From 5e93c73600408cacce3ef37e8bc6e8273f3e2da6 Mon Sep 17 00:00:00 2001
From: CyberMind <devel@cybermind.fr>
Date: Thu, 21 May 2026 10:03:05 +0200
Subject: [PATCH] feat(navbar): consolidate to 6 charter categories + fix
 dropped menu entries (closes #306) (#307)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The hub's `_compute_menu_sync()` drops menu entries lacking an `id`
field. 6+ packages (lyrion, yacy, zigbee, rustdesk, grafana, authelia)
shipped a different schema (`title/url/section/module`) so they NEVER
appeared in the navbar. Plus the existing CATEGORY_META declared 12
sections (dashboard/security/network/system/core/users/services/
privacy/monitoring/publishing/apps/admin), not the 6 SecuBox charter
modules.

Changes:
* All 121 packages/secubox-*/menu.d/*.json normalised to the canonical
  schema (id, name, path, category, icon, order, description). Legacy
  schema aliases (title/url/module/section) preserved as fallbacks then
  dropped from the file.
* Each menu entry's category remapped to one of the 6 charter modules:
  AUTH (auth/users/identity/zkp/nac/openclaw),
  WALL (crowdsec/waf/mitmproxy/hardening/threat-* /cve-triage/...),
  BOOT (kernel-build/eye-remote/master-link/droplet/cloner/backup/...),
  MIND (ai-gateway/mcp-server/grafana/ndpid/netifyd/glances/...),
  ROOT (system/hub/portal/console/admin/vault/vm/rtty/...),
  MESH (wireguard/dns/tor/matrix/gitea/nextcloud/mail/lyrion/yacy/
        zigbee/dns-provider/rustdesk/... — all network + comms apps).
* secubox-hub v1.4.0 — CATEGORY_META rewritten with the 6 charter
  modules carrying their official color from DESIGN-CHARTER.md and
  the complementary-pair order. DEFAULT_MENU fallback remapped too.
* secubox-zigbee v2.5.3 — www/zigbee/index.html rewritten with the
  canonical SecuBox scaffold (body display:flex, sidebar 220px fixed,
  .main reserving 48px for the global-menu-bar). MESH palette.

Browser side: operators need to clear localStorage sbx_menu_cache (or
hard-refresh after the 1h TTL) to see the new sections after deploy.

Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
---
 .../secubox-ad-guard/menu.d/160-ad-guard.json |   2 +-
 packages/secubox-admin/menu.d/100-admin.json  |   2 +-
 .../menu.d/110-ai-gateway.json                |   2 +-
 .../menu.d/701-ai-insights.json               |   2 +-
 packages/secubox-auth/menu.d/22-auth.json     |   2 +-
 .../secubox-authelia/menu.d/40-authelia.json  |   9 +-
 .../secubox-avatar/menu.d/470-avatar.json     |   2 +-
 .../secubox-backup/menu.d/550-backup.json     |   2 +-
 packages/secubox-c3box/menu.d/503-c3box.json  |   2 +-
 packages/secubox-cdn/menu.d/34-cdn.json       |   2 +-
 .../secubox-cloner/menu.d/902-cloner.json     |  10 +-
 .../menu.d/155-config-advisor.json            |   2 +-
 .../secubox-console/menu.d/03-console.json    |   5 +-
 .../secubox-cookies/menu.d/704-cookies.json   |   2 +-
 .../secubox-crowdsec/menu.d/20-crowdsec.json  |   2 +-
 .../menu.d/135-cve-triage.json                |   2 +-
 .../menu.d/490-cyberfeed.json                 |   2 +-
 .../menu.d/320-device-intel.json              |   2 +-
 .../menu.d/145-dns-guard.json                 |   2 +-
 .../menu.d/706-dns-provider.json              |   2 +-
 packages/secubox-dns/menu.d/32-dns.json       |   2 +-
 .../secubox-domoticz/menu.d/614-domoticz.json |   2 +-
 packages/secubox-dpi/menu.d/31-dpi.json       |   2 +-
 .../secubox-droplet/menu.d/50-droplet.json    |   2 +-
 .../secubox-exposure/menu.d/565-exposure.json |   2 +-
 .../menu.d/50-eye-remote.json                 |   2 +-
 packages/secubox-gitea/menu.d/504-gitea.json  |   2 +-
 .../secubox-glances/menu.d/904-glances.json   |   2 +-
 .../menu.d/615-gotosocial.json                |  13 +-
 .../secubox-grafana/menu.d/50-grafana.json    |   9 +-
 .../secubox-haproxy/menu.d/35-haproxy.json    |   2 +-
 .../menu.d/120-hardening.json                 |   2 +-
 packages/secubox-hexo/menu.d/610-hexo.json    |  13 +-
 .../menu.d/618-homeassistant.json             |   2 +-
 packages/secubox-hub/api/main.py              |  76 +++--
 packages/secubox-hub/debian/changelog         |  13 +
 packages/secubox-hub/menu.d/00-hub.json       |   2 +-
 .../secubox-identity/menu.d/125-identity.json |   2 +-
 .../menu.d/703-interceptor.json               |   2 +-
 .../menu.d/150-iot-guard.json                 |   2 +-
 .../secubox-ipblock/menu.d/702-ipblock.json   |   2 +-
 .../secubox-jabber/menu.d/818-jabber.json     |  10 +-
 .../secubox-jellyfin/menu.d/801-jellyfin.json |   2 +-
 packages/secubox-jitsi/menu.d/620-jitsi.json  |   2 +-
 packages/secubox-ksm/menu.d/460-ksm.json      |   2 +-
 .../secubox-localai/menu.d/804-localai.json   |   2 +-
 .../menu.d/120-localrecall.json               |   2 +-
 packages/secubox-lyrion/menu.d/80-lyrion.json |   9 +-
 .../menu.d/705-mac-guard.json                 |   2 +-
 .../menu.d/819-magicmirror.json               |  10 +-
 packages/secubox-mail/menu.d/55-mail.json     |   2 +-
 .../menu.d/200-master-link.json               |   2 +-
 .../secubox-matrix/menu.d/619-matrix.json     |   2 +-
 .../menu.d/115-mcp-server.json                |   2 +-
 .../menu.d/41-mediaflow.json                  |   2 +-
 packages/secubox-mesh/menu.d/580-mesh.json    |  14 +-
 .../secubox-meshname/menu.d/585-meshname.json |   2 +-
 .../menu.d/51-metablogizer.json               |   2 +-
 .../menu.d/480-metabolizer.json               |   2 +-
 .../menu.d/485-metacatalog.json               |   2 +-
 .../menu.d/950-metoblizer.json                |  12 +-
 .../secubox-metrics/menu.d/200-metrics.json   |  14 +-
 .../secubox-mirror/menu.d/495-mirror.json     |   2 +-
 .../menu.d/500-mitmproxy.json                 |   2 +-
 packages/secubox-mmpm/menu.d/820-mmpm.json    |  10 +-
 packages/secubox-modem/menu.d/37-modem.json   |   2 +-
 packages/secubox-mqtt/menu.d/80-mqtt.json     |   9 +-
 packages/secubox-nac/menu.d/23-nac.json       |   2 +-
 packages/secubox-ndpid/menu.d/32-ndpid.json   |   2 +-
 .../secubox-netdata/menu.d/40-netdata.json    |   2 +-
 .../secubox-netdiag/menu.d/921-netdiag.json   |   2 +-
 .../secubox-netifyd/menu.d/235-netifyd.json   |   2 +-
 .../secubox-netmodes/menu.d/30-netmodes.json  |   2 +-
 .../secubox-nettweak/menu.d/450-nettweak.json |   2 +-
 .../menu.d/140-network-anomaly.json           |   2 +-
 .../secubox-newsbin/menu.d/814-newsbin.json   |  13 +-
 .../menu.d/505-nextcloud.json                 |   2 +-
 .../secubox-ollama/menu.d/800-ollama.json     |  13 +-
 .../secubox-openclaw/menu.d/708-openclaw.json |   2 +-
 packages/secubox-ossec/menu.d/952-ossec.json  |  10 +-
 packages/secubox-p2p/menu.d/590-p2p.json      |  18 +-
 .../secubox-peertube/menu.d/811-peertube.json |  13 +-
 .../menu.d/617-photoprism.json                |  13 +-
 .../secubox-picobrew/menu.d/496-picobrew.json |   2 +-
 packages/secubox-portal/menu.d/01-portal.json |   2 +-
 .../secubox-publish/menu.d/600-publish.json   |   2 +-
 packages/secubox-qos/menu.d/32-qos.json       |   2 +-
 .../secubox-redroid/menu.d/821-redroid.json   |  10 +-
 .../secubox-reporter/menu.d/909-reporter.json |   2 +-
 .../secubox-rezapp/menu.d/494-rezapp.json     |   2 +-
 .../secubox-roadmap/menu.d/900-roadmap.json   |   2 +-
 .../secubox-routes/menu.d/907-routes.json     |   2 +-
 packages/secubox-rtty/menu.d/905-rtty.json    |   2 +-
 .../secubox-rustdesk/menu.d/70-rustdesk.json  |   9 +-
 .../menu.d/492-saas-relay.json                |   2 +-
 .../secubox-simplex/menu.d/816-simplex.json   |  11 +-
 .../menu.d/915-smtp-relay.json                |   2 +-
 packages/secubox-soc/menu.d/100-soc.json      |   2 +-
 .../menu.d/61-streamforge.json                |   2 +-
 .../menu.d/60-streamlit.json                  |   2 +-
 packages/secubox-system/menu.d/10-system.json |   2 +-
 .../menu.d/130-threat-analyst.json            |   2 +-
 .../secubox-threats/menu.d/707-threats.json   |   2 +-
 packages/secubox-tor/menu.d/560-tor.json      |   2 +-
 .../secubox-torrent/menu.d/612-torrent.json   |  13 +-
 .../secubox-traffic/menu.d/36-traffic.json    |   2 +-
 packages/secubox-turn/menu.d/914-turn.json    |   2 +-
 packages/secubox-users/menu.d/25-users.json   |   2 +-
 packages/secubox-vault/menu.d/901-vault.json  |  10 +-
 packages/secubox-vhost/menu.d/33-vhost.json   |   2 +-
 packages/secubox-vm/menu.d/903-vm.json        |  10 +-
 packages/secubox-voip/menu.d/622-voip.json    |  13 +-
 .../menu.d/33-vortex-dns.json                 |   2 +-
 .../menu.d/125-vortex-firewall.json           |   2 +-
 packages/secubox-waf/menu.d/110-waf.json      |   2 +-
 .../secubox-watchdog/menu.d/555-watchdog.json |   2 +-
 packages/secubox-wazuh/menu.d/951-wazuh.json  |  10 +-
 .../secubox-webmail/menu.d/56-webmail.json    |   2 +-
 .../secubox-webradio/menu.d/611-webradio.json |   2 +-
 .../menu.d/25-wireguard.json                  |   2 +-
 packages/secubox-yacy/menu.d/60-yacy.json     |   9 +-
 packages/secubox-zigbee/debian/changelog      |  14 +
 packages/secubox-zigbee/menu.d/80-zigbee.json |   9 +-
 packages/secubox-zigbee/www/zigbee/index.html | 280 ++++++++----------
 packages/secubox-zkp/menu.d/570-zkp.json      |   2 +-
 125 files changed, 499 insertions(+), 397 deletions(-)

