diff --git a/README.md b/README.md
index 2c61cf56f..07199a990 100644
--- a/README.md
+++ b/README.md
@@ -41,7 +41,8 @@ powercontext setup pi --source oceanbase/powercontext --ref master
 powercontext setup workbuddy --source oceanbase/powercontext --ref master
 
 # Or install several hosts in one pass.
-powercontext setup select --host codex --host claude-code --host opencode
+powercontext setup select --host codex --host claude-code --host opencode \
+  --source oceanbase/powercontext --ref master
 ```
 
 The first command installs the CLI and local Server from the latest `master` revision in an isolated environment.
@@ -60,7 +61,8 @@ In another terminal, verify the service and plugin:
 
 ```bash
 powercontext doctor
-powercontext doctor codex  # or: claude-code / dsh / hermes / openclaw / opencode / pi / workbuddy
+powercontext doctor integrations
+powercontext doctor codex  # Replace codex with the host you installed.
 ```
 
 By default, the Server listens on `127.0.0.1:8000`, exposes Streamable HTTP MCP at `/mcp`, and persists data in a
diff --git a/README_CN.md b/README_CN.md
index 7d4f15791..e20c8b01d 100644
--- a/README_CN.md
+++ b/README_CN.md
@@ -39,7 +39,8 @@ powercontext setup pi --source oceanbase/powercontext --ref master
 powercontext setup workbuddy --source oceanbase/powercontext --ref master
 
 # 或者一次性安装多个 Host。
-powercontext setup select --host codex --host claude-code --host opencode
+powercontext setup select --host codex --host claude-code --host opencode \
+  --source oceanbase/powercontext --ref master
 ```
 
 第一条命令会在隔离环境中从最新 `master` revision 安装 CLI 和本地 Server；每条 setup 命令都会从同一个
@@ -57,7 +58,8 @@ powercontext server run
 
 ```bash
 powercontext doctor
-powercontext doctor codex  # 或: claude-code / dsh / hermes / openclaw / opencode / pi / workbuddy
+powercontext doctor integrations
+powercontext doctor codex  # 请把 codex 换成已安装的宿主。
 ```
 
 默认情况下，Server 监听 `127.0.0.1:8000`，在 `/mcp` 提供 Streamable HTTP MCP，并将数据持久化到本地
diff --git a/README_JP.md b/README_JP.md
index 8ea64935b..f5b615798 100644
--- a/README_JP.md
+++ b/README_JP.md
@@ -41,7 +41,8 @@ powercontext setup pi --source oceanbase/powercontext --ref master
 powercontext setup workbuddy --source oceanbase/powercontext --ref master
 
 # 複数の Host を一度にインストールすることもできます。
-powercontext setup select --host codex --host claude-code --host opencode
+powercontext setup select --host codex --host claude-code --host opencode \
+  --source oceanbase/powercontext --ref master
 ```
 
 最初のコマンドは、隔離された環境に最新の `master` revision から CLI とローカル Server をインストールします。
@@ -60,7 +61,8 @@ powercontext server run
 
 ```bash
 powercontext doctor
-powercontext doctor codex  # または: claude-code / dsh / hermes / openclaw / opencode / pi / workbuddy
+powercontext doctor integrations
+powercontext doctor codex  # codex をインストールした Host 名に置き換えてください。
 ```
 
 デフォルトでは、Server は `127.0.0.1:8000` で待ち受け、`/mcp` で Streamable HTTP MCP を公開し、
diff --git a/docker/README.md b/docker/README.md
index e80577392..bc8f4bbdd 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -16,12 +16,16 @@ Run the Server with persistent SQLite and scheduler data:
 ```bash
 docker run --rm \
   --name powercontext-server \
-  --publish 8000:8000 \
+  --publish 127.0.0.1:8000:8000 \
   --volume powercontext-data:/data \
   powercontext-server:local
 ```
 
-The image listens on `0.0.0.0:8000`, stores its default data under `/data`, and exposes a Docker health check backed
+The image listens on `0.0.0.0:8000` inside the container. Keep the host-side publish address on loopback unless bearer
+authentication and a TLS-terminating network boundary are configured. See
+[`Deploy the Server`](../docs/en/docs/how-to/deploy-server.md) for the remote-access setup.
+
+The image stores its default data under `/data` and exposes a Docker health check backed
 by `GET /health/ready`. Runtime or database failures return `not_ready` with HTTP 503. A configured inference failure
 returns `degraded` with HTTP 200, so database-backed operations remain in traffic while the response exposes the
 affected capability. Provider checks make one minimal real request at startup. `ready` and `misconfigured` results
@@ -42,6 +46,6 @@ TLS-terminating proxy and enable bearer authentication with
 opt-in is no longer required.
 
 The `Build Docker image` GitHub workflow builds downloadable Linux amd64 and arm64 image archives for pull requests,
-changes merged to `main`, and manual runs. Publishing a GitHub Release pushes a multi-platform image to Docker Hub.
+changes merged to `master`, and manual runs. Publishing a GitHub Release pushes a multi-platform image to Docker Hub.
 Repository configuration must provide `DOCKER_USERNAME` and `DOCKER_PASSWORD` secrets plus a `DOCKER_PUSH_BASE`
 variable such as `oceanbase`; Release tags must use `vX.Y.Z` or `X.Y.Z` semantic versioning.
diff --git a/docs/en/docs/how-to/configure-hermes.md b/docs/en/docs/how-to/configure-hermes.md
new file mode 100644
index 000000000..aaaa7afbf
--- /dev/null
+++ b/docs/en/docs/how-to/configure-hermes.md
@@ -0,0 +1,102 @@
+---
+title: Configure Hermes
+description: Install the Hermes MemoryProvider and slash-command companion, then connect them to PowerContext Server.
+---
+
+# Configure Hermes
+
+The integration contains a standard Hermes `MemoryProvider` and a standalone slash-command plugin. Hermes remains
+responsible for the conversation and memory lifecycle; the provider sends recall, capture, and explicit operations to
+a separately running PowerContext Server. The companion registers `/pc` and `/powercontext` before the provider is
+activated. Backend failures do not interrupt the Hermes conversation.
+
+## Prerequisites
+
+- Hermes Agent 0.20.4 or newer, available on `PATH`;
+- PowerContext CLI and Server installed from `master`;
+- a running PowerContext Server.
+
+```bash
+uv tool install --force "powercontext[cli,server] @ git+https://github.com/oceanbase/powercontext.git@master"
+powercontext server run
+```
+
+## Install both plugins
+
+In another terminal, install or refresh both plugins from the matching revision:
+
+```bash
+powercontext setup hermes --source oceanbase/powercontext --ref master
+powercontext doctor hermes
+```
+
+The setup command copies the provider to `$HERMES_HOME/plugins/powercontext`, installs
+`$HERMES_HOME/plugins/powercontext-command`, and enables the companion without granting built-in tool override
+permissions. It does not start the Server or select the provider in Hermes.
+
+Run the Hermes memory setup wizard and select `PowerContext`:
+
+```bash
+hermes memory setup
+```
+
+On Hermes 0.20.4, use the generic command above. `hermes memory setup powercontext` selects the provider but does not
+open its configuration wizard. Restart Hermes after setup.
+
+## Verify recall and writes
+
+```bash
+hermes powercontext status
+hermes powercontext remember preference "The user prefers uv"
+hermes powercontext search "Python package manager"
+```
+
+Inside an interactive Hermes session, `/pc status` should reach the same active provider. Use `/pc ` followed by
+Tab/Down to inspect the available Memory, Handoff, Experience, Skill, review, statistics, trace, and Workstream
+commands. Hermes 0.20.4 does not provide enough invocation context to route gateway slash commands safely, so the
+companion rejects gateway invocations; use the provider's Hermes tools in gateway sessions.
+
+The provider uses `http://127.0.0.1:8000` by default. In a Git workspace, Workstream persistence first reads the
+shared `.git/powercontext/codex-workspace.json` scope binding. An explicit scope configuration takes precedence.
+Without either value, the provider derives a scope from the active Hermes profile and gateway user identifier; for a
+local CLI session without a user identifier, it derives a stable value from `HERMES_HOME`.
+
+## Configure the connection
+
+The wizard writes non-sensitive settings to `$HERMES_HOME/powercontext/config.json`. Environment variables override
+the file:
+
+| Variable | Purpose |
+| --- | --- |
+| `POWERCONTEXT_HERMES_CONFIG` | Config file path; defaults to `$HERMES_HOME/powercontext/config.json` |
+| `POWERCONTEXT_HERMES_BASE_URL` | PowerContext Server URL |
+| `POWERCONTEXT_HERMES_AUTHORIZATION` | Complete authorization header, such as `Bearer <token>` |
+| `POWERCONTEXT_HERMES_TOKEN` | Bare-token shorthand used when `AUTHORIZATION` is absent |
+| `POWERCONTEXT_HERMES_SCOPE_ID` | Explicit scope or scope template |
+| `POWERCONTEXT_HERMES_MAX_BYTES` | Maximum prepared-context size, from 512 to 32768 bytes |
+| `POWERCONTEXT_HERMES_TIMEOUT` | HTTP request timeout in seconds |
+| `POWERCONTEXT_HERMES_CAPTURE_TURNS` | Capture completed turns as Sources |
+| `POWERCONTEXT_HERMES_FLUSH_ON_SESSION_END` | Run Memory extraction at session end |
+| `POWERCONTEXT_HERMES_CAPTURE_PRE_COMPRESS` | Capture filtered new turns before compression; disabled by default |
+| `POWERCONTEXT_HERMES_EVALUATION_TRACE` | Record recalled context in sensitive local JSONL traces; disabled by default |
+| `POWERCONTEXT_HERMES_EVALUATION_TRACE_PATH` | Override the evaluation trace directory |
+| `POWERCONTEXT_HERMES_WORKSTREAM` | Read the shared Git-private Workstream binding; enabled by default |
+
+Let the Hermes wizard store authorization in its protected `.env` secret store; do not put the token in
+`config.json`. Use plain HTTP only for a loopback Server. See [Deploy the Server](deploy-server.md) before connecting
+to a remote deployment. Evaluation traces contain prompts and recalled context; keep them local and protect them as
+sensitive data.
+
+## Enable automatic extraction only when needed
+
+Completed-turn capture creates Source evidence. It does not create Memory by itself. Automatic Source-to-Memory
+extraction requires a generation model on the Server:
+
+```bash
+export POWERCONTEXT_SERVER_INFERENCE_GENERATION_MODEL=provider:model-name
+powercontext server run
+powercontext capabilities
+```
+
+The capability output must report Memory extraction as enabled. Explicit `hermes powercontext remember` writes do not
+require a model.
diff --git a/docs/en/docs/how-to/configure-langchain.md b/docs/en/docs/how-to/configure-langchain.md
index e3c2685b5..6d13778ae 100644
--- a/docs/en/docs/how-to/configure-langchain.md
+++ b/docs/en/docs/how-to/configure-langchain.md
@@ -14,17 +14,18 @@ The middleware uses LangChain's public `AgentMiddleware` API. Recalled content m
 
 ## Install
 
-The middleware ships in the standalone `powercontext-langchain` distribution and requires LangChain 1.3 or later:
+The middleware source is packaged separately as `powercontext-langchain` and requires LangChain 1.3 or later. It is
+not currently published on PyPI:
 
 ```bash
-uv tool install "powercontext[cli,server]==0.0.2"
+uv tool install --force "powercontext[cli,server] @ git+https://github.com/oceanbase/powercontext.git@master"
 powercontext server run
 ```
 
 Keep the Server running, then install the middleware in the LangChain application's environment:
 
 ```bash
-uv pip install "powercontext-langchain @ git+https://github.com/oceanbase/powercontext.git#subdirectory=integrations/langchain"
+uv pip install "powercontext-langchain @ git+https://github.com/oceanbase/powercontext.git@master#subdirectory=integrations/langchain"
 ```
 
 Skip the Server installation when the application already connects to a separately managed Server. From a repository
diff --git a/docs/en/docs/how-to/configure-langgraph.md b/docs/en/docs/how-to/configure-langgraph.md
index e833d7732..849937e8e 100644
--- a/docs/en/docs/how-to/configure-langgraph.md
+++ b/docs/en/docs/how-to/configure-langgraph.md
@@ -14,13 +14,12 @@ primitives that are stable public API. It never starts or embeds the Server.
 The package is not yet published to PyPI, so install it from source alongside a running Server:
 
 ```bash
-uv pip install "powercontext-langgraph @ git+https://github.com/oceanbase/powercontext.git#subdirectory=integrations/langgraph"
+uv pip install "powercontext-langgraph @ git+https://github.com/oceanbase/powercontext.git@master#subdirectory=integrations/langgraph"
 powercontext server run
 ```
 
-From a checkout you can install the local path instead: `uv pip install ./integrations/langgraph`. Publishing to
-PyPI is pending a standalone build and release step that advances the package version independently of the root
-`powercontext` distribution; until that lands, use the source install above.
+From a checkout you can install the local path instead: `uv pip install ./integrations/langgraph`. The adapter is not
+currently published on PyPI, so use one of these source installations.
 
 The package depends on `powercontext[client]`, `langgraph`, `langchain-core`, and `pydantic-settings`. It does not
 pull in the Server; point it at a Server you run separately.
@@ -148,10 +147,10 @@ Server. Implementing only search and raising for the rest produces an object tha
 fails at runtime inside unrelated nodes or tools, which is worse than providing no store. The adapter therefore
 integrates at the node and tool level and does not occupy the `store` parameter of `compile()`.
 
-## Scope of this release
+## Current scope
 
-In scope: Memory read and write, and bounded context preparation.
+Included: Memory read and write, and bounded context preparation.
 
-Out of scope for this release: automatic trajectory capture, checkpointing, Handoff, Artifact Candidate review, and
-Experience or Skill generation. Use `powercontext_remember` for explicit writes; automatic capture of a run as Source
-evidence is not part of this adapter.
+Not included: automatic trajectory capture, checkpointing, Handoff, Artifact Candidate review, and Experience or
+Skill generation. Use `powercontext_remember` for explicit writes; automatic capture of a run as Source evidence is
+not part of this adapter.
diff --git a/docs/en/docs/how-to/configure-openclaw.md b/docs/en/docs/how-to/configure-openclaw.md
index f8cc5de30..2db4fe700 100644
--- a/docs/en/docs/how-to/configure-openclaw.md
+++ b/docs/en/docs/how-to/configure-openclaw.md
@@ -7,7 +7,7 @@ description: Install the PowerContext memory plugin for OpenClaw and control rec
 
 ## Install or refresh the plugin
 
-Until a PowerContext release includes OpenClaw, install the CLI and plugin from the same `master` revision:
+Install the CLI and plugin from the same `master` revision:
 
 ```bash
 uv tool install --force "powercontext[cli,server] @ git+https://github.com/oceanbase/powercontext.git@master"
diff --git a/docs/en/docs/how-to/configure-pydantic-ai.md b/docs/en/docs/how-to/configure-pydantic-ai.md
index 4bea60a04..4cd53f2f9 100644
--- a/docs/en/docs/how-to/configure-pydantic-ai.md
+++ b/docs/en/docs/how-to/configure-pydantic-ai.md
@@ -1,20 +1,24 @@
 ---
-title: Configure Pydantic AI
-description: Add durable Memory tools, automatic context preparation, and optional trajectory capture to Pydantic AI.
+title: Pydantic AI adapter preview
+description: Review the current Pydantic AI adapter API and its installation status.
 ---
 
-# Configure Pydantic AI
+# Pydantic AI adapter preview
 
-Use the independently released `powercontext-pydantic-ai` package when a Pydantic AI agent should share durable
-Memory through a running PowerContext Server.
+The repository contains a preview adapter that lets a Pydantic AI agent share durable Memory through a running
+PowerContext Server. It is not yet available as a supported standalone installation.
 
