@delorenj/pjangler 1.2.9 → 1.2.13

package/dist/mcp-server.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/mcp-server.ts
-import { existsSync as existsSync9, statSync as statSync2 } from "node:fs";
-import { basename as basename4, dirname as dirname8, join as join12, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync10, statSync as statSync2 } from "node:fs";
+import { basename as basename4, dirname as dirname8, join as join13, resolve as resolve3 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -630,6 +630,8 @@ function renderHostConfig() {
   const hermesRepo = join3(home, "code", "hermes-agent");
   const scaffoldDir = join3(home, "code", "hermes-agent-template", "runtime-scaffold");
   const skillsDir = join3(home, ".agents", "skills");
+  const pmExternalSkillGlobalDir = join3(home, "code", "skillex", "skill-sets", "global", ".system");
+  const pmExternalSkillBmadDir = join3(home, "code", "skillex", "packs", "bmad", "6.10.2");
   return `# hermes-agent-template \u2014 host configuration
 # Bootstrapped by \`pjangler config bootstrap\` for $HOME=${home} (platform=${platform()}).
 #
@@ -645,9 +647,14 @@ home = "~/.hermes"
 hermes_bin = "${hermesBin}"
 hermes_repo = "${hermesRepo}"
 runtime_scaffold_dir = "${scaffoldDir}"
+# Shared fleet source-of-truth env file + fleet registry. ~ is expanded.
 fleet_env = "~/.hermes/fleet.env"
 registry_file = "~/.hermes/agents-registry.yaml"
 canonical_skills_dir = "${skillsDir}"
+pm_external_skill_dirs = [
+  "${pmExternalSkillGlobalDir}",
+  "${pmExternalSkillBmadDir}",
+]
 symlinked_runtime_skills = []
 
 [github]
@@ -895,10 +902,100 @@ var RunCopierTemplate = class extends Command {
   }
 };
 
-// src/commands/hermes/WireTelegram.ts
+// src/commands/hermes/UntrackHermesRuntimes.ts
+import { existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync3, readdirSync } from "fs";
+import { join as join6 } from "path";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { join as join6 } from "node:path";
-import { existsSync as existsSync4, unlinkSync } from "node:fs";
+var UntrackHermesRuntimes = class extends Command {
+  async invoke() {
+    const targetDir = this.context.targetDir;
+    const rolesDir = join6(targetDir, "agents", "hermes");
+    if (!existsSync4(rolesDir)) {
+      return {
+        success: true,
+        message: "No Hermes agents found (no agents/hermes directory)."
+      };
+    }
+    const roles = readdirSync(rolesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+    if (roles.length === 0) {
+      return {
+        success: true,
+        message: "No Hermes agents found."
+      };
+    }
+    let modifiedAny = false;
+    const details = [];
+    for (const role of roles) {
+      const roleDir = join6("agents", "hermes", role);
+      const runtimePath = join6(roleDir, "runtime");
+      const gitignorePath = join6(roleDir, ".gitignore");
+      let isTracked = false;
+      const lsResult = spawnSync2("git", ["ls-files", "--stage", runtimePath], {
+        cwd: targetDir,
+        encoding: "utf8"
+      });
+      if (lsResult.status === 0 && lsResult.stdout.trim().length > 0) {
+        isTracked = true;
+      }
+      let isIgnored = false;
+      const fullGitignorePath = join6(targetDir, gitignorePath);
+      if (existsSync4(fullGitignorePath)) {
+        const content = readFileSync2(fullGitignorePath, "utf8");
+        const lines = content.split(/\r?\n/).map((line) => line.trim());
+        isIgnored = lines.includes("runtime/") || lines.includes("runtime");
+      }
+      if (isTracked || !isIgnored) {
+        modifiedAny = true;
+        if (isTracked) {
+          details.push(`untrack agents/hermes/${role}/runtime`);
+          if (!this.context.dryRun) {
+            const rmResult = spawnSync2("git", ["rm", "--cached", "-r", runtimePath], {
+              cwd: targetDir,
+              encoding: "utf8"
+            });
+            if (rmResult.status !== 0) {
+              return {
+                success: false,
+                message: `Failed to untrack agents/hermes/${role}/runtime: ${rmResult.stderr}`
+              };
+            }
+          }
+        }
+        if (!isIgnored) {
+          details.push(`ignore runtime/ in agents/hermes/${role}/.gitignore`);
+          if (!this.context.dryRun) {
+            let content = "";
+            if (existsSync4(fullGitignorePath)) {
+              content = readFileSync2(fullGitignorePath, "utf8");
+            }
+            if (content && !content.endsWith("\n")) {
+              content += "\n";
+            }
+            content += "runtime/\n";
+            writeFileSync3(fullGitignorePath, content, "utf8");
+          }
+        }
+      }
+    }
+    if (!modifiedAny) {
+      return {
+        success: true,
+        message: "\u2705 All Hermes agent runtimes are already untracked and gitignored."
+      };
+    }
+    const actionText = this.context.dryRun ? "Would make" : "Made";
+    return {
+      success: true,
+      message: `${actionText} Hermes agent runtimes untracked and gitignored:
+${details.map((d) => `  - ${d}`).join("\n")}`
+    };
+  }
+};
+
+// src/commands/hermes/WireTelegram.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
+import { join as join7 } from "node:path";
+import { existsSync as existsSync5, unlinkSync } from "node:fs";
 import * as p3 from "@clack/prompts";
 var WireTelegram = class extends Command {
   async invoke() {
@@ -920,7 +1017,7 @@ var WireTelegram = class extends Command {
     let token = process.env.TELEGRAM_BOT_TOKEN;
     let source = token ? "env" : null;
     if (!token) {
-      const tryOp = spawnSync2("op", ["read", vaultRef], { encoding: "utf8" });
+      const tryOp = spawnSync3("op", ["read", vaultRef], { encoding: "utf8" });
       if (tryOp.status === 0) {
         token = tryOp.stdout.trim();
         source = "op";
@@ -959,7 +1056,7 @@ var WireTelegram = class extends Command {
         initialValue: true
       });
       if (!p3.isCancel(persist) && persist) {
-        const create = spawnSync2(
+        const create = spawnSync3(
           "op",
           [
             "item",
@@ -986,18 +1083,18 @@ var WireTelegram = class extends Command {
     if (p3.isCancel(allowedAnswer)) {
       return { success: false, message: "\u2717 Aborted; Telegram step deferred." };
     }
-    const script = join6(roleDir, ".scripts", "30-telegram.sh");
-    if (!existsSync4(script)) {
+    const script = join7(roleDir, ".scripts", "30-telegram.sh");
+    if (!existsSync5(script)) {
       return {
         success: false,
         message: `\u2717 ${script} not found.  Did copier finish?  Re-run with --skip-runtime-repo=0 if you skipped it.`
       };
     }
-    const marker = join6(roleDir, ".scripts", ".done-30-telegram");
-    if (existsSync4(marker)) unlinkSync(marker);
+    const marker = join7(roleDir, ".scripts", ".done-30-telegram");
+    if (existsSync5(marker)) unlinkSync(marker);
     const spinner4 = p3.spinner();
     spinner4.start("Verifying token + wiring profile");
-    const result = spawnSync2("bash", [script], {
+    const result = spawnSync3("bash", [script], {
       stdio: "inherit",
       env: {
         ...process.env,
@@ -1020,9 +1117,9 @@ function cap(s) {
 }
 
 // src/commands/hermes/WireEmail.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
-import { join as join7 } from "node:path";
-import { existsSync as existsSync5, unlinkSync as unlinkSync2 } from "node:fs";
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { join as join8 } from "node:path";
+import { existsSync as existsSync6, unlinkSync as unlinkSync2 } from "node:fs";
 import * as p4 from "@clack/prompts";
 var WireEmail = class extends Command {
   async invoke() {
@@ -1037,13 +1134,13 @@ var WireEmail = class extends Command {
     if (!targetRepo || !role || !roleDir) {
       return { success: false, message: "Cannot wire email: missing target_repo/role/roleDir" };
     }
-    const script = join7(roleDir, ".scripts", "50-email.sh");
-    if (!existsSync5(script)) {
+    const script = join8(roleDir, ".scripts", "50-email.sh");
+    if (!existsSync6(script)) {
       return { success: false, message: `\u2717 ${script} not found` };
     }
     let token = process.env.CF_EMAIL_ROUTING_TOKEN;
     if (!token) {
-      const tryOp = spawnSync3(
+      const tryOp = spawnSync4(
         "op",
         ["read", "op://DeLoSecrets/Cloudflare-EmailRouting/token"],
         { encoding: "utf8" }
@@ -1083,7 +1180,7 @@ var WireEmail = class extends Command {
         initialValue: true
       });
       if (!p4.isCancel(persist) && persist) {
-        const create = spawnSync3(
+        const create = spawnSync4(
           "op",
           [
             "item",
@@ -1100,11 +1197,11 @@ var WireEmail = class extends Command {
         }
       }
     }
-    const marker = join7(roleDir, ".scripts", ".done-50-email");
-    if (existsSync5(marker)) unlinkSync2(marker);
+    const marker = join8(roleDir, ".scripts", ".done-50-email");
+    if (existsSync6(marker)) unlinkSync2(marker);
     const spinner4 = p4.spinner();
     spinner4.start("Creating Cloudflare Email Routing rule");
-    const result = spawnSync3("bash", [script], {
+    const result = spawnSync4("bash", [script], {
       stdio: "inherit",
       env: { ...process.env, SKIP_EMAIL: "0", CF_EMAIL_ROUTING_TOKEN: token },
       cwd: roleDir
@@ -1164,7 +1261,7 @@ var PrintHermesSummary = class extends Command {
 var HermesAgentRecipe = class extends Recipe {
   constructor(context) {
     super(context);
-    this.addIngredient(EnsureTemplateConfig).addIngredient(PromptForAgentConfig).addIngredient(RunCopierTemplate).addIngredient(WireTelegram).addIngredient(WireEmail).addIngredient(PrintHermesSummary);
+    this.addIngredient(EnsureTemplateConfig).addIngredient(PromptForAgentConfig).addIngredient(RunCopierTemplate).addIngredient(UntrackHermesRuntimes).addIngredient(WireTelegram).addIngredient(WireEmail).addIngredient(PrintHermesSummary);
   }
   // Override execute() to suppress the base class's per-command logging since
   // our commands already render their own UI via @clack/prompts.
