@delorenj/pjangler 1.4.2 → 1.4.3

package/dist/mcp-server.js

@@ -193,17 +193,17 @@ var init_types = __esm({
 
 // src/utils/tree-diff.ts
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync4, lstatSync as lstatSync3, readFileSync as readFileSync4, readdirSync as readdirSync3, readlinkSync as readlinkSync2 } from "node:fs";
+import { existsSync as existsSync4, lstatSync as lstatSync4, readFileSync as readFileSync5, readdirSync as readdirSync3, readlinkSync as readlinkSync2 } from "node:fs";
 import { join as join6, relative as relative3 } from "node:path";
 function snapshotTree(root, current = root, snapshot = /* @__PURE__ */ new Map()) {
   if (!existsSync4(current)) return snapshot;
   const rel = relative3(root, current) || ".";
   if (rel === ".git" || rel.startsWith(`.git${process.platform === "win32" ? "\\" : "/"}`)) return snapshot;
-  const stat = lstatSync3(current);
+  const stat = lstatSync4(current);
   if (stat.isSymbolicLink()) {
     snapshot.set(rel, `link:${readlinkSync2(current)}`);
   } else if (stat.isFile()) {
-    snapshot.set(rel, `file:${createHash3("sha256").update(readFileSync4(current)).digest("hex")}:${stat.mode & 511}`);
+    snapshot.set(rel, `file:${createHash3("sha256").update(readFileSync5(current)).digest("hex")}:${stat.mode & 511}`);
   } else if (stat.isDirectory()) {
     snapshot.set(rel, `dir:${stat.mode & 511}`);
     for (const name of readdirSync3(current)) snapshotTree(root, join6(current, name), snapshot);
@@ -227,14 +227,14 @@ import {
   accessSync,
   constants as constants2,
   existsSync as existsSync5,
-  lstatSync as lstatSync4,
-  readFileSync as readFileSync5,
+  lstatSync as lstatSync5,
+  readFileSync as readFileSync6,
   readdirSync as readdirSync4,
-  realpathSync as realpathSync2,
+  realpathSync as realpathSync3,
   statSync
 } from "node:fs";
 import { tmpdir, userInfo } from "node:os";
-import { basename as basename4, delimiter, isAbsolute, join as join7, relative as relative4, resolve as resolve4 } from "node:path";
+import { basename as basename5, delimiter, isAbsolute, join as join7, relative as relative4, resolve as resolve4 } from "node:path";
 import YAML2 from "yaml";
 function containedBy(parent, candidate) {
   const rel = relative4(resolve4(parent), resolve4(candidate));
@@ -246,7 +246,7 @@ function firstExecutableOnPath(env2) {
     const candidate = resolve4(entry, process.platform === "win32" ? "copier.exe" : "copier");
     try {
       accessSync(candidate, constants2.X_OK);
-      const stat = lstatSync4(candidate);
+      const stat = lstatSync5(candidate);
       if (stat.isFile() || stat.isSymbolicLink()) return candidate;
     } catch {
     }
@@ -254,11 +254,11 @@ function firstExecutableOnPath(env2) {
   return void 0;
 }
 function sha2562(path) {
-  return createHash4("sha256").update(readFileSync5(path)).digest("base64url");
+  return createHash4("sha256").update(readFileSync6(path)).digest("base64url");
 }
 function fingerprint(path) {
   const absolute = resolve4(path);
-  const realPath = realpathSync2(absolute);
+  const realPath = realpathSync3(absolute);
   const stat = statSync(realPath);
   if (!stat.isFile()) throw new Error(`${absolute} is not a regular file`);
   return {
@@ -292,7 +292,7 @@ function sameFingerprint(expected) {
 function consoleScriptContract(path) {
   let text2;
   try {
-    text2 = readFileSync5(path, "utf8").slice(0, 32 * 1024);
+    text2 = readFileSync6(path, "utf8").slice(0, 32 * 1024);
   } catch (error) {
     return { ok: false, error: `cannot read Copier launcher: ${error instanceof Error ? error.message : String(error)}` };
   }
@@ -303,7 +303,7 @@ function consoleScriptContract(path) {
     return { ok: false, error: "Copier launcher must use one absolute Python interpreter" };
   }
   const interpreterPath = resolve4(shebang[0]);
-  const interpreter = basename4(interpreterPath);
+  const interpreter = basename5(interpreterPath);
   if (!/^python(?:\d+(?:\.\d+)*)?$/.test(interpreter)) {
     return { ok: false, error: "Copier launcher is not an absolute Python console script" };
   }
@@ -327,7 +327,7 @@ function locateUvSitePackages(toolRoot) {
     if (existsSync5(sitePackages)) candidates.push(sitePackages);
   }
   if (candidates.length !== 1) throw new Error(`expected one UV Copier site-packages directory, found ${candidates.length}`);
-  return realpathSync2(candidates[0]);
+  return realpathSync3(candidates[0]);
 }
 function parseRecordLine(line) {
   if (!line || line.includes('"')) return void 0;
@@ -356,11 +356,11 @@ function attestUvCopier(candidate, realCandidate, home) {
     if (!launcher.ok || !launcher.interpreter) {
       return { ...launcher, executable: realCandidate, realExecutable: realCandidate };
     }
-    const expectedInterpreter = join7(toolRoot, "bin", basename4(launcher.interpreter));
+    const expectedInterpreter = join7(toolRoot, "bin", basename5(launcher.interpreter));
     if (resolve4(launcher.interpreter) !== resolve4(expectedInterpreter)) {
       return { ok: false, error: "UV Copier launcher interpreter is outside the attested tool environment" };
     }
-    const interpreterReal = realpathSync2(launcher.interpreter);
+    const interpreterReal = realpathSync3(launcher.interpreter);
     const uvPythonRoots = [
       join7(home, ".local", "share", "uv", "python"),
       join7(home, "Library", "Application Support", "uv", "python")
@@ -369,7 +369,7 @@ function attestUvCopier(candidate, realCandidate, home) {
       return { ok: false, error: "UV Copier interpreter is not managed by the canonical UV Python installation" };
     }
     const receiptPath = join7(toolRoot, "uv-receipt.toml");
-    const receipt = readFileSync5(receiptPath, "utf8");
+    const receipt = readFileSync6(receiptPath, "utf8");
     if (!/requirements\s*=\s*\[[\s\S]*?name\s*=\s*["']copier["']/.test(receipt) || !/entrypoints\s*=\s*\[[\s\S]*?name\s*=\s*["']copier["'][\s\S]*?from\s*=\s*["']copier["']/.test(receipt)) {
       return { ok: false, error: "UV tool receipt does not bind the copier entry point to the Copier package" };
     }
@@ -378,24 +378,24 @@ function attestUvCopier(candidate, realCandidate, home) {
     if (distInfos.length !== 1) {
       return { ok: false, error: `expected one installed Copier distribution, found ${distInfos.length}` };
     }
-    const distInfo = realpathSync2(distInfos[0]);
+    const distInfo = realpathSync3(distInfos[0]);
     const metadataPath = join7(distInfo, "METADATA");
     const entryPointsPath = join7(distInfo, "entry_points.txt");
     const recordPath = join7(distInfo, "RECORD");
-    const metadata = readFileSync5(metadataPath, "utf8");
+    const metadata = readFileSync6(metadataPath, "utf8");
     const name = metadata.match(/^Name:\s*(.+)$/mi)?.[1]?.trim();
     const version = metadata.match(/^Version:\s*(.+)$/mi)?.[1]?.trim();
     if (name?.toLowerCase() !== "copier" || !version || !/^9(?:\.|$)/.test(version)) {
       return { ok: false, error: "installed distribution is not a Copier 9 package" };
     }
-    const entryPoints = readFileSync5(entryPointsPath, "utf8");
+    const entryPoints = readFileSync6(entryPointsPath, "utf8");
     if (!/^copier\s*=\s*copier\.__main__:CopierApp\.run\s*$/m.test(entryPoints)) {
       return { ok: false, error: "installed Copier distribution has an unexpected console entry point" };
     }
-    const recordEntries = readFileSync5(recordPath, "utf8").split(/\r?\n/).map(parseRecordLine).filter((entry) => Boolean(entry));
+    const recordEntries = readFileSync6(recordPath, "utf8").split(/\r?\n/).map(parseRecordLine).filter((entry) => Boolean(entry));
     const selected = recordEntries.filter((entry) => {
       const normalized = entry.relativePath.replaceAll("\\", "/");
-      return normalized.startsWith("copier/") || normalized === `${basename4(distInfo)}/METADATA` || normalized === `${basename4(distInfo)}/entry_points.txt` || normalized === "../../../bin/copier";
+      return normalized.startsWith("copier/") || normalized === `${basename5(distInfo)}/METADATA` || normalized === `${basename5(distInfo)}/entry_points.txt` || normalized === "../../../bin/copier";
     });
     if (!selected.some((entry) => entry.relativePath === "../../../bin/copier") || !selected.some((entry) => entry.relativePath.replaceAll("\\", "/") === "copier/__main__.py")) {
       return { ok: false, error: "Copier RECORD does not bind its launcher and package entry point" };
@@ -456,7 +456,7 @@ function preflightTrustedCopier(options) {
   if (!candidate) return { ok: false, error: "copier not found on PATH" };
   let realCandidate;
   try {
-    realCandidate = realpathSync2(candidate);
+    realCandidate = realpathSync3(candidate);
   } catch (error) {
     return { ok: false, error: `cannot resolve Copier launcher: ${error instanceof Error ? error.message : String(error)}` };
   }
@@ -469,10 +469,10 @@ function preflightTrustedCopier(options) {
 }
 function regularContainedFile(root, path, label) {
   try {
-    const rootReal = realpathSync2(root);
-    const fileReal = realpathSync2(path);
+    const rootReal = realpathSync3(root);
+    const fileReal = realpathSync3(path);
     if (!containedBy(rootReal, fileReal)) return { ok: false, error: `${label} escapes its vendored template root` };
-    if (!lstatSync4(path).isFile()) return { ok: false, error: `${label} is not a regular file` };
+    if (!lstatSync5(path).isFile()) return { ok: false, error: `${label} is not a regular file` };
     return { ok: true };
   } catch (error) {
     return { ok: false, error: `${label} is unavailable: ${error instanceof Error ? error.message : String(error)}` };
@@ -483,7 +483,7 @@ function parseCopierConfig(templateRoot, label) {
   const file = regularContainedFile(templateRoot, configPath, `${label} copier.yml`);
   if (!file.ok) return { result: file };
   try {
-    const parsed = YAML2.parse(readFileSync5(configPath, "utf8"));
+    const parsed = YAML2.parse(readFileSync6(configPath, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return { result: { ok: false, error: `${label} copier.yml must contain a mapping` } };
     }
@@ -518,7 +518,7 @@ function preflightCommonProjectTemplate(pjanglerRoot) {
     "template/mise.toml.jinja"
   ], "CommonProject template");
   if (!files.ok) return files;
-  const projectJson = readFileSync5(join7(templateRoot, "template", ".project.json.jinja"), "utf8");
+  const projectJson = readFileSync6(join7(templateRoot, "template", ".project.json.jinja"), "utf8");
   for (const key of ["project_name", "project_slug", "repo_path", "ticket_provider", "agents"]) {
     if (!projectJson.includes(`"${key}"`)) return { ok: false, error: `CommonProject projection is missing ${key}` };
   }
@@ -529,7 +529,7 @@ function preflightHermesTemplate(pjanglerRoot, env2 = process.env) {
   const explicit = env2.PJANGLER_HERMES_TEMPLATE?.trim();
   if (explicit) {
     try {
-      if (realpathSync2(resolve4(explicit)) !== realpathSync2(templateRoot)) {
+      if (realpathSync3(resolve4(explicit)) !== realpathSync3(templateRoot)) {
         return { ok: false, error: "MCP Hermes apply requires the version-locked vendored template" };
       }
     } catch (error) {
@@ -547,27 +547,29 @@ function preflightHermesTemplate(pjanglerRoot, env2 = process.env) {
     "template/.scripts/05-fleet-env.sh",
     "template/.scripts/10-hermes-profile.sh",
     "template/.scripts/20-runtime-repo.sh",
+    "template/.scripts/30-telegram.sh",
+    "template/.scripts/31-slack.sh",
     "template/.scripts/42-ticket-provider.sh",
     "template/.scripts/70-systemd.sh",
     "template/.scripts/80-registry.sh"
   ], "Hermes template");
   if (!required.ok) return required;
-  const role = readFileSync5(join7(templateRoot, "template", "role.yaml.jinja"), "utf8");
+  const role = readFileSync6(join7(templateRoot, "template", "role.yaml.jinja"), "utf8");
   if (!/^bloodbank:\s*$[\s\S]*?^\s+enabled:\s+(?:true|false)\s*$/m.test(role)) {
     return { ok: false, error: "Hermes role projection must declare bloodbank.enabled as a strict boolean" };
   }
-  const library = readFileSync5(join7(templateRoot, "template", ".scripts", "_lib.sh"), "utf8");
+  const library = readFileSync6(join7(templateRoot, "template", ".scripts", "_lib.sh"), "utf8");
   if (!library.includes("PJANGLER_PROJECT_ROOT") || !library.includes('"$explicit"/agents/hermes/*')) {
     return { ok: false, error: "Hermes project-root resolver must honor the explicitly contained MCP target" };
   }
-  const skipPlane = readFileSync5(join7(templateRoot, "template", ".scripts", "42-ticket-provider.sh"), "utf8");
+  const skipPlane = readFileSync6(join7(templateRoot, "template", ".scripts", "42-ticket-provider.sh"), "utf8");
   const guard = skipPlane.indexOf('if [[ "${SKIP_PLANE:-0}" == "1" ]]');
   const firstSource = skipPlane.search(/^source\s/m);
   if (guard < 0 || firstSource < 0 || guard > firstSource) {
     return { ok: false, error: "Hermes ticket-provider skip guard must precede all sourced provider/config logic" };
   }
-  for (const script of ["01-config.sh", "05-fleet-env.sh", "10-hermes-profile.sh", "80-registry.sh"]) {
-    const text2 = readFileSync5(join7(templateRoot, "template", ".scripts", script), "utf8");
+  for (const script of ["01-config.sh", "05-fleet-env.sh", "10-hermes-profile.sh", "30-telegram.sh", "31-slack.sh", "80-registry.sh"]) {
+    const text2 = readFileSync6(join7(templateRoot, "template", ".scripts", script), "utf8");
     const hostGuard = text2.indexOf('if [[ "${SKIP_HOST_STATE:-0}" == "1" ]]');
     const source = text2.search(/^source\s/m);
     if (hostGuard < 0 || source < 0 || hostGuard > source) {
@@ -585,7 +587,7 @@ function preflightRenderedHermes(options) {
   const roleDir = resolve4(options.roleDir);
   if (!containedBy(target, roleDir)) return { ok: false, error: "rendered Hermes role escapes its project target" };
   try {
-    const stat = lstatSync4(roleDir);
+    const stat = lstatSync5(roleDir);
     if (!stat.isDirectory() || stat.isSymbolicLink()) {
       return { ok: false, error: "rendered Hermes role must be a real directory" };
     }
@@ -606,7 +608,7 @@ function preflightRenderedHermes(options) {
   if (!required.ok) return required;
   for (const script of ["_lib.sh", "01-config.sh", "05-fleet-env.sh", "10-hermes-profile.sh", "20-runtime-repo.sh", "42-ticket-provider.sh", "70-systemd.sh", "80-registry.sh"]) {
     try {
-      if (readFileSync5(join7(renderedScripts, script), "utf8") !== readFileSync5(join7(templateScripts, script), "utf8")) {
+      if (readFileSync6(join7(renderedScripts, script), "utf8") !== readFileSync6(join7(templateScripts, script), "utf8")) {
         return { ok: false, error: `rendered Hermes script differs from the attested template: ${script}` };
       }
     } catch (error) {
@@ -615,7 +617,7 @@ function preflightRenderedHermes(options) {
   }
   let role;
   try {
-    const parsed = YAML2.parse(readFileSync5(join7(roleDir, "role.yaml"), "utf8"));
+    const parsed = YAML2.parse(readFileSync6(join7(roleDir, "role.yaml"), "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return { ok: false, error: "rendered Hermes role.yaml must contain a mapping" };
     }
@@ -637,7 +639,7 @@ function preflightRenderedHermes(options) {
   const manifestPath = join7(target, ".project.json");
   if (existsSync5(manifestPath)) {
     try {
-      const manifest = JSON.parse(readFileSync5(manifestPath, "utf8"));
+      const manifest = JSON.parse(readFileSync6(manifestPath, "utf8"));
       const agents = manifest.agents;
       const declared = agents?.[options.agentId];
       if (!declared || declared.role !== options.role || declared.role_dir !== relative4(target, roleDir) || declared.provisioning_state !== "provisioned") {
@@ -828,7 +830,7 @@ var init_RegistryStore = __esm({
       async getByRepoPath(repoPath) {
         const registry = await this.load();
         return Object.values(registry.projects).find(
-          (p6) => p6.repo_path === repoPath
+          (p4) => p4.repo_path === repoPath
         );
       }
       async close() {
@@ -905,7 +907,7 @@ var init_RegistryStore = __esm({
       }
       async loadTicketProvider(client, projectId) {
         const { rows } = await client.query(
-          `SELECT provider_type, workspace, identifier, board_id, state
+          `SELECT provider_type, workspace, identifier, identifier_source, identifier_fetched_at, board_id, board_confirmed_at, state
        FROM public.project_ticket_boards
        WHERE project_id = $1
        LIMIT 1`,
@@ -915,11 +917,20 @@ var init_RegistryStore = __esm({
           return { type: "plane", workspace: "33god", identifier: "", board_id: "", state: "planned" };
         }
         const row = rows[0];
+        const fetchedAt = row.identifier_fetched_at;
+        const confirmedAt = row.board_confirmed_at;
         return {
           type: row.provider_type,
           workspace: row.workspace ?? void 0,
           identifier: row.identifier ?? void 0,
+          // Provenance is a column, not an extension blob: dropping it here would
+          // silently demote every provider-confirmed board back to a guess.
