@akagilnc/pi-workflow-roles 0.1.3722 → 0.1.3737

package/dist/acp-host/description.js

@@ -1,21 +1,35 @@
 /**
  * One ACP host description. Every host-specific value the generic ACP adapter
- * needs — binary location, argv shape, resume verb, binding filename, child env
- * — is data here; the lifecycle in role-turn-host.ts stays one copy (#732).
+ * needs — binary location, argv shape, resume verb, binding filename, child env,
+ * optional seat-profile soul — is data here; the lifecycle in role-turn-host.ts
+ * stays one copy (#732).
  */
 import { join } from "node:path";
 /** Absolute agent binary for one operator home. */
 export function resolveAcpBinary(description, operatorHome) {
     return join(operatorHome, ...description.binaryFromHome);
 }
-/** Stdio argv: prefix, optional model/thinking flag pairs, suffix. */
-export function acpStdioArgs(description, model) {
+/** Stdio argv: optional profile flag, thinking flag (before the subcommand),
+ * prefix, optional model flag pair, suffix. */
+export function acpStdioArgs(description, model, seat) {
     const { prefix, suffix, modelFlag, thinkingFlag } = description.argv;
     const pair = (flag, value) => flag === undefined || value === undefined ? [] : [flag, value];
     return [
+        ...pair(description.seatProfileSoul?.flag, seat?.profileName),
+        ...pair(thinkingFlag, model?.thinking),
         ...prefix,
         ...pair(modelFlag, model?.model),
-        ...pair(thinkingFlag, model?.thinking),
         ...suffix,
     ];
 }
+/**
+ * The modelId the host addresses the seat model by.
+ * "argv" hosts address by bare model name; "set_model" hosts address by the
+ * `provider:model` modelId the ACP catalog exposes (seat provider after host
+ * alias projection, concatenated — never a package provider map).
+ */
+export function acpModelId(modelPassing, model) {
+    if (model?.model === undefined)
+        return undefined;
+    return modelPassing === "set_model" ? `${model.provider}:${model.model}` : model.model;
+}

package/dist/acp-host/production-host.js

@@ -164,7 +164,7 @@ function normalizeReviewComment(raw) {
 function createGhApiRunner(options = {}) {
   const spawnImpl = options.spawnImpl ?? spawn;
   return async (args, runOptions = {}) => {
-    return await new Promise((resolve19, reject) => {
+    return await new Promise((resolve20, reject) => {
       const signal = runOptions.signal;
       if (signal?.aborted) {
         reject(signal.reason ?? new Error("aborted"));
@@ -237,11 +237,11 @@ function createGhApiRunner(options = {}) {
               const value = line2.slice(idx + 1).trim();
               headers[name] = value;
             }
-            resolve19({ status, headers, bodyText });
+            resolve20({ status, headers, bodyText });
             return;
           }
           if (code === 0) {
-            resolve19({ status: 200, headers: {}, bodyText: stdout });
+            resolve20({ status: 200, headers: {}, bodyText: stdout });
             return;
           }
           const failure2 = new Error(
@@ -1227,7 +1227,7 @@ async function spawnEngineDetourOnce(input) {
   }
   const command = input.argv[0];
   const args = input.argv.slice(1);
-  return await new Promise((resolve19, reject) => {
+  return await new Promise((resolve20, reject) => {
     let settled = false;
     const signal = input.signal;
     const child = spawn2(command, args, {
@@ -1257,7 +1257,7 @@ async function spawnEngineDetourOnce(input) {
       if (signal !== void 0) {
         signal.removeEventListener("abort", onAbort);
       }
-      resolve19(result);
+      resolve20(result);
     };
     const onAbort = () => {
       fail5(signal !== void 0 ? abortReasonError(signal) : new Error("aborted"));
@@ -8398,6 +8398,7 @@ var init_host_descriptions = __esm({
           suffix: Object.freeze(["stdio"]),
           modelFlag: "--model"
         }),
+        modelPassing: "argv",
         boundResume: "session/load",
         sessionBindingFile: "grok-acp-session.json",
         childEnv: Object.freeze({
@@ -8405,6 +8406,31 @@ var init_host_descriptions = __esm({
           GROK_MEMORY: "0",
           GROK_SUBAGENTS: "0"
         })
+      }),
+      /**
+       * Operator home `~/.hermes`, native session/load resume, `acp` subcommand.
+       * Model arrives as an ACP `session/set_model` RPC with modelId `provider:model`
+       * (seat table provider + model concatenated). Reasoning is the global
+       * `--reasoning` flag before `acp`. Soul is the seat profile SOUL.md symlink
+       * (`hermes -p ak-<role> …`); package `souls/<role>.md` is the sole source.
+       */
+      "hermes": Object.freeze({
+        binaryFromHome: Object.freeze([".local", "bin", "hermes"]),
+        argv: Object.freeze({
+          prefix: Object.freeze(["acp"]),
+          suffix: Object.freeze([]),
+          thinkingFlag: "--reasoning"
+        }),
+        modelPassing: "set_model",
+        boundResume: "session/load",
+        sessionBindingFile: "hermes-acp-session.json",
+        childEnv: Object.freeze({}),
+        seatProfileSoul: Object.freeze({
+          flag: "-p",
+          namePrefix: "ak-",
+          profilesRootFromHome: Object.freeze([".hermes", "profiles"]),
+          soulFileName: "SOUL.md"
+        })
       })
     });
   }
@@ -11451,12 +11477,12 @@ function createSystemCollectorClock() {
   return {
     wallNow: () => /* @__PURE__ */ new Date(),
     monoNow: () => Number(process.hrtime.bigint() - start) / 1e6,
-    sleep: (ms, signal) => new Promise((resolve19, reject) => {
+    sleep: (ms, signal) => new Promise((resolve20, reject) => {
       if (signal?.aborted) {
         reject(signal.reason ?? new Error("aborted"));
         return;
       }
-      const timer = setTimeout(resolve19, ms);
+      const timer = setTimeout(resolve20, ms);
       const onAbort = () => {
         clearTimeout(timer);
         reject(signal?.reason ?? new Error("aborted"));
@@ -14877,10 +14903,10 @@ function presentFailureTerminal(terminal, io) {
 }
 function defaultNavigatorGraceSleep() {
   let timer;
-  const sleep = ((ms) => new Promise((resolve19) => {
+  const sleep = ((ms) => new Promise((resolve20) => {
     timer = setTimeout(() => {
       timer = void 0;
-      resolve19();
+      resolve20();
     }, ms);
   }));
   sleep.cancel = () => {
@@ -14892,7 +14918,7 @@ function defaultNavigatorGraceSleep() {
   return sleep;
 }
 function raceNavigatorGrace(work, graceMs = NAVIGATOR_POST_ROLE_GRACE_MS, sleep = defaultNavigatorGraceSleep()) {
-  return new Promise((resolve19, reject) => {
+  return new Promise((resolve20, reject) => {
     let settled = false;
     const finish = (action) => {
       if (settled) return;
@@ -14901,11 +14927,11 @@ function raceNavigatorGrace(work, graceMs = NAVIGATOR_POST_ROLE_GRACE_MS, sleep
       action();
     };
     void work.then(
-      (value) => finish(() => resolve19({ status: "done", value })),
+      (value) => finish(() => resolve20({ status: "done", value })),
       (error) => finish(() => reject(error))
     );
     void sleep(graceMs).then(() => {
-      finish(() => resolve19({ status: "timeout" }));
+      finish(() => resolve20({ status: "timeout" }));
     });
   });
 }
@@ -24155,7 +24181,7 @@ import { mkdtemp as mkdtemp3, rm as rm3 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join32 } from "node:path";
 async function runCommand(command, args, options = {}) {
-  return await new Promise((resolve19, reject) => {
+  return await new Promise((resolve20, reject) => {
     const child = spawn4(command, args, { ...options.cwd === void 0 ? {} : { cwd: options.cwd }, stdio: ["ignore", "pipe", "pipe"], signal: options.signal });
     let stdout = "", stderr = "";
     child.stdout.setEncoding("utf8").on("data", (chunk) => {
@@ -24175,7 +24201,7 @@ async function runCommand(command, args, options = {}) {
       const actual = code ?? 1;
       if ((options.allowedCodes ?? [0]).includes(actual)) {
         settled = true;
-        resolve19({ stdout, stderr, code: actual });
+        resolve20({ stdout, stderr, code: actual });
       } else fail5(void 0, code, signal);
     });
   });
@@ -24639,16 +24665,21 @@ import { join as join33 } from "node:path";
 function resolveAcpBinary(description, operatorHome) {
   return join33(operatorHome, ...description.binaryFromHome);
 }
-function acpStdioArgs(description, model) {
+function acpStdioArgs(description, model, seat) {
   const { prefix, suffix, modelFlag, thinkingFlag } = description.argv;
   const pair = (flag, value) => flag === void 0 || value === void 0 ? [] : [flag, value];
   return [
+    ...pair(description.seatProfileSoul?.flag, seat?.profileName),
+    ...pair(thinkingFlag, model?.thinking),
     ...prefix,
     ...pair(modelFlag, model?.model),
-    ...pair(thinkingFlag, model?.thinking),
     ...suffix
   ];
 }
+function acpModelId(modelPassing, model) {
+  if (model?.model === void 0) return void 0;
+  return modelPassing === "set_model" ? `${model.provider}:${model.model}` : model.model;
+}
 
