@delorenj/pjangler 1.2.33 → 1.3.0

package/dist/index.js

@@ -912,8 +912,26 @@ var OP_INJECT_SCRIPT = `'{{config_root}}/${MATERIALIZE_ENV_SCRIPT_REL}'`;
 var PROVISION_PACKS_SCRIPT_REL = ".mise/scripts/provision-packs.py";
 var LEGACY_PROVISION_SCRIPT_REL = ".mise/scripts/provision-bmad-skills.py";
 var SYNC_SKILLS_SCRIPT_REL = ".mise/scripts/sync-skills.py";
-var PROVISION_PACKS_TASK = "skills-provision-packs";
+var LINK_AGENTFILES_TASK = "link:agentfiles";
+var SKILLS_SYNC_TASK = "skills:sync";
+var PROVISION_PACKS_TASK = "skills:provision:packs";
 var LEGACY_PROVISION_TASK = "skills-provision-bmad";
+var RETIRED_TASK_RENAMES = [
+  ["link-agentfiles", LINK_AGENTFILES_TASK],
+  ["skills-sync", SKILLS_SYNC_TASK],
+  ["skills-provision-packs", PROVISION_PACKS_TASK],
+  ["hooks-sync", "hooks:sync"],
+  ["hooks-check", "hooks:check"],
+  ["hooks-uninstall", "hooks:uninstall"],
+  ["hindsight-setup", "hindsight:setup"]
+];
+function taskHeader(name) {
+  return `[tasks."${name}"]`;
+}
+function taskHeaderPattern(name) {
+  const esc = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`^\\[tasks\\.(?:"${esc}"|${esc})\\]$`);
+}
 var PROVISION_PACKS_SCRIPT = `python3 '{{config_root}}/${PROVISION_PACKS_SCRIPT_REL}'`;
 var LEGACY_PROVISION_BMAD_SKILLS_SCRIPT = `python3 '{{config_root}}/${LEGACY_PROVISION_SCRIPT_REL}'`;
 var SYNC_SKILLS_SCRIPT = `python3 '{{config_root}}/${SYNC_SKILLS_SCRIPT_REL}' --scope project`;
@@ -947,22 +965,22 @@ var LINK_AGENTFILES_HOOK_ENTRIES = [
 ];
 var LINK_AGENTFILES_WATCH_TASK_BLOCK = `[[watch_files]]
 patterns = ["AGENTS.md"]
-task = "link-agentfiles"
+task = "${LINK_AGENTFILES_TASK}"
 
 [[watch_files]]
 patterns = [".agents/skills.json"]
-task = "skills-sync"
+task = "${SKILLS_SYNC_TASK}"
 
-[tasks.link-agentfiles]
+${taskHeader(LINK_AGENTFILES_TASK)}
 description = "Symlink all agent files to AGENTS.md"
 run = "'{{config_root}}/.mise/scripts/link-agentfiles.sh'"
 
-[tasks.skills-sync]
+${taskHeader(SKILLS_SYNC_TASK)}
 description = "Sync skills from manifest to local CLI dirs"
 depends = ["${PROVISION_PACKS_TASK}"]
 run = ${JSON.stringify(SYNC_SKILLS_SCRIPT)}
 
-[tasks.${PROVISION_PACKS_TASK}]
+${taskHeader(PROVISION_PACKS_TASK)}
 description = "Provision every Skillex pack declared in .agents/skills.json"
 run = ${JSON.stringify(PROVISION_PACKS_SCRIPT)}`;
 var VERSIONING_BLOCK = `# >>> mise-versioning >>>  (managed block \u2014 do not edit by hand; re-run init to update)
@@ -1124,6 +1142,7 @@ function discoverRoles(repoRoot) {
       ticketProviderName: yamlGet(text3, "ticket_provider.name"),
       ticketProviderBoardId: yamlGet(text3, "ticket_provider.board_id"),
       ticketProviderIdentifier: yamlGet(text3, "plane.identifier"),
+      bloodbankEnabled: yamlGet(text3, "bloodbank.enabled"),
       deploymentSystemd: yamlGet(text3, "deployment.systemd"),
       legacyReconcileEnabled: yamlGet(text3, "reconcile.enabled"),
       legacyReconcileGraceHours: yamlGet(text3, "reconcile.grace_hours"),
@@ -2326,10 +2345,41 @@ function upsertOpInjectHook(text3) {
     [OP_INJECT_SCRIPT]
   );
 }
+function retiredTaskNameIssues(text3) {
+  const issues = [];
+  for (const [oldName, newName] of RETIRED_TASK_RENAMES) {
+    const esc = oldName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const present = new RegExp(
+      `^\\[tasks\\.(?:"${esc}"|${esc})\\]|^\\s*task\\s*=\\s*"${esc}"|^\\s*depends\\s*=\\s*\\[[^\\]]*"${esc}"`,
+      "m"
+    ).test(text3);
+    if (present) issues.push(`mise.toml still uses the retired task name "${oldName}" (renamed to "${newName}")`);
+  }
+  return issues;
+}
+function renameRetiredMiseTasks(text3) {
+  let out = text3;
+  for (const [oldName, newName] of RETIRED_TASK_RENAMES) {
+    const esc = oldName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    out = out.replace(new RegExp(`^\\[tasks\\.(?:"${esc}"|${esc})\\]`, "gm"), taskHeader(newName));
+    out = out.replace(new RegExp(`^(\\s*task\\s*=\\s*)"${esc}"`, "gm"), `$1"${newName}"`);
+    out = out.replace(new RegExp(`\\bmise run ${esc}\\b`, "g"), `mise run ${newName}`);
