@delorenj/pjangler 1.2.19 → 1.2.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delorenj/pjangler",
-  "version": "1.2.19",
+  "version": "1.2.21",
   "description": "Project subsystem bootstrapper CLI",
   "type": "module",
   "main": "dist/index.js",

package/templates/commonproject/copier.yml

@@ -90,8 +90,9 @@ agent_hooks_layer:
   default: true
   when: false
 
-# When agent_hooks_layer is false, omit the project-scoped hook tree + skill-link
-# scripts entirely (the mise.toml wiring is already gated inside the template).
+# When agent_hooks_layer is false, omit only the project-scoped hook tree. The
+# skills manifest stays — sync-skills.py writes project-local CLI dirs and is safe
+# even on machines that already run a global ~/.agents/hooks install.
 # The `.copier-noop-never-matches` sentinel keeps every pattern non-empty when the
 # layer is enabled, which copier requires.
 _exclude:
@@ -105,8 +106,6 @@ _exclude:
   - "{% if agent_hooks_layer %}.copier-noop-never-matches{% else %}.agents/hooks{% endif %}"
   - "{% if agent_hooks_layer %}.copier-noop-never-matches{% else %}.agents/hooks/**{% endif %}"
   - "{% if agent_hooks_layer %}.copier-noop-never-matches{% else %}.agents/local.example.json{% endif %}"
-  - "{% if agent_hooks_layer %}.copier-noop-never-matches{% else %}.mise/scripts/link-project-skills-to-clis.sh{% endif %}"
-  - "{% if agent_hooks_layer %}.copier-noop-never-matches{% else %}.mise/scripts/unlink-project-skills-from-clis.sh{% endif %}"
 
 # --- Post-generation tasks ---
 #

package/templates/commonproject/template/.agents/hooks/README.md

@@ -15,6 +15,7 @@ master writes zero bytes).
 mise run hooks-sync          # fan out the master -> claude + codex + hermes
 mise run hooks-check         # drift gate (read-only; used in CI)
 mise run hooks-uninstall     # remove codex + hermes injections
+mise run skills-sync         # sync .agents/skills.json -> local CLI skill dirs
 mise run hindsight-setup     # one-time: pull the shared CAF Hindsight key into .env
 ```
 
@@ -70,8 +71,7 @@ Copy [`.agents/local.example.json`](../local.example.json) → `.agents/local.js
   "hooks": {
     "disabled": ["hindsight-recall"],   // hook ids — skipped at runtime, ALL agents
     "disabled_agents": ["codex"]        // claude|codex|hermes — codex/hermes injection skipped/removed
-  },
-  "skills": { "disabled": ["bmad-help"] } // skill dir names — not symlinked for you
+  }
 }
 ```
 
@@ -83,32 +83,18 @@ Copy [`.agents/local.example.json`](../local.example.json) → `.agents/local.js
 - **Disabled agents** are enforced at **install** time (codex/hermes injection is
   skipped, and removed if previously installed). `CAF_HOOKS_SKIP_CODEX=1` is an
   env shortcut for `disabled_agents:["codex"]`.
-- **Disabled skills** are honored by the skill fan-out (below).
+## Skill fan-out — `.agents/skills.json` → each CLI
 
-## Skill fan-out — `.agents/skills` → each CLI
+`.agents/skills.json` is the project's skill manifest. `sync-skills.py --scope
+project` resolves that manifest into project-local CLI dirs (for example
+`./.codex/skills`, `./.hermes/skills`, `./.kimi-code/skills`) and honors
+`inherit_global: true` so a dev's global `~/.agents/skills.json` loadout is
+merged in automatically.
 
-`.agents/skills/` is the project's enabled skill set (committed inherited skills +
-`./skills/*` app skills symlinked in on enter). `link-project-skills-to-clis.sh`
-fans it out as per-skill symlinks to every agent CLI that doesn't read `.agents/`
-natively — a small `SKILL_TARGETS` table:
-
-| CLI | target dir | scope |
-|---|---|---|
-| Codex | `~/.codex/skills` | **global** — link ours in, never clobber foreign entries, removed on `leave` |
-| Kimi | `./.kimi-code/skills` | **local** — a project-scoped mirror we fully manage (stale real copies replaced with symlinks) |
-
-Add a CLI = one `dir|scope` line. Per-dev control via `.agents/local.json`
-`skills`:
-
-- `disabled: [...]` — never link these; pruned from managed mirrors.