@@ -1188,33 +1285,33 @@ var HermesAgentRecipe = class extends Recipe {
 
 // src/commands/AgentHooksCommands.ts
 import { homedir as homedir4 } from "node:os";
-import { join as join9, dirname as dirname5 } from "node:path";
-import { existsSync as existsSync7, cpSync, mkdirSync as mkdirSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join10, dirname as dirname5 } from "node:path";
+import { existsSync as existsSync8, cpSync, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "node:fs";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/project/index.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync2, renameSync, statSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync3, renameSync, statSync, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { basename as basename2, dirname as dirname4, join as join8, resolve } from "node:path";
+import { basename as basename2, delimiter, dirname as dirname4, join as join9, resolve } from "node:path";
 import YAML from "yaml";
 var PROJECT_REGISTRY_ENV = "PJ_PROJECT_REGISTRY";
+var PROJECT_SOURCE_SKILL_ROOTS_ENV = "PJ_SOURCE_SKILL_ROOTS";
 var PROJECT_REGISTRY_SCHEMA_VERSION = 1;
-var KNOWN_SKILL_ROOTS = [
+var DEFAULT_SOURCE_SKILL_ROOTS = [
   "/home/delorenj/code/skillex/all-skills",
-  "/home/delorenj/code/CoachingAgentFramework/.agents/skills",
-  "/home/delorenj/code/pjangler/.agents/skills",
-  join8(homedir3(), ".codex", "skills")
+  join9(homedir3(), ".agents", "skills"),
+  join9(homedir3(), ".codex", "skills")
 ];
 function projectRegistryPath(env2 = process.env) {
-  return expandHome(env2[PROJECT_REGISTRY_ENV] || join8(homedir3(), ".config", "pjangler", "projects.yaml"));
+  return expandHome(env2[PROJECT_REGISTRY_ENV] || join9(homedir3(), ".config", "pjangler", "projects.yaml"));
 }
 function emptyProjectRegistry() {
   return { schema_version: PROJECT_REGISTRY_SCHEMA_VERSION, projects: {} };
 }
 function loadProjectRegistry(path = projectRegistryPath()) {
-  if (!existsSync6(path)) return emptyProjectRegistry();
-  const raw = YAML.parse(readFileSync2(path, "utf8"));
+  if (!existsSync7(path)) return emptyProjectRegistry();
+  const raw = YAML.parse(readFileSync3(path, "utf8"));
   if (raw == null) return emptyProjectRegistry();
   if (!isRecord(raw)) throw new Error(`Project registry must be a mapping: ${path}`);
   const registry = raw;
@@ -1229,7 +1326,7 @@ function saveProjectRegistry(registry, path = projectRegistryPath()) {
   validateProjectRegistry(registry);
   mkdirSync4(dirname4(path), { recursive: true });
   const temp = `${path}.${process.pid}.${Date.now()}.tmp`;
-  writeFileSync3(temp, YAML.stringify(registry, { lineWidth: 0 }), "utf8");
+  writeFileSync4(temp, YAML.stringify(registry, { lineWidth: 0 }), "utf8");
   renameSync(temp, path);
 }
 function validateProjectRegistry(registry) {
@@ -1274,8 +1371,7 @@ function buildTicketProviderBlock(input) {
       workspace: input.workspace ?? "",
       identifier: input.identifier,
       board_id: boardId,
-      board_url: input.boardUrl ?? (boardId ? `https://trello.com/b/${boardId}` : ""),
-      state: "planned"
+      state: boardId ? "linked" : "planned"
     };
   }
   const workspace = input.workspace ?? "33god";
@@ -1284,8 +1380,16 @@ function buildTicketProviderBlock(input) {
     workspace,
     identifier: input.identifier,
     board_id: boardId,
-    board_url: input.boardUrl ?? (boardId ? `https://plane.delo.sh/${workspace}/projects/${boardId}/issues/` : ""),
-    state: "planned"
+    state: boardId ? "linked" : "planned"
+  };
+}
+function defaultProjectAutomation() {
+  return {
+    reconcile: {
+      enabled: false,
+      grace_hours: 0,
+      auto_review: true
+    }
   };
 }
 function slugifyProjectName(value) {
@@ -1304,7 +1408,7 @@ function resolveAgentHooksLayer(input, env2 = process.env) {
   const override = env2.PJ_AGENT_HOOKS_LAYER;
   if (override === "0" || override === "false") return false;
   if (override === "1" || override === "true") return true;
-  return !existsSync6(join8(homedir3(), ".agents", "hooks"));
+  return !existsSync7(join9(homedir3(), ".agents", "hooks"));
 }
 function jsonStable(value) {
   return JSON.stringify(value);
@@ -1319,18 +1423,31 @@ function defaultProjectTargetDir(name, cwd = process.cwd()) {
   const compactName = name.replace(/[^A-Za-z0-9._-]/g, "") || slugifyProjectName(name);
   return resolve(dirname4(resolve(cwd)), compactName);
 }
-function resolveSourceSkillPath(sourceSkill) {
+function sourceSkillRoots(env2 = process.env) {
+  const configuredRoots = (env2[PROJECT_SOURCE_SKILL_ROOTS_ENV] || "").split(delimiter).map((root) => root.trim()).filter(Boolean);
+  const seen = /* @__PURE__ */ new Set();
+  const roots = [];
+  for (const root of [...DEFAULT_SOURCE_SKILL_ROOTS, ...configuredRoots]) {
+    const normalized = resolve(expandHome(root));
+    if (seen.has(normalized)) continue;
+    seen.add(normalized);
+    roots.push(normalized);
+  }
+  return roots;
+}
+function resolveSourceSkillPath(sourceSkill, env2 = process.env) {
   if (!sourceSkill) return void 0;
   const expanded = expandHome(sourceSkill);
   const direct = resolve(expanded);
-  if (existsSync6(direct)) return direct;
+  if (existsSync7(direct)) return direct;
   const name = basename2(sourceSkill);
-  for (const root of KNOWN_SKILL_ROOTS) {
-    const candidate = join8(root, name);
-    if (existsSync6(candidate)) return candidate;
+  const roots = sourceSkillRoots(env2);
+  for (const root of roots) {
+    const candidate = join9(root, name);
+    if (existsSync7(candidate)) return candidate;
   }
-  const civilWarLetterifier = "/home/delorenj/code/skillex/all-skills/civilwar-letterifier";
-  const hint = existsSync6(civilWarLetterifier) ? ` Did you mean ${civilWarLetterifier}?` : "";
+  const searched = roots.length ? ` Searched roots: ${roots.join(", ")}.` : "";
+  const hint = `${searched} Add project-specific roots with ${PROJECT_SOURCE_SKILL_ROOTS_ENV}.`;
   throw new Error(`Source skill not found: ${sourceSkill}.${hint}`);
 }
 function planProjectInit(input) {
@@ -1370,10 +1487,10 @@ function planProjectInit(input) {
       type: input.ticketProvider ?? "plane",
       identifier,
       boardId: input.boardId ?? input.planeProjectId,
-      boardUrl: input.boardUrl,
       workspace: input.boardWorkspace ?? input.planeWorkspace
     }),
     agents,
+    automation: existing?.automation ?? defaultProjectAutomation(),
     created_at: existing?.created_at ?? now,
     updated_at: now
   };
@@ -1401,7 +1518,6 @@ function planProjectInit(input) {
       planeProjectId: project.ticket_provider.board_id ?? "",
       ticketWorkspace: project.ticket_provider.workspace ?? "",
       boardId: project.ticket_provider.board_id ?? "",
-      boardUrl: project.ticket_provider.board_url ?? "",
       projectIdentifier: identifier,
       primaryLanguage: project.template.commonproject.primary_language,
       agentHooksLayer: resolveAgentHooksLayer(input.agentHooksLayer),
@@ -1409,7 +1525,7 @@ function planProjectInit(input) {
     }));
   }
   actions.push(
-    { kind: "project.write-manifest", path: join8(targetDir, ".project.json"), manifest },
+    { kind: "project.write-manifest", path: join9(targetDir, ".project.json"), manifest },
     {
       kind: "ticket-provider.create-or-link",
       enabled: live,
@@ -1450,7 +1566,7 @@ function executeProjectInitPlan(plan) {
         action.data.agent_hooks_layer === "false" ? "commonproject: agent-hooks layer skipped (global ~/.agents/hooks detected \u2014 no per-user CLI injection)" : "commonproject: agent-hooks layer included"
       );
       mkdirSync4(dirname4(action.targetDir), { recursive: true });
-      const result = spawnSync4(action.command[0], action.command.slice(1), { encoding: "utf8", cwd: action.cwd });
+      const result = spawnSync5(action.command[0], action.command.slice(1), { encoding: "utf8", cwd: action.cwd });
       if (result.stdout?.trim()) logs.push(result.stdout.trim());
       if (result.stderr?.trim()) logs.push(result.stderr.trim());