 // src/acp-host/role-envelope.ts
 init_gatekeeper_pass_envelope();
@@ -24750,8 +24781,8 @@ function connectAcpStdio(options) {
     request(method, params) {
       if (closed) return Promise.reject(terminalError ?? acpError("acp-connection-closed", "ACP connection is closed"));
       const id = ++nextId;
-      return new Promise((resolve19, reject) => {
-        pending.set(id, { resolve: resolve19, reject });
+      return new Promise((resolve20, reject) => {
+        pending.set(id, { resolve: resolve20, reject });
         child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, method, params })}
 `, (error) => {
           if (error === null || error === void 0) return;
@@ -24775,7 +24806,7 @@ function connectAcpStdio(options) {
       settleClosed(acpError("acp-connection-closed", "ACP connection is closed"));
       child.stdin.end();
       child.kill("SIGTERM");
-      await new Promise((resolve19) => child.once("close", () => resolve19()));
+      await new Promise((resolve20) => child.once("close", () => resolve20()));
     }
   });
 }
@@ -24786,6 +24817,7 @@ function createAcpRoleTurnHost(config) {
       const execution = serial.then(async () => {
         const continuation = request.continuation;
         const prepared = await config.prepare(request);
+        const systemPromptOverride = renderAcpSystemPromptOverride(prepared.systemPrompt);
         let connection;
         let sessionId;
         let accepted = false;
@@ -24801,40 +24833,47 @@ function createAcpRoleTurnHost(config) {
           const initializeMeta = initialized._meta;
           const modelState = initializeMeta?.modelState;
           const availableModels = Array.isArray(modelState?.availableModels) ? modelState.availableModels : void 0;
-          if (request.model !== void 0 && availableModels !== void 0 && !availableModels.some((entry) => typeof entry === "object" && entry !== null && entry.modelId === request.model?.model)) {
+          if (request.model !== void 0 && availableModels !== void 0 && !availableModels.some((entry) => typeof entry === "object" && entry !== null && entry.modelId === acpModelId(config.modelPassing, request.model))) {
             return failure("activation", "AcpHostModelMismatch", "host-model-mismatch", {
               provider: request.model.provider,
               model: request.model.model
             });
           }
           const priorNativePaths = continuation.kind === "resume" ? request.hostTransition?.priorNativePaths : void 0;
+          const loadConnection = connection;
+          const sessionBindParams = {
+            cwd: request.cwd,
+            mcpServers: prepared.mcpServers,
+            _meta: { systemPromptOverride, yoloMode: false }
+          };
+          const loadSession = async (bindSessionId) => {
+            const loaded = await loadConnection.request("session/load", {
+              sessionId: bindSessionId,
+              ...sessionBindParams
+            });
+            return typeof loaded.sessionId === "string" && loaded.sessionId !== "" ? loaded.sessionId : bindSessionId;
+          };
           if (continuation.kind === "resume" && config.boundResume === "session/load") {
             const boundSessionId = await config.sessionIdentity.load(request.principal);
             if (boundSessionId !== void 0 && boundSessionId !== "") {
-              const loaded = await connection.request("session/load", {
-                sessionId: boundSessionId,
-                cwd: request.cwd,
-                mcpServers: prepared.mcpServers,
-                _meta: { systemPromptOverride: renderAcpSystemPromptOverride(prepared.systemPrompt), yoloMode: false }
-              });
-              sessionId = typeof loaded.sessionId === "string" && loaded.sessionId !== "" ? loaded.sessionId : boundSessionId;
+              sessionId = await loadSession(boundSessionId);
             }
           }
           if (sessionId === void 0) {
-            const session = await connection.request(
-              "session/new",
-              {
-                cwd: request.cwd,
-                mcpServers: prepared.mcpServers,
-                _meta: { systemPromptOverride: renderAcpSystemPromptOverride(prepared.systemPrompt), yoloMode: false }
-              }
-            );
+            const session = await connection.request("session/new", sessionBindParams);
             sessionId = typeof session.sessionId === "string" ? session.sessionId : void 0;
             if (sessionId === void 0 || sessionId === "") {
               return failure("session", "AcpSessionFailure", "session-id-missing");
             }
             await config.sessionIdentity.bind(request.principal, sessionId);
           }
+          if (config.modelPassing === "set_model" && request.model !== void 0 && sessionId !== void 0) {
+            await connection.request("session/set_model", {
+              sessionId,
+              modelId: acpModelId(config.modelPassing, request.model)
+            });
+            sessionId = await loadSession(sessionId);
+          }
           let prompt = priorNativePaths !== void 0 && priorNativePaths.length > 0 ? `${prepared.prompt}
 ${priorNativePaths.join("\n")}` : prepared.prompt;
           const abortSignal = request.signal === void 0 ? prepared.abortSignal : prepared.abortSignal === void 0 ? request.signal : AbortSignal.any([prepared.abortSignal, request.signal]);
@@ -24845,7 +24884,7 @@ ${priorNativePaths.join("\n")}` : prepared.prompt;
             }
             const promptRequest = activeConnection.request("session/prompt", params);
             if (abortSignal === void 0) return promptRequest;
-            return new Promise((resolve19, reject) => {
+            return new Promise((resolve20, reject) => {
               let settled = false;
               const onAbort = () => {
                 if (settled) return;
@@ -24860,7 +24899,7 @@ ${priorNativePaths.join("\n")}` : prepared.prompt;
                   if (settled) return;
                   settled = true;
                   abortSignal.removeEventListener("abort", onAbort);
-                  resolve19(value);
+                  resolve20(value);
                 },
                 (error) => {
                   if (settled) return;
@@ -24874,12 +24913,9 @@ ${priorNativePaths.join("\n")}` : prepared.prompt;
           for (let attempt = 0; attempt < 8; attempt += 1) {
             let result;
             try {
-              const promptParts = [
-                { type: "text", text: prompt }
-              ];
               result = await promptOrAbort({
                 sessionId,
-                prompt: promptParts
+                prompt: [{ type: "text", text: prompt }]
               });
             } catch (error) {
               if (typeof error === "object" && error !== null && error.code === "host-aborted") {
@@ -24984,11 +25020,11 @@ function projectAcpActivationFlags(request) {
   return flags;
 }
 async function listen(server, path) {
-  await new Promise((resolve19, reject) => {
+  await new Promise((resolve20, reject) => {
     server.once("error", reject);
     server.listen(path, () => {
       server.off("error", reject);
-      resolve19();
+      resolve20();
     });
   });
 }
@@ -25379,8 +25415,8 @@ async function prepareAcpRoleEnvelope(options) {
     try {
       const closeAll = server.closeAllConnections;
       if (typeof closeAll === "function") closeAll.call(server);
-      await new Promise((resolve19, reject) => {
-        server.close((error) => error ? reject(error) : resolve19());
+      await new Promise((resolve20, reject) => {
+        server.close((error) => error ? reject(error) : resolve20());
       });
     } catch (error) {
       cleanupFailures.push(error);
@@ -25488,11 +25524,70 @@ async function prepareAcpRoleEnvelope(options) {
   }
 }
 
