@delorenj/pjangler 1.2.21 → 1.2.33

package/templates/hermes-agent/scripts/backfill-fleet-sot.sh

@@ -1,270 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Distributable config — same source of truth the template's _lib.sh reads.
-HERMES_TEMPLATE_CONFIG="${HERMES_TEMPLATE_CONFIG:-${XDG_CONFIG_HOME:-$HOME/.config}/hermes-agent-template/config.toml}"
-cfg() {  # cfg <dotted.key> <default>  — read a value from config.toml (always exits 0)
-  local key="$1" def="$2"
-  { [[ -f "$HERMES_TEMPLATE_CONFIG" ]] && command -v python3 >/dev/null 2>&1; } || { printf '%s' "$def"; return 0; }
-  python3 - "$HERMES_TEMPLATE_CONFIG" "$key" "$def" <<'PYEOF' || printf '%s' "$def"
-import sys, os
-try:
-    import tomllib
-except ModuleNotFoundError:
-    print(sys.argv[3], end=""); sys.exit(0)
-try:
-    cur = tomllib.load(open(sys.argv[1], "rb"))
-except Exception:
-    print(sys.argv[3], end=""); sys.exit(0)
-for p in sys.argv[2].split("."):
-    if isinstance(cur, dict) and p in cur:
-        cur = cur[p]
-    else:
-        print(sys.argv[3], end=""); sys.exit(0)
-print(os.path.expanduser(str(cur)), end="")
-PYEOF
-  return 0
-}
-
-FLEET_ENV="${HERMES_FLEET_ENV:-$(cfg fleet.fleet_env "$HOME/.hermes/fleet.env")}"
-REGISTRY_FILE="${HERMES_FLEET_REGISTRY_FILE:-$(cfg fleet.registry_file "$HOME/.hermes/agents-registry.yaml")}"
-DEFAULT_BIN="${HERMES_FLEET_BIN:-$(cfg fleet.hermes_bin "$HOME/.hermes/hermes-agent/.venv/bin/hermes")}"
-DEFAULT_REPO="${HERMES_FLEET_REPO:-$(cfg fleet.hermes_repo "$HOME/.hermes/hermes-agent")}"
-DEFAULT_OAUTH_FILE="${HERMES_FLEET_OAUTH_FILE:-$(cfg fleet.oauth_file "$HOME/.hermes/auth.json")}"
-DEFAULT_CODEX_HOME="${HERMES_FLEET_CODEX_HOME:-$(cfg fleet.codex_home "$HOME/.codex")}"
-SCAFFOLD_SRC="$(cd "$(dirname "$0")/../template/.runtime-scaffold" && pwd)"
-
-mkdir -p "$(dirname "$FLEET_ENV")"
-if [[ ! -f "$FLEET_ENV" ]]; then
-  cat > "$FLEET_ENV" <<EOF
-# Hermes fleet source of truth.
-HERMES_FLEET_BIN=${DEFAULT_BIN}
-HERMES_FLEET_REPO=${DEFAULT_REPO}
-HERMES_FLEET_REGISTRY_FILE=${REGISTRY_FILE}
-HERMES_FLEET_OAUTH_FILE=${DEFAULT_OAUTH_FILE}
-HERMES_FLEET_CODEX_HOME=${DEFAULT_CODEX_HOME}
-EOF
-  chmod 600 "$FLEET_ENV"
-fi
-
-upsert_fleet_env() {
-  local key="$1" value="$2"
-  python3 - "$FLEET_ENV" "$key" "$value" <<'PYEOF'
-import pathlib
-import sys
-
-path = pathlib.Path(sys.argv[1])
-key = sys.argv[2]
-value = sys.argv[3]
-line = f"{key}={value}"
-lines = path.read_text().splitlines() if path.exists() else []
-for idx, existing in enumerate(lines):
-    if existing.startswith(f"{key}="):
-        lines[idx] = line
-        break
-else:
-    lines.append(line)
-path.write_text("\n".join(lines) + "\n")
-PYEOF
-}
-
-upsert_fleet_env HERMES_FLEET_OAUTH_FILE "$DEFAULT_OAUTH_FILE"
-upsert_fleet_env HERMES_FLEET_CODEX_HOME "$DEFAULT_CODEX_HOME"
-chmod 600 "$FLEET_ENV"
-
-# shellcheck disable=SC1090
-source "$FLEET_ENV"
-
-HERMES_FLEET_BIN="${HERMES_FLEET_BIN:-$DEFAULT_BIN}"
-HERMES_FLEET_REPO="${HERMES_FLEET_REPO:-$DEFAULT_REPO}"
-HERMES_FLEET_OAUTH_FILE="${HERMES_FLEET_OAUTH_FILE:-$DEFAULT_OAUTH_FILE}"
-HERMES_FLEET_CODEX_HOME="${HERMES_FLEET_CODEX_HOME:-$DEFAULT_CODEX_HOME}"
-
