## Horizon FastMCP Build Fix — WELD-006

### Problem
arifOS horizon server build failing pre-flight (`fastmcp inspect`) because discovery
routes (`GET /robots.txt`, `/llms.txt`, `/wells.json`, `/.well-known/agent.json`,
`/.well-known/arifos.json`) were added as `@app.get()` at module level in `server.py`.
`app = mcp.http_app()` returns `StarletteWithLifespan` which doesn't support
raw `.get()` decorators — fails during Cloud build inspect.

### Fix (commit 19e0e362)
1. **Removed** `@app.get()` routes from `server.py` (lines 419-437)
2. **Added** same routes to `arifosmcp/runtime/rest_routes.py` using existing `@route()`
   decorator (wraps `mcp.custom_route()` — works during inspect)
3. **Added** `FileResponse` to `rest_routes.py` imports
4. **Fixed** `NameError` guard: `register_rest_routes` at line 408 referenced
   `HARDENED_HANDLERS` which is only in try-block scope; added `if "HARDENED_HANDLERS" in globals()`
5. **VAULT999** sealed: `LGR-HORIZON-WELD006-FIX` / `GIT-19e0e362`

### Files Changed
- `server.py` (-27 net lines)
- `arifosmcp/runtime/rest_routes.py` (+51 lines)

### Verification
- `fastmcp inspect server.py:mcp` passes cleanly (28 tools, 7 prompts, 53 resources, 32 templates)
- Server imports OK locally
- Pushed to `origin/main` (86f60036 → 19e0e362)

### Status
AWAITING: Cloud build retry confirmation from Prefect Horizon

## arifOS Horizon — Live Server Audit + CLI Generation

### Server Status ✅ LIVE
- URL: https://arifOS.fastmcp.app/mcp
- Auth: Bearer token (fmcp_XpDEnm-...) — stored in Horizon dashboard
- 28 tools confirmed, 7 prompts, 53 resources
- Tested: arifos_get_vault_data ✅, arifos_verify_location ✅, P_well_state_read ❌ (server-side /root/WELL permission issue)

### Horizon API
- Key: fmcp_XpDEnm-F8QSAmCF0szefTmiraChh5B3KL0t0r2ZzQV8
- Auth flow: OAuth redirect to WorkOS AuthKit (browser required)
- Python BearerAuth: `BearerAuth(token=token)` via `fastmcp.client.auth`
- Direct URL inspection: `Client('https://arifOS.fastmcp.app/mcp', auth=BearerAuth(token=token))`

### Generated Artifacts (commit 6da049a0)
- `arifOS_horizon_cli.py` — 28 tool wrappers, BearerAuth, cyclopts-free pure Python
- `SKILL_arifOS_horizon.md` — Full tool reference for agents
- Both committed and pushed to main

## Tool Schema Upgrade — commit 2d807023

### What was done
- All 11 canonical public tool schemas in `arifosmcp/runtime/tool_specs.py` upgraded with full parameter descriptions
- Each property now has: `description`, proper `type`, and length constraints where applicable
- `ToolAnnotations` properly set: `readOnlyHint`, `destructiveHint`, `idempotentHint` per tool
- Wealth tools (4) also upgraded with full descriptions

### Tools upgraded (11 canonical)
arifos_init ✅ | arifos_sense ✅ | arifos_mind ✅ | arifos_kernel ✅
arifos_heart ✅ | arifos_ops ✅ | arifos_judge ✅ | arifos_memory ✅
arifos_vault ✅ | arifos_forge ✅ | arifos_gateway ✅

### Verification
- Local audit: ALL DESCRIPTIONS PRESENT ✅
- Live server: still running old build (2026.4.13, 22 tools) — Horizon rebuild pending

### Horizon rebuild
- Commit: 2d807023d7e1291cef79a06148b04d80f2ef2dc5
- Pushed: YES ✅
- Horizon status: NOT REBUILT YET — user needs to trigger via Horizon UI or wait for webhook
