@delorenj/pjangler 1.2.9 → 1.2.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delorenj/pjangler",
-  "version": "1.2.9",
+  "version": "1.2.13",
   "description": "Project subsystem bootstrapper CLI",
   "type": "module",
   "main": "dist/index.js",

package/templates/commonproject/copier.yml

@@ -72,12 +72,15 @@ plane_base:
 
 # Provider-agnostic board binding — supplied by pjangler's --data values after
 # the board is created or linked. Defaults keep a bare `copier copy` rendering
-# valid, and fall back to the legacy plane_* aliases above.
+# valid, and fall back to the legacy plane_* aliases above. Board URLs are
+# derived from provider/workspace/board_id and are intentionally not persisted.
 board_id:
   type: str
   default: "{{ plane_project_id }}"
   when: false
 
+# Deprecated no-op accepted so older pjangler/CommonProject callers do not fail
+# when they still pass `--data board_url=...`.
 board_url:
   type: str
   default: ""

package/templates/commonproject/template/.project.json.jinja

@@ -1,15 +1,5 @@
 {% set ticket_board_id = board_id | default(plane_project_id) -%}
-{% set ticket_board_url = board_url | default('') -%}
 {% set workspace = ticket_workspace | default(plane_workspace if ticket_provider == 'plane' else '') -%}
-{% if ticket_board_url -%}
-{% set resolved_board_url = ticket_board_url -%}
-{% elif ticket_provider == 'plane' and ticket_board_id -%}
-{% set resolved_board_url = plane_base ~ '/' ~ workspace ~ '/projects/' ~ ticket_board_id ~ '/issues/' -%}
-{% elif ticket_provider == 'trello' and ticket_board_id -%}
-{% set resolved_board_url = 'https://trello.com/b/' ~ ticket_board_id -%}
-{% else -%}
-{% set resolved_board_url = '' -%}
-{% endif -%}
 {
   "project_name": {{ project_name | tojson }},
   "project_description": {{ project_description | tojson }},
@@ -20,7 +10,14 @@
     "workspace": {{ workspace | tojson }},
     "identifier": {{ project_identifier | tojson }},
     "board_id": {{ ticket_board_id | tojson }},
-    "board_url": {{ resolved_board_url | tojson }}
+    "state": {{ ("linked" if ticket_board_id else "planned") | tojson }}
   },
-  "agents": {}
+  "agents": {},
+  "automation": {
+    "reconcile": {
+      "enabled": false,
+      "grace_hours": 0,
+      "auto_review": true
+    }
+  }
 }

package/templates/commonproject/template/mise.toml.jinja

@@ -15,7 +15,7 @@ _.file = [".env"]
 enter = [
   "{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh",
   "op inject -i .env.op > .env",
-  "{% raw %}{{config_root}}{% endraw %}/.mise/scripts/codegraph.sh",
+  "[ -f {% raw %}{{config_root}}{% endraw %}/.mise/scripts/codegraph.sh ] && {% raw %}{{config_root}}{% endraw %}/.mise/scripts/codegraph.sh || true",
 {%- if agent_hooks_layer %}
   "{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-project-skills-to-clis.sh",
   "{% raw %}{{config_root}}{% endraw %}/.agents/hooks/sync.py --install --quiet",

package/templates/hermes-agent/README.md

@@ -68,7 +68,7 @@ you to review it. Keys:
 | `fleet` | `fleet_env`, `registry_file` | Fleet source-of-truth + registry locations |
 | `fleet` | `oauth_file`, `codex_home` | Shared Hermes OAuth store + Codex CLI/app-server auth home |
 | `fleet` | `runtime_scaffold_dir` | Fallback scaffold (if agent-local one is missing) |
-| `fleet` | `canonical_skills_dir`, `symlinked_runtime_skills` | Skills mirrored into each profile |
+| `fleet` | `canonical_skills_dir`, `pm_external_skill_dirs`, `symlinked_runtime_skills` | Shared runtime skills plus PM external skill libraries |
 | `github` | `runtime_repo_owner` | Owner of the `agent-hm-*` runtime repos |
 | `plane` | `base`, `workspace` | Plane URL + workspace slug |
 | `bloodbank` | `nats_host`, `nats_port`, `compose_dir` | NATS endpoint + compose dir hint |

