@delorenj/pjangler 1.4.2 → 1.4.3

package/templates/hermes-agent/template/.scripts/providers/trello.sh

@@ -144,6 +144,25 @@ print(json.dumps({"id":c.get("id",""),"key":c.get("id",""),"title":c.get("name",
     api PUT "cards/$ID" "idList=$LID" | python3 -c 'import sys,json; c=json.load(sys.stdin); print("ok "+c.get("id",""))'
     ;;
 
+  describe_board)
+    # Read-only board lookup against an EXPLICIT workspace argument, mirroring
+    # the Plane op, so no ambient binding can send the query somewhere else.
+    # Trello mints NO project key, so `identifier` is ALWAYS empty here: an
+    # empty identifier is this provider's authoritative answer, not a lookup
+    # failure, and callers must never promote it to a confirmed value.
+    DWS="${1:?usage: describe_board <workspace> <board_id>}"
+    DBID="${2:?usage: describe_board <workspace> <board_id>}"
+    api GET "boards/$DBID" "fields=id,name,idOrganization" \
+      | WS="$DWS" BID="$DBID" python3 -c 'import sys, json, os
+b = json.load(sys.stdin)
+print(json.dumps({
+    "board_id": str(b.get("id") or os.environ["BID"]),
+    "identifier": "",
+    "workspace": str(b.get("idOrganization") or os.environ["WS"]),
+    "name": str(b.get("name") or ""),
+}))'
+    ;;
+
   create_board)
     NAME="${1:?usage: create_board <name> <ident> <desc>}"
     EXIST="$(api GET "members/me/boards" "fields=name" | NM="$NAME" python3 -c 'import sys,json,os
@@ -154,8 +173,12 @@ print(next((b["id"] for b in rows if b.get("name","").lower()==nm), ""))')"
         | python3 -c 'import sys,json; print(json.load(sys.stdin).get("id",""))')"
     fi
     [ -n "$BID" ] || die "create_board failed"
-    api GET "boards/$BID" "fields=url" | BID="$BID" python3 -c 'import sys,json,os
-b=json.load(sys.stdin); print(json.dumps({"board_id":os.environ["BID"],"board_url":b.get("url","")}))'
+    # Trello assigns no project key, so the caller's prefix IS the identity and
+    # this adapter is the only thing that can confirm it. Echo it back: the
+    # create_board envelope always carries the identifier the board is bound
+    # under, so no caller ever has to invent one.
+    api GET "boards/$BID" "fields=url" | BID="$BID" IDENT="${2:-}" python3 -c 'import sys,json,os
+b=json.load(sys.stdin); print(json.dumps({"board_id":os.environ["BID"],"board_url":b.get("url",""),"identifier":os.environ.get("IDENT","")}))'
     ;;
 
   create_issue)

package/templates/hermes-agent/template/.scripts/sentinel/bin/issue-autonomous-review.sh

@@ -2,8 +2,8 @@
 # Provider-agnostic autonomous adversarial-review decision gate (act, don't wait).
 #
 # The rigorous, INDEPENDENT ADVERSARIAL review is the normal per-pass path: an
-# adversarial microscope that couples the close gate, an independent-reviewer
-# drift attestation, and the BloodBank decision event. A clean adversarial
+# adversarial microscope that couples the close gate with an independent-reviewer
+# drift attestation. A clean adversarial
 # verdict is acted on AUTONOMOUSLY -- the loop treats the ticket as done and
 # moves on; it never parks the ticket waiting on the operator for approval or
 # sign-off. Every adversarial check stays at full strength (locked-intent
@@ -40,17 +40,14 @@ ROLE_YAML="$ROLE_DIR/role.yaml"
 ROOT="$(git -C "$ROLE_DIR" rev-parse --show-toplevel 2>/dev/null || pwd)"
 cd "$ROOT"
 
