@delorenj/pjangler 1.2.25 → 1.3.0

package/templates/hermes-agent/tests/test_fleet_upgrade_contract.py

@@ -1,176 +0,0 @@
-from __future__ import annotations
-
-import os
-import stat
-import subprocess
-from pathlib import Path
-
-import yaml
-
-
-ROOT = Path(__file__).parents[1]
-FLEET_SYNC = ROOT / "scripts" / "fleet-sync.sh"
-
-
-def _fixture(tmp_path: Path) -> tuple[dict[str, str], Path, Path, Path]:
-    home = tmp_path / "home"
-    role = tmp_path / "role"
-    runtime = role / "runtime"
-    runtime.mkdir(parents=True)
-    (runtime / "profile.yaml").write_text(
-        "config:\n  inherit_from: default\n  save_mode: delta\n", encoding="utf-8"
-    )
-    (role / "role.yaml").write_text("profile: demo-pm\n", encoding="utf-8")
-    registry = tmp_path / "agents-registry.yaml"
-    registry.write_text(
-        yaml.safe_dump(
-            {
-                "schema_version": 1,
-                "agents": {
-                    "demo-pm": {
-                        "role_dir": str(role),
-                        "profile_name": "demo-pm",
-                        "systemd": {
-                            "gateway_unit": "hermes-demo-pm-gateway.service",
-                            "consumer_unit": "hermes-demo-pm-consumer.service",
-                        },
-                    }
-                },
-            },
-            sort_keys=False,
-        ),
-        encoding="utf-8",
-    )
-    unit_dir = home / ".config" / "systemd" / "user"
-    unit_dir.mkdir(parents=True)
-    consumer = unit_dir / "hermes-demo-pm-consumer.service"
-    consumer.write_text("legacy\n", encoding="utf-8")
-    fake_bin = tmp_path / "bin"
-    fake_bin.mkdir()
-    retired = tmp_path / "retired"
-    systemctl = fake_bin / "systemctl"
-    systemctl.write_text(
-        """#!/usr/bin/env bash
-case "$*" in
-  *"disable --now hermes-demo-pm-consumer.service"*)
-    [[ "$SYSTEMCTL_MODE" == "disable-fail" ]] && exit 1
-    touch "$SYSTEMCTL_RETIRED"; exit 0 ;;
-  *"is-active hermes-demo-pm-consumer.service"*)
-    [[ "$SYSTEMCTL_MODE" == "active-query-error" ]] && { echo "Failed to connect to bus" >&2; exit 1; }
-    if [[ -f "$SYSTEMCTL_RETIRED" ]]; then echo inactive; exit 3; else echo active; exit 0; fi ;;
-  *"is-enabled hermes-demo-pm-consumer.service"*)
-    [[ "$SYSTEMCTL_MODE" == "enabled-query-error" ]] && { echo "Failed to connect to bus" >&2; exit 1; }
-    if [[ -f "$SYSTEMCTL_RETIRED" ]]; then echo disabled; exit 1; else echo enabled; exit 0; fi ;;
-  *"daemon-reload"*) exit 0 ;;
-esac
-exit 1
-""",
-        encoding="utf-8",
-    )
-    systemctl.chmod(0o755)
-    env = dict(os.environ)
-    env.update(
-        {
-            "HOME": str(home),
-            "PATH": f"{fake_bin}:{env['PATH']}",
-            "HERMES_FLEET_REGISTRY_FILE": str(registry),
-            "HERMES_FLEET_HOME": str(home / ".hermes"),
-            "SYSTEMCTL_RETIRED": str(retired),
-            "SYSTEMCTL_MODE": "success",
-        }
-    )
-    return env, registry, consumer, role
-
-
-def test_fleet_audit_reports_and_apply_retires_legacy_consumer(tmp_path: Path) -> None:
-    env, registry, consumer, _ = _fixture(tmp_path)
-
-    audit = subprocess.run(
-        ["bash", str(FLEET_SYNC), "--agent", "demo-pm"],
-        env=env,
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-    assert audit.returncode == 1
-    assert "legacy per-profile Bloodbank consumer remains" in audit.stdout
-
