@delorenj/pjangler 1.3.0 → 1.4.2

package/templates/commonproject/template/mise.toml.jinja

@@ -12,20 +12,26 @@ _.file = [".env"]
 # i.e. All linked agent files MUST be siblings at
 # any given level of nesting.
 #
+# NOTE: every managed script is handed config_root EXPLICITLY. A mise enter
+# hook runs with cwd set to the directory you cd'd into -- including a PARENT
+# config's hook -- so a script that reads its subject from cwd reshapes
+# whichever nested repo you entered. config_root locates the file; the
+# argument locates the subject. The scripts refuse to run without it.
+#
 # NOTE: hooks are an array of [[hooks.enter]] tables (NOT enter = [ ... ]) and
 # every {{config_root}} path is single-quoted so it survives a space in the
 # project path — mise runs each `script` via `sh -c`.
 [[hooks.enter]]
-script = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh'"
+script = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh' '{% raw %}{{config_root}}{% endraw %}'"
 [[hooks.enter]]
 # Atomic (PJAN-24/PJAN-57): shell complexity lives in the managed script so
 # mise never interpolates temporary variables. The script uses mktemp, traps
 # cleanup, and replaces .env only after op inject succeeds.
 script = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/materialize-env.sh'"
 [[hooks.enter]]
-script = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/provision-packs.py'"
+script = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/provision-packs.py' --root '{% raw %}{{config_root}}{% endraw %}'"
 [[hooks.enter]]
-script = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/sync-skills.py' --scope project"
+script = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/sync-skills.py' --scope project --root '{% raw %}{{config_root}}{% endraw %}'"
 [[hooks.enter]]
 script = "[ -f '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/codegraph.sh' ] && '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/codegraph.sh' || true"
 {%- if agent_hooks_layer %}
@@ -51,16 +57,16 @@ task = "hooks:sync"
 {% endif %}
 [tasks."link:agentfiles"]
 description = "Symlink all agent files to AGENTS.md"
-run = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh'"
+run = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh' '{% raw %}{{config_root}}{% endraw %}'"
 
 [tasks."skills:sync"]
 description = "Sync skills from manifest to local CLI dirs"
 depends = ["skills:provision:packs"]
-run = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/sync-skills.py' --scope project"
+run = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/sync-skills.py' --scope project --root '{% raw %}{{config_root}}{% endraw %}'"
 
 [tasks."skills:provision:packs"]
 description = "Provision every Skillex pack declared in .agents/skills.json"
-run = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/provision-packs.py'"
+run = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/provision-packs.py' --root '{% raw %}{{config_root}}{% endraw %}'"
 {% if agent_hooks_layer %}
 # --- Project-scoped agent hooks + skill fan-out (see .agents/hooks/README.md) ---
 

package/templates/hermes-agent/copier.yml

@@ -46,17 +46,14 @@ target_repo:
 
 role:
   type: str
-  help: "Role for this agent"
+  help: "Role for this agent (safe single path segment; arbitrary roles are supported)"
   default: pm
-  choices:
-    "Project Manager (pm)": pm
-    "Company Director (director)": director
-    "Developer (dev)": dev
-    "Reviewer (review)": review
-    "Company Reporter — daily cross-project rollup (reporter)": reporter
-    "Ops (ops)": ops
-    "QA (qa)": qa
-  validator: "{% if not role %}Required{% endif %}"
+  validator: >-
+    {% set alnum = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789' -%}
+    {% set safe_chars = alnum ~ '._-' -%}
+    {% if not role or role != role|trim or role in ['.', '..'] or role[0] not in alnum or role[-1] not in alnum or role|reject('in', safe_chars)|list|length -%}
+    Role must be a non-empty safe single path segment using letters, numbers, dots, underscores, or hyphens
+    {%- endif %}
 
 ticket_provider:
   type: str
@@ -157,7 +154,7 @@ plane_workspace:
 # All scripts are idempotent — safe to re-run if a step fails.
 