-## Install the adapter
+## Check availability before using it
 
-Start the Server, then install the adapter in the agent application:
+`powercontext-pydantic-ai` is not currently published on PyPI. Its source package also requires a final
+`powercontext[client]>=0.0.3`, which the current public package and the development version from `master` do not
+satisfy. Therefore, both the old PyPI command and a direct Git subdirectory install fail dependency resolution.
 
-```bash
-uv add powercontext-pydantic-ai "pydantic-ai-slim[openai]"
-```
+Do not add this adapter to an application until compatible root and adapter packages have been released. Repository
+contributors can run its tests through the root development environment; the remaining sections document the preview
+API for development and review, not a supported installation path.
+
+## Attach the preview capability
 
 The example below uses OpenAI. For another provider, install the matching `pydantic-ai-slim` provider extra and
 change the model string.
@@ -108,5 +112,5 @@ Connecting PowerContext MCP requires no adapter package, but it is a lower-capab
 provides explicit tools; it does not automatically call `prepare_context`, capture trajectory events, or Flush at
 checkpoints and run completion.
 
-This first adapter release supports ordinary Pydantic AI runs. Durable execution through Temporal, DBOS, Prefect, or
-similar systems is not yet validated. Handoff, Candidate Review, Experience, and Skill operations are not included.
+The preview supports ordinary Pydantic AI runs. Durable execution through Temporal, DBOS, Prefect, or similar systems
+is not yet validated. Handoff, Candidate Review, Experience, and Skill operations are not included.
diff --git a/docs/en/docs/how-to/configure-workbuddy.md b/docs/en/docs/how-to/configure-workbuddy.md
index 223056465..3933425f3 100644
--- a/docs/en/docs/how-to/configure-workbuddy.md
+++ b/docs/en/docs/how-to/configure-workbuddy.md
@@ -7,15 +7,12 @@ description: Install the PowerContext WorkBuddy hooks and control its local beha
 
 ## Prerequisites
 
-- A running PowerContext installation. Until WorkBuddy support is included in a
-  tagged release, install the CLI and local Server from the same `master`
-  revision used below:
+- A running PowerContext installation. Install the CLI and local Server from the same `master` revision used below:
   `uv tool install "powercontext[cli,server] @ git+https://github.com/oceanbase/powercontext.git@master"`.
   Start the Server with `powercontext server run`.
 - WorkBuddy with user-level hooks, MCP, and Skills support (the desktop app).
 - Python 3.11 or newer on `PATH` for the hook process.
-- The plugin directory from this repository:
-  `integrations/workbuddy/plugins/powercontext`.
+- The plugin directory from this repository: `integrations/workbuddy/plugins/powercontext`.
 
 The integration does not start or embed the Server; it only talks to a running
 PowerContext Server over HTTP.
diff --git a/docs/en/docs/how-to/deploy-server.md b/docs/en/docs/how-to/deploy-server.md
new file mode 100644
index 000000000..151e42c3d
--- /dev/null
+++ b/docs/en/docs/how-to/deploy-server.md
@@ -0,0 +1,134 @@
+---
+title: Deploy the Server
+description: Run PowerContext with persistent data, health checks, authentication, and a safe network boundary.
+---
+
+# Deploy the Server
+
+`powercontext server run` is a foreground process. For a personal workstation, run it in a terminal. For a
+long-running installation, let a container platform or service manager start it, restart it, and collect its logs.
+
+## Choose the network boundary
+
+The default Server listens on `127.0.0.1:8000` without authentication. This is suitable for clients on the same
+machine. Do not change the listener to a non-loopback address while authentication is disabled.
+
+For access from another machine:
+
+1. enable bearer authentication;
+2. keep the Server behind a TLS-terminating reverse proxy or private network boundary;
+3. provide the token through a secret manager or protected process environment;
+4. allow access to the data directory only for the Server operator.
+
+The built-in command serves HTTP and has no TLS options. Terminate HTTPS outside PowerContext.
+
+## Run from an installed tool
+
+Install PowerContext as described in [Install and run](install-and-run.md), then choose a persistent data directory:
+
+```bash
+export POWERCONTEXT_HOME=/srv/powercontext
+powercontext server run
+```
+
+The process must be able to create and update this directory. The default SQLite database and scheduler state are
+stored below it. Supply the same environment variables whenever your service manager restarts the process.
+
+PowerContext does not search for a `.env` file automatically. Export the variables, configure them in the service
+manager or container platform, or pass one explicit file:
+
+```bash
+powercontext config validate --env-file /etc/powercontext/powercontext.env
+powercontext server run --env-file /etc/powercontext/powercontext.env
+```
+
+The file may contain provider credentials or a bearer token, so restrict it to the Server operator. Values in the
+file override same-named process values; inherited `POWERCONTEXT_SERVER_*` variables that are absent from the file
+are ignored. See the [Full-capability Quick Start](full-capability-runtime.md) to generate a validated file
+interactively.
+
+## Run with Docker
+
+Build the image from the repository root:
+
+```bash
+POWERCONTEXT_VERSION=$(uvx --from hatchling --with hatch-vcs hatchling version)
+docker build \
+  --file docker/Dockerfile \
+  --build-arg "POWERCONTEXT_VERSION=${POWERCONTEXT_VERSION}" \
+  --tag powercontext-server:local \
+  .
+```
+
+Run it with a named volume and publish the port only on the host loopback interface:
+
+```bash
+docker run --rm \
+  --name powercontext-server \
+  --publish 127.0.0.1:8000:8000 \
+  --volume powercontext-data:/data \
+  powercontext-server:local
+```
+
+The image listens on `0.0.0.0:8000` inside the container, so the host-side address in `--publish` is important. The
+named volume persists the SQLite database and scheduler state after the container stops.
+
+## Enable authentication
+
+Load a strong token from your secret manager into the Server process environment:
+
+```bash
+export POWERCONTEXT_SERVER_AUTH_ENABLED=true
+export POWERCONTEXT_SERVER_AUTH_TOKEN="$POWERCONTEXT_DEPLOYMENT_TOKEN"
+powercontext server run
+```
+
+For Docker, pass the already-loaded variables without putting the token value in the command:
+
+```bash
+docker run --rm \
+  --name powercontext-server \
+  --publish 127.0.0.1:8000:8000 \
+  --volume powercontext-data:/data \
+  --env POWERCONTEXT_SERVER_AUTH_ENABLED=true \
+  --env POWERCONTEXT_SERVER_AUTH_TOKEN \
+  powercontext-server:local
+```
+
+Clients then send `Authorization: Bearer <token>`. The liveness and readiness endpoints remain public so an
+orchestrator can probe them. API, MCP, metrics, OpenAPI, and interactive API documentation require authentication.
+
+## Check the deployment
+
+Use liveness to determine whether the process can answer HTTP requests:
+
+```bash
+curl --fail http://127.0.0.1:8000/health/live
+```
+
+Use readiness before sending application traffic:
+
+```bash
+curl --fail http://127.0.0.1:8000/health/ready
+```
+
+Readiness returns HTTP 503 when a required runtime or database binding is unavailable. An optional inference provider
+can make the response `degraded` with HTTP 200 while database-backed operations remain available.
+
+After enabling authentication, verify a protected endpoint as well:
+
+```bash
+curl --fail \
+  --header "Authorization: Bearer ${POWERCONTEXT_DEPLOYMENT_TOKEN}" \
+  http://127.0.0.1:8000/v1/capabilities
+```
+
+See [HTTP API](../reference/http-api.md) for request examples and [Configuration](../reference/configuration.md) for
+all Server settings.
+
+## Protect and back up data
+
+- Back up the directory selected by `POWERCONTEXT_HOME`, or the Docker volume mounted at `/data`.
+- Stop writes or stop the Server while taking a filesystem-level SQLite backup.
+- Keep database backups and bearer tokens out of the repository.
+- Test restoration before relying on a backup procedure.
diff --git a/docs/en/docs/how-to/install-and-run.md b/docs/en/docs/how-to/install-and-run.md
index 49084a9ee..b853fe9c4 100644
--- a/docs/en/docs/how-to/install-and-run.md
+++ b/docs/en/docs/how-to/install-and-run.md
@@ -7,22 +7,21 @@ description: Install PowerContext from Git and run the local Server.
 
 ## Install the application
 
-Install `uv`, then install PowerContext directly from a Git ref:
+You need Python 3.11 or newer, Git, and [`uv`](https://docs.astral.sh/uv/) on macOS or Linux. Then install
+PowerContext directly from a Git ref:
 
 ```bash
 uv tool install "powercontext[cli,server] @ git+https://github.com/oceanbase/powercontext.git@master"
 ```
 
-This works on macOS and Linux and does not require a user-managed repository checkout. Git uses its normal credential
-configuration, including credential helpers and SSH settings. For an SSH-based install, replace the HTTPS URL with the
-Git URL approved for your environment.
+The command does not leave a repository checkout for you to manage. Git uses its normal credential configuration,
+including credential helpers and SSH settings. For an SSH-based install, replace the HTTPS URL with the Git URL
+approved for your environment.
 
 To install a tested branch or tag, replace `master` after the final `@`. Use the same ref when configuring integrations:
 
 ```bash
 powercontext setup codex --source oceanbase/powercontext --ref <ref>
-powercontext setup dsh --source oceanbase/powercontext --ref <ref>
-powercontext setup pi --source oceanbase/powercontext --ref <ref>
 ```
 
 Per-host commands remain the explicit path. The first-class catalog contains `codex`, `claude-code`, `dsh`,
@@ -38,8 +37,8 @@ Without `--server-url`, Claude Code and OpenClaw keep their `http://127.0.0.1:80
 OpenCode, Pi, and Hermes integrations pass their existing post-install diagnostics before they are reported as
 installed. After installing Hermes, run `hermes memory setup` and select PowerContext before starting Hermes.
 
-For host-specific options, see [Configure Codex](configure-codex.md) and
-[Configure DeepSeek Harness](configure-dsh.md).
+WorkBuddy remains available through `powercontext setup workbuddy`, but it is not part of `setup select`. The
+integration guides in the site navigation describe host-specific prerequisites, options, and behavior.
 
 ## Run the local Server
 
@@ -62,6 +61,10 @@ disable the Dashboard explicitly.
 
 `Ctrl-C` performs a clean shutdown. Restarting the command reopens the same database.
 
+This minimal launch does not enable model-backed extraction or vector search. To generate and validate one explicit
+environment file for those capabilities, continue with the
+[Full-capability Quick Start](full-capability-runtime.md).
+
 ## Use embedded seekDB
 
 Embedded seekDB is available on Linux and macOS when a compatible `pylibseekdb` wheel is available. Windows does not
@@ -71,17 +74,18 @@ support this embedded backend. Install or replace the tool with the optional see
 uv tool install --force "powercontext[cli,server,seekdb] @ git+https://github.com/oceanbase/powercontext.git@master"
 ```
 
-When switching from SQLite, remove `POWERCONTEXT_SERVER_DATABASE_URL` and
-`POWERCONTEXT_SERVER_DATABASE_VEC1_EXTENSION` from `.env`, or unset them in the shell. Those settings are not valid
-for seekDB. Then select the backend and start the Server:
+When switching from SQLite, remove `POWERCONTEXT_SERVER_DATABASE_URL` from the Server process environment. An explicit
+SQLAlchemy database URL is not valid for seekDB. Then select the backend and start the Server:
 
 ```bash
 unset POWERCONTEXT_SERVER_DATABASE_URL
-unset POWERCONTEXT_SERVER_DATABASE_VEC1_EXTENSION
 export POWERCONTEXT_SERVER_DATABASE_KIND=seekdb
 powercontext server run
 ```
 
+The CLI does not search for a `.env` file automatically. Export these values in the shell, configure them in the
+process manager or container, or pass a specific file with `powercontext server run --env-file <path>`.
+
 PowerContext always uses seekDB's built-in `test` database. Leave `POWERCONTEXT_SERVER_DATABASE_PATH` unset to store
 the instance in the `seekdb` subdirectory of the PowerContext user data directory. If `POWERCONTEXT_HOME` is set, the
 default is `$POWERCONTEXT_HOME/seekdb`; set `POWERCONTEXT_SERVER_DATABASE_PATH` only when a different location is
@@ -107,6 +111,7 @@ powercontext doctor openclaw
 powercontext doctor opencode
 powercontext doctor pi
 powercontext doctor hermes
+powercontext doctor workbuddy
 powercontext ready
 powercontext capabilities
 ```
@@ -116,10 +121,14 @@ readiness covers the database and each configured inference provider. Runtime or
 `not_ready`; an inference failure returns `degraded` without removing database-backed operations from traffic.
 `doctor integrations` is an optional read-only overview of every first-class host; a missing CLI does not fail that
 command. The individual `doctor <host>` commands check one optional host CLI and all of its PowerContext integration
-items. The content commands exercise the public HTTP SDK path. `ready` and `capabilities` show the readiness and
-enabled capabilities of the running service. For complete status definitions and recovery steps, see
+items. WorkBuddy has an individual `doctor workbuddy` command but is not included in the first-class overview. The
+content commands exercise the public HTTP SDK path. `ready` and `capabilities` show the readiness and enabled
+capabilities of the running service. For complete status definitions and recovery steps, see
 [Troubleshoot](troubleshoot.md).
 
+For a long-running process, Docker, authentication, or remote access, continue with
+[Deploy the Server](deploy-server.md).
+
 ## Update or replace an installation
 
 To replace the installed tool with a chosen ref:
@@ -127,12 +136,11 @@ To replace the installed tool with a chosen ref:
 ```bash
 uv tool install --force "powercontext[cli,server] @ git+https://github.com/oceanbase/powercontext.git@<ref>"
 powercontext setup codex --source oceanbase/powercontext --ref <ref>
-powercontext setup dsh --source oceanbase/powercontext --ref <ref>
-powercontext setup pi --source oceanbase/powercontext --ref <ref>
 ```
 
-Restart the Server and open a new host session after updating. Existing SQLite data remains in the user data
-directory unless `POWERCONTEXT_HOME` or the database URL changes.
+Repeat the setup command for each installed host, using the same ref. Restart the Server and open a new host session
+after updating. Existing SQLite data remains in the user data directory unless `POWERCONTEXT_HOME` or the database URL
+changes.
 