diff --git a/packages/secubox-ad-guard/menu.d/160-ad-guard.json b/packages/secubox-ad-guard/menu.d/160-ad-guard.json
index 05a25fc0..fd8012ba 100644
--- a/packages/secubox-ad-guard/menu.d/160-ad-guard.json
+++ b/packages/secubox-ad-guard/menu.d/160-ad-guard.json
@@ -1,7 +1,7 @@
 {
   "id": "ad-guard",
   "name": "Ad Guard",
-  "category": "network",
+  "category": "wall",
   "icon": "🛡️",
   "path": "/ad-guard/",
   "order": 160,
diff --git a/packages/secubox-admin/menu.d/100-admin.json b/packages/secubox-admin/menu.d/100-admin.json
index d755387d..32298ab4 100644
--- a/packages/secubox-admin/menu.d/100-admin.json
+++ b/packages/secubox-admin/menu.d/100-admin.json
@@ -1,7 +1,7 @@
 {
   "id": "admin",
   "name": "Administration",
-  "category": "core",
+  "category": "root",
   "icon": "⚙️",
   "path": "/admin/",
   "order": 100,
diff --git a/packages/secubox-ai-gateway/menu.d/110-ai-gateway.json b/packages/secubox-ai-gateway/menu.d/110-ai-gateway.json
index 1518ee39..4017e3bc 100644
--- a/packages/secubox-ai-gateway/menu.d/110-ai-gateway.json
+++ b/packages/secubox-ai-gateway/menu.d/110-ai-gateway.json
@@ -1,7 +1,7 @@
 {
   "id": "ai-gateway",
   "name": "AI Gateway",
-  "category": "security",
+  "category": "mind",
   "icon": "🤖",
   "path": "/ai-gateway/",
   "order": 110,
diff --git a/packages/secubox-ai-insights/menu.d/701-ai-insights.json b/packages/secubox-ai-insights/menu.d/701-ai-insights.json
index 929f8c81..ada13da5 100644
--- a/packages/secubox-ai-insights/menu.d/701-ai-insights.json
+++ b/packages/secubox-ai-insights/menu.d/701-ai-insights.json
@@ -1,7 +1,7 @@
 {
   "id": "ai-insights",
   "name": "AI Insights",
-  "category": "security",
+  "category": "mind",
   "icon": "🤖",
   "path": "/ai-insights/",
   "order": 701,
diff --git a/packages/secubox-auth/menu.d/22-auth.json b/packages/secubox-auth/menu.d/22-auth.json
index e786d5c5..5ef9d93f 100644
--- a/packages/secubox-auth/menu.d/22-auth.json
+++ b/packages/secubox-auth/menu.d/22-auth.json
@@ -1,7 +1,7 @@
 {
   "id": "auth",
   "name": "Auth Guardian",
-  "category": "security",
+  "category": "auth",
   "icon": "🔑",
   "path": "/auth/",
   "order": 120,
diff --git a/packages/secubox-authelia/menu.d/40-authelia.json b/packages/secubox-authelia/menu.d/40-authelia.json
index f52e8533..5cff3727 100644
--- a/packages/secubox-authelia/menu.d/40-authelia.json
+++ b/packages/secubox-authelia/menu.d/40-authelia.json
@@ -1,9 +1,10 @@
 {
-  "title": "SSO",
   "subtitle": "Authelia · OIDC IdP",
   "icon": "fa-key",
-  "url": "/auth/",
-  "section": "security",
   "order": 40,
-  "module": "authelia"
+  "id": "authelia",
+  "name": "SSO",
+  "path": "/auth/",
+  "category": "auth",
+  "description": ""
 }
diff --git a/packages/secubox-avatar/menu.d/470-avatar.json b/packages/secubox-avatar/menu.d/470-avatar.json
index d4a87bb1..4716cbd4 100644
--- a/packages/secubox-avatar/menu.d/470-avatar.json
+++ b/packages/secubox-avatar/menu.d/470-avatar.json
@@ -1,7 +1,7 @@
 {
   "id": "avatar",
   "name": "Identity Manager",
-  "category": "users",
+  "category": "mesh",
   "icon": "👤",
   "path": "/avatar/",
   "order": 470,
diff --git a/packages/secubox-backup/menu.d/550-backup.json b/packages/secubox-backup/menu.d/550-backup.json
index f8260d4f..5487b013 100644
--- a/packages/secubox-backup/menu.d/550-backup.json
+++ b/packages/secubox-backup/menu.d/550-backup.json
@@ -1,7 +1,7 @@
 {
   "id": "backup",
   "name": "Backup",
-  "category": "system",
+  "category": "boot",
   "icon": "💾",
   "path": "/backup/",
   "order": 550,
diff --git a/packages/secubox-c3box/menu.d/503-c3box.json b/packages/secubox-c3box/menu.d/503-c3box.json
index 7bc5fb1d..da6b2b4c 100644
--- a/packages/secubox-c3box/menu.d/503-c3box.json
+++ b/packages/secubox-c3box/menu.d/503-c3box.json
@@ -1,7 +1,7 @@
 {
   "id": "c3box",
   "name": "C3box",
-  "category": "apps",
+  "category": "mind",
   "icon": "🌐",
   "path": "/c3box/",
   "order": 503,
diff --git a/packages/secubox-cdn/menu.d/34-cdn.json b/packages/secubox-cdn/menu.d/34-cdn.json
index 3935ed1c..2c663f58 100644
--- a/packages/secubox-cdn/menu.d/34-cdn.json
+++ b/packages/secubox-cdn/menu.d/34-cdn.json
@@ -1,7 +1,7 @@
 {
   "id": "cdn",
   "name": "CDN Cache",
-  "category": "network",
+  "category": "mesh",
   "icon": "💾",
   "path": "/cdn/",
   "order": 240,
diff --git a/packages/secubox-cloner/menu.d/902-cloner.json b/packages/secubox-cloner/menu.d/902-cloner.json
index e301e300..54ac8d02 100644
--- a/packages/secubox-cloner/menu.d/902-cloner.json
+++ b/packages/secubox-cloner/menu.d/902-cloner.json
@@ -1 +1,9 @@
-{"id":"cloner","name":"Cloner","icon":"💾","path":"/cloner/","category":"system","order":902,"description":"System backup and restore"}
+{
+  "id": "cloner",
+  "name": "Cloner",
+  "icon": "💾",
+  "path": "/cloner/",
+  "category": "boot",
+  "order": 902,
+  "description": "System backup and restore"
+}
diff --git a/packages/secubox-config-advisor/menu.d/155-config-advisor.json b/packages/secubox-config-advisor/menu.d/155-config-advisor.json
index 552da815..40669038 100644
--- a/packages/secubox-config-advisor/menu.d/155-config-advisor.json
+++ b/packages/secubox-config-advisor/menu.d/155-config-advisor.json
@@ -1,7 +1,7 @@
 {
   "id": "config-advisor",
   "name": "Config Advisor",
-  "category": "security",
+  "category": "mind",
   "icon": "📋",
   "path": "/config-advisor/",
   "order": 155,
diff --git a/packages/secubox-console/menu.d/03-console.json b/packages/secubox-console/menu.d/03-console.json
index 6373df9f..8f156859 100644
--- a/packages/secubox-console/menu.d/03-console.json
+++ b/packages/secubox-console/menu.d/03-console.json
@@ -2,9 +2,10 @@
   "name": "Console TUI",
   "path": null,
   "icon": "🖥️",
-  "category": "system",
+  "category": "root",
   "order": 3,
   "description": "Terminal-based dashboard (TTY1)",
   "console_only": true,
-  "requires_auth": false
+  "requires_auth": false,
+  "id": "console"
 }
diff --git a/packages/secubox-cookies/menu.d/704-cookies.json b/packages/secubox-cookies/menu.d/704-cookies.json
index d0e5e93c..d98d2af8 100644
--- a/packages/secubox-cookies/menu.d/704-cookies.json
+++ b/packages/secubox-cookies/menu.d/704-cookies.json
@@ -3,7 +3,7 @@
   "name": "Cookie Tracker",
   "icon": "🍪",
   "path": "/cookies/",
-  "category": "privacy",
+  "category": "mesh",
   "order": 704,
   "description": "Cookie tracking and privacy compliance"
 }
diff --git a/packages/secubox-crowdsec/menu.d/20-crowdsec.json b/packages/secubox-crowdsec/menu.d/20-crowdsec.json
index 1b4cbdfd..9b2c26dd 100644
--- a/packages/secubox-crowdsec/menu.d/20-crowdsec.json
+++ b/packages/secubox-crowdsec/menu.d/20-crowdsec.json
@@ -1,7 +1,7 @@
 {
   "id": "crowdsec",
   "name": "CrowdSec",
-  "category": "security",
+  "category": "wall",
   "icon": "🛡️",
   "path": "/crowdsec/",
   "order": 100,
diff --git a/packages/secubox-cve-triage/menu.d/135-cve-triage.json b/packages/secubox-cve-triage/menu.d/135-cve-triage.json
index 617da0c5..4a96f956 100644
--- a/packages/secubox-cve-triage/menu.d/135-cve-triage.json
+++ b/packages/secubox-cve-triage/menu.d/135-cve-triage.json
@@ -1,7 +1,7 @@
 {
   "id": "cve-triage",
   "name": "Cve-triage",
-  "category": "security",
+  "category": "wall",
   "icon": "🛡️",
   "path": "/cve-triage/",
   "order": 135,
diff --git a/packages/secubox-cyberfeed/menu.d/490-cyberfeed.json b/packages/secubox-cyberfeed/menu.d/490-cyberfeed.json
index 065e3fb4..f893f854 100644
--- a/packages/secubox-cyberfeed/menu.d/490-cyberfeed.json
+++ b/packages/secubox-cyberfeed/menu.d/490-cyberfeed.json
@@ -1,7 +1,7 @@
 {
   "id": "cyberfeed",
   "name": "CyberFeed",
-  "category": "security",
+  "category": "wall",
   "icon": "📡",
   "path": "/cyberfeed/",
   "order": 490,
diff --git a/packages/secubox-device-intel/menu.d/320-device-intel.json b/packages/secubox-device-intel/menu.d/320-device-intel.json
index e4e8d5e2..94e1b1ca 100644
--- a/packages/secubox-device-intel/menu.d/320-device-intel.json
+++ b/packages/secubox-device-intel/menu.d/320-device-intel.json
@@ -1,7 +1,7 @@
 {
   "id": "device-intel",
   "name": "Device Intel",
-  "category": "monitoring",
+  "category": "mind",
   "icon": "🔬",
   "path": "/device-intel/",
   "order": 320,
diff --git a/packages/secubox-dns-guard/menu.d/145-dns-guard.json b/packages/secubox-dns-guard/menu.d/145-dns-guard.json
index 1975f6b9..984c57bc 100644
--- a/packages/secubox-dns-guard/menu.d/145-dns-guard.json
+++ b/packages/secubox-dns-guard/menu.d/145-dns-guard.json
@@ -1,7 +1,7 @@
 {
   "id": "dns-guard",
   "name": "DNS Guard",
-  "category": "security",
+  "category": "wall",
   "icon": "🌐",
   "path": "/dns-guard/",
   "order": 145,
diff --git a/packages/secubox-dns-provider/menu.d/706-dns-provider.json b/packages/secubox-dns-provider/menu.d/706-dns-provider.json
index 00739af6..d03fd24a 100644
--- a/packages/secubox-dns-provider/menu.d/706-dns-provider.json
+++ b/packages/secubox-dns-provider/menu.d/706-dns-provider.json
@@ -1,7 +1,7 @@
 {
   "id": "dns-provider",
   "name": "DNS Provider",
-  "category": "network",
+  "category": "mesh",
   "icon": "☁️",
   "path": "/dns-provider/",
   "order": 706,
diff --git a/packages/secubox-dns/menu.d/32-dns.json b/packages/secubox-dns/menu.d/32-dns.json
index 45a08b20..b1c10d45 100644
--- a/packages/secubox-dns/menu.d/32-dns.json
+++ b/packages/secubox-dns/menu.d/32-dns.json
@@ -1,7 +1,7 @@
 {
   "id": "dns",
   "name": "Dns",
-  "category": "network",
+  "category": "mesh",
   "icon": "🌐",
   "path": "/dns/",
   "order": 32,
diff --git a/packages/secubox-domoticz/menu.d/614-domoticz.json b/packages/secubox-domoticz/menu.d/614-domoticz.json
index 576ac783..6c76b30f 100644
--- a/packages/secubox-domoticz/menu.d/614-domoticz.json
+++ b/packages/secubox-domoticz/menu.d/614-domoticz.json
@@ -3,7 +3,7 @@
   "name": "Domoticz",
   "icon": "&#127968;",
   "path": "/domoticz/",
-  "category": "apps",
+  "category": "mesh",
   "order": 614,
   "description": "Home automation system"
 }
diff --git a/packages/secubox-dpi/menu.d/31-dpi.json b/packages/secubox-dpi/menu.d/31-dpi.json
index 9a19f668..37337538 100644
--- a/packages/secubox-dpi/menu.d/31-dpi.json
+++ b/packages/secubox-dpi/menu.d/31-dpi.json
@@ -1,7 +1,7 @@
 {
   "id": "dpi",
   "name": "DPI",
-  "category": "network",
+  "category": "mind",
   "icon": "🔍",
   "path": "/dpi/",
   "order": 210,
diff --git a/packages/secubox-droplet/menu.d/50-droplet.json b/packages/secubox-droplet/menu.d/50-droplet.json
index bb69bfbf..a9fd7a30 100644
--- a/packages/secubox-droplet/menu.d/50-droplet.json
+++ b/packages/secubox-droplet/menu.d/50-droplet.json
@@ -1,7 +1,7 @@
 {
   "id": "droplet",
   "name": "Droplet",
-  "category": "publishing",
+  "category": "boot",
   "icon": "📤",
   "path": "/droplet/",
   "order": 400,
diff --git a/packages/secubox-exposure/menu.d/565-exposure.json b/packages/secubox-exposure/menu.d/565-exposure.json
index cb376680..29abc39a 100644
--- a/packages/secubox-exposure/menu.d/565-exposure.json
+++ b/packages/secubox-exposure/menu.d/565-exposure.json
@@ -3,7 +3,7 @@
   "name": "Exposure",
   "icon": "🌐",
   "path": "/exposure/",
-  "category": "network",
+  "category": "wall",
   "order": 565,
   "description": "Unified exposure settings (Tor, SSL, DNS, Mesh)"
 }
diff --git a/packages/secubox-eye-remote/menu.d/50-eye-remote.json b/packages/secubox-eye-remote/menu.d/50-eye-remote.json
index 2b6a96b0..9a7bc131 100644
--- a/packages/secubox-eye-remote/menu.d/50-eye-remote.json
+++ b/packages/secubox-eye-remote/menu.d/50-eye-remote.json
@@ -4,6 +4,6 @@
   "icon": "👁️",
   "path": "/eye-remote/",
   "order": 50,
-  "category": "system",
+  "category": "boot",
   "description": "Manage Eye Remote display devices"
 }
diff --git a/packages/secubox-gitea/menu.d/504-gitea.json b/packages/secubox-gitea/menu.d/504-gitea.json
index cdc3fd7e..56eb78a2 100644
--- a/packages/secubox-gitea/menu.d/504-gitea.json
+++ b/packages/secubox-gitea/menu.d/504-gitea.json
@@ -1,7 +1,7 @@
 {
   "id": "gitea",
   "name": "Gitea",
-  "category": "apps",
+  "category": "mesh",
   "icon": "🐙",
   "path": "/gitea/",
   "order": 504,
diff --git a/packages/secubox-glances/menu.d/904-glances.json b/packages/secubox-glances/menu.d/904-glances.json
index 589f3b26..4b170531 100644
--- a/packages/secubox-glances/menu.d/904-glances.json
+++ b/packages/secubox-glances/menu.d/904-glances.json
@@ -1,7 +1,7 @@
 {
   "id": "glances",
   "name": "Glances",
-  "category": "monitoring",
+  "category": "mind",
   "icon": "📈",
   "path": "/glances/",
   "order": 904,
diff --git a/packages/secubox-gotosocial/menu.d/615-gotosocial.json b/packages/secubox-gotosocial/menu.d/615-gotosocial.json
index 95ac1314..a625121a 100644
--- a/packages/secubox-gotosocial/menu.d/615-gotosocial.json
+++ b/packages/secubox-gotosocial/menu.d/615-gotosocial.json
@@ -1,8 +1,9 @@
 {
-    "name": "GoToSocial",
-    "path": "/gotosocial/",
-    "icon": "🦋",
-    "category": "apps",
-    "order": 615,
-    "description": "Fediverse/ActivityPub server"
+  "name": "GoToSocial",
+  "path": "/gotosocial/",
+  "icon": "🦋",
+  "category": "mesh",
+  "order": 615,
+  "description": "Fediverse/ActivityPub server",
+  "id": "gotosocial"
 }
diff --git a/packages/secubox-grafana/menu.d/50-grafana.json b/packages/secubox-grafana/menu.d/50-grafana.json
index b8f371b2..ba37c5bc 100644
--- a/packages/secubox-grafana/menu.d/50-grafana.json
+++ b/packages/secubox-grafana/menu.d/50-grafana.json
@@ -1,9 +1,10 @@
 {
-  "title": "Grafana",
   "subtitle": "Security metrics",
   "icon": "fa-chart-line",
-  "url": "/grafana/",
-  "section": "monitoring",
   "order": 50,
-  "module": "grafana"
+  "id": "grafana",
+  "name": "Grafana",
+  "path": "/grafana/",
+  "category": "mind",
+  "description": ""
 }
diff --git a/packages/secubox-haproxy/menu.d/35-haproxy.json b/packages/secubox-haproxy/menu.d/35-haproxy.json
index d264510f..7675f17e 100644
--- a/packages/secubox-haproxy/menu.d/35-haproxy.json
+++ b/packages/secubox-haproxy/menu.d/35-haproxy.json
@@ -1,7 +1,7 @@
 {
   "id": "haproxy",
   "name": "HAProxy",
-  "category": "network",
+  "category": "mesh",
   "icon": "⚖️",
   "path": "/haproxy/",
   "order": 250,
diff --git a/packages/secubox-hardening/menu.d/120-hardening.json b/packages/secubox-hardening/menu.d/120-hardening.json
index 0b007d4b..75da588a 100644
--- a/packages/secubox-hardening/menu.d/120-hardening.json
+++ b/packages/secubox-hardening/menu.d/120-hardening.json
@@ -4,7 +4,7 @@
   "icon": "🛡️",
   "path": "/hardening/",
   "api": "/api/v1/hardening/",
-  "category": "security",
+  "category": "wall",
   "order": 120,
   "description": "Kernel and system hardening"
 }
diff --git a/packages/secubox-hexo/menu.d/610-hexo.json b/packages/secubox-hexo/menu.d/610-hexo.json
index 55fc26c6..229087a6 100644
--- a/packages/secubox-hexo/menu.d/610-hexo.json
+++ b/packages/secubox-hexo/menu.d/610-hexo.json
@@ -1,8 +1,9 @@
 {
-    "name": "Hexo",
-    "path": "/hexo/",
-    "icon": "edit",
-    "category": "apps",
-    "order": 610,
-    "description": "Static blog generator"
+  "name": "Hexo",
+  "path": "/hexo/",
+  "icon": "edit",
+  "category": "mesh",
+  "order": 610,
+  "description": "Static blog generator",
+  "id": "hexo"
 }
diff --git a/packages/secubox-homeassistant/menu.d/618-homeassistant.json b/packages/secubox-homeassistant/menu.d/618-homeassistant.json
index 8c38f6c3..60fd2480 100644
--- a/packages/secubox-homeassistant/menu.d/618-homeassistant.json
+++ b/packages/secubox-homeassistant/menu.d/618-homeassistant.json
@@ -3,7 +3,7 @@
   "name": "Home Assistant",
   "icon": "🏠",
   "path": "/homeassistant/",
-  "category": "apps",
+  "category": "mesh",
   "order": 618,
   "description": "Home automation and IoT hub"
 }
diff --git a/packages/secubox-hub/api/main.py b/packages/secubox-hub/api/main.py
index 40c2667a..e278b1e2 100644
--- a/packages/secubox-hub/api/main.py
+++ b/packages/secubox-hub/api/main.py
@@ -1716,48 +1716,46 @@ MENU_DIR = Path("/usr/share/secubox/menu.d")
 
