@delorenj/pjangler 1.1.5 → 1.2.2

package/templates/hermes-agent/docs/{scrum-master → sentinel}/development.md

@@ -1,29 +1,29 @@
-# Scrum Master development guide
+# Heartbeat sentinel development guide
 
-This guide covers the day-to-day work of changing the Scrum Master engine:
+This guide covers the day-to-day work of changing the heartbeat sentinel engine:
 how to edit it, how to validate changes locally, how to provision and propagate
-it, and what to watch out for. It closes with the record of the Drumjangler
-cutover and the open roadmap. Read the [handoff overview](README.md) and
-[Architecture](architecture.md) first.
+it, and what to watch out for. It closes with the open roadmap. Read the
+[handoff overview](README.md) and [Architecture](architecture.md) first.
 
 ## Two doc trees, kept in sync
 
 The engine has two documentation trees, and they serve different readers. When
 you change behavior, update both.
 
-- `docs/scrum-master/` (this directory) holds the **developer** docs for working
+- `docs/sentinel/` (this directory) holds the **developer** docs for working
   on the template.
-- `template/.scripts/scrum-master/docs/` holds the **runtime** protocol docs
+- `template/.scripts/sentinel/docs/` holds the **runtime** protocol docs
   that render into every provisioned project. The running agent reads these at
   run time. They are `autonomous-delegated-review.md`,
   `continuous-ticket-orchestration.md`, and `bloodbank-events.md`.
 
 ## Making a change
 
-Most engine logic lives under `template/.scripts/scrum-master/` and
-`template/.scripts/providers/`. The flow is the same for any change.
+Most engine logic lives under `template/.scripts/sentinel/` and
+`template/.scripts/providers/`, and the heartbeat runner is
+`template/.scripts/heartbeat.sh`. The flow is the same for any change.
 
-1. Edit the engine file, the adapter, or the prompt.
+1. Edit the runner, the engine file, the adapter, or the prompt.
 2. Validate locally with the steps in [Validating changes
    locally](#validating-changes-locally).
 3. If you changed behavior, update the runtime protocol docs and these developer
@@ -32,9 +32,10 @@ Most engine logic lives under `template/.scripts/scrum-master/` and
    [Propagating changes](#propagating-changes)).
 
 The prompt is a Jinja template,
-`template/.scripts/scrum-master/continuous-ticket-sentinel.prompt.md.jinja`. It
-uses `{{ display_name }}`, `{{ target_repo }}`, `{{ role }}`, and
-`{{ ticket_provider }}`. Copier renders it during provisioning.
+`template/.scripts/sentinel.prompt.md.jinja` (rendered to
+`.scripts/sentinel.prompt.md`). It uses `{{ display_name }}`,
+`{{ target_repo }}`, `{{ role }}`, and `{{ ticket_provider }}`. Copier renders
+it during provisioning.
 
