@delorenj/pjangler 1.1.5 → 1.2.2

package/dist/index.js

@@ -1,24 +1,16 @@
 #!/usr/bin/env node
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
 
 // src/index.ts
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { existsSync as existsSync9, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
+import { basename as basename4, join as join11, resolve as resolve3 } from "node:path";
 import { Command as Command3 } from "commander";
 
 // src/commands/hermes/types.ts
 var HERMES_AGENT_TEMPLATE = "gh:delorenj/hermes-agent-template";
 var SOUL_TONES = ["direct", "playful", "formal", "terse"];
 var ROLE_CHOICES = [
-  { value: "pm", label: "Project Manager (pm)", hint: "triage, planning, ticket authorship" },
-  {
-    value: "scrum-master",
-    label: "Scrum Master (Ticket Sentinel)",
-    hint: "continuous ticket sentinel + autonomous delegated review"
-  },
+  { value: "pm", label: "Project Manager (pm)", hint: "triage, planning, ticket authorship, board reconciliation" },
   { value: "dev", label: "Developer (dev)", hint: "implements tickets" },
   { value: "review", label: "Reviewer (review)", hint: "adversarial code review" },
   { value: "ops", label: "Ops (ops)", hint: "deploy / infra" },
@@ -38,10 +30,12 @@ function deriveProfileName(repo, role) {
 
 // src/commands/hermes/EnsureTemplateConfig.ts
 import { homedir, platform } from "node:os";
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join2, dirname as dirname2 } from "node:path";
 
 // src/commands/Command.ts
+import { existsSync, writeFileSync, mkdirSync } from "fs";
+import { join, dirname } from "path";
 var Command = class {
   context;
   constructor(context) {
@@ -54,30 +48,24 @@ var Command = class {
     return this.context.dryRun ? `[DRY RUN] ${message}` : message;
   }
   fileExists(filePath) {
-    const { existsSync: existsSync6 } = __require("fs");
-    const { join: join8 } = __require("path");
-    const fullPath = join8(this.context.targetDir, filePath);
-    return existsSync6(fullPath);
+    const fullPath = join(this.context.targetDir, filePath);
+    return existsSync(fullPath);
   }
   writeFile(filePath, content) {
     if (this.context.dryRun) {
       return;
     }
-    const { writeFileSync: writeFileSync3, mkdirSync: mkdirSync4 } = __require("fs");
-    const { join: join8, dirname: dirname5 } = __require("path");
-    const fullPath = join8(this.context.targetDir, filePath);
-    const dir = dirname5(fullPath);
-    mkdirSync4(dir, { recursive: true });
-    writeFileSync3(fullPath, content);
+    const fullPath = join(this.context.targetDir, filePath);
+    const dir = dirname(fullPath);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(fullPath, content);
   }
   createDirectory(dirPath) {
     if (this.context.dryRun) {
       return;
     }
-    const { mkdirSync: mkdirSync4 } = __require("fs");
-    const { join: join8 } = __require("path");
-    const fullPath = join8(this.context.targetDir, dirPath);
-    mkdirSync4(fullPath, { recursive: true });
+    const fullPath = join(this.context.targetDir, dirPath);
+    mkdirSync(fullPath, { recursive: true });
   }
 };
 
@@ -86,26 +74,26 @@ function resolveTemplateConfigPath() {
   const fromEnv = process.env.HERMES_TEMPLATE_CONFIG;
   if (fromEnv && fromEnv.trim()) return fromEnv.trim();
   const xdg = process.env.XDG_CONFIG_HOME?.trim();
-  const base = xdg && xdg.length ? xdg : join(homedir(), ".config");
-  return join(base, "hermes-agent-template", "config.toml");
+  const base = xdg && xdg.length ? xdg : join2(homedir(), ".config");
+  return join2(base, "hermes-agent-template", "config.toml");
 }
 function detectHermesBin(home) {
   const candidates = [
-    join(home, "code", "hermes-agent", "venv", "bin", "hermes"),
-    join(home, "code", "hermes-agent", ".venv", "bin", "hermes"),
-    join(home, ".local", "bin", "hermes")
+    join2(home, "code", "hermes-agent", "venv", "bin", "hermes"),
+    join2(home, "code", "hermes-agent", ".venv", "bin", "hermes"),
+    join2(home, ".local", "bin", "hermes")
   ];
   for (const c of candidates) {
-    if (existsSync(c)) return c;
+    if (existsSync2(c)) return c;
   }
   return candidates[0];
 }
 function renderHostConfig() {
   const home = homedir();
   const hermesBin = detectHermesBin(home);
-  const hermesRepo = join(home, "code", "hermes-agent");
-  const scaffoldDir = join(home, "code", "hermes-agent-template", "runtime-scaffold");
-  const skillsDir = join(home, ".agents", "skills");
+  const hermesRepo = join2(home, "code", "hermes-agent");
+  const scaffoldDir = join2(home, "code", "hermes-agent-template", "runtime-scaffold");
+  const skillsDir = join2(home, ".agents", "skills");
   return `# hermes-agent-template \u2014 host configuration
 # Bootstrapped by \`pjangler config bootstrap\` for $HOME=${home} (platform=${platform()}).
 #
@@ -149,7 +137,7 @@ var EnsureTemplateConfig = class extends Command {
     const ctx = this.context;
     const force = ctx.forceConfig === true || process.env.PJANGLER_FORCE_CONFIG === "1";
     const path = resolveTemplateConfigPath();
-    const exists = existsSync(path);
+    const exists = existsSync2(path);
     if (exists && !force) {
       console.log(`\u2713 Config present: ${path}`);
       return { success: true, message: "" };
@@ -159,8 +147,8 @@ var EnsureTemplateConfig = class extends Command {
       return { success: true, message: "" };
     }
     try {
-      mkdirSync(dirname(path), { recursive: true });
-      writeFileSync(path, renderHostConfig());
+      mkdirSync2(dirname2(path), { recursive: true });
+      writeFileSync2(path, renderHostConfig());
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       return { success: false, message: `\u2717 Failed to write ${path}: ${msg}` };
@@ -577,12 +565,12 @@ var NodeRecipe = class extends Recipe {
 };
 
 // src/commands/hermes/PromptForAgentConfig.ts
-import { basename, join as join2 } from "node:path";
+import { basename, join as join3 } from "node:path";
 import { readFileSync } from "node:fs";
 import * as p from "@clack/prompts";
 function detectTicketProvider(targetDir) {
   try {
-    const t = JSON.parse(readFileSync(join2(targetDir, ".project.json"), "utf8"))?.ticket_provider?.type;
+    const t = JSON.parse(readFileSync(join3(targetDir, ".project.json"), "utf8"))?.ticket_provider?.type;
     return t === "plane" || t === "linear" || t === "trello" ? t : void 0;
   } catch {
     return void 0;
@@ -601,7 +589,6 @@ var PromptForAgentConfig = class extends Command {
       ctx.modelProvider ??= "";
       ctx.modelName ??= "";
       ctx.ticketProvider ??= detectTicketProvider(ctx.targetDir) ?? "plane";
-      ctx.withScrumMaster ??= false;
       ctx.skipTelegram ??= true;
       ctx.skipEmail ??= true;
       ctx.agentId = deriveAgentId(ctx.targetRepo, ctx.role);
@@ -647,14 +634,6 @@ var PromptForAgentConfig = class extends Command {
       if (p.isCancel(answer)) return this.cancelled();
       ctx.ticketProvider = answer;
     }
-    if (ctx.role === "pm" && ctx.withScrumMaster === void 0) {
-      const answer = await p.confirm({
-        message: "Also provision the paired Scrum Master (Ticket Sentinel) for this repo?",
-        initialValue: true
-      });
-      if (p.isCancel(answer)) return this.cancelled();
-      ctx.withScrumMaster = answer === true;
-    }
     if (!ctx.agentPurpose) {
       const answer = await p.text({
         message: "One-line purpose",
@@ -727,21 +706,21 @@ var PromptForAgentConfig = class extends Command {
 // src/commands/hermes/RunCopierTemplate.ts
 import { spawnSync } from "node:child_process";
 import { homedir as homedir2 } from "node:os";
-import { join as join3, dirname as dirname2 } from "node:path";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2 } from "node:fs";
+import { join as join4, dirname as dirname3 } from "node:path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3 } from "node:fs";
 import { fileURLToPath } from "node:url";
 import * as p2 from "@clack/prompts";
 function resolveVendoredTemplate(name) {
   let dir;
   try {
-    dir = dirname2(fileURLToPath(import.meta.url));
+    dir = dirname3(fileURLToPath(import.meta.url));
   } catch {
     return void 0;
   }
   for (let i = 0; i < 8; i++) {
-    const candidate = join3(dir, "templates", name);
-    if (existsSync2(join3(candidate, "copier.yml"))) return candidate;
-    const parent = dirname2(dir);
+    const candidate = join4(dir, "templates", name);
+    if (existsSync3(join4(candidate, "copier.yml"))) return candidate;
+    const parent = dirname3(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -753,14 +732,13 @@ var RunCopierTemplate = class extends Command {
     const { targetRepo, role, agentPurpose, soulTone, modelProvider, modelName } = ctx;
     const ticketProvider = ctx.ticketProvider ?? "plane";
     const profileName = ctx.profileName ?? (targetRepo && role ? deriveProfileName(targetRepo, role) : void 0);
-    const withScrumMaster = role === "pm" && ctx.withScrumMaster === true;
     if (!targetRepo || !role) {
       return {
         success: false,
         message: "PromptForAgentConfig must run before RunCopierTemplate (targetRepo/role unset)"
       };
     }
-    const roleDir = join3(ctx.targetDir, "agents", "hermes", role);
+    const roleDir = join4(ctx.targetDir, "agents", "hermes", role);
     ctx.roleDir = roleDir;
     ctx.runtimeRepo = `delorenj/agent-hm-${targetRepo}-${role}`;
     const which = spawnSync("which", ["copier"], { encoding: "utf8" });
@@ -770,7 +748,7 @@ var RunCopierTemplate = class extends Command {
         message: "\u2717 copier not found on PATH.  Install with: `uv tool install copier` or `pip install copier`"
       };
     }
-    if (existsSync2(join3(roleDir, "role.yaml")) && !ctx.force) {
+    if (existsSync3(join4(roleDir, "role.yaml")) && !ctx.force) {
       if (ctx.yes) {
         ctx.force = true;
       } else {
@@ -797,9 +775,9 @@ var RunCopierTemplate = class extends Command {
       SKIP_BLOODBANK: ctx.skipBloodbank ? "1" : "0",
       SKIP_SYSTEMD: ctx.skipSystemd ? "1" : "0"
     };
-    const LOCAL_TEMPLATE = join3(homedir2(), "code", "hermes-agent-template");
+    const LOCAL_TEMPLATE = join4(homedir2(), "code", "hermes-agent-template");
     const vendored = resolveVendoredTemplate("hermes-agent");
-    const templateSrc = process.env.PJANGLER_HERMES_TEMPLATE || vendored || (existsSync2(join3(LOCAL_TEMPLATE, "copier.yml")) ? LOCAL_TEMPLATE : HERMES_AGENT_TEMPLATE);
+    const templateSrc = process.env.PJANGLER_HERMES_TEMPLATE || vendored || (existsSync3(join4(LOCAL_TEMPLATE, "copier.yml")) ? LOCAL_TEMPLATE : HERMES_AGENT_TEMPLATE);
     const args = [
       "copy",
       templateSrc,
@@ -820,8 +798,6 @@ var RunCopierTemplate = class extends Command {
       `soul_tone=${soulTone ?? "direct"}`,
       "--data",
       `ticket_provider=${ticketProvider}`,
-      "--data",
-      `with_scrum_master=${withScrumMaster}`,
       "--trust",
       "--vcs-ref=HEAD"
     ];
@@ -832,7 +808,7 @@ var RunCopierTemplate = class extends Command {
         message: this.formatMessage(`Would run: copier ${args.join(" ")}`)
       };
     }
-    mkdirSync2(join3(ctx.targetDir, "agents", "hermes"), { recursive: true });
+    mkdirSync3(join4(ctx.targetDir, "agents", "hermes"), { recursive: true });
     const spinner4 = p2.spinner();
     spinner4.start(`Running copier copy  (target: agents/hermes/${role})`);
     const result = spawnSync("copier", args, {
@@ -857,8 +833,8 @@ var RunCopierTemplate = class extends Command {
 
 // src/commands/hermes/WireTelegram.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { join as join4 } from "node:path";
-import { existsSync as existsSync3, unlinkSync } from "node:fs";
+import { join as join5 } from "node:path";
+import { existsSync as existsSync4, unlinkSync } from "node:fs";
 import * as p3 from "@clack/prompts";
 var WireTelegram = class extends Command {
   async invoke() {
@@ -946,15 +922,15 @@ var WireTelegram = class extends Command {
     if (p3.isCancel(allowedAnswer)) {
       return { success: false, message: "\u2717 Aborted; Telegram step deferred." };
     }
-    const script = join4(roleDir, ".scripts", "30-telegram.sh");
-    if (!existsSync3(script)) {
+    const script = join5(roleDir, ".scripts", "30-telegram.sh");
+    if (!existsSync4(script)) {
       return {
         success: false,
         message: `\u2717 ${script} not found.  Did copier finish?  Re-run with --skip-runtime-repo=0 if you skipped it.`
       };
     }
-    const marker = join4(roleDir, ".scripts", ".done-30-telegram");
-    if (existsSync3(marker)) unlinkSync(marker);
+    const marker = join5(roleDir, ".scripts", ".done-30-telegram");
+    if (existsSync4(marker)) unlinkSync(marker);
     const spinner4 = p3.spinner();
     spinner4.start("Verifying token + wiring profile");
     const result = spawnSync2("bash", [script], {
@@ -981,8 +957,8 @@ function cap(s) {
 
 // src/commands/hermes/WireEmail.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { join as join5 } from "node:path";
-import { existsSync as existsSync4, unlinkSync as unlinkSync2 } from "node:fs";
+import { join as join6 } from "node:path";
+import { existsSync as existsSync5, unlinkSync as unlinkSync2 } from "node:fs";
 import * as p4 from "@clack/prompts";
 var WireEmail = class extends Command {
   async invoke() {
@@ -997,8 +973,8 @@ var WireEmail = class extends Command {
     if (!targetRepo || !role || !roleDir) {
       return { success: false, message: "Cannot wire email: missing target_repo/role/roleDir" };
     }
-    const script = join5(roleDir, ".scripts", "50-email.sh");
-    if (!existsSync4(script)) {
+    const script = join6(roleDir, ".scripts", "50-email.sh");
+    if (!existsSync5(script)) {
       return { success: false, message: `\u2717 ${script} not found` };
     }
     let token = process.env.CF_EMAIL_ROUTING_TOKEN;
@@ -1060,8 +1036,8 @@ var WireEmail = class extends Command {
         }
       }
     }
-    const marker = join5(roleDir, ".scripts", ".done-50-email");
-    if (existsSync4(marker)) unlinkSync2(marker);
+    const marker = join6(roleDir, ".scripts", ".done-50-email");
+    if (existsSync5(marker)) unlinkSync2(marker);
     const spinner4 = p4.spinner();
     spinner4.start("Creating Cloudflare Email Routing rule");
     const result = spawnSync3("bash", [script], {
@@ -1090,7 +1066,7 @@ var PrintHermesSummary = class extends Command {
     const email = `${targetRepo}-${role}@delo.sh`;
     const gw = `hermes-${agentId}-gateway.service`;
     const csm = `hermes-${agentId}-consumer.service`;
-    const ckpt = `hermes-${agentId}-checkpoint.timer`;
+    const hb = `hermes-${agentId}-heartbeat.timer`;
     const lines = [];
     lines.push(`agent_id     ${agentId}`);
     lines.push(`role dir     ${ctx.roleDir}`);
@@ -1100,7 +1076,7 @@ var PrintHermesSummary = class extends Command {
     lines.push("");
     lines.push("Start daemons:");
     lines.push(`  systemctl --user start ${csm}`);
-    lines.push(`  systemctl --user start ${ckpt}`);
+    lines.push(`  systemctl --user start ${hb}`);
     if (!skipTelegram) {
       lines.push(`  systemctl --user start ${gw}`);
     } else {
@@ -1147,6 +1123,193 @@ var HermesAgentRecipe = class extends Recipe {
   }
 };
 
