@delorenj/pjangler 1.2.33 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delorenj/pjangler",
-  "version": "1.2.33",
+  "version": "1.3.0",
   "description": "Project subsystem bootstrapper CLI",
   "type": "module",
   "main": "dist/index.js",

package/templates/commonproject/template/.agents/hooks/README.md

@@ -12,11 +12,11 @@ master writes zero bytes).
 ## TL;DR
 
 ```bash
-mise run hooks-sync          # fan out the master -> claude + codex + hermes
-mise run hooks-check         # drift gate (read-only; used in CI)
-mise run hooks-uninstall     # remove codex + hermes injections
-mise run skills-sync         # sync .agents/skills.json -> local CLI skill dirs
-mise run hindsight-setup     # one-time: pull the shared CAF Hindsight key into .env
+mise run hooks:sync          # fan out the master -> claude + codex + hermes
+mise run hooks:check         # drift gate (read-only; used in CI)
+mise run hooks:uninstall     # remove codex + hermes injections
+mise run skills:sync         # sync .agents/skills.json -> local CLI skill dirs
+mise run hindsight:setup     # one-time: pull the shared CAF Hindsight key into .env
 ```
 
 You normally run nothing — `mise` does it on directory enter/leave (see
@@ -93,10 +93,10 @@ merged in automatically.
 
 - Project-local skills with the same name shadow the global ones.
 - No `defer_to_global` flag or bash cleanup scripts are needed anymore.
-- The manifest is the only hand-edited skill SSOT; run `mise run skills-sync`
+- The manifest is the only hand-edited skill SSOT; run `mise run skills:sync`
   after changing it, or just re-enter the repo.
 
-## Hindsight credentials — `mise run hindsight-setup`
+## Hindsight credentials — `mise run hindsight:setup`
 
 The hooks shell out to `hindsight`, which needs an API key for the self-hosted
 instance. Strategy: **one shared CAF-scoped key in 1Password**. `hindsight-setup`
@@ -105,7 +105,7 @@ gitignored `.env` (mise loads it, env vars outrank `~/.hindsight/config`). Point
 it at the right item if the default ref is wrong:
 
 ```bash
-HINDSIGHT_OP_KEY_REF="op://DeLoSecrets/<item>/<field>" mise run hindsight-setup
+HINDSIGHT_OP_KEY_REF="op://DeLoSecrets/<item>/<field>" mise run hindsight:setup
 ```
 
 Without a key the hooks **no-op gracefully** — recall/retain just do nothing.
@@ -113,10 +113,10 @@ Without a key the hooks **no-op gracefully** — recall/retain just do nothing.
 ## Adding / changing a hook
 
 1. Edit `hooks.master.json`.
-2. `mise run hooks-sync`.
+2. `mise run hooks:sync`.
 3. Commit the master **and** the regenerated `.claude/settings.json` together
    (codex/hermes targets are per-dev/per-deployment, not committed).
-4. CI runs `mise run hooks-check` — fails if the committed Claude settings drift.
+4. CI runs `mise run hooks:check` — fails if the committed Claude settings drift.
 
 ## Files
 

package/templates/commonproject/template/.agents/hooks/hooks.master.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "SINGLE SOURCE OF TRUTH for this repo's project-scoped agent hooks. Hand-edit ONLY this file, then run `mise run hooks-sync` (or re-cd into the repo) to regenerate every per-agent config. Generated files are NOT hand-edited. Pattern: the /ssot-fanout skill. See .agents/hooks/README.md.",
+  "$comment": "SINGLE SOURCE OF TRUTH for this repo's project-scoped agent hooks. Hand-edit ONLY this file, then run `mise run hooks:sync` (or re-cd into the repo) to regenerate every per-agent config. Generated files are NOT hand-edited. Pattern: the /ssot-fanout skill. See .agents/hooks/README.md.",
   "version": 1,
   "marker": "project-agent-hooks",
   "hooks": [

