@delorenj/pjangler 1.2.9 → 1.2.13

package/templates/hermes-agent/template/.scripts/42-ticket-provider.sh

@@ -10,11 +10,12 @@
 #   2. Otherwise (hermes run on a repo with no CommonProject board yet)
 #      -> create ONE repo-named board and write it back into .project.json so
 #         it becomes the SOT for every agent in this repo.
-# Either way we register this agent under .project.json `agents` and mirror the
-# binding into role.yaml for back-compat (80-registry.sh / 99-summary.sh).
+# Either way we register this agent under .project.json `agents`. role.yaml is
+# identity/personality only; it must not carry board UUIDs or derived URLs.
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 load_role_env
+resolve_plane_api_key "$PLANE_WORKSPACE"
 # shellcheck source=lib/ticket-provider.sh
 source "$(dirname "$0")/lib/ticket-provider.sh"
 
@@ -46,13 +47,13 @@ PY
 }
 
 # pj_write — merge board binding (optional) + this agent into .project.json.
-# args: set_provider(0|1) provider board_id board_url workspace identifier
+# args: set_provider(0|1) provider board_id workspace identifier
 pj_write() {
   REPO="$REPO" REPO_ROOT="$REPO_ROOT" AGENT_ID="$AGENT_ID" ROLE="$ROLE" \
   ROLE_DIR_REL="$ROLE_DIR_REL" PROJECT_DESC="${PROJECT_DESC:-}" \
   python3 - "$PROJECT_JSON" "$@" <<'PY'
 import sys, os, json, pathlib
-(path, set_provider, provider, board_id, board_url, workspace, identifier) = sys.argv[1:8]
+(path, set_provider, provider, board_id, workspace, identifier) = sys.argv[1:7]
 p = pathlib.Path(path)
 try:
     d = json.loads(p.read_text())
@@ -71,43 +72,28 @@ if set_provider == "1":
     if workspace:  tp["workspace"] = workspace
     if identifier: tp["identifier"] = identifier
     if board_id:   tp["board_id"] = board_id
-    if board_url:  tp["board_url"] = board_url
+    tp.pop("board_url", None)
+    tp["state"] = "linked" if board_id else tp.get("state", "planned")
 ag = d.setdefault("agents", {})
 ag[os.environ["AGENT_ID"]] = {"role": os.environ["ROLE"], "role_dir": os.environ["ROLE_DIR_REL"]}
+automation = d.setdefault("automation", {})
+automation.setdefault("reconcile", {"enabled": False, "grace_hours": 0, "auto_review": True})
 p.write_text(json.dumps(d, indent=2) + "\n")
 PY
   log "    .project.json updated (agent=$AGENT_ID)"
 }
 
-# Mirror the binding into role.yaml so legacy consumers keep working.
-mirror_to_role_yaml() {
-  # mirror_to_role_yaml <provider> <board_id> <board_url> <workspace> <identifier>
-  local provider="$1" bid="$2" burl="$3" ws="$4" ident="$5"
+# Keep only the legacy adapter name in role.yaml. Stable board identity belongs
+# in .project.json.
+mirror_provider_name_to_role_yaml() {
+  local provider="$1"
   yaml_set ticket_provider.name "$provider" 2>/dev/null || true
-  [ -n "$bid" ]  && yaml_set ticket_provider.board_id "$bid" 2>/dev/null || true
-  [ -n "$burl" ] && yaml_set ticket_provider.board_url "$burl" 2>/dev/null || true
-  case "$provider" in
-    plane)
-      [ -n "$bid" ] && echo "$bid" > "$ROLE_DIR/.scripts/.plane-project-id"
-      [ -n "$ws" ]    && yaml_set ticket_provider.workspace "$ws" 2>/dev/null || true
-      [ -n "$bid" ]   && yaml_set ticket_provider.project "$bid" 2>/dev/null || true
-      [ -n "$ws" ]    && yaml_set plane.workspace "$ws" 2>/dev/null || true
-      [ -n "$ident" ] && yaml_set plane.identifier "$ident" 2>/dev/null || true
-      ;;
-    trello)
-      [ -n "$bid" ] && yaml_set ticket_provider.board "$bid" 2>/dev/null || true
-      ;;
-    *)
-      die "unsupported ticket provider: $provider (expected plane|trello)"
-      ;;
-  esac
 }
 