+          identifier_source: row.identifier_source ?? void 0,
+          identifier_fetched_at: fetchedAt ? fetchedAt instanceof Date ? fetchedAt.toISOString() : String(fetchedAt) : void 0,
           board_id: row.board_id ?? void 0,
+          // Board-binding provenance is its own column for the same reason
+          // identifier provenance is: dropping it demotes every honest link.
+          board_confirmed_at: confirmedAt ? confirmedAt instanceof Date ? confirmedAt.toISOString() : String(confirmedAt) : void 0,
           state: row.state ?? void 0
         };
       }
@@ -947,15 +958,18 @@ var init_RegistryStore = __esm({
         );
         await client.query(
           `INSERT INTO public.project_ticket_boards
-         (repo_id, project_id, provider_type, workspace, identifier, board_id, state)
-       VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+         (repo_id, project_id, provider_type, workspace, identifier, identifier_source, identifier_fetched_at, board_id, board_confirmed_at, state)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
           [
             repoId,
             projectId,
             tp.type,
             tp.workspace ?? null,
             tp.identifier ?? null,
+            tp.identifier_source ?? null,
+            tp.identifier_fetched_at ?? null,
             tp.board_id ?? null,
+            tp.board_confirmed_at ?? null,
             tp.state ?? null
           ]
         );
@@ -965,18 +979,69 @@ var init_RegistryStore = __esm({
   }
 });
 
+// src/project/boardUrl.ts
+var init_boardUrl = __esm({
+  "src/project/boardUrl.ts"() {
+    "use strict";
+  }
+});
+
+// src/utils/version.ts
+import { readFileSync as readFileSync7 } from "node:fs";
+import { dirname as dirname5, join as join8 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var PJANGLER_VERSION;
+var init_version = __esm({
+  "src/utils/version.ts"() {
+    "use strict";
+    PJANGLER_VERSION = (() => {
+      try {
+        let dir = dirname5(fileURLToPath2(import.meta.url));
+        for (let i = 0; i < 4; i++) {
+          try {
+            const raw = readFileSync7(join8(dir, "package.json"), "utf8");
+            return JSON.parse(raw).version ?? "0.0.0";
+          } catch {
+            const parent = dirname5(dir);
+            if (parent === dir) break;
+            dir = parent;
+          }
+        }
+      } catch {
+      }
+      return "0.0.0";
+    })();
+  }
+});
+
+// src/project/boardQuery.ts
+function workspaceEnvKey(workspace) {
+  const key = (workspace ?? "default").toUpperCase().replace(/[^A-Z0-9]/g, "_");
+  return `PLANE_${key || "DEFAULT"}_API_KEY`;
+}
+var init_boardQuery = __esm({
+  "src/project/boardQuery.ts"() {
+    "use strict";
+    init_boardUrl();
+    init_version();
+  }
+});
+
 // src/project/index.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { spawnSync as spawnSync3 } from "node:child_process";
 import { isIP } from "node:net";
-import { chmodSync as chmodSync2, closeSync as closeSync2, copyFileSync as copyFileSync2, existsSync as existsSync6, fchmodSync, fsyncSync, lstatSync as lstatSync5, mkdirSync as mkdirSync4, mkdtempSync as mkdtempSync2, openSync as openSync2, readFileSync as readFileSync6, realpathSync as realpathSync3, renameSync as renameSync2, rmSync as rmSync2, statSync as statSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { chmodSync as chmodSync2, closeSync as closeSync2, copyFileSync as copyFileSync2, existsSync as existsSync6, fchmodSync, fsyncSync, lstatSync as lstatSync6, mkdirSync as mkdirSync4, mkdtempSync as mkdtempSync2, openSync as openSync2, readFileSync as readFileSync8, realpathSync as realpathSync4, renameSync as renameSync3, rmSync as rmSync3, statSync as statSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir4, tmpdir as tmpdir2 } from "node:os";
-import { basename as basename5, delimiter as delimiter2, dirname as dirname5, isAbsolute as isAbsolute2, join as join8, relative as relative5, resolve as resolve5, sep as sep2, win32 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { basename as basename6, delimiter as delimiter2, dirname as dirname6, isAbsolute as isAbsolute2, join as join9, relative as relative5, resolve as resolve5, sep as sep2, win32 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 import YAML3 from "yaml";
+function providerAssignsIdentifiers(type) {
+  return IDENTIFIER_ASSIGNING_PROVIDERS.includes((type ?? "").trim());
+}
 function synchronizeCopierIdentity(manifestPath, manifest) {
-  const answersPath = join8(dirname5(manifestPath), ".copier-answers.yml");
+  const answersPath = join9(dirname6(manifestPath), ".copier-answers.yml");
   if (!existsSync6(answersPath)) return [];
-  const current = readFileSync6(answersPath, "utf8");
+  const current = readFileSync8(answersPath, "utf8");
   const document = YAML3.parseDocument(current);
   if (document.errors.length) return [];
   const name = String(document.get("project_name") ?? "");
@@ -990,7 +1055,7 @@ function synchronizeCopierIdentity(manifestPath, manifest) {
   return [answersPath];
 }
 function projectRegistryPath(env2 = process.env) {
-  return expandHome(env2[PROJECT_REGISTRY_ENV] || join8(homedir4(), ".config", "pjangler", "projects.yaml"));
+  return expandHome(env2[PROJECT_REGISTRY_ENV] || join9(homedir4(), ".config", "pjangler", "projects.yaml"));
 }
 function createSafeRecord(entries = []) {
   const record = /* @__PURE__ */ Object.create(null);
@@ -1005,7 +1070,7 @@ function emptyProjectRegistry() {
 }
 function loadProjectRegistry(path = projectRegistryPath()) {
   if (!existsSync6(path)) return emptyProjectRegistry();
-  const raw = YAML3.parse(readFileSync6(path, "utf8"));
+  const raw = YAML3.parse(readFileSync8(path, "utf8"));
   if (raw == null) return emptyProjectRegistry();
   if (!isRecord(raw)) throw new Error(`Project registry must be a mapping: ${path}`);
   const registry = raw;
@@ -1084,14 +1149,14 @@ function fsyncDirectory(path) {
 }
 function saveProjectRegistry(registry, path = projectRegistryPath()) {
   validateProjectRegistry(registry);
-  mkdirSync4(dirname5(path), { recursive: true });
+  mkdirSync4(dirname6(path), { recursive: true });
   let text2;
   let mode = 420;
   if (existsSync6(path)) {
-    const stat = lstatSync5(path);
+    const stat = lstatSync6(path);
     if (!stat.isFile() || stat.isSymbolicLink()) throw new Error(`Project registry must be a regular file: ${path}`);
     mode = stat.mode & 511;
-    const current = readFileSync6(path, "utf8");
+    const current = readFileSync8(path, "utf8");
     const document = YAML3.parseDocument(current);
     if (document.errors.length) throw new Error(`Project registry YAML is invalid: ${path}`);
     setYamlLeaf(document, ["schema_version"], registry.schema_version);
@@ -1118,9 +1183,9 @@ function saveProjectRegistry(registry, path = projectRegistryPath()) {
     fsyncSync(fd);
     closeSync2(fd);
     fd = void 0;
-    renameSync2(temp, path);
+    renameSync3(temp, path);
     chmodSync2(path, mode);
-    fsyncDirectory(dirname5(path));
+    fsyncDirectory(dirname6(path));
   } catch (error) {
     if (fd !== void 0) try {
       closeSync2(fd);
@@ -1142,6 +1207,7 @@ function validateProjectRegistry(registry) {
   const slugs = /* @__PURE__ */ new Set();
   const repoPaths = /* @__PURE__ */ new Map();
   const identifiers = /* @__PURE__ */ new Map();
+  const boardIds = /* @__PURE__ */ new Map();
   const notebookIds = /* @__PURE__ */ new Map();
   const overviewNoteIds = /* @__PURE__ */ new Map();
   for (const [slug, project] of Object.entries(registry.projects)) {
@@ -1154,13 +1220,24 @@ function validateProjectRegistry(registry) {
       throw new Error(`Duplicate project repo_path: ${project.repo_path} used by ${existingRepoSlug} and ${slug}`);
     }
     repoPaths.set(repoKey, slug);
+    const scope = ticketProviderScope(project.ticket_provider);
+    const boardId = project.ticket_provider.board_id?.trim();
+    if (boardId) {
+      const boardKey = `${scope}\0${boardId}`;
+      const existingBoardSlug = boardIds.get(boardKey);
+      if (existingBoardSlug && existingBoardSlug !== slug) {
+        throw new Error(`Duplicate project board_id: ${boardId} in ${scope.replace("\0", "/")} used by ${existingBoardSlug} and ${slug}`);
+      }
+      boardIds.set(boardKey, slug);
+    }
     const identifier = project.ticket_provider.identifier?.toUpperCase();
     if (identifier) {
-      const existingIdentifierSlug = identifiers.get(identifier);
+      const identifierKey = `${scope}\0${identifier}`;
+      const existingIdentifierSlug = identifiers.get(identifierKey);
       if (existingIdentifierSlug && existingIdentifierSlug !== slug) {
-        throw new Error(`Duplicate project identifier: ${identifier} used by ${existingIdentifierSlug} and ${slug}`);
+        throw new Error(`Duplicate project identifier: ${identifier} in ${scope.replace("\0", "/")} used by ${existingIdentifierSlug} and ${slug}`);
       }
-      identifiers.set(identifier, slug);
+      identifiers.set(identifierKey, slug);
     }
     const notebookId = project.notebook?.notebook_id;
     if (notebookId) {
@@ -1176,6 +1253,9 @@ function validateProjectRegistry(registry) {
     }
   }
 }
+function ticketProviderScope(provider) {
+  return `${provider.type ?? ""}\0${(provider.workspace ?? "").toLowerCase()}`;
+}
 function validateGlobalNotebookConfig(value) {
   if (value === void 0) return;
   if (!isRecord(value)) throw new Error("Project registry notebook must be a mapping");
@@ -1241,40 +1321,41 @@ function normalizeTicketProvider(value) {
 function buildTicketProviderBlock(input) {
   const type = normalizeTicketProvider(input.type);
   const boardId = input.boardId ?? "";
-  if (type === "trello") {
-    return {
-      type,
-      workspace: input.workspace ?? "",
-      identifier: input.identifier,
-      board_id: boardId,
-      state: boardId ? "linked" : "planned"
-    };
-  }
-  const workspace = input.workspace ?? "33god";
+  const identifierSource = input.identifierSource ?? "proposed";
+  const fetchedAt = identifierSource === "provider" ? input.identifierFetchedAt : void 0;
+  const confirmedAt = input.boardConfirmedAt ?? (boardId ? fetchedAt : void 0);
+  const provenClaim = !providerAssignsIdentifiers(type) || identifierSource === "provider";
   return {
     type,
-    workspace,
+    workspace: input.workspace ?? (type === "trello" ? "" : "33god"),
     identifier: input.identifier,
+    identifier_source: identifierSource,
+    ...fetchedAt ? { identifier_fetched_at: fetchedAt } : {},
     board_id: boardId,
-    state: boardId ? "linked" : "planned"
+    ...confirmedAt ? { board_confirmed_at: confirmedAt } : {},
+    state: boardId && confirmedAt && provenClaim ? "linked" : "planned"
   };
 }
-function ticketProviderKeyVar(provider) {
-  return provider === "trello" ? "TRELLO_KEY" : "PLANE_API_KEY";
+function ticketProviderKeyGroups(provider, workspace) {
+  if (provider === "trello") return [["TRELLO_KEY"], ["TRELLO_TOKEN"]];
+  return [[.../* @__PURE__ */ new Set(["PLANE_API_KEY", workspaceEnvKey(workspace)])]];
 }
-function ticketProviderKeyVars(provider) {
-  return provider === "trello" ? ["TRELLO_KEY", "TRELLO_TOKEN"] : ["PLANE_API_KEY"];
+function ticketProviderKeyVars(provider, workspace) {
+  return ticketProviderKeyGroups(provider, workspace).flat();
 }
 function ticketProviderSecretsPath(env2 = process.env) {
-  const base = env2.XDG_CONFIG_HOME || join8(env2.HOME || homedir4(), ".config");
-  return join8(base, "zshyzsh", "secrets.zsh");
+  const base = env2.XDG_CONFIG_HOME || join9(env2.HOME || homedir4(), ".config");
+  return join9(base, "zshyzsh", "secrets.zsh");
+}
+function ticketProviderFleetEnvPath(env2 = process.env) {
+  return env2.HERMES_FLEET_ENV?.trim() || join9(env2.HOME || homedir4(), ".hermes", "fleet.env");
 }
 function readShellAssignments(path, keys) {
   const found = {};
   if (!existsSync6(path)) return found;
   let text2;
   try {
-    text2 = readFileSync6(path, "utf8");
+    text2 = readFileSync8(path, "utf8");
   } catch {
     return found;
   }
@@ -1287,8 +1368,8 @@ function readShellAssignments(path, keys) {
     const key = match[1];
     if (!wanted.has(key) || found[key] !== void 0) continue;
     let value = match[2].trim();
-    const quote = value[0];
-    if ((quote === '"' || quote === "'") && value.length > 1 && value.endsWith(quote)) {
+    const quote2 = value[0];
+    if ((quote2 === '"' || quote2 === "'") && value.length > 1 && value.endsWith(quote2)) {
       value = value.slice(1, -1);
     } else {
       value = value.split(/\s+#/)[0].trim();
@@ -1310,16 +1391,16 @@ function resolveTicketProviderCredentials(input) {
     }
   }
   const candidates = [];
-  if (input.repoPath) candidates.push({ path: join8(input.repoPath, ".env"), label: join8(input.repoPath, ".env") });
-  const secrets = ticketProviderSecretsPath(env2);
-  candidates.push({ path: secrets, label: secrets });
+  if (input.repoPath) candidates.push(join9(input.repoPath, ".env"));
+  candidates.push(ticketProviderFleetEnvPath(env2));
+  candidates.push(ticketProviderSecretsPath(env2));
   for (const candidate of candidates) {
     const outstanding = missing();
     if (!outstanding.length) break;
-    const assignments = readShellAssignments(candidate.path, outstanding);
+    const assignments = readShellAssignments(candidate, outstanding);
     for (const [key, value] of Object.entries(assignments)) {
       values[key] = value;
-      sources[key] = candidate.label;
+      sources[key] = candidate;
     }
   }
   return { values, sources };
@@ -1328,40 +1409,42 @@ function resolveTicketProviderAdapter(provider, env2 = process.env) {
   const file = `${provider}.sh`;
   const candidates = [];
   const override = env2[TICKET_PROVIDER_ADAPTERS_ENV];
-  if (override) candidates.push(join8(override, file));
+  if (override) candidates.push(join9(override, file));
   const relativeRoots = [
-    join8("templates", "hermes-agent", "template", ".scripts", "providers"),
-    join8("agents", "hermes", "pm", ".scripts", "providers")
+    join9("templates", "hermes-agent", "template", ".scripts", "providers"),
+    join9("agents", "hermes", "pm", ".scripts", "providers")
   ];
   try {
-    let dir = dirname5(fileURLToPath2(import.meta.url));
+    let dir = dirname6(fileURLToPath3(import.meta.url));
     for (let depth = 0; depth < 8; depth++) {
-      for (const relativeRoot of relativeRoots) candidates.push(join8(dir, relativeRoot, file));
-      const parent = dirname5(dir);
+      for (const relativeRoot of relativeRoots) candidates.push(join9(dir, relativeRoot, file));
+      const parent = dirname6(dir);
       if (parent === dir) break;
       dir = parent;
     }
   } catch {
   }
   for (const relativeRoot of relativeRoots) {
-    candidates.push(join8(homedir4(), "code", "pjangler", relativeRoot, file));
+    candidates.push(join9(homedir4(), "code", "pjangler", relativeRoot, file));
   }
   return candidates.find((candidate) => existsSync6(candidate));
 }
 function provisionTicketProviderBoard(action, env2 = process.env) {
   const provider = action.provider;
-  const keyVar = ticketProviderKeyVar(provider);
+  const groups = ticketProviderKeyGroups(provider, action.workspace);
   const { values } = resolveTicketProviderCredentials({
-    keys: ticketProviderKeyVars(provider),
+    keys: ticketProviderKeyVars(provider, action.workspace),
     repoPath: action.repoPath,
     env: env2
   });
-  if (!values[keyVar]) {
+  const unsatisfied = groups.filter((group) => !group.some((key) => values[key]));
+  if (unsatisfied.length) {
+    const names = unsatisfied.map((group) => group.join(" or ")).join(" and ");
     return {
       ok: true,
       skipped: true,
       logs: [
-        `ticket-provider: ${keyVar} not set; skipping ${provider} board creation (state stays "planned"). Set it in the environment, ${join8(action.repoPath, ".env")}, or ${ticketProviderSecretsPath(env2)}, then re-run with --live \u2014 or pass --board-id to link an existing board.`
+        `ticket-provider: ${names} not set; skipping ${provider} board creation (state stays "planned"). Set it in the environment, ${join9(action.repoPath, ".env")}, ${ticketProviderFleetEnvPath(env2)}, or ${ticketProviderSecretsPath(env2)} \u2014 or pass --board-id to link an existing board.`
       ]
     };
   }
@@ -1375,12 +1458,12 @@ function provisionTicketProviderBoard(action, env2 = process.env) {
     };
   }
   const redact = (text2) => Object.values(values).reduce((acc, secret) => secret ? acc.split(secret).join("***") : acc, text2);