package/templates/commonproject/template/.agents/hooks/sync.py

@@ -515,7 +515,7 @@ def cmd_check(master: dict) -> int:
         current = target.read_text() if target.exists() else None
         if current != desired:
             warn(f"DRIFT: {target.relative_to(REPO_ROOT)} differs from hooks.master.json "
-                 f"(run `mise run hooks-sync`)")
+                 f"(run `mise run hooks:sync`)")
             rc = 1
         else:
             log(f"claude: in sync ({target.relative_to(REPO_ROOT)})")
@@ -538,7 +538,7 @@ def cmd_check(master: dict) -> int:
                 ]
                 if missing:
                     warn(f"DRIFT: codex hooks.json missing {len(missing)} project hook(s) "
-                         f"(run `mise run hooks-sync`)")
+                         f"(run `mise run hooks:sync`)")
                     rc = 1
                 else:
                     log(f"codex: in sync ({ct})")
@@ -558,7 +558,7 @@ def cmd_check(master: dict) -> int:
             missing = [c for c in want_cmds if c not in present]
             if begin not in present or missing:
                 warn(f"DRIFT: kimi config.toml missing the project hooks block "
-                     f"(run `mise run hooks-sync`)")
+                     f"(run `mise run hooks:sync`)")
                 rc = 1
             else:
                 log(f"kimi: in sync ({kt})")
@@ -574,7 +574,7 @@ def cmd_check(master: dict) -> int:
             missing = [c for _ev, c, _t in hermes_commands(master) if c not in present]
             if missing:
                 warn(f"DRIFT: hermes config.yaml missing {len(missing)} adapter hook(s) "
-                     f"(run `mise run hooks-sync`)")
+                     f"(run `mise run hooks:sync`)")
                 rc = 1
             else:
                 log(f"hermes: in sync ({hcfg.relative_to(REPO_ROOT)})")

package/templates/commonproject/template/.agents/local.example.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "PER-DEV LOCAL OVERRIDES — copy this file to .agents/local.json (gitignored) and edit. Lets you opt out of individual hooks or whole injected agents without touching committed config. Hooks self-skip at RUNTIME via .agents/hooks/lib/hook-guard.sh (so even Claude's committed hooks honor it); codex/hermes injections additionally skip at INSTALL time. Re-run `mise run hooks-sync` (or re-cd into the repo) after editing.",
+  "$comment": "PER-DEV LOCAL OVERRIDES — copy this file to .agents/local.json (gitignored) and edit. Lets you opt out of individual hooks or whole injected agents without touching committed config. Hooks self-skip at RUNTIME via .agents/hooks/lib/hook-guard.sh (so even Claude's committed hooks honor it); codex/hermes injections additionally skip at INSTALL time. Re-run `mise run hooks:sync` (or re-cd into the repo) after editing.",
   "hooks": {
     "$disabled_help": "Hook ids from .agents/hooks/hooks.master.json: skill-check-reminder, hindsight-recall, hindsight-retain, hindsight-session-end. Listed ids are skipped at runtime across ALL agents.",
     "disabled": [],

package/templates/commonproject/template/.mise/scripts/hindsight-setup.sh

@@ -11,7 +11,7 @@
 # .env untouched. Never prints the secret.
 #
 # Override the 1Password reference if the item path differs:
-#   HINDSIGHT_OP_KEY_REF="op://DeLoSecrets/<item>/<field>" mise run hindsight-setup
+#   HINDSIGHT_OP_KEY_REF="op://DeLoSecrets/<item>/<field>" mise run hindsight:setup
 set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"

package/templates/commonproject/template/mise.toml.jinja

@@ -39,43 +39,43 @@ script = "'{% raw %}{{config_root}}{% endraw %}/.agents/hooks/sync.py' --uninsta
 
 [[watch_files]]
 patterns = ["AGENTS.md"]
-task = "link-agentfiles"
+task = "link:agentfiles"
 [[watch_files]]
 patterns = [".agents/skills.json"]
-task = "skills-sync"
+task = "skills:sync"
 {% if agent_hooks_layer %}
 # Re-fan-out the agent hooks whenever the single source of truth changes.
 [[watch_files]]
 patterns = [".agents/hooks/hooks.master.json"]
-task = "hooks-sync"
+task = "hooks:sync"
 {% endif %}
-[tasks.link-agentfiles]
+[tasks."link:agentfiles"]
 description = "Symlink all agent files to AGENTS.md"
 run = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh'"
 
-[tasks.skills-sync]
+[tasks."skills:sync"]
 description = "Sync skills from manifest to local CLI dirs"
-depends = ["skills-provision-packs"]
+depends = ["skills:provision:packs"]
 run = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/sync-skills.py' --scope project"
 
-[tasks.skills-provision-packs]
+[tasks."skills:provision:packs"]
 description = "Provision every Skillex pack declared in .agents/skills.json"
 run = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/provision-packs.py'"
 {% if agent_hooks_layer %}
 # --- Project-scoped agent hooks + skill fan-out (see .agents/hooks/README.md) ---
 