-- `defer_to_global: true` — **only if you run a global `~/.agents/skills` system.**
-  Skips any project skill whose name also exists there, so your global copy wins
-  and you get **zero duplicates** (it even yields the slot in `~/.codex/skills`).
-  Teammates with no global layer leave it `false` (default) and **inherit the full
-  set**. Override the global dir with `AGENTS_GLOBAL_SKILLS_DIR`.
-
-Tasks: `mise run skills-relink` (re-fan), `mise run link-project-skills-to-clis`,
-`mise run unlink-project-skills-from-clis`.
+- Project-local skills with the same name shadow the global ones.
+- No `defer_to_global` flag or bash cleanup scripts are needed anymore.
+- The manifest is the only hand-edited skill SSOT; run `mise run skills-sync`
+  after changing it, or just re-enter the repo.
 
 ## Hindsight credentials — `mise run hindsight-setup`
 
@@ -137,6 +123,7 @@ Without a key the hooks **no-op gracefully** — recall/retain just do nothing.
 ```
 .agents/
   local.example.json    # per-dev override template (copy -> local.json, gitignored)
+  skills.json           # project skill manifest (SSOT for sync-skills.py)
   hooks/
     hooks.master.json   # SSOT — the only hand-edited config
     sync.py             # fan-out engine (--install / --uninstall / --check)

package/templates/commonproject/template/.agents/hooks/lib/local-config.sh

@@ -4,10 +4,9 @@
 # Source this, then call:
 #   hook_disabled  <hook-id>     # true if .hooks.disabled[] contains the id
 #   agent_disabled <agent>       # true if .hooks.disabled_agents[] contains the agent
-#   skill_disabled <skill-name>  # true if .skills.disabled[] contains the name
 #
 # All FAIL OPEN (return 1 = "not disabled") when `.agents/local.json` or `jq` is
-# absent, so a missing/garbled local config can never silently kill hooks/skills.
+# absent, so a missing/garbled local config can never silently kill hooks.
 #
 # `.agents/local.json` is gitignored — each dev owns their own. See
 # `.agents/local.example.json` for the schema.
@@ -30,22 +29,13 @@ _caf_listed() {
 
 hook_disabled()  { _caf_listed '.hooks.disabled' "$1"; }
 agent_disabled() { _caf_listed '.hooks.disabled_agents' "$1"; }
-skill_disabled() { _caf_listed '.skills.disabled' "$1"; }
 
-# True if the dev opted to let their GLOBAL agent system (~/.agents/skills) provide
-# any overlapping skill, so the project linker should skip it (no duplicates).
-# Teammates with no global layer omit this and inherit the full project set.
+# True if the dev opted to let their GLOBAL agent system (~/.agents/hooks) provide
+# the hook layer, so project-scoped per-user injections should be suppressed.
 skills_defer_to_global() {
   local f
   f="$(_caf_local_json)" || return 1
   [[ -f "$f" ]] || return 1
   command -v jq >/dev/null 2>&1 || return 1
-  jq -e '.skills.defer_to_global == true' "$f" >/dev/null 2>&1
-}
-
-# True if <skill-name> is provided by the global agent SSOT. `-e` follows the
-# ~/.agents/skills symlink (-> skillex/skill-sets/global) and its entries.
-skill_is_global() {
-  local name="$1" gdir="${AGENTS_GLOBAL_SKILLS_DIR:-$HOME/.agents/skills}"
-  [[ -e "${gdir}/${name}" ]]
+  jq -e '.hooks.defer_to_global == true' "$f" >/dev/null 2>&1
 }

package/templates/commonproject/template/.agents/hooks/sync.py

@@ -72,10 +72,10 @@ def load_local() -> dict:
     (so even Claude's committed hooks honor them); this only needs disabled
     AGENTS, which gate install. CAF_HOOKS_SKIP_CODEX=1 is an env shortcut.
 
-    `defer_to_global` (under either `hooks` or `skills`) means "I already run
-    these hooks from a global agent system" — so the shared per-user injections
-    (codex/kimi/hermes) are suppressed and actively removed. Claude's committed
-    repo settings are harmless and left in place.