-EMIT="$BIN_DIR/emit-event.py"
 CLOSE_GATE="$BIN_DIR/issue-close-gate.sh"
 EVIDENCE="_bmad-output/implementation-artifacts/issue-evidence/$ISSUE.md"
 
 yget() { sed -n "s/^[[:space:]]*$1:[[:space:]]*//p" "$ROLE_YAML" 2>/dev/null | head -n1 | tr -d '"' | tr -d '\r'; }
-REPO="$(yget repo)"; REPO="${REPO:-unknown}"
-# Informational only: recorded in the decision event/comment, never a blocking
-# wait. Default 0 (no grace); an operator may set grace_hours>0 to reintroduce one.
+# Informational only: recorded in the ticket comment, never a blocking wait.
+# Default 0 (no grace); an operator may set grace_hours>0 to reintroduce one.
 GRACE_HOURS="${RECONCILE_GRACE_HOURS:-$(yget grace_hours)}"; GRACE_HOURS="${GRACE_HOURS:-0}"
 AUTO="$(yget auto_review)"; AUTO="${AUTO:-true}"
-EVT="bloodbank.v1.repo.$REPO.issue.autonomous_review.decided"
 
 if [[ "${RECONCILE_AUTO_REVIEW:-$AUTO}" == "false" || "${RECONCILE_AUTO_REVIEW:-}" == "off" ]]; then
   printf 'Autonomous review is disabled (reconcile.auto_review=false).\n' >&2; exit 3
@@ -85,14 +82,6 @@ if sh "$CLOSE_GATE" "$ISSUE" "$ROOT" >/dev/null 2>&1 </dev/null; then GATE=pass;
 
 if [[ -n "$HOLD" ]]; then DECISION=held; else DECISION=accepted; fi
 
-python3 "$EMIT" "$EVT" --root "$ROOT" \
-  --source "repo://sentinel/bin/issue-autonomous-review.sh" --actor-id "$REVIEWER" \
-  --field issue="$ISSUE" --field decision="$DECISION" --field drift="$DRIFT" \
-  --field close_gate="$GATE" --field reviewer_agent="$REVIEWER" \
-  --field evidence_file="$EVIDENCE" --field report_file="$REPORT" \
-  --field grace_hours="$GRACE_HOURS" --field hold_reasons="${HOLD:-none}" \
-  --quiet </dev/null || printf 'WARN: decision event emission failed; event trail incomplete.\n' >&2
-
 if [[ "$DECISION" == "held" ]]; then
   printf 'AUTONOMOUS REVIEW: HOLD for %s\nReasons: %s\n' "$ISSUE" "$HOLD" >&2
   exit 3
@@ -109,7 +98,7 @@ if [[ "$CLOSE" -eq 1 ]]; then
     TICKET_PROVIDER="$PROV" bash -c '. "$1"; tp comment "$2" "$3"' _ "$SCRIPTS_DIR/lib/ticket-provider.sh" "$ISSUE" \
       "Autonomously accepted by $REVIEWER under the independent adversarial-review protocol (drift: $DRIFT, gate: $GATE, grace ${GRACE_HOURS}h informational). Treated as done; review report: $REPORT." >/dev/null 2>&1 || true
   else
-    printf 'Adapter transition failed; decision event recorded, issue left open.\n' >&2
+    printf 'Adapter transition failed; issue left open.\n' >&2
     exit 1
   fi
 else

package/templates/hermes-agent/template/.scripts/sentinel/bin/issue-close-gate.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env sh
 # Provider-agnostic close gate. Verifies an issue's evidence file is complete
-# before any closure (manual or autonomous). Repo name is read from role.yaml so
-# event types carry the right repo lane.
+# before any closure (manual or autonomous). Pure gate: it reports PASS/FAIL on
+# stdout/stderr and via the exit code, and publishes nothing.
 #
 # Usage: issue-close-gate.sh ISSUE_ID [REPO_ROOT]
 set -eu
@@ -13,17 +13,9 @@ fi
 ISSUE="$1"
 case "$ISSUE" in *[!A-Za-z0-9_-]*) printf 'Invalid issue id: %s\n' "$ISSUE" >&2; exit 2 ;; esac
 
-BIN_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
-ROLE_DIR="$(cd "$BIN_DIR/../../.." && pwd)"
-ROLE_YAML="$ROLE_DIR/role.yaml"
-EMIT="$BIN_DIR/emit-event.py"
 ROOT="${2:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
 cd "$ROOT"
 
