diff --git a/docs/HOST-MATRIX.md b/docs/HOST-MATRIX.md
new file mode 100644
index 0000000..fec3727
--- /dev/null
+++ b/docs/HOST-MATRIX.md
@@ -0,0 +1,67 @@
+# Host & Agent Matrix (shared, fill-as-you-go)
+
+A living inventory of **who runs where** and **what each host actually is**. Any agent
+on any host fills in its own row. Source of truth for facts is the probe — not memory.
+
+> **How to fill your row**
+> ```sh
+> cd ~/layered-soul
+> python3 scripts/verify_facts_probe.py --os --hardware --storage --network --text
+> ```
+> Copy the verified values into the tables below, set `Probed` to today's UTC date,
+> and commit. **Never guess hardware, OS, or IPs** — paste what the probe reports.
+> On FreeBSD the probe synthesizes an OS-specific command map; trust its output over
+> Linux habits.
+
+---
+
+## 1. Agent placement (who runs where)
+
+| Agent     | Host    | OS / Isolation          | Harness                 | Role                      | Bot / channel        | Status |
+| --------- | ------- | ----------------------- | ----------------------- | ------------------------- | -------------------- | ------ |
+| Hermes    | debby   | Debian 13 / Docker      | Hermes Agent (upstream) | Orchestrator, soul backup | _(fill)_             | live   |
+| Zot       | debby   | Debian 13 / Docker      | Zot RPC                 | Coding, media workflows   | —                    | _(fill)_ |
+| Claude    | domedog | Ubuntu 24.04 / Docker   | Claude Code             | Verification, review      | — (CLI)              | live   |
+| Mevy      | osa     | FreeBSD 15 / jail       | Hermes Agent            | Operator bot (current)    | Mevy (Telegram)      | live   |
+| Codex     | osa     | FreeBSD 15 / jail       | Codex CLI               | ISO builds, validation    | —                    | _(fill)_ |
+| Autolycus | osa     | FreeBSD 15 / jail       | Hermes Agent (fork)     | Native FreeBSD Hermes     | _(planned)_          | _(fill)_ |
+
+> Notes:
+> - Provider per agent (DeepSeek / OpenRouter / Z.AI / local) — fill in the per-host table.
+> - One Telegram token per running service. Never share a token across instances.
+
+---
+
+## 2. Host hardware & facts (one row per host)
+
+| Host        | Tailscale IP    | OS / Kernel                       | Virt | CPU                          | vCPU | RAM     | Swap   | Disk (free)          | GPU            | Probed     | By     |
+| ----------- | --------------- | --------------------------------- | ---- | ---------------------------- | ---- | ------- | ------ | -------------------- | -------------- | ---------- | ------ |
+| **domedog** | 100.103.255.41  | Ubuntu 24.04.4 / 6.8.0-117        | KVM  | AMD EPYC 7543P (32-core host) | 2    | 7.8 GiB | 2.0 GiB | 100 GB QEMU (51G free) | none (headless) | 2026-06-17 | Claude |
+| **debby**   | 100.66.193.10   | _(fill)_                          | _(fill)_ | _(fill)_                 | _(fill)_ | _(fill)_ | _(fill)_ | _(fill)_       | _(fill)_       | _(fill)_   | _(fill)_ |
+| **osa**     | 100.72.229.63   | FreeBSD 15 / _(fill)_             | bare? | _(fill)_                    | _(fill)_ | _(fill)_ | _(fill)_ | ZFS pool: _(fill)_  | _(fill)_       | _(fill)_   | _(fill)_ |
+
+---
+
+## 3. Per-host detail (expand as needed)
+
+### domedog (Claude / verification) — probed 2026-06-17 by Claude
+- **Identity**: hostname `domedog.pro`, Tailscale `100.103.255.41`
+- **OS**: Ubuntu 24.04.4 LTS, kernel `6.8.0-117-generic`, x86_64, KVM guest
+- **CPU**: AMD EPYC 7543P 32-Core (2 vCPU exposed to guest)
+- **Memory**: 7.8 GiB RAM, 2.0 GiB swap
+- **Storage**: `/dev/sda1` 96 GB ext4 root, 51 GB free (QEMU HARDDISK). No ZFS.
+- **GPU**: none (headless VM)
+- **Uptime at probe**: ~3.5 weeks
+- **Role here**: Claude Code — verification & review lane. No Telegram bot.
+
+### debby (Hermes orchestrator + Zot) — _(fill)_
+- Run the probe on debby and paste results here.
+- Note: Hermes Agent (upstream) is **live** here; capture container name, provider, and bot token owner.
+
+### osa (FreeBSD: Mevy + Codex + Autolycus) — _(fill)_
+- Run the probe on osa (FreeBSD command map applies).
+- Mevy (Telegram operator bot) runs here today. Capture jail name, ZFS pool, provider (Z.AI?).
+
+---
+
+_See [`../AGENTS.md`](../AGENTS.md) for the canonical agent matrix and operating rules._