@delorenj/pjangler 1.2.33 → 1.3.7

package/templates/commonproject/template/.mise/scripts/provision-packs.py

@@ -19,9 +19,10 @@ What this script owns is the transactional projection into the project:
     one unsafe or tampered pack produces ZERO mutation
   * `.agents/skills.json` is rewritten atomically, preserving its mode
 
-Backwards compatibility: a project that declares no `bmad` pack still gets the
-pinned BMAD pack expanded into `skills[]`, exactly as before. Declaring
-`{"name": "bmad", ...}` in `packs[]` takes over and the pin is not consulted.
+Only packs a project DECLARES in `packs[]` are provisioned. Nothing is pinned
+implicitly -- in particular BMAD is not a pack: `bmad-method install` writes
+bmad-* skills into `.agents/skills` itself, versioned per project by
+`_bmad/_config/manifest.yaml`.
 """
 
 from __future__ import annotations
@@ -40,11 +41,12 @@ from typing import Callable
 SKILLS_SCHEMA = "https://raw.githubusercontent.com/delorenj/skillex/main/skills.schema.json"
 SKILLS_REGISTRY = "https://github.com/delorenj/skillex.git"
 
-# The BMAD pack pinned when a project declares none. Sealed from this side so
-# the pinned release is verified byte-for-byte even though its `pack.toml`
-# predates `[policy] sealed`.
-BMAD_PACK_NAME = "bmad"
-BMAD_PACK_VERSION = "6.10.1-next.31"
+# BMAD is NOT a pack. `bmad-method install` writes bmad-* skills into
+# .agents/skills itself, per project, versioned by _bmad/_config/manifest.yaml.
+# This script used to pin a frozen `packs/bmad/<version>` in the registry and
+# project a second copy of the same skills; when the registry dropped that pack
+# the pin took every `pjangler project create` down with it on any machine
+# without a warm cache. Only packs a project DECLARES are provisioned now.
 
 
 def load_engine():
@@ -68,38 +70,13 @@ engine = load_engine()
 
 
 def pack_root_override(name: str) -> Path | None:
-    """Developer/test pin for one pack root, e.g. `PJ_PACK_ROOT_HERMES_BASE`.
-
-    `PJ_BMAD_PACK_ROOT` predates the generic form and stays a first-class alias
-    for the `bmad` pack.
-    """
+    """Developer/test pin for one pack root, e.g. `PJ_PACK_ROOT_HERMES_BASE`."""
     generic = os.environ.get(f"PJ_PACK_ROOT_{re.sub(r'[^A-Z0-9]', '_', name.upper())}", "").strip()
     if generic:
         return Path(generic).expanduser().absolute()
-    if name == BMAD_PACK_NAME:
-        legacy = os.environ.get("PJ_BMAD_PACK_ROOT", "").strip()
-        if legacy:
-            return Path(legacy).expanduser().absolute()
     return None
 
 
-def implicit_bmad_entry() -> dict:
-    """The implicit BMAD pin, expressed as an ordinary `packs[]` entry.
-
-    It deliberately carries NO `source`: like every declared pack it must walk
-    the one resolution ladder in `resolve_pack_root()` -- env override first,
-    then the contract-ordered registry checkouts. Pinning a hardcoded root here
-    would give the same pack name two resolutions in one process, so adding
-    `packs:[{"name":"bmad",...}]` to a manifest would silently MOVE the pack.
-    """
-    return {
-        "name": BMAD_PACK_NAME,
-        "version": BMAD_PACK_VERSION,
-        "sealed": True,
-        "optional": False,
-    }
-
-
 def apply_root_override(entry: dict) -> dict:
     """Pin a declared pack at an overridden root without changing its identity."""
     if entry.get("source") or entry.get("registry_path"):
@@ -150,24 +127,11 @@ def resolve_declared_packs(manifest: dict, base_dir: Path):
             # Later packs override earlier ones (contract section 5).
             declared_members[name] = path
 