 # ── Provider resolution ──────────────────────────────────────────────────
 # An existing repo board (in .project.json) wins — every agent binds to it.
 SOT_TYPE="$(pj ticket_provider.type)"
 SOT_BOARD_ID="$(pj ticket_provider.board_id)"
-SOT_URL="$(pj ticket_provider.board_url)"
 SOT_WS="$(pj ticket_provider.workspace)"
 SOT_IDENT="$(pj ticket_provider.identifier)"
 
@@ -122,8 +108,8 @@ if [ -n "$SOT_BOARD_ID" ]; then
   fi
   case "$PROVIDER" in plane|trello) ;; *) die "unsupported ticket provider in .project.json: $PROVIDER (expected plane|trello)" ;; esac
   log "[42] binding $AGENT_ID to existing repo board (provider=$PROVIDER, id=$SOT_BOARD_ID)"
-  mirror_to_role_yaml "$PROVIDER" "$SOT_BOARD_ID" "$SOT_URL" "$SOT_WS" "$SOT_IDENT"
-  pj_write 0 "$PROVIDER" "" "" "" ""   # register agent only; board already recorded
+  mirror_provider_name_to_role_yaml "$PROVIDER"
+  pj_write 1 "$PROVIDER" "$SOT_BOARD_ID" "$SOT_WS" "$SOT_IDENT"
   mark_done 42-ticket-provider
   exit 0
 fi
@@ -146,16 +132,15 @@ case "$PROVIDER" in
     KEYVAR=PLANE_API_KEY; [ "$PROVIDER" = trello ] && KEYVAR=TRELLO_KEY
     if [[ -z "${!KEYVAR:-}" ]]; then
       warn "[42] $KEYVAR not set; skipping board creation. Set creds and re-run ./.scripts/42-ticket-provider.sh"
-      pj_write 1 "$PROVIDER" "" "" "${SOT_WS:-${PLANE_WORKSPACE:-}}" "$IDENT"
+      pj_write 1 "$PROVIDER" "" "${SOT_WS:-${PLANE_WORKSPACE:-}}" "$IDENT"
       mark_done 42-ticket-provider; exit 0
     fi
     OUT="$(tp create_board "$NAME" "$IDENT" "$DESC")" || die "create_board failed for $PROVIDER"
     BID="$(printf '%s' "$OUT" | python3 -c 'import sys,json; print(json.load(sys.stdin).get("board_id",""))')"
-    BURL="$(printf '%s' "$OUT" | python3 -c 'import sys,json; print(json.load(sys.stdin).get("board_url",""))')"
     WS="${SOT_WS:-${PLANE_WORKSPACE:-}}"
     [ "$PROVIDER" = trello ] && WS=""
-    mirror_to_role_yaml "$PROVIDER" "$BID" "$BURL" "$WS" "$IDENT"
-    pj_write 1 "$PROVIDER" "$BID" "$BURL" "$WS" "$IDENT"
+    mirror_provider_name_to_role_yaml "$PROVIDER"
+    pj_write 1 "$PROVIDER" "$BID" "$WS" "$IDENT"
     ;;
 
   *) die "unknown ticket provider: $PROVIDER (expected plane|trello)" ;;

package/templates/hermes-agent/template/.scripts/70-systemd.sh

@@ -5,7 +5,10 @@
 source "$(dirname "$0")/_lib.sh"
 load_role_env
 
-already_done 70-systemd && { log "[70] systemd already installed — skipping"; exit 0; }
+if already_done 70-systemd && [[ "${FORCE_SYSTEMD:-0}" != "1" ]]; then
+  log "[70] systemd already installed — skipping"
+  exit 0
+fi
 [[ "${SKIP_SYSTEMD:-0}" == "1" ]] && { log "[70] systemd — SKIPPED"; mark_done 70-systemd; exit 0; }
 