 ## Install a Python role
 
@@ -143,5 +151,5 @@ uv add "powercontext[client] @ git+https://github.com/oceanbase/powercontext.git
 ```
 
 Use `builtin` for in-process Python composition, `server` for the service, `client` for the Python SDK, or `cli` for
-the Server-backed command line.
-An extra that is only present in the isolated `uv tool` environment is not importable by an unrelated Python project.
+the Server-backed command line. An extra that is only present in the isolated `uv tool` environment is not importable
+by an unrelated Python project.
diff --git a/docs/en/docs/index.md b/docs/en/docs/index.md
index 7b1d90527..2531cfd73 100644
--- a/docs/en/docs/index.md
+++ b/docs/en/docs/index.md
@@ -30,6 +30,9 @@ overview:
     - title: Understand and operate
       description: Decide what persists, configure the Server, or resolve a broken setup.
       cards:
+        - title: Full-capability Quick Start
+          description: Generate one validated configuration and verify extraction, vector search, and an Agent loop.
+          href: en/docs/how-to/full-capability-runtime/
         - title: Core concepts
           description: Understand scopes, evidence, revisioned Artifacts, prepared context, and work continuity.
           href: en/docs/explanation/core-concepts/
@@ -42,6 +45,12 @@ overview:
         - title: Configuration
           description: Set storage, providers, interfaces, and runtime behavior.
           href: en/docs/reference/configuration/
+        - title: Deploy the Server
+          description: Run a persistent Server with health checks, authentication, and a safe network boundary.
+          href: en/docs/how-to/deploy-server/
+        - title: HTTP API
+          description: Call the Server from any language and find the complete OpenAPI contract.
+          href: en/docs/reference/http-api/
         - title: Review Candidates
           description: Inspect, revise, approve, or reject pending Experience and Skill proposals.
           href: en/docs/how-to/review-candidates/
diff --git a/docs/en/docs/reference/configuration.md b/docs/en/docs/reference/configuration.md
index 79bc0a96d..e541cfaed 100644
--- a/docs/en/docs/reference/configuration.md
+++ b/docs/en/docs/reference/configuration.md
@@ -5,7 +5,27 @@ description: PowerContext paths, Server, Client, inference, and Agent integratio
 
 # Configuration
 
-PowerContext reads configuration from environment variables when each process starts.
+PowerContext reads configuration from environment variables when each process starts. The CLI does not search for a
+`.env` file automatically. Export values in the shell, have the service manager or container supply them, or pass an
+explicit file to a command that accepts `--env-file`. An Agent host may load its own environment file according to
+that host's rules.
+
+## Explicit environment files
+
+Create a guided configuration, inspect it without printing credentials, and validate it before launch:
+
+```bash
+powercontext config init --output .env
+powercontext config show --env-file .env
+powercontext config validate --env-file .env
+powercontext server run --env-file .env
+```
+
+`config init` writes the file with mode `0600`. When `server run` receives `--env-file`, assignments in that file
+override same-named process values. Inherited `POWERCONTEXT_SERVER_*` values that are missing from the file are
+ignored, so validation and launch use the same Server configuration. `config show` redacts recognized and
+generator-recorded credentials; still treat the file itself as a secret-bearing deployment artifact. See the
+[Full-capability Quick Start](../how-to/full-capability-runtime.md) for the guided setup and verification flow.
 
 ## User data
 
@@ -44,7 +64,9 @@ Server settings use the `POWERCONTEXT_SERVER_` prefix.
 | `POWERCONTEXT_SERVER_LOGGING_ACCESS` | `true` | Log external HTTP and logical MCP request completion |
 | `POWERCONTEXT_SERVER_METRICS_ENABLED` | `true` | Expose Prometheus metrics at `/metrics` |
 | `POWERCONTEXT_SERVER_TRACING_ENABLED` | `false` | Enable span recording and OTLP export |
-| `POWERCONTEXT_SERVER_DATABASE_URL` | user data SQLite file | SQLAlchemy async database URL |
+| `POWERCONTEXT_SERVER_DATABASE_KIND` | `sqlite` | Storage backend: `sqlite`, `seekdb`, or `oceanbase` |
+| `POWERCONTEXT_SERVER_DATABASE_URL` | user data SQLite file | SQLAlchemy async URL for SQLite or OceanBase; do not set for seekDB |
+| `POWERCONTEXT_SERVER_DATABASE_PATH` | user data `seekdb` directory | Embedded seekDB path; used only when `DATABASE_KIND=seekdb` |
 | `POWERCONTEXT_SERVER_RUNTIME_SCOPE_CACHE_SIZE` | `128` | Inactive scope compositions retained by the Runtime; in-flight scopes are never evicted |
 | `POWERCONTEXT_SERVER_RUNTIME_SOURCE_WINDOW_LIMIT` | `100` | Maximum Sources processed in one activation |
 | `POWERCONTEXT_SERVER_RUNTIME_MEMORY_EXTRACTION_PROFILE` | `coding` | Memory selection policy: `coding` or `conversation` |
@@ -62,13 +84,15 @@ Static bearer authentication is disabled by default. When enabled, API and MCP r
 loopback address (`localhost`, `::1`, or any address in `127.0.0.0/8`). The Server refuses to start when it binds to a
 non-loopback address while authentication is disabled; either enable authentication, keep the bind on loopback, or,
 when TLS is terminated upstream or the network is otherwise controlled, set
-`POWERCONTEXT_SERVER_ALLOW_UNAUTHENTICATED_NON_LOOPBACK=true` to opt in explicitly. Use TLS before exposing an authenticated Server over a network.
+`POWERCONTEXT_SERVER_ALLOW_UNAUTHENTICATED_NON_LOOPBACK=true` to opt in explicitly. Use TLS before exposing an
+authenticated Server over a network.
 
-The Python Client and CLI apply the matching rule for outbound requests: a configured unencrypted `http://` Server URL is
-accepted only for loopback hosts, and the Client refuses to send any request -- authenticated or not -- over unencrypted
-non-loopback HTTP. Code whose `http://` base URL is only a routing label for a transport that is secure in practice (an
-in-process ASGI app, a Unix-domain socket, or a proxy that terminates TLS) must supply its own `http_client` and pass
-`trust_transport_security=True` explicitly.
+The Python Client and CLI apply the matching rule for outbound requests: a configured unencrypted `http://` Server
+URL is accepted only for loopback hosts. The Client refuses to send any request, authenticated or not, over
+unencrypted non-loopback HTTP. Code whose `http://` base URL is only a routing label for a transport that is secure in
+practice, such as an in-process ASGI app, Unix-domain socket, or TLS-terminating proxy, must supply its own
+`http_client` and pass `trust_transport_security=True` explicitly. See
+[Deploy the Server](../how-to/deploy-server.md) for a safe Docker and remote-access setup.
 
 The Dashboard is enabled by default and shares the Server listener and port with the HTTP API and MCP. With no scopes
 configured, the page shows an empty state. Dashboard initialization failures are logged with their direct cause and do
@@ -308,3 +332,15 @@ after changing its environment.
 Pi rejects base URLs containing credentials, a query, or a fragment. Recall, capture, and boundary flushing fail open;
 explicit `pc_*` durable writes require confirmation and are refused when Pi has no interactive UI. Restart Pi after
 changing these variables.
+
+## Other Agent integrations
+
+Some integrations have their own configuration file or environment prefix. Their guides are the source of truth:
+
+- [Hermes](../how-to/configure-hermes.md)
+- [LangChain](../how-to/configure-langchain.md)
+- [LangGraph](../how-to/configure-langgraph.md)
+- [OpenClaw](../how-to/configure-openclaw.md)
+- [OpenCode](../how-to/configure-opencode.md)
+- [Pydantic AI adapter preview](../how-to/configure-pydantic-ai.md)
+- [WorkBuddy](../how-to/configure-workbuddy.md)
diff --git a/docs/en/docs/reference/http-api.md b/docs/en/docs/reference/http-api.md
new file mode 100644
index 000000000..069f38d6c
--- /dev/null
+++ b/docs/en/docs/reference/http-api.md
@@ -0,0 +1,128 @@
+---
+title: HTTP API
+description: Call the PowerContext Server over HTTP and find the complete OpenAPI contract.
+---
+
+# HTTP API
+
+The HTTP API is the language-neutral interface to a running PowerContext Server. The default base URL is
+`http://127.0.0.1:8000`.
+
+## Discover the contract
+
+With a local unauthenticated Server running, open:
+
+- `/docs` for interactive Swagger UI;
+- `/redoc` for ReDoc;
+- `/openapi.json` for the contract served by that process.
+
+The checked-in source of truth is
+[`openapi/powercontext.yaml`](https://github.com/oceanbase/powercontext/blob/master/openapi/powercontext.yaml).
+Use it when generating a client or reviewing every request and response field. When Server authentication is enabled,
+the three discovery routes require the same bearer token as other protected routes.
+
+## Authenticate requests
+
+Authentication is disabled for the default loopback-only installation. When the operator enables it, include this
+header on API and MCP requests:
+
+```http
+Authorization: Bearer <token>
+```
+
+The examples below use an optional shell variable:
+
+```bash
+POWERCONTEXT_URL=http://127.0.0.1:8000
+POWERCONTEXT_AUTH_HEADER="Authorization: Bearer ${POWERCONTEXT_CLIENT_API_TOKEN}"
+```
+
+Omit `--header "$POWERCONTEXT_AUTH_HEADER"` when authentication is disabled. The `/health/live` and
+`/health/ready` endpoints are always public. See [Deploy the Server](../how-to/deploy-server.md) before allowing remote
+access.
+
+## Store and search one Memory
+
+Choose a stable `scope_id` for the project or tenant. Reuse it across sessions; a session ID is not a durable project
+identity.
+
+Store one already-curated Memory entry:
+
+```bash
+curl --fail-with-body \
+  --request POST \
+  --header 'Content-Type: application/json' \
+  --header "$POWERCONTEXT_AUTH_HEADER" \
+  --data '{
+    "scope_id": "project:example",
+    "kind": "decision",
+    "text": "Keep the public API asynchronous."
+  }' \
+  "$POWERCONTEXT_URL/v1/memory/remember"
+```
+
+The response contains an exact citation. Keep that citation when a later request must revise, retire, or read that
+specific immutable revision.
+
+Search active entries in the same scope:
+
+```bash
+curl --fail-with-body \
+  --request POST \
+  --header 'Content-Type: application/json' \
+  --header "$POWERCONTEXT_AUTH_HEADER" \
+  --data '{
+    "scope_id": "project:example",
+    "query": "public API",
+    "limit": 5
+  }' \
+  "$POWERCONTEXT_URL/v1/memory/search"
+```
+
+## Find an operation
+
+| Area | Main paths | Purpose |
+| --- | --- | --- |
+| Health and capabilities | `/health/*`, `/v1/capabilities` | Probe the deployment and discover enabled runtime behavior |
+| Source and context | `/v1/sources/content`, `/v1/context/prepare` | Capture evidence and prepare bounded context |
+| Work continuity | `/v1/work/*` | Create work contracts, prepare or acknowledge Handoffs, and record outcomes |
+| Low-level Handoff | `/v1/handoff/*` | Activate, prepare, finalize, commit, or continue a Handoff |
+| Memory | `/v1/memory/*` | Flush, remember, search, list, get, revise, retire, and inspect changes |
+| Experience and Skill | `/v1/experience/*`, `/v1/skill/*` | Propose, generate, and read Artifact revisions |
+| Review | `/v1/artifact-candidates/*` | List, inspect, revise, approve, or reject pending Candidates |
+| External Skills | `/v1/external-skills/*` | Scan configured targets and resolve or import packages |
+| Handoff Reports | `/v1/handoff-reports/*` | Manage Projects, Workstreams, activities, reports, and workspace bindings |
+| Statistics | `/v1/stats` | Read scoped usage statistics |
+
+The OpenAPI contract defines the complete path list, schemas, limits, and status codes. The higher-level workflow and
+Python examples are in [Interfaces](interfaces.md).
+
+## Handle errors and concurrent changes
+
+Errors use one JSON envelope:
+
+```json
+{
+  "error": {
+    "code": "invalid_request",
+    "message": "The request violates the API contract.",
+    "details": {}
+  }
+}
+```
+
+Common statuses are:
+
+| Status | Meaning |
+| --- | --- |
+| `401` | The Server requires a valid bearer token |
+| `404` | The requested immutable value does not exist |
+| `409` | The request conflicts with current immutable state or an expected version |
+| `413` | A selected Handoff Report exceeds its output limit |
+| `422` | The JSON body violates the transport or application contract |
+| `503` | A required Runtime binding or dependency is unavailable |
+| `500` | The Server failed without exposing internal details |
+
+Every response includes `X-PowerContext-Request-ID`; record it when diagnosing a failed call. Preserve exact citations
+for Memory revision and retirement. Candidate review writes require the current `expected_version`; after a `409`, read
+the Candidate again before deciding whether to retry.
diff --git a/docs/en/docs/reference/interfaces.md b/docs/en/docs/reference/interfaces.md
index 4149f25ca..661268c4a 100644
--- a/docs/en/docs/reference/interfaces.md
+++ b/docs/en/docs/reference/interfaces.md
@@ -7,19 +7,24 @@ description: Choose between Agent integrations, the CLI, Python SDKs, HTTP, and
 
 All remote interfaces operate on the same Server and persistent Artifact storage.
 
-| Interface | Intended use | Install |
+| Interface | Intended use | Start here |
 | --- | --- | --- |
-| Codex plugin | Cross-session recall and explicit Memory maintenance in Codex | `powercontext setup codex` |
-| Pydantic AI adapter | Memory tools, automatic context preparation, and optional trajectory capture | `powercontext-pydantic-ai` |
-| DeepSeek Harness plugin | Cross-session recall and explicit Memory maintenance in DeepSeek Harness | `powercontext setup dsh` |
-| LangChain middleware | Bounded recall and completed-turn Source capture in `create_agent` | `powercontext-langchain` |
-| LangGraph adapter | Memory tools and bounded recall inside a LangGraph graph | `powercontext-langgraph` |
-| Pi package | Cross-session recall, native Memory/Handoff tools, and skills in Pi | `powercontext setup pi` |
-| CLI | Setup, diagnostics, Server control, capability checks, and human Candidate review | `powercontext[cli,server]` |
-| Python Client SDK | Typed async calls to a running Server | `powercontext[client]` |
-| Core SDK | In-process Source, Artifact, Trigger, and composition contracts | base package |
-| HTTP | Service integration from any language | `powercontext[server]` |
-| MCP | Agent tools for Memory and work continuity | enabled by Server |
+| Codex plugin | Cross-session recall and explicit Memory maintenance in Codex | [Configure Codex](../how-to/configure-codex.md) |
+| Claude Code plugin | Cross-session recall and Handoff in Claude Code | [Configure Claude Code](../how-to/configure-claude-code.md) |
+| DeepSeek Harness plugin | Recall and explicit Memory maintenance in DeepSeek Harness | [Configure DeepSeek Harness](../how-to/configure-dsh.md) |
+| Hermes integration | Recall, Memory, and Handoff tools in Hermes | [Configure Hermes](../how-to/configure-hermes.md) |
+| OpenClaw plugin | Bounded recall and durable Memory tools in OpenClaw | [Configure OpenClaw](../how-to/configure-openclaw.md) |
+| OpenCode plugin | Recall and Memory maintenance in OpenCode | [Configure OpenCode](../how-to/configure-opencode.md) |
+| Pi package | Recall, native Memory/Handoff tools, and skills in Pi | [Configure Pi](../how-to/configure-pi.md) |
+| WorkBuddy integration | Prompt recall, MCP tools, and Handoff in WorkBuddy | [Configure WorkBuddy](../how-to/configure-workbuddy.md) |
+| Pydantic AI adapter | Preview API; no supported standalone install yet | [Adapter status](../how-to/configure-pydantic-ai.md) |
+| LangChain middleware | Bounded recall and completed-turn Source capture in `create_agent` | [Install from source](../how-to/configure-langchain.md) |
+| LangGraph adapter | Memory tools and bounded recall inside a LangGraph graph | [Install from source](../how-to/configure-langgraph.md) |
+| CLI | Setup, diagnostics, Server control, and human Candidate review | [Install and run](../how-to/install-and-run.md) |
+| Python Client SDK | Typed asynchronous calls to a running Server | [Install the client role](../how-to/install-and-run.md#install-a-python-role) |
+| Core SDK | In-process Source, Artifact, Trigger, and composition contracts | [Python API reference](/en/modules/) |
+| HTTP | Service integration from any language | [HTTP API](http-api.md) |
+| MCP | Agent tools for Memory and work continuity | Enabled by the Server at `/mcp` |
 
 ## Codex plugin
 
@@ -85,11 +90,11 @@ HTTP operations. The plugin never starts or embeds the Server.
 
 ## Pydantic AI adapter
 
-The independent `powercontext-pydantic-ai` distribution contributes three Memory tools through the public Python
-Client and can automatically prepend bounded `PreparedContext`. Optional capture stores redacted, bounded visible
-model and completed tool events, performs checkpoint Flush, and flushes remaining Sources after the run. MCP needs no
-adapter package but does not provide automatic context preparation, capture, or Flush. See
-[Configure Pydantic AI](../how-to/configure-pydantic-ai.md).
+The repository contains a preview Pydantic AI adapter with three Memory tools and automatic bounded
+`PreparedContext`. It is not currently available as a supported standalone package. Optional capture stores
+redacted, bounded visible model and completed tool events, performs checkpoint Flush, and flushes remaining Sources
+after the run. MCP needs no adapter package but does not provide automatic context preparation, capture, or Flush.
+See [Pydantic AI adapter preview](../how-to/configure-pydantic-ai.md).
 
 ## LangGraph adapter
 
@@ -100,11 +105,11 @@ labelled untrusted historical evidence; and `PowerContextScope` is a dataclass f
 carries the scope and per-run connection overrides. The recall node and tools read the active scope from the LangGraph
 runtime and otherwise fall back to `POWERCONTEXT_LANGGRAPH_*` environment settings.
 
-Scope resolution prefers an explicit `scope_id`, then a Git-remote-derived scope, and otherwise raises — the inverse of
-the Codex resolver, because a deployed graph's working directory rarely identifies the project. `TOKEN` is a bare token
-that the Client composes into `Authorization: Bearer`, unlike the `POWERCONTEXT_*_AUTHORIZATION` header used by the
+Scope resolution prefers an explicit `scope_id`, then a Git-remote-derived scope, and otherwise raises. This is the
+inverse of the Codex resolver because a deployed graph's working directory rarely identifies the project. `TOKEN` is
+a bare token that the Client composes into `Authorization: Bearer`, unlike the `POWERCONTEXT_*_AUTHORIZATION` header used by the
 Codex, Claude Code, and DeepSeek Harness plugins. Recall and the tools fail open: on Server unavailability the graph
-still reaches its end and the tools return a short unavailable string. This release covers Memory read and write and
+still reaches its end and the tools return a short unavailable string. The adapter covers Memory read and write and
 bounded recall only; automatic capture, checkpointing, and Handoff are out of scope. The adapter deliberately does not
 implement `BaseStore`, whose get, upsert-by-key, and delete operations the Memory model does not provide. It never
 starts or embeds the Server.
@@ -115,8 +120,8 @@ starts or embeds the Server.
 current model request without changing agent state. Automatic capture is disabled by default; pass `auto_capture=True`
 to capture the latest user message and final plain-text or structured answer as Content Source evidence after a
 successful run. Source-to-Memory activation remains a Server responsibility. Recall and capture fail open, and neither
-path starts or embeds the Server. It ships independently as `powercontext-langchain`; the LangGraph adapter remains a
-separate node-and-tool integration.
+path starts or embeds the Server. Its source is packaged as `powercontext-langchain`, but it is not currently
+published on PyPI. The LangGraph adapter remains a separate node-and-tool integration.
 
 ## Pi package
 
@@ -128,24 +133,16 @@ boundary flushing fail open; explicit durable writes require interactive confirm
 ## CLI
 