package/templates/hermes-agent/config.example.toml

@@ -0,0 +1,66 @@
+# hermes-agent-template — distributable configuration
+#
+# This file holds every environment-specific default the provisioning scripts
+# need. Copy it to ~/.config/hermes-agent-template/config.toml (the first
+# provisioning run does this for you) and edit the values for YOUR machine.
+#
+# Resolution precedence for each value (highest wins):
+#   explicit env var  >  ~/.hermes/fleet.env  >  this file  >  built-in fallback
+#
+# Override the config location with $HERMES_TEMPLATE_CONFIG if you keep it
+# somewhere other than $XDG_CONFIG_HOME/hermes-agent-template/config.toml.
+
+[fleet]
+# Absolute path to the shared Hermes executable every agent launcher execs.
+hermes_bin = "~/.hermes/hermes-agent/.venv/bin/hermes"
+# Checkout of the hermes-agent repo. Its .venv is used to install nats-py, etc.
+hermes_repo = "~/.hermes/hermes-agent"
+# Fallback runtime scaffold dir — used only when an agent's vendored
+# ./.runtime-scaffold is missing.
+runtime_scaffold_dir = "~/code/hermes-agent-template/runtime-scaffold"
+# Shared fleet source-of-truth env file + fleet registry. ~ is expanded.
+fleet_env = "~/.hermes/fleet.env"
+registry_file = "~/.hermes/agents-registry.yaml"
+# Shared auth roots. HERMES_OAUTH_FILE is the Hermes provider OAuth store
+# (including openai-codex); CODEX_HOME is for Codex CLI/app-server auth.
+oauth_file = "~/.hermes/auth.json"
+codex_home = "~/.codex"
+# Canonical external skills dir mirrored into each agent profile.
+canonical_skills_dir = "/home/delorenj/.agents/skills"
+# PM-only external skill libraries surfaced alongside Hermes built-ins.
+pm_external_skill_dirs = [
+  "~/code/skillex/skill-sets/global/.system",
+  "~/code/skillex/packs/bmad/6.10.2",
+]
+# Voxxy plugin + service defaults for Hermes PM agents.
+voxxy_plugin_dir = "~/code/voxxy/plugins/tts/voxxy"
+vox_url = "https://vox.delo.sh"
+# Canonical PM config.yaml the provisioner seeds each runtime's config.yaml from.
+# This is the fleet-wide Hermes inference/skill config (model, toolsets, etc.)
+# every agent runtime starts from. ~ is expanded.
+# canonical_pm_config = "~/.hermes/config.yaml"
+# Skills symlinked into every agent's runtime skills root.
+symlinked_runtime_skills = [
+  "delonet-conventions",
+  "delonet-dotenv",
+  "hermes-pm-template-maintenance",
+  "hindsight",
+  "33god-projects",
+  "subagent-driven-development",
+]
+
+[github]
+# Owner of the per-agent runtime repos (creates <owner>/agent-hm-<repo>-<role>).
+runtime_repo_owner = "delorenj"
+
+[plane]
+# Plane instance base URL and workspace slug (one project per agent).
+base = "https://plane.delo.sh"
+workspace = "33god"
+
+[bloodbank]
+# NATS endpoint the consumer connects to.
+nats_host = "127.0.0.1"
+nats_port = 4222
+# Where the bloodbank docker compose lives (used only for a hint message). ~ ok.
+compose_dir = "~/code/33GOD/bloodbank"

package/templates/hermes-agent/docs/architecture.md

@@ -107,3 +107,8 @@ Each consumer subscribes to two lanes:
 Each agent emits CloudEvents 1.0 envelopes with `actor.agent_id`,
 `producer = hermes-agent:<id>`, `source = hermes://agent/<id>`. The naming
 spec is owned by Holyfields (`~/code/33GOD/bloodbank/docs/event-naming.md`).
+
+The current generated consumer is a transitional NATS receiver and audit
+capture. The target architecture is a first-class Hermes Bloodbank gateway where
+command events enter the same turn queue as Telegram/web messages; see
+[Bloodbank Gateway](bloodbank-gateway.md).