+  }
+  return out.replace(/^(\s*depends\s*=\s*)(\[[^\]]*\])/gm, (_whole, head, arr) => {
+    let next = arr;
+    for (const [oldName, newName] of RETIRED_TASK_RENAMES) {
+      next = next.split(`"${oldName}"`).join(`"${newName}"`);
+    }
+    return head + next;
+  });
+}
 function upsertLinkAgentfilesBlock(text3, ctx) {
-  const withPath = upsertMisePath(text3, requiredMisePathEntries(ctx));
-  let cleaned = removeTomlSection(withPath, /^\[tasks\.link-agentfiles\]$/, /link-agentfiles/, { includePrecedingComments: false });
+  const withPath = upsertMisePath(renameRetiredMiseTasks(text3), requiredMisePathEntries(ctx));
+  let cleaned = removeTomlSection(withPath, taskHeaderPattern(LINK_AGENTFILES_TASK), /link-agentfiles/, { includePrecedingComments: false });
+  cleaned = removeTomlSection(cleaned, /^\[tasks\.link-agentfiles\]$/, /link-agentfiles/, { includePrecedingComments: false });
+  cleaned = removeTomlSection(cleaned, taskHeaderPattern(SKILLS_SYNC_TASK), void 0, { includePrecedingComments: false });
   cleaned = removeTomlSection(cleaned, /^\[tasks\.skills-sync\]$/, void 0, { includePrecedingComments: false });
+  cleaned = removeTomlSection(cleaned, taskHeaderPattern(PROVISION_PACKS_TASK), void 0, { includePrecedingComments: false });
   cleaned = removeTomlSection(cleaned, /^\[tasks\.skills-provision-packs\]$/, void 0, { includePrecedingComments: false });
   cleaned = removeTomlSection(cleaned, /^\[tasks\.skills-provision-bmad\]$/, void 0, { includePrecedingComments: false });
   cleaned = removeTomlSection(cleaned, /^\[tasks\.link-project-skills-to-clis\]$/, void 0, { includePrecedingComments: false });
@@ -2571,7 +2621,7 @@ You are **${role.displayName || role.agentId}** \u2014 a Hermes agent provisione
 
 ## Scope
 
-You operate only within the working directory of \`${role.repo}\`. Your HERMES_HOME is the ignored local directory at \`./runtime/\`, which \`~/.hermes/profiles/${role.profileName || role.agentId}\` projects into (so \`--profile\` invocations resolve here too). Secrets, SOUL, memories, skills, sessions, gateway state, and runtime files stay local to that runtime and are never project gitlinks.
+You operate only within the working directory of \`${role.repo}\`. HERMES_HOME is the real named profile at \`~/.hermes/profiles/${role.profileName || role.agentId}\`; shared config/auth/skills remain linked to fleet truth while owned state lives in ignored \`./runtime/\`. The launcher supplies the project root through process-local \`TERMINAL_CWD\` and never persists it into shared config.
 
 ## Tone
 
@@ -2586,51 +2636,62 @@ ${roleSpecific}
 Your memory is stored locally at \`./runtime/memories/\`. Use durable memory deliberately and keep \`memories/MEMORY.md\` current.
 `;
 }
-function renderHermesWrapper(role) {
-  return `#!/usr/bin/env bash
-# Launcher for ${role.agentId}. Resolves HERMES_HOME to the local runtime.
-
-set -euo pipefail
-
-ROLE_DIR="$(cd "$(dirname "$0")" && pwd)"
-RUNTIME_HOME="$ROLE_DIR/runtime"
-
-FLEET_ENV="{HERMES_FLEET_ENV:-$HOME/.hermes/fleet.env}"
-if [[ -f "$FLEET_ENV" ]]; then
-  # shellcheck disable=SC1090
-  source "$FLEET_ENV"
-fi
-
-HERMES_BIN="{HERMES_BIN:-{HERMES_FLEET_BIN:-$HOME/.hermes/hermes-agent/.venv/bin/hermes}}"
-CODEX_HOME="{CODEX_HOME:-{HERMES_FLEET_CODEX_HOME:-$HOME/.codex}}"
-
-FLEET_HOME="{HERMES_FLEET_HOME:-$HOME/.hermes}"
-PROFILE_NAME="{HERMES_PROFILE_NAME:-${role.profileName || role.agentId}}"
-
-# Singleton-runtime contract: HERMES_HOME MUST be the named profile dir, never
-# the raw runtime path. Hermes treats any HERMES_HOME that is neither under
-# ~/.hermes nor a child of a "profiles" dir as its own standalone root, which
-# makes get_active_profile_name() report "default" and _global_auth_file_path()
-# return None -- silently disabling shared fleet auth and giving every agent a
-# divergent config.yaml. The profile dir is a REAL dir whose shared entries
-# (config.yaml, .env, skills) symlink to the fleet root and whose person-owned
-# entries (memories, sessions, state.db, workspace) symlink into $RUNTIME_HOME.