 ```text
-powercontext setup codex
-powercontext setup claude-code
-powercontext setup dsh
-powercontext setup openclaw
-powercontext setup opencode
-powercontext setup pi
-powercontext setup hermes
-powercontext setup select
+powercontext setup <host> --source oceanbase/powercontext --ref master
+powercontext setup select --host codex --host dsh --source oceanbase/powercontext --ref master
+powercontext config init --output .env
+powercontext config show --env-file .env
+powercontext config validate --env-file .env
 powercontext doctor
+powercontext doctor <host>
 powercontext doctor integrations
-powercontext doctor codex
-powercontext doctor claude-code
-powercontext doctor dsh
-powercontext doctor openclaw
-powercontext doctor opencode
-powercontext doctor pi
-powercontext doctor hermes
 powercontext server run
+powercontext server run --env-file .env
 powercontext ready
 powercontext capabilities
 powercontext experience generate --scope-id project:example --source-ref content/SOURCE_ID
@@ -164,6 +161,14 @@ powercontext external-skill import --scope-id project:example --fingerprint SHA2
 All content commands call the configured Server. The optional `server` role adds `powercontext server run`; it does
 not create a second content profile inside the CLI.
 
+The `config` group creates, redacts, and validates an explicit environment file. The CLI never searches for that file
+implicitly; pass it to `config show`, `config validate`, or `server run` with `--env-file`. See
+[Configuration](configuration.md) for precedence and credential-handling rules.
+
+Use `codex`, `claude-code`, `dsh`, `hermes`, `openclaw`, `opencode`, `pi`, or `workbuddy` for `<host>`.
+The first-class catalog used by `setup select` and `doctor integrations` contains every listed host except WorkBuddy.
+WorkBuddy remains available through the explicit `setup workbuddy` and `doctor workbuddy` commands.
+
 `powercontext doctor` checks the package and Server without requiring an integration. `powercontext doctor integrations`
 prints a read-only matrix for every first-class host; a missing CLI is `missing` and does not fail the command.
 Each `powercontext doctor <host>` command still fails when that host CLI is missing. The matrix preserves every
@@ -306,10 +311,11 @@ want the supplied SQLite or OceanBase-backed implementation in the same process.
 
 ## HTTP and MCP
 
-The Server publishes its OpenAPI document at `/openapi.json`, readiness at `/health/ready`, capabilities at
+See [HTTP API](http-api.md) for authentication, curl examples, operation groups, errors, and the complete OpenAPI
+contract. The Server publishes its OpenAPI document at `/openapi.json`, readiness at `/health/ready`, capabilities at
 `/v1/capabilities`, and Streamable HTTP MCP at `/mcp` by default. HTTP is the complete application contract. MCP is a
-curated agent-facing projection of Memory and Candidate Review operations. The five Candidate Review operations use the
-same validation, `expected_version` concurrency checks, and approval transaction over HTTP and MCP.
+curated agent-facing projection of Memory and Candidate Review operations. The five Candidate Review operations use
+the same validation, `expected_version` concurrency checks, and approval transaction over HTTP and MCP.
 Readiness is `ready` with HTTP 200 when all checks pass, `degraded` with HTTP 200 when only configured inference checks
 fail, and `not_ready` with HTTP 503 when the Runtime or database fails. Dependency checks use `ready`, `unavailable`,
 `timeout`, or `misconfigured`; an intentionally unbound Runtime reports `not_ready` for the `runtime` check.
diff --git a/docs/en/modules.md b/docs/en/modules.md
index 1c74cda0c..e509fb8a4 100644
--- a/docs/en/modules.md
+++ b/docs/en/modules.md
@@ -1,7 +1,12 @@
-# API Reference
+---
+title: Python API reference
+description: Generated reference for the public Python modules in the current package.
+---
+
+# Python API reference
 
 This reference is generated from the public modules in the current package. RFCs may describe planned behavior that is
-not part of this API.
+not part of this API. For service endpoints and curl examples, see the [HTTP API](docs/reference/http-api.md).
 
 ## Composition
 
diff --git a/docs/zh/docs/how-to/configure-hermes.md b/docs/zh/docs/how-to/configure-hermes.md
new file mode 100644
index 000000000..2fde0931d
--- /dev/null
+++ b/docs/zh/docs/how-to/configure-hermes.md
@@ -0,0 +1,98 @@
+---
+title: 配置 Hermes
+description: 安装 Hermes MemoryProvider 和独立 slash-command 插件，并连接到 PowerContext Server。
+---
+
+# 配置 Hermes
+
+该集成包含标准 Hermes `MemoryProvider` 和独立 slash-command 插件。Hermes 继续负责对话和 Memory 生命周期，
+provider 把召回、采集和显式操作发送给单独运行的 PowerContext Server；该插件会在 provider 激活前注册
+`/pc` 和 `/powercontext`。后端故障不会中断 Hermes 对话。
+
+## 前置条件
+
+- `PATH` 中存在 Hermes Agent 0.20.4 或更新版本；
+- 从 `master` 安装 PowerContext CLI 和 Server；
+- PowerContext Server 正在运行。
+
+```bash
+uv tool install --force "powercontext[cli,server] @ git+https://github.com/oceanbase/powercontext.git@master"
+powercontext server run
+```
+
+## 安装两个插件
+
+在另一个终端从同一 revision 安装或刷新两个插件：
+
+```bash
+powercontext setup hermes --source oceanbase/powercontext --ref master
+powercontext doctor hermes
+```
+
+Setup 命令会把 provider 复制到 `$HERMES_HOME/plugins/powercontext`，安装
+`$HERMES_HOME/plugins/powercontext-command`，并在不授予内置工具覆盖权限的情况下启用 slash-command 插件。它不会启动
+Server，也不会在 Hermes 中选择 provider。
+
+运行 Hermes Memory 设置向导，并选择 `PowerContext`：
+
+```bash
+hermes memory setup
+```
+
+Hermes 0.20.4 应使用上面的通用命令。`hermes memory setup powercontext` 只选择 provider，不会打开配置向导。
+设置完成后重启 Hermes。
+
+## 验证召回和写入
+
+```bash
+hermes powercontext status
+hermes powercontext remember preference "The user prefers uv"
+hermes powercontext search "Python package manager"
+```
+
+在交互式 Hermes 会话中，`/pc status` 应连接到同一个 active provider。输入 `/pc ` 后按 Tab/Down，可查看
+Memory、Handoff、Experience、Skill、审核、统计、trace 和 Workstream 命令。Hermes 0.20.4 没有为 gateway
+slash command 提供足够的调用上下文，因此该插件会拒绝 gateway 调用；gateway 会话应使用 provider 提供的
+Hermes tools。
+
+provider 默认连接 `http://127.0.0.1:8000`。在 Git workspace 中，默认启用的 Workstream persistence 会先读取
+共享的 `.git/powercontext/codex-workspace.json` scope binding；显式 scope 配置的优先级更高。两者都没有时，
+provider 根据当前 Hermes profile 和 gateway user identifier 推导 scope；本地 CLI 会话没有 user identifier 时，
+会从 `HERMES_HOME` 推导稳定值。
+
+## 配置连接
+
+向导把非敏感设置写入 `$HERMES_HOME/powercontext/config.json`。环境变量会覆盖文件：
+
+| 变量 | 用途 |
+| --- | --- |
+| `POWERCONTEXT_HERMES_CONFIG` | 配置文件路径；默认为 `$HERMES_HOME/powercontext/config.json` |
+| `POWERCONTEXT_HERMES_BASE_URL` | PowerContext Server URL |
+| `POWERCONTEXT_HERMES_AUTHORIZATION` | 完整 authorization header，例如 `Bearer <token>` |
+| `POWERCONTEXT_HERMES_TOKEN` | 未设置 `AUTHORIZATION` 时使用的裸 token 简写 |
+| `POWERCONTEXT_HERMES_SCOPE_ID` | 显式 scope 或 scope template |
+| `POWERCONTEXT_HERMES_MAX_BYTES` | Prepared Context 上限，范围为 512 到 32768 字节 |
+| `POWERCONTEXT_HERMES_TIMEOUT` | HTTP 请求超时秒数 |
+| `POWERCONTEXT_HERMES_CAPTURE_TURNS` | 是否把完成的 turn 采集为 Source |
+| `POWERCONTEXT_HERMES_FLUSH_ON_SESSION_END` | 是否在会话结束时执行 Memory extraction |
+| `POWERCONTEXT_HERMES_CAPTURE_PRE_COMPRESS` | compression 前采集过滤后的新 turn；默认关闭 |
+| `POWERCONTEXT_HERMES_EVALUATION_TRACE` | 把召回上下文记录到敏感的本地 JSONL trace；默认关闭 |
+| `POWERCONTEXT_HERMES_EVALUATION_TRACE_PATH` | 覆盖 evaluation trace 目录 |
+| `POWERCONTEXT_HERMES_WORKSTREAM` | 读取 Git-private 的共享 Workstream binding；默认启用 |
+
+应由 Hermes 向导把 authorization 保存到受保护的 `.env` secret store，不要把 token 写入 `config.json`。明文 HTTP
+只用于 loopback Server；连接远程部署前请阅读[部署 Server](deploy-server.md)。Evaluation trace 包含 prompt 和
+召回上下文，应保留在本机并按敏感数据保护。
+
+## 只在需要时启用自动提取
+
+完成轮次采集只创建 Source 证据，不会自行创建 Memory。自动 Source-to-Memory 提取需要在 Server 上配置 generation
+model：
+
+```bash
+export POWERCONTEXT_SERVER_INFERENCE_GENERATION_MODEL=provider:model-name
+powercontext server run
+powercontext capabilities
+```
+
+能力输出必须显示 Memory extraction 已启用。显式执行 `hermes powercontext remember` 不需要模型。
diff --git a/docs/zh/docs/how-to/configure-langchain.md b/docs/zh/docs/how-to/configure-langchain.md
index 0b3903037..195bd3442 100644
--- a/docs/zh/docs/how-to/configure-langchain.md
+++ b/docs/zh/docs/how-to/configure-langchain.md
@@ -14,17 +14,17 @@ checkpointer。
 
