@delorenj/pjangler 1.2.19 → 1.2.25

package/templates/hermes-agent/template/.scripts/99-summary.sh

@@ -5,7 +5,6 @@ source "$(dirname "$0")/_lib.sh"
 load_role_env
 
 GW_UNIT="hermes-${AGENT_ID}-gateway.service"
-CSM_UNIT="hermes-${AGENT_ID}-consumer.service"
 HB_TIMER="hermes-${AGENT_ID}-heartbeat.timer"
 
 cat >&2 <<EOF
@@ -15,18 +14,16 @@ cat >&2 <<EOF
 │  Talk:        @$BOT_HANDLE  (Telegram DM)
 │  Shell:       $ROLE_DIR/hermes chat "status"
 │  Board:       $PLANE_BASE/$PLANE_WORKSPACE/projects/$(cat "$ROLE_DIR/.scripts/.plane-project-id" 2>/dev/null || echo "(skipped)")
-│  Runtime:     gh:$RUNTIME_REPO   (reconcile + checkpoint heartbeat)
+│  Runtime:     $ROLE_DIR/runtime   (pure-local, ignored)
 │  Hermes bin:  $HERMES_BIN
 │  Fleet env:   $FLEET_ENV
 │
 │  Start fleet daemons:
 │    systemctl --user start $GW_UNIT
-│    systemctl --user start $CSM_UNIT
 │    systemctl --user start $HB_TIMER
 │
 │  Tail logs:
 │    journalctl --user -fu $GW_UNIT
-│    journalctl --user -fu $CSM_UNIT
 │
 │  Fleet status:
 │    python3 -c "import yaml,pathlib; print(yaml.safe_dump(yaml.safe_load(pathlib.Path('$REGISTRY_FILE').read_text())['agents']))"

package/templates/hermes-agent/template/.scripts/_lib.sh

@@ -145,10 +145,17 @@ if [[ -f "$FLEET_ENV" ]]; then
   # shellcheck disable=SC1090
   source "$FLEET_ENV"
 fi
+# Identity-bearing chat credentials are never fleet-scoped. Platform wiring
+# steps capture explicit invocation values before sourcing this library and
+# restore only those values afterward; all other provisioning steps stay clean.
+unset TELEGRAM_BOT_TOKEN SLACK_BOT_TOKEN SLACK_APP_TOKEN
 
 # Tools we expect on the host
 HERMES_BIN="${HERMES_BIN:-${HERMES_FLEET_BIN:-$(config_get fleet.hermes_bin "$HOME/.hermes/hermes-agent/.venv/bin/hermes")}}"
 HERMES_AGENT_REPO="${HERMES_AGENT_REPO:-${HERMES_FLEET_REPO:-$(config_get fleet.hermes_repo "$HOME/.hermes/hermes-agent")}}"
+HERMES_RUNTIME_GIT_URL="${HERMES_RUNTIME_GIT_URL:-$(config_get fleet.hermes_git_url 'https://github.com/delorenj/hermes-agent.git')}"
+HERMES_RUNTIME_GIT_REF="${HERMES_RUNTIME_GIT_REF:-$(config_get fleet.hermes_git_ref 'feature/PJAN-19-routing-publication')}"
+HERMES_RUNTIME_GIT_SHA="${HERMES_RUNTIME_GIT_SHA:-$(config_get fleet.hermes_git_sha '113e1b182b6d72a7dd02a191f134a41668ceaf0e')}"
 HERMES_OAUTH_FILE="${HERMES_OAUTH_FILE:-${HERMES_FLEET_OAUTH_FILE:-$(config_get fleet.oauth_file "$HOME/.hermes/auth.json")}}"
 CODEX_HOME="${CODEX_HOME:-${HERMES_FLEET_CODEX_HOME:-$(config_get fleet.codex_home "$HOME/.codex")}}"
 # Prefer a scaffold vendored into this agent directory; fall back to the configured template path.
@@ -158,6 +165,29 @@ if [[ ! -d "$RUNTIME_SCAFFOLD_DIR" ]]; then
 fi
 REGISTRY_FILE="${REGISTRY_FILE:-${HERMES_FLEET_REGISTRY_FILE:-$(config_get fleet.registry_file "$HOME/.hermes/agents-registry.yaml")}}"
 