       if (result.error) {
@@ -1462,7 +1578,7 @@ function executeProjectInitPlan(plan) {
       }
       if (result.status !== 0) {
         errors.push(`copier exited with status ${result.status ?? "unknown"}`);
-        if (existsSync6(action.targetDir)) changedFiles.push(action.targetDir);
+        if (existsSync7(action.targetDir)) changedFiles.push(action.targetDir);
         break;
       }
       changedFiles.push(action.targetDir);
@@ -1470,9 +1586,9 @@ function executeProjectInitPlan(plan) {
       mkdirSync4(dirname4(action.path), { recursive: true });
       const next = `${JSON.stringify(action.manifest, null, 2)}
 `;
-      const current = existsSync6(action.path) ? readFileSync2(action.path, "utf8") : void 0;
+      const current = existsSync7(action.path) ? readFileSync3(action.path, "utf8") : void 0;
       if (current !== next) {
-        writeFileSync3(action.path, next, "utf8");
+        writeFileSync4(action.path, next, "utf8");
         changedFiles.push(action.path);
       }
     } else if (action.kind === "registry.upsert") {
@@ -1513,10 +1629,10 @@ function projectManifestFromRegistryProject(project) {
       workspace: project.ticket_provider.workspace ?? "",
       identifier: project.ticket_provider.identifier ?? "",
       board_id: project.ticket_provider.board_id ?? "",
-      board_url: project.ticket_provider.board_url ?? "",
       state: project.ticket_provider.state
     },
-    agents
+    agents,
+    automation: project.automation ?? defaultProjectAutomation()
   };
 }
 function getProject(registry, slug) {
@@ -1525,7 +1641,7 @@ function getProject(registry, slug) {
   return project;
 }
 function buildCommonProjectCopierAction(input) {
-  const templateDir = join8(input.pjanglerRoot, "templates", "commonproject");
+  const templateDir = join9(input.pjanglerRoot, "templates", "commonproject");
   const data = {
     project_name: input.projectName,
     project_description: input.projectDescription ?? "",
@@ -1535,7 +1651,6 @@ function buildCommonProjectCopierAction(input) {
     plane_project_id: input.planeProjectId ?? "",
     ticket_workspace: input.ticketWorkspace ?? input.planeWorkspace,
     board_id: input.boardId ?? input.planeProjectId ?? "",
-    board_url: input.boardUrl ?? "",
     project_identifier: input.projectIdentifier,
     primary_language: input.primaryLanguage,
     agent_hooks_layer: input.agentHooksLayer ?? true ? "true" : "false"
@@ -1555,7 +1670,7 @@ function buildCommonProjectCopierAction(input) {
 function resolvePjanglerRoot() {
   let dir = dirname4(new URL(import.meta.url).pathname);
   while (dir !== dirname4(dir)) {
-    if (existsSync6(join8(dir, "package.json")) && existsSync6(join8(dir, "templates", "commonproject", "copier.yml"))) return dir;
+    if (existsSync7(join9(dir, "package.json")) && existsSync7(join9(dir, "templates", "commonproject", "copier.yml"))) return dir;
     dir = dirname4(dir);
   }
   return resolve(process.cwd());
@@ -1587,7 +1702,7 @@ function validateProjectRecord(project, key) {
 }
 function expandHome(path) {
   if (path === "~") return homedir3();
-  if (path.startsWith("~/")) return join8(homedir3(), path.slice(2));
+  if (path.startsWith("~/")) return join9(homedir3(), path.slice(2));
   return path;
 }
 function isRecord(value) {
@@ -1604,16 +1719,16 @@ function resolveTemplateRoot() {
   try {
     let dir = dirname5(fileURLToPath2(import.meta.url));
     for (let i = 0; i < 8; i++) {
-      candidates.push(join9(dir, "templates", "commonproject", "template"));
+      candidates.push(join10(dir, "templates", "commonproject", "template"));
       const parent = dirname5(dir);
       if (parent === dir) break;
       dir = parent;
     }
   } catch {
   }
-  candidates.push(join9(homedir4(), "code", "pjangler", "templates", "commonproject", "template"));
+  candidates.push(join10(homedir4(), "code", "pjangler", "templates", "commonproject", "template"));
   for (const c of candidates) {
-    if (existsSync7(join9(c, ".agents", "hooks", "hooks.master.json"))) return c;
+    if (existsSync8(join10(c, ".agents", "hooks", "hooks.master.json"))) return c;
   }
   throw new Error(
     "Could not locate the CommonProject template. Set PJANGLER_COMMONPROJECT_TEMPLATE to <repo>/templates/commonproject/template."
@@ -1640,10 +1755,10 @@ var CopyAgentHooksTree = class extends Command {
     const created = [];
     const skipped = [];
     for (const { rel, dir } of items) {
-      const src = join9(templateRoot, rel);
-      const dest = join9(this.context.targetDir, rel);
-      if (!existsSync7(src)) continue;
-      if (existsSync7(dest) && !this.context.force) {
+      const src = join10(templateRoot, rel);
+      const dest = join10(this.context.targetDir, rel);
+      if (!existsSync8(src)) continue;
+      if (existsSync8(dest) && !this.context.force) {
         skipped.push(rel);
         continue;
       }
@@ -1669,14 +1784,14 @@ var WireMiseAgentHooks = class _WireMiseAgentHooks extends Command {
     if (!resolveAgentHooksLayer()) {
       return { success: true, message: this.formatMessage(AGENT_HOOKS_SKIP_MESSAGE) };
     }
-    const misePath = join9(this.context.targetDir, "mise.toml");
-    if (!existsSync7(misePath)) {
+    const misePath = join10(this.context.targetDir, "mise.toml");
+    if (!existsSync8(misePath)) {
       return {
         success: false,
         message: "\u26A0\uFE0F  No mise.toml found \u2014 run `pjangler init mise` first, then re-run."
       };
     }
-    let content = readFileSync3(misePath, "utf8");
+    let content = readFileSync4(misePath, "utf8");
     if (content.includes(_WireMiseAgentHooks.MARKER)) {
       return { success: true, message: this.formatMessage("\u2713 mise.toml already wired for agent-hooks") };
     }
@@ -1752,7 +1867,7 @@ ${leaveBlock}`);
       ""
     ].join("\n");
     content = content.replace(/\n*$/, "\n") + appended;
-    if (!this.context.dryRun) writeFileSync4(misePath, content);
+    if (!this.context.dryRun) writeFileSync5(misePath, content);
     if (wiredHooks) {
       return { success: true, message: this.formatMessage("\u2705 Wired mise.toml ([hooks] enter/leave + tasks)") };
     }
@@ -1906,15 +2021,15 @@ function createRecipe(name, context) {
 }
 
 // src/utils/version.ts
-import { readFileSync as readFileSync4 } from "node:fs";
-import { dirname as dirname6, join as join10 } from "node:path";
+import { readFileSync as readFileSync5 } from "node:fs";
+import { dirname as dirname6, join as join11 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var PJANGLER_VERSION = (() => {
   try {
     let dir = dirname6(fileURLToPath3(import.meta.url));
     for (let i = 0; i < 4; i++) {
       try {
-        const raw = readFileSync4(join10(dir, "package.json"), "utf8");
+        const raw = readFileSync5(join11(dir, "package.json"), "utf8");
         return JSON.parse(raw).version ?? "0.0.0";
       } catch {
         const parent = dirname6(dir);
@@ -1928,11 +2043,11 @@ var PJANGLER_VERSION = (() => {
 })();
 
 // src/parity/index.ts
-import { existsSync as existsSync8, lstatSync, mkdirSync as mkdirSync6, readFileSync as readFileSync5, readlinkSync, readdirSync, renameSync as renameSync2, symlinkSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync5, chmodSync as chmodSync2, copyFileSync } from "node:fs";
-import { basename as basename3, dirname as dirname7, join as join11, relative, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync9, lstatSync, mkdirSync as mkdirSync6, readFileSync as readFileSync6, readlinkSync, readdirSync as readdirSync2, renameSync as renameSync2, symlinkSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync6, chmodSync as chmodSync2, copyFileSync } from "node:fs";
+import { basename as basename3, dirname as dirname7, join as join12, relative, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { homedir as homedir5 } from "node:os";
-import { spawnSync as spawnSync5 } from "node:child_process";
+import { spawnSync as spawnSync6 } from "node:child_process";