 ## 安装
 
-middleware 由独立的 `powercontext-langchain` 包分发，要求 LangChain 1.3 或更高版本：
+middleware 源码独立打包为 `powercontext-langchain`，要求 LangChain 1.3 或更高版本。目前该包没有发布到 PyPI：
 
 ```bash
-uv tool install "powercontext[cli,server]==0.0.2"
+uv tool install --force "powercontext[cli,server] @ git+https://github.com/oceanbase/powercontext.git@master"
 powercontext server run
 ```
 
 保持 Server 运行，然后在 LangChain 应用自己的环境中安装 middleware：
 
 ```bash
-uv pip install "powercontext-langchain @ git+https://github.com/oceanbase/powercontext.git#subdirectory=integrations/langchain"
+uv pip install "powercontext-langchain @ git+https://github.com/oceanbase/powercontext.git@master#subdirectory=integrations/langchain"
 ```
 
 应用已经连接到单独管理的 Server 时，可以跳过 Server 安装。在仓库 checkout 中可使用
diff --git a/docs/zh/docs/how-to/configure-langgraph.md b/docs/zh/docs/how-to/configure-langgraph.md
index 4b22de243..508d4b780 100644
--- a/docs/zh/docs/how-to/configure-langgraph.md
+++ b/docs/zh/docs/how-to/configure-langgraph.md
@@ -13,12 +13,12 @@ description: 把 LangGraph 图连接到运行中的 PowerContext Server，获得
 该包尚未发布到 PyPI，请从源码安装，并配合一个运行中的 Server：
 
 ```bash
-uv pip install "powercontext-langgraph @ git+https://github.com/oceanbase/powercontext.git#subdirectory=integrations/langgraph"
+uv pip install "powercontext-langgraph @ git+https://github.com/oceanbase/powercontext.git@master#subdirectory=integrations/langgraph"
 powercontext server run
 ```
 
-在仓库检出目录下，也可以直接安装本地路径：`uv pip install ./integrations/langgraph`。发布到 PyPI 需要一个独立的
-构建与发布步骤，且该包版本需独立于根 `powercontext` 分发单独推进；在此之前，请使用上面的源码安装方式。
+在仓库检出目录下，也可以直接安装本地路径：`uv pip install ./integrations/langgraph`。该适配器目前没有发布到
+PyPI，请使用上述任一种源码安装方式。
 
 该包依赖 `powercontext[client]`、`langgraph`、`langchain-core` 和 `pydantic-settings`，不会拉入 Server；请把它指向
 一个单独运行的 Server。
@@ -134,9 +134,9 @@ debug 级别记录。Memory 工具返回简短的 `(PowerContext unavailable: ..
 search、其余抛错，会产生一个能通过装配期校验、却在无关节点或工具内运行时失败的对象，比不提供 store 更糟。因此适配器
 在节点和工具层集成，不占用 `compile()` 的 `store` 参数。
 
-## 本次发布范围
+## 当前范围
 
-范围内：Memory 读写，以及有界上下文准备。
+已包含：Memory 读写，以及有界上下文准备。
 
-本次发布范围外：自动轨迹采集、checkpointing、Handoff、Artifact Candidate 审核，以及 Experience 或 Skill 生成。显式写入
-请用 `powercontext_remember`；把一次运行自动采集为 Source 证据不属于本适配器。
+未包含：自动轨迹采集、checkpointing、Handoff、Artifact Candidate 审核，以及 Experience 或 Skill 生成。显式写入请用
+`powercontext_remember`；把一次运行自动采集为 Source 证据不属于本适配器。
diff --git a/docs/zh/docs/how-to/configure-openclaw.md b/docs/zh/docs/how-to/configure-openclaw.md
index 6b941c5b8..d1a9468c9 100644
--- a/docs/zh/docs/how-to/configure-openclaw.md
+++ b/docs/zh/docs/how-to/configure-openclaw.md
@@ -7,7 +7,7 @@ description: 为 OpenClaw 安装 PowerContext memory 插件，并控制召回、
 
 ## 安装或刷新插件
 
-在 PowerContext 正式版本包含 OpenClaw 之前，从同一个 `master` revision 安装 CLI 和插件：
+从同一个 `master` revision 安装 CLI 和插件：
 
 ```bash
 uv tool install --force "powercontext[cli,server] @ git+https://github.com/oceanbase/powercontext.git@master"
diff --git a/docs/zh/docs/how-to/configure-pydantic-ai.md b/docs/zh/docs/how-to/configure-pydantic-ai.md
index d7e26d991..001a64771 100644
--- a/docs/zh/docs/how-to/configure-pydantic-ai.md
+++ b/docs/zh/docs/how-to/configure-pydantic-ai.md
@@ -1,20 +1,23 @@
 ---
-title: 配置 Pydantic AI
-description: 为 Pydantic AI 增加持久化 Memory 工具、自动 Context 准备和可选轨迹采集。
+title: Pydantic AI 适配器预览
+description: 了解当前 Pydantic AI 适配器 API 和安装状态。
 ---
 
-# 配置 Pydantic AI
+# Pydantic AI 适配器预览
 
-当 Pydantic AI Agent 需要通过运行中的 PowerContext Server 共享持久化 Memory 时，安装独立发行的
-`powercontext-pydantic-ai` 包。
+仓库中包含一个预览适配器，用于让 Pydantic AI Agent 通过运行中的 PowerContext Server 共享持久化 Memory。目前
+还没有受支持的独立安装方式。
 
-## 安装适配器
+## 使用前检查可用状态
 
-先启动 Server，再在 Agent 应用中安装：
+`powercontext-pydantic-ai` 目前没有发布到 PyPI。它的源码包还要求正式版本
+`powercontext[client]>=0.0.3`，而当前公开包和 `master` 的开发版本都不满足该约束。因此，旧的 PyPI 命令和直接从
+Git subdirectory 安装都会在依赖解析时失败。
 
-```bash
-uv add powercontext-pydantic-ai "pydantic-ai-slim[openai]"
-```
+请等待根包和适配器发布兼容版本后再把它加入应用。仓库贡献者可以通过根目录开发环境运行适配器测试；后续内容仅用于
+说明预览 API，不能作为受支持的安装路径。
+
+## 挂载预览 Capability
 
 下面的示例使用 OpenAI。使用其他 Provider 时，请安装匹配的 `pydantic-ai-slim` Provider extra，并修改模型字符串。
 
@@ -103,5 +106,5 @@ Capture 默认关闭。只有在允许把初始用户文本、可见模型文本
 连接 PowerContext MCP 不需要额外适配器包，但对 Pydantic AI 来说能力较低。MCP 提供显式工具，不会自动调用
 `prepare_context`，也不会采集轨迹或在 checkpoint/run 结束时 Flush。
 
-首版只支持普通 Pydantic AI run；Temporal、DBOS、Prefect 等 durable execution 尚未验证。Handoff、Candidate
+预览版只支持普通 Pydantic AI run；Temporal、DBOS、Prefect 等 durable execution 尚未验证。Handoff、Candidate
 Review、Experience 与 Skill operation 不在本适配器范围内。
diff --git a/docs/zh/docs/how-to/configure-workbuddy.md b/docs/zh/docs/how-to/configure-workbuddy.md
index 2293aab3b..49059e221 100644
--- a/docs/zh/docs/how-to/configure-workbuddy.md
+++ b/docs/zh/docs/how-to/configure-workbuddy.md
@@ -7,8 +7,7 @@ description: 安装 PowerContext WorkBuddy hooks 并控制其本地行为。
 
 ## 前置条件
 
-- 已安装并可运行的 PowerContext。在带有 WorkBuddy 支持的新版本发布前，从与下方插件相同的 `master`
-  revision 安装 CLI 和本地 Server：
+- 已安装并可运行的 PowerContext。从与下方插件相同的 `master` revision 安装 CLI 和本地 Server：
   `uv tool install "powercontext[cli,server] @ git+https://github.com/oceanbase/powercontext.git@master"`。
   然后执行 `powercontext server run` 启动 Server。
 - 支持用户级 hooks、MCP 和 Skills 的 WorkBuddy 桌面应用。
diff --git a/docs/zh/docs/how-to/deploy-server.md b/docs/zh/docs/how-to/deploy-server.md
new file mode 100644
index 000000000..6c3d864e9
--- /dev/null
+++ b/docs/zh/docs/how-to/deploy-server.md
@@ -0,0 +1,131 @@
+---
+title: 部署 Server
+description: 使用持久化数据、健康检查、鉴权和安全网络边界运行 PowerContext。
+---
+
+# 部署 Server
+
+`powercontext server run` 是前台进程。个人工作站可以直接在终端中运行；长期运行时，应由容器平台或服务管理器负责启动、
+重启和收集日志。
+
+## 选择网络边界
+
+Server 默认在未启用鉴权的情况下监听 `127.0.0.1:8000`，适合本机客户端使用。鉴权关闭时，不要把监听地址改为非
+loopback 地址。
+
+如果需要从其他机器访问：
+
+1. 启用 Bearer 鉴权；
+2. 把 Server 放在负责 TLS 的反向代理或私有网络边界后面；
+3. 通过 secret manager 或受保护的进程环境提供 token；
+4. 只允许 Server 运维者访问数据目录。
+
+内置命令只提供 HTTP，没有 TLS 选项。HTTPS 必须在 PowerContext 外部终止。
+
+## 从已安装工具运行
+
+按照[安装和运行](install-and-run.md)安装 PowerContext，然后选择持久化数据目录：
+
+```bash
+export POWERCONTEXT_HOME=/srv/powercontext
+powercontext server run
+```
+
+运行进程必须能创建和更新该目录。默认 SQLite 数据库和 scheduler 状态都保存在这里。服务管理器每次重启进程时都应
+提供相同的环境变量。
+
+PowerContext 不会自动搜索 `.env` 文件。可以导出变量、由服务管理器或容器平台提供，或者显式传入一个文件：
+
+```bash
+powercontext config validate --env-file /etc/powercontext/powercontext.env
+powercontext server run --env-file /etc/powercontext/powercontext.env
+```
+
+文件可能包含 Provider 凭据或 Bearer token，因此只能允许 Server 运维者读取。文件中的值会覆盖进程中的同名值；
+文件中不存在的旧 `POWERCONTEXT_SERVER_*` 进程变量会被忽略。需要交互式生成并校验配置文件时，请阅读
+[完整功能 Quick Start](full-capability-runtime.md)。
+
+## 使用 Docker 运行
+
+在仓库根目录构建镜像：
+
+```bash
+POWERCONTEXT_VERSION=$(uvx --from hatchling --with hatch-vcs hatchling version)
+docker build \
+  --file docker/Dockerfile \
+  --build-arg "POWERCONTEXT_VERSION=${POWERCONTEXT_VERSION}" \
+  --tag powercontext-server:local \
+  .
+```
+
+使用 named volume，并且只在宿主机 loopback 地址发布端口：
+
+```bash
+docker run --rm \
+  --name powercontext-server \
+  --publish 127.0.0.1:8000:8000 \
+  --volume powercontext-data:/data \
+  powercontext-server:local
+```
+
+镜像内部监听 `0.0.0.0:8000`，所以 `--publish` 中的宿主机地址非常重要。容器停止后，named volume 仍会保留
+SQLite 数据库和 scheduler 状态。
+
+## 启用鉴权
+
+从 secret manager 把强 token 加载到 Server 进程环境：
+
+```bash
+export POWERCONTEXT_SERVER_AUTH_ENABLED=true
+export POWERCONTEXT_SERVER_AUTH_TOKEN="$POWERCONTEXT_DEPLOYMENT_TOKEN"
+powercontext server run
+```
+
+使用 Docker 时，只传递已经加载的环境变量，不要把 token 值写进命令：
+
+```bash
+docker run --rm \
+  --name powercontext-server \
+  --publish 127.0.0.1:8000:8000 \
+  --volume powercontext-data:/data \
+  --env POWERCONTEXT_SERVER_AUTH_ENABLED=true \
+  --env POWERCONTEXT_SERVER_AUTH_TOKEN \
+  powercontext-server:local
+```
+
+此后客户端需要发送 `Authorization: Bearer <token>`。liveness 和 readiness endpoint 保持公开，便于编排系统探测；
+API、MCP、metrics、OpenAPI 和交互式 API 文档都需要鉴权。
+
+## 检查部署
+
+使用 liveness 判断进程能否响应 HTTP 请求：
+
+```bash
+curl --fail http://127.0.0.1:8000/health/live
+```
+
+发送业务流量前检查 readiness：
+
+```bash
+curl --fail http://127.0.0.1:8000/health/ready
+```
+
+必需的 Runtime 或数据库绑定不可用时，readiness 返回 HTTP 503。可选推理服务故障时可能返回 HTTP 200 和
+`degraded`，数据库操作仍然可用。
+
+启用鉴权后，还应检查一个受保护的 endpoint：
+
+```bash
+curl --fail \
+  --header "Authorization: Bearer ${POWERCONTEXT_DEPLOYMENT_TOKEN}" \
+  http://127.0.0.1:8000/v1/capabilities
+```
+
+请求示例见 [HTTP API](../reference/http-api.md)，全部 Server 设置见[配置](../reference/configuration.md)。
+
+## 保护和备份数据
+
+- 备份 `POWERCONTEXT_HOME` 指向的目录，或挂载到 `/data` 的 Docker volume。
+- 执行文件系统级 SQLite 备份时，应先停止写入或停止 Server。
+- 不要把数据库备份或 Bearer token 放进仓库。
+- 在依赖备份流程前先验证恢复操作。
diff --git a/docs/zh/docs/how-to/install-and-run.md b/docs/zh/docs/how-to/install-and-run.md
index 6b816c800..58436c077 100644
--- a/docs/zh/docs/how-to/install-and-run.md
+++ b/docs/zh/docs/how-to/install-and-run.md
@@ -7,21 +7,20 @@ description: 从 Git 安装 PowerContext，并运行本地 Server。
 
 ## 安装应用
 
-先安装 `uv`，再从指定 Git ref 直接安装 PowerContext：
+需要在 macOS 或 Linux 上准备 Python 3.11 或更新版本、Git 和
+[`uv`](https://docs.astral.sh/uv/)，然后从指定 Git ref 直接安装 PowerContext：
 