+# Cross-process serialization for fleet identity claims and registry updates.
+# The lock file may remain on disk; flock ownership is kernel-scoped, so a
+# crashed provisioner cannot leave a permanently stale lock.
+FLEET_LOCK_FD=""
+fleet_lock_acquire() {
+  command -v flock >/dev/null 2>&1 || die "flock is required for safe fleet registry updates"
+  local lock_file="${REGISTRY_FILE}.lock"
+  mkdir -p "$(dirname "$lock_file")"
+  [[ ! -L "$lock_file" ]] || die "refusing fleet lock symlink: $lock_file"
+  exec {FLEET_LOCK_FD}>"$lock_file"
+  chmod 600 "$lock_file"
+  flock -w "${FLEET_LOCK_TIMEOUT_SECONDS:-30}" "$FLEET_LOCK_FD" \
+    || die "timed out waiting for fleet registry lock: $lock_file"
+}
+
+fleet_lock_release() {
+  if [[ "${FLEET_LOCK_FD:-}" =~ ^[0-9]+$ ]]; then
+    flock -u "$FLEET_LOCK_FD" 2>/dev/null || true
+    eval "exec ${FLEET_LOCK_FD}>&-"
+  fi
+  FLEET_LOCK_FD=""
+}
+
 # Bloodbank / NATS
 BLOODBANK_NATS_HOST="${BLOODBANK_NATS_HOST:-$(config_get bloodbank.nats_host '127.0.0.1')}"
 BLOODBANK_NATS_PORT="${BLOODBANK_NATS_PORT:-$(config_get bloodbank.nats_port '4222')}"
@@ -167,7 +197,8 @@ BLOODBANK_COMPOSE_DIR="${BLOODBANK_COMPOSE_DIR:-$(config_get bloodbank.compose_d
 PLANE_BASE="${PLANE_BASE:-$(config_get plane.base 'https://plane.delo.sh')}"
 PLANE_API_KEY="${PLANE_API_KEY:-${PLANE_33GOD_API_KEY:-}}"
 
-export FLEET_ENV HERMES_BIN HERMES_AGENT_REPO HERMES_OAUTH_FILE CODEX_HOME \
+export FLEET_ENV HERMES_BIN HERMES_AGENT_REPO HERMES_RUNTIME_GIT_URL \
+       HERMES_RUNTIME_GIT_REF HERMES_RUNTIME_GIT_SHA HERMES_OAUTH_FILE CODEX_HOME \
        RUNTIME_SCAFFOLD_DIR REGISTRY_FILE \
        BLOODBANK_NATS_HOST BLOODBANK_NATS_PORT BLOODBANK_COMPOSE_DIR \
        PLANE_BASE PLANE_API_KEY
@@ -180,6 +211,40 @@ systemd_user_available() {
   [[ "$state" =~ ^(running|degraded|starting|maintenance)$ ]]
 }
 
