@delorenj/pjangler 1.2.33 → 1.3.0

package/templates/hermes-agent/template/.scripts/80-registry.sh

@@ -29,7 +29,8 @@ python3 - "$REGISTRY_FILE" "$AGENT_ID" "$REPO" "$ROLE" "$DISPLAY_NAME" \
   "$(yaml_get slack.provisioning_status)" "$(yaml_get slack.team_id)" \
   "$(yaml_get slack.team_name)" "$(yaml_get slack.bot_user_id)" \
   "$(yaml_get slack.bot_id)" "$(yaml_get slack.bot_username)" \
-  "$(yaml_get bloodbank.gateway_scope)" "$(yaml_get bloodbank.target_agent_id)" \
+  "$(yaml_get bloodbank.enabled)" "$(yaml_get bloodbank.gateway_scope)" \
+  "$(yaml_get bloodbank.target_agent_id)" \
   "$PLANE_WORKSPACE" "$PLANE_PROJECT_ID" "$(yaml_get plane.identifier)" \
   "$RUNTIME_REPO" "$HERMES_BIN" "$HERMES_AGENT_REPO" "$HERMES_RUNTIME_GIT_URL" \
   "$HERMES_RUNTIME_GIT_REF" "$HERMES_RUNTIME_GIT_SHA" "$FLEET_ENV" \
@@ -47,13 +48,21 @@ except ImportError:
 (path, agent_id, repo, role, display, project, role_dir, profile,
  telegram_status, bot, telegram_bot_id,
  slack_status, slack_team_id, slack_team_name, slack_user_id, slack_bot_id,
- slack_username, bloodbank_scope, bloodbank_target, plane_ws, plane_id,
+ slack_username, bloodbank_enabled, bloodbank_scope, bloodbank_target, plane_ws, plane_id,
  plane_ident, runtime_repo, hermes_bin, hermes_repo, hermes_git_url,
- hermes_git_ref, hermes_git_sha, fleet_env, gw, heartbeat) = sys.argv[1:32]
+ hermes_git_ref, hermes_git_sha, fleet_env, gw, heartbeat) = sys.argv[1:33]
 p = pathlib.Path(path)
 if p.is_symlink():
     raise SystemExit(f"refusing to update registry symlink: {p}")
 data = yaml.safe_load(p.read_text()) or {"schema_version": 1, "agents": {}}
+if bloodbank_enabled == "":
+    bloodbank_enabled_value = False
+elif bloodbank_enabled == "true":
+    bloodbank_enabled_value = True
+elif bloodbank_enabled == "false":
+    bloodbank_enabled_value = False
+else:
+    raise SystemExit("bloodbank.enabled must be the strict YAML boolean true or false")
 data.setdefault("agents", {})[agent_id] = {
   "repo": repo, "role": role, "display_name": display,
   "project_path": project, "role_dir": role_dir,
@@ -72,6 +81,7 @@ data.setdefault("agents", {})[agent_id] = {
     "bot_username": slack_username,
   },
   "bloodbank": {
+    "enabled": bloodbank_enabled_value,
     "gateway_scope": bloodbank_scope,
     "target_agent_id": bloodbank_target,
   },

package/templates/hermes-agent/template/.scripts/_lib.sh

@@ -137,6 +137,12 @@ already_done() {
 mark_done() {
   touch "$ROLE_DIR/.scripts/.done-$1"
 }
+clear_done() {
+  # Remove only the marker for the explicitly deferred step.  This lets a
+  # later activation reconcile that phase without disturbing completed,
+  # unrelated provisioning state.
+  rm -f -- "$ROLE_DIR/.scripts/.done-$1"
+}
 
 # Fleet source-of-truth (shared across all wrappers/provisioners).
 # Every default below resolves as: env var > fleet.env > config.toml > fallback.
@@ -151,11 +157,12 @@ fi
 unset TELEGRAM_BOT_TOKEN SLACK_BOT_TOKEN SLACK_APP_TOKEN
 
