@delorenj/pjangler 1.2.25 → 1.3.0

package/templates/hermes-agent/scripts/backfill-fleet-sot.sh

@@ -1,270 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Distributable config — same source of truth the template's _lib.sh reads.
-HERMES_TEMPLATE_CONFIG="${HERMES_TEMPLATE_CONFIG:-${XDG_CONFIG_HOME:-$HOME/.config}/hermes-agent-template/config.toml}"
-cfg() {  # cfg <dotted.key> <default>  — read a value from config.toml (always exits 0)
-  local key="$1" def="$2"
-  { [[ -f "$HERMES_TEMPLATE_CONFIG" ]] && command -v python3 >/dev/null 2>&1; } || { printf '%s' "$def"; return 0; }
-  python3 - "$HERMES_TEMPLATE_CONFIG" "$key" "$def" <<'PYEOF' || printf '%s' "$def"
-import sys, os
-try:
-    import tomllib
-except ModuleNotFoundError:
-    print(sys.argv[3], end=""); sys.exit(0)
-try:
-    cur = tomllib.load(open(sys.argv[1], "rb"))
-except Exception:
-    print(sys.argv[3], end=""); sys.exit(0)
-for p in sys.argv[2].split("."):
-    if isinstance(cur, dict) and p in cur:
-        cur = cur[p]
-    else:
-        print(sys.argv[3], end=""); sys.exit(0)
-print(os.path.expanduser(str(cur)), end="")
-PYEOF
-  return 0
-}
-
-FLEET_ENV="${HERMES_FLEET_ENV:-$(cfg fleet.fleet_env "$HOME/.hermes/fleet.env")}"
-REGISTRY_FILE="${HERMES_FLEET_REGISTRY_FILE:-$(cfg fleet.registry_file "$HOME/.hermes/agents-registry.yaml")}"
-DEFAULT_BIN="${HERMES_FLEET_BIN:-$(cfg fleet.hermes_bin "$HOME/.hermes/hermes-agent/.venv/bin/hermes")}"
-DEFAULT_REPO="${HERMES_FLEET_REPO:-$(cfg fleet.hermes_repo "$HOME/.hermes/hermes-agent")}"
-DEFAULT_OAUTH_FILE="${HERMES_FLEET_OAUTH_FILE:-$(cfg fleet.oauth_file "$HOME/.hermes/auth.json")}"
-DEFAULT_CODEX_HOME="${HERMES_FLEET_CODEX_HOME:-$(cfg fleet.codex_home "$HOME/.codex")}"
-SCAFFOLD_SRC="$(cd "$(dirname "$0")/../template/.runtime-scaffold" && pwd)"
-
-mkdir -p "$(dirname "$FLEET_ENV")"
-if [[ ! -f "$FLEET_ENV" ]]; then
-  cat > "$FLEET_ENV" <<EOF
-# Hermes fleet source of truth.
-HERMES_FLEET_BIN=${DEFAULT_BIN}
-HERMES_FLEET_REPO=${DEFAULT_REPO}
-HERMES_FLEET_REGISTRY_FILE=${REGISTRY_FILE}
-HERMES_FLEET_OAUTH_FILE=${DEFAULT_OAUTH_FILE}
-HERMES_FLEET_CODEX_HOME=${DEFAULT_CODEX_HOME}
-EOF
-  chmod 600 "$FLEET_ENV"
-fi
-
-upsert_fleet_env() {
-  local key="$1" value="$2"
-  python3 - "$FLEET_ENV" "$key" "$value" <<'PYEOF'
-import pathlib
-import sys
-
-path = pathlib.Path(sys.argv[1])
-key = sys.argv[2]
-value = sys.argv[3]
-line = f"{key}={value}"
-lines = path.read_text().splitlines() if path.exists() else []
-for idx, existing in enumerate(lines):
-    if existing.startswith(f"{key}="):
-        lines[idx] = line
-        break
-else:
-    lines.append(line)
-path.write_text("\n".join(lines) + "\n")
-PYEOF
-}
-
-upsert_fleet_env HERMES_FLEET_OAUTH_FILE "$DEFAULT_OAUTH_FILE"
-upsert_fleet_env HERMES_FLEET_CODEX_HOME "$DEFAULT_CODEX_HOME"
-chmod 600 "$FLEET_ENV"
-
-# shellcheck disable=SC1090
-source "$FLEET_ENV"
-
-HERMES_FLEET_BIN="${HERMES_FLEET_BIN:-$DEFAULT_BIN}"
-HERMES_FLEET_REPO="${HERMES_FLEET_REPO:-$DEFAULT_REPO}"
-HERMES_FLEET_OAUTH_FILE="${HERMES_FLEET_OAUTH_FILE:-$DEFAULT_OAUTH_FILE}"