 RUNTIME="$ROLE_DIR/runtime"
@@ -34,6 +37,7 @@ Environment=HERMES_OAUTH_FILE=$HERMES_OAUTH_FILE
 Environment=CODEX_HOME=$CODEX_HOME
 Environment=HERMES_KANBAN_DISPATCH_IN_GATEWAY=0
 Environment=HERMES_KANBAN_SLASH_ENABLED=0
+EnvironmentFile=-$FLEET_ENV
 EnvironmentFile=-$RUNTIME/.env
 ExecStart=$HERMES_BIN gateway run --replace
 Restart=on-failure
@@ -59,6 +63,7 @@ WorkingDirectory=$RUNTIME
 Environment=HERMES_HOME=$RUNTIME
 Environment=HERMES_OAUTH_FILE=$HERMES_OAUTH_FILE
 Environment=CODEX_HOME=$CODEX_HOME
+EnvironmentFile=-$FLEET_ENV
 EnvironmentFile=-$RUNTIME/.env
 ExecStart=$HERMES_AGENT_REPO/.venv/bin/python $RUNTIME/bloodbank-consumer.py
 Restart=on-failure
@@ -88,6 +93,7 @@ WorkingDirectory=$REPO_ROOT
 Environment=HERMES_HOME=$RUNTIME
 Environment=HERMES_OAUTH_FILE=$HERMES_OAUTH_FILE
 Environment=CODEX_HOME=$CODEX_HOME
+EnvironmentFile=-$FLEET_ENV
 EnvironmentFile=-%h/.config/hermes-agent/env
 EnvironmentFile=-%h/.hermes/env
 EnvironmentFile=-%h/.hermes/hermes-agent.env
@@ -114,6 +120,7 @@ UNIT
 
 if systemd_user_available; then
   systemctl --user daemon-reload
+  systemctl --user disable --now "hermes-${AGENT_ID}-checkpoint.timer" "hermes-${AGENT_ID}-checkpoint.service" >/dev/null 2>&1 || true
   # `enable --now` both enables (persist across login) AND starts the unit now, so a
   # freshly provisioned agent comes up live instead of dormant. Units with missing
   # creds (e.g. a gateway with no Telegram token yet) fail softly via Restart=on-failure.

package/templates/hermes-agent/template/.scripts/_lib.sh

@@ -62,6 +62,41 @@ p.write_text(new)
 PYEOF
 }
 
+# Locate the repo-root .project.json for this role, if present.
+project_json_path() {
+  local root
+  root="$(project_repo_path 2>/dev/null || true)"
+  [[ -n "$root" && -f "$root/.project.json" ]] && { printf '%s' "$root/.project.json"; return 0; }
+  return 1
+}
+
+# project_json_get <dotted.key> — read a string/scalar from repo-root
+# .project.json. This is the deterministic SOT for project wiring.
+project_json_get() {
+  local key="$1" path
+  path="$(project_json_path 2>/dev/null || true)"
+  [[ -f "$path" ]] || { printf ''; return 0; }
+  python3 - "$path" "$key" <<'PYEOF'
+import json
+import pathlib
+import sys
+
+path, key = sys.argv[1:3]
+try:
+    cur = json.loads(pathlib.Path(path).read_text())
+except Exception:
+    print("", end="")
+    raise SystemExit(0)
+for part in key.split("."):
+    if isinstance(cur, dict) and part in cur:
+        cur = cur[part]
+    else:
+        print("", end="")
+        raise SystemExit(0)
+print(cur if isinstance(cur, (str, int, float, bool)) else "", end="")
+PYEOF
+}
+
 # ─── Distributable config (~/.config/hermes-agent-template/config.toml) ──────
 # Single source of truth for environment-specific defaults so this template can
 # be handed to someone else without editing any script. Ship config.example.toml
@@ -112,8 +147,10 @@ load_role_env() {
   BOT_HANDLE=$(yaml_get telegram.bot_username)
   PROFILE_NAME=$(yaml_get profile)
 
-  # Plane workspace: empty in role.yaml -> resolve from config.toml.
-  PLANE_WORKSPACE=$(yaml_get plane.workspace)
+  # Plane workspace: repo-root .project.json wins; role.yaml is legacy fallback.
+  PLANE_WORKSPACE=$(project_json_get ticket_provider.workspace)
+  [[ -n "$PLANE_WORKSPACE" ]] || PLANE_WORKSPACE=$(yaml_get ticket_provider.workspace)
+  [[ -n "$PLANE_WORKSPACE" ]] || PLANE_WORKSPACE=$(yaml_get plane.workspace)
   [[ -n "$PLANE_WORKSPACE" ]] || PLANE_WORKSPACE=$(config_get plane.workspace "33god")
 
