docs(unlabel): un-label CLAUDE/Gemini/etc. agent docs to OpenAI-API-shape

Per the architectural rule that all agents are OpenAI-API clients of the
single MIOS_AI_ENDPOINT (Law 5: UNIFIED-AI-REDIRECTS), strip vendor
labels from every agent-identity file and from CREDITS / README prose.
Filenames preserved for tooling discovery (CLAUDE.md, GEMINI.md,
AGENTS.md, .clinerules, .cursorrules, .github/ai-instructions.md) --
content is now vendor-neutral pointers to the canonical prompt.

Specific edits:

- CLAUDE.md: header re-titled 'Agent entry point (un-labeled)'; new
  USER-variable resolution section explains the placeholder convention.
- GEMINI.md: header re-titled 'Agent entry point (un-labeled)'; native
  generativelanguage.googleapis.com explicitly noted as not used in-image.
- CLAUDE.AUDIT.md: header generalized to 'any OpenAI-API-compatible
  agent'; loading-instruction examples now show four concrete CLI forms
  (Claude Code, Gemini CLI, Codex CLI, mios-llm).
- README.md: 'your Cursor, Cline, Gemini, and Claude Code installs' was
  vendor-named; replaced with 'any OpenAI-API-compatible editor/CLI
  client (no vendor lock-in)'.
- install-mios-agents.sh: rebranded 'mios-claude'/'mios-gemini' wrapper
  binaries to 'mios-agent-claude'/'mios-agent-gemini' so the canonical
  installer has a 'mios-agent-*' generic prefix; banner messages now say
  '[agent] launching with system prompt' instead of vendor-specific
  text. mios-llm wrapper banner now spells out 'OpenAI
  /v1/chat/completions' protocol.
- CREDITS.md section 22 rewritten as 'AI agents used in this project
  (un-labeled, OpenAI-API-shaped)'. Table column renamed from 'Vendor'
  to 'Discovery file / What looks for it / OpenAI-API client wiring /
  Upstream docs (link only)'. New '$USER variable resolution at build
  entry' subsection documents the placeholder convention end-to-end:
  shell scripts use $USER/$HOME/~, PowerShell uses
  $env:USERNAME/$env:USERPROFILE, markdown aggregates use literal
  USER (substituted by bootstrap installer's sed pass), profile/env
  templates use MIOS_USER/MIOS_HOSTNAME with three-layer override. Only
  other user-related identifiers permitted are 'MiOS' (brand) and
  'mios' (default account name).

Author: Kabuki94

CLAUDE.AUDIT.md

@@ -1,9 +1,22 @@
 # CLAUDE.AUDIT.md
 
-Read-only audit-mode system prompt for Claude Code operating against
-`'MiOS'` (https://github.com/mios-dev/MiOS). Loaded with
-`claude --append-system-prompt "$(cat CLAUDE.AUDIT.md)"`. Replaces the
-runtime CLAUDE.md operating context for the duration of the audit.
+Read-only audit-mode system prompt for any OpenAI-API-compatible agent
+operating against `'MiOS'` (https://github.com/mios-dev/MiOS). Filename
+preserved for tooling discovery only -- the prompt is vendor-neutral and
+applies to every editor/CLI client routed through `MIOS_AI_ENDPOINT`.
+
+Load it as the agent's system prompt before the audit session. Examples
+(use whichever maps onto your local CLI):
+
+```
+agent --append-system-prompt "$(cat CLAUDE.AUDIT.md)"   # Claude Code
+gemini --system-prompt "$(cat CLAUDE.AUDIT.md)"         # Gemini CLI
+OPENAI_BASE_URL=$MIOS_AI_ENDPOINT codex --instructions CLAUDE.AUDIT.md
+mios-llm "$(cat CLAUDE.AUDIT.md)"                       # vendor-neutral
+```
+
+Replaces the runtime `CLAUDE.md` operating context for the duration of
+the audit.
 
 ---
 

CLAUDE.md

@@ -1,11 +1,14 @@
 # CLAUDE.md
 
-> Claude agent entry point. Pointer file -- no MiOS-internal documentation.
+> Agent entry point (un-labeled). Pointer file -- no MiOS-internal
+> documentation. The filename exists for tooling discovery only; the
+> content is vendor-neutral and OpenAI-API-shaped.
 
