@delorenj/pjangler 1.2.21 → 1.2.25

package/templates/hermes-agent/tests/test_fleet_upgrade_contract.py

@@ -0,0 +1,176 @@
+from __future__ import annotations
+
+import os
+import stat
+import subprocess
+from pathlib import Path
+
+import yaml
+
+
+ROOT = Path(__file__).parents[1]
+FLEET_SYNC = ROOT / "scripts" / "fleet-sync.sh"
+
+
+def _fixture(tmp_path: Path) -> tuple[dict[str, str], Path, Path, Path]:
+    home = tmp_path / "home"
+    role = tmp_path / "role"
+    runtime = role / "runtime"
+    runtime.mkdir(parents=True)
+    (runtime / "profile.yaml").write_text(
+        "config:\n  inherit_from: default\n  save_mode: delta\n", encoding="utf-8"
+    )
+    (role / "role.yaml").write_text("profile: demo-pm\n", encoding="utf-8")
+    registry = tmp_path / "agents-registry.yaml"
+    registry.write_text(
+        yaml.safe_dump(
+            {
+                "schema_version": 1,
+                "agents": {
+                    "demo-pm": {
+                        "role_dir": str(role),
+                        "profile_name": "demo-pm",
+                        "systemd": {
+                            "gateway_unit": "hermes-demo-pm-gateway.service",
+                            "consumer_unit": "hermes-demo-pm-consumer.service",
+                        },
+                    }
+                },
+            },
+            sort_keys=False,
+        ),
+        encoding="utf-8",
+    )
+    unit_dir = home / ".config" / "systemd" / "user"
+    unit_dir.mkdir(parents=True)
+    consumer = unit_dir / "hermes-demo-pm-consumer.service"
+    consumer.write_text("legacy\n", encoding="utf-8")
+    fake_bin = tmp_path / "bin"
+    fake_bin.mkdir()
+    retired = tmp_path / "retired"
+    systemctl = fake_bin / "systemctl"
+    systemctl.write_text(
+        """#!/usr/bin/env bash
+case "$*" in
+  *"disable --now hermes-demo-pm-consumer.service"*)
+    [[ "$SYSTEMCTL_MODE" == "disable-fail" ]] && exit 1
+    touch "$SYSTEMCTL_RETIRED"; exit 0 ;;
+  *"is-active hermes-demo-pm-consumer.service"*)
+    [[ "$SYSTEMCTL_MODE" == "active-query-error" ]] && { echo "Failed to connect to bus" >&2; exit 1; }
+    if [[ -f "$SYSTEMCTL_RETIRED" ]]; then echo inactive; exit 3; else echo active; exit 0; fi ;;
+  *"is-enabled hermes-demo-pm-consumer.service"*)
+    [[ "$SYSTEMCTL_MODE" == "enabled-query-error" ]] && { echo "Failed to connect to bus" >&2; exit 1; }
+    if [[ -f "$SYSTEMCTL_RETIRED" ]]; then echo disabled; exit 1; else echo enabled; exit 0; fi ;;
+  *"daemon-reload"*) exit 0 ;;
+esac
+exit 1
+""",
+        encoding="utf-8",
+    )
+    systemctl.chmod(0o755)
+    env = dict(os.environ)
+    env.update(
+        {
+            "HOME": str(home),
+            "PATH": f"{fake_bin}:{env['PATH']}",
+            "HERMES_FLEET_REGISTRY_FILE": str(registry),
+            "HERMES_FLEET_HOME": str(home / ".hermes"),
+            "SYSTEMCTL_RETIRED": str(retired),
+            "SYSTEMCTL_MODE": "success",
+        }
+    )
+    return env, registry, consumer, role
+
+
+def test_fleet_audit_reports_and_apply_retires_legacy_consumer(tmp_path: Path) -> None:
+    env, registry, consumer, _ = _fixture(tmp_path)
+
+    audit = subprocess.run(
+        ["bash", str(FLEET_SYNC), "--agent", "demo-pm"],
+        env=env,
+        text=True,
+        capture_output=True,
+        check=False,
+    )
+    assert audit.returncode == 1
+    assert "legacy per-profile Bloodbank consumer remains" in audit.stdout
+
+    applied = subprocess.run(