 # Tools we expect on the host
-HERMES_BIN="${HERMES_BIN:-${HERMES_FLEET_BIN:-$(config_get fleet.hermes_bin "$HOME/.hermes/hermes-agent/.venv/bin/hermes")}}"
-HERMES_AGENT_REPO="${HERMES_AGENT_REPO:-${HERMES_FLEET_REPO:-$(config_get fleet.hermes_repo "$HOME/.hermes/hermes-agent")}}"
+HERMES_BIN="${HERMES_BIN:-${HERMES_FLEET_BIN:-$(config_get fleet.hermes_bin "$HOME/.local/share/hermes-agent/releases/0408fec7a153e6c32c064acd2b8053917f1525f1/.venv/bin/hermes")}}"
+HERMES_AGENT_REPO="${HERMES_AGENT_REPO:-${HERMES_FLEET_REPO:-$(config_get fleet.hermes_repo "$HOME/.local/share/hermes-agent/releases/0408fec7a153e6c32c064acd2b8053917f1525f1")}}"
+PJANGLER_BIN="${PJANGLER_BIN:-$(config_get fleet.pjangler_bin "pj")}"
 HERMES_RUNTIME_GIT_URL="${HERMES_RUNTIME_GIT_URL:-$(config_get fleet.hermes_git_url 'https://github.com/delorenj/hermes-agent.git')}"
-HERMES_RUNTIME_GIT_REF="${HERMES_RUNTIME_GIT_REF:-$(config_get fleet.hermes_git_ref 'feature/PJAN-19-routing-publication')}"
-HERMES_RUNTIME_GIT_SHA="${HERMES_RUNTIME_GIT_SHA:-$(config_get fleet.hermes_git_sha '113e1b182b6d72a7dd02a191f134a41668ceaf0e')}"
+HERMES_RUNTIME_GIT_REF="${HERMES_RUNTIME_GIT_REF:-$(config_get fleet.hermes_git_ref 'main')}"
+HERMES_RUNTIME_GIT_SHA="${HERMES_RUNTIME_GIT_SHA:-$(config_get fleet.hermes_git_sha '0408fec7a153e6c32c064acd2b8053917f1525f1')}"
 HERMES_OAUTH_FILE="${HERMES_OAUTH_FILE:-${HERMES_FLEET_OAUTH_FILE:-$(config_get fleet.oauth_file "$HOME/.hermes/auth.json")}}"
 CODEX_HOME="${CODEX_HOME:-${HERMES_FLEET_CODEX_HOME:-$(config_get fleet.codex_home "$HOME/.codex")}}"
 # Prefer a scaffold vendored into this agent directory; fall back to the configured template path.
@@ -197,7 +204,7 @@ BLOODBANK_COMPOSE_DIR="${BLOODBANK_COMPOSE_DIR:-$(config_get bloodbank.compose_d
 PLANE_BASE="${PLANE_BASE:-$(config_get plane.base 'https://plane.delo.sh')}"
 PLANE_API_KEY="${PLANE_API_KEY:-${PLANE_33GOD_API_KEY:-}}"
 
-export FLEET_ENV HERMES_BIN HERMES_AGENT_REPO HERMES_RUNTIME_GIT_URL \
+export FLEET_ENV HERMES_BIN HERMES_AGENT_REPO PJANGLER_BIN HERMES_RUNTIME_GIT_URL \
        HERMES_RUNTIME_GIT_REF HERMES_RUNTIME_GIT_SHA HERMES_OAUTH_FILE CODEX_HOME \
        RUNTIME_SCAFFOLD_DIR REGISTRY_FILE \
        BLOODBANK_NATS_HOST BLOODBANK_NATS_PORT BLOODBANK_COMPOSE_DIR \