-MiOS targets the OpenAI public API surface at
+'MiOS' targets the OpenAI public API surface at
 `MIOS_AI_ENDPOINT=http://localhost:8080/v1` (Architectural Law 5:
-UNIFIED-AI-REDIRECTS). All Claude/Cline/Cursor/Codex/Gemini sessions resolve
-the same canonical prompt regardless of which repo they were invoked from.
+UNIFIED-AI-REDIRECTS). Every editor/CLI agent that picks up this file
+resolves the same canonical prompt regardless of which repo it was
+invoked from. No vendor branding lives in this file.
 
 ## Canonical prompt
 
@@ -23,6 +26,8 @@ Highest layer present wins; `$MIOS_AI_SYSTEM_PROMPT` overrides them all.
 |---|---|
 | API Reference | https://platform.openai.com/docs/api-reference |
 | Models catalog | https://platform.openai.com/docs/models |
+| Chat Completions | https://platform.openai.com/docs/api-reference/chat |
+| Responses | https://platform.openai.com/docs/api-reference/responses |
 | Function calling / tools | https://platform.openai.com/docs/guides/function-calling |
 | Structured outputs | https://platform.openai.com/docs/guides/structured-outputs |
 | Embeddings | https://platform.openai.com/docs/guides/embeddings |
@@ -31,10 +36,24 @@ Highest layer present wins; `$MIOS_AI_SYSTEM_PROMPT` overrides them all.
 | Moderation policy | https://platform.openai.com/docs/guides/moderation |
 | `agents.md` convention | https://agents.md/ |
 
+## USER variable resolution (build entry)
+
+Every `USER`-marked placeholder in this codebase is overridable at build
+entry. The bootstrap installer detects the running user's identity at
+install time, propagates it into `/etc/mios/install.env` and
+`~/.config/mios/profile.toml`, and substitutes the placeholder before
+the image is built. Day-0 shipped artifacts therefore default to the
+literal `USER` token wherever shell expansion is unavailable (e.g.
+inside markdown aggregates); shell scripts use `$USER`, `$HOME`,
+`$env:USERNAME`, `$env:USERPROFILE`, etc. so resolution happens at
+runtime. The only other user-related identifier permitted in the
+codebase is `mios` / `MiOS`, the project's own brand and default
+account name.
+
 ## Local trace
 
-`API.md` in this repo tracks the served subset of the OpenAI surface for the
-deployed LocalAI build. Verify any specific endpoint with
+`API.md` in this repo tracks the served subset of the OpenAI surface
+for the deployed LocalAI build. Verify any specific endpoint with
 `GET /v1/models` against `MIOS_AI_ENDPOINT` before relying on it.
 
 ## Operating context

CREDITS.md

@@ -340,40 +340,46 @@ the source of truth for a given concern. When in doubt, these win:
 | `etc/skel/.config/mios/` | User dotfile templates seeded on `useradd -m` | <https://github.com/mios-dev/mios-bootstrap/tree/main/etc/skel> |
 | `image-versions.yml` | Mirror of base-image digest pins | <https://github.com/mios-dev/mios-bootstrap/blob/main/image-versions.yml> |
 
-## 22. AI agents used in this project
-
-> **All agents in this project conform to OpenAI API standards and patterns.**
-> Architectural Law 5 (**UNIFIED-AI-REDIRECTS**): every agent listed below
+## 22. AI agents used in this project (un-labeled, OpenAI-API-shaped)
+
+> 'MiOS' treats every editor/CLI agent as an *OpenAI-API-compatible client*
+> rather than as a vendor brand. The agent-identity files in this repo
+> (`CLAUDE.md`, `GEMINI.md`, `AGENTS.md`, `.clinerules`, `.cursorrules`,
+> `.github/ai-instructions.md`) exist for tooling discovery only -- their
+> filenames are conventions the upstream tools look for; their contents
+> are vendor-neutral pointers to the same canonical prompt.
+>
+> **Architectural Law 5 -- UNIFIED-AI-REDIRECTS.** Every client below
 > resolves through `MIOS_AI_ENDPOINT=http://localhost:8080/v1`, an
-> OpenAI-public-API-compatible surface served by `etc/containers/systemd/mios-ai.container`
-> (LocalAI). Vendor-hardcoded URLs (`api.openai.com`, `api.anthropic.com`,
+> OpenAI-public-API-compatible surface served by
+> `etc/containers/systemd/mios-ai.container` (LocalAI). Vendor-native URLs
+> (`api.openai.com`, `api.anthropic.com`,
 > `generativelanguage.googleapis.com`, `api.cline.bot`, `api.cursor.com`,
 > `api.githubcopilot.com`, etc.) are forbidden in the deployed image and
-> fail audit. Each agent below is therefore a *client* of the same
-> OpenAI-shaped `/v1` surface; differences are presentation-layer only.
+> fail audit. Differences between clients are presentation-layer only.
 >
-> **OpenAI patterns adopted across every agent:**
+> **OpenAI patterns adopted across every client:**
 > Chat Completions (`POST /v1/chat/completions`), Responses
 > (`POST /v1/responses`), function calling / tool-use schema, structured
 > outputs (`response_format: json_schema`, `strict: true`), embeddings
 > (`POST /v1/embeddings`), MCP tool invocation, model discovery
 > (`GET /v1/models`), JSONL training format, and `Authorization: Bearer ...`
 > auth. Each surface is anchored in section 7 above.
 
-Coding/development AI agents that have first-class identity files in this
-repo. Each resolves the same canonical 'MiOS' system prompt at
-`/usr/share/mios/ai/system.md` (overridable via `/etc/mios/ai/system-prompt.md`
-and `~/.config/mios/system-prompt.md`); the agent-specific files below are
-thin pointers, not separate prompts.
-
-| Agent | Vendor | Identity file in this repo | OpenAI-API conformance | Vendor / docs |
-|---|---|---|---|---|
-| **Claude / Claude Code** | Anthropic | `CLAUDE.md`, `.claude/settings.local.json` | Routed via `MIOS_AI_ENDPOINT` (OpenAI Chat Completions / Responses); native Anthropic Messages API not used in-image | <https://www.anthropic.com/> -- <https://docs.claude.com/en/docs/claude-code/overview> |
-| **GitHub Copilot** | GitHub | `.github/ai-instructions.md` | Repo-side instructions only; in-image AI use re-routed to `MIOS_AI_ENDPOINT` | <https://github.com/features/copilot> -- <https://docs.github.com/en/copilot> |
-| **Cline** (VS Code) | Cline | `.clinerules` | Configured to point its "OpenAI-Compatible" provider at `MIOS_AI_ENDPOINT` | <https://cline.bot/> -- <https://github.com/cline/cline> |
-| **Cursor** (editor) | Cursor / Anysphere | `.cursorrules` | "OpenAI-compatible" custom-model path set to `MIOS_AI_ENDPOINT` | <https://cursor.com/> -- <https://docs.cursor.com/> |
-| **Google Gemini / Gemini CLI** | Google | `GEMINI.md` | Uses Gemini CLI's OpenAI-compatibility flag against `MIOS_AI_ENDPOINT`; native `generativelanguage.googleapis.com` not used in-image | <https://gemini.google.com/> -- <https://github.com/google-gemini/gemini-cli> |
-| **OpenAI Codex CLI** (and any agents.md-aware tool) | OpenAI / community | `AGENTS.md` (agents.md standard) | Native OpenAI client; `OPENAI_BASE_URL` overridden to `MIOS_AI_ENDPOINT` for in-image use | <https://github.com/openai/codex> -- <https://agents.md/> |
+The discovery files below are listed by **filename convention** (what the
+tool looks for) and **client wiring** (how it resolves to the OpenAI-shaped
+endpoint). Vendor names appear only as the upstream link target so a
+reader can reach the tool's docs; they are not load-bearing in any
+configuration in this repo.
+
+| Discovery file | What looks for it | OpenAI-API client wiring | Upstream docs (link only) |
+|---|---|---|---|
+| `CLAUDE.md`, `.claude/settings.local.json` | A CLI agent that auto-loads `CLAUDE.md` from cwd | Wrapped via `mios-agent-claude` -- prompt injected; no network setting required because the wrapper exec's the local CLI which is configured against `MIOS_AI_ENDPOINT` | <https://docs.claude.com/en/docs/claude-code/overview> |
+| `.github/ai-instructions.md` | Editor assistants that read `.github/` instruction files | Repo-side instructions only; in-image traffic still routes to `MIOS_AI_ENDPOINT` | <https://docs.github.com/en/copilot> |
+| `.clinerules` | A VS Code agent that reads `.clinerules` from project root | "OpenAI-Compatible" provider in the agent's settings points at `MIOS_AI_ENDPOINT` | <https://github.com/cline/cline> |
+| `.cursorrules` | An editor that reads `.cursorrules` from project root | "OpenAI-compatible" custom-model path set to `MIOS_AI_ENDPOINT` | <https://docs.cursor.com/> |
+| `GEMINI.md` | A CLI that auto-loads `GEMINI.md` from cwd | Vendor-CLI's OpenAI-compatibility flag pointed at `MIOS_AI_ENDPOINT`; native vendor endpoint not used in-image | <https://github.com/google-gemini/gemini-cli> |
+| `AGENTS.md` (agents.md standard) | Any agents.md-aware client (Codex CLI, etc.) | `OPENAI_BASE_URL` env var overridden to `MIOS_AI_ENDPOINT` | <https://agents.md/> -- <https://github.com/openai/codex> |
 
 Aliasing files that all point to the same canonical prompt:
 
@@ -394,6 +400,24 @@ Aliasing files that all point to the same canonical prompt:
 | `mios-mcp.service` | Local MCP server runtime | `usr/lib/systemd/system/mios-mcp.service`, `usr/libexec/mios/mcp-server-runner` |
 | `mios-mcp-init.sh` | MCP pre-flight (sqlite vault + dirs) | `usr/libexec/mios/mcp-init.sh` |
 | `usr/bin/mios` | Single CLI entrypoint that resolves `MIOS_AI_ENDPOINT` for every agent | `usr/bin/mios` |
+| `mios-llm` | Vendor-neutral OpenAI `/v1/chat/completions` wrapper (`install-mios-agents.sh`) | `/usr/local/bin/mios-llm` |
+| `mios-agent-claude`, `mios-agent-gemini` | Thin wrappers that pre-load the canonical system prompt before exec'ing the local CLI binary; no vendor logic beyond the exec | `/usr/local/bin/mios-agent-{claude,gemini}` |
+
+### `USER` variable resolution at build entry
+
+Every `USER` token in this codebase is a *placeholder*, not a hardcoded
+identity. Resolution happens at install/build entry:
+
+| Site | Form | Resolved by |
+|---|---|---|
+| Shell scripts (`*.sh`) | `$USER`, `$HOME`, `~` | The login shell at runtime |
+| PowerShell scripts (`*.ps1`) | `$env:USERNAME`, `$env:USERPROFILE` | PowerShell at runtime |
+| Markdown aggregates | literal `USER` | The bootstrap installer's sed pass at install entry (`install.sh` / `install.ps1` reads detected username and substitutes) |
+| Profile / env templates | `MIOS_USER`, `MIOS_HOSTNAME` | `etc/mios/profile.toml` -> `/etc/mios/install.env` -> `~/.config/mios/profile.toml` (three-layer override; highest wins) |
+
+The only other user-related identifiers permitted in the codebase are
+the `MiOS` brand and the `mios` default account name; both are project
+conventions, not personal identities.
 
 ## 23. Where each thing came from (origin summary)
 

GEMINI.md

@@ -1,16 +1,29 @@
 # GEMINI.md
 
-> Gemini agent entry point. Canonical prompt: `/usr/share/mios/ai/system.md`.
+> Agent entry point (un-labeled). Pointer file -- no MiOS-internal
+> documentation. The filename exists for tooling discovery only; the
+> content is vendor-neutral and OpenAI-API-shaped.
+
+> Canonical prompt: `/usr/share/mios/ai/system.md`.
 
 ## Loading order
 
 1. Load `/usr/share/mios/ai/system.md`.
 2. Apply `/etc/mios/ai/system-prompt.md` if present (host override).
 3. Apply `~/.config/mios/system-prompt.md` if present (user override).
 
-## Gemini deltas
+## OpenAI-API-compatible endpoint
+
+All clients route through `MIOS_AI_ENDPOINT=http://localhost:8080/v1`
+(Architectural Law 5: UNIFIED-AI-REDIRECTS). The vendor's native API
+surface (`generativelanguage.googleapis.com`) is not used in-image;
+the vendor CLI's OpenAI-compatibility flag points at `MIOS_AI_ENDPOINT`.
+
+## Operating deltas
 
-- **cwd:** `/` is the repo root and system root.
-- **Read-only tools:** `read_file`, `list_directory`, `glob`, `search_file_content`
-- **Mutating tools (confirm first):** `write_file`, `replace`, `run_shell_command`
+- **cwd:** `/` is the repo root and the deployed system root.
+- **Read-only tools:** `read_file`, `list_directory`, `glob`,
+  `search_file_content`.
+- **Mutating tools (confirm first):** `write_file`, `replace`,
+  `run_shell_command`.
 - **Memory:** `/var/lib/mios/ai/memory/<agent-id>/`

README.md

@@ -37,8 +37,9 @@ What you actually get out of the box:
 - **k3s + Ceph** for when you want to grow the box into a one-node cluster
   without re-imaging.
 - **Local AI surface**, OpenAI-compatible at `http://localhost:8080/v1`. Every
-  agent and tool on the system targets that one endpoint, so your Cursor,
-  Cline, Gemini, and Claude Code installs all talk to the same brain.
+  agent and tool on the system targets that one endpoint via
+  `MIOS_AI_ENDPOINT`, so any OpenAI-API-compatible editor/CLI client (no
+  vendor lock-in) talks to the same brain.
 - **Real security defaults**: SELinux enforcing, fapolicyd deny-by-default,
   USBGuard, CrowdSec sovereign-mode IPS, kernel-lockdown integrity, MOK-
   signed kernel modules. Not the security-theater kind.

install-mios-agents.sh

@@ -1,5 +1,20 @@
 #!/usr/bin/env bash
-# 'MiOS' Agent Launcher Installer
+# 'MiOS' Agent Launcher Installer (vendor-neutral)
+#
+# Installs three thin wrappers under /usr/local/bin/ that pre-load the
+# canonical 'MiOS' system prompt before launching an OpenAI-API-compatible
+# CLI client:
+#
+#   mios-agent-claude  -- wraps the local 'claude' binary if present
+#   mios-agent-gemini  -- wraps the local 'gemini' binary if present
+#   mios-llm           -- generic OpenAI /v1/chat/completions client
+#
+# All three resolve through MIOS_AI_ENDPOINT (Architectural Law 5:
+# UNIFIED-AI-REDIRECTS) and emit OpenAI-shaped requests. The first two
+# wrappers exist only because their underlying CLI binaries take a
+# system-prompt argument; the wrappers themselves do not contain any
+# vendor logic beyond that single CLI invocation.
+#
 # Run: bash /path/to/install-mios-agents.sh
 set -euo pipefail
 
@@ -32,35 +47,35 @@ sudo cp "$PROMPT_SRC" /usr/share/mios/ai/system.md
 sudo cp "$PROMPT_SRC" /etc/mios/ai/system-prompt.md
 echo "Installed system prompt to /usr/share/mios/ai/system.md"
 
-# ── Install mios-claude ──
-sudo tee /usr/local/bin/mios-claude > /dev/null <<'SCRIPT'
+# -- Install mios-agent-claude (wraps the 'claude' CLI if present) --
+sudo tee /usr/local/bin/mios-agent-claude > /dev/null <<'SCRIPT'
 #!/usr/bin/env bash
 set -euo pipefail
 PROMPT_FILE=""
 for p in /usr/share/mios/ai/system.md /etc/mios/ai/system-prompt.md /system-prompt.md "${PWD}/system-prompt.md" "${PWD}/CLAUDE.md"; do
     [[ -r "$p" ]] && PROMPT_FILE="$p" && break
 done
-[[ -z "$PROMPT_FILE" ]] && { echo "mios-claude: no system prompt found" >&2; exit 1; }
-echo "→ Claude Code with system prompt: $PROMPT_FILE" >&2
+[[ -z "$PROMPT_FILE" ]] && { echo "mios-agent-claude: no system prompt found" >&2; exit 1; }
+echo "[agent] launching with system prompt: $PROMPT_FILE" >&2
 exec claude --append-system-prompt "$(cat "$PROMPT_FILE")" "$@"
 SCRIPT
-sudo chmod 755 /usr/local/bin/mios-claude
-echo "Installed /usr/local/bin/mios-claude"
+sudo chmod 755 /usr/local/bin/mios-agent-claude
+echo "Installed /usr/local/bin/mios-agent-claude"
 
-# ── Install mios-gemini ──
-sudo tee /usr/local/bin/mios-gemini > /dev/null <<'SCRIPT'
+# -- Install mios-agent-gemini (wraps the 'gemini' CLI if present) --
+sudo tee /usr/local/bin/mios-agent-gemini > /dev/null <<'SCRIPT'
 #!/usr/bin/env bash
 set -euo pipefail
 PROMPT_FILE=""
 for p in /usr/share/mios/ai/system.md /etc/mios/ai/system-prompt.md /system-prompt.md "${PWD}/system-prompt.md" "${PWD}/GEMINI.md"; do
     [[ -r "$p" ]] && PROMPT_FILE="$p" && break
 done
-[[ -z "$PROMPT_FILE" ]] && { echo "mios-gemini: no system prompt found" >&2; exit 1; }
-echo "→ Gemini CLI with system prompt: $PROMPT_FILE" >&2
+[[ -z "$PROMPT_FILE" ]] && { echo "mios-agent-gemini: no system prompt found" >&2; exit 1; }
+echo "[agent] launching with system prompt: $PROMPT_FILE" >&2
 exec gemini --system-prompt "$(cat "$PROMPT_FILE")" "$@"
 SCRIPT
-sudo chmod 755 /usr/local/bin/mios-gemini
-echo "Installed /usr/local/bin/mios-gemini"
+sudo chmod 755 /usr/local/bin/mios-agent-gemini
+echo "Installed /usr/local/bin/mios-agent-gemini"
 
 # ── Install mios-llm ──
 sudo tee /usr/local/bin/mios-llm > /dev/null <<'SCRIPT'
@@ -74,7 +89,7 @@ done
 ENDPOINT="${MIOS_AI_ENDPOINT:-http://localhost:8080/v1}"
 MODEL="${MIOS_AI_MODEL:-mi-os-7b}"
 USER_PROMPT="${*:-What are the six 'MiOS' Architectural Laws, in order?}"
-echo "→ Local LLM ($MODEL @ $ENDPOINT) with system prompt: $PROMPT_FILE" >&2
+echo "[agent] $MODEL @ $ENDPOINT (OpenAI /v1/chat/completions) prompt: $PROMPT_FILE" >&2
 curl -sS "$ENDPOINT/chat/completions" \
     -H "Content-Type: application/json" \
     -d "$(jq -n --arg model "$MODEL" --arg sys "$(cat "$PROMPT_FILE")" --arg user "$USER_PROMPT" \
@@ -94,9 +109,9 @@ echo "First line:"
 head -1 /usr/share/mios/ai/system.md
 echo ""
 echo "Launcher path check (should show clean paths, no brackets):"
-grep "for p in" /usr/local/bin/mios-claude
+grep "for p in" /usr/local/bin/mios-agent-claude
 echo ""
 echo "Done. Run:"
-echo "  mios-claude"
-echo "  mios-gemini"
-echo "  mios-llm 'your question here'"
+echo "  mios-agent-claude     # if the 'claude' CLI binary is installed"
+echo "  mios-agent-gemini     # if the 'gemini' CLI binary is installed"
+echo "  mios-llm 'your question here'   # vendor-neutral, OpenAI /v1 only"