-  const staging = mkdtempSync2(join8(tmpdir2(), "pjangler-tp-"));
+  const staging = mkdtempSync2(join9(tmpdir2(), "pjangler-tp-"));
   try {
-    const providersDir = join8(staging, "agents", "hermes", "pm", ".scripts", "providers");
+    const providersDir = join9(staging, "agents", "hermes", "pm", ".scripts", "providers");
     mkdirSync4(providersDir, { recursive: true });
     writeFileSync4(
-      join8(staging, ".project.json"),
+      join9(staging, ".project.json"),
       `${JSON.stringify(
         {
           project_name: action.boardName,
@@ -1399,11 +1482,11 @@ function provisionTicketProviderBoard(action, env2 = process.env) {
 `,
       "utf8"
     );
-    const staged = join8(providersDir, `${provider}.sh`);
+    const staged = join9(providersDir, `${provider}.sh`);
     copyFileSync2(adapter, staged);
     const childEnv = { ...env2, ...values, TICKET_PROVIDER: provider };
     if (provider === "plane" && action.workspace) childEnv.PLANE_WORKSPACE = action.workspace;
-    const result2 = spawnSync2("sh", [staged, "create_board", action.boardName, action.identifier, action.description], {
+    const result2 = spawnSync3("sh", [staged, "create_board", action.boardName, action.identifier, action.description], {
       cwd: existsSync6(action.repoPath) ? action.repoPath : staging,
       encoding: "utf8",
       env: childEnv
@@ -1447,16 +1530,26 @@ function provisionTicketProviderBoard(action, env2 = process.env) {
         error: `ticket-provider: ${provider} create_board returned no board_id`
       };
     }
-    const boardUrl = isRecord(parsed) && typeof parsed.board_url === "string" ? parsed.board_url : void 0;
+    const identifier = isRecord(parsed) && typeof parsed.identifier === "string" ? parsed.identifier.trim() : "";
+    if (!identifier) {
+      return {
+        ok: false,
+        skipped: false,
+        logs: [],
+        error: `ticket-provider: ${provider} create_board returned no identifier. The adapter must echo the identifier the provider assigned; pjangler no longer invents one.`
+      };
+    }
+    const boardUrl2 = isRecord(parsed) && typeof parsed.board_url === "string" ? parsed.board_url : void 0;
     return {
       ok: true,
       skipped: false,
       boardId,
-      boardUrl,
-      logs: [`ticket-provider: ${provider} board linked (${action.identifier} \u2192 ${boardId})`]
+      identifier,
+      boardUrl: boardUrl2,
+      logs: [`ticket-provider: ${provider} board linked (${identifier} \u2192 ${boardId})`]
     };
   } finally {
-    rmSync2(staging, { recursive: true, force: true });
+    rmSync3(staging, { recursive: true, force: true });
   }
 }
 function defaultProjectAutomation() {
@@ -1485,12 +1578,12 @@ function prospectiveRealPath(path) {
   let cursor = resolve5(path);
   const suffix = [];
   while (!existsSync6(cursor)) {
-    const parent = dirname5(cursor);
+    const parent = dirname6(cursor);
     if (parent === cursor) return resolve5(path);
-    suffix.unshift(basename5(cursor));
+    suffix.unshift(basename6(cursor));
     cursor = parent;
   }
-  return resolve5(realpathSync3(cursor), ...suffix);
+  return resolve5(realpathSync4(cursor), ...suffix);
 }
 function resolveContainedPath(parentDir, candidate, label) {
   const physicalParent = prospectiveRealPath(parentDir);
@@ -1501,7 +1594,7 @@ function resolveContainedPath(parentDir, candidate, label) {
   }
   return resolve5(candidate);
 }
-function deriveProjectIdentifier(value) {
+function proposeProjectIdentifier(value) {
   const compact = value.replace(/[^A-Za-z0-9]/g, "").toUpperCase();
   const identifier = compact.slice(0, 4) || "PROJ";
   return identifier.length >= 2 ? identifier : `${identifier}XX`.slice(0, 4);
@@ -1514,7 +1607,7 @@ function resolveAgentHooksLayer2(input, env2 = process.env) {
   const override = env2.PJ_AGENT_HOOKS_LAYER;
   if (override === "0" || override === "false") return false;
   if (override === "1" || override === "true") return true;
-  return !existsSync6(join8(homedir4(), ".agents", "hooks"));
+  return !existsSync6(join9(homedir4(), ".agents", "hooks"));
 }
 function jsonStable(value) {
   return JSON.stringify(value);
@@ -1528,7 +1621,7 @@ function projectRecordEquivalent(a, b) {
 function defaultProjectTargetDir(name, cwd = process.cwd()) {
   const compactName = name.replace(/[^A-Za-z0-9._-]/g, "");
   const safeName = SAFE_PATH_SEGMENT.test(compactName) ? compactName : slugifyProjectName(name);
-  return resolve5(dirname5(resolve5(cwd)), validateSafePathSegment(safeName, "Generated project directory"));
+  return resolve5(dirname6(resolve5(cwd)), validateSafePathSegment(safeName, "Generated project directory"));
 }
 function sourceSkillRoots(env2 = process.env) {
   const configuredRoots = (env2[PROJECT_SOURCE_SKILL_ROOTS_ENV] || "").split(delimiter2).map((root) => root.trim()).filter(Boolean);
@@ -1547,10 +1640,10 @@ function resolveSourceSkillPath(sourceSkill, env2 = process.env) {
   const expanded = expandHome(sourceSkill);
   const direct = resolve5(expanded);
   if (existsSync6(direct)) return direct;
-  const name = basename5(sourceSkill);
+  const name = basename6(sourceSkill);
   const roots = sourceSkillRoots(env2);
   for (const root of roots) {
-    const candidate = join8(root, name);
+    const candidate = join9(root, name);
     if (existsSync6(candidate)) return candidate;
   }
   const searched = roots.length ? ` Searched roots: ${roots.join(", ")}.` : "";
@@ -1565,8 +1658,14 @@ function planProjectInit(input) {
   const registry = loadProjectRegistry(registryPath2);
   const now = (input.now ?? /* @__PURE__ */ new Date()).toISOString();
   const targetDir = resolve5(input.targetDir ?? defaultProjectTargetDir(input.name, input.cwd));
-  const identifier = (input.projectIdentifier ?? deriveProjectIdentifier(input.name)).toUpperCase();
+  const identifier = (input.projectIdentifier ?? proposeProjectIdentifier(input.name)).toUpperCase();
   const existing = getOwnRecordValue(registry.projects, slug);
+  const resolvedBoardId = input.boardId ?? input.planeProjectId ?? (existing?.ticket_provider?.board_id || void 0);
+  const inheritedProvenance = existing?.ticket_provider?.identifier_source === "provider" && existing.ticket_provider.identifier?.toUpperCase() === identifier && (existing.ticket_provider.board_id || void 0) === resolvedBoardId ? {
+    identifierSource: "provider",
+    ...existing.ticket_provider.identifier_fetched_at ? { identifierFetchedAt: existing.ticket_provider.identifier_fetched_at } : {}
+  } : void 0;
+  const inheritedBoardConfirmation = resolvedBoardId && (existing?.ticket_provider?.board_id || void 0) === resolvedBoardId && existing?.ticket_provider?.board_confirmed_at ? { boardConfirmedAt: existing.ticket_provider.board_confirmed_at } : void 0;
   const sourceSkillPath = resolveSourceSkillPath(input.sourceSkill);
   const overwrite = input.overwrite ?? input.force ?? false;
   const agents = createSafeRecord(Object.entries(existing?.agents ?? {}));
@@ -1601,11 +1700,13 @@ function planProjectInit(input) {
     ticket_provider: buildTicketProviderBlock({
       type: input.ticketProvider ?? "plane",
       identifier,
-      // A board provisioned by an earlier run lives in the registry, not in the
-      // CLI flags — inherit it so re-running init re-links instead of minting a
-      // second board.
-      boardId: input.boardId ?? input.planeProjectId ?? (existing?.ticket_provider?.board_id || void 0),
-      workspace: input.boardWorkspace ?? input.planeWorkspace
+      boardId: resolvedBoardId,
+      workspace: input.boardWorkspace ?? input.planeWorkspace,
+      // Provenance survives a re-plan. Without this, re-running init on an
+      // already-confirmed board would demote it back to "planned" because the
+      // CLI has no way to re-derive where the identifier came from.
+      ...inheritedProvenance ?? {},
+      ...inheritedBoardConfirmation ?? {}
     }),
     agents,
     automation: existing?.automation ?? defaultProjectAutomation(),
@@ -1622,14 +1723,13 @@ function planProjectInit(input) {
   const manifest = projectManifestFromRegistryProject(project);
   const apply = input.apply ?? false;
   const live = input.live ?? false;
-  const provisionRuntimeRepo = input.provisionRuntimeRepo ?? live;
-  const provisionTicketBoard = input.provisionTicketBoard ?? live;
+  const provisionTicketBoard = input.provisionTicketBoard ?? true;
   const enableSystemd = input.enableSystemd ?? live;
   const skipPlane = input.skipPlane ?? false;
-  const boardEnabled = live && provisionTicketBoard && !skipPlane;
-  const runtimeRepoEnabled = live && provisionRuntimeRepo;
+  const boardEnabled = provisionTicketBoard && !skipPlane;
   const systemdEnabled = live && enableSystemd && process.platform !== "darwin";
-  const anyExternalAgentEffect = runtimeRepoEnabled || boardEnabled || systemdEnabled;
+  const agentBoardEffect = live && boardEnabled;
+  const anyExternalAgentEffect = agentBoardEffect || systemdEnabled;
   const actions = [
     { kind: "registry.upsert", registryPath: registryPath2, slug, project }
   ];
@@ -1652,7 +1752,7 @@ function planProjectInit(input) {
     }));
   }
   actions.push(
-    { kind: "project.write-manifest", path: join8(targetDir, ".project.json"), manifest },
+    { kind: "project.write-manifest", path: join9(targetDir, ".project.json"), manifest },
     {
       kind: "ticket-provider.create-or-link",
       enabled: boardEnabled,
@@ -1665,7 +1765,7 @@ function planProjectInit(input) {
       description: project.description || `Ticket board for ${project.slug}`,
       boardId: project.ticket_provider.board_id ?? "",
       state: project.ticket_provider.board_id ? "linked" : "planned",
-      reason: skipPlane ? "ticket-provider action disabled by skipPlane=true" : project.ticket_provider.board_id ? "board already linked; no provider call" : !live ? "network/cloud actions require --live" : !provisionTicketBoard ? "ticket-provider action requires explicit provisionTicketBoard=true" : `create or link the ${project.ticket_provider.type} board "${project.name}" (${identifier}) via the ticket-provider adapter`
+      reason: skipPlane ? "ticket-provider action disabled by skipPlane=true (--skip-board)" : project.ticket_provider.board_id ? "board already linked; no provider call" : !provisionTicketBoard ? "ticket-provider action requires explicit provisionTicketBoard=true" : `create or link the ${project.ticket_provider.type} board "${project.name}" (${identifier}) via the ticket-provider adapter`
     },
     {
       kind: "hermes.provision-agent",
@@ -1675,8 +1775,7 @@ function planProjectInit(input) {
       targetRepo: slug,
       role: agentRole,
       context: {
-        skipRuntimeRepo: !runtimeRepoEnabled,
-        skipPlane: !boardEnabled,
+        skipPlane: !agentBoardEffect,
         // Per-agent Bloodbank consumers are retired. Agent ingress always
         // stays on the fleet-shared gateway, regardless of live/local mode.
         skipBloodbank: true,
@@ -1696,30 +1795,39 @@ function planProjectInit(input) {
     ...input.boardUrl !== void 0 ? { warnings: [BOARD_URL_DEPRECATION_WARNING] } : {}
   };
 }
-function linkTicketProviderBoard(plan, action, boardId) {
+function linkTicketProviderBoard(plan, action, boardId, identifier, now = /* @__PURE__ */ new Date()) {
   const block = buildTicketProviderBlock({
     type: action.provider,
-    identifier: action.identifier,
+    // The PROVIDER's identifier, not the one we proposed on the way in.
+    identifier,
+    identifierSource: "provider",
+    identifierFetchedAt: now.toISOString(),
     boardId,
     workspace: action.workspace
   });
+  action.identifier = identifier;
   plan.project.ticket_provider = block;
   const manifestProvider = {
     type: block.type,
     workspace: block.workspace ?? "",
     identifier: block.identifier ?? "",
+    identifier_source: block.identifier_source ?? "proposed",
+    ...block.identifier_fetched_at ? { identifier_fetched_at: block.identifier_fetched_at } : {},
     board_id: block.board_id ?? "",
+    // The provider just handed this board back, and the manifest is where that
+    // confirmation lives for every later reader of the repo.
+    ...block.board_confirmed_at ? { board_confirmed_at: block.board_confirmed_at } : {},
     state: block.state ?? "linked"
   };
   plan.manifest.ticket_provider = manifestProvider;
   action.boardId = boardId;
   action.state = manifestProvider.state;
-  const manifestPath = join8(action.repoPath, ".project.json");
+  const manifestPath = join9(action.repoPath, ".project.json");
   let next;
   if (existsSync6(manifestPath)) {
     let existing = {};
     try {
-      const parsed = JSON.parse(readFileSync6(manifestPath, "utf8"));
+      const parsed = JSON.parse(readFileSync8(manifestPath, "utf8"));
       if (isRecord(parsed)) existing = parsed;
     } catch {
       existing = {};
@@ -1727,12 +1835,12 @@ function linkTicketProviderBoard(plan, action, boardId) {
     const existingProvider = isRecord(existing.ticket_provider) ? existing.ticket_provider : {};
     next = { ...existing, ticket_provider: { ...existingProvider, ...manifestProvider } };
   } else {
-    mkdirSync4(dirname5(manifestPath), { recursive: true });
+    mkdirSync4(dirname6(manifestPath), { recursive: true });
     next = plan.manifest;
   }
   const text2 = `${JSON.stringify(next, null, 2)}
 `;
-  if (!existsSync6(manifestPath) || readFileSync6(manifestPath, "utf8") !== text2) {
+  if (!existsSync6(manifestPath) || readFileSync8(manifestPath, "utf8") !== text2) {
     writeFileSync4(manifestPath, text2, "utf8");
     return [manifestPath];
   }
@@ -1761,7 +1869,7 @@ async function executeProjectInitPlan(plan, options = {}) {
       logs.push(
         action.data.agent_hooks_layer === "false" ? "commonproject: agent-hooks layer skipped (global ~/.agents/hooks detected \u2014 no per-user CLI injection)" : "commonproject: agent-hooks layer included"
       );
-      mkdirSync4(dirname5(action.targetDir), { recursive: true });
+      mkdirSync4(dirname6(action.targetDir), { recursive: true });
       const before = snapshotTree(action.targetDir);
       const copierExecutable = options.trustedCopier?.executable ?? action.command[0];
       const copierEnv = options.trustedCopier ? { ...process.env } : void 0;
@@ -1771,7 +1879,7 @@ async function executeProjectInitPlan(plan, options = {}) {
         copierEnv.PYTHONNOUSERSITE = "1";
         copierEnv.PYTHONSAFEPATH = "1";
       }
-      const result2 = spawnSync2(copierExecutable, action.command.slice(1), {
+      const result2 = spawnSync3(copierExecutable, action.command.slice(1), {
         encoding: "utf8",
         cwd: action.cwd,
         ...copierEnv ? { env: copierEnv } : {}
@@ -1792,11 +1900,11 @@ async function executeProjectInitPlan(plan, options = {}) {
         break;
       }
     } else if (action.kind === "project.write-manifest") {
-      mkdirSync4(dirname5(action.path), { recursive: true });
+      mkdirSync4(dirname6(action.path), { recursive: true });
       let value = action.manifest;
       if (existsSync6(action.path)) {
         try {
-          const currentValue = JSON.parse(readFileSync6(action.path, "utf8"));
+          const currentValue = JSON.parse(readFileSync8(action.path, "utf8"));
           if (isRecord(currentValue)) {
             const currentNotebook = isRecord(currentValue.notebook) ? currentValue.notebook : {};
             const desiredNotebook = isRecord(value.notebook) ? value.notebook : {};
@@ -1820,7 +1928,7 @@ async function executeProjectInitPlan(plan, options = {}) {
       }
       const next = `${JSON.stringify(value, null, 2)}
 `;
-      const current = existsSync6(action.path) ? readFileSync6(action.path, "utf8") : void 0;
+      const current = existsSync6(action.path) ? readFileSync8(action.path, "utf8") : void 0;
       if (current !== next) {
         writeFileSync4(action.path, next, "utf8");
         changedFiles.push(action.path);
@@ -1838,8 +1946,8 @@ async function executeProjectInitPlan(plan, options = {}) {
         logs.push(...outcome.logs);
         if (!outcome.ok) {
           errors.push(outcome.error ?? `ticket-provider: ${action.provider} board provisioning failed`);
-        } else if (outcome.boardId) {
-          changedFiles.push(...linkTicketProviderBoard(plan, action, outcome.boardId));
+        } else if (outcome.boardId && outcome.identifier) {
+          changedFiles.push(...linkTicketProviderBoard(plan, action, outcome.boardId, outcome.identifier));