-REPO="$(sed -n 's/^repo:[[:space:]]*//p' "$ROLE_YAML" 2>/dev/null | head -n1 | tr -d '"' | tr -d '\r')"
-REPO="${REPO:-unknown}"
-EVT_PREFIX="bloodbank.v1.repo.$REPO.issue"
-
 FILE="_bmad-output/implementation-artifacts/issue-evidence/$ISSUE.md"
 FAIL=0
 check() { grep -q "$1" "$FILE" || { printf 'Missing required evidence: %s\n' "$2" >&2; FAIL=1; }; }
@@ -49,14 +41,8 @@ grep -q 'Ledger updated: yes' "$FILE" || { printf 'Ledger update is not marked y
 grep -q 'Close recommendation: ready' "$FILE" || { printf 'Close recommendation is not ready.\n' >&2; FAIL=1; }
 
 if [ "$FAIL" -ne 0 ]; then
-  python3 "$EMIT" "$EVT_PREFIX.gate.failed" --root "$ROOT" \
-    --source "repo://sentinel/bin/issue-close-gate.sh" \
-    --field issue="$ISSUE" --field evidence_file="$FILE" --quiet </dev/null || true
   printf '\nCLOSE GATE: FAIL for %s\n' "$ISSUE" >&2
   exit 1
 fi
 
-python3 "$EMIT" "$EVT_PREFIX.gate.passed" --root "$ROOT" \
-  --source "repo://sentinel/bin/issue-close-gate.sh" \
-  --field issue="$ISSUE" --field evidence_file="$FILE" --quiet </dev/null || true
 printf 'CLOSE GATE: PASS for %s\n' "$ISSUE"

package/templates/hermes-agent/template/.scripts/sentinel/docs/autonomous-delegated-review.md