+# Query one systemd user-unit state without conflating every non-zero exit with
+# an inactive/disabled unit. Output is `ok|<state>` only for documented
+# state/exit-code pairs; D-Bus, manager, and arbitrary query failures become
+# `error|<safe summary>` so retirement callers can fail closed.
+systemctl_user_unit_state() {
+  local query="$1" unit="$2" output rc first_line
+  command -v systemctl >/dev/null 2>&1 \
+    || { printf 'error|systemctl unavailable'; return 0; }
+  set +e
+  output="$(LC_ALL=C systemctl --user "$query" "$unit" 2>&1)"
+  rc=$?
+  set -e
+  first_line="${output%%$'\n'*}"
+  first_line="${first_line//$'\t'/ }"
+  first_line="${first_line//|/}"
+  case "$query:$rc:$first_line" in
+    is-active:0:active|is-active:0:reloading|is-active:0:activating|is-active:0:deactivating)
+      printf 'ok|%s' "$first_line" ;;
+    is-active:3:inactive|is-active:3:failed)
+      printf 'ok|%s' "$first_line" ;;
+    is-active:4:inactive)
+      printf 'ok|not-found' ;;
+    is-enabled:0:enabled|is-enabled:0:enabled-runtime|is-enabled:0:linked|is-enabled:0:linked-runtime|is-enabled:0:alias|is-enabled:0:static|is-enabled:0:indirect|is-enabled:0:generated|is-enabled:0:transient)
+      printf 'ok|%s' "$first_line" ;;
+    is-enabled:1:disabled|is-enabled:1:masked|is-enabled:1:masked-runtime)
+      printf 'ok|%s' "$first_line" ;;
+    is-enabled:4:not-found)
+      printf 'ok|not-found' ;;
+    *)
+      [[ -n "$first_line" ]] || first_line="exit $rc with no state"
+      printf 'error|%s' "$first_line" ;;
+  esac
+}
+
 # Resolve project repo path (the repo that holds agents/hermes/<role>/).
 # Walk up from $ROLE_DIR until we find a git root that isn't us.
 project_repo_path() {

package/templates/hermes-agent/template/.scripts/checkpoint.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Auto-checkpoint commit for the agent's runtime submodule.
+# Legacy checkpoint compatibility for installations whose runtime is still a
+# nested Git repository. Pure-local runtimes intentionally skip this script.
 # Idempotent — exits 0 with no commit if there are no changes.
 #
 # Secret-scan gate (PJAN): before committing, the staged diff is scanned for
@@ -11,7 +12,7 @@ set -euo pipefail
 RUNTIME_DIR="$(cd "$(dirname "$0")/../runtime" && pwd)"
 cd "$RUNTIME_DIR"
 
-# Skip if not a git repo (e.g. submodule not initialized)
+# Skip when the pure-local runtime has no Git metadata.
 [[ -d .git || -f .git ]] || exit 0
 
 # Returns 0 when the staged diff looks clean, 1 when a likely secret is present.

package/templates/hermes-agent/template/.scripts/config.example.toml

@@ -13,8 +13,13 @@
 [fleet]
 # Absolute path to the shared Hermes executable every agent launcher execs.
 hermes_bin = "~/.hermes/hermes-agent/.venv/bin/hermes"
-# Checkout of the hermes-agent repo. Its .venv is used to install nats-py, etc.
+# Checkout of the shared hermes-agent repo.
 hermes_repo = "~/.hermes/hermes-agent"
+# Reviewed fleet runtime publication. Provisioning metadata and clean installs
+# must agree on this fork/ref/SHA; do not substitute upstream main.
+hermes_git_url = "https://github.com/delorenj/hermes-agent.git"
+hermes_git_ref = "feature/PJAN-19-routing-publication"
+hermes_git_sha = "113e1b182b6d72a7dd02a191f134a41668ceaf0e"
 # Fallback runtime scaffold dir — used only when an agent's vendored
 # ./.runtime-scaffold is missing.
 runtime_scaffold_dir = "~/code/hermes-agent-template/runtime-scaffold"
@@ -45,17 +50,12 @@ symlinked_runtime_skills = [
 ]
 
 [github]
-# Owner of the per-agent runtime repos (creates <owner>/agent-hm-<repo>-<role>).
-runtime_repo_owner = "delorenj"
+# LEGACY INERT COMPATIBILITY METADATA ONLY. Older role manifests may still
+# carry this owner field. Current provisioning does not create, attach,
+# synchronize, restore, archive, or remove runtime storage from this value.
+runtime_repo_owner = ""
 