+// src/commands/AgentHooksCommands.ts
+import { homedir as homedir3 } from "node:os";
+import { join as join7, dirname as dirname4 } from "node:path";
+import { existsSync as existsSync6, cpSync, mkdirSync as mkdirSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+function resolveTemplateRoot() {
+  const candidates = [];
+  if (process.env.PJANGLER_COMMONPROJECT_TEMPLATE) {
+    candidates.push(process.env.PJANGLER_COMMONPROJECT_TEMPLATE);
+  }
+  try {
+    let dir = dirname4(fileURLToPath2(import.meta.url));
+    for (let i = 0; i < 8; i++) {
+      candidates.push(join7(dir, "templates", "commonproject", "template"));
+      const parent = dirname4(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  } catch {
+  }
+  candidates.push(join7(homedir3(), "code", "pjangler", "templates", "commonproject", "template"));
+  for (const c of candidates) {
+    if (existsSync6(join7(c, ".agents", "hooks", "hooks.master.json"))) return c;
+  }
+  throw new Error(
+    "Could not locate the CommonProject template. Set PJANGLER_COMMONPROJECT_TEMPLATE to <repo>/templates/commonproject/template."
+  );
+}
+var CopyAgentHooksTree = class extends Command {
+  async invoke() {
+    let templateRoot;
+    try {
+      templateRoot = resolveTemplateRoot();
+    } catch (e) {
+      return { success: false, message: `\u26A0\uFE0F  ${e.message}` };
+    }
+    const items = [
+      { rel: ".agents/hooks", dir: true },
+      { rel: ".agents/local.example.json", dir: false },
+      { rel: ".mise/scripts/link-project-skills-to-clis.sh", dir: false },
+      { rel: ".mise/scripts/unlink-project-skills-from-clis.sh", dir: false },
+      { rel: ".mise/scripts/hindsight-setup.sh", dir: false }
+    ];
+    const created = [];
+    const skipped = [];
+    for (const { rel, dir } of items) {
+      const src = join7(templateRoot, rel);
+      const dest = join7(this.context.targetDir, rel);
+      if (!existsSync6(src)) continue;
+      if (existsSync6(dest) && !this.context.force) {
+        skipped.push(rel);
+        continue;
+      }
+      if (!this.context.dryRun) {
+        mkdirSync4(dirname4(dest), { recursive: true });
+        cpSync(src, dest, { recursive: dir, force: true });
+      }
+      created.push(rel);
+    }
+    const verb = this.context.dryRun ? "Would copy" : "Copied";
+    const tail = skipped.length ? ` (${skipped.length} already present \u2014 use --force to overwrite)` : "";
+    return {
+      success: created.length > 0,
+      message: this.formatMessage(`\u2705 ${verb} ${created.length} agent-hooks path(s)${tail}`)
+    };
+  }
+};
+var WireMiseAgentHooks = class _WireMiseAgentHooks extends Command {
+  static MARKER = "# pjangler:agent-hooks";
+  static CR = "{{config_root}}";
+  // mise's own runtime var — emitted literally
+  async invoke() {
+    const misePath = join7(this.context.targetDir, "mise.toml");
+    if (!existsSync6(misePath)) {
+      return {
+        success: false,
+        message: "\u26A0\uFE0F  No mise.toml found \u2014 run `pjangler init mise` first, then re-run."
+      };
+    }
+    let content = readFileSync2(misePath, "utf8");
+    if (content.includes(_WireMiseAgentHooks.MARKER)) {
+      return { success: true, message: this.formatMessage("\u2713 mise.toml already wired for agent-hooks") };
+    }
+    const cr = _WireMiseAgentHooks.CR;
+    const enterAdds = [
+      `  "${cr}/.mise/scripts/link-project-skills-to-clis.sh",`,
+      `  "${cr}/.agents/hooks/sync.py --install --quiet",`
+    ].join("\n");
+    const leaveBlock = [
+      "leave = [",
+      `  "${cr}/.mise/scripts/unlink-project-skills-from-clis.sh",`,
+      `  "${cr}/.agents/hooks/sync.py --uninstall --quiet",`,
+      "]"
+    ].join("\n");
+    let wiredHooks = false;
+    const enterRe = /(enter\s*=\s*\[[\s\S]*?)(\n[ \t]*\])/;
+    if (enterRe.test(content)) {
+      content = content.replace(enterRe, (_m, head, close) => {
+        const sep = /[,[]\s*$/.test(head) ? "" : ",";
+        return `${head}${sep}
+${enterAdds}${close}`;
+      });
+      const leaveRe = /(leave\s*=\s*\[[\s\S]*?)(\n[ \t]*\])/;
+      if (leaveRe.test(content)) {
+        content = content.replace(leaveRe, (_m, head, close) => {
+          const sep = /[,[]\s*$/.test(head) ? "" : ",";
+          return `${head}${sep}
+  "${cr}/.mise/scripts/unlink-project-skills-from-clis.sh",
+  "${cr}/.agents/hooks/sync.py --uninstall --quiet",${close}`;
+        });
+      } else {
+        content = content.replace(enterRe, (m) => `${m}
+${leaveBlock}`);
+      }
+      wiredHooks = true;
+    }
+    const appended = [
+      "",
+      _WireMiseAgentHooks.MARKER + " (generated \u2014 see .agents/hooks/README.md)",
+      "[[watch_files]]",
+      'patterns = [".agents/hooks/hooks.master.json"]',
+      'task = "hooks-sync"',
+      "",
+      "[tasks.hooks-sync]",
+      'description = "Fan out hooks.master.json to each agent CLI (claude/codex/kimi/hermes)"',
+      `run = "${cr}/.agents/hooks/sync.py --install"`,
+      "",
+      "[tasks.hooks-check]",
+      'description = "Drift gate: verify generated hook configs match hooks.master.json"',
+      `run = "${cr}/.agents/hooks/sync.py --check"`,
+      "",
+      "[tasks.hooks-uninstall]",
+      'description = "Remove per-user agent-hook injections (codex/kimi/hermes)"',
+      `run = "${cr}/.agents/hooks/sync.py --uninstall"`,
+      "",
+      "[tasks.link-project-skills-to-clis]",
+      'description = "Fan .agents/skills out to each agent CLI (honors local.json)"',
+      `run = "${cr}/.mise/scripts/link-project-skills-to-clis.sh"`,
+      "",
+      "[tasks.unlink-project-skills-from-clis]",
+      'description = "Remove project skill symlinks from shared per-CLI dirs"',
+      `run = "${cr}/.mise/scripts/unlink-project-skills-from-clis.sh"`,
+      "",
+      "[tasks.skills-relink]",
+      'description = "Re-fan the project skill set to all CLIs"',
+      `run = "${cr}/.mise/scripts/link-project-skills-to-clis.sh"`,
+      "",
+      "[tasks.hindsight-setup]",
+      `description = "Provision this dev's shared project Hindsight key from 1Password into .env"`,
+      `run = "${cr}/.mise/scripts/hindsight-setup.sh"`,
+      "",
+      _WireMiseAgentHooks.MARKER + ":end",
+      ""
+    ].join("\n");
+    content = content.replace(/\n*$/, "\n") + appended;
+    if (!this.context.dryRun) writeFileSync3(misePath, content);
+    if (wiredHooks) {
+      return { success: true, message: this.formatMessage("\u2705 Wired mise.toml ([hooks] enter/leave + tasks)") };
+    }
+    return {
+      success: true,
+      message: this.formatMessage(
+        `\u2705 Added agent-hooks tasks to mise.toml.
+   \u26A0\uFE0F  Could not find a [hooks].enter array to extend \u2014 add these to your [hooks] block manually:
+     enter += "${cr}/.mise/scripts/link-project-skills-to-clis.sh", "${cr}/.agents/hooks/sync.py --install --quiet"
+     leave += "${cr}/.mise/scripts/unlink-project-skills-from-clis.sh", "${cr}/.agents/hooks/sync.py --uninstall --quiet"`
+      )
+    };
+  }
+};
+
+// src/recipes/AgentHooksRecipe.ts
+var AgentHooksRecipe = class extends Recipe {
+  constructor(context) {
+    super(context);
+    this.addIngredient(CopyAgentHooksTree).addIngredient(WireMiseAgentHooks);
+  }
+  printNextSteps() {
+    console.log("\u{1FA9D} Agent-hooks layer installed!");
+    console.log("   Next steps:");
+    console.log("   1. mise run hooks-sync   # generate .claude/settings.json + inject codex/kimi/hermes");
+    console.log("   2. git add .claude/settings.json .agents/hooks && commit (codex/kimi/hermes are per-dev)");
+    console.log("   3. mise run hindsight-setup   # set HINDSIGHT_OP_KEY_REF to your 1Password item first");
+    console.log(`   4. If you run a global agent system: echo '{"skills":{"defer_to_global":true}}' > .agents/local.json`);
+  }
+};
+
 // src/utils/registry.ts
 var RECIPE_REGISTRY = {
   mise: {
@@ -1180,9 +1343,27 @@ var RECIPE_REGISTRY = {
       "WireEmail",
       "PrintHermesSummary"
     ]
+  },
+  "agent-hooks": {
+    name: "agent-hooks",
+    description: "Retrofit the project-scoped agent-hooks + skill fan-out layer (Claude/Codex/Kimi/Hermes hooks via mise enter/leave)",
+    class: AgentHooksRecipe,
+    commands: ["CopyAgentHooksTree", "WireMiseAgentHooks"]
   }
 };
 var COMMAND_REGISTRY = {
+  CopyAgentHooksTree: {
+    name: "CopyAgentHooksTree",
+    description: "Copy the generic agent-hooks tree (hooks SSOT + sync engine + scripts) from the CommonProject template",
+    group: "agent-hooks",
+    class: CopyAgentHooksTree
+  },
+  WireMiseAgentHooks: {
+    name: "WireMiseAgentHooks",
+    description: "Merge agent-hooks enter/leave + tasks into an existing mise.toml (idempotent)",
+    group: "agent-hooks",
+    class: WireMiseAgentHooks
+  },
   AddDockerfile: {
     name: "AddDockerfile",
     description: "Create Dockerfile for containerization",
@@ -1260,11 +1441,14 @@ function createRecipe(name, context) {
   return new info.class(context);
 }
 
+// src/index.ts
+import { cancel as cancel2, multiselect, text as text3, isCancel as isCancel5 } from "@clack/prompts";
+
 // src/parity/index.ts
-import { existsSync as existsSync5, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync2, readlinkSync, readdirSync, renameSync, symlinkSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2, chmodSync, copyFileSync } from "node:fs";
-import { dirname as dirname3, join as join6, relative, resolve } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { homedir as homedir3 } from "node:os";
+import { existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync5, readFileSync as readFileSync3, readlinkSync, readdirSync, renameSync, symlinkSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4, chmodSync, copyFileSync } from "node:fs";
+import { basename as basename2, dirname as dirname5, join as join8, relative, resolve } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { homedir as homedir4 } from "node:os";
 import { spawnSync as spawnSync4 } from "node:child_process";
 var LINK_AGENTFILES_BLOCK = `# This block will handle the linking of
 # agent files to the main AGENTS.md file.
@@ -1282,6 +1466,28 @@ enter = [
 patterns = ["AGENTS.md"]
 task = "link-agentfiles"
 
+[tasks.link-agentfiles]
+description = "Symlink all agent files to AGENTS.md"
+run = "{{config_root}}/.mise/scripts/link-agentfiles.sh"`;
+var LINK_AGENTFILES_HOOK_ENTRIES = [
+  "{{config_root}}/.mise/scripts/link-agentfiles.sh",
+  "op inject -i .env.op > .env"
+];
+var LINK_AGENTFILES_HOOKS_BLOCK = `# This block will handle the linking of
+# agent files to the main AGENTS.md file.
+#
+# TODO: Ensure this works for all levels of nesting.
+# i.e. All linked agent files MUST be siblings at
+# any given level of nesting.
+[hooks]
+enter = [
+  "{{config_root}}/.mise/scripts/link-agentfiles.sh",
+  "op inject -i .env.op > .env",
+]`;
+var LINK_AGENTFILES_WATCH_TASK_BLOCK = `[[watch_files]]
+patterns = ["AGENTS.md"]
+task = "link-agentfiles"
+
 [tasks.link-agentfiles]
 description = "Symlink all agent files to AGENTS.md"
 run = "{{config_root}}/.mise/scripts/link-agentfiles.sh"`;
@@ -1312,12 +1518,12 @@ description = "Force every versioned file up to the highest version"
 run = "{{config_root}}/.mise/scripts/versioning.sh sync"
 # <<< mise-versioning <<<`;
 function resolvePjanglerRoot() {
-  let dir = dirname3(fileURLToPath2(import.meta.url));
-  while (dir !== dirname3(dir)) {
-    if (existsSync5(join6(dir, "package.json")) && existsSync5(join6(dir, "templates", "commonproject", "copier.yml"))) {
+  let dir = dirname5(fileURLToPath3(import.meta.url));
+  while (dir !== dirname5(dir)) {
+    if (existsSync7(join8(dir, "package.json")) && existsSync7(join8(dir, "templates", "commonproject", "copier.yml"))) {
       return dir;
     }
-    dir = dirname3(dir);
+    dir = dirname5(dir);
   }
   throw new Error("Unable to resolve pjangler root");
 }
@@ -1325,22 +1531,22 @@ function normalizeNewlines(value) {
   return value.replace(/\r\n/g, "\n");
 }
 function readText(path) {
-  return normalizeNewlines(readFileSync2(path, "utf8"));
+  return normalizeNewlines(readFileSync3(path, "utf8"));
 }
 function safeReadText(path) {
-  return existsSync5(path) ? readText(path) : null;
+  return existsSync7(path) ? readText(path) : null;
 }
 function ensureParent(path) {
-  mkdirSync3(dirname3(path), { recursive: true });
+  mkdirSync5(dirname5(path), { recursive: true });
 }
 function writeText(path, content) {
   ensureParent(path);
-  writeFileSync2(path, content);
+  writeFileSync4(path, content);
 }
-function tryParseJson(text3) {
-  if (!text3) return null;
+function tryParseJson(text4) {
+  if (!text4) return null;
   try {
-    return JSON.parse(text3);
+    return JSON.parse(text4);
   } catch {
     return null;
   }
@@ -1352,7 +1558,7 @@ function titleCaseSlug(slug) {
   return slug.split(/[-_]/g).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
 function readSymlinkTarget(path) {
-  if (!existsSync5(path)) return null;
+  if (!existsSync7(path)) return null;
   try {
     return readlinkSync(path);
   } catch {
@@ -1360,7 +1566,7 @@ function readSymlinkTarget(path) {
   }
 }
 function ensureSymlink(path, target, dryRun) {
-  if (existsSync5(path)) {
+  if (existsSync7(path)) {
     const stat = lstatSync(path);
     if (stat.isSymbolicLink()) {
       const current = readSymlinkTarget(path);
@@ -1376,9 +1582,32 @@ function ensureSymlink(path, target, dryRun) {
   if (!dryRun) symlinkSync(target, path);
   return { changed: true };
 }
-function yamlGet(text3, keyPath) {
+function bootstrapAgentsFile(repoRoot, dryRun) {
+  const agentsPath = join8(repoRoot, "AGENTS.md");
+  if (existsSync7(agentsPath)) return { changedFiles: [], details: [] };
+  for (const file of ["CLAUDE.md", "GEMINI.md"]) {
+    const source = join8(repoRoot, file);
+    if (!existsSync7(source)) continue;
+    const stat = lstatSync(source);
+    if (stat.isSymbolicLink()) continue;
+    if (stat.isFile()) {
+      if (!dryRun) renameSync(source, agentsPath);
+      return { changedFiles: [agentsPath], details: [`Moved ${file} to AGENTS.md before wiring agent-file symlinks`] };
+    }
+    return { changedFiles: [], details: [], blocked: `${file} exists but is not a regular file; cannot promote to AGENTS.md` };
+  }
+  const readmePath = join8(repoRoot, "README.md");
+  if (existsSync7(readmePath)) {
+    const stat = lstatSync(readmePath);
+    if (!stat.isFile()) return { changedFiles: [], details: [], blocked: "README.md exists but is not a regular file; cannot copy to AGENTS.md" };
+    if (!dryRun) copyFileSync(readmePath, agentsPath);
+    return { changedFiles: [agentsPath], details: ["Copied README.md to AGENTS.md before wiring agent-file symlinks"] };
+  }
+  return { changedFiles: [], details: [], blocked: "AGENTS.md missing and no CLAUDE.md, GEMINI.md, or README.md source exists" };
+}
+function yamlGet(text4, keyPath) {
   const parts = keyPath.split(".");
-  const lines = text3.split("\n");
+  const lines = text4.split("\n");
   let start = 0;
   let indent = 0;
   for (let idx = 0; idx < parts.length; idx += 1) {
@@ -1407,36 +1636,36 @@ function yamlGet(text3, keyPath) {
   return "";
 }
 function discoverRoles(repoRoot) {
-  const rolesDir = join6(repoRoot, "agents", "hermes");
-  if (!existsSync5(rolesDir)) return [];
+  const rolesDir = join8(repoRoot, "agents", "hermes");
+  if (!existsSync7(rolesDir)) return [];
   return readdirSync(rolesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => {
-    const roleDir = join6(rolesDir, entry.name);
-    const roleYamlPath = join6(roleDir, "role.yaml");
-    if (!existsSync5(roleYamlPath)) return null;
-    const text3 = readText(roleYamlPath);
-    const runtimeRepoRaw = yamlGet(text3, "runtime.github_repo");
+    const roleDir = join8(rolesDir, entry.name);
+    const roleYamlPath = join8(roleDir, "role.yaml");
+    if (!existsSync7(roleYamlPath)) return null;
+    const text4 = readText(roleYamlPath);
+    const runtimeRepoRaw = yamlGet(text4, "runtime.github_repo");
     return {
-      role: yamlGet(text3, "role") || entry.name,
+      role: yamlGet(text4, "role") || entry.name,
       roleDir,
       roleYamlPath,
-      repo: yamlGet(text3, "repo"),
-      agentId: yamlGet(text3, "agent_id"),
-      profileName: yamlGet(text3, "profile") || yamlGet(text3, "agent_id"),
-      displayName: yamlGet(text3, "display_name"),
-      purpose: yamlGet(text3, "purpose"),
-      botHandle: yamlGet(text3, "telegram.bot_username"),
+      repo: yamlGet(text4, "repo"),
+      agentId: yamlGet(text4, "agent_id"),
+      profileName: yamlGet(text4, "profile") || yamlGet(text4, "agent_id"),
+      displayName: yamlGet(text4, "display_name"),
+      purpose: yamlGet(text4, "purpose"),
+      botHandle: yamlGet(text4, "telegram.bot_username"),
       runtimeRepo: runtimeRepoRaw.includes("/") ? runtimeRepoRaw.split("/").slice(-1)[0] ?? runtimeRepoRaw : runtimeRepoRaw,
-      runtimeOwner: yamlGet(text3, "runtime.github_owner"),
-      planeWorkspace: yamlGet(text3, "ticket_provider.workspace") || yamlGet(text3, "plane.workspace"),
-      ticketProviderName: yamlGet(text3, "ticket_provider.name"),
-      ticketProviderBoardId: yamlGet(text3, "ticket_provider.board_id"),
-      ticketProviderBoardUrl: yamlGet(text3, "ticket_provider.board_url"),
-      ticketProviderIdentifier: yamlGet(text3, "plane.identifier")
+      runtimeOwner: yamlGet(text4, "runtime.github_owner"),
+      planeWorkspace: yamlGet(text4, "ticket_provider.workspace") || yamlGet(text4, "plane.workspace"),
+      ticketProviderName: yamlGet(text4, "ticket_provider.name"),
+      ticketProviderBoardId: yamlGet(text4, "ticket_provider.board_id"),
+      ticketProviderBoardUrl: yamlGet(text4, "ticket_provider.board_url"),
+      ticketProviderIdentifier: yamlGet(text4, "plane.identifier")
     };
   }).filter((value) => Boolean(value));
 }
 function registryPath(homeDir) {
-  return join6(homeDir, ".hermes", "agents-registry.yaml");
+  return join8(homeDir, ".hermes", "agents-registry.yaml");
 }
 function systemctlUser(args) {
   const result = spawnSync4("systemctl", ["--user", ...args], { encoding: "utf8" });
@@ -1446,86 +1675,257 @@ function systemctlUser(args) {
     stderr: result.stderr.trim()
   };
 }
+function templateScript(ctx, name) {
+  const source = join8(ctx.pjanglerRoot, ".mise", "scripts", name);
+  return existsSync7(source) ? readText(source) : void 0;
+}
 function templateVersioningScript(ctx) {
-  const source = join6(ctx.pjanglerRoot, ".mise", "scripts", "versioning.sh");
-  return existsSync5(source) ? readText(source) : void 0;
+  return templateScript(ctx, "versioning.sh");
+}
+function templateLinkAgentfilesScript(ctx) {
+  return templateScript(ctx, "link-agentfiles.sh");
+}
+function renderGeneratedProjectMiseToml(ctx, template) {
+  const project = readProjectJson(ctx);
+  const projectName = String(project?.project_name ?? basename2(ctx.repoRoot) ?? "project");
+  return template.replace(/\{%\s*raw\s*%\}([\s\S]*?)\{%\s*endraw\s*%\}/g, "$1").replace(/\{\{\s*project_name\s*\}\}/g, projectName);
+}
+function ensureMiseTomlFromTemplate(ctx, changedFiles) {
+  const targetPath = join8(ctx.repoRoot, "mise.toml");
+  if (existsSync7(targetPath)) return false;
+  const sourcePath = join8(ctx.pjanglerRoot, "templates", "commonproject", "template", "mise.toml.jinja");
+  if (!existsSync7(sourcePath)) return false;
+  changedFiles.push(targetPath);
+  if (!ctx.dryRun) {
+    writeText(targetPath, renderGeneratedProjectMiseToml(ctx, readText(sourcePath)));
+  }
+  return true;
 }
 function templateVersionFilesConf(ctx, repoRoot) {
-  const packageJson = join6(repoRoot, "package.json");
-  return existsSync5(packageJson) ? "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\njson package.json\ngittag .\n" : "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\ngittag .\n";
+  const packageJson = join8(repoRoot, "package.json");
+  return existsSync7(packageJson) ? "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\njson package.json\ngittag .\n" : "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\ngittag .\n";
 }
-function replaceOrAppendManagedBlock(text3, startMarker, block, beforePattern) {
-  if (startMarker.test(text3)) {
-    return text3.replace(/# >>> mise-versioning >>>[\s\S]*?# <<< mise-versioning <<</, block);
+function replaceOrAppendManagedBlock(text4, startMarker, block, beforePattern) {
+  if (startMarker.test(text4)) {
+    return text4.replace(/# >>> mise-versioning >>>[\s\S]*?# <<< mise-versioning <<</, block);
   }
   if (beforePattern) {
-    const match = text3.match(beforePattern);
+    const match = text4.match(beforePattern);
     if (match && typeof match.index === "number") {
-      return `${text3.slice(0, match.index).replace(/\s*$/, "\n\n")}${block}
+      return `${text4.slice(0, match.index).replace(/\s*$/, "\n\n")}${block}
 