-[tasks.hooks-sync]
+[tasks."hooks:sync"]
 description = "Fan out .agents/hooks/hooks.master.json to each agent CLI (claude committed; codex/kimi injected; hermes adapter)"
 run = "'{% raw %}{{config_root}}{% endraw %}/.agents/hooks/sync.py' --install"
 
-[tasks.hooks-check]
+[tasks."hooks:check"]
 description = "Drift gate: verify generated hook configs match hooks.master.json (CI-safe, read-only)"
 run = "'{% raw %}{{config_root}}{% endraw %}/.agents/hooks/sync.py' --check"
 
-[tasks.hooks-uninstall]
+[tasks."hooks:uninstall"]
 description = "Remove per-user agent-hook injections (codex/kimi/hermes)"
 run = "'{% raw %}{{config_root}}{% endraw %}/.agents/hooks/sync.py' --uninstall"
 {% endif %}
-[tasks.hindsight-setup]
+[tasks."hindsight:setup"]
 description = "Provision this dev's shared project Hindsight key from 1Password into .env (op read; upserts those two keys, leaves the rest of .env intact)"
 run = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/hindsight-setup.sh'"

package/templates/hermes-agent/copier.yml

@@ -10,10 +10,10 @@
 #
 # What it does:
 #   1. Renders agents/hermes/<role>/{role.yaml, SOUL.md, hermes, .scripts/}
-#   2. Creates ignored local state at agents/hermes/<role>/runtime/
-#      (this is HERMES_HOME; no project gitlink or runtime remote)
+#   2. Creates ignored local state at agents/hermes/<role>/runtime/ and delegates
+#      named-profile wiring to `pj migrate hermes.runtime-singleton`
 #   4. Creates a Plane project in 33god workspace
-#   6. Prompts for a BotFather Telegram token, stores in runtime/.env
+#   6. Prompts for a BotFather Telegram token, stores in ignored runtime state
 #   7. Optionally wires a dedicated Slack app+bot pair into runtime/.env
 #   8. Records fleet-shared Bloodbank routing identity (no profile consumer)
 #   9. Installs a profile gateway + heartbeat timer (reconcile + checkpoint)
@@ -50,6 +50,7 @@ role:
   default: pm
   choices:
     "Project Manager (pm)": pm
+    "Company Director (director)": director
     "Developer (dev)": dev
     "Reviewer (review)": review
     "Company Reporter — daily cross-project rollup (reporter)": reporter
@@ -69,7 +70,7 @@ ticket_provider:
 agent_purpose:
   type: str
   help: "One-line description of what this agent does in this repo"
-  default: "{% if role == 'reporter' %}Company-wide evidence gathering, freshness-aware daily reporting, and critical delivery monitoring{% else %}Project management, triage, and continuous board reconciliation{% endif %}"
+  default: "{% if role == 'reporter' %}Company-wide evidence gathering, freshness-aware daily reporting, and critical delivery monitoring{% elif role == 'director' %}Company-level portfolio orchestration, delegation, and cross-project control{% else %}Project management, triage, and continuous board reconciliation{% endif %}"
 
 model_provider:
   type: str
@@ -81,6 +82,28 @@ model_name:
   help: "Model name (empty = inherit from global ~/.hermes config)"
   default: ""
 
+model_base_url:
+  type: str
+  help: "Per-agent model API base URL (empty = inherit from shared config)"
+  default: ""
+
+model_api_mode:
+  type: str
+  help: "Per-agent model API protocol (empty = inherit from shared config)"
+  default: ""
+  choices:
+    "Inherit from shared config": ""
+    "OpenAI-compatible chat completions": chat_completions
+    "OpenAI Codex responses": codex_responses
+    "Anthropic messages": anthropic_messages
+    "AWS Bedrock converse": bedrock_converse
+    "Codex app server": codex_app_server
+
+model_key_env:
+  type: str
+  help: "Environment variable NAME holding the per-agent model key (never the key value)"
+  default: ""
+
 soul_tone:
   type: str
   help: "Tone for the agent's SOUL.md"

package/templates/hermes-agent/template/.runtime-scaffold/README.md

@@ -1,21 +1,22 @@
 # {{agent_id}} — runtime
 
-This is the HERMES_HOME for the **{{display_name}}** agent. It is git-tracked
-so memory, SOUL evolution, and conversation history are durable across machines
-and recoverable on failure.
+This is the ignored, role-owned state for the **{{display_name}}** agent. The
+actual HERMES_HOME is a real named directory under `~/.hermes/profiles/`, with
+PJangler-managed links into this runtime. Back it up separately; it is not
+published by project Git.
 