package/templates/hermes-agent/template/.scripts/config.example.toml

@@ -12,14 +12,17 @@
 
 [fleet]
 # Absolute path to the shared Hermes executable every agent launcher execs.
-hermes_bin = "~/.hermes/hermes-agent/.venv/bin/hermes"
+hermes_bin = "~/.local/share/hermes-agent/releases/0408fec7a153e6c32c064acd2b8053917f1525f1/.venv/bin/hermes"
 # Checkout of the shared hermes-agent repo.
-hermes_repo = "~/.hermes/hermes-agent"
+hermes_repo = "~/.local/share/hermes-agent/releases/0408fec7a153e6c32c064acd2b8053917f1525f1"
+# Canonical CommonProject migration CLI. Runtime provisioning delegates named
+# profile topology to this command; it never rewrites profile links itself.
+pjangler_bin = "pj"
 # Reviewed fleet runtime publication. Provisioning metadata and clean installs
 # must agree on this fork/ref/SHA; do not substitute upstream main.
 hermes_git_url = "https://github.com/delorenj/hermes-agent.git"
-hermes_git_ref = "feature/PJAN-19-routing-publication"
-hermes_git_sha = "113e1b182b6d72a7dd02a191f134a41668ceaf0e"
+hermes_git_ref = "main"
+hermes_git_sha = "0408fec7a153e6c32c064acd2b8053917f1525f1"
 # Fallback runtime scaffold dir — used only when an agent's vendored
 # ./.runtime-scaffold is missing.
 runtime_scaffold_dir = "~/code/hermes-agent-template/runtime-scaffold"

package/templates/hermes-agent/template/.scripts/credential-launch.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# Secret-free systemd entrypoint. Decrypted values are read only from the
+# service manager's volatile credential directory and never printed or written.
+set -euo pipefail
+
+ROLE_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+ROLE_YAML="$ROLE_DIR/role.yaml"
+
+yaml_get() {
+  python3 - "$ROLE_YAML" "$1" <<'PYEOF'
+import re, sys
+from pathlib import Path
+text = Path(sys.argv[1]).read_text()
+parts = sys.argv[2].split(".")
+if len(parts) == 2:
+    match = re.search(
+        rf"(?m)^{re.escape(parts[0])}:[ \t]*\n((?:[ \t]+\S.*\n?)*)", text
+    )
+    text = match.group(1) if match else ""
+key = parts[-1]
+match = re.search(rf'(?m)^\s*{re.escape(key)}:\s*"?([^"\n]*)"?\s*$', text)
+print(match.group(1).strip() if match else "")
+PYEOF
+}
+
+AGENT_ID="$(yaml_get agent_id)"
+PROFILE_NAME="$(yaml_get profile)"
+[[ -n "$AGENT_ID" && -n "$PROFILE_NAME" ]] \
+  || { printf 'credential-launch: incomplete role identity\n' >&2; exit 2; }
+[[ -n "${HERMES_BIN:-}" && -x "$HERMES_BIN" ]] \
+  || { printf 'credential-launch: HERMES_BIN is not executable\n' >&2; exit 1; }
+
+mode="${1:-}"
+[[ "$mode" == "gateway" || "$mode" == "heartbeat" ]] \
+  || { printf 'credential-launch: expected gateway or heartbeat\n' >&2; exit 2; }
+
+FLEET_HOME="${HERMES_FLEET_HOME:-$HOME/.hermes}"
+PROFILE_HOME="$FLEET_HOME/profiles/${PROFILE_NAME:-$AGENT_ID}"
+[[ -d "$PROFILE_HOME" && ! -L "$PROFILE_HOME" ]] \
+  || { printf 'credential-launch: named profile is not a real directory\n' >&2; exit 1; }
+export HERMES_HOME="$PROFILE_HOME"
+
+if ! REPO_ROOT="$(git -C "$ROLE_DIR" rev-parse --show-toplevel 2>/dev/null)"; then
+  REPO_ROOT="$ROLE_DIR"
+fi
+export TERMINAL_CWD="$REPO_ROOT"
+
+load_credential() {
+  local credential_id="$1" env_name="$2" credential_file value
+  [[ "$env_name" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] \
+    || { printf 'credential-launch: invalid credential environment name\n' >&2; exit 2; }
+  credential_file="${CREDENTIALS_DIRECTORY:-}/$credential_id"
+  [[ -n "${CREDENTIALS_DIRECTORY:-}" && -r "$credential_file" ]] || return 0
+  value="$(<"$credential_file")"
+  printf -v "$env_name" '%s' "$value"
+  export "$env_name"
+  unset value
+}
+
+load_credential telegram_bot_token TELEGRAM_BOT_TOKEN
+MODEL_KEY_ENV="$(yaml_get model.key_env)"
+if [[ -n "$MODEL_KEY_ENV" ]]; then
+  load_credential model_api_key "$MODEL_KEY_ENV"
+fi
+
+if [[ "$mode" == "heartbeat" ]]; then
+  exec "$ROLE_DIR/.scripts/heartbeat.sh"
+fi
+
+gateway_args=(gateway run --replace)
+MODEL_NAME="$(yaml_get model.name)"
+MODEL_PROVIDER="$(yaml_get model.provider)"
+MODEL_BASE_URL="$(yaml_get model.base_url)"
+MODEL_API_MODE="$(yaml_get model.api_mode)"
+[[ -z "$MODEL_NAME" ]] || gateway_args+=(--model "$MODEL_NAME")
+[[ -z "$MODEL_PROVIDER" ]] || gateway_args+=(--provider "$MODEL_PROVIDER")
+[[ -z "$MODEL_BASE_URL" ]] || gateway_args+=(--base-url "$MODEL_BASE_URL")
+[[ -z "$MODEL_API_MODE" ]] || gateway_args+=(--api-mode "$MODEL_API_MODE")
+[[ -z "$MODEL_KEY_ENV" ]] || gateway_args+=(--key-env "$MODEL_KEY_ENV")
+
+exec "$HERMES_BIN" "${gateway_args[@]}"