 ## Validating changes locally
 
@@ -45,8 +46,8 @@ First, check shell syntax across the engine:
 ```bash
 for f in template/.scripts/lib/ticket-provider.sh \
          template/.scripts/providers/*.sh \
-         template/.scripts/scrum-master/continuous-ticket-sentinel.sh \
-         template/.scripts/scrum-master/bin/*.sh; do
+         template/.scripts/heartbeat.sh \
+         template/.scripts/sentinel/bin/*.sh; do
   sh -n "$f" || bash -n "$f" || echo "FAIL $f"
 done
 ```
@@ -80,20 +81,20 @@ optional adapter-based transition without touching a real board.
 <summary>Mock-provider end-to-end test</summary>
 
 ```bash
-T=$(mktemp -d); RD="$T/agents/hermes/scrum-master"
-mkdir -p "$RD/.scripts/lib" "$RD/.scripts/providers" "$RD/.scripts/scrum-master/bin" \
+T=$(mktemp -d); RD="$T/agents/hermes/pm"
+mkdir -p "$RD/.scripts/lib" "$RD/.scripts/providers" "$RD/.scripts/sentinel/bin" \
          "$T/_bmad-output/implementation-artifacts/issue-evidence"
 ( cd "$T" && git init -q && git config user.email t@t && git config user.name t )
 cp template/.scripts/lib/ticket-provider.sh "$RD/.scripts/lib/"
-cp template/.scripts/scrum-master/bin/* "$RD/.scripts/scrum-master/bin/"
-printf 'repo: demo\nrole: scrum-master\nagent_id: demo-sm\nticket_provider:\n  name: fake\nscrum_master:\n  grace_hours: 0\n  auto_review: true\n' > "$RD/role.yaml"
+cp template/.scripts/sentinel/bin/* "$RD/.scripts/sentinel/bin/"
+printf 'repo: demo\nrole: pm\nagent_id: demo-pm\nticket_provider:\n  name: fake\nreconcile:\n  grace_hours: 0\n  auto_review: true\n' > "$RD/role.yaml"
 printf '#!/usr/bin/env sh\nop="$1"; shift 2>/dev/null||true\ncase "$op" in\n transition) echo "FAKE $1 -> $2" >&2; echo ok;;\n comment) echo okc;; *) echo f;; esac\n' > "$RD/.scripts/providers/fake.sh"
-chmod +x "$RD/.scripts/providers/fake.sh" "$RD/.scripts/scrum-master/bin/"*.sh
+chmod +x "$RD/.scripts/providers/fake.sh" "$RD/.scripts/sentinel/bin/"*.sh
 EV="$T/_bmad-output/implementation-artifacts/issue-evidence"
 printf '## Issue\n- Worker: codex\n## Acceptance Criteria\n- AC1: done\n## Repo Changes\n- x\n## Verification\n- Command: t\n- Result: pass\n## Ledger Update\n- Ledger updated: yes\n## Known Gaps\n- None\n## Close Recommendation\nClose recommendation: ready\n' > "$EV/TIC-1.md"
 printf '## Reviewer\n- Reviewer agent: rev\n- Independent of implementer: yes\n## Locked Intent Baseline\n- Acceptance criteria source: board\n## Drift Assessment\n- Drift assessment: none\n## Adversarial Findings\n- Critical/high findings: none\n## Decision\n- Decision: accept\n' > "$EV/TIC-1.review.md"
 export BLOODBANK_EVENTS_LOG="$T/e.jsonl"
-bash "$RD/.scripts/scrum-master/bin/issue-autonomous-review.sh" TIC-1 "$EV/TIC-1.review.md" --close
+bash "$RD/.scripts/sentinel/bin/issue-autonomous-review.sh" TIC-1 "$EV/TIC-1.review.md" --close
 rm -rf "$T"
 ```
 
@@ -121,12 +122,13 @@ The script:
 2. writes a host-correct local `config.toml` (detects the hermes binary, leaves
    cloud fields blank) if one doesn't exist,
 3. lists the boards on the chosen provider and prompts for the one to manage,
-4. provisions the `pm` and `scrum-master` roles through Copier with all cloud,
-   Telegram, and `systemd`/gateway steps skipped,
-5. binds the Scrum Master to the existing board (it never creates one — it
-   scrubs the provider key from Copier's environment so `42-ticket-provider.sh`
-   skips board creation),
-6. installs the sentinel as a `launchd` agent on macOS or a `systemd` timer on
+4. provisions the `pm` role through Copier with all cloud, Telegram, and the
+   gateway step skipped,
+5. binds the PM to the existing board (it never creates one — it scrubs the
+   provider key from Copier's environment so `42-ticket-provider.sh` skips board
+   creation),
+6. installs the PM's heartbeat timer (board-reconciliation sentinel pass + gated
+   runtime checkpoint) as a `launchd` agent on macOS or a `systemd` timer on
    Linux,
 7. smoke-tests the board connection through the adapter.
 
@@ -136,18 +138,18 @@ Useful environment overrides (skip the prompts): `HAT_REPO`, `HAT_PROVIDER`,
 
 This local path does not wire Telegram or email. Those are convenience layers in
 the `pjangler` provisioner, not requirements for a working agent — talk to the
-agents with `agents/hermes/pm/hermes chat "..."` and let the sentinel run on its
-timer.
+agent with `agents/hermes/pm/hermes chat "..."` and let the sentinel run on its
+heartbeat timer.
 
-## Provisioning a Scrum Master (manual)
+## Provisioning the PM (manual)
 
-To drive Copier directly instead of using `install-local.sh`, provision a
-standalone Scrum Master with:
+To drive Copier directly instead of using `install-local.sh`, provision the PM
+with:
 
 ```bash
 cd /path/to/your-project
-copier copy gh:delorenj/hermes-agent-template ./agents/hermes/scrum-master \
-  --data role=scrum-master \
+copier copy gh:delorenj/hermes-agent-template ./agents/hermes/pm \
+  --data role=pm \
   --data target_repo=<repo> \
   --data ticket_provider=<linear|plane|trello>
 ```
@@ -172,27 +174,27 @@ script checks its flag and skips cleanly.
 | `SKIP_RUNTIME_REPO` | Creating the GitHub runtime repo. |
 | `SKIP_PLANE` | Creating a Plane project. |
 | `SKIP_BLOODBANK` | Installing the BloodBank consumer. |
-| `SKIP_SYSTEMD` | Installing `systemd` units. |
+| `SKIP_SYSTEMD` | Installing `systemd` units (gateway, consumer, heartbeat timer). |
 