 ## What's in here
 
 | Path | Tracked? | Purpose |
 | --- | --- | --- |
-| `config.yaml` | yes | Inference + skill config (cloned from global at provision time) |
-| `SOUL.md` | yes | The agent's personality, evolves over time |
-| `memories/MEMORY.md` | yes | The condensed mental-model summary loaded each session |
-| `memories/USER.md` | yes | The operator's persona (Jarad DeLorenzo, ...) |
-| `sessions/sessions.db` | yes (LFS) | SQLite store of every conversation |
-| `decisions/` | yes | Agent-emitted decisions, one file per important call |
+| `config.yaml` | local | Legacy seed/delta; shared profile config comes from fleet root |
+| `SOUL.md` | local | The agent's personality, evolves over time |
+| `memories/MEMORY.md` | local | The condensed mental-model summary loaded each session |
+| `memories/USER.md` | local | The operator's persona |
+| `sessions/sessions.db` | local | SQLite store of conversations |
+| `decisions/` | local | Agent-emitted decisions |
 | `.env` | **no** | API keys + Telegram bot token (per-machine secret) |
-| `auth.json` | **no** | Deprecated local OAuth store; fleet auth defaults to `HERMES_OAUTH_FILE=~/.hermes/auth.json` |
+| `auth.json` | **no** | Deprecated local OAuth store; named profiles use fleet auth fallback |
 | `audio_cache/`, `image_cache/` | **no** | Regenerable caches |
 | `sandboxes/` | **no** | Per-session ephemeral execution dirs |
 

package/templates/hermes-agent/template/.scripts/01-config.sh

@@ -21,11 +21,11 @@ else
     cat > "$CONFIG" <<'TOML'
 # hermes-agent-template config — edit for your environment.
 [fleet]
-hermes_bin = "~/.hermes/hermes-agent/.venv/bin/hermes"
-hermes_repo = "~/.hermes/hermes-agent"
+hermes_bin = "~/.local/share/hermes-agent/releases/0408fec7a153e6c32c064acd2b8053917f1525f1/.venv/bin/hermes"
+hermes_repo = "~/.local/share/hermes-agent/releases/0408fec7a153e6c32c064acd2b8053917f1525f1"
 hermes_git_url = "https://github.com/delorenj/hermes-agent.git"
-hermes_git_ref = "feature/PJAN-19-routing-publication"
-hermes_git_sha = "113e1b182b6d72a7dd02a191f134a41668ceaf0e"
+hermes_git_ref = "main"
+hermes_git_sha = "0408fec7a153e6c32c064acd2b8053917f1525f1"
 fleet_env = "~/.hermes/fleet.env"
 registry_file = "~/.hermes/agents-registry.yaml"
 canonical_skills_dir = "/home/delorenj/.agents/skills"

package/templates/hermes-agent/template/.scripts/10-hermes-profile.sh

@@ -1,10 +1,8 @@
 #!/usr/bin/env bash
-# Stage the per-agent runtime config/secrets via a TRANSIENT Hermes profile.
-# HERMES_HOME is the ignored ./runtime directory; this profile dir is a staging area
-# (cred-stripped .env + SOUL) that 20-runtime-repo.sh folds into the runtime and
-# then replaces with a symlink ~/.hermes/profiles/<name> -> ./runtime. That
-# symlink is load-bearing: hermes resolves `--profile <name>` invocations
-# through it (recreating it wrongly if it goes missing).
+# Create the initial named Hermes profile and sanitize cloned chat credentials.
+# The directory remains REAL. Step 20 delegates final shared-vs-owned link
+# topology to `pj migrate hermes.runtime-singleton`; no template step may
+# replace the profile itself with a symlink.
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 load_role_env
@@ -14,9 +12,6 @@ already_done 10-hermes-profile && { log "[10] profile already created — skippi
 log "[10] creating hermes profile: $PROFILE_NAME"
 PROFILE_HOME="$HOME/.hermes/profiles/$PROFILE_NAME"
 
-# Set repo path to directory where .git is
-REPO_PATH="$(cd "$ROLE_DIR" && git rev-parse --show-toplevel 2>/dev/null || echo "$ROLE_DIR")"
-
 if [[ -d "$PROFILE_HOME" ]]; then
   log "    profile dir already exists; reusing"
 else
@@ -112,9 +107,9 @@ PYEOF
   fi
 fi
 
-# Apply role-specific config overrides.
-log "    setting terminal.cwd = $REPO_PATH"
-env HERMES_HOME="$PROFILE_HOME" "$HERMES_BIN" config set terminal.cwd "$REPO_PATH"
+# Never persist a project-specific terminal.cwd through the named profile.
+# PJangler intentionally links profile config.yaml to the fleet-shared config;
+# the generated launchers therefore pass TERMINAL_CWD process-locally instead.
 
