@ahmed-g-gad/apothem 0.1.1

package/src/apothem/harnesses/github_copilot/capabilities.yml

@@ -0,0 +1,42 @@
+# SPDX-License-Identifier: MIT
+
+# Per rules/agent-capability-discipline.md §1 / §3 / §7. GitHub Copilot
+# anchors project-scope .github/copilot-instructions.md; the vendor also
+# recognizes .github/instructions/*.instructions.md, AGENTS.md, and root
+# CLAUDE.md/GEMINI.md, but the adapter delivers only the repo-wide
+# instructions file. MCP is service/IDE state (~/.copilot/mcp-config.json),
+# not a repo-writable file, so mcp_servers stays []. No repo-config
+# sub-agent dispatch; no durable memory surface. Universal-deny floor binds.
+
+mcp_servers: []
+# Operator-owned MCP surface: the adapter recognizes it but authors no entries.
+mcp_servers_authored: false
+sub_agent_dispatch: false
+custom_command_support: "no"
+recommended_postfix_rendering: "plain-text"
+long_context_compaction: "profile-managed"
+context_ignore_surface: "not-documented-in-current-pin"
+layered_context_surface: "copilot-instructions.md plus instructions directory"
+lsp_symbol_navigation: "tracked-gap-no-adapter-owned-LSP-surface"
+hook_learning_capture: "artifact-evolution-cycle"
+standard_convention_pin: "STANDARD-CONVENTION-PIN.md"
+# web-fetch / browser-retrieval surface — the backing capability dimension for
+# rules/source-accessibility.md step 1 ("retrieve through the host's browser /
+# fetch capability"). Vendor-confirmed: GitHub Copilot CLI (the agent-invocable
+# surface, distinct from the IDE extension) ships a `web_fetch` tool that
+# retrieves URL content as markdown, gated by `--allow-url` / `--deny-url`
+# permissions. Evidence triple — vendor-doc-url:
+# https://docs.github.com/en/copilot/concepts/agents/copilot-cli/research
+# (+ .../how-tos/copilot-cli/set-up-copilot-cli/configure-copilot-cli); snapshot-id:
+# living docs; snapshot-date: 2026-06-21. Note: this row reflects the Copilot CLI
+# tool surface; the adapter itself materializes only .github/copilot-instructions.md
+# and authors no tool config. Canonical evidence home is STANDARD-CONVENTION-PIN.md
+# per rules/agent-capability-discipline-matrix.md §1A; pin refresh tracked as a
+# follow-up.
+web_fetch: "yes"
+tool_surface_restrictions:
+  - secrets-paths
+  - destructive-shell-ops
+  - network-write-unsigned
+system_prompt_template_path: "templates/copilot-instructions.md"
+agent_memory_surface: "n/a"

package/src/apothem/harnesses/github_copilot/install.py

@@ -0,0 +1,40 @@
+# SPDX-License-Identifier: MIT
+
+"""Install logic for the github-copilot harness adapter.
+
+Materializes the apothem GitHub Copilot instructions surface into the
+operator-supplied project root. The GA repo-wide instructions file is
+``<project>/.github/copilot-instructions.md`` per
+https://docs.github.com/en/copilot/customizing-copilot/adding-custom-instructions-for-github-copilot.
+User-scope is unavailable — Copilot's user-level settings live in IDE
+state (VS Code / JetBrains UI), not a file path the harness can write.
+
+The propagation contract is declared in the canonical manifest at
+``src/apothem/lib/propagation-manifest.yaml`` under the ``github_copilot``
+key (a single ``sentinel_merge`` operation targeting
+``${PROJECT_ROOT}/.github/copilot-instructions.md``) and applied by the
+shared driver at ``apothem.harnesses._shared.install_driver``. The
+``${PROJECT_ROOT}`` placeholder is substituted with the operator-supplied
+``--project <path>`` value the CLI threads through; absence of
+``--project`` is rejected upstream at ``apothem.cli._materialize`` via the
+``requires_project`` opt-in.
+"""
+
+from __future__ import annotations
+
+from apothem.harnesses._shared.wrapper_factories import (
+    make_project_scope_install,
+    make_project_scope_plan,
+)
+
+# Manifest harness key for this adapter.
+_HARNESS_NAME: str = "github_copilot"
+
+install = make_project_scope_install(
+    _HARNESS_NAME,
+    error_message=(
+        "github_copilot adapter requires --project <path>; CLI must thread it through"
+    ),
+)
+
+plan = make_project_scope_plan(_HARNESS_NAME)

