fix `process_chat 'parameters' KeyError + SOUL self-iteration + brand

OWUI's process_chat:2013 unwraps spec["parameters"] for every bound
tool. The OpenUI tool was installed with specs=[] (operator-flagged
chat 2026-05-17 truncated at literal `'parameters'` -- the agent's
response WAS the KeyError string surfacing as content). mios_verbs
specs also lacked parameters and listed two methods that no longer
exist on the Tools class (everything_search, mios_apps). Fixed both:

* mios-owui-install-tools: rewrote `specs` list to match the actual
  3-method Tools class (launch_app, mios_find, system_status) with
  full JSONSchema parameters blocks. Live DB patched in-place; next
  rebuild starts correct.

* mios-owui-install-pipe: hand-built openui spec with parameters
  (one method render_openui taking openui_lang_code + optional
  title). Live DB patched in-place.

* hermes-soul.md: added "Self-improvement -- fork and iterate"
  section + clone verbs in the helpers table (mios-skill-clone,
  mios-tool-clone). Operator 2026-05-17: "agentic agents like
  Hermes should understand that tools and skills can be updated/
  iterated on -- making copies and improving them -- Hermes should
  be able to do this natively". The verbs and writable resolver
  paths existed since 2026-05-15; SOUL.md just didn't tell the
  agent. Added when-to-fork heuristic + WHY-stamp convention.

* MiOS-Agent dropdown description tightened a third time per
  operator: "Local agent. Offline. Locale-aware." -> "local-first
  Agent for MiOS systems". Live DB patched across function meta +
  both bound-model rows.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mios-dev

usr/libexec/mios/mios-owui-install-pipe

@@ -87,7 +87,7 @@ print(json.dumps({
     "name": pname,
     "content": content,
     "meta": {
-        "description": "Local agent. Offline. Locale-aware.",
+        "description": "local-first Agent for MiOS systems",
         "manifest": {},
     },
     "type": "pipe",
@@ -156,7 +156,7 @@ print(json.dumps({
     "name": mname,
     "meta": {
         "profile_image_url": "/static/favicon.png",
-        "description": "Local agent. Offline. Locale-aware.",
+        "description": "local-first Agent for MiOS systems",
         "capabilities": {"vision": False, "citations": True},
         # Native MiOS tool surface -- the model SEES these in its
         # tool_calls list (no `terminal: mios-<verb>` indirection).

usr/libexec/mios/mios-owui-install-tools

@@ -95,16 +95,50 @@ def main() -> int:
     if attached:
         c.commit()
 
-    # Build specs JSON. OWUI's loader extracts the schema from
-    # type hints + docstrings at runtime, but the `specs` column is
-    # also used as a quick reference for the admin UI. Compute the
-    # minimal spec list now; if a method signature changes the next
-    # firstboot run will re-derive on hash mismatch.
+    # Build specs JSON. OWUI's chat-completion path indexes into
+    # spec["parameters"] (open_webui.main:process_chat) so every spec
+    # MUST carry a JSONSchema parameters block -- a partial spec list
+    # (missing `parameters`) crashes the entire chat with KeyError:
+    # 'parameters'. Keep this list in lockstep with the actual Tools
+    # class methods in /usr/share/mios/owui/tools/mios_verbs.py.
     specs = [
-        {"name": "launch_app",        "description": "Launch a MiOS-registered app by short name (Steam/Epic/Xbox/flatpak/.exe/.lnk)"},
-        {"name": "everything_search", "description": "Search Windows NTFS index via Voidtools es.exe (sub-100ms)"},
-        {"name": "mios_apps",         "description": "Inventory installed apps across all sources"},
-        {"name": "mios_find",         "description": "Look up one app's launch info (fast single-shot)"},
+        {
+            "name": "launch_app",
+            "description": "Launch a MiOS-registered Windows/Linux app by short name. Resolves through the canonical chain (Steam/Epic/Xbox/GOG/Battle.net via protocol handler, Windows shortname, MiOS shim, Linux GUI, plain CLI). Dispatch only -- launch is detached.",
+            "parameters": {
+                "type": "object",
+                "properties": {
+                    "name": {
+                        "type": "string",
+                        "description": "App short name. Case-insensitive substring matches against the Windows games inventory; exact for shortnames. Examples: \"beamng\", \"notepad\", \"chromedev\", \"marvel rivals\".",
+                    }
+                },
+                "required": ["name"],
+            },
+        },
+        {
+            "name": "mios_find",
+            "description": "Resolve an app's launch info without launching it (read-only). Returns the canonical command the launcher would execute. Use this when you want to know whether something is installed / how it would be invoked.",
+            "parameters": {
+                "type": "object",
+                "properties": {
+                    "name": {
+                        "type": "string",
+                        "description": "App short name (same matching rules as launch_app).",
+                    }
+                },
+                "required": ["name"],
+            },
+        },
+        {
+            "name": "system_status",
+            "description": "Snapshot of host MiOS state: active services, container status, last journal errors, GPU/CPU/RAM headline numbers. Read-only -- safe to call without side effects.",
+            "parameters": {
+                "type": "object",
+                "properties": {},
+                "required": [],
+            },
+        },
     ]
 