package/templates/hermes-agent/docs/bloodbank-gateway.md

@@ -0,0 +1,57 @@
+# Bloodbank Gateway
+
+Bloodbank command events should be a first-class Hermes gateway, not an inbox
+directory that a later heartbeat drains.
+
+## Goal
+
+Make this true:
+
+```
+Telegram message -> Hermes gateway -> agent turn queue -> agent acts
+Bloodbank command -> Hermes gateway -> agent turn queue -> agent acts
+Web message      -> Hermes gateway -> agent turn queue -> agent acts
+```
+
+The transport changes; the agent turn contract does not.
+
+## Current State
+
+`runtime-scaffold/bloodbank-consumer.py` subscribes to NATS subjects and writes
+JSON files under `bloodbank-inbox/`. That proves subscription, envelope parsing,
+and durable audit capture, but it is not command execution. It can accumulate
+files while the agent never acts.
+
+## Target Contract
+
+- The Bloodbank gateway subscribes to `bloodbank.cmd.v1.agent.<agent_id>.>`.
+- Each command event is converted into the same internal Hermes message/turn
+  shape used by Telegram and web gateways.
+- Hermes owns backpressure: if the agent is busy, the command waits in the
+  message queue until the agent can act.
+- The gateway emits lifecycle events:
+  - received
+  - accepted or rejected
+  - turn_started
+  - turn_completed or turn_failed
+- Replies use the incoming `correlationid` and `reply_to`/reply subject when
+  present.
+- Idempotency uses the CloudEvent `id`; duplicate events do not create duplicate
+  turns.
+
+## Required Work
+
+1. Add a Hermes transport adapter for Bloodbank/NATS.
+2. Define a command payload schema that maps cleanly to a user prompt plus
+   metadata (`actor`, `source`, `priority`, `correlationid`, `reply_to`).
+3. Replace the file-inbox consumer service with `hermes gateway bloodbank run`
+   or equivalent.
+4. Keep optional audit persistence, but make it observational only.
+5. Add smoke tests that publish a NATS command and assert that a Hermes turn is
+   created, processed, and acknowledged.
+
+## Non-Goals
+
+- No heartbeat inbox drain.
+- No polling directory as the command execution mechanism.
+- No per-agent one-off consumer logic.

package/templates/hermes-agent/docs/fleet-control-plane/README.md

@@ -24,6 +24,7 @@ The Fleet remains a set of independently useful parts:
 - [prd.md](./prd.md) - Functional and non-functional requirements.
 - [architecture.md](./architecture.md) - Technical architecture and ADRs.
 - [epics-and-stories.md](./epics-and-stories.md) - Implementation backlog with acceptance criteria.
+- [n8n-service-hub.md](./n8n-service-hub.md) - Concrete service-hub shape for n8n plus systemd fallback.
 - [implementation-readiness-report-2026-06-27.md](./implementation-readiness-report-2026-06-27.md) - Readiness assessment and launch gates.
 
 ## Adapted BMAD Note
@@ -32,4 +33,3 @@ The formal BMAD workflow expects a project-local `_bmad` runtime, PRD, and
 step-by-step user confirmations. This repo does not currently contain `_bmad`.
 These artifacts preserve the BMAD intent and structure while using the live
 architecture review and advanced elicitation decisions as input.
-

package/templates/hermes-agent/docs/fleet-control-plane/n8n-service-hub.md

@@ -0,0 +1,60 @@
+# n8n Service Hub
+
+n8n should become the visible service hub for fleet operations while systemd
+remains the local survival layer.
+
+## Shape
+
+- systemd owns process supervision on each host.
+- n8n owns visibility, operator controls, scheduling, and multi-service flows.
+- pjangler owns deterministic generation and reconciliation of both sides.
+
+## Service Model
+
+Each installed Hermes agent service is represented as an n8n node/workflow item:
+
+- gateway service
+- Bloodbank gateway or transitional consumer
+- heartbeat timer/service
+- runtime checkpoint status
+- ticket-provider health check
+
+The node does not replace systemd. It calls stable commands such as:
+
+```
+systemctl --user status hermes-<agent>-heartbeat.timer
+systemctl --user restart hermes-<agent>-gateway.service
+pj fleet status --agent <agent_id> --json
+pj fleet reconcile --agent <agent_id> --apply
+```
+
+## Heartbeat v2
+
+Checkpoint era means the only recurring task was an hourly runtime
+commit/push. It preserved state but did not manage work.
+
+Heartbeat v2 is a frequent, cheap tick:
+
+- always performs a gated runtime checkpoint
+- optionally performs autonomous board reconciliation when
+  `.project.json automation.reconcile.enabled` is true
+- records status in runtime state files for fleet status readers
+- can be triggered by systemd locally or by n8n centrally
+
+## First Implementation Pass
+
+1. Extend `pj fleet status --json` to include service unit state, last heartbeat,
+   last checkpoint, and ticket-provider resolution.
+2. Generate an n8n workflow from `~/.hermes/agents-registry.yaml`.
+3. Add n8n actions for status, restart, reconcile dry-run, reconcile apply, and
+   log tail.
+4. Keep systemd timers installed and enabled as fallback.
+5. Add drift detection when n8n and systemd disagree about an agent.
+
+## Open Questions
+
+- Whether n8n should invoke local commands through SSH, an agent-side webhook,
+  or a small host-local control API.
+- How much service history should live in n8n versus Hermes runtime state.
+- Whether Bloodbank gateway events should also drive n8n workflows for visible
+  operator traces.