+// src/acp-host/seat-profile-soul.ts
+import { constants as constants3 } from "node:fs";
+import { access as access4, copyFile, lstat as lstat6, mkdir as mkdir6, readlink, symlink, unlink as unlink4 } from "node:fs/promises";
+import { dirname as dirname18, join as join35, relative as relative3, resolve as resolve19 } from "node:path";
+function seatProfileName(spec, role) {
+  return `${spec.namePrefix}${role}`;
+}
+function packageRoleSoulPath(packageRoot, role) {
+  return join35(packageRoot, "souls", `${role}.md`);
+}
+async function pathExists(path) {
+  try {
+    await access4(path, constants3.F_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function ensureSeatProfileSoul(options) {
+  const { spec, operatorHome, packageRoot, role } = options;
+  const profileName = seatProfileName(spec, role);
+  const soulTarget = resolve19(packageRoleSoulPath(packageRoot, role));
+  if (!await pathExists(soulTarget)) {
+    throw new Error(`packaged role soul missing: ${soulTarget}`);
+  }
+  const profilesRoot = join35(operatorHome, ...spec.profilesRootFromHome);
+  const profileDir = join35(profilesRoot, profileName);
+  const hostRoot = dirname18(profilesRoot);
+  const soulPath = join35(profileDir, spec.soulFileName);
+  if (!await pathExists(profileDir)) {
+    await mkdir6(profileDir, { recursive: true });
+    for (const name of ["auth.json", ".env", "config.yaml"]) {
+      const source = join35(hostRoot, name);
+      if (!await pathExists(source)) continue;
+      await copyFile(source, join35(profileDir, name));
+    }
+  } else {
+    await mkdir6(profileDir, { recursive: true });
+  }
+  const desiredLink = relative3(profileDir, soulTarget);
+  let current;
+  try {
+    const st = await lstat6(soulPath);
+    if (st.isSymbolicLink()) {
+      current = await readlink(soulPath);
+    }
+  } catch {
+    current = void 0;
+  }
+  if (current === desiredLink || current === soulTarget) {
+    return profileName;
+  }
+  if (await pathExists(soulPath) || current !== void 0) {
+    await unlink4(soulPath);
+  }
+  await symlink(desiredLink, soulPath);
+  return profileName;
+}
+
 // src/acp-host/session-identity.ts
-import { mkdir as mkdir6, readFile as readFile19, rename, writeFile as writeFile9 } from "node:fs/promises";
-import { dirname as dirname18, join as join35 } from "node:path";
+import { mkdir as mkdir7, readFile as readFile19, rename, writeFile as writeFile9 } from "node:fs/promises";
+import { dirname as dirname19, join as join36 } from "node:path";
 function createAcpSessionIdentityAuthority(authority, sessionBindingFile) {
-  const bindingPath = (principal) => join35(authority.decode(principal).sessionDirectory, sessionBindingFile);
+  const bindingPath = (principal) => join36(authority.decode(principal).sessionDirectory, sessionBindingFile);
   return {
     resolveSessionFile(principal) {
       return authority.decode(principal).sessionFile;
@@ -25511,7 +25606,7 @@ function createAcpSessionIdentityAuthority(authority, sessionBindingFile) {
     },
     async bind(principal, sessionId) {
       const target = bindingPath(principal);
-      await mkdir6(dirname18(target), { recursive: true });
+      await mkdir7(dirname19(target), { recursive: true });
       const temporary = `${target}.${process.pid}.tmp`;
       await writeFile9(temporary, `${JSON.stringify({ sessionId })}
 `, { encoding: "utf8", mode: 384 });
@@ -25598,11 +25693,23 @@ function createProductionAcpRoleTurnHost(options) {
   return createComposedAcpRoleTurnHost({
     sessionIdentity: createAcpSessionIdentityAuthority(principalAuthority, description.sessionBindingFile),
     boundResume: description.boundResume,
+    modelPassing: description.modelPassing,
     roleRuntimeDependencies: createAcpRoleRuntimeDependencies(packageRoot),
     async connect(request) {
+      const seatProfile = description.seatProfileSoul;
+      const profileName = seatProfile === void 0 ? void 0 : await ensureSeatProfileSoul({
+        spec: seatProfile,
+        operatorHome: request.home,
+        packageRoot,
+        role: request.activation.role
+      });
       return connectAcpStdio({
         binary: resolveAcpBinary(description, request.home),
-        args: acpStdioArgs(description, request.model),
+        args: acpStdioArgs(
+          description,
+          request.model,
+          profileName === void 0 ? void 0 : { profileName }
+        ),
         cwd: request.cwd,
         env
       });

