@delorenj/pjangler 1.1.3

package/templates/hermes-agent/template/.runtime-scaffold/README.md

@@ -0,0 +1,52 @@
+# {{agent_id}} — runtime
+
+This is the durable runtime for the **{{display_name}}** agent. The named
+Hermes profile `{{profile_name}}` points here from `~/.hermes/profiles/{{profile_name}}`,
+so Hermes sees an ordinary profile while this repo stays git-tracked and
+recoverable across machines.
+
+## What's in here
+
+| Path | Tracked? | Purpose |
+| --- | --- | --- |
+| `profile.yaml` | yes | Opts this profile into inheriting config from default |
+| `config.yaml` | yes | Local config overrides only; shared defaults come from the fleet default |
+| `SOUL.md` | yes | The agent's personality, evolves over time |
+| `memories/MEMORY.md` | yes | The condensed mental-model summary loaded each session |
+| `memories/USER.md` | yes | The operator's persona (Jarad DeLorenzo, ...) |
+| `sessions/sessions.db` | yes (LFS) | SQLite store of every conversation |
+| `bloodbank-consumer.py` | yes | NATS subscriber for repo-scoped events |
+| `decisions/` | yes | Agent-emitted decisions, one file per important call |
+| `.env` | **no** | API keys + Telegram bot token (per-machine secret) |
+| `auth.json` | **no** | Deprecated local OAuth store; fleet auth defaults to `HERMES_OAUTH_FILE=~/.hermes/auth.json` |
+| `audio_cache/`, `image_cache/` | **no** | Regenerable caches |
+| `sandboxes/` | **no** | Per-session ephemeral execution dirs |
+| `bloodbank-inbox/` | **no** | Inbox queue for incoming bloodbank events |
+
+## Checkpoint cadence
+
+- Hourly: systemd `--user` timer `hermes-{{agent_id}}-checkpoint.timer`
+- On session end: hermes Stop hook (TODO: hook script in `~/.hermes/hooks/`)
+
+The checkpoint script lives in the parent's `.scripts/checkpoint.sh`. It
+`git add -A`, commits only if dirty, and pushes to `origin`.
+
+## Restoring on a new machine
+
+```bash
+cd /path/to/parent-project
+git submodule update --init --recursive
+git -C agents/hermes/{{role}}/runtime lfs pull
+# Provide the per-runtime secrets the submodule deliberately excluded:
+cp ~/path/to/your/.env       agents/hermes/{{role}}/runtime/.env
+# OAuth provider credentials are shared across the fleet. If needed, login once:
+agents/hermes/{{role}}/hermes auth add openai-codex
+agents/hermes/{{role}}/hermes status
+```
+
+## DO NOT manually edit on multiple machines
+
+This repo is a single-writer system. Either run the agent on machine A or
+machine B — not both. The checkpoint commit will fast-forward; concurrent
+edits cause merge pain. If you really need to fork the agent (e.g. for
+experimentation), branch this repo.