package/src/apothem/harnesses/github_copilot/templates/copilot-instructions.md

@@ -0,0 +1,33 @@
+<!-- SPDX-License-Identifier: MIT -->
+
+# GitHub Copilot — Apothem Bootstrap
+
+This file is materialised by `apothem install --harness github-copilot --project <path>` and lands at `<project>/.github/copilot-instructions.md`, the GA repo-wide instructions surface per https://docs.github.com/en/copilot/customizing-copilot/adding-custom-instructions-for-github-copilot. The first 4,000 characters are parsed by Copilot's code-review agent; the remaining body is consumed by chat / completions in this project.
+
+## Project Context
+
+GitHub Copilot operates against the apothem governance and convention surface in this project. Apothem propagates a shared engineering discipline across every supported AI harness; inside Copilot, the surface manifests as this repo-wide instructions file.
+
+The full apothem rule / skill / command / agent cohort lives at the apothem source repository under `src/apothem/{rules,skills,commands,agents}/`. This file is the Copilot-facing anchor; consult the apothem rule tree for the per-rule body when generating non-trivial code or prose.
+
+## Engineering disciplines in force
+
+The apothem governance contract binds the following disciplines uniformly across every harness, including GitHub Copilot:
+
+- **Plans-Locality.** Plan-suite artefacts (PROGRESS.md, PLAN-NOTES.md, PHASE.md, REPORT.md) live under `<project>/.apothem/plans/{suite}/` — the sole canonical home; a legacy `<project>/.plans/` tree upgrades via `apothem migrate-workspace`. They never land in a global plans directory or any other global-ecosystem location.
+- **Authority hygiene.** Never fabricate identity, scope, security posture, or version-pin data. When generation requires data the operator has not supplied, surface the ambiguity through a question instead of inventing a plausible-looking value.
+- **Definitiveness.** Hedging vocabulary (`maybe`, `might`, `usually`, `generally`, `typically`, `probably`) is eliminated where binding prescription is possible. Pre / post / failure conditions are stated on every contract.
+- **Production-ready discipline.** Every change ships in production-ready form — tests, docs, CHANGELOG entry, conformant commit message, CI green — in the same change-set.
+- **Plain-language.** Codebase artefacts and user-facing prose read as natural domain language with zero trace of internal planning structure. Generated code uses domain-native names (`calculate_portfolio_risk`, not `process_data`).
+- **Human-only authorship.** Git commit messages, PR descriptions, branch names, and tag annotations carry human contributors only — never name the underlying language model, the runtime, the IDE extension, or any automated tool as a co-author.
+- **Lean-context delegation.** Where the host provides delegated-worker dispatch, broad reads and heavy workloads route to a spawned worker by default so the main working context stays lean. The heavy parallel apparatus stays opt-in; routing delegable work away from the main thread is the standing posture once dispatch is available.
+- **Observe-decide-act discipline.** Tool use runs as a loop — observe the current state, decide the next move from what was observed, then act — never an edit before a read or a result asserted before a check. Independent reads and searches run together in one pass, not one per turn; the loop closes on a verifiable condition (a gate green, a read confirmed), never a fixed number of tries. Advisory, never an auto-applied behavior.
+- **Source accessibility.** When the authoritative source for a claim, convention, or version pin is closed, paywalled, login-gated, or otherwise unreachable, ask the operator for it in full rather than substituting a lower-trust open page. Trust outranks reachability.
+
+## Modal hierarchy
+
+When the operator's request conflicts with an apothem rule, the rule wins; surface the conflict and propose the rule-conformant alternative. When two apothem surfaces conflict, the most specific path-filtered rule wins over the always-on rule. Always-on rules are listed at `<apothem-src>/src/apothem/rules/` with `alwaysApply: true` in their frontmatter.
+
+## Refreshing the file
+
+Re-run `apothem install --harness github-copilot --project <this-project-root>` to overwrite this file with the latest apothem template. The operation is idempotent — re-running cleanly replaces the prior content. The companion `apothem uninstall --harness github-copilot --project <this-project-root>` renames the file to a timestamped backup; `apothem verify --harness github-copilot --project <this-project-root>` checks the file is present and non-empty.