 For example, a local install that creates no cloud resources:
 
 ```bash
 SKIP_TELEGRAM=1 SKIP_RUNTIME_REPO=1 SKIP_PLANE=1 SKIP_BLOODBANK=1 \
-  copier copy gh:delorenj/hermes-agent-template ./agents/hermes/scrum-master \
-  --data role=scrum-master --data target_repo=<repo> --data ticket_provider=linear
+  copier copy gh:delorenj/hermes-agent-template ./agents/hermes/pm \
+  --data role=pm --data target_repo=<repo> --data ticket_provider=linear
 ```
 
 After provisioning, set the board binding in
-`agents/hermes/scrum-master/role.yaml`. For Linear, set `ticket_provider.team`
-to the team key. Make the provider key available to the sentinel's environment:
+`agents/hermes/pm/role.yaml`. For Linear, set `ticket_provider.team`
+to the team key. Make the provider key available to the heartbeat's environment:
 on Linux through a `systemd` `EnvironmentFile` (for example
 `~/.hermes/<agent_id>.env`); on macOS the `launchd` agent sources that same
 per-agent env file, so write the key there.
 
-`SKIP_SYSTEMD` gates only the gateway, consumer, and checkpoint units in
-`70-systemd.sh`. The sentinel scheduler itself is installed by
-`75-scrum-master.sh`, which picks `launchd` on macOS and `systemd` on Linux
-regardless of that flag.
+`SKIP_SYSTEMD` gates the gateway, consumer, and the fused `heartbeat` timer in
+`70-systemd.sh`. The heartbeat timer is what drives the sentinel pass and the
+gated checkpoint, so a local install that wants the sentinel running must leave
+`SKIP_SYSTEMD` unset (or install the timer afterward).
 
 ## Propagating changes
 
@@ -203,7 +205,7 @@ and tokens, is preserved while the engine logic refreshes.
 
 ```bash
 cd /path/to/your-project
-copier update ./agents/hermes/scrum-master
+copier update ./agents/hermes/pm
 ```
 
 <!-- prettier-ignore -->
@@ -211,46 +213,18 @@ copier update ./agents/hermes/scrum-master
 > `copier update` re-runs the `_tasks` chain. Pass the same `SKIP_*` flags you
 > used at provision time so the update doesn't try to recreate cloud resources.
 
-## The Drumjangler cutover
-
-Drumjangler was the prototype for this engine and the first project cut over to
-it. The cutover used a lean, fully reversible path rather than full Copier
-provisioning, because full provisioning would have created a GitHub repo and
-prompted for a Telegram token.
-
-What was done:
-
-- The engine was deployed from the template into
-  `agents/hermes/scrum-master/`, identical to the source of truth.
-- `role.yaml` was bound to Linear, team `DEL`. The runtime reuses the existing
-  `pm` runtime through a symlink,
-  `agents/hermes/scrum-master/runtime -> ../pm/runtime`, so the Scrum Master
-  shares the Hermes profile and the `LINEAR_API_KEY` wiring from
-  `~/.hermes/stemjangler-pm.env`.
-- The Linear adapter was verified live against the real `DEL` board from the
-  deployed role.
-- The `systemd` timer
-  `hermes-drumjangler-scrum-master-continuous-ticket-sentinel.timer` was
-  installed and enabled. The old
-  `hermes-stemjangler-pm-continuous-ticket-sentinel.timer` was disabled and
-  stopped.
-- The four bespoke `pm`-role sentinel scripts were removed. They're recoverable
-  from Git history.
-
-To roll back, restore the bespoke scripts from Git, then flip the timers:
+## History: consolidation into the PM heartbeat
 
-```bash
-git checkout <previous-commit> -- \
-  agents/hermes/pm/.scripts/continuous-ticket-sentinel.sh \
-  agents/hermes/pm/.scripts/75-continuous-ticket-sentinel.sh \
-  agents/hermes/pm/.scripts/run-adversarial-review.sh \
-  agents/hermes/pm/continuous-ticket-sentinel.prompt.md
-systemctl --user enable --now hermes-stemjangler-pm-continuous-ticket-sentinel.timer
-systemctl --user disable --now hermes-drumjangler-scrum-master-continuous-ticket-sentinel.timer
-```
-
-The full cutover record lives in the Drumjangler repo at
-`docs/operations/scrum-master-migration.md`.
+The sentinel began as a bespoke loop on the `pm` role, was briefly extracted into
+a standalone `scrum-master` role with its own `continuous-ticket-sentinel` timer,
+and has now been folded back into the unified PM. Today there is exactly one
+role (`pm`), one engine (under `.scripts/sentinel/`), and one timer
+(`hermes-<agent>-heartbeat.timer`) that fuses the board-reconciliation sentinel
+pass with a gated runtime checkpoint. The old per-agent
+`hermes-<agent>-continuous-ticket-sentinel.timer` and the separate
+`hermes-<agent>-checkpoint.timer` are gone; both are replaced by the single
+`heartbeat` timer. The earlier standalone-role design is recoverable from Git
+history if you ever need to compare.
 
