@delorenj/pjangler 1.2.18 → 1.2.19

package/templates/hermes-agent/template/.scripts/40-plane.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Create a Plane project in the configured workspace (one project per agent).
+# Workspace + base URL come from role.yaml / config.toml (see _lib.sh).
+# shellcheck source=_lib.sh
+source "$(dirname "$0")/_lib.sh"
+load_role_env
+
+already_done 40-plane && { log "[40] plane already set up — skipping"; exit 0; }
+[[ "${SKIP_PLANE:-0}" == "1" ]] && { log "[40] plane — SKIPPED"; mark_done 40-plane; exit 0; }
+
+[[ -n "$PLANE_API_KEY" ]] || { warn "[40] PLANE_API_KEY not set; skipping. set PLANE_33GOD_API_KEY and re-run ./.scripts/40-plane.sh"; exit 0; }
+
+# Build the 5-char identifier: <repo[0..2]><role[0..1]> uppercased
+RAW=$(printf '%s%s' "${REPO:0:3}" "${ROLE:0:2}" | tr -cd '[:alnum:]' | tr '[:lower:]' '[:upper:]')
+while (( ${#RAW} < 3 )); do RAW="${RAW}X"; done
+IDENT="${RAW:0:5}"
+
+# Project name = display_name (already smart-cased: "Bloodbank PM", "Hermes-Agent Dev").
+# Plane forbids hyphens in names — substitute spaces.
+NAME="${DISPLAY_NAME//-/ }"
+
+log "[40] creating plane project '$NAME' [$IDENT]"
+
+# Check for existing project with this identifier
+EXISTING=$(curl -sS "$PLANE_BASE/api/v1/workspaces/$PLANE_WORKSPACE/projects/?per_page=200" \
+  -H "X-API-Key: $PLANE_API_KEY" \
+  | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+ident = '$IDENT'
+for p in d.get('results', []):
+    if (p.get('identifier') or '').upper() == ident:
+        print(p['id']); break")
+
+if [[ -n "$EXISTING" ]]; then
+  log "    plane project $IDENT already exists (id=$EXISTING) — reusing"
+  PROJECT_ID="$EXISTING"
+else
+  RESP=$(curl -sS -X POST "$PLANE_BASE/api/v1/workspaces/$PLANE_WORKSPACE/projects/" \
+    -H "X-API-Key: $PLANE_API_KEY" \
+    -H "Content-Type: application/json" \
+    -d "$(python3 -c "import json,sys; print(json.dumps({'name': sys.argv[1], 'identifier': sys.argv[2], 'description': sys.argv[3]}))" \
+        "$NAME" "$IDENT" "Hermes agent board for $AGENT_ID")")
+  PROJECT_ID=$(echo "$RESP" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('id') or '')")
+  [[ -n "$PROJECT_ID" ]] || die "plane create failed: $RESP"
+  log "    plane project created id=$PROJECT_ID"
+fi
+
+yaml_set plane.identifier "$IDENT"
+echo "$PROJECT_ID" > "$ROLE_DIR/.scripts/.plane-project-id"
+mark_done 40-plane

package/templates/hermes-agent/template/.scripts/42-ticket-provider.sh

@@ -10,12 +10,11 @@
 #   2. Otherwise (hermes run on a repo with no CommonProject board yet)
 #      -> create ONE repo-named board and write it back into .project.json so
 #         it becomes the SOT for every agent in this repo.
-# Either way we register this agent under .project.json `agents`. role.yaml is
-# identity/personality only; it must not carry board UUIDs or derived URLs.
+# Either way we register this agent under .project.json `agents` and mirror the
+# binding into role.yaml for back-compat (80-registry.sh / 99-summary.sh).
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 load_role_env
-resolve_plane_api_key "$PLANE_WORKSPACE"
 # shellcheck source=lib/ticket-provider.sh
 source "$(dirname "$0")/lib/ticket-provider.sh"
 
