAuth();
+
+    // /api/settings requires owner|admin and 403s for members, so don't even ask.
+    const { data: settings, isLoading } = useQuery({
+        queryKey: ["settings"],
+        queryFn: api.getSettings,
+        enabled: isAdmin,
+    });
+
+    const [thresholdMinutes, setThresholdMinutes] = useState(5);
+    const [logRetentionDays, setLogRetentionDays] = useState(30);
+    const [saved, setSaved] = useState(false);
+
+    useEffect(() => {
+        if (!settings) return;
+        setThresholdMinutes(settings.alerts.offline_threshold_minutes || 5);
+        setLogRetentionDays(settings.workflow_log_retention_days ?? 30);
+    }, [settings]);
+
+    const { mutate: save, isPending } = useMutation({
+        mutationFn: (payload: Parameters<typeof api.saveSettings>[0]) => api.saveSettings(payload),
+        onSuccess: () => {
+            queryClient.invalidateQueries({ queryKey: ["settings"] });
+            setSaved(true);
+            setTimeout(() => setSaved(false), 3000);
+        },
+    });
+
+    function handleSubmit(e: React.FormEvent) {
+        e.preventDefault();
+        if (!settings) return;
+        // Preserve legacy alert/email values (managed via Notification Channels now);
+        // only the offline threshold and log retention are edited here.
+        save({
+            alerts: { ...settings.alerts, offline_threshold_minutes: thresholdMinutes },
+            email: settings.email,
+            workflow_log_retention_days: logRetentionDays,
+        });
+    }
+
+    if (!isAdmin) {
+        return (
+            <div className="p-8">
+                <Card className="max-w-lg">
+                    <h1 className="text-base font-semibold text-text-primary">You don&apos;t have access</h1>
+                    <p className="mt-1 text-sm text-text-secondary">
+                        Settings are available to owners and admins only. Ask an administrator if you need access.
+                    </p>
+                </Card>
+            </div>
+        );
+    }
+
+    if (isLoading) {
+        return (
+            <div className="flex h-full items-center justify-center">
+                <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+            </div>
+        );
+    }
+
+    return (
+        <div className="p-8">
+            <div className="mb-8">
+                <h1 className="text-2xl font-bold text-text-primary">Settings</h1>
+                <p className="mt-1 text-sm text-text-secondary">Configure monitoring, alerting, and integrations.</p>
+            </div>
+
+            <div className="space-y-6">
+                {/* Alerting — replaces the legacy webhook/email settings */}
+                <SectionCard title="Alerting" description="Alerts are now delivered through notification channels, triggered by service monitors." icon={<BellIcon />}>
+                    <div className="flex flex-wrap gap-3">
+                        <Link href="/settings/notifications">
+                            <Button variant="secondary">Manage Notification Channels</Button>
+                        </Link>
+                        <Link href="/monitors">
+                            <Button variant="ghost">View Monitors</Button>
+                        </Link>
+                    </div>
+                    <p className="mt-4 text-xs text-text-tertiary">
+                        Webhook, email (SMTP), Discord, Slack, and Telegram destinations are configured under Notification Channels and attached per monitor.
+                    </p>
+                </SectionCard>
+
+                <form onSubmit={handleSubmit}>
+                    <div className="grid grid-cols-1 gap-6 lg:grid-cols-2">
+                        <SectionCard title="Server Health" description="When to consider an agent-backed server offline." icon={<ServerIcon />}>
+                            <Field label="Offline threshold (minutes)" hint="How long a server must be silent before being marked offline. Agents poll every 30s, so 5 minutes is a safe minimum.">
+                                <input
+                                    type="number"
+                                    min={1}
+                                    max={60}
+                                    value={thresholdMinutes}
+                                    onChange={(e) => setThresholdMinutes(Number(e.target.value))}
+                                    className="w-32 rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                                />
+                            </Field>
+                        </SectionCard>
+
+                        <SectionCard title="Workflow Logs" description="How long run logs are kept before automatic deletion." icon={<DocumentIcon />}>
+                            <Field label="Log retention (days)" hint="0 = keep forever. Applies to per-run step output logs.">
+                                <input
+                                    type="number"
+                                    min={0}
+                                    value={logRetentionDays}
+                                    onChange={(e) => setLogRetentionDays(Number(e.target.value))}
+                                    className="w-32 rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                                />
+                            </Field>
+                        </SectionCard>
+                    </div>
+
