@delorenj/pjangler 1.2.21 → 1.2.33

package/templates/hermes-agent/template/.scripts/providers/plane.sh

@@ -1,13 +1,13 @@
 #!/usr/bin/env sh
 # Plane ticket-provider adapter.
 #
-# Credentials:  PLANE_API_KEY   (X-API-Key header)
+# Credentials:  PLANE_API_KEY or PLANE_<WORKSPACE>_API_KEY (X-API-Key header)
 # Endpoint:     PLANE_BASE       (default https://plane.delo.sh)
-# Board binding (role.yaml `ticket_provider:`):
-#   name: plane
+# Board binding (repo-root .project.json `ticket_provider:`):
 #   workspace: <workspace-slug>      (or env PLANE_WORKSPACE)
-#   project:   <project-uuid>        (set by create_board / 42-ticket-provider)
-#   state_map: { in_review: "In Review", completed: "Done" }   optional
+#   board_id:  <project-uuid>        (set by create_board / 42-ticket-provider)
+#   state_map: { in_review: "In Review", completed: "Done",
+#                cancelled: "Cancelled" }   optional
 #
 # Plane model:  project = board, cycle = milestone, state.group in
 #   backlog|unstarted|started|completed|cancelled.
@@ -21,9 +21,21 @@ ROLE_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
 ROLE_YAML="$ROLE_DIR/role.yaml"
 BASE="${PLANE_BASE:-https://plane.delo.sh}"
 
+FLEET_ENV="${HERMES_FLEET_ENV:-$HOME/.hermes/fleet.env}"
+if [ -f "$FLEET_ENV" ]; then
+  # shellcheck disable=SC1090
+  . "$FLEET_ENV"
+fi
+
 die() { echo "plane: $*" >&2; exit 1; }
 need_key() { [ -n "${PLANE_API_KEY:-}" ] || die "PLANE_API_KEY is not set"; }
 
+workspace_key() {
+  key="$(printf '%s' "${1:-default}" | tr '[:lower:]' '[:upper:]' | sed 's/[^A-Z0-9]/_/g')"
+  [ -n "$key" ] || key="DEFAULT"
+  printf 'PLANE_%s_API_KEY' "$key"
+}
+
 tp_cfg() {
   [ -f "$ROLE_YAML" ] || return 0
   python3 - "$ROLE_YAML" "$1" <<'PY'
@@ -54,13 +66,20 @@ else:
 PY
 }
 
-# Board binding: .project.json (SOT) first, then role.yaml, then env.
+# Board binding: .project.json (SOT) first, then legacy role.yaml, then env.
 WS="$(pj_cfg workspace)"; [ -n "$WS" ] || WS="$(tp_cfg workspace)"; WS="${WS:-${PLANE_WORKSPACE:-}}"
-PROJ="$(pj_cfg board_id)"; [ -n "$PROJ" ] || PROJ="$(tp_cfg project)"
+PROJ="$(pj_cfg board_id)"; [ -n "$PROJ" ] || PROJ="$(tp_cfg project)"; [ -n "$PROJ" ] || PROJ="$(tp_cfg board_id)"
 SM_IN_REVIEW="$(tp_cfg in_review)"; SM_IN_REVIEW="${SM_IN_REVIEW:-In Review}"
 SM_DONE="$(tp_cfg completed)"; SM_DONE="${SM_DONE:-Done}"
+SM_CANCELLED="$(tp_cfg cancelled)"; SM_CANCELLED="${SM_CANCELLED:-Cancelled}"
 API="$BASE/api/v1/workspaces/$WS"
 
+if [ -z "${PLANE_API_KEY:-}" ]; then
+  KEY="$(workspace_key "$WS")"
+  eval "PLANE_API_KEY=\${$KEY:-}"
+  export PLANE_API_KEY
+fi
+
 # api METHOD PATH [JSON_BODY] — call Plane REST, print response body.
 api() {
   need_key
@@ -68,9 +87,12 @@ api() {
   if [ -n "$body" ]; then
     curl -fsS -X "$method" "$API/$path" \
       -H "X-API-Key: $PLANE_API_KEY" -H "Content-Type: application/json" \
+      -H "User-Agent: curl/8.0" \
       -d "$body"
   else
-    curl -fsS -X "$method" "$API/$path" -H "X-API-Key: $PLANE_API_KEY"
+    curl -fsS -X "$method" "$API/$path" \
+      -H "X-API-Key: $PLANE_API_KEY" \
+      -H "User-Agent: curl/8.0"
   fi
 }
 