package/templates/hermes-agent/template/.runtime-scaffold/bloodbank-consumer.py

@@ -0,0 +1,147 @@
+#!/usr/bin/env python3
+"""
+Bloodbank consumer for hermes agent {{agent_id}}.
+
+Subscribes to:
+    bloodbank.evt.v1.repo.{{repo}}.>
+    bloodbank.cmd.v1.agent.{{agent_id}}.>
+
+For each event/command received, writes it to the agent's notification queue at
+$HERMES_HOME/bloodbank-inbox/<timestamp>.json so the gateway can ingest it on
+the next tick. Reconnects on broker churn; idempotent across restarts.
+
+Generated by hermes-agent-template/runtime-scaffold/bloodbank-consumer.py and
+rendered with role-specific values at provision time. Re-render by re-running
+agents/hermes/{{role}}/.scripts/20-runtime-repo.sh — do NOT edit by hand.
+"""
+
+import asyncio
+import json
+import os
+import pathlib
+import signal
+import sys
+import time
+import uuid
+from datetime import datetime, timezone
+
+try:
+    import nats
+except ImportError:
+    sys.stderr.write("nats-py not installed. install with: pip install nats-py\n")
+    sys.exit(2)
+
+
+HERMES_HOME = pathlib.Path(os.environ.get("HERMES_HOME", str(pathlib.Path.home() / ".hermes")))
+INBOX_DIR = HERMES_HOME / "bloodbank-inbox"
+INBOX_DIR.mkdir(parents=True, exist_ok=True)
+
+NATS_HOST = os.environ.get("BLOODBANK_NATS_HOST", "127.0.0.1")
+NATS_PORT = int(os.environ.get("BLOODBANK_NATS_PORT", "4222"))
+NATS_URL = f"nats://{NATS_HOST}:{NATS_PORT}"
+
+AGENT_ID = "{{agent_id}}"
+REPO     = "{{repo}}"
+ROLE     = "{{role}}"
+PRODUCER = f"hermes-agent:{AGENT_ID}"
+SOURCE   = f"hermes://agent/{AGENT_ID}"
+
+SUBJECTS = [
+    f"bloodbank.evt.v1.repo.{REPO}.>",
+    f"bloodbank.cmd.v1.agent.{AGENT_ID}.>",
+]
+
+KIND_MARKERS = {"event": "evt", "command": "cmd", "reply": "rpy"}
+
+
+def _now():
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _subject_and_domain(ce_type, kind):
+    parts = ce_type.split(".")
+    if len(parts) != 5 or parts[0] != "bloodbank" or not parts[1].startswith("v"):
+        raise ValueError(f"type {ce_type!r} must match bloodbank.vN.<domain>.<entity>.<action>")
+    if kind not in KIND_MARKERS:
+        raise ValueError(f"unknown envelope kind {kind!r}")
+    _vendor, version, domain, entity, action = parts
+    return f"bloodbank.{KIND_MARKERS[kind]}.{version}.{domain}.{entity}.{action}", domain
+
+
+def build_envelope(ce_type, data, *, kind="event", correlationid=None, causationid=None):
+    """Mirror of bloodbank/services/agent-hooks/core/envelope.build_envelope."""
+    subject, domain = _subject_and_domain(ce_type, kind)
+    env = {
+        "specversion": "1.0",
+        "type": ce_type,
+        "id": str(uuid.uuid4()),
+        "source": SOURCE,
+        "subject": subject,
+        "time": _now(),
+        "datacontenttype": "application/json",
+        "kind": kind,
+        "producer": PRODUCER,
+        "service": "hermes-agent",
+        "domain": domain,
+        "actor": {"type": "agent", "agent_id": AGENT_ID, "cli": "hermes"},
+        "data": data,
+        "correlationid": correlationid or str(uuid.uuid4()),
+        "causationid": causationid or str(uuid.uuid4()),
+    }
+    if kind == "event":
+        env["ordering_key"] = f"agent:{AGENT_ID}"
+    return env
+
+
+async def main():
+    nc = await nats.connect(NATS_URL, name=f"hermes-{AGENT_ID}")
+    stop = asyncio.Event()
+
+    async def on_msg(msg):
+        try:
+            payload = json.loads(msg.data.decode())
+        except Exception:
+            payload = {"_raw": msg.data.decode(errors="replace")}
+        entry = {
+            "received_at": _now(),
+            "subject": msg.subject,
+            "reply_to": msg.reply,
+            "payload": payload,
+        }
+        fname = f"{int(time.time()*1000):013d}-{uuid.uuid4().hex[:8]}.json"
+        tmp = INBOX_DIR / (fname + ".tmp")
+        tmp.write_text(json.dumps(entry, indent=2))
+        tmp.rename(INBOX_DIR / fname)
+        sys.stderr.write(f"[bloodbank-consumer:{AGENT_ID}] {msg.subject} -> {fname}\n")
+
+    for subj in SUBJECTS:
+        await nc.subscribe(subj, cb=on_msg)
+        sys.stderr.write(f"[bloodbank-consumer:{AGENT_ID}] subscribed: {subj}\n")
+
+    # Announce presence
+    online = build_envelope(
+        "bloodbank.v1.agent.online.changed",
+        {"agent_id": AGENT_ID, "repo": REPO, "role": ROLE, "state": "online"},
+    )
+    await nc.publish("bloodbank.evt.v1.agent.online.changed", json.dumps(online).encode())
+
+    def _shutdown(*_):
+        stop.set()
+    signal.signal(signal.SIGTERM, _shutdown)
+    signal.signal(signal.SIGINT, _shutdown)
+
+    await stop.wait()
+
+    offline = build_envelope(
+        "bloodbank.v1.agent.online.changed",
+        {"agent_id": AGENT_ID, "repo": REPO, "role": ROLE, "state": "offline"},
+    )
+    await nc.publish("bloodbank.evt.v1.agent.online.changed", json.dumps(offline).encode())
+    await nc.drain()
+
+
+if __name__ == "__main__":
+    try:
+        asyncio.run(main())
+    except KeyboardInterrupt:
+        pass