package/templates/hermes-agent/template/.scripts/heartbeat.sh

@@ -15,6 +15,7 @@ set -euo pipefail
 
 ROLE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"   # agents/hermes/<role>
 RUNTIME="$ROLE_DIR/runtime"
+RUN_HOME="${HERMES_HOME:-$RUNTIME}"
 PROMPT_FILE="$ROLE_DIR/.scripts/sentinel.prompt.md"
 STATE_FILE="$RUNTIME/continuous-ticket-sentinel-state.json"
 LOCK_FILE="$RUNTIME/continuous-ticket-sentinel.lock"
@@ -242,7 +243,7 @@ trap 'python3 "$ROLE_DIR/.scripts/momo-wip-lock.py" release "$WIP_LOCK" "hermes:
 
 prompt="$(<"$PROMPT_FILE")"
 set +e
-env HERMES_HOME="$RUNTIME" "$HERMES_BIN" chat -Q --source cron --max-turns 90 -q "$prompt"
+env HERMES_HOME="$RUN_HOME" "$HERMES_BIN" chat -Q --source cron --max-turns 90 -q "$prompt"
 status=$?
 set -e
 

package/templates/hermes-agent/template/.scripts/providers/plane.sh

@@ -22,10 +22,6 @@ ROLE_YAML="$ROLE_DIR/role.yaml"
 BASE="${PLANE_BASE:-https://plane.delo.sh}"
 
 FLEET_ENV="${HERMES_FLEET_ENV:-$HOME/.hermes/fleet.env}"
-if [ -f "$FLEET_ENV" ]; then
-  # shellcheck disable=SC1090
-  . "$FLEET_ENV"
-fi
 
 die() { echo "plane: $*" >&2; exit 1; }
 need_key() { [ -n "${PLANE_API_KEY:-}" ] || die "PLANE_API_KEY is not set"; }
@@ -36,6 +32,33 @@ workspace_key() {
   printf 'PLANE_%s_API_KEY' "$key"
 }
 