+    `hooks.defer_to_global` means "I already run these hooks from a global agent
+    system" — so the shared per-user injections (codex/kimi/hermes) are
+    suppressed and actively removed. Claude's committed repo settings are
+    harmless and left in place.
     """
     disabled_agents: set[str] = set()
     defer_to_global = False
@@ -84,9 +84,8 @@ def load_local() -> dict:
         try:
             data = json.loads(p.read_text() or "{}")
             hooks_cfg = data.get("hooks") or {}
-            skills_cfg = data.get("skills") or {}
             disabled_agents = set(hooks_cfg.get("disabled_agents") or [])
-            defer_to_global = bool(hooks_cfg.get("defer_to_global")) or bool(skills_cfg.get("defer_to_global"))
+            defer_to_global = bool(hooks_cfg.get("defer_to_global"))
         except (json.JSONDecodeError, OSError) as exc:
             warn(f"ignoring malformed .agents/local.json: {exc}")
     if os.environ.get("CAF_HOOKS_SKIP_CODEX") == "1":

package/templates/commonproject/template/.agents/local.example.json

@@ -1,17 +1,11 @@
 {
-  "$comment": "PER-DEV LOCAL OVERRIDES — copy this file to .agents/local.json (gitignored) and edit. Lets you opt out of individual hooks, whole agents, or specific auto-linked skills, and tune how project skills fan out to your agent CLIs — without touching committed config. Hooks self-skip at RUNTIME via .agents/hooks/lib/hook-guard.sh (so even Claude's committed hooks honor it); codex/hermes injections additionally skip at INSTALL time. Re-run `mise run hooks-sync` / `mise run skills-relink` (or re-cd into the repo) after editing.",
+  "$comment": "PER-DEV LOCAL OVERRIDES — copy this file to .agents/local.json (gitignored) and edit. Lets you opt out of individual hooks or whole injected agents without touching committed config. Hooks self-skip at RUNTIME via .agents/hooks/lib/hook-guard.sh (so even Claude's committed hooks honor it); codex/hermes injections additionally skip at INSTALL time. Re-run `mise run hooks-sync` (or re-cd into the repo) after editing.",
   "hooks": {
     "$disabled_help": "Hook ids from .agents/hooks/hooks.master.json: skill-check-reminder, hindsight-recall, hindsight-retain, hindsight-session-end. Listed ids are skipped at runtime across ALL agents.",
     "disabled": [],
     "$disabled_agents_help": "Agent keys: claude, codex, kimi, hermes. Listed agents are NOT installed (codex/kimi/hermes injections are skipped/removed). Claude's hooks are committed and can't be fully removed per-dev — disable them individually via `disabled` instead.",
     "disabled_agents": [],
-    "$defer_to_global_help": "Set true if you already run these hooks from a GLOBAL agent system (~/.agents/hooks). When true, sync.py suppresses AND removes the shared per-user injections (codex/kimi/hermes) so a project never double-injects into ~/.codex / ~/.kimi-code; Claude's committed repo settings are left in place. Implied by skills.defer_to_global. On a machine with a global install, pjangler skips scaffolding this whole layer, so you rarely need to set this by hand.",
-    "defer_to_global": false
-  },
-  "skills": {
-    "$disabled_help": "Skill directory names under .agents/skills/. Listed skills are NOT symlinked into any agent CLI dir for you, and are pruned from your managed mirrors.",
-    "disabled": [],
-    "$defer_to_global_help": "Set true ONLY if you run a global agent system at ~/.agents/skills. When true, the linker skips any project skill whose name also exists in your global SSOT, so your global copy wins and you get ZERO duplicates/conflicts (and yields the slot in shared dirs like ~/.codex/skills). Teammates with no global layer leave this false (the default) and inherit the FULL project skill set. Override the global dir with the AGENTS_GLOBAL_SKILLS_DIR env var.",
