npm - @delorenj/pjangler - Versions diffs - 1.2.21 → 1.2.33 - Mend

@delorenj/pjangler 1.2.21 → 1.2.33

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (835) hide show

package/templates/hermes-agent/template/.scripts/31-slack.sh ADDED Viewed

@@ -0,0 +1,362 @@
+#!/usr/bin/env bash
+# Opt-in, profile-local Slack Socket Mode provisioning.
+#
+# Slack credentials are invocation-only inputs.  Capture them before _lib.sh
+# sources fleet.env so an accidentally shared fleet token can never provision a
+# profile.  The non-secret allowed-user policy may still come from fleet.env.
+INVOCATION_SLACK_BOT_TOKEN="${SLACK_BOT_TOKEN-}"
+INVOCATION_SLACK_APP_TOKEN="${SLACK_APP_TOKEN-}"
+INVOCATION_SLACK_ALLOWED_USERS="${SLACK_ALLOWED_USERS-}"
+INVOCATION_ENABLE_SLACK="${ENABLE_SLACK-${WIRE_SLACK-}}"
+# shellcheck source=_lib.sh
+source "$(dirname "$0")/_lib.sh"
+load_role_env
+SLACK_BOT_TOKEN="$INVOCATION_SLACK_BOT_TOKEN"
+SLACK_APP_TOKEN="$INVOCATION_SLACK_APP_TOKEN"
+if [[ -n "$INVOCATION_SLACK_ALLOWED_USERS" ]]; then
+  SLACK_ALLOWED_USERS="$INVOCATION_SLACK_ALLOWED_USERS"
+else
+  SLACK_ALLOWED_USERS="${SLACK_ALLOWED_USERS-}"
+fi
+ENABLE_SLACK="$INVOCATION_ENABLE_SLACK"
+unset INVOCATION_SLACK_BOT_TOKEN INVOCATION_SLACK_APP_TOKEN
+slack_yaml_update() {
+  python3 - "$ROLE_YAML" "$@" <<'PYEOF'
+import json
+import pathlib
+import re
+import sys
+path = pathlib.Path(sys.argv[1])
+updates = dict(zip(sys.argv[2::2], sys.argv[3::2]))
+text = path.read_text(encoding="utf-8")
+match = re.search(r"(?ms)^slack:\s*\n(?P<body>(?:^[ \t]+.*\n?)*)", text)
+if not match:
+    raise SystemExit(f"slack metadata block missing from {path}")
+body = match.group("body")
+for key, value in updates.items():
+    replacement = f"  {key}: {json.dumps(value)}"
+    body, count = re.subn(
+        rf"(?m)^\s+{re.escape(key)}:\s*.*$", lambda _: replacement, body, count=1
+    )
+    if count != 1:
+        raise SystemExit(f"Slack metadata key {key!r} missing from {path}")
+path.write_text(text[: match.start("body")] + body + text[match.end("body") :], encoding="utf-8")
+PYEOF
+}
+truthy() {
+  case "${1,,}" in
+    1|true|yes|on) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+if [[ "${SKIP_SLACK:-0}" == "1" ]]; then
+  slack_yaml_update provisioning_status disabled
+  log "[31] slack — DISABLED (SKIP_SLACK=1)"
+  mark_done 31-slack
+  exit 0
+fi
+already_done 31-slack && { log "[31] slack already wired — skipping"; exit 0; }
+have_bot=0
+have_app=0
+[[ -n "$SLACK_BOT_TOKEN" ]] && have_bot=1
+[[ -n "$SLACK_APP_TOKEN" ]] && have_app=1
+if ! truthy "${ENABLE_SLACK:-0}" && (( ! have_bot && ! have_app )); then
+  slack_yaml_update provisioning_status deferred
+  log "[31] slack — deferred (opt in with ENABLE_SLACK=1 or supply both Slack tokens)"
+  exit 0
+fi
+if (( have_bot != have_app )) && ! truthy "${ENABLE_SLACK:-0}"; then
+  die "Slack provisioning requires a dedicated SLACK_BOT_TOKEN and SLACK_APP_TOKEN pair"
+fi
+if truthy "${ENABLE_SLACK:-0}" && [[ -t 0 ]]; then
+  if [[ -z "$SLACK_BOT_TOKEN" ]]; then
+    read -r -s -p "Slack Bot User OAuth Token (xoxb-...): " SLACK_BOT_TOKEN
+    echo >&2
+  fi
+  if [[ -z "$SLACK_APP_TOKEN" ]]; then
+    read -r -s -p "Slack App-Level Socket Mode Token (xapp-...): " SLACK_APP_TOKEN
+    echo >&2
+  fi
+fi
+[[ -n "$SLACK_BOT_TOKEN" && -n "$SLACK_APP_TOKEN" ]] \
+  || die "Slack provisioning requires both SLACK_BOT_TOKEN and SLACK_APP_TOKEN"
+[[ "$SLACK_BOT_TOKEN" == xoxb-* ]] || die "SLACK_BOT_TOKEN must be a Bot User OAuth token (xoxb-...)"
