@delorenj/pjangler 1.2.18 → 1.2.21

package/templates/hermes-agent/scripts/fleet-sync.sh

@@ -42,11 +42,7 @@ for p in sys.argv[2].split("."):
         cur = cur[p]
     else:
         print(sys.argv[3], end=""); sys.exit(0)
-if isinstance(cur, list):
-    cur = " ".join(str(x) for x in cur)
-else:
-    cur = str(cur)
-print(os.path.expanduser(cur), end="")
+print(os.path.expanduser(str(cur)), end="")
 PYEOF
   return 0
 }
@@ -60,7 +56,6 @@ REGISTRY_FILE="${HERMES_FLEET_REGISTRY_FILE:-$(cfg fleet.registry_file "$HOME/.h
 PROFILES_DIR="${HERMES_FLEET_HOME:-$HOME/.hermes}/profiles"
 VOXXY_PLUGIN_DIR="${VOXXY_PLUGIN_DIR:-$(cfg fleet.voxxy_plugin_dir "$HOME/code/voxxy/plugins/tts/voxxy")}"
 VOX_URL_VALUE="${VOX_URL:-$(cfg fleet.vox_url 'https://vox.delo.sh')}"
-PM_EXTERNAL_SKILL_DIRS="${PM_EXTERNAL_SKILL_DIRS:-$(cfg fleet.pm_external_skill_dirs "$HOME/code/skillex/skill-sets/global/.system $HOME/code/skillex/packs/bmad/6.10.2")}"
 
 APPLY=0
 RESTART=1
@@ -141,42 +136,6 @@ path.write_text("\n".join(lines) + "\n")
 PYEOF
 }
 
-pm_skill_dirs_status() {  # pm_skill_dirs_status <config-path>
-  python3 - "$1" "$PM_EXTERNAL_SKILL_DIRS" <<'PYEOF'
-import pathlib
-import sys
-
-import yaml
-
-path = pathlib.Path(sys.argv[1])
-desired = [entry for entry in sys.argv[2].split() if entry]
-if not path.exists():
-    print('missing')
-    raise SystemExit(0)
-data = yaml.safe_load(path.read_text()) or {}
-skills = data.get('skills') or {}
-current = list(skills.get('external_dirs') or [])
-print('ok' if current == desired else 'mismatch')
-PYEOF
-}
-
-set_pm_skill_dirs() {  # set_pm_skill_dirs <config-path>
-  python3 - "$1" "$PM_EXTERNAL_SKILL_DIRS" <<'PYEOF'
-import pathlib
-import sys
-
-import yaml
-
-path = pathlib.Path(sys.argv[1])
-desired = [entry for entry in sys.argv[2].split() if entry]
-data = yaml.safe_load(path.read_text()) or {}
-skills = data.get('skills') or {}
-skills['external_dirs'] = desired
-data['skills'] = skills
-path.write_text(yaml.safe_dump(data, sort_keys=False))
-PYEOF
-}
-
 wanted_agent() {
   [[ ${#ONLY_AGENTS[@]} -eq 0 ]] && return 0
   local a
@@ -279,28 +238,6 @@ while IFS=$'\t' read -r agent_id role_dir profile_name gateway_unit consumer_uni
   # 5. PM fleet voice contract: runtime plugin symlink + Voxxy config + VOX_URL.
   role_name="$(basename "$role_dir")"
   if [[ "$role_name" == "pm" && -d "$runtime" ]]; then
-    runtime_config="$runtime/config.yaml"
-    if [[ -n "$PM_EXTERNAL_SKILL_DIRS" ]]; then
-      skill_dir_status="$(pm_skill_dirs_status "$runtime_config")"
-      case "$skill_dir_status" in
-        ok) ;;
-        missing)
-          note "$agent_id" DRIFT "runtime config missing: $runtime_config"
-          DRIFT=$((DRIFT + 1))
-          ;;
-        *)
-          if [[ $APPLY -eq 1 ]]; then
-            set_pm_skill_dirs "$runtime_config"
-            note "$agent_id" FIXED "PM runtime skills.external_dirs synchronized"
-            changed=1; FIXED=$((FIXED + 1))
-          else
-            note "$agent_id" DRIFT "PM runtime skills.external_dirs differ from fleet contract"
-            DRIFT=$((DRIFT + 1))
-          fi
-          ;;
-      esac
-    fi
-
     plugin_link="$runtime/plugins/tts/voxxy"
     if [[ -d "$VOXXY_PLUGIN_DIR" ]]; then
       if [[ -L "$plugin_link" ]]; then