-python3 - "$REGISTRY_FILE" "$HERMES_FLEET_BIN" "$HERMES_FLEET_REPO" "$FLEET_ENV" "$SCAFFOLD_SRC" "$HERMES_FLEET_OAUTH_FILE" "$HERMES_FLEET_CODEX_HOME" <<'PYEOF'
-import os
-import stat
-import sys
-import shutil
-import pathlib
-
-try:
-    import yaml  # type: ignore
-except ImportError:
-    raise SystemExit("PyYAML required (pip install pyyaml)")
-
-registry_path = pathlib.Path(sys.argv[1])
-hermes_bin = sys.argv[2]
-hermes_repo = sys.argv[3]
-fleet_env = sys.argv[4]
-scaffold_src = pathlib.Path(sys.argv[5])
-oauth_file = sys.argv[6]
-codex_home = sys.argv[7]
-
-if not registry_path.exists():
-    raise SystemExit(f"Registry not found: {registry_path}")
-
-data = yaml.safe_load(registry_path.read_text()) or {}
-agents = data.get("agents") or {}
-
-wrapper_count = 0
-meta_count = 0
-scaffold_count = 0
-lib_count = 0
-systemd_count = 0
-
-
-def patch_systemd_unit(unit_path: pathlib.Path) -> bool:
-    if not unit_path.exists():
-        return False
-    original = unit_path.read_text()
-    lines = original.splitlines()
-    rendered = []
-    for line in lines:
-        if line.startswith("Environment=HERMES_OAUTH_FILE="):
-            continue
-        if line.startswith("Environment=CODEX_HOME="):
-            continue
-        rendered.append(line)
-        if line.startswith("Environment=HERMES_HOME="):
-            rendered.append(f"Environment=HERMES_OAUTH_FILE={oauth_file}")
-            rendered.append(f"Environment=CODEX_HOME={codex_home}")
-    new_text = "\n".join(rendered) + ("\n" if original.endswith("\n") else "")
-    if new_text == original:
-        return False
-    unit_path.write_text(new_text)
-    return True
-
-for agent_id, cfg in agents.items():
-    cfg["hermes"] = {
-        "bin": hermes_bin,
-        "repo": hermes_repo,
-        "fleet_env": fleet_env,
-        "oauth_file": oauth_file,
-        "codex_home": codex_home,
-    }
-    meta_count += 1
-
-    systemd_dir = pathlib.Path.home() / ".config" / "systemd" / "user"
-    for suffix in ("gateway", "consumer"):
-        unit = systemd_dir / f"hermes-{agent_id}-{suffix}.service"
-        if patch_systemd_unit(unit):
-            systemd_count += 1
-
-    role_dir = cfg.get("role_dir")
-    if not role_dir:
-        continue
-
-    role_path = pathlib.Path(role_dir)
-    if not role_path.exists():
-        continue
-
-    project_path = pathlib.Path(cfg.get("project_path") or "")
-    role_name = cfg.get("role") or "pm"
-    alt_role_path = project_path / "_agents" / "hermes" / role_name
-    if not (role_path / "hermes").exists() and (alt_role_path / "hermes").exists():
-        role_path = alt_role_path
-        cfg["role_dir"] = str(alt_role_path)
-
-    target_scaffold = role_path / ".runtime-scaffold"
-    shutil.copytree(scaffold_src, target_scaffold, dirs_exist_ok=True)
-    scaffold_count += 1
-
-    lib_path = role_path / ".scripts" / "_lib.sh"
-    if lib_path.exists():
-        lib_text = lib_path.read_text()
-        old_block = (
-            "# Tools we expect on the host\n"
-            "HERMES_BIN=\"${HERMES_BIN:-/home/delorenj/code/hermes-agent/.venv/bin/hermes}\"\n"
-            "HERMES_AGENT_REPO=\"${HERMES_AGENT_REPO:-/home/delorenj/code/hermes-agent}\"\n"
-            "RUNTIME_SCAFFOLD_DIR=\"${RUNTIME_SCAFFOLD_DIR:-/home/delorenj/code/hermes-agent-template/runtime-scaffold}\"\n"