+                    <div className="mt-6 flex items-center gap-3">
+                        <Button type="submit" variant="primary" loading={isPending}>
+                            {saved ? "Saved!" : "Save Settings"}
+                        </Button>
+                        {saved && <span className="text-sm text-success">Settings saved successfully.</span>}
+                    </div>
+                </form>
+
+                <SecretsTokenCard tokenSet={settings?.secrets?.read_token_set ?? false} rotatedAt={settings?.secrets?.rotated_at} />
+            </div>
+        </div>
+    );
+}

web/app/(app)/steps/page.tsx

@@ -0,0 +1,214 @@
+"use client";
+
+import { useMemo, useRef, useState } from "react";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { api, WorkflowStep } from "@/lib/api";
+import { Button } from "@/components/ui";
+import { EditStepModal } from "@/components/workflows/EditStepModal";
+
+type Tab = "all" | "bash" | "powershell" | "default" | "shared";
+
+const inputClass =
+  "w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder-text-secondary/50 focus:border-signal focus:outline-none focus:ring-1 focus:ring-signal";
+
+function ShellBadge({ interpreter }: { interpreter: "bash" | "powershell" }) {
+  const isBash = interpreter === "bash";
+  return (
+    <span className={`rounded px-1.5 py-0.5 font-mono text-[10px] uppercase ${isBash ? "bg-bash/15 text-bash" : "bg-pwsh/15 text-pwsh"}`}>
+      {isBash ? "bash" : "pwsh"}
+    </span>
+  );
+}
+
+export default function StepsPage() {
+  const qc = useQueryClient();
+  const { data: steps } = useQuery({ queryKey: ["steps"], queryFn: api.listSteps });
+  const { data: usage } = useQuery({ queryKey: ["step-usage"], queryFn: api.stepUsage });
+
+  const [search, setSearch] = useState("");
+  const [tab, setTab] = useState<Tab>("all");
+  const [editOpen, setEditOpen] = useState(false);
+  const [editing, setEditing] = useState<WorkflowStep | null>(null);
+  const [importing, setImporting] = useState(false);
+  const [syncing, setSyncing] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [notice, setNotice] = useState<string | null>(null);
+  const fileRef = useRef<HTMLInputElement>(null);
+
+  const rows = useMemo(() => {
+    const q = search.toLowerCase();
+    return (steps ?? []).filter((s) => {
+      const matchesText = s.name.toLowerCase().includes(q) || (s.description ?? "").toLowerCase().includes(q);
+      const matchesTab =
+        tab === "all" ||
+        (tab === "bash" && s.interpreter === "bash") ||
+        (tab === "powershell" && s.interpreter === "powershell") ||
+        (tab === "default" && s.source === "default") ||
+        (tab === "shared" && s.source !== "default");
+      return matchesText && matchesTab;
+    });
+  }, [steps, search, tab]);
+
+  const openNew = () => {
+    setEditing(null);
+    setEditOpen(true);
+  };
+  const openEdit = (s: WorkflowStep) => {
+    setEditing(s);
+    setEditOpen(true);
+  };
+
+  const onImport = async (e: React.ChangeEvent<HTMLInputElement>) => {
+    const file = e.target.files?.[0];
+    if (!file) return;
+    setImporting(true);
+    setError(null);
+    try {
+      const doc = JSON.parse(await file.text());
+      await api.importStep(doc);
+      qc.invalidateQueries({ queryKey: ["steps"] });
+      setNotice("Step imported.");
+    } catch (err) {
+      setError((err as Error).message);
+    } finally {
+      setImporting(false);
+      e.target.value = "";
+    }
+  };
+
+  const onSync = async () => {
+    setSyncing(true);
+    setError(null);
+    try {
+      const { created, updated } = await api.seedDefaults();
+      qc.invalidateQueries({ queryKey: ["steps"] });
+      setNotice(`${created} created, ${updated} updated`);
+    } catch (err) {
+      setError((err as Error).message);
+    } finally {
+      setSyncing(false);
+    }
+  };
+
+  return (
+    <div className="p-8">
+      <div className="mb-6 flex items-center gap-3">
+        <div>
+          <h1 className="text-xl font-semibold text-text-primary">Steps</h1>
+          <p className="text-sm text-text-secondary">Reusable steps shared across all workflows.</p>
+        </div>
+        <div className="ml-auto flex items-center gap-2">
+          <input ref={fileRef} type="file" accept="application/json" className="hidden" onChange={onImport} />
+          <Button variant="secondary" size="sm" loading={syncing} onClick={onSync}>
+            Sync defaults
+          </Button>
+          <Button variant="secondary" size="sm" loading={importing} onClick={() => fileRef.current?.click()}>
+            Import
+          </Button>
+          <Button size="sm" onClick={openNew}>
+            + New step
+          </Button>
+        </div>
+      </div>
+
+      {error && <div className="mb-4 rounded border border-danger/30 bg-danger/10 px-3 py-2 text-sm text-danger">{error}</div>}
+      {notice && <div className="mb-4 rounded border border-signal/30 bg-signal/10 px-3 py-2 text-sm text-signal">{notice}</div>}
+
+      <div className="mb-4 flex items-center gap-2">
+        <input className={`${inputClass} max-w-sm`} placeholder="Search steps…" value={search} onChange={(e) => setSearch(e.target.value)} />
+        <div className="flex gap-1.5">
+          {(["all", "bash", "powershell", "default", "shared"] as Tab[]).map((t) => (
+            <button
+              key={t}
+              onClick={() => setTab(t)}