+    "$defer_to_global_help": "Set true if you already run these hooks from a GLOBAL agent system (~/.agents/hooks). When true, sync.py suppresses AND removes the shared per-user injections (codex/kimi/hermes) so a project never double-injects into ~/.codex / ~/.kimi-code; Claude's committed repo settings are left in place. On a machine with a global install, pjangler skips scaffolding this whole layer, so you rarely need to set this by hand.",
     "defer_to_global": false
   }
 }

package/templates/commonproject/template/.agents/skills.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://raw.githubusercontent.com/skillex/schemas/main/skills.schema.json",
+  "inherit_global": true,
+  "registry": "https://github.com/delorenj/skillex.git",
+  "skills": []
+}

package/templates/commonproject/template/mise.toml.jinja

@@ -20,23 +20,24 @@ script = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh
 [[hooks.enter]]
 script = "op inject -i .env.op > .env"
 [[hooks.enter]]
+script = "sync-skills.py --scope project"
+[[hooks.enter]]
 script = "[ -f '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/codegraph.sh' ] && '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/codegraph.sh' || true"
 {%- if agent_hooks_layer %}
 [[hooks.enter]]
-script = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-project-skills-to-clis.sh'"
-[[hooks.enter]]
 script = "'{% raw %}{{config_root}}{% endraw %}/.agents/hooks/sync.py' --install --quiet"
 {%- endif %}
 {%- if agent_hooks_layer %}
 [[hooks.leave]]
-script = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/unlink-project-skills-from-clis.sh'"
-[[hooks.leave]]
 script = "'{% raw %}{{config_root}}{% endraw %}/.agents/hooks/sync.py' --uninstall --quiet"
 {%- endif %}
 
 [[watch_files]]
 patterns = ["AGENTS.md"]
 task = "link-agentfiles"
+[[watch_files]]
+patterns = [".agents/skills.json"]
+task = "skills-sync"
 {% if agent_hooks_layer %}
 # Re-fan-out the agent hooks whenever the single source of truth changes.
 [[watch_files]]
@@ -46,6 +47,10 @@ task = "hooks-sync"
 [tasks.link-agentfiles]
 description = "Symlink all agent files to AGENTS.md"
 run = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh'"
+
+[tasks.skills-sync]
+description = "Sync skills from manifest to local CLI dirs"
+run = "sync-skills.py --scope project"
 {% if agent_hooks_layer %}
 # --- Project-scoped agent hooks + skill fan-out (see .agents/hooks/README.md) ---
 
@@ -60,18 +65,6 @@ run = "'{% raw %}{{config_root}}{% endraw %}/.agents/hooks/sync.py' --check"
 [tasks.hooks-uninstall]
 description = "Remove per-user agent-hook injections (codex/kimi/hermes)"
 run = "'{% raw %}{{config_root}}{% endraw %}/.agents/hooks/sync.py' --uninstall"
-
-[tasks.link-project-skills-to-clis]
-description = "Fan .agents/skills out to each agent CLI; honors local.json defer_to_global + disabled"
-run = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-project-skills-to-clis.sh'"
-
-[tasks.unlink-project-skills-from-clis]
-description = "Remove project skill symlinks from shared per-CLI dirs"
-run = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/unlink-project-skills-from-clis.sh'"
-
-[tasks.skills-relink]
-description = "Re-fan the project skill set to all CLIs"
-run = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-project-skills-to-clis.sh'"
 {% endif %}
 [tasks.hindsight-setup]
 description = "Provision this dev's shared project Hindsight key from 1Password into .env (op inject)"

package/templates/hermes-agent/template/.scripts/heartbeat.sh

@@ -229,6 +229,17 @@ state.update({"source":"hermes-continuous-ticket-sentinel","agent_id":agent_id,"
 tmp = path.with_suffix(path.suffix + ".tmp"); tmp.write_text(json.dumps(state, indent=2, sort_keys=True)+"\n"); tmp.replace(path)
 PYEOF
 
+# Coexistence WIP=1 lease (momo E2/S2.3): don't full-drive if the human-drivable
+# Momo holds it — it's driving the same board. A crashed holder's lease expires
+# (ttl) so the board is never wedged. Release on any exit.