-HERMES_HOME="$FLEET_HOME/profiles/$PROFILE_NAME"
-
-if [[ ! -d "$RUNTIME_HOME" ]]; then
-  echo "hermes: local runtime not provisioned at $RUNTIME_HOME" >&2
-  echo "  fix: run the role's .scripts/20-runtime-repo.sh" >&2
-  exit 1
-fi
-
-if [[ ! -d "$HERMES_HOME" ]]; then
-  echo "hermes: profile not provisioned at $HERMES_HOME" >&2
-  echo "  fix: pj migrate hermes.runtime-singleton" >&2
-  exit 1
-fi
-
-exec env HERMES_HOME="$HERMES_HOME" HERMES_FLEET_ENV="$FLEET_ENV"   CODEX_HOME="$CODEX_HOME"   "$HERMES_BIN" "$@"
-`.replace(/\u0010/g, "$");
+function renderHermesWrapper(role, templateRoleDir) {
+  return readText(join3(templateRoleDir, "hermes.jinja")).replace(/\{\{\s*agent_id\s*\}\}/g, role.agentId);
+}
+function templateFiles(sourceDir, current = sourceDir) {
+  if (!existsSync2(current)) return [];
+  const files = [];
+  for (const entry of readdirSync2(current, { withFileTypes: true })) {
+    if (entry.name === "__pycache__" || entry.name.endsWith(".pyc") || entry.name.endsWith(".pyo")) continue;
+    const sourcePath = join3(current, entry.name);
+    if (entry.isDirectory()) files.push(...templateFiles(sourceDir, sourcePath));
+    else if (entry.isFile()) files.push(relative2(sourceDir, sourcePath));
+  }
+  return files.sort();
+}
+function managedHermesScaffoldRoles(ctx) {
+  const discovered = discoverRoles(ctx.repoRoot);
+  const declared = readDeclaredAgents(ctx).filter((entry) => entry.role === "pm" || entry.role === "director");
+  if (declared.length === 0) {
+    const orchestrators = discovered.filter((role) => role.role === "pm" || role.role === "director");
+    const blockers2 = orchestrators.filter((role) => roleBloodbankEnabled(role) === null).map((role) => `${relative2(ctx.repoRoot, role.roleYamlPath)} bloodbank.enabled must be the strict YAML boolean true or false`);
+    return {
+      roles: orchestrators.filter((role) => roleBloodbankEnabled(role) !== null),
+      blockers: blockers2
+    };
+  }
+  const roles = [];
+  const blockers = [];
+  for (const entry of declared) {
+    if (!entry.roleDir) {
+      blockers.push(`agents.${entry.agentId}.role_dir missing`);
+      continue;
+    }
+    const roleDir = resolve3(ctx.repoRoot, entry.roleDir);
+    if (!isContainedBy(ctx.repoRoot, roleDir)) {
+      blockers.push(`agents.${entry.agentId}.role_dir resolves outside the project`);
+      continue;
+    }
+    const role = discovered.find((candidate) => resolve3(candidate.roleDir) === roleDir);
+    if (!role) {
+      blockers.push(`agents.${entry.agentId}.role_dir ${entry.roleDir} missing role.yaml`);
+      continue;
+    }
+    if (role.agentId !== entry.agentId || role.role !== entry.role) {
+      blockers.push(`agents.${entry.agentId} identity does not match ${entry.roleDir}/role.yaml`);
+      continue;
+    }
+    if (roleBloodbankEnabled(role) === null) {
+      blockers.push(`${entry.roleDir}/role.yaml bloodbank.enabled must be the strict YAML boolean true or false`);
+      continue;
+    }
+    roles.push(role);
+  }
+  return { roles, blockers };
+}
+function renderSentinelPrompt(role, templateRoleDir) {
+  return readText(join3(templateRoleDir, ".scripts", "sentinel.prompt.md.jinja")).replace(/\{\{\s*agent_id\s*\}\}/g, role.agentId).replace(/\{\{\s*role\s*\}\}/g, role.role).replace(/\{\{\s*target_repo\s*\}\}/g, role.repo).replace(/\{\{\s*display_name\s*\}\}/g, role.displayName || role.agentId).replace(/\{\{\s*ticket_provider\s*\}\}/g, role.ticketProviderName || "plane");
 }
 function copyMissingRecursive(sourceDir, targetDir, changedFiles, dryRun, skip) {
   if (!existsSync2(sourceDir)) return;
@@ -2727,6 +2788,8 @@ function upsertRegistryEntry(role, homeDir, changedFiles, dryRun) {
   const path = registryPath(homeDir);
   const current = safeReadText(path) ?? "# Hermes agent fleet registry.\n# One entry per provisioned agent. Managed by hermes-agent-template/.scripts/80-registry.sh.\nschema_version: 1\nagents: {}\n";
   if (current.includes(`${role.agentId}:`)) return null;
+  const enabled = roleBloodbankEnabled(role);
+  if (enabled === null) return null;
   const block = `  ${role.agentId}:
     repo: ${role.repo}
     role: ${role.role}
@@ -2742,6 +2805,7 @@ function upsertRegistryEntry(role, homeDir, changedFiles, dryRun) {
       identifier: ${ctxEscape(role.ticketProviderIdentifier)}
     runtime_repo: ${ctxEscape(role.runtimeRepo)}
     bloodbank:
+      enabled: ${enabled ? "true" : "false"}
       gateway_scope: fleet
       target_agent_id: ${role.agentId}
     systemd:
@@ -2754,6 +2818,11 @@ ${block}`) : `${current.replace(/\s*$/, "\n")}${block}`;
   if (!dryRun) writeText(path, next);
   return path;
 }
+function roleBloodbankEnabled(role) {
+  if (role.bloodbankEnabled === "" || role.bloodbankEnabled === "false") return false;
+  if (role.bloodbankEnabled === "true") return true;
+  return null;
+}
 function profileMetaInheritsDefault(path) {
   const text3 = safeReadText(path);
   return Boolean(
@@ -3220,8 +3289,30 @@ function dropDeclaredAgent(ctx, agentId, changedFiles, details) {
   if (!ctx.dryRun) writeText(path, `${JSON.stringify(doc, null, 2)}
 `);
 }
-function rewriteLauncher(text3) {
-  let next = text3.replace(/^HERMES_HOME="\$RUNTIME_HOME"\s*$/m, 'HERMES_HOME="$FLEET_HOME/profiles/$PROFILE_NAME"');
+function isProfileHomeExpr(assigned) {
+  const bare = assigned.replace(/^["']|["']$/g, "");
+  return bare === "$FLEET_HOME/profiles/$PROFILE_NAME" || /^\$\{?HERMES_FLEET_HOME.*\}?\/profiles\//.test(bare) || /\/\.hermes\/profiles\/[^/]+$/.test(bare);
+}
+function rewriteLauncher(text3, profileName) {
+  let next = text3;
+  const assigned = /^HERMES_HOME=(.*)$/m.exec(next)?.[1]?.trim();
+  if (assigned !== void 0 && !isProfileHomeExpr(assigned)) {
+    const name = profileName ? `\${HERMES_PROFILE_NAME:-${profileName}}` : '${HERMES_PROFILE_NAME:-$(basename "$ROLE_DIR")}';
+    next = next.replace(
+      /^HERMES_HOME=(.*)$/m,
+      [
+        `RUNTIME_HOME=$1`,