@@ -80,6 +102,7 @@ resolve_state_id() {
   [ -n "$PROJ" ] || die "ticket_provider.project not set"
   case "$want" in
     completed) grp=completed; nm="$SM_DONE" ;;
+    cancelled) grp=cancelled; nm="$SM_CANCELLED" ;;
     in_review) grp=started;   nm="$SM_IN_REVIEW" ;;
     started)   grp=started;   nm="" ;;
     unstarted) grp=unstarted; nm="" ;;
@@ -87,7 +110,7 @@ resolve_state_id() {
     *) die "invalid normalized state: $want" ;;
   esac
   api GET "projects/$PROJ/states/" | GRP="$grp" NM="$nm" python3 -c 'import sys,json,os
-d=json.load(sys.stdin); rows=d.get("results", d if isinstance(d,list) else [])
+d=json.load(sys.stdin); rows=d if isinstance(d,list) else d.get("results", []) if isinstance(d,dict) else []
 grp=os.environ["GRP"]; nm=os.environ.get("NM","")
 named=[s for s in rows if nm and (s.get("name","").lower()==nm.lower())]
 grouped=[s for s in rows if s.get("group")==grp]
@@ -100,8 +123,8 @@ need_key
 
 case "$OP" in
   resolve)
-    [ -n "$WS" ] || die "workspace not set (role.yaml ticket_provider.workspace or PLANE_WORKSPACE)"
-    [ -n "$PROJ" ] || die "project not set (run 42-ticket-provider.sh)"
+    [ -n "$WS" ] || die "workspace not set (.project.json ticket_provider.workspace or PLANE_WORKSPACE)"
+    [ -n "$PROJ" ] || die "project not set (.project.json ticket_provider.board_id; run 42-ticket-provider.sh)"
     printf '{"provider":"plane","board_id":"%s","board_url":"%s/%s/projects/%s/issues/"}\n' \
       "$PROJ" "$BASE" "$WS" "$PROJ"
     ;;
@@ -109,7 +132,7 @@ case "$OP" in
   active_milestone)
     [ -n "$PROJ" ] || die "project not set"
     api GET "projects/$PROJ/cycles/" | python3 -c 'import sys,json,datetime
-d=json.load(sys.stdin); rows=d.get("results", d if isinstance(d,list) else [])
+d=json.load(sys.stdin); rows=d if isinstance(d,list) else d.get("results", []) if isinstance(d,dict) else []
 now=datetime.datetime.now(datetime.timezone.utc)
 def cur(c):
     s,e=c.get("start_date"),c.get("end_date")
@@ -126,9 +149,9 @@ print(json.dumps({"id":m.get("id",""),"name":m.get("name",""),"state":"active" i
     ISSUES="$(api GET "projects/$PROJ/issues/")"
     printf '%s\n%s\n' "$STATES" "$ISSUES" | BASE="$BASE" WS="$WS" PROJ="$PROJ" python3 -c 'import sys,json,os
 parts=sys.stdin.read().split("\n",1)
-srows=json.loads(parts[0] or "{}"); srows=srows.get("results", srows if isinstance(srows,list) else [])
+srows=json.loads(parts[0] or "{}"); srows=srows if isinstance(srows,list) else srows.get("results", []) if isinstance(srows,dict) else []
 smap={s.get("id"):(s.get("name",""),s.get("group","")) for s in srows}
-d=json.loads(parts[1] or "{}"); rows=d.get("results", d if isinstance(d,list) else [])
+d=json.loads(parts[1] or "{}"); rows=d if isinstance(d,list) else d.get("results", []) if isinstance(d,dict) else []
 base,ws,proj=os.environ["BASE"],os.environ["WS"],os.environ["PROJ"]
 out=[]
 for n in rows:
@@ -146,19 +169,30 @@ print(json.dumps(out))'
     STATES="$(api GET "projects/$PROJ/states/")"
     ISSUE="$(api GET "projects/$PROJ/issues/$ID/")"
     COMM="$(api GET "projects/$PROJ/issues/$ID/comments/" 2>/dev/null || echo '[]')"
