Update sherlock

README.md

@@ -17,6 +17,7 @@ Centralized source of truth for the homelab. Per-app stacks live as repos under
 - [Runners (`Charlie/runners` design)](docs/runners.md)
 - [Cert issuer](docs/cert-issuer.md)
 - [Vulnerability scanning](docs/vulnerability-scanning.md)
+- [Operator tooling — `Charlie/sherlock`](docs/inventory.md#operator-tooling)
 - [Roadmap](docs/roadmap.md)
 
 ## Assumptions

docs/inventory.md

@@ -56,6 +56,14 @@ Canonical list of `Charlie/<stack>` repos. Working trees live at `/mnt/nas/stack
 | [`otelcollector`](https://gitea.alexandru.macocian.me/Charlie/otelcollector) | morgott, melina, mohg, malenia | `docker-compose.yml` (shared); `secrets/env.sops.yaml` for the vmauth ingest header | morgott, melina | mohg deploys by hand until reonboarding; malenia (`launchd` + `install-mac.sh`) still ships the credential in `otelcol.mac.yaml` until reonboarded — see roadmap. |
 | [`trivy-runner`](https://gitea.alexandru.macocian.me/Charlie/trivy-runner) | morgott, melina | `docker-compose.yml` + `overrides/<host>.yml` (per-host trivy-server URL + cron schedule) | morgott, melina (sequential, mirrors otelcollector) | Daily `docker ps` sweep; staggered 03:00 morgott / 03:15 melina. Writes to `/var/lib/charlie/trivy/metrics/` consumed by otelcollector's node-exporter. |
 
+## Operator tooling
+
+Runs on the operator's workstation, not on a Charlie host. Installed per-operator (e.g. `go install`), no Docker, no `deploy-stack.yml` caller.
+
+| Charlie repo | Purpose | Status |
+|---|---|---|
+| [`sherlock`](https://gitea.alexandru.macocian.me/Charlie/sherlock) | Per-operator credential broker + agent-CLI wrapper. Holds the Authentik session once, mints per-service tokens, injects them into stdio MCPs, and execs the agent CLI of choice (Copilot, Claude Code, …). Design: [`Charlie/sherlock/plan.md`](https://gitea.alexandru.macocian.me/Charlie/sherlock/src/branch/main/plan.md). | phase 0 — scaffold |
+
 ## Mirrors (Gitea pull-mirror, no host action)
 
 Naming: `Charlie/<name>-mirror`.