+        `FLEET_HOME="\${HERMES_FLEET_HOME:-$HOME/.hermes}"`,
+        `PROFILE_NAME="${name}"`,
+        `# Singleton-runtime contract: HERMES_HOME MUST be the named profile dir.`,
+        `HERMES_HOME="$FLEET_HOME/profiles/$PROFILE_NAME"`
+      ].join("\n")
+    );
+    next = next.replace(
+      /if \[\[ ! -d "\$HERMES_HOME" \]\]; then\n(\s*)echo "hermes: local runtime not provisioned at \$HERMES_HOME"/,
+      'if [[ ! -d "$RUNTIME_HOME" ]]; then\n$1echo "hermes: local runtime not provisioned at $RUNTIME_HOME"'
+    );
+  }
   next = next.replace(/^HERMES_OAUTH_FILE=.*\n/m, "");
   next = next.replace(/\s*HERMES_OAUTH_FILE="\$HERMES_OAUTH_FILE"/g, "");
   next = next.replace(
@@ -3770,7 +3861,8 @@ function createMiseChecks() {
         if (missingPathValues.length) details.push(`[env]._.path should include ${missingPathValues.join(", ")}`);
         if (!text3.includes("'{{config_root}}/.mise/scripts/link-agentfiles.sh'")) details.push("link-agentfiles hook must use single-quoted {{config_root}} guard");
         if (!text3.includes('patterns = ["AGENTS.md"]')) details.push("watch_files must monitor AGENTS.md");
-        if (!text3.includes('task = "link-agentfiles"')) details.push("watch_files must dispatch link-agentfiles task");
+        if (!text3.includes(`task = "${LINK_AGENTFILES_TASK}"`)) details.push(`watch_files must dispatch the ${LINK_AGENTFILES_TASK} task`);
+        details.push(...retiredTaskNameIssues(text3));
         return {
           id: "mise.config-root",
           title: "mise config_root + AGENTS link hooks",
@@ -3818,7 +3910,7 @@ function createMiseChecks() {
           status: changedFiles.length ? "applied" : "noop",
           summary: changedFiles.length ? "Updated mise AGENTS-linking contract" : "No changes required",
           changedFiles,
-          details: changedFiles.length ? ["Normalized hooks/watch_files/tasks.link-agentfiles block and script"] : []
+          details: changedFiles.length ? [`Normalized hooks/watch_files/tasks."${LINK_AGENTFILES_TASK}" block and script`] : []
         };
       }
     },
@@ -4029,8 +4121,9 @@ function createAgentHooksChecks() {
           details.push("mise.toml still invokes the missing bare sync-skills.py executable");
         }
         if (!mise?.includes('patterns = [".agents/skills.json"]')) details.push("mise.toml should watch .agents/skills.json");
-        if (!mise?.includes("[tasks.skills-sync]")) details.push("mise.toml should define a skills-sync task");
-        if (!mise?.includes(`depends = ["${PROVISION_PACKS_TASK}"]`)) details.push(`skills-sync task should depend on ${PROVISION_PACKS_TASK}`);
+        if (!mise?.includes(taskHeader(SKILLS_SYNC_TASK))) details.push(`mise.toml should define a ${SKILLS_SYNC_TASK} task`);
+        if (!mise?.includes(`depends = ["${PROVISION_PACKS_TASK}"]`)) details.push(`${SKILLS_SYNC_TASK} task should depend on ${PROVISION_PACKS_TASK}`);
+        if (mise) details.push(...retiredTaskNameIssues(mise));
         for (const [rel, label] of [
           [PROVISION_PACKS_SCRIPT_REL, "Skillex pack provisioning script"],
           [SYNC_SKILLS_SCRIPT_REL, "Project-local skills sync engine"]
@@ -4923,75 +5016,90 @@ function createHermesChecks() {
   return [
     {
       id: "hermes.pm-scaffold",
-      title: "Hermes PM scaffold parity",
+      title: "Hermes orchestrator scaffold parity",
       audit: (ctx) => {
-        const roles = discoverRoles(ctx.repoRoot);
-        const role = roles.find((item) => item.role === "pm");
-        if (!role) {
-          return { id: "hermes.pm-scaffold", title: "Hermes PM scaffold parity", status: "skip", summary: "No pm role present", details: [], fixable: false };
-        }
-        const details = [];
-        for (const rel of ["role.yaml", "SOUL.md", "hermes", ".gitignore", ".scripts/70-systemd.sh", ".scripts/heartbeat.sh", ".scripts/checkpoint.sh", ".runtime-scaffold/README.md", "runtime/memories/MEMORY.md"]) {
-          if (!existsSync2(join3(role.roleDir, rel))) details.push(`missing ${relative2(ctx.repoRoot, join3(role.roleDir, rel))}`);
+        const selection = managedHermesScaffoldRoles(ctx);
+        if (selection.roles.length === 0 && selection.blockers.length === 0) {
+          return { id: "hermes.pm-scaffold", title: "Hermes orchestrator scaffold parity", status: "skip", summary: "No provisioned pm or director role present", details: [], fixable: false };
         }
-        if (hasRuntimeSubmoduleMapping(ctx.repoRoot, role)) {
-          details.push(".gitmodules contains retired pm runtime submodule mapping");
-        }
-        if (!profileMetaInheritsDefault(join3(role.roleDir, "runtime", "profile.yaml"))) {
-          details.push("runtime/profile.yaml missing inherited default config metadata");
+        const details = [...selection.blockers];
+        const templateRoleDir = join3(ctx.pjanglerRoot, "templates", "hermes-agent", "template");
+        const managedScripts = templateFiles(join3(templateRoleDir, ".scripts")).filter((rel) => rel !== "sentinel.prompt.md.jinja");
+        for (const role of selection.roles) {
+          const prefix = role.agentId || role.role;
+          for (const rel of ["role.yaml", "SOUL.md", ".runtime-scaffold/README.md", "runtime/memories/MEMORY.md"]) {
+            if (!existsSync2(join3(role.roleDir, rel))) details.push(`${prefix}: missing ${relative2(ctx.repoRoot, join3(role.roleDir, rel))}`);
+          }
+          const wrapper = join3(role.roleDir, "hermes");
+          const expectedWrapper = renderHermesWrapper(role, templateRoleDir);
+          if (!existsSync2(wrapper)) details.push(`${prefix}: missing ${relative2(ctx.repoRoot, wrapper)}`);
+          else if (safeReadText(wrapper) !== expectedWrapper) details.push(`${prefix}: stale ${relative2(ctx.repoRoot, wrapper)}`);
+          const expectedIgnore = readText(join3(templateRoleDir, ".gitignore.jinja")).replace(/\{\{\s*role\s*\}\}/g, role.role);