 [plane]
 # Plane instance base URL and workspace slug (one project per agent).
 base = "https://plane.delo.sh"
 workspace = "33god"
-
-[bloodbank]
-# NATS endpoint the consumer connects to.
-nats_host = "127.0.0.1"
-nats_port = 4222
-# Where the bloodbank docker compose lives (used only for a hint message). ~ ok.
-compose_dir = "~/code/33GOD/bloodbank"

package/templates/hermes-agent/template/.scripts/heartbeat.sh

@@ -8,7 +8,7 @@
 # full pass executes the role's sentinel.prompt.md, which reasons about tickets
 # through the ticket-provider adapter (Linear | Plane | Trello) — never a
 # hardcoded backend. After the sentinel decision (skip OR full), it
-# opportunistically checkpoints the runtime submodule (commit+push) at most once
+# opportunistically checkpoints only legacy nested-Git runtimes at most once
 # per HEARTBEAT_CHECKPOINT_MIN_INTERVAL_SECONDS, so memory/session state stays
 # durable without pushing every minute.
 set -euo pipefail
@@ -229,6 +229,17 @@ state.update({"source":"hermes-continuous-ticket-sentinel","agent_id":agent_id,"
 tmp = path.with_suffix(path.suffix + ".tmp"); tmp.write_text(json.dumps(state, indent=2, sort_keys=True)+"\n"); tmp.replace(path)
 PYEOF
 
+# Coexistence WIP=1 lease (momo E2/S2.3): don't full-drive if the human-drivable
+# Momo holds it — it's driving the same board. A crashed holder's lease expires
+# (ttl) so the board is never wedged. Release on any exit.
+WIP_LOCK="$RUNTIME/wip-driver.lock"
+if ! python3 "$ROLE_DIR/.scripts/momo-wip-lock.py" acquire "$WIP_LOCK" "hermes:$AGENT_ID" --ttl 3600 >/dev/null 2>&1; then
+  printf '[heartbeat] WIP lease held by Momo — skipping full reconcile pass this tick\n'
+  maybe_checkpoint
+  exit 0
+fi
+trap 'python3 "$ROLE_DIR/.scripts/momo-wip-lock.py" release "$WIP_LOCK" "hermes:$AGENT_ID" >/dev/null 2>&1 || true' EXIT
+
 prompt="$(<"$PROMPT_FILE")"
 set +e
 env HERMES_HOME="$RUNTIME" "$HERMES_BIN" chat -Q --source cron --max-turns 90 -q "$prompt"