+# dotenv_value FILE KEY — read one exact dotenv assignment as inert data.
+# Never source the shared fleet file: it may contain unrelated command
+# substitutions or credential helpers that this provider must not execute.
+dotenv_value() {
+  python3 - "$1" "$2" <<'PY'
+import pathlib, sys
+
+path = pathlib.Path(sys.argv[1])
+key = sys.argv[2]
+value = ""
+for raw in path.read_text(encoding="utf-8").splitlines():
+    line = raw.strip()
+    if not line or line.startswith("#"):
+        continue
+    if line.startswith("export "):
+        line = line[7:].lstrip()
+    name, sep, candidate = line.partition("=")
+    if sep and name.strip() == key:
+        candidate = candidate.strip()
+        if len(candidate) >= 2 and candidate[0] == candidate[-1] and candidate[0] in "'\"":
+            candidate = candidate[1:-1]
+        value = candidate
+        break
+print(value, end="")
+PY
+}
+
 tp_cfg() {
   [ -f "$ROLE_YAML" ] || return 0
   python3 - "$ROLE_YAML" "$1" <<'PY'
@@ -77,6 +100,9 @@ API="$BASE/api/v1/workspaces/$WS"
 if [ -z "${PLANE_API_KEY:-}" ]; then
   KEY="$(workspace_key "$WS")"
   eval "PLANE_API_KEY=\${$KEY:-}"
+  if [ -z "${PLANE_API_KEY:-}" ] && [ -f "$FLEET_ENV" ]; then
+    PLANE_API_KEY="$(dotenv_value "$FLEET_ENV" "$KEY")"
+  fi
   export PLANE_API_KEY
 fi
 

package/templates/hermes-agent/template/.scripts/secret-scan.py

@@ -8,45 +8,111 @@ import re
 from pathlib import Path
 
 KEY_VALUE = re.compile(
-    r"(?im)^\s*[\"']?(?:api[_-]?key|token|secret|password|authorization|cookie|client[_-]?secret|private[_-]?key)[\"']?\s*[:=]\s*[\"']?([^\s\"'#][^\r\n#]*)"
+    r"(?im)^\s*[\"']?(?P<key>api[_-]?key|token|secret|password|authorization|cookie|client[_-]?secret|private[_-]?key)[\"']?\s*[:=]\s*(?P<value>[^\r\n#]*)"
 )
 TOKEN = re.compile(
     r"(?:sk-[A-Za-z0-9_-]{12,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|tvly-[A-Za-z0-9_-]{10,}|fc-[A-Za-z0-9_-]{10,}|[0-9]{6,}:[A-Za-z0-9_-]{20,})"
 )
 PRIVATE_KEY = re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----")
-SAFE_VALUES = {"openrouter", "openai", "anthropic", "auto", "none", "null", "false", "true"}
-SKIP_PARTS = {".git", "__pycache__"}
+SAFE_VALUES = {
+    "openrouter",
+    "openai",
+    "anthropic",
+    "auto",
+    "none",
+    "null",
+    "false",
+    "true",
+}
+SAFE_PREFIXES = ("${", "$", "op://", "env:", "[REDACTED]", "{{", "{%")
+COMPUTED_VALUE = re.compile(r"^[A-Za-z_][A-Za-z0-9_.]*\s*(?:\(|\[)")
+INTERPOLATED_VALUE = re.compile(
+    r"(?:\$\{[A-Za-z_][A-Za-z0-9_]*[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*|\{[A-Za-z_][A-Za-z0-9_.]*\})"
+)
+ENV_ASSIGNMENT = re.compile(
+    r"(?m)^\s*(?:export\s+)?(?P<key>[A-Za-z_][A-Za-z0-9_]*)\s*=\s*(?P<value>[^\r\n#]*)"
+)
+SENSITIVE_ENV_KEY = re.compile(
+    r"(?i)(?:^|_)(?:api_key|token|secret|password|authorization|cookie|client_secret|private_key)(?:_|$)"
+)
+ALLOWED_ENV_FILES = {".env.example", ".env.op"}
+SKIP_PARTS = {
+    ".cache",
+    ".direnv",
+    ".eggs",
+    ".git",
+    ".mypy_cache",
+    ".nox",
+    ".npm",
+    ".pnpm-store",
+    ".pytest_cache",
+    ".ruff_cache",
+    ".tox",
+    ".turbo",
+    ".uv-cache",
+    ".venv",
+    ".yarn",
+    "__pycache__",
+    "dist-packages",
+    "node_modules",
+    "site-packages",
+    "venv",
+}
+
+
+def safe_assignment(raw_value: str) -> bool:
+    """Return true only for an explicit reference, sentinel, or computation."""
+
+    value = raw_value.strip().rstrip(",").strip().strip("\"'")
+    if not value or value.lower() in SAFE_VALUES:
+        return True
+    if value.startswith(SAFE_PREFIXES) or value.endswith("_ENV"):
+        return True
+    if INTERPOLATED_VALUE.search(value):
+        return True
+    # Source code commonly binds credentials from a runtime provider. A bare
+    # literal does not have a call/index boundary and remains fail-closed.
+    return COMPUTED_VALUE.match(value) is not None
+
+
+def safe_env_reference(raw_value: str) -> bool:
+    """Keep a tracked .env.op declarative: sensitive values stay references."""
+
+    value = raw_value.strip().rstrip(",").strip().strip("\"'")
+    return not value or value.startswith(SAFE_PREFIXES)
 