 _tasks:
-  - "chmod +x .scripts/*.sh .scripts/sentinel/bin/*.sh hermes 2>/dev/null || true"
+  - "chmod +x .scripts/*.sh .scripts/sentinel/bin/*.sh hermes momo 2>/dev/null || true"
   - "./.scripts/00-banner.sh"
   - "./.scripts/01-config.sh"
   - "./.scripts/05-fleet-env.sh"

package/templates/hermes-agent/template/.gitignore.jinja

@@ -8,3 +8,4 @@ runtime/
 .scripts/.provision.log
 .scripts/.last-run
 .scripts/.done-*
+.scripts/.plane-project-id

package/templates/hermes-agent/template/.runtime-scaffold/.gitignore.jinja

@@ -0,0 +1,44 @@
+# Per-agent runtime — what NOT to commit to the checkpoint repo.
+# Sensitive credentials never go in git.
+.env
+.env.*
+!.env.example
+auth.json
+auth.lock
+secrets.*
+*.pem
+*.key
+gateway.pid
+gateway_state.json
+processes.json
+interrupt_debug.log
+
+# Caches (large, regenerable)
+audio_cache/
+image_cache/
+models_dev_cache.json
+context_length_cache.yaml
+honcho.json
+
+# Sandboxes (ephemeral execution environments)
+sandboxes/
+
+# Heartbeat / sentinel ephemeral state — local to this runtime, never checkpointed.
+# (Keeps the fused checkpoint a true no-op on a clean tree.)
+continuous-ticket-sentinel-state.json
+continuous-ticket-sentinel.lock
+continuous-ticket-sentinel.lock.d/
+.last-checkpoint
+
+# Runtime logs (we want the LFS-tracked summary.log if we add one, not the noise)
+logs/*.log
+logs/*.systemd.log
+
+# Python cruft
+__pycache__/
+*.pyc
+.scripts/.done-*
+.scripts/.provision.log
+
+# Allow these subdirs to exist
+!logs/.gitkeep

package/templates/hermes-agent/template/.scripts/01-config.sh

@@ -1,6 +1,15 @@
 #!/usr/bin/env bash
 # Ensure the distributable config exists before any other step reads it.
 # Seeds ~/.config/hermes-agent-template/config.toml from the shipped example.
+
+# MCP render transactions establish repo-local lifecycle eligibility before
+# touching any host-global state. This guard must precede _lib.sh because that
+# library creates the role log and may read fleet configuration.
+if [[ "${SKIP_HOST_STATE:-0}" == "1" ]]; then
+  printf '%s\n' '[01] host config — DEFERRED (SKIP_HOST_STATE=1)' >&2
+  exit 0
+fi
+
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 

package/templates/hermes-agent/template/.scripts/05-fleet-env.sh

@@ -1,5 +1,11 @@
 #!/usr/bin/env bash
 # Ensure a single shared fleet source-of-truth file exists.
+
+if [[ "${SKIP_HOST_STATE:-0}" == "1" ]]; then
+  printf '%s\n' '[05] fleet env — DEFERRED (SKIP_HOST_STATE=1)' >&2
+  exit 0
+fi
+
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 load_role_env
@@ -8,45 +14,29 @@ already_done 05-fleet-env && log "[05] fleet env already checked — refreshing
 
 mkdir -p "$(dirname "$FLEET_ENV")"
 
+new_fleet_env=0
 if [[ ! -f "$FLEET_ENV" ]]; then
   log "[05] creating fleet source-of-truth: $FLEET_ENV"
-  cat > "$FLEET_ENV" <<EOF
-# Hermes fleet source of truth.
-# All generated wrappers and provisioning scripts read this file.
-HERMES_FLEET_BIN=${HERMES_BIN}
-HERMES_FLEET_REPO=${HERMES_AGENT_REPO}
-HERMES_FLEET_REGISTRY_FILE=${REGISTRY_FILE}
-HERMES_FLEET_OAUTH_FILE=${HERMES_OAUTH_FILE}
-HERMES_FLEET_CODEX_HOME=${CODEX_HOME}
-EOF
-  chmod 600 "$FLEET_ENV"
+  new_fleet_env=1
 else
   log "[05] fleet env exists: $FLEET_ENV"
 fi
 