-    printf '%s\n%s\n%s\n' "$STATES" "$ISSUE" "$COMM" | python3 -c 'import sys,json,re
-parts=sys.stdin.read().split("\n",2)
-srows=json.loads(parts[0] or "{}"); srows=srows.get("results", srows if isinstance(srows,list) else [])
+    ATTACH="$(api GET "projects/$PROJ/issues/$ID/issue-attachments/" 2>/dev/null || echo '[]')"
+    printf '%s\n%s\n%s\n%s\n' "$STATES" "$ISSUE" "$COMM" "$ATTACH" | python3 -c 'import sys,json,re
+parts=sys.stdin.read().split("\n",3)
+srows=json.loads(parts[0] or "{}"); srows=srows if isinstance(srows,list) else srows.get("results", []) if isinstance(srows,dict) else []
 smap={s.get("id"):(s.get("name",""),s.get("group","")) for s in srows}
-i=json.loads(parts[1] or "{}"); c=json.loads(parts[2] or "[]")
-rows=c.get("results", c if isinstance(c,list) else [])
+i=json.loads(parts[1] or "{}"); c=json.loads(parts[2] or "[]"); a=json.loads(parts[3] or "[]")
+rows=c if isinstance(c,list) else c.get("results", []) if isinstance(c,dict) else []
+arows=a if isinstance(a,list) else a.get("results", []) if isinstance(a,dict) else []
 def strip(h): return re.sub(r"<[^>]+>","",h or "").strip()
 name,group=smap.get(i.get("state",""),("",""))
 desc=strip(i.get("description_html",""))
 cs=[{"id":x.get("id",""),"body":strip(x.get("comment_html","")),"author":""} for x in rows]
+ats=[]
+for x in arows:
+    attrs=x.get("attributes") or {}
+    ats.append({"id":x.get("id",""),"name":attrs.get("name",x.get("name","")),
+                "type":attrs.get("type",x.get("type","")),
+                "size":attrs.get("size",x.get("size",0)),"asset":x.get("asset",""),
+                "url":x.get("asset_url",x.get("url","")),
+                "created_at":x.get("created_at",""),"updated_at":x.get("updated_at",""),
+                "is_uploaded":x.get("is_uploaded",False)})
 print(json.dumps({"id":i.get("id",""),"key":i.get("sequence_id",""),"title":i.get("name",""),
                   "description":desc,"acceptance":desc,
-                  "state":name,"state_type":group,"comments":cs}))'
+                  "state":name,"state_type":group,"comments":cs,"attachments":ats}))'
     ;;
 
   comment)
@@ -180,7 +214,7 @@ print(json.dumps({"id":i.get("id",""),"key":i.get("sequence_id",""),"title":i.ge
     NAME="${1:?usage: create_board <name> <ident> <desc>}"; IDENT="${2:-}"; DESC="${3:-}"
     [ -n "$WS" ] || die "workspace not set"
     EXIST="$(api GET "projects/?per_page=200" | NAME="$NAME" IDENT="$IDENT" python3 -c 'import sys,json,os
-d=json.load(sys.stdin); rows=d.get("results", d if isinstance(d,list) else [])
+d=json.load(sys.stdin); rows=d if isinstance(d,list) else d.get("results", []) if isinstance(d,dict) else []
 name=os.environ["NAME"].strip().lower(); ident=os.environ["IDENT"].upper()
 # Repo NAME is the primary key — links an existing repo board even if its
 # identifier differs (Plane does not enforce unique names, so this prevents
@@ -198,5 +232,41 @@ print(pid)')"
     printf '{"board_id":"%s","board_url":"%s/%s/projects/%s/issues/"}\n' "$PID" "$BASE" "$WS" "$PID"
     ;;
 