+    # Nothing is pinned implicitly any more. The empty pair is kept so every
+    # caller keeps one shape and the manifest writer still evicts leftovers
+    # from when something WAS pinned here.
     implicit_members: dict[str, Path] = {}
     implicit_packs: list[dict] = []
-    if not any(entry["name"] == BMAD_PACK_NAME for entry in entries):
-        # Same call shape as a declared pack above, so the pin cannot resolve
-        # anywhere a declared `bmad` entry would not.
-        pinned = engine.normalize_pack_entry(apply_root_override(implicit_bmad_entry()))
-        pinned["sealed"] = True
-        for name, path in engine.resolve_pack(
-            pinned,
-            cache_dir,
-            base_dir,
-            default_registry,
-            registry_roots,
-            managed_roots,
-            on_resolved=implicit_packs.append,
-        ):
-            implicit_members[name] = path
-
     return declared_members, implicit_members, declared_packs, implicit_packs
 
 

package/templates/commonproject/template/mise.toml.jinja

@@ -39,43 +39,43 @@ script = "'{% raw %}{{config_root}}{% endraw %}/.agents/hooks/sync.py' --uninsta
 
 [[watch_files]]
 patterns = ["AGENTS.md"]
-task = "link-agentfiles"
+task = "link:agentfiles"
 [[watch_files]]
 patterns = [".agents/skills.json"]
-task = "skills-sync"
+task = "skills:sync"
 {% if agent_hooks_layer %}
 # Re-fan-out the agent hooks whenever the single source of truth changes.
 [[watch_files]]
 patterns = [".agents/hooks/hooks.master.json"]
-task = "hooks-sync"
+task = "hooks:sync"
 {% endif %}
-[tasks.link-agentfiles]
+[tasks."link:agentfiles"]
 description = "Symlink all agent files to AGENTS.md"
 run = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh'"
 
-[tasks.skills-sync]
+[tasks."skills:sync"]
 description = "Sync skills from manifest to local CLI dirs"
-depends = ["skills-provision-packs"]
+depends = ["skills:provision:packs"]
 run = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/sync-skills.py' --scope project"
 
-[tasks.skills-provision-packs]
+[tasks."skills:provision:packs"]
 description = "Provision every Skillex pack declared in .agents/skills.json"
 run = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/provision-packs.py'"
 {% if agent_hooks_layer %}
 # --- Project-scoped agent hooks + skill fan-out (see .agents/hooks/README.md) ---
 
-[tasks.hooks-sync]
+[tasks."hooks:sync"]
 description = "Fan out .agents/hooks/hooks.master.json to each agent CLI (claude committed; codex/kimi injected; hermes adapter)"
 run = "'{% raw %}{{config_root}}{% endraw %}/.agents/hooks/sync.py' --install"
 
-[tasks.hooks-check]
+[tasks."hooks:check"]
 description = "Drift gate: verify generated hook configs match hooks.master.json (CI-safe, read-only)"
 run = "'{% raw %}{{config_root}}{% endraw %}/.agents/hooks/sync.py' --check"
 
-[tasks.hooks-uninstall]
+[tasks."hooks:uninstall"]
 description = "Remove per-user agent-hook injections (codex/kimi/hermes)"
 run = "'{% raw %}{{config_root}}{% endraw %}/.agents/hooks/sync.py' --uninstall"
 {% endif %}
-[tasks.hindsight-setup]
+[tasks."hindsight:setup"]
 description = "Provision this dev's shared project Hindsight key from 1Password into .env (op read; upserts those two keys, leaves the rest of .env intact)"
 run = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/hindsight-setup.sh'"

package/templates/hermes-agent/copier.yml

@@ -10,10 +10,10 @@
 #
 # What it does:
 #   1. Renders agents/hermes/<role>/{role.yaml, SOUL.md, hermes, .scripts/}
-#   2. Creates ignored local state at agents/hermes/<role>/runtime/
-#      (this is HERMES_HOME; no project gitlink or runtime remote)
+#   2. Creates ignored local state at agents/hermes/<role>/runtime/ and delegates
+#      named-profile wiring to `pj migrate hermes.runtime-singleton`
 #   4. Creates a Plane project in 33god workspace
-#   6. Prompts for a BotFather Telegram token, stores in runtime/.env
+#   6. Prompts for a BotFather Telegram token, stores in ignored runtime state
 #   7. Optionally wires a dedicated Slack app+bot pair into runtime/.env
 #   8. Records fleet-shared Bloodbank routing identity (no profile consumer)
 #   9. Installs a profile gateway + heartbeat timer (reconcile + checkpoint)
@@ -46,16 +46,14 @@ target_repo:
 
