diff --git a/toolchain/README.md b/toolchain/README.md
new file mode 100644
index 0000000..85b1d46
--- /dev/null
+++ b/toolchain/README.md
@@ -0,0 +1,30 @@
+# Arcline OS — toolchain packaging
+#
+# The landing page promises 11 Go tools shipping with Arcline OS. This harness
+# turns each tool's source repo into a .deb package that configure-system.sh
+# installs into the image.
+#
+# Tools (source of truth: tools.list):
+#
+#   arcline-uptime   HTTP/TCP/TLS/DNS monitoring, Prometheus metrics export
+#   arcline-check    CDN + transparency auditor
+#   arcline-audit    full site health scanner (SSL, headers, perf, a11y)
+#   arcline-dns      DNS propagation checker across resolvers
+#   arcline-vault    encrypted secrets store (REST API + CLI)
+#   arcline-email    self-hosted SMTP/IMAP stack (OpenSMTPD + Dovecot + Rspamd)
+#   arcline-migrate  cPanel/Plesk → Arcline migration
+#   arcline-billing  Stripe-powered subscription management
+#   arcline-portal   customer dashboard (SSL monitoring + ticketing)
+#   arcline-website  Go HTTP server for arcline.it
+#   arcline-status   static status page generator
+#
+# Usage:
+#   toolchain/build-tools.sh                  # build all (clone from git.arcline.it)
+#   ARCLINE_TOOLS_DIR=/path/to/checkouts \    # reuse local checkouts
+#     toolchain/build-tools.sh
+#   make toolchain
+#
+# The script is a harness ("the wires"): it clones each repo, tries a handful
+# of common Go layouts, builds a release binary, and packages a .deb. Any tool
+# whose repo is unavailable or fails to build is skipped with a warning — the
+# build must not silently break the OS image.
diff --git a/toolchain/build-tools.sh b/toolchain/build-tools.sh
new file mode 100755
index 0000000..7134ecf
--- /dev/null
+++ b/toolchain/build-tools.sh
@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# Arcline OS — toolchain .deb builder
+#
+#   toolchain/build-tools.sh
+#   ARCLINE_TOOLS_DIR=/path/to/checkouts toolchain/build-tools.sh
+#
+# For each tool in tools.list:
+#   1. obtain source (local checkout if ARCLINE_TOOLS_DIR set, else git clone)
+#   2. build a release binary (tries common Go layouts)
+#   3. package a .deb into build/debs/
+#
+# Skips (with a warning) anything it cannot build — the OS image must never
+# break because a tool repo is unreachable. Requires Go and dpkg-deb.
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/../scripts/common.sh"
+
+VERSION="${VERSION:-0.1.0}"
+ARCH="${ARCH:-amd64}"
+SRC_DIR="$ROOT/build/toolchain-src"
+LOCAL_TOOLS="${ARCLINE_TOOLS_DIR:-}"
+TOOLS_LIST="$ROOT/toolchain/tools.list"
+
+command -v go >/dev/null || die "go not found (toolchain build needs Go ≥ 1.21)"
+command -v dpkg-deb >/dev/null || die "dpkg-deb not found"
+
+mkdir -p "$SRC_DIR" "$DEB_DIR"
+log "toolchain build → $DEB_DIR (version $VERSION, arch $ARCH)"
+
+built=0; skipped=0
+
+while IFS='|' read -r name repo desc; do
+  [[ -n "$name" ]] || continue
+  [[ "$name" != \#* ]] || continue
+
+  # ── obtain source ─────────────────────────────────────────────────────────
+  if [[ -n "$LOCAL_TOOLS" && -d "$LOCAL_TOOLS/$name" ]]; then
+    SRC="$LOCAL_TOOLS/$name"
+    log "using local checkout: $name"
+  else
+    SRC="$SRC_DIR/$name"
+    if [[ ! -d "$SRC/.git" ]]; then
+      log "cloning: $name"
+      git clone --depth 1 --quiet "$repo" "$SRC" 2>/dev/null \
+        || { warn "could not fetch $name (repo unreachable), skipping"; skipped=$((skipped+1)); continue; }
+    fi
+  fi
+
+  # ── build ─────────────────────────────────────────────────────────────────