@@ -112,29 +112,23 @@ loop:
 .scripts/sentinel/bin/issue-autonomous-review.sh <ISSUE> <REPORT> --close
 ```
 
-## Decision event
+## Decision record
 
-```text
-bloodbank.v1.repo.<repo>.issue.autonomous_review.decided
-```
-
-Required data: `issue`, `decision` (`accepted | held`), `drift`, `close_gate`,
-`reviewer_agent`, `evidence_file`, `report_file`. See `bloodbank-events.md`.
+The verdict is carried by the script's exit code (`0` accepted, `3` held) and
+its stdout/stderr, plus the review report and the ticket comment it posts. The
+durable accountability trail is the review report + evidence file in the repo.
+No event is published; see `bloodbank-events.md` for why the old
+`repo.issue.*` family was retired.
 
 ## Downstream regression rollback
 
 Deferring operator QA means a later dependent can prove a review-accepted
 feature is ACTUALLY BROKEN. When that happens, move the accepted ticket back to
 active (`started` if a worker takes it now, else `unstarted`) as a PREREQUISITE
-of the dependent, via the adapter (`tp transition <id> <state>`); comment naming
-the dependent + symptom; and emit:
-
-```text
-bloodbank.v1.repo.<repo>.issue.review_rollback.recorded
-```
-
-Required data: `issue`, `surfaced_by`, `reason`. The dependent is blocked on the
-prerequisite until it is fixed. This is expected and healthy — it is the trade
+of the dependent, via the adapter (`tp transition <id> <state>`), and comment
+naming the dependent + symptom. Record the rollback in the ticket comment and
+the issue evidence file. The dependent is blocked on the prerequisite until it
+is fixed. This is expected and healthy — it is the trade
 for deferring operator QA, not a failure.
 
 ## Review report shape
@@ -163,6 +157,6 @@ Write `<ISSUE>.review.md`; the script validates it:
 ## Operator override
 
 `reconcile.auto_review: false` (role.yaml) or `RECONCILE_AUTO_REVIEW=off`
-disables autonomous acceptance. Autonomous acceptances are fully traceable via
-the decision events in
-`_bmad-output/implementation-artifacts/bloodbank-events.jsonl`.
+disables autonomous acceptance. Autonomous acceptances are traceable via the
+review report, the issue evidence file, and the ticket comment the script
+posts.

package/templates/hermes-agent/template/.scripts/sentinel/docs/bloodbank-events.md

@@ -4,46 +4,39 @@ Status: Sentinel engine protocol (provider-agnostic)
 
 ## Purpose
 
-Local workflow events are the machine-readable timeline of the sentinel loop.
-The board remains the human command center; issue evidence files remain the
-close gate; this JSONL spool lets Hermes, dashboards, and future agents observe
-what happened.
+The board remains the human command center and issue evidence files remain the
+close gate. Neither depends on an event trail: `bin/issue-close-gate.sh` and
+`bin/issue-autonomous-review.sh` report their verdicts on stdout/stderr and via
+their exit codes, and publish nothing.
+
+The `repo.issue.*` family the sentinel loop used to mint was retired on
+2026-08-28. It was never published to NATS and never consumed by anything, and
+its shape was invalid twice over: it embedded the repo slug inside the type
+(`bloodbank.v1.repo.<repo>.issue.…`) and `issue` is not in the Bloodbank §7
+entity allowlist. There is no correct version of it to migrate to, so it is
+gone rather than renamed.
 
 ## Emitter
 
+`bin/emit-event.py` stays as a dependency-free local emitter for a family a
+future pass genuinely needs:
+
 ```bash
 .scripts/sentinel/bin/emit-event.py <event_type> --field key=value [...]
 ```
 
-Appends to `_bmad-output/implementation-artifacts/bloodbank-events.jsonl`
-(git-ignored dev spool) using the Hermes CloudEvents envelope shape. Event types
-use the project repo lane `bloodbank.v1.repo.<repo>.<entity>.<action>`, where
-`<repo>` comes from `role.yaml`.
-
-## Event types
-
-| Event type | When | Required data |
-| --- | --- | --- |
-| `…repo.<repo>.issue.evidence.created` | Evidence file created | `issue`, `evidence_file` |
-| `…repo.<repo>.issue.gate.passed` | Close gate passes | `issue`, `evidence_file` |
-| `…repo.<repo>.issue.gate.failed` | Close gate fails | `issue`, `evidence_file` |
-| `…repo.<repo>.issue.autonomous_review.decided` | An independent adversarial review clears a review-lane ticket; the loop acts on the verdict autonomously and treats `accepted` tickets as done (left in the review lane) | `issue`, `decision` (`accepted`/`held`), `drift`, `close_gate`, `reviewer_agent`, `evidence_file`, `report_file` |