 role:
   type: str
-  help: "Role for this agent"
+  help: "Role for this agent (safe single path segment; arbitrary roles are supported)"
   default: pm
-  choices:
-    "Project Manager (pm)": pm
-    "Developer (dev)": dev
-    "Reviewer (review)": review
-    "Company Reporter — daily cross-project rollup (reporter)": reporter
-    "Ops (ops)": ops
-    "QA (qa)": qa
-  validator: "{% if not role %}Required{% endif %}"
+  validator: >-
+    {% set alnum = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789' -%}
+    {% set safe_chars = alnum ~ '._-' -%}
+    {% if not role or role != role|trim or role in ['.', '..'] or role[0] not in alnum or role[-1] not in alnum or role|reject('in', safe_chars)|list|length -%}
+    Role must be a non-empty safe single path segment using letters, numbers, dots, underscores, or hyphens
+    {%- endif %}
 
 ticket_provider:
   type: str
@@ -69,7 +67,7 @@ ticket_provider:
 agent_purpose:
   type: str
   help: "One-line description of what this agent does in this repo"
-  default: "{% if role == 'reporter' %}Company-wide evidence gathering, freshness-aware daily reporting, and critical delivery monitoring{% else %}Project management, triage, and continuous board reconciliation{% endif %}"
+  default: "{% if role == 'reporter' %}Company-wide evidence gathering, freshness-aware daily reporting, and critical delivery monitoring{% elif role == 'director' %}Company-level portfolio orchestration, delegation, and cross-project control{% else %}Project management, triage, and continuous board reconciliation{% endif %}"
 
 model_provider:
   type: str
@@ -81,6 +79,28 @@ model_name:
   help: "Model name (empty = inherit from global ~/.hermes config)"
   default: ""
 
+model_base_url:
+  type: str
+  help: "Per-agent model API base URL (empty = inherit from shared config)"
+  default: ""
+
+model_api_mode:
+  type: str
+  help: "Per-agent model API protocol (empty = inherit from shared config)"
+  default: ""
+  choices:
+    "Inherit from shared config": ""
+    "OpenAI-compatible chat completions": chat_completions
+    "OpenAI Codex responses": codex_responses
+    "Anthropic messages": anthropic_messages
+    "AWS Bedrock converse": bedrock_converse
+    "Codex app server": codex_app_server
+
+model_key_env:
+  type: str
+  help: "Environment variable NAME holding the per-agent model key (never the key value)"
+  default: ""
+
 soul_tone:
   type: str
   help: "Tone for the agent's SOUL.md"
@@ -134,7 +154,7 @@ plane_workspace:
 # All scripts are idempotent — safe to re-run if a step fails.
 
 _tasks:
-  - "chmod +x .scripts/*.sh .scripts/sentinel/bin/*.sh hermes 2>/dev/null || true"
+  - "chmod +x .scripts/*.sh .scripts/sentinel/bin/*.sh hermes momo 2>/dev/null || true"
   - "./.scripts/00-banner.sh"
   - "./.scripts/01-config.sh"
   - "./.scripts/05-fleet-env.sh"

package/templates/hermes-agent/template/.runtime-scaffold/.gitignore.jinja

@@ -0,0 +1,44 @@
+# Per-agent runtime — what NOT to commit to the checkpoint repo.
+# Sensitive credentials never go in git.
+.env
+.env.*
+!.env.example
+auth.json
+auth.lock
+secrets.*
+*.pem
+*.key
+gateway.pid
+gateway_state.json
+processes.json
+interrupt_debug.log
+
+# Caches (large, regenerable)
+audio_cache/
+image_cache/
+models_dev_cache.json
+context_length_cache.yaml
+honcho.json
+
+# Sandboxes (ephemeral execution environments)
+sandboxes/
+
+# Heartbeat / sentinel ephemeral state — local to this runtime, never checkpointed.
+# (Keeps the fused checkpoint a true no-op on a clean tree.)
+continuous-ticket-sentinel-state.json
+continuous-ticket-sentinel.lock
+continuous-ticket-sentinel.lock.d/
+.last-checkpoint
+
+# Runtime logs (we want the LFS-tracked summary.log if we add one, not the noise)
+logs/*.log
+logs/*.systemd.log
+
+# Python cruft
+__pycache__/
+*.pyc
+.scripts/.done-*
+.scripts/.provision.log
+
+# Allow these subdirs to exist
+!logs/.gitkeep