-    applied = subprocess.run(
-        ["bash", str(FLEET_SYNC), "--apply", "--no-restart", "--agent", "demo-pm"],
-        env=env,
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-    assert applied.returncode == 0, applied.stdout + applied.stderr
-    assert not consumer.exists()
-    entry = yaml.safe_load(registry.read_text(encoding="utf-8"))["agents"]["demo-pm"]
-    assert "consumer_unit" not in entry["systemd"]
-    assert stat.S_IMODE(registry.stat().st_mode) == 0o600
-
-
-def test_fleet_apply_preserves_unit_and_metadata_when_disable_fails(tmp_path: Path) -> None:
-    env, registry, consumer, _ = _fixture(tmp_path)
-    env["SYSTEMCTL_MODE"] = "disable-fail"
-
-    result = subprocess.run(
-        ["bash", str(FLEET_SYNC), "--apply", "--no-restart", "--agent", "demo-pm"],
-        env=env,
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-
-    assert result.returncode != 0
-    assert "disable failed; unit and metadata preserved" in result.stdout
-    assert consumer.read_text(encoding="utf-8") == "legacy\n"
-    entry = yaml.safe_load(registry.read_text(encoding="utf-8"))["agents"]["demo-pm"]
-    assert entry["systemd"]["consumer_unit"] == "hermes-demo-pm-consumer.service"
-    assert not Path(env["SYSTEMCTL_RETIRED"]).exists()
-
-
-def test_fleet_audit_and_apply_fail_closed_on_state_query_errors(tmp_path: Path) -> None:
-    for mode in ("active-query-error", "enabled-query-error"):
-        case_dir = tmp_path / mode
-        case_dir.mkdir()
-        env, registry, consumer, _ = _fixture(case_dir)
-        env["SYSTEMCTL_MODE"] = mode
-
-        for apply_args in ([], ["--apply", "--no-restart"]):
-            result = subprocess.run(
-                ["bash", str(FLEET_SYNC), *apply_args, "--agent", "demo-pm"],
-                env=env,
-                text=True,
-                capture_output=True,
-                check=False,
-            )
-            assert result.returncode != 0
-            assert "state query failed; unit and metadata preserved" in result.stdout
-            assert consumer.read_text(encoding="utf-8") == "legacy\n"
-            entry = yaml.safe_load(registry.read_text(encoding="utf-8"))["agents"]["demo-pm"]
-            assert entry["systemd"]["consumer_unit"] == "hermes-demo-pm-consumer.service"
-            assert not Path(env["SYSTEMCTL_RETIRED"]).exists()
-
-
-def test_pinned_fork_publication_replaces_upstream_clean_install_path() -> None:
-    installer = (ROOT / "install-local.sh").read_text(encoding="utf-8")
-    config = (ROOT / "template" / ".scripts" / "config.example.toml").read_text(
-        encoding="utf-8"
-    )
-    expected_sha = "113e1b182b6d72a7dd02a191f134a41668ceaf0e"
-
-    assert "raw.githubusercontent.com/NousResearch/hermes-agent" not in installer
-    assert 'HERMES_RUNTIME_GIT_URL="https://github.com/delorenj/hermes-agent.git"' in installer
-    assert 'HERMES_RUNTIME_GIT_REF="feature/PJAN-19-routing-publication"' in installer
-    assert f'HERMES_RUNTIME_GIT_SHA="{expected_sha}"' in installer
-    assert "merge-base --is-ancestor" in installer
-    assert f'hermes_git_sha = "{expected_sha}"' in config
-
-
-def test_runtime_templatizer_pins_canonical_bmad_next31_pack() -> None:
-    templatizer = (ROOT / "scripts" / "hermes-runtime-templatize.py").read_text(
-        encoding="utf-8"
-    )
-
-    assert "/packs/bmad/6.10.1-next.31" in templatizer
-    assert "/packs/bmad/6.10.2" not in templatizer