package/templates/hermes-agent/template/.gitignore.jinja

@@ -4,5 +4,3 @@
 # We just ignore the provisioning log so it doesn't end up in the project repo.
 .scripts/.provision.log
 .scripts/.last-run
-runtime/
-

package/templates/hermes-agent/template/.runtime-scaffold/README.md

@@ -13,7 +13,7 @@ and recoverable on failure.
 | `memories/MEMORY.md` | yes | The condensed mental-model summary loaded each session |
 | `memories/USER.md` | yes | The operator's persona (Jarad DeLorenzo, ...) |
 | `sessions/sessions.db` | yes (LFS) | SQLite store of every conversation |
-| `bloodbank-consumer.py` | yes | NATS subscriber for repo-scoped events |
+| `bloodbank-consumer.py` | yes | NATS subscriber using canonical subjects plus envelope routing data |
 | `decisions/` | yes | Agent-emitted decisions, one file per important call |
 | `.env` | **no** | API keys + Telegram bot token (per-machine secret) |
 | `auth.json` | **no** | Deprecated local OAuth store; fleet auth defaults to `HERMES_OAUTH_FILE=~/.hermes/auth.json` |

package/templates/hermes-agent/template/.runtime-scaffold/bloodbank-consumer.py

@@ -3,8 +3,12 @@
 Bloodbank consumer for hermes agent {{agent_id}}.
 
 Subscribes to:
-    bloodbank.evt.v1.repo.{{repo}}.>
-    bloodbank.cmd.v1.agent.{{agent_id}}.>
+    bloodbank.evt.v1.repo.>
+    bloodbank.cmd.v1.agent.>
+
+The Bloodbank subject identifies the fixed domain/entity/action route. Repo and
+agent identifiers stay in envelope data, so this consumer filters repo events
+by ``data.repo`` and agent commands by ``data.target_agent_id``.
 
 For each event/command received, writes it to the agent's notification queue at
 $HERMES_HOME/bloodbank-inbox/<timestamp>.json so the gateway can ingest it on
@@ -47,8 +51,8 @@ PRODUCER = f"hermes-agent:{AGENT_ID}"
 SOURCE   = f"hermes://agent/{AGENT_ID}"
 
 SUBJECTS = [
-    f"bloodbank.evt.v1.repo.{REPO}.>",
-    f"bloodbank.cmd.v1.agent.{AGENT_ID}.>",
+    "bloodbank.evt.v1.repo.>",
+    "bloodbank.cmd.v1.agent.>",
 ]
 
 KIND_MARKERS = {"event": "evt", "command": "cmd", "reply": "rpy"}
@@ -60,8 +64,8 @@ def _now():
 
 def _subject_and_domain(ce_type, kind):
     parts = ce_type.split(".")
-    if len(parts) != 5 or parts[0] != "bloodbank" or not parts[1].startswith("v"):
-        raise ValueError(f"type {ce_type!r} must match bloodbank.vN.<domain>.<entity>.<action>")
+    if len(parts) != 5 or parts[0] != "bloodbank" or parts[1] != "v1":
+        raise ValueError(f"type {ce_type!r} must match bloodbank.v1.<domain>.<entity>.<action>")
     if kind not in KIND_MARKERS:
         raise ValueError(f"unknown envelope kind {kind!r}")
     _vendor, version, domain, entity, action = parts
@@ -93,6 +97,33 @@ def build_envelope(ce_type, data, *, kind="event", correlationid=None, causation
     return env
 