 ## Known gotchas
 
@@ -271,18 +245,12 @@ These cost real debugging time. Watch for them.
   into a variable instead.
 - **Quoting in `python3 -c`.** See the warning in
   [Providers: adding a provider](providers.md#adding-a-provider).
-- **`flock` is Linux-only.** macOS doesn't ship `flock`, so the runner falls
-  back to an atomic `mkdir` lock. Keep both paths working in the runner.
+- **`flock` is Linux-only.** macOS doesn't ship `flock`, so the heartbeat runner
+  falls back to an atomic `mkdir` lock. Keep both paths working in the runner.
 - **Plane state is a bare UUID.** The Plane v1 API returns an issue's `state` as
   a UUID with no embedded object, so the adapter must join issues against the
   project's states map. Descriptions are `description_html`, not
   `description_stripped`.
-- **Engine files render for every role.** Copier renders
-  `template/.scripts/scrum-master/` and the provider files for all roles, not
-  only `scrum-master`. They're inert for other roles because
-  `75-scrum-master.sh` self-guards on `role == scrum-master`. Restricting the
-  render to the `scrum-master` role with a conditional file path is a cosmetic
-  improvement noted in the roadmap.
 
 ## Open roadmap
 
@@ -298,14 +266,10 @@ The following work is open for the incoming agent, roughly in priority order.
    `launchd` agent, the `mkdir` lock, and the assumption that the older Copier
    steps (`10-hermes-profile.sh`, `80-registry.sh`) are Darwin-clean get their
    first real run on a Mac.
-3. **Give the Drumjangler Scrum Master its own runtime repo.** It currently
-   reuses the `pm` runtime through a symlink. Re-provision with
-   `SKIP_TELEGRAM=1` and a dedicated runtime repo, then replace the symlink.
-4. **Confirm the first full Hermes pass after a cutover.** Heartbeat,
-   adapter, and enforcement layers are verified, but the first live `run:full`
-   pass with the new prompt is the last thing to watch.
-5. **Restrict engine-file rendering to the `scrum-master` role.** Use a Copier
-   conditional file path so other roles don't receive inert engine files.
+3. **Confirm the first full Hermes reconciliation pass on a fresh PM.** The
+   heartbeat, adapter, and enforcement layers are verified, but the first live
+   `run:full` pass with the rendered prompt on a newly provisioned PM is the
+   last thing to watch.
 
 ## Read next
 

package/templates/hermes-agent/docs/{scrum-master → sentinel}/providers.md

@@ -173,11 +173,11 @@ export LINEAR_API_KEY="$(grep -E '^(export )?LINEAR_API_KEY=' \
   ~/.hermes/<agent>.env | head -1 | sed -E 's/^(export )?LINEAR_API_KEY=//; s/^"//; s/"$//')"
 
 # 2. Stage a role directory bound to the real board.
-T=$(mktemp -d); RD="$T/agents/hermes/scrum-master"
+T=$(mktemp -d); RD="$T/agents/hermes/pm"
 mkdir -p "$RD/.scripts/lib" "$RD/.scripts/providers"
 cp template/.scripts/lib/ticket-provider.sh "$RD/.scripts/lib/"
 cp template/.scripts/providers/linear.sh "$RD/.scripts/providers/"
-printf 'repo: demo\nrole: scrum-master\nticket_provider:\n  name: linear\n  team: DEL\n' \
+printf 'repo: demo\nrole: pm\nticket_provider:\n  name: linear\n  team: DEL\n' \
   > "$RD/role.yaml"
 