+fleet_env_parser="$ROLE_DIR/.scripts/lib/parse-fleet-env.py"
+fleet_env_python="$(builtin type -P python3)" \
+  || die "python3 is required to update the fleet source-of-truth"
+
 upsert_fleet_env() {
   local key="$1" value="$2"
-  python3 - "$FLEET_ENV" "$key" "$value" <<'PYEOF'
-import pathlib
-import sys
-
-path = pathlib.Path(sys.argv[1])
-key = sys.argv[2]
-value = sys.argv[3]
-line = f"{key}={value}"
-lines = path.read_text().splitlines() if path.exists() else []
-for idx, existing in enumerate(lines):
-    if existing.startswith(f"{key}="):
-        lines[idx] = line
-        break
-else:
-    lines.append(line)
-path.write_text("\n".join(lines) + "\n")
-PYEOF
+  "$fleet_env_python" -I "$fleet_env_parser" --upsert "$FLEET_ENV" "$key" "$value"
 }
 
+if [[ "$new_fleet_env" == "1" ]]; then
+  upsert_fleet_env HERMES_FLEET_BIN "$HERMES_BIN"
+  upsert_fleet_env HERMES_FLEET_REPO "$HERMES_AGENT_REPO"
+  upsert_fleet_env HERMES_FLEET_REGISTRY_FILE "$REGISTRY_FILE"
+fi
 upsert_fleet_env HERMES_FLEET_OAUTH_FILE "$HERMES_OAUTH_FILE"
 upsert_fleet_env HERMES_FLEET_CODEX_HOME "$CODEX_HOME"
-chmod 600 "$FLEET_ENV"
 
 mark_done 05-fleet-env

package/templates/hermes-agent/template/.scripts/10-hermes-profile.sh

@@ -3,6 +3,12 @@
 # The directory remains REAL. Step 20 delegates final shared-vs-owned link
 # topology to `pj migrate hermes.runtime-singleton`; no template step may
 # replace the profile itself with a symlink.
+
+if [[ "${SKIP_HOST_STATE:-0}" == "1" ]]; then
+  printf '%s\n' '[10] Hermes profile — DEFERRED (SKIP_HOST_STATE=1)' >&2
+  exit 0
+fi
+
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 load_role_env
@@ -108,8 +114,56 @@ PYEOF
 fi
 
 # Never persist a project-specific terminal.cwd through the named profile.
-# PJangler intentionally links profile config.yaml to the fleet-shared config;
-# the generated launchers therefore pass TERMINAL_CWD process-locally instead.
+# The generated launchers pass TERMINAL_CWD process-locally instead.
+#
+# config.yaml is GENERATED, never hand-written and never a symlink to the fleet
+# base. It is deep_merge(~/.hermes/config.yaml, <profile>/config.delta.yaml).
+# The old symlink-to-base topology was actively harmful: Hermes' atomic writes
+# use os.replace, which REPLACES a symlink with a regular file, so the first
+# in-agent write (/model, onboarding, a config migration) silently detached the
+# profile onto a frozen copy of an old base — and a symlink gave the profile no
+# way to override anything in the first place.
+#
+# Seed an EMPTY delta: a new agent should be identical to the fleet base, and
+# every line here is an override someone must justify later.
+PROFILE_DELTA="$PROFILE_HOME/config.delta.yaml"
+if [[ ! -f "$PROFILE_DELTA" ]]; then
+  log "    seeding empty config.delta.yaml (override-only SSOT)"
+  cat > "$PROFILE_DELTA" <<'DELTA_EOF'
+# Override-only delta for this Hermes profile.
+# Merged over ~/.hermes/config.yaml to produce config.yaml (which is GENERATED).
+# Empty == identical to the fleet base. Add ONLY what must differ.
+{}
+DELTA_EOF
+  chmod 600 "$PROFILE_DELTA"
+fi
+
+# Pin the identity-memory bank explicitly rather than relying on the fleet
+# bank_id_template (agent-{profile}). {profile} resolves through Hermes'
+# get_active_profile_name(), which calls Path.resolve() on HERMES_HOME and
+# requires a lowercase id sitting directly under profiles/. A symlinked profile
+# dir or an uppercase name silently yields the literal "custom" — which would
+# merge this agent's PRIVATE memory into a bank shared with every other agent
+# that also failed to resolve.
+PROFILE_MEM_CFG="$PROFILE_HOME/hindsight/config.json"
+mkdir -p "$(dirname "$PROFILE_MEM_CFG")"
+if [[ ! -f "$PROFILE_MEM_CFG" ]]; then
+  log "    pinning identity-memory bank: agent-$PROFILE_NAME"
+  printf '{\n  "bank_id": "agent-%s"\n}\n' "$PROFILE_NAME" > "$PROFILE_MEM_CFG"
+  chmod 600 "$PROFILE_MEM_CFG"
+fi
+
+# Render config.yaml from base + delta when the renderer is available. Without
+# it the profile still boots (Hermes reads whatever config.yaml exists), but it
+# is not yet under inheritance and `pj audit` will say so.
+PROFILE_RENDERER="${PROFILE_RENDERER:-$HOME/code/33GOD/hermes-agent-template/scripts/hermes-profile-config.py}"
+if [[ -x "$PROFILE_RENDERER" || -f "$PROFILE_RENDERER" ]]; then
+  log "    rendering config.yaml from fleet base + delta"
+  python3 "$PROFILE_RENDERER" render --profile "$PROFILE_NAME" >/dev/null 2>&1 \
+    || warn "    render failed; run hermes-profile-config.py render --profile $PROFILE_NAME"
+else
+  warn "    profile renderer not found at $PROFILE_RENDERER — config.yaml not rendered"
+fi
 