package/templates/hermes-agent/template/.runtime-scaffold/decisions/.gitkeep

@@ -0,0 +1,2 @@
+# Agents drop one markdown file per important decision here.
+# Filename convention: YYYY-MM-DD-HHMMSS-<slug>.md

package/templates/hermes-agent/template/.runtime-scaffold/logs/.gitkeep

@@ -0,0 +1 @@
+# keep logs/ in the repo so per-agent log paths exist on first checkout

package/templates/hermes-agent/template/.runtime-scaffold/memories/MEMORY.md

@@ -0,0 +1,47 @@
+# MEMORY.md — {{agent_id}}
+
+This file is loaded by the gateway at the start of every session. Keep it
+short and high-signal — anything that should ALWAYS be in context.
+
+## Identity
+
+You are **{{display_name}}**, the `{{role}}` agent for the `{{repo}}` repo.
+Your scope is the repo at the project root. You communicate via Telegram
+(`@{{repo}}_{{role}}_bot`) and Bloodbank events on the
+`bloodbank.evt.v1.repo.{{repo}}.*` lane.
+
+## Operator
+
+Jarad DeLorenzo. One-man dev team. Pivots hard and fast — when documentation
+disagrees with reality, trust reality (the codebase, `git log`, `llr`/`find`
+sorted by mtime). Prefers direct, decision-forward communication. Never
+re-explains what the diff already shows. Hates "I'll help you with that"
+preambles.
+
+## DeloNet conventions you respect at all times
+
+- LAN: `192.168.1.0/24`. Host machine `big-chungus` = `192.168.1.12`.
+  Tailscale IP `100.66.29.76`. **Never hardcode `10.0.0.x`** — that's stale
+  Xfinity-era data.
+- External access: `*.delo.sh` via Cloudflare Tunnel
+  (`6dfd95af-6e2a-4833-84b8-e0a1fda5da4a`). Container-to-container uses
+  Docker service names.
+- Secrets: `op://DeLoSecrets/<item>/<field>`, `~/.config/zshyzsh/secrets.zsh`
+  (exported), or project-local `.env`. Default creds:
+  `$DEFAULT_USERNAME` / `$DEFAULT_PASSWORD`.
+- Hindsight memory: durable cross-session facts go in
+  `hindsight memory retain {{repo}} "..." --context <category>`. This file
+  is the runtime/session-start summary; Hindsight is the long-term store.
+
+## Bloodbank events you emit
+
+Always emit envelope-shaped events with `actor.agent_id = {{agent_id}}` and
+`producer = hermes-agent:{{agent_id}}` for every consequential action.
+Event type format: `bloodbank.v1.<domain>.<entity>.<action>` (5 tokens,
+lowercase, past-tense action for events). Naming spec lives at
+`~/code/33GOD/bloodbank/docs/event-naming.md`.
+
+## Recent context
+
+(This section gets updated by the agent itself as work progresses.
+Treat the bottom-most entry as the most relevant.)