package/templates/hermes-agent/docs/operations.md

@@ -190,7 +190,7 @@ hermes profile delete ${AGENT}
 # 3. Archive the ticket board if the provider supports archival
 PROJECT_ID=$(python3 -c "import yaml,pathlib; print(yaml.safe_load(pathlib.Path.home().joinpath('.hermes/agents-registry.yaml').read_text())['agents']['${AGENT}']['plane']['project_id'])")
 curl -X POST "https://plane.delo.sh/api/v1/workspaces/33god/projects/${PROJECT_ID}/archive/" \
-  -H "X-API-Key: ${PLANE_33GOD_API_KEY}"
+  -H "X-API-Key: ${PLANE_API_KEY:-${PLANE_33GOD_API_KEY}}"
 
 # 4. BotFather: /deletebot @<repo>_<role>_bot
 # 5. Archive runtime repo (GitHub UI; we don't have delete_repo scope by default)

package/templates/hermes-agent/docs/sentinel/README.md

@@ -52,7 +52,7 @@ For a local, single-machine install (no GitHub runtime repo, no Telegram, no
 NATS), use the one-command bootstrap. From inside the target project:
 
 ```bash
-export PLANE_API_KEY=<key>   # or TRELLO_KEY + TRELLO_TOKEN
+export PLANE_33GOD_API_KEY=<key>   # or PLANE_API_KEY / TRELLO_KEY + TRELLO_TOKEN
 curl -fsSL https://raw.githubusercontent.com/delorenj/hermes-agent-template/main/install-local.sh | sh
 ```
 
@@ -77,7 +77,7 @@ All paths are relative to the repository root.
 | Path | What it is |
 | --- | --- |
 | `copier.yml` | Questions (`role`, `ticket_provider`) and the `_tasks` provisioning chain. |
-| `template/role.yaml.jinja` | The rendered role manifest, including the `ticket_provider` binding and the `reconcile` knobs (`grace_hours`, `auto_review`). |
+| `template/role.yaml.jinja` | The rendered role identity/personality manifest. Repo-owned board binding and reconciliation knobs live in repo-root `.project.json`. |
 | `template/.scripts/lib/ticket-provider.sh` | The adapter dispatcher (`tp`). The engine's only seam to a ticket system. |
 | `template/.scripts/providers/{plane,trello}.sh` | The provider adapters. |
 | `template/.scripts/42-ticket-provider.sh` | Provisioning step that resolves or creates the board. |

package/templates/hermes-agent/docs/sentinel/development.md

@@ -112,7 +112,7 @@ repository root instead of driving Copier by hand. From inside the target
 project:
 
 ```bash
-export PLANE_API_KEY=<key>   # or TRELLO_KEY + TRELLO_TOKEN
+export PLANE_33GOD_API_KEY=<key>   # or PLANE_API_KEY / TRELLO_KEY + TRELLO_TOKEN
 curl -fsSL https://raw.githubusercontent.com/delorenj/hermes-agent-template/main/install-local.sh | sh
 ```
 
@@ -185,8 +185,8 @@ SKIP_TELEGRAM=1 SKIP_RUNTIME_REPO=1 SKIP_PLANE=1 SKIP_BLOODBANK=1 \
 ```
 
 After provisioning, set the board binding in
-`agents/hermes/pm/role.yaml`. For Trello, set `ticket_provider.board` to the
-board id; for Plane, set `ticket_provider.workspace` and `ticket_provider.project`.
+repo-root `.project.json`. For Trello, set `ticket_provider.board_id` to the
+board id; for Plane, set `ticket_provider.workspace` and `ticket_provider.board_id`.
 Make the provider key available to the heartbeat's environment: on Linux through
 a `systemd` `EnvironmentFile` (for example
 `~/.hermes/<agent_id>.env`); on macOS the `launchd` agent sources that same

package/templates/hermes-agent/docs/sentinel/providers.md

@@ -63,8 +63,9 @@ Set credentials in the environment and the board binding in `role.yaml`.
 <details>
 <summary>Plane</summary>
 
-- Credentials: `PLANE_API_KEY`. Endpoint: `PLANE_BASE` (default
-  `https://plane.delo.sh`).
+- Credentials: `PLANE_API_KEY` or workspace-specific
+  `PLANE_<WORKSPACE>_API_KEY` from the shared fleet env. Endpoint:
+  `PLANE_BASE` (default `https://plane.delo.sh`).
 - Binding:
 
   ```yaml
@@ -139,7 +140,7 @@ Before you touch a live board, confirm the adapter parses and fails cleanly.
    exit, with no Python traceback:
 