+        ["bash", str(FLEET_SYNC), "--apply", "--no-restart", "--agent", "demo-pm"],
+        env=env,
+        text=True,
+        capture_output=True,
+        check=False,
+    )
+    assert applied.returncode == 0, applied.stdout + applied.stderr
+    assert not consumer.exists()
+    entry = yaml.safe_load(registry.read_text(encoding="utf-8"))["agents"]["demo-pm"]
+    assert "consumer_unit" not in entry["systemd"]
+    assert stat.S_IMODE(registry.stat().st_mode) == 0o600
+
+
+def test_fleet_apply_preserves_unit_and_metadata_when_disable_fails(tmp_path: Path) -> None:
+    env, registry, consumer, _ = _fixture(tmp_path)
+    env["SYSTEMCTL_MODE"] = "disable-fail"
+
+    result = subprocess.run(
+        ["bash", str(FLEET_SYNC), "--apply", "--no-restart", "--agent", "demo-pm"],
+        env=env,
+        text=True,
+        capture_output=True,
+        check=False,
+    )
+
+    assert result.returncode != 0
+    assert "disable failed; unit and metadata preserved" in result.stdout
+    assert consumer.read_text(encoding="utf-8") == "legacy\n"
+    entry = yaml.safe_load(registry.read_text(encoding="utf-8"))["agents"]["demo-pm"]
+    assert entry["systemd"]["consumer_unit"] == "hermes-demo-pm-consumer.service"
+    assert not Path(env["SYSTEMCTL_RETIRED"]).exists()
+
+
+def test_fleet_audit_and_apply_fail_closed_on_state_query_errors(tmp_path: Path) -> None:
+    for mode in ("active-query-error", "enabled-query-error"):
+        case_dir = tmp_path / mode
+        case_dir.mkdir()
+        env, registry, consumer, _ = _fixture(case_dir)
+        env["SYSTEMCTL_MODE"] = mode
+
+        for apply_args in ([], ["--apply", "--no-restart"]):
+            result = subprocess.run(
+                ["bash", str(FLEET_SYNC), *apply_args, "--agent", "demo-pm"],
+                env=env,
+                text=True,
+                capture_output=True,
+                check=False,
+            )
+            assert result.returncode != 0
+            assert "state query failed; unit and metadata preserved" in result.stdout
+            assert consumer.read_text(encoding="utf-8") == "legacy\n"
+            entry = yaml.safe_load(registry.read_text(encoding="utf-8"))["agents"]["demo-pm"]
+            assert entry["systemd"]["consumer_unit"] == "hermes-demo-pm-consumer.service"
+            assert not Path(env["SYSTEMCTL_RETIRED"]).exists()
+
+
+def test_pinned_fork_publication_replaces_upstream_clean_install_path() -> None:
+    installer = (ROOT / "install-local.sh").read_text(encoding="utf-8")
+    config = (ROOT / "template" / ".scripts" / "config.example.toml").read_text(
+        encoding="utf-8"
+    )
+    expected_sha = "113e1b182b6d72a7dd02a191f134a41668ceaf0e"
+
+    assert "raw.githubusercontent.com/NousResearch/hermes-agent" not in installer
+    assert 'HERMES_RUNTIME_GIT_URL="https://github.com/delorenj/hermes-agent.git"' in installer
+    assert 'HERMES_RUNTIME_GIT_REF="feature/PJAN-19-routing-publication"' in installer
+    assert f'HERMES_RUNTIME_GIT_SHA="{expected_sha}"' in installer
+    assert "merge-base --is-ancestor" in installer
+    assert f'hermes_git_sha = "{expected_sha}"' in config
+
+
+def test_runtime_templatizer_pins_canonical_bmad_next31_pack() -> None:
+    templatizer = (ROOT / "scripts" / "hermes-runtime-templatize.py").read_text(
+        encoding="utf-8"
+    )
+
+    assert "/packs/bmad/6.10.1-next.31" in templatizer
+    assert "/packs/bmad/6.10.2" not in templatizer