package/templates/hermes-agent/template/.runtime-scaffold/memories/USER.md

@@ -0,0 +1,51 @@
+# USER.md — Jarad DeLorenzo
+
+The operator behind this agent. Loaded into context at session start so the
+agent doesn't have to re-discover who it's working with.
+
+## Identity
+
+- Name: Jarad DeLorenzo
+- Email: jaradd@gmail.com (personal), jarad@automaticai.io (business)
+- GitHub: `delorenj`
+- Telegram: see `TELEGRAM_ALLOWED_USERS` in this agent's `.env`
+- Role: One-man dev team running the 33GOD ecosystem and delonet homelab
+
+## How Jarad works
+
+- Pivots fast — instructions and architecture choices can flip between
+  sessions. Trust *current* code and `git log` over older documentation.
+- Prefers terse responses, decision-forward. No throat-clearing. No
+  "I'll help you with that". When unsure, asks one specific question, not
+  three vague ones.
+- Wants agents to act, then report. Not act, then ask if it was OK.
+- Uses Hindsight for durable memory. Expects agents to retain useful learnings
+  themselves rather than waiting to be asked.
+- Tracks confidence with `llr` (= `fdfind --type f --hidden --exclude .git -X
+  ls -lt --time=ctime -r`). Newer mtime = more authoritative.
+
+## Tooling he ships with
+
+- Copier (`gh:delorenj/CommonProject`) for new project bootstrap
+- BMAD method (`_bmad/`, `_bmad_output/`) for spec-driven work
+- Plane (`plane.delo.sh`) for ticket tracking — workspaces: 33god,
+  lasertoast, intelliforia
+- Bloodbank for cross-agent event flow
+- Hindsight for shared memory (banks: per-repo, `infra`, `33GOD`)
+- 1Password CLI (`op`) for all secrets
+- mise for env management
+
+## What he hates
+
+- Stale documentation that contradicts current state
+- Manual setup steps that should be scripted
+- Backwards-compatibility shims for code that just shipped
+- Long preambles before the actual answer
+- Hardcoded paths/IPs that break on the next machine
+
+## What he loves
+
+- Single source of truth (Holyfields-style schema registries)
+- Reproducible bootstrap (Copier + provision scripts)
+- Auto-checkpointed state (this very runtime repo!)
+- Agents that emit Bloodbank events so the rest of the system can react

package/templates/hermes-agent/template/.scripts/00-banner.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Print the welcome banner and the role we're provisioning.
+# shellcheck source=_lib.sh
+source "$(dirname "$0")/_lib.sh"
+load_role_env
+
+cat >&2 <<EOF
+
+╭─ Hermes Agent Provisioning ────────────────────────────────────────────╮
+│  agent_id    $AGENT_ID
+│  repo        $REPO
+│  role        $ROLE
+│  display     $DISPLAY_NAME
+│  telegram    @$BOT_HANDLE   (one bot per agent)
+│  plane       $PLANE_WORKSPACE workspace
+│  runtime     gh:$RUNTIME_REPO   (auto-checkpointed)
+│  profile     ~/.hermes/profiles/$PROFILE_NAME
+╰────────────────────────────────────────────────────────────────────────╯
+
+EOF
+mark_done 00-banner

