@delorenj/pjangler 1.2.21 → 1.2.33

package/templates/hermes-agent/scripts/migrate-unify.sh

@@ -1,252 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# migrate-unify — one-time fleet migration to the unified single-PM model.
-#
-# Decommissions the legacy `scrum-master` agents, collapsing each repo from a
-# PM + scrum-master pair down to a single PM. The PM keeps running untouched;
-# its checkpoint→heartbeat refresh is a separate uniform pass (and with
-# reconcile disabled by default the PM heartbeat is checkpoint-only, so removing
-# the scrum-master is behavior-complete for the collapse).
-#
-# Drives ENTIRELY off the registry's role=scrum-master entries
-# (role_dir / project_path / runtime_repo) — NEVER name-derived paths, because
-# keepy-money lives at ~/code/tiller, zshyzsh at ~/.config/zshyzsh, and
-# delocontainers at ~/docker.
-#
-# Safety model:
-#   * DRY-RUN by default — prints exactly what it WOULD do, touches nothing.
-#   * --apply performs the REVERSIBLE local teardown:
-#       - stop + disable + remove the scrum-master's systemd --user units
-#       - `git submodule deinit` + `git rm` the scrum-master role dir + clean
-#         .gitmodules / .git/modules  (STAGED only — never commits or pushes)
-#       - remove the ~/.hermes/profiles/<sm-id> symlink
-#       - drop the scrum-master entry from the fleet registry (.bak first)
-#   * The IRREVERSIBLE `gh repo delete` of each scrum-master runtime repo is held
-#     behind BOTH --decommission-sm-remotes AND --yes-i-mean-it, and runs only
-#     after all local teardown has succeeded.
-#
-# It never commits or pushes any project repo — staged submodule removals are
-# left for you to review and commit (some live in sensitive repos: ~/docker,
-# ~/.config/zshyzsh).
-#
-# Usage:
-#   migrate-unify.sh                      # dry-run report (all scrum-masters)
-#   migrate-unify.sh --apply              # reversible local teardown
-#   migrate-unify.sh --apply --decommission-sm-remotes --yes-i-mean-it
-#                                         # + delete the runtime repos on GitHub
-#   migrate-unify.sh --agent pjangler-scrum-master [--apply ...]   # one only
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-
-HERMES_TEMPLATE_CONFIG="${HERMES_TEMPLATE_CONFIG:-${XDG_CONFIG_HOME:-$HOME/.config}/hermes-agent-template/config.toml}"
-cfg() {  # cfg <dotted.key> <default>
-  local key="$1" def="$2"
-  { [[ -f "$HERMES_TEMPLATE_CONFIG" ]] && command -v python3 >/dev/null 2>&1; } || { printf '%s' "$def"; return 0; }
-  python3 - "$HERMES_TEMPLATE_CONFIG" "$key" "$def" <<'PYEOF' || printf '%s' "$def"
-import sys, os
-try:
-    import tomllib
-except ModuleNotFoundError:
-    print(sys.argv[3], end=""); sys.exit(0)
-try:
-    cur = tomllib.load(open(sys.argv[1], "rb"))
-except Exception:
-    print(sys.argv[3], end=""); sys.exit(0)
-for p in sys.argv[2].split("."):
-    if isinstance(cur, dict) and p in cur:
-        cur = cur[p]
-    else:
-        print(sys.argv[3], end=""); sys.exit(0)
-print(os.path.expanduser(str(cur)), end="")
-PYEOF
-  return 0
-}
-
-FLEET_ENV="${HERMES_FLEET_ENV:-$(cfg fleet.fleet_env "$HOME/.hermes/fleet.env")}"
-[[ -f "$FLEET_ENV" ]] && { # shellcheck disable=SC1090
-  source "$FLEET_ENV"; }
-REGISTRY_FILE="${HERMES_FLEET_REGISTRY_FILE:-$(cfg fleet.registry_file "$HOME/.hermes/agents-registry.yaml")}"
-PROFILES_DIR="${HERMES_FLEET_HOME:-$HOME/.hermes}/profiles"
-SYS_DIR="$HOME/.config/systemd/user"
-
-APPLY=0
-DELETE_REMOTES=0
-CONFIRM=0
-declare -a ONLY_AGENTS=()
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --apply) APPLY=1 ;;
-    --decommission-sm-remotes) DELETE_REMOTES=1 ;;
-    --yes-i-mean-it) CONFIRM=1 ;;
-    --all) : ;;  # accepted for symmetry; default is already all scrum-masters
-    --agent) shift; ONLY_AGENTS+=("$1") ;;
-    -h|--help) sed -n '3,55p' "$0"; exit 0 ;;
-    *) echo "migrate-unify: unknown flag $1" >&2; exit 2 ;;
-  esac
-  shift
-done
-
-[[ -f "$REGISTRY_FILE" ]] || { echo "migrate-unify: registry not found: $REGISTRY_FILE" >&2; exit 2; }
-command -v python3 >/dev/null || { echo "migrate-unify: python3 required" >&2; exit 2; }
-
-MODE="DRY-RUN"; [[ $APPLY -eq 1 ]] && MODE="APPLY"
-echo "migrate-unify — mode: $MODE   registry: $REGISTRY_FILE"
-echo "================================================================"
-
-# Emit scrum-master rows (pjangler first), TSV: agent_id, repo, role_dir, project_path, runtime_repo, profile_name
-read_sm() {
-  python3 - "$REGISTRY_FILE" <<'PYEOF'
-import sys, yaml
-data = yaml.safe_load(open(sys.argv[1], encoding="utf-8")) or {}
-rows = []
-for aid, a in (data.get("agents") or {}).items():
-    if not isinstance(a, dict) or a.get("role") != "scrum-master":
-        continue
-    rows.append((aid, str(a.get("repo") or ""), str(a.get("role_dir") or ""),
-                 str(a.get("project_path") or ""), str(a.get("runtime_repo") or ""),
-                 str(a.get("profile_name") or aid)))
-# pjangler first (the reference repo / canary), then alphabetical.
-rows.sort(key=lambda r: (r[1] != "pjangler", r[0]))
-for r in rows:
-    print("\t".join(r))
-PYEOF
-}
-
-wanted() {
-  [[ ${#ONLY_AGENTS[@]} -eq 0 ]] && return 0
-  local a; for a in "${ONLY_AGENTS[@]}"; do [[ "$a" == "$1" ]] && return 0; done; return 1
-}
-
-run() {  # run <human-description> -- <cmd...>   (prints always; executes only on --apply)
-  local desc="$1"; shift
-  [[ "${1:-}" == "--" ]] && shift
-  if [[ $APPLY -eq 1 ]]; then
-    printf '    [do]   %s\n' "$desc"
-    local rc=0
-    "$@" >/dev/null 2>&1 || rc=$?
-    if [[ $rc -ne 0 ]]; then printf '      (non-fatal: returned %s)\n' "$rc"; fi
-  else
-    printf '    [dry]  %s\n' "$desc"
-  fi
-}
-
-declare -a REMOVE_IDS=()       # registry ids to drop (batched)
-declare -a DELETE_REPOS=()     # runtime repos to delete (gated, last)
-declare -a STAGED_REPOS=()     # project repos left with staged submodule removals
-PROCESSED=0
-
-while IFS=$'\t' read -r sm_id repo role_dir project_path runtime_repo profile_name; do
-  wanted "$sm_id" || continue
-  PROCESSED=$((PROCESSED + 1))
-  echo
-  echo ">>> $sm_id   (repo=$repo)"
-  echo "    role_dir     : $role_dir"
-  echo "    project_path : $project_path"
-  echo "    runtime_repo : $runtime_repo"
-
-  # 1. systemd --user units: stop + disable + remove every hermes-<sm_id>-* unit.
-  shopt -s nullglob
-  units=("$SYS_DIR/hermes-${sm_id}-"*)
-  shopt -u nullglob
-  if [[ ${#units[@]} -eq 0 ]]; then
-    echo "    units        : (none found on disk)"
-  else
-    for uf in "${units[@]}"; do
-      u="$(basename "$uf")"
-      run "stop+disable $u" -- systemctl --user disable --now "$u"
-      run "rm unit file $u" -- rm -f "$uf"
-    done
-    if [[ $APPLY -eq 1 ]]; then
-      systemctl --user daemon-reload 2>/dev/null || true
-      systemctl --user reset-failed 2>/dev/null || true
-    fi
-  fi
-
-  # 2. scrum-master runtime submodule + role dir (STAGED removal, never committed).
-  if [[ -n "$project_path" && ( -d "$project_path/.git" || -f "$project_path/.git" ) ]]; then
-    sm_rel="agents/hermes/scrum-master"
-    if [[ -e "$project_path/$sm_rel" ]]; then
-      run "git submodule deinit -f $sm_rel/runtime" -- git -C "$project_path" submodule deinit -f "$sm_rel/runtime"
-      run "git rm -rf $sm_rel (staged)" -- git -C "$project_path" rm -rf "$sm_rel"
-      run "rm .git/modules/$sm_rel residue" -- rm -rf "$project_path/.git/modules/$sm_rel"
-      run "scrub .gitmodules section" -- git -C "$project_path" config -f "$project_path/.gitmodules" --remove-section "submodule.$sm_rel/runtime"
-      if [[ $APPLY -eq 1 ]]; then STAGED_REPOS+=("$project_path"); fi
-    else
-      echo "    role dir     : already absent at $project_path/$sm_rel"
-    fi
-  else
-    echo "    submodule    : project_path is not a git repo, skipping submodule teardown: $project_path"
-  fi
-
-  # 3. profile symlink ~/.hermes/profiles/<sm_id>.
-  link="$PROFILES_DIR/$profile_name"
-  if [[ -L "$link" ]]; then
-    run "rm profile symlink $link" -- rm -f "$link"
-  elif [[ -e "$link" ]]; then
-    echo "    profile      : $link is a real dir, NOT a symlink — left untouched (MANUAL)"
-  else
-    echo "    profile      : no symlink at $link"
-  fi
-
-  # 4. registry entry (batched; rewritten once at the end with a .bak).
-  REMOVE_IDS+=("$sm_id")
-  echo "    registry     : will drop agents.$sm_id"
-
-  # 5. runtime repo delete (gated, deferred to the very end).
-  [[ -n "$runtime_repo" ]] && DELETE_REPOS+=("$runtime_repo")
-done < <(read_sm)
-
-if [[ $PROCESSED -eq 0 ]]; then
-  echo; echo "migrate-unify: no scrum-master agents matched. Nothing to do."
-  exit 0
-fi
-
-# --- Registry rewrite (batched) ---
-echo
-if [[ ${#REMOVE_IDS[@]} -gt 0 ]]; then
-  if [[ $APPLY -eq 1 ]]; then
-    python3 - "$REGISTRY_FILE" "${REMOVE_IDS[@]}" <<'PYEOF'
-import sys, shutil, datetime, yaml
-path = sys.argv[1]; ids = sys.argv[2:]
-shutil.copy(path, path + ".bak-" + datetime.datetime.now().strftime("%Y%m%d%H%M%S"))
-data = yaml.safe_load(open(path, encoding="utf-8")) or {}
-agents = data.get("agents") or {}
-removed = [i for i in ids if agents.pop(i, None) is not None]
-data["agents"] = agents
-with open(path, "w", encoding="utf-8") as f:
-    f.write(yaml.safe_dump(data, sort_keys=False))
-print("    registry: removed " + ", ".join(removed) + " (backup written)")
-PYEOF
-  else
-    echo "    [dry]  would drop registry entries: ${REMOVE_IDS[*]} (after .bak)"
-  fi
-fi
-
-# --- Irreversible remote deletes (double-gated, last) ---
-echo
-echo "Runtime repos to delete on GitHub:"
-printf '    %s\n' "${DELETE_REPOS[@]}"
-if [[ ${#DELETE_REPOS[@]} -gt 0 ]]; then
-  if [[ $APPLY -eq 1 && $DELETE_REMOTES -eq 1 && $CONFIRM -eq 1 ]]; then
-    if command -v gh >/dev/null 2>&1; then
-      for r in "${DELETE_REPOS[@]}"; do
-        printf '    [do]   gh repo delete %s --yes\n' "$r"
-        gh repo delete "$r" --yes 2>&1 | tail -1 || echo "      (delete failed or already gone: $r)"
-      done
-    else
-      echo "    gh not on PATH — cannot delete remotes."
-    fi
-  else
-    echo "    [HELD] add --apply --decommission-sm-remotes --yes-i-mean-it to delete these (IRREVERSIBLE)."
-  fi
-fi
-
-echo
-echo "================================================================"
-echo "migrate-unify: processed $PROCESSED scrum-master agent(s) in $MODE mode."
-if [[ $APPLY -eq 1 && ${#STAGED_REPOS[@]} -gt 0 ]]; then
-  echo
-  echo "Review + commit the staged scrum-master removals in these repos (NOT auto-committed):"
-  printf '%s\n' "${STAGED_REPOS[@]}" | sort -u | sed 's/^/    git -C /; s/$/ status/'
-fi

package/templates/hermes-agent/scripts/repair-runtime-checkpoint.sh

@@ -1,122 +0,0 @@
-#!/usr/bin/env bash
-# Repair a failing runtime-checkpoint service caused by an UNPOPULATED runtime
-# submodule (`git add -A` -> "fatal: in unpopulated submodule" -> exit 128).
-#
-# Dry-run by default (diagnose + print plan). Pass --apply to mutate. The mutate
-# path only ever runs `git init` / `fetch` / `reset --mixed` / `.gitignore` edits
-# / `rm --cached` — it NEVER rewrites working-tree files, so live runtime state
-# (incl. a large state.db) is preserved. It does NOT commit or push; run the
-# role's checkpoint.sh afterward.
-#
-# Docs: docs/runbooks/runtime-checkpoint-repair.md
-# Usage: repair-runtime-checkpoint.sh [--apply] <runtime-dir>
-set -euo pipefail
-
-APPLY=0; RT=""
-for a in "$@"; do
-  case "$a" in
-    --apply) APPLY=1 ;;
-    -h|--help) sed -n '2,12p' "$0"; exit 0 ;;
-    *) RT="$a" ;;
-  esac
-done
-
-die(){ printf 'ERROR: %s\n' "$*" >&2; exit 1; }
-note(){ printf '  %s\n' "$*"; }
-
-[ -n "$RT" ] || die "usage: $0 [--apply] <runtime-dir>  (e.g. agents/hermes/pm/runtime)"
-[ -d "$RT" ] || die "no such directory: $RT"
-
-PARENT="$(git -C "$RT" rev-parse --show-superproject-working-tree 2>/dev/null || true)"
-[ -n "$PARENT" ] || PARENT="$(git -C "$RT" rev-parse --show-toplevel 2>/dev/null || true)"
-[ -n "$PARENT" ] || die "$RT is not inside a git repository"
-RTABS="$(cd "$RT" && pwd)"
-RELPATH="${RTABS#"$PARENT"/}"
-
-MODE="dry-run"; [ "$APPLY" -eq 1 ] && MODE="APPLY"
-printf '== runtime-checkpoint repair (%s) ==\n' "$MODE"
-note "runtime: $RTABS"
-note "parent:  $PARENT"
-note "subpath: $RELPATH"
-
-if git -C "$RTABS" rev-parse --git-dir >/dev/null 2>&1 && [ -e "$RTABS/.git" ]; then
-  POPULATED=1; note "state:   runtime already has its own .git (re-attach not needed)"
-else
-  POPULATED=0; note "state:   UNPOPULATED submodule (no .git) — re-attach required"
-fi
-
-URL="$(git -C "$PARENT" config -f "$PARENT/.gitmodules" --get "submodule.$RELPATH.url" 2>/dev/null || true)"
-[ -n "$URL" ] || die "no .gitmodules url for submodule '$RELPATH'"
-note "remote:  $URL"
-GIT_SSH_COMMAND='ssh -o BatchMode=yes -o ConnectTimeout=15' git ls-remote "$URL" >/dev/null 2>&1 \
-  || die "remote not reachable (check SSH/network): $URL"
-note "remote reachable: yes"
-
-IGNORE_MARK='NOT part of the durable brain backup'
-IGNORE_BLOCK='# Runtime working state — NOT part of the durable brain backup.
-*.db
-*.db-wal
-*.db-shm
-*.sqlite
-*.sqlite3
-*.lock
-.update_check
-lsp/
-checkpoints/
-sessions/
-cron/
-*_cache.json'
-
-if [ "$APPLY" -eq 0 ]; then
-  cat <<EOF
-
-PLAN (dry-run; re-run with --apply):
-  cd $RELPATH
-  $( [ "$POPULATED" -eq 0 ] && echo "git init -q; git symbolic-ref HEAD refs/heads/main; git remote add origin <url>; git fetch origin; git reset --mixed origin/main" || echo "(already populated — skip re-init)" )
-  git lfs install --local
-  git checkout origin/main -- .gitattributes README.md   # restore tracked config
-  ensure runtime/.gitignore has the volatile-state block
-  git rm -r --cached --ignore-unmatch state.db state.db-wal state.db-shm cron
-  # safety gate: git add -A --dry-run must show no >1MB blobs / secrets / volatile paths
-  then: run the role's checkpoint.sh and (re)start the systemd checkpoint unit.
-EOF
-  exit 0
-fi
-
-cd "$RTABS"
-if [ "$POPULATED" -eq 0 ]; then
-  git init -q
-  git symbolic-ref HEAD refs/heads/main
-  git remote add origin "$URL" 2>/dev/null || git remote set-url origin "$URL"
-  GIT_SSH_COMMAND='ssh -o BatchMode=yes -o ConnectTimeout=20' git fetch -q origin
-  git reset --mixed -q origin/main
-  git branch --set-upstream-to=origin/main main >/dev/null 2>&1 || true
-  note "re-attached HEAD -> $(git rev-parse --short HEAD) on $(git rev-parse --abbrev-ref HEAD)"
-fi
-git lfs install --local >/dev/null 2>&1 || true
-git checkout origin/main -- .gitattributes README.md 2>/dev/null || true
-
-touch .gitignore
-if grep -q "$IGNORE_MARK" .gitignore 2>/dev/null; then
-  note ".gitignore already has the volatile-state block"
-else
-  printf '\n%s\n' "$IGNORE_BLOCK" >> .gitignore
-  note "appended volatile-state ignore block to .gitignore"
-fi
-git rm -r --cached --quiet --ignore-unmatch state.db state.db-wal state.db-shm cron 2>/dev/null || true
-
-# ---- mandatory safety gate ----
-staged(){ git add -A --dry-run 2>/dev/null | sed -E "s/^[a-z]+ '?//; s/'?$//"; }
-BIG="$(staged | while read -r f; do [ -f "$f" ] && s=$(stat -c%s "$f" 2>/dev/null) && [ "${s:-0}" -gt 1048576 ] && printf '%s (%sMB)\n' "$f" "$((s/1048576))"; done)"
-SECRETS="$(staged | grep -iE '(^|/)(\.env|\.env\.|auth\.json|auth\.lock)([./]|$)|\.(pem|key)$' || true)"
-VOL="$(staged | grep -E '(^|/)(state\.db|lsp|sessions|checkpoints)(/|$)' || true)"
-if [ -n "$BIG$SECRETS$VOL" ]; then
-  printf 'SAFETY GATE FAILED — fix .gitignore before committing.\n' >&2
-  [ -n "$BIG" ]     && printf '  >1MB blobs:\n%s\n' "$BIG" >&2
-  [ -n "$SECRETS" ] && printf '  secrets:\n%s\n' "$SECRETS" >&2
-  [ -n "$VOL" ]     && printf '  volatile state:\n%s\n' "$VOL" >&2
-  exit 2
-fi
-note "safety gate passed: staged set is brain-only."
-note "DONE. Now run the role's checkpoint.sh, then:"
-note "  systemctl --user reset-failed <checkpoint-service> && systemctl --user start <checkpoint-service>"

package/templates/hermes-agent/scripts/retrofit-70-envfile.sh

@@ -1,129 +0,0 @@
-#!/usr/bin/env bash
-# Retrofit existing fleet systemd unit files to load runtime/.env.
-#
-# Companion to the fix in commit 3b7d2e5 (template/.scripts/70-systemd.sh).
-# Future agents pick the fix up automatically via pjangler; existing agents
-# already have unit files installed at ~/.config/systemd/user/ that won't
-# change until we rewrite them in place.
-#
-# What this does:
-#   - Finds every hermes-<agent>-{gateway,consumer}.service unit
-#   - Inserts `EnvironmentFile=-<runtime>/.env` after `Environment=HERMES_HOME=...`
-#     if not already present
-#   - daemon-reloads once
-#   - restarts each unit it modified (skippable with --no-restart)
-#
-# Idempotent: re-running is a no-op if the directive is already present.
-# Dry-run by default; pass --apply to actually write/restart.
-#
-# Usage:
-#   scripts/retrofit-70-envfile.sh             # dry-run: show what would change
-#   scripts/retrofit-70-envfile.sh --apply     # write + daemon-reload + restart
-#   scripts/retrofit-70-envfile.sh --apply --no-restart
-#
-set -euo pipefail
-
-APPLY=0
-RESTART=1
-for arg in "$@"; do
-  case "$arg" in
-    --apply)      APPLY=1 ;;
-    --no-restart) RESTART=0 ;;
-    -h|--help)
-      sed -n '2,/^set -euo/p' "$0" | sed 's/^# \{0,1\}//;/^set -euo/d'
-      exit 0
-      ;;
-    *) echo "unknown arg: $arg" >&2; exit 2 ;;
-  esac
-done
-
-SYS_DIR="$HOME/.config/systemd/user"
-DIRECTIVE_PREFIX="EnvironmentFile=-"
-
-shopt -s nullglob
-UNITS=( "$SYS_DIR"/hermes-*-gateway.service "$SYS_DIR"/hermes-*-consumer.service )
-shopt -u nullglob
-
-if [[ ${#UNITS[@]} -eq 0 ]]; then
-  echo "no hermes-*-{gateway,consumer}.service units found under $SYS_DIR"
-  exit 0
-fi
-
-mode="DRY-RUN"; [[ "$APPLY" == "1" ]] && mode="APPLY"
-echo "[$mode] scanning ${#UNITS[@]} unit(s) under $SYS_DIR"
-
-MODIFIED=()
-SKIPPED_OK=()
-SKIPPED_BAD=()
-
-for unit in "${UNITS[@]}"; do
-  base="$(basename "$unit")"
-
-  # Parse the runtime path from the Environment=HERMES_HOME= line.
-  runtime="$(grep -E '^Environment=HERMES_HOME=' "$unit" | head -1 | cut -d= -f3-)"
-  if [[ -z "$runtime" ]]; then
-    echo "  SKIP  $base — no Environment=HERMES_HOME= line; not a template-generated unit"
-    SKIPPED_BAD+=( "$base" )
-    continue
-  fi
-
-  expected="${DIRECTIVE_PREFIX}${runtime}/.env"
-
-  if grep -qxF "$expected" "$unit"; then
-    echo "  OK    $base — already has $expected"
-    SKIPPED_OK+=( "$base" )
-    continue
-  fi
-
-  echo "  PATCH $base"
-  echo "          + $expected"
-
-  if [[ "$APPLY" == "1" ]]; then
-    # Insert the directive on the line AFTER the Environment=HERMES_HOME= line.
-    # Use a tmp file + atomic replace to avoid half-written units.
-    tmp="$(mktemp "$unit.XXXXXX")"
-    awk -v ins="$expected" '
-      { print }
-      /^Environment=HERMES_HOME=/ && !done { print ins; done=1 }
-    ' "$unit" > "$tmp"
-    chmod --reference="$unit" "$tmp"
-    mv "$tmp" "$unit"
-  fi
-  MODIFIED+=( "$base" )
-done
-
-echo
-echo "summary:"
-echo "  ${#MODIFIED[@]} patched, ${#SKIPPED_OK[@]} already correct, ${#SKIPPED_BAD[@]} skipped (non-template)"
-
-if [[ "$APPLY" != "1" ]]; then
-  echo
-  echo "dry-run only. re-run with --apply to write the changes."
-  exit 0
-fi
-
-if [[ ${#MODIFIED[@]} -eq 0 ]]; then
-  echo "nothing to reload."
-  exit 0
-fi
-
-echo
-echo "systemctl --user daemon-reload"
-systemctl --user daemon-reload
-
-if [[ "$RESTART" != "1" ]]; then
-  echo "skipping restarts (--no-restart). reload only."
-  exit 0
-fi
-
-echo
-echo "restarting ${#MODIFIED[@]} modified unit(s)..."
-for unit in "${MODIFIED[@]}"; do
-  echo "  systemctl --user restart $unit"
-  if ! systemctl --user restart "$unit"; then
-    echo "    WARN: restart failed for $unit (status below)" >&2
-    systemctl --user --no-pager status "$unit" | head -10 >&2 || true
-  fi
-done
-
-echo "done."

package/templates/hermes-agent/scripts/unify-pm.sh

@@ -1,148 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# unify-pm — Phase C (safe subset): move every deployed PM toward the unified
-# single-PM model WITHOUT disrupting running services.
-#
-# Per PM (driven off registry role=pm, so specialized non-pm profiles are
-# naturally skipped):
-#   1. refresh .scripts/checkpoint.sh — applies the secret-scan gate to the live
-#      hourly checkpoint (the existing checkpoint.service ExecStarts this file).
-#   2. refresh the <role_dir>/hermes launcher to the runtime-only template
-#      (drops the stale profile-fallback; used for interactive `hermes chat`,
-#      never by the systemd units).
-#   3. ensure ~/.hermes/profiles/<profile_name> symlinks to ./runtime. This is
-#      LOAD-BEARING — hermes resolves `--profile <name>` through it (and recreates
-#      it as a fresh standalone dir if missing, disconnecting the agent from its
-#      runtime), so it is repaired/created, NEVER dropped.
-#
-# Does NOT touch gateway/consumer/checkpoint units, the registry, or runtimes.
-# The checkpoint→heartbeat unit rename + sentinel install is a separate pass.
-#
-# DRY-RUN by default; --apply performs; --agent <id>... scopes; pjangler-pm first.
-#
-# Usage: unify-pm.sh [--apply] [--agent <pm-id>]...
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-TEMPLATE_DIR="$SCRIPT_DIR/../template"
-CHECKPOINT_SRC="$TEMPLATE_DIR/.scripts/checkpoint.sh"
-WRAPPER_TEMPLATE="$TEMPLATE_DIR/hermes.jinja"
-
-HERMES_TEMPLATE_CONFIG="${HERMES_TEMPLATE_CONFIG:-${XDG_CONFIG_HOME:-$HOME/.config}/hermes-agent-template/config.toml}"
-cfg() {
-  local key="$1" def="$2"
-  { [[ -f "$HERMES_TEMPLATE_CONFIG" ]] && command -v python3 >/dev/null 2>&1; } || { printf '%s' "$def"; return 0; }
-  python3 - "$HERMES_TEMPLATE_CONFIG" "$key" "$def" <<'PYEOF' || printf '%s' "$def"
-import sys, os
-try:
-    import tomllib
-except ModuleNotFoundError:
-    print(sys.argv[3], end=""); sys.exit(0)
-try:
-    cur = tomllib.load(open(sys.argv[1], "rb"))
-except Exception:
-    print(sys.argv[3], end=""); sys.exit(0)
-for p in sys.argv[2].split("."):
-    if isinstance(cur, dict) and p in cur:
-        cur = cur[p]
-    else:
-        print(sys.argv[3], end=""); sys.exit(0)
-print(os.path.expanduser(str(cur)), end="")
-PYEOF
-  return 0
-}
-
-REGISTRY_FILE="${HERMES_FLEET_REGISTRY_FILE:-$(cfg fleet.registry_file "$HOME/.hermes/agents-registry.yaml")}"
-PROFILES_DIR="${HERMES_FLEET_HOME:-$HOME/.hermes}/profiles"
-SYS_DIR="$HOME/.config/systemd/user"
-
-APPLY=0
-declare -a ONLY=()
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --apply) APPLY=1 ;;
-    --agent) shift; ONLY+=("$1") ;;
-    -h|--help) sed -n '3,30p' "$0"; exit 0 ;;
-    *) echo "unify-pm: unknown flag $1" >&2; exit 2 ;;
-  esac
-  shift
-done
-
-[[ -f "$REGISTRY_FILE" ]] || { echo "unify-pm: registry not found: $REGISTRY_FILE" >&2; exit 2; }
-[[ -f "$CHECKPOINT_SRC" ]] || { echo "unify-pm: template checkpoint.sh not found: $CHECKPOINT_SRC" >&2; exit 2; }
-[[ -f "$WRAPPER_TEMPLATE" ]] || { echo "unify-pm: wrapper template not found: $WRAPPER_TEMPLATE" >&2; exit 2; }
-
-MODE="DRY-RUN"; [[ $APPLY -eq 1 ]] && MODE="APPLY"
-echo "unify-pm — mode: $MODE   registry: $REGISTRY_FILE"
-echo "================================================================"
-
-# PM rows (pjangler first), TSV: agent_id, role_dir, profile_name
-read_pm() {
-  python3 - "$REGISTRY_FILE" <<'PYEOF'
-import sys, yaml
-d = yaml.safe_load(open(sys.argv[1], encoding="utf-8")) or {}
-rows = [(aid, str(a.get("role_dir") or ""), str(a.get("profile_name") or aid))
-        for aid, a in (d.get("agents") or {}).items()
-        if isinstance(a, dict) and a.get("role") == "pm"]
-rows.sort(key=lambda r: (r[0] != "pjangler-pm", r[0]))
-for r in rows:
-    print("\t".join(r))
-PYEOF
-}
-
-wanted() { [[ ${#ONLY[@]} -eq 0 ]] && return 0; local a; for a in "${ONLY[@]}"; do [[ "$a" == "$1" ]] && return 0; done; return 1; }
-
-CK=0; WR=0; SL=0; SKIP=0
-while IFS=$'\t' read -r aid role_dir profile_name; do
-  wanted "$aid" || continue
-  echo
-  echo ">>> $aid"
-  if [[ -z "$role_dir" || ! -d "$role_dir" ]]; then
-    echo "    role_dir missing: ${role_dir:-<unset>} — skipping"; SKIP=$((SKIP+1)); continue
-  fi
-  runtime="$role_dir/runtime"
-
-  # 1. checkpoint.sh secret-gate refresh.
-  dst="$role_dir/.scripts/checkpoint.sh"
-  if [[ ! -f "$dst" ]] || ! diff -q "$CHECKPOINT_SRC" "$dst" >/dev/null 2>&1; then
-    if [[ $APPLY -eq 1 ]]; then
-      mkdir -p "$role_dir/.scripts"; cp "$CHECKPOINT_SRC" "$dst"; chmod +x "$dst"
-      echo "    [do]  checkpoint.sh refreshed (secret-gate)"; CK=$((CK+1))
-    else
-      echo "    [dry] checkpoint.sh would be refreshed (secret-gate)"; CK=$((CK+1))
-    fi
-  else
-    echo "    checkpoint.sh already current"
-  fi
-
-  # 2. launcher → runtime-only template.
-  expected_wrapper="$(sed "s/{{ agent_id }}/$aid/g" "$WRAPPER_TEMPLATE")"
-  if [[ ! -f "$role_dir/hermes" ]] || ! diff -q <(printf '%s\n' "$expected_wrapper") "$role_dir/hermes" >/dev/null 2>&1; then
-    if [[ $APPLY -eq 1 ]]; then
-      printf '%s\n' "$expected_wrapper" > "$role_dir/hermes"; chmod +x "$role_dir/hermes"
-      echo "    [do]  launcher regenerated (runtime-only)"; WR=$((WR+1))
-    else
-      echo "    [dry] launcher would be regenerated (runtime-only)"; WR=$((WR+1))
-    fi
-  else
-    echo "    launcher already current"
-  fi
-
-  # 3. ensure the profile symlink points at the runtime (load-bearing; never drop).
-  link="$PROFILES_DIR/$profile_name"
-  if [[ -L "$link" && "$(readlink -f "$link")" == "$(readlink -f "$runtime")" ]]; then
-    echo "    profile symlink ok -> runtime"
-  elif [[ -e "$link" && ! -L "$link" ]]; then
-    echo "    profile entry is a REAL dir (MANUAL merge): $link — left untouched"; SKIP=$((SKIP+1))
-  else
-    if [[ $APPLY -eq 1 ]]; then
-      mkdir -p "$PROFILES_DIR"; ln -sfn "$runtime" "$link"; echo "    [do]  profile symlink set -> runtime"; SL=$((SL+1))
-    else
-      echo "    [dry] profile symlink would be set -> runtime"; SL=$((SL+1))
-    fi
-  fi
-done < <(read_pm)
-
-echo
-echo "================================================================"
-echo "unify-pm: checkpoint=$CK launcher=$WR symlink-repair=$SL skipped=$SKIP  ($MODE)"