-HERMES_FLEET_CODEX_HOME="${HERMES_FLEET_CODEX_HOME:-$DEFAULT_CODEX_HOME}"
-
-python3 - "$REGISTRY_FILE" "$HERMES_FLEET_BIN" "$HERMES_FLEET_REPO" "$FLEET_ENV" "$SCAFFOLD_SRC" "$HERMES_FLEET_OAUTH_FILE" "$HERMES_FLEET_CODEX_HOME" <<'PYEOF'
-import os
-import stat
-import sys
-import shutil
-import pathlib
-
-try:
-    import yaml  # type: ignore
-except ImportError:
-    raise SystemExit("PyYAML required (pip install pyyaml)")
-
-registry_path = pathlib.Path(sys.argv[1])
-hermes_bin = sys.argv[2]
-hermes_repo = sys.argv[3]
-fleet_env = sys.argv[4]
-scaffold_src = pathlib.Path(sys.argv[5])
-oauth_file = sys.argv[6]
-codex_home = sys.argv[7]
-
-if not registry_path.exists():
-    raise SystemExit(f"Registry not found: {registry_path}")
-
-data = yaml.safe_load(registry_path.read_text()) or {}
-agents = data.get("agents") or {}
-
-wrapper_count = 0
-meta_count = 0
-scaffold_count = 0
-lib_count = 0
-systemd_count = 0
-
-
-def patch_systemd_unit(unit_path: pathlib.Path) -> bool:
-    if not unit_path.exists():
-        return False
-    original = unit_path.read_text()
-    lines = original.splitlines()
-    rendered = []
-    for line in lines:
-        if line.startswith("Environment=HERMES_OAUTH_FILE="):
-            continue
-        if line.startswith("Environment=CODEX_HOME="):
-            continue
-        rendered.append(line)
-        if line.startswith("Environment=HERMES_HOME="):
-            rendered.append(f"Environment=HERMES_OAUTH_FILE={oauth_file}")
-            rendered.append(f"Environment=CODEX_HOME={codex_home}")
-    new_text = "\n".join(rendered) + ("\n" if original.endswith("\n") else "")
-    if new_text == original:
-        return False
-    unit_path.write_text(new_text)
-    return True
-
-for agent_id, cfg in agents.items():
-    cfg["hermes"] = {
-        "bin": hermes_bin,
-        "repo": hermes_repo,
-        "fleet_env": fleet_env,
-        "oauth_file": oauth_file,
-        "codex_home": codex_home,
-    }
-    meta_count += 1
-
-    systemd_dir = pathlib.Path.home() / ".config" / "systemd" / "user"
-    for suffix in ("gateway", "consumer"):
-        unit = systemd_dir / f"hermes-{agent_id}-{suffix}.service"
-        if patch_systemd_unit(unit):
-            systemd_count += 1
-
-    role_dir = cfg.get("role_dir")
-    if not role_dir:
-        continue
-
-    role_path = pathlib.Path(role_dir)
-    if not role_path.exists():
-        continue
-
-    project_path = pathlib.Path(cfg.get("project_path") or "")
-    role_name = cfg.get("role") or "pm"
-    alt_role_path = project_path / "_agents" / "hermes" / role_name
-    if not (role_path / "hermes").exists() and (alt_role_path / "hermes").exists():
-        role_path = alt_role_path
-        cfg["role_dir"] = str(alt_role_path)
-
-    target_scaffold = role_path / ".runtime-scaffold"
-    shutil.copytree(scaffold_src, target_scaffold, dirs_exist_ok=True)
-    scaffold_count += 1
-
-    lib_path = role_path / ".scripts" / "_lib.sh"
-    if lib_path.exists():
-        lib_text = lib_path.read_text()
