@delorenj/pjangler 1.1.4 → 1.2.1

package/dist/mcp-server.js

@@ -1,19 +1,17 @@
 #!/usr/bin/env node
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
 
 // src/mcp-server.ts
-import { resolve } from "node:path";
-import { existsSync as existsSync5, statSync } from "node:fs";
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { existsSync as existsSync8, mkdirSync as mkdirSync6, statSync } from "node:fs";
+import { basename as basename2, dirname as dirname7, join as join10, resolve as resolve2 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 
 // src/commands/Command.ts
+import { existsSync, writeFileSync, mkdirSync } from "fs";
+import { join, dirname } from "path";
 var Command = class {
   context;
   constructor(context) {
@@ -26,30 +24,24 @@ var Command = class {
     return this.context.dryRun ? `[DRY RUN] ${message}` : message;
   }
   fileExists(filePath) {
-    const { existsSync: existsSync6 } = __require("fs");
-    const { join: join7 } = __require("path");
-    const fullPath = join7(this.context.targetDir, filePath);
-    return existsSync6(fullPath);
+    const fullPath = join(this.context.targetDir, filePath);
+    return existsSync(fullPath);
   }
   writeFile(filePath, content) {
     if (this.context.dryRun) {
       return;
     }
-    const { writeFileSync: writeFileSync2, mkdirSync: mkdirSync3 } = __require("fs");
-    const { join: join7, dirname: dirname4 } = __require("path");
-    const fullPath = join7(this.context.targetDir, filePath);
-    const dir = dirname4(fullPath);
-    mkdirSync3(dir, { recursive: true });
-    writeFileSync2(fullPath, content);
+    const fullPath = join(this.context.targetDir, filePath);
+    const dir = dirname(fullPath);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(fullPath, content);
   }
   createDirectory(dirPath) {
     if (this.context.dryRun) {
       return;
     }
-    const { mkdirSync: mkdirSync3 } = __require("fs");
-    const { join: join7 } = __require("path");
-    const fullPath = join7(this.context.targetDir, dirPath);
-    mkdirSync3(fullPath, { recursive: true });
+    const fullPath = join(this.context.targetDir, dirPath);
+    mkdirSync(fullPath, { recursive: true });
   }
 };
 
@@ -460,32 +452,32 @@ var NodeRecipe = class extends Recipe {
 
 // src/commands/hermes/EnsureTemplateConfig.ts
 import { homedir, platform } from "node:os";
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join2, dirname as dirname2 } from "node:path";
 function resolveTemplateConfigPath() {
   const fromEnv = process.env.HERMES_TEMPLATE_CONFIG;
   if (fromEnv && fromEnv.trim()) return fromEnv.trim();
   const xdg = process.env.XDG_CONFIG_HOME?.trim();
-  const base = xdg && xdg.length ? xdg : join(homedir(), ".config");
-  return join(base, "hermes-agent-template", "config.toml");
+  const base = xdg && xdg.length ? xdg : join2(homedir(), ".config");
+  return join2(base, "hermes-agent-template", "config.toml");
 }
 function detectHermesBin(home) {
   const candidates = [
-    join(home, "code", "hermes-agent", "venv", "bin", "hermes"),
-    join(home, "code", "hermes-agent", ".venv", "bin", "hermes"),
-    join(home, ".local", "bin", "hermes")
+    join2(home, "code", "hermes-agent", "venv", "bin", "hermes"),
+    join2(home, "code", "hermes-agent", ".venv", "bin", "hermes"),
+    join2(home, ".local", "bin", "hermes")
   ];
   for (const c of candidates) {
-    if (existsSync(c)) return c;
+    if (existsSync2(c)) return c;
   }
   return candidates[0];
 }
 function renderHostConfig() {
   const home = homedir();
   const hermesBin = detectHermesBin(home);
-  const hermesRepo = join(home, "code", "hermes-agent");
-  const scaffoldDir = join(home, "code", "hermes-agent-template", "runtime-scaffold");
-  const skillsDir = join(home, ".agents", "skills");
+  const hermesRepo = join2(home, "code", "hermes-agent");
+  const scaffoldDir = join2(home, "code", "hermes-agent-template", "runtime-scaffold");
+  const skillsDir = join2(home, ".agents", "skills");
   return `# hermes-agent-template \u2014 host configuration
 # Bootstrapped by \`pjangler config bootstrap\` for $HOME=${home} (platform=${platform()}).
 #
@@ -529,7 +521,7 @@ var EnsureTemplateConfig = class extends Command {
     const ctx = this.context;
     const force = ctx.forceConfig === true || process.env.PJANGLER_FORCE_CONFIG === "1";
     const path = resolveTemplateConfigPath();
-    const exists = existsSync(path);
+    const exists = existsSync2(path);
     if (exists && !force) {
       console.log(`\u2713 Config present: ${path}`);
       return { success: true, message: "" };
@@ -539,8 +531,8 @@ var EnsureTemplateConfig = class extends Command {
       return { success: true, message: "" };
     }
     try {
-      mkdirSync(dirname(path), { recursive: true });
-      writeFileSync(path, renderHostConfig());
+      mkdirSync2(dirname2(path), { recursive: true });
+      writeFileSync2(path, renderHostConfig());
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       return { success: false, message: `\u2717 Failed to write ${path}: ${msg}` };
@@ -552,7 +544,7 @@ var EnsureTemplateConfig = class extends Command {
 };
 
 // src/commands/hermes/PromptForAgentConfig.ts
-import { basename, join as join2 } from "node:path";
+import { basename, join as join3 } from "node:path";
 import { readFileSync } from "node:fs";
 import * as p from "@clack/prompts";
 
@@ -560,12 +552,7 @@ import * as p from "@clack/prompts";
 var HERMES_AGENT_TEMPLATE = "gh:delorenj/hermes-agent-template";
 var SOUL_TONES = ["direct", "playful", "formal", "terse"];
 var ROLE_CHOICES = [
-  { value: "pm", label: "Project Manager (pm)", hint: "triage, planning, ticket authorship" },
-  {
-    value: "scrum-master",
-    label: "Scrum Master (Ticket Sentinel)",
-    hint: "continuous ticket sentinel + autonomous delegated review"
-  },
+  { value: "pm", label: "Project Manager (pm)", hint: "triage, planning, ticket authorship, board reconciliation" },
   { value: "dev", label: "Developer (dev)", hint: "implements tickets" },
   { value: "review", label: "Reviewer (review)", hint: "adversarial code review" },
   { value: "ops", label: "Ops (ops)", hint: "deploy / infra" },
@@ -586,7 +573,7 @@ function deriveProfileName(repo, role) {
 // src/commands/hermes/PromptForAgentConfig.ts
 function detectTicketProvider(targetDir) {
   try {
-    const t = JSON.parse(readFileSync(join2(targetDir, ".project.json"), "utf8"))?.ticket_provider?.type;
+    const t = JSON.parse(readFileSync(join3(targetDir, ".project.json"), "utf8"))?.ticket_provider?.type;
     return t === "plane" || t === "linear" || t === "trello" ? t : void 0;
   } catch {
     return void 0;
@@ -605,7 +592,6 @@ var PromptForAgentConfig = class extends Command {
       ctx.modelProvider ??= "";
       ctx.modelName ??= "";
       ctx.ticketProvider ??= detectTicketProvider(ctx.targetDir) ?? "plane";
-      ctx.withScrumMaster ??= false;
       ctx.skipTelegram ??= true;
       ctx.skipEmail ??= true;
       ctx.agentId = deriveAgentId(ctx.targetRepo, ctx.role);
@@ -651,14 +637,6 @@ var PromptForAgentConfig = class extends Command {
       if (p.isCancel(answer)) return this.cancelled();
       ctx.ticketProvider = answer;
     }
-    if (ctx.role === "pm" && ctx.withScrumMaster === void 0) {
-      const answer = await p.confirm({
-        message: "Also provision the paired Scrum Master (Ticket Sentinel) for this repo?",
-        initialValue: true
-      });
-      if (p.isCancel(answer)) return this.cancelled();
-      ctx.withScrumMaster = answer === true;
-    }
     if (!ctx.agentPurpose) {
       const answer = await p.text({
         message: "One-line purpose",
@@ -731,21 +709,21 @@ var PromptForAgentConfig = class extends Command {
 // src/commands/hermes/RunCopierTemplate.ts
 import { spawnSync } from "node:child_process";
 import { homedir as homedir2 } from "node:os";
-import { join as join3, dirname as dirname2 } from "node:path";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2 } from "node:fs";
+import { join as join4, dirname as dirname3 } from "node:path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3 } from "node:fs";
 import { fileURLToPath } from "node:url";
 import * as p2 from "@clack/prompts";
 function resolveVendoredTemplate(name) {
   let dir;
   try {
-    dir = dirname2(fileURLToPath(import.meta.url));
+    dir = dirname3(fileURLToPath(import.meta.url));
   } catch {
     return void 0;
   }
   for (let i = 0; i < 8; i++) {
-    const candidate = join3(dir, "templates", name);
-    if (existsSync2(join3(candidate, "copier.yml"))) return candidate;
-    const parent = dirname2(dir);
+    const candidate = join4(dir, "templates", name);
+    if (existsSync3(join4(candidate, "copier.yml"))) return candidate;
+    const parent = dirname3(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -757,14 +735,13 @@ var RunCopierTemplate = class extends Command {
     const { targetRepo, role, agentPurpose, soulTone, modelProvider, modelName } = ctx;
     const ticketProvider = ctx.ticketProvider ?? "plane";
     const profileName = ctx.profileName ?? (targetRepo && role ? deriveProfileName(targetRepo, role) : void 0);
-    const withScrumMaster = role === "pm" && ctx.withScrumMaster === true;
     if (!targetRepo || !role) {
       return {
         success: false,
         message: "PromptForAgentConfig must run before RunCopierTemplate (targetRepo/role unset)"
       };
     }
-    const roleDir = join3(ctx.targetDir, "agents", "hermes", role);
+    const roleDir = join4(ctx.targetDir, "agents", "hermes", role);
     ctx.roleDir = roleDir;
     ctx.runtimeRepo = `delorenj/agent-hm-${targetRepo}-${role}`;
     const which = spawnSync("which", ["copier"], { encoding: "utf8" });
@@ -774,7 +751,7 @@ var RunCopierTemplate = class extends Command {
         message: "\u2717 copier not found on PATH.  Install with: `uv tool install copier` or `pip install copier`"
       };
     }
-    if (existsSync2(join3(roleDir, "role.yaml")) && !ctx.force) {
+    if (existsSync3(join4(roleDir, "role.yaml")) && !ctx.force) {
       if (ctx.yes) {
         ctx.force = true;
       } else {
@@ -801,9 +778,9 @@ var RunCopierTemplate = class extends Command {
       SKIP_BLOODBANK: ctx.skipBloodbank ? "1" : "0",
       SKIP_SYSTEMD: ctx.skipSystemd ? "1" : "0"
     };
-    const LOCAL_TEMPLATE = join3(homedir2(), "code", "hermes-agent-template");
+    const LOCAL_TEMPLATE = join4(homedir2(), "code", "hermes-agent-template");
     const vendored = resolveVendoredTemplate("hermes-agent");
-    const templateSrc = process.env.PJANGLER_HERMES_TEMPLATE || vendored || (existsSync2(join3(LOCAL_TEMPLATE, "copier.yml")) ? LOCAL_TEMPLATE : HERMES_AGENT_TEMPLATE);
+    const templateSrc = process.env.PJANGLER_HERMES_TEMPLATE || vendored || (existsSync3(join4(LOCAL_TEMPLATE, "copier.yml")) ? LOCAL_TEMPLATE : HERMES_AGENT_TEMPLATE);
     const args = [
       "copy",
       templateSrc,
@@ -824,8 +801,6 @@ var RunCopierTemplate = class extends Command {
       `soul_tone=${soulTone ?? "direct"}`,
       "--data",