 # Canonical shared-skill source of truth + local PM fallback sync.
 CANONICAL_SKILLS_DIR="${CANONICAL_SKILLS_DIR:-$(config_get fleet.canonical_skills_dir '/home/delorenj/.agents/skills')}"

package/templates/hermes-agent/template/.scripts/20-runtime-repo.sh

@@ -6,8 +6,13 @@
 source "$(dirname "$0")/_lib.sh"
 load_role_env
 
-already_done 20-runtime-repo && { log "[20] local runtime already set up — skipping"; exit 0; }
-[[ "${SKIP_RUNTIME_REPO:-0}" == "1" ]] && { log "[20] local runtime — SKIPPED (SKIP_RUNTIME_REPO=1)"; mark_done 20-runtime-repo; exit 0; }
+already_done 20-runtime-repo \
+  && log "[20] local runtime scaffold already set up — re-auditing singleton profile wiring"
+if [[ "${SKIP_RUNTIME_REPO:-0}" == "1" ]]; then
+  clear_done 20-runtime-repo
+  log "[20] local runtime — DEFERRED (SKIP_RUNTIME_REPO=1; completion marker cleared)"
+  exit 0
+fi
 
 PROFILE_HOME="$HOME/.hermes/profiles/$PROFILE_NAME"
 RUNTIME_LOCAL="$ROLE_DIR/runtime"
@@ -123,30 +128,34 @@ if [[ ! -e "$RUNTIME_LOCAL/SOUL.md" ]]; then
   cp "$ROLE_DIR/SOUL.md" "$RUNTIME_LOCAL/SOUL.md"
 fi
 
-# Fold the two supported staging-profile files into the runtime without
-# deleting unknown profile content. Unknown content blocks the symlink so an
-# operator can reconcile it explicitly instead of losing state.
-if [[ -d "$PROFILE_HOME" && ! -L "$PROFILE_HOME" ]]; then
-  log "    migrating supported staging profile state into the local runtime"
-  # A reporter never inherits .env; its credentials must be provisioned
-  # explicitly against a bot identity it owns.
-  if [[ "$ROLE" == "reporter" ]]; then
-    MIGRATE_FILES=(config.yaml profile.yaml)
-  else
-    MIGRATE_FILES=(.env config.yaml)
-  fi
-  for file_name in "${MIGRATE_FILES[@]}"; do
-    [[ -f "$PROFILE_HOME/$file_name" && ! -e "$RUNTIME_LOCAL/$file_name" ]] && cp "$PROFILE_HOME/$file_name" "$RUNTIME_LOCAL/$file_name"
-    [[ -f "$PROFILE_HOME/$file_name" ]] && rm -f -- "$PROFILE_HOME/$file_name"
-  done
-  if ! rmdir "$PROFILE_HOME" 2>/dev/null; then
-    die "staging profile contains unrecognized state and was preserved: $PROFILE_HOME"
-  fi
+# Named-profile topology belongs exclusively to PJangler. Preview first, then
+# apply the one idempotent rule. This script never removes or replaces a real
+# profile directory and never creates the obsolete profile -> runtime symlink.
+if [[ "$PJANGLER_BIN" != */* ]]; then
+  PJANGLER_BIN="$(command -v "$PJANGLER_BIN" 2>/dev/null || true)"
 fi
-ln -sfn "$RUNTIME_LOCAL" "$PROFILE_HOME"
-log "    profile symlink $PROFILE_HOME -> $RUNTIME_LOCAL"
+[[ -n "$PJANGLER_BIN" && -x "$PJANGLER_BIN" ]] \
+  || die "PJángler CLI not found; install 'pj' or set PJANGLER_BIN"
+"$PJANGLER_BIN" migrate hermes.runtime-singleton "$PROJECT_PATH" --dry-run --json >/dev/null \
+  || die "singleton-runtime audit failed; profile was left untouched"
+"$PJANGLER_BIN" migrate hermes.runtime-singleton "$PROJECT_PATH" --json >/dev/null \
+  || die "singleton-runtime migration failed; inspect with: pj migrate hermes.runtime-singleton '$PROJECT_PATH' --dry-run"
+[[ -d "$PROFILE_HOME" && ! -L "$PROFILE_HOME" ]] \
+  || die "PJángler did not establish a real named profile at $PROFILE_HOME"
+log "    singleton profile verified by pj migrate hermes.runtime-singleton: $PROFILE_HOME"
 