+[[ "$SLACK_APP_TOKEN" == xapp-* ]] || die "SLACK_APP_TOKEN must be an App-Level Socket Mode token (xapp-...)"
+SLACK_ALLOWED_USERS="${SLACK_ALLOWED_USERS//[[:space:]]/}"
+if [[ -n "$SLACK_ALLOWED_USERS" && "$SLACK_ALLOWED_USERS" != "*" \
+      && ! "$SLACK_ALLOWED_USERS" =~ ^[UW][A-Z0-9]+(,[UW][A-Z0-9]+)*$ ]]; then
+  die "SLACK_ALLOWED_USERS must be '*' or comma-separated Slack member IDs"
+fi
+RUNTIME="$ROLE_DIR/runtime"
+ENVF="$RUNTIME/.env"
+mkdir -p "$RUNTIME"
+[[ ! -L "$ENVF" ]] || die "refusing to write Slack credentials through symlink: $ENVF"
+log "[31] verifying Slack bot identity via auth.test"
+auth_response=$(curl -fsS \
+  -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -X POST "https://slack.com/api/auth.test") \
+  || die "Slack auth.test request failed"
+identity=$(printf '%s' "$auth_response" | python3 -c '
+import json, sys
+try:
+    data = json.load(sys.stdin)
+except Exception:
+    raise SystemExit("Slack auth.test returned an invalid response")
+if not data.get("ok"):
+    error = str(data.get("error") or "unknown_error")
+    safe = "".join(c for c in error if c.isalnum() or c in "_-.")[:80]
+    raise SystemExit("Slack auth.test rejected the bot token ({})".format(safe or "unknown_error"))
+values = [data.get(k, "") for k in ("team_id", "team", "user_id", "bot_id", "user")]
+if not values[0] or not values[2]:
+    raise SystemExit("Slack auth.test response omitted required identity fields")
+print("\t".join(str(v).replace("\t", " ").replace("\n", " ") for v in values))
+') || die "Slack bot identity verification failed"
+IFS=$'\t' read -r slack_team_id slack_team_name slack_bot_user_id slack_bot_id slack_bot_username <<< "$identity"
+# Reject credential reuse, token rotation onto an identity owned by another
+# agent, and credentials parked in shared env files. The scan, durable identity
+# claim, and profile credential write share one fleet-wide flock.