    ```bash
-   ( unset PLANE_API_KEY; sh template/.scripts/providers/plane.sh resolve )
+   ( unset PLANE_API_KEY PLANE_33GOD_API_KEY; sh template/.scripts/providers/plane.sh resolve )
    ```
 
 ## Verifying an adapter against a live board
@@ -150,8 +151,8 @@ never closes or modifies a ticket, so it's safe to run.
 
 ```bash
 # 1. Load the credential into the environment only (never print it).
-export PLANE_API_KEY="$(grep -E '^(export )?PLANE_API_KEY=' \
-  ~/.hermes/<agent>.env | head -1 | sed -E 's/^(export )?PLANE_API_KEY=//; s/^"//; s/"$//')"
+export PLANE_API_KEY="$(grep -E '^(export )?PLANE(_[A-Z0-9_]+)?_API_KEY=' \
+  ~/.hermes/<agent>.env | head -1 | sed -E 's/^(export )?PLANE(_[A-Z0-9_]+)?_API_KEY=//; s/^"//; s/"$//')"
 
 # 2. Stage a role directory bound to the real board.
 T=$(mktemp -d); RD="$T/agents/hermes/pm"

package/templates/hermes-agent/install-local.sh

@@ -18,7 +18,8 @@
 #   HAT_PROVIDER=plane|trello   (default: plane)
 #   HAT_ROLES="pm"                     roles to install (default: pm)
 #   HAT_DRY_RUN=1              print actions, change nothing
-#   Provider creds: PLANE_API_KEY+PLANE_BASE | TRELLO_KEY+TRELLO_TOKEN
+#   Provider creds: PLANE_API_KEY or PLANE_<WORKSPACE>_API_KEY + PLANE_BASE
+#                   | TRELLO_KEY+TRELLO_TOKEN
 set -eu
 
 say()  { printf '\033[36m%s\033[0m\n' "$*"; }
@@ -113,9 +114,13 @@ TP_BOARD="${HAT_TRELLO_BOARD:-}"
 case "$PROVIDER" in
   plane)
     ask PLANE_BASE "Plane base URL" "https://app.plane.so"
-    : "${PLANE_API_KEY:?Set PLANE_API_KEY in your environment, then re-run}"
     ask TP_WORKSPACE "Plane workspace slug" ""
     [ -n "$TP_WORKSPACE" ] || die "workspace is required"
+    TP_WORKSPACE_KEY="$(printf '%s' "$TP_WORKSPACE" | tr '[:lower:]' '[:upper:]' | sed 's/[^A-Z0-9]/_/g')"
+    TP_WORKSPACE_KEY="PLANE_${TP_WORKSPACE_KEY}_API_KEY"
+    eval "TP_WORKSPACE_API_KEY=\${$TP_WORKSPACE_KEY:-}"
+    PLANE_API_KEY="${PLANE_API_KEY:-$TP_WORKSPACE_API_KEY}"
+    : "${PLANE_API_KEY:?Set PLANE_API_KEY or $TP_WORKSPACE_KEY in your environment, then re-run}"
     say "   Plane projects in '$TP_WORKSPACE':"
     _pj="$(mktemp)"
     curl -fsS "$PLANE_BASE/api/v1/workspaces/$TP_WORKSPACE/projects/?per_page=100" \
@@ -133,7 +138,7 @@ PY
     rm -f "$_pj"
     ask TP_PROJECT "Plane project UUID to manage" ""
     [ -n "$TP_PROJECT" ] || die "project UUID is required"
-    CRED_LINES="PLANE_API_KEY=$PLANE_API_KEY
+    CRED_LINES="$TP_WORKSPACE_KEY=$PLANE_API_KEY
 PLANE_BASE=$PLANE_BASE"
     ;;
   trello)
@@ -159,12 +164,13 @@ fi
 export SKIP_TELEGRAM=1 SKIP_EMAIL=1 SKIP_RUNTIME_REPO=1 SKIP_PLANE=1 \
        SKIP_BLOODBANK=1 SKIP_SYSTEMD=1
 ROLES="${HAT_ROLES:-pm}"
+SCRUB_PLANE_KEY="${TP_WORKSPACE_KEY:-PLANE_DEFAULT_API_KEY}"
 for ROLE in $ROLES; do
   say "5. provisioning role: $ROLE"
   DEST="$PROJECT_DIR/agents/hermes/$ROLE"
   # Scrub provider creds from copier's environment so 42-ticket-provider skips
   # board CREATION; we bind to the existing board in step 6 instead.
-  run "env -u PLANE_API_KEY -u PLANE_33GOD_API_KEY \