-env HERMES_HOME="$RUNTIME_LOCAL" "$HERMES_BIN" config set terminal.cwd "$PROJECT_PATH" >/dev/null 2>&1 || true
+# Never persist a project-specific terminal.cwd through the named profile.
+# config.yaml is fleet-shared in the singleton topology.  The manual and
+# service launchers pass TERMINAL_CWD process-locally for this role instead.
+
+profile_config_set() {
+  local key="$1"
+  [[ -x "$HERMES_BIN" ]] \
+    || die "Hermes CLI is not executable; cannot configure named profile: $HERMES_BIN"
+  if ! env HERMES_HOME="$PROFILE_HOME" "$HERMES_BIN" config set "$@" >/dev/null; then
+    die "required Hermes config write failed for named profile $PROFILE_NAME: $key"
+  fi
+}
 
 if [[ "$ROLE" == "pm" ]]; then
   VOXXY_PLUGIN_DIR="${VOXXY_PLUGIN_DIR:-$(config_get fleet.voxxy_plugin_dir "$HOME/code/voxxy/plugins/tts/voxxy")}"
@@ -158,14 +167,10 @@ if [[ "$ROLE" == "pm" ]]; then
     warn "    Voxxy plugin dir missing: $VOXXY_PLUGIN_DIR"
   fi
 
-  if [[ -x "$HERMES_BIN" ]]; then
-    env HERMES_HOME="$RUNTIME_LOCAL" "$HERMES_BIN" config set plugins.enabled.0 tts/voxxy >/dev/null 2>&1 || true
-    env HERMES_HOME="$RUNTIME_LOCAL" "$HERMES_BIN" config set tts.provider voxxy >/dev/null 2>&1 || true
-    env HERMES_HOME="$RUNTIME_LOCAL" "$HERMES_BIN" config set tts.voice rick >/dev/null 2>&1 || true
-    log "    set PM runtime TTS provider -> voxxy"
-  else
-    warn "    Hermes bin missing; skipped PM Voxxy config"
-  fi
+  profile_config_set plugins.enabled.0 tts/voxxy
+  profile_config_set tts.provider voxxy
+  profile_config_set tts.voice rick
+  log "    set PM named-profile TTS provider -> voxxy"
 fi
 
 mark_done 20-runtime-repo

package/templates/hermes-agent/template/.scripts/30-telegram.sh

@@ -46,15 +46,28 @@ path.write_text(text[: match.start("body")] + body + text[match.end("body") :],
 PYEOF
 }
 
-already_done 30-telegram && { log "[30] telegram already wired — skipping"; exit 0; }
+telegram_status="$(yaml_get telegram.provisioning_status)"
 
 if [[ "${SKIP_TELEGRAM:-0}" == "1" ]]; then
-  telegram_yaml_update provisioning_status disabled
-  log "[30] telegram — SKIPPED (SKIP_TELEGRAM=1)"
-  mark_done 30-telegram
+  if [[ "$telegram_status" == "verified" ]] && already_done 30-telegram; then
+    log "[30] telegram — SKIPPED; existing verified wiring preserved"
+  else
+    telegram_yaml_update provisioning_status disabled
+    clear_done 30-telegram
+    log "[30] telegram — DEFERRED (SKIP_TELEGRAM=1; completion marker cleared)"
+  fi
   exit 0
 fi
 
+if already_done 30-telegram; then
+  if [[ "$telegram_status" == "verified" ]]; then
+    log "[30] telegram already wired — skipping"
+    exit 0
+  fi
+  clear_done 30-telegram
+  log "[30] stale deferred completion marker cleared — reconciling Telegram"
+fi
+
 RUNTIME="$ROLE_DIR/runtime"
 ENVF="$RUNTIME/.env"
 mkdir -p "$RUNTIME"
@@ -81,6 +94,7 @@ fi
 
 if [[ -z "${TELEGRAM_BOT_TOKEN:-}" ]]; then
   telegram_yaml_update provisioning_status deferred
+  clear_done 30-telegram
   warn "    no token provided; Telegram step deferred"
   warn "    re-run later with a profile-dedicated TELEGRAM_BOT_TOKEN invocation"
   exit 0