package/templates/hermes-agent/tests/test_launcher_chat_secret_isolation.py

@@ -0,0 +1,85 @@
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+from pathlib import Path
+
+
+ROOT = Path(__file__).parents[1]
+LAUNCHER_TEMPLATE = ROOT / "template" / "hermes.jinja"
+
+
+def test_launcher_drops_shared_identity_credentials_but_keeps_policy(tmp_path: Path) -> None:
+    home = tmp_path / "home"
+    role = tmp_path / "role"
+    runtime = role / "runtime"
+    runtime.mkdir(parents=True)
+    fleet = home / ".hermes" / "fleet.env"
+    fleet.parent.mkdir(parents=True)
+    fake_hermes = tmp_path / "fake-hermes"
+    fake_hermes.write_text(
+        """#!/usr/bin/env python3
+import json
+import os
+
+keys = (
+    "TELEGRAM_BOT_TOKEN",
+    "SLACK_BOT_TOKEN",
+    "SLACK_APP_TOKEN",
+    "TELEGRAM_ALLOWED_USERS",
+    "SLACK_ALLOWED_USERS",
+    "HERMES_HOME",
+)
+print(json.dumps({key: os.environ.get(key) for key in keys}))
+""",
+        encoding="utf-8",
+    )
+    fake_hermes.chmod(0o755)
+    fleet.write_text(
+        f"export HERMES_FLEET_BIN={fake_hermes}\n"
+        "export TELEGRAM_BOT_TOKEN=123456:shared-secret\n"
+        "export SLACK_BOT_TOKEN=xoxb-shared-secret\n"
+        "export SLACK_APP_TOKEN=xapp-shared-secret\n"
+        "export TELEGRAM_ALLOWED_USERS=111\n"
+        "export SLACK_ALLOWED_USERS=U111\n",
+        encoding="utf-8",
+    )
+    launcher = role / "hermes"
+    launcher.write_text(
+        LAUNCHER_TEMPLATE.read_text(encoding="utf-8").replace("{{ agent_id }}", "demo-pm"),
+        encoding="utf-8",
+    )
+    launcher.chmod(0o755)
+    env = {
+        key: value
+        for key, value in os.environ.items()
+        if key
+        not in {
+            "TELEGRAM_BOT_TOKEN",
+            "SLACK_BOT_TOKEN",
+            "SLACK_APP_TOKEN",
+            "TELEGRAM_ALLOWED_USERS",
+            "SLACK_ALLOWED_USERS",
+            "HERMES_BIN",
+            "HERMES_FLEET_BIN",
+        }
+    }
+    env.update({"HOME": str(home), "HERMES_FLEET_ENV": str(fleet)})
+
+    result = subprocess.run(
+        [str(launcher), "gateway", "run"],
+        env=env,
+        text=True,
+        capture_output=True,
+        check=False,
+    )
+
+    assert result.returncode == 0, result.stderr
+    observed = json.loads(result.stdout)
+    assert observed["TELEGRAM_BOT_TOKEN"] is None
+    assert observed["SLACK_BOT_TOKEN"] is None
+    assert observed["SLACK_APP_TOKEN"] is None
+    assert observed["TELEGRAM_ALLOWED_USERS"] == "111"
+    assert observed["SLACK_ALLOWED_USERS"] == "U111"
+    assert observed["HERMES_HOME"] == str(runtime)