package/templates/hermes-agent/template/.runtime-scaffold/README.md

@@ -1,21 +1,22 @@
 # {{agent_id}} — runtime
 
-This is the HERMES_HOME for the **{{display_name}}** agent. It is git-tracked
-so memory, SOUL evolution, and conversation history are durable across machines
-and recoverable on failure.
+This is the ignored, role-owned state for the **{{display_name}}** agent. The
+actual HERMES_HOME is a real named directory under `~/.hermes/profiles/`, with
+PJangler-managed links into this runtime. Back it up separately; it is not
+published by project Git.
 
 ## What's in here
 
 | Path | Tracked? | Purpose |
 | --- | --- | --- |
-| `config.yaml` | yes | Inference + skill config (cloned from global at provision time) |
-| `SOUL.md` | yes | The agent's personality, evolves over time |
-| `memories/MEMORY.md` | yes | The condensed mental-model summary loaded each session |
-| `memories/USER.md` | yes | The operator's persona (Jarad DeLorenzo, ...) |
-| `sessions/sessions.db` | yes (LFS) | SQLite store of every conversation |
-| `decisions/` | yes | Agent-emitted decisions, one file per important call |
+| `config.yaml` | local | Legacy seed/delta; shared profile config comes from fleet root |
+| `SOUL.md` | local | The agent's personality, evolves over time |
+| `memories/MEMORY.md` | local | The condensed mental-model summary loaded each session |
+| `memories/USER.md` | local | The operator's persona |
+| `sessions/sessions.db` | local | SQLite store of conversations |
+| `decisions/` | local | Agent-emitted decisions |
 | `.env` | **no** | API keys + Telegram bot token (per-machine secret) |
-| `auth.json` | **no** | Deprecated local OAuth store; fleet auth defaults to `HERMES_OAUTH_FILE=~/.hermes/auth.json` |
+| `auth.json` | **no** | Deprecated local OAuth store; named profiles use fleet auth fallback |
 | `audio_cache/`, `image_cache/` | **no** | Regenerable caches |
 | `sandboxes/` | **no** | Per-session ephemeral execution dirs |
 

package/templates/hermes-agent/template/.scripts/01-config.sh

@@ -1,6 +1,15 @@
 #!/usr/bin/env bash
 # Ensure the distributable config exists before any other step reads it.
 # Seeds ~/.config/hermes-agent-template/config.toml from the shipped example.
+
+# MCP render transactions establish repo-local lifecycle eligibility before
+# touching any host-global state. This guard must precede _lib.sh because that
+# library creates the role log and may read fleet configuration.
+if [[ "${SKIP_HOST_STATE:-0}" == "1" ]]; then
+  printf '%s\n' '[01] host config — DEFERRED (SKIP_HOST_STATE=1)' >&2
+  exit 0
+fi
+
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 
@@ -21,11 +30,11 @@ else
     cat > "$CONFIG" <<'TOML'
 # hermes-agent-template config — edit for your environment.
 [fleet]
-hermes_bin = "~/.hermes/hermes-agent/.venv/bin/hermes"
-hermes_repo = "~/.hermes/hermes-agent"
+hermes_bin = "~/.local/share/hermes-agent/releases/0408fec7a153e6c32c064acd2b8053917f1525f1/.venv/bin/hermes"
+hermes_repo = "~/.local/share/hermes-agent/releases/0408fec7a153e6c32c064acd2b8053917f1525f1"
 hermes_git_url = "https://github.com/delorenj/hermes-agent.git"
-hermes_git_ref = "feature/PJAN-19-routing-publication"
-hermes_git_sha = "113e1b182b6d72a7dd02a191f134a41668ceaf0e"
+hermes_git_ref = "main"
+hermes_git_sha = "0408fec7a153e6c32c064acd2b8053917f1525f1"
 fleet_env = "~/.hermes/fleet.env"
 registry_file = "~/.hermes/agents-registry.yaml"
 canonical_skills_dir = "/home/delorenj/.agents/skills"