 # Canonical shared-skill source of truth + local PM fallback sync.
 CANONICAL_SKILLS_DIR="${CANONICAL_SKILLS_DIR:-$(config_get fleet.canonical_skills_dir '/home/delorenj/.agents/skills')}"
@@ -117,8 +171,18 @@ CANONICAL_PM_SKILL_SRC="$CANONICAL_SKILLS_DIR/subagent-driven-development"
 LOCAL_PM_SKILL_DST="$PROFILE_HOME/skills/software-development/subagent-driven-development"
 
 if [[ -d "$CANONICAL_SKILLS_DIR" ]]; then
-  log "    setting skills.external_dirs[0] = $CANONICAL_SKILLS_DIR"
-  env HERMES_HOME="$PROFILE_HOME" "$HERMES_BIN" config set skills.external_dirs.0 "$CANONICAL_SKILLS_DIR"
+  # skills.external_dirs is a FLEET setting and already lives in
+  # ~/.hermes/config.yaml, so every rendered profile inherits it. Writing it
+  # per-profile here would (a) be redundant, and (b) write into the GENERATED
+  # config.yaml, where the next render discards it — the classic "I set it and
+  # it reverted" trap. Verify inheritance instead of re-asserting it.
+  if ! env HERMES_HOME="$PROFILE_HOME" "$HERMES_BIN" config get skills.external_dirs 2>/dev/null \
+       | grep -qF "$CANONICAL_SKILLS_DIR"; then
+    warn "    skills.external_dirs does not include $CANONICAL_SKILLS_DIR"
+    warn "    add it to the FLEET base (~/.hermes/config.yaml), then: hermes-profile-config.py render --all"
+  else
+    log "    skills.external_dirs inherited from fleet base: $CANONICAL_SKILLS_DIR"
+  fi
 
   # Ensure key PM/local-ops skills are symlinked into runtime/profile skills root.
   # This preserves canonical ownership and keeps updates instant across agents.