package/templates/hermes-agent/template/.scripts/01-config.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Ensure the distributable config exists before any other step reads it.
+# Seeds ~/.config/hermes-agent-template/config.toml from the shipped example.
+# shellcheck source=_lib.sh
+source "$(dirname "$0")/_lib.sh"
+
+already_done 01-config && { log "[01] config already checked — skipping"; exit 0; }
+
+CONFIG="$HERMES_TEMPLATE_CONFIG"
+EXAMPLE="$ROLE_DIR/.scripts/config.example.toml"
+
+if [[ -f "$CONFIG" ]]; then
+  log "[01] config present: $CONFIG"
+else
+  mkdir -p "$(dirname "$CONFIG")"
+  if [[ -f "$EXAMPLE" ]]; then
+    cp "$EXAMPLE" "$CONFIG"
+    log "[01] seeded $CONFIG from shipped example"
+  else
+    # Last-resort minimal config if the example didn't ship with this agent.
+    cat > "$CONFIG" <<'TOML'
+# hermes-agent-template config — edit for your environment.
+[fleet]
+home = "~/.hermes"
+hermes_bin = "/home/delorenj/code/hermes-agent/.venv/bin/hermes"
+hermes_repo = "/home/delorenj/code/hermes-agent"
+fleet_env = "~/.hermes/fleet.env"
+registry_file = "~/.hermes/agents-registry.yaml"
+canonical_skills_dir = "/home/delorenj/.agents/skills"
+
+[github]
+runtime_repo_owner = "delorenj"
+
+[plane]
+base = "https://plane.delo.sh"
+workspace = "33god"
+
+[bloodbank]
+nats_host = "127.0.0.1"
+nats_port = 4222
+compose_dir = "~/code/33GOD/bloodbank"
+TOML
+    log "[01] wrote built-in default config to $CONFIG"
+  fi
+  warn "[01] review $CONFIG and set values for YOUR environment"
+  warn "     (hermes_bin, runtime_repo_owner, plane.base/workspace, …) before relying on defaults"
+fi
+
+mark_done 01-config

package/templates/hermes-agent/template/.scripts/05-fleet-env.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Ensure a single shared fleet source-of-truth file exists.
+# shellcheck source=_lib.sh
+source "$(dirname "$0")/_lib.sh"
+load_role_env
+
+already_done 05-fleet-env && log "[05] fleet env already checked — refreshing shared keys"
+
+mkdir -p "$(dirname "$FLEET_ENV")"
+
+if [[ ! -f "$FLEET_ENV" ]]; then
+  log "[05] creating fleet source-of-truth: $FLEET_ENV"
+  cat > "$FLEET_ENV" <<EOF
+# Hermes fleet source of truth.
+# All generated wrappers and provisioning scripts read this file.
+HERMES_FLEET_BIN=${HERMES_BIN}
+HERMES_FLEET_REPO=${HERMES_AGENT_REPO}
+HERMES_FLEET_HOME=${FLEET_HOME}
+HERMES_FLEET_REGISTRY_FILE=${REGISTRY_FILE}
+HERMES_FLEET_OAUTH_FILE=${HERMES_OAUTH_FILE}
+HERMES_FLEET_CODEX_HOME=${CODEX_HOME}
+EOF
+  chmod 600 "$FLEET_ENV"
+else
+  log "[05] fleet env exists: $FLEET_ENV"
+fi
+
+upsert_fleet_env() {
+  local key="$1" value="$2"
+  python3 - "$FLEET_ENV" "$key" "$value" <<'PYEOF'
+import pathlib
+import sys
+
+path = pathlib.Path(sys.argv[1])
+key = sys.argv[2]
+value = sys.argv[3]
+line = f"{key}={value}"
+lines = path.read_text().splitlines() if path.exists() else []
+for idx, existing in enumerate(lines):
+    if existing.startswith(f"{key}="):
+        lines[idx] = line
+        break
+else:
+    lines.append(line)
+path.write_text("\n".join(lines) + "\n")
+PYEOF
+}
+
+upsert_fleet_env HERMES_FLEET_HOME "$FLEET_HOME"
+upsert_fleet_env HERMES_FLEET_OAUTH_FILE "$HERMES_OAUTH_FILE"
+upsert_fleet_env HERMES_FLEET_CODEX_HOME "$CODEX_HOME"
+chmod 600 "$FLEET_ENV"
+
+mark_done 05-fleet-env

