feat: add openbrain + turbo-cache credential support and OpenBrain tool docs

- credentials.sh: add turbo-cache and openbrain cases (load_credentials openbrain
  exports OPENBRAIN_URL + OPENBRAIN_TOKEN from credentials.json .openbrain.*)
- credentials.sh: update --help text and error messages to list new services
- TOOLS.md: mark Coolify as DEPRECATED (superseded by Portainer Docker Swarm)
- TOOLS.md: update Shared Credential Loader service list (turbo-cache, openbrain)
- TOOLS.md: add OpenBrain section — primary shared memory layer, REST API patterns,
  Python client usage, MCP note, and mandatory usage table

credentials.sh is always overwritten on reinstall (not in PRESERVE_PATHS), so all
agents that run install.sh will automatically get openbrain credential support.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

TOOLS.md

@@ -43,9 +43,13 @@ Mosaic wrappers at `~/.config/mosaic/tools/git/*.sh` handle platform detection a
 ~/.config/mosaic/tools/portainer/endpoint-list.sh
 ```
 
-### Infrastructure — Coolify
+### Infrastructure — Coolify (DEPRECATED)
+
+> Coolify has been superseded by Portainer Docker Swarm in this stack.
+> Tools remain for reference but should not be used for new deployments.
 
 ```bash
+# DEPRECATED — do not use for new deployments
 ~/.config/mosaic/tools/coolify/project-list.sh
 ~/.config/mosaic/tools/coolify/service-list.sh
 ~/.config/mosaic/tools/coolify/service-status.sh -u <uuid>
@@ -135,9 +139,62 @@ Multi-instance support: `-a <instance>` selects a named instance (e.g. `personal
 # Source in any script to load service credentials
 source ~/.config/mosaic/tools/_lib/credentials.sh
 load_credentials <service-name>
-# Supported: portainer, coolify, authentik, glpi, github, gitea-mosaicstack, gitea-usc, woodpecker, cloudflare
+# Supported: portainer, coolify, authentik, glpi, github, gitea-mosaicstack, gitea-usc, woodpecker, cloudflare, turbo-cache, openbrain
 ```
 
+### OpenBrain — Semantic Memory (PRIMARY)
+
+Self-hosted semantic brain backed by pgvector. Primary shared memory layer for all agents across all sessions and harnesses. Stores and retrieves decisions, context, project state, and observations via semantic search.
+
+**Credentials:** `load_credentials openbrain` → exports `OPENBRAIN_URL`, `OPENBRAIN_TOKEN`
+
+Configure in your credentials.json:
+```json
+"openbrain": {
+  "url": "https://<your-openbrain-host>",
+  "api_key": "<your-api-key>"
+}
+```
+
+**REST API** (any language, any harness):
+```bash
+source ~/.config/mosaic/tools/_lib/credentials.sh && load_credentials openbrain
+
+# Search by meaning
+curl -s -X POST -H "Authorization: Bearer $OPENBRAIN_TOKEN" -H "Content-Type: application/json" \
+  -d '{"query": "your search", "limit": 5}' "$OPENBRAIN_URL/v1/search"
+
+# Capture a thought
+curl -s -X POST -H "Authorization: Bearer $OPENBRAIN_TOKEN" -H "Content-Type: application/json" \
+  -d '{"content": "...", "source": "agent-name", "metadata": {}}' "$OPENBRAIN_URL/v1/thoughts"
+
+# Recent activity
+curl -s -H "Authorization: Bearer $OPENBRAIN_TOKEN" "$OPENBRAIN_URL/v1/thoughts/recent?limit=5"
+
+# Stats
+curl -s -H "Authorization: Bearer $OPENBRAIN_TOKEN" "$OPENBRAIN_URL/v1/stats"
+```
+