       `ticket_provider=${ticketProvider}`,
-      "--data",
-      `with_scrum_master=${withScrumMaster}`,
       "--trust",
       "--vcs-ref=HEAD"
     ];
@@ -836,7 +811,7 @@ var RunCopierTemplate = class extends Command {
         message: this.formatMessage(`Would run: copier ${args.join(" ")}`)
       };
     }
-    mkdirSync2(join3(ctx.targetDir, "agents", "hermes"), { recursive: true });
+    mkdirSync3(join4(ctx.targetDir, "agents", "hermes"), { recursive: true });
     const spinner4 = p2.spinner();
     spinner4.start(`Running copier copy  (target: agents/hermes/${role})`);
     const result = spawnSync("copier", args, {
@@ -861,8 +836,8 @@ var RunCopierTemplate = class extends Command {
 
 // src/commands/hermes/WireTelegram.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { join as join4 } from "node:path";
-import { existsSync as existsSync3, unlinkSync } from "node:fs";
+import { join as join5 } from "node:path";
+import { existsSync as existsSync4, unlinkSync } from "node:fs";
 import * as p3 from "@clack/prompts";
 var WireTelegram = class extends Command {
   async invoke() {
@@ -950,15 +925,15 @@ var WireTelegram = class extends Command {
     if (p3.isCancel(allowedAnswer)) {
       return { success: false, message: "\u2717 Aborted; Telegram step deferred." };
     }
-    const script = join4(roleDir, ".scripts", "30-telegram.sh");
-    if (!existsSync3(script)) {
+    const script = join5(roleDir, ".scripts", "30-telegram.sh");
+    if (!existsSync4(script)) {
       return {
         success: false,
         message: `\u2717 ${script} not found.  Did copier finish?  Re-run with --skip-runtime-repo=0 if you skipped it.`
       };
     }
-    const marker = join4(roleDir, ".scripts", ".done-30-telegram");
-    if (existsSync3(marker)) unlinkSync(marker);
+    const marker = join5(roleDir, ".scripts", ".done-30-telegram");
+    if (existsSync4(marker)) unlinkSync(marker);
     const spinner4 = p3.spinner();
     spinner4.start("Verifying token + wiring profile");
     const result = spawnSync2("bash", [script], {
@@ -985,8 +960,8 @@ function cap(s) {
 
 // src/commands/hermes/WireEmail.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { join as join5 } from "node:path";
-import { existsSync as existsSync4, unlinkSync as unlinkSync2 } from "node:fs";
+import { join as join6 } from "node:path";
+import { existsSync as existsSync5, unlinkSync as unlinkSync2 } from "node:fs";
 import * as p4 from "@clack/prompts";
 var WireEmail = class extends Command {
   async invoke() {
@@ -1001,8 +976,8 @@ var WireEmail = class extends Command {
     if (!targetRepo || !role || !roleDir) {
       return { success: false, message: "Cannot wire email: missing target_repo/role/roleDir" };
     }
-    const script = join5(roleDir, ".scripts", "50-email.sh");
-    if (!existsSync4(script)) {
+    const script = join6(roleDir, ".scripts", "50-email.sh");
+    if (!existsSync5(script)) {
       return { success: false, message: `\u2717 ${script} not found` };
     }
     let token = process.env.CF_EMAIL_ROUTING_TOKEN;
@@ -1064,8 +1039,8 @@ var WireEmail = class extends Command {
         }
       }
     }
-    const marker = join5(roleDir, ".scripts", ".done-50-email");
-    if (existsSync4(marker)) unlinkSync2(marker);
+    const marker = join6(roleDir, ".scripts", ".done-50-email");
+    if (existsSync5(marker)) unlinkSync2(marker);
     const spinner4 = p4.spinner();
     spinner4.start("Creating Cloudflare Email Routing rule");
     const result = spawnSync3("bash", [script], {
@@ -1094,7 +1069,7 @@ var PrintHermesSummary = class extends Command {
     const email = `${targetRepo}-${role}@delo.sh`;
     const gw = `hermes-${agentId}-gateway.service`;
     const csm = `hermes-${agentId}-consumer.service`;
-    const ckpt = `hermes-${agentId}-checkpoint.timer`;
+    const hb = `hermes-${agentId}-heartbeat.timer`;
     const lines = [];
     lines.push(`agent_id     ${agentId}`);
     lines.push(`role dir     ${ctx.roleDir}`);
@@ -1104,7 +1079,7 @@ var PrintHermesSummary = class extends Command {
     lines.push("");
     lines.push("Start daemons:");
     lines.push(`  systemctl --user start ${csm}`);
-    lines.push(`  systemctl --user start ${ckpt}`);
+    lines.push(`  systemctl --user start ${hb}`);
     if (!skipTelegram) {
       lines.push(`  systemctl --user start ${gw}`);
     } else {
@@ -1151,6 +1126,193 @@ var HermesAgentRecipe = class extends Recipe {
   }
 };
 
+// src/commands/AgentHooksCommands.ts
+import { homedir as homedir3 } from "node:os";
+import { join as join7, dirname as dirname4 } from "node:path";
+import { existsSync as existsSync6, cpSync, mkdirSync as mkdirSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+function resolveTemplateRoot() {
+  const candidates = [];
+  if (process.env.PJANGLER_COMMONPROJECT_TEMPLATE) {
+    candidates.push(process.env.PJANGLER_COMMONPROJECT_TEMPLATE);
+  }
+  try {
+    let dir = dirname4(fileURLToPath2(import.meta.url));
+    for (let i = 0; i < 8; i++) {
+      candidates.push(join7(dir, "templates", "commonproject", "template"));
+      const parent = dirname4(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  } catch {
+  }
+  candidates.push(join7(homedir3(), "code", "pjangler", "templates", "commonproject", "template"));
+  for (const c of candidates) {
+    if (existsSync6(join7(c, ".agents", "hooks", "hooks.master.json"))) return c;
+  }
+  throw new Error(
+    "Could not locate the CommonProject template. Set PJANGLER_COMMONPROJECT_TEMPLATE to <repo>/templates/commonproject/template."
+  );
+}
+var CopyAgentHooksTree = class extends Command {
+  async invoke() {
+    let templateRoot;
+    try {
+      templateRoot = resolveTemplateRoot();
+    } catch (e) {
+      return { success: false, message: `\u26A0\uFE0F  ${e.message}` };
+    }
+    const items = [
+      { rel: ".agents/hooks", dir: true },
+      { rel: ".agents/local.example.json", dir: false },
+      { rel: ".mise/scripts/link-project-skills-to-clis.sh", dir: false },
+      { rel: ".mise/scripts/unlink-project-skills-from-clis.sh", dir: false },
+      { rel: ".mise/scripts/hindsight-setup.sh", dir: false }
+    ];
+    const created = [];
+    const skipped = [];
+    for (const { rel, dir } of items) {
+      const src = join7(templateRoot, rel);
+      const dest = join7(this.context.targetDir, rel);
+      if (!existsSync6(src)) continue;
+      if (existsSync6(dest) && !this.context.force) {
+        skipped.push(rel);
+        continue;
+      }
+      if (!this.context.dryRun) {
+        mkdirSync4(dirname4(dest), { recursive: true });
+        cpSync(src, dest, { recursive: dir, force: true });
+      }
+      created.push(rel);
+    }
+    const verb = this.context.dryRun ? "Would copy" : "Copied";
+    const tail = skipped.length ? ` (${skipped.length} already present \u2014 use --force to overwrite)` : "";
+    return {
+      success: created.length > 0,
+      message: this.formatMessage(`\u2705 ${verb} ${created.length} agent-hooks path(s)${tail}`)
+    };
+  }
+};
+var WireMiseAgentHooks = class _WireMiseAgentHooks extends Command {
+  static MARKER = "# pjangler:agent-hooks";
+  static CR = "{{config_root}}";
+  // mise's own runtime var — emitted literally
+  async invoke() {
+    const misePath = join7(this.context.targetDir, "mise.toml");
+    if (!existsSync6(misePath)) {
+      return {
+        success: false,
+        message: "\u26A0\uFE0F  No mise.toml found \u2014 run `pjangler init mise` first, then re-run."
+      };
+    }
+    let content = readFileSync2(misePath, "utf8");
+    if (content.includes(_WireMiseAgentHooks.MARKER)) {
+      return { success: true, message: this.formatMessage("\u2713 mise.toml already wired for agent-hooks") };
+    }
+    const cr = _WireMiseAgentHooks.CR;
+    const enterAdds = [
+      `  "${cr}/.mise/scripts/link-project-skills-to-clis.sh",`,
+      `  "${cr}/.agents/hooks/sync.py --install --quiet",`
+    ].join("\n");
+    const leaveBlock = [
+      "leave = [",
+      `  "${cr}/.mise/scripts/unlink-project-skills-from-clis.sh",`,
+      `  "${cr}/.agents/hooks/sync.py --uninstall --quiet",`,
+      "]"
+    ].join("\n");
+    let wiredHooks = false;
+    const enterRe = /(enter\s*=\s*\[[\s\S]*?)(\n[ \t]*\])/;
+    if (enterRe.test(content)) {
+      content = content.replace(enterRe, (_m, head, close) => {
+        const sep = /[,[]\s*$/.test(head) ? "" : ",";
+        return `${head}${sep}
+${enterAdds}${close}`;
+      });
+      const leaveRe = /(leave\s*=\s*\[[\s\S]*?)(\n[ \t]*\])/;
+      if (leaveRe.test(content)) {
+        content = content.replace(leaveRe, (_m, head, close) => {
+          const sep = /[,[]\s*$/.test(head) ? "" : ",";
+          return `${head}${sep}
+  "${cr}/.mise/scripts/unlink-project-skills-from-clis.sh",
+  "${cr}/.agents/hooks/sync.py --uninstall --quiet",${close}`;
+        });
+      } else {
+        content = content.replace(enterRe, (m) => `${m}
+${leaveBlock}`);
+      }
+      wiredHooks = true;
+    }
+    const appended = [
+      "",
+      _WireMiseAgentHooks.MARKER + " (generated \u2014 see .agents/hooks/README.md)",
+      "[[watch_files]]",
+      'patterns = [".agents/hooks/hooks.master.json"]',
+      'task = "hooks-sync"',
+      "",
+      "[tasks.hooks-sync]",
+      'description = "Fan out hooks.master.json to each agent CLI (claude/codex/kimi/hermes)"',
+      `run = "${cr}/.agents/hooks/sync.py --install"`,
+      "",
+      "[tasks.hooks-check]",
+      'description = "Drift gate: verify generated hook configs match hooks.master.json"',
+      `run = "${cr}/.agents/hooks/sync.py --check"`,
+      "",
+      "[tasks.hooks-uninstall]",
+      'description = "Remove per-user agent-hook injections (codex/kimi/hermes)"',
+      `run = "${cr}/.agents/hooks/sync.py --uninstall"`,
+      "",
+      "[tasks.link-project-skills-to-clis]",
+      'description = "Fan .agents/skills out to each agent CLI (honors local.json)"',
+      `run = "${cr}/.mise/scripts/link-project-skills-to-clis.sh"`,
+      "",
+      "[tasks.unlink-project-skills-from-clis]",
+      'description = "Remove project skill symlinks from shared per-CLI dirs"',
+      `run = "${cr}/.mise/scripts/unlink-project-skills-from-clis.sh"`,
+      "",
+      "[tasks.skills-relink]",
+      'description = "Re-fan the project skill set to all CLIs"',
+      `run = "${cr}/.mise/scripts/link-project-skills-to-clis.sh"`,
+      "",
+      "[tasks.hindsight-setup]",
+      `description = "Provision this dev's shared project Hindsight key from 1Password into .env"`,
+      `run = "${cr}/.mise/scripts/hindsight-setup.sh"`,
+      "",
+      _WireMiseAgentHooks.MARKER + ":end",
+      ""
+    ].join("\n");
+    content = content.replace(/\n*$/, "\n") + appended;
+    if (!this.context.dryRun) writeFileSync3(misePath, content);
+    if (wiredHooks) {
+      return { success: true, message: this.formatMessage("\u2705 Wired mise.toml ([hooks] enter/leave + tasks)") };
+    }
+    return {
+      success: true,
+      message: this.formatMessage(
+        `\u2705 Added agent-hooks tasks to mise.toml.