+export SLACK_BOT_TOKEN SLACK_APP_TOKEN SLACK_ALLOWED_USERS
+fleet_lock_acquire
+trap 'fleet_lock_release' EXIT
+python3 - "$REGISTRY_FILE" "$FLEET_ENV" "$ENVF" "$AGENT_ID" \
+  "$slack_team_id" "$slack_bot_user_id" "$slack_bot_id" \
+  "$ROLE_DIR" "$PROFILE_NAME" "$slack_team_name" "$slack_bot_username" <<'PYEOF'
+import errno
+import os
+import pathlib
+import re
+import sys
+import tempfile
+try:
+    import yaml  # type: ignore
+except ImportError:
+    raise SystemExit("PyYAML is required for Slack fleet claims")
+(
+    registry_path,
+    fleet_path,
+    target_path,
+    agent_id,
+    team_id,
+    user_id,
+    bot_id,
+    role_dir,
+    profile_name,
+    team_name,
+    bot_username,
+) = sys.argv[1:]
+bot_token = os.environ["SLACK_BOT_TOKEN"]
+app_token = os.environ["SLACK_APP_TOKEN"]
+target = pathlib.Path(target_path).resolve(strict=False)
+def env_values(path):
+    try:
+        text = path.read_text(encoding="utf-8")
+    except (OSError, UnicodeError):
+        return {}
+    values = {}
+    for key in ("SLACK_BOT_TOKEN", "SLACK_APP_TOKEN"):
+        match = re.search(rf"(?m)^\s*(?:export\s+)?{key}\s*=\s*(.*)$", text)
+        if match:
+            value = match.group(1).strip()
+            if len(value) >= 2 and value[0] == value[-1] and value[0] in "\"'":
+                value = value[1:-1]
+            values[key] = value
+    return values
+owners = [("shared fleet environment", pathlib.Path(fleet_path))]
+registry = pathlib.Path(registry_path)
+if registry.is_symlink():
+    raise SystemExit(f"refusing to update registry symlink: {registry}")
+data = {"schema_version": 1, "agents": {}}
+if registry.is_file():
+    try:
+        data = yaml.safe_load(registry.read_text(encoding="utf-8")) or data
+    except Exception as exc:
+        raise SystemExit(f"cannot safely inspect Slack ownership registry: {type(exc).__name__}")
+if not isinstance(data, dict) or not isinstance(data.get("agents", {}), dict):
+    raise SystemExit("cannot safely inspect Slack ownership registry: invalid agents mapping")
+agents = data.setdefault("agents", {})
+for other_id, entry in agents.items():
+    if other_id == agent_id or not isinstance(entry, dict):
+        continue
+    slack = entry.get("slack") or {}
+    if isinstance(slack, dict):
+        same_user = user_id and slack.get("bot_user_id") == user_id
+        same_bot = bot_id and slack.get("bot_id") == bot_id
+        same_team_user = team_id and same_user and slack.get("team_id") == team_id
+        if same_bot or same_team_user:
+            raise SystemExit(f"Slack bot identity is already assigned to agent {other_id}")
+    other_role_dir = entry.get("role_dir")
+    if other_role_dir:
+        owners.append((f"agent {other_id}", pathlib.Path(str(other_role_dir)) / "runtime" / ".env"))
+home_value = os.environ.get("HOME", "")
+if home_value:
+    home = pathlib.Path(home_value)
+    owners.append(("shared Hermes root", home / ".hermes" / ".env"))
+    profiles = home / ".hermes" / "profiles"
+    if profiles.is_dir():
+        for profile in profiles.iterdir():
+            owners.append((f"profile {profile.name}", profile / ".env"))
+seen = set()
+for owner, path in owners:
+    resolved = path.resolve(strict=False)
+    if resolved == target or resolved in seen:
+        continue
+    seen.add(resolved)
+    values = env_values(path)
+    if values.get("SLACK_BOT_TOKEN") == bot_token:
+        raise SystemExit(f"Slack bot token is already assigned to {owner}")
+    if values.get("SLACK_APP_TOKEN") == app_token:
+        raise SystemExit(f"Slack app token is already assigned to {owner}")
+claim = agents.setdefault(agent_id, {})
+if not isinstance(claim, dict):
+    raise SystemExit(f"registry entry for {agent_id} is not a mapping")
+claim["role_dir"] = role_dir
+claim["profile_name"] = profile_name
+claim["slack"] = {
+    "provisioning_status": "verified",
+    "team_id": team_id,
+    "team_name": team_name,