-${text3.slice(match.index)}`;
+${text4.slice(match.index)}`;
     }
   }
-  return `${text3.replace(/\s*$/, "")}
+  return `${text4.replace(/\s*$/, "")}
 
 ${block}
 `;
 }
-function upsertLinkAgentfilesBlock(text3) {
-  const existing = /# This block will handle the linking of[\s\S]*?\[tasks\.link-agentfiles\][\s\S]*?run = "\{\{config_root\}\}\/\.mise\/scripts\/link-agentfiles\.sh"/;
-  if (existing.test(text3)) {
-    return text3.replace(existing, LINK_AGENTFILES_BLOCK);
+var BASE_MISE_PATH_ENTRIES = [".mise/scripts", "agents/hermes/pm"];
+var CONDITIONAL_HERMES_PATHS = ["agents/hermes/pm/hermes", "agent/hermes/pm/hermes"];
+function requiredMisePathEntries(ctx) {
+  const required = [...BASE_MISE_PATH_ENTRIES];
+  for (const candidate of CONDITIONAL_HERMES_PATHS) {
+    if (existsSync7(join8(ctx.repoRoot, candidate)) && !required.includes(candidate)) required.push(candidate);
+  }
+  return required;
+}
+function upsertMisePath(text4, required = BASE_MISE_PATH_ENTRIES) {
+  const render = (values) => `_.path = [${values.map((value) => JSON.stringify(value)).join(", ")}]`;
+  const envMatch = text4.match(/(^|\n)(\[env\][\s\S]*?)(?=\n\[[^\]]+\]|$)/);
+  if (!envMatch || typeof envMatch.index !== "number") {
+    return `[env]
+${render(required)}
+
+${text4.replace(/^\s+/, "")}`;
+  }
+  const prefix = text4.slice(0, envMatch.index + envMatch[1].length);
+  const section = envMatch[2];
+  const suffix = text4.slice(envMatch.index + envMatch[1].length + section.length);
+  const pathLine = section.match(/^_\.path\s*=\s*\[([^\]]*)\]\s*$/m);
+  if (!pathLine) {
+    return `${prefix}${section.replace(/\n?$/, "\n")}${render(required)}${suffix}`;
+  }
+  const current = [...pathLine[1].matchAll(/"([^"]+)"/g)].map((match) => match[1]);
+  const merged = [...current];
+  for (const value of required) {
+    if (!merged.includes(value)) merged.push(value);
+  }
+  const nextLine = render(merged);
+  if (pathLine[0] === nextLine) return text4;
+  return `${prefix}${section.replace(pathLine[0], nextLine)}${suffix}`;
+}
+function removeTomlSection(text4, headerPattern, marker, options) {
+  const lines = text4.split("\n");
+  let start = -1;
+  let end = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if (!headerPattern.test(lines[i])) continue;
+    if (marker) {
+      let hasMarker = false;
+      for (let j = i + 1; j < lines.length && !/^\[[^\]]+\]/.test(lines[j]); j++) {
+        if (marker.test(lines[j])) {
+          hasMarker = true;
+          break;
+        }
+      }
+      if (!hasMarker) continue;
+    }
+    start = i;
+    for (let j = i + 1; j < lines.length; j++) {
+      if (/^\[[^\]]+\]/.test(lines[j])) {
+        end = j;
+        break;
+      }
+    }
+    if (end === -1) end = lines.length;
+    break;
+  }
+  if (start === -1) return text4;
+  if (options?.includePrecedingComments) {
+    while (start > 0 && lines[start - 1].trim().startsWith("#")) {
+      start--;
+    }
   }
-  const versioningIndex = text3.indexOf("# >>> mise-versioning >>>");
+  const result = lines.slice(0, start).concat(lines.slice(end)).join("\n");
+  return result.replace(/\n{3,}/g, "\n\n").replace(/\n+$/, "\n");
+}
+function insertTomlBlockBeforeVersioning(text4, block) {
+  const versioningIndex = text4.indexOf("# >>> mise-versioning >>>");
   if (versioningIndex >= 0) {
-    return `${text3.slice(0, versioningIndex).replace(/\s*$/, "\n\n")}${LINK_AGENTFILES_BLOCK}
+    return `${text4.slice(0, versioningIndex).replace(/\s*$/, "\n\n")}${block}
 
-${text3.slice(versioningIndex)}`;
+${text4.slice(versioningIndex)}`;
   }
-  return `${text3.replace(/\s*$/, "")}
+  return `${text4.replace(/\s*$/, "")}
 
-${LINK_AGENTFILES_BLOCK}
+${block}
 `;
 }
+function extractTomlStrings(text4) {
+  const values = [];
+  const stringPattern = /"((?:\\.|[^"\\])*)"|'([^']*)'/g;
+  for (const match of text4.matchAll(stringPattern)) {
+    if (match[1] !== void 0) {
+      try {
+        values.push(JSON.parse(`"${match[1]}"`));
+      } catch {
+        values.push(match[1]);
+      }
+    } else if (match[2] !== void 0) {
+      values.push(match[2]);
+    }
+  }
+  return values;
+}
+function isManagedHookEntry(value) {
+  const trimmed = value.trim();
+  return trimmed === "op inject -i .env.op > .env" || /(^|\/)link-agentfiles\.sh$/.test(trimmed);
+}
+function renderHookEntries(entries, indent = "") {
+  return [
+    `${indent}enter = [`,
+    ...entries.map((entry) => `${indent}  ${JSON.stringify(entry)},`),
+    `${indent}]`
+  ];
+}
+function upsertLinkAgentfilesHooks(text4) {
+  const lines = text4.split("\n");
+  const hooksStart = lines.findIndex((line) => /^\[hooks\]$/.test(line.trim()));
+  if (hooksStart === -1) return insertTomlBlockBeforeVersioning(text4, LINK_AGENTFILES_HOOKS_BLOCK);
+  let hooksEnd = lines.length;
+  for (let i = hooksStart + 1; i < lines.length; i++) {
+    if (/^\[[^\]]+\]/.test(lines[i].trim())) {
+      hooksEnd = i;
+      break;
+    }
+  }
+  let enterStart = -1;
+  let enterEnd = -1;
+  for (let i = hooksStart + 1; i < hooksEnd; i++) {
+    if (!/^\s*enter\s*=/.test(lines[i])) continue;
+    enterStart = i;
+    enterEnd = i + 1;
+    const afterEquals = lines[i].slice(lines[i].indexOf("=") + 1);
+    if (afterEquals.includes("[") && !afterEquals.includes("]")) {
+      while (enterEnd < hooksEnd && !lines[enterEnd].includes("]")) enterEnd++;
+      if (enterEnd < hooksEnd) enterEnd++;
+    }
+    break;
+  }
+  const existingBlock = enterStart >= 0 ? lines.slice(enterStart, enterEnd).join("\n") : "";
+  const preserved = extractTomlStrings(existingBlock).filter((entry) => !isManagedHookEntry(entry));
+  const merged = [...LINK_AGENTFILES_HOOK_ENTRIES];
+  for (const entry of preserved) {
+    if (!merged.includes(entry)) merged.push(entry);
+  }
+  const indent = enterStart >= 0 ? lines[enterStart].match(/^\s*/)?.[0] ?? "" : "";
+  const rendered = renderHookEntries(merged, indent);
+  if (enterStart >= 0) {
+    return lines.slice(0, enterStart).concat(rendered, lines.slice(enterEnd)).join("\n").replace(/\n{3,}/g, "\n\n").replace(/\n+$/, "\n");
+  }
+  return lines.slice(0, hooksStart + 1).concat(rendered, lines.slice(hooksStart + 1)).join("\n").replace(/\n{3,}/g, "\n\n").replace(/\n+$/, "\n");
+}
+function upsertLinkAgentfilesBlock(text4, ctx) {
+  const withPath = upsertMisePath(text4, requiredMisePathEntries(ctx));
+  if (withPath.includes(LINK_AGENTFILES_BLOCK)) return withPath;
+  let cleaned = removeTomlSection(withPath, /^\[tasks\.link-agentfiles\]$/, /link-agentfiles/, { includePrecedingComments: false });
+  cleaned = removeTomlSection(cleaned, /^\[\[watch_files\]\]$/, /AGENTS\.md/, { includePrecedingComments: false });
+  cleaned = upsertLinkAgentfilesHooks(cleaned);
+  return insertTomlBlockBeforeVersioning(cleaned, LINK_AGENTFILES_WATCH_TASK_BLOCK);
+}
 function readProjectJson(ctx) {
-  return tryParseJson(safeReadText(join6(ctx.repoRoot, ".project.json")));
+  return tryParseJson(safeReadText(join8(ctx.repoRoot, ".project.json")));
 }
 function canonicalProjectJson(ctx) {
   const roles = discoverRoles(ctx.repoRoot);
   const existing = readProjectJson(ctx) ?? {};
-  const slug = String(existing.project_slug ?? slugifyRepoName(dirname3(ctx.repoRoot) === ctx.repoRoot ? ctx.repoRoot.split("/").pop() ?? "project" : ctx.repoRoot.split("/").pop() ?? "project"));
+  const slug = String(existing.project_slug ?? slugifyRepoName(dirname5(ctx.repoRoot) === ctx.repoRoot ? ctx.repoRoot.split("/").pop() ?? "project" : ctx.repoRoot.split("/").pop() ?? "project"));
   const firstRole = roles[0];
   const ticketProvider = {
     type: String((existing.ticket_provider?.type ?? firstRole?.ticketProviderName ?? "plane") || "plane"),
     workspace: String((existing.ticket_provider?.workspace ?? firstRole?.planeWorkspace ?? "") || ""),
     identifier: String((existing.ticket_provider?.identifier ?? firstRole?.ticketProviderIdentifier ?? "") || ""),
     board_id: String((existing.ticket_provider?.board_id ?? firstRole?.ticketProviderBoardId ?? "") || ""),
-    board_url: String((existing.ticket_provider?.board_url ?? firstRole?.ticketProviderBoardUrl ?? "") || "")
+    board_url: String((existing.ticket_provider?.board_url ?? firstRole?.ticketProviderBoardUrl ?? "") || ""),
+    state: String((existing.ticket_provider?.state ?? "planned") || "planned")
   };
+  const existingAgents = existing.agents ?? {};
+  const discoveredAgents = Object.fromEntries(
+    roles.map((role) => [
+      role.agentId || `${slug}-${role.role}`,
+      {
+        role: role.role,
+        role_dir: relative(ctx.repoRoot, role.roleDir)
+      }
+    ])
+  );
+  const agents = { ...existingAgents };
+  for (const [agentId, discovered] of Object.entries(discoveredAgents)) {
+    const existingAgent = existingAgents[agentId] ?? {};
+    agents[agentId] = {
+      role: discovered.role,
+      role_dir: discovered.role_dir,
+      provisioning_state: existingAgent.provisioning_state
+    };
+  }
   return {
     project_name: String(existing.project_name ?? titleCaseSlug(slug)),
     project_description: String(existing.project_description ?? ""),
     project_slug: slug,
     repo_path: ctx.repoRoot,
     ticket_provider: ticketProvider,
-    agents: Object.fromEntries(
-      roles.map((role) => [
-        role.agentId || `${slug}-${role.role}`,
-        {
-          role: role.role,
-          role_dir: relative(ctx.repoRoot, role.roleDir)
-        }
-      ])
-    )
+    agents
   };
 }
 function projectJsonFinding(ctx) {
-  const projectPath = join6(ctx.repoRoot, ".project.json");
-  const planeJsonPath = join6(ctx.repoRoot, ".plane.json");
+  const projectPath = join8(ctx.repoRoot, ".project.json");
+  const planeJsonPath = join8(ctx.repoRoot, ".plane.json");
   const details = [];
   const data = readProjectJson(ctx);
   const roles = discoverRoles(ctx.repoRoot);
-  if (!existsSync5(projectPath)) {
+  if (!existsSync7(projectPath)) {
     return { id: "sot.project-json", title: "Canonical .project.json", status: "fail", summary: ".project.json missing", details: [], fixable: true };
   }
   if (!data) {
@@ -1548,10 +1948,10 @@ function projectJsonFinding(ctx) {
     }
   }
   const ticketProvider = data.ticket_provider ?? {};
-  for (const key of ["type", "workspace", "identifier", "board_id", "board_url"]) {
+  for (const key of ["type", "workspace", "identifier", "board_id", "board_url", "state"]) {
     if (!(key in ticketProvider)) details.push(`ticket_provider.${key} missing`);
   }
-  if (existsSync5(planeJsonPath)) details.push(".plane.json should not exist once .project.json is canonical");
+  if (existsSync7(planeJsonPath)) details.push(".plane.json should not exist once .project.json is canonical");
   return {
     id: "sot.project-json",
     title: "Canonical .project.json",
@@ -1563,8 +1963,8 @@ function projectJsonFinding(ctx) {
 }
 function renderSoul(role) {
   const telegram = role.botHandle ? `@${role.botHandle}` : "(unwired)";
-  const tone = role.role === "pm" ? `Direct and brief. Decision-forward. No throat-clearing, no apologies, no "I'll help you with that" preambles.` : role.role === "scrum-master" ? "Operational, skeptical, and schedule-aware. Prefer explicit next actions, evidence, and status transitions." : "Direct and brief.";
-  const roleSpecific = role.role === "pm" ? `You are the project manager. You triage incoming work, create or refine tickets, and delegate implementation. You do not ship product code.` : role.role === "scrum-master" ? `You own the continuous-ticket sentinel. You watch the ticket board, enforce workflow policy, and keep work moving without inventing requirements.` : `You operate as the ${role.role} agent for this repo.`;
+  const tone = role.role === "pm" ? `Direct and brief. Decision-forward. No throat-clearing, no apologies, no "I'll help you with that" preambles.` : "Direct and brief.";
+  const roleSpecific = role.role === "pm" ? `You are the project manager. You triage incoming work, create or refine tickets, and delegate implementation. You do not ship product code. A systemd heartbeat checkpoints your runtime; when this repo opts into reconciliation (\`reconcile.enabled\` in role.yaml), the same heartbeat also runs your continuous board-reconciliation pass out-of-band (\`.scripts/sentinel.prompt.md\`, \`--source cron\`), kept separate from your interactive session memory.` : `You operate as the ${role.role} agent for this repo.`;
   const runtimeOwner = role.runtimeOwner || "delorenj";
   return `# ${role.displayName || role.agentId}
 