 var LINK_AGENTFILES_BLOCK = `# This block will handle the linking of
 # agent files to the main AGENTS.md file.
 #
@@ -2003,7 +2118,7 @@ run = "{{config_root}}/.mise/scripts/versioning.sh sync"
 function resolvePjanglerRoot2() {
   let dir = dirname7(fileURLToPath4(import.meta.url));
   while (dir !== dirname7(dir)) {
-    if (existsSync8(join11(dir, "package.json")) && existsSync8(join11(dir, "templates", "commonproject", "copier.yml"))) {
+    if (existsSync9(join12(dir, "package.json")) && existsSync9(join12(dir, "templates", "commonproject", "copier.yml"))) {
       return dir;
     }
     dir = dirname7(dir);
@@ -2014,17 +2129,17 @@ function normalizeNewlines(value) {
   return value.replace(/\r\n/g, "\n");
 }
 function readText(path) {
-  return normalizeNewlines(readFileSync5(path, "utf8"));
+  return normalizeNewlines(readFileSync6(path, "utf8"));
 }
 function safeReadText(path) {
-  return existsSync8(path) ? readText(path) : null;
+  return existsSync9(path) ? readText(path) : null;
 }
 function ensureParent(path) {
   mkdirSync6(dirname7(path), { recursive: true });
 }
 function writeText(path, content) {
   ensureParent(path);
-  writeFileSync5(path, content);
+  writeFileSync6(path, content);
 }
 function tryParseJson(text2) {
   if (!text2) return null;
@@ -2041,7 +2156,7 @@ function titleCaseSlug(slug) {
   return slug.split(/[-_]/g).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
 function readSymlinkTarget(path) {
-  if (!existsSync8(path)) return null;
+  if (!existsSync9(path)) return null;
   try {
     return readlinkSync(path);
   } catch {
@@ -2049,7 +2164,7 @@ function readSymlinkTarget(path) {
   }
 }
 function ensureSymlink(path, target, dryRun) {
-  if (existsSync8(path)) {
+  if (existsSync9(path)) {
     const stat = lstatSync(path);
     if (stat.isSymbolicLink()) {
       const current = readSymlinkTarget(path);
@@ -2066,11 +2181,11 @@ function ensureSymlink(path, target, dryRun) {
   return { changed: true };
 }
 function bootstrapAgentsFile(repoRoot, dryRun) {
-  const agentsPath = join11(repoRoot, "AGENTS.md");
-  if (existsSync8(agentsPath)) return { changedFiles: [], details: [] };
+  const agentsPath = join12(repoRoot, "AGENTS.md");
+  if (existsSync9(agentsPath)) return { changedFiles: [], details: [] };
   for (const file of ["CLAUDE.md", "GEMINI.md"]) {
-    const source = join11(repoRoot, file);
-    if (!existsSync8(source)) continue;
+    const source = join12(repoRoot, file);
+    if (!existsSync9(source)) continue;
     const stat = lstatSync(source);
     if (stat.isSymbolicLink()) continue;
     if (stat.isFile()) {
@@ -2079,8 +2194,8 @@ function bootstrapAgentsFile(repoRoot, dryRun) {
     }
     return { changedFiles: [], details: [], blocked: `${file} exists but is not a regular file; cannot promote to AGENTS.md` };
   }
-  const readmePath = join11(repoRoot, "README.md");
-  if (existsSync8(readmePath)) {
+  const readmePath = join12(repoRoot, "README.md");
+  if (existsSync9(readmePath)) {
     const stat = lstatSync(readmePath);
     if (!stat.isFile()) return { changedFiles: [], details: [], blocked: "README.md exists but is not a regular file; cannot copy to AGENTS.md" };
     if (!dryRun) copyFileSync(readmePath, agentsPath);
@@ -2119,12 +2234,12 @@ function yamlGet(text2, keyPath) {
   return "";
 }
 function discoverRoles(repoRoot) {
-  const rolesDir = join11(repoRoot, "agents", "hermes");
-  if (!existsSync8(rolesDir)) return [];
-  return readdirSync(rolesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => {
-    const roleDir = join11(rolesDir, entry.name);
-    const roleYamlPath = join11(roleDir, "role.yaml");
-    if (!existsSync8(roleYamlPath)) return null;
+  const rolesDir = join12(repoRoot, "agents", "hermes");
+  if (!existsSync9(rolesDir)) return [];
+  return readdirSync2(rolesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => {
+    const roleDir = join12(rolesDir, entry.name);
+    const roleYamlPath = join12(roleDir, "role.yaml");
+    if (!existsSync9(roleYamlPath)) return null;
     const text2 = readText(roleYamlPath);
     const runtimeRepoRaw = yamlGet(text2, "runtime.github_repo");
     return {
@@ -2142,16 +2257,20 @@ function discoverRoles(repoRoot) {
       planeWorkspace: yamlGet(text2, "ticket_provider.workspace") || yamlGet(text2, "plane.workspace"),
       ticketProviderName: yamlGet(text2, "ticket_provider.name"),
       ticketProviderBoardId: yamlGet(text2, "ticket_provider.board_id"),
-      ticketProviderBoardUrl: yamlGet(text2, "ticket_provider.board_url"),
-      ticketProviderIdentifier: yamlGet(text2, "plane.identifier")
+      ticketProviderIdentifier: yamlGet(text2, "plane.identifier"),
+      legacyReconcileEnabled: yamlGet(text2, "reconcile.enabled"),
+      legacyReconcileGraceHours: yamlGet(text2, "reconcile.grace_hours"),
+      legacyReconcileAutoReview: yamlGet(text2, "reconcile.auto_review"),
+      legacyScrumGraceHours: yamlGet(text2, "scrum_master.grace_hours"),
+      legacyScrumAutoReview: yamlGet(text2, "scrum_master.auto_review")
     };
   }).filter((value) => Boolean(value));
 }
 function registryPath(homeDir) {
-  return join11(homeDir, ".hermes", "agents-registry.yaml");
+  return join12(homeDir, ".hermes", "agents-registry.yaml");
 }
 function systemctlUser(args) {
-  const result = spawnSync5("systemctl", ["--user", ...args], { encoding: "utf8" });
+  const result = spawnSync6("systemctl", ["--user", ...args], { encoding: "utf8" });
   return {
     ok: result.status === 0,
     stdout: result.stdout.trim(),
@@ -2159,8 +2278,8 @@ function systemctlUser(args) {
   };
 }
 function templateScript(ctx, name) {
-  const source = join11(ctx.pjanglerRoot, ".mise", "scripts", name);
-  return existsSync8(source) ? readText(source) : void 0;
+  const source = join12(ctx.pjanglerRoot, ".mise", "scripts", name);
+  return existsSync9(source) ? readText(source) : void 0;
 }
 function templateVersioningScript(ctx) {
   return templateScript(ctx, "versioning.sh");
@@ -2168,16 +2287,45 @@ function templateVersioningScript(ctx) {
 function templateLinkAgentfilesScript(ctx) {
   return templateScript(ctx, "link-agentfiles.sh");
 }
+function resolveAgentHooksLayer2(ctx) {
+  const override = process.env.PJ_AGENT_HOOKS_LAYER;
+  if (override === "0" || override === "false") return false;
+  if (override === "1" || override === "true") return true;
+  if (existsSync9(join12(ctx.repoRoot, ".agents", "hooks", "sync.py"))) return true;
+  return !existsSync9(join12(ctx.homeDir, ".agents", "hooks"));
+}
+function evaluateMiseConditionals(template, agentHooksLayer) {
+  const out = [];
+  let depth = 0;
+  let skipDepth = 0;
+  for (const line of template.split("\n")) {
+    const stmt = line.trim();
+    const ifMatch = /^\{%-?\s*if\s+(\w+)\s*-?%\}$/.exec(stmt);
+    if (ifMatch) {
+      depth += 1;
+      const truthy = ifMatch[1] === "agent_hooks_layer" ? agentHooksLayer : false;
+      if (skipDepth === 0 && !truthy) skipDepth = depth;
+      continue;
+    }
+    if (/^\{%-?\s*endif\s*-?%\}$/.test(stmt)) {
+      if (skipDepth === depth) skipDepth = 0;
+      depth = Math.max(0, depth - 1);
+      continue;
+    }
+    if (skipDepth === 0) out.push(line);
+  }
+  return out.join("\n");
+}
 function renderGeneratedProjectMiseToml(ctx, template) {
   const project = readProjectJson(ctx);
   const projectName = String(project?.project_name ?? basename3(ctx.repoRoot) ?? "project");
-  return template.replace(/\{%\s*raw\s*%\}([\s\S]*?)\{%\s*endraw\s*%\}/g, "$1").replace(/\{\{\s*project_name\s*\}\}/g, projectName);
+  return evaluateMiseConditionals(template, resolveAgentHooksLayer2(ctx)).replace(/\{%\s*raw\s*%\}([\s\S]*?)\{%\s*endraw\s*%\}/g, "$1").replace(/\{\{\s*project_name\s*\}\}/g, projectName);
 }
 function ensureMiseTomlFromTemplate(ctx, changedFiles) {
-  const targetPath = join11(ctx.repoRoot, "mise.toml");
-  if (existsSync8(targetPath)) return false;
-  const sourcePath = join11(ctx.pjanglerRoot, "templates", "commonproject", "template", "mise.toml.jinja");
-  if (!existsSync8(sourcePath)) return false;
+  const targetPath = join12(ctx.repoRoot, "mise.toml");
+  if (existsSync9(targetPath)) return false;
+  const sourcePath = join12(ctx.pjanglerRoot, "templates", "commonproject", "template", "mise.toml.jinja");
+  if (!existsSync9(sourcePath)) return false;
   changedFiles.push(targetPath);
   if (!ctx.dryRun) {
     writeText(targetPath, renderGeneratedProjectMiseToml(ctx, readText(sourcePath)));
@@ -2185,8 +2333,8 @@ function ensureMiseTomlFromTemplate(ctx, changedFiles) {
   return true;
 }
 function templateVersionFilesConf(ctx, repoRoot) {
-  const packageJson = join11(repoRoot, "package.json");
-  return existsSync8(packageJson) ? "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\njson package.json\ngittag .\n" : "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\ngittag .\n";
+  const packageJson = join12(repoRoot, "package.json");
+  return existsSync9(packageJson) ? "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\njson package.json\ngittag .\n" : "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\ngittag .\n";
 }
 function replaceOrAppendManagedBlock(text2, startMarker, block, beforePattern) {
   if (startMarker.test(text2)) {
@@ -2210,7 +2358,7 @@ var CONDITIONAL_HERMES_PATHS = ["agents/hermes/pm/hermes", "agent/hermes/pm/herm
 function requiredMisePathEntries(ctx) {
   const required = [...BASE_MISE_PATH_ENTRIES];
   for (const candidate of CONDITIONAL_HERMES_PATHS) {
-    if (existsSync8(join11(ctx.repoRoot, candidate)) && !required.includes(candidate)) required.push(candidate);
+    if (existsSync9(join12(ctx.repoRoot, candidate)) && !required.includes(candidate)) required.push(candidate);
   }
   return required;
 }
@@ -2359,7 +2507,24 @@ function upsertLinkAgentfilesBlock(text2, ctx) {
