feat: open Athena tool architecture

dev/test_athena_operator.py

@@ -85,12 +85,32 @@ class OperatorTests(unittest.TestCase):
         with self.assertRaises(RuntimeError):
             self.module.execute({"ticket": proposal["ticket"], "confirmation": proposal["required_confirmation"]})
 
-    def test_remote_access_and_power_operations_do_not_exist(self):
+    def test_structured_power_operations_do_not_exist(self):
         self.assertNotIn("shell", self.module.ALLOWED_OPERATIONS)
         for operation in ("shutdown", "reboot", "ssh", "network", "command"):
             with self.assertRaises(ValueError):
                 self.module.normalise_operation(operation, {})
 
+    def test_general_terminal_runs_normal_work(self):
+        calls = []
+        self.module.run = lambda argv, **kwargs: calls.append((argv, kwargs)) or {
+            "argv": argv, "exit_code": 0, "output": "ok"
+        }
+        result = self.module.terminal({"command": "docker ps", "cwd": str(self.stack)})
+        self.assertEqual(result["exit_code"], 0)
+        self.assertEqual(calls[0][0], ["/bin/bash", "-lc", "docker ps"])
+        self.assertEqual(result["reachability_guard"], "active")
+
+    def test_general_terminal_blocks_reachability_changes(self):
+        blocked = (
+            "shutdown -h now", "systemctl restart ssh", "iptables -F",
+            "ip route del default", "umount /data", "nano /etc/ssh/sshd_config",
+            "docker restart mike-ai-wireguard-gateway",
+        )
+        for command in blocked:
+            with self.subTest(command=command), self.assertRaises(PermissionError):
+                self.module.terminal({"command": command, "cwd": str(self.stack)})
+
     def test_wireguard_gateway_cannot_be_stopped(self):
         with self.assertRaises(PermissionError):
             self.module.normalise_operation("container_action", {"action": "stop", "containers": ["mike-ai-wireguard-gateway"]})

dev/test_openwebui_filters.py

@@ -161,7 +161,7 @@ class StabilityGuardTests(unittest.IsolatedAsyncioTestCase):
 
     async def test_private_csv_stops_before_openwebui_hard_tool_limit(self):
         calls = []
-        for index in range(6):
+        for index in range(8):
             calls.extend(
                 [
                     {
@@ -213,6 +213,12 @@ class AutoToolSelectorTests(unittest.IsolatedAsyncioTestCase):
             result["tool_ids"], ["server:mcp:homeassistant-local"]
         )
 
+    async def test_general_web_is_available_without_site_specific_rules(self):
+        result = await self._select("Erkläre mir kurz, wie ein Fahrrad funktioniert.")
+        self.assertTrue(result["features"]["web_search"])
+        self.assertTrue(result["metadata"]["features"]["web_search"])
+        self.assertNotIn("tool_ids", result)
+
     async def test_weather_uses_native_web_without_mcp(self):
         result = await self._select("Soll es heute in Rastatt regnen?")
         self.assertNotIn("tool_ids", result)
@@ -309,15 +315,19 @@ class AutoToolSelectorTests(unittest.IsolatedAsyncioTestCase):
             ["server:mcp:github-local", "server:mcp:athena-operator-local"],
         )
 
-    async def test_existing_unraid_backend_beats_duplicate_operator_plan(self):
+    async def test_existing_unraid_backend_gets_operator_and_runtime_evidence(self):
         result = await self._select(
             "Baue aus https://github.com/foo/deemix einen MCP. Deemix läuft bereits als Container auf Unraid; prüfe ihn zuerst."
         )
         self.assertEqual(
             result["tool_ids"],
-            ["server:mcp:github-local", "server:mcp:mua-readonly-local"],
+            [
+                "server:mcp:github-local",
+                "server:mcp:athena-operator-local",
+                "server:mcp:mua-readonly-local",
+            ],
         )
-        self.assertIn("Never compensate", result["messages"][0]["content"])
+        self.assertIn("integrate or relay", result["messages"][0]["content"])
 
     async def test_github_and_explicit_web_only_adds_github_mcp(self):
         result = await self._select(

dev/verify_mcp_catalogs.sh

@@ -18,8 +18,11 @@ verify http://mike-ai-mcp-platform-context:8000/mcp \
   --max-tools 12 --max-schema-chars 12000
 verify http://mike-ai-mcp-athena-operator:8000/mcp \
   --max-tools 8 --max-schema-chars 12000
-verify http://mike-ai-mcp-web:8000/mcp \
-  --max-tools 8 --max-schema-chars 12000
+verify http://tinysearch:8000/mcp \
+  --require search \
+  --require scrape_urls \
+  --require research \
+  --max-tools 6 --max-schema-chars 12000
 
 if docker inspect mike-ai-mcp-github >/dev/null 2>&1; then
   verify http://mike-ai-mcp-github:8000/mcp \