@delorenj/pjangler 1.2.25 → 1.3.0

package/templates/hermes-agent/scripts/unify-pm.sh

@@ -1,148 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# unify-pm — Phase C (safe subset): move every deployed PM toward the unified
-# single-PM model WITHOUT disrupting running services.
-#
-# Per PM (driven off registry role=pm, so specialized non-pm profiles are
-# naturally skipped):
-#   1. refresh .scripts/checkpoint.sh — applies the secret-scan gate to the live
-#      hourly checkpoint (the existing checkpoint.service ExecStarts this file).
-#   2. refresh the <role_dir>/hermes launcher to the runtime-only template
-#      (drops the stale profile-fallback; used for interactive `hermes chat`,
-#      never by the systemd units).
-#   3. ensure ~/.hermes/profiles/<profile_name> symlinks to ./runtime. This is
-#      LOAD-BEARING — hermes resolves `--profile <name>` through it (and recreates
-#      it as a fresh standalone dir if missing, disconnecting the agent from its
-#      runtime), so it is repaired/created, NEVER dropped.
-#
-# Does NOT touch gateway/consumer/checkpoint units, the registry, or runtimes.
-# The checkpoint→heartbeat unit rename + sentinel install is a separate pass.
-#
-# DRY-RUN by default; --apply performs; --agent <id>... scopes; pjangler-pm first.
-#
-# Usage: unify-pm.sh [--apply] [--agent <pm-id>]...
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-TEMPLATE_DIR="$SCRIPT_DIR/../template"
-CHECKPOINT_SRC="$TEMPLATE_DIR/.scripts/checkpoint.sh"
-WRAPPER_TEMPLATE="$TEMPLATE_DIR/hermes.jinja"
-
-HERMES_TEMPLATE_CONFIG="${HERMES_TEMPLATE_CONFIG:-${XDG_CONFIG_HOME:-$HOME/.config}/hermes-agent-template/config.toml}"
-cfg() {
-  local key="$1" def="$2"
-  { [[ -f "$HERMES_TEMPLATE_CONFIG" ]] && command -v python3 >/dev/null 2>&1; } || { printf '%s' "$def"; return 0; }
-  python3 - "$HERMES_TEMPLATE_CONFIG" "$key" "$def" <<'PYEOF' || printf '%s' "$def"
-import sys, os
-try:
-    import tomllib
-except ModuleNotFoundError:
-    print(sys.argv[3], end=""); sys.exit(0)
-try:
-    cur = tomllib.load(open(sys.argv[1], "rb"))
-except Exception:
-    print(sys.argv[3], end=""); sys.exit(0)
-for p in sys.argv[2].split("."):
-    if isinstance(cur, dict) and p in cur:
-        cur = cur[p]
-    else:
-        print(sys.argv[3], end=""); sys.exit(0)
-print(os.path.expanduser(str(cur)), end="")
-PYEOF
-  return 0
-}
-
-REGISTRY_FILE="${HERMES_FLEET_REGISTRY_FILE:-$(cfg fleet.registry_file "$HOME/.hermes/agents-registry.yaml")}"
-PROFILES_DIR="${HERMES_FLEET_HOME:-$HOME/.hermes}/profiles"
-SYS_DIR="$HOME/.config/systemd/user"
-
-APPLY=0
-declare -a ONLY=()
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --apply) APPLY=1 ;;
-    --agent) shift; ONLY+=("$1") ;;
-    -h|--help) sed -n '3,30p' "$0"; exit 0 ;;
-    *) echo "unify-pm: unknown flag $1" >&2; exit 2 ;;
-  esac
-  shift
-done
-
-[[ -f "$REGISTRY_FILE" ]] || { echo "unify-pm: registry not found: $REGISTRY_FILE" >&2; exit 2; }
-[[ -f "$CHECKPOINT_SRC" ]] || { echo "unify-pm: template checkpoint.sh not found: $CHECKPOINT_SRC" >&2; exit 2; }
-[[ -f "$WRAPPER_TEMPLATE" ]] || { echo "unify-pm: wrapper template not found: $WRAPPER_TEMPLATE" >&2; exit 2; }
-
-MODE="DRY-RUN"; [[ $APPLY -eq 1 ]] && MODE="APPLY"
-echo "unify-pm — mode: $MODE   registry: $REGISTRY_FILE"
-echo "================================================================"
-
-# PM rows (pjangler first), TSV: agent_id, role_dir, profile_name
-read_pm() {
-  python3 - "$REGISTRY_FILE" <<'PYEOF'
-import sys, yaml
-d = yaml.safe_load(open(sys.argv[1], encoding="utf-8")) or {}
-rows = [(aid, str(a.get("role_dir") or ""), str(a.get("profile_name") or aid))
-        for aid, a in (d.get("agents") or {}).items()
-        if isinstance(a, dict) and a.get("role") == "pm"]
-rows.sort(key=lambda r: (r[0] != "pjangler-pm", r[0]))
-for r in rows:
-    print("\t".join(r))
-PYEOF
-}
-
-wanted() { [[ ${#ONLY[@]} -eq 0 ]] && return 0; local a; for a in "${ONLY[@]}"; do [[ "$a" == "$1" ]] && return 0; done; return 1; }
-
-CK=0; WR=0; SL=0; SKIP=0
-while IFS=$'\t' read -r aid role_dir profile_name; do
-  wanted "$aid" || continue
-  echo
-  echo ">>> $aid"
-  if [[ -z "$role_dir" || ! -d "$role_dir" ]]; then
-    echo "    role_dir missing: ${role_dir:-<unset>} — skipping"; SKIP=$((SKIP+1)); continue
-  fi
-  runtime="$role_dir/runtime"
-
-  # 1. checkpoint.sh secret-gate refresh.
-  dst="$role_dir/.scripts/checkpoint.sh"
-  if [[ ! -f "$dst" ]] || ! diff -q "$CHECKPOINT_SRC" "$dst" >/dev/null 2>&1; then
-    if [[ $APPLY -eq 1 ]]; then
-      mkdir -p "$role_dir/.scripts"; cp "$CHECKPOINT_SRC" "$dst"; chmod +x "$dst"
-      echo "    [do]  checkpoint.sh refreshed (secret-gate)"; CK=$((CK+1))
-    else
-      echo "    [dry] checkpoint.sh would be refreshed (secret-gate)"; CK=$((CK+1))
-    fi
-  else
-    echo "    checkpoint.sh already current"
-  fi
-
-  # 2. launcher → runtime-only template.
-  expected_wrapper="$(sed "s/{{ agent_id }}/$aid/g" "$WRAPPER_TEMPLATE")"
-  if [[ ! -f "$role_dir/hermes" ]] || ! diff -q <(printf '%s\n' "$expected_wrapper") "$role_dir/hermes" >/dev/null 2>&1; then
-    if [[ $APPLY -eq 1 ]]; then
-      printf '%s\n' "$expected_wrapper" > "$role_dir/hermes"; chmod +x "$role_dir/hermes"
-      echo "    [do]  launcher regenerated (runtime-only)"; WR=$((WR+1))
-    else
-      echo "    [dry] launcher would be regenerated (runtime-only)"; WR=$((WR+1))
-    fi
-  else
-    echo "    launcher already current"
-  fi
-
-  # 3. ensure the profile symlink points at the runtime (load-bearing; never drop).
-  link="$PROFILES_DIR/$profile_name"
-  if [[ -L "$link" && "$(readlink -f "$link")" == "$(readlink -f "$runtime")" ]]; then
-    echo "    profile symlink ok -> runtime"
-  elif [[ -e "$link" && ! -L "$link" ]]; then
-    echo "    profile entry is a REAL dir (MANUAL merge): $link — left untouched"; SKIP=$((SKIP+1))
-  else
-    if [[ $APPLY -eq 1 ]]; then
-      mkdir -p "$PROFILES_DIR"; ln -sfn "$runtime" "$link"; echo "    [do]  profile symlink set -> runtime"; SL=$((SL+1))
-    else
-      echo "    [dry] profile symlink would be set -> runtime"; SL=$((SL+1))
-    fi
-  fi
-done < <(read_pm)
-
-echo
-echo "================================================================"
-echo "unify-pm: checkpoint=$CK launcher=$WR symlink-repair=$SL skipped=$SKIP  ($MODE)"

package/templates/hermes-agent/tests/test_bloodbank_consumer_contract.py

@@ -1,437 +0,0 @@
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-from concurrent.futures import ThreadPoolExecutor
-from pathlib import Path
-
-import pytest
-import yaml
-
-
-ROOT = Path(__file__).parents[1]
-SCRIPTS = ROOT / "template" / ".scripts"
-
-
-def _make_role(tmp_path: Path) -> tuple[Path, Path]:
-    role = tmp_path / "role"
-    scripts = role / ".scripts"
-    runtime = role / "runtime"
-    scripts.mkdir(parents=True)
-    runtime.mkdir()
-    for name in ("_lib.sh", "60-bloodbank.sh", "70-systemd.sh", "80-registry.sh"):
-        shutil.copy2(SCRIPTS / name, scripts / name)
-    (scripts / "heartbeat.sh").write_text("#!/usr/bin/env bash\n", encoding="utf-8")
-    (scripts / "checkpoint.sh").write_text("#!/usr/bin/env bash\n", encoding="utf-8")
-    (role / "role.yaml").write_text(
-        """repo: demo
-role: pm
-agent_id: demo-pm
-display_name: "Demo PM"
-profile: demo-pm
-telegram:
-  provisioning_status: "deferred"
-  bot_username: "demo_pm_bot"
-  bot_id: ""
-slack:
-  provisioning_status: "deferred"
-  team_id: ""
-  team_name: ""
-  bot_user_id: ""
-  bot_id: ""
-  bot_username: ""
-bloodbank:
-  gateway_scope: fleet
-  target_agent_id: "demo-pm"
-  producer: "hermes-agent:demo-pm"
-plane:
-  workspace: "test"
-  identifier: ""
-runtime:
-  github_owner: "test"
-  github_repo: "agent-hm-demo-pm"
-""",
-        encoding="utf-8",
-    )
-    registry = tmp_path / "agents-registry.yaml"
-    registry.write_text("schema_version: 1\nagents: {}\n", encoding="utf-8")
-    return role, registry
-
-
-def _environment(tmp_path: Path, registry: Path) -> dict[str, str]:
-    home = tmp_path / "home"
-    home.mkdir(exist_ok=True)
-    env = dict(os.environ)
-    env.update(
-        {
-            "HOME": str(home),
-            "HERMES_FLEET_ENV": str(home / ".hermes" / "fleet.env"),
-            "REGISTRY_FILE": str(registry),
-        }
-    )
-    return env
-
-
-def _run(role: Path, name: str, env: dict[str, str]) -> subprocess.CompletedProcess[str]:
-    return subprocess.run(
-        ["bash", str(role / ".scripts" / name)],
-        env=env,
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-
-
-def _inject_parent_fsync_failure(
-    tmp_path: Path, env: dict[str, str], parent: Path
-) -> None:
-    site_dir = tmp_path / "fsync-failure-site"
-    site_dir.mkdir()
-    (site_dir / "sitecustomize.py").write_text(
-        """import errno
-import os
-import stat
-
-_real_fsync = os.fsync
-_failed_parent = os.path.realpath(os.environ["FAIL_PARENT_FSYNC"])
-
-def _fsync(fd):
-    if stat.S_ISDIR(os.fstat(fd).st_mode):
-        resolved = os.path.realpath(f"/proc/self/fd/{fd}")
-        if resolved == _failed_parent:
-            raise OSError(errno.EIO, "injected parent directory fsync failure")
-    return _real_fsync(fd)
-
-os.fsync = _fsync
-""",
-        encoding="utf-8",
-    )
-    env["PYTHONPATH"] = str(site_dir)
-    env["FAIL_PARENT_FSYNC"] = str(parent)
-
-
-def test_future_runtime_scaffolds_have_no_profile_consumer_or_inbox() -> None:
-    for scaffold in (ROOT / "runtime-scaffold", ROOT / "template" / ".runtime-scaffold"):
-        assert not (scaffold / "bloodbank-consumer.py").exists()
-        assert "bloodbank-inbox" not in (scaffold / ".gitignore").read_text(encoding="utf-8")
-        readme = (scaffold / "README.md").read_text(encoding="utf-8")
-        assert "fleet-shared" in readme
-        assert "no consumer process or inbox bridge" in readme
-
-
-@pytest.mark.parametrize("skip", ["0", "1"])
-def test_step_60_is_a_harmless_compatibility_noop(tmp_path: Path, skip: str) -> None:
-    role, registry = _make_role(tmp_path)
-    env = _environment(tmp_path, registry)
-    env["SKIP_BLOODBANK"] = skip
-
-    result = _run(role, "60-bloodbank.sh", env)
-
-    assert result.returncode == 0, result.stderr
-    assert (role / ".scripts" / ".done-60-bloodbank").is_file()
-    assert not (role / "runtime" / "bloodbank-consumer.py").exists()
-    assert "NATS" not in result.stdout + result.stderr
-
-
-def test_systemd_installs_only_profile_gateway_and_heartbeat(tmp_path: Path) -> None:
-    role, registry = _make_role(tmp_path)
-    env = _environment(tmp_path, registry)
-    fake_bin = tmp_path / "bin"
-    fake_bin.mkdir()
-    fake_systemctl = fake_bin / "systemctl"
-    fake_systemctl.write_text(
-        """#!/usr/bin/env bash
-case "$*" in
-  *"is-active hermes-demo-pm-consumer.service"*) echo inactive; exit 4 ;;
-  *"is-enabled hermes-demo-pm-consumer.service"*) echo not-found; exit 4 ;;
-  *"is-system-running"*) exit 1 ;;
-esac
-exit 1
-""",
-        encoding="utf-8",
-    )
-    fake_systemctl.chmod(0o755)
-    env["PATH"] = f"{fake_bin}:{env['PATH']}"
-
-    result = _run(role, "70-systemd.sh", env)
-
-    assert result.returncode == 0, result.stderr
-    unit_dir = Path(env["HOME"]) / ".config" / "systemd" / "user"
-    assert (unit_dir / "hermes-demo-pm-gateway.service").is_file()
-    assert (unit_dir / "hermes-demo-pm-heartbeat.service").is_file()
-    assert (unit_dir / "hermes-demo-pm-heartbeat.timer").is_file()
-    assert not (unit_dir / "hermes-demo-pm-consumer.service").exists()
-    rendered = "\n".join(path.read_text(encoding="utf-8") for path in unit_dir.iterdir())
-    assert "bloodbank-consumer.py" not in rendered
-    assert "consumer.log" not in rendered
-
-
-def test_systemd_done_marker_still_retires_legacy_consumer(tmp_path: Path) -> None:
-    role, registry = _make_role(tmp_path)
-    env = _environment(tmp_path, registry)
-    unit_dir = Path(env["HOME"]) / ".config" / "systemd" / "user"
-    unit_dir.mkdir(parents=True)
-    consumer = unit_dir / "hermes-demo-pm-consumer.service"
-    consumer.write_text("legacy\n", encoding="utf-8")
-    (role / ".scripts" / ".done-70-systemd").touch()
-    fake_bin = tmp_path / "bin"
-    fake_bin.mkdir()
-    log = tmp_path / "systemctl.log"
-    retired = tmp_path / "retired"
-    systemctl = fake_bin / "systemctl"
-    systemctl.write_text(
-        """#!/usr/bin/env bash
-printf '%s\n' "$*" >> "$SYSTEMCTL_LOG"
-case "$*" in
-  *"disable --now hermes-demo-pm-consumer.service"*) touch "$SYSTEMCTL_RETIRED"; exit 0 ;;
-  *"is-active hermes-demo-pm-consumer.service"*)
-    if [[ -f "$SYSTEMCTL_RETIRED" ]]; then echo inactive; exit 3; else echo active; exit 0; fi ;;
-  *"is-enabled hermes-demo-pm-consumer.service"*)
-    if [[ -f "$SYSTEMCTL_RETIRED" ]]; then echo disabled; exit 1; else echo enabled; exit 0; fi ;;
-  *"is-system-running"*) echo running; exit 0 ;;
-esac
-exit 1
-""",
-        encoding="utf-8",
-    )
-    systemctl.chmod(0o755)
-    env.update(
-        {
-            "PATH": f"{fake_bin}:{env['PATH']}",
-            "SYSTEMCTL_LOG": str(log),
-            "SYSTEMCTL_RETIRED": str(retired),
-        }
-    )
-
-    result = _run(role, "70-systemd.sh", env)
-
-    assert result.returncode == 0, result.stderr
-    assert not consumer.exists()
-    assert "disable --now hermes-demo-pm-consumer.service" in log.read_text(encoding="utf-8")
-    assert "legacy cleanup checked" in result.stderr
-    assert not (unit_dir / "hermes-demo-pm-gateway.service").exists()
-
-
-def test_systemd_preserves_legacy_consumer_when_disable_fails(tmp_path: Path) -> None:
-    role, registry = _make_role(tmp_path)
-    env = _environment(tmp_path, registry)
-    unit_dir = Path(env["HOME"]) / ".config" / "systemd" / "user"
-    unit_dir.mkdir(parents=True)
-    consumer = unit_dir / "hermes-demo-pm-consumer.service"
-    consumer.write_text("legacy\n", encoding="utf-8")
-    marker = role / ".scripts" / ".done-70-systemd"
-    marker.touch()
-    fake_bin = tmp_path / "bin"
-    fake_bin.mkdir()
-    systemctl = fake_bin / "systemctl"
-    systemctl.write_text(
-        """#!/usr/bin/env bash
-case "$*" in
-  *"is-active hermes-demo-pm-consumer.service"*) echo active; exit 0 ;;
-  *"is-enabled hermes-demo-pm-consumer.service"*) echo enabled; exit 0 ;;
-  *"disable --now hermes-demo-pm-consumer.service"*) exit 1 ;;
-esac
-exit 1
-""",
-        encoding="utf-8",
-    )
-    systemctl.chmod(0o755)
-    env["PATH"] = f"{fake_bin}:{env['PATH']}"
-
-    result = _run(role, "70-systemd.sh", env)
-
-    assert result.returncode != 0
-    assert "disable failed" in result.stderr
-    assert consumer.read_text(encoding="utf-8") == "legacy\n"
-    assert marker.exists()
-    assert not (unit_dir / "hermes-demo-pm-gateway.service").exists()
-
-
-@pytest.mark.parametrize("failed_query", ["is-active", "is-enabled"])
-def test_systemd_preserves_legacy_consumer_when_state_query_fails(
-    tmp_path: Path, failed_query: str
-) -> None:
-    role, registry = _make_role(tmp_path)
-    env = _environment(tmp_path, registry)
-    unit_dir = Path(env["HOME"]) / ".config" / "systemd" / "user"
-    unit_dir.mkdir(parents=True)
-    consumer = unit_dir / "hermes-demo-pm-consumer.service"
-    consumer.write_text("legacy\n", encoding="utf-8")
-    marker = role / ".scripts" / ".done-70-systemd"
-    marker.touch()
-    fake_bin = tmp_path / "bin"
-    fake_bin.mkdir()
-    log = tmp_path / "systemctl.log"
-    systemctl = fake_bin / "systemctl"
-    systemctl.write_text(
-        """#!/usr/bin/env bash
-printf '%s\n' "$*" >> "$SYSTEMCTL_LOG"
-case "$*" in
-  *"$FAILED_QUERY hermes-demo-pm-consumer.service"*) echo "Failed to connect to bus" >&2; exit 1 ;;
-  *"is-active hermes-demo-pm-consumer.service"*) echo active; exit 0 ;;
-  *"is-enabled hermes-demo-pm-consumer.service"*) echo enabled; exit 0 ;;
-esac
-exit 1
-""",
-        encoding="utf-8",
-    )
-    systemctl.chmod(0o755)
-    env.update(
-        {
-            "PATH": f"{fake_bin}:{env['PATH']}",
-            "FAILED_QUERY": failed_query,
-            "SYSTEMCTL_LOG": str(log),
-        }
-    )
-
-    result = _run(role, "70-systemd.sh", env)
-
-    assert result.returncode != 0
-    assert "cannot safely query" in result.stderr
-    assert consumer.read_text(encoding="utf-8") == "legacy\n"
-    assert marker.exists()
-    assert "disable --now" not in log.read_text(encoding="utf-8")
-
-
-def test_registry_records_fleet_gateway_contract_without_consumer_unit(tmp_path: Path) -> None:
-    role, registry = _make_role(tmp_path)
-    env = _environment(tmp_path, registry)
-    registry.write_text(
-        yaml.safe_dump(
-            {
-                "schema_version": 1,
-                "agents": {
-                    "demo-pm": {
-                        "systemd": {
-                            "consumer_unit": "hermes-demo-pm-consumer.service"
-                        }
-                    }
-                },
-            },
-            sort_keys=False,
-        ),
-        encoding="utf-8",
-    )
-
-    result = _run(role, "80-registry.sh", env)
-
-    assert result.returncode == 0, result.stderr
-    entry = yaml.safe_load(registry.read_text(encoding="utf-8"))["agents"]["demo-pm"]
-    assert entry["bloodbank"] == {
-        "gateway_scope": "fleet",
-        "target_agent_id": "demo-pm",
-    }
-    assert entry["systemd"] == {
-        "gateway_unit": "hermes-demo-pm-gateway.service",
-        "heartbeat_timer": "hermes-demo-pm-heartbeat.timer",
-    }
-    assert "consumer_unit" not in entry["systemd"]
-
-
-def test_concurrent_registry_upserts_are_atomic_and_lossless(tmp_path: Path) -> None:
-    role_a, _ = _make_role(tmp_path / "a")
-    role_b, _ = _make_role(tmp_path / "b")
-    role_b_yaml = role_b / "role.yaml"
-    role_b_yaml.write_text(
-        role_b_yaml.read_text(encoding="utf-8").replace("demo-pm", "demo-reviewer"),
-        encoding="utf-8",
-    )
-    registry = tmp_path / "agents-registry.yaml"
-    registry.write_text("schema_version: 1\nagents: {}\n", encoding="utf-8")
-    (tmp_path / "env-a").mkdir()
-    (tmp_path / "env-b").mkdir()
-    env_a = _environment(tmp_path / "env-a", registry)
-    env_b = _environment(tmp_path / "env-b", registry)
-
-    with ThreadPoolExecutor(max_workers=2) as pool:
-        results = list(
-            pool.map(
-                lambda args: _run(*args),
-                (
-                    (role_a, "80-registry.sh", env_a),
-                    (role_b, "80-registry.sh", env_b),
-                ),
-            )
-        )
-
-    assert all(result.returncode == 0 for result in results), [r.stderr for r in results]
-    agents = yaml.safe_load(registry.read_text(encoding="utf-8"))["agents"]
-    assert set(agents) == {"demo-pm", "demo-reviewer"}