@@ -1584,7 +1984,7 @@ You are **${role.displayName || role.agentId}** \u2014 a Hermes agent provisione
 
 ## Scope
 
-You operate only within the working directory of \`${role.repo}\`. Your HERMES_HOME resolves through the named profile \`${role.profileName || role.agentId}\`, which is symlinked to the runtime submodule at \`./runtime/\` (repo \`${runtimeOwner}/${role.runtimeRepo}\`). Your \`config.yaml\` inherits shared non-secret defaults from the fleet default profile; secrets, SOUL, memories, skills, sessions, gateway state, and runtime files remain local to this profile.
+You operate only within the working directory of \`${role.repo}\`. Your HERMES_HOME is the runtime submodule at \`./runtime/\` (repo \`${runtimeOwner}/${role.runtimeRepo}\`), which \`~/.hermes/profiles/${role.profileName || role.agentId}\` symlinks to (so \`--profile\` invocations resolve here too); Hermes loads its \`config.yaml\` directly. Secrets, SOUL, memories, skills, sessions, gateway state, and runtime files all live local to that runtime.
 
 ## Tone
 
@@ -1601,8 +2001,7 @@ Your memory is the submodule at \`./runtime/memories/\`. Use durable memory deli
 }
 function renderHermesWrapper(role) {
   return `#!/usr/bin/env bash
-# Launcher for ${role.agentId}. Resolves HERMES_HOME through the fleet profile
-# when available, then falls back to the local runtime submodule.
+# Launcher for ${role.agentId}. Resolves HERMES_HOME to the runtime submodule.
 
 set -euo pipefail
 
@@ -1621,12 +2020,7 @@ CODEX_HOME="{CODEX_HOME:-{HERMES_FLEET_CODEX_HOME:-$HOME/.codex}}"
 
 FLEET_HOME="{HERMES_FLEET_HOME:-$HOME/.hermes}"
 PROFILE_NAME="{HERMES_PROFILE_NAME:-${role.profileName || role.agentId}}"
-PROFILE_HOME="$FLEET_HOME/profiles/$PROFILE_NAME"
-if [[ -d "$PROFILE_HOME" ]]; then
-  HERMES_HOME="$PROFILE_HOME"
-else
-  HERMES_HOME="$RUNTIME_HOME"
-fi
+HERMES_HOME="$RUNTIME_HOME"
 