-        old_block = (
-            "# Tools we expect on the host\n"
-            "HERMES_BIN=\"${HERMES_BIN:-/home/delorenj/code/hermes-agent/.venv/bin/hermes}\"\n"
-            "HERMES_AGENT_REPO=\"${HERMES_AGENT_REPO:-/home/delorenj/code/hermes-agent}\"\n"
-            "RUNTIME_SCAFFOLD_DIR=\"${RUNTIME_SCAFFOLD_DIR:-/home/delorenj/code/hermes-agent-template/runtime-scaffold}\"\n"
-            "REGISTRY_FILE=\"${REGISTRY_FILE:-$HOME/.hermes/agents-registry.yaml}\"\n"
-        )
-        new_block = (
-            "# Fleet source-of-truth (shared across all wrappers/provisioners)\n"
-            "FLEET_ENV=\"${HERMES_FLEET_ENV:-$HOME/.hermes/fleet.env}\"\n"
-            "if [[ -f \"$FLEET_ENV\" ]]; then\n"
-            "  # shellcheck disable=SC1090\n"
-            "  source \"$FLEET_ENV\"\n"
-            "fi\n\n"
-            "# Tools we expect on the host\n"
-            "HERMES_BIN=\"${HERMES_BIN:-${HERMES_FLEET_BIN:-$HOME/.hermes/hermes-agent/.venv/bin/hermes}}\"\n"
-            "HERMES_AGENT_REPO=\"${HERMES_AGENT_REPO:-${HERMES_FLEET_REPO:-$HOME/.hermes/hermes-agent}}\"\n"
-            "HERMES_OAUTH_FILE=\"${HERMES_OAUTH_FILE:-${HERMES_FLEET_OAUTH_FILE:-$HOME/.hermes/auth.json}}\"\n"
-            "CODEX_HOME=\"${CODEX_HOME:-${HERMES_FLEET_CODEX_HOME:-$HOME/.codex}}\"\n"
-            "# Prefer a scaffold vendored into this agent directory; fall back to legacy template path.\n"
-            "RUNTIME_SCAFFOLD_DIR=\"${RUNTIME_SCAFFOLD_DIR:-$ROLE_DIR/.runtime-scaffold}\"\n"
-            "if [[ ! -d \"$RUNTIME_SCAFFOLD_DIR\" ]]; then\n"
-            "  RUNTIME_SCAFFOLD_DIR=\"${HERMES_TEMPLATE_RUNTIME_SCAFFOLD:-$HOME/code/hermes-agent-template/runtime-scaffold}\"\n"
-            "fi\n"
-            "REGISTRY_FILE=\"${REGISTRY_FILE:-${HERMES_FLEET_REGISTRY_FILE:-$HOME/.hermes/agents-registry.yaml}}\"\n"
-        )
-        if old_block in lib_text:
-            lib_text = lib_text.replace(old_block, new_block)
-        if "HERMES_OAUTH_FILE=" not in lib_text:
-            lib_text = lib_text.replace(
-                "HERMES_AGENT_REPO=\"${HERMES_AGENT_REPO:-${HERMES_FLEET_REPO:-$HOME/.hermes/hermes-agent}}\"\n",
-                "HERMES_AGENT_REPO=\"${HERMES_AGENT_REPO:-${HERMES_FLEET_REPO:-$HOME/.hermes/hermes-agent}}\"\n"
-                "HERMES_OAUTH_FILE=\"${HERMES_OAUTH_FILE:-${HERMES_FLEET_OAUTH_FILE:-$HOME/.hermes/auth.json}}\"\n"
-                "CODEX_HOME=\"${CODEX_HOME:-${HERMES_FLEET_CODEX_HOME:-$HOME/.codex}}\"\n",
-            )
-        lib_text = lib_text.replace(
-            "export HERMES_BIN HERMES_AGENT_REPO RUNTIME_SCAFFOLD_DIR REGISTRY_FILE \\\n       BLOODBANK_NATS_HOST BLOODBANK_NATS_PORT \\\n       PLANE_BASE PLANE_API_KEY \\\n       CF_API CF_ZONE_DELO_SH CF_ACCOUNT_ID\n",
-            "export FLEET_ENV HERMES_BIN HERMES_AGENT_REPO RUNTIME_SCAFFOLD_DIR REGISTRY_FILE \\\n       BLOODBANK_NATS_HOST BLOODBANK_NATS_PORT \\\n       PLANE_BASE PLANE_API_KEY \\\n       CF_API CF_ZONE_DELO_SH CF_ACCOUNT_ID\n",
-        )
-        lib_text = lib_text.replace(