package/templates/hermes-agent/template/.scripts/05-fleet-env.sh

@@ -1,5 +1,11 @@
 #!/usr/bin/env bash
 # Ensure a single shared fleet source-of-truth file exists.
+
+if [[ "${SKIP_HOST_STATE:-0}" == "1" ]]; then
+  printf '%s\n' '[05] fleet env — DEFERRED (SKIP_HOST_STATE=1)' >&2
+  exit 0
+fi
+
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 load_role_env
@@ -8,45 +14,29 @@ already_done 05-fleet-env && log "[05] fleet env already checked — refreshing
 
 mkdir -p "$(dirname "$FLEET_ENV")"
 
+new_fleet_env=0
 if [[ ! -f "$FLEET_ENV" ]]; then
   log "[05] creating fleet source-of-truth: $FLEET_ENV"
-  cat > "$FLEET_ENV" <<EOF
-# Hermes fleet source of truth.
-# All generated wrappers and provisioning scripts read this file.
-HERMES_FLEET_BIN=${HERMES_BIN}
-HERMES_FLEET_REPO=${HERMES_AGENT_REPO}
-HERMES_FLEET_REGISTRY_FILE=${REGISTRY_FILE}
-HERMES_FLEET_OAUTH_FILE=${HERMES_OAUTH_FILE}
-HERMES_FLEET_CODEX_HOME=${CODEX_HOME}
-EOF
-  chmod 600 "$FLEET_ENV"
+  new_fleet_env=1
 else
   log "[05] fleet env exists: $FLEET_ENV"
 fi
 
+fleet_env_parser="$ROLE_DIR/.scripts/lib/parse-fleet-env.py"
+fleet_env_python="$(builtin type -P python3)" \
+  || die "python3 is required to update the fleet source-of-truth"
+
 upsert_fleet_env() {
   local key="$1" value="$2"
-  python3 - "$FLEET_ENV" "$key" "$value" <<'PYEOF'
-import pathlib
-import sys
-
-path = pathlib.Path(sys.argv[1])
-key = sys.argv[2]
-value = sys.argv[3]
-line = f"{key}={value}"
-lines = path.read_text().splitlines() if path.exists() else []
-for idx, existing in enumerate(lines):
-    if existing.startswith(f"{key}="):
-        lines[idx] = line
-        break
-else:
-    lines.append(line)
-path.write_text("\n".join(lines) + "\n")
-PYEOF
+  "$fleet_env_python" -I "$fleet_env_parser" --upsert "$FLEET_ENV" "$key" "$value"
 }
 
+if [[ "$new_fleet_env" == "1" ]]; then
+  upsert_fleet_env HERMES_FLEET_BIN "$HERMES_BIN"
+  upsert_fleet_env HERMES_FLEET_REPO "$HERMES_AGENT_REPO"
+  upsert_fleet_env HERMES_FLEET_REGISTRY_FILE "$REGISTRY_FILE"
+fi
 upsert_fleet_env HERMES_FLEET_OAUTH_FILE "$HERMES_OAUTH_FILE"
 upsert_fleet_env HERMES_FLEET_CODEX_HOME "$CODEX_HOME"
-chmod 600 "$FLEET_ENV"
 
 mark_done 05-fleet-env

package/templates/hermes-agent/template/.scripts/10-hermes-profile.sh

@@ -1,10 +1,14 @@
 #!/usr/bin/env bash
-# Stage the per-agent runtime config/secrets via a TRANSIENT Hermes profile.
-# HERMES_HOME is the ignored ./runtime directory; this profile dir is a staging area
-# (cred-stripped .env + SOUL) that 20-runtime-repo.sh folds into the runtime and
-# then replaces with a symlink ~/.hermes/profiles/<name> -> ./runtime. That
-# symlink is load-bearing: hermes resolves `--profile <name>` invocations
-# through it (recreating it wrongly if it goes missing).
+# Create the initial named Hermes profile and sanitize cloned chat credentials.
+# The directory remains REAL. Step 20 delegates final shared-vs-owned link
+# topology to `pj migrate hermes.runtime-singleton`; no template step may
+# replace the profile itself with a symlink.
+
+if [[ "${SKIP_HOST_STATE:-0}" == "1" ]]; then
+  printf '%s\n' '[10] Hermes profile — DEFERRED (SKIP_HOST_STATE=1)' >&2
+  exit 0
+fi
+
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 load_role_env
@@ -14,9 +18,6 @@ already_done 10-hermes-profile && { log "[10] profile already created — skippi
 log "[10] creating hermes profile: $PROFILE_NAME"
 PROFILE_HOME="$HOME/.hermes/profiles/$PROFILE_NAME"
 