+    "bot_user_id": user_id,
+    "bot_id": bot_id,
+    "bot_username": bot_username,
+}
+registry.parent.mkdir(parents=True, exist_ok=True)
+rendered = yaml.safe_dump(data, sort_keys=False)
+def fsync_parent(target):
+    unsupported = {errno.EINVAL, getattr(errno, "ENOTSUP", errno.EINVAL), errno.ENOSYS}
+    flags = os.O_RDONLY | getattr(os, "O_DIRECTORY", 0)
+    try:
+        directory_fd = os.open(target.parent, flags)
+    except OSError as exc:
+        if exc.errno in unsupported:
+            return
+        raise
+    try:
+        try:
+            os.fsync(directory_fd)
+        except OSError as exc:
+            if exc.errno not in unsupported:
+                raise
+    finally:
+        os.close(directory_fd)
+fd, temporary = tempfile.mkstemp(prefix=f".{registry.name}.slack-", dir=registry.parent)
+try:
+    os.fchmod(fd, 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as handle:
+        handle.write(rendered)
+        handle.flush()
+        os.fsync(handle.fileno())
+    os.replace(temporary, registry)
+    os.chmod(registry, 0o600)
+    fsync_parent(registry)
+except BaseException:
+    try:
+        os.unlink(temporary)
+    except FileNotFoundError:
+        pass
+    raise
+PYEOF
+# Atomically replace only the Slack fields in the profile-local runtime file.
+# Secrets stay out of argv and are never written to root .env or fleet.env.
+python3 - "$ENVF" <<'PYEOF'
+import errno
+import json
+import os
+import pathlib
+import re
+import tempfile
+path = pathlib.Path(__import__("sys").argv[1])
+if path.is_symlink():
+    raise SystemExit(f"refusing to write Slack credentials through symlink: {path}")
+path.parent.mkdir(parents=True, exist_ok=True)
+text = path.read_text(encoding="utf-8") if path.exists() else ""
+for key in ("SLACK_BOT_TOKEN", "SLACK_APP_TOKEN", "SLACK_ALLOWED_USERS"):
+    text = re.sub(rf"(?m)^\s*(?:export\s+)?#?\s*{key}\s*=.*(?:\n|$)", "", text)
+values = {key: os.environ.get(key, "") for key in (
+    "SLACK_BOT_TOKEN", "SLACK_APP_TOKEN", "SLACK_ALLOWED_USERS"
+)}
+text = text.rstrip("\n")
+if text:
+    text += "\n"
+text += "".join(f"{key}={json.dumps(value)}\n" for key, value in values.items())
+def fsync_parent(target):
+    unsupported = {errno.EINVAL, getattr(errno, "ENOTSUP", errno.EINVAL), errno.ENOSYS}
+    flags = os.O_RDONLY | getattr(os, "O_DIRECTORY", 0)
+    try:
+        directory_fd = os.open(target.parent, flags)
+    except OSError as exc:
+        if exc.errno in unsupported:
+            return
+        raise
+    try:
+        try:
+            os.fsync(directory_fd)
+        except OSError as exc:
+            if exc.errno not in unsupported:
+                raise
+    finally:
+        os.close(directory_fd)
+fd, temporary = tempfile.mkstemp(prefix=".env.slack-", dir=path.parent)
+try:
+    os.fchmod(fd, 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as handle:
+        handle.write(text)
+        handle.flush()
+        os.fsync(handle.fileno())
+    os.replace(temporary, path)
+    os.chmod(path, 0o600)
+    fsync_parent(path)
+except BaseException:
+    try:
+        os.unlink(temporary)
+    except FileNotFoundError:
+        pass
+    raise
+PYEOF
+unset SLACK_BOT_TOKEN SLACK_APP_TOKEN
+slack_yaml_update \
+  provisioning_status verified \
+  team_id "$slack_team_id" \
+  team_name "$slack_team_name" \
+  bot_user_id "$slack_bot_user_id" \
+  bot_id "$slack_bot_id" \
+  bot_username "$slack_bot_username"
+fleet_lock_release
+trap - EXIT
+if [[ -z "$SLACK_ALLOWED_USERS" ]]; then
+  warn "    Slack is wired but denies all inbound users until SLACK_ALLOWED_USERS is set"
+fi
+log "    verified Slack bot $slack_bot_username in $slack_team_name (profile-local credentials)"
+mark_done 31-slack

package/templates/hermes-agent/template/.scripts/60-bloodbank.sh CHANGED Viewed

@@ -1,76 +1,18 @@
 #!/usr/bin/env bash
-# Install the bloodbank consumer + envelope helper into the runtime submodule.