+              className={`rounded-full border px-3 py-1 text-xs capitalize ${
+                tab === t ? "border-signal/50 bg-signal/15 text-signal" : "border-border bg-surface-2 text-text-secondary hover:text-text-primary"
+              }`}
+            >
+              {t === "powershell" ? "PowerShell" : t}
+            </button>
+          ))}
+        </div>
+      </div>
+
+      <div className="overflow-x-auto rounded-lg border border-border">
+        <table className="w-full text-sm">
+          <thead>
+            <tr className="border-b border-border text-left text-[11px] uppercase tracking-wide text-text-secondary">
+              <th className="px-4 py-2.5 font-bold">Name</th>
+              <th className="px-4 py-2.5 font-bold">Shell</th>
+              <th className="px-4 py-2.5 font-bold">Source</th>
+              <th className="px-4 py-2.5 font-bold">Outputs</th>
+              <th className="px-4 py-2.5 font-bold">Used by</th>
+              <th className="px-4 py-2.5 text-right font-bold">Actions</th>
+            </tr>
+          </thead>
+          <tbody>
+            {rows.map((s) => {
+              const count = usage?.[s.step_id] ?? 0;
+              return (
+                <tr key={s.step_id} className="border-b border-border last:border-0">
+                  <td className="px-4 py-3">
+                    <div className="font-medium text-text-primary">{s.name}</div>
+                    {s.description && <div className="text-xs text-text-secondary">{s.description}</div>}
+                  </td>
+                  <td className="px-4 py-3">
+                    <ShellBadge interpreter={s.interpreter} />
+                  </td>
+                  <td className="px-4 py-3">
+                    <span className="rounded bg-surface-2 px-1.5 py-0.5 font-mono text-[10px] uppercase text-text-secondary">
+                      {s.source === "default" ? "default" : "shared"}
+                    </span>
+                  </td>
+                  <td className="px-4 py-3">
+                    <div className="flex flex-wrap gap-1">
+                      {(s.declared_outputs ?? []).map((o) => (
+                        <span key={o} className="rounded border border-signal/35 px-1.5 py-0.5 font-mono text-[10px] text-signal">
+                          {o}
+                        </span>
+                      ))}
+                    </div>
+                  </td>
+                  <td className="px-4 py-3 text-text-secondary">
+                    {count === 0 ? "—" : `${count} workflow${count === 1 ? "" : "s"}`}
+                  </td>
+                  <td className="px-4 py-3 text-right">
+                    <div className="flex items-center justify-end gap-3 text-text-secondary">
+                      <button onClick={() => openEdit(s)} className="hover:text-text-primary">
+                        Edit
+                      </button>
+                      <a href={api.exportStepUrl(s.step_id)} download className="hover:text-text-primary">
+                        Export
+                      </a>
+                      <button onClick={() => openEdit(s)} className="hover:text-danger">
+                        Delete
+                      </button>
+                    </div>
+                  </td>
+                </tr>
+              );
+            })}
+            {rows.length === 0 && (
+              <tr>
+                <td colSpan={6} className="px-4 py-8 text-center text-sm text-text-secondary">
+                  No steps found.
+                </td>
+              </tr>
+            )}
+          </tbody>
+        </table>
+      </div>
+
+      <EditStepModal
+        key={editing?.step_id ?? "new"}
+        open={editOpen}
+        step={editing}
+        onClose={() => {
+          setEditOpen(false);
+          qc.invalidateQueries({ queryKey: ["steps"] });
+          qc.invalidateQueries({ queryKey: ["step-usage"] });
+        }}
+      />
+    </div>
+  );
+}

web/app/(app)/workflows/[id]/page.tsx

@@ -0,0 +1,616 @@
+"use client";
+
+import { useEffect, useRef, useState } from "react";
+import Link from "next/link";
+import { useParams, useRouter } from "next/navigation";
+import { useQuery } from "@tanstack/react-query";
+import { api, Workflow, WorkflowStep, WorkflowStepRef, SecretGroupSummary } from "@/lib/api";
+import { Button } from "@/components/ui";
+import { EditWorkflowModal } from "@/components/workflows/EditWorkflowModal";
+import { StepPickerModal } from "@/components/workflows/StepPickerModal";
+
+const inputClass =
+    "w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder-text-secondary/50 focus:border-signal focus:outline-none focus:ring-1 focus:ring-signal";
+
+type DragPayload = { kind: "lib"; stepId: string } | { kind: "move"; from: number };
+
+function ShellBadge({ interpreter }: { interpreter: "bash" | "powershell" }) {
+    const isBash = interpreter === "bash";
+    return <span className={`rounded px-1.5 py-0.5 font-mono text-[10px] uppercase ${isBash ? "bg-bash/15 text-bash" : "bg-pwsh/15 text-pwsh"}`}>{isBash ? "bash" : "pwsh"}</span>;
+}
+
+function AdhocBadge() {
+    return <span className="rounded px-1.5 py-0.5 font-mono text-[10px] uppercase bg-signal/15 text-signal">ad-hoc</span>;
+}
+
+// Stable snapshot of only the fields the editor controls. Excludes volatile
+// server-echo fields (e.g. updated_at) that would otherwise change on every
+// save and cause autosave to loop forever.