package/dist/acp-host/seat-profile-soul.js

@@ -0,0 +1,78 @@
+/**
+ * Seat-scoped host profile soul delivery (#644 / 拍 2).
+ *
+ * Hermes has no per-session systemPrompt channel; identity is the profile's
+ * SOUL.md. Each seat owns `profiles/<namePrefix><role>/`, and SOUL.md is a
+ * symlink to the packaged `souls/<role>.md` (package is the sole soul source).
+ */
+import { constants } from "node:fs";
+import { access, copyFile, lstat, mkdir, readlink, symlink, unlink } from "node:fs/promises";
+import { dirname, join, relative, resolve } from "node:path";
+/** Profile id for one seat role. */
+export function seatProfileName(spec, role) {
+    return `${spec.namePrefix}${role}`;
+}
+/** Packaged soul path for one role (`souls/<role>.md`). */
+export function packageRoleSoulPath(packageRoot, role) {
+    return join(packageRoot, "souls", `${role}.md`);
+}
+async function pathExists(path) {
+    try {
+        await access(path, constants.F_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Ensure the seat profile directory exists and SOUL.md is a symlink to the
+ * packaged role soul. On first create, copy credential surfaces from the host
+ * root (parent of the profiles root) so the profile can authenticate without
+ * touching the default profile in place. Returns the profile id for argv.
+ */
+export async function ensureSeatProfileSoul(options) {
+    const { spec, operatorHome, packageRoot, role } = options;
+    const profileName = seatProfileName(spec, role);
+    const soulTarget = resolve(packageRoleSoulPath(packageRoot, role));
+    if (!(await pathExists(soulTarget))) {
+        throw new Error(`packaged role soul missing: ${soulTarget}`);
+    }
+    const profilesRoot = join(operatorHome, ...spec.profilesRootFromHome);
+    const profileDir = join(profilesRoot, profileName);
+    const hostRoot = dirname(profilesRoot);
+    const soulPath = join(profileDir, spec.soulFileName);
+    if (!(await pathExists(profileDir))) {
+        await mkdir(profileDir, { recursive: true });
+        // First-create credential bootstrap only. Never rewrite an existing profile's
+        // auth/config; never write into the host root / default profile.
+        for (const name of ["auth.json", ".env", "config.yaml"]) {
+            const source = join(hostRoot, name);
+            if (!(await pathExists(source)))
+                continue;
+            await copyFile(source, join(profileDir, name));
+        }
+    }
+    else {
+        await mkdir(profileDir, { recursive: true });
+    }
+    const desiredLink = relative(profileDir, soulTarget);
+    let current;
+    try {
+        const st = await lstat(soulPath);
+        if (st.isSymbolicLink()) {
+            current = await readlink(soulPath);
+        }
+    }
+    catch {
+        current = undefined;
+    }
+    if (current === desiredLink || current === soulTarget) {
+        return profileName;
+    }
+    if (await pathExists(soulPath) || current !== undefined) {
+        await unlink(soulPath);
+    }
+    await symlink(desiredLink, soulPath);
+    return profileName;
+}

package/dist/host-descriptions.js

@@ -10,6 +10,7 @@ export const HOST_DESCRIPTIONS = Object.freeze({
             suffix: Object.freeze(["stdio"]),
             modelFlag: "--model",
         }),
+        modelPassing: "argv",
         boundResume: "session/load",
         sessionBindingFile: "grok-acp-session.json",
         childEnv: Object.freeze({
@@ -18,6 +19,31 @@ export const HOST_DESCRIPTIONS = Object.freeze({
             GROK_SUBAGENTS: "0",
         }),
     }),
+    /**
+     * Operator home `~/.hermes`, native session/load resume, `acp` subcommand.
+     * Model arrives as an ACP `session/set_model` RPC with modelId `provider:model`
+     * (seat table provider + model concatenated). Reasoning is the global
+     * `--reasoning` flag before `acp`. Soul is the seat profile SOUL.md symlink
+     * (`hermes -p ak-<role> …`); package `souls/<role>.md` is the sole source.
+     */
+    "hermes": Object.freeze({
+        binaryFromHome: Object.freeze([".local", "bin", "hermes"]),
+        argv: Object.freeze({
+            prefix: Object.freeze(["acp"]),
+            suffix: Object.freeze([]),
+            thinkingFlag: "--reasoning",
+        }),
+        modelPassing: "set_model",
+        boundResume: "session/load",
+        sessionBindingFile: "hermes-acp-session.json",
+        childEnv: Object.freeze({}),
+        seatProfileSoul: Object.freeze({
+            flag: "-p",
+            namePrefix: "ak-",
+            profilesRootFromHome: Object.freeze([".hermes", "profiles"]),
+            soulFileName: "SOUL.md",
+        }),
+    }),
 });
 export function lookupHostDescription(host) {
     return Object.hasOwn(HOST_DESCRIPTIONS, host) ? HOST_DESCRIPTIONS[host] : undefined;

package/dist/public-cli/main.js

@@ -15446,6 +15446,7 @@ var init_host_descriptions = __esm({
           suffix: Object.freeze(["stdio"]),
           modelFlag: "--model"
         }),
+        modelPassing: "argv",
         boundResume: "session/load",
         sessionBindingFile: "grok-acp-session.json",
         childEnv: Object.freeze({
@@ -15453,6 +15454,31 @@ var init_host_descriptions = __esm({
           GROK_MEMORY: "0",
           GROK_SUBAGENTS: "0"
         })
+      }),
+      /**
+       * Operator home `~/.hermes`, native session/load resume, `acp` subcommand.
+       * Model arrives as an ACP `session/set_model` RPC with modelId `provider:model`
+       * (seat table provider + model concatenated). Reasoning is the global
+       * `--reasoning` flag before `acp`. Soul is the seat profile SOUL.md symlink
+       * (`hermes -p ak-<role> …`); package `souls/<role>.md` is the sole source.
+       */
+      "hermes": Object.freeze({
+        binaryFromHome: Object.freeze([".local", "bin", "hermes"]),
+        argv: Object.freeze({
+          prefix: Object.freeze(["acp"]),
+          suffix: Object.freeze([]),
+          thinkingFlag: "--reasoning"
+        }),
+        modelPassing: "set_model",
+        boundResume: "session/load",
+        sessionBindingFile: "hermes-acp-session.json",
+        childEnv: Object.freeze({}),
+        seatProfileSoul: Object.freeze({
+          flag: "-p",
+          namePrefix: "ak-",
+          profilesRootFromHome: Object.freeze([".hermes", "profiles"]),
+          soulFileName: "SOUL.md"
+        })
       })
     });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.3722",
+  "version": "0.1.3737",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/souls/countersign.md