+  run "env -u PLANE_API_KEY -u '$SCRUB_PLANE_KEY' \
         -u TRELLO_KEY -u TRELLO_TOKEN \
         copier copy '$TEMPLATE_SRC' '$DEST' --trust --defaults --overwrite \
         --data target_repo='$REPO' --data role='$ROLE' --data ticket_provider='$PROVIDER'"

package/templates/hermes-agent/runtime-scaffold/bloodbank-consumer.py

@@ -6,9 +6,11 @@ Subscribes to:
     bloodbank.evt.v1.repo.{{repo}}.>
     bloodbank.cmd.v1.agent.{{agent_id}}.>
 
-For each event/command received, writes it to the agent's notification queue at
-$HERMES_HOME/bloodbank-inbox/<timestamp>.json so the gateway can ingest it on
-the next tick. Reconnects on broker churn; idempotent across restarts.
+This scaffold is a transitional receiver: it proves NATS subscription and keeps
+a durable audit copy at $HERMES_HOME/bloodbank-inbox/<timestamp>.json. It is
+not the final command path. Bloodbank command subjects should become a Hermes
+gateway/transport so each consumed event enters the same turn queue as Telegram
+or web input, with backpressure handled by the queue instead of by a file drain.
 
 Generated by hermes-agent-template/runtime-scaffold/bloodbank-consumer.py and
 rendered with role-specific values at provision time. Re-render by re-running

package/templates/hermes-agent/scripts/fleet-sync.sh

@@ -42,7 +42,11 @@ for p in sys.argv[2].split("."):
         cur = cur[p]
     else:
         print(sys.argv[3], end=""); sys.exit(0)
-print(os.path.expanduser(str(cur)), end="")
+if isinstance(cur, list):
+    cur = " ".join(str(x) for x in cur)
+else:
+    cur = str(cur)
+print(os.path.expanduser(cur), end="")
 PYEOF
   return 0
 }
@@ -56,6 +60,7 @@ REGISTRY_FILE="${HERMES_FLEET_REGISTRY_FILE:-$(cfg fleet.registry_file "$HOME/.h
 PROFILES_DIR="${HERMES_FLEET_HOME:-$HOME/.hermes}/profiles"
 VOXXY_PLUGIN_DIR="${VOXXY_PLUGIN_DIR:-$(cfg fleet.voxxy_plugin_dir "$HOME/code/voxxy/plugins/tts/voxxy")}"
 VOX_URL_VALUE="${VOX_URL:-$(cfg fleet.vox_url 'https://vox.delo.sh')}"
+PM_EXTERNAL_SKILL_DIRS="${PM_EXTERNAL_SKILL_DIRS:-$(cfg fleet.pm_external_skill_dirs "$HOME/code/skillex/skill-sets/global/.system $HOME/code/skillex/packs/bmad/6.10.2")}"
 
 APPLY=0
 RESTART=1
@@ -136,6 +141,42 @@ path.write_text("\n".join(lines) + "\n")
 PYEOF
 }
 
+pm_skill_dirs_status() {  # pm_skill_dirs_status <config-path>
+  python3 - "$1" "$PM_EXTERNAL_SKILL_DIRS" <<'PYEOF'
+import pathlib
+import sys
+
+import yaml
+
+path = pathlib.Path(sys.argv[1])
+desired = [entry for entry in sys.argv[2].split() if entry]
+if not path.exists():
+    print('missing')
+    raise SystemExit(0)
+data = yaml.safe_load(path.read_text()) or {}
+skills = data.get('skills') or {}
+current = list(skills.get('external_dirs') or [])
+print('ok' if current == desired else 'mismatch')
+PYEOF
+}
+
+set_pm_skill_dirs() {  # set_pm_skill_dirs <config-path>
+  python3 - "$1" "$PM_EXTERNAL_SKILL_DIRS" <<'PYEOF'
+import pathlib
+import sys
+
+import yaml
+
+path = pathlib.Path(sys.argv[1])