+   \u26A0\uFE0F  Could not find a [hooks].enter array to extend \u2014 add these to your [hooks] block manually:
+     enter += "${cr}/.mise/scripts/link-project-skills-to-clis.sh", "${cr}/.agents/hooks/sync.py --install --quiet"
+     leave += "${cr}/.mise/scripts/unlink-project-skills-from-clis.sh", "${cr}/.agents/hooks/sync.py --uninstall --quiet"`
+      )
+    };
+  }
+};
+
+// src/recipes/AgentHooksRecipe.ts
+var AgentHooksRecipe = class extends Recipe {
+  constructor(context) {
+    super(context);
+    this.addIngredient(CopyAgentHooksTree).addIngredient(WireMiseAgentHooks);
+  }
+  printNextSteps() {
+    console.log("\u{1FA9D} Agent-hooks layer installed!");
+    console.log("   Next steps:");
+    console.log("   1. mise run hooks-sync   # generate .claude/settings.json + inject codex/kimi/hermes");
+    console.log("   2. git add .claude/settings.json .agents/hooks && commit (codex/kimi/hermes are per-dev)");
+    console.log("   3. mise run hindsight-setup   # set HINDSIGHT_OP_KEY_REF to your 1Password item first");
+    console.log(`   4. If you run a global agent system: echo '{"skills":{"defer_to_global":true}}' > .agents/local.json`);
+  }
+};
+
 // src/utils/registry.ts
 var RECIPE_REGISTRY = {
   mise: {
@@ -1184,9 +1346,27 @@ var RECIPE_REGISTRY = {
       "WireEmail",
       "PrintHermesSummary"
     ]
+  },
+  "agent-hooks": {
+    name: "agent-hooks",
+    description: "Retrofit the project-scoped agent-hooks + skill fan-out layer (Claude/Codex/Kimi/Hermes hooks via mise enter/leave)",
+    class: AgentHooksRecipe,
+    commands: ["CopyAgentHooksTree", "WireMiseAgentHooks"]
   }
 };
 var COMMAND_REGISTRY = {
+  CopyAgentHooksTree: {
+    name: "CopyAgentHooksTree",
+    description: "Copy the generic agent-hooks tree (hooks SSOT + sync engine + scripts) from the CommonProject template",
+    group: "agent-hooks",
+    class: CopyAgentHooksTree
+  },
+  WireMiseAgentHooks: {
+    name: "WireMiseAgentHooks",
+    description: "Merge agent-hooks enter/leave + tasks into an existing mise.toml (idempotent)",
+    group: "agent-hooks",
+    class: WireMiseAgentHooks
+  },
   AddDockerfile: {
     name: "AddDockerfile",
     description: "Create Dockerfile for containerization",
@@ -1249,18 +1429,18 @@ function createRecipe(name, context) {
 }
 
 // src/utils/version.ts
-import { readFileSync as readFileSync2 } from "node:fs";
-import { dirname as dirname3, join as join6 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { readFileSync as readFileSync3 } from "node:fs";
+import { dirname as dirname5, join as join8 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 var PJANGLER_VERSION = (() => {
   try {
-    let dir = dirname3(fileURLToPath2(import.meta.url));
+    let dir = dirname5(fileURLToPath3(import.meta.url));
     for (let i = 0; i < 4; i++) {
       try {
-        const raw = readFileSync2(join6(dir, "package.json"), "utf8");
+        const raw = readFileSync3(join8(dir, "package.json"), "utf8");
         return JSON.parse(raw).version ?? "0.0.0";
       } catch {
-        const parent = dirname3(dir);
+        const parent = dirname5(dir);
         if (parent === dir) break;
         dir = parent;
       }
@@ -1270,14 +1450,1150 @@ var PJANGLER_VERSION = (() => {
   return "0.0.0";
 })();
 
+// src/parity/index.ts
+import { existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync5, readFileSync as readFileSync4, readlinkSync, readdirSync, renameSync, symlinkSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4, chmodSync, copyFileSync } from "node:fs";
+import { dirname as dirname6, join as join9, relative, resolve } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { homedir as homedir4 } from "node:os";
+import { spawnSync as spawnSync4 } from "node:child_process";
+var LINK_AGENTFILES_BLOCK = `# This block will handle the linking of
+# agent files to the main AGENTS.md file.
+#
+# TODO: Ensure this works for all levels of nesting.
+# i.e. All linked agent files MUST be siblings at
+# any given level of nesting.
+[hooks]
+enter = [
+  "{{config_root}}/.mise/scripts/link-agentfiles.sh",
+  "op inject -i .env.op > .env",
+]
+
+[[watch_files]]
+patterns = ["AGENTS.md"]
+task = "link-agentfiles"
+
+[tasks.link-agentfiles]
+description = "Symlink all agent files to AGENTS.md"
+run = "{{config_root}}/.mise/scripts/link-agentfiles.sh"`;
+var VERSIONING_BLOCK = `# >>> mise-versioning >>>  (managed block \u2014 do not edit by hand; re-run init to update)
+[tasks."version"]
+description = "Print the current version (vX.Y.Z)"
+run = "{{config_root}}/.mise/scripts/versioning.sh current"
+
+[tasks."version:bump"]
+description = "Bump patch version: vX.Y.Z -> vX.Y.(Z+1)"
+alias = "version:bump-patch"
+run = "{{config_root}}/.mise/scripts/versioning.sh bump patch"
+
+[tasks."version:bump-minor"]
+description = "Bump minor version: vX.Y.Z -> vX.(Y+1).0"
+run = "{{config_root}}/.mise/scripts/versioning.sh bump minor"
+
+[tasks."version:bump-major"]
+description = "Bump major version: vX.Y.Z -> v(X+1).0.0"
+run = "{{config_root}}/.mise/scripts/versioning.sh bump major"
+
+[tasks."version:check"]
+description = "Verify every versioned file is in parity"
+run = "{{config_root}}/.mise/scripts/versioning.sh check"
+
+[tasks."version:sync"]
+description = "Force every versioned file up to the highest version"
+run = "{{config_root}}/.mise/scripts/versioning.sh sync"
+# <<< mise-versioning <<<`;
+function resolvePjanglerRoot() {
+  let dir = dirname6(fileURLToPath4(import.meta.url));
+  while (dir !== dirname6(dir)) {
+    if (existsSync7(join9(dir, "package.json")) && existsSync7(join9(dir, "templates", "commonproject", "copier.yml"))) {
+      return dir;
+    }
+    dir = dirname6(dir);
+  }
+  throw new Error("Unable to resolve pjangler root");
+}
+function normalizeNewlines(value) {
+  return value.replace(/\r\n/g, "\n");
+}
+function readText(path) {
+  return normalizeNewlines(readFileSync4(path, "utf8"));
+}
+function safeReadText(path) {
+  return existsSync7(path) ? readText(path) : null;
+}
+function ensureParent(path) {
+  mkdirSync5(dirname6(path), { recursive: true });
+}
+function writeText(path, content) {
+  ensureParent(path);
+  writeFileSync4(path, content);
+}
+function tryParseJson(text3) {
+  if (!text3) return null;
+  try {
+    return JSON.parse(text3);
+  } catch {
+    return null;
+  }
+}
+function slugifyRepoName(name) {
+  return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "project";
+}
+function titleCaseSlug(slug) {
+  return slug.split(/[-_]/g).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+}
+function readSymlinkTarget(path) {
+  if (!existsSync7(path)) return null;
+  try {
+    return readlinkSync(path);
+  } catch {
+    return null;
+  }
+}
+function ensureSymlink(path, target, dryRun) {
+  if (existsSync7(path)) {
+    const stat = lstatSync(path);
+    if (stat.isSymbolicLink()) {
+      const current = readSymlinkTarget(path);
+      if (current === target) return { changed: false };
+      if (!dryRun) {
+        unlinkSync3(path);
+        symlinkSync(target, path);
+      }
+      return { changed: true };
+    }
+    return { changed: false, blocked: `${relative(process.cwd(), path) || path} exists and is not a symlink` };
+  }
+  if (!dryRun) symlinkSync(target, path);
+  return { changed: true };
+}
+function bootstrapAgentsFile(repoRoot, dryRun) {
+  const agentsPath = join9(repoRoot, "AGENTS.md");
+  if (existsSync7(agentsPath)) return { changedFiles: [], details: [] };
+  for (const file of ["CLAUDE.md", "GEMINI.md"]) {
+    const source = join9(repoRoot, file);
+    if (!existsSync7(source)) continue;
+    const stat = lstatSync(source);
+    if (stat.isSymbolicLink()) continue;
+    if (stat.isFile()) {
+      if (!dryRun) renameSync(source, agentsPath);
+      return { changedFiles: [agentsPath], details: [`Moved ${file} to AGENTS.md before wiring agent-file symlinks`] };
+    }
+    return { changedFiles: [], details: [], blocked: `${file} exists but is not a regular file; cannot promote to AGENTS.md` };
+  }
+  const readmePath = join9(repoRoot, "README.md");
+  if (existsSync7(readmePath)) {
+    const stat = lstatSync(readmePath);
+    if (!stat.isFile()) return { changedFiles: [], details: [], blocked: "README.md exists but is not a regular file; cannot copy to AGENTS.md" };
+    if (!dryRun) copyFileSync(readmePath, agentsPath);
+    return { changedFiles: [agentsPath], details: ["Copied README.md to AGENTS.md before wiring agent-file symlinks"] };
+  }
+  return { changedFiles: [], details: [], blocked: "AGENTS.md missing and no CLAUDE.md, GEMINI.md, or README.md source exists" };
+}
+function yamlGet(text3, keyPath) {
+  const parts = keyPath.split(".");
+  const lines = text3.split("\n");
+  let start = 0;
+  let indent = 0;
+  for (let idx = 0; idx < parts.length; idx += 1) {
+    const key = parts[idx];
+    let found = false;
+    for (let i = start; i < lines.length; i += 1) {
+      const line = lines[i];
+      if (!line.trim() || line.trim().startsWith("#")) continue;
+      const match = line.match(/^(\s*)([^:#]+):\s*(.*)$/);
+      if (!match) continue;
+      const currentIndent = match[1].length;
+      const currentKey = match[2].trim();
+      const rest = match[3].trim();
+      if (idx > 0 && currentIndent < indent) break;
+      if (currentIndent !== indent || currentKey !== key) continue;
+      found = true;
+      if (idx === parts.length - 1) {
+        return rest.replace(/^['"]|['"]$/g, "").trim();
+      }
+      start = i + 1;
+      indent = currentIndent + 2;
+      break;
+    }
+    if (!found) return "";
+  }
+  return "";
+}
+function discoverRoles(repoRoot) {
+  const rolesDir = join9(repoRoot, "agents", "hermes");
+  if (!existsSync7(rolesDir)) return [];
+  return readdirSync(rolesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => {
+    const roleDir = join9(rolesDir, entry.name);
+    const roleYamlPath = join9(roleDir, "role.yaml");
+    if (!existsSync7(roleYamlPath)) return null;
+    const text3 = readText(roleYamlPath);
+    const runtimeRepoRaw = yamlGet(text3, "runtime.github_repo");
+    return {
+      role: yamlGet(text3, "role") || entry.name,
+      roleDir,
+      roleYamlPath,
+      repo: yamlGet(text3, "repo"),
+      agentId: yamlGet(text3, "agent_id"),
+      profileName: yamlGet(text3, "profile") || yamlGet(text3, "agent_id"),