+WIP_LOCK="$RUNTIME/wip-driver.lock"
+if ! python3 "$ROLE_DIR/.scripts/momo-wip-lock.py" acquire "$WIP_LOCK" "hermes:$AGENT_ID" --ttl 3600 >/dev/null 2>&1; then
+  printf '[heartbeat] WIP lease held by Momo — skipping full reconcile pass this tick\n'
+  maybe_checkpoint
+  exit 0
+fi
+trap 'python3 "$ROLE_DIR/.scripts/momo-wip-lock.py" release "$WIP_LOCK" "hermes:$AGENT_ID" >/dev/null 2>&1 || true' EXIT
+
 prompt="$(<"$PROMPT_FILE")"
 set +e
 env HERMES_HOME="$RUNTIME" "$HERMES_BIN" chat -Q --source cron --max-turns 90 -q "$prompt"

package/templates/hermes-agent/template/.scripts/momo-wip-lock.py

@@ -0,0 +1,137 @@
+#!/usr/bin/env python3
+"""momo-wip-lock — shared WIP=1 driver lease so interactive Momo and the Hermes
+sentinel never double-drive one board (momo E2/S2.3, the coexistence gate).
+
+Both drivers acquire the SAME advisory lease (a JSON file, conventionally
+<runtime>/wip-driver.lock) before a board-driving pass. The lease PERSISTS across
+processes — it is deliberately NOT a held flock, because a Momo pass spans many
+separate tool-call/bash invocations over minutes. flock is used only to serialize
+the check-and-set so two acquirers can't race. A lease is respected while its
+heartbeat is fresh (now - heartbeat_at < ttl); a stale lease (holder died without
+releasing) can be stolen after it expires.
+
+Owners are free strings by convention: "momo" (interactive) or
+"hermes:<agent_id>" (the sentinel). WIP=1 is per BOARD == per runtime, so there
+is one lease file per runtime.
+
+Protocol:
+  * Driver start:  acquire <lock> <me>   -> exit 0 → drive; exit 1 → HELD, back off.
+  * While driving: refresh <lock> <me>   periodically (< ttl) so the lease stays fresh.
+  * Driver end:    release <lock> <me>.
+  * A holder that crashed leaves a lease that expires after `ttl`; the next driver
+    acquires it normally (or `--steal` to take an explicitly stale one immediately).
+
+Commands (exit 0 = you hold it; 1 = someone else holds it fresh; 2 = usage/error):
+  acquire <lockfile> <owner> [--ttl S] [--steal]
+  refresh <lockfile> <owner>
+  release <lockfile> <owner>
+  status  <lockfile>                     # always exit 0
+"""
+from __future__ import annotations
+import argparse, fcntl, json, os, socket, sys, tempfile, time
+
+
+def _read(path: str):
+    try:
+        with open(path) as f:
+            return json.load(f)
+    except Exception:
+        return None
+
+
+def _fresh(lease: dict | None, now: float) -> bool:
+    return bool(lease) and (now - lease.get("heartbeat_at", 0)) < lease.get("ttl", 300)
+
+
+def _write_atomic(path: str, data: dict) -> None:
+    d = os.path.dirname(os.path.abspath(path)) or "."
+    fd, tmp = tempfile.mkstemp(dir=d)
+    with os.fdopen(fd, "w") as f:
+        json.dump(data, f)
+    os.replace(tmp, path)
+
+
+def _guard(lockfile: str):
+    """Sibling .flock file held only for the read-modify-write critical section."""
+    g = open(lockfile + ".flock", "a")
+    fcntl.flock(g, fcntl.LOCK_EX)
+    return g
+
+
+def acquire(lockfile: str, owner: str, ttl: int, steal: bool) -> int:
+    now = time.time(); g = _guard(lockfile)
+    try:
+        cur = _read(lockfile)
+        if cur and cur.get("owner") != owner and _fresh(cur, now) and not steal:
+            print(f"HELD by {cur['owner']} (fresh, {int(now - cur['heartbeat_at'])}s ago) — back off")
+            return 1
+        started = cur["started_at"] if (cur and cur.get("owner") == owner and "started_at" in cur) else now
+        _write_atomic(lockfile, {
+            "owner": owner, "pid": os.getpid(), "host": socket.gethostname(),
+            "started_at": started, "heartbeat_at": now, "ttl": ttl,
+        })
+        print(f"ACQUIRED by {owner}" + (" (stole stale lease)" if (cur and cur.get('owner') != owner) else ""))
+        return 0
+    finally:
+        fcntl.flock(g, fcntl.LOCK_UN); g.close()
+
+
+def refresh(lockfile: str, owner: str) -> int:
+    now = time.time(); g = _guard(lockfile)
+    try:
+        cur = _read(lockfile)