-            "export FLEET_ENV HERMES_BIN HERMES_AGENT_REPO RUNTIME_SCAFFOLD_DIR REGISTRY_FILE",
-            "export FLEET_ENV HERMES_BIN HERMES_AGENT_REPO HERMES_OAUTH_FILE CODEX_HOME RUNTIME_SCAFFOLD_DIR REGISTRY_FILE",
-        )
-        if lib_text != lib_path.read_text():
-            lib_path.write_text(lib_text)
-            lib_count += 1
-
-    wrapper = role_path / "hermes"
-    if not wrapper.exists():
-        continue
-
-    wrapper.write_text(
-        "#!/usr/bin/env bash\n"
-        f"# Launcher for {agent_id}. Resolves HERMES_HOME to runtime and execs shared fleet Hermes.\n"
-        "set -euo pipefail\n\n"
-        "ROLE_DIR=\"$(cd \"$(dirname \"$0\")\" && pwd)\"\n"
-        "HERMES_HOME=\"$ROLE_DIR/runtime\"\n\n"
-        "FLEET_ENV=\"${HERMES_FLEET_ENV:-$HOME/.hermes/fleet.env}\"\n"
-        "if [[ -f \"$FLEET_ENV\" ]]; then\n"
-        "  # shellcheck disable=SC1090\n"
-        "  source \"$FLEET_ENV\"\n"
-        "fi\n\n"
-        "HERMES_BIN=\"${HERMES_BIN:-${HERMES_FLEET_BIN:-$HOME/.hermes/hermes-agent/.venv/bin/hermes}}\"\n\n"
-        "HERMES_OAUTH_FILE=\"${HERMES_OAUTH_FILE:-${HERMES_FLEET_OAUTH_FILE:-$HOME/.hermes/auth.json}}\"\n"
-        "CODEX_HOME=\"${CODEX_HOME:-${HERMES_FLEET_CODEX_HOME:-$HOME/.codex}}\"\n\n"
-        "if [[ ! -d \"$HERMES_HOME\" ]]; then\n"
-        "  echo \"hermes: runtime submodule not initialized at $HERMES_HOME\" >&2\n"
-        "  echo \"  fix: git submodule update --init --recursive\" >&2\n"
-        "  exit 1\n"
-        "fi\n\n"
-        "if [[ ! -x \"$HERMES_BIN\" ]]; then\n"
-        "  echo \"hermes: binary not executable at $HERMES_BIN\" >&2\n"
-        "  echo \"  set HERMES_BIN or HERMES_FLEET_BIN (in $FLEET_ENV) to the shared Hermes binary.\" >&2\n"
-        "  exit 1\n"
-        "fi\n\n"
-        "exec env HERMES_HOME=\"$HERMES_HOME\" HERMES_FLEET_ENV=\"$FLEET_ENV\" "
-        "HERMES_OAUTH_FILE=\"$HERMES_OAUTH_FILE\" CODEX_HOME=\"$CODEX_HOME\" \"$HERMES_BIN\" \"$@\"\n"
-    )
-
-    mode = wrapper.stat().st_mode
-    wrapper.chmod(mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
-    wrapper_count += 1
-
-registry_path.write_text(yaml.safe_dump(data, sort_keys=False))
-print(f"updated wrappers: {wrapper_count}")
-print(f"updated registry entries: {meta_count}")
-print(f"copied role-local scaffolds: {scaffold_count}")
-print(f"patched role _lib.sh files: {lib_count}")
-print(f"patched systemd units: {systemd_count}")
-print(f"registry: {registry_path}")
-print(f"fleet env: {fleet_env}")
-print(f"shared bin: {hermes_bin}")
-print(f"shared repo: {hermes_repo}")
-print(f"shared oauth file: {oauth_file}")
-print(f"shared codex home: {codex_home}")
-PYEOF

package/templates/hermes-agent/scripts/degit-runtime.sh

@@ -1,192 +0,0 @@
-#!/usr/bin/env bash
-# degit-runtime — make a repo's Hermes agent runtime(s) PURE LOCAL state.
-#
-# Run from (or point --root at) the ROOT of a project repo. Discovers every
-# agents/hermes/*/runtime under it and, in one shot, removes it from git and
-# gitignores it so it never re-enters version control.
-#
-# Policy = pure-local (fleet decision D2, 2026-07-21): the runtime is no longer
-# a git-tracked submodule NOR its own checkpoint repo. Per-agent memory
-# durability moves to the per-repo Hindsight bank. The
-# github.com/delorenj/agent-hm-*-pm remotes are left intact (recoverable) but
-# are no longer pushed to. This is the INVERSE of repair-runtime-checkpoint.sh,
-# which keeps the checkpoint repo alive.
-#
-# Per runtime:
-#   Layer A (project repo, if one exists):
-#     - gitlink submodule   -> git rm --cached <rel>
-#                              + drop [submodule "<rel>"] from .gitmodules
-#                              + rm -rf .git/modules/<rel>
-#     - plain tracked files -> git rm -r --cached <rel>
-#     - ensure .gitignore ignores agents/hermes/*/runtime/
-#   Layer B (the runtime itself):
-#     - if it has unpushed commits, push once (best-effort) unless --force
-#     - rm -rf <runtime>/.git            (retire the checkpoint repo)
-#     - write <runtime>/.gitignore = "*\n!.gitignore"   (pure-local marker)
-#
-# REPORTED but not touched here (fleet-level; handled by fleet-prune-debris.sh):
-#   ~/.hermes/profiles/<profile> symlink, agents-registry.yaml runtime_repo,
-#   and the now-dead -checkpoint.service/.timer units.
-#
-# Dry-run by default (prints the plan). --apply mutates. Idempotent: every step
-# checks state first, so a second run is a clean no-op.
-#
-# Usage: degit-runtime.sh [--apply] [--force] [--root DIR]
-set -euo pipefail
-
-APPLY=0; FORCE=0; ROOT=""
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --apply) APPLY=1 ;;
-    --force) FORCE=1 ;;
-    --root)  shift; ROOT="${1:-}" ;;
-    -h|--help) sed -n '2,37p' "$0"; exit 0 ;;
-    *) printf 'degit-runtime: unknown arg: %s\n' "$1" >&2; exit 2 ;;
-  esac
-  shift
-done
-
-die(){ printf 'ERROR: %s\n' "$*" >&2; exit 1; }
-note(){ printf '  %s\n' "$*"; }
-# run CMD... — execute on --apply, otherwise print the plan line.
-run(){ if [ "$APPLY" -eq 1 ]; then "$@"; else printf '  [would] %s\n' "$*"; fi; }
-
-ROOT="${ROOT:-$PWD}"
-[ -d "$ROOT" ] || die "no such directory: $ROOT"
-ROOT="$(cd "$ROOT" && pwd)"
-[ -d "$ROOT/agents/hermes" ] || die "no agents/hermes under $ROOT — run from a project repo root (or pass --root)"
-
-MODE="dry-run"; [ "$APPLY" -eq 1 ] && MODE="APPLY"
-printf '== degit-runtime (%s) :: %s ==\n' "$MODE" "$ROOT"
-
-# Project repo root (the superproject). Empty when the project has no git at all
-# (e.g. DeLoDocs, pjangler) — Layer A is then skipped.
-PROJ="$(git -C "$ROOT" rev-parse --show-toplevel 2>/dev/null || true)"
-if [ -n "$PROJ" ]; then note "project repo: $PROJ"; else note "project repo: (none — Layer A skipped)"; fi
-
-# Discover runtimes: agents/hermes/<role>/runtime (depth 2 under agents/hermes).
-mapfile -t RUNTIMES < <(find "$ROOT/agents/hermes" -mindepth 2 -maxdepth 2 -type d -name runtime 2>/dev/null | sort)
-[ "${#RUNTIMES[@]}" -gt 0 ] || die "no agents/hermes/*/runtime found under $ROOT"
-note "runtimes: ${#RUNTIMES[@]}"
-
-CHANGED=0
-
-ensure_project_ignore(){ # $1 = relpath of runtime from project root
-  local rel="$1" gi="$PROJ/.gitignore"
-  # Prefer a broad, role-agnostic rule; fall back to the exact path.
-  if git -C "$PROJ" check-ignore -q "$rel" 2>/dev/null; then
-    note ".gitignore already ignores $rel"; return 0
-  fi
-  local rule="agents/hermes/*/runtime/"
-  if [ -f "$gi" ] && grep -qxF "$rule" "$gi" 2>/dev/null; then
-    note ".gitignore already has rule: $rule"; return 0
-  fi
-  if [ "$APPLY" -eq 1 ]; then
-    printf '\n# Hermes agent runtime — pure-local state, never tracked (degit-runtime).\n%s\n' "$rule" >> "$gi"
-    note "appended ignore rule to .gitignore: $rule"
-  else
-    printf '  [would] append %s to %s\n' "$rule" "$gi"
-  fi
-  CHANGED=1
-}
-
-layer_a(){ # $1 = absolute runtime dir
-  local rt="$1" rel
-  [ -n "$PROJ" ] || return 0
-  rel="${rt#"$PROJ"/}"
-  # Is it a gitlink submodule (mode 160000) in the index?
-  if git -C "$PROJ" ls-files --stage -- "$rel" 2>/dev/null | grep -q '^160000 '; then
-    note "Layer A: '$rel' is a gitlink submodule -> de-submodule"
-    # -f: the gitlink may be staged with a pointer differing from HEAD (e.g. a
-    # freshly-added, not-yet-committed submodule). --cached is index-only and
-    # never touches the working tree, so forcing is safe.
-    run git -C "$PROJ" rm --cached -f -q -- "$rel"
-    if [ -f "$PROJ/.gitmodules" ] && git -C "$PROJ" config -f "$PROJ/.gitmodules" --get "submodule.$rel.url" >/dev/null 2>&1; then
-      run git -C "$PROJ" config -f "$PROJ/.gitmodules" --remove-section "submodule.$rel"
-      # Drop .gitmodules entirely once no [submodule] sections remain.
-      # (In dry-run the section is still present, so this stays conservative.)
-      if [ ! -f "$PROJ/.gitmodules" ] || ! grep -q '^\[submodule' "$PROJ/.gitmodules" 2>/dev/null; then
-        run rm -f "$PROJ/.gitmodules"
-        run git -C "$PROJ" rm --cached -q --ignore-unmatch -- .gitmodules
-      fi
-    fi
-    # The real gitdir (runtime layer already removed the runtime/.git pointer).
-    [ -e "$PROJ/.git/modules/$rel" ] && run rm -rf "$PROJ/.git/modules/$rel"
-    CHANGED=1
-  elif git -C "$PROJ" ls-files --error-unmatch -- "$rel" >/dev/null 2>&1; then
-    note "Layer A: '$rel' is tracked as plain content -> unstage"
-    run git -C "$PROJ" rm -r --cached -q -- "$rel"
-    CHANGED=1
-  else
-    note "Layer A: '$rel' is not tracked in the project repo (good)"
-  fi
-  ensure_project_ignore "$rel"
-}
-
-layer_b(){ # $1 = absolute runtime dir
-  local rt="$1"
-  # hard guard before any rm -rf
-  case "$rt" in */runtime) : ;; *) die "refusing: '$rt' does not end in /runtime" ;; esac
-  [ -d "$rt" ] || die "refusing: runtime dir vanished: $rt"
-
-  if [ -e "$rt/.git" ]; then
-    # Guard unpushed local commits: push once (best-effort) unless --force.
-    local ahead=0
-    if git -C "$rt" rev-parse --abbrev-ref --symbolic-full-name '@{u}' >/dev/null 2>&1; then
-      ahead="$(git -C "$rt" rev-list --count '@{u}..HEAD' 2>/dev/null || echo 0)"
-    else
-      ahead="unknown(no-upstream)"
-    fi
-    note "Layer B: runtime has .git (unpushed ahead: $ahead)"
-    if [ "$ahead" != "0" ]; then
-      if [ "$FORCE" -eq 1 ]; then
-        note "  --force: discarding local .git without pushing ($ahead ahead)"
-      else
-        note "  attempting one final push before retiring .git (--force to skip)"
-        if [ "$APPLY" -eq 1 ]; then
-          if GIT_SSH_COMMAND='ssh -o BatchMode=yes -o ConnectTimeout=20' \
-               timeout 45 git -C "$rt" push 2>/dev/null; then
-            note "  final push OK"
-          else
-            note "  MANUAL: final push FAILED and commits are unpushed — skipping .git removal for this runtime (re-run with --force to discard, or push by hand)"
-            return 0
-          fi
-        else
-          printf '  [would] git -C %s push   (final backup)\n' "$rt"
-        fi
-      fi
-    fi
-    run rm -rf "$rt/.git"
-    CHANGED=1
-  else
-    note "Layer B: runtime already has no .git (good)"
-  fi
-
-  # Pure-local marker: ignore everything except the marker itself.