+          const ignorePath = join3(role.roleDir, ".gitignore");
+          if (!existsSync2(ignorePath)) details.push(`${prefix}: missing ${relative2(ctx.repoRoot, ignorePath)}`);
+          else if (safeReadText(ignorePath) !== expectedIgnore) details.push(`${prefix}: stale ${relative2(ctx.repoRoot, ignorePath)}`);
+          for (const rel of managedScripts) {
+            const source = join3(templateRoleDir, ".scripts", rel);
+            const target = join3(role.roleDir, ".scripts", rel);
+            if (!existsSync2(target)) details.push(`${prefix}: missing ${relative2(ctx.repoRoot, target)}`);
+            else if (safeReadText(target) !== readText(source)) details.push(`${prefix}: stale ${relative2(ctx.repoRoot, target)}`);
+          }
+          const promptPath = join3(role.roleDir, ".scripts", "sentinel.prompt.md");
+          if (!existsSync2(promptPath)) details.push(`${prefix}: missing ${relative2(ctx.repoRoot, promptPath)}`);
+          else if (safeReadText(promptPath) !== renderSentinelPrompt(role, templateRoleDir)) details.push(`${prefix}: stale ${relative2(ctx.repoRoot, promptPath)}`);
+          if (hasRuntimeSubmoduleMapping(ctx.repoRoot, role)) details.push(`${prefix}: .gitmodules contains retired ${role.role} runtime submodule mapping`);
+          if (!profileMetaInheritsDefault(join3(role.roleDir, "runtime", "profile.yaml"))) details.push(`${prefix}: runtime/profile.yaml missing inherited default config metadata`);
+          const registry = safeReadText(registryPath(ctx.homeDir));
+          if (!registry?.includes(`${role.agentId}:`)) details.push(`fleet registry missing ${role.agentId}`);
         }
-        const registry = safeReadText(registryPath(ctx.homeDir));
-        if (!registry?.includes(`${role.agentId}:`)) details.push(`fleet registry missing ${role.agentId}`);
         return {
           id: "hermes.pm-scaffold",
-          title: "Hermes PM scaffold parity",
+          title: "Hermes orchestrator scaffold parity",
           status: details.length === 0 ? "pass" : "fail",
-          summary: details.length === 0 ? "PM scaffold parity verified" : `${details.length} PM scaffold issue(s) detected`,
+          summary: details.length === 0 ? `${selection.roles.length} orchestrator scaffold(s) verified` : `${details.length} orchestrator scaffold issue(s) detected`,
           details,
-          fixable: true
+          fixable: selection.blockers.length === 0
         };
       },
       migrate: (ctx, finding) => {
-        const role = discoverRoles(ctx.repoRoot).find((item) => item.role === "pm");
+        const selection = managedHermesScaffoldRoles(ctx);
         const changedFiles = [];
         const details = [];
-        if (!role) {
-          return { id: finding.id, title: finding.title, status: "blocked", summary: "No pm role present", changedFiles, details: [] };
+        if (selection.blockers.length > 0) {
+          return { id: finding.id, title: finding.title, status: "blocked", summary: "Provisioned orchestrator manifest is invalid", changedFiles, details: selection.blockers };
         }
-        const retirement = retireRuntimeSubmodule(ctx.repoRoot, role, changedFiles, ctx.dryRun);
-        details.push(...retirement.details);
-        if (!retirement.ok) {
-          return {
-            id: finding.id,
-            title: finding.title,
-            status: "blocked",
-            summary: "Failed to retire PM runtime submodule metadata safely",
-            changedFiles,
-            details: [retirement.error ?? "unknown runtime retirement failure"]
-          };
+        if (selection.roles.length === 0) {
+          return { id: finding.id, title: finding.title, status: "blocked", summary: "No provisioned pm or director role present", changedFiles, details: [] };
         }
         const templateRoleDir = join3(ctx.pjanglerRoot, "templates", "hermes-agent", "template");
-        writeIfDifferent(join3(role.roleDir, "SOUL.md"), renderSoul(role), ctx.dryRun, changedFiles);
-        writeIfDifferent(join3(role.roleDir, "hermes"), renderHermesWrapper(role), ctx.dryRun, changedFiles, 493);
-        writeIfDifferent(join3(role.roleDir, ".gitignore"), readText(join3(templateRoleDir, ".gitignore.jinja")).replace(/\{\{ role \}\}/g, role.role), ctx.dryRun, changedFiles);
-        copyMissingRecursive(join3(templateRoleDir, ".runtime-scaffold"), join3(role.roleDir, ".runtime-scaffold"), changedFiles, ctx.dryRun);
-        copyMissingRecursive(join3(templateRoleDir, ".runtime-scaffold"), join3(role.roleDir, "runtime"), changedFiles, ctx.dryRun);
-        copyMissingRecursive(join3(templateRoleDir, ".scripts"), join3(role.roleDir, ".scripts"), changedFiles, ctx.dryRun, (source) => source.endsWith("sentinel.prompt.md.jinja"));
-        const promptSource = join3(templateRoleDir, ".scripts", "sentinel.prompt.md.jinja");
-        const promptTarget = join3(role.roleDir, ".scripts", "sentinel.prompt.md");
-        if (existsSync2(promptSource) && !existsSync2(promptTarget)) {
-          const prompt = readText(promptSource).replace(/\{\{ agent_id \}\}/g, role.agentId).replace(/\{\{ role \}\}/g, role.role).replace(/\{\{ target_repo \}\}/g, role.repo).replace(/\{\{ display_name \}\}/g, role.displayName || role.agentId);
-          writeIfDifferent(promptTarget, prompt, ctx.dryRun, changedFiles);
-        }
-        const profileMetaUpdated = upsertInheritedProfileMeta(join3(role.roleDir, "runtime", "profile.yaml"), changedFiles, ctx.dryRun);
-        if (profileMetaUpdated) details.push(`updated ${profileMetaUpdated}`);
-        const registryUpdated = upsertRegistryEntry(role, ctx.homeDir, changedFiles, ctx.dryRun);
-        if (registryUpdated) details.push(`updated ${registryUpdated}`);
+        const managedScripts = templateFiles(join3(templateRoleDir, ".scripts")).filter((rel) => rel !== "sentinel.prompt.md.jinja");
+        for (const role of selection.roles) {