package/templates/hermes-agent/template/.scripts/70-systemd.sh

@@ -12,9 +12,35 @@ if [[ "$ROLE" == "reporter" ]]; then
   exit 0
 fi
 
+# Resolve expected paths without creating directories or querying the user
+# manager.  A legacy skip-created marker is complete only when all units exist.
 RUNTIME="$ROLE_DIR/runtime"
+FLEET_HOME="${HERMES_FLEET_HOME:-$HOME/.hermes}"
+PROFILE_HOME="$FLEET_HOME/profiles/${PROFILE_NAME:-$AGENT_ID}"
 REPO_ROOT="$(project_repo_path)" || REPO_ROOT="$ROLE_DIR"
 SYS_DIR="$HOME/.config/systemd/user"
+GW_UNIT="hermes-${AGENT_ID}-gateway.service"
+HB_SVC="hermes-${AGENT_ID}-heartbeat.service"
+HB_TIMER="hermes-${AGENT_ID}-heartbeat.timer"
+
+# Local-only provisioning must not inspect or mutate the host user manager.
+# Honor the explicit skip before creating unit directories or querying legacy
+# unit state; cleanup remains fail-closed whenever systemd management is active.
+if [[ "${SKIP_SYSTEMD:-0}" == "1" ]]; then
+  if already_done 70-systemd \
+     && [[ -f "$SYS_DIR/$GW_UNIT" && -f "$SYS_DIR/$HB_SVC" && -f "$SYS_DIR/$HB_TIMER" ]]; then
+    log "[70] systemd — SKIPPED; existing complete unit set preserved"
+  else
+    clear_done 70-systemd
+    log "[70] systemd — DEFERRED (completion marker cleared)"
+  fi
+  exit 0
+fi
+
+# Singleton-runtime contract: units set HERMES_HOME to the agent's NAMED PROFILE
+# dir, never the raw runtime path — Hermes derives profile identity and shared
+# fleet auth from the unresolved HERMES_HOME. $RUNTIME stays correct for
+# EnvironmentFile and logs: those are the repo-owned side the profile links to.
 mkdir -p "$SYS_DIR" "$RUNTIME/logs"
 
 # Upgrade remediation must run before honoring a legacy done marker. Older
@@ -56,17 +82,49 @@ if [[ $legacy_consumer_present -eq 1 ]]; then
   log "    retired legacy per-profile Bloodbank consumer: $LEGACY_CONSUMER_UNIT"
 fi
 
-already_done 70-systemd && { log "[70] systemd already installed — legacy cleanup checked"; exit 0; }
-[[ "${SKIP_SYSTEMD:-0}" == "1" ]] && { log "[70] systemd — SKIPPED"; mark_done 70-systemd; exit 0; }
+if already_done 70-systemd; then
+  if [[ -f "$SYS_DIR/$GW_UNIT" && -f "$SYS_DIR/$HB_SVC" && -f "$SYS_DIR/$HB_TIMER" ]]; then
+    log "[70] systemd already installed — reconciling unit definitions"
+  else
+    clear_done 70-systemd
+    log "    stale/incomplete systemd marker cleared — reconciling required units"
+  fi
+fi
 