package/templates/hermes-agent/tests/test_launcher_chat_secret_isolation.py

@@ -1,85 +0,0 @@
-from __future__ import annotations
-
-import json
-import os
-import subprocess
-from pathlib import Path
-
-
-ROOT = Path(__file__).parents[1]
-LAUNCHER_TEMPLATE = ROOT / "template" / "hermes.jinja"
-
-
-def test_launcher_drops_shared_identity_credentials_but_keeps_policy(tmp_path: Path) -> None:
-    home = tmp_path / "home"
-    role = tmp_path / "role"
-    runtime = role / "runtime"
-    runtime.mkdir(parents=True)
-    fleet = home / ".hermes" / "fleet.env"
-    fleet.parent.mkdir(parents=True)
-    fake_hermes = tmp_path / "fake-hermes"
-    fake_hermes.write_text(
-        """#!/usr/bin/env python3
-import json
-import os
-
-keys = (
-    "TELEGRAM_BOT_TOKEN",
-    "SLACK_BOT_TOKEN",
-    "SLACK_APP_TOKEN",
-    "TELEGRAM_ALLOWED_USERS",
-    "SLACK_ALLOWED_USERS",
-    "HERMES_HOME",
-)
-print(json.dumps({key: os.environ.get(key) for key in keys}))
-""",
-        encoding="utf-8",
-    )
-    fake_hermes.chmod(0o755)
-    fleet.write_text(
-        f"export HERMES_FLEET_BIN={fake_hermes}\n"
-        "export TELEGRAM_BOT_TOKEN=123456:shared-secret\n"
-        "export SLACK_BOT_TOKEN=xoxb-shared-secret\n"
-        "export SLACK_APP_TOKEN=xapp-shared-secret\n"
-        "export TELEGRAM_ALLOWED_USERS=111\n"
-        "export SLACK_ALLOWED_USERS=U111\n",
-        encoding="utf-8",
-    )
-    launcher = role / "hermes"
-    launcher.write_text(
-        LAUNCHER_TEMPLATE.read_text(encoding="utf-8").replace("{{ agent_id }}", "demo-pm"),
-        encoding="utf-8",
-    )
-    launcher.chmod(0o755)
-    env = {
-        key: value
-        for key, value in os.environ.items()
-        if key
-        not in {
-            "TELEGRAM_BOT_TOKEN",
-            "SLACK_BOT_TOKEN",
-            "SLACK_APP_TOKEN",
-            "TELEGRAM_ALLOWED_USERS",
-            "SLACK_ALLOWED_USERS",
-            "HERMES_BIN",
-            "HERMES_FLEET_BIN",
-        }
-    }
-    env.update({"HOME": str(home), "HERMES_FLEET_ENV": str(fleet)})
-
-    result = subprocess.run(
-        [str(launcher), "gateway", "run"],
-        env=env,
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-
-    assert result.returncode == 0, result.stderr
-    observed = json.loads(result.stdout)
-    assert observed["TELEGRAM_BOT_TOKEN"] is None
-    assert observed["SLACK_BOT_TOKEN"] is None
-    assert observed["SLACK_APP_TOKEN"] is None
-    assert observed["TELEGRAM_ALLOWED_USERS"] == "111"
-    assert observed["SLACK_ALLOWED_USERS"] == "U111"
-    assert observed["HERMES_HOME"] == str(runtime)