-            "REGISTRY_FILE=\"${REGISTRY_FILE:-$HOME/.hermes/agents-registry.yaml}\"\n"
-        )
-        new_block = (
-            "# Fleet source-of-truth (shared across all wrappers/provisioners)\n"
-            "FLEET_ENV=\"${HERMES_FLEET_ENV:-$HOME/.hermes/fleet.env}\"\n"
-            "if [[ -f \"$FLEET_ENV\" ]]; then\n"
-            "  # shellcheck disable=SC1090\n"
-            "  source \"$FLEET_ENV\"\n"
-            "fi\n\n"
-            "# Tools we expect on the host\n"
-            "HERMES_BIN=\"${HERMES_BIN:-${HERMES_FLEET_BIN:-$HOME/.hermes/hermes-agent/.venv/bin/hermes}}\"\n"
-            "HERMES_AGENT_REPO=\"${HERMES_AGENT_REPO:-${HERMES_FLEET_REPO:-$HOME/.hermes/hermes-agent}}\"\n"
-            "HERMES_OAUTH_FILE=\"${HERMES_OAUTH_FILE:-${HERMES_FLEET_OAUTH_FILE:-$HOME/.hermes/auth.json}}\"\n"
-            "CODEX_HOME=\"${CODEX_HOME:-${HERMES_FLEET_CODEX_HOME:-$HOME/.codex}}\"\n"
-            "# Prefer a scaffold vendored into this agent directory; fall back to legacy template path.\n"
-            "RUNTIME_SCAFFOLD_DIR=\"${RUNTIME_SCAFFOLD_DIR:-$ROLE_DIR/.runtime-scaffold}\"\n"
-            "if [[ ! -d \"$RUNTIME_SCAFFOLD_DIR\" ]]; then\n"
-            "  RUNTIME_SCAFFOLD_DIR=\"${HERMES_TEMPLATE_RUNTIME_SCAFFOLD:-$HOME/code/hermes-agent-template/runtime-scaffold}\"\n"
-            "fi\n"
-            "REGISTRY_FILE=\"${REGISTRY_FILE:-${HERMES_FLEET_REGISTRY_FILE:-$HOME/.hermes/agents-registry.yaml}}\"\n"
-        )
-        if old_block in lib_text:
-            lib_text = lib_text.replace(old_block, new_block)
-        if "HERMES_OAUTH_FILE=" not in lib_text:
-            lib_text = lib_text.replace(
-                "HERMES_AGENT_REPO=\"${HERMES_AGENT_REPO:-${HERMES_FLEET_REPO:-$HOME/.hermes/hermes-agent}}\"\n",
-                "HERMES_AGENT_REPO=\"${HERMES_AGENT_REPO:-${HERMES_FLEET_REPO:-$HOME/.hermes/hermes-agent}}\"\n"
-                "HERMES_OAUTH_FILE=\"${HERMES_OAUTH_FILE:-${HERMES_FLEET_OAUTH_FILE:-$HOME/.hermes/auth.json}}\"\n"
-                "CODEX_HOME=\"${CODEX_HOME:-${HERMES_FLEET_CODEX_HOME:-$HOME/.codex}}\"\n",
-            )
-        lib_text = lib_text.replace(
-            "export HERMES_BIN HERMES_AGENT_REPO RUNTIME_SCAFFOLD_DIR REGISTRY_FILE \\\n       BLOODBANK_NATS_HOST BLOODBANK_NATS_PORT \\\n       PLANE_BASE PLANE_API_KEY \\\n       CF_API CF_ZONE_DELO_SH CF_ACCOUNT_ID\n",
-            "export FLEET_ENV HERMES_BIN HERMES_AGENT_REPO RUNTIME_SCAFFOLD_DIR REGISTRY_FILE \\\n       BLOODBANK_NATS_HOST BLOODBANK_NATS_PORT \\\n       PLANE_BASE PLANE_API_KEY \\\n       CF_API CF_ZONE_DELO_SH CF_ACCOUNT_ID\n",
-        )
-        lib_text = lib_text.replace(
-            "export FLEET_ENV HERMES_BIN HERMES_AGENT_REPO RUNTIME_SCAFFOLD_DIR REGISTRY_FILE",
-            "export FLEET_ENV HERMES_BIN HERMES_AGENT_REPO HERMES_OAUTH_FILE CODEX_HOME RUNTIME_SCAFFOLD_DIR REGISTRY_FILE",
-        )
-        if lib_text != lib_path.read_text():
-            lib_path.write_text(lib_text)
-            lib_count += 1
-
-    wrapper = role_path / "hermes"
-    if not wrapper.exists():
-        continue
-
-    wrapper.write_text(
-        "#!/usr/bin/env bash\n"