+      displayName: yamlGet(text3, "display_name"),
+      purpose: yamlGet(text3, "purpose"),
+      botHandle: yamlGet(text3, "telegram.bot_username"),
+      runtimeRepo: runtimeRepoRaw.includes("/") ? runtimeRepoRaw.split("/").slice(-1)[0] ?? runtimeRepoRaw : runtimeRepoRaw,
+      runtimeOwner: yamlGet(text3, "runtime.github_owner"),
+      planeWorkspace: yamlGet(text3, "ticket_provider.workspace") || yamlGet(text3, "plane.workspace"),
+      ticketProviderName: yamlGet(text3, "ticket_provider.name"),
+      ticketProviderBoardId: yamlGet(text3, "ticket_provider.board_id"),
+      ticketProviderBoardUrl: yamlGet(text3, "ticket_provider.board_url"),
+      ticketProviderIdentifier: yamlGet(text3, "plane.identifier")
+    };
+  }).filter((value) => Boolean(value));
+}
+function registryPath(homeDir) {
+  return join9(homeDir, ".hermes", "agents-registry.yaml");
+}
+function systemctlUser(args) {
+  const result = spawnSync4("systemctl", ["--user", ...args], { encoding: "utf8" });
+  return {
+    ok: result.status === 0,
+    stdout: result.stdout.trim(),
+    stderr: result.stderr.trim()
+  };
+}
+function templateScript(ctx, name) {
+  const source = join9(ctx.pjanglerRoot, ".mise", "scripts", name);
+  return existsSync7(source) ? readText(source) : void 0;
+}
+function templateVersioningScript(ctx) {
+  return templateScript(ctx, "versioning.sh");
+}
+function templateLinkAgentfilesScript(ctx) {
+  return templateScript(ctx, "link-agentfiles.sh");
+}
+function templateVersionFilesConf(ctx, repoRoot) {
+  const packageJson = join9(repoRoot, "package.json");
+  return existsSync7(packageJson) ? "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\njson package.json\ngittag .\n" : "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\ngittag .\n";
+}
+function replaceOrAppendManagedBlock(text3, startMarker, block, beforePattern) {
+  if (startMarker.test(text3)) {
+    return text3.replace(/# >>> mise-versioning >>>[\s\S]*?# <<< mise-versioning <<</, block);
+  }
+  if (beforePattern) {
+    const match = text3.match(beforePattern);
+    if (match && typeof match.index === "number") {
+      return `${text3.slice(0, match.index).replace(/\s*$/, "\n\n")}${block}
+
+${text3.slice(match.index)}`;
+    }
+  }
+  return `${text3.replace(/\s*$/, "")}
+
+${block}
+`;
+}
+var BASE_MISE_PATH_ENTRIES = [".mise/scripts", "agents/hermes/pm"];
+var CONDITIONAL_HERMES_PATHS = ["agents/hermes/pm/hermes", "agent/hermes/pm/hermes"];
+function requiredMisePathEntries(ctx) {
+  const required = [...BASE_MISE_PATH_ENTRIES];
+  for (const candidate of CONDITIONAL_HERMES_PATHS) {
+    if (existsSync7(join9(ctx.repoRoot, candidate)) && !required.includes(candidate)) required.push(candidate);
+  }
+  return required;
+}
+function upsertMisePath(text3, required = BASE_MISE_PATH_ENTRIES) {
+  const render = (values) => `_.path = [${values.map((value) => JSON.stringify(value)).join(", ")}]`;
+  const envMatch = text3.match(/(^|\n)(\[env\][\s\S]*?)(?=\n\[[^\]]+\]|$)/);
+  if (!envMatch || typeof envMatch.index !== "number") {
+    return `[env]
+${render(required)}
+
+${text3.replace(/^\s+/, "")}`;
+  }
+  const prefix = text3.slice(0, envMatch.index + envMatch[1].length);
+  const section = envMatch[2];
+  const suffix = text3.slice(envMatch.index + envMatch[1].length + section.length);
+  const pathLine = section.match(/^_\.path\s*=\s*\[([^\]]*)\]\s*$/m);
+  if (!pathLine) {
+    return `${prefix}${section.replace(/\n?$/, "\n")}${render(required)}${suffix}`;
+  }
+  const current = [...pathLine[1].matchAll(/"([^"]+)"/g)].map((match) => match[1]);
+  const merged = [...current];
+  for (const value of required) {
+    if (!merged.includes(value)) merged.push(value);
+  }
+  const nextLine = render(merged);
+  if (pathLine[0] === nextLine) return text3;
+  return `${prefix}${section.replace(pathLine[0], nextLine)}${suffix}`;
+}
+function upsertLinkAgentfilesBlock(text3, ctx) {
+  const withPath = upsertMisePath(text3, requiredMisePathEntries(ctx));
+  const existing = /# This block will handle the linking of[\s\S]*?\[tasks\.link-agentfiles\][\s\S]*?run = "\{\{config_root\}\}\/\.mise\/scripts\/link-agentfiles\.sh"/;
+  if (existing.test(withPath)) {
+    return withPath.replace(existing, LINK_AGENTFILES_BLOCK);
+  }
+  const versioningIndex = withPath.indexOf("# >>> mise-versioning >>>");
+  if (versioningIndex >= 0) {
+    return `${withPath.slice(0, versioningIndex).replace(/\s*$/, "\n\n")}${LINK_AGENTFILES_BLOCK}
+
+${withPath.slice(versioningIndex)}`;
+  }
+  return `${withPath.replace(/\s*$/, "")}
+
+${LINK_AGENTFILES_BLOCK}
+`;
+}
+function readProjectJson(ctx) {
+  return tryParseJson(safeReadText(join9(ctx.repoRoot, ".project.json")));
+}
+function canonicalProjectJson(ctx) {
+  const roles = discoverRoles(ctx.repoRoot);
+  const existing = readProjectJson(ctx) ?? {};
+  const slug = String(existing.project_slug ?? slugifyRepoName(dirname6(ctx.repoRoot) === ctx.repoRoot ? ctx.repoRoot.split("/").pop() ?? "project" : ctx.repoRoot.split("/").pop() ?? "project"));
+  const firstRole = roles[0];
+  const ticketProvider = {
+    type: String((existing.ticket_provider?.type ?? firstRole?.ticketProviderName ?? "plane") || "plane"),
+    workspace: String((existing.ticket_provider?.workspace ?? firstRole?.planeWorkspace ?? "") || ""),
+    identifier: String((existing.ticket_provider?.identifier ?? firstRole?.ticketProviderIdentifier ?? "") || ""),
+    board_id: String((existing.ticket_provider?.board_id ?? firstRole?.ticketProviderBoardId ?? "") || ""),
+    board_url: String((existing.ticket_provider?.board_url ?? firstRole?.ticketProviderBoardUrl ?? "") || "")
+  };
+  return {
+    project_name: String(existing.project_name ?? titleCaseSlug(slug)),
+    project_description: String(existing.project_description ?? ""),
+    project_slug: slug,
+    repo_path: ctx.repoRoot,
+    ticket_provider: ticketProvider,
+    agents: Object.fromEntries(
+      roles.map((role) => [
+        role.agentId || `${slug}-${role.role}`,
+        {
+          role: role.role,
+          role_dir: relative(ctx.repoRoot, role.roleDir)
+        }
+      ])
+    )
+  };
+}
+function projectJsonFinding(ctx) {
+  const projectPath = join9(ctx.repoRoot, ".project.json");
+  const planeJsonPath = join9(ctx.repoRoot, ".plane.json");
+  const details = [];
+  const data = readProjectJson(ctx);
+  const roles = discoverRoles(ctx.repoRoot);
+  if (!existsSync7(projectPath)) {
+    return { id: "sot.project-json", title: "Canonical .project.json", status: "fail", summary: ".project.json missing", details: [], fixable: true };
+  }
+  if (!data) {
+    return { id: "sot.project-json", title: "Canonical .project.json", status: "fail", summary: ".project.json is not valid JSON", details: [], fixable: true };
+  }
+  for (const key of ["project_name", "project_description", "project_slug", "repo_path", "ticket_provider", "agents"]) {
+    if (!(key in data)) details.push(`missing key: ${key}`);
+  }
+  if (data.repo_path !== ctx.repoRoot) details.push(`repo_path should be ${ctx.repoRoot}`);
+  const agents = data.agents ?? {};
+  for (const role of roles) {
+    const agent = agents[role.agentId];
+    if (!agent) {
+      details.push(`agents.${role.agentId} missing`);
+      continue;
+    }
+    if (agent.role !== role.role) details.push(`agents.${role.agentId}.role should be ${role.role}`);
+    if (agent.role_dir !== relative(ctx.repoRoot, role.roleDir)) {
+      details.push(`agents.${role.agentId}.role_dir should be ${relative(ctx.repoRoot, role.roleDir)}`);
+    }
+  }
+  const ticketProvider = data.ticket_provider ?? {};
+  for (const key of ["type", "workspace", "identifier", "board_id", "board_url"]) {
+    if (!(key in ticketProvider)) details.push(`ticket_provider.${key} missing`);
+  }
+  if (existsSync7(planeJsonPath)) details.push(".plane.json should not exist once .project.json is canonical");
+  return {
+    id: "sot.project-json",
+    title: "Canonical .project.json",
+    status: details.length === 0 ? "pass" : "fail",
+    summary: details.length === 0 ? ".project.json matches canonical parity contract" : `${details.length} parity issue(s) detected`,
+    details,
+    fixable: true
+  };
+}
+function renderSoul(role) {
+  const telegram = role.botHandle ? `@${role.botHandle}` : "(unwired)";
+  const tone = role.role === "pm" ? `Direct and brief. Decision-forward. No throat-clearing, no apologies, no "I'll help you with that" preambles.` : "Direct and brief.";
+  const roleSpecific = role.role === "pm" ? `You are the project manager. You triage incoming work, create or refine tickets, and delegate implementation. You do not ship product code. A systemd heartbeat checkpoints your runtime; when this repo opts into reconciliation (\`reconcile.enabled\` in role.yaml), the same heartbeat also runs your continuous board-reconciliation pass out-of-band (\`.scripts/sentinel.prompt.md\`, \`--source cron\`), kept separate from your interactive session memory.` : `You operate as the ${role.role} agent for this repo.`;
+  const runtimeOwner = role.runtimeOwner || "delorenj";
+  return `# ${role.displayName || role.agentId}
+
+You are **${role.displayName || role.agentId}** \u2014 a Hermes agent provisioned to work inside the
+\`${role.repo}\` repository.
+
+## Identity
+
+| | |
+| --- | --- |
+| Agent ID | \`${role.agentId}\` |
+| Profile | \`${role.profileName || role.agentId}\` |
+| Repo | \`${role.repo}\` |
+| Role | \`${role.role}\` |
+| Telegram | \`${telegram}\` |
+| Purpose | ${role.purpose || `${role.role} agent for ${role.repo}`} |
+
+## Scope
+
+You operate only within the working directory of \`${role.repo}\`. Your HERMES_HOME is the runtime submodule at \`./runtime/\` (repo \`${runtimeOwner}/${role.runtimeRepo}\`), which \`~/.hermes/profiles/${role.profileName || role.agentId}\` symlinks to (so \`--profile\` invocations resolve here too); Hermes loads its \`config.yaml\` directly. Secrets, SOUL, memories, skills, sessions, gateway state, and runtime files all live local to that runtime.
+
+## Tone
+
+${tone}
+
+## Role-specific behavior
+
+${roleSpecific}
+
+## Memory hygiene
+
+Your memory is the submodule at \`./runtime/memories/\`. Use durable memory deliberately and keep \`memories/MEMORY.md\` current.
+`;
+}
+function renderHermesWrapper(role) {
+  return `#!/usr/bin/env bash
+# Launcher for ${role.agentId}. Resolves HERMES_HOME to the runtime submodule.