   return insertTomlBlockBeforeVersioning(cleaned, LINK_AGENTFILES_WATCH_TASK_BLOCK);
 }
 function readProjectJson(ctx) {
-  return tryParseJson(safeReadText(join11(ctx.repoRoot, ".project.json")));
+  return tryParseJson(safeReadText(join12(ctx.repoRoot, ".project.json")));
+}
+function boolSetting(value, fallback) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "string") {
+    const normalized = value.trim().toLowerCase();
+    if (["true", "1", "yes", "on"].includes(normalized)) return true;
+    if (["false", "0", "no", "off"].includes(normalized)) return false;
+  }
+  return fallback;
+}
+function numberSetting(value, fallback) {
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value === "string" && value.trim()) {
+    const parsed = Number(value);
+    if (Number.isFinite(parsed)) return parsed;
+  }
+  return fallback;
 }
 function canonicalProjectJson(ctx) {
   const roles = discoverRoles(ctx.repoRoot);
@@ -2371,9 +2536,9 @@ function canonicalProjectJson(ctx) {
     workspace: String((existing.ticket_provider?.workspace ?? firstRole?.planeWorkspace ?? "") || ""),
     identifier: String((existing.ticket_provider?.identifier ?? firstRole?.ticketProviderIdentifier ?? "") || ""),
     board_id: String((existing.ticket_provider?.board_id ?? firstRole?.ticketProviderBoardId ?? "") || ""),
-    board_url: String((existing.ticket_provider?.board_url ?? firstRole?.ticketProviderBoardUrl ?? "") || ""),
-    state: String((existing.ticket_provider?.state ?? "planned") || "planned")
+    state: String((existing.ticket_provider?.state ?? (firstRole?.ticketProviderBoardId ? "linked" : "planned")) || "planned")
   };
+  if (ticketProvider.board_id && ticketProvider.state === "planned") ticketProvider.state = "linked";
   const existingAgents = existing.agents ?? {};
   const discoveredAgents = Object.fromEntries(
     roles.map((role) => [
@@ -2393,28 +2558,42 @@ function canonicalProjectJson(ctx) {
       provisioning_state: existingAgent.provisioning_state
     };
   }
+  const existingAutomation = existing.automation ?? {};
+  const existingReconcile = existingAutomation.reconcile ?? {};
+  const legacyEnabled = roles.find((role) => role.legacyReconcileEnabled)?.legacyReconcileEnabled;
+  const legacyGrace = roles.find((role) => role.legacyReconcileGraceHours || role.legacyScrumGraceHours);
+  const legacyAutoReview = roles.find((role) => role.legacyReconcileAutoReview || role.legacyScrumAutoReview);
+  const automation = {
+    ...existingAutomation,
+    reconcile: {
+      enabled: boolSetting(existingReconcile.enabled, boolSetting(legacyEnabled, false)),
+      grace_hours: numberSetting(existingReconcile.grace_hours, numberSetting(legacyGrace?.legacyReconcileGraceHours || legacyGrace?.legacyScrumGraceHours, 0)),
+      auto_review: boolSetting(existingReconcile.auto_review, boolSetting(legacyAutoReview?.legacyReconcileAutoReview || legacyAutoReview?.legacyScrumAutoReview, true))
+    }
+  };
   return {
     project_name: String(existing.project_name ?? titleCaseSlug(slug)),
     project_description: String(existing.project_description ?? ""),
     project_slug: slug,
     repo_path: ctx.repoRoot,
     ticket_provider: ticketProvider,
-    agents
+    agents,
+    automation
   };
 }
 function projectJsonFinding(ctx) {
-  const projectPath = join11(ctx.repoRoot, ".project.json");
-  const planeJsonPath = join11(ctx.repoRoot, ".plane.json");
+  const projectPath = join12(ctx.repoRoot, ".project.json");
+  const planeJsonPath = join12(ctx.repoRoot, ".plane.json");
   const details = [];
   const data = readProjectJson(ctx);
   const roles = discoverRoles(ctx.repoRoot);
-  if (!existsSync8(projectPath)) {
+  if (!existsSync9(projectPath)) {
     return { id: "sot.project-json", title: "Canonical .project.json", status: "fail", summary: ".project.json missing", details: [], fixable: true };
   }
   if (!data) {
     return { id: "sot.project-json", title: "Canonical .project.json", status: "fail", summary: ".project.json is not valid JSON", details: [], fixable: true };
   }
-  for (const key of ["project_name", "project_description", "project_slug", "repo_path", "ticket_provider", "agents"]) {
+  for (const key of ["project_name", "project_description", "project_slug", "repo_path", "ticket_provider", "agents", "automation"]) {
     if (!(key in data)) details.push(`missing key: ${key}`);
   }
   if (data.repo_path !== ctx.repoRoot) details.push(`repo_path should be ${ctx.repoRoot}`);
@@ -2431,10 +2610,19 @@ function projectJsonFinding(ctx) {
     }
   }
   const ticketProvider = data.ticket_provider ?? {};
-  for (const key of ["type", "workspace", "identifier", "board_id", "board_url", "state"]) {
+  for (const key of ["type", "workspace", "identifier", "board_id", "state"]) {
     if (!(key in ticketProvider)) details.push(`ticket_provider.${key} missing`);
   }
-  if (existsSync8(planeJsonPath)) details.push(".plane.json should not exist once .project.json is canonical");
+  if ("board_url" in ticketProvider) details.push("ticket_provider.board_url should be removed; derive it from provider/workspace/board_id");
+  if (!ticketProvider.board_id && roles.some((role) => role.ticketProviderBoardId)) {
+    details.push("ticket_provider.board_id missing even though legacy role.yaml contains a board binding");
+  }
+  const automation = data.automation ?? {};
+  const reconcile = automation.reconcile ?? {};
+  for (const key of ["enabled", "grace_hours", "auto_review"]) {
+    if (!(key in reconcile)) details.push(`automation.reconcile.${key} missing`);
+  }
+  if (existsSync9(planeJsonPath)) details.push(".plane.json should not exist once .project.json is canonical");
   return {
     id: "sot.project-json",
     title: "Canonical .project.json",
@@ -2447,7 +2635,7 @@ function projectJsonFinding(ctx) {
 function renderSoul(role) {
   const telegram = role.botHandle ? `@${role.botHandle}` : "(unwired)";
   const tone = role.role === "pm" ? `Direct and brief. Decision-forward. No throat-clearing, no apologies, no "I'll help you with that" preambles.` : "Direct and brief.";
-  const roleSpecific = role.role === "pm" ? `You are the project manager. You triage incoming work, create or refine tickets, and delegate implementation. You do not ship product code. A systemd heartbeat checkpoints your runtime; when this repo opts into reconciliation (\`reconcile.enabled\` in role.yaml), the same heartbeat also runs your continuous board-reconciliation pass out-of-band (\`.scripts/sentinel.prompt.md\`, \`--source cron\`), kept separate from your interactive session memory.` : `You operate as the ${role.role} agent for this repo.`;
+  const roleSpecific = role.role === "pm" ? `You are the project manager. You triage incoming work, create or refine tickets, and delegate implementation. You do not ship product code. A systemd heartbeat checkpoints your runtime; when this repo opts into reconciliation (\`automation.reconcile.enabled\` in repo-root \`.project.json\`), the same heartbeat also runs your continuous board-reconciliation pass out-of-band (\`.scripts/sentinel.prompt.md\`, \`--source cron\`), kept separate from your interactive session memory.` : `You operate as the ${role.role} agent for this repo.`;
   const runtimeOwner = role.runtimeOwner || "delorenj";
   return `# ${role.displayName || role.agentId}
 
@@ -2515,17 +2703,17 @@ exec env HERMES_HOME="$HERMES_HOME" HERMES_FLEET_ENV="$FLEET_ENV"   HERMES_OAUTH
 `.replace(/\u0010/g, "$");
 }
 function copyMissingRecursive(sourceDir, targetDir, changedFiles, dryRun, skip) {
-  if (!existsSync8(sourceDir)) return;
+  if (!existsSync9(sourceDir)) return;
   mkdirSync6(targetDir, { recursive: true });
-  for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {
-    const sourcePath = join11(sourceDir, entry.name);
+  for (const entry of readdirSync2(sourceDir, { withFileTypes: true })) {
+    const sourcePath = join12(sourceDir, entry.name);
     if (skip?.(sourcePath)) continue;
-    const targetPath = join11(targetDir, entry.name);
+    const targetPath = join12(targetDir, entry.name);
     if (entry.isDirectory()) {
       copyMissingRecursive(sourcePath, targetPath, changedFiles, dryRun, skip);
       continue;
     }
-    if (existsSync8(targetPath)) continue;
+    if (existsSync9(targetPath)) continue;
     changedFiles.push(targetPath);
     if (!dryRun) {
       ensureParent(targetPath);
@@ -2534,7 +2722,7 @@ function copyMissingRecursive(sourceDir, targetDir, changedFiles, dryRun, skip)
   }
 }
 function upsertSubmodule(repoRoot, role, changedFiles, dryRun) {
-  const gitmodulesPath = join11(repoRoot, ".gitmodules");
+  const gitmodulesPath = join12(repoRoot, ".gitmodules");
   const repoName = role.runtimeRepo || `agent-hm-${role.repo}-${role.role}`;
   const owner = role.runtimeOwner || "delorenj";
   const block = `[submodule "agents/hermes/${role.role}/runtime"]
@@ -2634,14 +2822,14 @@ var RULES = [
     id: "mise.config-root",
     title: "mise config_root + AGENTS link hooks",
     audit: (ctx) => {
-      const misePath = join11(ctx.repoRoot, "mise.toml");
-      if (!existsSync8(misePath)) {
+      const misePath = join12(ctx.repoRoot, "mise.toml");
+      if (!existsSync9(misePath)) {
         return { id: "mise.config-root", title: "mise config_root + AGENTS link hooks", status: "fail", summary: "mise.toml missing", details: [], fixable: true };
       }
       const text2 = readText(misePath);
       const details = [];
-      const linkAgentfilesPath = join11(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
-      if (!existsSync8(linkAgentfilesPath)) details.push(".mise/scripts/link-agentfiles.sh missing");
+      const linkAgentfilesPath = join12(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
+      if (!existsSync9(linkAgentfilesPath)) details.push(".mise/scripts/link-agentfiles.sh missing");