 # 3. Run the read operations.

package/templates/hermes-agent/docs/sentinel.md

@@ -0,0 +1,18 @@
+# The PM's heartbeat sentinel
+
+The PM runs a provider-agnostic ticket sentinel out-of-band on its heartbeat
+timer: a board-reconciliation pass with an autonomous adversarial review (act,
+do not wait), fused with a gated runtime checkpoint into a single timer tick.
+The full documentation lives in a dedicated handoff guide.
+
+This page is kept as a stable pointer so existing links keep working.
+
+## Where the docs live now
+
+- [Sentinel handoff overview](sentinel/README.md): start here.
+- [Architecture](sentinel/architecture.md): the heartbeat loop, the provider
+  abstraction, and the autonomous adversarial review.
+- [Providers](sentinel/providers.md): the adapter contract and how to add or
+  verify a provider.
+- [Development guide](sentinel/development.md): editing, validating,
+  provisioning, propagating, and the roadmap.

package/templates/hermes-agent/install-local.sh

@@ -1,8 +1,10 @@
 #!/usr/bin/env sh
-# Least-friction local install of Hermes PM + Scrum Master roles into a project.
+# Least-friction local install of the Hermes PM role into a project.
 #
 # Local-only: no GitHub runtime repo, no Telegram, no NATS/BloodBank, no Plane
-# project creation. It binds the Scrum Master to a ticket board you already have.
+# project creation. It binds the PM to a ticket board you already have. The PM
+# runs the continuous ticket sentinel out-of-band on its heartbeat timer
+# (board-reconciliation pass + gated runtime checkpoint, one tick).
 # Works on macOS (launchd) and Linux (systemd).
 #
 # One-liner (from anywhere inside the target project):
@@ -14,7 +16,7 @@
 # Environment overrides (skip the prompts):
 #   HAT_REPO=<name>            project/repo name (default: basename of CWD)
 #   HAT_PROVIDER=linear|plane|trello   (default: plane)
-#   HAT_ROLES="pm scrum-master"        roles to install (default: both)
+#   HAT_ROLES="pm"                     roles to install (default: pm)
 #   HAT_DRY_RUN=1              print actions, change nothing
 #   Provider creds: LINEAR_API_KEY | PLANE_API_KEY+PLANE_BASE | TRELLO_KEY+TRELLO_TOKEN
 set -eu
@@ -102,9 +104,9 @@ ask HAT_PROVIDER "Ticket provider (linear|plane|trello)" "plane"
 PROVIDER="$HAT_PROVIDER"
 ask HAT_REPO "Project/repo name" "$(basename "$PROJECT_DIR" | tr '[:upper:]' '[:lower:]')"
 REPO="$HAT_REPO"
-SM_ENV="$HOME/.hermes/${REPO}-scrum-master.env"
+PM_ENV="$HOME/.hermes/${REPO}-pm.env"
 
-# These get written into the scrum-master role.yaml binding after render.
+# These get written into the pm role.yaml binding after render.
 # Pre-seed from optional env knobs so the install can run non-interactively.
 TP_WORKSPACE="${HAT_PLANE_WORKSPACE:-}"; TP_PROJECT="${HAT_PLANE_PROJECT:-}"
 TP_TEAM="${HAT_LINEAR_TEAM:-}"; TP_BOARD="${HAT_TRELLO_BOARD:-}"
@@ -151,10 +153,10 @@ TRELLO_TOKEN=$TRELLO_TOKEN"
   *) die "unknown provider: $PROVIDER" ;;
 esac
 
-say "4. writing provider credentials to $SM_ENV"
+say "4. writing provider credentials to $PM_ENV"
 if [ "${HAT_DRY_RUN:-0}" != "1" ]; then
   mkdir -p "$HOME/.hermes"; umask 077
-  printf '%s\n' "$CRED_LINES" > "$SM_ENV"
+  printf '%s\n' "$CRED_LINES" > "$PM_ENV"
 fi
 
 # --- 5. Provision each role with copier (cloud + Telegram + systemd skipped) --
@@ -162,7 +164,7 @@ fi
 # we bind to the existing board below.
 export SKIP_TELEGRAM=1 SKIP_EMAIL=1 SKIP_RUNTIME_REPO=1 SKIP_PLANE=1 \
        SKIP_BLOODBANK=1 SKIP_SYSTEMD=1
-ROLES="${HAT_ROLES:-pm scrum-master}"
+ROLES="${HAT_ROLES:-pm}"
 for ROLE in $ROLES; do
   say "5. provisioning role: $ROLE"
   DEST="$PROJECT_DIR/agents/hermes/$ROLE"
@@ -174,12 +176,12 @@ for ROLE in $ROLES; do
         --data target_repo='$REPO' --data role='$ROLE' --data ticket_provider='$PROVIDER'"
 done
 