           pendingRegistryAction ??= {
             kind: "registry.upsert",
             registryPath: plan.registryPath,
@@ -1905,7 +2013,7 @@ function getProject(registry, slug) {
   return project;
 }
 function buildCommonProjectCopierAction(input) {
-  const templateDir = join8(input.pjanglerRoot, "templates", "commonproject");
+  const templateDir = join9(input.pjanglerRoot, "templates", "commonproject");
   const data = {
     project_name: input.projectName,
     project_description: input.projectDescription ?? "",
@@ -1932,10 +2040,10 @@ function buildCommonProjectCopierAction(input) {
   };
 }
 function resolvePjanglerRoot() {
-  let dir = dirname5(fileURLToPath2(import.meta.url));
-  while (dir !== dirname5(dir)) {
-    if (existsSync6(join8(dir, "package.json")) && existsSync6(join8(dir, "templates", "commonproject", "copier.yml"))) return dir;
-    dir = dirname5(dir);
+  let dir = dirname6(fileURLToPath3(import.meta.url));
+  while (dir !== dirname6(dir)) {
+    if (existsSync6(join9(dir, "package.json")) && existsSync6(join9(dir, "templates", "commonproject", "copier.yml"))) return dir;
+    dir = dirname6(dir);
   }
   return resolve5(process.cwd());
 }
@@ -1949,6 +2057,10 @@ function validateNoDuplicateProject(registry, project, overwrite) {
     if (resolve5(existing.repo_path) === resolve5(project.repo_path)) {
       throw new Error(`Project repo_path already registered by ${slug}: ${project.repo_path}`);
     }
+    if (ticketProviderScope(existing.ticket_provider) !== ticketProviderScope(project.ticket_provider)) continue;
+    if (existing.ticket_provider.board_id?.trim() && existing.ticket_provider.board_id === project.ticket_provider.board_id) {
+      throw new Error(`Project board_id already registered by ${slug}: ${project.ticket_provider.board_id}`);
+    }
     if (existing.ticket_provider.identifier && existing.ticket_provider.identifier.toUpperCase() === project.ticket_provider.identifier?.toUpperCase()) {
       throw new Error(`Project identifier already registered by ${slug}: ${project.ticket_provider.identifier}`);
     }
@@ -1964,6 +2076,28 @@ function validateProjectRecord(project, key) {
   if (!project.repo_path) throw new Error(`Project ${key} missing repo_path`);
   if (!Array.isArray(project.source_artifacts)) throw new Error(`Project ${key} source_artifacts must be a list`);
   if (!isRecord(project.ticket_provider)) throw new Error(`Project ${key} ticket_provider must be a mapping`);
+  const provider = project.ticket_provider;
+  if (provider.state !== void 0 && !TICKET_PROVIDER_STATES.includes(provider.state)) {
+    throw new Error(`Project ${key} ticket_provider.state must be one of ${TICKET_PROVIDER_STATES.join(" | ")}; got ${JSON.stringify(provider.state)}`);
+  }
+  if (provider.identifier_source !== void 0 && !PROJECT_IDENTIFIER_SOURCES.includes(provider.identifier_source)) {
+    throw new Error(`Project ${key} ticket_provider.identifier_source must be one of ${PROJECT_IDENTIFIER_SOURCES.join(" | ")}; got ${JSON.stringify(provider.identifier_source)}`);
+  }
+  if (provider.state === "linked" && !(provider.board_id && provider.board_confirmed_at)) {
+    throw new Error(
+      `Project ${key} ticket_provider.state is "linked" but its board binding is not provider-confirmed (board_id=${JSON.stringify(provider.board_id ?? "")}, board_confirmed_at=${JSON.stringify(provider.board_confirmed_at ?? "")}). Run \`${IDENTIFIER_REPAIR_COMMAND}\`.`
+    );
+  }
+  if (provider.identifier_source === "provider" && !(provider.identifier && provider.identifier_fetched_at)) {
+    throw new Error(
+      `Project ${key} ticket_provider.identifier_source is "provider" but no identifier was read back (identifier=${JSON.stringify(provider.identifier ?? "")}, identifier_fetched_at=${JSON.stringify(provider.identifier_fetched_at ?? "")}). Run \`${IDENTIFIER_REPAIR_COMMAND}\`.`
+    );
+  }
+  if (provider.state === "linked" && providerAssignsIdentifiers(provider.type) && provider.identifier_source !== "provider") {
+    throw new Error(
+      `Project ${key} ticket_provider.state is "linked" on ${provider.type}, which assigns its own identifiers, but identifier_source=${JSON.stringify(provider.identifier_source ?? "")} (identifier=${JSON.stringify(provider.identifier ?? "")}). Run \`${IDENTIFIER_REPAIR_COMMAND}\`.`
+    );
+  }
   if (!isRecord(project.agents)) throw new Error(`Project ${key} agents must be a mapping`);
   if (project.notebook !== void 0) {
     if (!isRecord(project.notebook)) throw new Error(`Project ${key} notebook must be a mapping`);
@@ -1985,13 +2119,13 @@ function validateProjectRecord(project, key) {
 }
 function expandHome(path) {
   if (path === "~") return homedir4();
-  if (path.startsWith("~/")) return join8(homedir4(), path.slice(2));
+  if (path.startsWith("~/")) return join9(homedir4(), path.slice(2));
   return path;
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-var PROJECT_REGISTRY_ENV, PROJECT_SOURCE_SKILL_ROOTS_ENV, TICKET_PROVIDER_ADAPTERS_ENV, PROJECT_REGISTRY_SCHEMA_VERSION, DEFAULT_NEW_PROJECT_STATUS, BOARD_URL_DEPRECATION_WARNING, DEFAULT_SOURCE_SKILL_ROOTS, PROJECT_REGISTRY_OWNED_KEYS, PROJECT_NOTEBOOK_OWNED_KEYS, TICKET_PROVIDER_OWNED_KEYS, GLOBAL_NOTEBOOK_OWNED_KEYS, GLOBAL_NOTEBOOK_AUTH_OWNED_KEYS, GLOBAL_NOTEBOOK_DEFAULTS_OWNED_KEYS, GLOBAL_NOTEBOOK_LIMITS_OWNED_KEYS, GLOBAL_NOTEBOOK_SUMMARIZER_OWNED_KEYS, SAFE_PATH_SEGMENT;
+var PROJECT_REGISTRY_ENV, PROJECT_SOURCE_SKILL_ROOTS_ENV, TICKET_PROVIDER_ADAPTERS_ENV, PROJECT_REGISTRY_SCHEMA_VERSION, DEFAULT_NEW_PROJECT_STATUS, BOARD_URL_DEPRECATION_WARNING, PROJECT_IDENTIFIER_SOURCES, IDENTIFIER_ASSIGNING_PROVIDERS, TICKET_PROVIDER_STATES, IDENTIFIER_REPAIR_COMMAND, DEFAULT_SOURCE_SKILL_ROOTS, PROJECT_REGISTRY_OWNED_KEYS, PROJECT_NOTEBOOK_OWNED_KEYS, TICKET_PROVIDER_OWNED_KEYS, GLOBAL_NOTEBOOK_OWNED_KEYS, GLOBAL_NOTEBOOK_AUTH_OWNED_KEYS, GLOBAL_NOTEBOOK_DEFAULTS_OWNED_KEYS, GLOBAL_NOTEBOOK_LIMITS_OWNED_KEYS, GLOBAL_NOTEBOOK_SUMMARIZER_OWNED_KEYS, SAFE_PATH_SEGMENT;
 var init_project = __esm({
   "src/project/index.ts"() {
     "use strict";
@@ -2000,16 +2134,21 @@ var init_project = __esm({
     init_tree_diff();
     init_preflight();
     init_RegistryStore();
+    init_boardQuery();
     PROJECT_REGISTRY_ENV = "PJ_PROJECT_REGISTRY";
     PROJECT_SOURCE_SKILL_ROOTS_ENV = "PJ_SOURCE_SKILL_ROOTS";
     TICKET_PROVIDER_ADAPTERS_ENV = "PJ_TICKET_PROVIDER_ADAPTERS";
     PROJECT_REGISTRY_SCHEMA_VERSION = 1;
     DEFAULT_NEW_PROJECT_STATUS = "active";
     BOARD_URL_DEPRECATION_WARNING = "boardUrl is deprecated and ignored; board URLs are derived at runtime and are never persisted.";
+    PROJECT_IDENTIFIER_SOURCES = ["provider", "proposed"];
+    IDENTIFIER_ASSIGNING_PROVIDERS = ["plane", "linear"];
+    TICKET_PROVIDER_STATES = ["planned", "linked", "skipped"];
+    IDENTIFIER_REPAIR_COMMAND = "pj project identity --all --apply";
     DEFAULT_SOURCE_SKILL_ROOTS = [
       "/home/delorenj/code/skillex/all-skills",
-      join8(homedir4(), ".agents", "skills"),
-      join8(homedir4(), ".codex", "skills")
+      join9(homedir4(), ".agents", "skills"),
+      join9(homedir4(), ".codex", "skills")
     ];
     PROJECT_REGISTRY_OWNED_KEYS = [
       "name",
@@ -2027,7 +2166,7 @@ var init_project = __esm({
       "updated_at"
     ];
     PROJECT_NOTEBOOK_OWNED_KEYS = ["state", "notebook_id", "notebook_name", "overview_note_id", "blocked_reason"];
-    TICKET_PROVIDER_OWNED_KEYS = ["type", "workspace", "identifier", "board_id", "board_url", "state"];
+    TICKET_PROVIDER_OWNED_KEYS = ["type", "workspace", "identifier", "identifier_source", "identifier_fetched_at", "board_id", "board_confirmed_at", "board_url", "state"];
     GLOBAL_NOTEBOOK_OWNED_KEYS = ["base_url", "auth", "defaults", "limits", "summarizer"];
     GLOBAL_NOTEBOOK_AUTH_OWNED_KEYS = ["mode", "env_var"];
     GLOBAL_NOTEBOOK_DEFAULTS_OWNED_KEYS = ["enabled", "session_start_enabled", "session_capture_enabled", "overview_max_chars", "documentation_globs", "overview_references", "excluded_globs"];
@@ -2040,21 +2179,21 @@ var init_project = __esm({
 // src/notebook/config.ts
 import { randomUUID } from "node:crypto";
 import { isIP as isIP2 } from "node:net";
-import { closeSync as closeSync3, existsSync as existsSync13, fchmodSync as fchmodSync2, fsyncSync as fsyncSync2, lstatSync as lstatSync6, openSync as openSync3, readFileSync as readFileSync10, realpathSync as realpathSync4, renameSync as renameSync3, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname7, resolve as resolve7 } from "node:path";
+import { closeSync as closeSync3, existsSync as existsSync14, fchmodSync as fchmodSync2, fsyncSync as fsyncSync2, lstatSync as lstatSync8, openSync as openSync3, readFileSync as readFileSync14, realpathSync as realpathSync5, renameSync as renameSync4, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname8, resolve as resolve7 } from "node:path";
 function isRecord2(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function realOrResolved(path) {
   const absolute = resolve7(path);
-  return existsSync13(absolute) ? realpathSync4(absolute) : absolute;
+  return existsSync14(absolute) ? realpathSync5(absolute) : absolute;
 }
 function readManifest(repoPath) {
   const path = resolve7(repoPath, ".project.json");
-  if (!existsSync13(path)) return null;
+  if (!existsSync14(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync10(path, "utf8"));
+    parsed = JSON.parse(readFileSync14(path, "utf8"));
   } catch {
     throw new NotebookError("INVALID_INPUT", `${path} is not valid JSON`);
   }
@@ -2279,7 +2418,7 @@ function requireRemoteNotebookConfig(config) {
 function persistProjectNotebookBinding(resolved, binding, policy) {
   const changed = [];
   const manifestPath = resolve7(resolved.project.repo_path, ".project.json");
-  const manifestRaw = existsSync13(manifestPath) ? JSON.parse(readFileSync10(manifestPath, "utf8")) : {};
+  const manifestRaw = existsSync14(manifestPath) ? JSON.parse(readFileSync14(manifestPath, "utf8")) : {};
   if (!isRecord2(manifestRaw)) throw new NotebookError("INVALID_INPUT", `${manifestPath} must contain a JSON object`);
   validateManifestNotebookSurface(manifestRaw.notebook);
   const manifestNotebook2 = isRecord2(manifestRaw.notebook) ? manifestRaw.notebook : {};
@@ -2296,14 +2435,14 @@ function persistProjectNotebookBinding(resolved, binding, policy) {
   };
   const manifestText = `${JSON.stringify(manifestNext, null, 2)}
 `;
-  if (!existsSync13(manifestPath) || readFileSync10(manifestPath, "utf8") !== manifestText) {
+  if (!existsSync14(manifestPath) || readFileSync14(manifestPath, "utf8") !== manifestText) {
     let mode = 420;
-    if (existsSync13(manifestPath)) {
-      const current2 = lstatSync6(manifestPath);
+    if (existsSync14(manifestPath)) {
+      const current2 = lstatSync8(manifestPath);
       if (!current2.isFile() || current2.isSymbolicLink()) throw new NotebookError("CONFLICT", `${manifestPath} must be a regular non-symlink file`);
       mode = current2.mode & 511;
     }
-    const temp = resolve7(dirname7(manifestPath), `.${process.pid}.${randomUUID()}.project.json.tmp`);
+    const temp = resolve7(dirname8(manifestPath), `.${process.pid}.${randomUUID()}.project.json.tmp`);
     const fd = openSync3(temp, "wx", mode);
     try {
       writeFileSync8(fd, manifestText, "utf8");
@@ -2312,9 +2451,9 @@ function persistProjectNotebookBinding(resolved, binding, policy) {
     } finally {
       closeSync3(fd);
     }
-    renameSync3(temp, manifestPath);
+    renameSync4(temp, manifestPath);
     try {
-      const directory = openSync3(dirname7(manifestPath), "r");
+      const directory = openSync3(dirname8(manifestPath), "r");
       try {
         fsyncSync2(directory);
       } finally {
@@ -2326,9 +2465,9 @@ function persistProjectNotebookBinding(resolved, binding, policy) {
   }
   const current = resolved.project.notebook;
   resolved.project.notebook = { ...isRecord2(current) ? current : { state: "planned" }, ...binding };
-  const registryBefore = existsSync13(resolved.registry_path) ? readFileSync10(resolved.registry_path, "utf8") : null;
+  const registryBefore = existsSync14(resolved.registry_path) ? readFileSync14(resolved.registry_path, "utf8") : null;
   saveProjectRegistry(resolved.registry, resolved.registry_path);
-  const registryAfter = existsSync13(resolved.registry_path) ? readFileSync10(resolved.registry_path, "utf8") : null;
+  const registryAfter = existsSync14(resolved.registry_path) ? readFileSync14(resolved.registry_path, "utf8") : null;
   if (registryBefore !== registryAfter) changed.push(resolved.registry_path);
   return changed;
 }
@@ -2474,26 +2613,26 @@ function truncateUtf8(value, maxBytes) {
   }
   return result2.join("");
 }
-function noteDetail(note2, maxBytes) {
-  const parsed = parseNoteEnvelope(note2.content);
+function noteDetail(note, maxBytes) {
+  const parsed = parseNoteEnvelope(note.content);
   return {
-    id: note2.id,
-    title: note2.title,
-    note_type: note2.note_type,
-    created_at: note2.created_at,
-    updated_at: note2.updated_at,
-    content: truncateUtf8(parsed?.body ?? note2.content, maxBytes)
+    id: note.id,
+    title: note.title,
+    note_type: note.note_type,
+    created_at: note.created_at,
+    updated_at: note.updated_at,
+    content: truncateUtf8(parsed?.body ?? note.content, maxBytes)
   };
 }
-function noteSummary(note2, excerptMaxChars) {
-  const body = parseNoteEnvelope(note2.content)?.body ?? note2.content;
+function noteSummary(note, excerptMaxChars) {
+  const body = parseNoteEnvelope(note.content)?.body ?? note.content;
   const excerpt = Array.from(body.replace(/\s+/gu, " ").trim()).slice(0, excerptMaxChars).join("");
   return {
-    id: note2.id,
-    title: note2.title,
-    note_type: note2.note_type,
-    created_at: note2.created_at,
-    updated_at: note2.updated_at,
+    id: note.id,
+    title: note.title,
+    note_type: note.note_type,
+    created_at: note.created_at,
+    updated_at: note.updated_at,
     excerpt
   };
 }
@@ -2510,13 +2649,13 @@ function searchNotesLocally(notes, query, limit, excerptMaxChars) {
   const queryTokens = tokenizeSearch(query);
   if (!queryTokens.length) throw new NotebookError("INVALID_INPUT", "Search query must contain at least one letter or number");
   if (!Number.isSafeInteger(limit) || limit < 1) throw new NotebookError("INVALID_INPUT", "Search limit must be a positive integer");
-  const scored = notes.flatMap((note2) => {
-    const body = parseNoteEnvelope(note2.content)?.body ?? note2.content;
-    const titleTokens = tokenizeSearch(note2.title);
+  const scored = notes.flatMap((note) => {
+    const body = parseNoteEnvelope(note.content)?.body ?? note.content;
+    const titleTokens = tokenizeSearch(note.title);
     const bodyTokens = tokenizeSearch(body);
     if (!queryTokens.every((token) => titleTokens.includes(token) || bodyTokens.includes(token))) return [];
     const score = queryTokens.reduce((sum, token) => sum + 10 * countTokens(titleTokens, token) + countTokens(bodyTokens, token), 0);
-    return [{ note: note2, body, score }];
+    return [{ note, body, score }];
   });
   const timestamp2 = (value) => {
     const parsed = Date.parse(value ?? "");
@@ -2524,12 +2663,12 @@ function searchNotesLocally(notes, query, limit, excerptMaxChars) {
   };
   scored.sort((left, right) => right.score - left.score || timestamp2(right.note.updated_at) - timestamp2(left.note.updated_at) || left.note.id.localeCompare(right.note.id, "en"));
   return {
-    items: scored.slice(0, limit).map(({ note: note2, body }) => {
+    items: scored.slice(0, limit).map(({ note, body }) => {
       const normalizedBody = body.replace(/\s+/gu, " ").trim().normalize("NFKC");
       const lower = normalizedBody.toLocaleLowerCase("und");
       const starts = queryTokens.map((token) => lower.indexOf(token)).filter((index) => index >= 0);
       const start = starts.length ? Math.min(...starts) : 0;
-      return { ...noteSummary(note2, excerptMaxChars), excerpt: Array.from(normalizedBody.slice(start)).slice(0, excerptMaxChars).join("") };
+      return { ...noteSummary(note, excerptMaxChars), excerpt: Array.from(normalizedBody.slice(start)).slice(0, excerptMaxChars).join("") };
     }),
     next_cursor: null,
     query_tokens: queryTokens
@@ -2634,23 +2773,23 @@ import { createHash as createHash6, randomUUID as randomUUID3 } from "node:crypt
 import {
   closeSync as closeSync4,
   constants as constants3,
-  existsSync as existsSync14,
+  existsSync as existsSync15,
   fchmodSync as fchmodSync3,
   fstatSync as fstatSync2,