+desired = [entry for entry in sys.argv[2].split() if entry]
+data = yaml.safe_load(path.read_text()) or {}
+skills = data.get('skills') or {}
+skills['external_dirs'] = desired
+data['skills'] = skills
+path.write_text(yaml.safe_dump(data, sort_keys=False))
+PYEOF
+}
+
 wanted_agent() {
   [[ ${#ONLY_AGENTS[@]} -eq 0 ]] && return 0
   local a
@@ -238,6 +279,28 @@ while IFS=$'\t' read -r agent_id role_dir profile_name gateway_unit consumer_uni
   # 5. PM fleet voice contract: runtime plugin symlink + Voxxy config + VOX_URL.
   role_name="$(basename "$role_dir")"
   if [[ "$role_name" == "pm" && -d "$runtime" ]]; then
+    runtime_config="$runtime/config.yaml"
+    if [[ -n "$PM_EXTERNAL_SKILL_DIRS" ]]; then
+      skill_dir_status="$(pm_skill_dirs_status "$runtime_config")"
+      case "$skill_dir_status" in
+        ok) ;;
+        missing)
+          note "$agent_id" DRIFT "runtime config missing: $runtime_config"
+          DRIFT=$((DRIFT + 1))
+          ;;
+        *)
+          if [[ $APPLY -eq 1 ]]; then
+            set_pm_skill_dirs "$runtime_config"
+            note "$agent_id" FIXED "PM runtime skills.external_dirs synchronized"
+            changed=1; FIXED=$((FIXED + 1))
+          else
+            note "$agent_id" DRIFT "PM runtime skills.external_dirs differ from fleet contract"
+            DRIFT=$((DRIFT + 1))
+          fi
+          ;;
+      esac
+    fi
+
     plugin_link="$runtime/plugins/tts/voxxy"
     if [[ -d "$VOXXY_PLUGIN_DIR" ]]; then
       if [[ -L "$plugin_link" ]]; then

package/templates/hermes-agent/template/.gitignore.jinja

@@ -4,3 +4,5 @@
 # We just ignore the provisioning log so it doesn't end up in the project repo.
 .scripts/.provision.log
 .scripts/.last-run
+runtime/
+

package/templates/hermes-agent/template/.scripts/01-config.sh

@@ -26,6 +26,7 @@ hermes_repo = "~/.hermes/hermes-agent"
 fleet_env = "~/.hermes/fleet.env"
 registry_file = "~/.hermes/agents-registry.yaml"
 canonical_skills_dir = "/home/delorenj/.agents/skills"
+pm_external_skill_dirs = ["~/code/skillex/skill-sets/global/.system", "~/code/skillex/packs/bmad/6.10.2"]
 
 [github]
 runtime_repo_owner = "delorenj"

package/templates/hermes-agent/template/.scripts/05-fleet-env.sh

@@ -47,6 +47,15 @@ PYEOF
 
 upsert_fleet_env HERMES_FLEET_OAUTH_FILE "$HERMES_OAUTH_FILE"
 upsert_fleet_env HERMES_FLEET_CODEX_HOME "$CODEX_HOME"
+
+PLANE_WORKSPACE_KEY="$(plane_workspace_key "$PLANE_WORKSPACE")"
+PLANE_WORKSPACE_VALUE="${!PLANE_WORKSPACE_KEY:-}"
+if [[ -z "$PLANE_WORKSPACE_VALUE" && -n "${PLANE_API_KEY:-}" ]]; then
+  PLANE_WORKSPACE_VALUE="$PLANE_API_KEY"
+fi
+if [[ -n "$PLANE_WORKSPACE_VALUE" ]]; then
+  upsert_fleet_env "$PLANE_WORKSPACE_KEY" "$PLANE_WORKSPACE_VALUE"
+fi
 chmod 600 "$FLEET_ENV"
 
 mark_done 05-fleet-env

package/templates/hermes-agent/template/.scripts/10-hermes-profile.sh

@@ -110,10 +110,29 @@ CANONICAL_SKILLS_DIR="${CANONICAL_SKILLS_DIR:-$(config_get fleet.canonical_skill
 CANONICAL_PM_SKILL_SRC="$CANONICAL_SKILLS_DIR/subagent-driven-development"