-# --- 6. Bind the Scrum Master to the existing board --------------------------
-SM_ROLE="$PROJECT_DIR/agents/hermes/scrum-master/role.yaml"
-if [ -f "$SM_ROLE" ] && [ "${HAT_DRY_RUN:-0}" != "1" ]; then
-  say "6. binding scrum-master to your $PROVIDER board"
+# --- 6. Bind the PM to the existing board ------------------------------------
+PM_ROLE="$PROJECT_DIR/agents/hermes/pm/role.yaml"
+if [ -f "$PM_ROLE" ] && [ "${HAT_DRY_RUN:-0}" != "1" ]; then
+  say "6. binding pm to your $PROVIDER board"
   TP_WORKSPACE="$TP_WORKSPACE" TP_PROJECT="$TP_PROJECT" TP_TEAM="$TP_TEAM" \
-  TP_BOARD="$TP_BOARD" PROVIDER="$PROVIDER" python3 - "$SM_ROLE" <<'PY'
+  TP_BOARD="$TP_BOARD" PROVIDER="$PROVIDER" python3 - "$PM_ROLE" <<'PY'
 import os, re, sys, pathlib
 p = pathlib.Path(sys.argv[1]); t = p.read_text()
 def setleaf(text, key, val):
@@ -196,19 +198,19 @@ PY
 fi
 
 # --- 7. Smoke test the board connection --------------------------------------
-if [ "${HAT_DRY_RUN:-0}" != "1" ] && [ -f "$SM_ROLE" ]; then
+if [ "${HAT_DRY_RUN:-0}" != "1" ] && [ -f "$PM_ROLE" ]; then
   say "7. smoke test: reading your board through the adapter"
-  LIB="$PROJECT_DIR/agents/hermes/scrum-master/.scripts/lib/ticket-provider.sh"
-  ( set -a; . "$SM_ENV" 2>/dev/null; set +a
+  LIB="$PROJECT_DIR/agents/hermes/pm/.scripts/lib/ticket-provider.sh"
+  ( set -a; . "$PM_ENV" 2>/dev/null; set +a
     bash -c '. "$1"; tp resolve && echo "   issues: $(tp list_issues | python3 -c "import sys,json;print(len(json.load(sys.stdin)))")"' _ "$LIB" ) \
-    || warn "   smoke test failed — check the binding in $SM_ROLE and creds in $SM_ENV"
+    || warn "   smoke test failed — check the binding in $PM_ROLE and creds in $PM_ENV"
 fi
 
 say ""
 say "Done. Talk to the PM:   agents/hermes/pm/hermes chat \"status\""
 if [ "$OS" = "Darwin" ]; then
-  say "Sentinel (launchd):     launchctl list | grep $REPO-scrum-master"
+  say "Sentinel (launchd):     launchctl list | grep $REPO-pm-heartbeat"
 else
-  say "Sentinel (systemd):     systemctl --user status hermes-$REPO-scrum-master-continuous-ticket-sentinel.timer"
+  say "Sentinel (systemd):     systemctl --user status hermes-$REPO-pm-heartbeat.timer"
 fi
-say "Provider creds live in: $SM_ENV"
+say "Provider creds live in: $PM_ENV"

package/templates/hermes-agent/runtime-scaffold/README.md

@@ -1,16 +1,14 @@
 # {{agent_id}} — runtime
 
-This is the durable runtime for the **{{display_name}}** agent. The named
-Hermes profile `{{profile_name}}` points here from `~/.hermes/profiles/{{profile_name}}`,
-so Hermes sees an ordinary profile while this repo stays git-tracked and
-recoverable across machines.
+This is the HERMES_HOME for the **{{display_name}}** agent. It is git-tracked
+so memory, SOUL evolution, and conversation history are durable across machines
+and recoverable on failure.
 
 ## What's in here
 
 | Path | Tracked? | Purpose |
 | --- | --- | --- |
-| `profile.yaml` | yes | Opts this profile into inheriting config from default |
-| `config.yaml` | yes | Local config overrides only; shared defaults come from the fleet default |
+| `config.yaml` | yes | Inference + skill config (cloned from global at provision time) |
 | `SOUL.md` | yes | The agent's personality, evolves over time |
 | `memories/MEMORY.md` | yes | The condensed mental-model summary loaded each session |
 | `memories/USER.md` | yes | The operator's persona (Jarad DeLorenzo, ...) |
@@ -25,11 +23,14 @@ recoverable across machines.
 