 if [[ ! -d "$RUNTIME_HOME" ]]; then
   echo "hermes: runtime submodule not initialized at $RUNTIME_HOME" >&2
@@ -1638,17 +2032,17 @@ exec env HERMES_HOME="$HERMES_HOME" HERMES_FLEET_ENV="$FLEET_ENV"   HERMES_OAUTH
 `.replace(/\u0010/g, "$");
 }
 function copyMissingRecursive(sourceDir, targetDir, changedFiles, dryRun, skip) {
-  if (!existsSync5(sourceDir)) return;
-  mkdirSync3(targetDir, { recursive: true });
+  if (!existsSync7(sourceDir)) return;
+  mkdirSync5(targetDir, { recursive: true });
   for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {
-    const sourcePath = join6(sourceDir, entry.name);
+    const sourcePath = join8(sourceDir, entry.name);
     if (skip?.(sourcePath)) continue;
-    const targetPath = join6(targetDir, entry.name);
+    const targetPath = join8(targetDir, entry.name);
     if (entry.isDirectory()) {
       copyMissingRecursive(sourcePath, targetPath, changedFiles, dryRun, skip);
       continue;
     }
-    if (existsSync5(targetPath)) continue;
+    if (existsSync7(targetPath)) continue;
     changedFiles.push(targetPath);
     if (!dryRun) {
       ensureParent(targetPath);
@@ -1657,7 +2051,7 @@ function copyMissingRecursive(sourceDir, targetDir, changedFiles, dryRun, skip)
   }
 }
 function upsertSubmodule(repoRoot, role, changedFiles, dryRun) {
-  const gitmodulesPath = join6(repoRoot, ".gitmodules");
+  const gitmodulesPath = join8(repoRoot, ".gitmodules");
   const repoName = role.runtimeRepo || `agent-hm-${role.repo}-${role.role}`;
   const owner = role.runtimeOwner || "delorenj";
   const block = `[submodule "agents/hermes/${role.role}/runtime"]
@@ -1679,7 +2073,7 @@ function upsertRegistryEntry(role, homeDir, changedFiles, dryRun) {
     repo: ${role.repo}
     role: ${role.role}
     display_name: ${JSON.stringify(role.displayName || role.agentId)}
-    project_path: ${ctxEscape(role.roleDir ? dirname3(dirname3(dirname3(role.roleDir))) : "")}
+    project_path: ${ctxEscape(role.roleDir ? dirname5(dirname5(dirname5(role.roleDir))) : "")}
     role_dir: ${ctxEscape(role.roleDir)}
     profile_name: ${role.profileName || role.agentId}
     telegram:
@@ -1692,7 +2086,7 @@ function upsertRegistryEntry(role, homeDir, changedFiles, dryRun) {
     systemd:
       gateway_unit: hermes-${role.agentId}-gateway.service
       consumer_unit: hermes-${role.agentId}-consumer.service
-      checkpoint_timer: hermes-${role.agentId}-checkpoint.timer
+      heartbeat_timer: hermes-${role.agentId}-heartbeat.timer
 `;
   const next = current.includes("agents: {}") ? current.replace("agents: {}", `agents:
 ${block}`) : `${current.replace(/\s*$/, "\n")}${block}`;
@@ -1701,9 +2095,9 @@ ${block}`) : `${current.replace(/\s*$/, "\n")}${block}`;
   return path;
 }
 function profileMetaInheritsDefault(path) {
-  const text3 = safeReadText(path);
+  const text4 = safeReadText(path);
   return Boolean(
-    text3 && /^config:\s*$/m.test(text3) && /^\s+inherit_from:\s*default\s*$/m.test(text3) && /^\s+save_mode:\s*delta\s*$/m.test(text3)
+    text4 && /^config:\s*$/m.test(text4) && /^\s+inherit_from:\s*default\s*$/m.test(text4) && /^\s+save_mode:\s*delta\s*$/m.test(text4)
   );
 }
 function upsertInheritedProfileMeta(path, changedFiles, dryRun) {
@@ -1757,17 +2151,21 @@ var RULES = [
     id: "mise.config-root",
     title: "mise config_root + AGENTS link hooks",
     audit: (ctx) => {
-      const misePath = join6(ctx.repoRoot, "mise.toml");
-      if (!existsSync5(misePath)) {
+      const misePath = join8(ctx.repoRoot, "mise.toml");
+      if (!existsSync7(misePath)) {
         return { id: "mise.config-root", title: "mise config_root + AGENTS link hooks", status: "fail", summary: "mise.toml missing", details: [], fixable: true };
       }
-      const text3 = readText(misePath);
+      const text4 = readText(misePath);
       const details = [];
-      if (!text3.includes('_.path = [".mise/scripts", "agents/hermes/pm"]')) details.push("[env]._.path should include .mise/scripts and agents/hermes/pm");
-      if (!text3.includes('"{{config_root}}/.mise/scripts/link-agentfiles.sh"')) details.push("link-agentfiles must use raw {{config_root}} guard");
-      if (!text3.includes("op inject -i .env.op > .env")) details.push("[hooks].enter must materialize .env from .env.op");
-      if (!text3.includes('patterns = ["AGENTS.md"]')) details.push("watch_files must monitor AGENTS.md");
-      if (!text3.includes('task = "link-agentfiles"')) details.push("watch_files must dispatch link-agentfiles task");
+      const linkAgentfilesPath = join8(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
+      if (!existsSync7(linkAgentfilesPath)) details.push(".mise/scripts/link-agentfiles.sh missing");
+      const pathValues = [...(text4.match(/^_\.path\s*=\s*\[([^\]]*)\]/m)?.[1] ?? "").matchAll(/"([^"]+)"/g)].map((match) => match[1]);
+      const missingPathValues = requiredMisePathEntries(ctx).filter((value) => !pathValues.includes(value));
+      if (missingPathValues.length) details.push(`[env]._.path should include ${missingPathValues.join(", ")}`);
+      if (!text4.includes('"{{config_root}}/.mise/scripts/link-agentfiles.sh"')) details.push("link-agentfiles must use raw {{config_root}} guard");
+      if (!text4.includes("op inject -i .env.op > .env")) details.push("[hooks].enter must materialize .env from .env.op");
+      if (!text4.includes('patterns = ["AGENTS.md"]')) details.push("watch_files must monitor AGENTS.md");
+      if (!text4.includes('task = "link-agentfiles"')) details.push("watch_files must dispatch link-agentfiles task");
       return {
         id: "mise.config-root",
         title: "mise config_root + AGENTS link hooks",
@@ -1778,17 +2176,36 @@ var RULES = [
       };
     },
     migrate: (ctx, finding) => {
-      const path = join6(ctx.repoRoot, "mise.toml");
+      const path = join8(ctx.repoRoot, "mise.toml");
       const changedFiles = [];
-      if (!existsSync5(path)) {
-        return { id: finding.id, title: finding.title, status: "blocked", summary: "mise.toml missing; initialize mise first", changedFiles, details: [] };
+      const details = [];
+      if (!existsSync7(path)) {
+        if (!ensureMiseTomlFromTemplate(ctx, changedFiles)) {
+          return { id: finding.id, title: finding.title, status: "blocked", summary: "mise.toml missing and no generated-project mise template available to initialize from", changedFiles, details: [] };
+        }
+        details.push("Initialized mise.toml from generated-project template");
+        if (ctx.dryRun) {
+          return { id: finding.id, title: finding.title, status: "applied", summary: "Would initialize mise.toml from generated-project template", changedFiles, details };
+        }
       }
-      let text3 = readText(path);
-      const next = upsertLinkAgentfilesBlock(text3);
-      if (next !== text3) {
-        changedFiles.push(path);
+      let text4 = readText(path);
+      const next = upsertLinkAgentfilesBlock(text4, ctx);
+      if (next !== text4) {
+        if (!changedFiles.includes(path)) changedFiles.push(path);
         if (!ctx.dryRun) writeText(path, next);
-        text3 = next;
+        text4 = next;
+      }
+      const linkAgentfilesPath = join8(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
+      const expectedScript = templateLinkAgentfilesScript(ctx);
+      if (expectedScript === void 0) {
+        return { id: finding.id, title: finding.title, status: "blocked", summary: "pjangler install is missing .mise/scripts/link-agentfiles.sh \u2014 update @delorenj/pjangler (broken package)", changedFiles, details: [] };
+      }
+      if (safeReadText(linkAgentfilesPath) !== expectedScript) {
+        changedFiles.push(linkAgentfilesPath);
+        if (!ctx.dryRun) {
+          writeText(linkAgentfilesPath, expectedScript);
+          chmodSync(linkAgentfilesPath, 493);
+        }
       }
       return {
         id: finding.id,
@@ -1796,7 +2213,7 @@ var RULES = [
         status: changedFiles.length ? "applied" : "noop",
         summary: changedFiles.length ? "Updated mise AGENTS-linking contract" : "No changes required",
         changedFiles,
-        details: changedFiles.length ? ["Normalized hooks/watch_files/tasks.link-agentfiles block"] : []
+        details: changedFiles.length ? ["Normalized hooks/watch_files/tasks.link-agentfiles block and script"] : []
       };
     }
   },
@@ -1805,13 +2222,13 @@ var RULES = [
     title: "managed mise versioning block",
     audit: (ctx) => {
       const details = [];
-      const misePath = join6(ctx.repoRoot, "mise.toml");
-      const versioningPath = join6(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
-      const manifestPath = join6(ctx.repoRoot, ".mise", "version-files.conf");
-      const text3 = safeReadText(misePath);
-      if (!text3?.includes("# >>> mise-versioning >>>")) details.push("mise versioning managed block missing");
-      if (!existsSync5(versioningPath)) details.push(".mise/scripts/versioning.sh missing");
-      if (!existsSync5(manifestPath)) details.push(".mise/version-files.conf missing");
+      const misePath = join8(ctx.repoRoot, "mise.toml");
+      const versioningPath = join8(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
+      const manifestPath = join8(ctx.repoRoot, ".mise", "version-files.conf");
+      const text4 = safeReadText(misePath);
+      if (!text4?.includes("# >>> mise-versioning >>>")) details.push("mise versioning managed block missing");
+      if (!existsSync7(versioningPath)) details.push(".mise/scripts/versioning.sh missing");
+      if (!existsSync7(manifestPath)) details.push(".mise/version-files.conf missing");
       return {
         id: "mise.versioning",
         title: "managed mise versioning block",
@@ -1823,17 +2240,24 @@ var RULES = [
     },
     migrate: (ctx, finding) => {
       const changedFiles = [];
-      const misePath = join6(ctx.repoRoot, "mise.toml");
-      if (!existsSync5(misePath)) {
-        return { id: finding.id, title: finding.title, status: "blocked", summary: "mise.toml missing; cannot inject versioning block", changedFiles, details: [] };
+      const details = [];
+      const misePath = join8(ctx.repoRoot, "mise.toml");
+      if (!existsSync7(misePath)) {
+        if (!ensureMiseTomlFromTemplate(ctx, changedFiles)) {
+          return { id: finding.id, title: finding.title, status: "blocked", summary: "mise.toml missing and no generated-project mise template available to initialize from", changedFiles, details: [] };
+        }
+        details.push("Initialized mise.toml from generated-project template");
+        if (ctx.dryRun) {
+          return { id: finding.id, title: finding.title, status: "applied", summary: "Would initialize mise.toml from generated-project template", changedFiles, details };
+        }
       }
       const currentMise = readText(misePath);
       const nextMise = replaceOrAppendManagedBlock(currentMise, /# >>> mise-versioning >>>/, VERSIONING_BLOCK, /^\[tasks\.build\]/m);
       if (nextMise !== currentMise) {
-        changedFiles.push(misePath);
+        if (!changedFiles.includes(misePath)) changedFiles.push(misePath);
         if (!ctx.dryRun) writeText(misePath, nextMise);
       }
-      const versioningPath = join6(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
+      const versioningPath = join8(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
       const expectedScript = templateVersioningScript(ctx);
       if (expectedScript === void 0) {
         return { id: finding.id, title: finding.title, status: "blocked", summary: "pjangler install is missing .mise/scripts/versioning.sh \u2014 update @delorenj/pjangler (broken package)", changedFiles, details: [] };
@@ -1845,7 +2269,7 @@ var RULES = [
           chmodSync(versioningPath, 493);
         }
       }
-      const manifestPath = join6(ctx.repoRoot, ".mise", "version-files.conf");
+      const manifestPath = join8(ctx.repoRoot, ".mise", "version-files.conf");
       const expectedManifest = templateVersionFilesConf(ctx, ctx.repoRoot);
       if (safeReadText(manifestPath) !== expectedManifest) {
         changedFiles.push(manifestPath);
@@ -1865,13 +2289,24 @@ var RULES = [
     id: "sot.agent-symlinks",
     title: "AGENTS/CLAUDE/GEMINI symlink contract",
     audit: (ctx) => {
-      const agentsPath = join6(ctx.repoRoot, "AGENTS.md");
-      if (!existsSync5(agentsPath)) {
-        return { id: "sot.agent-symlinks", title: "AGENTS/CLAUDE/GEMINI symlink contract", status: "skip", summary: "AGENTS.md missing; symlink contract not applicable", details: [], fixable: false };
+      const agentsPath = join8(ctx.repoRoot, "AGENTS.md");
+      if (!existsSync7(agentsPath)) {
+        const fallbackSources = ["CLAUDE.md", "GEMINI.md", "README.md"].filter((file) => existsSync7(join8(ctx.repoRoot, file)));
+        if (fallbackSources.length === 0) {
+          return { id: "sot.agent-symlinks", title: "AGENTS/CLAUDE/GEMINI symlink contract", status: "skip", summary: "AGENTS.md missing; symlink contract not applicable", details: [], fixable: false };
+        }
+        return {
+          id: "sot.agent-symlinks",
+          title: "AGENTS/CLAUDE/GEMINI symlink contract",
+          status: "fail",
+          summary: "AGENTS.md missing but can be derived from existing project documentation",
+          details: [`AGENTS.md can be created from ${fallbackSources[0]}`],
+          fixable: true
+        };
       }
       const details = [];
       for (const file of ["CLAUDE.md", "GEMINI.md"]) {
-        const full = join6(ctx.repoRoot, file);
+        const full = join8(ctx.repoRoot, file);
         const target = readSymlinkTarget(full);
         if (target !== "AGENTS.md") details.push(`${file} should be a symlink to AGENTS.md`);
       }
@@ -1887,22 +2322,26 @@ var RULES = [
     migrate: (ctx, finding) => {
       const changedFiles = [];
       const details = [];
-      if (!existsSync5(join6(ctx.repoRoot, "AGENTS.md"))) {
-        return { id: finding.id, title: finding.title, status: "blocked", summary: "AGENTS.md missing; cannot wire symlinks", changedFiles, details: [] };
+      const blockedDetails = [];
+      const bootstrap = bootstrapAgentsFile(ctx.repoRoot, ctx.dryRun);
+      changedFiles.push(...bootstrap.changedFiles);
+      details.push(...bootstrap.details);
+      if (bootstrap.blocked) {
+        return { id: finding.id, title: finding.title, status: "blocked", summary: "AGENTS.md missing; cannot derive canonical agent file", changedFiles, details: [bootstrap.blocked] };
       }
       for (const file of ["CLAUDE.md", "GEMINI.md"]) {
-        const full = join6(ctx.repoRoot, file);
+        const full = join8(ctx.repoRoot, file);
         const result = ensureSymlink(full, "AGENTS.md", ctx.dryRun);
-        if (result.blocked) details.push(result.blocked);
+        if (result.blocked) blockedDetails.push(result.blocked);
         if (result.changed) changedFiles.push(full);
       }
       return {
         id: finding.id,
         title: finding.title,
-        status: details.length ? "blocked" : changedFiles.length ? "applied" : "noop",
-        summary: details.length ? "One or more files could not be replaced safely" : changedFiles.length ? "Symlink contract repaired" : "No changes required",
+        status: blockedDetails.length ? "blocked" : changedFiles.length ? "applied" : "noop",
+        summary: blockedDetails.length ? "One or more files could not be replaced safely" : changedFiles.length ? "Symlink contract repaired" : "No changes required",
         changedFiles,
-        details
+        details: [...details, ...blockedDetails]
       };
     }
   },
@@ -1913,7 +2352,7 @@ var RULES = [
     migrate: (ctx, finding) => {
       const changedFiles = [];
       const details = [];
-      const path = join6(ctx.repoRoot, ".project.json");
+      const path = join8(ctx.repoRoot, ".project.json");
       const existing = readProjectJson(ctx) ?? {};
       const canonical = canonicalProjectJson(ctx);
       const merged = { ...existing, ...canonical };
@@ -1923,10 +2362,10 @@ var RULES = [
         changedFiles.push(path);
         if (!ctx.dryRun) writeText(path, expected);
       }
-      const planeJson = join6(ctx.repoRoot, ".plane.json");
-      if (existsSync5(planeJson)) {
+      const planeJson = join8(ctx.repoRoot, ".plane.json");
+      if (existsSync7(planeJson)) {
         const backup = `${planeJson}.migrated-backup`;
-        if (existsSync5(backup)) {
+        if (existsSync7(backup)) {
           details.push(`cannot back up .plane.json because ${relative(ctx.repoRoot, backup)} already exists`);
         } else {
           changedFiles.push(backup);
@@ -1948,14 +2387,15 @@ var RULES = [
     title: ".env.op + gitignore secrets contract",
     audit: (ctx) => {
       const details = [];
-      const envOp = safeReadText(join6(ctx.repoRoot, ".env.op"));
-      const gitignore = safeReadText(join6(ctx.repoRoot, ".gitignore"));
+      const envOp = safeReadText(join8(ctx.repoRoot, ".env.op"));
+      const gitignore = safeReadText(join8(ctx.repoRoot, ".gitignore"));
       if (!envOp) {
         details.push(".env.op missing");
       } else {
         const invalidLines = envOp.split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#") && line.includes("=")).filter((line) => {
           const value = line.slice(line.indexOf("=") + 1).trim();
-          return !value.startsWith("op://") && !/^https?:\/\//.test(value) && !/^[A-Za-z0-9_.:-]+$/.test(value);
+          const quotedLiteral = /^"[^"\r\n]*"$/.test(value) || /^'[^'\r\n]*'$/.test(value);
+          return !value.startsWith("op://") && !/^https?:\/\//.test(value) && !/^[A-Za-z0-9_.:-]+$/.test(value) && !quotedLiteral;
         });
         if (invalidLines.length) details.push(`.env.op has non-reference values that do not look like safe literals: ${invalidLines.join(", ")}`);
       }
@@ -1974,12 +2414,12 @@ var RULES = [
     migrate: (ctx, finding) => {
       const changedFiles = [];
       const details = [];
-      const envOpPath = join6(ctx.repoRoot, ".env.op");
-      if (!existsSync5(envOpPath)) {
+      const envOpPath = join8(ctx.repoRoot, ".env.op");
+      if (!existsSync7(envOpPath)) {
         changedFiles.push(envOpPath);
-        if (!ctx.dryRun) writeText(envOpPath, readText(join6(ctx.pjanglerRoot, "templates", "commonproject", "template", ".env.op")));
+        if (!ctx.dryRun) writeText(envOpPath, readText(join8(ctx.pjanglerRoot, "templates", "commonproject", "template", ".env.op")));
       }
-      const gitignorePath = join6(ctx.repoRoot, ".gitignore");
+      const gitignorePath = join8(ctx.repoRoot, ".gitignore");
       const gitignore = safeReadText(gitignorePath) ?? "";
       const requiredBlock = `# Secrets \u2014 .env is materialized by \`op inject -i .env.op > .env\` on mise enter.
 # NEVER commit it. .env.op holds only 1Password references or safe literals and IS committed.
@@ -2006,20 +2446,20 @@ var RULES = [