 # Default menu definitions (used if menu.d files don't exist)
 DEFAULT_MENU = [
-    {"id": "hub", "name": "Dashboard", "category": "dashboard", "icon": "🏠", "path": "/", "order": 0},
-    {"id": "system", "name": "System Hub", "category": "dashboard", "icon": "🔧", "path": "/system/", "order": 10},
-    {"id": "crowdsec", "name": "CrowdSec", "category": "security", "icon": "🛡️", "path": "/crowdsec/", "order": 100},
-    {"id": "waf", "name": "WAF", "category": "security", "icon": "🔥", "path": "/waf/", "order": 105},
-    {"id": "wireguard", "name": "WireGuard VPN", "category": "security", "icon": "🔐", "path": "/wireguard/", "order": 110},
-    {"id": "auth", "name": "Auth Guardian", "category": "security", "icon": "🔑", "path": "/auth/", "order": 120},
-    {"id": "nac", "name": "Client Guardian", "category": "security", "icon": "👥", "path": "/nac/", "order": 130},
-    {"id": "netmodes", "name": "Network Modes", "category": "network", "icon": "🔀", "path": "/netmodes/", "order": 200},
-    {"id": "dpi", "name": "DPI", "category": "network", "icon": "🔍", "path": "/dpi/", "order": 210},
-    {"id": "qos", "name": "Bandwidth Manager", "category": "network", "icon": "📶", "path": "/qos/", "order": 220},
-    {"id": "vhost", "name": "Virtual Hosts", "category": "network", "icon": "🌍", "path": "/vhost/", "order": 230},
-    {"id": "cdn", "name": "CDN Cache", "category": "network", "icon": "💾", "path": "/cdn/", "order": 240},
-    {"id": "haproxy", "name": "HAProxy", "category": "network", "icon": "⚖️", "path": "/haproxy/", "order": 250},
-    {"id": "dns", "name": "DNS", "category": "network", "icon": "🌐", "path": "/dns/", "order": 260},
-    {"id": "netdata", "name": "Netdata", "category": "monitoring", "icon": "📊", "path": "/netdata/", "order": 300},
-    {"id": "mediaflow", "name": "Media Flow", "category": "monitoring", "icon": "📺", "path": "/mediaflow/", "order": 310},
-    {"id": "droplet", "name": "Droplet", "category": "publishing", "icon": "📤", "path": "/droplet/", "order": 400},
-    {"id": "metablogizer", "name": "MetaBlogizer", "category": "publishing", "icon": "📝", "path": "/metablogizer/", "order": 410},
-    {"id": "publish", "name": "Publish", "category": "publishing", "icon": "🚀", "path": "/publish/", "order": 420},
-    {"id": "streamlit", "name": "Streamlit", "category": "apps", "icon": "🎯", "path": "/streamlit/", "order": 500},
-    {"id": "streamforge", "name": "StreamForge", "category": "apps", "icon": "🔨", "path": "/streamforge/", "order": 510},
-    {"id": "users", "name": "Users", "category": "admin", "icon": "👤", "path": "/users/", "order": 600},
-    {"id": "mail", "name": "Mail Server", "category": "admin", "icon": "📧", "path": "/mail/", "order": 610},
-    {"id": "webmail", "name": "Webmail", "category": "admin", "icon": "📬", "path": "/webmail/", "order": 620},
-    {"id": "mail-lxc", "name": "Mail LXC", "category": "admin", "icon": "📧", "path": "/mail-lxc/", "order": 630},
-    {"id": "webmail-lxc", "name": "Webmail LXC", "category": "admin", "icon": "📬", "path": "/webmail-lxc/", "order": 640},
-    {"id": "portal", "name": "Portal", "category": "security", "icon": "🚪", "path": "/portal/", "order": 140},
+    {"id": "hub", "name": "Dashboard", "category": "root", "icon": "🏠", "path": "/", "order": 0},
+    {"id": "system", "name": "System Hub", "category": "root", "icon": "🔧", "path": "/system/", "order": 10},
+    {"id": "crowdsec", "name": "CrowdSec", "category": "wall", "icon": "🛡️", "path": "/crowdsec/", "order": 100},
+    {"id": "waf", "name": "WAF", "category": "wall", "icon": "🔥", "path": "/waf/", "order": 105},
+    {"id": "wireguard", "name": "WireGuard VPN", "category": "mesh", "icon": "🔐", "path": "/wireguard/", "order": 110},
+    {"id": "auth", "name": "Auth Guardian", "category": "auth", "icon": "🔑", "path": "/auth/", "order": 120},
+    {"id": "nac", "name": "Client Guardian", "category": "auth", "icon": "👥", "path": "/nac/", "order": 130},
+    {"id": "netmodes", "name": "Network Modes", "category": "mesh", "icon": "🔀", "path": "/netmodes/", "order": 200},
+    {"id": "dpi", "name": "DPI", "category": "mind", "icon": "🔍", "path": "/dpi/", "order": 210},
+    {"id": "qos", "name": "Bandwidth Manager", "category": "mesh", "icon": "📶", "path": "/qos/", "order": 220},
+    {"id": "vhost", "name": "Virtual Hosts", "category": "mesh", "icon": "🌍", "path": "/vhost/", "order": 230},
+    {"id": "cdn", "name": "CDN Cache", "category": "mesh", "icon": "💾", "path": "/cdn/", "order": 240},
+    {"id": "haproxy", "name": "HAProxy", "category": "mesh", "icon": "⚖️", "path": "/haproxy/", "order": 250},
+    {"id": "dns", "name": "DNS", "category": "mesh", "icon": "🌐", "path": "/dns/", "order": 260},
+    {"id": "netdata", "name": "Netdata", "category": "mind", "icon": "📊", "path": "/netdata/", "order": 300},
+    {"id": "mediaflow", "name": "Media Flow", "category": "boot", "icon": "📺", "path": "/mediaflow/", "order": 310},
+    {"id": "droplet", "name": "Droplet", "category": "boot", "icon": "📤", "path": "/droplet/", "order": 400},
+    {"id": "metablogizer", "name": "MetaBlogizer", "category": "mind", "icon": "📝", "path": "/metablogizer/", "order": 410},
+    {"id": "publish", "name": "Publish", "category": "boot", "icon": "🚀", "path": "/publish/", "order": 420},
+    {"id": "streamlit", "name": "Streamlit", "category": "mesh", "icon": "🎯", "path": "/streamlit/", "order": 500},
+    {"id": "streamforge", "name": "StreamForge", "category": "mesh", "icon": "🔨", "path": "/streamforge/", "order": 510},
+    {"id": "users", "name": "Users", "category": "auth", "icon": "👤", "path": "/users/", "order": 600},
+    {"id": "mail", "name": "Mail Server", "category": "mesh", "icon": "📧", "path": "/mail/", "order": 610},
+    {"id": "webmail", "name": "Webmail", "category": "mesh", "icon": "📬", "path": "/webmail/", "order": 620},
+    {"id": "mail-lxc", "name": "Mail LXC", "category": "mesh", "icon": "📧", "path": "/mail-lxc/", "order": 630},
+    {"id": "webmail-lxc", "name": "Webmail LXC", "category": "mesh", "icon": "📬", "path": "/webmail-lxc/", "order": 640},
+    {"id": "portal", "name": "Portal", "category": "root", "icon": "🚪", "path": "/portal/", "order": 140},
 ]
 
 CATEGORY_META = {
-    "dashboard": {"name": "Dashboard", "icon": "📊", "order": 0},
-    "security": {"name": "Security", "icon": "🛡️", "order": 1},
-    "network": {"name": "Network", "icon": "🌐", "order": 2},
-    "system": {"name": "System", "icon": "⚙️", "order": 3},
-    "core": {"name": "Core", "icon": "🔧", "order": 4},
-    "users": {"name": "Users", "icon": "👥", "order": 5},
-    "services": {"name": "Services", "icon": "🔌", "order": 6},
-    "privacy": {"name": "Privacy", "icon": "🔒", "order": 7},
-    "monitoring": {"name": "Monitoring", "icon": "📈", "order": 8},
-    "publishing": {"name": "Publishing", "icon": "📤", "order": 9},
-    "apps": {"name": "Applications", "icon": "🎯", "order": 10},
-    "admin": {"name": "Administration", "icon": "🛠️", "order": 11},
+    # SecuBox 6-module color system (Charte §Six Module Color System).
+    # Every menu.d entry MUST set `category` to one of these six. The
+    # ordering mirrors the charter's complementary-pair sequence:
+    # AUTH/WALL/BOOT then their counterparts MIND/ROOT/MESH.
+    "auth": {"name": "Auth", "icon": "🛂", "order": 0, "color": "#C04E24"},
+    "wall": {"name": "Wall", "icon": "🛡️", "order": 1, "color": "#9A6010"},
+    "boot": {"name": "Boot", "icon": "🚀", "order": 2, "color": "#803018"},
+    "mind": {"name": "Mind", "icon": "🧠", "order": 3, "color": "#3D35A0"},
+    "root": {"name": "Root", "icon": "⚙️", "order": 4, "color": "#0A5840"},
+    "mesh": {"name": "Mesh", "icon": "🌐", "order": 5, "color": "#104A88"},
 }
 
 
diff --git a/packages/secubox-hub/debian/changelog b/packages/secubox-hub/debian/changelog
index f935546c..59752ed1 100644
--- a/packages/secubox-hub/debian/changelog
+++ b/packages/secubox-hub/debian/changelog
@@ -1,3 +1,16 @@
+secubox-hub (1.4.0-1~bookworm1) bookworm; urgency=medium
+
+  * api/main.py: CATEGORY_META rewritten to the 6 SecuBox charter
+    modules (auth / wall / boot / mind / root / mesh) instead of the
+    legacy 12 (dashboard / security / network / system / core / users
+    / services / privacy / monitoring / publishing / apps / admin).
+    Each entry carries its charter color and complementary-pair order.
+    Closes #306.
+  * api/main.py: DEFAULT_MENU fallback entries remapped to the 6
+    charter categories.
+
+ -- Gerald Kerma <devel@cybermind.fr>  Thu, 21 May 2026 11:30:00 +0000
+
 secubox-hub (1.3.4-1~bookworm1) bookworm; urgency=medium
 