 
 def findings(root: Path) -> list[str]:
     result: list[str] = []
     for path in root.rglob("*"):
-        if not path.is_file() or any(part in SKIP_PARTS for part in path.parts):
+        relative = path.relative_to(root)
+        if not path.is_file() or any(part in SKIP_PARTS for part in relative.parts):
             continue
         if path.name == "secret-scan.py":
             continue
-        if path.name.startswith(".env") and path.name != ".env.example":
-            result.append(f"forbidden secret file: {path.relative_to(root)}")
+        if path.name.startswith(".env") and path.name not in ALLOWED_ENV_FILES:
+            result.append(f"forbidden secret file: {relative}")
             continue
         if path.name in {"auth.json", "auth.lock"} or path.suffix in {".pem", ".key"}:
-            result.append(f"forbidden credential file: {path.relative_to(root)}")
+            result.append(f"forbidden credential file: {relative}")
             continue
         try:
             text = path.read_text(encoding="utf-8")
         except (UnicodeDecodeError, OSError):
             continue
         if TOKEN.search(text) or PRIVATE_KEY.search(text):
-            result.append(f"credential token pattern: {path.relative_to(root)}")
+            result.append(f"credential token pattern: {relative}")
+        if path.name == ".env.op":
+            for match in ENV_ASSIGNMENT.finditer(text):
+                if SENSITIVE_ENV_KEY.search(
+                    match.group("key")
+                ) and not safe_env_reference(match.group("value")):
+                    result.append(f"literal credential assignment: {relative}")
+                    break
         for match in KEY_VALUE.finditer(text):
-            value = match.group(1).strip().strip("\"'").rstrip(",")
-            if (
-                not value
-                or value.lower() in SAFE_VALUES
-                or value.startswith(("${", "$", "op://", "env:", "[REDACTED]"))
-                or value.endswith("_ENV")
-            ):
+            if safe_assignment(match.group("value")):
                 continue
-            result.append(f"literal credential assignment: {path.relative_to(root)}")
+            result.append(f"literal credential assignment: {relative}")
             break
     return sorted(set(result))
 

package/templates/hermes-agent/template/SOUL.md.jinja

@@ -15,10 +15,10 @@ You are **{{ display_name }}** — a Hermes agent provisioned to work inside the
 