package/templates/hermes-agent/tests/test_local_runtime_provisioning.py

@@ -0,0 +1,130 @@
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+from pathlib import Path
+
+
+ROOT = Path(__file__).parents[1]
+RUNTIME_SCRIPT = ROOT / "template" / ".scripts" / "20-runtime-repo.sh"
+LIB_SCRIPT = ROOT / "template" / ".scripts" / "_lib.sh"
+
+
+def _fixture(tmp_path: Path) -> tuple[Path, Path, dict[str, str]]:
+    project = tmp_path / "project"
+    role = project / "agents" / "hermes" / "pm"
+    scripts = role / ".scripts"
+    scaffold = role / ".runtime-scaffold"
+    scripts.mkdir(parents=True)
+    scaffold.mkdir()
+    shutil.copy2(RUNTIME_SCRIPT, scripts / RUNTIME_SCRIPT.name)
+    shutil.copy2(LIB_SCRIPT, scripts / LIB_SCRIPT.name)
+    (scaffold / "MEMORY.md").write_text("agent={{agent_id}}\n", encoding="utf-8")
+    (role / "SOUL.md").write_text("local soul\n", encoding="utf-8")
+    (role / ".gitignore").write_text("runtime/\n", encoding="utf-8")
+    (role / "role.yaml").write_text(
+        """repo: demo
+role: pm
+agent_id: demo-pm
+display_name: "Demo PM"
+profile: demo-pm
+telegram:
+  bot_username: demo_pm_bot
+plane:
+  workspace: test
+runtime:
+  github_owner: legacy
+  github_repo: agent-hm-demo-pm
+  local_path: ./runtime
+""",
+        encoding="utf-8",
+    )
+    subprocess.run(["git", "init", "--quiet"], cwd=project, check=True)
+
+    home = tmp_path / "home"
+    profiles = home / ".hermes" / "profiles"
+    profiles.mkdir(parents=True)
+    fake_bin = tmp_path / "bin"
+    fake_bin.mkdir()
+    hermes = fake_bin / "hermes"
+    hermes.write_text("#!/usr/bin/env bash\nexit 0\n", encoding="utf-8")
+    hermes.chmod(0o755)
+    env = dict(os.environ)
+    env.update(
+        {
+            "HOME": str(home),
+            "HERMES_BIN": str(hermes),
+            "HERMES_FLEET_ENV": str(home / ".hermes" / "fleet.env"),
+            "RUNTIME_SCAFFOLD_DIR": str(scaffold),
+            "VOXXY_PLUGIN_DIR": str(tmp_path / "missing-voxxy"),
+        }
+    )
+    return project, role, env
+
+
+def _run(role: Path, env: dict[str, str]) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        ["bash", str(role / ".scripts" / "20-runtime-repo.sh")],
+        env=env,
+        text=True,
+        capture_output=True,
+        check=False,
+    )
+
+
+def test_provisioner_creates_ignored_local_runtime_without_git(tmp_path: Path) -> None:
+    project, role, env = _fixture(tmp_path)
+
+    result = _run(role, env)
+
+    assert result.returncode == 0, result.stdout + result.stderr
+    runtime = role / "runtime"
+    assert (runtime / "MEMORY.md").read_text(encoding="utf-8") == "agent=demo-pm\n"
+    assert (runtime / "SOUL.md").read_text(encoding="utf-8") == "local soul\n"
+    assert not (runtime / ".git").exists()
+    assert (Path(env["HOME"]) / ".hermes" / "profiles" / "demo-pm").resolve() == runtime
+    assert subprocess.run(
+        ["git", "check-ignore", "-q", "agents/hermes/pm/runtime/"],
+        cwd=project,
+        check=False,
+    ).returncode == 0
+
+
+def test_provisioner_preserves_existing_runtime_and_refuses_stale_mapping(tmp_path: Path) -> None:
+    project, role, env = _fixture(tmp_path)
+    runtime = role / "runtime"
+    runtime.mkdir()
+    private_state = runtime / "private-state.txt"
+    private_state.write_text("preserve exactly\n", encoding="utf-8")
+    (project / ".gitmodules").write_text(
+        """[submodule "legacy-runtime"]
+\tpath = agents/hermes/pm/runtime
+\turl = git@github.com:example/legacy.git
+""",
+        encoding="utf-8",
+    )
+
+    result = _run(role, env)
+
+    assert result.returncode != 0
+    assert "stale .gitmodules mapping" in result.stderr
+    assert private_state.read_text(encoding="utf-8") == "preserve exactly\n"
+    assert not (runtime / ".git").exists()
+
+
+def test_active_provisioner_has_no_runtime_repo_or_submodule_mutation() -> None:
+    script = RUNTIME_SCRIPT.read_text(encoding="utf-8")
+
+    for forbidden in (
+        "gh repo create",
+        "gh repo view",
+        "git submodule add",
+        "git submodule update",
+        'rm -rf "$RUNTIME_LOCAL"',
+        "git push",
+        "git init",
+    ):
+        assert forbidden not in script
+    assert "stale .gitmodules mapping" in script
+    assert 'cp -an "$TMP/." "$RUNTIME_LOCAL/"' in script

package/templates/hermes-agent/tests/test_operator_docs_local_runtime_contract.py