   * www/shared/health-banner.js: stop emitting clickable <a href="…">
diff --git a/packages/secubox-hub/menu.d/00-hub.json b/packages/secubox-hub/menu.d/00-hub.json
index f7a1b5f9..ed193bc9 100644
--- a/packages/secubox-hub/menu.d/00-hub.json
+++ b/packages/secubox-hub/menu.d/00-hub.json
@@ -1,7 +1,7 @@
 {
   "id": "hub",
   "name": "Dashboard",
-  "category": "dashboard",
+  "category": "root",
   "icon": "🏠",
   "path": "/",
   "order": 0,
diff --git a/packages/secubox-identity/menu.d/125-identity.json b/packages/secubox-identity/menu.d/125-identity.json
index ef7c3836..1d791a49 100644
--- a/packages/secubox-identity/menu.d/125-identity.json
+++ b/packages/secubox-identity/menu.d/125-identity.json
@@ -1,7 +1,7 @@
 {
   "id": "identity",
   "name": "Identity",
-  "category": "security",
+  "category": "auth",
   "icon": "🔐",
   "path": "/identity/",
   "order": 125,
diff --git a/packages/secubox-interceptor/menu.d/703-interceptor.json b/packages/secubox-interceptor/menu.d/703-interceptor.json
index d425aa19..cb3795a0 100644
--- a/packages/secubox-interceptor/menu.d/703-interceptor.json
+++ b/packages/secubox-interceptor/menu.d/703-interceptor.json
@@ -3,7 +3,7 @@
   "name": "Interceptor",
   "icon": "🎯",
   "path": "/interceptor/",
-  "category": "security",
+  "category": "wall",
   "order": 703,
   "description": "Traffic interception and analysis"
 }
diff --git a/packages/secubox-iot-guard/menu.d/150-iot-guard.json b/packages/secubox-iot-guard/menu.d/150-iot-guard.json
index e91ee313..0b1c9cd2 100644
--- a/packages/secubox-iot-guard/menu.d/150-iot-guard.json
+++ b/packages/secubox-iot-guard/menu.d/150-iot-guard.json
@@ -1,7 +1,7 @@
 {
   "id": "iot-guard",
   "name": "IoT Guard",
-  "category": "security",
+  "category": "wall",
   "icon": "📡",
   "path": "/iot-guard/",
   "order": 150,
diff --git a/packages/secubox-ipblock/menu.d/702-ipblock.json b/packages/secubox-ipblock/menu.d/702-ipblock.json
index 848cb5fe..d7c6730f 100644
--- a/packages/secubox-ipblock/menu.d/702-ipblock.json
+++ b/packages/secubox-ipblock/menu.d/702-ipblock.json
@@ -1,7 +1,7 @@
 {
   "id": "ipblock",
   "name": "IP Blocklist",
-  "category": "security",
+  "category": "wall",
   "icon": "🚫",
   "path": "/ipblock/",
   "order": 702,
diff --git a/packages/secubox-jabber/menu.d/818-jabber.json b/packages/secubox-jabber/menu.d/818-jabber.json
index 43c70012..bb96f97c 100644
--- a/packages/secubox-jabber/menu.d/818-jabber.json
+++ b/packages/secubox-jabber/menu.d/818-jabber.json
@@ -1 +1,9 @@
-{"id":"jabber","name":"Jabber","icon":"💬","path":"/jabber/","category":"apps","order":818,"description":"XMPP messaging server"}
+{
+  "id": "jabber",
+  "name": "Jabber",
+  "icon": "💬",
+  "path": "/jabber/",
+  "category": "mesh",
+  "order": 818,
+  "description": "XMPP messaging server"
+}
diff --git a/packages/secubox-jellyfin/menu.d/801-jellyfin.json b/packages/secubox-jellyfin/menu.d/801-jellyfin.json
index 64780702..d7742841 100644
--- a/packages/secubox-jellyfin/menu.d/801-jellyfin.json
+++ b/packages/secubox-jellyfin/menu.d/801-jellyfin.json
@@ -3,7 +3,7 @@
   "name": "Jellyfin",
   "path": "/jellyfin/",
   "icon": "🎬",
-  "category": "apps",
+  "category": "mesh",
   "order": 801,
   "description": "Media server management"
 }
diff --git a/packages/secubox-jitsi/menu.d/620-jitsi.json b/packages/secubox-jitsi/menu.d/620-jitsi.json
index 3c77ab92..f4a624cc 100644
--- a/packages/secubox-jitsi/menu.d/620-jitsi.json
+++ b/packages/secubox-jitsi/menu.d/620-jitsi.json
@@ -3,7 +3,7 @@
   "name": "Jitsi Meet",
   "icon": "📹",
   "path": "/jitsi/",
-  "category": "apps",
+  "category": "mesh",
   "order": 620,
   "description": "Video conferencing and meetings"
 }
diff --git a/packages/secubox-ksm/menu.d/460-ksm.json b/packages/secubox-ksm/menu.d/460-ksm.json
index 776181a9..dbfffb41 100644
--- a/packages/secubox-ksm/menu.d/460-ksm.json
+++ b/packages/secubox-ksm/menu.d/460-ksm.json
@@ -1,7 +1,7 @@
 {
   "id": "ksm",
   "name": "KSM Memory",
-  "category": "system",
+  "category": "wall",
   "icon": "💾",
   "path": "/ksm/",
   "order": 460,
diff --git a/packages/secubox-localai/menu.d/804-localai.json b/packages/secubox-localai/menu.d/804-localai.json
index 568918b0..73cadea5 100644
--- a/packages/secubox-localai/menu.d/804-localai.json
+++ b/packages/secubox-localai/menu.d/804-localai.json
@@ -3,7 +3,7 @@
   "name": "LocalAI",
   "icon": "🤖",
   "path": "/localai/",
-  "category": "apps",
+  "category": "mind",
   "order": 804,
   "description": "Self-hosted LLM inference with OpenAI-compatible API"
 }
diff --git a/packages/secubox-localrecall/menu.d/120-localrecall.json b/packages/secubox-localrecall/menu.d/120-localrecall.json
index e5c2d308..4ff3e9ad 100644
--- a/packages/secubox-localrecall/menu.d/120-localrecall.json
+++ b/packages/secubox-localrecall/menu.d/120-localrecall.json
@@ -1,7 +1,7 @@
 {
   "id": "localrecall",
   "name": "Localrecall",
-  "category": "security",
+  "category": "mind",
   "icon": "🧠",
   "path": "/localrecall/",
   "order": 120,
diff --git a/packages/secubox-lyrion/menu.d/80-lyrion.json b/packages/secubox-lyrion/menu.d/80-lyrion.json
index adbf86f1..43203e99 100644
--- a/packages/secubox-lyrion/menu.d/80-lyrion.json
+++ b/packages/secubox-lyrion/menu.d/80-lyrion.json
@@ -1,9 +1,10 @@
 {
-  "title": "Lyrion",
   "subtitle": "Music server",
   "icon": "fa-music",
-  "url": "/lyrion/",
-  "section": "hosting",
   "order": 80,
-  "module": "lyrion"
+  "id": "lyrion",
+  "name": "Lyrion",
+  "path": "/lyrion/",
+  "category": "mesh",
+  "description": ""
 }
diff --git a/packages/secubox-mac-guard/menu.d/705-mac-guard.json b/packages/secubox-mac-guard/menu.d/705-mac-guard.json
index 25faa607..aa9e2dec 100644
--- a/packages/secubox-mac-guard/menu.d/705-mac-guard.json
+++ b/packages/secubox-mac-guard/menu.d/705-mac-guard.json
@@ -1,7 +1,7 @@
 {
   "id": "mac-guard",
   "name": "MAC Guard",
-  "category": "security",
+  "category": "wall",
   "icon": "🖥️",
   "path": "/mac-guard/",
   "order": 705,
diff --git a/packages/secubox-magicmirror/menu.d/819-magicmirror.json b/packages/secubox-magicmirror/menu.d/819-magicmirror.json
index de852eea..13db80c0 100644
--- a/packages/secubox-magicmirror/menu.d/819-magicmirror.json
+++ b/packages/secubox-magicmirror/menu.d/819-magicmirror.json
@@ -1 +1,9 @@
-{"id":"magicmirror","name":"MagicMirror","icon":"🪞","path":"/magicmirror/","category":"apps","order":819,"description":"Smart display platform"}
+{
+  "id": "magicmirror",
+  "name": "MagicMirror",
+  "icon": "🪞",
+  "path": "/magicmirror/",
+  "category": "mesh",
+  "order": 819,
+  "description": "Smart display platform"
+}
diff --git a/packages/secubox-mail/menu.d/55-mail.json b/packages/secubox-mail/menu.d/55-mail.json
index 45c76fcb..8e38108b 100644
--- a/packages/secubox-mail/menu.d/55-mail.json
+++ b/packages/secubox-mail/menu.d/55-mail.json
@@ -1,7 +1,7 @@
 {
   "id": "mail",
   "name": "Mail",
-  "category": "apps",
+  "category": "mesh",
   "icon": "📧",
   "path": "/mail/",
   "order": 55,
diff --git a/packages/secubox-master-link/menu.d/200-master-link.json b/packages/secubox-master-link/menu.d/200-master-link.json
index 0ccc4874..15c8c529 100644
--- a/packages/secubox-master-link/menu.d/200-master-link.json
+++ b/packages/secubox-master-link/menu.d/200-master-link.json
@@ -1,7 +1,7 @@
 {
   "id": "master-link",
   "name": "Master-link",
-  "category": "network",
+  "category": "boot",
   "icon": "🔗",
   "path": "/master-link/",
   "order": 200,
diff --git a/packages/secubox-matrix/menu.d/619-matrix.json b/packages/secubox-matrix/menu.d/619-matrix.json
index 6148ec9c..2f3c299b 100644
--- a/packages/secubox-matrix/menu.d/619-matrix.json
+++ b/packages/secubox-matrix/menu.d/619-matrix.json
@@ -3,7 +3,7 @@
   "name": "Matrix Chat",
   "icon": "💬",
   "path": "/matrix/",
-  "category": "apps",
+  "category": "mesh",
   "order": 619,
   "description": "Federated encrypted chat server"
 }
diff --git a/packages/secubox-mcp-server/menu.d/115-mcp-server.json b/packages/secubox-mcp-server/menu.d/115-mcp-server.json
index 629fa53f..b0f2278c 100644
--- a/packages/secubox-mcp-server/menu.d/115-mcp-server.json
+++ b/packages/secubox-mcp-server/menu.d/115-mcp-server.json
@@ -1,7 +1,7 @@
 {
   "id": "mcp-server",
   "name": "MCP Server",
-  "category": "security",
+  "category": "mind",
   "icon": "🔌",
   "path": "/mcp-server/",
   "order": 115,
diff --git a/packages/secubox-mediaflow/menu.d/41-mediaflow.json b/packages/secubox-mediaflow/menu.d/41-mediaflow.json
index 2545b510..d785b8f1 100644
--- a/packages/secubox-mediaflow/menu.d/41-mediaflow.json
+++ b/packages/secubox-mediaflow/menu.d/41-mediaflow.json
@@ -1,7 +1,7 @@
 {
   "id": "mediaflow",
   "name": "Media Flow",
-  "category": "monitoring",
+  "category": "boot",
   "icon": "📺",
   "path": "/mediaflow/",
   "order": 310,
diff --git a/packages/secubox-mesh/menu.d/580-mesh.json b/packages/secubox-mesh/menu.d/580-mesh.json
index 6a6e576e..ba26693c 100644
--- a/packages/secubox-mesh/menu.d/580-mesh.json
+++ b/packages/secubox-mesh/menu.d/580-mesh.json
@@ -1,9 +1,9 @@
 {
-    "id": "mesh",
-    "name": "Yggdrasil Mesh",
-    "icon": "🌐",
-    "path": "/mesh/",
-    "category": "network",
-    "order": 580,
-    "description": "Yggdrasil mesh network management"
+  "id": "mesh",
+  "name": "Yggdrasil Mesh",
+  "icon": "🌐",
+  "path": "/mesh/",
+  "category": "mesh",
+  "order": 580,
+  "description": "Yggdrasil mesh network management"
 }
diff --git a/packages/secubox-meshname/menu.d/585-meshname.json b/packages/secubox-meshname/menu.d/585-meshname.json
index dd1c1e8e..754a97da 100644
--- a/packages/secubox-meshname/menu.d/585-meshname.json
+++ b/packages/secubox-meshname/menu.d/585-meshname.json
@@ -1,7 +1,7 @@
 {
   "id": "meshname",
   "name": "Mesh DNS",
-  "category": "network",
+  "category": "mesh",
   "icon": "🌐",
   "path": "/meshname/",
   "order": 585,
diff --git a/packages/secubox-metablogizer/menu.d/51-metablogizer.json b/packages/secubox-metablogizer/menu.d/51-metablogizer.json
index 3defa821..7cdb14a1 100644
--- a/packages/secubox-metablogizer/menu.d/51-metablogizer.json
+++ b/packages/secubox-metablogizer/menu.d/51-metablogizer.json
@@ -1,7 +1,7 @@
 {
   "id": "metablogizer",
   "name": "MetaBlogizer",
-  "category": "publishing",
+  "category": "mind",
   "icon": "📝",
   "path": "/metablogizer/",
   "order": 410,
diff --git a/packages/secubox-metabolizer/menu.d/480-metabolizer.json b/packages/secubox-metabolizer/menu.d/480-metabolizer.json
index 14ddb7ed..5bb49698 100644
--- a/packages/secubox-metabolizer/menu.d/480-metabolizer.json
+++ b/packages/secubox-metabolizer/menu.d/480-metabolizer.json
@@ -1,7 +1,7 @@
 {
   "id": "metabolizer",
   "name": "Metabolizer",
-  "category": "system",
+  "category": "mind",
   "icon": "&#128202;",
   "path": "/metabolizer/",
   "order": 480,
diff --git a/packages/secubox-metacatalog/menu.d/485-metacatalog.json b/packages/secubox-metacatalog/menu.d/485-metacatalog.json
index a2d27916..b0c508e4 100644
--- a/packages/secubox-metacatalog/menu.d/485-metacatalog.json
+++ b/packages/secubox-metacatalog/menu.d/485-metacatalog.json
@@ -1,7 +1,7 @@
 {
   "id": "metacatalog",
   "name": "Service Catalog",
-  "category": "system",
+  "category": "mind",
   "icon": "📚",
   "path": "/metacatalog/",
   "order": 485,
diff --git a/packages/secubox-metoblizer/menu.d/950-metoblizer.json b/packages/secubox-metoblizer/menu.d/950-metoblizer.json
index 9a68f826..ccb84b76 100644
--- a/packages/secubox-metoblizer/menu.d/950-metoblizer.json
+++ b/packages/secubox-metoblizer/menu.d/950-metoblizer.json
@@ -1,9 +1,10 @@
 {
   "name": "Metoblizer",
-  "title": "Metoblizer - Log Aggregator",
   "order": 950,
   "depends": {
-    "acl": ["luci-app-secubox"],
+    "acl": [
+      "luci-app-secubox"
+    ],
     "uci": {}
   },
   "entries": [
@@ -13,5 +14,10 @@
       "order": 1,
       "icon": "scroll"
     }
-  ]
+  ],
+  "id": "metoblizer",
+  "category": "mind",
+  "icon": "🧠",
+  "path": "/metoblizer/",
+  "description": ""
 }
diff --git a/packages/secubox-metrics/menu.d/200-metrics.json b/packages/secubox-metrics/menu.d/200-metrics.json
index ecb31a16..2886d4ab 100644
--- a/packages/secubox-metrics/menu.d/200-metrics.json
+++ b/packages/secubox-metrics/menu.d/200-metrics.json
@@ -1,9 +1,9 @@
 {
-    "id": "metrics",
-    "name": "Metrics",
-    "icon": "📊",
-    "path": "/metrics/",
-    "order": 200,
-    "category": "monitoring",
-    "description": "Metrics Dashboard"
+  "id": "metrics",
+  "name": "Metrics",
+  "icon": "📊",
+  "path": "/metrics/",
+  "order": 200,
+  "category": "mind",
+  "description": "Metrics Dashboard"
 }
diff --git a/packages/secubox-mirror/menu.d/495-mirror.json b/packages/secubox-mirror/menu.d/495-mirror.json
index 4c848d77..ffbbdbea 100644
--- a/packages/secubox-mirror/menu.d/495-mirror.json
+++ b/packages/secubox-mirror/menu.d/495-mirror.json
@@ -1,7 +1,7 @@
 {
   "id": "mirror",
   "name": "Mirror/CDN",
-  "category": "system",
+  "category": "mesh",
   "icon": "☁️",
   "path": "/mirror/",
   "order": 495,
diff --git a/packages/secubox-mitmproxy/menu.d/500-mitmproxy.json b/packages/secubox-mitmproxy/menu.d/500-mitmproxy.json
index eee2ccca..8e02e3e3 100644
--- a/packages/secubox-mitmproxy/menu.d/500-mitmproxy.json
+++ b/packages/secubox-mitmproxy/menu.d/500-mitmproxy.json
@@ -3,7 +3,7 @@
   "name": "WAF",
   "icon": "🛡️",
   "path": "/mitmproxy/",
-  "category": "security",
+  "category": "wall",
   "order": 500,
   "description": "Web Application Firewall"
 }
diff --git a/packages/secubox-mmpm/menu.d/820-mmpm.json b/packages/secubox-mmpm/menu.d/820-mmpm.json
index 0e25c89b..973a37d1 100644
--- a/packages/secubox-mmpm/menu.d/820-mmpm.json
+++ b/packages/secubox-mmpm/menu.d/820-mmpm.json
@@ -1 +1,9 @@
-{"id":"mmpm","name":"MMPM","icon":"📦","path":"/mmpm/","category":"apps","order":820,"description":"MagicMirror Package Manager"}
+{
+  "id": "mmpm",
+  "name": "MMPM",
+  "icon": "📦",
+  "path": "/mmpm/",
+  "category": "mesh",
+  "order": 820,
+  "description": "MagicMirror Package Manager"
+}
diff --git a/packages/secubox-modem/menu.d/37-modem.json b/packages/secubox-modem/menu.d/37-modem.json
index 707ab539..fcd4cf8a 100644
--- a/packages/secubox-modem/menu.d/37-modem.json
+++ b/packages/secubox-modem/menu.d/37-modem.json
@@ -3,7 +3,7 @@
   "name": "Modem",
   "icon": "📶",
   "path": "/modem/",
-  "category": "network",
+  "category": "mesh",
   "order": 37,
   "description": "LTE/5G modem management"
 }
diff --git a/packages/secubox-mqtt/menu.d/80-mqtt.json b/packages/secubox-mqtt/menu.d/80-mqtt.json
index adbf86f1..43203e99 100644
--- a/packages/secubox-mqtt/menu.d/80-mqtt.json
+++ b/packages/secubox-mqtt/menu.d/80-mqtt.json
@@ -1,9 +1,10 @@
 {
-  "title": "Lyrion",
   "subtitle": "Music server",
   "icon": "fa-music",
-  "url": "/lyrion/",
-  "section": "hosting",
   "order": 80,
-  "module": "lyrion"
+  "id": "lyrion",
+  "name": "Lyrion",
+  "path": "/lyrion/",
+  "category": "mesh",
+  "description": ""
 }
diff --git a/packages/secubox-nac/menu.d/23-nac.json b/packages/secubox-nac/menu.d/23-nac.json
index 6b32fdce..0d02727a 100644
--- a/packages/secubox-nac/menu.d/23-nac.json
+++ b/packages/secubox-nac/menu.d/23-nac.json
@@ -1,7 +1,7 @@
 {
   "id": "nac",
   "name": "Client Guardian",
-  "category": "security",
+  "category": "auth",
   "icon": "👥",
   "path": "/nac/",
   "order": 130,
diff --git a/packages/secubox-ndpid/menu.d/32-ndpid.json b/packages/secubox-ndpid/menu.d/32-ndpid.json
index 0344d936..c30f9454 100644
--- a/packages/secubox-ndpid/menu.d/32-ndpid.json
+++ b/packages/secubox-ndpid/menu.d/32-ndpid.json
@@ -1,7 +1,7 @@
 {
   "id": "ndpid",
   "name": "nDPId",
-  "category": "network",
+  "category": "mind",
   "icon": "🔬",
   "path": "/ndpid/",
   "order": 32,
diff --git a/packages/secubox-netdata/menu.d/40-netdata.json b/packages/secubox-netdata/menu.d/40-netdata.json
index d8caa272..3e2f5b04 100644
--- a/packages/secubox-netdata/menu.d/40-netdata.json
+++ b/packages/secubox-netdata/menu.d/40-netdata.json
@@ -1,7 +1,7 @@
 {
   "id": "netdata",
   "name": "Netdata",
-  "category": "monitoring",
+  "category": "mind",
   "icon": "📊",
   "path": "/netdata/",
   "order": 300,
diff --git a/packages/secubox-netdiag/menu.d/921-netdiag.json b/packages/secubox-netdiag/menu.d/921-netdiag.json
index b722a4ea..62bba247 100644
--- a/packages/secubox-netdiag/menu.d/921-netdiag.json
+++ b/packages/secubox-netdiag/menu.d/921-netdiag.json
@@ -3,7 +3,7 @@
   "name": "Network Diagnostics",
   "icon": "🩺",
   "path": "/netdiag/",
-  "category": "network",
+  "category": "root",
   "order": 921,
   "description": "Network troubleshooting tools: ping, traceroute, DNS, WHOIS, MTR, port scan"
 }
diff --git a/packages/secubox-netifyd/menu.d/235-netifyd.json b/packages/secubox-netifyd/menu.d/235-netifyd.json
index 92012cbd..44a0eb50 100644
--- a/packages/secubox-netifyd/menu.d/235-netifyd.json
+++ b/packages/secubox-netifyd/menu.d/235-netifyd.json
@@ -1,7 +1,7 @@
 {
   "id": "netifyd",
   "name": "Netifyd",
-  "category": "network",
+  "category": "mind",
   "icon": "N",
   "path": "/netifyd/",
   "order": 235,
diff --git a/packages/secubox-netmodes/menu.d/30-netmodes.json b/packages/secubox-netmodes/menu.d/30-netmodes.json
index 28682ff2..d0b554f6 100644
--- a/packages/secubox-netmodes/menu.d/30-netmodes.json
+++ b/packages/secubox-netmodes/menu.d/30-netmodes.json
@@ -1,7 +1,7 @@
 {
   "id": "netmodes",
   "name": "Network Modes",
-  "category": "network",
+  "category": "mesh",
   "icon": "🔀",
   "path": "/netmodes/",
   "order": 200,
diff --git a/packages/secubox-nettweak/menu.d/450-nettweak.json b/packages/secubox-nettweak/menu.d/450-nettweak.json
index 0204163d..79a958be 100644
--- a/packages/secubox-nettweak/menu.d/450-nettweak.json
+++ b/packages/secubox-nettweak/menu.d/450-nettweak.json
@@ -1,7 +1,7 @@
 {
   "id": "nettweak",
   "name": "Network Tuning",
-  "category": "system",
+  "category": "mesh",
   "icon": "🔧",
   "path": "/nettweak/",
   "order": 450,
diff --git a/packages/secubox-network-anomaly/menu.d/140-network-anomaly.json b/packages/secubox-network-anomaly/menu.d/140-network-anomaly.json
index 92c98a77..3a94fdbd 100644
--- a/packages/secubox-network-anomaly/menu.d/140-network-anomaly.json
+++ b/packages/secubox-network-anomaly/menu.d/140-network-anomaly.json
@@ -1,7 +1,7 @@
 {
   "id": "network-anomaly",
   "name": "Network-anomaly",
-  "category": "security",
+  "category": "wall",
   "icon": "📊",
   "path": "/network-anomaly/",
   "order": 140,
diff --git a/packages/secubox-newsbin/menu.d/814-newsbin.json b/packages/secubox-newsbin/menu.d/814-newsbin.json
index da599e07..a15954f5 100644
--- a/packages/secubox-newsbin/menu.d/814-newsbin.json
+++ b/packages/secubox-newsbin/menu.d/814-newsbin.json
@@ -1,8 +1,9 @@
 {
-    "name": "Newsbin",
-    "path": "/newsbin/",
-    "icon": "📥",
-    "category": "apps",
-    "order": 814,
-    "description": "Usenet downloader management"
+  "name": "Newsbin",
+  "path": "/newsbin/",
+  "icon": "📥",
+  "category": "mesh",
+  "order": 814,
+  "description": "Usenet downloader management",
+  "id": "newsbin"
 }
diff --git a/packages/secubox-nextcloud/menu.d/505-nextcloud.json b/packages/secubox-nextcloud/menu.d/505-nextcloud.json
index 7ecd1cea..4542564d 100644
--- a/packages/secubox-nextcloud/menu.d/505-nextcloud.json
+++ b/packages/secubox-nextcloud/menu.d/505-nextcloud.json
@@ -1,7 +1,7 @@
 {
   "id": "nextcloud",
   "name": "Nextcloud",
-  "category": "apps",
+  "category": "mesh",
   "icon": "☁️",
   "path": "/nextcloud/",
   "order": 505,
diff --git a/packages/secubox-ollama/menu.d/800-ollama.json b/packages/secubox-ollama/menu.d/800-ollama.json
index 1c08291b..b1979277 100644
--- a/packages/secubox-ollama/menu.d/800-ollama.json
+++ b/packages/secubox-ollama/menu.d/800-ollama.json
@@ -1,8 +1,9 @@
 {
-    "name": "Ollama AI",
-    "path": "/ollama/",
-    "icon": "🧠",
-    "category": "apps",
-    "order": 800,
-    "description": "Local AI inference with Ollama"
+  "name": "Ollama AI",
+  "path": "/ollama/",
+  "icon": "🧠",
+  "category": "mind",
+  "order": 800,
+  "description": "Local AI inference with Ollama",
+  "id": "ollama"
 }
diff --git a/packages/secubox-openclaw/menu.d/708-openclaw.json b/packages/secubox-openclaw/menu.d/708-openclaw.json
index 1bea1913..d4b72460 100644
--- a/packages/secubox-openclaw/menu.d/708-openclaw.json
+++ b/packages/secubox-openclaw/menu.d/708-openclaw.json
@@ -1,7 +1,7 @@
 {
   "id": "openclaw",
   "name": "OpenClaw OSINT",
-  "category": "security",
+  "category": "auth",
   "icon": "🕵️",
   "path": "/openclaw/",
   "order": 708,
diff --git a/packages/secubox-ossec/menu.d/952-ossec.json b/packages/secubox-ossec/menu.d/952-ossec.json
index 6d692e13..7d29545b 100644
--- a/packages/secubox-ossec/menu.d/952-ossec.json
+++ b/packages/secubox-ossec/menu.d/952-ossec.json
@@ -1 +1,9 @@
-{"id":"ossec","name":"OSSEC HIDS","icon":"🔒","path":"/ossec/","category":"security","order":952,"description":"Host intrusion detection"}