 LOCAL_PM_SKILL_DST="$PROFILE_HOME/skills/software-development/subagent-driven-development"
 
-if [[ -d "$CANONICAL_SKILLS_DIR" ]]; then
-  log "    setting skills.external_dirs[0] = $CANONICAL_SKILLS_DIR"
-  env HERMES_HOME="$PROFILE_HOME" "$HERMES_BIN" config set skills.external_dirs.0 "$CANONICAL_SKILLS_DIR"
+if [[ "$ROLE" == "pm" ]]; then
+  PM_EXTERNAL_SKILL_DIRS="${PM_EXTERNAL_SKILL_DIRS:-$(config_get fleet.pm_external_skill_dirs "$HOME/code/skillex/skill-sets/global/.system $HOME/code/skillex/packs/bmad/6.10.2")}" 
+  read -r -a RESOLVED_PM_EXTERNAL_SKILL_DIRS <<< "$PM_EXTERNAL_SKILL_DIRS"
+  if [[ ${#RESOLVED_PM_EXTERNAL_SKILL_DIRS[@]} -gt 0 ]]; then
+    log "    setting PM skills.external_dirs = ${RESOLVED_PM_EXTERNAL_SKILL_DIRS[*]}"
+    python3 - "$PROFILE_HOME/config.yaml" "${RESOLVED_PM_EXTERNAL_SKILL_DIRS[@]}" <<'PYEOF'
+import pathlib
+import sys
+
+import yaml
 
+path = pathlib.Path(sys.argv[1])
+external_dirs = sys.argv[2:]
+data = yaml.safe_load(path.read_text()) or {}
+skills = data.get("skills") or {}
+skills["external_dirs"] = external_dirs
+data["skills"] = skills
+path.write_text(yaml.safe_dump(data, sort_keys=False))
+PYEOF
+  fi
+fi
+
+if [[ -d "$CANONICAL_SKILLS_DIR" ]]; then
   # Ensure key PM/local-ops skills are symlinked into runtime/profile skills root.
   # This preserves canonical ownership and keeps updates instant across agents.
   read -r -a SYMLINKED_RUNTIME_SKILLS <<< "${SYMLINKED_RUNTIME_SKILLS:-$(config_get fleet.symlinked_runtime_skills 'delonet-conventions delonet-dotenv hermes-pm-template-maintenance hindsight subagent-driven-development')}"

package/templates/hermes-agent/template/.scripts/20-runtime-repo.sh

@@ -144,6 +144,28 @@ log "    profile symlink $PROFILE_HOME -> $RUNTIME_LOCAL"
 # Apply the one genuine per-repo config delta directly to the runtime config.
 env HERMES_HOME="$RUNTIME_LOCAL" "$HERMES_BIN" config set terminal.cwd "$PROJECT_PATH" >/dev/null 2>&1 || true
 
+if [[ "$ROLE" == "pm" ]]; then
+  PM_EXTERNAL_SKILL_DIRS="${PM_EXTERNAL_SKILL_DIRS:-$(config_get fleet.pm_external_skill_dirs "$HOME/code/skillex/skill-sets/global/.system $HOME/code/skillex/packs/bmad/6.10.2")}"
+  read -r -a RESOLVED_PM_EXTERNAL_SKILL_DIRS <<< "$PM_EXTERNAL_SKILL_DIRS"
+  if [[ ${#RESOLVED_PM_EXTERNAL_SKILL_DIRS[@]} -gt 0 ]]; then
+    python3 - "$RUNTIME_LOCAL/config.yaml" "${RESOLVED_PM_EXTERNAL_SKILL_DIRS[@]}" <<'PYEOF'
+import pathlib
+import sys
+
+import yaml
+
+path = pathlib.Path(sys.argv[1])
+external_dirs = sys.argv[2:]
+data = yaml.safe_load(path.read_text()) or {}
+skills = data.get("skills") or {}
+skills["external_dirs"] = external_dirs
+data["skills"] = skills
+path.write_text(yaml.safe_dump(data, sort_keys=False))
+PYEOF
+    log "    set PM runtime skills.external_dirs -> ${RESOLVED_PM_EXTERNAL_SKILL_DIRS[*]}"
+  fi
+fi
+
 if [[ "$ROLE" == "pm" ]]; then
   VOXXY_PLUGIN_DIR="${VOXXY_PLUGIN_DIR:-$(config_get fleet.voxxy_plugin_dir "$HOME/code/voxxy/plugins/tts/voxxy")}"
   if [[ -d "$VOXXY_PLUGIN_DIR" ]]; then