   fsyncSync as fsyncSync3,
-  lstatSync as lstatSync7,
+  lstatSync as lstatSync9,
   mkdirSync as mkdirSync6,
   openSync as openSync4,
   readSync,
-  readdirSync as readdirSync6,
-  renameSync as renameSync4,
-  unlinkSync as unlinkSync5,
+  readdirSync as readdirSync7,
+  renameSync as renameSync5,
+  unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync9
 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { basename as basename6, dirname as dirname8, join as join15, parse, relative as relative7, resolve as resolve8, sep as sep3 } from "node:path";
+import { basename as basename7, dirname as dirname9, join as join18, parse, relative as relative8, resolve as resolve8, sep as sep3 } from "node:path";
 function notebookStateRoot(env2 = process.env) {
-  const base = env2.XDG_STATE_HOME || join15(env2.HOME || homedir6(), ".local", "state");
+  const base = env2.XDG_STATE_HOME || join18(env2.HOME || homedir6(), ".local", "state");
   return resolve8(base, "pjangler", "notebook", NOTEBOOK_STATE_VERSION);
 }
 function assertDigest(value, label) {
@@ -2658,10 +2797,10 @@ function assertDigest(value, label) {
 }
 function projectStateDir(root, projectSlug) {
   if (!/^[a-z0-9][a-z0-9._-]{0,127}$/iu.test(projectSlug)) throw new NotebookError("INVALID_INPUT", "Invalid project slug for Notebook state");
-  return join15(resolve8(root), "projects", sha256Hex(`pjangler-project-state-v1\0${projectSlug}`));
+  return join18(resolve8(root), "projects", sha256Hex(`pjangler-project-state-v1\0${projectSlug}`));
 }
 function assertContained(root, candidate) {
-  const rel = relative7(resolve8(root), resolve8(candidate));
+  const rel = relative8(resolve8(root), resolve8(candidate));
   if (!rel || !rel.startsWith(`..${sep3}`) && rel !== ".." && !rel.startsWith(sep3)) return;
   throw new NotebookError("INTERNAL_ERROR", "Notebook state path escaped its root");
 }
@@ -2669,14 +2808,14 @@ function openPinnedDirectory(path, root, create) {
   const absolute = resolve8(path);
   const absoluteRoot = resolve8(root);
   assertContained(absoluteRoot, absolute);
-  if (!existsSync14("/proc/self/fd")) throw new NotebookError("INTERNAL_ERROR", "Descriptor-pinned Notebook state requires procfs");
+  if (!existsSync15("/proc/self/fd")) throw new NotebookError("INTERNAL_ERROR", "Descriptor-pinned Notebook state requires procfs");
   const parsed = parse(absolute);
   let fd = openSync4(parsed.root, DIRECTORY_OPEN_FLAGS);
   let cursor = parsed.root;
   try {
     for (const part of absolute.slice(parsed.root.length).split(sep3).filter(Boolean)) {
       const child = `/proc/self/fd/${fd}/${part}`;
-      cursor = join15(cursor, part);
+      cursor = join18(cursor, part);
       let childFd;
       try {
         childFd = openSync4(child, DIRECTORY_OPEN_FLAGS);
@@ -2693,7 +2832,7 @@ function openPinnedDirectory(path, root, create) {
       fd = childFd;
       const stat = fstatSync2(fd);
       if (!stat.isDirectory()) throw new NotebookError("INTERNAL_ERROR", "Notebook state path component is not a directory");
-      if (cursor === absoluteRoot || relative7(absoluteRoot, cursor).startsWith("..") === false) assertOwned(stat);
+      if (cursor === absoluteRoot || relative8(absoluteRoot, cursor).startsWith("..") === false) assertOwned(stat);
     }
     return fd;
   } catch (error) {
@@ -2705,7 +2844,7 @@ function openPinnedDirectory(path, root, create) {
   }
 }
 function pinnedLeaf(parentFd, path) {
-  return `/proc/self/fd/${parentFd}/${basename6(path)}`;
+  return `/proc/self/fd/${parentFd}/${basename7(path)}`;
 }
 function assertOwned(stat) {
   if (typeof process.getuid === "function" && stat.uid !== process.getuid()) {
@@ -2733,18 +2872,18 @@ function notebookStatePaths(root, projectSlug) {
   return {
     root: absoluteRoot,
     project,
-    baselines: join15(project, "baselines"),
-    claims: join15(project, "claims"),
-    receipts: join15(project, "receipts"),
-    refusals: join15(project, "refusals"),
-    journals: join15(project, "journals"),
-    locks: join15(project, "locks")
+    baselines: join18(project, "baselines"),
+    claims: join18(project, "claims"),
+    receipts: join18(project, "receipts"),
+    refusals: join18(project, "refusals"),
+    journals: join18(project, "journals"),
+    locks: join18(project, "locks")
   };
 }
 function ensureNotebookState(root, projectSlug) {
   const paths = notebookStatePaths(root, projectSlug);
   const { root: absoluteRoot, project } = paths;
-  for (const path of [absoluteRoot, join15(absoluteRoot, "projects"), project, paths.baselines, paths.claims, paths.receipts, paths.refusals, paths.journals, paths.locks]) {
+  for (const path of [absoluteRoot, join18(absoluteRoot, "projects"), project, paths.baselines, paths.claims, paths.receipts, paths.refusals, paths.journals, paths.locks]) {
     ensureDirectory(path, absoluteRoot);
   }
   return paths;
@@ -2766,7 +2905,7 @@ function fsyncDirectory2(path) {
 function readStateDirectory(path, root) {
   const fd = openPinnedDirectory(path, root, false);
   try {
-    return readdirSync6(`/proc/self/fd/${fd}`, { withFileTypes: true });
+    return readdirSync7(`/proc/self/fd/${fd}`, { withFileTypes: true });
   } finally {
     closeSync4(fd);
   }
@@ -2777,7 +2916,7 @@ function readNotebookStateDirectory(path, root) {
 }
 function unlinkStateFile(path, root, allowMissing = false) {
   assertContained(root, path);
-  const parentFd = openPinnedDirectory(dirname8(path), root, false);
+  const parentFd = openPinnedDirectory(dirname9(path), root, false);
   const target = pinnedLeaf(parentFd, path);
   let fileFd;
   try {
@@ -2792,7 +2931,7 @@ function unlinkStateFile(path, root, allowMissing = false) {
       throw new NotebookError("CONFLICT", "Refusing to remove a suspect Notebook state entry; run pj notebook audit --json");
     }
     assertOwned(stat);
-    unlinkSync5(target);
+    unlinkSync4(target);
     fsyncSync3(parentFd);
     return true;
   } finally {
@@ -2801,8 +2940,8 @@ function unlinkStateFile(path, root, allowMissing = false) {
   }
 }
 function renameStateFile(source, target, root) {
-  if (dirname8(source) !== dirname8(target)) throw new NotebookError("INTERNAL_ERROR", "Notebook state rename crossed directories");
-  const parentFd = openPinnedDirectory(dirname8(source), root, false);
+  if (dirname9(source) !== dirname9(target)) throw new NotebookError("INTERNAL_ERROR", "Notebook state rename crossed directories");
+  const parentFd = openPinnedDirectory(dirname9(source), root, false);
   const sourcePath = pinnedLeaf(parentFd, source);
   const targetPath = pinnedLeaf(parentFd, target);
   let sourceFd;
@@ -2812,12 +2951,12 @@ function renameStateFile(source, target, root) {
     if (!stat.isFile() || (stat.mode & 511) !== 384) throw new NotebookError("CONFLICT", "Notebook state rename source has an integrity finding");
     assertOwned(stat);
     try {
-      lstatSync7(targetPath);
+      lstatSync9(targetPath);
       throw new NotebookError("CONFLICT", "Notebook state rename target already exists");
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
-    renameSync4(sourcePath, targetPath);
+    renameSync5(sourcePath, targetPath);
     fsyncSync3(parentFd);
   } finally {
     if (sourceFd !== void 0) closeSync4(sourceFd);
@@ -2826,11 +2965,11 @@ function renameStateFile(source, target, root) {
 }
 function atomicWriteJson(path, value, root, afterParentPinned) {
   assertContained(root, path);
-  ensureDirectory(dirname8(path), root);
+  ensureDirectory(dirname9(path), root);
   const text2 = jsonLine(value);
-  const parentFd = openPinnedDirectory(dirname8(path), root, false);
+  const parentFd = openPinnedDirectory(dirname9(path), root, false);
   const target = pinnedLeaf(parentFd, path);
-  const tempName = `.${basename6(path)}.${process.pid}.${randomUUID3()}.tmp`;
+  const tempName = `.${basename7(path)}.${process.pid}.${randomUUID3()}.tmp`;
   const temp = `/proc/self/fd/${parentFd}/${tempName}`;
   let existingIdentity = null;
   try {
@@ -2857,18 +2996,18 @@ function atomicWriteJson(path, value, root, afterParentPinned) {
       closeSync4(fd);
     }
     try {
-      const current = lstatSync7(target);
+      const current = lstatSync9(target);
       if (!existingIdentity || !current.isFile() || current.isSymbolicLink() || current.dev !== existingIdentity.dev || current.ino !== existingIdentity.ino) {
         throw new NotebookError("CONFLICT", "Notebook state target changed during atomic update; preserving both entries for audit");
       }
     } catch (error) {
       if (error.code !== "ENOENT" || existingIdentity) throw error;
     }
-    renameSync4(temp, target);
+    renameSync5(temp, target);
     fsyncSync3(parentFd);
   } catch (error) {
     try {
-      unlinkSync5(temp);
+      unlinkSync4(temp);
     } catch {
     }
     throw error;
@@ -2879,7 +3018,7 @@ function atomicWriteJson(path, value, root, afterParentPinned) {
 }
 function exclusiveWrite(path, text2, root) {
   assertContained(root, path);
-  const parentFd = openPinnedDirectory(dirname8(path), root, false);
+  const parentFd = openPinnedDirectory(dirname9(path), root, false);
   const target = pinnedLeaf(parentFd, path);
   let fd;
   try {
@@ -3036,7 +3175,7 @@ function parseRefusal(value) {
 function safeReadJson(path, maxBytes) {
   let parentFd;
   try {
-    parentFd = openPinnedDirectory(dirname8(path), dirname8(path), false);
+    parentFd = openPinnedDirectory(dirname9(path), dirname9(path), false);
   } catch {
     return { reason: "non-regular", bytes: 0 };
   }
@@ -3082,7 +3221,7 @@ function safeEntryId(kind, name) {
   return `${kind}/${/^[a-zA-Z0-9._-]{1,160}$/u.test(name) ? name : sha256Hex(name).slice(0, 24)}`;
 }
 function readBaseline(path, maxBytes) {
-  if (!existsSync14(path)) return null;
+  if (!existsSync15(path)) return null;
   const read = safeReadJson(path, maxBytes);
   return read.value === void 0 ? null : parseBaseline(read.value);
 }
@@ -3092,10 +3231,10 @@ function baselineReceiptByteCeiling(limits) {
 function readSessionBaseline(root, projectSlug, sessionKey, limits) {
   assertDigest(sessionKey, "session key");
   const paths = ensureNotebookState(root, projectSlug);
-  return readBaseline(join15(paths.baselines, `${sessionKey}.json`), baselineReceiptByteCeiling(limits));
+  return readBaseline(join18(paths.baselines, `${sessionKey}.json`), baselineReceiptByteCeiling(limits));
 }
 function acquireLock(paths, maxWaitMs) {
-  const lock = join15(paths.locks, "admission.lock");
+  const lock = join18(paths.locks, "admission.lock");
   const deadline = Date.now() + Math.max(1, maxWaitMs);
   const token = randomUUID3();
   const record = () => ({
@@ -3125,7 +3264,7 @@ function acquireLock(paths, maxWaitMs) {
       throw new NotebookError("CONFLICT", "Notebook state lock has an integrity finding; preserve it and run pj notebook audit --json");
     }
     if (Date.now() >= expiresAt) {
-      const recovery = join15(paths.locks, `recovery-${heldToken}.lock`);
+      const recovery = join18(paths.locks, `recovery-${heldToken}.lock`);
       const recoveryRecord = jsonLine({ schema_version: NOTEBOOK_SCHEMA_VERSION, stale_token: heldToken, recovery_token: token, expires_at: new Date(Date.now() + 5e3).toISOString() });
       if (exclusiveWrite(recovery, recoveryRecord, paths.root)) {
         try {
@@ -3133,7 +3272,7 @@ function acquireLock(paths, maxWaitMs) {
           const currentToken = verify.value && typeof verify.value === "object" && !Array.isArray(verify.value) ? verify.value.token : null;
           const currentExpiry = verify.value && typeof verify.value === "object" && !Array.isArray(verify.value) ? Date.parse(String(verify.value.expires_at ?? "")) : Number.NaN;
           if (currentToken === heldToken && Number.isFinite(currentExpiry) && Date.now() >= currentExpiry) {
-            const recovered = join15(paths.locks, `.recovered-${heldToken}-${randomUUID3()}.json`);
+            const recovered = join18(paths.locks, `.recovered-${heldToken}-${randomUUID3()}.json`);
             renameStateFile(lock, recovered, paths.root);
             unlinkStateFile(recovered, paths.root);
           }
@@ -3199,7 +3338,7 @@ function scanAuxiliaryState(paths, limits) {
     { kind: "refusals", dir: paths.refusals, suffix: ".json", maxBytes: limits.receipt_max_bytes, parse: parseRefusal, key: (value) => value.session_key }
   ];
   for (const specification of specifications) {
-    if (!existsSync14(specification.dir)) continue;
+    if (!existsSync15(specification.dir)) continue;
     let entries;
     try {
       entries = readStateDirectory(specification.dir, paths.root);
@@ -3213,7 +3352,7 @@ function scanAuxiliaryState(paths, limits) {
         addBoundedIntegrity(scan, limits, { entry_id: entryId, reason: "non-regular" });
         continue;
       }
-      const read = safeReadJson(join15(specification.dir, entry.name), specification.maxBytes);
+      const read = safeReadJson(join18(specification.dir, entry.name), specification.maxBytes);
       if (read.reason || read.value === void 0) {
         addBoundedIntegrity(scan, limits, { entry_id: entryId, reason: read.reason ?? "invalid-json" }, read.bytes);
         continue;
@@ -3224,7 +3363,7 @@ function scanAuxiliaryState(paths, limits) {
       if (!parsed || expectedName !== entry.name) addBoundedIntegrity(scan, limits, { entry_id: entryId, reason: "invalid-schema" }, read.bytes);
     }
   }
-  if (existsSync14(paths.journals)) {
+  if (existsSync15(paths.journals)) {
     let entries;
     try {
       entries = readStateDirectory(paths.journals, paths.root);
@@ -3238,7 +3377,7 @@ function scanAuxiliaryState(paths, limits) {
         addBoundedIntegrity(scan, limits, { entry_id: entryId, reason: "non-regular" });
         continue;
       }
-      const read = safeReadJson(join15(paths.journals, entry.name), limits.receipt_max_bytes);
+      const read = safeReadJson(join18(paths.journals, entry.name), limits.receipt_max_bytes);
       if (read.reason || read.value === void 0) {
         addBoundedIntegrity(scan, limits, { entry_id: entryId, reason: read.reason ?? "invalid-json" }, read.bytes);
         continue;
@@ -3253,7 +3392,7 @@ function scanAuxiliaryState(paths, limits) {
       if (reference.summary) scan.unresolvedJournals.push(reference.summary);
     }
   }
-  if (existsSync14(paths.locks)) {
+  if (existsSync15(paths.locks)) {
     let entries;
     try {
       entries = readStateDirectory(paths.locks, paths.root);
@@ -3267,7 +3406,7 @@ function scanAuxiliaryState(paths, limits) {
         addBoundedIntegrity(scan, limits, { entry_id: entryId, reason: "non-regular" });
         continue;
       }
-      const read = safeReadJson(join15(paths.locks, entry.name), 8192);
+      const read = safeReadJson(join18(paths.locks, entry.name), 8192);
       if (read.reason || read.value === void 0) {
         addBoundedIntegrity(scan, limits, { entry_id: entryId, reason: read.reason ?? "invalid-json" }, read.bytes);
         continue;
@@ -3296,7 +3435,7 @@ function scanReceipts(paths, limits) {
     unresolvedBytes += Math.max(0, knownBytes);
     if (integrity.length < limits.integrity_max_entries) integrity.push(entry);
   };
-  if (!existsSync14(paths.receipts)) return { receipts, unresolvedCount, unresolvedBytes, referencedSessions, integrity, integrityCount };
+  if (!existsSync15(paths.receipts)) return { receipts, unresolvedCount, unresolvedBytes, referencedSessions, integrity, integrityCount };
   let entries;
   try {
     entries = readStateDirectory(paths.receipts, paths.root);
@@ -3306,7 +3445,7 @@ function scanReceipts(paths, limits) {
   }
   for (const entry of entries) {
     const entryId = safeEntryId("receipts", entry.name);
-    const path = join15(paths.receipts, entry.name);
+    const path = join18(paths.receipts, entry.name);
     if (!entry.isFile() || entry.isSymbolicLink() || !/^[a-f0-9]{64}\.json$/u.test(entry.name)) {
       addIntegrity({ entry_id: entryId, reason: "non-regular" });
       continue;
@@ -3333,10 +3472,10 @@ function scanReceipts(paths, limits) {
 function scanBaselines(paths, nowMs, limits, referenced) {
   let current = 0;
   let stale = 0;
-  if (!existsSync14(paths.baselines)) return { current, stale };
+  if (!existsSync15(paths.baselines)) return { current, stale };
   for (const entry of readStateDirectory(paths.baselines, paths.root)) {
     if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-    const baseline = readBaseline(join15(paths.baselines, entry.name), baselineReceiptByteCeiling(limits));