+function snapshotOf(w: Workflow): string {
+    return JSON.stringify({
+        name: w.name,
+        target_server_ids: w.target_server_ids,
+        steps: w.steps,
+    });
+}
+
+function timeAgo(date: Date): string {
+    const s = Math.floor((Date.now() - date.getTime()) / 1000);
+    if (s < 5) return "just now";
+    if (s < 60) return `${s}s ago`;
+    const m = Math.floor(s / 60);
+    if (m < 60) return `${m}m ago`;
+    const h = Math.floor(m / 60);
+    return `${h}h ago`;
+}
+
+export default function WorkflowBuilder() {
+    const params = useParams<{ id: string }>();
+    const id = params.id;
+    const router = useRouter();
+
+    const [wf, setWf] = useState<Workflow | null>(null);
+    const [selected, setSelected] = useState<number | null>(null);
+    const [saving, setSaving] = useState(false);
+    const [lastSaved, setLastSaved] = useState<Date | null>(null);
+    const [, setTick] = useState(0);
+    const savedSnapshotRef = useRef<string | null>(null);
+    const savingRef = useRef(false);
+    const wfRef = useRef<Workflow | null>(null);
+    const [running, setRunning] = useState(false);
+    const [error, setError] = useState<string | null>(null);
+    const [notice, setNotice] = useState<string | null>(null);
+    const [importingInline, setImportingInline] = useState(false);
+    const [groupKeys, setGroupKeys] = useState<Record<string, string[]>>({});
+    const [editWorkflowOpen, setEditWorkflowOpen] = useState(false);
+    const [dragOverZone, setDragOverZone] = useState<number | null>(null);
+    const [pickerOpen, setPickerOpen] = useState(false);
+
+    const { data: loaded } = useQuery({
+        queryKey: ["workflow", id],
+        queryFn: () => api.getWorkflow(id),
+    });
+    const { data: library } = useQuery({ queryKey: ["steps"], queryFn: api.listSteps });
+    const { data: secretGroups } = useQuery({
+        queryKey: ["secret-groups"],
+        queryFn: api.listSecretGroups,
+    });
+
+    useEffect(() => {
+        if (loaded && !wf) {
+            setWf(loaded);
+            savedSnapshotRef.current = snapshotOf(loaded);
+        }
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [loaded]);
+
+    // Lazily fetch the keys for every secret group so the inspector's
+    // secret-ref checklist can offer "group/KEY" options.
+    useEffect(() => {
+        if (!secretGroups) return;
+        secretGroups.forEach((g: SecretGroupSummary) => {
+            if (groupKeys[g.group] !== undefined) return;
+            api.getSecretGroup(g.group)
+                .then((res) =>
+                    setGroupKeys((prev) => ({
+                        ...prev,
+                        [g.group]: res.secrets.map((s) => s.key),
+                    })),
+                )
+                .catch(() => {
+                    setGroupKeys((prev) => ({ ...prev, [g.group]: [] }));
+                });
+        });
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [secretGroups]);
+
+    // Keep a ref to the latest workflow so an in-flight save can tell whether
+    // the user edited again while the request was on the wire.
+    wfRef.current = wf;
+
+    // Autosave: debounce 800ms after any change to the workflow (step added,
+    // removed, reordered, or edited) and persist. Diffing the serialized state
+    // against the last saved snapshot skips no-op saves and the initial load.
+    // Must stay above the early return below so hook order is stable.
+    useEffect(() => {
+        if (!wf || savedSnapshotRef.current === null) return;
+        if (snapshotOf(wf) === savedSnapshotRef.current) return;
+        const t = setTimeout(() => {
+            save();
+        }, 800);
+        return () => clearTimeout(t);
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [wf]);
+
+    // Re-render every 15s so the "Saved … ago" label stays current.
+    useEffect(() => {
+        if (!lastSaved) return;
+        const iv = setInterval(() => setTick((n) => n + 1), 15000);
+        return () => clearInterval(iv);
+    }, [lastSaved]);
+
+    if (!wf) {
+        return <div className="p-8 text-text-secondary">Loading…</div>;
+    }
+
+    const libById = (sid?: string) => (sid ? library?.find((l) => l.step_id === sid) : undefined);
+
+    const sortedSteps = [...wf.steps].sort((a, b) => a.order - b.order);
+    const selectedRef = selected !== null ? sortedSteps[selected] : null;
+    const selectedLib = selectedRef ? libById(selectedRef.step_id) : null;
+    const selectedIdxInWf = selectedRef ? wf.steps.indexOf(selectedRef) : -1;
+
+    const save = async () => {
+        // Never run two saves concurrently: a request in flight would race the
+        // next one. The finally block re-triggers if edits landed meanwhile.
+        if (savingRef.current) return;
+        const current = wfRef.current;
+        if (!current) return;
+        const snapshot = snapshotOf(current);
+        if (snapshot === savedSnapshotRef.current) return;
+        savingRef.current = true;
+        setSaving(true);
+        setError(null);
+        try {
+            const updated = await api.updateWorkflow(id, current);
+            if (!updated || !Array.isArray(updated.steps)) {
+                setError("Save failed: server returned an unexpected response.");
+                return;
+            }
+            if (wfRef.current && snapshotOf(wfRef.current) === snapshot) {
+                // Nothing changed while the request was in flight: adopt the
+                // server echo as the new saved baseline.
+                savedSnapshotRef.current = snapshotOf(updated);
+                setWf(updated);
+            } else {
+                // The user edited again mid-flight. Keep their newer state and
+                // mark only the SENT snapshot as saved, so the effect re-fires
+                // and persists the remaining changes.