package/src/apothem/harnesses/github_copilot/uninstall.py

@@ -0,0 +1,25 @@
+# SPDX-License-Identifier: MIT
+
+"""Uninstall logic for the github-copilot harness adapter."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from apothem.harnesses._shared import install_driver
+
+_HARNESS_NAME: str = "github_copilot"
+
+
+def uninstall(output_path: Path, *, project: Path | None = None) -> None:
+    """Remove Apothem-managed GitHub Copilot targets surgically.
+
+    The copilot-instructions ``sentinel_merge`` anchor is cleaned by the shared
+    driver, which strips only Apothem's managed block (operator prose survives),
+    deletes an Apothem-only file, and backs the file up under the Apothem backup
+    root — no whole-file ``.bak`` sibling is left beside the operator's file.
+    """
+    install_driver.run_uninstall(
+        _HARNESS_NAME,
+        project_root=project or output_path.parents[1],
+    )

package/src/apothem/harnesses/github_copilot/update.py

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: MIT
+
+"""Update logic for the github-copilot harness adapter."""
+
+from __future__ import annotations
+
+from apothem.harnesses._shared.wrapper_factories import make_update_project
+from apothem.harnesses.github_copilot.install import install
+
+update = make_update_project(install)

package/src/apothem/harnesses/github_copilot/verify.py

@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: MIT
+
+"""Verify logic for the github_copilot harness adapter."""
+
+from __future__ import annotations
+
+from apothem.harnesses._shared.wrapper_factories import make_verify_project
+
+_HARNESS_NAME: str = "github_copilot"
+
+verify = make_verify_project(_HARNESS_NAME)

package/src/apothem/harnesses/glm/STANDARD-CONVENTION-PIN.md

@@ -0,0 +1,77 @@
+<!-- SPDX-License-Identifier: MIT -->
+
+# GLM (Z.ai) Standard Convention Pin
+
+## Snapshot
+
+- Snapshot date: 2026-06-25
+- Snapshot note: base URLs re-confirmed live against `docs.z.ai` — the Anthropic-compatible endpoint `https://api.z.ai/api/anthropic` (env `ANTHROPIC_BASE_URL` / `ANTHROPIC_AUTH_TOKEN` / `API_TIMEOUT_MS`) is an exact match to current docs; the no-pinned-model-id decision is vindicated (the catalog already advanced to GLM-5.2 / GLM-5-Turbo / GLM-4.7, which a hard-pinned id would have made stale). Previous 2026-06-24.
+- Adapter source: `src/apothem/harnesses/glm/`
+- Evidence level: adapter-local projection; no vendor-native coding-tool UI claim is made here. GLM is a model backend, not a coding-agent tool.
+
+## Official Surface Refresh
+
+- Refreshed live 2026-06-24 against the current Z.ai documentation
+  (`docs.z.ai`). No authority-host move; no immutable version pin is exposed
+  (mutable docs site), so every captured convention carries a
+  no-immutable-source exception.
+- GLM (Z.ai) is a **model backend**, not a first-party coding CLI. Z.ai ships
+  no native GLM coding-agent tool. An Anthropic-compatible or OpenAI-compatible
+  coding agent is pointed at GLM by setting backend environment variables.
+- Anthropic-compatible backend: base URL `https://api.z.ai/api/anthropic`. An
+  operator sets `ANTHROPIC_BASE_URL`, `ANTHROPIC_AUTH_TOKEN`, and
+  (optionally) `API_TIMEOUT_MS` to route an Anthropic-compatible agent to GLM.
+- OpenAI-compatible backend: base URL `https://api.z.ai/api/coding/paas/v4`.
+- Canonical filename: `.apothem/providers/glm.toml`. The adapter is
+  project-scope and writes only `<project>/.apothem/providers/glm.toml`, an
+  Apothem-owned TOML provider file recording both compatibility surfaces, an
+  auth-token placeholder (never a real secret), and operator-configurable
+  model-mapping placeholders. No GLM model id is pinned (model ids are
+  version-volatile); the operator selects one from the current Z.ai catalog.
+- The adapter authors no coding-agent cohort (rules, commands, skills, agents,
+  hooks): a model backend exposes none. Every capability is `unsupported`.
+
+## Recommended Postfix Rendering
+
+- Status: not applicable.
+- Mechanism: GLM is a model backend, not a coding-agent tool with an
+  option-rendering surface. Apothem renders no recommended-option label here.
+- Boundary: this pin claims no harness-native recommended-option widget; the
+  backend exposes no agent UI surface to render one.
+
+## Long Context and Compaction
+
+- Status: profile-managed.
+- Mechanism: long-context and compaction are properties of the coding agent
+  the operator points at GLM, not of the backend. Apothem's context-management
+  discipline lives in the agent harness, not in this backend provider file.
+- Boundary: this pin claims no vendor-native autocompaction or long-context
+  size for the backend itself.
+
+## Large-Codebase Practice Projection
+
+- Layered context: not applicable — GLM is a backend endpoint, not an agent
+  with a context hierarchy. The provider config file carries backend wiring
+  only.
+- LSP symbol navigation: not applicable — provided by the agent runtime the
+  operator points at GLM, never by the backend.
+- Hook learning capture: routed through the `persistent-conventions-vigilance`
+  artifact-evolution cycle; the backend exposes no hook surface.
+
+## Plugin-alone Persistence
+
+GLM (Z.ai) exposes **no vendor plugin or extension install surface** that
+Apothem ships. The adapter is project-scope and writes a single Apothem-owned
+provider config file at `<project>/.apothem/providers/glm.toml`. There is no
+standalone-installable bundle; the file is written only by the
+`apothem install --harness glm --project <path>` engine run.
+
+| Artifact class | Persists standalone? | Mechanism / limit |
+|---|---|---|
+| Provider config | No — requires `apothem install` | The `glm.toml` backend-provider file is written only by the engine into `<project>/.apothem/providers/`. Nothing persists before that run. |
+| Commands / Skills / Agents / Rules / Hooks | No — platform limit | GLM is a model backend; it exposes no coding-agent primitive Apothem targets, so these cohorts are not materialized for this harness. |
+| Auth / model mapping | Operator-owned | The auth token and model ids are operator placeholders; Apothem never writes a real secret or pins a version-volatile model id. |
+
+Platform limit: GLM ships no marketplace/extension channel, so a plugin-alone
+story does not exist for this harness — the backend-provider file via
+`apothem install` is the sole persistence surface.