@@ -0,0 +1,132 @@
+from __future__ import annotations
+
+import re
+import subprocess
+from pathlib import Path
+
+
+ROOT = Path(__file__).parents[1]
+ACTIVE_OPERATOR_SURFACES = (
+    ROOT / "README.md",
+    ROOT / "docs" / "operations.md",
+    ROOT / "docs" / "architecture.md",
+    ROOT / "docs" / "sentinel.md",
+    ROOT / "docs" / "sentinel" / "README.md",
+    ROOT / "docs" / "sentinel" / "architecture.md",
+    ROOT / "docs" / "sentinel" / "development.md",
+    ROOT / "template" / ".scripts" / "config.example.toml",
+)
+
+
+def test_active_operator_surfaces_describe_only_pure_local_runtime() -> None:
+    forbidden = {
+        "per-agent remote runtime name": r"agent-hm-",
+        "active runtime repository": r"(?:github\s+)?runtime repositor(?:y|ies)|runtime repo(?:s)?\b",
+        "runtime submodule": r"runtime.{0,60}submodule|submodule.{0,60}runtime",
+        "runtime LFS": r"git\s+lfs",
+        "runtime push": r"git\s+push|commit\s*\+\s*push",
+        "cascading profile deletion": r"hermes\s+profile\s+delete|cascad(?:e|es|ing)",
+        "blanket runtime deletion": r"rm\s+-rf[^\n]*(?:runtime|agents/hermes|\$RUNTIME|\$ROLE_DIR)",
+        "runtime submodule deletion": r"git\s+submodule\s+deinit|\.git/modules/agents/hermes|git\s+rm[^\n]*runtime",
+        "runtime find deletion": r"find[^\n]*(?:runtime|\$RUNTIME)[^\n]*-delete",
+        "runtime directory removal": r"rmdir[^\n]*(?:runtime|\$RUNTIME)",
+        "runtime deletion confirmation shell": r"read[^\n]*REMOVE LOCAL RUNTIME",
+        "step-20 GitHub creation claim": r"20-runtime-repo\.sh.{0,160}gh\s+repo\s+create",
+    }
+
+    for path in ACTIVE_OPERATOR_SURFACES:
+        content = path.read_text(encoding="utf-8")
+        for label, pattern in forbidden.items():
+            assert re.search(pattern, content, re.IGNORECASE | re.DOTALL) is None, (
+                f"{path.relative_to(ROOT)} contains obsolete {label} guidance"
+            )
+
+
+def test_operations_make_recovery_and_retirement_boundaries_explicit() -> None:
+    operations = (ROOT / "docs" / "operations.md").read_text(encoding="utf-8")
+    normalized = " ".join(operations.split())
+
+    for required in (
+        "does **not** ship automatic backup",
+        "verified filesystem backup",
+        "Hindsight can restore only",
+        "secret manager can restore only",
+        "Retire an agent (preserves runtime by default)",
+        "Profile and service retirement always preserves the local runtime",
+        "This release intentionally provides no automated runtime purge",
+        "separately reviewed, path-safe tool",
+        "canonicalizes both the repository root and role path",
+        "verifies that the backup archive contains the expected runtime members",
+    ):
+        assert required in normalized