-  local gi="$rt/.gitignore" want=$'*\n!.gitignore'
-  if [ -f "$gi" ] && [ "$(cat "$gi" 2>/dev/null)" = "$want" ]; then
-    note "Layer B: runtime/.gitignore already pure-local"
-  else
-    if [ "$APPLY" -eq 1 ]; then printf '%s\n' "$want" > "$gi"; note "wrote pure-local runtime/.gitignore"
-    else printf '  [would] write pure-local %s\n' "$gi"; fi
-    CHANGED=1
-  fi
-}
-
-for rt in "${RUNTIMES[@]}"; do
-  printf -- '-- %s\n' "$rt"
-  # Runtime layer FIRST: any final push needs the gitdir, which the project
-  # layer's `rm -rf .git/modules/<rel>` would otherwise remove.
-  layer_b "$rt"
-  layer_a "$rt"
-done
-
-echo
-if [ "$CHANGED" -eq 0 ]; then
-  printf 'RESULT: already pure-local — nothing to do.\n'
-elif [ "$APPLY" -eq 1 ]; then
-  printf 'RESULT: applied. Commit the project-repo changes (.gitignore / .gitmodules / unstaged runtime) when ready.\n'
-  printf '        Fleet-level cleanup (dead -checkpoint units, profile symlink) -> fleet-prune-debris.sh\n'
-else
-  printf 'RESULT: dry-run only. Re-run with --apply to mutate.\n'
-fi

package/templates/hermes-agent/scripts/fleet-prune-debris.sh

@@ -1,128 +0,0 @@
-#!/usr/bin/env bash
-# fleet-prune-debris — remove evolutionary debris from the Hermes fleet's
-# systemd USER units, and retire now-dead runtime-checkpoint units for agents
-# whose runtime is already pure-local (see degit-runtime.sh, fleet decision D2).
-#
-# Conservative by design. It only AUTO-removes things that are unambiguously
-# dead:
-#   - a hardcoded allowlist of DISABLED stale units (old singleton gateways,
-#     the delodocs per-agent dashboard) — and only while they are NOT active;
-#   - *.bak-* backup copies of hermes unit files;
-#   - hermes-<id>-pm-checkpoint.{service,timer} whose runtime has NO .git
-#     (already pure-local -> the checkpoint unit can never do anything again).
-# Everything ambiguous (active/enabled redundant units, the carrie persona, the
-# delonet-company-reporter archetype, FAILED units still git-backed) is REPORTED
-# as MANUAL and never touched.
-#
-# Dry-run by default. --apply performs the removals + one daemon-reload.
-#
-# Usage: fleet-prune-debris.sh [--apply]
-set -euo pipefail
-
-APPLY=0
-for a in "$@"; do
-  case "$a" in
-    --apply) APPLY=1 ;;
-    -h|--help) sed -n '2,26p' "$0"; exit 0 ;;
-    *) printf 'fleet-prune-debris: unknown arg: %s\n' "$a" >&2; exit 2 ;;
-  esac
-done
-
-SD="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
-[ -d "$SD" ] || { printf 'ERROR: no systemd user dir at %s\n' "$SD" >&2; exit 1; }
-
-MODE="dry-run"; [ "$APPLY" -eq 1 ] && MODE="APPLY"
-printf '== fleet-prune-debris (%s) :: %s ==\n' "$MODE" "$SD"
-note(){ printf '  %s\n' "$*"; }
-uc(){ systemctl --user "$@" 2>/dev/null; }         # user systemctl, quiet
-is_active(){ uc is-active "$1" >/dev/null; }
-exists(){ [ -e "$SD/$1" ]; }
-DID=0
-
-# remove_unit BASENAME... — disable+stop (if loaded) then rm the file(s).