 ## Scope
 
-Your HERMES_HOME is the local runtime at `./runtime/`; Hermes loads its
-`config.yaml` directly. Secrets, SOUL, skills, sessions, and gateway state live
-local to that runtime (pure-local state; durable memory is the shared Hindsight
-bank — see Memory hygiene).
+Your HERMES_HOME is the real named profile under `~/.hermes/profiles/`. Shared
+config/auth/skills link to fleet truth; your SOUL, sessions, memory, and other
+owned state link into the ignored local `./runtime/`. Only PJangler may repair
+that wiring (`pj migrate hermes.runtime-singleton`).
 
 ## Tone
 

package/templates/hermes-agent/template/hermes.jinja

@@ -1,11 +1,28 @@
 #!/usr/bin/env bash
-# Launcher for {{ agent_id }}. Resolves HERMES_HOME to the local runtime
+# Launcher for {{ agent_id }}. Resolves HERMES_HOME to the agent's NAMED PROFILE
 # and execs the shared fleet Hermes binary configured in ~/.hermes/fleet.env.
 
 set -euo pipefail
 
 ROLE_DIR="$(cd "$(dirname "$0")" && pwd)"
-HERMES_HOME="$ROLE_DIR/runtime"
+RUNTIME_HOME="$ROLE_DIR/runtime"
+
+FLEET_HOME="${HERMES_FLEET_HOME:-$HOME/.hermes}"
+PROFILE_NAME="${HERMES_PROFILE_NAME:-{{ agent_id }}}"
+
+# Singleton-runtime contract: HERMES_HOME MUST be the named profile dir, never
+# the raw runtime path. Hermes derives the profile identity from the UNRESOLVED
+# HERMES_HOME path; any HERMES_HOME that is neither under ~/.hermes nor a child
+# of a "profiles" dir makes get_active_profile_name() report "default" and
+# _global_auth_file_path() return None — silently disabling shared fleet auth
+# and giving the agent a divergent config.yaml. The profile dir is a REAL dir
+# whose shared entries (config.yaml, .env, skills) symlink to the fleet root
+# and whose owned entries (memories, sessions, state.db, ...) symlink into
+# $RUNTIME_HOME. Provision it with: pj migrate hermes.runtime-singleton
+HERMES_HOME="$FLEET_HOME/profiles/$PROFILE_NAME"
+if ! REPO_ROOT="$(git -C "$ROLE_DIR" rev-parse --show-toplevel 2>/dev/null)"; then
+  REPO_ROOT="$ROLE_DIR"
+fi
 
 FLEET_ENV="${HERMES_FLEET_ENV:-$HOME/.hermes/fleet.env}"
 if [[ -f "$FLEET_ENV" ]]; then
@@ -47,16 +64,28 @@ HERMES_BIN="${HERMES_BIN:-${HERMES_FLEET_BIN:-}}"
 if [[ -z "$HERMES_BIN" ]]; then
   HERMES_BIN="$(config_get fleet.hermes_bin "")"
 fi
-HERMES_BIN="${HERMES_BIN:-$HOME/.hermes/hermes-agent/.venv/bin/hermes}"
-HERMES_OAUTH_FILE="${HERMES_OAUTH_FILE:-${HERMES_FLEET_OAUTH_FILE:-$(config_get fleet.oauth_file "$HOME/.hermes/auth.json")}}"
+HERMES_BIN="${HERMES_BIN:-$HOME/.local/share/hermes-agent/releases/0408fec7a153e6c32c064acd2b8053917f1525f1/.venv/bin/hermes}"
 CODEX_HOME="${CODEX_HOME:-${HERMES_FLEET_CODEX_HOME:-$(config_get fleet.codex_home "$HOME/.codex")}}"
 