+          const retirement = retireRuntimeSubmodule(ctx.repoRoot, role, changedFiles, ctx.dryRun);
+          details.push(...retirement.details);
+          if (!retirement.ok) {
+            return { id: finding.id, title: finding.title, status: "blocked", summary: `Failed to retire ${role.role} runtime submodule metadata safely`, changedFiles, details: [retirement.error ?? "unknown runtime retirement failure"] };
+          }
+          if (!existsSync2(join3(role.roleDir, "SOUL.md"))) writeIfDifferent(join3(role.roleDir, "SOUL.md"), renderSoul(role), ctx.dryRun, changedFiles);
+          writeIfDifferent(join3(role.roleDir, "hermes"), renderHermesWrapper(role, templateRoleDir), ctx.dryRun, changedFiles, 493);
+          writeIfDifferent(join3(role.roleDir, ".gitignore"), readText(join3(templateRoleDir, ".gitignore.jinja")).replace(/\{\{\s*role\s*\}\}/g, role.role), ctx.dryRun, changedFiles);
+          copyMissingRecursive(join3(templateRoleDir, ".runtime-scaffold"), join3(role.roleDir, ".runtime-scaffold"), changedFiles, ctx.dryRun);
+          copyMissingRecursive(join3(templateRoleDir, ".runtime-scaffold"), join3(role.roleDir, "runtime"), changedFiles, ctx.dryRun);
+          for (const rel of managedScripts) {
+            const source = join3(templateRoleDir, ".scripts", rel);
+            const executable = (lstatSync2(source).mode & 73) !== 0;
+            writeIfDifferent(join3(role.roleDir, ".scripts", rel), readText(source), ctx.dryRun, changedFiles, executable ? 493 : void 0);
+          }
+          writeIfDifferent(join3(role.roleDir, ".scripts", "sentinel.prompt.md"), renderSentinelPrompt(role, templateRoleDir), ctx.dryRun, changedFiles);
+          const profileMetaUpdated = upsertInheritedProfileMeta(join3(role.roleDir, "runtime", "profile.yaml"), changedFiles, ctx.dryRun);
+          if (profileMetaUpdated) details.push(`updated ${profileMetaUpdated}`);
+          const registryUpdated = upsertRegistryEntry(role, ctx.homeDir, changedFiles, ctx.dryRun);
+          if (registryUpdated) details.push(`updated ${registryUpdated}`);
+        }
         return {
           id: finding.id,
           title: finding.title,
           status: changedFiles.length ? "applied" : "noop",
-          summary: changedFiles.length ? "PM scaffold normalized" : "No changes required",
+          summary: changedFiles.length ? `${selection.roles.length} orchestrator scaffold(s) normalized` : "No changes required",
           changedFiles,
           details
         };
@@ -5298,8 +5406,9 @@ function createHermesChecks() {
           if (text3 === null) {
             details.push(`launcher missing: ${relative2(ctx.repoRoot, launcher)}`);
           } else {
-            if (/^HERMES_HOME="\$RUNTIME_HOME"\s*$/m.test(text3)) {
-              details.push(`launcher sets HERMES_HOME to the raw runtime path (disables shared auth + profile identity): ${relative2(ctx.repoRoot, launcher)}`);
+            const assigned = /^HERMES_HOME=(.*)$/m.exec(text3)?.[1]?.trim();
+            if (assigned !== void 0 && !isProfileHomeExpr(assigned)) {
+              details.push(`launcher sets HERMES_HOME=${assigned} instead of the named profile dir (disables shared auth + profile identity): ${relative2(ctx.repoRoot, launcher)}`);
             }
             if (/HERMES_OAUTH_FILE/.test(text3)) {
               details.push(`launcher exports HERMES_OAUTH_FILE, which Hermes does not implement (dead config): ${relative2(ctx.repoRoot, launcher)}`);
@@ -5337,9 +5446,16 @@ function createHermesChecks() {
           const launcher = join3(role.roleDir, "hermes");
           const text3 = safeReadText(launcher);
           if (text3 !== null) {
-            const rewritten = rewriteLauncher(text3);
+            const before = /^HERMES_HOME=(.*)$/m.exec(text3)?.[1]?.trim();
+            const rewritten = rewriteLauncher(text3, role.profileName || role.agentId);
             if (rewritten !== text3) {
-              details.push(`rewrite launcher HERMES_HOME -> profile path: ${relative2(ctx.repoRoot, launcher)}`);
+              const rel = relative2(ctx.repoRoot, launcher);
+              if (before !== void 0 && !isProfileHomeExpr(before)) {
+                details.push(`rewrite launcher HERMES_HOME ${before} -> ${plan.profileDir}: ${rel}`);
+              }
+              if (/HERMES_OAUTH_FILE/.test(text3)) {
+                details.push(`strip dead HERMES_OAUTH_FILE export: ${rel}`);
+              }
               writeIfDifferent(launcher, rewritten, ctx.dryRun, changedFiles, 493);
             }
           }
@@ -5376,6 +5492,7 @@ function createHermesChecks() {
       audit: (ctx) => {
         const roles = discoverRoles(ctx.repoRoot);
         const details = [];
+        let malformedRoleGate = false;
         const registryPath2 = join3(ctx.homeDir, ".hermes", "agents-registry.yaml");
         const registry = readRegistry(registryPath2);
         if (!registry) {
@@ -5412,6 +5529,11 @@ function createHermesChecks() {
           details.push(`.project.json declares agent "${extra}" that no role.yaml claims`);
         }
         for (const role of roles) {
+          const expectedBloodbankEnabled = roleBloodbankEnabled(role);
+          if (expectedBloodbankEnabled === null) {
+            details.push(`${relative2(ctx.repoRoot, role.roleYamlPath)} bloodbank.enabled must be the strict YAML boolean true or false`);
+            malformedRoleGate = true;
+          }
           const entry = registry[role.agentId];
           if (!entry) {
             details.push(`registry is missing an entry for ${role.agentId}`);
@@ -5426,6 +5548,11 @@ function createHermesChecks() {
             details.push(`registry hermes.bin for ${role.agentId} does not exist: ${bin}`);
           }
           const bloodbank = entry.bloodbank ?? {};
+          if (typeof bloodbank.enabled !== "boolean") {
+            details.push(`registry entry for ${role.agentId} bloodbank.enabled must be a strict boolean`);