package/templates/hermes-agent/template/.scripts/10-hermes-profile.sh

@@ -0,0 +1,130 @@
+#!/usr/bin/env bash
+# Create the per-agent Hermes profile. Config inherits explicitly from the
+# default fleet profile; secrets and runtime state stay profile-local.
+# shellcheck source=_lib.sh
+source "$(dirname "$0")/_lib.sh"
+load_role_env
+
+already_done 10-hermes-profile && { log "[10] profile already created — skipping"; exit 0; }
+
+log "[10] creating hermes profile: $PROFILE_NAME"
+PROFILE_HOME="$(profile_home)"
+
+# Set repo path to directory where .git is
+REPO_PATH="$(cd "$ROLE_DIR" && git rev-parse --show-toplevel 2>/dev/null || echo "$ROLE_DIR")"
+
+if [[ -d "$PROFILE_HOME" ]]; then
+  log "    profile dir already exists; reusing"
+else
+  env HERMES_HOME="$FLEET_HOME" "$HERMES_BIN" profile create \
+    "$PROFILE_NAME" --inherit-config --no-alias
+fi
+
+# Existing profiles from older template runs may not have the inheritance
+# metadata yet. Make the operation idempotent and preserve unrelated
+# profile.yaml metadata such as descriptions.
+env HERMES_HOME="$FLEET_HOME" "$HERMES_BIN" profile config-inherit \
+  "$PROFILE_NAME" --from default
+
+# Copy local profile assets from the default profile without copying config or
+# credentials. Only config.yaml inherits; these directories remain local state.
+log "    mirroring local skills, plugins, hooks from default profile"
+for sub in skills plugins hooks cron skins; do
+  src="$FLEET_HOME/$sub"
+  dst="$PROFILE_HOME/$sub"
+  if [[ -d "$src" && "$src" != "$PROFILE_HOME"* ]]; then
+    mkdir -p "$dst"
+    # cp -R, dereferencing symlinks; -u to preserve newer if dst exists
+    cp -RLu "$src/." "$dst/" 2>/dev/null || cp -RL "$src/." "$dst/" 2>/dev/null || true
+  fi
+done
+
+# Strip any inherited gateway/runtime state so this profile boots clean.
+rm -f "$PROFILE_HOME/gateway.pid" "$PROFILE_HOME/gateway_state.json" \
+      "$PROFILE_HOME/processes.json" "$PROFILE_HOME/state.db" 2>/dev/null || true
+# Belt-and-suspenders: if a profiles/ dir somehow exists, remove it
+[[ -d "$PROFILE_HOME/profiles" ]] && rm -rf "$PROFILE_HOME/profiles"
+
+# Strip messaging-platform credentials from any existing .env left by an older
+# clone-based profile. New inherited profiles do not copy default .env at all.
+# A sub-agent must establish its OWN identity via the Wire steps
+# (30-telegram etc), never borrow the operator's default profile token.
+PROFILE_ENV="$PROFILE_HOME/.env"
+if [[ -f "$PROFILE_ENV" ]]; then
+  log "    stripping inherited platform credentials from profile .env"
+  python3 - "$PROFILE_ENV" <<'PYEOF'
+import re, sys, pathlib
+p = pathlib.Path(sys.argv[1])
+# Identity-bearing platform creds that must be per-agent, not inherited.
+keys = (
+    "SLACK_BOT_TOKEN", "SLACK_APP_TOKEN", "SLACK_ALLOWED_USERS",
+    "SLACK_SIGNING_SECRET", "SLACK_HOME_CHANNEL",