       const pathValues = [...(text2.match(/^_\.path\s*=\s*\[([^\]]*)\]/m)?.[1] ?? "").matchAll(/"([^"]+)"/g)].map((match) => match[1]);
       const missingPathValues = requiredMisePathEntries(ctx).filter((value) => !pathValues.includes(value));
       if (missingPathValues.length) details.push(`[env]._.path should include ${missingPathValues.join(", ")}`);
@@ -2659,10 +2847,10 @@ var RULES = [
       };
     },
     migrate: (ctx, finding) => {
-      const path = join11(ctx.repoRoot, "mise.toml");
+      const path = join12(ctx.repoRoot, "mise.toml");
       const changedFiles = [];
       const details = [];
-      if (!existsSync8(path)) {
+      if (!existsSync9(path)) {
         if (!ensureMiseTomlFromTemplate(ctx, changedFiles)) {
           return { id: finding.id, title: finding.title, status: "blocked", summary: "mise.toml missing and no generated-project mise template available to initialize from", changedFiles, details: [] };
         }
@@ -2678,7 +2866,7 @@ var RULES = [
         if (!ctx.dryRun) writeText(path, next);
         text2 = next;
       }
-      const linkAgentfilesPath = join11(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
+      const linkAgentfilesPath = join12(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
       const expectedScript = templateLinkAgentfilesScript(ctx);
       if (expectedScript === void 0) {
         return { id: finding.id, title: finding.title, status: "blocked", summary: "pjangler install is missing .mise/scripts/link-agentfiles.sh \u2014 update @delorenj/pjangler (broken package)", changedFiles, details: [] };
@@ -2705,13 +2893,13 @@ var RULES = [
     title: "managed mise versioning block",
     audit: (ctx) => {
       const details = [];
-      const misePath = join11(ctx.repoRoot, "mise.toml");
-      const versioningPath = join11(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
-      const manifestPath = join11(ctx.repoRoot, ".mise", "version-files.conf");
+      const misePath = join12(ctx.repoRoot, "mise.toml");
+      const versioningPath = join12(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
+      const manifestPath = join12(ctx.repoRoot, ".mise", "version-files.conf");
       const text2 = safeReadText(misePath);
       if (!text2?.includes("# >>> mise-versioning >>>")) details.push("mise versioning managed block missing");
-      if (!existsSync8(versioningPath)) details.push(".mise/scripts/versioning.sh missing");
-      if (!existsSync8(manifestPath)) details.push(".mise/version-files.conf missing");
+      if (!existsSync9(versioningPath)) details.push(".mise/scripts/versioning.sh missing");
+      if (!existsSync9(manifestPath)) details.push(".mise/version-files.conf missing");
       return {
         id: "mise.versioning",
         title: "managed mise versioning block",
@@ -2724,8 +2912,8 @@ var RULES = [
     migrate: (ctx, finding) => {
       const changedFiles = [];
       const details = [];
-      const misePath = join11(ctx.repoRoot, "mise.toml");
-      if (!existsSync8(misePath)) {
+      const misePath = join12(ctx.repoRoot, "mise.toml");
+      if (!existsSync9(misePath)) {
         if (!ensureMiseTomlFromTemplate(ctx, changedFiles)) {
           return { id: finding.id, title: finding.title, status: "blocked", summary: "mise.toml missing and no generated-project mise template available to initialize from", changedFiles, details: [] };
         }
@@ -2735,12 +2923,21 @@ var RULES = [
         }
       }
       const currentMise = readText(misePath);
-      const nextMise = replaceOrAppendManagedBlock(currentMise, /# >>> mise-versioning >>>/, VERSIONING_BLOCK, /^\[tasks\.build\]/m);
+      let cleanedMise = currentMise;
+      if (!currentMise.includes("# >>> mise-versioning >>>")) {
+        const taskNames = ["version", "version:bump", "version:bump-patch", "version:bump-minor", "version:bump-major", "version:check", "version:sync"];
+        for (const taskName of taskNames) {
+          const escaped = taskName.replace(/:/g, "\\:");
+          const headerPattern = new RegExp(`^\\[tasks\\.(?:"${escaped}"|'${escaped}'|${escaped})\\]$`);
+          cleanedMise = removeTomlSection(cleanedMise, headerPattern);
+        }
+      }
+      const nextMise = replaceOrAppendManagedBlock(cleanedMise, /# >>> mise-versioning >>>/, VERSIONING_BLOCK, /^\[tasks\.build\]/m);
       if (nextMise !== currentMise) {
         if (!changedFiles.includes(misePath)) changedFiles.push(misePath);
         if (!ctx.dryRun) writeText(misePath, nextMise);
       }
-      const versioningPath = join11(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
+      const versioningPath = join12(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
       const expectedScript = templateVersioningScript(ctx);
       if (expectedScript === void 0) {
         return { id: finding.id, title: finding.title, status: "blocked", summary: "pjangler install is missing .mise/scripts/versioning.sh \u2014 update @delorenj/pjangler (broken package)", changedFiles, details: [] };
@@ -2752,7 +2949,7 @@ var RULES = [
           chmodSync2(versioningPath, 493);
         }
       }
-      const manifestPath = join11(ctx.repoRoot, ".mise", "version-files.conf");
+      const manifestPath = join12(ctx.repoRoot, ".mise", "version-files.conf");
       const expectedManifest = templateVersionFilesConf(ctx, ctx.repoRoot);
       if (safeReadText(manifestPath) !== expectedManifest) {
         changedFiles.push(manifestPath);
@@ -2772,9 +2969,9 @@ var RULES = [
     id: "sot.agent-symlinks",
     title: "AGENTS/CLAUDE/GEMINI symlink contract",
     audit: (ctx) => {
-      const agentsPath = join11(ctx.repoRoot, "AGENTS.md");
-      if (!existsSync8(agentsPath)) {
-        const fallbackSources = ["CLAUDE.md", "GEMINI.md", "README.md"].filter((file) => existsSync8(join11(ctx.repoRoot, file)));
+      const agentsPath = join12(ctx.repoRoot, "AGENTS.md");
+      if (!existsSync9(agentsPath)) {
+        const fallbackSources = ["CLAUDE.md", "GEMINI.md", "README.md"].filter((file) => existsSync9(join12(ctx.repoRoot, file)));
         if (fallbackSources.length === 0) {
           return { id: "sot.agent-symlinks", title: "AGENTS/CLAUDE/GEMINI symlink contract", status: "skip", summary: "AGENTS.md missing; symlink contract not applicable", details: [], fixable: false };
         }
@@ -2789,7 +2986,7 @@ var RULES = [
       }
       const details = [];
       for (const file of ["CLAUDE.md", "GEMINI.md"]) {
-        const full = join11(ctx.repoRoot, file);
+        const full = join12(ctx.repoRoot, file);
         const target = readSymlinkTarget(full);
         if (target !== "AGENTS.md") details.push(`${file} should be a symlink to AGENTS.md`);
       }
@@ -2813,7 +3010,7 @@ var RULES = [
         return { id: finding.id, title: finding.title, status: "blocked", summary: "AGENTS.md missing; cannot derive canonical agent file", changedFiles, details: [bootstrap.blocked] };
       }
       for (const file of ["CLAUDE.md", "GEMINI.md"]) {
-        const full = join11(ctx.repoRoot, file);
+        const full = join12(ctx.repoRoot, file);
         const result = ensureSymlink(full, "AGENTS.md", ctx.dryRun);
         if (result.blocked) blockedDetails.push(result.blocked);
         if (result.changed) changedFiles.push(full);
@@ -2835,7 +3032,7 @@ var RULES = [
     migrate: (ctx, finding) => {
       const changedFiles = [];
       const details = [];
-      const path = join11(ctx.repoRoot, ".project.json");
+      const path = join12(ctx.repoRoot, ".project.json");
       const existing = readProjectJson(ctx) ?? {};
       const canonical = canonicalProjectJson(ctx);
       const merged = { ...existing, ...canonical };
@@ -2845,10 +3042,10 @@ var RULES = [
         changedFiles.push(path);
         if (!ctx.dryRun) writeText(path, expected);
       }
-      const planeJson = join11(ctx.repoRoot, ".plane.json");
-      if (existsSync8(planeJson)) {
+      const planeJson = join12(ctx.repoRoot, ".plane.json");
+      if (existsSync9(planeJson)) {
         const backup = `${planeJson}.migrated-backup`;
-        if (existsSync8(backup)) {
+        if (existsSync9(backup)) {
           details.push(`cannot back up .plane.json because ${relative(ctx.repoRoot, backup)} already exists`);
         } else {
           changedFiles.push(backup);
@@ -2870,8 +3067,8 @@ var RULES = [
     title: ".env.op + gitignore secrets contract",
     audit: (ctx) => {
       const details = [];
-      const envOp = safeReadText(join11(ctx.repoRoot, ".env.op"));
-      const gitignore = safeReadText(join11(ctx.repoRoot, ".gitignore"));
+      const envOp = safeReadText(join12(ctx.repoRoot, ".env.op"));
+      const gitignore = safeReadText(join12(ctx.repoRoot, ".gitignore"));
       if (!envOp) {
         details.push(".env.op missing");
       } else {
@@ -2897,12 +3094,12 @@ var RULES = [
     migrate: (ctx, finding) => {
       const changedFiles = [];
       const details = [];
-      const envOpPath = join11(ctx.repoRoot, ".env.op");
-      if (!existsSync8(envOpPath)) {
+      const envOpPath = join12(ctx.repoRoot, ".env.op");
+      if (!existsSync9(envOpPath)) {
         changedFiles.push(envOpPath);
-        if (!ctx.dryRun) writeText(envOpPath, readText(join11(ctx.pjanglerRoot, "templates", "commonproject", "template", ".env.op")));
+        if (!ctx.dryRun) writeText(envOpPath, readText(join12(ctx.pjanglerRoot, "templates", "commonproject", "template", ".env.op")));
       }
-      const gitignorePath = join11(ctx.repoRoot, ".gitignore");
+      const gitignorePath = join12(ctx.repoRoot, ".gitignore");
       const gitignore = safeReadText(gitignorePath) ?? "";
       const requiredBlock = `# Secrets \u2014 .env is materialized by \`op inject -i .env.op > .env\` on mise enter.