package/templates/hermes-agent/template/.scripts/momo-wip-lock.py

@@ -0,0 +1,137 @@
+#!/usr/bin/env python3
+"""momo-wip-lock — shared WIP=1 driver lease so interactive Momo and the Hermes
+sentinel never double-drive one board (momo E2/S2.3, the coexistence gate).
+
+Both drivers acquire the SAME advisory lease (a JSON file, conventionally
+<runtime>/wip-driver.lock) before a board-driving pass. The lease PERSISTS across
+processes — it is deliberately NOT a held flock, because a Momo pass spans many
+separate tool-call/bash invocations over minutes. flock is used only to serialize
+the check-and-set so two acquirers can't race. A lease is respected while its
+heartbeat is fresh (now - heartbeat_at < ttl); a stale lease (holder died without
+releasing) can be stolen after it expires.
+
+Owners are free strings by convention: "momo" (interactive) or
+"hermes:<agent_id>" (the sentinel). WIP=1 is per BOARD == per runtime, so there
+is one lease file per runtime.
+
+Protocol:
+  * Driver start:  acquire <lock> <me>   -> exit 0 → drive; exit 1 → HELD, back off.
+  * While driving: refresh <lock> <me>   periodically (< ttl) so the lease stays fresh.
+  * Driver end:    release <lock> <me>.
+  * A holder that crashed leaves a lease that expires after `ttl`; the next driver
+    acquires it normally (or `--steal` to take an explicitly stale one immediately).
+
+Commands (exit 0 = you hold it; 1 = someone else holds it fresh; 2 = usage/error):
+  acquire <lockfile> <owner> [--ttl S] [--steal]
+  refresh <lockfile> <owner>
+  release <lockfile> <owner>
+  status  <lockfile>                     # always exit 0
+"""
+from __future__ import annotations
+import argparse, fcntl, json, os, socket, sys, tempfile, time
+
+
+def _read(path: str):
+    try:
+        with open(path) as f:
+            return json.load(f)
+    except Exception:
+        return None
+
+
+def _fresh(lease: dict | None, now: float) -> bool:
+    return bool(lease) and (now - lease.get("heartbeat_at", 0)) < lease.get("ttl", 300)
+
+
+def _write_atomic(path: str, data: dict) -> None:
+    d = os.path.dirname(os.path.abspath(path)) or "."
+    fd, tmp = tempfile.mkstemp(dir=d)
+    with os.fdopen(fd, "w") as f:
+        json.dump(data, f)
+    os.replace(tmp, path)
+
+
+def _guard(lockfile: str):
+    """Sibling .flock file held only for the read-modify-write critical section."""
+    g = open(lockfile + ".flock", "a")
+    fcntl.flock(g, fcntl.LOCK_EX)
+    return g
+
+
+def acquire(lockfile: str, owner: str, ttl: int, steal: bool) -> int:
+    now = time.time(); g = _guard(lockfile)
+    try:
+        cur = _read(lockfile)
+        if cur and cur.get("owner") != owner and _fresh(cur, now) and not steal:
+            print(f"HELD by {cur['owner']} (fresh, {int(now - cur['heartbeat_at'])}s ago) — back off")
+            return 1
+        started = cur["started_at"] if (cur and cur.get("owner") == owner and "started_at" in cur) else now
+        _write_atomic(lockfile, {
+            "owner": owner, "pid": os.getpid(), "host": socket.gethostname(),
+            "started_at": started, "heartbeat_at": now, "ttl": ttl,
+        })
+        print(f"ACQUIRED by {owner}" + (" (stole stale lease)" if (cur and cur.get('owner') != owner) else ""))
+        return 0
+    finally:
+        fcntl.flock(g, fcntl.LOCK_UN); g.close()
+
+
+def refresh(lockfile: str, owner: str) -> int:
+    now = time.time(); g = _guard(lockfile)
+    try:
+        cur = _read(lockfile)
+        if not cur or cur.get("owner") != owner:
+            print(f"NOT OWNER (held by {cur.get('owner') if cur else 'nobody'}) — cannot refresh")
+            return 1
+        cur["heartbeat_at"] = now
+        _write_atomic(lockfile, cur); print("REFRESHED"); return 0
+    finally:
+        fcntl.flock(g, fcntl.LOCK_UN); g.close()
+
+
+def release(lockfile: str, owner: str) -> int:
+    g = _guard(lockfile)
+    try:
+        cur = _read(lockfile)
+        if cur and cur.get("owner") != owner:
+            print(f"NOT OWNER (held by {cur['owner']}) — not releasing"); return 1
+        try:
+            os.remove(lockfile)
+        except FileNotFoundError:
+            pass
+        print("RELEASED"); return 0
+    finally:
+        fcntl.flock(g, fcntl.LOCK_UN); g.close()
+
+
+def status(lockfile: str) -> int:
+    now = time.time(); cur = _read(lockfile)
+    if not cur:
+        print("FREE (no lease)"); return 0
+    state = "fresh" if _fresh(cur, now) else "STALE"
+    print(f"{cur['owner']} — {state} (heartbeat {int(now - cur.get('heartbeat_at', 0))}s ago, "
+          f"ttl {cur.get('ttl')}s, pid {cur.get('pid')}@{cur.get('host')})")
+    return 0
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("cmd", choices=["acquire", "refresh", "release", "status"])
+    ap.add_argument("lockfile")
+    ap.add_argument("owner", nargs="?")
+    ap.add_argument("--ttl", type=int, default=300, help="freshness window in seconds (default 300)")
+    ap.add_argument("--steal", action="store_true", help="take an explicitly stale lease immediately")
+    a = ap.parse_args()
+    if a.cmd in ("acquire", "refresh", "release") and not a.owner:
+        print("owner required", file=sys.stderr); return 2
+    if a.cmd == "acquire":
+        return acquire(a.lockfile, a.owner, a.ttl, a.steal)
+    if a.cmd == "refresh":
+        return refresh(a.lockfile, a.owner)
+    if a.cmd == "release":
+        return release(a.lockfile, a.owner)
+    return status(a.lockfile)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/templates/hermes-agent/template/.scripts/sentinel.prompt.md.jinja

@@ -31,6 +31,12 @@ on Linear, Plane, or Trello.
 