-| `…repo.<repo>.issue.review_rollback.recorded` | A review-accepted ticket is moved back to active because a dependent proved it broken | `issue`, `surfaced_by`, `reason` |
-| `…repo.<repo>.issue.truthcheck.flagged` | Status/evidence mismatch found | `issue`, `reason` |
-
-## Rules
-
-- Emit events for consequential transitions; do not invent types casually.
-- Event emission never replaces the board update or issue evidence.
-- If emission fails, continue and report the trail is incomplete.
-- Autonomous acceptance is legitimate only when
-  `issue.autonomous_review.decided` is emitted with `decision=accepted` and
-  `close_gate=pass` by `bin/issue-autonomous-review.sh`. That script will not
-  emit an `accepted` decision while the close gate fails or drift is `significant`.
-
-## Canonical BloodBank
-
-These project-local repo-lane events are BloodBank-*style*. Promote a type to a
-canonical NATS subject only after adding its JSON Schema to the BloodBank schema
-tree and passing validation. The local emitter does not require NATS so the loop
-stays reliable offline.
+It appends to `_bmad-output/implementation-artifacts/bloodbank-events.jsonl`
+(git-ignored dev spool) using the Hermes CloudEvents envelope shape. Nothing in
+the engine calls it today.
+
+## Naming, before you add one
+
+Event types are exactly four tokens — `bloodbank.<domain>.<entity>.<action>` —
+with `<domain>` and `<entity>` drawn from the allowlists in
+`~/code/33GOD/bloodbank/docs/event-naming.md` (§6/§7). Repo and agent identity
+go in `data.repo` / `actor.agent_id`, never in a type or subject token. Schema
+revision lives in `dataschema`/`schemaref`, never in the type.
+
+Add a family when something will actually consume it — register the schema in
+the BloodBank schema tree first, then emit. A type nobody reads is a type that
+rots into the wrong shape.

package/templates/hermes-agent/template/.scripts/sentinel.prompt.md.jinja

@@ -33,8 +33,8 @@ on Linear, Plane, or Trello.
 ## Pass
 
 **Trigger.** This pass runs both on the cheap heartbeat timer AND on a live
-**Plane board event** — a `bloodbank.evt.v1.repo.<repo>.ticket_*` event delivered
-by the `plane-webhook-bridge`. If a specific ticket event triggered you, FIRST
+**Plane board event** — a `bloodbank.evt.repo.task.*` event (repo identity lives
+in `data.repo`, never in the subject) delivered by the `plane-webhook-bridge`. If a specific ticket event triggered you, FIRST
 `tp get_issue <that ticket>`, read the change, and react to it (triage / refine /
 comment / transition per the lifecycle) before the general reconcile below.
 
@@ -68,19 +68,18 @@ comment / transition per the lifecycle) before the general reconcile below.
      independence satisfied, close gate passes): autonomously TREAT THE TICKET AS
      DONE. Leave it in the review lane as the operator's deferred-QA queue (do NOT
      auto-transition to `completed`; `--close` is an optional operator-QA-sweep
-     flag the loop omits). Record the adversarial review report, emit the decision
-     event, and post ONE ticket comment stating the autonomous acceptance with a
+     flag the loop omits). Record the adversarial review report and post ONE
+     ticket comment stating the autonomous acceptance with a
      pointer to the report — never a "waiting on you" comment, no grace wait. A
      dependent blocked only on this review-accepted feature is now unblocked.
    - **Held** (a real finding or gate failure): the ticket goes back to active
      (`started` if a worker takes it now, else `unstarted`); record the hold
-     reasons and emit the decision event.
+     reasons in the review report and a ticket comment.
 6. **Regression rollback.** If a later dependent proves a review-accepted feature
    is ACTUALLY BROKEN, move that feature back to active (`started` if a worker
    takes it now, else `unstarted`) as a PREREQUISITE of the dependent; comment
-   naming the dependent + symptom; emit
-   `bloodbank.v1.repo.{{ target_repo }}.issue.review_rollback.recorded`
-   `{issue, surfaced_by, reason}`. The dependent stays blocked on the prerequisite
+   naming the dependent + symptom, and record the rollback (issue, surfaced_by,
+   reason) in the issue evidence file. The dependent stays blocked on the prerequisite
    until it is fixed. This is expected and healthy — it is the trade for deferring
    operator QA, not a failure.
 7. **External blockers only** (credentials, third-party access, paid actions,