 # NEVER commit it. .env.op holds only 1Password references or safe literals and IS committed.
@@ -2929,7 +3126,7 @@ var RULES = [
     title: ".copier-answers.yml provenance + drift report",
     audit: (ctx) => {
       const details = [];
-      const path = join11(ctx.repoRoot, ".copier-answers.yml");
+      const path = join12(ctx.repoRoot, ".copier-answers.yml");
       const text2 = safeReadText(path);
       const project = readProjectJson(ctx);
       if (!text2) {
@@ -2960,12 +3157,12 @@ var RULES = [
       const changedFiles = [];
       const project = canonicalProjectJson(ctx);
       const text2 = `# Changes here will be overwritten by Copier; NEVER EDIT MANUALLY
-_src_path: ${join11(ctx.pjanglerRoot, "templates", "commonproject")}
+_src_path: ${join12(ctx.pjanglerRoot, "templates", "commonproject")}
 project_description: ${String(project.project_description)}
 project_name: ${String(project.project_name)}
 ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
 `;
-      const path = join11(ctx.repoRoot, ".copier-answers.yml");
+      const path = join12(ctx.repoRoot, ".copier-answers.yml");
       if (safeReadText(path) !== text2) {
         changedFiles.push(path);
         if (!ctx.dryRun) writeText(path, text2);
@@ -2984,15 +3181,15 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
     id: "bmad.scaffold",
     title: "BMAD modules/docs scaffold",
     audit: (ctx) => {
-      const sourceRoot = join11(ctx.pjanglerRoot, "templates", "commonproject", "_bmad");
-      const targetRoot = join11(ctx.repoRoot, "_bmad");
+      const sourceRoot = join12(ctx.pjanglerRoot, "templates", "commonproject", "_bmad");
+      const targetRoot = join12(ctx.repoRoot, "_bmad");
       const sentinels = [
-        join11("core", "config.yaml"),
-        join11("custom", "config.yaml"),
-        join11("custom", "workflows", "ticket-lifecycle", "workflow.yaml"),
-        join11("bmm", "workflows", "workflow-status", "workflow.yaml")
+        join12("core", "config.yaml"),
+        join12("custom", "config.yaml"),
+        join12("custom", "workflows", "ticket-lifecycle", "workflow.yaml"),
+        join12("bmm", "workflows", "workflow-status", "workflow.yaml")
       ];
-      const missing = sentinels.filter((file) => existsSync8(join11(sourceRoot, file)) && !existsSync8(join11(targetRoot, file)));
+      const missing = sentinels.filter((file) => existsSync9(join12(sourceRoot, file)) && !existsSync9(join12(targetRoot, file)));
       return {
         id: "bmad.scaffold",
         title: "BMAD modules/docs scaffold",
@@ -3004,7 +3201,7 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
     },
     migrate: (ctx, finding) => {
       const changedFiles = [];
-      copyMissingRecursive(join11(ctx.pjanglerRoot, "templates", "commonproject", "_bmad"), join11(ctx.repoRoot, "_bmad"), changedFiles, ctx.dryRun);
+      copyMissingRecursive(join12(ctx.pjanglerRoot, "templates", "commonproject", "_bmad"), join12(ctx.repoRoot, "_bmad"), changedFiles, ctx.dryRun);
       return {
         id: finding.id,
         title: finding.title,
@@ -3026,11 +3223,11 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       }
       const details = [];
       for (const rel of ["role.yaml", "SOUL.md", "hermes", ".gitignore", ".scripts/70-systemd.sh", ".scripts/heartbeat.sh", ".scripts/checkpoint.sh", ".runtime-scaffold/README.md", "runtime/memories/MEMORY.md", "runtime/bloodbank-consumer.py"]) {
-        if (!existsSync8(join11(role.roleDir, rel))) details.push(`missing ${relative(ctx.repoRoot, join11(role.roleDir, rel))}`);
+        if (!existsSync9(join12(role.roleDir, rel))) details.push(`missing ${relative(ctx.repoRoot, join12(role.roleDir, rel))}`);
       }
-      const gitmodules = safeReadText(join11(ctx.repoRoot, ".gitmodules")) ?? "";
+      const gitmodules = safeReadText(join12(ctx.repoRoot, ".gitmodules")) ?? "";
       if (!gitmodules.includes(`agents/hermes/${role.role}/runtime`)) details.push(".gitmodules missing pm runtime submodule entry");
-      if (!profileMetaInheritsDefault(join11(role.roleDir, "runtime", "profile.yaml"))) {
+      if (!profileMetaInheritsDefault(join12(role.roleDir, "runtime", "profile.yaml"))) {
         details.push("runtime/profile.yaml missing inherited default config metadata");
       }
       const registry = safeReadText(registryPath(ctx.homeDir));
@@ -3051,21 +3248,21 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       if (!role) {
         return { id: finding.id, title: finding.title, status: "blocked", summary: "No pm role present", changedFiles, details: [] };
       }
-      const templateRoleDir = join11(ctx.pjanglerRoot, "templates", "hermes-agent", "template");
-      writeIfDifferent(join11(role.roleDir, "SOUL.md"), renderSoul(role), ctx.dryRun, changedFiles);
-      writeIfDifferent(join11(role.roleDir, "hermes"), renderHermesWrapper(role), ctx.dryRun, changedFiles, 493);
-      writeIfDifferent(join11(role.roleDir, ".gitignore"), readText(join11(templateRoleDir, ".gitignore.jinja")).replace(/\{\{ role \}\}/g, role.role), ctx.dryRun, changedFiles);
-      copyMissingRecursive(join11(templateRoleDir, ".runtime-scaffold"), join11(role.roleDir, ".runtime-scaffold"), changedFiles, ctx.dryRun);
-      copyMissingRecursive(join11(templateRoleDir, ".runtime-scaffold"), join11(role.roleDir, "runtime"), changedFiles, ctx.dryRun);
-      copyMissingRecursive(join11(templateRoleDir, ".scripts"), join11(role.roleDir, ".scripts"), changedFiles, ctx.dryRun, (source) => source.endsWith("sentinel.prompt.md.jinja"));
-      const promptSource = join11(templateRoleDir, ".scripts", "sentinel.prompt.md.jinja");
-      const promptTarget = join11(role.roleDir, ".scripts", "sentinel.prompt.md");
-      if (existsSync8(promptSource) && !existsSync8(promptTarget)) {
+      const templateRoleDir = join12(ctx.pjanglerRoot, "templates", "hermes-agent", "template");
+      writeIfDifferent(join12(role.roleDir, "SOUL.md"), renderSoul(role), ctx.dryRun, changedFiles);
+      writeIfDifferent(join12(role.roleDir, "hermes"), renderHermesWrapper(role), ctx.dryRun, changedFiles, 493);
+      writeIfDifferent(join12(role.roleDir, ".gitignore"), readText(join12(templateRoleDir, ".gitignore.jinja")).replace(/\{\{ role \}\}/g, role.role), ctx.dryRun, changedFiles);
+      copyMissingRecursive(join12(templateRoleDir, ".runtime-scaffold"), join12(role.roleDir, ".runtime-scaffold"), changedFiles, ctx.dryRun);
+      copyMissingRecursive(join12(templateRoleDir, ".runtime-scaffold"), join12(role.roleDir, "runtime"), changedFiles, ctx.dryRun);
+      copyMissingRecursive(join12(templateRoleDir, ".scripts"), join12(role.roleDir, ".scripts"), changedFiles, ctx.dryRun, (source) => source.endsWith("sentinel.prompt.md.jinja"));
+      const promptSource = join12(templateRoleDir, ".scripts", "sentinel.prompt.md.jinja");
+      const promptTarget = join12(role.roleDir, ".scripts", "sentinel.prompt.md");
+      if (existsSync9(promptSource) && !existsSync9(promptTarget)) {
         const prompt = readText(promptSource).replace(/\{\{ agent_id \}\}/g, role.agentId).replace(/\{\{ role \}\}/g, role.role).replace(/\{\{ target_repo \}\}/g, role.repo).replace(/\{\{ display_name \}\}/g, role.displayName || role.agentId);
         writeIfDifferent(promptTarget, prompt, ctx.dryRun, changedFiles);
       }
       upsertSubmodule(ctx.repoRoot, role, changedFiles, ctx.dryRun);
-      const profileMetaUpdated = upsertInheritedProfileMeta(join11(role.roleDir, "runtime", "profile.yaml"), changedFiles, ctx.dryRun);
+      const profileMetaUpdated = upsertInheritedProfileMeta(join12(role.roleDir, "runtime", "profile.yaml"), changedFiles, ctx.dryRun);
       if (profileMetaUpdated) details.push(`updated ${profileMetaUpdated}`);
       const registryUpdated = upsertRegistryEntry(role, ctx.homeDir, changedFiles, ctx.dryRun);
       if (registryUpdated) details.push(`updated ${registryUpdated}`);
@@ -3079,6 +3276,103 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       };
     }
   },
+  {
+    id: "hermes.untracked-runtimes",
+    title: "Hermes agent runtimes untracked + gitignored",