+
+
+def test_legacy_runtime_owner_config_is_explicitly_inert() -> None:
+    config = (ROOT / "template" / ".scripts" / "config.example.toml").read_text(
+        encoding="utf-8"
+    )
+    github_block = config.split("[github]", 1)[1].split("[plane]", 1)[0]
+
+    assert "LEGACY INERT COMPATIBILITY METADATA ONLY" in github_block
+    assert 'runtime_repo_owner = ""' in github_block
+    assert "does not create, attach" in github_block
+
+
+def test_retired_checkpoint_runbook_is_historical_evidence_only() -> None:
+    runbook = (
+        ROOT / "docs" / "runbooks" / "runtime-checkpoint-repair.md"
+    ).read_text(encoding="utf-8")
+
+    assert "Historical evidence only" in runbook
+    assert "do not execute" in runbook
+    assert "commands have intentionally been removed" in runbook
+
+
+def test_step_20_is_documented_as_ignored_local_population() -> None:
+    development = (
+        ROOT / "docs" / "sentinel" / "development.md"
+    ).read_text(encoding="utf-8")
+
+    assert "`20-runtime-repo.sh` populates the ignored local runtime" in development
+    assert "it creates no GitHub storage" in development
+    assert "creates a private GitHub repo" not in development
+
+
+def test_retired_checkpoint_repair_is_a_non_mutating_tombstone(tmp_path: Path) -> None:
+    script = ROOT / "scripts" / "repair-runtime-checkpoint.sh"
+    source = script.read_text(encoding="utf-8")
+    forbidden = (
+        r"\bgit\s+(?:init|fetch|reset|lfs|push|remote|submodule|checkout|restore)\b",
+        r"\b(?:rm|mv|cp|touch|truncate)\b",
+        r">>",
+    )
+    for pattern in forbidden:
+        assert re.search(pattern, source, re.IGNORECASE) is None
+
+    runtime = tmp_path / "project" / "agents" / "hermes" / "pm" / "runtime"
+    private = runtime / "sessions" / "private-state.bin"
+    private.parent.mkdir(parents=True)
+    private.write_bytes(bytes((0, 17, 34, 255)))
+    (runtime / ".env").write_text("TOKEN=preserve-exactly\n", encoding="utf-8")
+
+    def snapshot() -> list[tuple[str, str, int, bytes]]:
+        entries: list[tuple[str, str, int, bytes]] = []
+        for path in sorted(runtime.rglob("*")):
+            kind = "dir" if path.is_dir() else "file"
+            payload = b"" if path.is_dir() else path.read_bytes()
+            entries.append((str(path.relative_to(runtime)), kind, path.stat().st_mode, payload))
+        return entries
+
+    before = snapshot()
+    result = subprocess.run(
+        [str(script), "--apply", str(runtime)],
+        text=True,
+        capture_output=True,
+        check=False,
+    )
+
+    assert result.returncode != 0
+    assert result.stdout == ""
+    assert "retired and intentionally non-operational" in result.stderr
+    assert "changed nothing" in result.stderr
+    assert snapshot() == before