+  create_issue)
+    # File a new ticket on the bound board. Board/workspace come from resolved
+    # config, never from an argument. Deliberately NOT idempotent by default:
+    # two issues may legitimately share a title. Pass --if-absent to reuse an
+    # issue whose title already matches exactly (case-insensitive) instead.
+    IF_ABSENT=0
+    case "${1:-}" in --if-absent) IF_ABSENT=1; shift ;; esac
+    TITLE="${1:?usage: create_issue [--if-absent] <title> [description]}"; DESC="${2:-}"
+    [ -n "$WS" ] || die "workspace not set (.project.json ticket_provider.workspace or PLANE_WORKSPACE)"
+    [ -n "$PROJ" ] || die "project not set (.project.json ticket_provider.board_id; run 42-ticket-provider.sh)"
+    IID=""; SEQ=""; CREATED=true
+    if [ "$IF_ABSENT" = 1 ]; then
+      HIT="$(api GET "projects/$PROJ/issues/?per_page=200" | TITLE="$TITLE" python3 -c 'import sys,json,os
+d=json.load(sys.stdin); rows=d if isinstance(d,list) else d.get("results", []) if isinstance(d,dict) else []
+want=os.environ["TITLE"].strip().lower()
+m=next((i for i in rows if (i.get("name") or "").strip().lower()==want), None)
+print((str(m.get("id","")) + " " + str(m.get("sequence_id","") or "")) if m else "")')"
+      if [ -n "$HIT" ]; then IID="${HIT%% *}"; SEQ="${HIT#* }"; CREATED=false; fi
+    fi
+    if [ -z "$IID" ]; then
+      NEW="$(api POST "projects/$PROJ/issues/" \
+        "$(python3 -c 'import html,json,sys
+body={"name": sys.argv[1]}
+desc=sys.argv[2]
+if desc: body["description_html"]="<p>"+html.escape(desc)+"</p>"
+print(json.dumps(body))' "$TITLE" "$DESC")" \
+        | python3 -c 'import sys,json
+d=json.load(sys.stdin)
+print(str(d.get("id","")) + " " + str(d.get("sequence_id","") or ""))')"
+      IID="${NEW%% *}"; SEQ="${NEW#* }"
+    fi
+    [ -n "$IID" ] || die "create_issue failed"
+    printf '{"issue_id":"%s","key":"%s","issue_url":"%s/%s/projects/%s/issues/%s","created":%s}\n' \
+      "$IID" "$SEQ" "$BASE" "$WS" "$PROJ" "$IID" "$CREATED"
+    ;;
+
   *) die "unknown op: $OP" ;;
 esac

package/templates/hermes-agent/template/.scripts/providers/trello.sh

@@ -6,7 +6,8 @@
 #   name: trello
 #   board: <board-id>                 (set by create_board / 42-ticket-provider)
 #   state_map: { backlog:"Backlog", unstarted:"To Do", started:"In Progress",
-#                in_review:"Review", completed:"Done" }   optional
+#                in_review:"Review", completed:"Done", cancelled:"Cancelled" }
+#                                              optional
 #
 # Trello model:  board = project & milestone, list = state, card = issue.
 # Trello has no milestone primitive, so active_milestone returns the board.
@@ -61,6 +62,7 @@ list_name_for() {
     started)   v="$(tp_cfg started)";   printf '%s' "${v:-In Progress}" ;;
     in_review) v="$(tp_cfg in_review)"; printf '%s' "${v:-Review}" ;;
     completed) v="$(tp_cfg completed)"; printf '%s' "${v:-Done}" ;;
+    cancelled) v="$(tp_cfg cancelled)"; printf '%s' "${v:-Cancelled}" ;;
     *) die "invalid normalized state: $1" ;;
   esac
 }
@@ -156,5 +158,36 @@ print(next((b["id"] for b in rows if b.get("name","").lower()==nm), ""))')"
 b=json.load(sys.stdin); print(json.dumps({"board_id":os.environ["BID"],"board_url":b.get("url","")}))'
     ;;
 