     title: ".copier-answers.yml provenance + drift report",
     audit: (ctx) => {
       const details = [];
-      const path = join6(ctx.repoRoot, ".copier-answers.yml");
-      const text3 = safeReadText(path);
+      const path = join8(ctx.repoRoot, ".copier-answers.yml");
+      const text4 = safeReadText(path);
       const project = readProjectJson(ctx);
-      if (!text3) {
+      if (!text4) {
         details.push(".copier-answers.yml missing");
       } else {
-        if (!text3.startsWith("# Changes here will be overwritten by Copier; NEVER EDIT MANUALLY")) details.push("missing Copier overwrite warning header");
-        if (!text3.includes("_src_path:")) details.push("_src_path missing");
+        if (!text4.startsWith("# Changes here will be overwritten by Copier; NEVER EDIT MANUALLY")) details.push("missing Copier overwrite warning header");
+        if (!text4.includes("_src_path:")) details.push("_src_path missing");
         if (project?.project_name) {
-          const nameMatch = text3.match(/project_name:\s*(.+)/);
+          const nameMatch = text4.match(/project_name:\s*(.+)/);
           if (!nameMatch || nameMatch[1]?.trim() !== String(project.project_name)) details.push("project_name drift between .copier-answers.yml and .project.json");
         }
         if (project?.project_description) {
-          const descMatch = text3.match(/project_description:\s*([\s\S]*?)(?=\n\w|$)/);
+          const descMatch = text4.match(/project_description:\s*([\s\S]*?)(?=\n\w|$)/);
           const yamlDesc = descMatch?.[1]?.replace(/\n\s+/g, " ").trim() ?? "";
           if (yamlDesc !== String(project.project_description)) details.push("project_description drift between .copier-answers.yml and .project.json");
         }
@@ -2036,16 +2476,16 @@ var RULES = [
     migrate: (ctx, finding) => {
       const changedFiles = [];
       const project = canonicalProjectJson(ctx);
-      const text3 = `# Changes here will be overwritten by Copier; NEVER EDIT MANUALLY
-_src_path: ${join6(ctx.pjanglerRoot, "templates", "commonproject")}
+      const text4 = `# Changes here will be overwritten by Copier; NEVER EDIT MANUALLY
+_src_path: ${join8(ctx.pjanglerRoot, "templates", "commonproject")}
 project_description: ${String(project.project_description)}
 project_name: ${String(project.project_name)}
 ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
 `;
-      const path = join6(ctx.repoRoot, ".copier-answers.yml");
-      if (safeReadText(path) !== text3) {
+      const path = join8(ctx.repoRoot, ".copier-answers.yml");
+      if (safeReadText(path) !== text4) {
         changedFiles.push(path);
-        if (!ctx.dryRun) writeText(path, text3);
+        if (!ctx.dryRun) writeText(path, text4);
       }
       return {
         id: finding.id,
@@ -2061,15 +2501,15 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
     id: "bmad.scaffold",
     title: "BMAD modules/docs scaffold",
     audit: (ctx) => {
-      const sourceRoot = join6(ctx.pjanglerRoot, "templates", "commonproject", "_bmad");
-      const targetRoot = join6(ctx.repoRoot, "_bmad");
+      const sourceRoot = join8(ctx.pjanglerRoot, "templates", "commonproject", "_bmad");
+      const targetRoot = join8(ctx.repoRoot, "_bmad");
       const sentinels = [
-        join6("core", "config.yaml"),
-        join6("custom", "config.yaml"),
-        join6("custom", "workflows", "ticket-lifecycle", "workflow.yaml"),
-        join6("bmm", "workflows", "workflow-status", "workflow.yaml")
+        join8("core", "config.yaml"),
+        join8("custom", "config.yaml"),
+        join8("custom", "workflows", "ticket-lifecycle", "workflow.yaml"),
+        join8("bmm", "workflows", "workflow-status", "workflow.yaml")
       ];
-      const missing = sentinels.filter((file) => existsSync5(join6(sourceRoot, file)) && !existsSync5(join6(targetRoot, file)));
+      const missing = sentinels.filter((file) => existsSync7(join8(sourceRoot, file)) && !existsSync7(join8(targetRoot, file)));
       return {
         id: "bmad.scaffold",
         title: "BMAD modules/docs scaffold",
@@ -2081,7 +2521,7 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
     },
     migrate: (ctx, finding) => {
       const changedFiles = [];
-      copyMissingRecursive(join6(ctx.pjanglerRoot, "templates", "commonproject", "_bmad"), join6(ctx.repoRoot, "_bmad"), changedFiles, ctx.dryRun);
+      copyMissingRecursive(join8(ctx.pjanglerRoot, "templates", "commonproject", "_bmad"), join8(ctx.repoRoot, "_bmad"), changedFiles, ctx.dryRun);
       return {
         id: finding.id,
         title: finding.title,
@@ -2102,12 +2542,12 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
         return { id: "hermes.pm-scaffold", title: "Hermes PM scaffold parity", status: "skip", summary: "No pm role present", details: [], fixable: false };
       }
       const details = [];
-      for (const rel of ["role.yaml", "SOUL.md", "hermes", ".gitignore", ".scripts/70-systemd.sh", ".runtime-scaffold/README.md", "runtime/memories/MEMORY.md", "runtime/bloodbank-consumer.py"]) {
-        if (!existsSync5(join6(role.roleDir, rel))) details.push(`missing ${relative(ctx.repoRoot, join6(role.roleDir, rel))}`);
+      for (const rel of ["role.yaml", "SOUL.md", "hermes", ".gitignore", ".scripts/70-systemd.sh", ".scripts/heartbeat.sh", ".scripts/checkpoint.sh", ".runtime-scaffold/README.md", "runtime/memories/MEMORY.md", "runtime/bloodbank-consumer.py"]) {
+        if (!existsSync7(join8(role.roleDir, rel))) details.push(`missing ${relative(ctx.repoRoot, join8(role.roleDir, rel))}`);
       }
-      const gitmodules = safeReadText(join6(ctx.repoRoot, ".gitmodules")) ?? "";
+      const gitmodules = safeReadText(join8(ctx.repoRoot, ".gitmodules")) ?? "";
       if (!gitmodules.includes(`agents/hermes/${role.role}/runtime`)) details.push(".gitmodules missing pm runtime submodule entry");
-      if (!profileMetaInheritsDefault(join6(role.roleDir, "runtime", "profile.yaml"))) {
+      if (!profileMetaInheritsDefault(join8(role.roleDir, "runtime", "profile.yaml"))) {
         details.push("runtime/profile.yaml missing inherited default config metadata");
       }
       const registry = safeReadText(registryPath(ctx.homeDir));
@@ -2128,79 +2568,21 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       if (!role) {
         return { id: finding.id, title: finding.title, status: "blocked", summary: "No pm role present", changedFiles, details: [] };
       }
-      const templateRoleDir = join6(ctx.pjanglerRoot, "templates", "hermes-agent", "template");
-      writeIfDifferent(join6(role.roleDir, "SOUL.md"), renderSoul(role), ctx.dryRun, changedFiles);
-      writeIfDifferent(join6(role.roleDir, "hermes"), renderHermesWrapper(role), ctx.dryRun, changedFiles, 493);
-      writeIfDifferent(join6(role.roleDir, ".gitignore"), readText(join6(templateRoleDir, ".gitignore.jinja")).replace(/\{\{ role \}\}/g, role.role), ctx.dryRun, changedFiles);
-      copyMissingRecursive(join6(templateRoleDir, ".runtime-scaffold"), join6(role.roleDir, ".runtime-scaffold"), changedFiles, ctx.dryRun);
-      copyMissingRecursive(join6(templateRoleDir, ".runtime-scaffold"), join6(role.roleDir, "runtime"), changedFiles, ctx.dryRun);
-      copyMissingRecursive(join6(templateRoleDir, ".scripts"), join6(role.roleDir, ".scripts"), changedFiles, ctx.dryRun, (source) => source.endsWith("continuous-ticket-sentinel.prompt.md.jinja"));
-      upsertSubmodule(ctx.repoRoot, role, changedFiles, ctx.dryRun);
-      const profileMetaUpdated = upsertInheritedProfileMeta(join6(role.roleDir, "runtime", "profile.yaml"), changedFiles, ctx.dryRun);
-      if (profileMetaUpdated) details.push(`updated ${profileMetaUpdated}`);
-      const registryUpdated = upsertRegistryEntry(role, ctx.homeDir, changedFiles, ctx.dryRun);
-      if (registryUpdated) details.push(`updated ${registryUpdated}`);
-      return {
-        id: finding.id,
-        title: finding.title,
-        status: changedFiles.length ? "applied" : "noop",
-        summary: changedFiles.length ? "PM scaffold normalized" : "No changes required",
-        changedFiles,
-        details
-      };
-    }
-  },
-  {
-    id: "hermes.scrum-master-scaffold",
-    title: "Hermes scrum-master scaffold parity",
-    audit: (ctx) => {
-      const roles = discoverRoles(ctx.repoRoot);
-      const role = roles.find((item) => item.role === "scrum-master");
-      if (!role) {
-        return { id: "hermes.scrum-master-scaffold", title: "Hermes scrum-master scaffold parity", status: "skip", summary: "No scrum-master role present", details: [], fixable: false };
-      }
-      const details = [];
-      for (const rel of ["role.yaml", "SOUL.md", "hermes", ".gitignore", ".scripts/75-scrum-master.sh", ".scripts/scrum-master/continuous-ticket-sentinel.sh", "runtime/memories/MEMORY.md", "runtime/bloodbank-consumer.py"]) {
-        if (!existsSync5(join6(role.roleDir, rel))) details.push(`missing ${relative(ctx.repoRoot, join6(role.roleDir, rel))}`);
-      }
-      const gitmodules = safeReadText(join6(ctx.repoRoot, ".gitmodules")) ?? "";
-      if (!gitmodules.includes(`agents/hermes/${role.role}/runtime`)) details.push(".gitmodules missing scrum-master runtime submodule entry");
-      if (!profileMetaInheritsDefault(join6(role.roleDir, "runtime", "profile.yaml"))) {
-        details.push("runtime/profile.yaml missing inherited default config metadata");
-      }
-      const registry = safeReadText(registryPath(ctx.homeDir));
-      if (!registry?.includes(`${role.agentId}:`)) details.push(`fleet registry missing ${role.agentId}`);
-      return {
-        id: "hermes.scrum-master-scaffold",
-        title: "Hermes scrum-master scaffold parity",
-        status: details.length === 0 ? "pass" : "fail",
-        summary: details.length === 0 ? "scrum-master scaffold parity verified" : `${details.length} scrum-master scaffold issue(s) detected`,
-        details,
-        fixable: true
-      };
-    },
-    migrate: (ctx, finding) => {
-      const role = discoverRoles(ctx.repoRoot).find((item) => item.role === "scrum-master");
-      const changedFiles = [];
-      const details = [];
-      if (!role) {
-        return { id: finding.id, title: finding.title, status: "blocked", summary: "No scrum-master role present", changedFiles, details: [] };
-      }
-      const templateRoleDir = join6(ctx.pjanglerRoot, "templates", "hermes-agent", "template");
-      writeIfDifferent(join6(role.roleDir, "SOUL.md"), renderSoul(role), ctx.dryRun, changedFiles);
-      writeIfDifferent(join6(role.roleDir, "hermes"), renderHermesWrapper(role), ctx.dryRun, changedFiles, 493);
-      writeIfDifferent(join6(role.roleDir, ".gitignore"), readText(join6(templateRoleDir, ".gitignore.jinja")).replace(/\{\{ role \}\}/g, role.role), ctx.dryRun, changedFiles);
-      copyMissingRecursive(join6(templateRoleDir, ".runtime-scaffold"), join6(role.roleDir, ".runtime-scaffold"), changedFiles, ctx.dryRun);
-      copyMissingRecursive(join6(templateRoleDir, ".runtime-scaffold"), join6(role.roleDir, "runtime"), changedFiles, ctx.dryRun);
-      copyMissingRecursive(join6(templateRoleDir, ".scripts"), join6(role.roleDir, ".scripts"), changedFiles, ctx.dryRun, (source) => source.endsWith("continuous-ticket-sentinel.prompt.md.jinja"));
-      const promptSource = join6(templateRoleDir, ".scripts", "scrum-master", "continuous-ticket-sentinel.prompt.md.jinja");
-      const promptTarget = join6(role.roleDir, ".scripts", "scrum-master", "continuous-ticket-sentinel.prompt.md");
-      if (!existsSync5(promptTarget)) {
-        const prompt = readText(promptSource).replace(/\{\{ agent_id \}\}/g, role.agentId).replace(/\{\{ role \}\}/g, role.role).replace(/\{\{ target_repo \}\}/g, role.repo);
+      const templateRoleDir = join8(ctx.pjanglerRoot, "templates", "hermes-agent", "template");
+      writeIfDifferent(join8(role.roleDir, "SOUL.md"), renderSoul(role), ctx.dryRun, changedFiles);
+      writeIfDifferent(join8(role.roleDir, "hermes"), renderHermesWrapper(role), ctx.dryRun, changedFiles, 493);
+      writeIfDifferent(join8(role.roleDir, ".gitignore"), readText(join8(templateRoleDir, ".gitignore.jinja")).replace(/\{\{ role \}\}/g, role.role), ctx.dryRun, changedFiles);
+      copyMissingRecursive(join8(templateRoleDir, ".runtime-scaffold"), join8(role.roleDir, ".runtime-scaffold"), changedFiles, ctx.dryRun);
+      copyMissingRecursive(join8(templateRoleDir, ".runtime-scaffold"), join8(role.roleDir, "runtime"), changedFiles, ctx.dryRun);
+      copyMissingRecursive(join8(templateRoleDir, ".scripts"), join8(role.roleDir, ".scripts"), changedFiles, ctx.dryRun, (source) => source.endsWith("sentinel.prompt.md.jinja"));
+      const promptSource = join8(templateRoleDir, ".scripts", "sentinel.prompt.md.jinja");
+      const promptTarget = join8(role.roleDir, ".scripts", "sentinel.prompt.md");
+      if (existsSync7(promptSource) && !existsSync7(promptTarget)) {
+        const prompt = readText(promptSource).replace(/\{\{ agent_id \}\}/g, role.agentId).replace(/\{\{ role \}\}/g, role.role).replace(/\{\{ target_repo \}\}/g, role.repo).replace(/\{\{ display_name \}\}/g, role.displayName || role.agentId);
         writeIfDifferent(promptTarget, prompt, ctx.dryRun, changedFiles);
       }
       upsertSubmodule(ctx.repoRoot, role, changedFiles, ctx.dryRun);
-      const profileMetaUpdated = upsertInheritedProfileMeta(join6(role.roleDir, "runtime", "profile.yaml"), changedFiles, ctx.dryRun);
+      const profileMetaUpdated = upsertInheritedProfileMeta(join8(role.roleDir, "runtime", "profile.yaml"), changedFiles, ctx.dryRun);
       if (profileMetaUpdated) details.push(`updated ${profileMetaUpdated}`);
       const registryUpdated = upsertRegistryEntry(role, ctx.homeDir, changedFiles, ctx.dryRun);
       if (registryUpdated) details.push(`updated ${registryUpdated}`);
@@ -2208,7 +2590,7 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
         id: finding.id,
         title: finding.title,
         status: changedFiles.length ? "applied" : "noop",
-        summary: changedFiles.length ? "scrum-master scaffold normalized" : "No changes required",
+        summary: changedFiles.length ? "PM scaffold normalized" : "No changes required",
         changedFiles,
         details
       };
@@ -2228,14 +2610,10 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       }
       const details = [];
       for (const role of roles) {
-        for (const unit of [`hermes-${role.agentId}-gateway.service`, `hermes-${role.agentId}-consumer.service`, `hermes-${role.agentId}-checkpoint.timer`]) {
+        for (const unit of [`hermes-${role.agentId}-gateway.service`, `hermes-${role.agentId}-consumer.service`, `hermes-${role.agentId}-heartbeat.timer`]) {
           const state = checkUnit(unit);
           if (!state.enabled || !state.active) details.push(`${unit} should be enabled+active`);
         }
-        if (role.role === "scrum-master") {
-          const state = checkUnit(`hermes-${role.agentId}-continuous-ticket-sentinel.timer`);
-          if (!state.enabled || !state.active) details.push(`hermes-${role.agentId}-continuous-ticket-sentinel.timer should be enabled+active`);
-        }
       }
       return {
         id: "systemd.sentinel",
@@ -2258,10 +2636,9 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
         return { id: finding.id, title: finding.title, status: "blocked", summary: "systemd --user unavailable on this host", changedFiles, details };
       }
       for (const role of roles) {
-        const sysDir = join6(ctx.homeDir, ".config", "systemd", "user");
-        const units = [`hermes-${role.agentId}-gateway.service`, `hermes-${role.agentId}-consumer.service`, `hermes-${role.agentId}-checkpoint.timer`];
-        if (role.role === "scrum-master") units.push(`hermes-${role.agentId}-continuous-ticket-sentinel.timer`);
-        const allUnitsPresent = units.every((unit) => existsSync5(join6(sysDir, unit)));
+        const sysDir = join8(ctx.homeDir, ".config", "systemd", "user");
+        const units = [`hermes-${role.agentId}-gateway.service`, `hermes-${role.agentId}-consumer.service`, `hermes-${role.agentId}-heartbeat.timer`];
+        const allUnitsPresent = units.every((unit) => existsSync7(join8(sysDir, unit)));
         if (allUnitsPresent) {
           if (ctx.dryRun) {
             details.push(`would run: systemctl --user enable --now ${units.join(" ")}`);
@@ -2273,8 +2650,8 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
           }
           continue;
         }
-        for (const script of [join6(role.roleDir, ".scripts", "70-systemd.sh"), role.role === "scrum-master" ? join6(role.roleDir, ".scripts", "75-scrum-master.sh") : ""]) {
-          if (!script || !existsSync5(script)) continue;
+        for (const script of [join8(role.roleDir, ".scripts", "70-systemd.sh")]) {
+          if (!script || !existsSync7(script)) continue;
           if (ctx.dryRun) {
             details.push(`would run: bash ${script}`);
           } else {
@@ -2304,13 +2681,16 @@ function writeIfDifferent(path, content, dryRun, changedFiles, mode) {
     if (mode) chmodSync(path, mode);
   }
 }
+function getParityRuleIds() {
+  return RULES.map((rule) => rule.id);
+}
 function runAudit(repoArg) {
   const pjanglerRoot = resolvePjanglerRoot();
   const ctx = {
     repoRoot: resolve(repoArg ?? process.cwd()),
     dryRun: true,
     pjanglerRoot,
-    homeDir: homedir3()
+    homeDir: homedir4()
   };
   const rules = RULES.map((rule) => rule.audit(ctx));
   return {
@@ -2320,17 +2700,17 @@ function runAudit(repoArg) {
     rules
   };
 }
-function runMigration(selector, repoArg, dryRun, all) {
+function runMigrationForRules(ruleIds, repoArg, dryRun) {
   const pjanglerRoot = resolvePjanglerRoot();
   const ctx = {
     repoRoot: resolve(repoArg ?? process.cwd()),
     dryRun,
     pjanglerRoot,
-    homeDir: homedir3()
+    homeDir: homedir4()
   };
-  const selected = all ? RULES : RULES.filter((rule) => rule.id === selector);
+  const selected = RULES.filter((rule) => ruleIds.includes(rule.id));
   if (!selected.length) {
-    throw new Error(`Unknown parity rule: ${selector}`);
+    throw new Error(`Unknown parity rules: ${ruleIds.join(", ")}`);
   }
   const results = selected.map((rule) => {
     try {
@@ -2356,6 +2736,10 @@ function runMigration(selector, repoArg, dryRun, all) {
     changedFiles
   };
 }
+function runMigration(selector, repoArg, dryRun, all) {
+  const ruleIds = all ? RULES.map((rule) => rule.id) : selector ? [selector] : [];
+  return runMigrationForRules(ruleIds, repoArg, dryRun);
+}
 function formatAuditReport(report) {
   const lines = [`repo: ${report.repo}`, `ok: ${report.ok}`, `audited_at: ${report.auditedAt}`, "rules:"];
   for (const rule of report.rules) {
@@ -2380,19 +2764,421 @@ function formatMigrationReport(report) {
 `;
 }
 