+# Compatibility checkpoint for the fleet-shared Bloodbank gateway contract.
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 load_role_env
-already_done 60-bloodbank && { log "[60] bloodbank already installed — skipping"; exit 0; }
-[[ "${SKIP_BLOODBANK:-0}" == "1" ]] && { log "[60] bloodbank — SKIPPED"; mark_done 60-bloodbank; exit 0; }
+already_done 60-bloodbank && { log "[60] bloodbank fleet-routing checkpoint already complete — skipping"; exit 0; }
-RUNTIME="$ROLE_DIR/runtime"
-[[ -d "$RUNTIME" ]] || die "runtime not initialized; run 20-runtime-repo.sh first"
-log "[60] installing bloodbank consumer for $AGENT_ID"
-# Ensure the runtime consumer exists AND is rendered.
-#
-# Step 20 (20-runtime-repo.sh) only renders into a TMP dir during the
-# initial GH-repo push — the on-disk $RUNTIME_SCAFFOLD_DIR copy that lands
-# in the project repo keeps its `{{agent_id}}`/`{{repo}}`/`{{role}}`
-# placeholders. If $RUNTIME/bloodbank-consumer.py was ever lost (runtime
-# submodule wiped, manual rm, etc.) and then someone restored it by
-# copying from $RUNTIME_SCAFFOLD_DIR, they'd end up with an un-rendered
-# consumer whose envelope routing filter compares against literal `{{repo}}`
-# and `{{agent_id}}` values.
-# This block handles both failure modes idempotently.
-CONSUMER="$RUNTIME/bloodbank-consumer.py"
-SCAFFOLD_CONSUMER="$RUNTIME_SCAFFOLD_DIR/bloodbank-consumer.py"
-needs_restore=0
-if [[ ! -f "$CONSUMER" ]]; then
-  log "    consumer missing in runtime — restoring from scaffold"
-  needs_restore=1
-elif grep -qE '\{\{(agent_id|repo|role|display_name)\}\}' "$CONSUMER"; then
-  warn "    consumer in runtime has un-rendered placeholders — re-rendering"
-  needs_restore=1
-fi
-if [[ "$needs_restore" == "1" ]]; then
-  [[ -f "$SCAFFOLD_CONSUMER" ]] || die "scaffold source missing: $SCAFFOLD_CONSUMER"
-  cp "$SCAFFOLD_CONSUMER" "$CONSUMER"
-  # Same placeholder set + values as 20-runtime-repo.sh's render pass.
-  python3 - "$CONSUMER" "$AGENT_ID" "$REPO" "$ROLE" "$DISPLAY_NAME" <<'PYEOF'
-import pathlib, sys
-p = pathlib.Path(sys.argv[1])
-agent_id, repo, role, display = sys.argv[2:6]
-mapping = {
-    "{{agent_id}}": agent_id, "{{repo}}": repo, "{{role}}": role,
-    "{{display_name}}": display,
-}
-t = p.read_text()
-for k, v in mapping.items():
-    t = t.replace(k, v)
-p.write_text(t)
-PYEOF
-fi
-chmod +x "$CONSUMER"
-# Health check: is NATS up?
-if (echo > /dev/tcp/$BLOODBANK_NATS_HOST/$BLOODBANK_NATS_PORT) 2>/dev/null; then
-  log "    NATS reachable at $BLOODBANK_NATS_HOST:$BLOODBANK_NATS_PORT"
+# SKIP_BLOODBANK used to suppress per-profile consumer installation. Keep the
+# flag harmless for existing unattended provisioning commands; there is no
+# profile-local process, dependency, broker probe, or file to skip anymore.