+          } else if (expectedBloodbankEnabled !== null && bloodbank.enabled !== expectedBloodbankEnabled) {
+            details.push(`registry entry for ${role.agentId} bloodbank.enabled must match explicit role value ${expectedBloodbankEnabled}`);
+          }
           if (bloodbank.gateway_scope !== "fleet" || bloodbank.target_agent_id !== role.agentId) {
             details.push(`registry entry for ${role.agentId} must advertise bloodbank { gateway_scope: fleet, target_agent_id: ${role.agentId} }`);
           }
@@ -5446,7 +5573,7 @@ function createHermesChecks() {
           status: details.length === 0 ? "pass" : "fail",
           summary: details.length === 0 ? "Fleet registry is in parity" : `${details.length} registry parity issue(s) detected`,
           details,
-          fixable: true
+          fixable: !malformedRoleGate
         };
       },
       migrate: (ctx, finding) => {
@@ -5458,6 +5585,19 @@ function createHermesChecks() {
           return { id: finding.id, title: finding.title, status: "blocked", summary: `registry unreadable at ${registryPath2}`, changedFiles, details };
         }
         const roles = discoverRoles(ctx.repoRoot);
+        const malformedRoleGates = roles.filter((role) => roleBloodbankEnabled(role) === null);
+        if (malformedRoleGates.length > 0) {
+          return {
+            id: finding.id,
+            title: finding.title,
+            status: "blocked",
+            summary: "Registry parity is blocked by malformed role Bloodbank gates",
+            changedFiles,
+            details: malformedRoleGates.map(
+              (role) => `${relative2(ctx.repoRoot, role.roleYamlPath)} bloodbank.enabled must be the strict YAML boolean true or false`
+            )
+          };
+        }
         const missingRoles = roles.filter((role) => !raw.includes(`${role.agentId}:`));
         for (const role of missingRoles) {
           const updated = upsertRegistryEntry(role, ctx.homeDir, changedFiles, ctx.dryRun);
@@ -5521,9 +5661,10 @@ function createHermesChecks() {
             dirty = true;
           }
           const bloodbank = entry.bloodbank ?? {};
-          if (bloodbank.gateway_scope !== "fleet" || bloodbank.target_agent_id !== role.agentId) {
-            details.push(`advertise fleet bloodbank routing for ${role.agentId}`);
-            entry.bloodbank = { gateway_scope: "fleet", target_agent_id: role.agentId };
+          const expectedBloodbankEnabled = roleBloodbankEnabled(role) ?? false;
+          if (bloodbank.enabled !== expectedBloodbankEnabled || bloodbank.gateway_scope !== "fleet" || bloodbank.target_agent_id !== role.agentId) {
+            details.push(`normalize fleet bloodbank routing for ${role.agentId} with enabled=${expectedBloodbankEnabled}`);
+            entry.bloodbank = { ...bloodbank, enabled: expectedBloodbankEnabled, gateway_scope: "fleet", target_agent_id: role.agentId };
             dirty = true;
           }
           const systemd = entry.systemd;
@@ -5756,10 +5897,10 @@ var AgentHooksRecipe = class extends Recipe {
   printNextSteps() {
     console.log("\u{1FA9D} Agent-hooks layer installed!");
     console.log("   Next steps:");
-    console.log("   1. mise run skills-sync  # sync .agents/skills.json into local CLI dirs");
-    console.log("   2. mise run hooks-sync   # generate .claude/settings.json + inject codex/kimi/hermes");
+    console.log("   1. mise run skills:sync  # sync .agents/skills.json into local CLI dirs");
+    console.log("   2. mise run hooks:sync   # generate .claude/settings.json + inject codex/kimi/hermes");
     console.log("   3. git add .claude/settings.json .agents/hooks .agents/skills.json && commit (codex/kimi/hermes are per-dev)");
-    console.log("   4. mise run hindsight-setup   # set HINDSIGHT_OP_KEY_REF to your 1Password item first");
+    console.log("   4. mise run hindsight:setup   # set HINDSIGHT_OP_KEY_REF to your 1Password item first");
     console.log("   5. Optional per-dev hook opt-out: copy .agents/local.example.json -> .agents/local.json");
   }
 };
@@ -5941,6 +6082,9 @@ var PromptForAgentConfig = class extends Command {
     ctx.soulTone ??= "direct";
     ctx.modelProvider ??= "";
     ctx.modelName ??= "";
+    ctx.modelBaseUrl ??= "";
+    ctx.modelApiMode ??= "";
+    ctx.modelKeyEnv ??= "";
     ctx.ticketProvider ??= detectTicketProvider(ctx.targetDir) ?? "plane";
     ctx.skipEmail ??= true;
     ctx.agentId = deriveAgentId(ctx.targetRepo, ctx.role);
@@ -6007,7 +6151,17 @@ function resolveVendoredTemplate(name) {
 var RunCopierTemplate = class extends Command {
   async invoke() {
     const ctx = this.context;
-    const { targetRepo, role, agentPurpose, soulTone, modelProvider, modelName } = ctx;
+    const {
+      targetRepo,
+      role,
+      agentPurpose,
+      soulTone,
+      modelProvider,
+      modelName,
+      modelBaseUrl,
+      modelApiMode,
+      modelKeyEnv
+    } = ctx;
     const ticketProvider = ctx.ticketProvider ?? "plane";
     const profileName = ctx.profileName ?? (targetRepo && role ? deriveProfileName(targetRepo, role) : void 0);
     if (!targetRepo || !role) {
@@ -6074,6 +6228,12 @@ var RunCopierTemplate = class extends Command {
       "--data",
       `model_name=${modelName ?? ""}`,
       "--data",
+      `model_base_url=${modelBaseUrl ?? ""}`,
+      "--data",
+      `model_api_mode=${modelApiMode ?? ""}`,
+      "--data",
+      `model_key_env=${modelKeyEnv ?? ""}`,
+      "--data",
       `profile_name=${profileName ?? ""}`,
       "--data",
       `soul_tone=${soulTone ?? "direct"}`,
@@ -8597,31 +8757,33 @@ ${leaveBlock}`);
     const appended = [
       "",
       _WireMiseAgentHooks.MARKER + " (generated \u2014 see .agents/hooks/README.md)",
+      // PJAN-61: task names use the colon namespace form. A colon is not legal
+      // in a BARE toml key, so every header here MUST stay quoted.