package/templates/hermes-agent/tests/test_local_runtime_provisioning.py

@@ -1,130 +0,0 @@
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-from pathlib import Path
-
-
-ROOT = Path(__file__).parents[1]
-RUNTIME_SCRIPT = ROOT / "template" / ".scripts" / "20-runtime-repo.sh"
-LIB_SCRIPT = ROOT / "template" / ".scripts" / "_lib.sh"
-
-
-def _fixture(tmp_path: Path) -> tuple[Path, Path, dict[str, str]]:
-    project = tmp_path / "project"
-    role = project / "agents" / "hermes" / "pm"
-    scripts = role / ".scripts"
-    scaffold = role / ".runtime-scaffold"
-    scripts.mkdir(parents=True)
-    scaffold.mkdir()
-    shutil.copy2(RUNTIME_SCRIPT, scripts / RUNTIME_SCRIPT.name)
-    shutil.copy2(LIB_SCRIPT, scripts / LIB_SCRIPT.name)
-    (scaffold / "MEMORY.md").write_text("agent={{agent_id}}\n", encoding="utf-8")
-    (role / "SOUL.md").write_text("local soul\n", encoding="utf-8")
-    (role / ".gitignore").write_text("runtime/\n", encoding="utf-8")
-    (role / "role.yaml").write_text(
-        """repo: demo
-role: pm
-agent_id: demo-pm
-display_name: "Demo PM"
-profile: demo-pm
-telegram:
-  bot_username: demo_pm_bot
-plane:
-  workspace: test
-runtime:
-  github_owner: legacy
-  github_repo: agent-hm-demo-pm
-  local_path: ./runtime
-""",
-        encoding="utf-8",
-    )
-    subprocess.run(["git", "init", "--quiet"], cwd=project, check=True)
-
-    home = tmp_path / "home"
-    profiles = home / ".hermes" / "profiles"
-    profiles.mkdir(parents=True)
-    fake_bin = tmp_path / "bin"
-    fake_bin.mkdir()
-    hermes = fake_bin / "hermes"
-    hermes.write_text("#!/usr/bin/env bash\nexit 0\n", encoding="utf-8")
-    hermes.chmod(0o755)
-    env = dict(os.environ)
-    env.update(
-        {
-            "HOME": str(home),
-            "HERMES_BIN": str(hermes),
-            "HERMES_FLEET_ENV": str(home / ".hermes" / "fleet.env"),
-            "RUNTIME_SCAFFOLD_DIR": str(scaffold),
-            "VOXXY_PLUGIN_DIR": str(tmp_path / "missing-voxxy"),
-        }
-    )
-    return project, role, env
-
-
-def _run(role: Path, env: dict[str, str]) -> subprocess.CompletedProcess[str]:
-    return subprocess.run(
-        ["bash", str(role / ".scripts" / "20-runtime-repo.sh")],
-        env=env,
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-
-
-def test_provisioner_creates_ignored_local_runtime_without_git(tmp_path: Path) -> None:
-    project, role, env = _fixture(tmp_path)
-
-    result = _run(role, env)
-
-    assert result.returncode == 0, result.stdout + result.stderr
-    runtime = role / "runtime"
-    assert (runtime / "MEMORY.md").read_text(encoding="utf-8") == "agent=demo-pm\n"
-    assert (runtime / "SOUL.md").read_text(encoding="utf-8") == "local soul\n"
-    assert not (runtime / ".git").exists()
-    assert (Path(env["HOME"]) / ".hermes" / "profiles" / "demo-pm").resolve() == runtime
-    assert subprocess.run(
-        ["git", "check-ignore", "-q", "agents/hermes/pm/runtime/"],
-        cwd=project,
-        check=False,
-    ).returncode == 0
-
-
-def test_provisioner_preserves_existing_runtime_and_refuses_stale_mapping(tmp_path: Path) -> None:
-    project, role, env = _fixture(tmp_path)
-    runtime = role / "runtime"
-    runtime.mkdir()
-    private_state = runtime / "private-state.txt"
-    private_state.write_text("preserve exactly\n", encoding="utf-8")
-    (project / ".gitmodules").write_text(
-        """[submodule "legacy-runtime"]
-\tpath = agents/hermes/pm/runtime
-\turl = git@github.com:example/legacy.git
-""",
-        encoding="utf-8",
-    )
-
-    result = _run(role, env)
-
-    assert result.returncode != 0
-    assert "stale .gitmodules mapping" in result.stderr
-    assert private_state.read_text(encoding="utf-8") == "preserve exactly\n"
-    assert not (runtime / ".git").exists()
-
-
-def test_active_provisioner_has_no_runtime_repo_or_submodule_mutation() -> None:
-    script = RUNTIME_SCRIPT.read_text(encoding="utf-8")
-
-    for forbidden in (
-        "gh repo create",
-        "gh repo view",
-        "git submodule add",
-        "git submodule update",
-        'rm -rf "$RUNTIME_LOCAL"',
-        "git push",
-        "git init",
-    ):
-        assert forbidden not in script
-    assert "stale .gitmodules mapping" in script
-    assert 'cp -an "$TMP/." "$RUNTIME_LOCAL/"' in script

package/templates/hermes-agent/tests/test_operator_docs_local_runtime_contract.py