+
+set -euo pipefail
+
+ROLE_DIR="$(cd "$(dirname "$0")" && pwd)"
+RUNTIME_HOME="$ROLE_DIR/runtime"
+
+FLEET_ENV="{HERMES_FLEET_ENV:-$HOME/.hermes/fleet.env}"
+if [[ -f "$FLEET_ENV" ]]; then
+  # shellcheck disable=SC1090
+  source "$FLEET_ENV"
+fi
+
+HERMES_BIN="{HERMES_BIN:-{HERMES_FLEET_BIN:-/home/delorenj/code/hermes-agent/.venv/bin/hermes}}"
+HERMES_OAUTH_FILE="{HERMES_OAUTH_FILE:-{HERMES_FLEET_OAUTH_FILE:-$HOME/.hermes/auth.json}}"
+CODEX_HOME="{CODEX_HOME:-{HERMES_FLEET_CODEX_HOME:-$HOME/.codex}}"
+
+FLEET_HOME="{HERMES_FLEET_HOME:-$HOME/.hermes}"
+PROFILE_NAME="{HERMES_PROFILE_NAME:-${role.profileName || role.agentId}}"
+HERMES_HOME="$RUNTIME_HOME"
+
+if [[ ! -d "$RUNTIME_HOME" ]]; then
+  echo "hermes: runtime submodule not initialized at $RUNTIME_HOME" >&2
+  echo "  fix: git submodule update --init --recursive" >&2
+  exit 1
+fi
+
+exec env HERMES_HOME="$HERMES_HOME" HERMES_FLEET_ENV="$FLEET_ENV"   HERMES_OAUTH_FILE="$HERMES_OAUTH_FILE" CODEX_HOME="$CODEX_HOME"   "$HERMES_BIN" "$@"
+`.replace(/\u0010/g, "$");
+}
+function copyMissingRecursive(sourceDir, targetDir, changedFiles, dryRun, skip) {
+  if (!existsSync7(sourceDir)) return;
+  mkdirSync5(targetDir, { recursive: true });
+  for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {
+    const sourcePath = join9(sourceDir, entry.name);
+    if (skip?.(sourcePath)) continue;
+    const targetPath = join9(targetDir, entry.name);
+    if (entry.isDirectory()) {
+      copyMissingRecursive(sourcePath, targetPath, changedFiles, dryRun, skip);
+      continue;
+    }
+    if (existsSync7(targetPath)) continue;
+    changedFiles.push(targetPath);
+    if (!dryRun) {
+      ensureParent(targetPath);
+      copyFileSync(sourcePath, targetPath);
+    }
+  }
+}
+function upsertSubmodule(repoRoot, role, changedFiles, dryRun) {
+  const gitmodulesPath = join9(repoRoot, ".gitmodules");
+  const repoName = role.runtimeRepo || `agent-hm-${role.repo}-${role.role}`;
+  const owner = role.runtimeOwner || "delorenj";
+  const block = `[submodule "agents/hermes/${role.role}/runtime"]
+	path = agents/hermes/${role.role}/runtime
+	url = git@github.com:${owner}/${repoName}.git
+`;
+  const current = safeReadText(gitmodulesPath) ?? "";
+  const header = `[submodule "agents/hermes/${role.role}/runtime"]`;
+  if (current.includes(header)) return [];
+  changedFiles.push(gitmodulesPath);
+  if (!dryRun) writeText(gitmodulesPath, `${current.replace(/\s*$/, "")}${current.trim() ? "\n" : ""}${block}`);
+  return [gitmodulesPath];
+}
+function upsertRegistryEntry(role, homeDir, changedFiles, dryRun) {
+  const path = registryPath(homeDir);
+  const current = safeReadText(path) ?? "# Hermes agent fleet registry.\n# One entry per provisioned agent. Managed by hermes-agent-template/.scripts/80-registry.sh.\nschema_version: 1\nagents: {}\n";
+  if (current.includes(`${role.agentId}:`)) return null;
+  const block = `  ${role.agentId}:
+    repo: ${role.repo}
+    role: ${role.role}
+    display_name: ${JSON.stringify(role.displayName || role.agentId)}
+    project_path: ${ctxEscape(role.roleDir ? dirname6(dirname6(dirname6(role.roleDir))) : "")}
+    role_dir: ${ctxEscape(role.roleDir)}
+    profile_name: ${role.profileName || role.agentId}
+    telegram:
+      bot_username: ${ctxEscape(role.botHandle)}
+    plane:
+      workspace: ${ctxEscape(role.planeWorkspace)}
+      project_id: ${ctxEscape(role.ticketProviderBoardId)}
+      identifier: ${ctxEscape(role.ticketProviderIdentifier)}
+    runtime_repo: ${ctxEscape(role.runtimeRepo)}
+    systemd:
+      gateway_unit: hermes-${role.agentId}-gateway.service
+      consumer_unit: hermes-${role.agentId}-consumer.service
+      heartbeat_timer: hermes-${role.agentId}-heartbeat.timer
+`;
+  const next = current.includes("agents: {}") ? current.replace("agents: {}", `agents:
+${block}`) : `${current.replace(/\s*$/, "\n")}${block}`;
+  changedFiles.push(path);
+  if (!dryRun) writeText(path, next);
+  return path;
+}
+function profileMetaInheritsDefault(path) {
+  const text3 = safeReadText(path);
+  return Boolean(
+    text3 && /^config:\s*$/m.test(text3) && /^\s+inherit_from:\s*default\s*$/m.test(text3) && /^\s+save_mode:\s*delta\s*$/m.test(text3)
+  );
+}
+function upsertInheritedProfileMeta(path, changedFiles, dryRun) {
+  const current = safeReadText(path) ?? "";
+  const lines = current.split("\n");
+  let next;
+  const start = lines.findIndex((line) => /^config:\s*$/.test(line));
+  if (!current.trim()) {
+    next = "config:\n  inherit_from: default\n  save_mode: delta\n";
+  } else if (start === -1) {
+    next = `${current.replace(/\s*$/, "\n")}config:
+  inherit_from: default
+  save_mode: delta
+`;
+  } else {
+    let end = start + 1;
+    while (end < lines.length && !/^[^#\s][^:]*:\s*/.test(lines[end] ?? "")) end++;
+    let hasInherit = false;
+    let hasSave = false;
+    for (let idx = start + 1; idx < end; idx++) {
+      if (/^\s+inherit_from:\s*/.test(lines[idx] ?? "")) {
+        lines[idx] = "  inherit_from: default";
+        hasInherit = true;
+      } else if (/^\s+save_mode:\s*/.test(lines[idx] ?? "")) {
+        lines[idx] = "  save_mode: delta";
+        hasSave = true;
+      }
+    }
+    const inserts = [];
+    if (!hasInherit) inserts.push("  inherit_from: default");
+    if (!hasSave) inserts.push("  save_mode: delta");
+    if (inserts.length) lines.splice(end, 0, ...inserts);
+    next = lines.join("\n");
+    if (!next.endsWith("\n")) next += "\n";
+  }
+  if (next === current) return null;
+  changedFiles.push(path);
+  if (!dryRun) writeText(path, next);
+  return path;
+}
+function ctxEscape(value) {
+  return JSON.stringify(value || "");
+}
+function checkUnit(unit) {
+  const enabled = systemctlUser(["is-enabled", unit]).ok;
+  const active = systemctlUser(["is-active", unit]).ok;
+  return { enabled, active };
+}
+var RULES = [
+  {
+    id: "mise.config-root",
+    title: "mise config_root + AGENTS link hooks",
+    audit: (ctx) => {
+      const misePath = join9(ctx.repoRoot, "mise.toml");
+      if (!existsSync7(misePath)) {
+        return { id: "mise.config-root", title: "mise config_root + AGENTS link hooks", status: "fail", summary: "mise.toml missing", details: [], fixable: true };
+      }
+      const text3 = readText(misePath);
+      const details = [];
+      const linkAgentfilesPath = join9(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
+      if (!existsSync7(linkAgentfilesPath)) details.push(".mise/scripts/link-agentfiles.sh missing");
+      const pathValues = [...(text3.match(/^_\.path\s*=\s*\[([^\]]*)\]/m)?.[1] ?? "").matchAll(/"([^"]+)"/g)].map((match) => match[1]);
+      const missingPathValues = requiredMisePathEntries(ctx).filter((value) => !pathValues.includes(value));
+      if (missingPathValues.length) details.push(`[env]._.path should include ${missingPathValues.join(", ")}`);
+      if (!text3.includes('"{{config_root}}/.mise/scripts/link-agentfiles.sh"')) details.push("link-agentfiles must use raw {{config_root}} guard");
+      if (!text3.includes("op inject -i .env.op > .env")) details.push("[hooks].enter must materialize .env from .env.op");
+      if (!text3.includes('patterns = ["AGENTS.md"]')) details.push("watch_files must monitor AGENTS.md");
+      if (!text3.includes('task = "link-agentfiles"')) details.push("watch_files must dispatch link-agentfiles task");
+      return {
+        id: "mise.config-root",
+        title: "mise config_root + AGENTS link hooks",
+        status: details.length === 0 ? "pass" : "fail",
+        summary: details.length === 0 ? "mise AGENTS-linking parity verified" : `${details.length} issue(s) detected in mise AGENTS-linking contract`,
+        details,
+        fixable: true
+      };
+    },
+    migrate: (ctx, finding) => {
+      const path = join9(ctx.repoRoot, "mise.toml");
+      const changedFiles = [];
+      if (!existsSync7(path)) {
+        return { id: finding.id, title: finding.title, status: "blocked", summary: "mise.toml missing; initialize mise first", changedFiles, details: [] };
+      }
+      let text3 = readText(path);
+      const next = upsertLinkAgentfilesBlock(text3, ctx);
+      if (next !== text3) {
+        changedFiles.push(path);
+        if (!ctx.dryRun) writeText(path, next);
+        text3 = next;
+      }
+      const linkAgentfilesPath = join9(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
+      const expectedScript = templateLinkAgentfilesScript(ctx);
+      if (expectedScript === void 0) {
+        return { id: finding.id, title: finding.title, status: "blocked", summary: "pjangler install is missing .mise/scripts/link-agentfiles.sh \u2014 update @delorenj/pjangler (broken package)", changedFiles, details: [] };
+      }
+      if (safeReadText(linkAgentfilesPath) !== expectedScript) {
+        changedFiles.push(linkAgentfilesPath);
+        if (!ctx.dryRun) {
+          writeText(linkAgentfilesPath, expectedScript);
+          chmodSync(linkAgentfilesPath, 493);
+        }
+      }
+      return {
+        id: finding.id,
+        title: finding.title,
+        status: changedFiles.length ? "applied" : "noop",
+        summary: changedFiles.length ? "Updated mise AGENTS-linking contract" : "No changes required",
+        changedFiles,
+        details: changedFiles.length ? ["Normalized hooks/watch_files/tasks.link-agentfiles block and script"] : []
+      };
+    }
+  },
+  {
+    id: "mise.versioning",
+    title: "managed mise versioning block",
+    audit: (ctx) => {
+      const details = [];
+      const misePath = join9(ctx.repoRoot, "mise.toml");
+      const versioningPath = join9(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
+      const manifestPath = join9(ctx.repoRoot, ".mise", "version-files.conf");
+      const text3 = safeReadText(misePath);
+      if (!text3?.includes("# >>> mise-versioning >>>")) details.push("mise versioning managed block missing");
+      if (!existsSync7(versioningPath)) details.push(".mise/scripts/versioning.sh missing");
+      if (!existsSync7(manifestPath)) details.push(".mise/version-files.conf missing");
+      return {
+        id: "mise.versioning",
+        title: "managed mise versioning block",
+        status: details.length === 0 ? "pass" : "fail",
+        summary: details.length === 0 ? "mise versioning parity verified" : `${details.length} versioning issue(s) detected`,
+        details,
+        fixable: true
+      };
+    },
+    migrate: (ctx, finding) => {
+      const changedFiles = [];
+      const misePath = join9(ctx.repoRoot, "mise.toml");
+      if (!existsSync7(misePath)) {
+        return { id: finding.id, title: finding.title, status: "blocked", summary: "mise.toml missing; cannot inject versioning block", changedFiles, details: [] };
+      }
+      const currentMise = readText(misePath);
+      const nextMise = replaceOrAppendManagedBlock(currentMise, /# >>> mise-versioning >>>/, VERSIONING_BLOCK, /^\[tasks\.build\]/m);
+      if (nextMise !== currentMise) {
+        changedFiles.push(misePath);
+        if (!ctx.dryRun) writeText(misePath, nextMise);
+      }
+      const versioningPath = join9(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
+      const expectedScript = templateVersioningScript(ctx);
+      if (expectedScript === void 0) {
+        return { id: finding.id, title: finding.title, status: "blocked", summary: "pjangler install is missing .mise/scripts/versioning.sh \u2014 update @delorenj/pjangler (broken package)", changedFiles, details: [] };
+      }
+      if (safeReadText(versioningPath) !== expectedScript) {
+        changedFiles.push(versioningPath);
+        if (!ctx.dryRun) {
+          writeText(versioningPath, expectedScript);
+          chmodSync(versioningPath, 493);
+        }
+      }
+      const manifestPath = join9(ctx.repoRoot, ".mise", "version-files.conf");
+      const expectedManifest = templateVersionFilesConf(ctx, ctx.repoRoot);
+      if (safeReadText(manifestPath) !== expectedManifest) {
+        changedFiles.push(manifestPath);
+        if (!ctx.dryRun) writeText(manifestPath, expectedManifest);
+      }
+      return {
+        id: finding.id,
+        title: finding.title,
+        status: changedFiles.length ? "applied" : "noop",
+        summary: changedFiles.length ? "Versioning block/script/manifest normalized" : "No changes required",
+        changedFiles,
+        details: []
+      };
+    }
+  },
+  {
+    id: "sot.agent-symlinks",
+    title: "AGENTS/CLAUDE/GEMINI symlink contract",
+    audit: (ctx) => {
+      const agentsPath = join9(ctx.repoRoot, "AGENTS.md");
+      if (!existsSync7(agentsPath)) {
+        const fallbackSources = ["CLAUDE.md", "GEMINI.md", "README.md"].filter((file) => existsSync7(join9(ctx.repoRoot, file)));
+        if (fallbackSources.length === 0) {
+          return { id: "sot.agent-symlinks", title: "AGENTS/CLAUDE/GEMINI symlink contract", status: "skip", summary: "AGENTS.md missing; symlink contract not applicable", details: [], fixable: false };
+        }
+        return {