package/src/apothem/harnesses/glm/__init__.py

@@ -0,0 +1,56 @@
+# SPDX-License-Identifier: MIT
+
+"""Apothem harness adapter for glm — project-scope backend-provider config.
+
+GLM (Z.ai) is a **model backend**, not a first-party coding-agent tool: Z.ai
+ships no native GLM coding CLI. GLM is the model an Anthropic-compatible or
+OpenAI-compatible coding agent points at by setting backend environment
+variables. The adapter therefore writes a provider configuration file —
+``<project>/.apothem/providers/glm.toml`` — that records the Anthropic-compatible
+and OpenAI-compatible base URLs, an auth-token placeholder, and
+operator-configurable model-mapping placeholders so an operator can wire any
+compatible agent to GLM. The file is materialized via ``write_text`` as an
+operator-owned valid-TOML config: Apothem writes the clean template, and the
+operator owns the file thereafter — their own backend secrets and edits route
+through the per-file destructive-op authorization gate on every subsequent
+``update`` rather than being silently overwritten. It carries **no** projected
+shared-profile content and **no** coding-agent cohort (rules, commands, skills,
+agents, hooks): a model backend is not rule-bearing and exposes none. The
+managed-block sentinel machinery is markdown-only (HTML-comment delimiters, a
+frozen contract), so it is deliberately not used here — folding sentinels into
+a ``.toml`` surface would produce invalid TOML.
+
+The adapter opts into the project-scope contract via ``requires_project = True``;
+the CLI rejects an install / update / uninstall / verify invocation that omits
+``--project <path>``. Delegates install logic to
+:mod:`apothem.harnesses.glm.install`, which consumes the canonical propagation
+manifest at ``src/apothem/lib/propagation-manifest.yaml`` under the ``glm`` key.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from apothem.harnesses._shared.wrapper_factories import make_project_scope_adapter
+from apothem.harnesses.glm.install import install as _install
+from apothem.harnesses.glm.install import plan as _plan
+from apothem.harnesses.glm.uninstall import uninstall as _uninstall
+from apothem.harnesses.glm.update import update as _update
+from apothem.harnesses.glm.verify import verify as _verify
+
+# Sentinel relative path used by ``output_path`` for display purposes only.
+# The real target is resolved per-install via ``resolve_output_path(project)``
+# once the operator supplies ``--project <path>``.
+_SENTINEL_RELATIVE: Path = Path(".apothem") / "providers" / "glm.toml"
+
+GlmAdapter = make_project_scope_adapter(
+    "glm",
+    error_label="glm",
+    relative_target=_SENTINEL_RELATIVE,
+    install_fn=_install,
+    plan_fn=_plan,
+    uninstall_fn=_uninstall,
+    update_fn=_update,
+    verify_fn=_verify,
+    class_name="GlmAdapter",
+)