+        if not cur or cur.get("owner") != owner:
+            print(f"NOT OWNER (held by {cur.get('owner') if cur else 'nobody'}) — cannot refresh")
+            return 1
+        cur["heartbeat_at"] = now
+        _write_atomic(lockfile, cur); print("REFRESHED"); return 0
+    finally:
+        fcntl.flock(g, fcntl.LOCK_UN); g.close()
+
+
+def release(lockfile: str, owner: str) -> int:
+    g = _guard(lockfile)
+    try:
+        cur = _read(lockfile)
+        if cur and cur.get("owner") != owner:
+            print(f"NOT OWNER (held by {cur['owner']}) — not releasing"); return 1
+        try:
+            os.remove(lockfile)
+        except FileNotFoundError:
+            pass
+        print("RELEASED"); return 0
+    finally:
+        fcntl.flock(g, fcntl.LOCK_UN); g.close()
+
+
+def status(lockfile: str) -> int:
+    now = time.time(); cur = _read(lockfile)
+    if not cur:
+        print("FREE (no lease)"); return 0
+    state = "fresh" if _fresh(cur, now) else "STALE"
+    print(f"{cur['owner']} — {state} (heartbeat {int(now - cur.get('heartbeat_at', 0))}s ago, "
+          f"ttl {cur.get('ttl')}s, pid {cur.get('pid')}@{cur.get('host')})")
+    return 0
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("cmd", choices=["acquire", "refresh", "release", "status"])
+    ap.add_argument("lockfile")
+    ap.add_argument("owner", nargs="?")
+    ap.add_argument("--ttl", type=int, default=300, help="freshness window in seconds (default 300)")
+    ap.add_argument("--steal", action="store_true", help="take an explicitly stale lease immediately")
+    a = ap.parse_args()
+    if a.cmd in ("acquire", "refresh", "release") and not a.owner:
+        print("owner required", file=sys.stderr); return 2
+    if a.cmd == "acquire":
+        return acquire(a.lockfile, a.owner, a.ttl, a.steal)
+    if a.cmd == "refresh":
+        return refresh(a.lockfile, a.owner)
+    if a.cmd == "release":
+        return release(a.lockfile, a.owner)
+    return status(a.lockfile)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/templates/hermes-agent/template/.scripts/sentinel.prompt.md.jinja

@@ -31,6 +31,12 @@ on Linear, Plane, or Trello.
 
 ## Pass
 
+**Trigger.** This pass runs both on the cheap heartbeat timer AND on a live
+**Plane board event** — a `bloodbank.evt.v1.repo.<repo>.ticket_*` event delivered
+by the `plane-webhook-bridge`. If a specific ticket event triggered you, FIRST
+`tp get_issue <that ticket>`, read the change, and react to it (triage / refine /
+comment / transition per the lifecycle) before the general reconcile below.
+
 1. Run or explicitly follow the project session-start ritual if one exists.
 2. Reconcile: active milestone (`tp active_milestone`), issues (`tp list_issues`),
    local evidence under `_bmad-output/implementation-artifacts/issue-evidence/`,
@@ -85,6 +91,21 @@ on Linear, Plane, or Trello.
    as done, move on), **held** (back to active), or a genuine **out-of-scope
    blocker** (recorded and waited on). There is no fourth "waiting for the
    operator's sign-off" state.
+
+**Before going idle — always run this protocol (this is the point of the pass):**
+
+- **(a) Unclaimed-work sweep.** If ANY ticket is claimable (`ready`/`unstarted`
+  in the active milestone, no active worker) and WIP allows, run the delegation
+  cycle (step 4) now — never go idle with claimable work sitting on the board.
+- **(b) In-progress status sweep.** For EVERY `started` / `in_review` ticket:
+  request a status update — verify the worker is alive (its zellij session /
+  worktree / recent git activity) and post or refresh a concise status note on
+  the ticket (`tp comment`) with progress + next step. If a ticket is
+  **blocked**, actively try to UNBLOCK it: identify the blocker and act on
+  anything agent-doable (missing AC, a dependency you can drive, a stale worker
+  to re-drive); escalate ONLY a genuine external blocker (step 7). A silent or
+  stalled worker is re-driven or flagged — never left silent.