+          id: "sot.agent-symlinks",
+          title: "AGENTS/CLAUDE/GEMINI symlink contract",
+          status: "fail",
+          summary: "AGENTS.md missing but can be derived from existing project documentation",
+          details: [`AGENTS.md can be created from ${fallbackSources[0]}`],
+          fixable: true
+        };
+      }
+      const details = [];
+      for (const file of ["CLAUDE.md", "GEMINI.md"]) {
+        const full = join9(ctx.repoRoot, file);
+        const target = readSymlinkTarget(full);
+        if (target !== "AGENTS.md") details.push(`${file} should be a symlink to AGENTS.md`);
+      }
+      return {
+        id: "sot.agent-symlinks",
+        title: "AGENTS/CLAUDE/GEMINI symlink contract",
+        status: details.length === 0 ? "pass" : "fail",
+        summary: details.length === 0 ? "Agent documentation symlinks are in parity" : `${details.length} symlink issue(s) detected`,
+        details,
+        fixable: true
+      };
+    },
+    migrate: (ctx, finding) => {
+      const changedFiles = [];
+      const details = [];
+      const blockedDetails = [];
+      const bootstrap = bootstrapAgentsFile(ctx.repoRoot, ctx.dryRun);
+      changedFiles.push(...bootstrap.changedFiles);
+      details.push(...bootstrap.details);
+      if (bootstrap.blocked) {
+        return { id: finding.id, title: finding.title, status: "blocked", summary: "AGENTS.md missing; cannot derive canonical agent file", changedFiles, details: [bootstrap.blocked] };
+      }
+      for (const file of ["CLAUDE.md", "GEMINI.md"]) {
+        const full = join9(ctx.repoRoot, file);
+        const result = ensureSymlink(full, "AGENTS.md", ctx.dryRun);
+        if (result.blocked) blockedDetails.push(result.blocked);
+        if (result.changed) changedFiles.push(full);
+      }
+      return {
+        id: finding.id,
+        title: finding.title,
+        status: blockedDetails.length ? "blocked" : changedFiles.length ? "applied" : "noop",
+        summary: blockedDetails.length ? "One or more files could not be replaced safely" : changedFiles.length ? "Symlink contract repaired" : "No changes required",
+        changedFiles,
+        details: [...details, ...blockedDetails]
+      };
+    }
+  },
+  {
+    id: "sot.project-json",
+    title: "Canonical .project.json",
+    audit: projectJsonFinding,
+    migrate: (ctx, finding) => {
+      const changedFiles = [];
+      const details = [];
+      const path = join9(ctx.repoRoot, ".project.json");
+      const existing = readProjectJson(ctx) ?? {};
+      const canonical = canonicalProjectJson(ctx);
+      const merged = { ...existing, ...canonical };
+      const expected = `${JSON.stringify(merged, null, 2)}
+`;
+      if (safeReadText(path) !== expected) {
+        changedFiles.push(path);
+        if (!ctx.dryRun) writeText(path, expected);
+      }
+      const planeJson = join9(ctx.repoRoot, ".plane.json");
+      if (existsSync7(planeJson)) {
+        const backup = `${planeJson}.migrated-backup`;
+        if (existsSync7(backup)) {
+          details.push(`cannot back up .plane.json because ${relative(ctx.repoRoot, backup)} already exists`);
+        } else {
+          changedFiles.push(backup);
+          if (!ctx.dryRun) renameSync(planeJson, backup);
+        }
+      }
+      return {
+        id: finding.id,
+        title: finding.title,
+        status: details.length ? "blocked" : changedFiles.length ? "applied" : "noop",
+        summary: details.length ? "Project SOT partially blocked" : changedFiles.length ? "Canonical .project.json written" : "No changes required",
+        changedFiles,
+        details
+      };
+    }
+  },
+  {
+    id: "secrets.env-op",
+    title: ".env.op + gitignore secrets contract",
+    audit: (ctx) => {
+      const details = [];
+      const envOp = safeReadText(join9(ctx.repoRoot, ".env.op"));
+      const gitignore = safeReadText(join9(ctx.repoRoot, ".gitignore"));
+      if (!envOp) {
+        details.push(".env.op missing");
+      } else {
+        const invalidLines = envOp.split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#") && line.includes("=")).filter((line) => {
+          const value = line.slice(line.indexOf("=") + 1).trim();
+          return !value.startsWith("op://") && !/^https?:\/\//.test(value) && !/^[A-Za-z0-9_.:-]+$/.test(value);
+        });
+        if (invalidLines.length) details.push(`.env.op has non-reference values that do not look like safe literals: ${invalidLines.join(", ")}`);
+      }
+      if (!gitignore?.includes(".env\n") && !gitignore?.includes(".env\r\n")) details.push(".gitignore should ignore .env");
+      if (!gitignore?.includes(".env.*")) details.push(".gitignore should ignore .env.*");
+      if (!gitignore?.includes("!.env.op")) details.push(".gitignore should unignore .env.op");
+      return {
+        id: "secrets.env-op",
+        title: ".env.op + gitignore secrets contract",
+        status: details.length === 0 ? "pass" : "fail",
+        summary: details.length === 0 ? "Secret reference file and ignore rules are in parity" : `${details.length} env parity issue(s) detected`,
+        details,
+        fixable: true
+      };
+    },
+    migrate: (ctx, finding) => {
+      const changedFiles = [];
+      const details = [];
+      const envOpPath = join9(ctx.repoRoot, ".env.op");
+      if (!existsSync7(envOpPath)) {
+        changedFiles.push(envOpPath);
+        if (!ctx.dryRun) writeText(envOpPath, readText(join9(ctx.pjanglerRoot, "templates", "commonproject", "template", ".env.op")));
+      }
+      const gitignorePath = join9(ctx.repoRoot, ".gitignore");
+      const gitignore = safeReadText(gitignorePath) ?? "";
+      const requiredBlock = `# Secrets \u2014 .env is materialized by \`op inject -i .env.op > .env\` on mise enter.
+# NEVER commit it. .env.op holds only 1Password references or safe literals and IS committed.
+.env
+.env.*
+!.env.op
+`;
+      if (!gitignore.includes("!.env.op") || !gitignore.includes(".env.*")) {
+        changedFiles.push(gitignorePath);
+        if (!ctx.dryRun) writeText(gitignorePath, `${gitignore.replace(/\s*$/, "")}${gitignore.trim() ? "\n\n" : ""}${requiredBlock}`);
+      }
+      return {
+        id: finding.id,
+        title: finding.title,
+        status: details.length ? "blocked" : changedFiles.length ? "applied" : "noop",
+        summary: details.length ? "Manual cleanup still required" : changedFiles.length ? "Wrote .env.op/gitignore parity files" : "No changes required",
+        changedFiles,
+        details
+      };
+    }
+  },
+  {
+    id: "provenance.copier",
+    title: ".copier-answers.yml provenance + drift report",
+    audit: (ctx) => {
+      const details = [];
+      const path = join9(ctx.repoRoot, ".copier-answers.yml");
+      const text3 = safeReadText(path);
+      const project = readProjectJson(ctx);
+      if (!text3) {
+        details.push(".copier-answers.yml missing");
+      } else {
+        if (!text3.startsWith("# Changes here will be overwritten by Copier; NEVER EDIT MANUALLY")) details.push("missing Copier overwrite warning header");
+        if (!text3.includes("_src_path:")) details.push("_src_path missing");
+        if (project?.project_name) {
+          const nameMatch = text3.match(/project_name:\s*(.+)/);
+          if (!nameMatch || nameMatch[1]?.trim() !== String(project.project_name)) details.push("project_name drift between .copier-answers.yml and .project.json");
+        }
+        if (project?.project_description) {
+          const descMatch = text3.match(/project_description:\s*([\s\S]*?)(?=\n\w|$)/);
+          const yamlDesc = descMatch?.[1]?.replace(/\n\s+/g, " ").trim() ?? "";
+          if (yamlDesc !== String(project.project_description)) details.push("project_description drift between .copier-answers.yml and .project.json");
+        }
+      }
+      return {
+        id: "provenance.copier",
+        title: ".copier-answers.yml provenance + drift report",
+        status: details.length === 0 ? "pass" : "fail",
+        summary: details.length === 0 ? "Copier provenance is in parity" : `${details.length} provenance issue(s) detected`,
+        details,
+        fixable: true
+      };
+    },
+    migrate: (ctx, finding) => {
+      const changedFiles = [];
+      const project = canonicalProjectJson(ctx);
+      const text3 = `# Changes here will be overwritten by Copier; NEVER EDIT MANUALLY
+_src_path: ${join9(ctx.pjanglerRoot, "templates", "commonproject")}
+project_description: ${String(project.project_description)}
+project_name: ${String(project.project_name)}
+ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
+`;
+      const path = join9(ctx.repoRoot, ".copier-answers.yml");
+      if (safeReadText(path) !== text3) {
+        changedFiles.push(path);
+        if (!ctx.dryRun) writeText(path, text3);
+      }
+      return {
+        id: finding.id,
+        title: finding.title,
+        status: changedFiles.length ? "applied" : "noop",
+        summary: changedFiles.length ? "Copier provenance file refreshed" : "No changes required",
+        changedFiles,
+        details: []
+      };
+    }
+  },
+  {
+    id: "bmad.scaffold",
+    title: "BMAD modules/docs scaffold",
+    audit: (ctx) => {
+      const sourceRoot = join9(ctx.pjanglerRoot, "templates", "commonproject", "_bmad");
+      const targetRoot = join9(ctx.repoRoot, "_bmad");
+      const sentinels = [
+        join9("core", "config.yaml"),
+        join9("custom", "config.yaml"),
+        join9("custom", "workflows", "ticket-lifecycle", "workflow.yaml"),
+        join9("bmm", "workflows", "workflow-status", "workflow.yaml")
+      ];
+      const missing = sentinels.filter((file) => existsSync7(join9(sourceRoot, file)) && !existsSync7(join9(targetRoot, file)));
+      return {
+        id: "bmad.scaffold",
+        title: "BMAD modules/docs scaffold",
+        status: missing.length === 0 ? "pass" : "fail",
+        summary: missing.length === 0 ? "BMAD scaffold parity verified" : `${missing.length} BMAD sentinel file(s) missing`,
+        details: missing.map((file) => `_bmad/${file}`),
+        fixable: true
+      };
+    },
+    migrate: (ctx, finding) => {
+      const changedFiles = [];
+      copyMissingRecursive(join9(ctx.pjanglerRoot, "templates", "commonproject", "_bmad"), join9(ctx.repoRoot, "_bmad"), changedFiles, ctx.dryRun);
+      return {
+        id: finding.id,
+        title: finding.title,
+        status: changedFiles.length ? "applied" : "noop",
+        summary: changedFiles.length ? "Copied missing BMAD scaffold files" : "No changes required",
+        changedFiles,
+        details: []
+      };
+    }
+  },
+  {
+    id: "hermes.pm-scaffold",
+    title: "Hermes PM scaffold parity",
+    audit: (ctx) => {
+      const roles = discoverRoles(ctx.repoRoot);
+      const role = roles.find((item) => item.role === "pm");
+      if (!role) {
+        return { id: "hermes.pm-scaffold", title: "Hermes PM scaffold parity", status: "skip", summary: "No pm role present", details: [], fixable: false };
+      }
+      const details = [];
+      for (const rel of ["role.yaml", "SOUL.md", "hermes", ".gitignore", ".scripts/70-systemd.sh", ".scripts/heartbeat.sh", ".scripts/checkpoint.sh", ".runtime-scaffold/README.md", "runtime/memories/MEMORY.md", "runtime/bloodbank-consumer.py"]) {
+        if (!existsSync7(join9(role.roleDir, rel))) details.push(`missing ${relative(ctx.repoRoot, join9(role.roleDir, rel))}`);
+      }
+      const gitmodules = safeReadText(join9(ctx.repoRoot, ".gitmodules")) ?? "";
+      if (!gitmodules.includes(`agents/hermes/${role.role}/runtime`)) details.push(".gitmodules missing pm runtime submodule entry");
+      if (!profileMetaInheritsDefault(join9(role.roleDir, "runtime", "profile.yaml"))) {
+        details.push("runtime/profile.yaml missing inherited default config metadata");
+      }
+      const registry = safeReadText(registryPath(ctx.homeDir));
+      if (!registry?.includes(`${role.agentId}:`)) details.push(`fleet registry missing ${role.agentId}`);
+      return {
+        id: "hermes.pm-scaffold",
+        title: "Hermes PM scaffold parity",
+        status: details.length === 0 ? "pass" : "fail",
+        summary: details.length === 0 ? "PM scaffold parity verified" : `${details.length} PM scaffold issue(s) detected`,
+        details,
+        fixable: true
+      };
+    },
+    migrate: (ctx, finding) => {
+      const role = discoverRoles(ctx.repoRoot).find((item) => item.role === "pm");
+      const changedFiles = [];
+      const details = [];
+      if (!role) {
+        return { id: finding.id, title: finding.title, status: "blocked", summary: "No pm role present", changedFiles, details: [] };
+      }
+      const templateRoleDir = join9(ctx.pjanglerRoot, "templates", "hermes-agent", "template");
+      writeIfDifferent(join9(role.roleDir, "SOUL.md"), renderSoul(role), ctx.dryRun, changedFiles);
+      writeIfDifferent(join9(role.roleDir, "hermes"), renderHermesWrapper(role), ctx.dryRun, changedFiles, 493);