 ## Pass
 
+**Trigger.** This pass runs both on the cheap heartbeat timer AND on a live
+**Plane board event** — a `bloodbank.evt.v1.repo.<repo>.ticket_*` event delivered
+by the `plane-webhook-bridge`. If a specific ticket event triggered you, FIRST
+`tp get_issue <that ticket>`, read the change, and react to it (triage / refine /
+comment / transition per the lifecycle) before the general reconcile below.
+
 1. Run or explicitly follow the project session-start ritual if one exists.
 2. Reconcile: active milestone (`tp active_milestone`), issues (`tp list_issues`),
    local evidence under `_bmad-output/implementation-artifacts/issue-evidence/`,
@@ -85,6 +91,21 @@ on Linear, Plane, or Trello.
    as done, move on), **held** (back to active), or a genuine **out-of-scope
    blocker** (recorded and waited on). There is no fourth "waiting for the
    operator's sign-off" state.
+
+**Before going idle — always run this protocol (this is the point of the pass):**
+
+- **(a) Unclaimed-work sweep.** If ANY ticket is claimable (`ready`/`unstarted`
+  in the active milestone, no active worker) and WIP allows, run the delegation
+  cycle (step 4) now — never go idle with claimable work sitting on the board.
+- **(b) In-progress status sweep.** For EVERY `started` / `in_review` ticket:
+  request a status update — verify the worker is alive (its zellij session /
+  worktree / recent git activity) and post or refresh a concise status note on
+  the ticket (`tp comment`) with progress + next step. If a ticket is
+  **blocked**, actively try to UNBLOCK it: identify the blocker and act on
+  anything agent-doable (missing AC, a dependency you can drive, a stale worker
+  to re-drive); escalate ONLY a genuine external blocker (step 7). A silent or
+  stalled worker is re-driven or flagged — never left silent.
+
 9. Update `runtime/continuous-ticket-sentinel-state.json`: `active` /
    `blocked` / `idle` / `stalled` with the required fields (`source`, `agent_id`,
    `repo`, `ticket_provider`, `status`, `summary`, `reason`, `updated_at`,

package/templates/hermes-agent/template/SOUL.md.jinja

@@ -17,9 +17,10 @@ You are **{{ display_name }}** — a Hermes agent provisioned to work inside the
 
 You operate **only** within the working directory of `{{ target_repo }}`. You do
 not touch files outside this repo unless the operator explicitly approves it.
-Your HERMES_HOME is the submodule at `./runtime/` (a separate git repo named
-`{{ runtime_repo_owner }}/{{ runtime_repo }}`); everything you change there is
-auto-checkpointed hourly + on session end.
+Your HERMES_HOME is the local runtime at `./runtime/`; Hermes loads its
+`config.yaml` directly. Secrets, SOUL, skills, sessions, and gateway state live
+local to that runtime (pure-local state; durable memory is the shared Hindsight
+bank — see Memory hygiene).
 
 ## Tone
 
@@ -43,8 +44,8 @@ question — not three vague ones.
 You **MUST** emit a Bloodbank event for every consequential action you take.
 Envelope shape: CloudEvents 1.0, type `bloodbank.v1.<domain>.<entity>.<action>`,
 `actor.agent_id = {{ agent_id }}`, `producer = hermes-agent:{{ agent_id }}`,
-`source = hermes://agent/{{ agent_id }}`. The consumer in `./runtime/` already
-imports the envelope helper.
+`source = hermes://agent/{{ agent_id }}`. Inbound commands arrive through the
+fleet-shared Hermes gateway and are routed by `data.target_agent_id`.
 