+  BUILD=""
+  for target in "./cmd/$name" "./cmd" "./" ; do
+    if [[ -f "$SRC/$target/go.mod" || -f "$SRC/$target/main.go" ]]; then
+      BUILD="$target"; break
+    fi
+  done
+  if [[ -z "$BUILD" ]]; then
+    warn "$name: no go.mod/main.go found in a known layout, skipping"
+    skipped=$((skipped+1)); continue
+  fi
+
+  log "building: $name (go build $BUILD)"
+  (
+    cd "$SRC"
+    go build -trimpath -mod=mod -ldflags "-s -w -X main.version=$VERSION" -o "$ROOT/build/$name" "$BUILD"
+  ) || { warn "$name: go build failed, skipping"; skipped=$((skipped+1)); continue; }
+
+  # ── package .deb ──────────────────────────────────────────────────────────
+  PKG="$ROOT/build/pkg-$name"
+  rm -rf "$PKG"
+  mkdir -p "$PKG/DEBIAN" "$PKG/usr/bin"
+  install -m0755 "$ROOT/build/$name" "$PKG/usr/bin/$name"
+  cp "$ROOT/toolchain/debian/control.tmpl" "$PKG/DEBIAN/control"
+  sed -i \
+    -e "s/__NAME__/$name/g" \
+    -e "s/__VERSION__/$VERSION/g" \
+    -e "s/__ARCH__/$ARCH/g" \
+    -e "s/__DESC__/${desc}/g" \
+    "$PKG/DEBIAN/control"
+
+  dpkg-deb --build --root-owner-group "$PKG" "$DEB_DIR/${name}_${VERSION}_${ARCH}.deb" >/dev/null
+  log "packaged: ${name}_${VERSION}_${ARCH}.deb"
+  built=$((built+1))
+done < "$TOOLS_LIST"
+
+rm -rf "$ROOT/build/pkg-"* "$ROOT/build/$name" 2>/dev/null || true
+
+log "toolchain complete: $built built, $skipped skipped"
+[[ $built -gt 0 ]] || warn "nothing was built — check repo access / ARCLINE_TOOLS_DIR"
diff --git a/toolchain/debian/control.tmpl b/toolchain/debian/control.tmpl
new file mode 100644
index 0000000..05271d9
--- /dev/null
+++ b/toolchain/debian/control.tmpl
@@ -0,0 +1,10 @@
+Package: __NAME__
+Version: __VERSION__
+Section: admin
+Priority: optional
+Architecture: __ARCH__
+Maintainer: Arcline IT LLC <os@arcline.it>
+Homepage: https://git.arcline.it
+Description: __DESC__
+ Built as part of the Arcline OS toolchain. See docs/toolchain.md for the
+ full list of tools and their responsibilities.
diff --git a/toolchain/tools.list b/toolchain/tools.list
new file mode 100644
index 0000000..1b28d11
--- /dev/null
+++ b/toolchain/tools.list
@@ -0,0 +1,15 @@
+# Arcline OS — toolchain manifest
+# Format: name|repo|short description
+# Source of truth for the 11 tools shipped with Arcline OS.
+
+arcline-uptime|https://git.arcline.it/arcline/arcline-uptime.git|HTTP/TCP/TLS/DNS monitoring with Prometheus metrics export
+arcline-check|https://git.arcline.it/arcline/arcline-check.git|CDN and transparency auditor - verifies sites are not leaking data
+arcline-audit|https://git.arcline.it/arcline/arcline-audit.git|Full site health scanner - SSL, headers, performance, accessibility
+arcline-dns|https://git.arcline.it/arcline/arcline-dns.git|DNS propagation checker across multiple resolvers
+arcline-vault|https://git.arcline.it/arcline/arcline-vault.git|Encrypted secrets store with REST API and CLI
+arcline-email|https://git.arcline.it/arcline/arcline-email.git|Self-hosted SMTP/IMAP stack - OpenSMTPD + Dovecot + Rspamd
+arcline-migrate|https://git.arcline.it/arcline/arcline-migrate.git|cPanel and Plesk to Arcline migration tool
+arcline-billing|https://git.arcline.it/arcline/arcline-billing.git|Stripe-powered subscription management
+arcline-portal|https://git.arcline.it/arcline/arcline-portal.git|Customer dashboard with SSL monitoring and ticketing
+arcline-website|https://git.arcline.it/arcline/arcline-website.git|Go HTTP server powering arcline.it
+arcline-status|https://git.arcline.it/arcline/arcline-status.git|Static status page generator