package/src/apothem/harnesses/glm/capabilities.yml

@@ -0,0 +1,33 @@
+# SPDX-License-Identifier: MIT
+
+# Per rules/agent-capability-discipline.md §1 / §3 / §7. GLM (Z.ai) is a
+# model backend, not a coding-agent tool: Z.ai ships no native GLM coding CLI.
+# An Anthropic-compatible or OpenAI-compatible agent points at GLM by setting
+# backend environment variables. The adapter writes a single Apothem-owned
+# provider config file under .apothem/providers/ and authors no coding-agent
+# cohort (rules, commands, skills, agents, hooks), because a model backend
+# exposes none. Every capability is therefore unsupported.
+
+# No MCP file surface exists: GLM is a backend endpoint, not an agent that
+# hosts MCP servers. Empty list per the registry's unsupported mcp_servers cell.
+mcp_servers: []
+mcp_servers_authored: false
+sub_agent_dispatch: false
+custom_command_support: "no"
+recommended_postfix_rendering: "not-applicable-model-backend"
+long_context_compaction: "profile-managed"
+context_ignore_surface: "not-applicable-model-backend"
+layered_context_surface: ".apothem/providers/glm.toml backend config (no agent context surface)"
+lsp_symbol_navigation: "not-applicable-model-backend"
+hook_learning_capture: "artifact-evolution-cycle"
+standard_convention_pin: "STANDARD-CONVENTION-PIN.md"
+# web-fetch / browser-retrieval surface — the backing capability dimension for
+# rules/source-accessibility.md step 1. GLM is a model backend with no agent
+# tool surface to discover against the pin.
+web_fetch: "not-applicable-model-backend"
+tool_surface_restrictions:
+  - secrets-paths
+  - destructive-shell-ops
+  - network-write-unsigned
+system_prompt_template_path: "templates/glm.toml"
+agent_memory_surface: "not-applicable-model-backend (no agent runtime owned by the backend)"

package/src/apothem/harnesses/glm/install.py

@@ -0,0 +1,45 @@
+# SPDX-License-Identifier: MIT
+
+"""Install logic for the glm harness adapter.
+
+Materializes the GLM backend-provider configuration into the operator-supplied
+project root. GLM (Z.ai) is a model backend an Anthropic-compatible or
+OpenAI-compatible coding agent points at; it exposes no native coding-agent
+config surface, so the adapter writes a single provider file at
+``<project>/.apothem/providers/glm.toml`` recording the backend base URLs, an
+auth-token placeholder, and operator-configurable model-mapping placeholders.
+
+The propagation contract is declared in the canonical manifest at
+``src/apothem/lib/propagation-manifest.yaml`` under the ``glm`` key (a single
+operator-owned ``write_text`` operation targeting
+``${PROJECT_ROOT}/.apothem/providers/glm.toml``) and applied by the shared
+driver at ``apothem.harnesses._shared.install_driver``. ``write_text`` writes
+the clean valid-TOML template; the operator owns the file thereafter, so a
+subsequent ``update`` that would overwrite differing operator content routes
+through the per-file destructive-op authorization gate rather than clobbering
+silently. The file carries **no** projected shared-profile content — GLM is a
+model backend, not a rule-bearing coding agent, so there is no instruction
+cohort to fold in, and the markdown-only sentinel-merge machinery (HTML-comment
+delimiters) would corrupt a ``.toml`` surface and is deliberately not used. The
+``${PROJECT_ROOT}`` placeholder is substituted with the operator-supplied
+``--project <path>`` value the CLI threads through; absence of ``--project`` is
+rejected upstream at ``apothem.cli._materialize`` via the ``requires_project``
+opt-in.
+"""
+
+from __future__ import annotations
+
+from apothem.harnesses._shared.wrapper_factories import (
+    make_project_scope_install,
+    make_project_scope_plan,
+)
+
+# Manifest harness key for this adapter.
+_HARNESS_NAME: str = "glm"
+
+install = make_project_scope_install(
+    _HARNESS_NAME,
+    error_message="glm adapter requires --project <path>; CLI must thread it through",
+)
+
+plan = make_project_scope_plan(_HARNESS_NAME)