+// src/project/index.ts
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync4, renameSync as renameSync2, statSync, writeFileSync as writeFileSync5 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { basename as basename3, dirname as dirname6, join as join9, resolve as resolve2 } from "node:path";
+import YAML from "yaml";
+var PROJECT_REGISTRY_ENV = "PJ_PROJECT_REGISTRY";
+var PROJECT_REGISTRY_SCHEMA_VERSION = 1;
+var KNOWN_SKILL_ROOTS = [
+  "/home/delorenj/code/skillex/all-skills",
+  "/home/delorenj/code/CoachingAgentFramework/.agents/skills",
+  "/home/delorenj/code/pjangler/.agents/skills",
+  join9(homedir5(), ".codex", "skills")
+];
+function projectRegistryPath(env = process.env) {
+  return expandHome(env[PROJECT_REGISTRY_ENV] || join9(homedir5(), ".config", "pjangler", "projects.yaml"));
+}
+function emptyProjectRegistry() {
+  return { schema_version: PROJECT_REGISTRY_SCHEMA_VERSION, projects: {} };
+}
+function loadProjectRegistry(path = projectRegistryPath()) {
+  if (!existsSync8(path)) return emptyProjectRegistry();
+  const raw = YAML.parse(readFileSync4(path, "utf8"));
+  if (raw == null) return emptyProjectRegistry();
+  if (!isRecord(raw)) throw new Error(`Project registry must be a mapping: ${path}`);
+  const registry = raw;
+  const normalized = {
+    schema_version: Number(registry.schema_version ?? PROJECT_REGISTRY_SCHEMA_VERSION),
+    projects: isRecord(registry.projects) ? registry.projects : {}
+  };
+  validateProjectRegistry(normalized);
+  return normalized;
+}
+function saveProjectRegistry(registry, path = projectRegistryPath()) {
+  validateProjectRegistry(registry);
+  mkdirSync6(dirname6(path), { recursive: true });
+  const temp = `${path}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync5(temp, YAML.stringify(registry, { lineWidth: 0 }), "utf8");
+  renameSync2(temp, path);
+}
+function validateProjectRegistry(registry) {
+  if (registry.schema_version !== PROJECT_REGISTRY_SCHEMA_VERSION) {
+    throw new Error(`Unsupported project registry schema_version: ${registry.schema_version}`);
+  }
+  if (!isRecord(registry.projects)) throw new Error("Project registry projects must be a mapping");
+  const slugs = /* @__PURE__ */ new Set();
+  const repoPaths = /* @__PURE__ */ new Map();
+  const identifiers = /* @__PURE__ */ new Map();
+  for (const [slug, project] of Object.entries(registry.projects)) {
+    validateProjectRecord(project, slug);
+    if (slugs.has(project.slug)) throw new Error(`Duplicate project slug: ${project.slug}`);
+    slugs.add(project.slug);
+    const repoKey = resolve2(project.repo_path);
+    const existingRepoSlug = repoPaths.get(repoKey);
+    if (existingRepoSlug && existingRepoSlug !== slug) {
+      throw new Error(`Duplicate project repo_path: ${project.repo_path} used by ${existingRepoSlug} and ${slug}`);
+    }
+    repoPaths.set(repoKey, slug);
+    const identifier = project.ticket_provider.identifier?.toUpperCase();
+    if (identifier) {
+      const existingIdentifierSlug = identifiers.get(identifier);
+      if (existingIdentifierSlug && existingIdentifierSlug !== slug) {
+        throw new Error(`Duplicate project identifier: ${identifier} used by ${existingIdentifierSlug} and ${slug}`);
+      }
+      identifiers.set(identifier, slug);
+    }
+  }
+}
+function slugifyProjectName(value) {
+  return value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "project";
+}
+function deriveProjectIdentifier(value) {
+  const compact = value.replace(/[^A-Za-z0-9]/g, "").toUpperCase();
+  const identifier = compact.slice(0, 4) || "PROJ";
+  return identifier.length >= 2 ? identifier : `${identifier}XX`.slice(0, 4);
+}
+function normalizeAgentRole(value) {
+  return value?.trim() || "pm";
+}
+function jsonStable(value) {
+  return JSON.stringify(value);
+}
+function projectRecordEquivalent(a, b) {
+  if (!a) return false;
+  const { created_at: _aCreated, updated_at: _aUpdated, ...aComparable } = a;
+  const { created_at: _bCreated, updated_at: _bUpdated, ...bComparable } = b;
+  return jsonStable(aComparable) === jsonStable(bComparable);
+}
+function defaultProjectTargetDir(name, cwd = process.cwd()) {
+  const compactName = name.replace(/[^A-Za-z0-9._-]/g, "") || slugifyProjectName(name);
+  return resolve2(dirname6(resolve2(cwd)), compactName);
+}
+function resolveSourceSkillPath(sourceSkill) {
+  if (!sourceSkill) return void 0;
+  const expanded = expandHome(sourceSkill);
+  const direct = resolve2(expanded);
+  if (existsSync8(direct)) return direct;
+  const name = basename3(sourceSkill);
+  for (const root of KNOWN_SKILL_ROOTS) {
+    const candidate = join9(root, name);
+    if (existsSync8(candidate)) return candidate;
+  }
+  const civilWarLetterifier = "/home/delorenj/code/skillex/all-skills/civilwar-letterifier";
+  const hint = existsSync8(civilWarLetterifier) ? ` Did you mean ${civilWarLetterifier}?` : "";
+  throw new Error(`Source skill not found: ${sourceSkill}.${hint}`);
+}
+function planProjectInit(input) {
+  if (!input.name.trim()) throw new Error("Project name is required");
+  const registryPath2 = resolve2(projectRegistryPath({ ...process.env, [PROJECT_REGISTRY_ENV]: input.registryPath || process.env[PROJECT_REGISTRY_ENV] }));
+  const registry = loadProjectRegistry(registryPath2);
+  const now = (input.now ?? /* @__PURE__ */ new Date()).toISOString();
+  const slug = input.projectSlug ?? slugifyProjectName(input.name);
+  const targetDir = resolve2(input.targetDir ?? defaultProjectTargetDir(input.name, input.cwd));
+  const identifier = (input.projectIdentifier ?? deriveProjectIdentifier(input.name)).toUpperCase();
+  const existing = registry.projects[slug];
+  const sourceSkillPath = resolveSourceSkillPath(input.sourceSkill);
+  const overwrite = input.overwrite ?? input.force ?? false;
+  const agentRole = normalizeAgentRole(input.agentRole);
+  const agents = input.provisionAgent ? {
+    ...existing?.agents ?? {},
+    [agentRole]: {
+      role: agentRole,
+      provisioning_state: "planned"
+    }
+  } : existing?.agents ?? {};
+  const scaffold = input.scaffold ?? true;
+  const candidateProject = {
+    name: input.name,
+    slug,
+    repo_path: targetDir,
+    description: input.description ?? "",
+    status: "planned",
+    source_artifacts: sourceSkillPath ? [{ kind: "skill", path: sourceSkillPath, package_name: input.packageName ?? slug }] : [],
+    template: {
+      commonproject: {
+        enabled: true,
+        primary_language: input.primaryLanguage ?? "python"
+      }
+    },
+    ticket_provider: {
+      type: input.ticketProvider ?? "plane",
+      workspace: input.planeWorkspace ?? "33god",
+      identifier,
+      board_id: input.planeProjectId ?? "",
+      board_url: input.planeProjectId ? `https://plane.delo.sh/${input.planeWorkspace ?? "33god"}/projects/${input.planeProjectId}/issues/` : "",
+      state: input.live ? "planned" : "planned"
+    },
+    agents,
+    created_at: existing?.created_at ?? now,
+    updated_at: now
+  };
+  const project = {
+    ...candidateProject,
+    updated_at: projectRecordEquivalent(existing, candidateProject) ? existing.updated_at : now
+  };
+  validateNoDuplicateProject(registry, project, overwrite);
+  const pjanglerRoot = resolve2(input.pjanglerRoot ?? resolvePjanglerRoot2());
+  const manifest = projectManifestFromRegistryProject(project);
+  const apply = input.apply ?? false;
+  const live = input.live ?? false;
+  const actions = [
+    { kind: "registry.upsert", registryPath: registryPath2, slug, project }
+  ];
+  if (scaffold) {
+    actions.push(buildCommonProjectCopierAction({
+      pjanglerRoot,
+      targetDir,
+      projectName: project.name,
+      projectDescription: project.description,
+      projectSlug: project.slug,
+      ticketProvider: project.ticket_provider.type,
+      planeWorkspace: project.ticket_provider.workspace ?? "33god",
+      planeProjectId: project.ticket_provider.board_id ?? "",
+      projectIdentifier: identifier,
+      primaryLanguage: project.template.commonproject.primary_language,
+      overwrite
+    }));
+  }
+  actions.push(
+    { kind: "project.write-manifest", path: join9(targetDir, ".project.json"), manifest },
+    {
+      kind: "plane.create-or-link",
+      enabled: live,
+      live,
+      workspace: project.ticket_provider.workspace ?? "33god",
+      identifier,
+      state: live ? "planned" : "planned",
+      reason: live ? void 0 : "network/cloud actions require --live"
+    },
+    {
+      kind: "hermes.provision-agent",
+      enabled: input.provisionAgent ?? false,
+      local: !live,
+      targetDir,
+      targetRepo: slug,
+      role: agentRole,
+      context: {
+        skipRuntimeRepo: !live,
+        skipPlane: !live,
+        skipBloodbank: !live,
+        skipSystemd: !live || process.platform === "darwin"
+      }
+    }
+  );
+  return { ok: true, apply, dryRun: !apply, live, registryPath: registryPath2, project, manifest, actions };
+}
+function executeProjectInitPlan(plan) {
+  const logs = [];
+  const errors = [];
+  const changedFiles = [];
+  if (!plan.apply) return { ok: true, plan, logs, errors, changedFiles };
+  const registry = loadProjectRegistry(plan.registryPath);
+  let pendingRegistryAction;
+  for (const action of plan.actions) {
+    if (action.kind === "copier.copy.commonproject") {
+      mkdirSync6(dirname6(action.targetDir), { recursive: true });
+      const result = spawnSync5(action.command[0], action.command.slice(1), { encoding: "utf8", cwd: action.cwd });
+      if (result.stdout?.trim()) logs.push(result.stdout.trim());
+      if (result.stderr?.trim()) logs.push(result.stderr.trim());
+      if (result.error) {
+        const code = result.error.code;
+        errors.push(
+          code === "ENOENT" ? "copier not found on PATH. Install with: uv tool install copier or pip install copier" : `copier failed: ${result.error.message}`
+        );
+        break;
+      }
+      if (result.status !== 0) {
+        errors.push(`copier exited with status ${result.status ?? "unknown"}`);
+        if (existsSync8(action.targetDir)) changedFiles.push(action.targetDir);
+        break;
+      }
+      changedFiles.push(action.targetDir);
+    } else if (action.kind === "project.write-manifest") {
+      mkdirSync6(dirname6(action.path), { recursive: true });
+      const next = `${JSON.stringify(action.manifest, null, 2)}
+`;
+      const current = existsSync8(action.path) ? readFileSync4(action.path, "utf8") : void 0;
+      if (current !== next) {
+        writeFileSync5(action.path, next, "utf8");
+        changedFiles.push(action.path);
+      }
+    } else if (action.kind === "registry.upsert") {
+      pendingRegistryAction = action;
+    } else if (action.kind === "plane.create-or-link") {
+      logs.push(action.enabled ? "plane.create-or-link requires a live provider integration" : "plane.create-or-link skipped (requires --live)");
+    } else if (action.kind === "hermes.provision-agent") {
+      logs.push(action.enabled ? "hermes.provision-agent planned for the caller to execute" : "hermes.provision-agent skipped");
+    }
+  }
+  if (pendingRegistryAction && errors.length === 0) {
+    if (!projectRecordEquivalent(registry.projects[pendingRegistryAction.slug], pendingRegistryAction.project)) {
+      registry.projects[pendingRegistryAction.slug] = pendingRegistryAction.project;
+      saveProjectRegistry(registry, pendingRegistryAction.registryPath);
+      changedFiles.push(pendingRegistryAction.registryPath);
+    }
+  }
+  return { ok: errors.length === 0, plan, logs, errors, changedFiles };
+}
+function projectManifestFromRegistryProject(project) {
+  const agents = Object.fromEntries(
+    Object.entries(project.agents).map(([name, agent]) => [
+      `${project.slug}-${name}`,
+      {
+        role: agent.role,
+        role_dir: agent.role_dir,
+        provisioning_state: agent.provisioning_state
+      }
+    ])
+  );
+  return {
+    project_name: project.name,
+    project_description: project.description,
+    project_slug: project.slug,
+    repo_path: project.repo_path,
+    ticket_provider: {
+      type: project.ticket_provider.type,
+      workspace: project.ticket_provider.workspace ?? "",
+      identifier: project.ticket_provider.identifier ?? "",
+      board_id: project.ticket_provider.board_id ?? "",
+      board_url: project.ticket_provider.board_url ?? "",
+      state: project.ticket_provider.state
+    },
+    agents
+  };
+}
+function formatProjectInitPlan(plan) {
+  const lines = [
+    `${plan.dryRun ? "[DRY RUN] " : ""}Project init plan: ${plan.project.name} (${plan.project.slug})`,
+    `Registry: ${plan.registryPath}`,
+    `Target: ${plan.project.repo_path}`,
+    "Actions:"
+  ];
+  for (const action of plan.actions) {
+    lines.push(`  - ${action.kind}`);
+    if (action.kind === "copier.copy.commonproject") lines.push(`    target: ${action.targetDir}`);
+    if (action.kind === "project.write-manifest") lines.push(`    path: ${action.path}`);
+    if (action.kind === "plane.create-or-link" && action.reason) lines.push(`    note: ${action.reason}`);
+  }
+  return lines.join("\n");
+}
+function formatProjectList(registry) {
+  const projects = Object.values(registry.projects).sort((a, b) => a.slug.localeCompare(b.slug));
+  if (!projects.length) return "No projects registered.";
+  return projects.map((project) => `${project.slug.padEnd(18)} ${String(project.ticket_provider.identifier ?? "").padEnd(6)} ${project.status.padEnd(8)} ${project.repo_path}`).join("\n");
+}
+function getProject(registry, slug) {
+  const project = registry.projects[slug];
+  if (!project) throw new Error(`Project not found in registry: ${slug}`);
+  return project;
+}
+function doctorProjectRegistry(registryPath2 = projectRegistryPath(), slug) {
+  const issues = [];
+  const registry = loadProjectRegistry(registryPath2);
+  const projects = slug ? [[slug, getProject(registry, slug)]] : Object.entries(registry.projects);
+  for (const [projectSlug, project] of projects) {
+    if (!existsSync8(project.repo_path)) {
+      issues.push({ level: "warn", slug: projectSlug, message: `repo_path does not exist: ${project.repo_path}` });
+    } else if (!statSync(project.repo_path).isDirectory()) {
+      issues.push({ level: "error", slug: projectSlug, message: `repo_path is not a directory: ${project.repo_path}` });
+    } else {
+      const manifestPath = join9(project.repo_path, ".project.json");
+      if (!existsSync8(manifestPath)) issues.push({ level: "warn", slug: projectSlug, message: ".project.json is missing" });
+    }
+    for (const artifact of project.source_artifacts) {
+      if (artifact.path && !existsSync8(artifact.path)) {
+        issues.push({ level: "warn", slug: projectSlug, message: `source artifact missing: ${artifact.path}` });
+      }
+    }
+  }
+  return {
+    ok: !issues.some((issue) => issue.level === "error"),
+    registryPath: registryPath2,
+    checkedProjects: projects.map(([projectSlug]) => projectSlug),
+    issues
+  };
+}
+function buildCommonProjectCopierAction(input) {
+  const templateDir = join9(input.pjanglerRoot, "templates", "commonproject");
+  const data = {
+    project_name: input.projectName,
+    project_description: input.projectDescription ?? "",
+    project_slug: input.projectSlug,
+    ticket_provider: input.ticketProvider,
+    plane_workspace: input.planeWorkspace,
+    plane_project_id: input.planeProjectId ?? "",
+    project_identifier: input.projectIdentifier,
+    primary_language: input.primaryLanguage
+  };
+  const command = ["copier", "copy", "--trust", templateDir, input.targetDir, "--defaults"];
+  for (const [key, value] of Object.entries(data)) command.push("--data", `${key}=${value}`);
+  if (input.overwrite) command.push("--overwrite");
+  return {
+    kind: "copier.copy.commonproject",
+    cwd: input.pjanglerRoot,
+    command,
+    targetDir: input.targetDir,
+    data,
+    overwrite: input.overwrite
+  };
+}
+function resolvePjanglerRoot2() {
+  let dir = dirname6(new URL(import.meta.url).pathname);
+  while (dir !== dirname6(dir)) {
+    if (existsSync8(join9(dir, "package.json")) && existsSync8(join9(dir, "templates", "commonproject", "copier.yml"))) return dir;
+    dir = dirname6(dir);
+  }
+  return resolve2(process.cwd());
+}
+function validateNoDuplicateProject(registry, project, overwrite) {
+  const existingSameSlug = registry.projects[project.slug];
+  if (existingSameSlug && !overwrite && resolve2(existingSameSlug.repo_path) !== resolve2(project.repo_path)) {
+    throw new Error(`Project slug already exists in registry: ${project.slug}`);
+  }
+  for (const [slug, existing] of Object.entries(registry.projects)) {
+    if (slug === project.slug) continue;
+    if (resolve2(existing.repo_path) === resolve2(project.repo_path)) {
+      throw new Error(`Project repo_path already registered by ${slug}: ${project.repo_path}`);
+    }
+    if (existing.ticket_provider.identifier && existing.ticket_provider.identifier.toUpperCase() === project.ticket_provider.identifier?.toUpperCase()) {
+      throw new Error(`Project identifier already registered by ${slug}: ${project.ticket_provider.identifier}`);
+    }
+  }
+}
+function validateProjectRecord(project, key) {
+  if (!isRecord(project)) throw new Error(`Project ${key} must be a mapping`);
+  if (!project.name) throw new Error(`Project ${key} missing name`);
+  if (!project.slug) throw new Error(`Project ${key} missing slug`);
+  if (project.slug !== key) throw new Error(`Project key ${key} does not match slug ${project.slug}`);
+  if (!project.repo_path) throw new Error(`Project ${key} missing repo_path`);
+  if (!Array.isArray(project.source_artifacts)) throw new Error(`Project ${key} source_artifacts must be a list`);
+  if (!isRecord(project.ticket_provider)) throw new Error(`Project ${key} ticket_provider must be a mapping`);
+  if (!isRecord(project.agents)) throw new Error(`Project ${key} agents must be a mapping`);
+}
+function expandHome(path) {
+  if (path === "~") return homedir5();
+  if (path.startsWith("~/")) return join9(homedir5(), path.slice(2));
+  return path;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/utils/version.ts
-import { readFileSync as readFileSync3 } from "node:fs";
-import { dirname as dirname4, join as join7 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { readFileSync as readFileSync5 } from "node:fs";
+import { dirname as dirname7, join as join10 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 var PJANGLER_VERSION = (() => {
   try {
-    let dir = dirname4(fileURLToPath3(import.meta.url));
+    let dir = dirname7(fileURLToPath4(import.meta.url));
     for (let i = 0; i < 4; i++) {
       try {
-        const raw = readFileSync3(join7(dir, "package.json"), "utf8");
+        const raw = readFileSync5(join10(dir, "package.json"), "utf8");
         return JSON.parse(raw).version ?? "0.0.0";
       } catch {
-        const parent = dirname4(dir);
+        const parent = dirname7(dir);
         if (parent === dir) break;
         dir = parent;
       }
@@ -2403,6 +3189,190 @@ var PJANGLER_VERSION = (() => {
 })();
 
