diff --git a/.sisyphus/evidence/task-1-docker-build-success.txt b/.sisyphus/evidence/task-1-docker-build-success.txt
new file mode 100644
index 0000000..d3dceb4
--- /dev/null
+++ b/.sisyphus/evidence/task-1-docker-build-success.txt
@@ -0,0 +1,16 @@
+F2: Docker Build Verification
+==============================
+Command: docker build -f apps/server-core/Dockerfile -t nexusguard-server-core apps/server-core
+Result: EXIT 0 (SUCCESS)
+Date: 2026-05-25
+
+Key steps from build output:
+ #12 swag init generated:
+ - docs/docs.go
+ - docs/swagger.json
+ - docs/swagger.yaml
+ #14 go build completed (88.1s)
+ #20 Image: nexusguard-server-core
+
+Verified: swag init runs during Docker build before go build.
+The fix resolves the original error: "no required module provides package .../docs"
diff --git a/.sisyphus/evidence/task-1-swagger-200.txt b/.sisyphus/evidence/task-1-swagger-200.txt
new file mode 100644
index 0000000..99e959f
--- /dev/null
+++ b/.sisyphus/evidence/task-1-swagger-200.txt
@@ -0,0 +1,12 @@
+F3: Swagger Endpoint Verification
+==================================
+Command: curl -s -o /dev/null -w "HTTP %{http_code}" http://localhost:8080/swagger/index.html
+Result: HTTP 200 (SUCCESS)
+Date: 2026-05-25
+
+Additional verification:
+ - Swagger HTML: ...
+ - Swagger JSON: valid OpenAPI 2.0 spec with paths (/servers, etc.)
+ - Server-core running: Up 8 seconds, port 8080 mapped
+
+Container: nexusguard-server-core (built from fixed Dockerfile)
diff --git a/.sisyphus/plans/agents-deep-init.md b/.sisyphus/plans/agents-deep-init.md
deleted file mode 100644
index 850c3d4..0000000
--- a/.sisyphus/plans/agents-deep-init.md
+++ /dev/null
@@ -1,349 +0,0 @@
-# init-deep: AGENTS.md Generation Plan
-
-**Generated:** 2026-05-22
-**Branch:** `main` (`92051d5`)
-
-## Overview
-
-Generate hierarchical AGENTS.md files for the NexusGuard SD-WAN Suite monorepo.
-Scored 4 locations for AGENTS.md: root + 3 submodules.
-
-## Scoring Results
-
-| Location | Score | Reason | Action |
-|----------|-------|--------|--------|
-| `.` (root) | — | Always create root | CREATE |
-| `apps/server-core/` | 3+2+2+1=8+ | 54 files (3x), 9 subdirs (2x), go.mod (2x), Dockerfile (1x) | CREATE |
-| `apps/dashboard-ui/` | 3+2+2+1=8+ | 54 files (3x), 8 subdirs (2x), package.json (2x), tsconfig (1x) | CREATE |
-| `apps/device-agent/` | 3+0+2+0=5+ | 21 files (3x), 5 subdirs (0x), go.mod (2x) | CREATE (≥15) |
-| `apps/server-core/api/` | 0 | 17 files (<20) | SKIP (parent covers) |
-| `apps/dashboard-ui/views/` | 0 | 7 files (<20) | SKIP (parent covers) |
-| `apps/dashboard-ui/api/` | 0 | 7 files (<20) | SKIP (parent covers) |
-
-## Files to Create/Update
-
-No existing AGENTS.md files found. All 4 are new files (`Write`).
-
----
-
-## File 1: `./AGENTS.md` (Root — 122 lines)
-
-```markdown
-# PROJECT KNOWLEDGE BASE
-
-**Generated:** 2026-05-22
-**Commit:** `92051d5`
-**Branch:** `main`
-
-## OVERVIEW
-NexusGuard SD-WAN Suite — Enterprise Zero-Trust SD-WAN with WireGuard tunneling, centralized IPAM, and real-time nftables network isolation. Monorepo with 3 git submodules: Go backend (Gin), Vue 3 dashboard, Go device agent.