     meta = {

usr/share/mios/ai/hermes-soul.md

@@ -120,6 +120,8 @@ boundary (operator secret, hardware fault).
 | `mios-restart <svc>` | Graceful systemd restart (for MiOS services). |
 | `mios-doctor` | Health probe. |
 | `mios-env-probe` | Runtime snapshot. |
+| `mios-skill-clone <name> [--as <new>]` | Fork a vendor skill into `$HERMES_HOME/skills/` so you can edit it. Same-name fork overrides on next load. |
+| `mios-tool-clone <name> [--as <new>]` | Fork a vendor shim into `/usr/local/bin/` (precedes `/usr/libexec/mios` on PATH). |
 
 State paths (read freely):
 - `/var/lib/mios/scratch/` — inter-agent shared scratch (mode 1777)
@@ -257,6 +259,42 @@ For standalone markdown editing (the operator types + sees rendered
 preview): `terminal: mios-md [<file>] [--text "<inline>"]` opens the
 vendored snarkdown viewer in their browser.
 
+## Self-improvement — fork and iterate
+
+Your tools and skills are **mutable**. When a vendor skill or shim
+doesn't quite fit a recurring task, fork it and improve it — don't
+work around it forever.
+
+Skills:
+- `terminal: mios-skill-clone <name>` forks
+  `/usr/share/mios/hermes/skills/<name>/` into
+  `$HERMES_HOME/skills/<name>/`. The resolver loads your copy first.
+- Edit `$HERMES_HOME/skills/<name>/SKILL.md` (and support files) with
+  `write_file` or `terminal: $EDITOR …`. The next turn loads it.
+- Use `--as <new-name>` to ship a sibling skill instead of overriding.
+- `skill_manage` (native tool) handles CRUD on the metadata side; pair
+  it with `mios-skill-clone` for the file payload.
+
+Shims (`mios-*` helpers):
+- `terminal: mios-tool-clone <name>` copies the vendor shim into
+  `/usr/local/bin/`, which precedes `/usr/libexec/mios` on PATH.
+- Edit the local copy; next call uses it.
+- For brand-new shims with no parent to clone: `write_file
+  /usr/local/bin/<name>` + `terminal: chmod +x /usr/local/bin/<name>`.
+
+When to fork (operator directive 2026-05-15: "Hermes should be
+properly improving skills and tools iteratively"):
+- A skill keeps producing the wrong shape for a task you do often →
+  clone, tighten the SKILL.md prompt, ship.
+- A shim is missing a flag you need → clone, add the flag, ship.
+- A new recurring workflow doesn't match any existing skill → write
+  a new one rather than re-deriving the steps every turn.
+
+Always stamp WHY in a one-line comment at the top of the edit
+(operator 2026-05-DD: "<their words>" or a short root-cause note).
+Don't fork pre-emptively — fork when you've hit the same failure
+twice.
+
 ## Long-form detail
 
 `hermes-soul-full.md` ships alongside this file. Load it