+    const baseline = readBaseline(join18(paths.baselines, entry.name), baselineReceiptByteCeiling(limits));
     if (!baseline || referenced.has(baseline.session_key)) continue;
     const expires = Date.parse(baseline.created_at) + limits.receiptless_session_retention_seconds * 1e3;
     if (nowMs >= expires) stale += 1;
@@ -3346,11 +3485,11 @@ function scanBaselines(paths, nowMs, limits, referenced) {
 }
 function scanRefusals(paths, nowMs, limits, scan) {
   const result2 = [];
-  if (!existsSync14(paths.refusals)) return result2;
+  if (!existsSync15(paths.refusals)) return result2;
   const entries = readStateDirectory(paths.refusals, paths.root).sort((a, b) => a.name.localeCompare(b.name, "en")).slice(0, limits.refusal_max_entries);
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-    const read = safeReadJson(join15(paths.refusals, entry.name), limits.receipt_max_bytes);
+    const read = safeReadJson(join18(paths.refusals, entry.name), limits.receipt_max_bytes);
     const marker = read.value === void 0 ? null : parseRefusal(read.value);
     if (!marker || `${marker.session_key}.json` !== entry.name) continue;
     if (nowMs >= Date.parse(marker.baseline_created_at) + limits.receiptless_session_retention_seconds * 1e3) continue;
@@ -3433,8 +3572,8 @@ function listCaptureReceipts(root, projectSlug, limits, state) {
 function readCaptureReceipt(root, projectSlug, receiptId, limits) {
   if (!RECEIPT_ID_RE.test(receiptId)) throw new NotebookError("INVALID_INPUT", "Invalid receipt ID");
   const paths = notebookStatePaths(root, projectSlug);
-  const path = join15(paths.receipts, `${receiptId}.json`);
-  if (!existsSync14(path)) throw new NotebookError("NOT_FOUND", `Capture receipt not found: ${receiptId}`);
+  const path = join18(paths.receipts, `${receiptId}.json`);
+  if (!existsSync15(path)) throw new NotebookError("NOT_FOUND", `Capture receipt not found: ${receiptId}`);
   const read = safeReadJson(path, limits.receipt_max_bytes);
   const receipt = read.value === void 0 ? null : parseReceipt(read.value);
   if (!receipt || receipt.serialized_bytes !== read.bytes) throw new NotebookError("CONFLICT", `Capture receipt has an integrity finding: ${receiptId}`);
@@ -3446,7 +3585,7 @@ function writeReceipt(paths, receipt, limit) {
     const bytes = Buffer.byteLength(text2, "utf8");
     if (bytes > limit) throw new NotebookError("CONFLICT", "Receipt transition exceeds its per-receipt ceiling");
     if (receipt.serialized_bytes === bytes) {
-      atomicWriteJson(join15(paths.receipts, `${receipt.receipt_id}.json`), receipt, paths.root);
+      atomicWriteJson(join18(paths.receipts, `${receipt.receipt_id}.json`), receipt, paths.root);
       return receipt;
     }
     receipt.serialized_bytes = bytes;
@@ -3585,25 +3724,25 @@ function pruneNotebookState(root, projectSlug, limits, now = /* @__PURE__ */ new
     const successCutoff = now.getTime() - limits.receipt_succeeded_retention_days * 864e5;
     for (const receipt of scan.receipts) {
       if (receipt.state !== "succeeded" || Date.parse(receipt.updated_at) > successCutoff) continue;
-      const path = join15(paths.receipts, `${receipt.receipt_id}.json`);
+      const path = join18(paths.receipts, `${receipt.receipt_id}.json`);
       unlinkStateFile(path, paths.root);
-      removed.push(safeEntryId("receipts", basename6(path)));
+      removed.push(safeEntryId("receipts", basename7(path)));
     }
     const remaining = scanReceipts(paths, limits);
     const remainingAuxiliary = scanAuxiliaryState(paths, limits);
     const referenced = /* @__PURE__ */ new Set([...remaining.referencedSessions, ...remainingAuxiliary.referencedSessions]);
     for (const entry of readStateDirectory(paths.baselines, paths.root)) {
       if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-      const path = join15(paths.baselines, entry.name);
+      const path = join18(paths.baselines, entry.name);
       const baseline = readBaseline(path, baselineReceiptByteCeiling(limits));
       if (!baseline || referenced.has(baseline.session_key)) continue;
       if (now.getTime() < Date.parse(baseline.created_at) + limits.receiptless_session_retention_seconds * 1e3) continue;
       unlinkStateFile(path, paths.root);
       removed.push(safeEntryId("baselines", entry.name));
-      const claim = join15(paths.claims, `${baseline.session_key}.overview`);
-      if (unlinkStateFile(claim, paths.root, true)) removed.push(safeEntryId("claims", basename6(claim)));
-      const refusal = join15(paths.refusals, `${baseline.session_key}.json`);
-      if (unlinkStateFile(refusal, paths.root, true)) removed.push(safeEntryId("refusals", basename6(refusal)));
+      const claim = join18(paths.claims, `${baseline.session_key}.overview`);
+      if (unlinkStateFile(claim, paths.root, true)) removed.push(safeEntryId("claims", basename7(claim)));
+      const refusal = join18(paths.refusals, `${baseline.session_key}.json`);
+      if (unlinkStateFile(refusal, paths.root, true)) removed.push(safeEntryId("refusals", basename7(refusal)));
     }
     fsyncDirectory2(paths.project);
     return removed;
@@ -3703,9 +3842,9 @@ function parseScopedNoteListItem(value, noteMaxBytes) {
   return parseNoteRecord(value, noteMaxBytes, true);
 }
 function parseNote(value, noteMaxBytes) {
-  const note2 = parseNoteRecord(value, noteMaxBytes, false);
-  if (note2.content === null) throw new NotebookError("REMOTE_PROTOCOL_ERROR", "Open Notebook returned invalid note content");
-  return note2;
+  const note = parseNoteRecord(value, noteMaxBytes, false);
+  if (note.content === null) throw new NotebookError("REMOTE_PROTOCOL_ERROR", "Open Notebook returned invalid note content");
+  return note;
 }
 function errorForStatus(status, message) {
   if (status === 400 || status === 422) return new NotebookError("INVALID_INPUT", message, false, { http_status: status, definitive_rejection: true });
@@ -3831,9 +3970,9 @@ var init_open_notebook_client = __esm({
       }
       async getOwnedNote(notebookId, noteId) {
         const notes = await this.listNotes(notebookId);
-        const note2 = notes.find((item) => item.id === noteId);
-        if (!note2) throw new NotebookError("NOT_FOUND", `Note is not a proven member of the bound notebook: ${noteId}`);
-        return note2;
+        const note = notes.find((item) => item.id === noteId);
+        if (!note) throw new NotebookError("NOT_FOUND", `Note is not a proven member of the bound notebook: ${noteId}`);
+        return note;
       }
       async updateOwnedNote(notebookId, noteId, input) {
         if (input.content !== void 0 && Buffer.byteLength(input.content, "utf8") > this.config.limits.note_max_bytes) throw new NotebookError("INVALID_INPUT", "Note content exceeds the configured ceiling");
@@ -3917,8 +4056,8 @@ var init_open_notebook_client = __esm({
 
 // src/notebook/git-evidence.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { closeSync as closeSync5, constants as constants4, fstatSync as fstatSync3, lstatSync as lstatSync8, openSync as openSync5, readSync as readSync2, realpathSync as realpathSync5 } from "node:fs";
-import { extname, join as join17, relative as relative8, resolve as resolve9, sep as sep4 } from "node:path";
+import { closeSync as closeSync5, constants as constants4, fstatSync as fstatSync3, lstatSync as lstatSync10, openSync as openSync5, readSync as readSync2, realpathSync as realpathSync6 } from "node:fs";
+import { extname, join as join20, relative as relative9, resolve as resolve9, sep as sep4 } from "node:path";
 function git(repo, args, maxBuffer = 4 * 1024 * 1024, timeout = 5e3) {
   const result2 = spawnSync9("git", args, { cwd: repo, encoding: "utf8", maxBuffer, timeout, shell: false });
   return { ok: result2.status === 0, stdout: result2.stdout ?? "" };
@@ -3986,19 +4125,19 @@ function validateCommittedGitRef(repoPath, gitRef) {
 }
 function safeRelative(repoPath, relativePath2) {
   if (!relativePath2 || relativePath2.includes("\0") || relativePath2.startsWith("/") || relativePath2.split(/[\\/]/u).includes("..")) return null;
-  const root = realpathSync5(repoPath);
+  const root = realpathSync6(repoPath);
   const candidate = resolve9(root, relativePath2);
-  const rel = relative8(root, candidate);
+  const rel = relative9(root, candidate);
   if (rel === ".." || rel.startsWith(`..${sep4}`) || rel.startsWith(sep4)) return null;
   return { root, candidate };
 }
 function hasSymlinkComponent(root, candidate) {
-  const rel = relative8(root, candidate);
+  const rel = relative9(root, candidate);
   let cursor = root;
   for (const part of rel.split(sep4).filter(Boolean)) {
-    cursor = join17(cursor, part);
+    cursor = join20(cursor, part);
     try {
-      if (lstatSync8(cursor).isSymbolicLink()) return true;
+      if (lstatSync10(cursor).isSymbolicLink()) return true;
     } catch {
       return true;
     }
@@ -4020,11 +4159,11 @@ function readSafeEvidenceText(repoPath, relativePath2, maxBytes) {
     if (before.size > maxBytes) return { status: "excluded", reason: "oversize" };
     let physical;
     try {
-      physical = realpathSync5(`/proc/self/fd/${fd}`);
+      physical = realpathSync6(`/proc/self/fd/${fd}`);
     } catch {
       return { status: "excluded", reason: "unsafe-path" };
     }
-    const physicalRel = relative8(safe.root, physical);
+    const physicalRel = relative9(safe.root, physical);
     if (physicalRel === ".." || physicalRel.startsWith(`..${sep4}`) || physicalRel.startsWith(sep4)) return { status: "excluded", reason: "unsafe-path" };
     const chunks = [];
     let total = 0;
@@ -4139,10 +4278,10 @@ var init_git_evidence = __esm({
 
 // src/notebook/remote-mutation-journal.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { join as join18 } from "node:path";
+import { join as join21 } from "node:path";
 function journalPath(root, projectSlug, operationId) {
   if (!/^[a-f0-9-]{16,64}$/iu.test(operationId)) throw new NotebookError("INVALID_INPUT", "Invalid remote mutation operation ID");
-  return join18(ensureNotebookState(root, projectSlug).journals, `${operationId}.json`);
+  return join21(ensureNotebookState(root, projectSlug).journals, `${operationId}.json`);
 }
 function remoteMutationJournalPath(root, projectSlug, operationId) {
   return journalPath(root, projectSlug, operationId);
@@ -4162,7 +4301,7 @@ function listRemoteMutationJournals(root, projectSlug) {
     if (!entry.isFile() || entry.isSymbolicLink() || !/^[a-f0-9-]{16,64}\.json$/iu.test(entry.name)) {
       throw new NotebookError("CONFLICT", `Remote mutation journal state-integrity finding: journals/${entry.name}`);
     }
-    const read = readNotebookStateJson(join18(paths.journals, entry.name), paths.root, 65536);
+    const read = readNotebookStateJson(join21(paths.journals, entry.name), paths.root, 65536);
     const journal = read.value === void 0 ? null : parseRemoteMutationJournal(read.value);
     if (!journal || `${journal.operation_id}.json` !== entry.name) {
       throw new NotebookError("CONFLICT", `Remote mutation journal state-integrity finding: journals/${entry.name}`);
@@ -4452,7 +4591,7 @@ async function reconcileManagedNote(input) {
   const reconcile = async () => {
     input.beforeRemote?.();
     const notes = await input.client.listNotes(input.notebookId);
-    const candidates2 = notes.filter((note2) => parseNoteEnvelope(note2.content)?.envelope.logical_id === input.logicalId);
+    const candidates2 = notes.filter((note) => parseNoteEnvelope(note.content)?.envelope.logical_id === input.logicalId);
     journal = recordReconciliation({
       stateRoot: input.stateRoot,
       journal,
@@ -4798,10 +4937,10 @@ async function processClaimed(module, receipt, leaseUpdated) {
       content: documentContent,
       beforeRemote: renew
     });
-    const note2 = upserted.note;
+    const note = upserted.note;
     if (upserted.journal) journals.push(upserted.journal);
     logicalIds.push(logicalId);
-    remoteIds.push(note2.id);
+    remoteIds.push(note.id);
   }
   const summary = summarizeCapture(linked.config, {
     documents: evidence.documents,
@@ -4928,8 +5067,8 @@ var init_capture = __esm({
 });
 
 // src/mcp-server.ts
-import { existsSync as existsSync22, statSync as statSync5 } from "node:fs";
-import { basename as basename8, dirname as dirname14, join as join28, resolve as resolve16 } from "node:path";
+import { existsSync as existsSync23, statSync as statSync5 } from "node:fs";
+import { basename as basename9, dirname as dirname14, join as join30, resolve as resolve16 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -5324,21 +5463,21 @@ function selectPackVersion(packDir) {
 }
 function stripTomlComment(line) {
   let out = "";
-  let quote = null;
+  let quote2 = null;
   for (let index = 0; index < line.length; index += 1) {
     const ch = line[index];
-    if (quote) {
-      if (ch === "\\" && quote === '"') {
+    if (quote2) {
+      if (ch === "\\" && quote2 === '"') {
         out += ch + (line[index + 1] ?? "");
         index += 1;
         continue;
       }
-      if (ch === quote) quote = null;
+      if (ch === quote2) quote2 = null;
       out += ch;
       continue;
     }
     if (ch === '"' || ch === "'") {
-      quote = ch;
+      quote2 = ch;
       out += ch;
       continue;
     }
@@ -5349,15 +5488,15 @@ function stripTomlComment(line) {
 }
 function bracketDepth(text2) {
   let depth = 0;
-  let quote = null;
+  let quote2 = null;
   for (let index = 0; index < text2.length; index += 1) {
     const ch = text2[index];
-    if (quote) {
-      if (ch === "\\" && quote === '"') index += 1;
-      else if (ch === quote) quote = null;
+    if (quote2) {
+      if (ch === "\\" && quote2 === '"') index += 1;
+      else if (ch === quote2) quote2 = null;
       continue;
     }
-    if (ch === '"' || ch === "'") quote = ch;
+    if (ch === '"' || ch === "'") quote2 = ch;
     else if (ch === "[") depth += 1;
     else if (ch === "]") depth -= 1;
   }
@@ -6033,6 +6172,8 @@ function discoverRoles(repoRoot) {
       ticketProviderIdentifier: yamlGet(text2, "plane.identifier"),
       bloodbankEnabled: yamlGet(text2, "bloodbank.enabled"),
       deploymentSystemd: yamlGet(text2, "deployment.systemd"),
+      serviceStateGateway: yamlGet(text2, "service_state.gateway"),
+      serviceStateHeartbeat: yamlGet(text2, "service_state.heartbeat"),
       legacyReconcileEnabled: yamlGet(text2, "reconcile.enabled"),
       legacyReconcileGraceHours: yamlGet(text2, "reconcile.grace_hours"),
       legacyReconcileAutoReview: yamlGet(text2, "reconcile.auto_review"),
@@ -6920,13 +7061,8 @@ ${block}
 `;
 }
 var BASE_MISE_PATH_ENTRIES = [".mise/scripts", "agents/hermes/pm"];
-var CONDITIONAL_HERMES_PATHS = ["agents/hermes/pm/hermes", "agent/hermes/pm/hermes"];
-function requiredMisePathEntries(ctx) {
-  const required = [...BASE_MISE_PATH_ENTRIES];
-  for (const candidate of CONDITIONAL_HERMES_PATHS) {
-    if (existsSync2(join3(ctx.repoRoot, candidate)) && !required.includes(candidate)) required.push(candidate);
-  }
-  return required;
+function requiredMisePathEntries(_ctx) {
+  return [...BASE_MISE_PATH_ENTRIES];
 }
 function upsertMisePath(text2, required = BASE_MISE_PATH_ENTRIES) {
   const render = (values) => `_.path = [${values.map((value) => JSON.stringify(value)).join(", ")}]`;
@@ -7785,6 +7921,94 @@ function checkUnit(unit) {
   const active = systemctlUser(["is-active", unit]).ok;
   return { enabled: enabled2, active };
 }
+function persistRoleServiceState(role, updates) {
+  try {
+    const stat = lstatSync2(role.roleYamlPath);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+      return { changed: false, error: `refusing unsafe role manifest ${role.roleYamlPath}` };
+    }
+    const current = readFileSync2(role.roleYamlPath, "utf8");
+    const document = YAML.parseDocument(current);
+    if (document.errors.length) throw document.errors[0];
+    const serviceState = document.get("service_state", true);
+    if (serviceState !== void 0 && serviceState !== null && !YAML.isMap(serviceState)) {
+      return { changed: false, error: `${role.roleYamlPath} service_state must be a YAML mapping` };
+    }
+    for (const [leaf, value] of Object.entries(updates)) {
+      document.setIn(["service_state", leaf], value);
+    }
+    const next = String(document);
+    if (next === current) return { changed: false };
+    const transaction = mkdtempSync(join3(dirname2(role.roleYamlPath), ".pjangler-role-state-"));
+    try {
+      atomicWriteBuffer(
+        role.roleYamlPath,
+        Buffer.from(next),
+        Number(stat.mode) & 511,