 // src/index.ts
+function printMigrationReport(report, asJson) {
+  if (asJson) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    console.log(formatMigrationReport(report));
+  }
+}
+async function promptForRuleIds(rules) {
+  const options = rules.filter((rule) => rule.fixable).map((rule) => ({
+    value: rule.id,
+    label: `${rule.id} [${rule.status}] ${rule.title}`,
+    hint: rule.summary
+  }));
+  if (!options.length) {
+    return [];
+  }
+  const initialValues = rules.filter((rule) => rule.fixable && rule.status !== "pass" && rule.status !== "skip").map((rule) => rule.id);
+  const selected = await multiselect({
+    message: "Select parity rules to apply (space to toggle, enter to confirm):",
+    options,
+    initialValues
+  });
+  if (isCancel5(selected)) {
+    return [];
+  }
+  return selected;
+}
+function readJson(path) {
+  if (!existsSync9(path)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync6(path, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function findGitRoot(cwd) {
+  const result = spawnSync6("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8" });
+  if (result.status !== 0) return void 0;
+  return resolve3(result.stdout.trim());
+}
+function packageNameToProjectName(value) {
+  if (!value) return void 0;
+  const name = value.split("/").pop() ?? value;
+  return name.replace(/[-_]+/g, " ").replace(/\b\w/g, (letter) => letter.toUpperCase()).trim();
+}
+function deriveProjectDefaults(targetDir) {
+  const manifest = readJson(join11(targetDir, ".project.json"));
+  const pkg = readJson(join11(targetDir, "package.json"));
+  const name = String(manifest?.project_name ?? "").trim() || packageNameToProjectName(typeof pkg?.name === "string" ? pkg.name : void 0) || packageNameToProjectName(basename4(targetDir)) || "Project";
+  const ticketProvider = manifest?.ticket_provider && typeof manifest.ticket_provider === "object" ? manifest.ticket_provider : {};
+  return {
+    name,
+    description: String(manifest?.project_description ?? pkg?.description ?? ""),
+    slug: typeof manifest?.project_slug === "string" ? manifest.project_slug : void 0,
+    identifier: typeof ticketProvider.identifier === "string" ? ticketProvider.identifier : void 0
+  };
+}
+function isInteractiveProjectInit(options) {
+  return !options.json && !options.yes && options.tui !== false && Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+async function promptTextValue(message, initialValue) {
+  const value = await text3({
+    message,
+    initialValue,
+    validate: (input) => input?.trim() ? void 0 : "Required"
+  });
+  if (isCancel5(value)) {
+    cancel2("project init cancelled");
+    process.exit(1);
+  }
+  return value.trim();
+}
+function projectInitActionLabel(kind) {
+  switch (kind) {
+    case "registry.upsert":
+      return "Register/update project registry entry";
+    case "copier.copy.commonproject":
+      return "Render CommonProject scaffold";
+    case "project.write-manifest":
+      return "Write repo-local .project.json projection";
+    case "plane.create-or-link":
+      return "Create/link ticket provider project";
+    case "hermes.provision-agent":
+      return "Provision Hermes agent";
+    default:
+      return kind;
+  }
+}
+function registryNeedsUpsert(plan) {
+  const registry = loadProjectRegistry(plan.registryPath);
+  const existing = registry.projects[plan.project.slug];
+  if (!existing) return true;
+  const { created_at: _existingCreated, updated_at: _existingUpdated, ...existingComparable } = existing;
+  const { created_at: _projectCreated, updated_at: _projectUpdated, ...projectComparable } = plan.project;
+  return JSON.stringify(existingComparable) !== JSON.stringify(projectComparable);
+}
+function actionNeedsRun(plan, kind, syncMode) {
+  if (kind === "registry.upsert") return registryNeedsUpsert(plan);
+  if (kind === "project.write-manifest") {
+    const action = plan.actions.find((item) => item.kind === "project.write-manifest");
+    if (!action || action.kind !== "project.write-manifest") return false;
+    const next = `${JSON.stringify(action.manifest, null, 2)}
+`;
+    return !existsSync9(action.path) || readFileSync6(action.path, "utf8") !== next;
+  }
+  if (kind === "copier.copy.commonproject") return true;
+  if (kind === "plane.create-or-link") return plan.actions.some((action) => action.kind === kind && action.enabled);
+  if (kind === "hermes.provision-agent") return plan.actions.some((action) => action.kind === kind && action.enabled);
+  return true;
+}
+async function selectProjectInitOperations(input) {
+  const planOperations = input.plan.actions.filter((action) => actionNeedsRun(input.plan, action.kind, input.syncMode)).map((action) => ({
+    value: action.kind,
+    label: projectInitActionLabel(action.kind),
+    hint: action.kind === "registry.upsert" ? input.plan.registryPath : action.kind
+  }));
+  const parityOperations = input.auditRules.filter((rule) => rule.fixable && rule.status !== "pass" && rule.status !== "skip").map((rule) => ({
+    value: `parity:${rule.id}`,
+    label: `${rule.title}`,
+    hint: `${rule.id}: ${rule.summary}`
+  }));
+  const operations = [...planOperations, ...parityOperations];
+  const all = operations.map((operation) => operation.value);
+  if (input.options.yes || input.options.apply && !isInteractiveProjectInit(input.options)) {
+    return {
+      selectedOperations: all,
+      selectedParityRules: parityOperations.map((operation) => operation.value.replace(/^parity:/, ""))
+    };
+  }
+  if (input.options.dryRun || !isInteractiveProjectInit(input.options)) {
+    return { selectedOperations: [], selectedParityRules: [] };
+  }
+  if (!operations.length) return { selectedOperations: [], selectedParityRules: [] };
+  const selected = await multiselect({
+    message: "Select project init operations to run:",
+    options: operations,
+    initialValues: all
+  });
+  if (isCancel5(selected)) {
+    cancel2("project init cancelled");
+    process.exit(1);
+  }
+  return {
+    selectedOperations: selected,
+    selectedParityRules: selected.filter((value) => value.startsWith("parity:")).map((value) => value.replace(/^parity:/, ""))
+  };
+}
+async function resolveProjectInitTarget(name, options) {
+  const interactive = isInteractiveProjectInit(options);
+  const cwd = process.cwd();
+  const cwdGitRoot = findGitRoot(cwd);
+  let targetDir = options.targetDir ? resolve3(options.targetDir) : void 0;
+  if (!targetDir && cwdGitRoot) {
+    targetDir = cwdGitRoot;
+  }
+  if (!targetDir && interactive) {
+    const defaultName = name ?? basename4(cwd);
+    const promptedName = name ?? await promptTextValue("Project name", packageNameToProjectName(defaultName));
+    const defaultDir = join11(cwd, promptedName.replace(/[^A-Za-z0-9._-]/g, "") || promptedName.toLowerCase().replace(/[^a-z0-9]+/g, "-"));
+    targetDir = await promptTextValue("Project directory", defaultDir);
+    name = promptedName;
+  }
+  if (!targetDir) {
+    if (!name) throw new Error("Project name or --target-dir is required when project init is not run inside a git repo");
+    targetDir = resolve3(process.cwd(), name.replace(/[^A-Za-z0-9._-]/g, "") || name.toLowerCase().replace(/[^a-z0-9]+/g, "-"));
+  }
+  const targetExists = existsSync9(targetDir);
+  if (targetExists && !statSync2(targetDir).isDirectory()) throw new Error(`Target path is not a directory: ${targetDir}`);
+  const targetGitRoot = targetExists ? findGitRoot(targetDir) : void 0;
+  const syncMode = Boolean(targetGitRoot && resolve3(targetGitRoot) === resolve3(targetDir));
+  const defaults = targetExists ? deriveProjectDefaults(targetDir) : { name: packageNameToProjectName(basename4(targetDir)) ?? "Project", description: "" };
+  if (!name && interactive && !syncMode) {
+    name = await promptTextValue("Project name", defaults.name);
+  }
+  return {
+    name: name ?? defaults.name,
+    targetDir,
+    description: options.description ?? defaults.description,
+    syncMode,
+    slug: options.slug ?? defaults.slug,
+    identifier: options.identifier ?? defaults.identifier
+  };
+}
 var program = new Command3();
 program.name("pjangler").description("Project subsystem bootstrapper CLI").version(PJANGLER_VERSION);
 program.command("init").argument("<subsystem>", "Subsystem to initialize").description("Initialize a project subsystem").option("--dry-run", "Preview changes without writing files").option("-f, --force", "Overwrite existing files").action(async (subsystem, options) => {
@@ -2436,6 +3406,144 @@ program.command("list").description("List available subsystems").action(() => {
   console.log("  pjangler init docker");
   console.log("  pjangler init node");
 });
+var projectCmd = program.command("project").description("Manage the pjangler project registry");
+projectCmd.command("init").argument("[name]", "Project display name").description("Plan or apply a registry-backed CommonProject initialization or legacy repo sync").option("--description <text>", "Project description").option("--target-dir <path>", "Target repo path").option("--source-skill <path>", "Source skill/template provenance path").option("--primary-language <language>", "Primary language for CommonProject rendering", "python").option("--provision-agent", "Plan local Hermes PM agent provisioning").option("--agent-role <role>", "Hermes agent role to plan when --provision-agent is set", "pm").option("--apply", "Write the registry and render the repo scaffold").option("--dry-run", "Preview changes without writing files (default)").option("--live", "Allow live/network/cloud provisioning actions").option("--slug <slug>", "Project registry slug override").option("--identifier <identifier>", "Ticket identifier override").option("--registry <path>", `Registry path override (default: ${projectRegistryPath()})`).option("-f, --force", "Allow replacing an existing registry entry and re-rendering files").option("-y, --yes", "Apply every proposed operation without prompting").option("--no-tui", "Disable interactive prompts").option("--json", "Output machine-parseable JSON").action(async (name, options) => {
+  try {
+    const target = await resolveProjectInitTarget(name, options);
+    const interactive = isInteractiveProjectInit(options);
+    const apply = Boolean(!options.dryRun && (options.yes || options.apply || interactive));
+    const plan = planProjectInit({
+      name: target.name,
+      description: target.description,
+      targetDir: target.targetDir,
+      sourceSkill: options.sourceSkill,
+      primaryLanguage: options.primaryLanguage,
+      provisionAgent: options.provisionAgent ?? false,
+      agentRole: options.agentRole,
+      apply,
+      live: options.live ?? false,
+      projectSlug: target.slug,
+      projectIdentifier: target.identifier,
+      registryPath: options.registry,
+      force: options.force ?? false,
+      overwrite: options.force ?? false,
+      cwd: process.cwd(),
+      scaffold: !target.syncMode
+    });
+    const audit = target.syncMode ? runAudit(target.targetDir) : void 0;
+    const selection = await selectProjectInitOperations({
+      plan,
+      auditRules: audit?.rules ?? [],
+      syncMode: target.syncMode,
+      options
+    });
+    const selectedPlanActionKinds = new Set(selection.selectedOperations.filter((value) => !value.startsWith("parity:")));
+    const selectedPlan = {
+      ...plan,
+      apply,
+      dryRun: !apply,
+      actions: apply ? plan.actions.filter((action) => selectedPlanActionKinds.has(action.kind)) : plan.actions
+    };
+    if (!apply) {
+      const payload = {
+        ...plan,
+        mode: target.syncMode ? "sync" : "create",
+        audit,
+        proposedOperations: [
+          ...plan.actions.filter((action) => actionNeedsRun(plan, action.kind, target.syncMode)).map((action) => action.kind),
+          ...(audit?.rules ?? []).filter((rule) => rule.fixable && rule.status !== "pass" && rule.status !== "skip").map((rule) => `parity:${rule.id}`)
+        ]
+      };
+      if (options.json) console.log(JSON.stringify(payload, null, 2));
+      else {
+        console.log(formatProjectInitPlan(plan));
+        if (payload.proposedOperations.length) {
+          console.log("Proposed sync operations:");
+          for (const operation of payload.proposedOperations) console.log(`  - ${operation}`);
+        } else {
+          console.log("Project is already in parity.");
+        }
+      }
+      return;
+    }
+    const initResult = selectedPlan.actions.length ? executeProjectInitPlan(selectedPlan) : { ok: true, plan: selectedPlan, logs: [], errors: [], changedFiles: [] };
+    const migrationReport = selection.selectedParityRules.length ? runMigrationForRules(selection.selectedParityRules, target.targetDir, false) : void 0;
+    const migrationErrors = migrationReport?.results.filter((result2) => result2.status === "blocked").map((result2) => `${result2.id}: ${result2.summary}`) ?? [];
+    const changedFiles = Array.from(/* @__PURE__ */ new Set([
+      ...initResult.changedFiles,
+      ...migrationReport?.changedFiles ?? []
+    ])).sort();
+    const result = {
+      ok: initResult.ok && (migrationReport?.ok ?? true),
+      mode: target.syncMode ? "sync" : "create",
+      plan: selectedPlan,
+      audit,
+      selectedOperations: selection.selectedOperations,
+      selectedParityRules: selection.selectedParityRules,
+      logs: initResult.logs,
+      errors: [...initResult.errors, ...migrationErrors],
+      changedFiles,
+      migrationReport
+    };
+    if (options.json) {
+      console.log(JSON.stringify(result, null, 2));
+    } else {
+      console.log(formatProjectInitPlan(selectedPlan));
+      for (const line of result.logs) console.log(line);
+      for (const line of result.errors) console.error(line);
+      if (migrationReport) console.log(formatMigrationReport(migrationReport));
+      if (result.ok && changedFiles.length) console.log(`Project synchronized: ${plan.project.slug}`);
+      if (result.ok && changedFiles.length === 0) console.log(`Project already in parity: ${plan.project.slug}`);
+    }
+    process.exitCode = result.ok ? 0 : 1;
+  } catch (err) {
+    if (options.json) {
+      console.log(JSON.stringify({ ok: false, error: err instanceof Error ? err.message : String(err) }, null, 2));
+    } else {
+      console.error("\u274C project init failed:", err instanceof Error ? err.message : err);
+    }
+    process.exit(1);
+  }
+});
+projectCmd.command("list").description("List projects in the pjangler registry").option("--registry <path>", `Registry path override (default: ${projectRegistryPath()})`).option("--json", "Output machine-parseable JSON").action((options) => {
+  try {
+    const registry = loadProjectRegistry(options.registry ?? projectRegistryPath());
+    if (options.json) console.log(JSON.stringify(registry, null, 2));
+    else console.log(formatProjectList(registry));
+  } catch (err) {
+    console.error("\u274C project list failed:", err instanceof Error ? err.message : err);
+    process.exit(1);
+  }
+});
+projectCmd.command("show").argument("<slug>", "Project slug").description("Show one project from the pjangler registry").option("--registry <path>", `Registry path override (default: ${projectRegistryPath()})`).option("--json", "Output machine-parseable JSON").action((slug, options) => {
+  try {
+    const project = getProject(loadProjectRegistry(options.registry ?? projectRegistryPath()), slug);
+    if (options.json) console.log(JSON.stringify(project, null, 2));
+    else console.log(`${project.name} (${project.slug})
+${project.repo_path}
+${project.description}`);
+  } catch (err) {
+    console.error("\u274C project show failed:", err instanceof Error ? err.message : err);
+    process.exit(1);
+  }
+});
+projectCmd.command("doctor").argument("[slug]", "Optional project slug").description("Validate the project registry and local projections").option("--registry <path>", `Registry path override (default: ${projectRegistryPath()})`).option("--json", "Output machine-parseable JSON").action((slug, options) => {
+  try {
+    const report = doctorProjectRegistry(options.registry ?? projectRegistryPath(), slug);
+    if (options.json) {
+      console.log(JSON.stringify(report, null, 2));
+    } else if (!report.issues.length) {
+      console.log(`Project registry OK: ${report.registryPath}`);
+    } else {
+      console.log(`Project registry issues: ${report.registryPath}`);
+      for (const issue of report.issues) console.log(`  [${issue.level}] ${issue.slug ?? "registry"}: ${issue.message}`);
+    }
+    process.exit(report.ok ? 0 : 1);
+  } catch (err) {
+    console.error("\u274C project doctor failed:", err instanceof Error ? err.message : err);
+    process.exit(1);
+  }
+});
 var recipeCmd = program.command("recipe").description("Manage pjangler recipes");
 recipeCmd.command("list").description("List all available recipes").action(() => {
   console.log("\u{1F4E6} Available Recipes:");
@@ -2568,24 +3676,50 @@ program.command("audit").argument("[repo]", "Path to repo to audit (default: cwd
     process.exit(1);
   }
 });
-program.command("migrate").argument("[rule-id]", "Rule ID to migrate (omit with --all to apply all)").argument("[repo]", "Path to repo (default: cwd)").description("Idempotent migration recipe for a parity rule (or --all)").option("--all", "Apply every migration recipe in order").option("--dry-run", "Preview changes without writing files").option("--json", "Output machine-parseable JSON").action((ruleId, repo, options) => {
+program.command("migrate").argument("[rule-id]", "Rule ID to migrate (omit to open interactive rule selector)").argument("[repo]", "Path to repo (default: cwd)").description("Idempotent migration recipe for a parity rule (or open the rule selector)").option("--all", "Apply every migration recipe in order").option("--dry-run", "Preview changes without writing files").option("--json", "Output machine-parseable JSON").action(async (ruleId, repo, options) => {
   try {
     const all = options.all ?? false;
-    if (!all && !ruleId) {
-      console.error("\u274C Provide a rule-id or use --all");
-      process.exit(1);
+    const dryRun = options.dryRun ?? false;
+    if (all) {
+      let actualRepo = repo;
+      if (ruleId && !actualRepo) {
+        actualRepo = ruleId;
+      }
+      const report2 = runMigration(void 0, actualRepo, dryRun, true);
+      printMigrationReport(report2, options.json);
+      process.exit(report2.ok ? 0 : 1);
+    }
+    if (ruleId && repo) {
+      if (!getParityRuleIds().includes(ruleId)) {
+        console.error(`\u274C Unknown parity rule: ${ruleId}`);
+        process.exit(1);
+      }
+      const report2 = runMigration(ruleId, repo, dryRun, false);
+      printMigrationReport(report2, options.json);
+      process.exit(report2.ok ? 0 : 1);
     }
-    let actualRuleId = all ? void 0 : ruleId;
-    let actualRepo = repo;
-    if (all && ruleId && !actualRepo) {
-      actualRepo = ruleId;
+    if (ruleId && getParityRuleIds().includes(ruleId)) {
+      const report2 = runMigration(ruleId, void 0, dryRun, false);
+      printMigrationReport(report2, options.json);
+      process.exit(report2.ok ? 0 : 1);
     }
-    const report = runMigration(actualRuleId, actualRepo, options.dryRun ?? false, all);
     if (options.json) {
-      console.log(JSON.stringify(report, null, 2));
-    } else {
-      console.log(formatMigrationReport(report));
+      console.error("\u274C JSON output requires a rule-id or --all");
+      process.exit(1);
+    }
+    if (!process.stdin.isTTY) {
+      console.error("\u274C Provide a rule-id, use --all, or run in an interactive terminal");
+      process.exit(1);
+    }
+    const targetRepo = ruleId ?? repo;
+    const audit = runAudit(targetRepo);
+    const ruleIds = await promptForRuleIds(audit.rules);
+    if (!ruleIds.length) {
+      console.log("No rules selected; nothing to migrate.");
+      process.exit(0);
     }
+    const report = runMigrationForRules(ruleIds, targetRepo, dryRun);
+    printMigrationReport(report, false);
     process.exit(report.ok ? 0 : 1);
   } catch (err) {
     console.error("\u274C migrate failed:", err);