 ```bash
 uv tool install "powercontext[cli,server] @ git+https://github.com/oceanbase/powercontext.git@master"
 ```
 
-该方式支持 macOS 和 Linux，不需要用户自行管理仓库工作副本。Git 会沿用本机的凭据配置，包括 credential
-helper 和 SSH 设置。如需使用 SSH，请把 HTTPS URL 换成当前环境允许的 Git URL。
+该命令不会留下需要自行管理的仓库工作副本。Git 会沿用本机的凭据配置，包括 credential helper 和 SSH 设置。
+如需使用 SSH，请把 HTTPS URL 换成当前环境允许的 Git URL。
 
 安装指定分支或 tag 时，替换最后一个 `@` 后的 `master`。配置集成时应使用同一个 ref：
 
 ```bash
 powercontext setup codex --source oceanbase/powercontext --ref <ref>
-powercontext setup dsh --source oceanbase/powercontext --ref <ref>
-powercontext setup pi --source oceanbase/powercontext --ref <ref>
 ```
 
 单宿主命令仍是显式路径。一级宿主目录包含 `codex`、`claude-code`、`dsh`、`openclaw`、`opencode`、`pi`
@@ -37,7 +36,8 @@ powercontext setup select --host codex --host dsh --source oceanbase/powercontex
 通过现有安装后诊断后才会报告为 installed。安装 Hermes 后，还需运行 `hermes memory setup` 并选择 PowerContext，
 然后再启动 Hermes。
 
-宿主专有选项见[配置 Codex](configure-codex.md)和[配置 DeepSeek Harness](configure-dsh.md)。
+WorkBuddy 仍可通过 `powercontext setup workbuddy` 安装，但不在 `setup select` 中。站点导航中的集成指南说明了
+各宿主的前置条件、专有选项和行为。
 
 ## 运行本地 Server
 
@@ -59,6 +59,9 @@ powercontext server run
 
 按 `Ctrl-C` 可正常关闭。再次运行该命令会打开同一个数据库。
 
+这种最小启动方式不会启用依赖模型的抽取或向量搜索。如需生成并校验一份显式环境文件以启用这些能力，请继续阅读
+[完整功能 Quick Start](full-capability-runtime.md)。
+
 ## 使用嵌入式 seekDB
 
 在有兼容 `pylibseekdb` wheel 的 Linux 和 macOS 系统上可以使用嵌入式 seekDB；Windows 不支持该嵌入式
@@ -68,17 +71,18 @@ powercontext server run
 uv tool install --force "powercontext[cli,server,seekdb] @ git+https://github.com/oceanbase/powercontext.git@master"
 ```
 
-从 SQLite 切换时，需要从 `.env` 中删除 `POWERCONTEXT_SERVER_DATABASE_URL` 和
-`POWERCONTEXT_SERVER_DATABASE_VEC1_EXTENSION`，或在 shell 中取消这两个变量；seekDB 不接受这些配置。
-然后选择 seekDB 后端并启动 Server：
+从 SQLite 切换时，需要从 Server 进程环境中删除 `POWERCONTEXT_SERVER_DATABASE_URL`；seekDB 不接受显式的
+SQLAlchemy 数据库 URL。然后选择 seekDB 后端并启动 Server：
 
 ```bash
 unset POWERCONTEXT_SERVER_DATABASE_URL
-unset POWERCONTEXT_SERVER_DATABASE_VEC1_EXTENSION
 export POWERCONTEXT_SERVER_DATABASE_KIND=seekdb
 powercontext server run
 ```
 