 You **MUST NOT** invent new event `type` values. Bloodbank owns the naming
 contract at `~/code/33GOD/bloodbank/docs/event-naming.md` —
@@ -53,12 +54,24 @@ read it before publishing a type you haven't published before.
 ## Role-specific behavior
 
 {% if role == "pm" -%}
-You are the **project manager**. You triage incoming requests from Telegram /
-Bloodbank command lanes, decompose them into discrete tasks on the
-Plane board, and route work to other agents in the fleet (e.g. the dev role
-on `bloodbank.cmd.v1.agent.task.assign` with
-`data.target_agent_id = {{ target_repo }}-dev`). You do not write application
-code. You do not approve merges.
+You are the **project-manager ORCHESTRATOR** — the autonomous Hermes carrier of
+Momo, and the twin of the human-drivable Momo. You share ONE board and ONE
+Hindsight bank with it; stay attributable and never split-brain the state. You
+triage incoming requests from Telegram / Bloodbank command lanes, decompose them
+into discrete tasks on the Plane board, and route work to other agents (e.g. the
+dev role on `bloodbank.cmd.v1.agent.task.assign` with
+`data.target_agent_id = {{ target_repo }}-dev`).
+
+**Prime directives (non-negotiable):**
+- **Never mutate code** — every code change flows through a delegated worker.
+- **WIP = 1**, shared with the human-drivable Momo via the driver lease
+  (`.scripts/momo-wip-lock.py` → `runtime/wip-driver.lock`) — acquire before driving,
+  back off if Momo holds it fresh; never double-drive one board. (The heartbeat
+  enforces this automatically for the reconcile pass.)
+- **Reviewer ≠ implementer** — independent adversarial review is the normal path.
+- **Evidence over status** — a board column is a claim; repo evidence is proof.
+- **Anti-stall** — never park a pass on operator sign-off.
+- You do not write application code. You do not approve merges.
 
 Default execution workflow for implementation delivery: use
 `subagent-driven-development` in kanban-orchestrated codex mode
@@ -114,7 +127,15 @@ declared` event so the fleet knows what to route to you.
 
 ## Memory hygiene
 
-Your memory is the submodule at `./runtime/memories/`. Use Hindsight for
-durable cross-session facts (`hindsight memory retain {{ target_repo }} "…"
---context conventions`). Edit `memories/MEMORY.md` directly for the
-condensed mental-model summary the gateway loads on every session.
+Your durable memory is the shared **Hindsight bank `{{ target_repo }}`** — one
+bank per PROJECT, shared with the human-drivable Momo twin. Honcho and the
+per-agent `runtime/memories/` store are **neutralized** (see `config.yaml`
+`memory.provider: ""`): do not rely on `MEMORY.md`/`USER.md`. Retain with
+`hindsight memory retain {{ target_repo }} "…" --context <cat>`; recall with
+`hindsight memory recall {{ target_repo }} "…"`.
+
+## Doctrine
+
+Decide on the operator's behalf using **`~/code/33GOD/momo/PILLARS.md`**
+(canonical, priority-ordered). This soul **references** that file; it does not
+copy it. Cite the pillar(s) that drove a consequential call in its decision event.

package/templates/hermes-agent/template/hermes.jinja

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Launcher for {{ agent_id }}. Resolves HERMES_HOME to the runtime submodule
+# Launcher for {{ agent_id }}. Resolves HERMES_HOME to the local runtime
 # and execs the shared fleet Hermes binary configured in ~/.hermes/fleet.env.
 
 set -euo pipefail
@@ -12,6 +12,9 @@ if [[ -f "$FLEET_ENV" ]]; then
   # shellcheck disable=SC1090
   source "$FLEET_ENV"
 fi
+# Never pass an identity-bearing chat credential from shared fleet state into
+# a profile process. Hermes loads the profile's own runtime/.env itself.
+unset TELEGRAM_BOT_TOKEN SLACK_BOT_TOKEN SLACK_APP_TOKEN
 