package/templates/hermes-agent/template/.scripts/store-onepassword-secret.py

@@ -0,0 +1,260 @@
+#!/usr/bin/env python3
+"""Store process-only secrets in 1Password and print op:// references.
+
+Secret values are read from stdin and are never placed in argv, a temporary
+file, stdout, or an ``op`` child environment. Item JSON travels only over an
+anonymous pipe to the 1Password CLI. Credential pairs are staged in a new,
+versioned item and both fields are verified before either reference is emitted.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import shutil
+import subprocess
+import sys
+import uuid
+
+
+def fail(message: str) -> "None":
+    raise SystemExit(f"1Password secret storage failed: {message}")
+
+
+def op_run(args: list[str], *, payload: str | None = None) -> subprocess.CompletedProcess[str]:
+    allowed = (
+        "PATH",
+        "HOME",
+        "USERPROFILE",
+        "APPDATA",
+        "LOCALAPPDATA",
+        "SystemRoot",
+        "TMPDIR",
+        "TMP",
+        "TEMP",
+        "XDG_CONFIG_HOME",
+        "XDG_RUNTIME_DIR",
+        "OP_ACCOUNT",
+        "OP_CONNECT_HOST",
+        "OP_CONNECT_TOKEN",
+        "OP_LOAD_DESKTOP_APP_SETTINGS",
+        "OP_SERVICE_ACCOUNT_TOKEN",
+    )
+    env = {name: os.environ[name] for name in allowed if name in os.environ}
+    env.update(
+        (name, value)
+        for name, value in os.environ.items()
+        if name.startswith("OP_SESSION_")
+    )
+    env["NO_COLOR"] = "1"
+    return subprocess.run(
+        [OP, *args],
+        input=payload,
+        text=True,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        check=False,
+        env=env,
+        timeout=30,
+    )
+
+
+OP = shutil.which("op") or ""
+if not OP:
+    fail("the op CLI is not installed")
+
+if len(sys.argv) == 3 and sys.argv[1] == "--validate-reference":
+    reference = sys.argv[2]
+    if not reference.startswith("op://") or any(ch in reference for ch in "\r\n\0"):
+        fail("invalid 1Password reference")
+    resolved = op_run(["read", "--", reference])
+    if resolved.returncode != 0 or not resolved.stdout.rstrip("\n"):
+        fail("the configured reference did not resolve")
+    raise SystemExit(0)
+
+if len(sys.argv) == 4 and sys.argv[1] == "--delete-item-id":
+    vault, item_id = sys.argv[2:]
+    if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._ -]{0,126}", vault):
+        fail("vault name contains unsupported characters")
+    if not re.fullmatch(r"[A-Za-z0-9_-]{1,128}", item_id):
+        fail("invalid immutable item id")
+    deleted = op_run(["item", "delete", item_id, "--vault", vault, "--archive"])
+    if deleted.returncode != 0:
+        fail("staged item cleanup was rejected")
+    raise SystemExit(0)
+
+pair_mode = len(sys.argv) == 6 and sys.argv[1] == "--store-pair"
+single_staged_mode = len(sys.argv) == 5 and sys.argv[1] == "--store-staged"
+staged_mode = pair_mode or single_staged_mode
+if pair_mode:
+    vault, item, field_one, field_two = sys.argv[2:]
+    if field_one == field_two or not all(
+        re.fullmatch(r"[a-z][a-z0-9_]{0,63}", field)
+        for field in (field_one, field_two)
+    ):
+        fail("pair field names are invalid or not distinct")
+elif single_staged_mode:
+    vault, item, field_one = sys.argv[2:]
+    if not re.fullmatch(r"[a-z][a-z0-9_]{0,63}", field_one):
+        fail("staged field name is invalid")
+else:
+    if len(sys.argv) != 3:
+        fail(
+            "usage: store-onepassword-secret.py <vault> <item>, "
+            "--store-staged <vault> <item-prefix> <field>, or "
+            "--store-pair <vault> <item-prefix> <field-one> <field-two>"
+        )
+    vault, item = sys.argv[1:]
+safe = re.compile(r"[A-Za-z0-9][A-Za-z0-9._ -]{0,126}")
+if not safe.fullmatch(vault) or not safe.fullmatch(item):
+    fail("vault or item name contains unsupported characters")
+
+payload = sys.stdin.read()
+if pair_mode:
+    values = payload.split("\n")
+    if len(values) != 2 or not all(values):
+        fail("credential pair input must contain exactly two non-empty lines")
+    secrets = [(field_one, values[0]), (field_two, values[1])]
+elif single_staged_mode:
+    if payload.endswith("\n"):
+        payload = payload[:-1]
+    secrets = [(field_one, payload)]
+else:
+    if payload.endswith("\n"):
+        payload = payload[:-1]
+    secrets = [("password", payload)]
+if any(not value or any(ch in value for ch in "\r\n\0") for _, value in secrets):