package/src/apothem/harnesses/glm/templates/glm.toml

@@ -0,0 +1,58 @@
+# SPDX-License-Identifier: MIT
+
+# GLM (Z.ai) backend-provider configuration — operator-owned.
+#
+# GLM is a MODEL BACKEND, not a coding-agent tool. Z.ai ships no first-party
+# GLM coding CLI; instead, an Anthropic-compatible or OpenAI-compatible coding
+# agent is pointed at GLM by setting the backend base URL and an auth token.
+# This file records both compatibility surfaces plus operator-configurable
+# model-mapping placeholders so any compatible agent can be wired to the GLM
+# model family. Replace every <...> placeholder; the auth token is a
+# placeholder, never a committed secret.
+#
+# This file is operator-owned. GLM is a model backend, not a rule-bearing
+# coding agent, so Apothem projects NO shared-profile instruction content here
+# (no rules, no opted-in behaviors — a backend exposes none): the file carries
+# only the backend wiring below. Apothem writes this clean template on install;
+# thereafter the file is yours. Your own backend keys and edits route through
+# the per-file confirmation gate on every subsequent `apothem install` /
+# `apothem update` rather than being silently overwritten.
+#
+# Vendor surface conventions are pinned at
+# src/apothem/harnesses/glm/STANDARD-CONVENTION-PIN.md (snapshotted against the
+# live Z.ai documentation).
+
+[provider]
+# Display label for the GLM model family. No specific model id is pinned here:
+# model ids are version-volatile, so the operator selects one from the current
+# Z.ai catalog at install time (see the [models] table below).
+name = "GLM (Z.ai)"
+family = "glm"
+docs = "https://docs.z.ai/"
+
+# Anthropic-compatible backend. Point an Anthropic-compatible coding agent at
+# GLM by exporting these environment variables before launching the agent.
+[backends.anthropic_compatible]
+base_url = "https://api.z.ai/api/anthropic"
+# Environment variables an operator sets so an Anthropic-compatible agent
+# routes to GLM instead of the default Anthropic endpoint.
+[backends.anthropic_compatible.env]
+ANTHROPIC_BASE_URL = "https://api.z.ai/api/anthropic"
+ANTHROPIC_AUTH_TOKEN = "<YOUR_ZAI_API_KEY>"
+API_TIMEOUT_MS = "<TIMEOUT_MS>"
+
+# OpenAI-compatible backend. Point an OpenAI-compatible coding agent at GLM by
+# setting its base URL to this endpoint and supplying the API key.
+[backends.openai_compatible]
+base_url = "https://api.z.ai/api/coding/paas/v4"
+[backends.openai_compatible.env]
+OPENAI_BASE_URL = "https://api.z.ai/api/coding/paas/v4"
+OPENAI_API_KEY = "<YOUR_ZAI_API_KEY>"
+
+# Operator-configurable model-mapping placeholders. Apothem pins no model id
+# (version-volatile); the operator fills these from the current GLM catalog at
+# https://docs.z.ai/ so the chosen agent's logical roles map to GLM models.
+[models]
+default = "<GLM_MODEL_ID>"
+fast = "<GLM_FAST_MODEL_ID>"
+reasoning = "<GLM_REASONING_MODEL_ID>"

package/src/apothem/harnesses/glm/uninstall.py

@@ -0,0 +1,25 @@
+# SPDX-License-Identifier: MIT
+
+"""Uninstall logic for the glm harness adapter."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from apothem.harnesses._shared import install_driver
+
+_HARNESS_NAME: str = "glm"
+
+
+def uninstall(output_path: Path, *, project: Path | None = None) -> None:
+    """Remove Apothem-managed GLM provider targets surgically.
+
+    The Apothem-owned ``glm.toml`` provider file is removed by the shared
+    driver, which backs the file up under the Apothem backup root before
+    deletion — no whole-file ``.bak`` sibling is left beside the operator's
+    project files.
+    """
+    install_driver.run_uninstall(
+        _HARNESS_NAME,
+        project_root=project or output_path.parents[2],
+    )

package/src/apothem/harnesses/glm/update.py

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: MIT
+
+"""Update logic for the glm harness adapter."""
+
+from __future__ import annotations
+
+from apothem.harnesses._shared.wrapper_factories import make_update_project
+from apothem.harnesses.glm.install import install
+
+update = make_update_project(install)