+{
+  "id": "ossec",
+  "name": "OSSEC HIDS",
+  "icon": "🔒",
+  "path": "/ossec/",
+  "category": "wall",
+  "order": 952,
+  "description": "Host intrusion detection"
+}
diff --git a/packages/secubox-p2p/menu.d/590-p2p.json b/packages/secubox-p2p/menu.d/590-p2p.json
index 6882a6f2..ae05bc8c 100644
--- a/packages/secubox-p2p/menu.d/590-p2p.json
+++ b/packages/secubox-p2p/menu.d/590-p2p.json
@@ -1,10 +1,12 @@
 {
-    "id": "p2p",
-    "name": "P2P Hub",
-    "icon": "🔗",
-    "path": "/p2p/",
-    "category": "network",
-    "order": 590,
-    "description": "Peer-to-Peer Network Hub",
-    "requires": ["secubox-p2p"]
+  "id": "p2p",
+  "name": "P2P Hub",
+  "icon": "🔗",
+  "path": "/p2p/",
+  "category": "mesh",
+  "order": 590,
+  "description": "Peer-to-Peer Network Hub",
+  "requires": [
+    "secubox-p2p"
+  ]
 }
diff --git a/packages/secubox-peertube/menu.d/811-peertube.json b/packages/secubox-peertube/menu.d/811-peertube.json
index f0d53c79..ff756145 100644
--- a/packages/secubox-peertube/menu.d/811-peertube.json
+++ b/packages/secubox-peertube/menu.d/811-peertube.json
@@ -1,8 +1,9 @@
 {
-    "name": "PeerTube",
-    "path": "/peertube/",
-    "icon": "📹",
-    "category": "apps",
-    "order": 811,
-    "description": "Federated video platform"
+  "name": "PeerTube",
+  "path": "/peertube/",
+  "icon": "📹",
+  "category": "mesh",
+  "order": 811,
+  "description": "Federated video platform",
+  "id": "peertube"
 }
diff --git a/packages/secubox-photoprism/menu.d/617-photoprism.json b/packages/secubox-photoprism/menu.d/617-photoprism.json
index d819ef12..56270bf3 100644
--- a/packages/secubox-photoprism/menu.d/617-photoprism.json
+++ b/packages/secubox-photoprism/menu.d/617-photoprism.json
@@ -1,8 +1,9 @@
 {
-    "name": "PhotoPrism",
-    "path": "/photoprism/",
-    "icon": "📷",
-    "category": "apps",
-    "order": 617,
-    "description": "Photo management and AI recognition"
+  "name": "PhotoPrism",
+  "path": "/photoprism/",
+  "icon": "📷",
+  "category": "mesh",
+  "order": 617,
+  "description": "Photo management and AI recognition",
+  "id": "photoprism"
 }
diff --git a/packages/secubox-picobrew/menu.d/496-picobrew.json b/packages/secubox-picobrew/menu.d/496-picobrew.json
index 18dd877c..37f3dc6d 100644
--- a/packages/secubox-picobrew/menu.d/496-picobrew.json
+++ b/packages/secubox-picobrew/menu.d/496-picobrew.json
@@ -3,7 +3,7 @@
   "name": "PicoBrew",
   "icon": "🍺",
   "path": "/picobrew/",
-  "category": "apps",
+  "category": "mesh",
   "order": 496,
   "description": "Homebrew fermentation controller"
 }
diff --git a/packages/secubox-portal/menu.d/01-portal.json b/packages/secubox-portal/menu.d/01-portal.json
index d6f047a3..51f0d2f7 100644
--- a/packages/secubox-portal/menu.d/01-portal.json
+++ b/packages/secubox-portal/menu.d/01-portal.json
@@ -1,7 +1,7 @@
 {
   "id": "portal",
   "name": "Portal",
-  "category": "dashboard",
+  "category": "root",
   "icon": "🔐",
   "path": "/portal/",
   "order": 1,
diff --git a/packages/secubox-publish/menu.d/600-publish.json b/packages/secubox-publish/menu.d/600-publish.json
index 03991c06..647aff30 100644
--- a/packages/secubox-publish/menu.d/600-publish.json
+++ b/packages/secubox-publish/menu.d/600-publish.json
@@ -1,7 +1,7 @@
 {
   "id": "publish",
   "name": "Publish",
-  "category": "publishing",
+  "category": "boot",
   "icon": "📡",
   "path": "/publish/",
   "order": 600,
diff --git a/packages/secubox-qos/menu.d/32-qos.json b/packages/secubox-qos/menu.d/32-qos.json
index b26bdb47..d74a4d94 100644
--- a/packages/secubox-qos/menu.d/32-qos.json
+++ b/packages/secubox-qos/menu.d/32-qos.json
@@ -1,7 +1,7 @@
 {
   "id": "qos",
   "name": "Bandwidth Manager",
-  "category": "network",
+  "category": "mesh",
   "icon": "📶",
   "path": "/qos/",
   "order": 220,
diff --git a/packages/secubox-redroid/menu.d/821-redroid.json b/packages/secubox-redroid/menu.d/821-redroid.json
index e656b479..58b3d288 100644
--- a/packages/secubox-redroid/menu.d/821-redroid.json
+++ b/packages/secubox-redroid/menu.d/821-redroid.json
@@ -1 +1,9 @@
-{"id":"redroid","name":"Redroid","icon":"🤖","path":"/redroid/","category":"apps","order":821,"description":"Android in container"}
+{
+  "id": "redroid",
+  "name": "Redroid",
+  "icon": "🤖",
+  "path": "/redroid/",
+  "category": "mesh",
+  "order": 821,
+  "description": "Android in container"
+}
diff --git a/packages/secubox-reporter/menu.d/909-reporter.json b/packages/secubox-reporter/menu.d/909-reporter.json
index 7e7db90f..957b0fe3 100644
--- a/packages/secubox-reporter/menu.d/909-reporter.json
+++ b/packages/secubox-reporter/menu.d/909-reporter.json
@@ -1,7 +1,7 @@
 {
   "id": "reporter",
   "name": "Reporter",
-  "category": "monitoring",
+  "category": "mind",
   "icon": "📊",
   "path": "/reporter/",
   "order": 909,
diff --git a/packages/secubox-rezapp/menu.d/494-rezapp.json b/packages/secubox-rezapp/menu.d/494-rezapp.json
index ccadb204..57b9a730 100644
--- a/packages/secubox-rezapp/menu.d/494-rezapp.json
+++ b/packages/secubox-rezapp/menu.d/494-rezapp.json
@@ -3,7 +3,7 @@
   "name": "RezApp",
   "icon": "📦",
   "path": "/rezapp/",
-  "category": "apps",
+  "category": "root",
   "order": 494,
   "description": "Application deployment and management"
 }
diff --git a/packages/secubox-roadmap/menu.d/900-roadmap.json b/packages/secubox-roadmap/menu.d/900-roadmap.json
index 35418d2f..955bdb55 100644
--- a/packages/secubox-roadmap/menu.d/900-roadmap.json
+++ b/packages/secubox-roadmap/menu.d/900-roadmap.json
@@ -3,7 +3,7 @@
   "name": "Migration Roadmap",
   "icon": "🗺️",
   "path": "/roadmap/",
-  "category": "system",
+  "category": "mind",
   "order": 900,
   "description": "OpenWRT to Debian migration tracking"
 }
diff --git a/packages/secubox-routes/menu.d/907-routes.json b/packages/secubox-routes/menu.d/907-routes.json
index 887c75ce..75ca891d 100644
--- a/packages/secubox-routes/menu.d/907-routes.json
+++ b/packages/secubox-routes/menu.d/907-routes.json
@@ -1,7 +1,7 @@
 {
   "id": "routes",
   "name": "Routes",
-  "category": "network",
+  "category": "root",
   "icon": "🛣️",
   "path": "/routes/",
   "order": 907,
diff --git a/packages/secubox-rtty/menu.d/905-rtty.json b/packages/secubox-rtty/menu.d/905-rtty.json
index cf8c9782..2e61f0e0 100644
--- a/packages/secubox-rtty/menu.d/905-rtty.json
+++ b/packages/secubox-rtty/menu.d/905-rtty.json
@@ -3,7 +3,7 @@
   "name": "Remote Terminal",
   "icon": "🖥️",
   "path": "/rtty/",
-  "category": "system",
+  "category": "root",
   "order": 905,
   "description": "Web-based remote terminal access using rtty"
 }
diff --git a/packages/secubox-rustdesk/menu.d/70-rustdesk.json b/packages/secubox-rustdesk/menu.d/70-rustdesk.json
index 34a711b3..f7b6b457 100644
--- a/packages/secubox-rustdesk/menu.d/70-rustdesk.json
+++ b/packages/secubox-rustdesk/menu.d/70-rustdesk.json
@@ -1,9 +1,10 @@
 {
-  "title": "RustDesk",
   "subtitle": "Remote desktop relay",
   "icon": "fa-desktop",
-  "url": "/rustdesk/",
-  "section": "remote-access",
   "order": 70,
-  "module": "rustdesk"
+  "id": "rustdesk",
+  "name": "RustDesk",
+  "path": "/rustdesk/",
+  "category": "mesh",
+  "description": ""
 }
diff --git a/packages/secubox-saas-relay/menu.d/492-saas-relay.json b/packages/secubox-saas-relay/menu.d/492-saas-relay.json
index b2fbca80..6194f6ca 100644
--- a/packages/secubox-saas-relay/menu.d/492-saas-relay.json
+++ b/packages/secubox-saas-relay/menu.d/492-saas-relay.json
@@ -1,7 +1,7 @@
 {
   "id": "saas-relay",
   "name": "SaaS Relay",
-  "category": "services",
+  "category": "mind",
   "icon": "🔄",
   "path": "/saas-relay/",
   "order": 492,
diff --git a/packages/secubox-simplex/menu.d/816-simplex.json b/packages/secubox-simplex/menu.d/816-simplex.json
index 2a71161f..a21b76c2 100644
--- a/packages/secubox-simplex/menu.d/816-simplex.json
+++ b/packages/secubox-simplex/menu.d/816-simplex.json
@@ -1 +1,10 @@
-{"id":"simplex","name":"SimpleX","icon":"💬","path":"/simplex/","category":"apps","order":816,"description":"Zero-knowledge private messaging server","color":"#6366f1"}
+{
+  "id": "simplex",
+  "name": "SimpleX",
+  "icon": "💬",
+  "path": "/simplex/",
+  "category": "mesh",
+  "order": 816,
+  "description": "Zero-knowledge private messaging server",
+  "color": "#6366f1"
+}
diff --git a/packages/secubox-smtp-relay/menu.d/915-smtp-relay.json b/packages/secubox-smtp-relay/menu.d/915-smtp-relay.json
index e5ec29c9..280871e0 100644
--- a/packages/secubox-smtp-relay/menu.d/915-smtp-relay.json
+++ b/packages/secubox-smtp-relay/menu.d/915-smtp-relay.json
@@ -1,7 +1,7 @@
 {
   "id": "smtp-relay",
   "name": "SMTP Relay",
-  "category": "services",
+  "category": "mesh",
   "icon": "envelope",
   "path": "/smtp-relay/",
   "order": 915,
diff --git a/packages/secubox-soc/menu.d/100-soc.json b/packages/secubox-soc/menu.d/100-soc.json
index b3d1c663..784051a0 100644
--- a/packages/secubox-soc/menu.d/100-soc.json
+++ b/packages/secubox-soc/menu.d/100-soc.json
@@ -1,7 +1,7 @@
 {
   "id": "soc",
   "name": "Soc",
-  "category": "dashboard",
+  "category": "wall",
   "icon": "🛡️",
   "path": "/soc/",
   "order": 100,
diff --git a/packages/secubox-streamforge/menu.d/61-streamforge.json b/packages/secubox-streamforge/menu.d/61-streamforge.json
index 75355ff2..5e0abe95 100644
--- a/packages/secubox-streamforge/menu.d/61-streamforge.json
+++ b/packages/secubox-streamforge/menu.d/61-streamforge.json
@@ -1,7 +1,7 @@
 {
   "id": "streamforge",
   "name": "StreamForge",
-  "category": "apps",
+  "category": "mesh",
   "icon": "🔨",
   "path": "/streamforge/",
   "order": 510,
diff --git a/packages/secubox-streamlit/menu.d/60-streamlit.json b/packages/secubox-streamlit/menu.d/60-streamlit.json
index 71e0a3b8..ea4891cc 100644
--- a/packages/secubox-streamlit/menu.d/60-streamlit.json
+++ b/packages/secubox-streamlit/menu.d/60-streamlit.json
@@ -1,7 +1,7 @@
 {
   "id": "streamlit",
   "name": "Streamlit",
-  "category": "apps",
+  "category": "mesh",
   "icon": "🎯",
   "path": "/streamlit/",
   "order": 500,
diff --git a/packages/secubox-system/menu.d/10-system.json b/packages/secubox-system/menu.d/10-system.json
index 0f38be9e..b41bbac1 100644
--- a/packages/secubox-system/menu.d/10-system.json
+++ b/packages/secubox-system/menu.d/10-system.json
@@ -1,7 +1,7 @@
 {
   "id": "system",
   "name": "System Hub",
-  "category": "dashboard",
+  "category": "root",
   "icon": "🔧",
   "path": "/system/",
   "order": 10,
diff --git a/packages/secubox-threat-analyst/menu.d/130-threat-analyst.json b/packages/secubox-threat-analyst/menu.d/130-threat-analyst.json
index 4b850fa4..1db59bed 100644
--- a/packages/secubox-threat-analyst/menu.d/130-threat-analyst.json
+++ b/packages/secubox-threat-analyst/menu.d/130-threat-analyst.json
@@ -1,7 +1,7 @@
 {
   "id": "threat-analyst",
   "name": "Threat Analyst",
-  "category": "security",
+  "category": "wall",
   "icon": "🕵️",
   "path": "/threat-analyst/",
   "order": 130,
diff --git a/packages/secubox-threats/menu.d/707-threats.json b/packages/secubox-threats/menu.d/707-threats.json
index 06ee9d70..c7481233 100644
--- a/packages/secubox-threats/menu.d/707-threats.json
+++ b/packages/secubox-threats/menu.d/707-threats.json
@@ -1,7 +1,7 @@
 {
   "id": "threats",
   "name": "Threats",
-  "category": "security",
+  "category": "wall",
   "icon": "⚠️",
   "path": "/threats/",
   "order": 707,
diff --git a/packages/secubox-tor/menu.d/560-tor.json b/packages/secubox-tor/menu.d/560-tor.json
index df87d525..a71674b0 100644
--- a/packages/secubox-tor/menu.d/560-tor.json
+++ b/packages/secubox-tor/menu.d/560-tor.json
@@ -1,7 +1,7 @@
 {
   "id": "tor",
   "name": "Tor",
-  "category": "security",
+  "category": "mesh",
   "icon": "🧅",
   "path": "/tor/",
   "order": 560,
diff --git a/packages/secubox-torrent/menu.d/612-torrent.json b/packages/secubox-torrent/menu.d/612-torrent.json
index 2e2b450f..67085848 100644
--- a/packages/secubox-torrent/menu.d/612-torrent.json
+++ b/packages/secubox-torrent/menu.d/612-torrent.json
@@ -1,8 +1,9 @@
 {
-    "name": "Torrent",
-    "path": "/torrent/",
-    "icon": "📥",
-    "category": "apps",
-    "order": 612,
-    "description": "BitTorrent client management"
+  "name": "Torrent",
+  "path": "/torrent/",
+  "icon": "📥",
+  "category": "mesh",
+  "order": 612,
+  "description": "BitTorrent client management",
+  "id": "torrent"
 }
diff --git a/packages/secubox-traffic/menu.d/36-traffic.json b/packages/secubox-traffic/menu.d/36-traffic.json
index 81f5aa8f..3d4669a1 100644
--- a/packages/secubox-traffic/menu.d/36-traffic.json
+++ b/packages/secubox-traffic/menu.d/36-traffic.json
@@ -3,7 +3,7 @@
   "name": "Traffic Shaping",
   "icon": "📊",
   "path": "/traffic/",
-  "category": "network",
+  "category": "mesh",
   "order": 36,
   "description": "TC/CAKE QoS traffic shaping per interface"
 }
diff --git a/packages/secubox-turn/menu.d/914-turn.json b/packages/secubox-turn/menu.d/914-turn.json
index 0b746409..d929818d 100644
--- a/packages/secubox-turn/menu.d/914-turn.json
+++ b/packages/secubox-turn/menu.d/914-turn.json
@@ -3,7 +3,7 @@
   "name": "TURN/STUN Server",
   "icon": "📞",
   "path": "/turn/",
-  "category": "network",
+  "category": "mesh",
   "order": 914,
   "description": "TURN/STUN server management for WebRTC"
 }
diff --git a/packages/secubox-users/menu.d/25-users.json b/packages/secubox-users/menu.d/25-users.json
index a5286e68..eee385c8 100644
--- a/packages/secubox-users/menu.d/25-users.json
+++ b/packages/secubox-users/menu.d/25-users.json
@@ -1,7 +1,7 @@
 {
   "id": "users",
   "name": "Users",
-  "category": "security",
+  "category": "auth",
   "icon": "👥",
   "path": "/users/",
   "order": 25,
diff --git a/packages/secubox-vault/menu.d/901-vault.json b/packages/secubox-vault/menu.d/901-vault.json
index 3a0e789d..918d8289 100644
--- a/packages/secubox-vault/menu.d/901-vault.json
+++ b/packages/secubox-vault/menu.d/901-vault.json
@@ -1 +1,9 @@
-{"id":"vault","name":"Vault","icon":"🔐","path":"/vault/","category":"system","order":901,"description":"Secrets management"}
+{
+  "id": "vault",
+  "name": "Vault",
+  "icon": "🔐",
+  "path": "/vault/",
+  "category": "root",
+  "order": 901,
+  "description": "Secrets management"
+}
diff --git a/packages/secubox-vhost/menu.d/33-vhost.json b/packages/secubox-vhost/menu.d/33-vhost.json
index 0530ef1f..9fbc54eb 100644
--- a/packages/secubox-vhost/menu.d/33-vhost.json
+++ b/packages/secubox-vhost/menu.d/33-vhost.json
@@ -1,7 +1,7 @@
 {
   "id": "vhost",
   "name": "Virtual Hosts",
-  "category": "network",
+  "category": "mesh",
   "icon": "🌍",
   "path": "/vhost/",
   "order": 230,
diff --git a/packages/secubox-vm/menu.d/903-vm.json b/packages/secubox-vm/menu.d/903-vm.json
index 4273e9cd..95b138dd 100644
--- a/packages/secubox-vm/menu.d/903-vm.json
+++ b/packages/secubox-vm/menu.d/903-vm.json
@@ -1 +1,9 @@
-{"id":"vm","name":"VM Manager","icon":"🖥️","path":"/vm/","category":"system","order":903,"description":"Virtual machines and containers"}
+{
+  "id": "vm",
+  "name": "VM Manager",
+  "icon": "🖥️",
+  "path": "/vm/",
+  "category": "root",
+  "order": 903,
+  "description": "Virtual machines and containers"
+}
diff --git a/packages/secubox-voip/menu.d/622-voip.json b/packages/secubox-voip/menu.d/622-voip.json
index 552cd22f..c7a1cc5e 100644
--- a/packages/secubox-voip/menu.d/622-voip.json
+++ b/packages/secubox-voip/menu.d/622-voip.json
@@ -1,8 +1,9 @@
 {
-    "name": "VoIP/PBX",
-    "path": "/voip/",
-    "icon": "📞",
-    "category": "apps",
-    "order": 622,
-    "description": "Asterisk/FreePBX PBX management"
+  "name": "VoIP/PBX",
+  "path": "/voip/",
+  "icon": "📞",
+  "category": "mesh",
+  "order": 622,
+  "description": "Asterisk/FreePBX PBX management",
+  "id": "voip"
 }
diff --git a/packages/secubox-vortex-dns/menu.d/33-vortex-dns.json b/packages/secubox-vortex-dns/menu.d/33-vortex-dns.json
index 505a9e3f..0ebca6e1 100644
--- a/packages/secubox-vortex-dns/menu.d/33-vortex-dns.json
+++ b/packages/secubox-vortex-dns/menu.d/33-vortex-dns.json
@@ -1,7 +1,7 @@
 {
   "id": "vortex-dns",
   "name": "Vortex DNS",
-  "category": "network",
+  "category": "mesh",
   "icon": "🌀",
   "path": "/vortex-dns/",
   "order": 33,
diff --git a/packages/secubox-vortex-firewall/menu.d/125-vortex-firewall.json b/packages/secubox-vortex-firewall/menu.d/125-vortex-firewall.json
index d7655a52..cc2940bd 100644
--- a/packages/secubox-vortex-firewall/menu.d/125-vortex-firewall.json
+++ b/packages/secubox-vortex-firewall/menu.d/125-vortex-firewall.json
@@ -1,7 +1,7 @@
 {
   "id": "vortex-firewall",
   "name": "Vortex Firewall",
-  "category": "security",
+  "category": "wall",
   "icon": "🔥",
   "path": "/vortex-firewall/",
   "order": 125,
diff --git a/packages/secubox-waf/menu.d/110-waf.json b/packages/secubox-waf/menu.d/110-waf.json
index 7febf5dc..4aabfe88 100644
--- a/packages/secubox-waf/menu.d/110-waf.json
+++ b/packages/secubox-waf/menu.d/110-waf.json
@@ -1,7 +1,7 @@
 {
   "id": "waf",
   "name": "WAF",
-  "category": "security",
+  "category": "wall",
   "icon": "🛡️",
   "path": "/waf/",
   "order": 110,
diff --git a/packages/secubox-watchdog/menu.d/555-watchdog.json b/packages/secubox-watchdog/menu.d/555-watchdog.json
index 47187fb0..194aa29a 100644
--- a/packages/secubox-watchdog/menu.d/555-watchdog.json
+++ b/packages/secubox-watchdog/menu.d/555-watchdog.json
@@ -1,7 +1,7 @@
 {
   "id": "watchdog",
   "name": "Watchdog",
-  "category": "system",
+  "category": "wall",
   "icon": "🔍",
   "path": "/watchdog/",
   "order": 555,
diff --git a/packages/secubox-wazuh/menu.d/951-wazuh.json b/packages/secubox-wazuh/menu.d/951-wazuh.json
index 1518cb02..64c7e372 100644
--- a/packages/secubox-wazuh/menu.d/951-wazuh.json
+++ b/packages/secubox-wazuh/menu.d/951-wazuh.json
@@ -1 +1,9 @@
-{"id":"wazuh","name":"Wazuh SIEM","icon":"🛡️","path":"/wazuh/","category":"security","order":951,"description":"Security monitoring and alerts"}
+{
+  "id": "wazuh",
+  "name": "Wazuh SIEM",
+  "icon": "🛡️",
+  "path": "/wazuh/",
+  "category": "wall",
+  "order": 951,
+  "description": "Security monitoring and alerts"
+}
diff --git a/packages/secubox-webmail/menu.d/56-webmail.json b/packages/secubox-webmail/menu.d/56-webmail.json
index 1afca953..72eca492 100644
--- a/packages/secubox-webmail/menu.d/56-webmail.json
+++ b/packages/secubox-webmail/menu.d/56-webmail.json
@@ -1,7 +1,7 @@
 {
   "id": "webmail",
   "name": "Webmail",
-  "category": "apps",
+  "category": "mesh",
   "icon": "📬",
   "path": "/webmail/",
   "order": 56,
diff --git a/packages/secubox-webradio/menu.d/611-webradio.json b/packages/secubox-webradio/menu.d/611-webradio.json
index 5512774a..c977a967 100644
--- a/packages/secubox-webradio/menu.d/611-webradio.json
+++ b/packages/secubox-webradio/menu.d/611-webradio.json
@@ -3,7 +3,7 @@
   "name": "WebRadio",
   "icon": "📻",
   "path": "/webradio/",
-  "category": "apps",
+  "category": "mesh",
   "order": 611,
   "description": "Internet radio streaming and recording"
 }
diff --git a/packages/secubox-wireguard/menu.d/25-wireguard.json b/packages/secubox-wireguard/menu.d/25-wireguard.json
index 70848af1..934749c8 100644
--- a/packages/secubox-wireguard/menu.d/25-wireguard.json
+++ b/packages/secubox-wireguard/menu.d/25-wireguard.json
@@ -3,7 +3,7 @@
   "name": "WireGuard VPN",
   "icon": "🔐",
   "path": "/wireguard/",
-  "category": "security",
+  "category": "mesh",
   "order": 25,
   "description": "WireGuard VPN tunnel management"
 }
diff --git a/packages/secubox-yacy/menu.d/60-yacy.json b/packages/secubox-yacy/menu.d/60-yacy.json
index bd21797d..29a77677 100644
--- a/packages/secubox-yacy/menu.d/60-yacy.json
+++ b/packages/secubox-yacy/menu.d/60-yacy.json
@@ -1,9 +1,10 @@
 {
-  "title": "YaCy",
   "subtitle": "Peer-to-peer search",
   "icon": "fa-search",
-  "url": "/yacy/",
-  "section": "search",
   "order": 60,
-  "module": "yacy"
+  "id": "yacy",
+  "name": "YaCy",
+  "path": "/yacy/",
+  "category": "mesh",
+  "description": ""
 }
diff --git a/packages/secubox-zigbee/debian/changelog b/packages/secubox-zigbee/debian/changelog
index 2950b0c9..5abac092 100644
--- a/packages/secubox-zigbee/debian/changelog
+++ b/packages/secubox-zigbee/debian/changelog
@@ -1,3 +1,17 @@
+secubox-zigbee (2.5.3-1~bookworm1) bookworm; urgency=medium
+
+  * www/zigbee/index.html: rewrite using the canonical SecuBox webui
+    scaffold (body display:flex, sidebar fixed at 220px, .main with
+    padding-top reserving 48px for the global-menu-bar). Replaces the
+    ad-hoc grid layout that mismatched the global navbar. Uses MESH
+    palette (#104A88) per the charter — Zigbee is a mesh-topology IoT
+    manager.
+  * menu.d/80-zigbee.json: schema normalised to id/name/path/category
+    (was title/url/section/module — silently ignored by the hub),
+    category=mesh per the new 6-charter taxonomy (#306).
+
+ -- Gerald Kerma <devel@cybermind.fr>  Thu, 21 May 2026 11:30:00 +0000
+
 secubox-zigbee (2.5.2-1~bookworm1) bookworm; urgency=medium
 