+    audit: (ctx) => {
+      const roles = discoverRoles(ctx.repoRoot);
+      if (roles.length === 0) {
+        return {
+          id: "hermes.untracked-runtimes",
+          title: "Hermes agent runtimes untracked + gitignored",
+          status: "skip",
+          summary: "No Hermes roles present",
+          details: [],
+          fixable: false
+        };
+      }
+      const details = [];
+      for (const role of roles) {
+        const roleRelDir = relative(ctx.repoRoot, role.roleDir);
+        const runtimeRelPath = join12(roleRelDir, "runtime");
+        const lsResult = spawnSync6("git", ["ls-files", "--stage", runtimeRelPath], {
+          cwd: ctx.repoRoot,
+          encoding: "utf8"
+        });
+        if (lsResult.status === 0 && lsResult.stdout.trim().length > 0) {
+          details.push(`submodule runtime is tracked in Git index at ${runtimeRelPath}`);
+        }
+        const gitignorePath = join12(role.roleDir, ".gitignore");
+        if (existsSync9(gitignorePath)) {
+          const content = safeReadText(gitignorePath) ?? "";
+          const lines = content.split(/\r?\n/).map((line) => line.trim());
+          if (!lines.includes("runtime/") && !lines.includes("runtime")) {
+            details.push(`.gitignore missing runtime/ ignore entry in ${relative(ctx.repoRoot, gitignorePath)}`);
+          }
+        } else {
+          details.push(`.gitignore is missing in ${relative(ctx.repoRoot, gitignorePath)}`);
+        }
+      }
+      return {
+        id: "hermes.untracked-runtimes",
+        title: "Hermes agent runtimes untracked + gitignored",
+        status: details.length === 0 ? "pass" : "fail",
+        summary: details.length === 0 ? "All Hermes agent runtimes are untracked and gitignored" : `${details.length} issue(s) with untracked/ignored runtimes detected`,
+        details,
+        fixable: true
+      };
+    },
+    migrate: (ctx, finding) => {
+      const roles = discoverRoles(ctx.repoRoot);
+      const changedFiles = [];
+      const details = [];
+      for (const role of roles) {
+        const roleRelDir = relative(ctx.repoRoot, role.roleDir);
+        const runtimeRelPath = join12(roleRelDir, "runtime");
+        const lsResult = spawnSync6("git", ["ls-files", "--stage", runtimeRelPath], {
+          cwd: ctx.repoRoot,
+          encoding: "utf8"
+        });
+        if (lsResult.status === 0 && lsResult.stdout.trim().length > 0) {
+          details.push(`untrack ${runtimeRelPath}`);
+          changedFiles.push(runtimeRelPath);
+          if (!ctx.dryRun) {
+            spawnSync6("git", ["rm", "--cached", "-r", runtimeRelPath], {
+              cwd: ctx.repoRoot,
+              encoding: "utf8"
+            });
+          }
+        }
+        const gitignorePath = join12(role.roleDir, ".gitignore");
+        let content = "";
+        let isIgnored = false;
+        if (existsSync9(gitignorePath)) {
+          content = safeReadText(gitignorePath) ?? "";
+          const lines = content.split(/\r?\n/).map((line) => line.trim());
+          isIgnored = lines.includes("runtime/") || lines.includes("runtime");
+        }
+        if (!isIgnored) {
+          details.push(`ignore runtime/ in ${relative(ctx.repoRoot, gitignorePath)}`);
+          changedFiles.push(gitignorePath);
+          if (!ctx.dryRun) {
+            if (content && !content.endsWith("\n")) {
+              content += "\n";
+            }
+            content += "runtime/\n";
+            writeText(gitignorePath, content);
+          }
+        }
+      }
+      return {
+        id: finding.id,
+        title: finding.title,
+        status: changedFiles.length ? "applied" : "noop",
+        summary: changedFiles.length ? "Hermes agent runtimes made untracked and ignored" : "No changes required",
+        changedFiles,
+        details
+      };
+    }
+  },
   {
     id: "systemd.sentinel",
     title: "Hermes systemd/sentinel units enabled + active",
@@ -3119,9 +3413,9 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
         return { id: finding.id, title: finding.title, status: "blocked", summary: "systemd --user unavailable on this host", changedFiles, details };
       }
       for (const role of roles) {
-        const sysDir = join11(ctx.homeDir, ".config", "systemd", "user");
+        const sysDir = join12(ctx.homeDir, ".config", "systemd", "user");
         const units = [`hermes-${role.agentId}-gateway.service`, `hermes-${role.agentId}-consumer.service`, `hermes-${role.agentId}-heartbeat.timer`];
-        const allUnitsPresent = units.every((unit) => existsSync8(join11(sysDir, unit)));
+        const allUnitsPresent = units.every((unit) => existsSync9(join12(sysDir, unit)));
         if (allUnitsPresent) {
           if (ctx.dryRun) {
             details.push(`would run: systemctl --user enable --now ${units.join(" ")}`);
@@ -3133,12 +3427,12 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
           }
           continue;
         }
-        for (const script of [join11(role.roleDir, ".scripts", "70-systemd.sh")]) {
-          if (!script || !existsSync8(script)) continue;
+        for (const script of [join12(role.roleDir, ".scripts", "70-systemd.sh")]) {
+          if (!script || !existsSync9(script)) continue;
           if (ctx.dryRun) {
             details.push(`would run: bash ${script}`);
           } else {
-            const result = spawnSync5("bash", [script], { cwd: role.roleDir, encoding: "utf8" });
+            const result = spawnSync6("bash", [script], { cwd: role.roleDir, encoding: "utf8" });
             if (result.status !== 0) details.push(`script failed: ${script}: ${result.stderr.trim() || result.stdout.trim()}`);
           }
         }
@@ -3258,7 +3552,7 @@ var server = new McpServer({
 var TICKET_PROVIDER_SCHEMA = z.enum(["plane", "trello"]);
 function resolveTargetDir(targetDir) {
   const dir = resolve3(targetDir ?? process.cwd());
-  if (!existsSync9(dir)) {
+  if (!existsSync10(dir)) {
     throw new Error(`Target directory does not exist: ${dir}`);
   }
   if (!statSync2(dir).isDirectory()) {
@@ -3269,7 +3563,7 @@ function resolveTargetDir(targetDir) {
 function resolvePjanglerRoot3() {
   let dir = dirname8(fileURLToPath5(import.meta.url));
   while (dir !== dirname8(dir)) {
-    if (existsSync9(join12(dir, "package.json")) && existsSync9(join12(dir, "templates", "commonproject", "copier.yml"))) {
+    if (existsSync10(join13(dir, "package.json")) && existsSync10(join13(dir, "templates", "commonproject", "copier.yml"))) {
       return dir;
     }
     dir = dirname8(dir);
@@ -3471,8 +3765,8 @@ server.registerTool(
       const pjanglerRoot = resolvePjanglerRoot3();
       const projectSlug = input.projectSlug ?? slugify(input.projectName);
       const parentDir = resolve3(input.parentDir ?? process.cwd());
-      if (!existsSync9(parentDir) || !statSync2(parentDir).isDirectory()) throw new Error(`Parent directory does not exist: ${parentDir}`);
-      const targetDir = resolve3(input.targetDir ?? join12(parentDir, projectSlug));
+      if (!existsSync10(parentDir) || !statSync2(parentDir).isDirectory()) throw new Error(`Parent directory does not exist: ${parentDir}`);
+      const targetDir = resolve3(input.targetDir ?? join13(parentDir, projectSlug));
       const overwrite = input.overwrite ?? input.force ?? false;
       const dryRun = input.dryRun ?? true;
       const local = input.local ?? true;
@@ -3482,7 +3776,7 @@ server.registerTool(
       if (!skipPlane && ticketProvider === "plane" && !boardId) {
         throw new Error("boardId or planeProjectId is required when skipPlane=false for Plane; keep skipPlane=true for safe local bootstrap");
       }
-      if (!dryRun && existsSync9(targetDir) && !overwrite) throw new Error(`Target already exists: ${targetDir} (set force/overwrite=true to re-render)`);
+      if (!dryRun && existsSync10(targetDir) && !overwrite) throw new Error(`Target already exists: ${targetDir} (set force/overwrite=true to re-render)`);
       const plan = planProjectInit({
         name: input.projectName,
         description: input.projectDescription,