-# Set repo path to directory where .git is
-REPO_PATH="$(cd "$ROLE_DIR" && git rev-parse --show-toplevel 2>/dev/null || echo "$ROLE_DIR")"
-
 if [[ -d "$PROFILE_HOME" ]]; then
   log "    profile dir already exists; reusing"
 else
@@ -112,9 +113,57 @@ PYEOF
   fi
 fi
 
-# Apply role-specific config overrides.
-log "    setting terminal.cwd = $REPO_PATH"
-env HERMES_HOME="$PROFILE_HOME" "$HERMES_BIN" config set terminal.cwd "$REPO_PATH"
+# Never persist a project-specific terminal.cwd through the named profile.
+# The generated launchers pass TERMINAL_CWD process-locally instead.
+#
+# config.yaml is GENERATED, never hand-written and never a symlink to the fleet
+# base. It is deep_merge(~/.hermes/config.yaml, <profile>/config.delta.yaml).
+# The old symlink-to-base topology was actively harmful: Hermes' atomic writes
+# use os.replace, which REPLACES a symlink with a regular file, so the first
+# in-agent write (/model, onboarding, a config migration) silently detached the
+# profile onto a frozen copy of an old base — and a symlink gave the profile no
+# way to override anything in the first place.
+#
+# Seed an EMPTY delta: a new agent should be identical to the fleet base, and
+# every line here is an override someone must justify later.
+PROFILE_DELTA="$PROFILE_HOME/config.delta.yaml"
+if [[ ! -f "$PROFILE_DELTA" ]]; then
+  log "    seeding empty config.delta.yaml (override-only SSOT)"
+  cat > "$PROFILE_DELTA" <<'DELTA_EOF'
+# Override-only delta for this Hermes profile.
+# Merged over ~/.hermes/config.yaml to produce config.yaml (which is GENERATED).
+# Empty == identical to the fleet base. Add ONLY what must differ.
+{}
+DELTA_EOF
+  chmod 600 "$PROFILE_DELTA"
+fi
+
+# Pin the identity-memory bank explicitly rather than relying on the fleet
+# bank_id_template (agent-{profile}). {profile} resolves through Hermes'
+# get_active_profile_name(), which calls Path.resolve() on HERMES_HOME and
+# requires a lowercase id sitting directly under profiles/. A symlinked profile
+# dir or an uppercase name silently yields the literal "custom" — which would
+# merge this agent's PRIVATE memory into a bank shared with every other agent
+# that also failed to resolve.
+PROFILE_MEM_CFG="$PROFILE_HOME/hindsight/config.json"
+mkdir -p "$(dirname "$PROFILE_MEM_CFG")"
+if [[ ! -f "$PROFILE_MEM_CFG" ]]; then
+  log "    pinning identity-memory bank: agent-$PROFILE_NAME"
+  printf '{\n  "bank_id": "agent-%s"\n}\n' "$PROFILE_NAME" > "$PROFILE_MEM_CFG"
+  chmod 600 "$PROFILE_MEM_CFG"
+fi
+
+# Render config.yaml from base + delta when the renderer is available. Without
+# it the profile still boots (Hermes reads whatever config.yaml exists), but it
+# is not yet under inheritance and `pj audit` will say so.
+PROFILE_RENDERER="${PROFILE_RENDERER:-$HOME/code/33GOD/hermes-agent-template/scripts/hermes-profile-config.py}"
+if [[ -x "$PROFILE_RENDERER" || -f "$PROFILE_RENDERER" ]]; then
+  log "    rendering config.yaml from fleet base + delta"
+  python3 "$PROFILE_RENDERER" render --profile "$PROFILE_NAME" >/dev/null 2>&1 \
+    || warn "    render failed; run hermes-profile-config.py render --profile $PROFILE_NAME"
+else
+  warn "    profile renderer not found at $PROFILE_RENDERER — config.yaml not rendered"
+fi
 