+                savedSnapshotRef.current = snapshot;
+            }
+            setLastSaved(new Date());
+        } catch (e) {
+            setError((e as Error).message);
+        } finally {
+            savingRef.current = false;
+            setSaving(false);
+            // If edits arrived during the save (or a concurrent save was
+            // skipped), persist them on the next tick.
+            if (wfRef.current && snapshotOf(wfRef.current) !== savedSnapshotRef.current) {
+                setTimeout(() => save(), 0);
+            }
+        }
+    };
+
+    const run = async () => {
+        setRunning(true);
+        setError(null);
+        try {
+            const { run_id } = await api.runWorkflow(id);
+            router.push(`/workflows/${id}/runs/${run_id}`);
+        } catch (e) {
+            setError((e as Error).message);
+            setRunning(false);
+        }
+    };
+
+    const resequence = (steps: WorkflowStepRef[]) => steps.map((r, i) => ({ ...r, order: i }));
+
+    const insertLibStep = (stepId: string, pos: number) => {
+        const next = [...sortedSteps];
+        next.splice(pos, 0, { step_id: stepId, order: 0, on_failure: "stop", max_retries: 0 });
+        setWf({ ...wf, steps: resequence(next) });
+    };
+
+    const appendRef = (ref: WorkflowStepRef) => {
+        setWf({ ...wf, steps: resequence([...sortedSteps, ref]) });
+    };
+
+    const addAdhocStep = () => {
+        appendRef({
+            inline: {
+                step_id: "",
+                name: "New ad-hoc step",
+                description: "",
+                interpreter: "bash",
+                script: "",
+                declared_outputs: [],
+                declared_inputs: [],
+                secret_refs: [],
+            },
+            order: wf.steps.length,
+            on_failure: "stop",
+            max_retries: 0,
+        });
+    };
+
+    const moveStep = (from: number, pos: number) => {
+        const next = [...sortedSteps];
+        const [item] = next.splice(from, 1);
+        const target = from < pos ? pos - 1 : pos;
+        next.splice(target, 0, item);
+        setWf({ ...wf, steps: resequence(next) });
+        if (selected === from) setSelected(target);
+        else if (selected !== null) {
+            if (from < selected && target >= selected) setSelected(selected - 1);
+            else if (from > selected && target <= selected) setSelected(selected + 1);
+        }
+    };
+
+    const handleDrop = (e: React.DragEvent, pos: number) => {
+        e.preventDefault();
+        setDragOverZone(null);
+        const raw = e.dataTransfer.getData("text/plain");
+        if (!raw) return;
+        let payload: DragPayload;
+        try {
+            payload = JSON.parse(raw);
+        } catch {
+            return;
+        }
+        if (payload.kind === "lib") {
+            insertLibStep(payload.stepId, pos);
+        } else if (payload.kind === "move") {
+            moveStep(payload.from, pos);
+        }
+    };
+
+    const updateRef = (idx: number, patch: Partial<WorkflowStepRef>) =>
+        setWf({
+            ...wf,
+            steps: wf.steps.map((r, i) => (i === idx ? { ...r, ...patch } : r)),
+        });
+
+    const updateInline = (idx: number, patch: Partial<WorkflowStep>) =>
+        setWf({
+            ...wf,
+            steps: wf.steps.map((r, i) => (i === idx && r.inline ? { ...r, inline: { ...r.inline, ...patch } } : r)),
+        });
+
+    const removeStep = (idx: number) => {
+        const remaining = resequence(wf.steps.filter((_, i) => i !== idx));
+        setWf({ ...wf, steps: remaining });
+        setSelected(null);
+    };
+
+    const toggleSecretRef = (ref: string) => {
+        if (selectedIdxInWf === -1 || !selectedRef) return;
+        if (selectedRef.inline) {
+            const current = selectedRef.inline.secret_refs ?? [];
+            const next = current.includes(ref) ? current.filter((r) => r !== ref) : [...current, ref];
+            updateInline(selectedIdxInWf, { secret_refs: next });
+            return;
+        }
+        const current = selectedRef.overrides?.secret_refs ?? [];
+        const next = current.includes(ref) ? current.filter((r) => r !== ref) : [...current, ref];
+        updateRef(selectedIdxInWf, { overrides: { ...selectedRef.overrides, secret_refs: next } });
+    };
+
+    const upstreamOutputsFor = (i: number) => Array.from(new Set(sortedSteps.slice(0, i).flatMap((r) => r.inline?.declared_outputs ?? libById(r.step_id)?.declared_outputs ?? [])));
+
+    const DropZone = ({ pos }: { pos: number }) => (
+        <div
+            className={`h-3 w-full transition-all ${dragOverZone === pos ? "h-8 rounded bg-signal/15 border border-dashed border-signal/50" : ""}`}
+            onDragOver={(e) => {
+                e.preventDefault();
+                setDragOverZone(pos);
+            }}
+            onDragLeave={() => setDragOverZone((z) => (z === pos ? null : z))}
+            onDrop={(e) => handleDrop(e, pos)}
+        />
+    );
+
+    return (
+        <>
+            <div className="flex items-center gap-3 border-b border-border bg-surface px-4 py-3">
+                <span className="h-2.5 w-2.5 rounded-full bg-signal" />
+                <div className="flex items-center gap-1.5 text-sm">
+                    <span className="text-text-secondary">Workflows /</span>
+                    <span className="font-medium text-text-primary">{wf.name}</span>
+                    <span className="text-text-secondary">· {saving ? "Saving…" : lastSaved ? `Saved ${timeAgo(lastSaved)}` : ""}</span>
+                </div>
+                <div className="ml-auto flex items-center gap-2">
+                    <span className="rounded-full border border-border bg-surface-2 px-3 py-1 text-xs text-text-secondary">{wf.target_server_ids.length} servers</span>
+                    <Link href={`/workflows/${id}/runs`} className="rounded-lg border border-border bg-surface-2 px-3 py-1.5 text-sm text-text-secondary hover:text-text-primary">
+                        Runs
+                    </Link>
+                    <Button variant="secondary" size="sm" onClick={() => setEditWorkflowOpen(true)}>
+                        Edit
+                    </Button>
+                    <Button size="sm" loading={running} onClick={run} className="bg-signal text-signal-ink border-transparent hover:bg-signal/90">
+                        Run workflow
+                    </Button>
+                </div>
+            </div>
+
+            {error && <div className="border-b border-danger/30 bg-danger/10 px-4 py-2 text-sm text-danger">{error}</div>}
+            {notice && <div className="border-b border-signal/30 bg-signal/10 px-4 py-2 text-sm text-signal">{notice}</div>}