package/templates/hermes-agent/template/.scripts/42-ticket-provider.sh

@@ -12,6 +12,15 @@
 #         it becomes the SOT for every agent in this repo.
 # Either way we register this agent under .project.json `agents` and mirror the
 # binding into role.yaml for back-compat (80-registry.sh / 99-summary.sh).
+
+# The caller's negative board grant is authoritative. Check it before sourcing
+# _lib.sh so a skipped step cannot load fleet credentials, create logs/markers,
+# inspect bindings, or reach a provider adapter.
+if [[ "${SKIP_PLANE:-0}" == "1" ]]; then
+  printf '%s\n' '[42] ticket provider — SKIPPED (SKIP_PLANE=1)' >&2
+  exit 0
+fi
+
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 load_role_env
@@ -74,7 +83,15 @@ if set_provider == "1":
     if board_url:  tp["board_url"] = board_url
     if team:       tp["team"] = team
 ag = d.setdefault("agents", {})
-ag[os.environ["AGENT_ID"]] = {"role": os.environ["ROLE"], "role_dir": os.environ["ROLE_DIR_REL"]}
+entry = ag.get(os.environ["AGENT_ID"], {})
+if not isinstance(entry, dict):
+    entry = {}
+entry.update({
+    "role": os.environ["ROLE"],
+    "role_dir": os.environ["ROLE_DIR_REL"],
+    "provisioning_state": "provisioned",
+})
+ag[os.environ["AGENT_ID"]] = entry
 p.write_text(json.dumps(d, indent=2) + "\n")
 PY
   log "    .project.json updated (agent=$AGENT_ID)"

package/templates/hermes-agent/template/.scripts/70-systemd.sh

@@ -37,6 +37,63 @@ if [[ "${SKIP_SYSTEMD:-0}" == "1" ]]; then
   exit 0
 fi
 
+# Render every caller-controlled systemd scalar through the same data-only
+# serializer used by fleet backfill. This validation happens before mkdir,
+# systemctl, or unit writes, so CR/LF/NUL cannot create a second directive and
+# spaces/quotes/backslashes/specifier bytes remain exact.
+PYTHON_BIN="$(builtin type -P python3)" || die "python3 is unavailable for systemd unit serialization"
+systemd_value() {
+  "$PYTHON_BIN" -I "$FLEET_ENV_PARSER" --systemd-value "$1" \
+    || die "systemd value validation failed"
+}
+systemd_scalar() {
+  "$PYTHON_BIN" -I "$FLEET_ENV_PARSER" --systemd-scalar "$1" \
+    || die "systemd scalar validation failed"
+}
+systemd_environment() {
+  "$PYTHON_BIN" -I "$FLEET_ENV_PARSER" --systemd-environment "$1" "$2" \
+    || die "systemd environment validation failed"
+}
+systemd_exec_value() {
+  "$PYTHON_BIN" -I "$FLEET_ENV_PARSER" --systemd-exec-value "$1" \
+    || die "systemd ExecStart value validation failed"
+}
+GW_DESCRIPTION="$(systemd_scalar "Hermes Gateway — $DISPLAY_NAME")"
+HB_DESCRIPTION="$(systemd_scalar "Hermes Heartbeat (reconcile + checkpoint) — $DISPLAY_NAME")"
+TIMER_DESCRIPTION="$(systemd_scalar "Heartbeat (reconcile + checkpoint) for $AGENT_ID")"
+ENV_HERMES_HOME="$(systemd_environment HERMES_HOME "$PROFILE_HOME")"
+ENV_HERMES_BIN="$(systemd_environment HERMES_BIN "$HERMES_BIN")"
+ENV_CODEX_HOME="$(systemd_environment CODEX_HOME "$CODEX_HOME")"
+ENV_TERMINAL_CWD="$(systemd_environment TERMINAL_CWD "$REPO_ROOT")"
+WORKING_DIRECTORY="$(systemd_scalar "$REPO_ROOT")"
+RUNTIME_ENV_FILE="$(systemd_scalar "-$RUNTIME/.env")"
+GW_LOG_OUTPUT="$(systemd_scalar "append:$RUNTIME/logs/gateway.systemd.log")"
+HB_LOG_OUTPUT="$(systemd_scalar "append:$RUNTIME/logs/heartbeat.log")"
+GW_EXEC_START="$(systemd_exec_value "$ROLE_DIR/.scripts/credential-launch.sh")"
+HB_EXEC_START="$GW_EXEC_START"
+
+# Encrypted credentials are optional and take precedence over the existing
+# ignored runtime/.env fallback. Validate every path-derived unit scalar before
+# any directory, unit, marker, or systemd mutation.
+CREDENTIAL_DIR="${HERMES_SYSTEMD_CREDENTIAL_DIR:-$HOME/.config/hermes-agent/credentials}"
+TELEGRAM_CREDENTIAL="$CREDENTIAL_DIR/${AGENT_ID}-telegram-bot-token.cred"
+MODEL_CREDENTIAL="$CREDENTIAL_DIR/${AGENT_ID}-model-api-key.cred"
+GW_CREDENTIAL_LINES=""
+HB_CREDENTIAL_LINES=""
+if [[ -f "$TELEGRAM_CREDENTIAL" ]]; then
+  command -v systemd-creds >/dev/null 2>&1 \
+    || die "encrypted Telegram credential exists but systemd-creds is unavailable"
+  GW_CREDENTIAL_LINES="LoadCredentialEncrypted=$(systemd_value "telegram_bot_token:$TELEGRAM_CREDENTIAL")"
+fi
+if [[ -f "$MODEL_CREDENTIAL" ]]; then
+  [[ -n "$(yaml_get model.key_env)" ]] \
+    || die "encrypted model credential exists but model.key_env is blank in role.yaml"
+  command -v systemd-creds >/dev/null 2>&1 \
+    || die "encrypted model credential exists but systemd-creds is unavailable"
+  GW_CREDENTIAL_LINES="${GW_CREDENTIAL_LINES}${GW_CREDENTIAL_LINES:+$'\n'}LoadCredentialEncrypted=$(systemd_value "model_api_key:$MODEL_CREDENTIAL")"
+  HB_CREDENTIAL_LINES="LoadCredentialEncrypted=$(systemd_value "model_api_key:$MODEL_CREDENTIAL")"
+fi
+
 # Singleton-runtime contract: units set HERMES_HOME to the agent's NAMED PROFILE
 # dir, never the raw runtime path — Hermes derives profile identity and shared
 # fleet auth from the unresolved HERMES_HOME. $RUNTIME stays correct for
@@ -101,49 +158,26 @@ chmod +x "$HEARTBEAT_BIN" "$CREDENTIAL_LAUNCHER" "$ROLE_DIR/.scripts/checkpoint.
 [[ -d "$PROFILE_HOME" && ! -L "$PROFILE_HOME" ]] \
   || die "named profile is not a real directory; run: pj migrate hermes.runtime-singleton '$REPO_ROOT'"
 