   # Runtime repo: role.yaml stores the bare repo name plus an optional owner.
@@ -129,6 +166,27 @@ load_role_env() {
          PLANE_WORKSPACE RUNTIME_REPO PROFILE_NAME
 }
 
+plane_workspace_key() {
+  local workspace="${1:-${PLANE_WORKSPACE:-}}"
+  workspace="$(printf '%s' "$workspace" | tr '[:lower:]' '[:upper:]' | sed 's/[^A-Z0-9]/_/g')"
+  [[ -n "$workspace" ]] || workspace="DEFAULT"
+  printf 'PLANE_%s_API_KEY' "$workspace"
+}
+
+resolve_plane_api_key() {
+  if [[ -n "${PLANE_API_KEY:-}" ]]; then
+    export PLANE_API_KEY
+    return 0
+  fi
+  local key value
+  key="$(plane_workspace_key "${1:-${PLANE_WORKSPACE:-}}")"
+  value="${!key:-}"
+  if [[ -n "$value" ]]; then
+    PLANE_API_KEY="$value"
+    export PLANE_API_KEY
+  fi
+}
+
 # Skip a step if previously completed (idempotent reruns).
 already_done() {
   local marker="$ROLE_DIR/.scripts/.done-$1"
@@ -165,7 +223,7 @@ BLOODBANK_COMPOSE_DIR="${BLOODBANK_COMPOSE_DIR:-$(config_get bloodbank.compose_d
 
 # Plane
 PLANE_BASE="${PLANE_BASE:-$(config_get plane.base 'https://plane.delo.sh')}"
-PLANE_API_KEY="${PLANE_API_KEY:-${PLANE_33GOD_API_KEY:-}}"
+PLANE_API_KEY="${PLANE_API_KEY:-}"
 
 export FLEET_ENV HERMES_BIN HERMES_AGENT_REPO HERMES_OAUTH_FILE CODEX_HOME \
        RUNTIME_SCAFFOLD_DIR REGISTRY_FILE \

package/templates/hermes-agent/template/.scripts/config.example.toml

@@ -27,6 +27,11 @@ oauth_file = "~/.hermes/auth.json"
 codex_home = "~/.codex"
 # Canonical external skills dir mirrored into each agent profile.
 canonical_skills_dir = "/home/delorenj/.agents/skills"
+# PM-only external skill libraries surfaced alongside Hermes built-ins.
+pm_external_skill_dirs = [
+  "~/code/skillex/skill-sets/global/.system",
+  "~/code/skillex/packs/bmad/6.10.2",
+]
 # Voxxy plugin + service defaults for Hermes PM agents.
 voxxy_plugin_dir = "~/code/voxxy/plugins/tts/voxxy"
 vox_url = "https://vox.delo.sh"

package/templates/hermes-agent/template/.scripts/heartbeat.sh

@@ -6,7 +6,7 @@
 # reconciliation pass when local state says no worker is active, the worker
 # heartbeat is stale, or the last full run is outside the cooldown window. The
 # full pass executes the role's sentinel.prompt.md, which reasons about tickets
-# through the ticket-provider adapter (Linear | Plane | Trello) — never a
+# through the ticket-provider adapter (Plane | Trello) — never a
 # hardcoded backend. After the sentinel decision (skip OR full), it
 # opportunistically checkpoints the runtime submodule (commit+push) at most once
 # per HEARTBEAT_CHECKPOINT_MIN_INTERVAL_SECONDS, so memory/session state stays
@@ -19,12 +19,18 @@ PROMPT_FILE="$ROLE_DIR/.scripts/sentinel.prompt.md"
 STATE_FILE="$RUNTIME/continuous-ticket-sentinel-state.json"
 LOCK_FILE="$RUNTIME/continuous-ticket-sentinel.lock"
 ROLE_YAML="$ROLE_DIR/role.yaml"
+FLEET_ENV="${HERMES_FLEET_ENV:-$HOME/.hermes/fleet.env}"
 LOG_FILE="$RUNTIME/logs/heartbeat.log"
 CHECKPOINT_BIN="$ROLE_DIR/.scripts/checkpoint.sh"
 CHECKPOINT_STAMP="$RUNTIME/.last-checkpoint"
 