+  create_issue)
+    # File a new card on the bound board. Board comes from resolved config,
+    # never from an argument. Deliberately NOT idempotent by default: two cards
+    # may legitimately share a title. Pass --if-absent to reuse a card whose
+    # name already matches exactly (case-insensitive) instead.
+    IF_ABSENT=0
+    case "${1:-}" in --if-absent) IF_ABSENT=1; shift ;; esac
+    TITLE="${1:?usage: create_issue [--if-absent] <title> [description]}"; DESC="${2:-}"
+    [ -n "$BOARD" ] || die "board not set (run 42-ticket-provider.sh)"
+    CID=""; CREATED=true
+    if [ "$IF_ABSENT" = 1 ]; then
+      CID="$(api GET "boards/$BOARD/cards" "fields=name" | NM="$TITLE" python3 -c 'import sys,json,os
+rows=json.load(sys.stdin); nm=os.environ["NM"].strip().lower()
+print(next((c["id"] for c in rows if (c.get("name") or "").strip().lower()==nm), ""))')"
+      [ -z "$CID" ] || CREATED=false
+    fi
+    if [ -z "$CID" ]; then
+      # New cards land in the backlog list, falling back to the unstarted one.
+      LID="$(list_id_for backlog)"
+      [ -n "$LID" ] || LID="$(list_id_for unstarted)"
+      [ -n "$LID" ] || die "no Trello list mapped for 'backlog' or 'unstarted' (check state_map)"
+      CID="$(api POST "cards" "idList=$LID&name=$(python3 -c 'import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1]))' "$TITLE")&desc=$(python3 -c 'import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1]))' "$DESC")" \
+        | python3 -c 'import sys,json; print(json.load(sys.stdin).get("id",""))')"
+    fi
+    [ -n "$CID" ] || die "create_issue failed"
+    api GET "cards/$CID" "fields=url,shortLink" | CID="$CID" CREATED="$CREATED" python3 -c 'import sys,json,os
+c=json.load(sys.stdin)
+print(json.dumps({"issue_id":os.environ["CID"],"key":c.get("shortLink",""),
+                  "issue_url":c.get("url",""),"created":os.environ["CREATED"]=="true"}))'
+    ;;
+
   *) die "unknown op: $OP" ;;
 esac

package/templates/hermes-agent/template/.scripts/reporter-watchdog.py

@@ -0,0 +1,242 @@
+#!/usr/bin/env python3
+"""Gateway-independent health watchdog for a Hermes reporter profile.
+
+Defaults target the DeLoNET company reporter; override the REPORTER_* environment
+variables below to point it at another reporter deployment.
+"""
+
+from __future__ import annotations
+
+import argparse
+import datetime as dt
+import hashlib
+import json
+import os
+import re
+import subprocess
+import tempfile
+import urllib.request
+from pathlib import Path
+from zoneinfo import ZoneInfo
+
+# Deployment-specific constants. The defaults describe the DeLoNET company
+# reporter this watchdog was written for; every one is overridable so a second
+# reporter does not need a forked copy of this file.
+PROFILE_NAME = os.environ.get("REPORTER_PROFILE_NAME", "delonet-company-reporter")
+REPORT_SLUG = os.environ.get("REPORTER_REPORT_SLUG", "delonet-daily-report")
+JOB_PREFIX = os.environ.get("REPORTER_JOB_PREFIX", "ddr")
+EXPECTED_JOBS = {
+    job.strip()
+    for job in os.environ.get(
+        "REPORTER_EXPECTED_JOBS",
+        f"{JOB_PREFIX}:daily,"
+        f"{JOB_PREFIX}:journal:hermes-fleet-health,"
+        f"{JOB_PREFIX}:journal:nightly-pr-maintenance,"
+        f"{JOB_PREFIX}:journal:report-delivery-health",
+    ).split(",")
+    if job.strip()
+}
+REPORT_TIMEZONE = os.environ.get("REPORTER_TIMEZONE", "America/New_York")
+NTFY_URL = os.environ.get("REPORTER_NTFY_URL", "https://ntfy.delo.sh/bloodbank")
+NTFY_TOKEN_REF = os.environ.get(
+    "REPORTER_NTFY_TOKEN_REF", "op://DeLoSecrets/ntfy/add more/accessToken"
+)
+HOME = Path.home()
+PROFILE = HOME / ".hermes" / "profiles" / PROFILE_NAME
+CONFIG = HOME / ".config" / REPORT_SLUG / "report.json"
+STATE_DIR = HOME / ".local" / "state" / REPORT_SLUG / "watchdog"
+STATUS_PATH = STATE_DIR / "status.json"
+ALERT_PATH = STATE_DIR / "last-alert.json"
+TICK_MAX_AGE_SECONDS = 180
+
+
+def load_json(path: Path) -> object:
+    return json.loads(path.read_text(encoding="utf-8"))
+
+
+def atomic_json(path: Path, value: object) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    fd, temporary = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            json.dump(value, handle, indent=2, sort_keys=True)
+            handle.write("\n")
+            handle.flush()
+            os.fsync(handle.fileno())
+        os.replace(temporary, path)
+    finally:
+        try:
+            os.unlink(temporary)
+        except FileNotFoundError:
+            pass
+
+
+def gateway_homes() -> dict[str, list[str]]:
+    homes: dict[str, list[str]] = {}
+    for unit in (HOME / ".config" / "systemd" / "user").glob("hermes*gateway.service"):
+        text = unit.read_text(encoding="utf-8", errors="replace")
+        match = re.search(r"^Environment=HERMES_HOME=(.+)$", text, re.MULTILINE)
+        if not match:
+            continue
+        raw = match.group(1).strip().strip('"')
+        resolved = str(Path(os.path.expandvars(raw)).expanduser().resolve(strict=False))
+        homes.setdefault(resolved, []).append(unit.name)
+    return homes
+
+
+def alert_ntfy(codes: list[str]) -> str | None:
+    try:
+        token = subprocess.run(
+            ["op", "read", NTFY_TOKEN_REF],
+            check=True,
+            capture_output=True,
+            text=True,
+            timeout=15,
+        ).stdout.strip()
+        if not token:
+            return "ntfy access token unavailable"
+        body = (
+            f"Critical {PROFILE_NAME} health failure: "
+            + ", ".join(sorted(codes))
+            + ". Inspect the profile-scoped watchdog status."
+        ).encode()
+        request = urllib.request.Request(
+            NTFY_URL,
+            data=body,
+            method="POST",
+            headers={
+                "Authorization": f"Bearer {token}",
+                "Title": f"{PROFILE_NAME} critical",
+                "Priority": "urgent",
+                "Tags": "rotating_light",
+            },
+        )
+        with urllib.request.urlopen(request, timeout=15) as response:
+            if not 200 <= response.status < 300:
+                return f"ntfy returned HTTP {response.status}"
+    except Exception as exc:  # fail open; status captures the alert failure
+        return f"ntfy alert failed: {type(exc).__name__}"
+    return None
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--no-alert", action="store_true")
+    parser.add_argument("--tick-max-age", type=int, default=TICK_MAX_AGE_SECONDS)
+    args = parser.parse_args()
+
+    now = dt.datetime.now(dt.UTC)
+    eastern = now.astimezone(ZoneInfo(REPORT_TIMEZONE))
+    critical: list[dict[str, str]] = []
+    warnings: list[dict[str, str]] = []
+
+    target = PROFILE.resolve(strict=False)
+    if not PROFILE.is_symlink():
+        critical.append({"code": "profile_not_symlinked", "detail": str(PROFILE)})
+
+    jobs_path = PROFILE / "cron" / "jobs.json"
+    try:
+        raw_jobs = load_json(jobs_path)
+        jobs = raw_jobs.get("jobs", []) if isinstance(raw_jobs, dict) else []
+    except (OSError, json.JSONDecodeError):
+        jobs = []
+        critical.append({"code": "jobs_store_unreadable", "detail": str(jobs_path)})
+
+    names = [job.get("name") for job in jobs if isinstance(job, dict)]
+    duplicates = sorted({name for name in names if name and names.count(name) > 1})
+    missing = sorted(EXPECTED_JOBS - set(names))
+    unexpected = sorted({name for name in names if name and name.startswith(f"{JOB_PREFIX}:")} - EXPECTED_JOBS)
+    if duplicates:
+        critical.append({"code": "duplicate_managed_jobs", "detail": ",".join(duplicates)})
+    if missing:
+        critical.append({"code": "missing_managed_jobs", "detail": ",".join(missing)})
+    if unexpected:
+        warnings.append({"code": "unexpected_managed_jobs", "detail": ",".join(unexpected)})
+    paused = sorted(
+        job.get("name")
+        for job in jobs
+        if isinstance(job, dict)
+        and job.get("name") in EXPECTED_JOBS
+        and not job.get("enabled", False)
+    )
+    if paused:
+        warnings.append({"code": "managed_jobs_paused", "detail": ",".join(paused)})
+
+    tick_lock = PROFILE / "cron" / ".tick.lock"
+    tick_age = None
+    if tick_lock.exists():
+        tick_age = max(0, int(now.timestamp() - tick_lock.stat().st_mtime))
+        if tick_age > args.tick_max_age:
+            critical.append({"code": "stale_cron_tick", "detail": f"age_seconds={tick_age}"})
+    else:
+        critical.append({"code": "missing_cron_tick", "detail": str(tick_lock)})
+
+    daily = next((job for job in jobs if isinstance(job, dict) and job.get("name") == f"{JOB_PREFIX}:daily"), {})
+    state = str(daily.get("last_status") or daily.get("status") or "").lower()
+    if state in {"failed", "error"}:
+        critical.append({"code": "daily_job_failed", "detail": state})
+
+    try:
+        config = load_json(CONFIG)
+    except (OSError, json.JSONDecodeError):
+        config = {}
+        critical.append({"code": "config_unreadable", "detail": str(CONFIG)})
+    daily_config = (
+        config.get("daily", {}) if isinstance(config, dict) and isinstance(config.get("daily"), dict) else {}
+    )
+    deliver = (
+        daily_config.get("deliver")
+    )
+    if deliver != "telegram":
+        warnings.append({"code": "telegram_delivery_not_activated", "detail": str(deliver)})
+
+    archive_dir = Path(config.get("archive_dir", "")) if isinstance(config, dict) else Path()
+    current = archive_dir / eastern.strftime("%Y/%m/%Y-%m-%d/current.json")
+    if daily_config.get("enabled") and (eastern.hour, eastern.minute) >= (8, 15) and not current.is_file():
+        critical.append({"code": "daily_report_missed", "detail": str(current)})
+
+    homes = gateway_homes()
+    profile_units = sorted(homes.get(str(target), []))
+    if len(profile_units) > 1:
+        critical.append({"code": "reporter_gateway_duplicated", "detail": ",".join(profile_units)})
+    for home, units in sorted(homes.items()):
+        if len(units) > 1 and home != str(target):
+            warnings.append(
+                {"code": "fleet_gateway_home_duplicated", "detail": f"{home}: {','.join(sorted(units))}"}
+            )
+
+    codes = sorted(item["code"] for item in critical)
+    fingerprint = hashlib.sha256("\n".join(codes).encode()).hexdigest() if codes else ""
+    previous = {}
+    try:
+        previous = load_json(ALERT_PATH)
+    except (OSError, json.JSONDecodeError):
+        pass
+    alert_error = None
+    if codes and fingerprint != previous.get("fingerprint") and not args.no_alert:
+        alert_error = alert_ntfy(codes)
+        if alert_error is None:
+            atomic_json(ALERT_PATH, {"fingerprint": fingerprint, "sent_at": now.isoformat()})