   * menu.d/80-zigbee.json: rewrite (was a copy-paste of Lyrion's
diff --git a/packages/secubox-zigbee/menu.d/80-zigbee.json b/packages/secubox-zigbee/menu.d/80-zigbee.json
index cad03419..ca979841 100644
--- a/packages/secubox-zigbee/menu.d/80-zigbee.json
+++ b/packages/secubox-zigbee/menu.d/80-zigbee.json
@@ -1,9 +1,10 @@
 {
-  "title": "Zigbee",
   "subtitle": "Mesh manager (z2m)",
   "icon": "fa-microchip",
-  "url": "/zigbee/",
-  "section": "hosting",
   "order": 85,
-  "module": "zigbee"
+  "id": "zigbee",
+  "name": "Zigbee",
+  "path": "/zigbee/",
+  "category": "mesh",
+  "description": ""
 }
diff --git a/packages/secubox-zigbee/www/zigbee/index.html b/packages/secubox-zigbee/www/zigbee/index.html
index 9bfb9c96..180f5026 100644
--- a/packages/secubox-zigbee/www/zigbee/index.html
+++ b/packages/secubox-zigbee/www/zigbee/index.html
@@ -3,150 +3,137 @@
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>SecuBox — Zigbee</title>
+<title>SecuBox - Zigbee</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@400;600;700&family=JetBrains+Mono:wght@400;700&display=swap" rel="stylesheet">
 <link rel="stylesheet" href="/shared/crt-light.css">
 <link rel="stylesheet" href="/shared/sidebar-light.css">
 <style>
-  html, body { margin: 0; padding: 0; min-height: 100%; }
-  /* Global menu bar (injected by shared/sidebar.js) is position:fixed,
-     top:0, height:48px, z-index:998. Push our content below it. */
-  body { padding-top: 48px; box-sizing: border-box; }
-  .layout {
-    display: grid;
-    grid-template-columns: 220px 1fr; /* canonical SecuBox sidebar width */
-    min-height: calc(100vh - 48px);
+  :root {
+    /* MESH palette (Charte SecuBox §Six Module Color System). Zigbee is a
+       mesh-topology IoT manager → MESH (Blue). */
+    --mesh-main:  #104A88;
+    --mesh-light: #2C70C0;
+    --mesh-xlt:   #E6F1FB;
+    --accent:       var(--mesh-main);
+    --accent-light: var(--mesh-light);
+
+    --bg:       #FFFFFF;
+    --surface:  #FAFAF8;
+    --surface2: #F4F3EF;
+    --border:   #E2E0D8;
+    --border2:  #C8C6BE;
+    --text:     #1A1A18;
+    --muted:    #6B6963;
+
+    --green:  #0A5840;
+    --yellow: #9A6010;
+    --red:    #803018;
+
+    /* Reserve room for the .global-menu-bar injected by shared/sidebar.js
+       (position:fixed, top:0, height:48px, z-index:998). */
+    --gmb-h: 48px;
   }
-  .container { display: flex; flex-direction: column; min-height: calc(100vh - 48px); }
-  .topbar {
+
+  * { box-sizing: border-box; margin: 0; padding: 0; }
+  body {
+    font-family: 'Space Grotesk', sans-serif;
+    background: var(--bg);
+    color: var(--text);
     display: flex;
-    align-items: center;
-    justify-content: space-between;
-    padding: 0.6rem 1.25rem;
-    background: var(--bg-2, #181c2c);
-    border-bottom: 1px solid var(--border, #2a3354);
-    color: var(--root-main, #00d49b);
-    font-family: 'JetBrains Mono', monospace;
-    font-size: 0.85rem;
-  }
-  .topbar .actions a {
-    color: var(--root-main, #00d49b);
-    margin-left: 1rem;
-    text-decoration: none;
-  }
-  .topbar .actions a:hover { text-decoration: underline; }
-  .open-manager {
-    display: inline-block;
-    padding: 0.45rem 0.9rem;
-    border: 1px solid var(--root-main, #00d49b);
-    border-radius: 4px;
-    background: rgba(0,212,155,0.08);
-    color: var(--root-main, #00d49b);
-    text-decoration: none;
-    font-family: 'JetBrains Mono', monospace;
-    font-size: 0.85rem;
-  }
-  .open-manager:hover { background: rgba(0,212,155,0.18); }
-  .threefold {
-    display: grid;
-    grid-template-columns: repeat(3, 1fr);
-    gap: 1rem;
-    padding: 1.25rem;
-    background: var(--bg-1, #0f1320);
-  }
-  .threefold article {
-    background: var(--bg-2);
-    border: 1px solid var(--border);
-    padding: 0.85rem 1rem;
-    border-radius: 4px;
-    min-height: 110px;
-  }
-  .threefold h3 {
-    margin: 0 0 0.6rem 0;
-    color: var(--root-main);
-    font-size: 0.75rem;
-    text-transform: uppercase;
-    letter-spacing: 0.1em;
-  }
-  .threefold .v {
-    font-family: 'JetBrains Mono', monospace;
-    font-size: 0.85rem;
-    line-height: 1.5;
-  }
-  .threefold .v a { color: var(--root-main); }
-  .info-block {
-    padding: 1.25rem;
-    color: var(--text, #b8c5e0);
-    font-size: 0.9rem;
+    min-height: 100vh;
+    font-size: 14px;
     line-height: 1.6;
-    border-top: 1px solid var(--border);
   }
-  .info-block h2 {
-    font-size: 0.85rem;
-    text-transform: uppercase;
-    letter-spacing: 0.1em;
-    color: var(--root-main);
-    margin: 0 0 0.6rem 0;
+
+  .main {
+    flex: 1;
+    margin-left: 220px;
+    padding: calc(var(--gmb-h) + 1.5rem) 1.5rem 1.5rem;
+    min-width: 0;
   }
-  .info-block code {
-    background: var(--bg-2);
-    padding: 0.05rem 0.3rem;
-    border-radius: 3px;
-    font-family: 'JetBrains Mono', monospace;
-    font-size: 0.85em;
+
+  .header { display: flex; justify-content: space-between; align-items: center; margin-bottom: 1.5rem; gap: 1rem; }
+  .header h1 { font-size: 24px; font-weight: 600; letter-spacing: -0.4px; color: var(--accent); }
+  .header h1 .icon { margin-right: 0.5rem; }
+  .header-actions { display: flex; gap: 0.5rem; }
+
+  .btn { padding: 0.5rem 1rem; border-radius: 6px; border: 1px solid var(--border2); background: var(--surface); color: var(--text); cursor: pointer; font-family: inherit; font-size: 14px; text-decoration: none; display: inline-flex; align-items: center; gap: 0.4rem; transition: all 0.15s; }
+  .btn:hover { border-color: var(--accent); color: var(--accent); background: var(--mesh-xlt); }
+  .btn.primary { background: var(--accent); border-color: var(--accent); color: #fff; }
+  .btn.primary:hover { background: var(--accent-light); color: #fff; }
+
+  .threefold { display: grid; grid-template-columns: repeat(3, 1fr); gap: 1rem; margin-bottom: 1.5rem; }
+  .card { background: var(--surface); border: 1px solid var(--border); border-radius: 14px; padding: 1.25rem 1.5rem; }
+  .card h3 { font-size: 12px; font-weight: 700; text-transform: uppercase; letter-spacing: 0.1em; color: var(--muted); margin-bottom: 0.75rem; }
+  .card .v { font-family: 'JetBrains Mono', monospace; font-size: 13px; line-height: 1.7; color: var(--text); }
+  .card .v a { color: var(--accent); text-decoration: none; }
+  .card .v a:hover { text-decoration: underline; }
+  .card .v strong { color: var(--accent); font-weight: 700; }
+
+  .status-pill { display: inline-block; padding: 0.2rem 0.6rem; border-radius: 999px; font-size: 12px; font-weight: 700; letter-spacing: 0.05em; }
+  .status-pill.green  { background: rgba(10,88,64,0.1);  color: var(--green); }
+  .status-pill.yellow { background: rgba(154,96,16,0.1); color: var(--yellow); }
+  .status-pill.red    { background: rgba(128,48,24,0.1); color: var(--red); }
+
+  .about { background: var(--surface2); border: 1px solid var(--border); border-radius: 14px; padding: 1.25rem 1.5rem; color: var(--muted); }
+  .about h2 { font-size: 12px; font-weight: 700; text-transform: uppercase; letter-spacing: 0.1em; color: var(--text); margin-bottom: 0.5rem; }
+  .about p { margin-bottom: 0.5rem; }
+  .about code { background: var(--bg); padding: 0.05rem 0.4rem; border-radius: 3px; font-family: 'JetBrains Mono', monospace; font-size: 12px; color: var(--text); border: 1px solid var(--border); }
+
+  @media (max-width: 900px) {
+    .main { margin-left: 0; padding-top: calc(var(--gmb-h) + 1rem); }
+    .threefold { grid-template-columns: 1fr; }
   }
 </style>
 </head>
 <body class="crt-light">
 