-# Encrypted credentials are optional and take precedence over the existing
-# ignored runtime/.env fallback. Their plaintext appears only below /run while
-# systemd executes the unit. Files are provisioned separately with
-# `systemd-creds encrypt --user`; this step never reads or writes secret values.
-CREDENTIAL_DIR="${HERMES_SYSTEMD_CREDENTIAL_DIR:-$HOME/.config/hermes-agent/credentials}"
-TELEGRAM_CREDENTIAL="$CREDENTIAL_DIR/${AGENT_ID}-telegram-bot-token.cred"
-MODEL_CREDENTIAL="$CREDENTIAL_DIR/${AGENT_ID}-model-api-key.cred"
-GW_CREDENTIAL_LINES=""
-HB_CREDENTIAL_LINES=""
-if [[ -f "$TELEGRAM_CREDENTIAL" ]]; then
-  command -v systemd-creds >/dev/null 2>&1 \
-    || die "encrypted Telegram credential exists but systemd-creds is unavailable"
-  GW_CREDENTIAL_LINES="LoadCredentialEncrypted=telegram_bot_token:$TELEGRAM_CREDENTIAL"
-fi
-if [[ -f "$MODEL_CREDENTIAL" ]]; then
-  [[ -n "$(yaml_get model.key_env)" ]] \
-    || die "encrypted model credential exists but model.key_env is blank in role.yaml"
-  command -v systemd-creds >/dev/null 2>&1 \
-    || die "encrypted model credential exists but systemd-creds is unavailable"
-  GW_CREDENTIAL_LINES="${GW_CREDENTIAL_LINES}${GW_CREDENTIAL_LINES:+$'\n'}LoadCredentialEncrypted=model_api_key:$MODEL_CREDENTIAL"
-  HB_CREDENTIAL_LINES="LoadCredentialEncrypted=model_api_key:$MODEL_CREDENTIAL"
-fi
-
 # Gateway unit
 cat > "$SYS_DIR/$GW_UNIT" <<UNIT
 [Unit]
-Description=Hermes Gateway — $DISPLAY_NAME
+Description=$GW_DESCRIPTION
 After=network-online.target
 Wants=network-online.target
 