 ## Checkpoint cadence
 
-- Hourly: systemd `--user` timer `hermes-{{agent_id}}-checkpoint.timer`
+- Heartbeat: systemd `--user` timer `hermes-{{agent_id}}-heartbeat.timer`. Each
+  tick reconciles the ticket board (the PM's sentinel pass) and then, gated to
+  at most once an hour, checkpoints this runtime.
 - On session end: hermes Stop hook (TODO: hook script in `~/.hermes/hooks/`)
 
-The checkpoint script lives in the parent's `.scripts/checkpoint.sh`. It
-`git add -A`, commits only if dirty, and pushes to `origin`.
+The heartbeat runner lives in the parent's `.scripts/heartbeat.sh`; it calls
+`.scripts/checkpoint.sh` internally, which `git add -A`, commits only if dirty,
+and pushes to `origin`.
 
 ## Restoring on a new machine
 

package/templates/hermes-agent/scripts/backfill-fleet-sot.sh

@@ -28,8 +28,8 @@ PYEOF
 
 FLEET_ENV="${HERMES_FLEET_ENV:-$(cfg fleet.fleet_env "$HOME/.hermes/fleet.env")}"
 REGISTRY_FILE="${HERMES_FLEET_REGISTRY_FILE:-$(cfg fleet.registry_file "$HOME/.hermes/agents-registry.yaml")}"
-DEFAULT_BIN="${HERMES_FLEET_BIN:-$(cfg fleet.hermes_bin /home/delorenj/code/hermes-agent/.venv/bin/hermes)}"
-DEFAULT_REPO="${HERMES_FLEET_REPO:-$(cfg fleet.hermes_repo /home/delorenj/code/hermes-agent)}"
+DEFAULT_BIN="${HERMES_FLEET_BIN:-$(cfg fleet.hermes_bin "$HOME/.hermes/hermes-agent/.venv/bin/hermes")}"
+DEFAULT_REPO="${HERMES_FLEET_REPO:-$(cfg fleet.hermes_repo "$HOME/.hermes/hermes-agent")}"
 DEFAULT_OAUTH_FILE="${HERMES_FLEET_OAUTH_FILE:-$(cfg fleet.oauth_file "$HOME/.hermes/auth.json")}"
 DEFAULT_CODEX_HOME="${HERMES_FLEET_CODEX_HOME:-$(cfg fleet.codex_home "$HOME/.codex")}"
 SCAFFOLD_SRC="$(cd "$(dirname "$0")/../template/.runtime-scaffold" && pwd)"
@@ -160,7 +160,6 @@ for agent_id, cfg in agents.items():
 
     project_path = pathlib.Path(cfg.get("project_path") or "")
     role_name = cfg.get("role") or "pm"
-    profile_name = cfg.get("profile_name") or agent_id
     alt_role_path = project_path / "_agents" / "hermes" / role_name
     if not (role_path / "hermes").exists() and (alt_role_path / "hermes").exists():
         role_path = alt_role_path
@@ -188,14 +187,14 @@ for agent_id, cfg in agents.items():
             "  source \"$FLEET_ENV\"\n"
             "fi\n\n"
             "# Tools we expect on the host\n"
-            "HERMES_BIN=\"${HERMES_BIN:-${HERMES_FLEET_BIN:-/home/delorenj/code/hermes-agent/.venv/bin/hermes}}\"\n"
-            "HERMES_AGENT_REPO=\"${HERMES_AGENT_REPO:-${HERMES_FLEET_REPO:-/home/delorenj/code/hermes-agent}}\"\n"
+            "HERMES_BIN=\"${HERMES_BIN:-${HERMES_FLEET_BIN:-$HOME/.hermes/hermes-agent/.venv/bin/hermes}}\"\n"
+            "HERMES_AGENT_REPO=\"${HERMES_AGENT_REPO:-${HERMES_FLEET_REPO:-$HOME/.hermes/hermes-agent}}\"\n"
             "HERMES_OAUTH_FILE=\"${HERMES_OAUTH_FILE:-${HERMES_FLEET_OAUTH_FILE:-$HOME/.hermes/auth.json}}\"\n"
             "CODEX_HOME=\"${CODEX_HOME:-${HERMES_FLEET_CODEX_HOME:-$HOME/.codex}}\"\n"
             "# Prefer a scaffold vendored into this agent directory; fall back to legacy template path.\n"
             "RUNTIME_SCAFFOLD_DIR=\"${RUNTIME_SCAFFOLD_DIR:-$ROLE_DIR/.runtime-scaffold}\"\n"
             "if [[ ! -d \"$RUNTIME_SCAFFOLD_DIR\" ]]; then\n"
-            "  RUNTIME_SCAFFOLD_DIR=\"${HERMES_TEMPLATE_RUNTIME_SCAFFOLD:-/home/delorenj/code/hermes-agent-template/runtime-scaffold}\"\n"
+            "  RUNTIME_SCAFFOLD_DIR=\"${HERMES_TEMPLATE_RUNTIME_SCAFFOLD:-$HOME/code/hermes-agent-template/runtime-scaffold}\"\n"
             "fi\n"
             "REGISTRY_FILE=\"${REGISTRY_FILE:-${HERMES_FLEET_REGISTRY_FILE:-$HOME/.hermes/agents-registry.yaml}}\"\n"
         )
@@ -203,8 +202,8 @@ for agent_id, cfg in agents.items():
             lib_text = lib_text.replace(old_block, new_block)
         if "HERMES_OAUTH_FILE=" not in lib_text:
             lib_text = lib_text.replace(
-                "HERMES_AGENT_REPO=\"${HERMES_AGENT_REPO:-${HERMES_FLEET_REPO:-/home/delorenj/code/hermes-agent}}\"\n",
-                "HERMES_AGENT_REPO=\"${HERMES_AGENT_REPO:-${HERMES_FLEET_REPO:-/home/delorenj/code/hermes-agent}}\"\n"
+                "HERMES_AGENT_REPO=\"${HERMES_AGENT_REPO:-${HERMES_FLEET_REPO:-$HOME/.hermes/hermes-agent}}\"\n",
+                "HERMES_AGENT_REPO=\"${HERMES_AGENT_REPO:-${HERMES_FLEET_REPO:-$HOME/.hermes/hermes-agent}}\"\n"
                 "HERMES_OAUTH_FILE=\"${HERMES_OAUTH_FILE:-${HERMES_FLEET_OAUTH_FILE:-$HOME/.hermes/auth.json}}\"\n"
                 "CODEX_HOME=\"${CODEX_HOME:-${HERMES_FLEET_CODEX_HOME:-$HOME/.codex}}\"\n",
             )
@@ -226,28 +225,20 @@ for agent_id, cfg in agents.items():
 