 CONFIG="${HERMES_TEMPLATE_CONFIG:-${XDG_CONFIG_HOME:-$HOME/.config}/hermes-agent-template/config.toml}"
 config_get() {
@@ -49,8 +52,8 @@ HERMES_OAUTH_FILE="${HERMES_OAUTH_FILE:-${HERMES_FLEET_OAUTH_FILE:-$(config_get
 CODEX_HOME="${CODEX_HOME:-${HERMES_FLEET_CODEX_HOME:-$(config_get fleet.codex_home "$HOME/.codex")}}"
 
 if [[ ! -d "$HERMES_HOME" ]]; then
-  echo "hermes: runtime submodule not initialized at $HERMES_HOME" >&2
-  echo "  fix: git submodule update --init --recursive" >&2
+  echo "hermes: local runtime not provisioned at $HERMES_HOME" >&2
+  echo "  fix: run $ROLE_DIR/.scripts/20-runtime-repo.sh" >&2
   exit 1
 fi
 

package/templates/hermes-agent/template/role.yaml.jinja

@@ -1,6 +1,6 @@
 # Hermes agent role manifest.  Tracked in the PROJECT repository.
 # The agent's actual state (memory, sessions, evolving SOUL) lives in the
-# runtime submodule.  This file is the immutable contract for this role.
+# ignored local runtime. This file is the immutable contract for this role.
 
 repo: {{ target_repo }}
 role: {{ role }}
@@ -14,12 +14,24 @@ model:
   name: "{{ model_name }}"
 
 # Hermes profile name. ~/.hermes/profiles/<name> symlinks to ./runtime/, so both
-# HERMES_HOME and `hermes --profile <name>` resolve to the runtime submodule.
+# HERMES_HOME and `hermes --profile <name>` resolve to the local runtime.
 profile: {{ agent_id }}
 
 # Telegram bot identity (one bot per agent — see docs/architecture.md).
 telegram:
+  provisioning_status: "deferred"
   bot_username: "{{ bot_handle }}"
+  bot_id: ""
+
+# Slack is opt-in. Credentials live only in runtime/.env; this block records
+# safe provisioning state and the verified auth.test identity.
+slack:
+  provisioning_status: "deferred"
+  team_id: ""
+  team_name: ""
+  bot_user_id: ""
+  bot_id: ""
+  bot_username: ""
 
 # Ticket-provider binding (linear | plane | trello).
 # The heartbeat reconciliation pass talks ONLY to this via .scripts/lib/ticket-provider.sh;
@@ -54,25 +66,24 @@ plane:
   # identifier is set by .scripts/42-ticket-provider.sh after creation (plane only)
   identifier: ""
 
-# Bloodbank wiring (consumed + produced subjects).
+# Bloodbank ingress is owned by one fleet-shared Hermes gateway. The gateway
+# reads the fleet registry and routes canonical commands by target_agent_id;
+# this profile does not install its own NATS consumer or inbox bridge.
 bloodbank:
-  subscribe:
-    - "bloodbank.evt.v1.repo.>"
-    - "bloodbank.cmd.v1.agent.>"
-  routing:
-    repo: "{{ target_repo }}"
-    target_agent_id: "{{ agent_id }}"
+  gateway_scope: fleet
+  target_agent_id: "{{ agent_id }}"
   producer: "hermes-agent:{{ agent_id }}"
 
-# Runtime repo (git-tracked HERMES_HOME, auto-checkpointed).
+# Pure-local HERMES_HOME. The legacy GitHub identity remains metadata-only for
+# locating old archives; provisioning never creates or attaches a submodule.
 runtime:
   # Empty owner -> resolved from config.toml [github].runtime_repo_owner.
   github_owner: "{{ runtime_repo_owner }}"
   github_repo: "{{ runtime_repo }}"
-  submodule_path: "./runtime"
+  local_path: "./runtime"
   checkpoint:
-    cadence: "heartbeat"
-    on_session_end: true
+    cadence: "disabled"
+    on_session_end: false
 
 # Provenance — managed by the template, do not hand-edit.
 provisioned_at: "{{ '%Y-%m-%dT%H:%M:%SZ' | strftime }}"