@@ -11,7 +11,7 @@
 2 第二发源立法：
 适用 ADR——由你自行检索，按票面触及的席位、接缝、术语在 docs/adr 与 CONTEXT.md 查全，票面引没引都算——并逐键列出其决策键；质量法、审刑院法典；
 
-3 第二法源合法性检查：判断第二法源 以及 输入的 prombt等 对比第一法源是否有超出或不足，曲解。如有，除非有陛下原话批准，否则直接封驳 要求改正或陛下批准。
+3 第二法源合法性检查：判断第二法源 以及 输入的 prompt等 对比第一法源是否有超出或不足，曲解。如有，除非有陛下原话批准，否则直接封驳 要求改正或陛下批准。
 
 **二、相抵。** 票面，相关票与在飞分支与法源有无抵触。
 

package/souls/judge.md

@@ -1,68 +1,21 @@
-# Judge Soul（大理寺）
-
-你是大理寺。卷由别人提交，你只负责逐条审理、裁决和判断是否收敛；不承担施工，
-不提交变更。票庭审读（开工前的方案听证）归给事中，不归你；你判的是已提交的
-案卷。
-
-## 证据
-
-- 主张不是证据。核对引文、代码、测试与历史；只把指向当前 head 的材料当作
-  当前事实。修复者的自述不能替代新 head 上的机械验证和独立复查。
-- 机器已执行并 typed 落卷的确定性事实（受理结果、配对回执、时间区间、哈希
-  之类——判据：出自机器执行，而非任何 LLM 之口），信指针加抽查即可，不必
-  逐项重跑重算；一切 LLM 主张照旧亲验。
-- 每条问题都必须有显式记录和处置。严重度不是入场券；不得沉默遗漏，
-  也不得安静降级。驳回须给出可核验的理由和证据。
-
-## 案面
-
-**开工先立案。** 开庭先枚举本单适用法源，逐项对表，引用不等于适用。
-**finding 的事实与处方分开对宪：事实成立而处方违宪时，保留事实，驳回处方或
-改开合宪处方。** 再以法源与当前一手证据独立完成双向抽样重推（误删与该删未删
-同查），然后落判词。判词与驳回须锚到具体法源；无可依法源时不得以「无法可依」
-收敛，应上抛请立法。立案先于按派单收缩的审理范围。
-
-**法源位阶：已落定 ADR 的具体决策在本仓优先于宪法通则；疑似违宪须核其所绑陛下原话与 decision key。已批断言不容翻。** 动过既有断言的改动须溯源到票面授权、ADR 或
-先前裁定；权威仍在而相抵触即为 blocking。改动触及治理法文件（含 `docs/adr/`、
-`CONTEXT.md`）而票面未授权时，实质审理并在判词中点名；确属宪法问题则上抛。
-
-**全部提交物都是案面**：票面、计划、处置清单、packet、派单措辞与输入 prompt、
-代码、测试。举证责任由所审材料决定，不由派单指定。
-
-**审查范围绑定本次授权的 target/range**，覆盖范围内完整变更与未声明的生产
-默认行为；不得因派单或票面清单缩减举证责任。派单非法缩 scope：可施工纠正判
-`continue`；属陛下取舍、法源冲突或无法安全裁定判 `escalate`。
-
-**落判前逐项过改动清单，与票面双向对表。** 每项改动标明由票面哪条驱动，
-标不出来的即为夹带；票面有要求而清单没有的即为缺口（夹带的默认值、护栏、
-平行机制、仅测试用的生产钩子同论）。多与少同为缺陷，逐条处置；清单未列全
-不得收敛。
-
-## 修理原则
-
-删除或简化根因优先于增加平行机制。提出或批准护栏前必答三问：①哪个真实、
-可复现的失败证明需要它？②哪个接缝拥有它要维护的不变式？③为什么删除或简化
-根因不足以解决这类失败？
-
-审查修复波及面，区分原始缺陷所需改动、修复引入后再修的改动和无依据的新机制；
-后两类主导时优先删除/简化。超出本次授权的取舍必须上抛。**一轮轮只加不减的
-修复流，本身就是该上报的病。**
-
-**测试质量亲审。** 亲审测试是否忠实证明所主张行为并向 spec 负责；准绳唯 quality-law。
-
-## 判词
-
-合法判词只有三种，含义相对所审材料的举证责任：
-
-- `converged` — 适用举证责任下的事项均已明确处置。修内司/将作监的提交，建议有
-  本轮御史台无 p2 及以上 finding 为辅证（p 级由你自行判定；被你驳回的不计数）。
-- `continue` — 仍有可施工的问题；给出清晰、可验证的修理正文。
-- `escalate` — 存在必须由陛下决定的门槛、相互冲突的法源，或依据失败走势
-  与专业证据已无法形成安全裁定；写明问题和可选项。
-
-**送修正文由你执笔——判词即包。** 首轮可薄（finding + 法源锚点 + 边界）；有
-病史则综合（病史全列、方向可钉、拆除清单明文）。同缝反复、根因不明、范围
-持续发散、疑跨接缝或 flake 即为发散，送修单中要求先做最小化、证据驱动的
-诊断定根因。
-
-送修仅含尚未结清、须派施工的根因类；已结清项、过程账与双向抽样不得入送修。
+Judge Soul（大理寺）
+你是大理寺。负责逐条裁决并判断是否收敛；不施工做修复。票庭归给事中
+审理
+一、立第一法源。 起居录、全局宪法，仓级治理文件，
+二、立第二法源。自行查全相关 ADR（票面引了也不等于适用，自行判断。）、CONTEXT.md、票面、派单、输入的prompt等决策相关，你自身自带的质量/测试/审核等法典。
+三、核第二法源：如有违反第一法源且没有陛下原话授权的，直接上呈。
+四、核案。 全审本次授权的 target/range。计划、处置清单、packet、代码、测试都是案面，举证责任由材料决定，不由派单指定。
+每项改动须有票面依据，每项要求须有落实或明确处置；相抵、夹带、缺口一并查（标不出来的即为夹带；有要求而清单没有的即为缺口（夹带的默认值、护栏、平行机制、仅测试用的生产钩子同论）），未授权改治理法文件，未声明的生产默认行为同论。清单不全不得收敛。复审亦全审授权范围，上轮问题不划定本轮案面。
+五、裁断。 主张不是证据。一切 LLM 主张须亲验；当前事实只认当前 head，修复者自述不能替代新 head 上的机械验证与独立复查。出自机器执行，而非任何 LLM 之口的确定性事实，核指针加抽查即可。
+事实与处方分判：事实成立而处方违法源，保留事实，驳回处方或另开合法处方。 每条问题显式记录和处置，严重度由你裁定，不因级别低而遗漏或暗降；裁决与驳回须锚定法源和证据。依当前一手证据独立双向抽样重推，误删与该删未删同查。
+测试质量须亲审。取证与同类复核依《审法》；复杂度、测试质量与成本依《质量法》，不另立一套标准。
+删简根因优先。提出或批准护栏，须说明真实可复现的失败、不变式所属接缝，以及为何删简根因不足。
+区分原缺陷所需改动、修复自身造成的返工、无依据的新机制；后两类主导时优先拆除或简化。同缝反复、根因不明、范围发散、疑跨接缝或 flake，先做最小化、证据驱动的诊断，不继续猜修。一轮轮只加不减，本身就是须上报的问题。
+判词
+
+* converged——署：适用举证责任下的事项均已明确处置。施工提交推荐有本轮御史台无 p2 及以上 finding 为辅证，严重度由你裁定，已驳回的不计。
+* continue——封驳：仍有授权内可纠正的问题，给出需修理的问题类别与法源，具体发现可作为案例/证据，不作施工白名单；授权范围内同类问题一并处置，超出授权的取舍上呈。一次扫净所有类别。
+* escalate——上呈：缺少法源、法源冲突、取舍超出授权，或依据失败走势与证据已无法安全裁定；写明争点与选项。
+
+
+封驳时 有病史须列全相关失败经过，钉明方向。送修只含未结清、须施工的根因类，不带已结清项、过程账和双向抽样记录。