+if [[ "${SKIP_BLOODBANK:-0}" == "1" ]]; then
+  log "[60] bloodbank — SKIP_BLOODBANK accepted as a compatibility no-op"
 else
-  warn "    NATS not reachable; consumer will retry on start"
-  warn "    bring up:  cd $BLOODBANK_COMPOSE_DIR && docker compose -f compose/docker-compose.yml up -d"
-fi
-# Ensure nats-py is available in the hermes venv (uv-managed, no pip binary)
-if ! "$HERMES_AGENT_REPO/.venv/bin/python" -c "import nats" 2>/dev/null; then
-  warn "    python nats-py not installed in hermes venv; installing via uv"
-  if command -v uv >/dev/null 2>&1; then
-    (cd "$HERMES_AGENT_REPO" && uv pip install --quiet --python .venv/bin/python nats-py 2>&1 | tail -3) || true
-  else
-    warn "    uv not available either — install nats-py manually: cd $HERMES_AGENT_REPO && uv pip install nats-py"
-  fi
+  log "[60] bloodbank — fleet-shared gateway routes target_agent_id=$AGENT_ID"
 fi
 mark_done 60-bloodbank

package/templates/hermes-agent/template/.scripts/70-systemd.sh CHANGED Viewed

@@ -1,18 +1,64 @@
 #!/usr/bin/env bash
-# Install systemd --user units: gateway, consumer, and a fused heartbeat timer
+# Install systemd --user units: profile gateway and fused heartbeat timer
 # (board-reconciliation sentinel pass + gated runtime checkpoint, one tick).
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 load_role_env
-already_done 70-systemd && { log "[70] systemd already installed — skipping"; exit 0; }
-[[ "${SKIP_SYSTEMD:-0}" == "1" ]] && { log "[70] systemd — SKIPPED"; mark_done 70-systemd; exit 0; }
+if [[ "$ROLE" == "reporter" ]]; then
+  log "[70] reporter systemd — gateway/consumer intentionally not installed"
+  log "    use the reporter runtime's explicit install command after credential and policy preflight"
+  mark_done 70-systemd
+  exit 0
+fi
 RUNTIME="$ROLE_DIR/runtime"
 REPO_ROOT="$(project_repo_path)" || REPO_ROOT="$ROLE_DIR"
 SYS_DIR="$HOME/.config/systemd/user"
 mkdir -p "$SYS_DIR" "$RUNTIME/logs"
+# Upgrade remediation must run before honoring a legacy done marker. Older
+# templates installed one per-profile Bloodbank consumer; leaving even one
+# enabled races the fleet-shared durable gateway and can duplicate execution.
+LEGACY_CONSUMER_UNIT="hermes-${AGENT_ID}-consumer.service"
+LEGACY_CONSUMER_PATH="$SYS_DIR/$LEGACY_CONSUMER_UNIT"
+legacy_consumer_present=0
+[[ -e "$LEGACY_CONSUMER_PATH" || -L "$LEGACY_CONSUMER_PATH" ]] \
+  && legacy_consumer_present=1
+if command -v systemctl >/dev/null 2>&1; then
+  legacy_active_result="$(systemctl_user_unit_state is-active "$LEGACY_CONSUMER_UNIT")"
+  legacy_enabled_result="$(systemctl_user_unit_state is-enabled "$LEGACY_CONSUMER_UNIT")"
+  [[ "$legacy_active_result" != error\|* ]] \
+    || die "cannot safely query legacy consumer activity; preserving unit: ${legacy_active_result#*|}"
+  [[ "$legacy_enabled_result" != error\|* ]] \
+    || die "cannot safely query legacy consumer enablement; preserving unit: ${legacy_enabled_result#*|}"
+  legacy_active_state="${legacy_active_result#*|}"
+  legacy_enabled_state="${legacy_enabled_result#*|}"
+  [[ "$legacy_active_state" == "not-found" && "$legacy_enabled_state" == "not-found" ]] \