package/templates/hermes-agent/tests/test_profile_env_detach_contract.py

@@ -0,0 +1,14 @@
+from pathlib import Path
+
+
+SCRIPT = Path(__file__).parents[1] / "template" / ".scripts" / "10-hermes-profile.sh"
+
+
+def test_profile_env_symlink_is_detached_before_sanitization() -> None:
+    text = SCRIPT.read_text(encoding="utf-8")
+    detach = text.index('if [[ -L "$PROFILE_ENV" ]]')
+    dereference_copy = text.index('cp -L "$PROFILE_ENV" "$PROFILE_ENV_COPY"')
+    replace_link = text.index('mv -fT "$PROFILE_ENV_COPY" "$PROFILE_ENV"')
+    sanitize = text.index('python3 - "$PROFILE_ENV"')
+
+    assert detach < dereference_copy < replace_link < sanitize

package/templates/hermes-agent/tests/test_profile_scoped_chat_secrets.py

@@ -0,0 +1,89 @@
+from __future__ import annotations
+
+import importlib.util
+import stat
+from pathlib import Path
+
+
+SCRIPT = Path(__file__).parents[1] / "scripts" / "migrate-profile-scoped-chat-secrets.py"
+SPEC = importlib.util.spec_from_file_location("chat_secret_migration", SCRIPT)
+assert SPEC and SPEC.loader
+MODULE = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(MODULE)
+
+
+def _write(path: Path, text: str) -> None:
+    path.write_text(text, encoding="utf-8")
+    path.chmod(0o600)
+
+
+def test_dry_run_never_changes_files_or_reports_values(tmp_path: Path) -> None:
+    central = tmp_path / "central.env"
+    target = tmp_path / "profile.env"
+    _write(
+        central,
+        "KIMI_API_KEY=provider-secret\nSLACK_APP_TOKEN=app-secret\n"
+        "SLACK_BOT_TOKEN=bot-secret\nSLACK_ALLOWED_USERS=U123\n",
+    )
+
+    moved = MODULE.migrate(central, target, MODULE.DEFAULT_KEYS, apply=False)
+
+    assert moved == list(MODULE.DEFAULT_KEYS)
+    assert not target.exists()
+    assert "SLACK_BOT_TOKEN=bot-secret" in central.read_text(encoding="utf-8")
+
+
+def test_apply_moves_only_chat_keys_and_creates_private_backup(tmp_path: Path) -> None:
+    central = tmp_path / "central.env"
+    target = tmp_path / "profile.env"
+    _write(
+        central,
+        "KIMI_API_KEY=provider-secret\nSLACK_APP_TOKEN=app-secret\n"
+        "SLACK_BOT_TOKEN=bot-secret\nSLACK_ALLOWED_USERS=U123\n",
+    )
+
+    MODULE.migrate(central, target, MODULE.DEFAULT_KEYS, apply=True)
+
+    assert central.read_text(encoding="utf-8") == "KIMI_API_KEY=provider-secret\n"
+    target_text = target.read_text(encoding="utf-8")
+    assert "SLACK_APP_TOKEN=app-secret" in target_text
+    assert "SLACK_BOT_TOKEN=bot-secret" in target_text
+    assert "SLACK_ALLOWED_USERS=U123" in target_text
+    assert stat.S_IMODE(target.stat().st_mode) == 0o600
+    backups = list(tmp_path.glob("central.env.bak-*-before-chat-scope"))
+    assert len(backups) == 1
+    assert stat.S_IMODE(backups[0].stat().st_mode) == 0o600
+
+
+def test_refuses_target_symlink_to_shared_env(tmp_path: Path) -> None:
+    central = tmp_path / "central.env"
+    target = tmp_path / "profile.env"
+    _write(
+        central,
+        "SLACK_APP_TOKEN=app\nSLACK_BOT_TOKEN=bot\nSLACK_ALLOWED_USERS=user\n",
+    )
+    target.symlink_to(central)
+
+    try:
+        MODULE.migrate(central, target, MODULE.DEFAULT_KEYS, apply=True)
+    except ValueError as exc:
+        assert "not a symlink" in str(exc)
+    else:
+        raise AssertionError("expected symlink safety failure")
+
+
+def test_refuses_conflicting_target_value(tmp_path: Path) -> None:
+    central = tmp_path / "central.env"
+    target = tmp_path / "profile.env"
+    _write(
+        central,
+        "SLACK_APP_TOKEN=app\nSLACK_BOT_TOKEN=bot\nSLACK_ALLOWED_USERS=user\n",
+    )
+    _write(target, "SLACK_BOT_TOKEN=different\n")
+
+    try:
+        MODULE.migrate(central, target, MODULE.DEFAULT_KEYS, apply=True)
+    except ValueError as exc:
+        assert "different values" in str(exc)
+    else:
+        raise AssertionError("expected conflict safety failure")

package/templates/hermes-agent/tests/test_repository_privacy_contract.py

@@ -0,0 +1,32 @@
+from __future__ import annotations
+
+import re
+import subprocess
+from pathlib import Path
+
+
+ROOT = Path(__file__).parents[1]
+
+
+def test_host_local_runtime_payloads_are_ignored() -> None:
+    gitignore = (ROOT / ".gitignore").read_text(encoding="utf-8").splitlines()
+
+    assert ".codegraph/daemon.pid" in gitignore
+    assert ".omo/run-continuation/" in gitignore
+
+
+def test_host_local_runtime_payloads_are_not_tracked() -> None:
+    tracked = subprocess.run(
+        ["git", "ls-files", "-z"],
+        cwd=ROOT,
+        check=True,
+        capture_output=True,
+    ).stdout.decode("utf-8").split("\0")
+    forbidden = re.compile(
+        r"(?:^|/)(?:\.omo/run-continuation/|\.codegraph/[^/]+\.(?:pid|sock|socket)$)"
+        r"|(?:^|/)(?:sessions?|runtime-state)/"
+        r"|(?:^|/)[^/]+\.(?:pid|sock|socket)$"
+    )
+
+    offenders = sorted(path for path in tracked if path and forbidden.search(path))
+    assert offenders == [], f"tracked host-local runtime payloads: {offenders}"