+        join3(transaction, "role.yaml")
+      );
+    } finally {
+      rmSync(transaction, { recursive: true, force: true });
+    }
+    return { changed: true };
+  } catch (error) {
+    return { changed: false, error: error instanceof Error ? error.message : String(error) };
+  }
+}
+function reconcileHermesRoleUnits(ctx, role, changedFiles, details) {
+  const gatewayUnit = `hermes-${role.agentId}-gateway.service`;
+  const heartbeatUnit = `hermes-${role.agentId}-heartbeat.timer`;
+  const gatewayDeferred = role.serviceStateGateway === "deferred";
+  const stateUpdates = {};
+  if (role.serviceStateHeartbeat !== "active") stateUpdates.heartbeat = "active";
+  if (!gatewayDeferred && role.serviceStateGateway !== "active") stateUpdates.gateway = "active";
+  if (ctx.dryRun) {
+    details.push("would run: systemctl --user daemon-reload");
+    details.push(`would run: systemctl --user enable --now ${heartbeatUnit}`);
+    details.push(`would run: systemctl --user ${gatewayDeferred ? "disable" : "enable"} --now ${gatewayUnit}`);
+    if (Object.keys(stateUpdates).length) {
+      if (!changedFiles.includes(role.roleYamlPath)) changedFiles.push(role.roleYamlPath);
+      details.push(`would atomically record verified service_state in ${relative2(ctx.repoRoot, role.roleYamlPath)}`);
+    }
+    return true;
+  }
+  const reload = systemctlUser(["daemon-reload"]);
+  if (!reload.ok) {
+    details.push(`script failed: systemctl --user daemon-reload: ${reload.stderr || reload.stdout || "unknown error"}`);
+    return false;
+  }
+  const heartbeat = systemctlUser(["enable", "--now", heartbeatUnit]);
+  const gateway = systemctlUser([gatewayDeferred ? "disable" : "enable", "--now", gatewayUnit]);
+  if (!heartbeat.ok) {
+    details.push(`script failed: could not enable ${heartbeatUnit}: ${heartbeat.stderr || heartbeat.stdout || "unknown error"}`);
+  }
+  if (!gateway.ok) {
+    details.push(`script failed: could not ${gatewayDeferred ? "disable" : "enable"} ${gatewayUnit}: ${gateway.stderr || gateway.stdout || "unknown error"}`);
+  }
+  if (!heartbeat.ok || !gateway.ok) return false;
+  const heartbeatState = checkUnit(heartbeatUnit);
+  const gatewayState = checkUnit(gatewayUnit);
+  const heartbeatHealthy = heartbeatState.enabled && heartbeatState.active;
+  const gatewayHealthy = gatewayDeferred ? !gatewayState.enabled && !gatewayState.active : gatewayState.enabled && gatewayState.active;
+  if (!heartbeatHealthy) {
+    details.push(`script failed: ${heartbeatUnit} did not become enabled+active after systemctl reported success`);
+  }
+  if (!gatewayHealthy) {
+    details.push(`script failed: ${gatewayUnit} did not become ${gatewayDeferred ? "disabled+inactive" : "enabled+active"} after systemctl reported success`);
+  }
+  if (!heartbeatHealthy || !gatewayHealthy) return false;
+  const persisted = persistRoleServiceState(role, stateUpdates);
+  if (persisted.error) {
+    details.push(`script failed: could not update ${relative2(ctx.repoRoot, role.roleYamlPath)}: ${persisted.error}`);
+    return false;
+  }
+  if (persisted.changed) {
+    if (!changedFiles.includes(role.roleYamlPath)) changedFiles.push(role.roleYamlPath);
+    details.push(`atomically recorded verified service_state in ${relative2(ctx.repoRoot, role.roleYamlPath)}`);
+  }
+  details.push(`verified ${heartbeatUnit} enabled+active and ${gatewayUnit} ${gatewayDeferred ? "disabled+inactive" : "enabled+active"}`);
+  return true;
+}
 var BMAD_NPM_PACKAGE = "bmad-method";
 var BMAD_INSTALLER_VERSION = "6.11.1-next.1";
 var BMAD_TARGET_CHANNEL = "next";
@@ -9962,20 +10186,52 @@ function createHermesChecks() {
         }
         const probe = systemctlUser(["is-system-running"]);
         if (!probe.ok && !/running|degraded|starting|maintenance/.test(`${probe.stdout} ${probe.stderr}`)) {
-          return { id: "systemd.sentinel", title: "Hermes systemd/sentinel units enabled + active", status: "warn", summary: "systemd --user unavailable; unit state not auditable here", details: [], fixable: false };
+          const sysDir2 = join3(ctx.homeDir, ".config", "systemd", "user");
+          const details2 = [];
+          for (const role of requiredRoles) {
+            const gateway = role.serviceStateGateway || "active";
+            const heartbeat = role.serviceStateHeartbeat || "active";
+            for (const unit of [`hermes-${role.agentId}-gateway.service`, `hermes-${role.agentId}-heartbeat.timer`]) {
+              if (!existsSync2(join3(sysDir2, unit))) details2.push(`${unit} should be installed`);
+            }
+            if (heartbeat !== "installed") details2.push(`${role.agentId} heartbeat should record installed while systemd --user is unavailable (got ${heartbeat})`);
+            if (gateway !== "installed" && gateway !== "deferred") details2.push(`${role.agentId} gateway should record installed or deferred while systemd --user is unavailable (got ${gateway})`);
+          }
+          return {
+            id: "systemd.sentinel",
+            title: "Hermes systemd/sentinel units enabled + active",
+            status: details2.length ? "warn" : "pass",
+            summary: details2.length ? "systemd --user unavailable and installed-state metadata is incomplete" : "Hermes units are installed; activation is deferred because systemd --user is unavailable",
+            details: details2,
+            fixable: false
+          };
         }
         const details = [];
+        const sysDir = join3(ctx.homeDir, ".config", "systemd", "user");
         for (const role of requiredRoles) {
-          for (const unit of [`hermes-${role.agentId}-gateway.service`, `hermes-${role.agentId}-heartbeat.timer`]) {
-            const state = checkUnit(unit);
-            if (!state.enabled || !state.active) details.push(`${unit} should be enabled+active`);
+          const gatewayUnit = `hermes-${role.agentId}-gateway.service`;
+          const heartbeatUnit = `hermes-${role.agentId}-heartbeat.timer`;
+          const gatewayState = role.serviceStateGateway || "active";
+          const heartbeatState = role.serviceStateHeartbeat || "active";
+          for (const unit of [gatewayUnit, heartbeatUnit]) {
+            if (!existsSync2(join3(sysDir, unit))) details.push(`${unit} should be installed`);
+          }
+          const heartbeat = checkUnit(heartbeatUnit);
+          if (heartbeatState !== "active" || !heartbeat.enabled || !heartbeat.active) {
+            details.push(`${heartbeatUnit} should be enabled+active (manifest: ${heartbeatState || "missing"})`);
+          }
+          const gateway = checkUnit(gatewayUnit);
+          if (gatewayState === "deferred") {
+            if (gateway.enabled || gateway.active) details.push(`${gatewayUnit} is deferred and should be disabled+inactive`);
+          } else if (gatewayState !== "active" || !gateway.enabled || !gateway.active) {
+            details.push(`${gatewayUnit} should be enabled+active (manifest: ${gatewayState || "missing"})`);
           }
         }
         return {
           id: "systemd.sentinel",
           title: "Hermes systemd/sentinel units enabled + active",
           status: details.length === 0 ? "pass" : "fail",
-          summary: details.length === 0 ? "Hermes user units are enabled and active" : `${details.length} systemd parity issue(s) detected`,
+          summary: details.length === 0 ? "Hermes user units match each role's declared service state" : `${details.length} systemd parity issue(s) detected`,
           details,
           fixable: true
         };
@@ -10000,17 +10256,12 @@ function createHermesChecks() {
             if (text2 === null) return true;
             return text2.includes("/agents/hermes/") && !text2.includes(role.roleDir);
           });
-          if (allUnitsPresent && !unitsStale) {
-            if (ctx.dryRun) {
-              details.push(`would run: systemctl --user enable --now ${units.join(" ")}`);
-            } else {
-              systemctlUser(["daemon-reload"]);
-              for (const unit of units) {
-                systemctlUser(["enable", "--now", unit]);
-              }
-            }
+          const manifestNeedsReconcile = [role.serviceStateGateway, role.serviceStateHeartbeat].some((state) => state === "pending" || state === "error");
+          if (allUnitsPresent && !unitsStale && !manifestNeedsReconcile) {
+            reconcileHermesRoleUnits(ctx, role, changedFiles, details);
             continue;
           }
+          let regenerated = false;
           for (const script of [join3(role.roleDir, ".scripts", "70-systemd.sh")]) {
             if (!existsSync2(script)) {
               details.push(`script failed: missing ${script}`);
@@ -10027,16 +10278,26 @@ function createHermesChecks() {
               if (result2.status !== 0) {
                 details.push(`script failed: ${script}: ${result2.stderr.trim() || result2.stdout.trim()}`);
               } else {
+                regenerated = true;
                 details.push(`regenerated systemd units for ${role.agentId} from ${role.roleDir}`);
               }
             }
           }
+          if (ctx.dryRun) continue;
+          if (regenerated) {
+            const refreshed = discoverRoles(ctx.repoRoot).find((candidate) => candidate.agentId === role.agentId);
+            if (!refreshed) {
+              details.push(`script failed: regenerated role ${role.agentId} could not be rediscovered`);
+            } else {
+              reconcileHermesRoleUnits(ctx, refreshed, changedFiles, details);
+            }
+          }
         }
         return {
           id: finding2.id,
           title: finding2.title,
           status: details.some((detail) => detail.includes("failed:")) ? "blocked" : details.length ? ctx.dryRun ? "skipped" : "applied" : "noop",
-          summary: details.length ? ctx.dryRun ? "Planned systemd remediation commands" : "Attempted systemd remediation" : "No changes required",
+          summary: details.length ? ctx.dryRun ? "Planned systemd remediation commands" : "Reconciled and verified systemd service state" : "No changes required",
           changedFiles,
           details
         };
@@ -10863,8 +11124,21 @@ var DockerRecipe = class extends Recipe {
 
 // src/commands/hermes/EnsureTemplateConfig.ts
 import { homedir as homedir3, platform } from "node:os";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join4, dirname as dirname3 } from "node:path";
+import {
+  existsSync as existsSync3,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
+  realpathSync as realpathSync2,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync3
+} from "node:fs";
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { basename as basename3, join as join4, dirname as dirname3 } from "node:path";
+var HERMES_GIT_URL = "https://github.com/delorenj/hermes-agent.git";
+var HERMES_GIT_REF = "main";
+var HERMES_GIT_SHA = "0408fec7a153e6c32c064acd2b8053917f1525f1";
 function resolveTemplateConfigPath() {
   const fromEnv = process.env.HERMES_TEMPLATE_CONFIG;
   if (fromEnv && fromEnv.trim()) return fromEnv.trim();
@@ -10872,69 +11146,395 @@ function resolveTemplateConfigPath() {
   const base = xdg && xdg.length ? xdg : join4(homedir3(), ".config");
   return join4(base, "hermes-agent-template", "config.toml");
 }
-function detectHermesBin(home) {
+function quote(value) {
+  return JSON.stringify(value);
+}
+function detectHermesInstall(home) {
+  const releaseRoot = join4(home, ".local", "share", "hermes-agent", "releases", HERMES_GIT_SHA);
+  const devRoot = join4(home, "code", "hermes-agent");
   const candidates = [
-    join4(home, "code", "hermes-agent", "venv", "bin", "hermes"),
-    join4(home, "code", "hermes-agent", ".venv", "bin", "hermes"),
-    join4(home, ".local", "bin", "hermes")
+    join4(releaseRoot, ".venv", "bin", "hermes"),
+    join4(home, ".local", "bin", "hermes"),
+    join4(devRoot, "venv", "bin", "hermes"),
+    join4(devRoot, ".venv", "bin", "hermes")
   ];
-  for (const c of candidates) {
-    if (existsSync3(c)) return c;
+  const bin = candidates.find((candidate) => existsSync3(candidate)) ?? candidates[0];
+  try {
+    const resolved = realpathSync2(bin);
+    const environment = dirname3(dirname3(resolved));
+    if (["venv", ".venv"].includes(environment.split("/").at(-1) ?? "")) {
+      return { bin, repo: dirname3(environment) };
+    }
+  } catch {
   }
-  return candidates[0];
+  return { bin, repo: bin.startsWith(devRoot) ? devRoot : releaseRoot };
 }
-function renderHostConfig() {
+function hostSchema() {
   const home = homedir3();
-  const hermesBin = detectHermesBin(home);
-  const hermesRepo = join4(home, "code", "hermes-agent");
-  const scaffoldDir = join4(home, "code", "hermes-agent-template", "runtime-scaffold");
-  const skillsDir = join4(home, ".agents", "skills");
-  const pmExternalSkillGlobalDir = join4(home, "code", "skillex", "skill-sets", "global", ".system");
+  const hermes = detectHermesInstall(home);
+  return [
+    {
+      section: "fleet",
+      values: [
+        ["hermes_bin", quote(hermes.bin)],
+        ["hermes_repo", quote(hermes.repo)],
+        ["pjangler_bin", quote("pj")],
+        ["hermes_git_url", quote(HERMES_GIT_URL)],
+        ["hermes_git_ref", quote(HERMES_GIT_REF)],
+        ["hermes_git_sha", quote(HERMES_GIT_SHA)],
+        ["runtime_scaffold_dir", quote(join4(home, "code", "hermes-agent-template", "runtime-scaffold"))],
+        ["fleet_env", quote("~/.hermes/fleet.env")],
+        ["registry_file", quote("~/.hermes/agents-registry.yaml")],
+        ["oauth_file", quote("~/.hermes/auth.json")],
+        ["codex_home", quote("~/.codex")],
+        ["canonical_skills_dir", quote(join4(home, ".agents", "skills"))],
+        ["vox_plugin_name", quote("vox")],
+        ["vox_plugin_dir", quote(join4(home, "code", "voxxy", "plugins", "tts", "vox"))],
+        ["vox_voice", quote("carlin")],
+        ["vox_url", quote("https://vox.delo.sh")],
+        ["onepassword_vault", quote("DeLoSecrets")],
+        ["onepassword_item_prefix", quote("hermes-agent")],
+        [
+          "symlinked_runtime_skills",
+          `[${[
+            "delonet-conventions",
+            "delonet-dotenv",
+            "hermes-pm-template-maintenance",
+            "hindsight",
+            "33god-projects",
+            "subagent-driven-development"
+          ].map(quote).join(", ")}]`
+        ]
+      ]
+    },
+    { section: "github", values: [["runtime_repo_owner", quote("")]] },
+    {
+      section: "plane",
+      values: [
+        ["base", quote("https://plane.delo.sh")],
+        ["workspace", quote("33god")]
+      ]
+    }
+  ];
+}
+function renderHostConfig() {
+  const sections = hostSchema().map(({ section: section2, values }) => `[${section2}]
+${values.map(([key, value]) => `${key} = ${value}`).join("\n")}`).join("\n\n");
   return `# hermes-agent-template \u2014 host configuration
-# Bootstrapped by \`pjangler config bootstrap\` for $HOME=${home} (platform=${platform()}).
-#
-# [fleet] paths below were derived from THIS machine. The identity values in
-# [github]/[plane]/[bloodbank] are intentionally left to be confirmed before a
-# CLOUD provision (\`pjangler hermes\` without --local); they are unused by the
-# default local-only provision.
-#
-# Resolution precedence per value: env var > ~/.hermes/fleet.env > this file > fallback.
+# Bootstrapped by \`pj config bootstrap\` for $HOME=${homedir3()} (platform=${platform()}).
+# Existing values and additional keys are preserved by \`--force\`; it only adds
+# fields missing from the schema pinned in this pjangler release.
+# Resolution precedence: env var > ~/.hermes/fleet.env > this file > fallback.
 
-[fleet]
-home = "~/.hermes"
-hermes_bin = "${hermesBin}"
-hermes_repo = "${hermesRepo}"
-runtime_scaffold_dir = "${scaffoldDir}"
-# Shared fleet source-of-truth env file + fleet registry. ~ is expanded.
-fleet_env = "~/.hermes/fleet.env"
-registry_file = "~/.hermes/agents-registry.yaml"
-canonical_skills_dir = "${skillsDir}"
-# BMAD is NOT listed here. "bmad-method install" writes bmad-* skills into each
-# project's own .agents/skills, so an agent sees the version its repo pins
-# rather than one frozen fleet-wide copy. This list is for genuinely shared,
-# out-of-project skill sources only.
-pm_external_skill_dirs = [
-  "${pmExternalSkillGlobalDir}",
-]
-symlinked_runtime_skills = []
-
-[github]
-# Owner of the per-agent runtime repos (creates <owner>/agent-hm-<repo>-<role>).
-# REQUIRED before a cloud provision. Leave empty for local-only runs.