+CLI 不会自动搜索 `.env` 文件。请在 shell 中导出这些值、在启动 Server 的进程管理器或容器中配置，或者通过
+`powercontext server run --env-file <path>` 显式传入文件。
+
 PowerContext 固定使用 seekDB 内置的 `test` 数据库。未设置 `POWERCONTEXT_SERVER_DATABASE_PATH` 时，实例保存在
 PowerContext 用户数据目录的 `seekdb` 子目录中；如果设置了 `POWERCONTEXT_HOME`，默认路径为
 `$POWERCONTEXT_HOME/seekdb`。只有需要其他位置时才设置 `POWERCONTEXT_SERVER_DATABASE_PATH`。
@@ -103,6 +107,7 @@ powercontext doctor openclaw
 powercontext doctor opencode
 powercontext doctor pi
 powercontext doctor hermes
+powercontext doctor workbuddy
 powercontext ready
 powercontext capabilities
 ```
@@ -110,10 +115,13 @@ powercontext capabilities
 `doctor` 检查已安装的包、Server 存活状态和 Server 就绪状态，不要求安装集成。Server 就绪检查涵盖数据库和
 每个已配置的推理服务。Runtime 或数据库故障返回 `not_ready`；推理服务故障返回 `degraded`，不会使数据库
 操作退出流量。`doctor integrations` 是可选的一级宿主只读总览，缺失 CLI 不会让该命令失败。
-各个 `doctor <host>` 命令分别检查一个可选宿主 CLI 及其全部 PowerContext 集成项。内容命令会经过公开 HTTP SDK
-路径。`ready` 和 `capabilities` 用于查看运行中服务的就绪状态和已启用能力。完整的状态解释和恢复步骤见
+各个 `doctor <host>` 命令分别检查一个可选宿主 CLI 及其全部 PowerContext 集成项。WorkBuddy 提供独立的
+`doctor workbuddy` 命令，但不出现在一级宿主总览中。内容命令会经过公开 HTTP SDK 路径。`ready` 和
+`capabilities` 用于查看运行中服务的就绪状态和已启用能力。完整的状态解释和恢复步骤见
 [排查问题](troubleshoot.md)。
 
+需要长期运行进程、使用 Docker、启用鉴权或允许远程访问时，请继续阅读[部署 Server](deploy-server.md)。
+
 ## 更新或替换安装
 
 使用指定 ref 替换现有工具：
@@ -121,12 +129,10 @@ powercontext capabilities
 ```bash
 uv tool install --force "powercontext[cli,server] @ git+https://github.com/oceanbase/powercontext.git@<ref>"
 powercontext setup codex --source oceanbase/powercontext --ref <ref>
-powercontext setup dsh --source oceanbase/powercontext --ref <ref>
-powercontext setup pi --source oceanbase/powercontext --ref <ref>
 ```
 
-更新后重启 Server，并开启新的宿主会话。只要没有修改 `POWERCONTEXT_HOME` 或数据库 URL，现有 SQLite
-数据会继续保留。
+对每个已安装宿主重复 setup 命令，并使用同一个 ref。更新后重启 Server，再开启新的宿主会话。只要没有修改
+`POWERCONTEXT_HOME` 或数据库 URL，现有 SQLite 数据会继续保留。
 
 ## 为 Python 项目安装角色
 
diff --git a/docs/zh/docs/index.md b/docs/zh/docs/index.md
index bdd91dc72..0655b7524 100644
--- a/docs/zh/docs/index.md
+++ b/docs/zh/docs/index.md
@@ -30,6 +30,9 @@ overview:
     - title: 理解与运行
       description: 判断什么需要保留，配置 Server，或排查无法工作的环境。
       cards:
+        - title: 完整功能 Quick Start
+          description: 生成一份经过校验的配置，并验证抽取、向量搜索和 Agent 闭环。
+          href: zh/docs/how-to/full-capability-runtime/
         - title: 核心概念
           description: 理解 scope、证据、带 Revision 的 Artifact、prepared context 和工作连续性。
           href: zh/docs/explanation/core-concepts/
@@ -42,6 +45,12 @@ overview:
         - title: 配置
           description: 设置存储、provider、接口和运行行为。
           href: zh/docs/reference/configuration/
+        - title: 部署 Server
+          description: 使用持久化数据、健康检查、鉴权和安全网络边界运行 Server。
+          href: zh/docs/how-to/deploy-server/
+        - title: HTTP API
+          description: 从任意语言调用 Server，并查阅完整 OpenAPI 契约。
+          href: zh/docs/reference/http-api/
         - title: 审核 Candidate
           description: 检查、修订、批准或拒绝待审核的 Experience 和 Skill 提案。
           href: zh/docs/how-to/review-candidates/
diff --git a/docs/zh/docs/reference/configuration.md b/docs/zh/docs/reference/configuration.md
index 576fe3a9a..1508d3f18 100644
--- a/docs/zh/docs/reference/configuration.md
+++ b/docs/zh/docs/reference/configuration.md
@@ -5,7 +5,24 @@ description: PowerContext 路径、Server、Client、推理和 Agent 集成环
 
 # 配置
 
-PowerContext 进程启动时从环境变量读取配置。
+PowerContext 进程启动时从环境变量读取配置。CLI 不会自动搜索 `.env` 文件；请在 shell 中导出变量、由服务管理器
+或容器提供，或者向支持 `--env-file` 的命令显式传入文件。Agent 宿主可能会按照自身规则加载自己的环境文件。
+
+## 显式环境文件
+
+通过引导生成配置，在不显示凭据的情况下检查内容，并在启动前完成校验：
+
+```bash
+powercontext config init --output .env
+powercontext config show --env-file .env
+powercontext config validate --env-file .env
+powercontext server run --env-file .env
+```
+
+`config init` 会以 `0600` 权限写入文件。`server run` 收到 `--env-file` 后，文件中的赋值会覆盖进程中的同名值；
+文件中不存在的旧 `POWERCONTEXT_SERVER_*` 进程变量会被忽略，因此校验和启动使用同一份 Server 配置。
+`config show` 会隐藏已识别及生成器记录的凭据，但仍应把原文件当作可能含有秘密的部署文件保护。完整的引导与验证流程见
+[完整功能 Quick Start](../how-to/full-capability-runtime.md)。
 
 ## 用户数据
 
@@ -44,7 +61,9 @@ Server 配置使用 `POWERCONTEXT_SERVER_` 前缀。
 | `POWERCONTEXT_SERVER_LOGGING_ACCESS` | `true` | 记录外部 HTTP 和逻辑 MCP request completion |
 | `POWERCONTEXT_SERVER_METRICS_ENABLED` | `true` | 在 `/metrics` 暴露 Prometheus metrics |
 | `POWERCONTEXT_SERVER_TRACING_ENABLED` | `false` | 启用 span recording 和 OTLP export |
-| `POWERCONTEXT_SERVER_DATABASE_URL` | 用户数据目录下的 SQLite 文件 | SQLAlchemy 异步数据库 URL |
+| `POWERCONTEXT_SERVER_DATABASE_KIND` | `sqlite` | 存储后端：`sqlite`、`seekdb` 或 `oceanbase` |
+| `POWERCONTEXT_SERVER_DATABASE_URL` | 用户数据目录下的 SQLite 文件 | SQLite 或 OceanBase 的 SQLAlchemy 异步 URL；seekDB 不设置 |
+| `POWERCONTEXT_SERVER_DATABASE_PATH` | 用户数据目录下的 `seekdb` 目录 | 嵌入式 seekDB 路径；仅在 `DATABASE_KIND=seekdb` 时使用 |
 | `POWERCONTEXT_SERVER_RUNTIME_SCOPE_CACHE_SIZE` | `128` | Runtime 保留的非活动 scope composition 数量；进行中的 scope 不会被驱逐 |
 | `POWERCONTEXT_SERVER_RUNTIME_SOURCE_WINDOW_LIMIT` | `100` | 单次 activation 最多处理的 Source 数量 |
 | `POWERCONTEXT_SERVER_RUNTIME_MEMORY_EXTRACTION_PROFILE` | `coding` | Memory 选择策略：`coding` 或 `conversation` |
@@ -58,15 +77,18 @@ Server 配置使用 `POWERCONTEXT_SERVER_` 前缀。
 | `POWERCONTEXT_SERVER_EXTERNAL_SKILLS` | 未设置 | 包含 host identity 和显式 Agent Skill targets 的 JSON object |
 
 静态 Bearer 鉴权默认关闭。启用后，API 和 MCP 请求必须携带 `Authorization: Bearer <token>`；liveness 和
-readiness endpoint 仍然公开。明文 HTTP 仅在 loopback 地址（`localhost`、`::1` 及 `127.0.0.0/8` 网段内的任意地址）上受信任。当 Server 绑定到
-非 loopback 地址且鉴权关闭时会拒绝启动；此时应启用鉴权、改回绑定 loopback，或在 TLS 由上游终止或网络本身受控的场景下，
+readiness endpoint 仍然公开。明文 HTTP 仅在 loopback 地址（`localhost`、`::1` 及 `127.0.0.0/8` 网段内的任意
+地址）上受信任。当 Server 绑定到非 loopback 地址且鉴权关闭时会拒绝启动；此时应启用鉴权、改回绑定 loopback，或在
+TLS 由上游终止或网络本身受控的场景下，
 显式设置 `POWERCONTEXT_SERVER_ALLOW_UNAUTHENTICATED_NON_LOOPBACK=true` 主动选择接受。通过网络暴露启用鉴权的
 Server 前必须配置 TLS。
 
 Python Client 和 CLI 对出站请求应用相同规则：配置的明文 `http://` Server URL 仅接受 loopback 主机，并且 Client 拒绝
-通过明文的非 loopback HTTP 发送任何请求——无论是否携带 Bearer token。当代码的 `http://` base URL 只是路由标签、
-实际传输是安全的（进程内 ASGI 应用、Unix domain socket、由代理终止 TLS）时，必须自行传入 `http_client` 并显式设置
-`trust_transport_security=True`。
+通过明文的非 loopback HTTP 发送任何请求，无论是否携带 Bearer token。当代码的 `http://` base URL 只是路由标签、
+实际传输是安全的，例如进程内 ASGI 应用、Unix domain socket 或由代理终止 TLS 时，必须自行传入 `http_client` 并
+显式设置 `trust_transport_security=True`。
+
+安全的 Docker 和远程访问配置见[部署 Server](../how-to/deploy-server.md)。
 
 Dashboard 默认启用，并与 HTTP API、MCP 共用监听地址和端口。默认未配置 scope，页面会显示空状态；Dashboard
 初始化失败只记录包含直接原因的 warning，不影响 Server 的 HTTP API、MCP 和健康检查启动。
@@ -297,3 +319,15 @@ Authorization 只能来自环境变量，不能加入 Server URL 或插件选项
 
 Pi 会拒绝包含凭据、query 或 fragment 的 base URL。召回、采集和边界 flush 都会正常降级；显式 `pc_*` 持久化写入
 必须确认，Pi 没有交互 UI 时会被拒绝。修改这些变量后需要重启 Pi。
+
+## 其他 Agent 集成
+
+部分集成使用自己的配置文件或环境变量前缀，具体指南是这些设置的准确信息源：
+
+- [Hermes](../how-to/configure-hermes.md)
+- [LangChain](../how-to/configure-langchain.md)
+- [LangGraph](../how-to/configure-langgraph.md)
+- [OpenClaw](../how-to/configure-openclaw.md)
+- [OpenCode](../how-to/configure-opencode.md)
+- [Pydantic AI 适配器预览](../how-to/configure-pydantic-ai.md)
+- [WorkBuddy](../how-to/configure-workbuddy.md)
diff --git a/docs/zh/docs/reference/http-api.md b/docs/zh/docs/reference/http-api.md
new file mode 100644
index 000000000..141edfbcf
--- /dev/null
+++ b/docs/zh/docs/reference/http-api.md
@@ -0,0 +1,121 @@
+---
+title: HTTP API
+description: 通过 HTTP 调用 PowerContext Server，并找到完整 OpenAPI 契约。
+---
+
+# HTTP API
+
+HTTP API 是访问 PowerContext Server 的语言无关接口。默认 base URL 为 `http://127.0.0.1:8000`。
+
+## 查看契约
+
+本地未启用鉴权的 Server 运行后，可以打开：
+
+- `/docs`：交互式 Swagger UI；
+- `/redoc`：ReDoc；
+- `/openapi.json`：该进程实际提供的契约。
+
+仓库中的契约源文件是
+[`openapi/powercontext.yaml`](https://github.com/oceanbase/powercontext/blob/master/openapi/powercontext.yaml)。
+生成客户端或检查全部请求、响应字段时以它为准。启用 Server 鉴权后，这三个发现路由与其他受保护路由一样需要 Bearer
+token。
+
+## 请求鉴权
+
+默认的 loopback 安装不启用鉴权。运维者启用鉴权后，API 和 MCP 请求需要携带：
+
+```http
+Authorization: Bearer <token>
+```
+
+下面的示例使用两个可选 shell 变量：
+
+```bash
+POWERCONTEXT_URL=http://127.0.0.1:8000
+POWERCONTEXT_AUTH_HEADER="Authorization: Bearer ${POWERCONTEXT_CLIENT_API_TOKEN}"
+```
+
+未启用鉴权时，请去掉 `--header "$POWERCONTEXT_AUTH_HEADER"`。`/health/live` 和 `/health/ready` 始终公开。
+允许远程访问前，请先阅读[部署 Server](../how-to/deploy-server.md)。
+
+## 保存并搜索一条 Memory
+
+为项目或租户选择稳定的 `scope_id`，并在不同会话中复用。会话 ID 不是持久的项目身份。
+
+保存一条已经整理好的 Memory：
+
+```bash
+curl --fail-with-body \
+  --request POST \
+  --header 'Content-Type: application/json' \
+  --header "$POWERCONTEXT_AUTH_HEADER" \
+  --data '{
+    "scope_id": "project:example",
+    "kind": "decision",
+    "text": "公开 API 保持异步。"
+  }' \
+  "$POWERCONTEXT_URL/v1/memory/remember"
+```
+
+响应包含精确 citation。后续请求需要修订、停用或读取这个不可变 revision 时，应保留并传回该 citation。
+
+在同一个 scope 中搜索 active entry：
+
+```bash
+curl --fail-with-body \
+  --request POST \
+  --header 'Content-Type: application/json' \
+  --header "$POWERCONTEXT_AUTH_HEADER" \
+  --data '{
+    "scope_id": "project:example",
+    "query": "公开 API",
+    "limit": 5
+  }' \
+  "$POWERCONTEXT_URL/v1/memory/search"
+```
+
+## 查找操作
+
+| 领域 | 主要路径 | 用途 |
+| --- | --- | --- |
+| 健康与能力 | `/health/*`、`/v1/capabilities` | 探测部署状态并查看已启用的 Runtime 行为 |
+| Source 与 Context | `/v1/sources/content`、`/v1/context/prepare` | 采集证据并准备有界 Context |
+| 工作连续性 | `/v1/work/*` | 创建 Work Contract、准备或确认 Handoff、记录 Outcome |
+| 底层 Handoff | `/v1/handoff/*` | activate、prepare、finalize、commit 或 continue Handoff |
+| Memory | `/v1/memory/*` | flush、remember、search、list、get、revise、retire 和查看变更 |
+| Experience 与 Skill | `/v1/experience/*`、`/v1/skill/*` | propose、generate 和读取 Artifact Revision |
+| 审核 | `/v1/artifact-candidates/*` | 列出、检查、修订、批准或拒绝 pending Candidate |
+| 外部 Skill | `/v1/external-skills/*` | 扫描已配置 target，解析或导入 package |
+| Handoff Report | `/v1/handoff-reports/*` | 管理 Project、Workstream、activity、report 和 workspace binding |
+| 统计 | `/v1/stats` | 读取指定 scope 的使用统计 |
+
+完整路径、schema、限制和状态码以 OpenAPI 契约为准。高层工作流和 Python 示例见[接口](interfaces.md)。
+
+## 处理错误和并发变更
+
+错误统一使用以下 JSON envelope：
+
+```json
+{
+  "error": {
+    "code": "invalid_request",
+    "message": "The request violates the API contract.",
+    "details": {}
+  }
+}
+```
+
+常见状态码：
+
+| 状态码 | 含义 |
+| --- | --- |
+| `401` | Server 要求有效的 Bearer token |
+| `404` | 请求的不可变值不存在 |
+| `409` | 请求与当前不可变状态或 expected version 冲突 |
+| `413` | 选中的 Handoff Report 超过输出限制 |
+| `422` | JSON body 不符合传输或应用契约 |
+| `503` | 必需的 Runtime 绑定或依赖不可用 |
+| `500` | Server 发生错误，但不会暴露内部细节 |
+
+每个响应都包含 `X-PowerContext-Request-ID`，排查失败请求时应记录它。修订或停用 Memory 时应传回精确 citation。
+Candidate 审核写操作需要当前 `expected_version`；收到 `409` 后，应重新读取 Candidate，再决定是否重试。
diff --git a/docs/zh/docs/reference/interfaces.md b/docs/zh/docs/reference/interfaces.md
index 4a71c93d8..3042aac53 100644
--- a/docs/zh/docs/reference/interfaces.md
+++ b/docs/zh/docs/reference/interfaces.md
@@ -7,19 +7,24 @@ description: 在 Agent 集成、CLI、Python SDK、HTTP 和 MCP 之间选择。
 
 所有远程接口都操作同一个 Server 和同一份持久化 Artifact 存储。
 
-| 接口 | 适用场景 | 安装 |
+| 接口 | 适用场景 | 从这里开始 |
 | --- | --- | --- |
-| Codex 插件 | 在 Codex 中跨会话恢复和显式维护 Memory | `powercontext setup codex` |
-| Pydantic AI 适配器 | Memory 工具、自动 Context 准备和可选轨迹采集 | `powercontext-pydantic-ai` |
-| DeepSeek Harness 插件 | 在 DeepSeek Harness 中跨会话恢复和显式维护 Memory | `powercontext setup dsh` |
-| LangChain middleware | 在 `create_agent` 中提供有界召回和完成轮次 Source 采集 | `powercontext-langchain` |
-| LangGraph 适配器 | 在 LangGraph 图中提供 Memory 工具和有界召回 | `powercontext-langgraph` |
-| Pi package | 在 Pi 中跨会话恢复、使用原生 Memory/Handoff 工具和 skill | `powercontext setup pi` |
-| CLI | 配置、诊断、Server 控制、能力检查和人工 Candidate 审核 | `powercontext[cli,server]` |
-| Python Client SDK | 对运行中的 Server 发起类型化异步调用 | `powercontext[client]` |
-| Core SDK | 进程内 Source、Artifact、Trigger 和组合契约 | 基础包 |
-| HTTP | 从任意语言集成服务 | `powercontext[server]` |
-| MCP | 面向 Agent 的 Memory 与工作连续性工具 | 由 Server 启用 |
+| Codex 插件 | 在 Codex 中跨会话恢复和显式维护 Memory | [配置 Codex](../how-to/configure-codex.md) |
+| Claude Code 插件 | 在 Claude Code 中跨会话恢复和交接 | [配置 Claude Code](../how-to/configure-claude-code.md) |
+| DeepSeek Harness 插件 | 在 DeepSeek Harness 中召回和显式维护 Memory | [配置 DeepSeek Harness](../how-to/configure-dsh.md) |
+| Hermes 集成 | 在 Hermes 中使用召回、Memory 和 Handoff 工具 | [配置 Hermes](../how-to/configure-hermes.md) |
+| OpenClaw 插件 | 在 OpenClaw 中使用有界召回和持久化 Memory 工具 | [配置 OpenClaw](../how-to/configure-openclaw.md) |
+| OpenCode 插件 | 在 OpenCode 中召回和维护 Memory | [配置 OpenCode](../how-to/configure-opencode.md) |
+| Pi package | 在 Pi 中使用召回、原生 Memory/Handoff 工具和 skill | [配置 Pi](../how-to/configure-pi.md) |
+| WorkBuddy 集成 | 在 WorkBuddy 中使用提示词召回、MCP 工具和 Handoff | [配置 WorkBuddy](../how-to/configure-workbuddy.md) |
+| Pydantic AI 适配器 | 预览 API；尚无受支持的独立安装方式 | [适配器状态](../how-to/configure-pydantic-ai.md) |
+| LangChain middleware | 在 `create_agent` 中提供有界召回和完成轮次 Source 采集 | [从源码安装](../how-to/configure-langchain.md) |
+| LangGraph 适配器 | 在 LangGraph 图中提供 Memory 工具和有界召回 | [从源码安装](../how-to/configure-langgraph.md) |
+| CLI | 配置、诊断、Server 控制和人工 Candidate 审核 | [安装和运行](../how-to/install-and-run.md) |
+| Python Client SDK | 对运行中的 Server 发起类型化异步调用 | [安装 Client role](../how-to/install-and-run.md) |
+| Core SDK | 进程内 Source、Artifact、Trigger 和组合契约 | [Python API 参考](/zh/modules/) |
+| HTTP | 从任意语言集成服务 | [HTTP API](http-api.md) |
+| MCP | 面向 Agent 的 Memory 与工作连续性工具 | Server 在 `/mcp` 启用 |
 
 ## Codex 插件
 
@@ -76,10 +81,10 @@ project-context skill 指导 DeepSeek Harness 何时检索、记忆、修订或
 
 ## Pydantic AI 适配器
 
-独立发行的 `powercontext-pydantic-ai` 通过公共 Python Client 提供三个 Memory 工具，并可自动前置有界
-`PreparedContext`。可选 Capture 会保存经过清洗和限长的可见模型事件与已完成工具事件，执行 checkpoint Flush，并在
-run 结束后 Flush 剩余 Source。MCP 不需要适配器包，但不提供自动 Context 准备、Capture 或 Flush。参见
-[配置 Pydantic AI](../how-to/configure-pydantic-ai.md)。
+仓库中包含一个 Pydantic AI 预览适配器，通过公共 Python Client 提供三个 Memory 工具，并可自动前置有界
+`PreparedContext`。目前还没有受支持的独立安装包。可选 Capture 会保存经过清洗和限长的可见模型事件与已完成工具
+事件，执行 checkpoint Flush，并在 run 结束后 Flush 剩余 Source。MCP 不需要适配器包，但不提供自动 Context 准备、
+Capture 或 Flush。参见 [Pydantic AI 适配器预览](../how-to/configure-pydantic-ai.md)。
 
 ## LangGraph 适配器
 
@@ -89,10 +94,10 @@ run 结束后 Flush 剩余 Source。MCP 不需要适配器包，但不提供自
 `PowerContextScope` 是用于图 `context_schema` 的 dataclass，承载 scope 和单次运行的连接覆盖项。召回节点和工具
 从 LangGraph runtime 读取当前 scope，否则回退到 `POWERCONTEXT_LANGGRAPH_*` 环境配置。
 
-Scope 解析优先取显式 `scope_id`，其次取由 Git remote 推导的 scope，都没有时报错——这与 Codex resolver 相反，
+Scope 解析优先取显式 `scope_id`，其次取由 Git remote 推导的 scope，都没有时报错。这与 Codex resolver 相反，
 因为已部署的图其工作目录通常无法标识项目。`TOKEN` 是裸 token，由 Client 组装为 `Authorization: Bearer`，不同于
 Codex、Claude Code 和 DeepSeek Harness 插件使用的 `POWERCONTEXT_*_AUTHORIZATION` header。召回和工具都会失败开放：
-Server 不可用时图仍能到达终点，工具返回一段简短的不可用字符串。本次发布只覆盖 Memory 读写和有界召回；自动采集、
+Server 不可用时图仍能到达终点，工具返回一段简短的不可用字符串。适配器只覆盖 Memory 读写和有界召回；自动采集、
 checkpointing 和 Handoff 不在范围内。适配器有意不实现 `BaseStore`——Memory 模型不提供其所需的按 key 读取、upsert
 和删除操作。它不会启动或内嵌 Server。
 
@@ -101,8 +106,8 @@ checkpointing 和 Handoff 不在范围内。适配器有意不实现 `BaseStore`
 `PowerContextMiddleware` 使用 LangChain 的 `AgentMiddleware` API。它在不修改 agent state 的前提下，把一份有界
 PreparedContext 注入每个当前模型请求。自动采集默认关闭；显式传入 `auto_capture=True` 后，运行成功时会把最新用户消息
 和最终的纯文本或 structured answer 采集为 Content Source 证据。Source-to-Memory 激活仍由 Server 负责。召回和采集
-都会失败开放，且都不会启动或内嵌 Server。它由独立的 `powercontext-langchain` 包分发；LangGraph 适配器仍是单独的
-节点与工具集成。
+都会失败开放，且都不会启动或内嵌 Server。其源码打包为 `powercontext-langchain`，但目前没有发布到 PyPI；
+LangGraph 适配器仍是单独的节点与工具集成。
 
 ## Pi package
 
@@ -113,24 +118,16 @@ Pi transcript。召回、采集和边界 flush 都会正常降级；显式持久
 ## CLI
 
 ```text
-powercontext setup codex
-powercontext setup claude-code
-powercontext setup dsh
-powercontext setup openclaw
-powercontext setup opencode
-powercontext setup pi
-powercontext setup hermes
-powercontext setup select
+powercontext setup <host> --source oceanbase/powercontext --ref master
+powercontext setup select --host codex --host dsh --source oceanbase/powercontext --ref master
+powercontext config init --output .env
+powercontext config show --env-file .env
+powercontext config validate --env-file .env
 powercontext doctor
+powercontext doctor <host>
 powercontext doctor integrations
-powercontext doctor codex
-powercontext doctor claude-code
-powercontext doctor dsh
-powercontext doctor openclaw
-powercontext doctor opencode
-powercontext doctor pi
-powercontext doctor hermes
 powercontext server run
+powercontext server run --env-file .env
 powercontext ready
 powercontext capabilities
 powercontext experience generate --scope-id project:example --source-ref content/SOURCE_ID
@@ -149,6 +146,13 @@ powercontext external-skill import --scope-id project:example --fingerprint SHA2
 所有内容命令都调用已配置的 Server。可选的 `server` role 会增加 `powercontext server run`，但不会在 CLI
 中创建第二套内容 profile。
 