 # Canonical shared-skill source of truth + local PM fallback sync.
 CANONICAL_SKILLS_DIR="${CANONICAL_SKILLS_DIR:-$(config_get fleet.canonical_skills_dir '/home/delorenj/.agents/skills')}"
@@ -122,8 +171,18 @@ CANONICAL_PM_SKILL_SRC="$CANONICAL_SKILLS_DIR/subagent-driven-development"
 LOCAL_PM_SKILL_DST="$PROFILE_HOME/skills/software-development/subagent-driven-development"
 
 if [[ -d "$CANONICAL_SKILLS_DIR" ]]; then
-  log "    setting skills.external_dirs[0] = $CANONICAL_SKILLS_DIR"
-  env HERMES_HOME="$PROFILE_HOME" "$HERMES_BIN" config set skills.external_dirs.0 "$CANONICAL_SKILLS_DIR"
+  # skills.external_dirs is a FLEET setting and already lives in
+  # ~/.hermes/config.yaml, so every rendered profile inherits it. Writing it
+  # per-profile here would (a) be redundant, and (b) write into the GENERATED
+  # config.yaml, where the next render discards it — the classic "I set it and
+  # it reverted" trap. Verify inheritance instead of re-asserting it.
+  if ! env HERMES_HOME="$PROFILE_HOME" "$HERMES_BIN" config get skills.external_dirs 2>/dev/null \
+       | grep -qF "$CANONICAL_SKILLS_DIR"; then
+    warn "    skills.external_dirs does not include $CANONICAL_SKILLS_DIR"
+    warn "    add it to the FLEET base (~/.hermes/config.yaml), then: hermes-profile-config.py render --all"
+  else
+    log "    skills.external_dirs inherited from fleet base: $CANONICAL_SKILLS_DIR"
+  fi
 
   # Ensure key PM/local-ops skills are symlinked into runtime/profile skills root.
   # This preserves canonical ownership and keeps updates instant across agents.

package/templates/hermes-agent/template/.scripts/20-runtime-repo.sh

@@ -6,8 +6,13 @@
 source "$(dirname "$0")/_lib.sh"
 load_role_env
 
-already_done 20-runtime-repo && { log "[20] local runtime already set up — skipping"; exit 0; }
-[[ "${SKIP_RUNTIME_REPO:-0}" == "1" ]] && { log "[20] local runtime — SKIPPED (SKIP_RUNTIME_REPO=1)"; mark_done 20-runtime-repo; exit 0; }
+already_done 20-runtime-repo \
+  && log "[20] local runtime scaffold already set up — re-auditing singleton profile wiring"
+if [[ "${SKIP_RUNTIME_REPO:-0}" == "1" ]]; then
+  clear_done 20-runtime-repo
+  log "[20] local runtime — DEFERRED (SKIP_RUNTIME_REPO=1; completion marker cleared)"
+  exit 0
+fi
 
 PROFILE_HOME="$HOME/.hermes/profiles/$PROFILE_NAME"
 RUNTIME_LOCAL="$ROLE_DIR/runtime"
@@ -123,30 +128,34 @@ if [[ ! -e "$RUNTIME_LOCAL/SOUL.md" ]]; then
   cp "$ROLE_DIR/SOUL.md" "$RUNTIME_LOCAL/SOUL.md"
 fi
 