+if [[ -f "$FLEET_ENV" ]]; then
+  # shellcheck disable=SC1090
+  source "$FLEET_ENV"
+fi
+
 # Hermes binary: explicit env > ~/.config/hermes-agent/hermes-bin > PATH.
-HERMES_BIN="${HERMES_BIN:-}"
+HERMES_BIN="${HERMES_BIN:-${HERMES_FLEET_BIN:-}}"
 if [[ -z "$HERMES_BIN" ]]; then
   if [[ -r "$HOME/.config/hermes-agent/hermes-bin" ]]; then
     HERMES_BIN="$(cat "$HOME/.config/hermes-agent/hermes-bin")"
@@ -80,13 +86,61 @@ print(value.strip().strip('"').strip("'"))
 PYEOF
 }
 
-# True only when role.yaml has a reconcile: block with enabled: true. Block-aware
-# so an unrelated `enabled:` leaf elsewhere in the file can't flip it on.
+repo_root() {
+  local dir="$ROLE_DIR"
+  for _ in 1 2 3 4 5; do
+    dir="$(dirname "$dir")"
+    if [[ -d "$dir/.git" || -f "$dir/.git" ]]; then printf '%s\n' "$dir"; return 0; fi
+  done
+  return 1
+}
+REPO_ROOT="$(repo_root)"
+PROJECT_JSON="$REPO_ROOT/.project.json"
+
+project_json_value() {
+  python3 - "$PROJECT_JSON" "$1" <<'PYEOF'
+import json
+import pathlib
+import sys
+
+path, key = sys.argv[1:3]
+try:
+    cur = json.loads(pathlib.Path(path).read_text())
+except Exception:
+    print("")
+    raise SystemExit(0)
+for part in key.split("."):
+    if isinstance(cur, dict) and part in cur:
+        cur = cur[part]
+    else:
+        print("")
+        raise SystemExit(0)
+print(cur if isinstance(cur, (str, int, float, bool)) else "")
+PYEOF
+}
+
+# Project-owned automation gate. Legacy role.yaml reconcile.enabled is honored
+# only for older agents that have not migrated their .project.json yet.
 reconcile_enabled() {
-  python3 - "$ROLE_YAML" <<'PYEOF'
-import re, sys
+  python3 - "$PROJECT_JSON" "$ROLE_YAML" <<'PYEOF'
+import json
+import re
+import sys
 from pathlib import Path
-text = Path(sys.argv[1]).read_text()
+project_path, role_path = map(Path, sys.argv[1:3])
+try:
+    project = json.loads(project_path.read_text())
+except Exception:
+    project = {}
+reconcile = ((project.get("automation") or {}).get("reconcile") or {}) if isinstance(project, dict) else {}
+if "enabled" in reconcile:
+    value = reconcile.get("enabled")
+    print("true" if str(value).lower() == "true" else "false")
+    raise SystemExit(0)
+try:
+    text = role_path.read_text()
+except Exception:
+    text = ""
 m = re.search(r'(?m)^reconcile:[ \t]*\n((?:[ \t]+\S.*\n?)*)', text)
 block = m.group(1) if m else ""
 me = re.search(r'(?m)^[ \t]+enabled:[ \t]*"?([A-Za-z]+)"?', block)
@@ -96,17 +150,8 @@ PYEOF
 
 AGENT_ID="$(yaml_value agent_id)"
 REPO_NAME="$(yaml_value repo)"
-PROVIDER="$(yaml_block_value ticket_provider name)"
-
-repo_root() {
-  local dir="$ROLE_DIR"
-  for _ in 1 2 3 4 5; do
-    dir="$(dirname "$dir")"
-    if [[ -d "$dir/.git" || -f "$dir/.git" ]]; then printf '%s\n' "$dir"; return 0; fi
-  done
-  return 1
-}
-REPO_ROOT="$(repo_root)"
+PROVIDER="$(project_json_value ticket_provider.type)"
+[[ -n "$PROVIDER" ]] || PROVIDER="$(yaml_block_value ticket_provider name)"
 cd "$REPO_ROOT"
 mkdir -p "$RUNTIME/logs"
 