+    || legacy_consumer_present=1
+elif [[ $legacy_consumer_present -eq 1 ]]; then
+  die "systemctl is unavailable; cannot safely retire legacy consumer: $LEGACY_CONSUMER_UNIT"
+fi
+if [[ $legacy_consumer_present -eq 1 ]]; then
+  systemctl --user disable --now "$LEGACY_CONSUMER_UNIT" >/dev/null 2>&1 \
+    || die "legacy consumer disable failed; preserving unit: $LEGACY_CONSUMER_UNIT"
+  legacy_active_result="$(systemctl_user_unit_state is-active "$LEGACY_CONSUMER_UNIT")"
+  legacy_enabled_result="$(systemctl_user_unit_state is-enabled "$LEGACY_CONSUMER_UNIT")"
+  [[ "$legacy_active_result" == "ok|inactive" ]] \
+    || die "legacy consumer is not proven inactive; preserving unit: ${legacy_active_result#*|}"
+  [[ "$legacy_enabled_result" == "ok|disabled" ]] \
+    || die "legacy consumer is not proven disabled; preserving unit: ${legacy_enabled_result#*|}"
+  rm -f -- "$LEGACY_CONSUMER_PATH"
+  if systemd_user_available; then
+    systemctl --user daemon-reload >/dev/null 2>&1 \
+      || warn "    systemd daemon-reload failed after legacy consumer retirement"
+  fi
+  log "    retired legacy per-profile Bloodbank consumer: $LEGACY_CONSUMER_UNIT"
+fi
+already_done 70-systemd && { log "[70] systemd already installed — legacy cleanup checked"; exit 0; }
+[[ "${SKIP_SYSTEMD:-0}" == "1" ]] && { log "[70] systemd — SKIPPED"; mark_done 70-systemd; exit 0; }
 # The heartbeat runner (board-reconciliation sentinel pass + gated checkpoint)
 # and the checkpoint helper both render into the role dir; just ensure they are
 # executable. heartbeat.sh calls checkpoint.sh internally.
@@ -43,31 +89,6 @@ StandardError=append:$RUNTIME/logs/gateway.systemd.log
 WantedBy=default.target
 UNIT
-# Consumer unit
-CSM_UNIT="hermes-${AGENT_ID}-consumer.service"
-cat > "$SYS_DIR/$CSM_UNIT" <<UNIT
-[Unit]
-Description=Bloodbank Consumer — $DISPLAY_NAME
-After=network-online.target $GW_UNIT
-Wants=network-online.target
-[Service]
-Type=simple
-WorkingDirectory=$RUNTIME
-Environment=HERMES_HOME=$RUNTIME
-Environment=HERMES_OAUTH_FILE=$HERMES_OAUTH_FILE
-Environment=CODEX_HOME=$CODEX_HOME
-EnvironmentFile=-$RUNTIME/.env
-ExecStart=$HERMES_AGENT_REPO/.venv/bin/python $RUNTIME/bloodbank-consumer.py
-Restart=on-failure
-RestartSec=5
-StandardOutput=append:$RUNTIME/logs/consumer.log
-StandardError=append:$RUNTIME/logs/consumer.log
-[Install]
-WantedBy=default.target
-UNIT
 # Fused heartbeat: board-reconciliation sentinel pass + gated runtime checkpoint.
 # Frequent ticks (1 min); heartbeat.sh's own cooldown/lock logic rate-limits the
 # full Hermes pass, and the checkpoint is gated to ~hourly inside the runner.
@@ -115,7 +136,7 @@ if systemd_user_available; then
   # `enable --now` both enables (persist across login) AND starts the unit now, so a
   # freshly provisioned agent comes up live instead of dormant. Units with missing
   # creds (e.g. a gateway with no Telegram token yet) fail softly via Restart=on-failure.
-  for u in "$GW_UNIT" "$CSM_UNIT" "$HB_TIMER"; do
+  for u in "$GW_UNIT" "$HB_TIMER"; do
     systemctl --user enable --now "$u" >/dev/null 2>&1 && log "    enabled + started: $u" || warn "    failed to enable/start: $u"
   done
 else