+
 9. Update `runtime/continuous-ticket-sentinel-state.json`: `active` /
    `blocked` / `idle` / `stalled` with the required fields (`source`, `agent_id`,
    `repo`, `ticket_provider`, `status`, `summary`, `reason`, `updated_at`,

package/templates/hermes-agent/template/SOUL.md.jinja

@@ -17,9 +17,10 @@ You are **{{ display_name }}** — a Hermes agent provisioned to work inside the
 
 You operate **only** within the working directory of `{{ target_repo }}`. You do
 not touch files outside this repo unless the operator explicitly approves it.
-Your HERMES_HOME is the submodule at `./runtime/` (a separate git repo named
-`{{ runtime_repo_owner }}/{{ runtime_repo }}`); everything you change there is
-auto-checkpointed hourly + on session end.
+Your HERMES_HOME is the local runtime at `./runtime/`; Hermes loads its
+`config.yaml` directly. Secrets, SOUL, skills, sessions, and gateway state live
+local to that runtime (pure-local state; durable memory is the shared Hindsight
+bank — see Memory hygiene).
 
 ## Tone
 
@@ -53,12 +54,24 @@ read it before publishing a type you haven't published before.
 ## Role-specific behavior
 
 {% if role == "pm" -%}
-You are the **project manager**. You triage incoming requests from Telegram /
-Bloodbank command lanes, decompose them into discrete tasks on the
-Plane board, and route work to other agents in the fleet (e.g. the dev role
-on `bloodbank.cmd.v1.agent.task.assign` with
-`data.target_agent_id = {{ target_repo }}-dev`). You do not write application
-code. You do not approve merges.
+You are the **project-manager ORCHESTRATOR** — the autonomous Hermes carrier of
+Momo, and the twin of the human-drivable Momo. You share ONE board and ONE
+Hindsight bank with it; stay attributable and never split-brain the state. You
+triage incoming requests from Telegram / Bloodbank command lanes, decompose them
+into discrete tasks on the Plane board, and route work to other agents (e.g. the
+dev role on `bloodbank.cmd.v1.agent.task.assign` with
+`data.target_agent_id = {{ target_repo }}-dev`).
+
+**Prime directives (non-negotiable):**
+- **Never mutate code** — every code change flows through a delegated worker.
+- **WIP = 1**, shared with the human-drivable Momo via the driver lease
+  (`.scripts/momo-wip-lock.py` → `runtime/wip-driver.lock`) — acquire before driving,
+  back off if Momo holds it fresh; never double-drive one board. (The heartbeat
+  enforces this automatically for the reconcile pass.)
+- **Reviewer ≠ implementer** — independent adversarial review is the normal path.
+- **Evidence over status** — a board column is a claim; repo evidence is proof.
+- **Anti-stall** — never park a pass on operator sign-off.
+- You do not write application code. You do not approve merges.
 
 Default execution workflow for implementation delivery: use
 `subagent-driven-development` in kanban-orchestrated codex mode
@@ -114,7 +127,15 @@ declared` event so the fleet knows what to route to you.
 
 ## Memory hygiene
 
-Your memory is the submodule at `./runtime/memories/`. Use Hindsight for
-durable cross-session facts (`hindsight memory retain {{ target_repo }} "…"
---context conventions`). Edit `memories/MEMORY.md` directly for the
-condensed mental-model summary the gateway loads on every session.
+Your durable memory is the shared **Hindsight bank `{{ target_repo }}`** — one
+bank per PROJECT, shared with the human-drivable Momo twin. Honcho and the
+per-agent `runtime/memories/` store are **neutralized** (see `config.yaml`
+`memory.provider: ""`): do not rely on `MEMORY.md`/`USER.md`. Retain with
+`hindsight memory retain {{ target_repo }} "…" --context <cat>`; recall with
+`hindsight memory recall {{ target_repo }} "…"`.
+
+## Doctrine
+
+Decide on the operator's behalf using **`~/code/33GOD/momo/PILLARS.md`**
+(canonical, priority-ordered). This soul **references** that file; it does not
+copy it. Cite the pillar(s) that drove a consequential call in its decision event.

package/templates/commonproject/template/.mise/scripts/link-project-skills-to-clis.sh

@@ -1,110 +0,0 @@
-#!/bin/bash
-# Fan the project's enabled skill set out to every agent CLI that does NOT read
-# .agents/ natively, as per-skill symlinks.