 # The heartbeat runner (board-reconciliation sentinel pass + gated checkpoint)
 # and the checkpoint helper both render into the role dir; just ensure they are
 # executable. heartbeat.sh calls checkpoint.sh internally.
 HEARTBEAT_BIN="$ROLE_DIR/.scripts/heartbeat.sh"
-chmod +x "$HEARTBEAT_BIN" "$ROLE_DIR/.scripts/checkpoint.sh" 2>/dev/null || true
+CREDENTIAL_LAUNCHER="$ROLE_DIR/.scripts/credential-launch.sh"
+chmod +x "$HEARTBEAT_BIN" "$CREDENTIAL_LAUNCHER" "$ROLE_DIR/.scripts/checkpoint.sh" 2>/dev/null || true
+
+[[ -d "$PROFILE_HOME" && ! -L "$PROFILE_HOME" ]] \
+  || die "named profile is not a real directory; run: pj migrate hermes.runtime-singleton '$REPO_ROOT'"
+
+# Encrypted credentials are optional and take precedence over the existing
+# ignored runtime/.env fallback. Their plaintext appears only below /run while
+# systemd executes the unit. Files are provisioned separately with
+# `systemd-creds encrypt --user`; this step never reads or writes secret values.
+CREDENTIAL_DIR="${HERMES_SYSTEMD_CREDENTIAL_DIR:-$HOME/.config/hermes-agent/credentials}"
+TELEGRAM_CREDENTIAL="$CREDENTIAL_DIR/${AGENT_ID}-telegram-bot-token.cred"
+MODEL_CREDENTIAL="$CREDENTIAL_DIR/${AGENT_ID}-model-api-key.cred"
+GW_CREDENTIAL_LINES=""
+HB_CREDENTIAL_LINES=""
+if [[ -f "$TELEGRAM_CREDENTIAL" ]]; then
+  command -v systemd-creds >/dev/null 2>&1 \
+    || die "encrypted Telegram credential exists but systemd-creds is unavailable"
+  GW_CREDENTIAL_LINES="LoadCredentialEncrypted=telegram_bot_token:$TELEGRAM_CREDENTIAL"
+fi
+if [[ -f "$MODEL_CREDENTIAL" ]]; then
+  [[ -n "$(yaml_get model.key_env)" ]] \
+    || die "encrypted model credential exists but model.key_env is blank in role.yaml"
+  command -v systemd-creds >/dev/null 2>&1 \
+    || die "encrypted model credential exists but systemd-creds is unavailable"
+  GW_CREDENTIAL_LINES="${GW_CREDENTIAL_LINES}${GW_CREDENTIAL_LINES:+$'\n'}LoadCredentialEncrypted=model_api_key:$MODEL_CREDENTIAL"
+  HB_CREDENTIAL_LINES="LoadCredentialEncrypted=model_api_key:$MODEL_CREDENTIAL"
+fi
 
 # Gateway unit
-GW_UNIT="hermes-${AGENT_ID}-gateway.service"
 cat > "$SYS_DIR/$GW_UNIT" <<UNIT
 [Unit]
 Description=Hermes Gateway — $DISPLAY_NAME
@@ -75,11 +133,13 @@ Wants=network-online.target
 
 [Service]
 Type=simple
-Environment=HERMES_HOME=$RUNTIME
-Environment=HERMES_OAUTH_FILE=$HERMES_OAUTH_FILE
+Environment=HERMES_HOME=$PROFILE_HOME
+Environment=HERMES_BIN=$HERMES_BIN
 Environment=CODEX_HOME=$CODEX_HOME
+Environment="TERMINAL_CWD=$REPO_ROOT"
 EnvironmentFile=-$RUNTIME/.env
-ExecStart=$HERMES_BIN gateway run --replace
+$GW_CREDENTIAL_LINES
+ExecStart=$CREDENTIAL_LAUNCHER gateway
 Restart=on-failure
 RestartSec=10
 StandardOutput=append:$RUNTIME/logs/gateway.systemd.log
@@ -93,8 +153,6 @@ UNIT
 # Frequent ticks (1 min); heartbeat.sh's own cooldown/lock logic rate-limits the
 # full Hermes pass, and the checkpoint is gated to ~hourly inside the runner.
 # The per-agent EnvironmentFiles load ticket-provider creds for the sentinel pass.
-HB_SVC="hermes-${AGENT_ID}-heartbeat.service"
-HB_TIMER="hermes-${AGENT_ID}-heartbeat.timer"
 cat > "$SYS_DIR/$HB_SVC" <<UNIT
 [Unit]
 Description=Hermes Heartbeat (reconcile + checkpoint) — $DISPLAY_NAME
@@ -104,15 +162,17 @@ Wants=network-online.target
 [Service]
 Type=oneshot
 WorkingDirectory=$REPO_ROOT
-Environment=HERMES_HOME=$RUNTIME
-Environment=HERMES_OAUTH_FILE=$HERMES_OAUTH_FILE
+Environment=HERMES_HOME=$PROFILE_HOME
+Environment=HERMES_BIN=$HERMES_BIN
 Environment=CODEX_HOME=$CODEX_HOME
+Environment="TERMINAL_CWD=$REPO_ROOT"
 EnvironmentFile=-%h/.config/hermes-agent/env
 EnvironmentFile=-%h/.hermes/env
 EnvironmentFile=-%h/.hermes/hermes-agent.env
 EnvironmentFile=-%h/.hermes/${AGENT_ID}.env
 EnvironmentFile=-$RUNTIME/.env
-ExecStart=$HEARTBEAT_BIN
+$HB_CREDENTIAL_LINES
+ExecStart=$CREDENTIAL_LAUNCHER heartbeat
 TimeoutStartSec=45min
 StandardOutput=append:$RUNTIME/logs/heartbeat.log
 StandardError=append:$RUNTIME/logs/heartbeat.log