-# Fold the two supported staging-profile files into the runtime without
-# deleting unknown profile content. Unknown content blocks the symlink so an
-# operator can reconcile it explicitly instead of losing state.
-if [[ -d "$PROFILE_HOME" && ! -L "$PROFILE_HOME" ]]; then
-  log "    migrating supported staging profile state into the local runtime"
-  # A reporter never inherits .env; its credentials must be provisioned
-  # explicitly against a bot identity it owns.
-  if [[ "$ROLE" == "reporter" ]]; then
-    MIGRATE_FILES=(config.yaml profile.yaml)
-  else
-    MIGRATE_FILES=(.env config.yaml)
-  fi
-  for file_name in "${MIGRATE_FILES[@]}"; do
-    [[ -f "$PROFILE_HOME/$file_name" && ! -e "$RUNTIME_LOCAL/$file_name" ]] && cp "$PROFILE_HOME/$file_name" "$RUNTIME_LOCAL/$file_name"
-    [[ -f "$PROFILE_HOME/$file_name" ]] && rm -f -- "$PROFILE_HOME/$file_name"
-  done
-  if ! rmdir "$PROFILE_HOME" 2>/dev/null; then
-    die "staging profile contains unrecognized state and was preserved: $PROFILE_HOME"
-  fi
+# Named-profile topology belongs exclusively to PJangler. Preview first, then
+# apply the one idempotent rule. This script never removes or replaces a real
+# profile directory and never creates the obsolete profile -> runtime symlink.
+if [[ "$PJANGLER_BIN" != */* ]]; then
+  PJANGLER_BIN="$(command -v "$PJANGLER_BIN" 2>/dev/null || true)"
 fi
-ln -sfn "$RUNTIME_LOCAL" "$PROFILE_HOME"
-log "    profile symlink $PROFILE_HOME -> $RUNTIME_LOCAL"
+[[ -n "$PJANGLER_BIN" && -x "$PJANGLER_BIN" ]] \
+  || die "PJángler CLI not found; install 'pj' or set PJANGLER_BIN"
+"$PJANGLER_BIN" migrate hermes.runtime-singleton "$PROJECT_PATH" --dry-run --json >/dev/null \
+  || die "singleton-runtime audit failed; profile was left untouched"
+"$PJANGLER_BIN" migrate hermes.runtime-singleton "$PROJECT_PATH" --json >/dev/null \
+  || die "singleton-runtime migration failed; inspect with: pj migrate hermes.runtime-singleton '$PROJECT_PATH' --dry-run"
+[[ -d "$PROFILE_HOME" && ! -L "$PROFILE_HOME" ]] \
+  || die "PJángler did not establish a real named profile at $PROFILE_HOME"
+log "    singleton profile verified by pj migrate hermes.runtime-singleton: $PROFILE_HOME"
 
-env HERMES_HOME="$RUNTIME_LOCAL" "$HERMES_BIN" config set terminal.cwd "$PROJECT_PATH" >/dev/null 2>&1 || true
+# Never persist a project-specific terminal.cwd through the named profile.
+# config.yaml is fleet-shared in the singleton topology.  The manual and
+# service launchers pass TERMINAL_CWD process-locally for this role instead.
+
+profile_config_set() {
+  local key="$1"
+  [[ -x "$HERMES_BIN" ]] \
+    || die "Hermes CLI is not executable; cannot configure named profile: $HERMES_BIN"
+  if ! env HERMES_HOME="$PROFILE_HOME" "$HERMES_BIN" config set "$@" >/dev/null; then
+    die "required Hermes config write failed for named profile $PROFILE_NAME: $key"
+  fi
+}
 
 if [[ "$ROLE" == "pm" ]]; then
   VOXXY_PLUGIN_DIR="${VOXXY_PLUGIN_DIR:-$(config_get fleet.voxxy_plugin_dir "$HOME/code/voxxy/plugins/tts/voxxy")}"
@@ -158,14 +167,10 @@ if [[ "$ROLE" == "pm" ]]; then
     warn "    Voxxy plugin dir missing: $VOXXY_PLUGIN_DIR"
   fi
 
-  if [[ -x "$HERMES_BIN" ]]; then
-    env HERMES_HOME="$RUNTIME_LOCAL" "$HERMES_BIN" config set plugins.enabled.0 tts/voxxy >/dev/null 2>&1 || true
-    env HERMES_HOME="$RUNTIME_LOCAL" "$HERMES_BIN" config set tts.provider voxxy >/dev/null 2>&1 || true
-    env HERMES_HOME="$RUNTIME_LOCAL" "$HERMES_BIN" config set tts.voice rick >/dev/null 2>&1 || true
-    log "    set PM runtime TTS provider -> voxxy"
-  else
-    warn "    Hermes bin missing; skipped PM Voxxy config"
-  fi
+  profile_config_set plugins.enabled.0 tts/voxxy
+  profile_config_set tts.provider voxxy
+  profile_config_set tts.voice rick
+  log "    set PM named-profile TTS provider -> voxxy"
 fi
 
 mark_done 20-runtime-repo