+    fail("refusing to store an empty or multiline value")
+
+if staged_mode:
+    if len(item) > 105:
+        fail("item prefix is too long for a versioned item")
+    item = f"{item}-v-{uuid.uuid4().hex[:16]}"
+    document = {
+        "title": item,
+        "category": "PASSWORD",
+        "fields": [
+            {
+                "id": field,
+                "type": "CONCEALED",
+                "label": field,
+                "value": value,
+            }
+            for field, value in secrets
+        ]
+        + [
+            {
+                "id": "notesPlain",
+                "type": "STRING",
+                "purpose": "NOTES",
+                "label": "notesPlain",
+                "value": (
+                    "Managed by hermes-agent-template as a staged credential; "
+                    "rotate through the provisioner."
+                ),
+            }
+        ],
+    }
+    stored = op_run(
+        ["item", "create", "--vault", vault, "--format=json", "-"],
+        payload=json.dumps(document),
+    )
+    if stored.returncode != 0:
+        fail("op rejected the staged credential update")
+    try:
+        created = json.loads(stored.stdout)
+        item_id = str(created.get("id") or "")
+    except (AttributeError, TypeError, json.JSONDecodeError):
+        fail("op item create returned invalid JSON")
+    if not re.fullmatch(r"[A-Za-z0-9_-]{1,128}", item_id):
+        fail("op item create omitted an immutable item id")
+    references = [f"op://{vault}/{item_id}/{field}" for field, _ in secrets]
+    for reference, (_, expected) in zip(references, secrets, strict=True):
+        verified = op_run(["read", "--", reference])
+        if verified.returncode != 0 or verified.stdout.rstrip("\n") != expected:
+            # The item is not active until the caller commits its refs. Archive
+            # this failed stage by immutable id; never guess/delete by title.
+            op_run(["item", "delete", item_id, "--vault", vault, "--archive"])
+            fail("a staged credential field did not verify; cleanup attempted")
+    print("\n".join([item_id, *references]))
+    raise SystemExit(0)
+
+listed = op_run(["item", "list", "--vault", vault, "--format=json"])
+if listed.returncode != 0:
+    fail("vault access/authentication was rejected")
+try:
+    rows = json.loads(listed.stdout)
+except (TypeError, json.JSONDecodeError):
+    fail("op item list returned invalid JSON")
+
+matches = [row for row in rows if isinstance(row, dict) and row.get("title") == item]
+if len(matches) > 1:
+    fail("multiple items have the requested title")
+
+if matches:
+    item_id = str(matches[0].get("id") or "")
+    if not item_id:
+        fail("the existing item has no id")
+    fetched = op_run(["item", "get", item_id, "--vault", vault, "--format=json"])
+    if fetched.returncode != 0:
+        fail("the existing item could not be read")
+    try:
+        document = json.loads(fetched.stdout)
+    except (TypeError, json.JSONDecodeError):
+        fail("op item get returned invalid JSON")
+    fields = document.get("fields")
+    if not isinstance(fields, list):
+        fail("the existing item has no fields list")
+    concealed_field = next(
+        (field for field in fields if isinstance(field, dict) and field.get("id") == "password"),
+        None,
+    )
+    if concealed_field is None:
+        concealed_field = {
+            "id": "password",
+            "type": "CONCEALED",
+            "purpose": "PASSWORD",
+            "label": "password",
+        }
+        fields.append(concealed_field)
+    concealed_field["value"] = secrets[0][1]
+    stored = op_run(
+        ["item", "edit", item_id, "--vault", vault],
+        payload=json.dumps(document),
+    )
+else:
+    document = {
+        "title": item,
+        "category": "PASSWORD",
+        "fields": [
+            {
+                "id": "password",
+                "type": "CONCEALED",
+                "purpose": "PASSWORD",
+                "label": "password",
+                "value": secrets[0][1],
+            },
+            {
+                "id": "notesPlain",
+                "type": "STRING",
+                "purpose": "NOTES",
+                "label": "notesPlain",
+                "value": "Managed by hermes-agent-template; rotate through the provisioner.",
+            },
+        ],
+    }
+    stored = op_run(
+        ["item", "create", "--vault", vault, "-"],