 [Service]
 Type=simple
-Environment=HERMES_HOME=$PROFILE_HOME
-Environment=HERMES_BIN=$HERMES_BIN
-Environment=CODEX_HOME=$CODEX_HOME
-Environment="TERMINAL_CWD=$REPO_ROOT"
-EnvironmentFile=-$RUNTIME/.env
+$ENV_HERMES_HOME
+$ENV_HERMES_BIN
+$ENV_CODEX_HOME
+$ENV_TERMINAL_CWD
+EnvironmentFile=$RUNTIME_ENV_FILE
 $GW_CREDENTIAL_LINES
-ExecStart=$CREDENTIAL_LAUNCHER gateway
+ExecStart=$GW_EXEC_START gateway
 Restart=on-failure
 RestartSec=10
-StandardOutput=append:$RUNTIME/logs/gateway.systemd.log
-StandardError=append:$RUNTIME/logs/gateway.systemd.log
+StandardOutput=$GW_LOG_OUTPUT
+StandardError=$GW_LOG_OUTPUT
 
 [Install]
 WantedBy=default.target
@@ -155,31 +189,31 @@ UNIT
 # The per-agent EnvironmentFiles load ticket-provider creds for the sentinel pass.
 cat > "$SYS_DIR/$HB_SVC" <<UNIT
 [Unit]
-Description=Hermes Heartbeat (reconcile + checkpoint) — $DISPLAY_NAME
+Description=$HB_DESCRIPTION
 After=network-online.target
 Wants=network-online.target
 
 [Service]
 Type=oneshot
-WorkingDirectory=$REPO_ROOT
-Environment=HERMES_HOME=$PROFILE_HOME
-Environment=HERMES_BIN=$HERMES_BIN
-Environment=CODEX_HOME=$CODEX_HOME
-Environment="TERMINAL_CWD=$REPO_ROOT"
+WorkingDirectory=$WORKING_DIRECTORY
+$ENV_HERMES_HOME
+$ENV_HERMES_BIN
+$ENV_CODEX_HOME
+$ENV_TERMINAL_CWD
 EnvironmentFile=-%h/.config/hermes-agent/env
 EnvironmentFile=-%h/.hermes/env
 EnvironmentFile=-%h/.hermes/hermes-agent.env
 EnvironmentFile=-%h/.hermes/${AGENT_ID}.env
-EnvironmentFile=-$RUNTIME/.env
+EnvironmentFile=$RUNTIME_ENV_FILE
 $HB_CREDENTIAL_LINES
-ExecStart=$CREDENTIAL_LAUNCHER heartbeat
+ExecStart=$HB_EXEC_START heartbeat
 TimeoutStartSec=45min
-StandardOutput=append:$RUNTIME/logs/heartbeat.log
-StandardError=append:$RUNTIME/logs/heartbeat.log
+StandardOutput=$HB_LOG_OUTPUT
+StandardError=$HB_LOG_OUTPUT
 UNIT
 cat > "$SYS_DIR/$HB_TIMER" <<UNIT
 [Unit]
-Description=Heartbeat (reconcile + checkpoint) for $AGENT_ID
+Description=$TIMER_DESCRIPTION
 
 [Timer]
 OnBootSec=1min

package/templates/hermes-agent/template/.scripts/80-registry.sh

@@ -1,5 +1,11 @@
 #!/usr/bin/env bash
 # Append this agent's entry to the global fleet registry.
+
+if [[ "${SKIP_HOST_STATE:-0}" == "1" ]]; then
+  printf '%s\n' '[80] fleet registry — DEFERRED (SKIP_HOST_STATE=1)' >&2
+  exit 0
+fi
+
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 load_role_env