+
+            <div className="grid h-[calc(100vh-53px)] grid-cols-[1fr_320px]">
+                {/* CENTER: canvas */}
+                <main className="overflow-auto bg-background bg-[radial-gradient(circle_at_1px_1px,theme(colors.border)_1px,transparent_0)] bg-[length:22px_22px] p-8">
+                    <div className="pointer-events-none sticky top-0 z-10 flex justify-center pt-4">
+                        <button
+                            onClick={() => setPickerOpen(true)}
+                            className="pointer-events-auto inline-flex items-center gap-2 rounded-[9px] bg-signal px-4 py-2.5 text-sm font-semibold text-signal-ink shadow-[0_6px_20px_rgba(245,165,36,0.28)] hover:bg-signal/90"
+                        >
+                            <span className="text-base leading-none">+</span> Add step
+                        </button>
+                    </div>
+                    <div className="mx-auto flex w-[340px] flex-col items-center">
+                        <DropZone pos={0} />
+                        {sortedSteps.map((ref, i) => {
+                            const lib = libById(ref.step_id);
+                            const outs = upstreamOutputsFor(i);
+                            const script = ref.inline?.script ?? ref.overrides?.script ?? lib?.script ?? "";
+                            const wfIdx = wf.steps.indexOf(ref);
+                            const isSelected = selected === i;
+                            return (
+                                <div key={wfIdx} className="w-full">
+                                    {i > 0 && (
+                                        <div className="flex flex-col items-center py-1">
+                                            <div className="h-[13px] w-0.5 bg-border" />
+                                            {outs.length > 0 && (
+                                                <div className="flex w-fit max-w-[300px] flex-wrap items-center justify-center gap-1 rounded-full border border-dashed border-signal/55 bg-surface px-3 py-1">
+                                                    <span className="text-[10px] uppercase text-text-secondary">passes</span>
+                                                    {outs.map((o) => (
+                                                        <span key={o} className="rounded bg-signal px-2 py-0.5 font-mono text-[11px] text-signal-ink">
+                                                            {o}
+                                                        </span>
+                                                    ))}
+                                                </div>
+                                            )}
+                                            <div className="h-[13px] w-0.5 bg-border" />
+                                        </div>
+                                    )}
+                                    <div
+                                        draggable
+                                        onDragStart={(e) => {
+                                            e.dataTransfer.setData("text/plain", JSON.stringify({ kind: "move", from: i }));
+                                        }}
+                                        onClick={() => setSelected(i)}
+                                        className={`w-[340px] cursor-pointer rounded-[10px] border bg-surface p-3 ${isSelected ? "border-signal ring-2 ring-signal/40" : "border-border"}`}
+                                    >
+                                        <div className="mb-2 flex items-center gap-2">
+                                            <span className="grid h-5 w-5 place-items-center rounded border border-border font-mono text-[10px] text-text-secondary">{i + 1}</span>
+                                            <span className="text-sm font-medium text-text-primary">{ref.inline?.name ?? lib?.name ?? ref.step_id}</span>
+                                            {ref.inline && <ShellBadge interpreter={ref.inline.interpreter} />}
+                                            {lib && !ref.inline && <ShellBadge interpreter={lib.interpreter} />}
+                                            {ref.inline && <AdhocBadge />}
+                                        </div>
+                                        <pre className="max-h-16 overflow-hidden text-ellipsis whitespace-pre-wrap rounded border border-border bg-surface-2 p-2 font-mono text-xs text-text-secondary">
+                                            {script.slice(0, 200)}
+                                        </pre>
+                                    </div>
+                                    <DropZone pos={i + 1} />
+                                </div>
+                            );
+                        })}
+                        {sortedSteps.length === 0 && (
+                            <button
+                                onDragOver={(e) => e.preventDefault()}
+                                onDrop={(e) => handleDrop(e, 0)}
+                                onClick={() => setPickerOpen(true)}
+                                className="mt-2 w-full rounded-[10px] border border-dashed border-border bg-surface py-6 text-sm text-text-secondary hover:border-signal/50 hover:text-text-primary"
+                            >
+                                + Add your first step
+                            </button>
+                        )}
+                    </div>
+                </main>
+
+                {/* RIGHT: inspector */}
+                <aside className="overflow-auto border-l border-border bg-surface p-4">
+                    {selected === null || !selectedRef ? (
+                        <p className="text-sm text-text-secondary">Select a step to configure it.</p>
+                    ) : (
+                        <div className="space-y-4">
+                            <div>
+                                <div className="mb-1 text-[11px] font-bold uppercase tracking-wide text-text-secondary">Step {selected + 1} · Inspector</div>
+                                <div className="flex items-center gap-2">
+                                    {selectedRef.inline && <ShellBadge interpreter={selectedRef.inline.interpreter} />}
+                                    {selectedLib && !selectedRef.inline && <ShellBadge interpreter={selectedLib.interpreter} />}
+                                    {selectedRef.inline && <AdhocBadge />}
+                                    <h2 className="text-sm font-bold text-text-primary">{selectedRef.inline?.name ?? selectedLib?.name ?? selectedRef.step_id}</h2>
+                                </div>
+                            </div>
+
+                            {selectedRef.inline ? (
+                                <div className="space-y-4 border-b border-border pb-4">
+                                    <div>
+                                        <label className="mb-1 block text-xs uppercase text-text-secondary">Name</label>
+                                        <input className={inputClass} value={selectedRef.inline.name} onChange={(e) => updateInline(selectedIdxInWf, { name: e.target.value })} />
+                                    </div>
+                                    <div>
+                                        <label className="mb-1 block text-xs uppercase text-text-secondary">Interpreter</label>
+                                        <select
+                                            className={inputClass}
+                                            value={selectedRef.inline.interpreter}
+                                            onChange={(e) =>
+                                                updateInline(selectedIdxInWf, {
+                                                    interpreter: e.target.value as WorkflowStep["interpreter"],
+                                                })
+                                            }
+                                        >
+                                            <option value="bash">bash</option>
+                                            <option value="powershell">powershell</option>
+                                        </select>
+                                    </div>
+                                    <div>
+                                        <label className="mb-1 block text-xs uppercase text-text-secondary">Command</label>
+                                        <textarea
+                                            className={`${inputClass} h-32 font-mono text-xs`}
+                                            value={selectedRef.inline.script}
+                                            onChange={(e) => updateInline(selectedIdxInWf, { script: e.target.value })}
+                                        />
+                                        <p className="mt-1 text-xs text-text-secondary">
+                                            Write <code className="text-signal">KEY=value</code> to <code className="text-signal">$WORKFLOW_ENV</code> to expose it to later steps. Outputs are derived
+                                            automatically on save.
+                                        </p>
+                                    </div>
+                                </div>
+                            ) : (
+                                <div className="border-b border-border pb-4">
+                                    <label className="mb-1 block text-xs uppercase text-text-secondary">Command</label>
+                                    <textarea
+                                        className={`${inputClass} h-32 font-mono text-xs`}
+                                        value={selectedRef.overrides?.script ?? selectedLib?.script ?? ""}
+                                        onChange={(e) =>
+                                            updateRef(selectedIdxInWf, {
+                                                overrides: { ...selectedRef.overrides, script: e.target.value },
+                                            })
+                                        }
+                                    />
+                                    <p className="mt-1 text-xs text-text-secondary">
+                                        Write <code className="text-signal">KEY=value</code> to <code className="text-signal">$WORKFLOW_ENV</code> to expose it to later steps.
+                                    </p>
+                                </div>
+                            )}
+
+                            {(selectedRef.inline?.declared_inputs ?? selectedLib?.declared_inputs ?? []).length > 0 && (
+                                <div className="border-b border-border pb-4">
+                                    <label className="mb-2 block text-xs uppercase text-text-secondary">Inputs</label>
+                                    <div className="space-y-2">
+                                        {(selectedRef.inline?.declared_inputs ?? selectedLib?.declared_inputs ?? []).map((param) => (
+                                            <div key={param.name}>
+                                                <div className="mb-1 font-mono text-xs text-text-primary">{param.name}</div>
+                                                {param.description && <div className="mb-1 text-[11px] text-text-secondary">{param.description}</div>}
+                                                <input
+                                                    className={inputClass}
+                                                    placeholder={param.default}
+                                                    value={selectedRef.inputs?.[param.name] ?? ""}
+                                                    onChange={(e) =>
+                                                        updateRef(selectedIdxInWf, {
+                                                            inputs: { ...selectedRef.inputs, [param.name]: e.target.value },
+                                                        })
+                                                    }
+                                                />
+                                            </div>
+                                        ))}
+                                    </div>
+                                </div>
+                            )}
+
+                            <div className="border-b border-border pb-4">
+                                <label className="mb-2 block text-xs uppercase text-text-secondary">Inputs · from upstream</label>
+                                <div className="flex flex-wrap gap-1">
+                                    {upstreamOutputsFor(selected).length === 0 && <p className="text-xs text-text-secondary">No upstream outputs.</p>}
+                                    {upstreamOutputsFor(selected).map((o) => (
+                                        <span key={o} className="flex items-center gap-1 rounded bg-surface-2 border border-border px-2 py-0.5 font-mono text-[11px] text-text-primary">
+                                            <span className="text-[9px] uppercase text-text-secondary">in</span>
+                                            {o}
+                                        </span>
+                                    ))}
+                                </div>
+                            </div>
+
+                            <div className="border-b border-border pb-4">
+                                <label className="mb-2 block text-xs uppercase text-text-secondary">Outputs · to $WORKFLOW_ENV</label>
+                                <div className="flex flex-wrap gap-1">
+                                    {(selectedRef.inline?.declared_outputs ?? selectedLib?.declared_outputs ?? []).length === 0 && <p className="text-xs text-text-secondary">No declared outputs.</p>}
+                                    {(selectedRef.inline?.declared_outputs ?? selectedLib?.declared_outputs ?? []).map((o) => (
+                                        <span key={o} className="flex items-center gap-1 rounded bg-signal px-2 py-0.5 font-mono text-[11px] text-signal-ink">
+                                            <span className="text-[9px] uppercase">out</span>
+                                            {o}
+                                        </span>
+                                    ))}
+                                </div>
+                            </div>
+
+                            <div className="border-b border-border pb-4">
+                                <label className="mb-2 block text-xs uppercase text-text-secondary">Secret refs</label>
+                                <div className="max-h-56 space-y-2 overflow-auto rounded-lg border border-border p-2">
+                                    {secretGroups?.map((g) => (
+                                        <div key={g.group}>
+                                            <div className="font-mono text-[11px] font-semibold text-text-secondary">{g.group}</div>
+                                            {(groupKeys[g.group] ?? []).map((key) => {
+                                                const ref = `${g.group}/${key}`;
+                                                const checked = (selectedRef.inline ? (selectedRef.inline.secret_refs ?? []) : (selectedRef.overrides?.secret_refs ?? [])).includes(ref);
+                                                return (
+                                                    <label key={ref} className="ml-2 flex cursor-pointer items-center gap-2 text-xs text-text-primary">
+                                                        <input type="checkbox" className="accent-signal" checked={checked} onChange={() => toggleSecretRef(ref)} />
+                                                        <span className="font-mono">{key}</span>
+                                                    </label>
+                                                );
+                                            })}
+                                            {(groupKeys[g.group] ?? []).length === 0 && <p className="ml-2 text-[11px] text-text-secondary">No keys.</p>}
+                                        </div>
+                                    ))}
+                                    {secretGroups && secretGroups.length === 0 && <p className="text-xs text-text-secondary">No secret groups yet.</p>}
+                                </div>
+                            </div>
+
+                            <div className="border-b border-border pb-4">
+                                <label className="mb-1 block text-xs uppercase text-text-secondary">On failure</label>
+                                <select
+                                    className={inputClass}
+                                    value={selectedRef.on_failure}
+                                    onChange={(e) =>
+                                        updateRef(selectedIdxInWf, {
+                                            on_failure: e.target.value as WorkflowStepRef["on_failure"],
+                                        })
+                                    }
+                                >
+                                    <option value="stop">Stop workflow</option>
+                                    <option value="continue">Continue</option>
+                                    <option value="retry">Retry</option>
+                                </select>
+                                {selectedRef.on_failure === "retry" && (
+                                    <div className="mt-2">
+                                        <label className="mb-1 block text-xs uppercase text-text-secondary">Max retries</label>
+                                        <input
+                                            type="number"
+                                            min={1}
+                                            className={inputClass}
+                                            value={selectedRef.max_retries}
+                                            onChange={(e) => updateRef(selectedIdxInWf, { max_retries: parseInt(e.target.value || "0", 10) })}
+                                        />
+                                    </div>
+                                )}
+                            </div>
+
+                            <Button variant="danger" size="sm" onClick={() => removeStep(selectedIdxInWf)}>
+                                Remove from workflow
+                            </Button>
+                        </div>
+                    )}
+                </aside>
+            </div>
+
+            <EditWorkflowModal
+                open={editWorkflowOpen}
+                workflow={wf}
+                onSaved={(w) => {
+                    // The modal already persisted w; sync the snapshot so
+                    // autosave doesn't fire a redundant follow-up save.
+                    savedSnapshotRef.current = snapshotOf(w);
+                    setWf(w);
+                }}
+                onClose={() => setEditWorkflowOpen(false)}
+            />
+            <StepPickerModal
+                open={pickerOpen}
+                onClose={() => setPickerOpen(false)}
+                onSelect={(stepId) => insertLibStep(stepId, sortedSteps.length)}
+                onAddAdhoc={() => {
+                    addAdhocStep();
+                    setPickerOpen(false);
+                }}
+                onImportAdhoc={async (file) => {
+                    setPickerOpen(false);
+                    setImportingInline(true);
+                    setError(null);
+                    try {
+                        const doc = JSON.parse(await file.text());
+                        const step = await api.parseStep(doc);
+                        appendRef({ inline: step, order: wf.steps.length, on_failure: "stop", max_retries: 0 });
+                    } catch (err) {
+                        setError((err as Error).message);
+                    } finally {
+                        setImportingInline(false);
+                    }
+                }}
+            />
+        </>
+    );
+}