Simplify Athena operator architecture

platform/mcp/install-tools.sh

@@ -17,26 +17,22 @@ export SEARXNG_SETTINGS_FILE="${SEARXNG_SETTINGS_FILE:-$MCP_DIR/../web-search/se
   exit 1
 }
 
-# The platform context MCP never receives the Docker socket. A root-owned
-# timer writes a bounded metadata snapshot instead. Only documentation files
-# and the dedicated state directory are writable by the unprivileged MCP uid.
+# The read-only platform context MCP never receives the Docker socket. A
+# root-owned timer writes a bounded metadata snapshot instead.
 install -d -m 0755 /usr/local/libexec /var/lib/mike-ai-platform-context
-install -d -o 10001 -g 10001 -m 0750 /data/mike-ai-platform-context
 install -m 0755 "$MCP_DIR/platform-context-snapshot.py" \
   /usr/local/libexec/mike-ai-platform-context-snapshot
 install -m 0644 "$MCP_DIR/../systemd/mike-ai-platform-context-snapshot.service" \
   /etc/systemd/system/mike-ai-platform-context-snapshot.service
 install -m 0644 "$MCP_DIR/../systemd/mike-ai-platform-context-snapshot.timer" \
   /etc/systemd/system/mike-ai-platform-context-snapshot.timer
-find /opt/mike-ai/stack/docs -type d -exec chown root:10001 {} + -exec chmod 0775 {} +
-find /opt/mike-ai/stack/docs -type f -name '*.md' -exec chown root:10001 {} + -exec chmod 0664 {} +
 systemctl daemon-reload
 systemctl enable --now mike-ai-platform-context-snapshot.timer
 systemctl start mike-ai-platform-context-snapshot.service
 
-# One user-facing Athena Operator MCP controls the complete local AI platform
-# through a root-side structured executor. It is intentionally not a general
-# shell and exposes no raw Docker socket or host paths to the MCP container.
+# One user-facing Athena Operator MCP controls the local AI platform through a
+# root-side executor. The facade exposes six bounded tools and no Docker socket
+# or host paths to its unprivileged container.
 "$MCP_DIR/../operator/install-operator.sh"
 
 profiles=()