@@ -47,13 +46,13 @@ PY
 }
 
 # pj_write — merge board binding (optional) + this agent into .project.json.
-# args: set_provider(0|1) provider board_id workspace identifier
+# args: set_provider(0|1) provider board_id board_url workspace identifier team
 pj_write() {
   REPO="$REPO" REPO_ROOT="$REPO_ROOT" AGENT_ID="$AGENT_ID" ROLE="$ROLE" \
   ROLE_DIR_REL="$ROLE_DIR_REL" PROJECT_DESC="${PROJECT_DESC:-}" \
   python3 - "$PROJECT_JSON" "$@" <<'PY'
 import sys, os, json, pathlib
-(path, set_provider, provider, board_id, workspace, identifier) = sys.argv[1:7]
+(path, set_provider, provider, board_id, board_url, workspace, identifier, team) = sys.argv[1:9]
 p = pathlib.Path(path)
 try:
     d = json.loads(p.read_text())
@@ -72,30 +71,47 @@ if set_provider == "1":
     if workspace:  tp["workspace"] = workspace
     if identifier: tp["identifier"] = identifier
     if board_id:   tp["board_id"] = board_id
-    tp.pop("board_url", None)
-    tp["state"] = "linked" if board_id else tp.get("state", "planned")
+    if board_url:  tp["board_url"] = board_url
+    if team:       tp["team"] = team
 ag = d.setdefault("agents", {})
 ag[os.environ["AGENT_ID"]] = {"role": os.environ["ROLE"], "role_dir": os.environ["ROLE_DIR_REL"]}
-automation = d.setdefault("automation", {})
-automation.setdefault("reconcile", {"enabled": False, "grace_hours": 0, "auto_review": True})
 p.write_text(json.dumps(d, indent=2) + "\n")
 PY
   log "    .project.json updated (agent=$AGENT_ID)"
 }
 
-# Keep only the legacy adapter name in role.yaml. Stable board identity belongs
-# in .project.json.
-mirror_provider_name_to_role_yaml() {
-  local provider="$1"
+# Mirror the binding into role.yaml so legacy consumers keep working.
+mirror_to_role_yaml() {
+  # mirror_to_role_yaml <provider> <board_id> <board_url> <workspace> <identifier> <team>
+  local provider="$1" bid="$2" burl="$3" ws="$4" ident="$5" team="$6"
   yaml_set ticket_provider.name "$provider" 2>/dev/null || true
+  [ -n "$bid" ]  && yaml_set ticket_provider.board_id "$bid" 2>/dev/null || true
+  [ -n "$burl" ] && yaml_set ticket_provider.board_url "$burl" 2>/dev/null || true
+  case "$provider" in
+    plane)
+      [ -n "$bid" ] && echo "$bid" > "$ROLE_DIR/.scripts/.plane-project-id"
+      [ -n "$ws" ]    && yaml_set ticket_provider.workspace "$ws" 2>/dev/null || true
+      [ -n "$bid" ]   && yaml_set ticket_provider.project "$bid" 2>/dev/null || true
+      [ -n "$ws" ]    && yaml_set plane.workspace "$ws" 2>/dev/null || true
+      [ -n "$ident" ] && yaml_set plane.identifier "$ident" 2>/dev/null || true
+      ;;
+    trello)
+      [ -n "$bid" ] && yaml_set ticket_provider.board "$bid" 2>/dev/null || true
+      ;;
+    linear)
+      [ -n "$team" ] && yaml_set ticket_provider.team "$team" 2>/dev/null || true
+      ;;
+  esac
 }
 
 # ── Provider resolution ──────────────────────────────────────────────────
 # An existing repo board (in .project.json) wins — every agent binds to it.
 SOT_TYPE="$(pj ticket_provider.type)"
 SOT_BOARD_ID="$(pj ticket_provider.board_id)"
+SOT_URL="$(pj ticket_provider.board_url)"
 SOT_WS="$(pj ticket_provider.workspace)"
 SOT_IDENT="$(pj ticket_provider.identifier)"
+SOT_TEAM="$(pj ticket_provider.team)"
 
 # role.yaml provider comes from copier --data (the operator's pjangler choice).
 ROLE_PROVIDER="$(yaml_get ticket_provider.name)"
@@ -106,10 +122,9 @@ if [ -n "$SOT_BOARD_ID" ]; then
   if [ -n "$ROLE_PROVIDER" ] && [ "$ROLE_PROVIDER" != "$PROVIDER" ]; then
     warn "[42] requested provider '$ROLE_PROVIDER' but repo board is '$PROVIDER' (.project.json wins); binding to existing board"
   fi
-  case "$PROVIDER" in plane|trello) ;; *) die "unsupported ticket provider in .project.json: $PROVIDER (expected plane|trello)" ;; esac
   log "[42] binding $AGENT_ID to existing repo board (provider=$PROVIDER, id=$SOT_BOARD_ID)"
-  mirror_provider_name_to_role_yaml "$PROVIDER"
-  pj_write 1 "$PROVIDER" "$SOT_BOARD_ID" "$SOT_WS" "$SOT_IDENT"
+  mirror_to_role_yaml "$PROVIDER" "$SOT_BOARD_ID" "$SOT_URL" "$SOT_WS" "$SOT_IDENT" "$SOT_TEAM"
+  pj_write 0 "$PROVIDER" "" "" "" "" ""   # register agent only; board already recorded
   mark_done 42-ticket-provider
   exit 0
 fi
@@ -128,22 +143,45 @@ NAME="$(printf '%s' "$REPO" | tr '_-' '  ' | python3 -c 'import sys; print(" ".j
 DESC="Ticket board for $REPO"
 
 case "$PROVIDER" in
+  linear)
+    if [[ -z "${LINEAR_API_KEY:-}" ]]; then
+      warn "[42] LINEAR_API_KEY not set; set role.yaml/.project.json ticket_provider.team and re-run ./.scripts/42-ticket-provider.sh"
+      pj_write 1 linear "" "" "" "$IDENT" "$SOT_TEAM"
+      mark_done 42-ticket-provider; exit 0
+    fi
+    OUT="$(tp resolve 2>/dev/null || true)"
+    BID="$(printf '%s' "$OUT" | python3 -c 'import sys,json
+try: print(json.load(sys.stdin).get("board_id",""))
+except Exception: print("")')"
+    BURL="$(printf '%s' "$OUT" | python3 -c 'import sys,json
+try: print(json.load(sys.stdin).get("board_url",""))
+except Exception: print("")')"
+    if [ -n "$BID" ]; then
+      mirror_to_role_yaml linear "$BID" "$BURL" "" "$IDENT" "$SOT_TEAM"
+      pj_write 1 linear "$BID" "$BURL" "" "$IDENT" "$SOT_TEAM"
+    else
+      warn "[42] linear resolve returned no board; set ticket_provider.team and re-run"
+      pj_write 1 linear "" "" "" "$IDENT" "$SOT_TEAM"
+    fi
+    ;;
+
   plane|trello)
     KEYVAR=PLANE_API_KEY; [ "$PROVIDER" = trello ] && KEYVAR=TRELLO_KEY
     if [[ -z "${!KEYVAR:-}" ]]; then
       warn "[42] $KEYVAR not set; skipping board creation. Set creds and re-run ./.scripts/42-ticket-provider.sh"
-      pj_write 1 "$PROVIDER" "" "${SOT_WS:-${PLANE_WORKSPACE:-}}" "$IDENT"
+      pj_write 1 "$PROVIDER" "" "" "${SOT_WS:-$PLANE_WORKSPACE}" "$IDENT" ""
       mark_done 42-ticket-provider; exit 0
     fi
     OUT="$(tp create_board "$NAME" "$IDENT" "$DESC")" || die "create_board failed for $PROVIDER"
     BID="$(printf '%s' "$OUT" | python3 -c 'import sys,json; print(json.load(sys.stdin).get("board_id",""))')"
-    WS="${SOT_WS:-${PLANE_WORKSPACE:-}}"
+    BURL="$(printf '%s' "$OUT" | python3 -c 'import sys,json; print(json.load(sys.stdin).get("board_url",""))')"
+    WS="${SOT_WS:-$PLANE_WORKSPACE}"
     [ "$PROVIDER" = trello ] && WS=""
-    mirror_provider_name_to_role_yaml "$PROVIDER"
-    pj_write 1 "$PROVIDER" "$BID" "$WS" "$IDENT"
+    mirror_to_role_yaml "$PROVIDER" "$BID" "$BURL" "$WS" "$IDENT" ""
+    pj_write 1 "$PROVIDER" "$BID" "$BURL" "$WS" "$IDENT" ""
     ;;
 
-  *) die "unknown ticket provider: $PROVIDER (expected plane|trello)" ;;
+  *) die "unknown ticket provider: $PROVIDER (expected linear|plane|trello)" ;;
 esac
 
 mark_done 42-ticket-provider

package/templates/hermes-agent/template/.scripts/60-bloodbank.sh

@@ -20,7 +20,8 @@ log "[60] installing bloodbank consumer for $AGENT_ID"
 # placeholders. If $RUNTIME/bloodbank-consumer.py was ever lost (runtime
 # submodule wiped, manual rm, etc.) and then someone restored it by
 # copying from $RUNTIME_SCAFFOLD_DIR, they'd end up with an un-rendered
-# consumer subscribing to literal `bloodbank.evt.v1.repo.{{repo}}.>`.
+# consumer whose envelope routing filter compares against literal `{{repo}}`
+# and `{{agent_id}}` values.
 # This block handles both failure modes idempotently.
 CONSUMER="$RUNTIME/bloodbank-consumer.py"
 SCAFFOLD_CONSUMER="$RUNTIME_SCAFFOLD_DIR/bloodbank-consumer.py"

package/templates/hermes-agent/template/.scripts/70-systemd.sh

@@ -5,10 +5,7 @@
 source "$(dirname "$0")/_lib.sh"
 load_role_env
 
-if already_done 70-systemd && [[ "${FORCE_SYSTEMD:-0}" != "1" ]]; then
-  log "[70] systemd already installed — skipping"
-  exit 0
-fi
+already_done 70-systemd && { log "[70] systemd already installed — skipping"; exit 0; }
 [[ "${SKIP_SYSTEMD:-0}" == "1" ]] && { log "[70] systemd — SKIPPED"; mark_done 70-systemd; exit 0; }
 
 RUNTIME="$ROLE_DIR/runtime"
@@ -35,9 +32,6 @@ Type=simple
 Environment=HERMES_HOME=$RUNTIME
 Environment=HERMES_OAUTH_FILE=$HERMES_OAUTH_FILE
 Environment=CODEX_HOME=$CODEX_HOME
-Environment=HERMES_KANBAN_DISPATCH_IN_GATEWAY=0
-Environment=HERMES_KANBAN_SLASH_ENABLED=0
-EnvironmentFile=-$FLEET_ENV
 EnvironmentFile=-$RUNTIME/.env
 ExecStart=$HERMES_BIN gateway run --replace
 Restart=on-failure
@@ -63,7 +57,6 @@ WorkingDirectory=$RUNTIME
 Environment=HERMES_HOME=$RUNTIME
 Environment=HERMES_OAUTH_FILE=$HERMES_OAUTH_FILE
 Environment=CODEX_HOME=$CODEX_HOME
-EnvironmentFile=-$FLEET_ENV
 EnvironmentFile=-$RUNTIME/.env
 ExecStart=$HERMES_AGENT_REPO/.venv/bin/python $RUNTIME/bloodbank-consumer.py
 Restart=on-failure
@@ -93,7 +86,6 @@ WorkingDirectory=$REPO_ROOT
 Environment=HERMES_HOME=$RUNTIME
 Environment=HERMES_OAUTH_FILE=$HERMES_OAUTH_FILE
 Environment=CODEX_HOME=$CODEX_HOME
-EnvironmentFile=-$FLEET_ENV
 EnvironmentFile=-%h/.config/hermes-agent/env
 EnvironmentFile=-%h/.hermes/env
 EnvironmentFile=-%h/.hermes/hermes-agent.env
@@ -120,7 +112,6 @@ UNIT
 
 if systemd_user_available; then
   systemctl --user daemon-reload
-  systemctl --user disable --now "hermes-${AGENT_ID}-checkpoint.timer" "hermes-${AGENT_ID}-checkpoint.service" >/dev/null 2>&1 || true
   # `enable --now` both enables (persist across login) AND starts the unit now, so a
   # freshly provisioned agent comes up live instead of dormant. Units with missing
   # creds (e.g. a gateway with no Telegram token yet) fail softly via Restart=on-failure.

package/templates/hermes-agent/template/.scripts/_lib.sh

@@ -62,41 +62,6 @@ p.write_text(new)
 PYEOF
 }
 
-# Locate the repo-root .project.json for this role, if present.
-project_json_path() {
-  local root
-  root="$(project_repo_path 2>/dev/null || true)"
-  [[ -n "$root" && -f "$root/.project.json" ]] && { printf '%s' "$root/.project.json"; return 0; }
-  return 1
-}
-
-# project_json_get <dotted.key> — read a string/scalar from repo-root
-# .project.json. This is the deterministic SOT for project wiring.
-project_json_get() {
-  local key="$1" path
-  path="$(project_json_path 2>/dev/null || true)"
-  [[ -f "$path" ]] || { printf ''; return 0; }
-  python3 - "$path" "$key" <<'PYEOF'
-import json
-import pathlib
-import sys
-
-path, key = sys.argv[1:3]
-try:
-    cur = json.loads(pathlib.Path(path).read_text())
-except Exception:
-    print("", end="")
-    raise SystemExit(0)
-for part in key.split("."):
-    if isinstance(cur, dict) and part in cur:
-        cur = cur[part]
-    else:
-        print("", end="")
-        raise SystemExit(0)
-print(cur if isinstance(cur, (str, int, float, bool)) else "", end="")
-PYEOF
-}
-
 # ─── Distributable config (~/.config/hermes-agent-template/config.toml) ──────
 # Single source of truth for environment-specific defaults so this template can
 # be handed to someone else without editing any script. Ship config.example.toml
@@ -147,10 +112,8 @@ load_role_env() {
   BOT_HANDLE=$(yaml_get telegram.bot_username)
   PROFILE_NAME=$(yaml_get profile)
 
-  # Plane workspace: repo-root .project.json wins; role.yaml is legacy fallback.
-  PLANE_WORKSPACE=$(project_json_get ticket_provider.workspace)
-  [[ -n "$PLANE_WORKSPACE" ]] || PLANE_WORKSPACE=$(yaml_get ticket_provider.workspace)
-  [[ -n "$PLANE_WORKSPACE" ]] || PLANE_WORKSPACE=$(yaml_get plane.workspace)
+  # Plane workspace: empty in role.yaml -> resolve from config.toml.
+  PLANE_WORKSPACE=$(yaml_get plane.workspace)
   [[ -n "$PLANE_WORKSPACE" ]] || PLANE_WORKSPACE=$(config_get plane.workspace "33god")
 
   # Runtime repo: role.yaml stores the bare repo name plus an optional owner.
@@ -166,27 +129,6 @@ load_role_env() {
          PLANE_WORKSPACE RUNTIME_REPO PROFILE_NAME
 }
 
-plane_workspace_key() {
-  local workspace="${1:-${PLANE_WORKSPACE:-}}"
-  workspace="$(printf '%s' "$workspace" | tr '[:lower:]' '[:upper:]' | sed 's/[^A-Z0-9]/_/g')"
-  [[ -n "$workspace" ]] || workspace="DEFAULT"
-  printf 'PLANE_%s_API_KEY' "$workspace"
-}
-
-resolve_plane_api_key() {
-  if [[ -n "${PLANE_API_KEY:-}" ]]; then
-    export PLANE_API_KEY
-    return 0
-  fi
-  local key value
-  key="$(plane_workspace_key "${1:-${PLANE_WORKSPACE:-}}")"
-  value="${!key:-}"
-  if [[ -n "$value" ]]; then
-    PLANE_API_KEY="$value"
-    export PLANE_API_KEY
-  fi
-}
-
 # Skip a step if previously completed (idempotent reruns).
 already_done() {
   local marker="$ROLE_DIR/.scripts/.done-$1"
@@ -223,7 +165,7 @@ BLOODBANK_COMPOSE_DIR="${BLOODBANK_COMPOSE_DIR:-$(config_get bloodbank.compose_d
 
 # Plane
 PLANE_BASE="${PLANE_BASE:-$(config_get plane.base 'https://plane.delo.sh')}"
-PLANE_API_KEY="${PLANE_API_KEY:-}"
+PLANE_API_KEY="${PLANE_API_KEY:-${PLANE_33GOD_API_KEY:-}}"
 
 export FLEET_ENV HERMES_BIN HERMES_AGENT_REPO HERMES_OAUTH_FILE CODEX_HOME \
        RUNTIME_SCAFFOLD_DIR REGISTRY_FILE \

package/templates/hermes-agent/template/.scripts/config.example.toml

@@ -27,11 +27,6 @@ oauth_file = "~/.hermes/auth.json"
 codex_home = "~/.codex"
 # Canonical external skills dir mirrored into each agent profile.
 canonical_skills_dir = "/home/delorenj/.agents/skills"
-# PM-only external skill libraries surfaced alongside Hermes built-ins.
-pm_external_skill_dirs = [
-  "~/code/skillex/skill-sets/global/.system",
-  "~/code/skillex/packs/bmad/6.10.2",
-]
 # Voxxy plugin + service defaults for Hermes PM agents.
 voxxy_plugin_dir = "~/code/voxxy/plugins/tts/voxxy"
 vox_url = "https://vox.delo.sh"

package/templates/hermes-agent/template/.scripts/heartbeat.sh

@@ -6,7 +6,7 @@
 # reconciliation pass when local state says no worker is active, the worker
 # heartbeat is stale, or the last full run is outside the cooldown window. The
 # full pass executes the role's sentinel.prompt.md, which reasons about tickets
-# through the ticket-provider adapter (Plane | Trello) — never a
+# through the ticket-provider adapter (Linear | Plane | Trello) — never a
 # hardcoded backend. After the sentinel decision (skip OR full), it
 # opportunistically checkpoints the runtime submodule (commit+push) at most once
 # per HEARTBEAT_CHECKPOINT_MIN_INTERVAL_SECONDS, so memory/session state stays
@@ -19,18 +19,12 @@ PROMPT_FILE="$ROLE_DIR/.scripts/sentinel.prompt.md"
 STATE_FILE="$RUNTIME/continuous-ticket-sentinel-state.json"
 LOCK_FILE="$RUNTIME/continuous-ticket-sentinel.lock"
 ROLE_YAML="$ROLE_DIR/role.yaml"
-FLEET_ENV="${HERMES_FLEET_ENV:-$HOME/.hermes/fleet.env}"
 LOG_FILE="$RUNTIME/logs/heartbeat.log"
 CHECKPOINT_BIN="$ROLE_DIR/.scripts/checkpoint.sh"
 CHECKPOINT_STAMP="$RUNTIME/.last-checkpoint"
 
-if [[ -f "$FLEET_ENV" ]]; then
-  # shellcheck disable=SC1090
-  source "$FLEET_ENV"
-fi
-
 # Hermes binary: explicit env > ~/.config/hermes-agent/hermes-bin > PATH.
-HERMES_BIN="${HERMES_BIN:-${HERMES_FLEET_BIN:-}}"
+HERMES_BIN="${HERMES_BIN:-}"
 if [[ -z "$HERMES_BIN" ]]; then
   if [[ -r "$HOME/.config/hermes-agent/hermes-bin" ]]; then
     HERMES_BIN="$(cat "$HOME/.config/hermes-agent/hermes-bin")"
@@ -86,61 +80,13 @@ print(value.strip().strip('"').strip("'"))
 PYEOF
 }
 
-repo_root() {
-  local dir="$ROLE_DIR"
-  for _ in 1 2 3 4 5; do
-    dir="$(dirname "$dir")"
-    if [[ -d "$dir/.git" || -f "$dir/.git" ]]; then printf '%s\n' "$dir"; return 0; fi
-  done
-  return 1
-}
-REPO_ROOT="$(repo_root)"
-PROJECT_JSON="$REPO_ROOT/.project.json"
-
-project_json_value() {
-  python3 - "$PROJECT_JSON" "$1" <<'PYEOF'
-import json
-import pathlib
-import sys
-
-path, key = sys.argv[1:3]
-try:
-    cur = json.loads(pathlib.Path(path).read_text())
-except Exception:
-    print("")
-    raise SystemExit(0)
-for part in key.split("."):
-    if isinstance(cur, dict) and part in cur:
-        cur = cur[part]
-    else:
-        print("")
-        raise SystemExit(0)
-print(cur if isinstance(cur, (str, int, float, bool)) else "")
-PYEOF
-}
-
-# Project-owned automation gate. Legacy role.yaml reconcile.enabled is honored
-# only for older agents that have not migrated their .project.json yet.
+# True only when role.yaml has a reconcile: block with enabled: true. Block-aware
+# so an unrelated `enabled:` leaf elsewhere in the file can't flip it on.
 reconcile_enabled() {
-  python3 - "$PROJECT_JSON" "$ROLE_YAML" <<'PYEOF'
-import json
-import re
-import sys
+  python3 - "$ROLE_YAML" <<'PYEOF'
+import re, sys
 from pathlib import Path
-project_path, role_path = map(Path, sys.argv[1:3])
-try:
-    project = json.loads(project_path.read_text())
-except Exception:
-    project = {}
-reconcile = ((project.get("automation") or {}).get("reconcile") or {}) if isinstance(project, dict) else {}
-if "enabled" in reconcile:
-    value = reconcile.get("enabled")
-    print("true" if str(value).lower() == "true" else "false")
-    raise SystemExit(0)
-try:
-    text = role_path.read_text()
-except Exception:
-    text = ""
+text = Path(sys.argv[1]).read_text()
 m = re.search(r'(?m)^reconcile:[ \t]*\n((?:[ \t]+\S.*\n?)*)', text)
 block = m.group(1) if m else ""
 me = re.search(r'(?m)^[ \t]+enabled:[ \t]*"?([A-Za-z]+)"?', block)
@@ -150,8 +96,17 @@ PYEOF
 