@@ -132,11 +177,10 @@ else
 fi
 
 # Reconcile gate: the autonomous board-reconciliation pass runs only when
-# role.yaml's reconcile.enabled is true. Default off → the heartbeat just
-# checkpoints (behaves like the legacy hourly checkpoint timer). Flip
-# reconcile.enabled to opt a repo into autonomous board reconciliation.
+# repo-root .project.json automation.reconcile.enabled is true. Default off →
+# the heartbeat just checkpoints (legacy checkpoint-timer behavior).
 if [[ "$(reconcile_enabled)" != "true" ]]; then
-  printf '[heartbeat] reconcile disabled (reconcile.enabled != true) — checkpoint-only tick\n'
+  printf '[heartbeat] reconcile disabled (automation.reconcile.enabled != true) — checkpoint-only tick\n'
   maybe_checkpoint
   exit 0
 fi

package/templates/hermes-agent/template/.scripts/lib/ticket-provider.sh

@@ -3,8 +3,8 @@
 # sentinel engine and a concrete ticket system (Plane | Trello).
 #
 # The engine NEVER calls a provider directly. It calls `tp <op> [args...]`,
-# which dispatches to providers/<provider>.sh. Swapping providers is a one-line
-# config change in role.yaml (ticket_provider.name) — no engine edits.
+# which dispatches to providers/<provider>.sh. Repo-root .project.json owns the
+# provider/board binding; role.yaml is only a legacy provider-name fallback.
 #
 # Contract (operations every provider must implement):
 #   resolve                       -> JSON {provider, board_id, board_url}
@@ -19,7 +19,7 @@
 #   create_board <name> <id> <d>  -> JSON {board_id, board_url}
 #
 # Each provider reads its credentials from the environment (see providers/*.sh
-# headers) and the board binding from role.yaml under `ticket_provider:`.
+# headers) and the board binding from repo-root .project.json.
 
 # Resolve the provider name: explicit env wins, then repo-root .project.json
 # (the SOT), then role.yaml (self-parsed so this works even when _lib.sh /

package/templates/hermes-agent/template/.scripts/providers/plane.sh

@@ -1,12 +1,11 @@
 #!/usr/bin/env sh
 # Plane ticket-provider adapter.
 #
-# Credentials:  PLANE_API_KEY   (X-API-Key header)
+# Credentials:  PLANE_API_KEY or PLANE_<WORKSPACE>_API_KEY (X-API-Key header)
 # Endpoint:     PLANE_BASE       (default https://plane.delo.sh)
-# Board binding (role.yaml `ticket_provider:`):
-#   name: plane
+# Board binding (repo-root .project.json `ticket_provider:`):
 #   workspace: <workspace-slug>      (or env PLANE_WORKSPACE)
-#   project:   <project-uuid>        (set by create_board / 42-ticket-provider)
+#   board_id:  <project-uuid>        (set by create_board / 42-ticket-provider)
 #   state_map: { in_review: "In Review", completed: "Done" }   optional
 #
 # Plane model:  project = board, cycle = milestone, state.group in
@@ -21,9 +20,21 @@ ROLE_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
 ROLE_YAML="$ROLE_DIR/role.yaml"
 BASE="${PLANE_BASE:-https://plane.delo.sh}"
 
+FLEET_ENV="${HERMES_FLEET_ENV:-$HOME/.hermes/fleet.env}"
+if [ -f "$FLEET_ENV" ]; then
+  # shellcheck disable=SC1090
+  . "$FLEET_ENV"
+fi
+
 die() { echo "plane: $*" >&2; exit 1; }
 need_key() { [ -n "${PLANE_API_KEY:-}" ] || die "PLANE_API_KEY is not set"; }
 
+workspace_key() {
+  key="$(printf '%s' "${1:-default}" | tr '[:lower:]' '[:upper:]' | sed 's/[^A-Z0-9]/_/g')"
+  [ -n "$key" ] || key="DEFAULT"
+  printf 'PLANE_%s_API_KEY' "$key"
+}
+
 tp_cfg() {
   [ -f "$ROLE_YAML" ] || return 0
   python3 - "$ROLE_YAML" "$1" <<'PY'
@@ -54,13 +65,19 @@ else:
 PY
 }
 