-        f"# Launcher for {agent_id}. Resolves HERMES_HOME to runtime and execs shared fleet Hermes.\n"
-        "set -euo pipefail\n\n"
-        "ROLE_DIR=\"$(cd \"$(dirname \"$0\")\" && pwd)\"\n"
-        "HERMES_HOME=\"$ROLE_DIR/runtime\"\n\n"
-        "FLEET_ENV=\"${HERMES_FLEET_ENV:-$HOME/.hermes/fleet.env}\"\n"
-        "if [[ -f \"$FLEET_ENV\" ]]; then\n"
-        "  # shellcheck disable=SC1090\n"
-        "  source \"$FLEET_ENV\"\n"
-        "fi\n\n"
-        "HERMES_BIN=\"${HERMES_BIN:-${HERMES_FLEET_BIN:-$HOME/.hermes/hermes-agent/.venv/bin/hermes}}\"\n\n"
-        "HERMES_OAUTH_FILE=\"${HERMES_OAUTH_FILE:-${HERMES_FLEET_OAUTH_FILE:-$HOME/.hermes/auth.json}}\"\n"
-        "CODEX_HOME=\"${CODEX_HOME:-${HERMES_FLEET_CODEX_HOME:-$HOME/.codex}}\"\n\n"
-        "if [[ ! -d \"$HERMES_HOME\" ]]; then\n"
-        "  echo \"hermes: runtime submodule not initialized at $HERMES_HOME\" >&2\n"
-        "  echo \"  fix: git submodule update --init --recursive\" >&2\n"
-        "  exit 1\n"
-        "fi\n\n"
-        "if [[ ! -x \"$HERMES_BIN\" ]]; then\n"
-        "  echo \"hermes: binary not executable at $HERMES_BIN\" >&2\n"
-        "  echo \"  set HERMES_BIN or HERMES_FLEET_BIN (in $FLEET_ENV) to the shared Hermes binary.\" >&2\n"
-        "  exit 1\n"
-        "fi\n\n"
-        "exec env HERMES_HOME=\"$HERMES_HOME\" HERMES_FLEET_ENV=\"$FLEET_ENV\" "
-        "HERMES_OAUTH_FILE=\"$HERMES_OAUTH_FILE\" CODEX_HOME=\"$CODEX_HOME\" \"$HERMES_BIN\" \"$@\"\n"
-    )
-
-    mode = wrapper.stat().st_mode
-    wrapper.chmod(mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
-    wrapper_count += 1
-
-registry_path.write_text(yaml.safe_dump(data, sort_keys=False))
-print(f"updated wrappers: {wrapper_count}")
-print(f"updated registry entries: {meta_count}")
-print(f"copied role-local scaffolds: {scaffold_count}")
-print(f"patched role _lib.sh files: {lib_count}")
-print(f"patched systemd units: {systemd_count}")
-print(f"registry: {registry_path}")
-print(f"fleet env: {fleet_env}")
-print(f"shared bin: {hermes_bin}")
-print(f"shared repo: {hermes_repo}")
-print(f"shared oauth file: {oauth_file}")
-print(f"shared codex home: {codex_home}")
-PYEOF

package/templates/hermes-agent/scripts/fleet-sync.sh

@@ -1,369 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# fleet-sync — reconcile every deployed Hermes agent with the current
-# template and fleet contract. The registry (~/.hermes/agents-registry.yaml)
-# is the iteration source; the vendored template is the content source.
-#
-# Per agent:
-#   wrapper   <role_dir>/hermes regenerated from template/hermes.jinja
-#   contract  runtime/profile.yaml opts into config.inherit_from: default
-#   registry  ~/.hermes/profiles/<profile_name> -> <role_dir>/runtime
-#   role      <role_dir>/role.yaml profile: <profile_name>
-#   services  systemd gateway/consumer units restarted when something changed
-#
-# Default is a DRY-RUN drift report (exit 1 when drift exists, 0 when clean).
-# --apply writes the fixes and restarts the changed agents' services.
-# Anything that would require destroying or merging existing data (a real
-# directory where a symlink belongs, a profile.yaml with foreign content)
-# is reported as MANUAL and never touched.
-#
-# Usage: fleet-sync.sh [--apply] [--no-restart] [--agent <id>]...
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-WRAPPER_TEMPLATE="$SCRIPT_DIR/../template/hermes.jinja"
-
-HERMES_TEMPLATE_CONFIG="${HERMES_TEMPLATE_CONFIG:-${XDG_CONFIG_HOME:-$HOME/.config}/hermes-agent-template/config.toml}"
-cfg() {  # cfg <dotted.key> <default>
-  local key="$1" def="$2"
-  { [[ -f "$HERMES_TEMPLATE_CONFIG" ]] && command -v python3 >/dev/null 2>&1; } || { printf '%s' "$def"; return 0; }
-  python3 - "$HERMES_TEMPLATE_CONFIG" "$key" "$def" <<'PYEOF' || printf '%s' "$def"
-import sys, os
-try:
-    import tomllib
-except ModuleNotFoundError:
-    print(sys.argv[3], end=""); sys.exit(0)
-try:
-    cur = tomllib.load(open(sys.argv[1], "rb"))
-except Exception:
-    print(sys.argv[3], end=""); sys.exit(0)
-for p in sys.argv[2].split("."):
-    if isinstance(cur, dict) and p in cur:
-        cur = cur[p]
-    else:
-        print(sys.argv[3], end=""); sys.exit(0)
-print(os.path.expanduser(str(cur)), end="")
-PYEOF
-  return 0
-}
-
-FLEET_ENV="${HERMES_FLEET_ENV:-$(cfg fleet.fleet_env "$HOME/.hermes/fleet.env")}"
-if [[ -f "$FLEET_ENV" ]]; then
-  # shellcheck disable=SC1090
-  source "$FLEET_ENV"
-fi
-REGISTRY_FILE="${HERMES_FLEET_REGISTRY_FILE:-$(cfg fleet.registry_file "$HOME/.hermes/agents-registry.yaml")}"
-PROFILES_DIR="${HERMES_FLEET_HOME:-$HOME/.hermes}/profiles"
-VOXXY_PLUGIN_DIR="${VOXXY_PLUGIN_DIR:-$(cfg fleet.voxxy_plugin_dir "$HOME/code/voxxy/plugins/tts/voxxy")}"
-VOX_URL_VALUE="${VOX_URL:-$(cfg fleet.vox_url 'https://vox.delo.sh')}"
-
-APPLY=0
-RESTART=1
-declare -a ONLY_AGENTS=()
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --apply) APPLY=1 ;;
-    --no-restart) RESTART=0 ;;
-    --agent) shift; ONLY_AGENTS+=("$1") ;;
-    -h|--help) sed -n '3,21p' "$0"; exit 0 ;;
-    *) echo "fleet-sync: unknown flag $1" >&2; exit 2 ;;
-  esac
-  shift
-done
-
-[[ -f "$REGISTRY_FILE" ]] || { echo "fleet-sync: registry not found: $REGISTRY_FILE" >&2; exit 2; }
-[[ -f "$WRAPPER_TEMPLATE" ]] || { echo "fleet-sync: wrapper template not found: $WRAPPER_TEMPLATE" >&2; exit 2; }
-
-# Registry -> TSV: agent_id, role_dir, profile_name, gateway_unit, consumer_unit
-read_registry() {
-  python3 - "$REGISTRY_FILE" <<'PYEOF'
-import sys
-
-try:
-    import yaml
-    with open(sys.argv[1], encoding="utf-8") as f:
-        data = yaml.safe_load(f) or {}
-except ModuleNotFoundError:
-    sys.stderr.write("fleet-sync: python3-yaml is required to read the registry\n")
-    sys.exit(2)
-
-for agent_id, a in sorted((data.get("agents") or {}).items()):
-    if not isinstance(a, dict):
-        continue
-    systemd = a.get("systemd") or {}
-    print("\t".join([
-        agent_id,
-        str(a.get("role_dir") or ""),
-        str(a.get("profile_name") or agent_id),
-        str(systemd.get("gateway_unit") or ""),
-        str(systemd.get("consumer_unit") or ""),
-    ]))
-PYEOF
-}
-
-render_wrapper() {  # render_wrapper <agent_id>
-  sed "s/{{ agent_id }}/$1/g" "$WRAPPER_TEMPLATE"
-}
-
-DRIFT=0
-FIXED=0
-declare -a RESTART_UNITS=()
-
-# Registry agents sharing a role_dir would overwrite each other's wrapper
-# and role.yaml on --apply; refuse to write into contested dirs.
-CONTESTED_DIRS="$(read_registry | cut -f2 | sort | uniq -d)"
-
-note() {  # note <agent> <status> <message>
-  printf '%-34s %-7s %s\n' "$1" "$2" "$3"
-}
-
-ensure_env_key() {  # ensure_env_key <path> <key> <value>
-  python3 - "$1" "$2" "$3" <<'PYEOF'
-import pathlib, sys
-
-path = pathlib.Path(sys.argv[1])
-key = sys.argv[2]
-value = sys.argv[3]
-lines = path.read_text().splitlines() if path.exists() else []
-needle = f"{key}="
-for idx, line in enumerate(lines):
-    if line.startswith(needle):
-        lines[idx] = f'{key}="{value}"'
-        break
-else:
-    lines.append(f'{key}="{value}"')
-path.write_text("\n".join(lines) + "\n")
-PYEOF
-}
-
-wanted_agent() {
-  [[ ${#ONLY_AGENTS[@]} -eq 0 ]] && return 0
-  local a
-  for a in "${ONLY_AGENTS[@]}"; do [[ "$a" == "$1" ]] && return 0; done
-  return 1
-}
-
-while IFS=$'\t' read -r agent_id role_dir profile_name gateway_unit consumer_unit; do
-  wanted_agent "$agent_id" || continue
-  if [[ -z "$role_dir" || ! -d "$role_dir" ]]; then
-    note "$agent_id" DRIFT "role_dir missing: ${role_dir:-<unset>} (MANUAL: deprovision or fix registry)"
-    DRIFT=$((DRIFT + 1))
-    continue
-  fi
-  if [[ -n "$CONTESTED_DIRS" ]] && grep -qx "$role_dir" <<<"$CONTESTED_DIRS"; then
-    note "$agent_id" DRIFT "role_dir claimed by multiple registry agents: $role_dir (MANUAL: fix registry)"
-    DRIFT=$((DRIFT + 1))
-    continue
-  fi
-  runtime="$role_dir/runtime"
-  changed=0
-
-  # 1. Launcher wrapper regenerated from the current template.
-  expected_wrapper="$(render_wrapper "$agent_id")"
-  if [[ ! -f "$role_dir/hermes" ]] || ! diff -q <(printf '%s\n' "$expected_wrapper") "$role_dir/hermes" >/dev/null 2>&1; then
-    if [[ $APPLY -eq 1 ]]; then
-      printf '%s\n' "$expected_wrapper" > "$role_dir/hermes"
-      chmod +x "$role_dir/hermes"
-      note "$agent_id" FIXED "wrapper regenerated from template"
-      changed=1; FIXED=$((FIXED + 1))
-    else
-      note "$agent_id" DRIFT "wrapper differs from template"
-      DRIFT=$((DRIFT + 1))
-    fi
-  fi
-
-  # 2. Inherited-config contract in runtime/profile.yaml.
-  profile_yaml="$runtime/profile.yaml"
-  if [[ ! -d "$runtime" ]]; then
-    note "$agent_id" DRIFT "runtime dir missing: $runtime (MANUAL: re-provision)"
-    DRIFT=$((DRIFT + 1))
-  elif [[ ! -f "$profile_yaml" ]]; then
-    if [[ $APPLY -eq 1 ]]; then
-      printf 'config:\n  inherit_from: default\n  save_mode: delta\n' > "$profile_yaml"
-      note "$agent_id" FIXED "profile.yaml written (inherit_from: default)"
-      changed=1; FIXED=$((FIXED + 1))
-    else
-      note "$agent_id" DRIFT "profile.yaml missing (no inherited config)"
-      DRIFT=$((DRIFT + 1))
-    fi
-  elif ! grep -q 'inherit_from: default' "$profile_yaml"; then
-    note "$agent_id" DRIFT "profile.yaml lacks inherit_from: default (MANUAL: merge contract)"
-    DRIFT=$((DRIFT + 1))
-  fi
-
-  # 3. Profile symlink ~/.hermes/profiles/<profile_name> -> runtime.
-  # LOAD-BEARING: hermes resolves agents launched as `hermes --profile <name>`
-  # through this path (and recreates it as a fresh standalone dir if missing,
-  # disconnecting the agent from its runtime) — so it MUST point at the runtime.
-  link="$PROFILES_DIR/$profile_name"
-  if [[ -L "$link" ]]; then
-    if [[ "$(readlink -f "$link")" != "$(readlink -f "$runtime")" ]]; then
-      if [[ $APPLY -eq 1 ]]; then
-        ln -sfn "$runtime" "$link"
-        note "$agent_id" FIXED "profile symlink repointed -> $runtime"
-        changed=1; FIXED=$((FIXED + 1))
-      else
-        note "$agent_id" DRIFT "profile symlink points at $(readlink "$link")"
-        DRIFT=$((DRIFT + 1))
-      fi
-    fi
-  elif [[ -e "$link" ]]; then
-    note "$agent_id" DRIFT "$link is a real directory, expected symlink (MANUAL: merge state)"
-    DRIFT=$((DRIFT + 1))
-  else
-    if [[ $APPLY -eq 1 ]]; then
-      mkdir -p "$PROFILES_DIR"
-      ln -sfn "$runtime" "$link"
-      note "$agent_id" FIXED "profile symlink created -> $runtime"
-      changed=1; FIXED=$((FIXED + 1))
-    else
-      note "$agent_id" DRIFT "profile symlink missing"
-      DRIFT=$((DRIFT + 1))
-    fi
-  fi
-
-  # 4. role.yaml binds the registry profile name.
-  role_yaml="$role_dir/role.yaml"
-  if [[ -f "$role_yaml" ]] && ! grep -q "^profile: $profile_name$" "$role_yaml"; then
-    if [[ $APPLY -eq 1 ]] && grep -q '^profile: ' "$role_yaml"; then
-      sed -i "s/^profile: .*/profile: $profile_name/" "$role_yaml"
-      note "$agent_id" FIXED "role.yaml profile -> $profile_name"
-      changed=1; FIXED=$((FIXED + 1))
-    else
-      note "$agent_id" DRIFT "role.yaml profile != $profile_name"
-      DRIFT=$((DRIFT + 1))
-    fi
-  fi
-
-  # 5. PM fleet voice contract: runtime plugin symlink + Voxxy config + VOX_URL.
-  role_name="$(basename "$role_dir")"
-  if [[ "$role_name" == "pm" && -d "$runtime" ]]; then
-    plugin_link="$runtime/plugins/tts/voxxy"
-    if [[ -d "$VOXXY_PLUGIN_DIR" ]]; then
-      if [[ -L "$plugin_link" ]]; then
-        if [[ "$(readlink -f "$plugin_link")" != "$(readlink -f "$VOXXY_PLUGIN_DIR")" ]]; then
-          if [[ $APPLY -eq 1 ]]; then
-            mkdir -p "$runtime/plugins/tts"
-            ln -sfn "$VOXXY_PLUGIN_DIR" "$plugin_link"
-            note "$agent_id" FIXED "runtime Voxxy plugin relinked"
-            changed=1; FIXED=$((FIXED + 1))
-          else
-            note "$agent_id" DRIFT "runtime Voxxy plugin points at $(readlink "$plugin_link")"
-            DRIFT=$((DRIFT + 1))
-          fi
-        fi
-      elif [[ -e "$plugin_link" ]]; then
-        note "$agent_id" DRIFT "$plugin_link exists and is not a symlink (MANUAL: merge runtime plugin state)"
-        DRIFT=$((DRIFT + 1))
-      else
-        if [[ $APPLY -eq 1 ]]; then
-          mkdir -p "$runtime/plugins/tts"
-          ln -sfn "$VOXXY_PLUGIN_DIR" "$plugin_link"
-          note "$agent_id" FIXED "runtime Voxxy plugin linked"
-          changed=1; FIXED=$((FIXED + 1))
-        else
-          note "$agent_id" DRIFT "runtime Voxxy plugin missing"
-          DRIFT=$((DRIFT + 1))
-        fi
-      fi
-    else
-      note "$agent_id" DRIFT "configured Voxxy plugin dir missing: $VOXXY_PLUGIN_DIR (MANUAL: install voxxy repo)"
-      DRIFT=$((DRIFT + 1))
-    fi
-
-    runtime_env="$runtime/.env"
-    if [[ -n "$VOX_URL_VALUE" ]]; then
-      vox_env_status="$(python3 - "$runtime_env" "$VOX_URL_VALUE" <<'PYEOF'
-import pathlib, sys
-path = pathlib.Path(sys.argv[1])
-expected = sys.argv[2]
-if not path.exists():
-    print('missing-file')
-    raise SystemExit(0)
-for line in path.read_text().splitlines():
-    if line.startswith('VOX_URL='):
-        current = line.split('=', 1)[1].strip().strip('"').strip("'")
-        print('ok' if current == expected else 'mismatch')
-        raise SystemExit(0)
-print('missing-key')
-PYEOF
-)"
-      case "$vox_env_status" in
-        ok) ;;
-        *)
-          if [[ $APPLY -eq 1 ]]; then
-            ensure_env_key "$runtime_env" VOX_URL "$VOX_URL_VALUE"
-            chmod 600 "$runtime_env" 2>/dev/null || true
-            note "$agent_id" FIXED "runtime .env VOX_URL -> $VOX_URL_VALUE"
-            changed=1; FIXED=$((FIXED + 1))
-          else
-            note "$agent_id" DRIFT "runtime .env missing/incorrect VOX_URL"
-            DRIFT=$((DRIFT + 1))
-          fi
-          ;;
-      esac
-    fi
-
-    config_status="$(python3 - "$runtime/config.yaml" <<'PYEOF'
-import pathlib, sys
-
-path = pathlib.Path(sys.argv[1])
-if not path.exists():
-    print('missing')
-    raise SystemExit(0)
-text = path.read_text()
-provider = 'voxxy' if 'provider: voxxy' in text else 'other'
-plugin = 'yes' if 'tts/voxxy' in text else 'no'
-voice = 'rick' if 'voice: rick' in text else 'other'
-print(f'{provider}|{plugin}|{voice}')
-PYEOF
-)"
-    if [[ "$config_status" != "voxxy|yes|rick" ]]; then
-      if [[ "$APPLY" -eq 1 ]]; then
-        HERMES_HOME="$runtime" "${HERMES_FLEET_BIN:-$(cfg fleet.hermes_bin "$HOME/.hermes/hermes-agent/.venv/bin/hermes")}" config set plugins.enabled.0 tts/voxxy >/dev/null 2>&1 || true
-        HERMES_HOME="$runtime" "${HERMES_FLEET_BIN:-$(cfg fleet.hermes_bin "$HOME/.hermes/hermes-agent/.venv/bin/hermes")}" config set tts.provider voxxy >/dev/null 2>&1 || true
-        HERMES_HOME="$runtime" "${HERMES_FLEET_BIN:-$(cfg fleet.hermes_bin "$HOME/.hermes/hermes-agent/.venv/bin/hermes")}" config set tts.voice rick >/dev/null 2>&1 || true
-        note "$agent_id" FIXED "runtime TTS config enforced -> voxxy/rick"
-        changed=1; FIXED=$((FIXED + 1))
-      else
-        note "$agent_id" DRIFT "runtime Voxxy config missing from config.yaml"
-        DRIFT=$((DRIFT + 1))
-      fi
-    fi
-  fi
-
-  if [[ $changed -eq 1 && $RESTART -eq 1 ]]; then
-    [[ -n "$gateway_unit" ]] && RESTART_UNITS+=("$gateway_unit")
-    [[ -n "$consumer_unit" ]] && RESTART_UNITS+=("$consumer_unit")
-  fi
-done < <(read_registry)
-
-# 5. Stale registry symlinks: entries pointing into fleet runtimes under a
-# name the registry does not know. Reported only — removal is a human call.
-known_names="$(read_registry | cut -f3 | sort -u)"
-if [[ -d "$PROFILES_DIR" ]]; then
-  for link in "$PROFILES_DIR"/*; do
-    [[ -L "$link" ]] || continue
-    name="$(basename "$link")"
-    grep -qx "$name" <<<"$known_names" && continue
-    target="$(readlink "$link")"
-    if [[ "$target" == */agents/hermes/* ]]; then
-      note "$name" STALE "registry symlink not in agents-registry -> $target (MANUAL: remove or register)"
-      DRIFT=$((DRIFT + 1))
-    fi
-  done
-fi
-
-if [[ ${#RESTART_UNITS[@]} -gt 0 ]]; then
-  echo
-  echo "Restarting: ${RESTART_UNITS[*]}"
-  systemctl --user try-restart "${RESTART_UNITS[@]}" || true
-fi
-
-echo
-if [[ $APPLY -eq 1 ]]; then
-  echo "fleet-sync: $FIXED fixed, $DRIFT unresolved (manual)"
-else
-  echo "fleet-sync: $DRIFT drift item(s). Re-run with --apply to fix."
-fi
-[[ $DRIFT -eq 0 ]] || exit 1