+    elif not codes and previous.get("fingerprint"):
+        atomic_json(ALERT_PATH, {"fingerprint": "", "cleared_at": now.isoformat()})
+
+    status = {
+        "checked_at": now.isoformat(),
+        "profile": PROFILE_NAME,
+        "profile_home": str(PROFILE),
+        "profile_target": str(target),
+        "healthy": not critical,
+        "critical": critical,
+        "warnings": warnings,
+        "tick_age_seconds": tick_age,
+        "managed_jobs": sorted(name for name in names if name and name.startswith(f"{JOB_PREFIX}:")),
+        "delivery": deliver,
+        "alert_error": alert_error,
+    }
+    atomic_json(STATUS_PATH, status)
+    print(json.dumps(status, indent=2, sort_keys=True))
+    return 1 if critical else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/templates/hermes-agent/template/.scripts/secret-scan.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+"""Fail closed when a runtime tree contains likely credential material."""
+
+from __future__ import annotations
+
+import argparse
+import re
+from pathlib import Path
+
+KEY_VALUE = re.compile(
+    r"(?im)^\s*[\"']?(?:api[_-]?key|token|secret|password|authorization|cookie|client[_-]?secret|private[_-]?key)[\"']?\s*[:=]\s*[\"']?([^\s\"'#][^\r\n#]*)"
+)
+TOKEN = re.compile(
+    r"(?:sk-[A-Za-z0-9_-]{12,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|tvly-[A-Za-z0-9_-]{10,}|fc-[A-Za-z0-9_-]{10,}|[0-9]{6,}:[A-Za-z0-9_-]{20,})"
+)
+PRIVATE_KEY = re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----")
+SAFE_VALUES = {"openrouter", "openai", "anthropic", "auto", "none", "null", "false", "true"}
+SKIP_PARTS = {".git", "__pycache__"}
+
+
+def findings(root: Path) -> list[str]:
+    result: list[str] = []
+    for path in root.rglob("*"):
+        if not path.is_file() or any(part in SKIP_PARTS for part in path.parts):
+            continue
+        if path.name == "secret-scan.py":
+            continue
+        if path.name.startswith(".env") and path.name != ".env.example":
+            result.append(f"forbidden secret file: {path.relative_to(root)}")
+            continue
+        if path.name in {"auth.json", "auth.lock"} or path.suffix in {".pem", ".key"}:
+            result.append(f"forbidden credential file: {path.relative_to(root)}")
+            continue
+        try:
+            text = path.read_text(encoding="utf-8")
+        except (UnicodeDecodeError, OSError):
+            continue
+        if TOKEN.search(text) or PRIVATE_KEY.search(text):
+            result.append(f"credential token pattern: {path.relative_to(root)}")
+        for match in KEY_VALUE.finditer(text):
+            value = match.group(1).strip().strip("\"'").rstrip(",")
+            if (
+                not value
+                or value.lower() in SAFE_VALUES
+                or value.startswith(("${", "$", "op://", "env:", "[REDACTED]"))
+                or value.endswith("_ENV")
+            ):
+                continue
+            result.append(f"literal credential assignment: {path.relative_to(root)}")
+            break
+    return sorted(set(result))
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("root", type=Path)
+    args = parser.parse_args()
+    issues = findings(args.root.resolve())
+    if issues:
+        for issue in issues:
+            print(issue)
+        return 1
+    print("secret scan: clean")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/templates/hermes-agent/template/.scripts/sentinel.prompt.md.jinja

@@ -21,9 +21,10 @@ Never call {{ ticket_provider }} directly. Use the adapter:
 .scripts/lib/ticket-provider.sh        # defines tp(); source it, then:
 tp active_milestone                    # JSON {id,name,state}
 tp list_issues                         # JSON [{id,key,title,state,state_type,...}]
-tp get_issue <id>                      # JSON incl. description + comments
+tp get_issue <id>                      # JSON incl. description + comments + attachments
 tp comment <id> "<body>"               # post a PM/review note
-tp transition <id> <normalized-state>  # backlog|unstarted|started|in_review|completed
+tp transition <id> <normalized-state>  # backlog|unstarted|started|in_review|completed|cancelled
+tp create_issue "<title>" "<desc>"    # file a NEW ticket; --if-absent to dedupe by title
 ```
 
 Reason in **normalized states**, not provider terms. This pass works identically