-<div class="layout">
-  <nav class="sidebar" id="sidebar"></nav>
-  <div class="container">
-    <div class="topbar">
-      <div><strong>SecuBox</strong> · Zigbee — Mesh manager</div>
-      <div class="actions">
-        <a href="/" title="Back to SecuBox hub">&larr; hub</a>
-        <a class="open-manager" href="https://zigbee.gk2.secubox.in/" id="open-manager"
-           title="Open the full zigbee2mqtt manager">Open Zigbee Manager &rarr;</a>
-      </div>
-    </div>
+<nav class="sidebar" id="sidebar"></nav>
 
-    <section class="threefold" id="threefold">
-      <article id="components-card">
-        <h3>Components</h3>
-        <div class="v" id="components-v">loading&hellip;</div>
-      </article>
-      <article id="status-card">
-        <h3>Status</h3>
-        <div class="v" id="status-v">loading&hellip;</div>
-      </article>
-      <article id="access-card">
-        <h3>Access</h3>
-        <div class="v" id="access-v">loading&hellip;</div>
-      </article>
-    </section>
-
-    <div class="info-block">
-      <h2>About this module</h2>
-      <p>
-        SecuBox manages a <code>zigbee2mqtt</code> instance running in an
-        LXC at <code>10.100.0.111</code> with a SONOFF Dongle-E coordinator.
-        Pairing, network maps, OTA updates, and group bindings are handled
-        by the <em>Zigbee Manager</em> &mdash; open it via the button above
-        (Authelia SSO-gated).
-      </p>
-      <p>
-        This module surfaces the SecuBox-side health (component state, MQTT
-        bridge status, access points) so operators can confirm the stack
-        is up before opening the manager.
-      </p>
+<main class="main">
+  <div class="header">
+    <h1><span class="icon">📡</span> Zigbee — Mesh manager</h1>
+    <div class="header-actions">
+      <a class="btn" href="/" title="Back to SecuBox hub">← hub</a>
+      <a class="btn primary" href="https://zigbee.gk2.secubox.in/" title="Open the full zigbee2mqtt manager (SSO-gated)">Open Zigbee Manager →</a>
     </div>
   </div>
-</div>
+
+  <section class="threefold">
+    <div class="card">
+      <h3>Components</h3>
+      <div class="v" id="components-v">loading…</div>
+    </div>
+    <div class="card">
+      <h3>Status</h3>
+      <div class="v" id="status-v">loading…</div>
+    </div>
+    <div class="card">
+      <h3>Access</h3>
+      <div class="v" id="access-v">loading…</div>
+    </div>
+  </section>
+
+  <div class="about">
+    <h2>About this module</h2>
+    <p>
+      SecuBox runs <code>zigbee2mqtt</code> in an LXC at <code>10.100.0.111</code>
+      with a SONOFF Dongle-E coordinator. Pairing, network maps, OTA updates,
+      and group bindings are handled by the dedicated <em>Zigbee Manager</em>
+      vhost (Authelia SSO-gated) — click <strong>Open Zigbee Manager →</strong>.
+    </p>
+    <p>
+      This page surfaces the SecuBox-side health (component state, MQTT bridge,
+      access endpoints) so operators can confirm the stack is up before opening
+      the manager.
+    </p>
+  </div>
+</main>
 