+    "TELEGRAM_BOT_TOKEN", "TELEGRAM_ALLOWED_USERS",
+    "DISCORD_BOT_TOKEN", "DISCORD_ALLOWED_USERS", "DISCORD_HOME_CHANNEL",
+    "DISCORD_HOME_CHANNEL_NAME",
+)
+# Only touch *uncommented* assignments (leave the template's `# KEY=` examples).
+pat = re.compile(r"^\s*(?:%s)=" % "|".join(keys))
+lines = p.read_text().splitlines(keepends=True)
+kept = [ln for ln in lines if not pat.match(ln)]
+if len(kept) != len(lines):
+    p.write_text("".join(kept))
+PYEOF
+  chmod 600 "$PROFILE_ENV"
+fi
+
+# Apply role-specific config overrides.
+log "    setting terminal.cwd = $REPO_PATH"
+env HERMES_HOME="$PROFILE_HOME" "$HERMES_BIN" config set terminal.cwd "$REPO_PATH"
+
+# Canonical shared-skill source of truth + local PM fallback sync.
+CANONICAL_SKILLS_DIR="${CANONICAL_SKILLS_DIR:-$(config_get fleet.canonical_skills_dir '/home/delorenj/.agents/skills')}"
+CANONICAL_PM_SKILL_SRC="$CANONICAL_SKILLS_DIR/subagent-driven-development"
+LOCAL_PM_SKILL_DST="$PROFILE_HOME/skills/software-development/subagent-driven-development"
+
+if [[ -d "$CANONICAL_SKILLS_DIR" ]]; then
+  log "    setting skills.external_dirs[0] = $CANONICAL_SKILLS_DIR"
+  env HERMES_HOME="$PROFILE_HOME" "$HERMES_BIN" config set skills.external_dirs.0 "$CANONICAL_SKILLS_DIR"
+
+  # Ensure key PM/local-ops skills are symlinked into runtime/profile skills root.
+  # This preserves canonical ownership and keeps updates instant across agents.
+  read -r -a SYMLINKED_RUNTIME_SKILLS <<< "${SYMLINKED_RUNTIME_SKILLS:-$(config_get fleet.symlinked_runtime_skills 'delonet-conventions delonet-dotenv hermes-pm-template-maintenance hindsight subagent-driven-development')}"
+  mkdir -p "$PROFILE_HOME/skills"
+
+  for skill_name in "${SYMLINKED_RUNTIME_SKILLS[@]}"; do
+    src="$CANONICAL_SKILLS_DIR/$skill_name"
+    dst="$PROFILE_HOME/skills/$skill_name"
+
+    if [[ ! -f "$src/SKILL.md" ]]; then
+      warn "    skipping runtime skill symlink (missing SKILL.md): $src"
+      continue
+    fi
+
+    if [[ -L "$dst" && "$(readlink "$dst")" == "$src" ]]; then
+      log "    runtime skill symlink already set: $dst -> $src"
+      continue
+    fi
+
+    [[ -e "$dst" || -L "$dst" ]] && rm -rf "$dst"
+    ln -s "$src" "$dst"
+    log "    symlinked runtime skill: $dst -> $src"
+  done
+else
+  warn "    canonical skills dir missing: $CANONICAL_SKILLS_DIR"
+fi
+
+if [[ -f "$CANONICAL_PM_SKILL_SRC/SKILL.md" ]]; then
+  log "    syncing canonical PM workflow skill -> $LOCAL_PM_SKILL_DST"
+  mkdir -p "$LOCAL_PM_SKILL_DST"
+  cp -f "$CANONICAL_PM_SKILL_SRC/SKILL.md" "$LOCAL_PM_SKILL_DST/SKILL.md"
+else
+  warn "    canonical PM skill missing: $CANONICAL_PM_SKILL_SRC/SKILL.md"
+fi
+
+# Install the project's SOUL.md into the profile so the agent loads it.
+if [[ -f "$ROLE_DIR/SOUL.md" ]]; then
+  cp "$ROLE_DIR/SOUL.md" "$PROFILE_HOME/SOUL.md"
+  log "    installed SOUL.md into profile"
+fi
+
+mark_done 10-hermes-profile