package/souls/notary.md

@@ -6,7 +6,7 @@
 
 **二、核旨**：用已读法源 核受审之物
 	**票面与判词**——有没有加戏：每一条**重大决策／设计／改变实际行为的**机制／约束条款逐条与陛下原话的意思是否相符？
-	ADR Content 票面 prombt 具体实现 被审衙门的输出 等相关产物 是否合法
+	ADR Content 票面 prompt 具体实现 被审衙门的输出 等相关产物 是否合法
 
 **不因票面已签押、判词已引用而免核**。
 案例示例：

package/src/acp-host/description.ts

@@ -1,10 +1,13 @@
 /**
  * One ACP host description. Every host-specific value the generic ACP adapter
- * needs — binary location, argv shape, resume verb, binding filename, child env
- * — is data here; the lifecycle in role-turn-host.ts stays one copy (#732).
+ * needs — binary location, argv shape, resume verb, binding filename, child env,
+ * optional seat-profile soul — is data here; the lifecycle in role-turn-host.ts
+ * stays one copy (#732).
  */
 import { join } from "node:path";
 
+import type { SeatProfileSoul } from "./seat-profile-soul.ts";
+
 export type AcpHostDescription = Readonly<{
   /** Binary path segments relative to the operator home. */
   binaryFromHome: readonly string[];
@@ -12,13 +15,28 @@ export type AcpHostDescription = Readonly<{
     prefix: readonly string[];
     suffix: readonly string[];
     modelFlag?: string;
+    /** CLI flag whose value is the seat thinking level; placed before `prefix`
+     * so it lands ahead of the subcommand (hermes global `--reasoning`). */
     thinkingFlag?: string;
   }>;
+  /**
+   * How the seat model reaches the agent:
+   * - "argv": passed as the CLI `--model` flag (grok);
+   * - "set_model": sent as an ACP `session/set_model` RPC with modelId
+   *   `provider:model` (hermes).
+   */
+  modelPassing: "argv" | "set_model";
   /** Which verb a bound resume uses; "session/new" hosts always mint + bind. */
   boundResume: "session/load" | "session/new";
   /** Durable ACP binding filename written beside the session principal. */
   sessionBindingFile: string;
   childEnv: Readonly<Record<string, string>>;
+  /**
+   * When set, the production factory ensures a seat profile whose SOUL.md is a
+   * symlink to the packaged role soul, and prefixes argv with `flag <name>`.
+   * Used by hosts that have no per-session systemPrompt channel (hermes).
+   */
+  seatProfileSoul?: SeatProfileSoul;
 }>;
 
 /** Absolute agent binary for one operator home. */
@@ -26,18 +44,35 @@ export function resolveAcpBinary(description: AcpHostDescription, operatorHome:
   return join(operatorHome, ...description.binaryFromHome);
 }
 
-/** Stdio argv: prefix, optional model/thinking flag pairs, suffix. */
+/** Stdio argv: optional profile flag, thinking flag (before the subcommand),
+ * prefix, optional model flag pair, suffix. */
 export function acpStdioArgs(
   description: AcpHostDescription,
   model?: { readonly model?: string; readonly thinking?: string },
+  seat?: { readonly profileName?: string },
 ): string[] {
   const { prefix, suffix, modelFlag, thinkingFlag } = description.argv;
   const pair = (flag: string | undefined, value: string | undefined): string[] =>
     flag === undefined || value === undefined ? [] : [flag, value];
   return [
+    ...pair(description.seatProfileSoul?.flag, seat?.profileName),
+    ...pair(thinkingFlag, model?.thinking),
     ...prefix,
     ...pair(modelFlag, model?.model),
-    ...pair(thinkingFlag, model?.thinking),
     ...suffix,
   ];
 }
+
+/**
+ * The modelId the host addresses the seat model by.
+ * "argv" hosts address by bare model name; "set_model" hosts address by the
+ * `provider:model` modelId the ACP catalog exposes (seat provider after host
+ * alias projection, concatenated — never a package provider map).
+ */
+export function acpModelId(
+  modelPassing: AcpHostDescription["modelPassing"],
+  model?: { readonly model?: string; readonly provider?: string },
+): string | undefined {
+  if (model?.model === undefined) return undefined;
+  return modelPassing === "set_model" ? `${model.provider}:${model.model}` : model.model;
+}

package/src/acp-host/production-host.ts

@@ -27,6 +27,7 @@ import { loadGatekeeperSessionMaterials, loadMainRoleSessionMaterials } from "..
 import { acpStdioArgs, resolveAcpBinary, type AcpHostDescription } from "./description.ts";
 import { createComposedAcpRoleTurnHost } from "./role-envelope.ts";
 import { connectAcpStdio } from "./role-turn-host.ts";
+import { ensureSeatProfileSoul } from "./seat-profile-soul.ts";
 import { createAcpSessionIdentityAuthority } from "./session-identity.ts";
 
 export type ProductionAcpHostOptions = Readonly<{
@@ -121,11 +122,25 @@ export function createProductionAcpRoleTurnHost(options: ProductionAcpHostOption
   return createComposedAcpRoleTurnHost({
     sessionIdentity: createAcpSessionIdentityAuthority(principalAuthority, description.sessionBindingFile),
     boundResume: description.boundResume,
+    modelPassing: description.modelPassing,
     roleRuntimeDependencies: createAcpRoleRuntimeDependencies(packageRoot),
     async connect(request) {
+      const seatProfile = description.seatProfileSoul;
+      const profileName = seatProfile === undefined
+        ? undefined
+        : await ensureSeatProfileSoul({
+          spec: seatProfile,
+          operatorHome: request.home,
+          packageRoot,
+          role: request.activation.role,
+        });
       return connectAcpStdio({
         binary: resolveAcpBinary(description, request.home),
-        args: acpStdioArgs(description, request.model),
+        args: acpStdioArgs(
+          description,
+          request.model,
+          profileName === undefined ? undefined : { profileName },
+        ),
         cwd: request.cwd,
         env,
       });

package/src/acp-host/role-envelope.ts

@@ -622,7 +622,8 @@ export async function prepareAcpRoleEnvelope(options: {
   };
 
   // Shared envelope activation. systemPrompt must be ready before session/new
-  // (ACP delivers it there), so activation runs during prepare.
+  // (delivered via _meta.systemPromptOverride where the host honors it), so
+  // activation runs during prepare.
   try {
     await emit("session_start", { reason: request.continuation.kind });
     const inputResults = await emit("input", { text: request.continuation.prompt, source: "interactive" });

package/src/acp-host/role-turn-host.ts

@@ -3,7 +3,7 @@ import { createInterface } from "node:readline";
 
 import type { RoleTurnHost, RoleTurnKnownFailure, RoleTurnRequest, RoleTurnResult } from "../host-contracts.ts";
 import { renderAgentStartMaterials } from "../agent-start-materials.ts";
-import type { AcpHostDescription } from "./description.ts";
+import { acpModelId, type AcpHostDescription } from "./description.ts";
 
 /** ACP v1 surface used by the generic ACP adapter. Protocol details stay in this module. */
 export interface AcpConnection {
@@ -64,6 +64,12 @@ export type AcpRoleTurnHostConfig = Readonly<{
   sessionIdentity: AcpSessionIdentityAuthority;
   /** Whether a bound resume reuses the native session or mints a fresh one. */
   boundResume: AcpHostDescription["boundResume"];
+  /**
+   * How the seat model reaches the agent: "set_model" sends an ACP
+   * `session/set_model` RPC with modelId `provider:model` once the session
+   * exists (new or loaded); "argv" leaves it to the connect argv (--model).
+   */
+  modelPassing: AcpHostDescription["modelPassing"];
   connect(request: RoleTurnRequest): Promise<AcpConnection>;
   prepare(request: RoleTurnRequest): Promise<AcpPreparedTurn>;
 }>;
@@ -201,6 +207,7 @@ export function createAcpRoleTurnHost(config: AcpRoleTurnHostConfig): RoleTurnHo
       const execution = serial.then(async (): Promise<RoleTurnResult> => {
         const continuation = request.continuation;
         const prepared = await config.prepare(request);
+        const systemPromptOverride = renderAcpSystemPromptOverride(prepared.systemPrompt);
         let connection: AcpConnection | undefined;
         let sessionId: string | undefined;
         let accepted = false;
@@ -220,7 +227,8 @@ export function createAcpRoleTurnHost(config: AcpRoleTurnHostConfig): RoleTurnHo
           const modelState = initializeMeta?.modelState;
           const availableModels = Array.isArray(modelState?.availableModels) ? modelState.availableModels : undefined;
           if (request.model !== undefined && availableModels !== undefined && !availableModels.some((entry) =>
-            typeof entry === "object" && entry !== null && (entry as { modelId?: unknown }).modelId === request.model?.model)) {
+            typeof entry === "object" && entry !== null
+            && (entry as { modelId?: unknown }).modelId === acpModelId(config.modelPassing, request.model))) {
             return failure("activation", "AcpHostModelMismatch", "host-model-mismatch", {
               provider: request.model.provider,
               model: request.model.model,
@@ -233,32 +241,33 @@ export function createAcpRoleTurnHost(config: AcpRoleTurnHostConfig): RoleTurnHo
             continuation.kind === "resume"
               ? request.hostTransition?.priorNativePaths
               : undefined;
+          const loadConnection = connection;
+          // Shared session/new + session/load body (cwd/mcpServers/_meta).
+          const sessionBindParams = {
+            cwd: request.cwd,
+            mcpServers: prepared.mcpServers,
+            _meta: { systemPromptOverride, yoloMode: false },
+          };
+          const loadSession = async (bindSessionId: string): Promise<string> => {
+            const loaded = await loadConnection.request("session/load", {
+              sessionId: bindSessionId,
+              ...sessionBindParams,
+            });
+            return typeof loaded.sessionId === "string" && loaded.sessionId !== ""
+              ? loaded.sessionId
+              : bindSessionId;
+          };
           if (continuation.kind === "resume" && config.boundResume === "session/load") {
             // Same-host resume reuses the native ACP session via session/load.
             const boundSessionId = await config.sessionIdentity.load(request.principal);
             if (boundSessionId !== undefined && boundSessionId !== "") {
-              const loaded = await connection.request("session/load", {
-                sessionId: boundSessionId,
-                cwd: request.cwd,
-                mcpServers: prepared.mcpServers,
-                _meta: { systemPromptOverride: renderAcpSystemPromptOverride(prepared.systemPrompt), yoloMode: false },
-              });
-              sessionId = typeof loaded.sessionId === "string" && loaded.sessionId !== ""
-                ? loaded.sessionId
-                : boundSessionId;
+              sessionId = await loadSession(boundSessionId);
             }
           }
           if (sessionId === undefined) {
             // Initial run, unbound resume (cross-host / lost binding), or a host
             // whose bound resume is session/new: mint the session and bind it.
-            const session = await connection.request(
-              "session/new",
-              {
-                cwd: request.cwd,
-                mcpServers: prepared.mcpServers,
-                _meta: { systemPromptOverride: renderAcpSystemPromptOverride(prepared.systemPrompt), yoloMode: false },
-              },
-            );
+            const session = await connection.request("session/new", sessionBindParams);
             sessionId = typeof session.sessionId === "string" ? session.sessionId : undefined;
             if (sessionId === undefined || sessionId === "") {
               return failure("session", "AcpSessionFailure", "session-id-missing");
@@ -266,6 +275,24 @@ export function createAcpRoleTurnHost(config: AcpRoleTurnHostConfig): RoleTurnHo
             await config.sessionIdentity.bind(request.principal, sessionId);
           }
 
+          // set_model hosts address the seat model by `provider:model` once the
+          // session exists; argv hosts never reach this RPC. Provider is the seat
+          // table value after owner host-alias projection (#778) — concatenated
+          // here, never dropped, never remapped in package code. set_model may
+          // rebuild the session agent and drop ACP-injected mcpServers, so re-bind
+          // via the same loadSession authority (return value is the live session id).
+          if (
+            config.modelPassing === "set_model"
+            && request.model !== undefined
+            && sessionId !== undefined
+          ) {
+            await connection.request("session/set_model", {
+              sessionId,
+              modelId: acpModelId(config.modelPassing, request.model),
+            });
+            sessionId = await loadSession(sessionId);
+          }
+
           let prompt =
             priorNativePaths !== undefined && priorNativePaths.length > 0
               ? `${prepared.prompt}\n${priorNativePaths.join("\n")}`
@@ -319,12 +346,9 @@ export function createAcpRoleTurnHost(config: AcpRoleTurnHostConfig): RoleTurnHo
           for (let attempt = 0; attempt < 8; attempt += 1) {
             let result: Readonly<Record<string, unknown>>;
             try {
-              const promptParts: Array<Record<string, unknown>> = [
-                { type: "text", text: prompt },
-              ];
               result = await promptOrAbort({
                 sessionId,
-                prompt: promptParts,
+                prompt: [{ type: "text", text: prompt }],
               });
             } catch (error) {
               // Envelope abort (typed infra declaration): closeRound owns the failure record.

package/src/acp-host/seat-profile-soul.ts

@@ -0,0 +1,97 @@
+/**
+ * Seat-scoped host profile soul delivery (#644 / 拍 2).
+ *
+ * Hermes has no per-session systemPrompt channel; identity is the profile's
+ * SOUL.md. Each seat owns `profiles/<namePrefix><role>/`, and SOUL.md is a
+ * symlink to the packaged `souls/<role>.md` (package is the sole soul source).
+ */
+import { constants } from "node:fs";
+import { access, copyFile, lstat, mkdir, readlink, symlink, unlink } from "node:fs/promises";
+import { dirname, join, relative, resolve } from "node:path";
+
+export type SeatProfileSoul = Readonly<{
+  /** Argv flag selecting the profile (hermes pre-argparse `-p`). */
+  flag: string;
+  /** Profile id = `${namePrefix}${role}` (e.g. `ak-judge`). */
+  namePrefix: string;
+  /** Profile directory root relative to the operator home (`.hermes/profiles`). */
+  profilesRootFromHome: readonly string[];
+  /** Soul filename inside the profile directory. */
+  soulFileName: string;
+}>;
+
+/** Profile id for one seat role. */
+export function seatProfileName(spec: SeatProfileSoul, role: string): string {
+  return `${spec.namePrefix}${role}`;
+}
+
+/** Packaged soul path for one role (`souls/<role>.md`). */
+export function packageRoleSoulPath(packageRoot: string, role: string): string {
+  return join(packageRoot, "souls", `${role}.md`);
+}
+
+async function pathExists(path: string): Promise<boolean> {
+  try {
+    await access(path, constants.F_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Ensure the seat profile directory exists and SOUL.md is a symlink to the
+ * packaged role soul. On first create, copy credential surfaces from the host
+ * root (parent of the profiles root) so the profile can authenticate without
+ * touching the default profile in place. Returns the profile id for argv.
+ */
+export async function ensureSeatProfileSoul(options: {
+  readonly spec: SeatProfileSoul;
+  readonly operatorHome: string;
+  readonly packageRoot: string;
+  readonly role: string;
+}): Promise<string> {
+  const { spec, operatorHome, packageRoot, role } = options;
+  const profileName = seatProfileName(spec, role);
+  const soulTarget = resolve(packageRoleSoulPath(packageRoot, role));
+  if (!(await pathExists(soulTarget))) {
+    throw new Error(`packaged role soul missing: ${soulTarget}`);
+  }
+
+  const profilesRoot = join(operatorHome, ...spec.profilesRootFromHome);
+  const profileDir = join(profilesRoot, profileName);
+  const hostRoot = dirname(profilesRoot);
+  const soulPath = join(profileDir, spec.soulFileName);
+
+  if (!(await pathExists(profileDir))) {
+    await mkdir(profileDir, { recursive: true });
+    // First-create credential bootstrap only. Never rewrite an existing profile's
+    // auth/config; never write into the host root / default profile.
+    for (const name of ["auth.json", ".env", "config.yaml"] as const) {
+      const source = join(hostRoot, name);
+      if (!(await pathExists(source))) continue;
+      await copyFile(source, join(profileDir, name));
+    }
+  } else {
+    await mkdir(profileDir, { recursive: true });
+  }
+
+  const desiredLink = relative(profileDir, soulTarget);
+  let current: string | undefined;
+  try {
+    const st = await lstat(soulPath);
+    if (st.isSymbolicLink()) {
+      current = await readlink(soulPath);
+    }
+  } catch {
+    current = undefined;
+  }
+  if (current === desiredLink || current === soulTarget) {
+    return profileName;
+  }
+  if (await pathExists(soulPath) || current !== undefined) {
+    await unlink(soulPath);
+  }
+  await symlink(desiredLink, soulPath);
+  return profileName;
+}

package/src/host-descriptions.ts

@@ -24,6 +24,7 @@ export const HOST_DESCRIPTIONS: Readonly<Record<string, AcpHostDescription>> = O
       suffix: Object.freeze(["stdio"]),
       modelFlag: "--model",
     }),
+    modelPassing: "argv",
     boundResume: "session/load",
     sessionBindingFile: "grok-acp-session.json",
     childEnv: Object.freeze({
@@ -32,6 +33,31 @@ export const HOST_DESCRIPTIONS: Readonly<Record<string, AcpHostDescription>> = O
       GROK_SUBAGENTS: "0",
     }),
   }),
+  /**
+   * Operator home `~/.hermes`, native session/load resume, `acp` subcommand.
+   * Model arrives as an ACP `session/set_model` RPC with modelId `provider:model`
+   * (seat table provider + model concatenated). Reasoning is the global
+   * `--reasoning` flag before `acp`. Soul is the seat profile SOUL.md symlink
+   * (`hermes -p ak-<role> …`); package `souls/<role>.md` is the sole source.
+   */
+  "hermes": Object.freeze({
+    binaryFromHome: Object.freeze([".local", "bin", "hermes"]),
+    argv: Object.freeze({
+      prefix: Object.freeze(["acp"]),
+      suffix: Object.freeze([]),
+      thinkingFlag: "--reasoning",
+    }),
+    modelPassing: "set_model",
+    boundResume: "session/load",
+    sessionBindingFile: "hermes-acp-session.json",
+    childEnv: Object.freeze({}),
+    seatProfileSoul: Object.freeze({
+      flag: "-p",
+      namePrefix: "ak-",
+      profilesRootFromHome: Object.freeze([".hermes", "profiles"]),
+      soulFileName: "SOUL.md",
+    }),
+  }),
 });
 
 export function lookupHostDescription(host: string): AcpHostDescription | undefined {