package/src/apothem/harnesses/glm/verify.py

@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: MIT
+
+"""Verify logic for the glm harness adapter."""
+
+from __future__ import annotations
+
+from apothem.harnesses._shared.wrapper_factories import make_verify_project
+
+_HARNESS_NAME: str = "glm"
+
+verify = make_verify_project(_HARNESS_NAME)

package/src/apothem/harnesses/hermes/STANDARD-CONVENTION-PIN.md

@@ -0,0 +1,57 @@
+<!-- SPDX-License-Identifier: MIT -->
+
+# Hermes Standard Convention Pin
+
+## Snapshot
+
+- Snapshot date: 2026-06-25
+- Snapshot note: live re-verification — Hermes docs are now also published at `hermes-agent.nousresearch.com/docs`; the `~/.hermes/config.yaml` `delegation` block (subagent model/provider override, bounded), the `skills.config` namespace (skills auto-exposed as commands; `hermes config migrate` / `show`), and `quick_commands` all confirmed current; the commit anchor `355af2c…` is retained as the immutable evidence pin. Previous 2026-05-31.
+- Adapter source: `src/apothem/harnesses/hermes/`
+- Evidence level: vendor-repo pinned (live re-fetch 2026-05-31) at commit
+  `355af2c20f495b97c22c9aeb4c227fb0ca010da7` for `~/.hermes/config.yaml`.
+  Skills are installable registry packages under `skills.config` (auto-exposed
+  as commands) — NOT `skills.external_dirs` (that earlier claim is refuted). MCP
+  is the `auxiliary.mcp` config block; sub-agent dispatch is the `delegation`
+  block (`delegate_task`, bounded by `max_concurrent_children` /
+  `max_spawn_depth`); user commands are `quick_commands` plus skill-exposed
+  commands; durable memory lives at `~/.hermes/memories/`. Hermes is a
+  multi-platform messaging gateway. No vendor-native UI claim is made here.
+- Official references (commit-permalinked to the pinned SHA):
+  - <https://github.com/NousResearch/hermes-agent/blob/355af2c20f495b97c22c9aeb4c227fb0ca010da7/website/docs/user-guide/configuration.md>
+  - <https://github.com/NousResearch/hermes-agent/blob/355af2c20f495b97c22c9aeb4c227fb0ca010da7/website/docs/reference/slash-commands.md>
+
+## Recommended Postfix Rendering
+
+- Status: supported as plain text.
+- Mechanism: Apothem emits the literal ` (Recommended)` suffix in the option label. Hermes adapter output preserves that suffix when prompt text is materialized.
+- Boundary: this pin does not claim a harness-native recommended-option widget. It only pins the text-rendered convention used by `rules/interactive-questions.md`.
+
+## Long Context and Compaction
+
+- Status: profile-managed.
+- Mechanism: Apothem keeps full-suite `/plan-execute` runs continuous by externalizing state to `.apothem/plans/`, compacting or restarting the harness session at phase boundaries as needed, and restoring via the Blind Bootstrap sequence.
+- Boundary: this pin does not claim vendor-native autocompaction or a long-context size. It pins the adapter-local state handoff and compaction-restoration convention used by `rules/context-management.md`.
+
+## Large-Codebase Practice Projection
+
+- Layered context: declared in `capabilities.yml` under `layered_context_surface`; no vendor-native hierarchy is claimed beyond the adapter's documented file/template surface.
+- LSP symbol navigation: `tracked-gap` until a vendor-ratified plugin or tool surface is pinned.
+- Hook learning capture: routed through the `persistent-conventions-vigilance` artifact-evolution cycle; pass-class hooks stay silent and recurring findings become rule, skill, hook, or documentation updates.
+
+## Plugin-alone Persistence
+
+Hermes is a multi-platform messaging gateway with **no vendor plugin or
+extension install surface** that Apothem ships. The adapter materializes
+`~/.hermes/config.yaml` (native MCP under `auxiliary.mcp`) via its materializer
+and keeps non-native cohorts under the Apothem support subtree
+(`~/.hermes/apothem/`). There is no standalone-installable bundle; every artifact
+requires the full `apothem install --harness hermes` engine run.
+
+| Artifact class | Persists standalone? | Mechanism / limit |
+|---|---|---|
+| Config / MCP | No — requires `apothem install` | `~/.hermes/config.yaml` is materializer-rendered by the engine; nothing persists before that run. |
+| Commands / Skills / Agents / Rules | No — requires `apothem install` | These land under `~/.hermes/apothem/` (support subtree) via the engine; Hermes `skills.config` registry packages are a vendor list the adapter does not author. |
+| Hooks / Settings | No — platform limit | No Apothem-authored hook or settings surface beyond the config materializer. |
+
+Platform limit: Hermes ships no marketplace/extension channel, so a plugin-alone
+story does not exist — the engine install is the sole persistence path.