 
+def _is_for_consumer(subject, payload):
+    """Route canonical subjects using identifiers carried in envelope data."""
+    if not isinstance(payload, dict):
+        return False
+    parts = subject.split(".")
+    if len(parts) != 6 or parts[0] != "bloodbank" or parts[2] != "v1":
+        return False
+
+    _vendor, kind, version, domain, entity, action = parts
+    if kind not in KIND_MARKERS.values():
+        return False
+    if KIND_MARKERS.get(payload.get("kind")) != kind:
+        return False
+    if payload.get("subject") != subject:
+        return False
+    if payload.get("type") != f"bloodbank.{version}.{domain}.{entity}.{action}":
+        return False
+    data = payload.get("data")
+    if not isinstance(data, dict):
+        return False
+    if kind == "evt" and domain == "repo":
+        return data.get("repo") == REPO
+    if kind == "cmd" and domain == "agent":
+        return data.get("target_agent_id") == AGENT_ID
+    return False
+
+
 async def main():
     nc = await nats.connect(NATS_URL, name=f"hermes-{AGENT_ID}")
     stop = asyncio.Event()
@@ -101,7 +132,10 @@ async def main():
         try:
             payload = json.loads(msg.data.decode())
         except Exception:
-            payload = {"_raw": msg.data.decode(errors="replace")}
+            sys.stderr.write(f"[bloodbank-consumer:{AGENT_ID}] skipped unroutable payload on {msg.subject}\n")
+            return
+        if not _is_for_consumer(msg.subject, payload):
+            return
         entry = {
             "received_at": _now(),
             "subject": msg.subject,
@@ -123,7 +157,7 @@ async def main():
         "bloodbank.v1.agent.online.changed",
         {"agent_id": AGENT_ID, "repo": REPO, "role": ROLE, "state": "online"},
     )
-    await nc.publish("bloodbank.evt.v1.agent.online.changed", json.dumps(online).encode())
+    await nc.publish(online["subject"], json.dumps(online).encode())
 
     def _shutdown(*_):
         stop.set()
@@ -136,7 +170,7 @@ async def main():
         "bloodbank.v1.agent.online.changed",
         {"agent_id": AGENT_ID, "repo": REPO, "role": ROLE, "state": "offline"},
     )
-    await nc.publish("bloodbank.evt.v1.agent.online.changed", json.dumps(offline).encode())
+    await nc.publish(offline["subject"], json.dumps(offline).encode())
     await nc.drain()
 
 

package/templates/hermes-agent/template/.runtime-scaffold/memories/MEMORY.md

@@ -7,8 +7,8 @@ short and high-signal — anything that should ALWAYS be in context.
 
 You are **{{display_name}}**, the `{{role}}` agent for the `{{repo}}` repo.
 Your scope is the repo at the project root. You communicate via Telegram
-(`@{{repo}}_{{role}}_bot`) and Bloodbank events on the
-`bloodbank.evt.v1.repo.{{repo}}.*` lane.
+(`@{{repo}}_{{role}}_bot`) and canonical Bloodbank repo events on
+`bloodbank.evt.v1.repo.>`, filtered by `data.repo = {{repo}}`.
 
 ## Operator
 

package/templates/hermes-agent/template/.scripts/01-config.sh

@@ -26,7 +26,6 @@ hermes_repo = "~/.hermes/hermes-agent"
 fleet_env = "~/.hermes/fleet.env"
 registry_file = "~/.hermes/agents-registry.yaml"
 canonical_skills_dir = "/home/delorenj/.agents/skills"
-pm_external_skill_dirs = ["~/code/skillex/skill-sets/global/.system", "~/code/skillex/packs/bmad/6.10.2"]
 
 [github]
 runtime_repo_owner = "delorenj"

package/templates/hermes-agent/template/.scripts/05-fleet-env.sh

@@ -47,15 +47,6 @@ PYEOF
 
 upsert_fleet_env HERMES_FLEET_OAUTH_FILE "$HERMES_OAUTH_FILE"
 upsert_fleet_env HERMES_FLEET_CODEX_HOME "$CODEX_HOME"
-
-PLANE_WORKSPACE_KEY="$(plane_workspace_key "$PLANE_WORKSPACE")"
-PLANE_WORKSPACE_VALUE="${!PLANE_WORKSPACE_KEY:-}"
-if [[ -z "$PLANE_WORKSPACE_VALUE" && -n "${PLANE_API_KEY:-}" ]]; then
-  PLANE_WORKSPACE_VALUE="$PLANE_API_KEY"
-fi
-if [[ -n "$PLANE_WORKSPACE_VALUE" ]]; then
-  upsert_fleet_env "$PLANE_WORKSPACE_KEY" "$PLANE_WORKSPACE_VALUE"
-fi
 chmod 600 "$FLEET_ENV"
 
 mark_done 05-fleet-env

package/templates/hermes-agent/template/.scripts/10-hermes-profile.sh

@@ -110,29 +110,10 @@ CANONICAL_SKILLS_DIR="${CANONICAL_SKILLS_DIR:-$(config_get fleet.canonical_skill
 CANONICAL_PM_SKILL_SRC="$CANONICAL_SKILLS_DIR/subagent-driven-development"
 LOCAL_PM_SKILL_DST="$PROFILE_HOME/skills/software-development/subagent-driven-development"
 
