skeleton: package, schema, config, CLI, alembic, CI, deploy, docs

- cayceops core: env-only config (CAYCE_OPS_*), engine/session, ORM models
  with state machines (proposal/mail/content) and audited writes
- provider-agnostic LLM interface (null provider default, stdlib openai-compat)
- Typer CLI with lazy component loading (scanner/executor/maild/publisher/monitor)
- alembic 0001 initial schema; sqlite-portable JSON columns
- tests: 7 passing on throwaway sqlite; fixtures invented, never real data
- ci: ruff + alembic smoke + pytest + gitleaks(full history) in
  .gitea/workflows + .github/workflows; local gate = make check
- deploy: docker-compose (postgres 16) + hardened systemd units/timers
- docs: DECISIONS D1-D9; README project (grant text retired)

deploy/systemd/README.md

@@ -0,0 +1,24 @@
+# systemd deployment (VPS)
+
+This is the primary deployment path (docker-compose is for local dev).
+
+```bash
+sudo useradd -r -m -d /srv/cayce-ops cayce
+rsync -a --exclude .venv ./ cayce@vm:/srv/cayce-ops/
+sudo -u cayce uv sync --frozen
+sudo -u cayce cayceops db upgrade          # alembic to head
+sudo cp deploy/systemd/cayce-ops@.service deploy/systemd/cayce-ops@.timer /etc/systemd/system/
+
+# cadence per daemon (edit OnCalendar in each timer copy):
+#   scanner  hourly      executor  */10 min      maild  */5 min
+#   publisher */5 min    monitor   */1 min
+for d in scanner executor maild publisher monitor; do
+  sudo cp deploy/systemd/cayce-ops@.timer /etc/systemd/system/cayce-ops@$d.timer
+done
+# adjust OnCalendar per timer, then:
+sudo systemctl daemon-reload
+sudo systemctl enable --now cayce-ops@{scanner,executor,maild,publisher,monitor}.timer
+```
+
+The unit hardens the daemon (NoNewPrivileges, ProtectSystem=strict) and reads
+secrets only from `/srv/cayce-ops/.env` (never in the repo).

deploy/systemd/cayce-ops@.service

@@ -0,0 +1,19 @@
+# Unit template — the same file is instantiated per daemon with different ExecStart.
+# Deploy: cp deploy/systemd/cayce-ops@.service /etc/systemd/system/
+#         systemctl enable --now cayce-ops@scanner.timer
+
+[Unit]
+Description=cayce-ops %i daemon
+After=network-online.target postgresql.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=cayce
+WorkingDirectory=/srv/cayce-ops
+EnvironmentFile=/srv/cayce-ops/.env
+ExecStart=/srv/cayce-ops/.venv/bin/cayceops %i run
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/srv/cayce-ops

deploy/systemd/cayce-ops@.timer

@@ -0,0 +1,15 @@
+# Timer template — instantiated per daemon.
+#   systemctl enable --now cayce-ops@scanner.timer
+# Cadence per daemon: scanner 1h, executor 10m, maild 5m, publisher 5m, monitor 1m.
+# Copy and edit the OnCalendar line per instance (see deploy/systemd/README.md).
+
+[Unit]
+Description=Run cayce-ops %i periodically
+
+[Timer]
+OnCalendar=*:0/10
+RandomizedDelaySec=30
+Persistent=true
+
+[Install]
+WantedBy=timers.target