+**Python client** (if jarvis-brain is available on PYTHONPATH):
+```bash
+python tools/openbrain_client.py search "topic"
+python tools/openbrain_client.py capture "decision or observation" --source agent-name
+python tools/openbrain_client.py recent --limit 5
+python tools/openbrain_client.py stats
+```
+
+**MCP (Claude Code sessions):** When connected, `mcp__openbrain__capture/search/recent/stats` tools are available natively — prefer those over CLI when in a Claude session.
+
+**When to use openbrain (required for all agents):**
+
+| Trigger | Action |
+|---------|--------|
+| Session start | Search/recent to load prior context |
+| Significant decision made | Capture with rationale |
+| Blocker or gotcha discovered | Capture immediately |
+| Task or milestone completed | Capture summary |
+| Cross-agent handoff | Capture current state |
+
 ## Git Providers
 
 | Instance | URL | CLI | Purpose |

tools/_lib/credentials.sh

@@ -10,7 +10,8 @@
 #
 # Supported services:
 #   portainer, coolify, authentik, glpi, github,
-#   gitea-mosaicstack, gitea-usc, woodpecker, cloudflare
+#   gitea-mosaicstack, gitea-usc, woodpecker, cloudflare,
+#   turbo-cache, openbrain
 #
 # After loading, service-specific env vars are exported.
 # Run `load_credentials --help` for details.
@@ -71,6 +72,8 @@ Services and exported variables:
   woodpecker-<name> → WOODPECKER_URL, WOODPECKER_TOKEN (specific instance, e.g. woodpecker-usc)
   cloudflare        → CLOUDFLARE_API_TOKEN (uses default instance)
   cloudflare-<name> → CLOUDFLARE_API_TOKEN (specific instance, e.g. cloudflare-personal)
+  turbo-cache       → TURBO_API, TURBO_TOKEN, TURBO_TEAM
+  openbrain         → OPENBRAIN_URL, OPENBRAIN_TOKEN
 EOF
     return 0
   fi
@@ -201,9 +204,24 @@ EOF
       fi
       load_credentials "cloudflare-${cf_default}"
       ;;
+    turbo-cache)
+      export TURBO_API="${TURBO_API:-$(_mosaic_read_cred '.turbo_cache.api_url')}"
+      export TURBO_TOKEN="${TURBO_TOKEN:-$(_mosaic_read_cred '.turbo_cache.token')}"
+      export TURBO_TEAM="${TURBO_TEAM:-$(_mosaic_read_cred '.turbo_cache.team')}"
+      [[ -n "$TURBO_API" ]] || { echo "Error: turbo_cache.api_url not found" >&2; return 1; }
+      [[ -n "$TURBO_TOKEN" ]] || { echo "Error: turbo_cache.token not found" >&2; return 1; }
+      [[ -n "$TURBO_TEAM" ]] || { echo "Error: turbo_cache.team not found" >&2; return 1; }
+      ;;
+    openbrain)
+      export OPENBRAIN_URL="${OPENBRAIN_URL:-$(_mosaic_read_cred '.openbrain.url')}"
+      export OPENBRAIN_TOKEN="${OPENBRAIN_TOKEN:-$(_mosaic_read_cred '.openbrain.api_key')}"
+      OPENBRAIN_URL="${OPENBRAIN_URL%/}"
+      [[ -n "$OPENBRAIN_URL" ]] || { echo "Error: openbrain.url not found" >&2; return 1; }
+      [[ -n "$OPENBRAIN_TOKEN" ]] || { echo "Error: openbrain.api_key not found" >&2; return 1; }
+      ;;
     *)
       echo "Error: Unknown service '$service'" >&2
-      echo "Supported: portainer, coolify, authentik[-<name>], glpi, github, gitea-mosaicstack, gitea-usc, woodpecker[-<name>], cloudflare[-<name>]" >&2
+      echo "Supported: portainer, coolify, authentik[-<name>], glpi, github, gitea-mosaicstack, gitea-usc, woodpecker[-<name>], cloudflare[-<name>], turbo-cache, openbrain" >&2
       return 1
       ;;
   esac