@@ -1,132 +0,0 @@
-from __future__ import annotations
-
-import re
-import subprocess
-from pathlib import Path
-
-
-ROOT = Path(__file__).parents[1]
-ACTIVE_OPERATOR_SURFACES = (
-    ROOT / "README.md",
-    ROOT / "docs" / "operations.md",
-    ROOT / "docs" / "architecture.md",
-    ROOT / "docs" / "sentinel.md",
-    ROOT / "docs" / "sentinel" / "README.md",
-    ROOT / "docs" / "sentinel" / "architecture.md",
-    ROOT / "docs" / "sentinel" / "development.md",
-    ROOT / "template" / ".scripts" / "config.example.toml",
-)
-
-
-def test_active_operator_surfaces_describe_only_pure_local_runtime() -> None:
-    forbidden = {
-        "per-agent remote runtime name": r"agent-hm-",
-        "active runtime repository": r"(?:github\s+)?runtime repositor(?:y|ies)|runtime repo(?:s)?\b",
-        "runtime submodule": r"runtime.{0,60}submodule|submodule.{0,60}runtime",
-        "runtime LFS": r"git\s+lfs",
-        "runtime push": r"git\s+push|commit\s*\+\s*push",
-        "cascading profile deletion": r"hermes\s+profile\s+delete|cascad(?:e|es|ing)",
-        "blanket runtime deletion": r"rm\s+-rf[^\n]*(?:runtime|agents/hermes|\$RUNTIME|\$ROLE_DIR)",
-        "runtime submodule deletion": r"git\s+submodule\s+deinit|\.git/modules/agents/hermes|git\s+rm[^\n]*runtime",
-        "runtime find deletion": r"find[^\n]*(?:runtime|\$RUNTIME)[^\n]*-delete",
-        "runtime directory removal": r"rmdir[^\n]*(?:runtime|\$RUNTIME)",
-        "runtime deletion confirmation shell": r"read[^\n]*REMOVE LOCAL RUNTIME",
-        "step-20 GitHub creation claim": r"20-runtime-repo\.sh.{0,160}gh\s+repo\s+create",
-    }
-
-    for path in ACTIVE_OPERATOR_SURFACES:
-        content = path.read_text(encoding="utf-8")
-        for label, pattern in forbidden.items():
-            assert re.search(pattern, content, re.IGNORECASE | re.DOTALL) is None, (
-                f"{path.relative_to(ROOT)} contains obsolete {label} guidance"
-            )
-
-
-def test_operations_make_recovery_and_retirement_boundaries_explicit() -> None:
-    operations = (ROOT / "docs" / "operations.md").read_text(encoding="utf-8")
-    normalized = " ".join(operations.split())
-
-    for required in (
-        "does **not** ship automatic backup",
-        "verified filesystem backup",
-        "Hindsight can restore only",
-        "secret manager can restore only",
-        "Retire an agent (preserves runtime by default)",
-        "Profile and service retirement always preserves the local runtime",
-        "This release intentionally provides no automated runtime purge",
-        "separately reviewed, path-safe tool",
-        "canonicalizes both the repository root and role path",
-        "verifies that the backup archive contains the expected runtime members",
-    ):
-        assert required in normalized
-
-
-def test_legacy_runtime_owner_config_is_explicitly_inert() -> None:
-    config = (ROOT / "template" / ".scripts" / "config.example.toml").read_text(
-        encoding="utf-8"
-    )
-    github_block = config.split("[github]", 1)[1].split("[plane]", 1)[0]
-
-    assert "LEGACY INERT COMPATIBILITY METADATA ONLY" in github_block
-    assert 'runtime_repo_owner = ""' in github_block
-    assert "does not create, attach" in github_block
-
-
-def test_retired_checkpoint_runbook_is_historical_evidence_only() -> None:
-    runbook = (
-        ROOT / "docs" / "runbooks" / "runtime-checkpoint-repair.md"
-    ).read_text(encoding="utf-8")
-
-    assert "Historical evidence only" in runbook
-    assert "do not execute" in runbook
-    assert "commands have intentionally been removed" in runbook
-
-
-def test_step_20_is_documented_as_ignored_local_population() -> None:
-    development = (
-        ROOT / "docs" / "sentinel" / "development.md"
-    ).read_text(encoding="utf-8")
-
-    assert "`20-runtime-repo.sh` populates the ignored local runtime" in development
-    assert "it creates no GitHub storage" in development
-    assert "creates a private GitHub repo" not in development
-
-
-def test_retired_checkpoint_repair_is_a_non_mutating_tombstone(tmp_path: Path) -> None:
-    script = ROOT / "scripts" / "repair-runtime-checkpoint.sh"
-    source = script.read_text(encoding="utf-8")
-    forbidden = (
-        r"\bgit\s+(?:init|fetch|reset|lfs|push|remote|submodule|checkout|restore)\b",
-        r"\b(?:rm|mv|cp|touch|truncate)\b",
-        r">>",
-    )
-    for pattern in forbidden:
-        assert re.search(pattern, source, re.IGNORECASE) is None
-
-    runtime = tmp_path / "project" / "agents" / "hermes" / "pm" / "runtime"
-    private = runtime / "sessions" / "private-state.bin"
-    private.parent.mkdir(parents=True)
-    private.write_bytes(bytes((0, 17, 34, 255)))
-    (runtime / ".env").write_text("TOKEN=preserve-exactly\n", encoding="utf-8")
-
-    def snapshot() -> list[tuple[str, str, int, bytes]]:
-        entries: list[tuple[str, str, int, bytes]] = []
-        for path in sorted(runtime.rglob("*")):
-            kind = "dir" if path.is_dir() else "file"
-            payload = b"" if path.is_dir() else path.read_bytes()
-            entries.append((str(path.relative_to(runtime)), kind, path.stat().st_mode, payload))
-        return entries
-
-    before = snapshot()
-    result = subprocess.run(
-        [str(script), "--apply", str(runtime)],
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-
-    assert result.returncode != 0
-    assert result.stdout == ""
-    assert "retired and intentionally non-operational" in result.stderr
-    assert "changed nothing" in result.stderr
-    assert snapshot() == before