-if [[ "$ROLE" == "pm" ]]; then
-  PM_EXTERNAL_SKILL_DIRS="${PM_EXTERNAL_SKILL_DIRS:-$(config_get fleet.pm_external_skill_dirs "$HOME/code/skillex/skill-sets/global/.system $HOME/code/skillex/packs/bmad/6.10.2")}" 
-  read -r -a RESOLVED_PM_EXTERNAL_SKILL_DIRS <<< "$PM_EXTERNAL_SKILL_DIRS"
-  if [[ ${#RESOLVED_PM_EXTERNAL_SKILL_DIRS[@]} -gt 0 ]]; then
-    log "    setting PM skills.external_dirs = ${RESOLVED_PM_EXTERNAL_SKILL_DIRS[*]}"
-    python3 - "$PROFILE_HOME/config.yaml" "${RESOLVED_PM_EXTERNAL_SKILL_DIRS[@]}" <<'PYEOF'
-import pathlib
-import sys
-
-import yaml
-
-path = pathlib.Path(sys.argv[1])
-external_dirs = sys.argv[2:]
-data = yaml.safe_load(path.read_text()) or {}
-skills = data.get("skills") or {}
-skills["external_dirs"] = external_dirs
-data["skills"] = skills
-path.write_text(yaml.safe_dump(data, sort_keys=False))
-PYEOF
-  fi
-fi
-
 if [[ -d "$CANONICAL_SKILLS_DIR" ]]; then
+  log "    setting skills.external_dirs[0] = $CANONICAL_SKILLS_DIR"
+  env HERMES_HOME="$PROFILE_HOME" "$HERMES_BIN" config set skills.external_dirs.0 "$CANONICAL_SKILLS_DIR"
+
   # Ensure key PM/local-ops skills are symlinked into runtime/profile skills root.
   # This preserves canonical ownership and keeps updates instant across agents.
   read -r -a SYMLINKED_RUNTIME_SKILLS <<< "${SYMLINKED_RUNTIME_SKILLS:-$(config_get fleet.symlinked_runtime_skills 'delonet-conventions delonet-dotenv hermes-pm-template-maintenance hindsight subagent-driven-development')}"

package/templates/hermes-agent/template/.scripts/20-runtime-repo.sh

@@ -144,28 +144,6 @@ log "    profile symlink $PROFILE_HOME -> $RUNTIME_LOCAL"
 # Apply the one genuine per-repo config delta directly to the runtime config.
 env HERMES_HOME="$RUNTIME_LOCAL" "$HERMES_BIN" config set terminal.cwd "$PROJECT_PATH" >/dev/null 2>&1 || true
 
-if [[ "$ROLE" == "pm" ]]; then
-  PM_EXTERNAL_SKILL_DIRS="${PM_EXTERNAL_SKILL_DIRS:-$(config_get fleet.pm_external_skill_dirs "$HOME/code/skillex/skill-sets/global/.system $HOME/code/skillex/packs/bmad/6.10.2")}"
-  read -r -a RESOLVED_PM_EXTERNAL_SKILL_DIRS <<< "$PM_EXTERNAL_SKILL_DIRS"
-  if [[ ${#RESOLVED_PM_EXTERNAL_SKILL_DIRS[@]} -gt 0 ]]; then
-    python3 - "$RUNTIME_LOCAL/config.yaml" "${RESOLVED_PM_EXTERNAL_SKILL_DIRS[@]}" <<'PYEOF'
-import pathlib
-import sys
-
-import yaml
-
-path = pathlib.Path(sys.argv[1])
-external_dirs = sys.argv[2:]
-data = yaml.safe_load(path.read_text()) or {}
-skills = data.get("skills") or {}
-skills["external_dirs"] = external_dirs
-data["skills"] = skills
-path.write_text(yaml.safe_dump(data, sort_keys=False))
-PYEOF
-    log "    set PM runtime skills.external_dirs -> ${RESOLVED_PM_EXTERNAL_SKILL_DIRS[*]}"
-  fi
-fi
-
 if [[ "$ROLE" == "pm" ]]; then
   VOXXY_PLUGIN_DIR="${VOXXY_PLUGIN_DIR:-$(config_get fleet.voxxy_plugin_dir "$HOME/code/voxxy/plugins/tts/voxxy")}"
   if [[ -d "$VOXXY_PLUGIN_DIR" ]]; then

package/templates/hermes-agent/template/.scripts/40-plane.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Create a Plane project in the configured workspace (one project per agent).
+# Workspace + base URL come from role.yaml / config.toml (see _lib.sh).
+# shellcheck source=_lib.sh
+source "$(dirname "$0")/_lib.sh"
+load_role_env
+
+already_done 40-plane && { log "[40] plane already set up — skipping"; exit 0; }
+[[ "${SKIP_PLANE:-0}" == "1" ]] && { log "[40] plane — SKIPPED"; mark_done 40-plane; exit 0; }
+
+[[ -n "$PLANE_API_KEY" ]] || { warn "[40] PLANE_API_KEY not set; skipping. set PLANE_33GOD_API_KEY and re-run ./.scripts/40-plane.sh"; exit 0; }
+
+# Build the 5-char identifier: <repo[0..2]><role[0..1]> uppercased
+RAW=$(printf '%s%s' "${REPO:0:3}" "${ROLE:0:2}" | tr -cd '[:alnum:]' | tr '[:lower:]' '[:upper:]')
+while (( ${#RAW} < 3 )); do RAW="${RAW}X"; done
+IDENT="${RAW:0:5}"
+
+# Project name = display_name (already smart-cased: "Bloodbank PM", "Hermes-Agent Dev").
+# Plane forbids hyphens in names — substitute spaces.
+NAME="${DISPLAY_NAME//-/ }"
+
+log "[40] creating plane project '$NAME' [$IDENT]"
+
+# Check for existing project with this identifier
+EXISTING=$(curl -sS "$PLANE_BASE/api/v1/workspaces/$PLANE_WORKSPACE/projects/?per_page=200" \
+  -H "X-API-Key: $PLANE_API_KEY" \
+  | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+ident = '$IDENT'
+for p in d.get('results', []):
+    if (p.get('identifier') or '').upper() == ident:
+        print(p['id']); break")
+
+if [[ -n "$EXISTING" ]]; then
+  log "    plane project $IDENT already exists (id=$EXISTING) — reusing"
+  PROJECT_ID="$EXISTING"
+else
+  RESP=$(curl -sS -X POST "$PLANE_BASE/api/v1/workspaces/$PLANE_WORKSPACE/projects/" \
+    -H "X-API-Key: $PLANE_API_KEY" \
+    -H "Content-Type: application/json" \
+    -d "$(python3 -c "import json,sys; print(json.dumps({'name': sys.argv[1], 'identifier': sys.argv[2], 'description': sys.argv[3]}))" \
+        "$NAME" "$IDENT" "Hermes agent board for $AGENT_ID")")
+  PROJECT_ID=$(echo "$RESP" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('id') or '')")
+  [[ -n "$PROJECT_ID" ]] || die "plane create failed: $RESP"
+  log "    plane project created id=$PROJECT_ID"
+fi
+
+yaml_set plane.identifier "$IDENT"
+echo "$PROJECT_ID" > "$ROLE_DIR/.scripts/.plane-project-id"
+mark_done 40-plane

package/templates/hermes-agent/template/.scripts/42-ticket-provider.sh

@@ -10,12 +10,11 @@
 #   2. Otherwise (hermes run on a repo with no CommonProject board yet)
 #      -> create ONE repo-named board and write it back into .project.json so
 #         it becomes the SOT for every agent in this repo.
-# Either way we register this agent under .project.json `agents`. role.yaml is
-# identity/personality only; it must not carry board UUIDs or derived URLs.
+# Either way we register this agent under .project.json `agents` and mirror the
+# binding into role.yaml for back-compat (80-registry.sh / 99-summary.sh).
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 load_role_env
-resolve_plane_api_key "$PLANE_WORKSPACE"
 # shellcheck source=lib/ticket-provider.sh
 source "$(dirname "$0")/lib/ticket-provider.sh"
 
@@ -47,13 +46,13 @@ PY
 }
 
 # pj_write — merge board binding (optional) + this agent into .project.json.
-# args: set_provider(0|1) provider board_id workspace identifier
+# args: set_provider(0|1) provider board_id board_url workspace identifier team
 pj_write() {
   REPO="$REPO" REPO_ROOT="$REPO_ROOT" AGENT_ID="$AGENT_ID" ROLE="$ROLE" \
   ROLE_DIR_REL="$ROLE_DIR_REL" PROJECT_DESC="${PROJECT_DESC:-}" \
   python3 - "$PROJECT_JSON" "$@" <<'PY'
 import sys, os, json, pathlib
-(path, set_provider, provider, board_id, workspace, identifier) = sys.argv[1:7]
+(path, set_provider, provider, board_id, board_url, workspace, identifier, team) = sys.argv[1:9]
 p = pathlib.Path(path)
 try:
     d = json.loads(p.read_text())
@@ -72,30 +71,47 @@ if set_provider == "1":
     if workspace:  tp["workspace"] = workspace
     if identifier: tp["identifier"] = identifier
     if board_id:   tp["board_id"] = board_id
-    tp.pop("board_url", None)
-    tp["state"] = "linked" if board_id else tp.get("state", "planned")
+    if board_url:  tp["board_url"] = board_url
+    if team:       tp["team"] = team
 ag = d.setdefault("agents", {})
 ag[os.environ["AGENT_ID"]] = {"role": os.environ["ROLE"], "role_dir": os.environ["ROLE_DIR_REL"]}
-automation = d.setdefault("automation", {})
-automation.setdefault("reconcile", {"enabled": False, "grace_hours": 0, "auto_review": True})
 p.write_text(json.dumps(d, indent=2) + "\n")
 PY
   log "    .project.json updated (agent=$AGENT_ID)"
 }
 
-# Keep only the legacy adapter name in role.yaml. Stable board identity belongs
-# in .project.json.
-mirror_provider_name_to_role_yaml() {
-  local provider="$1"
+# Mirror the binding into role.yaml so legacy consumers keep working.
+mirror_to_role_yaml() {
+  # mirror_to_role_yaml <provider> <board_id> <board_url> <workspace> <identifier> <team>
+  local provider="$1" bid="$2" burl="$3" ws="$4" ident="$5" team="$6"
   yaml_set ticket_provider.name "$provider" 2>/dev/null || true
+  [ -n "$bid" ]  && yaml_set ticket_provider.board_id "$bid" 2>/dev/null || true
+  [ -n "$burl" ] && yaml_set ticket_provider.board_url "$burl" 2>/dev/null || true
+  case "$provider" in
+    plane)
+      [ -n "$bid" ] && echo "$bid" > "$ROLE_DIR/.scripts/.plane-project-id"
+      [ -n "$ws" ]    && yaml_set ticket_provider.workspace "$ws" 2>/dev/null || true
+      [ -n "$bid" ]   && yaml_set ticket_provider.project "$bid" 2>/dev/null || true
+      [ -n "$ws" ]    && yaml_set plane.workspace "$ws" 2>/dev/null || true
+      [ -n "$ident" ] && yaml_set plane.identifier "$ident" 2>/dev/null || true
+      ;;
+    trello)
+      [ -n "$bid" ] && yaml_set ticket_provider.board "$bid" 2>/dev/null || true
+      ;;
+    linear)
+      [ -n "$team" ] && yaml_set ticket_provider.team "$team" 2>/dev/null || true
+      ;;
+  esac
 }
 
 # ── Provider resolution ──────────────────────────────────────────────────
 # An existing repo board (in .project.json) wins — every agent binds to it.
 SOT_TYPE="$(pj ticket_provider.type)"
 SOT_BOARD_ID="$(pj ticket_provider.board_id)"
+SOT_URL="$(pj ticket_provider.board_url)"
 SOT_WS="$(pj ticket_provider.workspace)"
 SOT_IDENT="$(pj ticket_provider.identifier)"
+SOT_TEAM="$(pj ticket_provider.team)"
 
 # role.yaml provider comes from copier --data (the operator's pjangler choice).
 ROLE_PROVIDER="$(yaml_get ticket_provider.name)"
@@ -106,10 +122,9 @@ if [ -n "$SOT_BOARD_ID" ]; then
   if [ -n "$ROLE_PROVIDER" ] && [ "$ROLE_PROVIDER" != "$PROVIDER" ]; then
     warn "[42] requested provider '$ROLE_PROVIDER' but repo board is '$PROVIDER' (.project.json wins); binding to existing board"
   fi
-  case "$PROVIDER" in plane|trello) ;; *) die "unsupported ticket provider in .project.json: $PROVIDER (expected plane|trello)" ;; esac
   log "[42] binding $AGENT_ID to existing repo board (provider=$PROVIDER, id=$SOT_BOARD_ID)"
-  mirror_provider_name_to_role_yaml "$PROVIDER"
-  pj_write 1 "$PROVIDER" "$SOT_BOARD_ID" "$SOT_WS" "$SOT_IDENT"
+  mirror_to_role_yaml "$PROVIDER" "$SOT_BOARD_ID" "$SOT_URL" "$SOT_WS" "$SOT_IDENT" "$SOT_TEAM"
+  pj_write 0 "$PROVIDER" "" "" "" "" ""   # register agent only; board already recorded
   mark_done 42-ticket-provider
   exit 0
 fi
@@ -128,22 +143,45 @@ NAME="$(printf '%s' "$REPO" | tr '_-' '  ' | python3 -c 'import sys; print(" ".j
 DESC="Ticket board for $REPO"
 
 case "$PROVIDER" in
+  linear)
+    if [[ -z "${LINEAR_API_KEY:-}" ]]; then
+      warn "[42] LINEAR_API_KEY not set; set role.yaml/.project.json ticket_provider.team and re-run ./.scripts/42-ticket-provider.sh"
+      pj_write 1 linear "" "" "" "$IDENT" "$SOT_TEAM"
+      mark_done 42-ticket-provider; exit 0
+    fi
+    OUT="$(tp resolve 2>/dev/null || true)"
+    BID="$(printf '%s' "$OUT" | python3 -c 'import sys,json
+try: print(json.load(sys.stdin).get("board_id",""))
+except Exception: print("")')"
+    BURL="$(printf '%s' "$OUT" | python3 -c 'import sys,json
+try: print(json.load(sys.stdin).get("board_url",""))
+except Exception: print("")')"
+    if [ -n "$BID" ]; then
+      mirror_to_role_yaml linear "$BID" "$BURL" "" "$IDENT" "$SOT_TEAM"
+      pj_write 1 linear "$BID" "$BURL" "" "$IDENT" "$SOT_TEAM"
+    else
+      warn "[42] linear resolve returned no board; set ticket_provider.team and re-run"
+      pj_write 1 linear "" "" "" "$IDENT" "$SOT_TEAM"
+    fi
+    ;;
+
   plane|trello)
     KEYVAR=PLANE_API_KEY; [ "$PROVIDER" = trello ] && KEYVAR=TRELLO_KEY
     if [[ -z "${!KEYVAR:-}" ]]; then
       warn "[42] $KEYVAR not set; skipping board creation. Set creds and re-run ./.scripts/42-ticket-provider.sh"
-      pj_write 1 "$PROVIDER" "" "${SOT_WS:-${PLANE_WORKSPACE:-}}" "$IDENT"
+      pj_write 1 "$PROVIDER" "" "" "${SOT_WS:-$PLANE_WORKSPACE}" "$IDENT" ""
       mark_done 42-ticket-provider; exit 0
     fi
     OUT="$(tp create_board "$NAME" "$IDENT" "$DESC")" || die "create_board failed for $PROVIDER"
     BID="$(printf '%s' "$OUT" | python3 -c 'import sys,json; print(json.load(sys.stdin).get("board_id",""))')"
-    WS="${SOT_WS:-${PLANE_WORKSPACE:-}}"
+    BURL="$(printf '%s' "$OUT" | python3 -c 'import sys,json; print(json.load(sys.stdin).get("board_url",""))')"
+    WS="${SOT_WS:-$PLANE_WORKSPACE}"
     [ "$PROVIDER" = trello ] && WS=""
-    mirror_provider_name_to_role_yaml "$PROVIDER"
-    pj_write 1 "$PROVIDER" "$BID" "$WS" "$IDENT"
+    mirror_to_role_yaml "$PROVIDER" "$BID" "$BURL" "$WS" "$IDENT" ""
+    pj_write 1 "$PROVIDER" "$BID" "$BURL" "$WS" "$IDENT" ""
     ;;
 