-    assert (registry.stat().st_mode & 0o777) == 0o600
-
-
-def test_registry_parent_fsync_failure_is_reported_and_retryable(tmp_path: Path) -> None:
-    role, registry = _make_role(tmp_path)
-    env = _environment(tmp_path, registry)
-    _inject_parent_fsync_failure(tmp_path, env, registry.parent)
-
-    failed = _run(role, "80-registry.sh", env)
-
-    assert failed.returncode != 0
-    assert "injected parent directory fsync failure" in failed.stderr
-    assert "demo-pm" in yaml.safe_load(registry.read_text(encoding="utf-8"))["agents"]
-    assert (registry.stat().st_mode & 0o777) == 0o600
-    assert not (role / ".scripts" / ".done-80-registry").exists()
-
-    retry_env = _environment(tmp_path, registry)
-    retried = _run(role, "80-registry.sh", retry_env)
-
-    assert retried.returncode == 0, retried.stderr
-    assert (role / ".scripts" / ".done-80-registry").exists()
-
-
-def test_registry_upsert_refuses_lock_symlink(tmp_path: Path) -> None:
-    role, registry = _make_role(tmp_path)
-    env = _environment(tmp_path, registry)
-    lock_target = tmp_path / "lock-target"
-    lock_target.write_text("untouched", encoding="utf-8")
-    Path(f"{registry}.lock").symlink_to(lock_target)
-
-    result = _run(role, "80-registry.sh", env)
-
-    assert result.returncode != 0
-    assert "lock symlink" in result.stderr
-    assert lock_target.read_text(encoding="utf-8") == "untouched"
-
-
-def test_stale_lock_file_is_safe_when_no_process_holds_flock(tmp_path: Path) -> None:
-    role, registry = _make_role(tmp_path)
-    env = _environment(tmp_path, registry)
-    lock = Path(f"{registry}.lock")
-    lock.write_text("left by a crashed provisioner\n", encoding="utf-8")
-    lock.chmod(0o644)
-
-    result = _run(role, "80-registry.sh", env)
-
-    assert result.returncode == 0, result.stderr
-    assert "demo-pm" in yaml.safe_load(registry.read_text(encoding="utf-8"))["agents"]
-    assert (lock.stat().st_mode & 0o777) == 0o600
-
-
-def test_template_declares_fleet_scope_and_retains_compatibility_step() -> None:
-    role = (ROOT / "template" / "role.yaml.jinja").read_text(encoding="utf-8")
-    copier = (ROOT / "copier.yml").read_text(encoding="utf-8")
-    step = (SCRIPTS / "60-bloodbank.sh").read_text(encoding="utf-8")
-
-    assert "gateway_scope: fleet" in role
-    assert 'target_agent_id: "{{ agent_id }}"' in role
-    assert './.scripts/60-bloodbank.sh' in copier
-    assert "SKIP_BLOODBANK accepted as a compatibility no-op" in step
-    for legacy in ("/dev/tcp", "uv pip install", "bloodbank-consumer.py"):
-        assert legacy not in step
-
-
-def test_documented_gateway_lifecycle_matches_canonical_bloodbank_contract() -> None:
-    architecture = (ROOT / "docs" / "architecture.md").read_text(encoding="utf-8")
-
-    for event_type in (
-        "bloodbank.v1.conversation.turn.started",
-        "bloodbank.v1.agent.invocation.started",
-        "bloodbank.v1.agent.invocation.completed",
-        "bloodbank.v1.agent.invocation.failed",
-        "bloodbank.v1.conversation.turn.completed",
-    ):
-        assert event_type in architecture
-    assert "There are no separate `received` or `accepted` lifecycle events" in architecture
-    assert "acknowledged only after Hermes processing completion" in architecture