-# Board binding: .project.json (SOT) first, then role.yaml, then env.
+# Board binding: .project.json (SOT) first, then legacy role.yaml, then env.
 WS="$(pj_cfg workspace)"; [ -n "$WS" ] || WS="$(tp_cfg workspace)"; WS="${WS:-${PLANE_WORKSPACE:-}}"
-PROJ="$(pj_cfg board_id)"; [ -n "$PROJ" ] || PROJ="$(tp_cfg project)"
+PROJ="$(pj_cfg board_id)"; [ -n "$PROJ" ] || PROJ="$(tp_cfg project)"; [ -n "$PROJ" ] || PROJ="$(tp_cfg board_id)"
 SM_IN_REVIEW="$(tp_cfg in_review)"; SM_IN_REVIEW="${SM_IN_REVIEW:-In Review}"
 SM_DONE="$(tp_cfg completed)"; SM_DONE="${SM_DONE:-Done}"
 API="$BASE/api/v1/workspaces/$WS"
 
+if [ -z "${PLANE_API_KEY:-}" ]; then
+  KEY="$(workspace_key "$WS")"
+  eval "PLANE_API_KEY=\${$KEY:-}"
+  export PLANE_API_KEY
+fi
+
 # api METHOD PATH [JSON_BODY] — call Plane REST, print response body.
 api() {
   need_key
@@ -68,9 +85,12 @@ api() {
   if [ -n "$body" ]; then
     curl -fsS -X "$method" "$API/$path" \
       -H "X-API-Key: $PLANE_API_KEY" -H "Content-Type: application/json" \
+      -H "User-Agent: curl/8.0" \
       -d "$body"
   else
-    curl -fsS -X "$method" "$API/$path" -H "X-API-Key: $PLANE_API_KEY"
+    curl -fsS -X "$method" "$API/$path" \
+      -H "X-API-Key: $PLANE_API_KEY" \
+      -H "User-Agent: curl/8.0"
   fi
 }
 
@@ -100,8 +120,8 @@ need_key
 
 case "$OP" in
   resolve)
-    [ -n "$WS" ] || die "workspace not set (role.yaml ticket_provider.workspace or PLANE_WORKSPACE)"
-    [ -n "$PROJ" ] || die "project not set (run 42-ticket-provider.sh)"
+    [ -n "$WS" ] || die "workspace not set (.project.json ticket_provider.workspace or PLANE_WORKSPACE)"
+    [ -n "$PROJ" ] || die "project not set (.project.json ticket_provider.board_id; run 42-ticket-provider.sh)"
     printf '{"provider":"plane","board_id":"%s","board_url":"%s/%s/projects/%s/issues/"}\n' \
       "$PROJ" "$BASE" "$WS" "$PROJ"
     ;;

package/templates/hermes-agent/template/role.yaml.jinja

@@ -21,35 +21,10 @@ profile: {{ agent_id }}
 telegram:
   bot_username: "{{ bot_handle }}"
 
-# Ticket-provider binding (plane | trello).
-# The heartbeat reconciliation pass talks ONLY to this via .scripts/lib/ticket-provider.sh;
-# swapping providers is a one-line change here. Filled in by 42-ticket-provider.sh.
+# Ticket-provider adapter preference (plane | trello).
+# Repo-owned board identity lives in repo-root .project.json, not in this role.
 ticket_provider:
   name: {{ ticket_provider }}
-  board_id: ""
-  board_url: ""
-{%- if ticket_provider == 'plane' %}
-  workspace: "{{ plane_workspace }}"
-  project: ""     # Plane project uuid (set by 42-ticket-provider.sh)
-{%- elif ticket_provider == 'trello' %}
-  board: ""       # Trello board id (set by 42-ticket-provider.sh)
-{%- endif %}
-  # Optional normalized-state name overrides for non-standard boards.
-  in_review: ""   # e.g. "In Review"
-  completed: ""   # e.g. "Done"
-
-# Board-reconciliation knobs for the heartbeat sentinel pass.
-reconcile:
-  enabled: false             # heartbeat runs the autonomous board-reconciliation pass ONLY when true; default off = checkpoint-only
-  grace_hours: 0             # 0 = no human-approval wait (adversarially-reviewed review-lane = done); set >0 to require a wait
-  auto_review: true          # autonomous adversarial review (act, do not wait) on/off
-
-# Plane metadata — retained for fleet-registry back-compat when provider=plane.
-plane:
-  # Empty -> resolved from ~/.config/hermes-agent-template/config.toml [plane].workspace
-  workspace: "{{ plane_workspace }}"
-  # identifier is set by .scripts/42-ticket-provider.sh after creation (plane only)
-  identifier: ""
 
 # Bloodbank wiring (consumed + produced subjects).
 bloodbank: