Improve external service discovery and tool routing

config/operator-system-prompt.txt

@@ -65,6 +65,15 @@ failure. For public information make at most one focused fallback attempt with
 the general web tool, then synthesize the available evidence or stop clearly.
 Never enter a fallback or synonym-search loop.
 
+Before designing, installing or migrating a backend, query the versioned
+external-service catalog and then the listed specialist tool. Existing services
+on Unraid or elsewhere in the home network are dependencies to integrate, not
+components to duplicate. If inventory or specialist verification is missing,
+disabled, unreachable or inconclusive, stop and ask the user. Never fill that
+knowledge gap by proposing or deploying a replacement service. A duplicate is
+allowed only when the user explicitly requests migration, replacement,
+redundancy or an isolated experiment after the existing service was identified.
+
 For models and GPU services, introduce changes only through the experimental
 profile or an isolated container. Change one variable at a time, record source,
 license, revision, size and SHA256, account for weights, KV cache, projector,

config/service-catalog.json

@@ -0,0 +1,44 @@
+{
+  "version": 1,
+  "updated": "2026-08-23",
+  "scope": "Verified external services used by Athena; no credentials or secret values.",
+  "services": [
+    {
+      "id": "unraid",
+      "name": "HomeServer Unraid",
+      "location": "home-network",
+      "host": "homeserver.fritz.box",
+      "address": "192.168.1.2",
+      "port": 5001,
+      "protocol": "https",
+      "probe": "tcp",
+      "specialist_tool": "unraid-readonly-local",
+      "purpose": "Existing NAS, Docker host and storage platform. Inspect it before planning any replacement service on Athena."
+    },
+    {
+      "id": "mua",
+      "name": "MUA Unraid management",
+      "location": "home-network",
+      "host": "192.168.1.2",
+      "address": "192.168.1.2",
+      "port": 3002,
+      "protocol": "http",
+      "probe": "tcp",
+      "specialist_tool": "mua",
+      "purpose": "Explicitly enabled Unraid management actions; not the default diagnostic path."
+    },
+    {
+      "id": "deemix",
+      "name": "Existing Deemix on Unraid",
+      "location": "unraid-container",
+      "host": "192.168.1.2",
+      "address": "192.168.1.2",
+      "port": 6595,
+      "protocol": "http",
+      "probe": "http-head",
+      "probe_path": "/",
+      "specialist_tool": "unraid-readonly-local",
+      "purpose": "Existing Deemix backend and download location. An Athena MCP must integrate this instance over WireGuard; it must not create a second Deemix unless the user explicitly requests migration or replacement."
+    }
+  ]
+}