+        payload=json.dumps(document),
+    )
+
+if stored.returncode != 0:
+    fail("op rejected the item update")
+
+reference = f"op://{vault}/{item}/password"
+verified = op_run(["read", "--", reference])
+if verified.returncode != 0 or verified.stdout.rstrip("\n") != secrets[0][1]:
+    fail("the stored reference did not resolve to the supplied value")
+
+print(reference)

package/templates/hermes-agent/template/SOUL.md.jinja

@@ -39,7 +39,7 @@ question — not three vague ones.
 
 ## Default contract (every role)
 
-Envelope shape: CloudEvents 1.0, type `bloodbank.v1.<domain>.<entity>.<action>`,
+Envelope shape: CloudEvents 1.0, type `bloodbank.<domain>.<entity>.<action>`,
 `actor.agent_id = {{ agent_id }}`, `producer = hermes-agent:{{ agent_id }}`,
 `source = hermes://agent/{{ agent_id }}`. Inbound commands arrive through the
 fleet-shared Hermes gateway and are routed by `data.target_agent_id`.
@@ -55,9 +55,8 @@ You are the **project-manager ORCHESTRATOR** — the autonomous Hermes carrier o
 Momo, and the twin of the human-drivable Momo. You share ONE board and ONE
 Hindsight bank with it; stay attributable and never split-brain the state. You
 triage incoming requests, decompose them into discrete tasks on the Plane
-board, and route work to other agents (e.g. the dev role on
-`bloodbank.cmd.v1.agent.task.assign` with
-`data.target_agent_id = {{ target_repo }}-dev`).
+board, and route work to other agents (e.g. the `{{ target_repo }}-dev`
+role).
 
 **Prime directives (non-negotiable):**
 - **Never mutate code** — every code change flows through a delegated worker.
@@ -75,9 +74,9 @@ Default execution workflow for implementation delivery: use
 (WIP=1, spec review gate, quality review gate).
 
 Decision events you commonly emit:
-- `bloodbank.v1.repo.decision.recorded`
-- `bloodbank.v1.repo.intake.triaged`
-- `bloodbank.v1.repo.task.created`
+- `bloodbank.repo.decision.recorded`
+- `bloodbank.repo.intake.triaged`
+- `bloodbank.repo.task.created`
 
 Put `repo = {{ target_repo }}` in event data; never insert repo or agent
 identifiers into Bloodbank type or subject tokens.
@@ -94,18 +93,17 @@ You are the **developer**. You implement tasks dispatched by the PM agent,
 write tests, run the project's `mise run test` or equivalent, open PRs, and
 respond to review comments. You do not merge — that's the reviewer's call.
 
-Events you commonly emit:
-- `bloodbank.v1.repo.code.committed`
-- `bloodbank.v1.repo.test.completed`
-- `bloodbank.v1.repo.pr.opened`
+You emit no Bloodbank event family of your own. Report progress on the ticket;
+if a delivery fact is genuinely worth publishing, ask for a family to be minted
+first — do not invent a type on the fly.
 {%- elif role == "review" -%}
 You are the **reviewer**. You read PRs critically, check against the
 project's CONTRIBUTING and AGENTS.md, and either approve or request changes.
 You hold the merge gate for non-trivial changes.
 
-Events:
-- `bloodbank.v1.repo.review.completed`
-- `bloodbank.v1.repo.pr.merged`
+You emit no Bloodbank event family of your own. The review verdict lives on the
+ticket and in the review report; if a review fact is genuinely worth publishing,
+ask for a family to be minted first — do not invent a type on the fly.
 {%- elif role == "reporter" -%}
 You are the **DeLoNET company reporter**. Your single durable product is the
 operator's evidence-backed daily company rollup. Run the `delonet-daily-report`
@@ -135,8 +133,8 @@ credential is verified as owned by this reporter. Never reuse another agent's
 Telegram or Slack identity.
 {%- else -%}
 You operate as the **{{ role }}** agent for this repo. Define your contract
-in this file (this section), then publish a `bloodbank.v1.agent.contract.
-declared` event so the fleet knows what to route to you.
+in this file (this section) — this file is the fleet's record of what to
+route to you.
 {%- endif %}
 
 ## DeloNet conventions you respect

package/templates/hermes-agent/template/hermes.jinja

@@ -42,7 +42,7 @@ if ! REPO_ROOT="$(git -C "$ROLE_DIR" rev-parse --show-toplevel 2>/dev/null)"; th
 fi
 
 # Never pass an identity-bearing chat credential from shared fleet state into
-# a profile process. Hermes loads the profile's own runtime/.env itself.
+# a profile process. Hermes resolves the named profile's 1Password references.
 unset TELEGRAM_BOT_TOKEN SLACK_BOT_TOKEN SLACK_APP_TOKEN
 
 CONFIG="${HERMES_TEMPLATE_CONFIG:-${XDG_CONFIG_HOME:-$HOME/.config}/hermes-agent-template/config.toml}"