package/templates/hermes-agent/tests/test_profile_env_detach_contract.py

@@ -1,14 +0,0 @@
-from pathlib import Path
-
-
-SCRIPT = Path(__file__).parents[1] / "template" / ".scripts" / "10-hermes-profile.sh"
-
-
-def test_profile_env_symlink_is_detached_before_sanitization() -> None:
-    text = SCRIPT.read_text(encoding="utf-8")
-    detach = text.index('if [[ -L "$PROFILE_ENV" ]]')
-    dereference_copy = text.index('cp -L "$PROFILE_ENV" "$PROFILE_ENV_COPY"')
-    replace_link = text.index('mv -fT "$PROFILE_ENV_COPY" "$PROFILE_ENV"')
-    sanitize = text.index('python3 - "$PROFILE_ENV"')
-
-    assert detach < dereference_copy < replace_link < sanitize

package/templates/hermes-agent/tests/test_profile_scoped_chat_secrets.py

@@ -1,89 +0,0 @@
-from __future__ import annotations
-
-import importlib.util
-import stat
-from pathlib import Path
-
-
-SCRIPT = Path(__file__).parents[1] / "scripts" / "migrate-profile-scoped-chat-secrets.py"
-SPEC = importlib.util.spec_from_file_location("chat_secret_migration", SCRIPT)
-assert SPEC and SPEC.loader
-MODULE = importlib.util.module_from_spec(SPEC)
-SPEC.loader.exec_module(MODULE)
-
-
-def _write(path: Path, text: str) -> None:
-    path.write_text(text, encoding="utf-8")
-    path.chmod(0o600)
-
-
-def test_dry_run_never_changes_files_or_reports_values(tmp_path: Path) -> None:
-    central = tmp_path / "central.env"
-    target = tmp_path / "profile.env"
-    _write(
-        central,
-        "KIMI_API_KEY=provider-secret\nSLACK_APP_TOKEN=app-secret\n"
-        "SLACK_BOT_TOKEN=bot-secret\nSLACK_ALLOWED_USERS=U123\n",
-    )
-
-    moved = MODULE.migrate(central, target, MODULE.DEFAULT_KEYS, apply=False)
-
-    assert moved == list(MODULE.DEFAULT_KEYS)
-    assert not target.exists()
-    assert "SLACK_BOT_TOKEN=bot-secret" in central.read_text(encoding="utf-8")
-
-
-def test_apply_moves_only_chat_keys_and_creates_private_backup(tmp_path: Path) -> None:
-    central = tmp_path / "central.env"
-    target = tmp_path / "profile.env"
-    _write(
-        central,
-        "KIMI_API_KEY=provider-secret\nSLACK_APP_TOKEN=app-secret\n"
-        "SLACK_BOT_TOKEN=bot-secret\nSLACK_ALLOWED_USERS=U123\n",
-    )
-
-    MODULE.migrate(central, target, MODULE.DEFAULT_KEYS, apply=True)
-
-    assert central.read_text(encoding="utf-8") == "KIMI_API_KEY=provider-secret\n"
-    target_text = target.read_text(encoding="utf-8")
-    assert "SLACK_APP_TOKEN=app-secret" in target_text
-    assert "SLACK_BOT_TOKEN=bot-secret" in target_text