package/src/apothem/harnesses/hermes/__init__.py

@@ -0,0 +1,33 @@
+# SPDX-License-Identifier: MIT
+
+"""Apothem harness adapter for hermes.
+
+Materializes ``~/.hermes/config.yaml`` from the shared profile: the Hermes
+Agent user-global configuration file per the vendor canonical schema at
+https://hermes-agent.nousresearch.com/docs/. The adapter-local
+``STANDARD-CONVENTION-PIN.md`` records the current convention snapshot.
+Delegates installation to :mod:`apothem.harnesses.hermes.materializer`.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from apothem.harnesses._shared.wrapper_factories import make_native_config_adapter
+from apothem.harnesses.hermes.install import install as _install
+from apothem.harnesses.hermes.materializer import (
+    materialize_native_config as materialize_native_config,
+)
+from apothem.harnesses.hermes.uninstall import uninstall as _uninstall
+from apothem.harnesses.hermes.update import update as _update
+from apothem.harnesses.hermes.verify import verify as _verify
+
+HermesAdapter = make_native_config_adapter(
+    "hermes",
+    target_factory=lambda: Path.home() / ".hermes/config.yaml",
+    install_fn=_install,
+    uninstall_fn=_uninstall,
+    update_fn=_update,
+    verify_fn=_verify,
+    class_name="HermesAdapter",
+)

package/src/apothem/harnesses/hermes/capabilities.yml

@@ -0,0 +1,36 @@
+# SPDX-License-Identifier: MIT
+
+# Per rules/agent-capability-discipline.md §1 / §3 / §7. Hermes (a multi-platform
+# messaging gateway) ratifies ~/.hermes/config.yaml as the canonical surface.
+# Skills are installable registry packages under skills.config (auto-exposed as
+# commands); MCP is the auxiliary.mcp config block; sub-agent dispatch is the
+# delegation block (delegate_task, bounded by max_concurrent_children /
+# max_spawn_depth); user commands are quick_commands plus skill-exposed commands;
+# durable memory lives at ~/.hermes/memories/ (MEMORY.md + USER.md).
+
+mcp_servers:
+  - config.yaml-auxiliary-mcp-block
+# The adapter's materializer.py authors this MCP block from the shared profile.
+mcp_servers_authored: true
+sub_agent_dispatch: true
+custom_command_support: "quick-commands-and-skill-commands"
+recommended_postfix_rendering: "plain-text"
+long_context_compaction: "profile-managed"
+context_ignore_surface: "not-documented-in-current-pin"
+layered_context_surface: "config.yaml (SOUL.md voice anchor) plus skills.config registry skills"
+lsp_symbol_navigation: "tracked-gap-no-adapter-owned-LSP-surface"
+hook_learning_capture: "artifact-evolution-cycle"
+standard_convention_pin: "STANDARD-CONVENTION-PIN.md"
+# web-fetch / browser-retrieval surface — the backing capability dimension for
+# rules/source-accessibility.md step 1 ("retrieve through the host's browser /
+# fetch capability"). The pinned snapshot catalogs config-materialization
+# surfaces, not the vendor tool surface, so the web-fetch tool is not yet
+# discovered against the pin — discovery-pending per
+# rules/agent-capability-discipline-matrix.md §1.
+web_fetch: "discovery-pending"
+tool_surface_restrictions:
+  - secrets-paths
+  - destructive-shell-ops
+  - network-write-unsigned
+system_prompt_template_path: "n/a"
+agent_memory_surface: "~/.hermes/memories/ (MEMORY.md + USER.md, vendor-managed)"

package/src/apothem/harnesses/hermes/install.py

@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: MIT
+
+"""Install logic for the hermes harness adapter."""
+
+from __future__ import annotations
+
+from apothem.harnesses._shared.wrapper_factories import make_native_config_install
+from apothem.harnesses.hermes.materializer import materialize_native_config
+
+_HARNESS_NAME: str = "hermes"
+_HARNESS_ID: str = "hermes"
+
+install = make_native_config_install(
+    _HARNESS_NAME,
+    materialize_native_config,
+    harness_id=_HARNESS_ID,
+)