-  *) die "unknown ticket provider: $PROVIDER (expected plane|trello)" ;;
+  *) die "unknown ticket provider: $PROVIDER (expected linear|plane|trello)" ;;
 esac
 
 mark_done 42-ticket-provider

package/templates/hermes-agent/template/.scripts/60-bloodbank.sh

@@ -20,7 +20,8 @@ log "[60] installing bloodbank consumer for $AGENT_ID"
 # placeholders. If $RUNTIME/bloodbank-consumer.py was ever lost (runtime
 # submodule wiped, manual rm, etc.) and then someone restored it by
 # copying from $RUNTIME_SCAFFOLD_DIR, they'd end up with an un-rendered
-# consumer subscribing to literal `bloodbank.evt.v1.repo.{{repo}}.>`.
+# consumer whose envelope routing filter compares against literal `{{repo}}`
+# and `{{agent_id}}` values.
 # This block handles both failure modes idempotently.
 CONSUMER="$RUNTIME/bloodbank-consumer.py"
 SCAFFOLD_CONSUMER="$RUNTIME_SCAFFOLD_DIR/bloodbank-consumer.py"

package/templates/hermes-agent/template/.scripts/70-systemd.sh

@@ -5,10 +5,7 @@
 source "$(dirname "$0")/_lib.sh"
 load_role_env
 
-if already_done 70-systemd && [[ "${FORCE_SYSTEMD:-0}" != "1" ]]; then
-  log "[70] systemd already installed — skipping"
-  exit 0
-fi
+already_done 70-systemd && { log "[70] systemd already installed — skipping"; exit 0; }
 [[ "${SKIP_SYSTEMD:-0}" == "1" ]] && { log "[70] systemd — SKIPPED"; mark_done 70-systemd; exit 0; }
 
 RUNTIME="$ROLE_DIR/runtime"
@@ -35,9 +32,6 @@ Type=simple
 Environment=HERMES_HOME=$RUNTIME
 Environment=HERMES_OAUTH_FILE=$HERMES_OAUTH_FILE
 Environment=CODEX_HOME=$CODEX_HOME
-Environment=HERMES_KANBAN_DISPATCH_IN_GATEWAY=0
-Environment=HERMES_KANBAN_SLASH_ENABLED=0
-EnvironmentFile=-$FLEET_ENV
 EnvironmentFile=-$RUNTIME/.env
 ExecStart=$HERMES_BIN gateway run --replace
 Restart=on-failure
@@ -63,7 +57,6 @@ WorkingDirectory=$RUNTIME
 Environment=HERMES_HOME=$RUNTIME
 Environment=HERMES_OAUTH_FILE=$HERMES_OAUTH_FILE
 Environment=CODEX_HOME=$CODEX_HOME
-EnvironmentFile=-$FLEET_ENV
 EnvironmentFile=-$RUNTIME/.env
 ExecStart=$HERMES_AGENT_REPO/.venv/bin/python $RUNTIME/bloodbank-consumer.py
 Restart=on-failure
@@ -93,7 +86,6 @@ WorkingDirectory=$REPO_ROOT
 Environment=HERMES_HOME=$RUNTIME
 Environment=HERMES_OAUTH_FILE=$HERMES_OAUTH_FILE
 Environment=CODEX_HOME=$CODEX_HOME
-EnvironmentFile=-$FLEET_ENV
 EnvironmentFile=-%h/.config/hermes-agent/env
 EnvironmentFile=-%h/.hermes/env
 EnvironmentFile=-%h/.hermes/hermes-agent.env
@@ -120,7 +112,6 @@ UNIT
 
 if systemd_user_available; then
   systemctl --user daemon-reload
-  systemctl --user disable --now "hermes-${AGENT_ID}-checkpoint.timer" "hermes-${AGENT_ID}-checkpoint.service" >/dev/null 2>&1 || true
   # `enable --now` both enables (persist across login) AND starts the unit now, so a
   # freshly provisioned agent comes up live instead of dormant. Units with missing
   # creds (e.g. a gateway with no Telegram token yet) fail softly via Restart=on-failure.