-if [[ ! -d "$HERMES_HOME" ]]; then
-  echo "hermes: local runtime not provisioned at $HERMES_HOME" >&2
+if [[ ! -d "$RUNTIME_HOME" ]]; then
+  echo "hermes: local runtime not provisioned at $RUNTIME_HOME" >&2
   echo "  fix: run $ROLE_DIR/.scripts/20-runtime-repo.sh" >&2
   exit 1
 fi
 
+if [[ ! -d "$HERMES_HOME" ]]; then
+  echo "hermes: profile not provisioned at $HERMES_HOME" >&2
+  echo "  fix: pj migrate hermes.runtime-singleton" >&2
+  exit 1
+fi
+
+if [[ -L "$HERMES_HOME" ]]; then
+  echo "hermes: $HERMES_HOME is a symlink; the profile dir must be a REAL dir" >&2
+  echo "  (a symlink breaks profile-name resolution and shared fleet auth)" >&2
+  echo "  fix: pj migrate hermes.runtime-singleton" >&2
+  exit 1
+fi
+
 if [[ ! -x "$HERMES_BIN" ]]; then
   echo "hermes: binary not executable at $HERMES_BIN" >&2
   echo "  set HERMES_BIN or HERMES_FLEET_BIN (in $FLEET_ENV) to the shared Hermes binary." >&2
@@ -64,5 +93,5 @@ if [[ ! -x "$HERMES_BIN" ]]; then
 fi
 
 exec env HERMES_HOME="$HERMES_HOME" HERMES_FLEET_ENV="$FLEET_ENV" \
-  HERMES_OAUTH_FILE="$HERMES_OAUTH_FILE" CODEX_HOME="$CODEX_HOME" \
+  CODEX_HOME="$CODEX_HOME" TERMINAL_CWD="$REPO_ROOT" \
   "$HERMES_BIN" "$@"

package/templates/hermes-agent/template/role.yaml.jinja

@@ -8,13 +8,20 @@ agent_id: {{ agent_id }}
 display_name: "{{ display_name }}"
 purpose: "{{ agent_purpose }}"
 
-# Inference target (empty = inherit from global ~/.hermes/config.yaml)
+# Process-local gateway inference target (empty = inherit from shared
+# ~/.hermes/config.yaml). key_env is a variable NAME only; its secret value is
+# injected at runtime and must never be written here.
 model:
   provider: "{{ model_provider }}"
   name: "{{ model_name }}"
+  base_url: "{{ model_base_url }}"
+  api_mode: "{{ model_api_mode }}"
+  key_env: "{{ model_key_env }}"
 
-# Hermes profile name. ~/.hermes/profiles/<name> symlinks to ./runtime/, so both
-# HERMES_HOME and `hermes --profile <name>` resolve to the local runtime.
+# Hermes profile name. ~/.hermes/profiles/<name> is a REAL directory managed by
+# `pj migrate hermes.runtime-singleton`: shared config/auth/skills link to the
+# fleet root while role-owned state links into ./runtime. Never replace the
+# named profile with a symlink to runtime.
 profile: {{ agent_id }}
 
 # Telegram bot identity (one bot per agent — see docs/architecture.md).
@@ -71,12 +78,15 @@ plane:
 # reads the fleet registry and routes canonical commands by target_agent_id;
 # this profile does not install its own NATS consumer or inbox bridge.
 bloodbank:
+  # Quarantine gate: discovery is safe; execution requires explicit activation.
+  enabled: false
   gateway_scope: fleet
   target_agent_id: "{{ agent_id }}"
   producer: "hermes-agent:{{ agent_id }}"
 
-# Pure-local HERMES_HOME. The legacy GitHub identity remains metadata-only for
-# locating old archives; provisioning never creates or attaches a submodule.
+# Pure-local role-owned state. HERMES_HOME itself is the named profile directory
+# above; the legacy GitHub identity remains metadata-only for locating old
+# archives, and provisioning never creates or attaches a submodule.
 runtime:
   # Empty owner -> resolved from config.toml [github].runtime_repo_owner.
   github_owner: "{{ runtime_repo_owner }}"