-
-## STRUCTURE
-```
-./
-├── apps/
-│ ├── server-core/ # Go/Gin API backend (submodule)
-│ ├── dashboard-ui/ # Vue 3 + Vite frontend (submodule)
-│ └── device-agent/ # Go stealth daemon (submodule)
-├── docker-compose.yml # Production orchestration
-├── docker-compose.dev.yml # Dev (air hot-reload)
-├── Makefile # up/down/dev/migrate/reset-db
-├── setup.sh # First-run: generate .env + random keys
-├── .env.example # DB/JWT/SALT/VITE config template
-├── .gitmodules # 3 submodules → git.datadunia.com
-└── .opencode/ # IDE agent config (tooling, not project code)
-```
-
-**CRITICAL**: `apps/*` are **git submodules** — clone with `--recurse-submodules`.
-
-## WHERE TO LOOK
-| Task | Location | Notes |
-|------|----------|-------|
-| API handlers | `apps/server-core/api/` | 17 files: auth, devices, peers, rules, share, provisioning, servers, wg |
-| Backend core | `apps/server-core/internal/` | auth, config, firewall, heartbeat, ipam, models, wgmanager |
-| Dev migration | `apps/server-core/main_dev.go` | GORM AutoMigrate (build tag `dev`) |
-| Firewall rules | `apps/server-core/internal/firewall/` | nftables Linux rules |
-| Dashboard views | `apps/dashboard-ui/src/views/` | Vue SFC pages |
-| Dashboard API client | `apps/dashboard-ui/src/api/` | Axios API modules |
-| Dashboard stores | `apps/dashboard-ui/src/stores/` | Pinia state stores |
-| Agent client | `apps/device-agent/internal/client/` | Provisioning + heartbeat |
-| Agent tunnel | `apps/device-agent/internal/tunnel/` | Memory-injected WireGuard |
-| Shared crypto | `apps/*/shared/crypto/encryptor.go` | AES-256-GCM (duplicated identical) |
-| CI workflows | `apps/*/.gitea/workflows/build.yml` | Gitea Actions per submodule |
-| Build config | `apps/dashboard-ui/vite.config.ts` | Vite 8 + Vue + TailwindCSS v4 |
-| Source of truth | `apps/server-core/docs/` | API_SPEC, KEY_ROTATION, PEER_DISCOVERY |
-| Plan guardrails | `.sisyphus/plans/` | Anti-patterns, "Must NOT do" rules |
-
-## CODE MAP
-| Symbol | Type | Location | Role |
-|--------|------|----------|------|
-| `main()` (server-core) | func | `apps/server-core/main.go` | Entry: CLI flags + Gin init |
-| `main()` (device-agent) | func | `apps/device-agent/main.go` | Entry: agent daemon lifecycle |
-| `config.Load()` | func | `apps/server-core/internal/config/` | Env-based config loader |
-| `auth.Init()` | func | `apps/server-core/internal/auth/` | JWT sign/verify init |
-| `firewall.InitNetwork()` | func | `apps/server-core/internal/firewall/` | nftables table/set creation |
-| `ipam.AllocateIP()` | func | `apps/server-core/internal/ipam/` | IP pool allocation from CIDR |
-| `wgmanager.SetConfig()` | func | `apps/server-core/internal/wgmanager/` | WireGuard config push |
-| `models.AutoMigrate()` | func | `apps/server-core/internal/models/` | GORM schema migration |
-| `encrypt()` / `decrypt()` | func | `apps/*/shared/crypto/encryptor.go` | AES-256-GCM (identical) |
-
-## CONVENTIONS
-- **Go**: Standard layout (`main.go` in root, `internal/`, `api/`)
-- **Vue 3**: Composition API + `