 AGENT_ID="$(yaml_value agent_id)"
 REPO_NAME="$(yaml_value repo)"
-PROVIDER="$(project_json_value ticket_provider.type)"
-[[ -n "$PROVIDER" ]] || PROVIDER="$(yaml_block_value ticket_provider name)"
+PROVIDER="$(yaml_block_value ticket_provider name)"
+
+repo_root() {
+  local dir="$ROLE_DIR"
+  for _ in 1 2 3 4 5; do
+    dir="$(dirname "$dir")"
+    if [[ -d "$dir/.git" || -f "$dir/.git" ]]; then printf '%s\n' "$dir"; return 0; fi
+  done
+  return 1
+}
+REPO_ROOT="$(repo_root)"
 cd "$REPO_ROOT"
 mkdir -p "$RUNTIME/logs"
 
@@ -177,10 +132,11 @@ else
 fi
 
 # Reconcile gate: the autonomous board-reconciliation pass runs only when
-# repo-root .project.json automation.reconcile.enabled is true. Default off →
-# the heartbeat just checkpoints (legacy checkpoint-timer behavior).
+# role.yaml's reconcile.enabled is true. Default off → the heartbeat just
+# checkpoints (behaves like the legacy hourly checkpoint timer). Flip
+# reconcile.enabled to opt a repo into autonomous board reconciliation.
 if [[ "$(reconcile_enabled)" != "true" ]]; then
-  printf '[heartbeat] reconcile disabled (automation.reconcile.enabled != true) — checkpoint-only tick\n'
+  printf '[heartbeat] reconcile disabled (reconcile.enabled != true) — checkpoint-only tick\n'
   maybe_checkpoint
   exit 0
 fi

package/templates/hermes-agent/template/.scripts/lib/ticket-provider.sh

@@ -1,10 +1,10 @@
 # shellcheck shell=bash
 # Ticket-provider adapter dispatcher — the single seam between the heartbeat
-# sentinel engine and a concrete ticket system (Plane | Trello).
+# sentinel engine and a concrete ticket system (Linear | Plane | Trello).
 #
 # The engine NEVER calls a provider directly. It calls `tp <op> [args...]`,
-# which dispatches to providers/<provider>.sh. Repo-root .project.json owns the
-# provider/board binding; role.yaml is only a legacy provider-name fallback.
+# which dispatches to providers/<provider>.sh. Swapping providers is a one-line
+# config change in role.yaml (ticket_provider.name) — no engine edits.
 #
 # Contract (operations every provider must implement):
 #   resolve                       -> JSON {provider, board_id, board_url}
@@ -19,7 +19,7 @@
 #   create_board <name> <id> <d>  -> JSON {board_id, board_url}
 #
 # Each provider reads its credentials from the environment (see providers/*.sh
-# headers) and the board binding from repo-root .project.json.
+# headers) and the board binding from role.yaml under `ticket_provider:`.
 
 # Resolve the provider name: explicit env wins, then repo-root .project.json
 # (the SOT), then role.yaml (self-parsed so this works even when _lib.sh /
@@ -64,7 +64,7 @@ PY
 )"
     [ -n "$name" ] && { printf '%s\n' "$name"; return 0; }
   fi
-  printf 'plane\n'
+  printf 'linear\n'
 }
 
 # Directory holding provider implementations (sibling of this lib).
@@ -81,10 +81,6 @@ tp() {
 
   local name impl
   name="$(tp_provider_name)"
-  case "$name" in
-    plane|trello) ;;
-    *) echo "tp: unsupported ticket provider '$name' (expected plane|trello)" >&2; return 2 ;;
-  esac
   impl="$(tp_providers_dir)/${name}.sh"
 
   if [ ! -f "$impl" ]; then