-    assert "SLACK_ALLOWED_USERS=U123" in target_text
-    assert stat.S_IMODE(target.stat().st_mode) == 0o600
-    backups = list(tmp_path.glob("central.env.bak-*-before-chat-scope"))
-    assert len(backups) == 1
-    assert stat.S_IMODE(backups[0].stat().st_mode) == 0o600
-
-
-def test_refuses_target_symlink_to_shared_env(tmp_path: Path) -> None:
-    central = tmp_path / "central.env"
-    target = tmp_path / "profile.env"
-    _write(
-        central,
-        "SLACK_APP_TOKEN=app\nSLACK_BOT_TOKEN=bot\nSLACK_ALLOWED_USERS=user\n",
-    )
-    target.symlink_to(central)
-
-    try:
-        MODULE.migrate(central, target, MODULE.DEFAULT_KEYS, apply=True)
-    except ValueError as exc:
-        assert "not a symlink" in str(exc)
-    else:
-        raise AssertionError("expected symlink safety failure")
-
-
-def test_refuses_conflicting_target_value(tmp_path: Path) -> None:
-    central = tmp_path / "central.env"
-    target = tmp_path / "profile.env"
-    _write(
-        central,
-        "SLACK_APP_TOKEN=app\nSLACK_BOT_TOKEN=bot\nSLACK_ALLOWED_USERS=user\n",
-    )
-    _write(target, "SLACK_BOT_TOKEN=different\n")
-
-    try:
-        MODULE.migrate(central, target, MODULE.DEFAULT_KEYS, apply=True)
-    except ValueError as exc:
-        assert "different values" in str(exc)
-    else:
-        raise AssertionError("expected conflict safety failure")

package/templates/hermes-agent/tests/test_repository_privacy_contract.py

@@ -1,32 +0,0 @@
-from __future__ import annotations
-
-import re
-import subprocess
-from pathlib import Path
-
-
-ROOT = Path(__file__).parents[1]
-
-
-def test_host_local_runtime_payloads_are_ignored() -> None:
-    gitignore = (ROOT / ".gitignore").read_text(encoding="utf-8").splitlines()
-
-    assert ".codegraph/daemon.pid" in gitignore
-    assert ".omo/run-continuation/" in gitignore
-
-
-def test_host_local_runtime_payloads_are_not_tracked() -> None:
-    tracked = subprocess.run(
-        ["git", "ls-files", "-z"],
-        cwd=ROOT,
-        check=True,
-        capture_output=True,
-    ).stdout.decode("utf-8").split("\0")
-    forbidden = re.compile(
-        r"(?:^|/)(?:\.omo/run-continuation/|\.codegraph/[^/]+\.(?:pid|sock|socket)$)"
-        r"|(?:^|/)(?:sessions?|runtime-state)/"
-        r"|(?:^|/)[^/]+\.(?:pid|sock|socket)$"
-    )
-
-    offenders = sorted(path for path in tracked if path and forbidden.search(path))
-    assert offenders == [], f"tracked host-local runtime payloads: {offenders}"