 <script src="/shared/sidebar.js"></script>
 <script src="/shared/api-utils.js"></script>
 <script>
-// Mandatory auth wrapper (matches docs/MODULE-GUIDELINES.md §4)
 (function () {
   function getToken() { return localStorage.getItem('sbx_token'); }
   function checkAuth() {
@@ -157,42 +144,27 @@
     return true;
   }
   if (!checkAuth()) {
-    document.body.innerHTML = '<div style="padding:2rem;color:var(--root-main);">Redirecting to login&hellip;</div>';
+    document.querySelector('main.main').innerHTML = '<div style="padding:2rem;color:var(--muted);">Redirecting to login…</div>';
     return;
   }
-
   function get(path) {
-    return fetch('/api/v1/zigbee' + path, {
-      headers: { 'Authorization': 'Bearer ' + getToken() }
-    }).then(r => r.ok ? r.json() : Promise.reject(r.status));
+    return fetch('/api/v1/zigbee' + path, { headers: { 'Authorization': 'Bearer ' + getToken() } })
+      .then(function (r) { return r.ok ? r.json() : Promise.reject(r.status); });
   }
+  get('/components').then(function (d) {
+    var list = (d.components || []).map(function (c) { return '<div>' + c.name + ': <strong>' + c.state + '</strong></div>'; }).join('');
+    document.getElementById('components-v').innerHTML = list || '<span style="color:var(--muted)">no components</span>';
+  }).catch(function () { document.getElementById('components-v').innerHTML = '<span style="color:var(--muted)">unavailable</span>'; });
 
-  get('/components').then(d => {
-    const list = (d.components || []).map(c =>
-      '<div>' + c.name + ': <strong>' + c.state + '</strong></div>').join('');
-    document.getElementById('components-v').innerHTML = list || 'no components';
-  }).catch(() => {
-    document.getElementById('components-v').textContent = 'unavailable';
-  });
+  get('/status').then(function (d) {
+    var pill = (d.overall === 'green') ? 'green' : (d.overall === 'yellow') ? 'yellow' : (d.overall === 'red') ? 'red' : '';
+    document.getElementById('status-v').innerHTML = '<span class="status-pill ' + pill + '">' + (d.overall || 'unknown').toUpperCase() + '</span>';
+  }).catch(function () { document.getElementById('status-v').innerHTML = '<span style="color:var(--muted)">unavailable</span>'; });
 
-  get('/status').then(d => {
-    const overall = (d.overall || 'unknown').toUpperCase();
-    const color = d.overall === 'green' ? 'root-main'
-                : d.overall === 'yellow' ? 'wall-main'
-                : 'cinnabar';
-    document.getElementById('status-v').innerHTML =
-      '<span style="color:var(--' + color + ')">' + overall + '</span>';
-  }).catch(() => {
-    document.getElementById('status-v').textContent = 'unavailable';
-  });
-
-  get('/access').then(d => {
-    const list = (d.access || []).map(a =>
-      '<div>' + a.scope + ': <a href="' + a.url + '">' + a.url + '</a></div>').join('');
-    document.getElementById('access-v').innerHTML = list || 'no access points';
-  }).catch(() => {
-    document.getElementById('access-v').textContent = 'unavailable';
-  });
+  get('/access').then(function (d) {
+    var list = (d.access || []).map(function (a) { return '<div>' + a.scope + ': <a href="' + a.url + '">' + a.url + '</a></div>'; }).join('');
+    document.getElementById('access-v').innerHTML = list || '<span style="color:var(--muted)">no access points</span>';
+  }).catch(function () { document.getElementById('access-v').innerHTML = '<span style="color:var(--muted)">unavailable</span>'; });
 })();
 </script>
 
diff --git a/packages/secubox-zkp/menu.d/570-zkp.json b/packages/secubox-zkp/menu.d/570-zkp.json
index 47012e75..ad5a5e4b 100644
--- a/packages/secubox-zkp/menu.d/570-zkp.json
+++ b/packages/secubox-zkp/menu.d/570-zkp.json
@@ -3,7 +3,7 @@
   "name": "Zero-Knowledge Proof",
   "icon": "🔐",
   "path": "/zkp/",
-  "category": "security",
+  "category": "auth",
   "order": 570,
   "description": "Zero-Knowledge Proof Hamiltonian management"
 }