-remove_unit(){
-  local u
-  for u in "$@"; do
-    exists "$u" || { note "absent (ok): $u"; continue; }
-    if [ "$APPLY" -eq 1 ]; then
-      uc disable --now "$u" || true
-      rm -f "$SD/$u"
-      note "removed: $u"
-    else
-      note "[would] disable --now + rm: $u"
-    fi
-    DID=1
-  done
-}
-
-printf '\n[1] disabled stale units (old singleton gateways / stale dashboard)\n'
-# From recon: these are DISABLED + superseded. Auto-remove only if not active.
-for u in hermes-gateway.service hermes-gateway-de01182b.service hermes-dashboard-delodocs-pm.service; do
-  if exists "$u"; then
-    if is_active "$u"; then note "MANUAL: $u is ACTIVE — expected disabled; confirm before removing";
-    else remove_unit "$u"; fi
-  else note "absent (ok): $u"; fi
-done
-
-printf '\n[2] *.bak-* backup copies of hermes unit files\n'
-shopt -s nullglob
-BAKS=("$SD"/hermes-*.bak-*)   # matches *.service.bak-* / *.timer.bak-* too (glob * spans dots)
-shopt -u nullglob
-if [ "${#BAKS[@]}" -eq 0 ]; then note "none"; else
-  for f in "${BAKS[@]}"; do
-    if [ "$APPLY" -eq 1 ]; then rm -f "$f"; note "removed: $(basename "$f")"; else note "[would] rm: $(basename "$f")"; fi
-    DID=1
-  done
-fi
-
-printf '\n[3] dead checkpoint units for pure-local runtimes\n'
-shopt -s nullglob
-CKPTS=("$SD"/hermes-*-pm-checkpoint.service)
-shopt -u nullglob
-if [ "${#CKPTS[@]}" -eq 0 ]; then note "none"; else
-  for svc in "${CKPTS[@]}"; do
-    base="$(basename "$svc")"
-    # Derive the runtime from ExecStart=<role_dir>/.scripts/checkpoint.sh
-    exec_line="$(grep -m1 '^ExecStart=' "$svc" 2>/dev/null | sed 's/^ExecStart=//')"
-    script="${exec_line%% *}"                    # strip any args
-    role_dir="$(dirname "$(dirname "$script")")" # .../pm/.scripts/x.sh -> .../pm
-    runtime="$role_dir/runtime"
-    if [ ! -d "$runtime" ]; then
-      note "MANUAL: $base -> runtime not found ($runtime); leaving"
-      continue
-    fi
-    if [ -e "$runtime/.git" ]; then
-      note "SKIP: $base -> runtime still git-backed (degit-runtime.sh first): $runtime"
-    else
-      note "pure-local -> retiring: $base (+ .timer)"
-      remove_unit "$base" "${base%.service}.timer"
-    fi
-  done
-fi
-
-printf '\n[4] MANUAL review (not auto-touched)\n'
-# Running-redundant / ambiguous units surfaced for a human decision.
-for u in hermes-gateway-intelliforia-voice-agent.service hermes-carrie-backend.service hermes-carrie-telegram-gateway.service; do
-  exists "$u" && note "MANUAL: $u ($(uc is-active "$u" || true)/$(uc is-enabled "$u" || true)) — redundant/legacy persona; decide keep vs retire"
-done
-# delonet-company-reporter is a different archetype (not a PM).
-shopt -s nullglob
-for u in "$SD"/hermes-delonet-company-reporter-*.service; do
-  b="$(basename "$u")"; note "MANUAL: $b ($(uc is-active "$b" || true)) — non-PM reporter archetype; repair or remove as a unit"
-done
-shopt -u nullglob
-# Any remaining failed hermes units.
-FAILED="$(uc --plain --no-legend list-units --state=failed 'hermes-*' | awk '{print $1}')"
-if [ -n "$FAILED" ]; then
-  printf '%s\n' "$FAILED" | while read -r f; do [ -n "$f" ] && note "FAILED: $f — investigate (degit fixes git-push failures; missing-script units are orphans to remove)"; done
-else note "no failed hermes units"; fi
-
-echo
-if [ "$APPLY" -eq 1 ]; then
-  uc daemon-reload || true
-  printf 'RESULT: applied + daemon-reload. Re-run to confirm idempotent (should be all "absent/none/SKIP").\n'
-elif [ "$DID" -eq 1 ]; then
-  printf 'RESULT: dry-run. Re-run with --apply to remove the [would] items above.\n'
-else
-  printf 'RESULT: nothing to prune (already clean) — only MANUAL items remain.\n'
-fi