+      writeIfDifferent(join9(role.roleDir, ".gitignore"), readText(join9(templateRoleDir, ".gitignore.jinja")).replace(/\{\{ role \}\}/g, role.role), ctx.dryRun, changedFiles);
+      copyMissingRecursive(join9(templateRoleDir, ".runtime-scaffold"), join9(role.roleDir, ".runtime-scaffold"), changedFiles, ctx.dryRun);
+      copyMissingRecursive(join9(templateRoleDir, ".runtime-scaffold"), join9(role.roleDir, "runtime"), changedFiles, ctx.dryRun);
+      copyMissingRecursive(join9(templateRoleDir, ".scripts"), join9(role.roleDir, ".scripts"), changedFiles, ctx.dryRun, (source) => source.endsWith("sentinel.prompt.md.jinja"));
+      const promptSource = join9(templateRoleDir, ".scripts", "sentinel.prompt.md.jinja");
+      const promptTarget = join9(role.roleDir, ".scripts", "sentinel.prompt.md");
+      if (existsSync7(promptSource) && !existsSync7(promptTarget)) {
+        const prompt = readText(promptSource).replace(/\{\{ agent_id \}\}/g, role.agentId).replace(/\{\{ role \}\}/g, role.role).replace(/\{\{ target_repo \}\}/g, role.repo).replace(/\{\{ display_name \}\}/g, role.displayName || role.agentId);
+        writeIfDifferent(promptTarget, prompt, ctx.dryRun, changedFiles);
+      }
+      upsertSubmodule(ctx.repoRoot, role, changedFiles, ctx.dryRun);
+      const profileMetaUpdated = upsertInheritedProfileMeta(join9(role.roleDir, "runtime", "profile.yaml"), changedFiles, ctx.dryRun);
+      if (profileMetaUpdated) details.push(`updated ${profileMetaUpdated}`);
+      const registryUpdated = upsertRegistryEntry(role, ctx.homeDir, changedFiles, ctx.dryRun);
+      if (registryUpdated) details.push(`updated ${registryUpdated}`);
+      return {
+        id: finding.id,
+        title: finding.title,
+        status: changedFiles.length ? "applied" : "noop",
+        summary: changedFiles.length ? "PM scaffold normalized" : "No changes required",
+        changedFiles,
+        details
+      };
+    }
+  },
+  {
+    id: "systemd.sentinel",
+    title: "Hermes systemd/sentinel units enabled + active",
+    audit: (ctx) => {
+      const roles = discoverRoles(ctx.repoRoot);
+      if (!roles.length) {
+        return { id: "systemd.sentinel", title: "Hermes systemd/sentinel units enabled + active", status: "skip", summary: "No Hermes roles present", details: [], fixable: false };
+      }
+      const probe = systemctlUser(["is-system-running"]);
+      if (!probe.ok && !/running|degraded|starting|maintenance/.test(`${probe.stdout} ${probe.stderr}`)) {
+        return { id: "systemd.sentinel", title: "Hermes systemd/sentinel units enabled + active", status: "warn", summary: "systemd --user unavailable; unit state not auditable here", details: [], fixable: false };
+      }
+      const details = [];
+      for (const role of roles) {
+        for (const unit of [`hermes-${role.agentId}-gateway.service`, `hermes-${role.agentId}-consumer.service`, `hermes-${role.agentId}-heartbeat.timer`]) {
+          const state = checkUnit(unit);
+          if (!state.enabled || !state.active) details.push(`${unit} should be enabled+active`);
+        }
+      }
+      return {
+        id: "systemd.sentinel",
+        title: "Hermes systemd/sentinel units enabled + active",
+        status: details.length === 0 ? "pass" : "fail",
+        summary: details.length === 0 ? "Hermes user units are enabled and active" : `${details.length} systemd parity issue(s) detected`,
+        details,
+        fixable: true
+      };
+    },
+    migrate: (ctx, finding) => {
+      const roles = discoverRoles(ctx.repoRoot);
+      const changedFiles = [];
+      const details = [];
+      if (!roles.length) {
+        return { id: finding.id, title: finding.title, status: "blocked", summary: "No Hermes roles present", changedFiles, details };
+      }
+      const probe = systemctlUser(["is-system-running"]);
+      if (!probe.ok && !/running|degraded|starting|maintenance/.test(`${probe.stdout} ${probe.stderr}`)) {
+        return { id: finding.id, title: finding.title, status: "blocked", summary: "systemd --user unavailable on this host", changedFiles, details };
+      }
+      for (const role of roles) {
+        const sysDir = join9(ctx.homeDir, ".config", "systemd", "user");
+        const units = [`hermes-${role.agentId}-gateway.service`, `hermes-${role.agentId}-consumer.service`, `hermes-${role.agentId}-heartbeat.timer`];
+        const allUnitsPresent = units.every((unit) => existsSync7(join9(sysDir, unit)));
+        if (allUnitsPresent) {
+          if (ctx.dryRun) {
+            details.push(`would run: systemctl --user enable --now ${units.join(" ")}`);
+          } else {
+            systemctlUser(["daemon-reload"]);
+            for (const unit of units) {
+              systemctlUser(["enable", "--now", unit]);
+            }
+          }
+          continue;
+        }
+        for (const script of [join9(role.roleDir, ".scripts", "70-systemd.sh")]) {
+          if (!script || !existsSync7(script)) continue;
+          if (ctx.dryRun) {
+            details.push(`would run: bash ${script}`);
+          } else {
+            const result = spawnSync4("bash", [script], { cwd: role.roleDir, encoding: "utf8" });
+            if (result.status !== 0) details.push(`script failed: ${script}: ${result.stderr.trim() || result.stdout.trim()}`);
+          }
+        }
+      }
+      return {
+        id: finding.id,
+        title: finding.title,
+        status: details.some((detail) => detail.includes("failed:")) ? "blocked" : details.length ? ctx.dryRun ? "skipped" : "applied" : "noop",
+        summary: details.length ? ctx.dryRun ? "Planned systemd remediation commands" : "Attempted systemd remediation" : "No changes required",
+        changedFiles,
+        details
+      };
+    }
+  }
+];
+function writeIfDifferent(path, content, dryRun, changedFiles, mode) {
+  const normalized = content.endsWith("\n") ? content : `${content}
+`;
+  if (safeReadText(path) === normalized) return;
+  changedFiles.push(path);
+  if (!dryRun) {
+    writeText(path, normalized);
+    if (mode) chmodSync(path, mode);
+  }
+}
+function getParityRuleIds() {
+  return RULES.map((rule) => rule.id);
+}
+function runAudit(repoArg) {
+  const pjanglerRoot = resolvePjanglerRoot();
+  const ctx = {
+    repoRoot: resolve(repoArg ?? process.cwd()),
+    dryRun: true,
+    pjanglerRoot,
+    homeDir: homedir4()
+  };
+  const rules = RULES.map((rule) => rule.audit(ctx));
+  return {
+    repo: ctx.repoRoot,
+    ok: rules.every((rule) => rule.status === "pass" || rule.status === "skip"),
+    auditedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    rules
+  };
+}
+function runMigration(selector, repoArg, dryRun, all) {
+  const pjanglerRoot = resolvePjanglerRoot();
+  const ctx = {
+    repoRoot: resolve(repoArg ?? process.cwd()),
+    dryRun,
+    pjanglerRoot,
+    homeDir: homedir4()
+  };
+  const selected = all ? RULES : RULES.filter((rule) => rule.id === selector);
+  if (!selected.length) {
+    throw new Error(`Unknown parity rule: ${selector}`);
+  }
+  const results = selected.map((rule) => {
+    try {
+      return rule.migrate(ctx, rule.audit(ctx));
+    } catch (err) {
+      return {
+        id: rule.id,
+        title: rule.title,
+        status: "blocked",
+        summary: `migrate threw: ${err instanceof Error ? err.message : String(err)}`,
+        changedFiles: [],
+        details: []
+      };
+    }
+  });
+  const changedFiles = Array.from(new Set(results.flatMap((result) => result.changedFiles))).sort();
+  return {
+    repo: ctx.repoRoot,
+    dryRun,
+    ok: results.every((result) => result.status !== "blocked"),
+    selectedRules: selected.map((rule) => rule.id),
+    results,
+    changedFiles
+  };
+}
+function formatAuditReport(report) {
+  const lines = [`repo: ${report.repo}`, `ok: ${report.ok}`, `audited_at: ${report.auditedAt}`, "rules:"];
+  for (const rule of report.rules) {
+    lines.push(`- ${rule.id} [${rule.status}] ${rule.summary}`);
+    for (const detail of rule.details) lines.push(`    - ${detail}`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+
 // src/mcp-server.ts
 var server = new McpServer({
   name: "pjangler-mcp",
   version: PJANGLER_VERSION
 });
+var TICKET_PROVIDER_SCHEMA = z.enum(["plane", "linear", "trello"]);
 function resolveTargetDir(targetDir) {
-  const dir = resolve(targetDir ?? process.cwd());
-  if (!existsSync5(dir)) {
+  const dir = resolve2(targetDir ?? process.cwd());
+  if (!existsSync8(dir)) {
     throw new Error(`Target directory does not exist: ${dir}`);
   }
   if (!statSync(dir).isDirectory()) {
@@ -1285,6 +2601,49 @@ function resolveTargetDir(targetDir) {
   }
   return dir;
 }
+function resolvePjanglerRoot2() {
+  let dir = dirname7(fileURLToPath5(import.meta.url));
+  while (dir !== dirname7(dir)) {
+    if (existsSync8(join10(dir, "package.json")) && existsSync8(join10(dir, "templates", "commonproject", "copier.yml"))) {
+      return dir;
+    }
+    dir = dirname7(dir);
+  }
+  throw new Error("Unable to resolve pjangler root");
+}
+function slugify(value) {
+  return value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "project";
+}
+function asText(payload) {
+  return { content: [{ type: "text", text: typeof payload === "string" ? payload : JSON.stringify(payload, null, 2) }] };
+}
+function auditSummary(report) {
+  const counts = report.rules.reduce((acc, rule) => {
+    acc[rule.status] = (acc[rule.status] ?? 0) + 1;
+    return acc;
+  }, {});
+  const nextActions = report.rules.filter((rule) => (rule.status === "fail" || rule.status === "warn") && rule.fixable).map((rule) => `pjangler_migrate_project ${rule.id}`);
+  return { counts, nextActions };
+}
+function migrationSummary(report) {
+  const counts = report.results.reduce((acc, result) => {
+    acc[result.status] = (acc[result.status] ?? 0) + 1;
+    return acc;
+  }, {});
+  return { counts, changedFileCount: report.changedFiles.length };
+}
+function parityGuidance() {
+  return {
+    skill: "@33god-projects",
+    guidance: "Use these tools before editing a project so the repo SOT, agent files, mise hooks, and Hermes role scaffold are current.",
+    workflows: [
+      "audit -> pjangler_audit_project",
+      "migrate -> pjangler_migrate_project",
+      "bootstrap -> pjangler_bootstrap_33god_project",
+      "agent provisioning -> pjangler_deploy_hermes_agent"
+    ]
+  };
+}
 async function runRecipeWithCapture(recipeName, context) {
   const recipe = createRecipe(recipeName, context);
   if (!recipe) {
@@ -1317,11 +2676,31 @@ async function runRecipeWithCapture(recipeName, context) {
     console.error = origError;
   }
 }
+function buildCommonProjectCopierAction(input) {
+  const data = {
+    project_name: input.projectName,
+    project_description: input.projectDescription ?? "",
+    project_slug: input.projectSlug,
+    ticket_provider: input.ticketProvider,
+    plane_workspace: input.planeWorkspace,
+    plane_project_id: input.planeProjectId ?? "",
+    project_identifier: input.projectIdentifier,
+    primary_language: input.primaryLanguage
+  };
+  const args = ["copy", "--trust", input.templateDir, input.targetDir, "--defaults"];
+  for (const [key, value] of Object.entries(data)) args.push("--data", `${key}=${value}`);
+  if (input.overwrite) args.push("--overwrite");
+  return {
+    kind: "copier.copy.commonproject",
+    command: ["copier", ...args],
+    data
+  };
+}
 server.registerTool(
   "pjangler_list_capabilities",
   {
     title: "List pjangler capabilities",
-    description: "Returns available recipes and commands exposed by pjangler.",
+    description: "Returns available recipes, commands, parity rules, workflows, and @33god-projects tool guidance.",
     inputSchema: {}
   },
   async () => {
@@ -1335,11 +2714,197 @@ server.registerTool(
         name: c.name,
         description: c.description,
         group: c.group
-      }))
-    };
-    return {
-      content: [{ type: "text", text: JSON.stringify(payload, null, 2) }]
+      })),
+      parityRules: getParityRuleIds(),
+      recommendedWorkflows: {
+        existingProject: ["pjangler_audit_project", "pjangler_migrate_project"],
+        new33godProject: ["pjangler_bootstrap_33god_project", "pjangler_audit_project"],
+        hermesAgentProvisioning: ["pjangler_deploy_hermes_agent", "pjangler_audit_project"]
+      },
+      skillSynergy: parityGuidance()
     };
+    return asText(payload);
+  }
+);
+server.registerTool(
+  "pjangler_list_parity_rules",
+  {
+    title: "List pjangler parity rules",
+    description: "Returns parity rule ids plus brief @33god-projects guidance.",
+    inputSchema: {}
+  },
+  async () => asText({ parityRules: getParityRuleIds(), guidance: parityGuidance() })
+);
+server.registerTool(
+  "pjangler_audit_project",
+  {
+    title: "Audit project parity",
+    description: "Runs pjangler parity audit for a project and returns structured findings with summary counts and next actions.",
+    inputSchema: {
+      targetDir: z.string().optional(),
+      json: z.boolean().optional()
+    }
+  },
+  async ({ targetDir, json }) => {
+    try {
+      const resolvedTarget = resolveTargetDir(targetDir);
+      const report = runAudit(resolvedTarget);
+      const payload = { ...report, summary: auditSummary(report), guidance: parityGuidance() };
+      return asText(json === false ? formatAuditReport(report) : payload);
+    } catch (err) {
+      return { isError: true, content: [{ type: "text", text: err instanceof Error ? err.message : String(err) }] };
+    }
+  }
+);
+server.registerTool(
+  "pjangler_migrate_project",
+  {
+    title: "Migrate project parity",
+    description: "Runs one pjangler parity migration rule, or all rules, against a project.",
+    inputSchema: {
+      targetDir: z.string().optional(),
+      ruleId: z.string().optional(),
+      all: z.boolean().optional(),
+      dryRun: z.boolean().optional()
+    }
+  },
+  async ({ targetDir, ruleId, all, dryRun }) => {
+    try {
+      const runAll = all ?? false;
+      if (!runAll && !ruleId) throw new Error("Either ruleId or all=true is required");
+      if (runAll && ruleId) throw new Error("Pass either ruleId or all=true, not both");
+      const resolvedTarget = resolveTargetDir(targetDir);
+      const report = runMigration(ruleId, resolvedTarget, dryRun ?? true, runAll);
+      return asText({
+        ok: report.ok,
+        repo: report.repo,
+        dryRun: report.dryRun,
+        selectedRules: report.selectedRules,
+        changedFiles: report.changedFiles,
+        results: report.results,
+        summary: migrationSummary(report)
+      });
+    } catch (err) {
+      return { isError: true, content: [{ type: "text", text: err instanceof Error ? err.message : String(err) }] };
+    }
+  }
+);
+server.registerTool(
+  "pjangler_bootstrap_33god_project",
+  {
+    title: "Bootstrap a new @33god project",
+    description: "Create a new CommonProject-based 33god repo with optional local Hermes agent provisioning. Dry-run is safe and does not require copier.",
+    inputSchema: {
+      parentDir: z.string().optional(),
+      targetDir: z.string().optional(),
+      projectName: z.string(),
+      projectDescription: z.string().optional(),
+      projectSlug: z.string().optional(),
+      ticketProvider: TICKET_PROVIDER_SCHEMA.optional(),
+      planeWorkspace: z.string().optional(),
+      planeProjectId: z.string().optional(),
+      projectIdentifier: z.string().optional(),
+      primaryLanguage: z.string().optional(),
+      skipPlane: z.boolean().optional(),
+      provisionAgent: z.boolean().optional(),
+      agentRole: z.string().optional(),
+      agentPurpose: z.string().optional(),
+      local: z.boolean().optional(),
+      force: z.boolean().optional(),
+      overwrite: z.boolean().optional(),
+      dryRun: z.boolean().optional()
+    }
+  },
+  async (input) => {
+    try {
+      const pjanglerRoot = resolvePjanglerRoot2();
+      const projectSlug = input.projectSlug ?? slugify(input.projectName);
+      const parentDir = resolve2(input.parentDir ?? process.cwd());
+      if (!existsSync8(parentDir) || !statSync(parentDir).isDirectory()) throw new Error(`Parent directory does not exist: ${parentDir}`);
+      const targetDir = resolve2(input.targetDir ?? join10(parentDir, projectSlug));
+      const overwrite = input.overwrite ?? input.force ?? false;
+      const dryRun = input.dryRun ?? true;
+      const local = input.local ?? true;
+      const skipPlane = input.skipPlane ?? true;
+      const planeProjectId = input.planeProjectId ?? "";
+      if (!skipPlane && !planeProjectId) {
+        throw new Error("planeProjectId is required when skipPlane=false; keep skipPlane=true for safe local bootstrap");
+      }
+      if (existsSync8(targetDir) && !overwrite) throw new Error(`Target already exists: ${targetDir} (set force/overwrite=true to re-render)`);
+      const templateDir = join10(pjanglerRoot, "templates", "commonproject");
+      const copierAction = buildCommonProjectCopierAction({
+        templateDir,
+        targetDir,
+        projectName: input.projectName,
+        projectDescription: input.projectDescription,
+        projectSlug,
+        ticketProvider: input.ticketProvider ?? "plane",
+        planeWorkspace: input.planeWorkspace ?? "33god",
+        planeProjectId,
+        projectIdentifier: input.projectIdentifier ?? projectSlug.slice(0, 4).toUpperCase(),
+        primaryLanguage: input.primaryLanguage ?? "python",
+        overwrite
+      });
+      const actions = [
+        { kind: "ensure.parent", path: dirname7(targetDir) },
+        copierAction
+      ];
+      if (input.provisionAgent) {
+        actions.push({
+          kind: "pjangler.recipe.hermes-agent",
+          targetDir,
+          context: {
+            targetRepo: projectSlug,
+            role: input.agentRole ?? "pm",
+            agentPurpose: input.agentPurpose ?? `Project manager for ${input.projectName}`,
+            local,
+            dryRun,
+            force: overwrite,
+            skipTelegram: true,
+            skipEmail: true,
+            skipRuntimeRepo: local,
+            skipPlane: skipPlane || local,
+            skipBloodbank: local,
+            skipSystemd: local || process.platform === "darwin"
+          }
+        });
+      }
+      if (dryRun) {
+        return asText({ ok: true, dryRun, targetDir, projectSlug, actions, guidance: parityGuidance() });
+      }
+      const which = spawnSync5("which", ["copier"], { encoding: "utf8" });
+      if (which.status !== 0) throw new Error("copier not found on PATH. Install with: uv tool install copier or pip install copier");
+      mkdirSync6(dirname7(targetDir), { recursive: true });
+      const result = spawnSync5(copierAction.command[0], copierAction.command.slice(1), { encoding: "utf8", cwd: pjanglerRoot });
+      const logs = [result.stdout.trim()].filter(Boolean);
+      const errors = [result.stderr.trim()].filter(Boolean);
+      if (result.status !== 0) {
+        return asText({ ok: false, dryRun, targetDir, actions, logs, errors, exitCode: result.status });
+      }
+      let agentResult;
+      if (input.provisionAgent) {
+        const context = {
+          targetDir,
+          yes: true,
+          targetRepo: projectSlug,
+          role: input.agentRole ?? "pm",
+          agentPurpose: input.agentPurpose ?? `Project manager for ${input.projectName}`,
+          local,
+          force: overwrite,
+          dryRun: false,
+          skipTelegram: true,
+          skipEmail: true,
+          skipRuntimeRepo: local,
+          skipPlane: skipPlane || local,
+          skipBloodbank: local,
+          skipSystemd: local || process.platform === "darwin"
+        };
+        agentResult = await runRecipeWithCapture("hermes-agent", context);
+      }
+      return asText({ ok: !agentResult || agentResult.success, dryRun, targetDir, projectSlug, actions, logs, errors, agentResult });
+    } catch (err) {
+      return { isError: true, content: [{ type: "text", text: err instanceof Error ? err.message : String(err) }] };
+    }
   }
 );
 server.registerTool(
@@ -1359,22 +2924,11 @@ server.registerTool(
         content: [{ type: "text", text: `Recipe not found: ${recipe}` }]
       };
     }
-    return {
-      content: [
-        {
-          type: "text",
-          text: JSON.stringify(
-            {
-              name: info.name,
-              description: info.description,
-              commands: info.commands
-            },
-            null,
-            2
-          )
-        }
-      ]
-    };
+    return asText({
+      name: info.name,
+      description: info.description,
+      commands: info.commands
+    });
   }
 );
 server.registerTool(
@@ -1400,22 +2954,13 @@ server.registerTool(
       const result = await runRecipeWithCapture(recipe, context);
       return {
         isError: !result.success,
-        content: [
-          {
-            type: "text",
-            text: JSON.stringify(
-              {
-                success: result.success,
-                recipe,
-                targetDir: resolvedTarget,
-                logs: result.logs,
-                errors: result.errors
-              },
-              null,
-              2
-            )
-          }
-        ]
+        ...asText({
+          success: result.success,
+          recipe,
+          targetDir: resolvedTarget,
+          logs: result.logs,
+          errors: result.errors
+        })
       };
     } catch (err) {
       return {
@@ -1429,15 +2974,16 @@ server.registerTool(
   "pjangler_deploy_hermes_agent",
   {
     title: "Deploy Hermes agent",
-    description: "Provision a Hermes agent role with an inherited named profile and optional integrations (Telegram, email, runtime repo, Plane, Bloodbank, systemd).",
+    description: "Provision a Hermes agent role for @33god-projects. For safe MCP use local=true defaults skip runtime repo, Plane, Bloodbank, and systemd; opt out with local=false plus explicit skip flags.",
     inputSchema: {
       targetDir: z.string(),
-      targetRepo: z.string(),
-      role: z.string(),
+      targetRepo: z.string().optional(),
+      role: z.enum(["pm", "dev", "review", "ops", "qa"]),
       agentPurpose: z.string().optional(),
       soulTone: z.enum(["direct", "playful", "formal", "terse"]).optional(),
       modelProvider: z.string().optional(),
       modelName: z.string().optional(),
+      local: z.boolean().optional(),
       force: z.boolean().optional(),
       dryRun: z.boolean().optional(),
       skipTelegram: z.boolean().optional(),
@@ -1445,61 +2991,58 @@ server.registerTool(
       skipRuntimeRepo: z.boolean().optional(),
       skipPlane: z.boolean().optional(),
       skipBloodbank: z.boolean().optional(),
-      skipSystemd: z.boolean().optional()
+      skipSystemd: z.boolean().optional(),
+      ticketProvider: TICKET_PROVIDER_SCHEMA.optional()
     }
   },
   async (input) => {
     try {
       const resolvedTarget = resolveTargetDir(input.targetDir);
+      const local = input.local ?? true;
       const context = {
         targetDir: resolvedTarget,
         yes: true,
-        targetRepo: input.targetRepo,
+        local,
+        targetRepo: input.targetRepo ?? basename2(resolvedTarget),
         role: input.role,
         agentPurpose: input.agentPurpose,
         soulTone: input.soulTone,
         modelProvider: input.modelProvider,
         modelName: input.modelName,
+        ticketProvider: input.ticketProvider,
         force: input.force ?? false,
         dryRun: input.dryRun ?? false,
         skipTelegram: input.skipTelegram ?? true,
         skipEmail: input.skipEmail ?? true,
-        skipRuntimeRepo: input.skipRuntimeRepo ?? false,
-        skipPlane: input.skipPlane ?? false,
-        skipBloodbank: input.skipBloodbank ?? false,
-        skipSystemd: input.skipSystemd ?? false
+        skipRuntimeRepo: input.skipRuntimeRepo ?? local,
+        skipPlane: input.skipPlane ?? local,
+        skipBloodbank: input.skipBloodbank ?? local,
+        skipSystemd: input.skipSystemd ?? (local || process.platform === "darwin")
       };
       const result = await runRecipeWithCapture("hermes-agent", context);
       return {
         isError: !result.success,
-        content: [
-          {
-            type: "text",
-            text: JSON.stringify(
-              {
-                success: result.success,
-                recipe: "hermes-agent",
-                targetDir: resolvedTarget,
-                context: {
-                  targetRepo: context.targetRepo,
-                  role: context.role,
-                  dryRun: context.dryRun,
-                  force: context.force,
-                  skipTelegram: context.skipTelegram,
-                  skipEmail: context.skipEmail,
-                  skipRuntimeRepo: context.skipRuntimeRepo,
-                  skipPlane: context.skipPlane,
-                  skipBloodbank: context.skipBloodbank,
-                  skipSystemd: context.skipSystemd
-                },
-                logs: result.logs,
-                errors: result.errors
-              },
-              null,
-              2
-            )
-          }
-        ]
+        ...asText({
+          success: result.success,
+          recipe: "hermes-agent",
+          targetDir: resolvedTarget,
+          guidance: parityGuidance(),
+          context: {
+            targetRepo: context.targetRepo,
+            role: context.role,
+            local: context.local,
+            dryRun: context.dryRun,
+            force: context.force,
+            skipTelegram: context.skipTelegram,
+            skipEmail: context.skipEmail,
+            skipRuntimeRepo: context.skipRuntimeRepo,
+            skipPlane: context.skipPlane,
+            skipBloodbank: context.skipBloodbank,
+            skipSystemd: context.skipSystemd
+          },
+          logs: result.logs,
+          errors: result.errors
+        })
       };
     } catch (err) {
       return {