+`config` 命令组用于生成、脱敏显示和校验显式环境文件。CLI 不会隐式搜索该文件；使用 `config show`、
+`config validate` 或 `server run` 时需要通过 `--env-file` 传入。配置优先级和凭据处理规则见[配置](configuration.md)。
+
+`<host>` 可以是 `codex`、`claude-code`、`dsh`、`hermes`、`openclaw`、`opencode`、`pi` 或
+`workbuddy`。`setup select` 和 `doctor integrations` 使用的一级宿主目录包含上述除 WorkBuddy 外的所有宿主；
+WorkBuddy 仍可通过显式的 `setup workbuddy` 和 `doctor workbuddy` 命令使用。
+
 `powercontext doctor` 检查安装包和 Server，不要求任何集成。`powercontext doctor integrations` 打印全部一级宿主的只读矩阵；
 CLI 不在 PATH 上时该行是 `missing`，不会让整条命令失败。各个 `powercontext doctor <host>` 命令在对应 CLI
 缺失时仍会失败。矩阵保留每个宿主专有的全部集成检查，包括 OpenCode 独立的 `plugin` 与 `skill` 结果。
@@ -283,7 +287,8 @@ Discovery 不进入 Review。显式调用 `import_external_skill` 并提供精
 
 ## HTTP 和 MCP
 
-Server 在 `/openapi.json` 提供 OpenAPI 文档，在 `/health/ready` 提供就绪检查，在 `/v1/capabilities`
+鉴权、curl 示例、操作分组、错误格式和完整 OpenAPI 契约见 [HTTP API](http-api.md)。Server 在
+`/openapi.json` 提供 OpenAPI 文档，在 `/health/ready` 提供就绪检查，在 `/v1/capabilities`
 提供能力信息，并默认在 `/mcp` 提供 Streamable HTTP MCP。HTTP 是完整应用契约，MCP 是面向 Agent 的
 Memory 与 Candidate Review operation 子集。五个 Candidate Review operation 通过 HTTP 和 MCP 使用相同的
 validation、`expected_version` 并发校验和 approval transaction。Experience/Skill generation、exact read、
diff --git a/docs/zh/modules.md b/docs/zh/modules.md
index 819ae1f02..a5c12ac2c 100644
--- a/docs/zh/modules.md
+++ b/docs/zh/modules.md
@@ -1,6 +1,12 @@
-# API 参考
+---
+title: Python API 参考
+description: 根据当前包的公开 Python 模块生成的参考文档。
+---
 
-本参考由当前包的公开模块生成。RFC 可能描述尚未成为当前 API 一部分的计划能力。
+# Python API 参考
+
+本参考由当前包的公开模块生成。RFC 可能描述尚未成为当前 API 一部分的计划能力。服务 endpoint 和 curl 示例见
+[HTTP API](docs/reference/http-api.md)。
 
 ## Composition
 
diff --git a/integrations/hermes/README.md b/integrations/hermes/README.md
index c6729b40f..c4c658709 100644
--- a/integrations/hermes/README.md
+++ b/integrations/hermes/README.md
@@ -10,7 +10,7 @@ The integration requires Hermes Agent v0.20.4 or newer.
 ## Install with the PowerContext CLI
 
 With Hermes installed and available on `PATH`, install or refresh the provider
-from the matching PowerContext release tag:
+from the matching PowerContext `master` revision:
 
 ```bash
 powercontext setup hermes --source oceanbase/powercontext --ref master
diff --git a/integrations/hermes/plugins/powercontext/README.md b/integrations/hermes/plugins/powercontext/README.md
index 9515fd640..fc81ba6aa 100644
--- a/integrations/hermes/plugins/powercontext/README.md
+++ b/integrations/hermes/plugins/powercontext/README.md
@@ -10,7 +10,7 @@ The plugin deliberately uses only the Python standard library for HTTP, so it
 can be copied into Hermes without adding an HTTP client dependency. Its
 provider configuration is read from `$HERMES_HOME/powercontext/config.json`.
 
-To install or refresh the provider from a matching PowerContext release tag:
+To install or refresh the provider from the matching PowerContext `master` revision:
 
 ```bash
 powercontext setup hermes --source oceanbase/powercontext --ref master
diff --git a/integrations/langchain/README.md b/integrations/langchain/README.md
index ffad25eaf..f1b490fec 100644
--- a/integrations/langchain/README.md
+++ b/integrations/langchain/README.md
@@ -7,18 +7,18 @@ user/assistant turn as Source evidence after a successful agent run.
 ## Install
 
 ```bash
-uv tool install "powercontext[cli,server]==0.0.2"
+uv tool install --force "powercontext[cli,server] @ git+https://github.com/oceanbase/powercontext.git@master"
 powercontext server run
 ```
 
 Keep the Server running, then install the middleware in the LangChain application's environment:
 
 ```bash
-uv pip install "powercontext-langchain @ git+https://github.com/oceanbase/powercontext.git#subdirectory=integrations/langchain"
+uv pip install "powercontext-langchain @ git+https://github.com/oceanbase/powercontext.git@master#subdirectory=integrations/langchain"
 ```
 
 Skip the Server installation when the application already connects to a separately managed Server. From a checkout,
-install the middleware with `uv pip install ./integrations/langchain`.
+install the middleware with `uv pip install ./integrations/langchain`. The package is not currently published on PyPI.
 
 This package owns its Scope, Settings, Client wiring, and Middleware implementation. It neither imports nor depends on
 the separate `powercontext-langgraph` adapter. LangChain itself uses LangGraph internally, so installing LangChain may
diff --git a/integrations/langgraph/README.md b/integrations/langgraph/README.md
index 0a5f9df93..7d1e62b74 100644
--- a/integrations/langgraph/README.md
+++ b/integrations/langgraph/README.md
@@ -66,14 +66,13 @@ await graph.ainvoke(state, context=PowerContextScope(scope_id="git:github.com/ac
 This package is not yet published to PyPI, so install it from source alongside a running Server:
 
 ```bash
-uv pip install "powercontext-langgraph @ git+https://github.com/oceanbase/powercontext.git#subdirectory=integrations/langgraph"
+uv pip install "powercontext-langgraph @ git+https://github.com/oceanbase/powercontext.git@master#subdirectory=integrations/langgraph"
 powercontext server run
 ```
 
-From a checkout of this repository you can instead install the local path, e.g.
-`uv pip install ./integrations/langgraph`. Publishing to PyPI is pending a standalone build and release step for the
-package (its version must be advanced independently of the root `powercontext` distribution); until that lands, use
-the source install above.
+From a checkout of this repository you can instead install the local path, for example
+`uv pip install ./integrations/langgraph`. The adapter is not currently published on PyPI, so use one of these source
+installations.
 
 ## Configuration
 
diff --git a/integrations/openclaw/README.md b/integrations/openclaw/README.md
index f198e180d..c5b14bcd8 100644
--- a/integrations/openclaw/README.md
+++ b/integrations/openclaw/README.md
@@ -16,7 +16,7 @@ normal OpenClaw work.
 
 ## Install or refresh the plugin
 
-Until a PowerContext release includes OpenClaw, install the CLI and plugin from the same `master` revision:
+Install the CLI and plugin from the same `master` revision:
 
 ```bash
 uv tool install --force "powercontext[cli,server] @ git+https://github.com/oceanbase/powercontext.git@master"
@@ -42,10 +42,10 @@ powercontext server run
 openclaw
 ```
 
-To change the Server endpoint or memory scope during setup:
+To use a Server that actually listens on another port, or to change the memory scope during setup:
 
 ```bash
-powercontext setup openclaw --server-url http://127.0.0.1:8765 --scope-mode project
+powercontext setup openclaw --server-url http://127.0.0.1:9000 --scope-mode project
 ```
 
 Run `setup openclaw` again to refresh an existing installation.
diff --git a/integrations/pydantic-ai/README.md b/integrations/pydantic-ai/README.md
index a502d983e..2abb958c9 100644
--- a/integrations/pydantic-ai/README.md
+++ b/integrations/pydantic-ai/README.md
@@ -1,17 +1,19 @@
 # PowerContext for Pydantic AI
 
-`powercontext-pydantic-ai` connects a Pydantic AI agent to a running PowerContext Server through the public async
-Python Client. It provides three tools, prepares relevant context before model requests, and can optionally capture
-bounded agent events and flush them into Memory.
+This directory contains a preview `powercontext-pydantic-ai` adapter. It connects a Pydantic AI agent to a running
+PowerContext Server through the public asynchronous Python Client. It provides three tools, prepares relevant context
+before model requests, and can optionally capture bounded agent events and flush them into Memory.
 
-## Install and use
+## Availability
 
-```bash
-uv add powercontext-pydantic-ai "pydantic-ai-slim[openai]"
-```
+The adapter is not currently published on PyPI. Its source metadata requires a final `powercontext[client]>=0.0.3`,
+which the current public root package and the development version from `master` do not satisfy. Do not use the old
+PyPI command or a direct Git subdirectory install; both fail dependency resolution. Repository contributors can run
+the adapter tests through the root development environment.
 
-The example below uses OpenAI. For another provider, install the matching `pydantic-ai-slim` provider extra and
-change the model string.
+The remaining sections document the preview API for development and review; they are not a supported installation
+path. The example uses OpenAI. For another provider, use the matching `pydantic-ai-slim` provider extra and change the
+model string after compatible packages are released.
 
 ```python
 from pydantic_ai import Agent
@@ -73,5 +75,5 @@ run.
 
 PowerContext MCP requires no Pydantic AI-specific package and remains a useful lower-capability alternative. It does
 not provide automatic `prepare_context`, trajectory capture, or checkpoint/final flush. Temporal, DBOS, Prefect, and
-other durable-execution integrations have not been validated in this first release. Handoff, Candidate Review,
-Experience, and Skill operations are outside this adapter's initial scope.
+other durable-execution integrations have not been validated for the preview. Handoff, Candidate Review, Experience,
+and Skill operations are outside this adapter's scope.
diff --git a/zensical.toml b/zensical.toml
index 45508c449..3365122da 100644
--- a/zensical.toml
+++ b/zensical.toml
@@ -17,6 +17,7 @@ nav = [
                 { "Codex quickstart" = "en/docs/tutorials/codex-quickstart.md" },
                 { "Install and run" = "en/docs/how-to/install-and-run.md" },
                 { "Full-capability Quick Start" = "en/docs/how-to/full-capability-runtime.md" },
+                { "Deploy the Server" = "en/docs/how-to/deploy-server.md" },
                 { "Core concepts" = "en/docs/explanation/core-concepts.md" },
                 { "Memory and Handoff" = "en/docs/explanation/memory-and-handoff.md" },
                 { "Experience and Skill lifecycle" = "en/docs/explanation/experience-and-skill-lifecycle.md" },
@@ -30,8 +31,9 @@ nav = [
             { "Integrations" = [
                 { "Configure Codex" = "en/docs/how-to/configure-codex.md" },
                 { "Configure Claude Code" = "en/docs/how-to/configure-claude-code.md" },
-                { "Configure Pydantic AI" = "en/docs/how-to/configure-pydantic-ai.md" },
+                { "Pydantic AI adapter preview" = "en/docs/how-to/configure-pydantic-ai.md" },
                 { "Configure DeepSeek Harness" = "en/docs/how-to/configure-dsh.md" },
+                { "Configure Hermes" = "en/docs/how-to/configure-hermes.md" },
                 { "Configure LangChain middleware" = "en/docs/how-to/configure-langchain.md" },
                 { "Configure LangGraph" = "en/docs/how-to/configure-langgraph.md" },
                 { "Configure Pi" = "en/docs/how-to/configure-pi.md" },
@@ -42,6 +44,7 @@ nav = [
             ] },
             { "Reference" = [
                 { "Interfaces" = "en/docs/reference/interfaces.md" },
+                { "HTTP API" = "en/docs/reference/http-api.md" },
                 { "Configuration" = "en/docs/reference/configuration.md" },
             ] },
         ] },
@@ -51,7 +54,7 @@ nav = [
             { "Pydantic AI Inference" = "en/development/pydantic-ai-inference.md" },
             { "Remote Access Implementation" = "en/development/remote-access-implementation.md" },
             { "Server Web UI" = "en/development/server-web-ui.md" },
-            { "API Reference" = "en/modules.md" },
+            { "Python API reference" = "en/modules.md" },
         ] },
         { "Blog" = [
             { "Overview" = "en/blog/index.md" },
@@ -95,6 +98,7 @@ nav = [
                 { "Codex 快速入门" = "zh/docs/tutorials/codex-quickstart.md" },
                 { "安装和运行" = "zh/docs/how-to/install-and-run.md" },
                 { "完整功能 Quick Start" = "zh/docs/how-to/full-capability-runtime.md" },
+                { "部署 Server" = "zh/docs/how-to/deploy-server.md" },
                 { "核心概念" = "zh/docs/explanation/core-concepts.md" },
                 { "理解 Memory 和 Handoff" = "zh/docs/explanation/memory-and-handoff.md" },
                 { "Experience 与 Skill 生命周期" = "zh/docs/explanation/experience-and-skill-lifecycle.md" },
@@ -108,8 +112,9 @@ nav = [
             { "集成方式" = [
                 { "配置 Codex" = "zh/docs/how-to/configure-codex.md" },
                 { "配置 Claude Code" = "zh/docs/how-to/configure-claude-code.md" },
-                { "配置 Pydantic AI" = "zh/docs/how-to/configure-pydantic-ai.md" },
+                { "Pydantic AI 适配器预览" = "zh/docs/how-to/configure-pydantic-ai.md" },
                 { "配置 DeepSeek Harness" = "zh/docs/how-to/configure-dsh.md" },
+                { "配置 Hermes" = "zh/docs/how-to/configure-hermes.md" },
                 { "配置 LangChain middleware" = "zh/docs/how-to/configure-langchain.md" },
                 { "配置 LangGraph" = "zh/docs/how-to/configure-langgraph.md" },
                 { "配置 Pi" = "zh/docs/how-to/configure-pi.md" },
@@ -120,6 +125,7 @@ nav = [
             ] },
             { "参考" = [
                 { "接口" = "zh/docs/reference/interfaces.md" },
+                { "HTTP API" = "zh/docs/reference/http-api.md" },
                 { "配置" = "zh/docs/reference/configuration.md" },
             ] },
         ] },
@@ -129,7 +135,7 @@ nav = [
             { "Pydantic AI 推理" = "zh/development/pydantic-ai-inference.md" },
             { "远程访问实现" = "zh/development/remote-access-implementation.md" },
             { "Server Web UI" = "zh/development/server-web-ui.md" },
-            { "API 参考" = "zh/modules.md" },
+            { "Python API 参考" = "zh/modules.md" },
         ] },
         { "博客" = [
             { "概览" = "zh/blog/index.md" },