       "[[watch_files]]",
       'patterns = [".agents/skills.json"]',
-      'task = "skills-sync"',
+      'task = "skills:sync"',
       "",
-      "[tasks.skills-sync]",
+      '[tasks."skills:sync"]',
       'description = "Sync skills from manifest to local CLI dirs"',
       'run = "sync-skills.py --scope project"',
       "",
       "[[watch_files]]",
       'patterns = [".agents/hooks/hooks.master.json"]',
-      'task = "hooks-sync"',
+      'task = "hooks:sync"',
       "",
-      "[tasks.hooks-sync]",
+      '[tasks."hooks:sync"]',
       'description = "Fan out hooks.master.json to each agent CLI (claude/codex/kimi/hermes)"',
       `run = "${cr}/.agents/hooks/sync.py --install"`,
       "",
-      "[tasks.hooks-check]",
+      '[tasks."hooks:check"]',
       'description = "Drift gate: verify generated hook configs match hooks.master.json"',
       `run = "${cr}/.agents/hooks/sync.py --check"`,
       "",
-      "[tasks.hooks-uninstall]",
+      '[tasks."hooks:uninstall"]',
       'description = "Remove per-user agent-hook injections (codex/kimi/hermes)"',
       `run = "${cr}/.agents/hooks/sync.py --uninstall"`,
       "",
-      "[tasks.hindsight-setup]",
+      '[tasks."hindsight:setup"]',
       `description = "Provision this dev's shared project Hindsight key from 1Password into .env"`,
       `run = "${cr}/.mise/scripts/hindsight-setup.sh"`,
       "",
@@ -9581,7 +9743,7 @@ program.command("migrate").argument("[rule-id]", "Rule ID to migrate (omit to op
     process.exit(1);
   }
 });
-program.command("hermes-agent").alias("hermes").description("Provision the PM agent for the current repo (defaults everything; only asks about Telegram)").option("-y, --yes", "Non-interactive: accept all defaults (also skips the Telegram prompt)").option("--target-repo <name>", "Target repo name (default: basename of cwd)").option("--role <role>", "Agent role override (default: pm \u2014 the only role in the fleet)").option("--purpose <text>", 'One-line agent purpose (default: "pm agent for <repo>")').option(`--tone <tone>`, `Personality tone (default: direct; ${SOUL_TONES.join(" | ")})`).option("--model-provider <name>", 'Inference provider override ("" = inherit shared default profile)').option("--model-name <name>", 'Model name override ("" = inherit shared default profile)').option("--skip-telegram", "Skip the Telegram wire-up (no BotFather prompt)").option("--email", "Also provision the delo.sh email address (off by default; never prompted)").option("--skip-runtime-repo", "Skip creating the per-agent runtime GH repo").option("--skip-plane", "Skip creating or linking the ticket board").option("--skip-bloodbank", "Deprecated compatibility flag; Bloodbank now uses one fleet-shared Hermes gateway").option("--skip-systemd", "Skip installing systemd --user units").option("--local", "Local-only: skip runtime repo, ticket-board creation, Bloodbank, and systemd (safe for laptops/macOS/non-technical operators)").option("--force-config", "Regenerate ~/.config/hermes-agent-template/config.toml even if it exists").option("--dry-run", "Preview what would run; don't execute copier").option("-f, --force", "Re-render even if agents/hermes/<role>/role.yaml already exists").action(async (options) => {
+program.command("hermes-agent").alias("hermes").description("Provision the PM agent for the current repo (defaults everything; only asks about Telegram)").option("-y, --yes", "Non-interactive: accept all defaults (also skips the Telegram prompt)").option("--target-repo <name>", "Target repo name (default: basename of cwd)").option("--role <role>", "Agent role override (default: pm \u2014 the only role in the fleet)").option("--purpose <text>", 'One-line agent purpose (default: "pm agent for <repo>")').option(`--tone <tone>`, `Personality tone (default: direct; ${SOUL_TONES.join(" | ")})`).option("--model-provider <name>", 'Inference provider override ("" = inherit shared default profile)').option("--model-name <name>", 'Model name override ("" = inherit shared default profile)').option("--model-base-url <url>", 'Inference API base URL override ("" = inherit shared default profile)').option("--model-api-mode <mode>", 'Inference API mode override ("" = inherit shared default profile)').option("--model-key-env <name>", "Environment variable name holding the scoped model credential").option("--skip-telegram", "Skip the Telegram wire-up (no BotFather prompt)").option("--email", "Also provision the delo.sh email address (off by default; never prompted)").option("--skip-runtime-repo", "Skip creating the per-agent runtime GH repo").option("--skip-plane", "Skip creating or linking the ticket board").option("--skip-bloodbank", "Deprecated compatibility flag; Bloodbank now uses one fleet-shared Hermes gateway").option("--skip-systemd", "Skip installing systemd --user units").option("--local", "Local-only: skip runtime repo, ticket-board creation, Bloodbank, and systemd (safe for laptops/macOS/non-technical operators)").option("--force-config", "Regenerate ~/.config/hermes-agent-template/config.toml even if it exists").option("--dry-run", "Preview what would run; don't execute copier").option("-f, --force", "Re-render even if agents/hermes/<role>/role.yaml already exists").action(async (options) => {
   const isDarwin = process.platform === "darwin";
   const local = options.local ?? false;
   const context = {
@@ -9597,6 +9759,9 @@ program.command("hermes-agent").alias("hermes").description("Provision the PM ag
     soulTone: options.tone,
     modelProvider: options.modelProvider,
     modelName: options.modelName,
+    modelBaseUrl: options.modelBaseUrl,
+    modelApiMode: options.modelApiMode,
+    modelKeyEnv: options.modelKeyEnv,
     skipTelegram: options.skipTelegram,
     // Email is opt-in only: `--email` wires it, otherwise it's never done.
     skipEmail: options.email ? false : void 0,