-#
-#   SSOT:    .agents/skills/   (committed inherited skills + on-enter ./skills/* links)
-#   Targets: a table of per-CLI skill dirs, each with a SCOPE:
-#     global -> a shared per-user dir (e.g. ~/.codex/skills): link ours in, never
-#               clobber foreign entries, removed on leave (unlink-*-from-clis.sh).
-#     local  -> a project-scoped mirror dir (e.g. ./.kimi-code/skills) that is fully
-#               ours: stale real copies / foreign symlinks are replaced, and
-#               disabled/deferred skills are pruned. Persists across leave.
-#
-# Per-dev controls — .agents/local.json (see .agents/local.example.json):
-#   skills.disabled[]       never link these
-#   skills.defer_to_global  if true, skip any skill that ALSO exists in your global
-#                           SSOT (~/.agents/skills) so your global copy wins and you
-#                           get zero duplicates. Teammates omit it → inherit all.
-#
-# Add a CLI: append one "dir|scope" line to SKILL_TARGETS. That's the whole change.
-set -euo pipefail
-
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-project_root="$(cd "${script_dir}/../.." && pwd)"
-agents_skills="${project_root}/.agents/skills"
-
-SKILL_TARGETS=(
-  "${CODEX_HOME:-$HOME/.codex}/skills|global"
-  "${project_root}/.kimi-code/skills|local"
-)
-
-local_config="${project_root}/.agents/hooks/lib/local-config.sh"
-if [ -f "$local_config" ]; then
-  # shellcheck source=/dev/null
-  source "$local_config"
-else
-  skill_disabled() { return 1; }
-  skills_defer_to_global() { return 1; }
-  skill_is_global() { return 1; }
-fi
-
-if [ ! -d "$agents_skills" ]; then
-  echo "No .agents/skills/ found. Nothing to fan out."
-  exit 0
-fi
-
-defer=0
-skills_defer_to_global && defer=1
-
-# Should this skill be skipped (disabled, or deferred to the dev's global system)?
-is_skipped() {
-  local name="$1"
-  skill_disabled "$name" && return 0
-  [ "$defer" = "1" ] && skill_is_global "$name" && return 0
-  return 1
-}
-
-# readlink with any trailing slash stripped (older links were stored with one).
-_readlink_norm() {
-  local l; l="$(readlink "$1" 2>/dev/null || echo "")"
-  printf '%s' "${l%/}"
-}
-
-link_into() {
-  local dir="$1" scope="$2" linked=0 skipped=0 pruned=0
-  mkdir -p "$dir"
-  for skill_path in "$agents_skills"/*; do
-    [ -d "$skill_path" ] || continue
-    local name target
-    name="$(basename "$skill_path")"
-    [[ "$name" == ".system" ]] && continue
-    target="${dir}/${name}"
-
-    if is_skipped "$name"; then
-      # Yield the slot: remove a link WE previously made (so the dev's global copy
-      # can claim it), and prune stale entries from our fully-managed mirror.
-      if [ -L "$target" ] && [ "$(_readlink_norm "$target")" = "$skill_path" ]; then
-        rm -f "$target"
-        pruned=$((pruned + 1))
-      elif [ "$scope" = "local" ] && { [ -L "$target" ] || [ -e "$target" ]; }; then
-        rm -rf "$target"
-        pruned=$((pruned + 1))
-      fi
-      skipped=$((skipped + 1))
-      continue
-    fi
-
-    if [ -L "$target" ] && [ "$(_readlink_norm "$target")" = "$skill_path" ]; then
-      linked=$((linked + 1))
-      continue
-    fi
-
-    if [ -e "$target" ] || [ -L "$target" ]; then
-      if [ "$scope" = "local" ]; then
-        rm -rf "$target"            # our mirror: replace stale copy / foreign link
-      else
-        skipped=$((skipped + 1))    # shared dir: leave foreign entries untouched
-        continue
-      fi
-    fi
-
-    ln -s "$skill_path" "$target"
-    linked=$((linked + 1))
-  done
-  echo "  ${dir} (${scope}): ${linked} linked, ${skipped} skipped, ${pruned} pruned"
-}
-
-echo "Fanning .agents/skills -> agent CLIs (defer_to_global=${defer})"
-for entry in "${SKILL_TARGETS[@]}"; do
-  link_into "${entry%%|*}" "${entry##*|}"
-done