     wrapper.write_text(
         "#!/usr/bin/env bash\n"
-        f"# Launcher for {agent_id}. Resolves HERMES_HOME through the fleet profile when available.\n"
+        f"# Launcher for {agent_id}. Resolves HERMES_HOME to runtime and execs shared fleet Hermes.\n"
         "set -euo pipefail\n\n"
         "ROLE_DIR=\"$(cd \"$(dirname \"$0\")\" && pwd)\"\n"
-        "RUNTIME_HOME=\"$ROLE_DIR/runtime\"\n\n"
+        "HERMES_HOME=\"$ROLE_DIR/runtime\"\n\n"
         "FLEET_ENV=\"${HERMES_FLEET_ENV:-$HOME/.hermes/fleet.env}\"\n"
         "if [[ -f \"$FLEET_ENV\" ]]; then\n"
         "  # shellcheck disable=SC1090\n"
         "  source \"$FLEET_ENV\"\n"
         "fi\n\n"
-        "HERMES_BIN=\"${HERMES_BIN:-${HERMES_FLEET_BIN:-/home/delorenj/code/hermes-agent/.venv/bin/hermes}}\"\n\n"
+        "HERMES_BIN=\"${HERMES_BIN:-${HERMES_FLEET_BIN:-$HOME/.hermes/hermes-agent/.venv/bin/hermes}}\"\n\n"
         "HERMES_OAUTH_FILE=\"${HERMES_OAUTH_FILE:-${HERMES_FLEET_OAUTH_FILE:-$HOME/.hermes/auth.json}}\"\n"
         "CODEX_HOME=\"${CODEX_HOME:-${HERMES_FLEET_CODEX_HOME:-$HOME/.codex}}\"\n\n"
-        "FLEET_HOME=\"${HERMES_FLEET_HOME:-$HOME/.hermes}\"\n"
-        f"PROFILE_NAME=\"${{HERMES_PROFILE_NAME:-{profile_name}}}\"\n"
-        "PROFILE_HOME=\"$FLEET_HOME/profiles/$PROFILE_NAME\"\n"
-        "if [[ -d \"$PROFILE_HOME\" ]]; then\n"
-        "  HERMES_HOME=\"$PROFILE_HOME\"\n"
-        "else\n"
-        "  HERMES_HOME=\"$RUNTIME_HOME\"\n"
-        "fi\n\n"
-        "if [[ ! -d \"$RUNTIME_HOME\" ]]; then\n"
-        "  echo \"hermes: runtime submodule not initialized at $RUNTIME_HOME\" >&2\n"
+        "if [[ ! -d \"$HERMES_HOME\" ]]; then\n"
+        "  echo \"hermes: runtime submodule not initialized at $HERMES_HOME\" >&2\n"
         "  echo \"  fix: git submodule update --init --recursive\" >&2\n"
         "  exit 1\n"
         "fi\n\n"