-runtime_repo_owner = ""
+${sections}
+`;
+}
+function isEscaped(value, index) {
+  let slashes = 0;
+  for (let cursor = index - 1; cursor >= 0 && value[cursor] === "\\"; cursor -= 1) slashes += 1;
+  return slashes % 2 === 1;
+}
+function scanMultilineState(line, initial) {
+  let state = initial;
+  let string;
+  for (let index = 0; index < line.length; ) {
+    if (state) {
+      const marker = state === "basic" ? '"""' : "'''";
+      const close = line.indexOf(marker, index);
+      if (close === -1) return state;
+      if (state === "basic" && isEscaped(line, close)) {
+        index = close + marker.length;
+        continue;
+      }
+      state = void 0;
+      index = close + marker.length;
+      continue;
+    }
+    if (string === "basic") {
+      if (line[index] === '"' && !isEscaped(line, index)) string = void 0;
+      index += 1;
+      continue;
+    }
+    if (string === "literal") {
+      if (line[index] === "'") string = void 0;
+      index += 1;
+      continue;
+    }
+    if (line[index] === "#") break;
+    if (line.startsWith('"""', index)) {
+      state = "basic";
+      index += 3;
+      continue;
+    }
+    if (line.startsWith("'''", index)) {
+      state = "literal";
+      index += 3;
+      continue;
+    }
+    if (line[index] === '"') string = "basic";
+    else if (line[index] === "'") string = "literal";
+    index += 1;
+  }
+  return state;
+}
+function parseBasicKey(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "string" ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function parseDottedKey(raw) {
+  const path = [];
+  let cursor = 0;
+  const whitespace = () => {
+    while (cursor < raw.length && /[ \t]/.test(raw[cursor])) cursor += 1;
+  };
+  whitespace();
+  while (cursor < raw.length) {
+    let key;
+    if (raw[cursor] === '"') {
+      const start = cursor;
+      cursor += 1;
+      while (cursor < raw.length) {
+        if (raw[cursor] === '"' && !isEscaped(raw, cursor)) {
+          cursor += 1;
+          key = parseBasicKey(raw.slice(start, cursor));
+          break;
+        }
+        cursor += 1;
+      }
+    } else if (raw[cursor] === "'") {
+      const end = raw.indexOf("'", cursor + 1);
+      if (end !== -1) {
+        key = raw.slice(cursor + 1, end);
+        cursor = end + 1;
+      }
+    } else {
+      const match = raw.slice(cursor).match(/^[A-Za-z0-9_-]+/);
+      if (match) {
+        key = match[0];
+        cursor += match[0].length;
+      }
+    }
+    if (key === void 0) return void 0;
+    path.push(key);
+    whitespace();
+    if (cursor === raw.length) return path;
+    if (raw[cursor] !== ".") return void 0;
+    cursor += 1;
+    whitespace();
+    if (cursor === raw.length) return void 0;
+  }
+  return path.length ? path : void 0;
+}
+function parseHeaderLine(line) {
+  const text2 = line.trimStart();
+  if (!text2.startsWith("[")) return void 0;
+  const kind = text2.startsWith("[[") ? "array-table" : "table";
+  const openLength = kind === "array-table" ? 2 : 1;
+  const close = kind === "array-table" ? "]]" : "]";
+  let string;
+  let closeAt = -1;
+  for (let cursor = openLength; cursor < text2.length; cursor += 1) {
+    if (string === "basic") {
+      if (text2[cursor] === '"' && !isEscaped(text2, cursor)) string = void 0;
+      continue;
+    }
+    if (string === "literal") {
+      if (text2[cursor] === "'") string = void 0;
+      continue;
+    }
+    if (text2[cursor] === '"') {
+      string = "basic";
+      continue;
+    }
+    if (text2[cursor] === "'") {
+      string = "literal";
+      continue;
+    }
+    if (text2.startsWith(close, cursor)) {
+      closeAt = cursor;
+      break;
+    }
+  }
+  if (closeAt === -1) return void 0;
+  const tail = text2.slice(closeAt + close.length);
+  if (!/^[ \t]*(?:#.*)?$/.test(tail)) return void 0;
+  const path = parseDottedKey(text2.slice(openLength, closeAt));
+  return path ? { kind, path } : void 0;
+}
+function parseTomlTableHeaders(source) {
+  const parsed = [];
+  let offset = 0;
+  let multiline;
+  for (const match of source.matchAll(/[^\r\n]*(?:\r\n|\n|\r|$)/g)) {
+    const segment = match[0];
+    if (!segment) break;
+    const line = segment.replace(/(?:\r\n|\n|\r)$/, "");
+    if (!multiline) {
+      const header = parseHeaderLine(line);
+      if (header) {
+        parsed.push({
+          ...header,
+          headerStart: offset,
+          bodyStart: offset + segment.length
+        });
+      }
+    }
+    multiline = scanMultilineState(line, multiline);
+    offset += segment.length;
+  }
+  return parsed.map((header, index) => ({
+    ...header,
+    bodyEnd: parsed[index + 1]?.headerStart ?? source.length
+  }));
+}
+function ownedBareKeys(source, table) {
+  const keys = /* @__PURE__ */ new Set();
+  let multiline;
+  const body = source.slice(table.bodyStart, table.bodyEnd);
+  for (const match of body.matchAll(/[^\r\n]*(?:\r\n|\n|\r|$)/g)) {
+    const segment = match[0];
+    if (!segment) break;
+    const line = segment.replace(/(?:\r\n|\n|\r)$/, "");
+    if (!multiline) {
+      const assignment = line.match(/^\s*((?:"(?:\\.|[^"\\])*"|'[^']*'|[A-Za-z0-9_-]+))\s*=/);
+      if (assignment) {
+        const path = parseDottedKey(assignment[1]);
+        if (path?.length === 1) keys.add(path[0]);
+      }
+    }
+    multiline = scanMultilineState(line, multiline);
+  }
+  return keys;
+}
+var TOMLLIB_VALIDATE = String.raw`
+import sys
 
-[plane]
-# Plane instance + workspace (one project per agent). Confirm before cloud provision.
-base = "https://plane.delo.sh"
-workspace = "33god"
+try:
+    import tomllib
+except Exception as exc:
+    sys.stderr.write("TOMLLIB_UNAVAILABLE:" + repr(exc))
+    raise SystemExit(2)
 
-[bloodbank]
-# NATS endpoint the consumer connects to. For a remote fleet node, point this at
-# the bloodbank host over Tailscale rather than localhost.
-nats_host = "127.0.0.1"
-nats_port = 4222
-compose_dir = "~/code/33GOD/bloodbank"
+try:
+    source = sys.stdin.buffer.read().decode("utf-8", errors="strict")
+    tomllib.loads(source)
+except (UnicodeDecodeError, tomllib.TOMLDecodeError) as exc:
+    sys.stderr.write("TOML_INVALID:" + exc.__class__.__name__ + ": " + str(exc))
+    raise SystemExit(1)
+`;
+var TOMLLIB_VALIDATION_TIMEOUT_MS = 5e3;
+function isolatedPythonEnvironment() {
+  return Object.fromEntries(
+    Object.entries(process.env).filter(([name]) => !name.toUpperCase().startsWith("PYTHON"))
+  );
+}
+function validateTomlBytes(source, label) {
+  const validation = spawnSync2("python3", ["-I", "-S", "-c", TOMLLIB_VALIDATE], {
+    input: source,
+    encoding: "utf8",
+    env: isolatedPythonEnvironment(),
+    maxBuffer: 1024 * 1024,
+    timeout: TOMLLIB_VALIDATION_TIMEOUT_MS,
+    killSignal: "SIGKILL"
+  });
+  if (validation.error) {
+    const code = validation.error.code;
+    if (code === "ETIMEDOUT") {
+      throw new Error(`${label} validation timed out after ${TOMLLIB_VALIDATION_TIMEOUT_MS}ms`);
+    }
+    throw new Error(
+      code === "ENOENT" ? `${label} cannot be validated: python3 with tomllib is required but was not found` : `${label} validation failed to start: ${validation.error.message}`
+    );
+  }
+  if (validation.status === 2 || validation.stderr.startsWith("TOMLLIB_UNAVAILABLE:")) {
+    throw new Error(
+      `${label} cannot be validated: python3 with tomllib is required (${validation.stderr.replace(/^TOMLLIB_UNAVAILABLE:/, "")})`
+    );
+  }
+  if (validation.status !== 0) {
+    const detail = validation.stderr.replace(/^TOML_INVALID:/, "").trim() || `python3 exited ${validation.status ?? "without a status"}`;
+    throw new Error(`${label} is not valid TOML 1.0 for Python tomllib: ${detail}`);
+  }
+}
+function assertValidToml(source, label) {
+  validateTomlBytes(Buffer.from(source, "utf8"), label);
+}
+function mergeHostConfig(existingBytes) {
+  validateTomlBytes(existingBytes, "Existing Hermes template config");
+  const existing = existingBytes.toString("utf8");
+  if (!Buffer.from(existing, "utf8").equals(existingBytes)) {
+    throw new Error("Existing Hermes template config is not valid UTF-8");
+  }
+  let merged = existing;
+  for (const { section: section2, values } of hostSchema()) {
+    const tables = parseTomlTableHeaders(merged);
+    const matching = tables.filter((table2) => table2.kind === "table" && table2.path.length === 1 && table2.path[0] === section2);
+    if (matching.length > 1) {
+      throw new Error(`Cannot merge [${section2}]: config contains duplicate table headers`);
+    }
+    const table = matching[0];
+    if (!table) {
+      const incompatible = tables.find((candidate) => candidate.path[0] === section2);
+      if (incompatible) {
+        throw new Error(`Cannot merge [${section2}]: config defines ${incompatible.kind === "array-table" ? "an array table" : "a child table"} at [${incompatible.path.join(".")}] without an owning [${section2}] table`);
+      }
+      const prefix = merged.length === 0 ? "" : merged.endsWith("\n") ? "\n" : "\n\n";
+      merged += `${prefix}[${section2}]
+${values.map(([key, value]) => `${key} = ${value}`).join("\n")}
 `;
+      continue;
+    }
+    const existingKeys = ownedBareKeys(merged, table);
+    const missing = values.filter(([key]) => !existingKeys.has(key));
+    if (!missing.length) continue;
+    const body = merged.slice(table.bodyStart, table.bodyEnd);
+    const addition = `${body.length === 0 || body.endsWith("\n") ? "" : "\n"}${missing.map(([key, value]) => `${key} = ${value}`).join("\n")}
+`;
+    merged = `${merged.slice(0, table.bodyEnd)}${addition}${merged.slice(table.bodyEnd)}`;
+  }
+  assertValidToml(merged, "Merged Hermes template config");
+  return merged;
+}
+function describePathType(stats) {
+  if (stats.isSymbolicLink()) return "symbolic link";
+  if (stats.isDirectory()) return "directory";
+  if (stats.isFIFO()) return "FIFO";
+  if (stats.isSocket()) return "socket";
+  if (stats.isCharacterDevice()) return "character device";
+  if (stats.isBlockDevice()) return "block device";
+  return "non-regular file";
+}
+function inspectConfigPath(path) {
+  let stats;
+  try {
+    stats = lstatSync3(path);
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+  if (!stats.isFile() || stats.isSymbolicLink()) {
+    throw new Error(`Unsafe Hermes template config path ${path}: expected a regular file, found ${describePathType(stats)}`);
+  }
+  return stats;
+}
+function installConfig(path, next, previous) {
+  const dir = dirname3(path);
+  mkdirSync3(dir, { recursive: true });
+  const tmp = join4(dir, `.${basename3(path)}.pjangler-${process.pid}.tmp`);
+  try {
+    writeFileSync3(tmp, next, { mode: previous ? previous.mode & 511 : 384 });
+    renameSync2(tmp, path);
+  } catch (error) {
+    try {
+      rmSync2(tmp, { force: true });
+    } catch {
+    }
+    throw error;
+  }
 }
 var EnsureTemplateConfig = class extends Command {
   async invoke() {
@@ -10948,33 +11548,75 @@ var EnsureTemplateConfig = class extends Command {
     }
     const force = ctx.forceConfig === true || process.env.PJANGLER_FORCE_CONFIG === "1";
     const path = resolveTemplateConfigPath();
-    const exists = existsSync3(path);
+    let stats;
+    try {
+      stats = inspectConfigPath(path);
+    } catch (error) {
+      return {
+        success: false,
+        outcome: "failed",
+        message: `Failed to inspect ${path}: ${error instanceof Error ? error.message : String(error)}`
+      };
+    }
+    const exists = stats !== void 0;
     if (exists && !force) {
       if (!ctx.quiet) console.log(`\u2713 Config present: ${path}`);
-      return { success: true, outcome: "unchanged", message: "" };
+      return { success: true, outcome: "unchanged", message: `Config present: ${path}` };
+    }
+    let next = renderHostConfig();
+    let current = "";
+    try {
+      if (exists) {
+        const bytes = readFileSync3(path);
+        next = mergeHostConfig(bytes);
+        current = bytes.toString("utf8");
+      } else {
+        assertValidToml(next, "Rendered Hermes template config");
+      }
+    } catch (error) {
+      return {
+        success: false,
+        outcome: "failed",
+        message: `Failed to prepare ${path}; no changes were applied: ${error instanceof Error ? error.message : String(error)}`
+      };
+    }
+    if (exists && next === current) {
+      return { success: true, outcome: "unchanged", message: `Config schema already current: ${path}` };
     }
     if (ctx.dryRun) {
-      if (!ctx.quiet) console.log(`[DRY RUN] Would ${exists ? "overwrite" : "create"} config: ${path}`);
-      return { success: true, outcome: "planned", filePath: path, message: "" };
+      if (!ctx.quiet) console.log(`[DRY RUN] Would ${exists ? "merge missing schema fields into" : "create"} config: ${path}`);
+      return {
+        success: true,
+        outcome: "planned",
+        filePath: path,
+        message: `[DRY RUN] Would ${exists ? "merge missing schema fields into" : "create"} config: ${path}`
+      };
     }
     try {
-      mkdirSync3(dirname3(path), { recursive: true });
-      writeFileSync3(path, renderHostConfig());
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      return { success: false, outcome: "failed", message: `Failed to write ${path}: ${msg}` };
+      installConfig(path, next, stats);
+    } catch (error) {
+      return {
+        success: false,
+        outcome: "failed",
+        message: `Failed to write ${path}: ${error instanceof Error ? error.message : String(error)}`
+      };
     }
     if (!ctx.quiet) {
-      console.log(`\u2713 Bootstrapped config: ${path}`);
-      console.log("  Review [github].runtime_repo_owner + [plane] + [bloodbank] before a cloud provision.");
+      console.log(`\u2713 ${exists ? "Updated" : "Bootstrapped"} config: ${path}`);
+      if (!exists) console.log("  Review [github].runtime_repo_owner + [plane] + [bloodbank] before a cloud provision.");
     }
-    return { success: true, outcome: "changed", filePath: path, message: "" };
+    return {
+      success: true,
+      outcome: "changed",
+      filePath: path,
+      message: `${exists ? "Updated" : "Bootstrapped"} config without replacing existing values: ${path}`
+    };
   }
 };
 
 // src/commands/hermes/PromptForAgentConfig.ts
-import { basename as basename3, join as join5 } from "node:path";
-import { readFileSync as readFileSync3 } from "node:fs";
+import { basename as basename4, join as join5 } from "node:path";
+import { readFileSync as readFileSync4 } from "node:fs";
 import * as p from "@clack/prompts";
 
 // src/commands/hermes/types.ts
@@ -10989,7 +11631,7 @@ function deriveProfileName(repo, role) {
 // src/commands/hermes/PromptForAgentConfig.ts
 function detectTicketProvider(targetDir) {
   try {
-    const t = JSON.parse(readFileSync3(join5(targetDir, ".project.json"), "utf8"))?.ticket_provider?.type;
+    const t = JSON.parse(readFileSync4(join5(targetDir, ".project.json"), "utf8"))?.ticket_provider?.type;
     return t === "plane" || t === "trello" ? t : void 0;
   } catch {
     return void 0;
@@ -10998,7 +11640,7 @@ function detectTicketProvider(targetDir) {
 var PromptForAgentConfig = class extends Command {
   async invoke() {
     const ctx = this.context;
-    const defaultRepo = basename3(ctx.targetDir).toLowerCase();
+    const defaultRepo = basename4(ctx.targetDir).toLowerCase();
     ctx.targetRepo = (ctx.targetRepo ?? defaultRepo).toLowerCase();
     ctx.role ??= "pm";
     ctx.agentPurpose ??= `${ctx.role} agent for ${ctx.targetRepo}`;
@@ -11054,12 +11696,73 @@ var PromptForAgentConfig = class extends Command {
   }
 };
 
+// src/commands/hermes/ValidateHermesOptions.ts
+import { lstatSync as lstatSync7, readdirSync as readdirSync5 } from "node:fs";
+import { join as join10, relative as relative6 } from "node:path";
+init_project();
+var EMAIL_UNSUPPORTED_MESSAGE = "Email provisioning is unavailable: the pinned Hermes template has no supported email provisioner. Omit --email; no files or external state were changed.";
+var HARMLESS_ROLE_PLACEHOLDERS = /* @__PURE__ */ new Set([".gitkeep", ".DS_Store", "Thumbs.db"]);
+function existingRoleDirectoryBlockers(roleDir) {
+  let root;
+  try {
+    root = lstatSync7(roleDir);
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  if (!root.isDirectory() || root.isSymbolicLink()) return ["<target is not a real directory>"];
+  const blockers = [];
+  const visit = (directory) => {
+    for (const entry of readdirSync5(directory, { withFileTypes: true })) {
+      const path = join10(directory, entry.name);
+      const stats = lstatSync7(path);
+      if (stats.isDirectory() && !stats.isSymbolicLink()) {
+        visit(path);
+      } else if (!HARMLESS_ROLE_PLACEHOLDERS.has(entry.name) || !stats.isFile() || stats.isSymbolicLink() || stats.nlink !== 1) {
+        blockers.push(relative6(roleDir, path));
+      }
+    }
+  };
+  visit(roleDir);
+  return blockers.sort();
+}
+function existingRoleRefusal(roleDir) {
+  const blockers = existingRoleDirectoryBlockers(roleDir);
+  if (!blockers.length) return void 0;
+  const sample = blockers.slice(0, 3).join(", ");
+  const remainder = blockers.length > 3 ? ` and ${blockers.length - 3} more` : "";
+  return `Hermes target directory is not empty at ${roleDir} (found ${sample}${remainder}); non-interactive mode will not render into it. Re-run with --force to re-render explicitly.`;
+}
+var ValidateHermesOptions = class extends Command {
+  async invoke() {
+    const ctx = this.context;
+    if (ctx.skipEmail === false) {
+      return { success: false, outcome: "failed", message: EMAIL_UNSUPPORTED_MESSAGE };
+    }
+    const role = normalizeAgentRole(ctx.role ?? "pm");
+    const roleDir = resolveContainedPath(
+      ctx.targetDir,
+      join10(ctx.targetDir, "agents", "hermes", role),
+      "Hermes role directory"
+    );
+    const refusal = (ctx.yes || ctx.quiet) && !ctx.force ? existingRoleRefusal(roleDir) : void 0;
+    if (refusal) {
+      return {
+        success: false,
+        outcome: "failed",
+        message: refusal
+      };
+    }
+    return { success: true, outcome: "unchanged", message: "" };
+  }
+};
+
 // src/commands/hermes/RunCopierTemplate.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 import { homedir as homedir5 } from "node:os";
-import { join as join9, dirname as dirname6, relative as relative6 } from "node:path";
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "node:fs";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { join as join11, dirname as dirname7, relative as relative7 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "node:fs";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 import * as p2 from "@clack/prompts";
 import YAML4 from "yaml";
 init_project();
@@ -11089,9 +11792,9 @@ function scrubInteractiveChannelCredentials(env2) {
   delete env2.WIRE_SLACK;
 }
 function registerRenderedAgent(ctx, roleDir, role) {
-  const manifestPath = join9(ctx.targetDir, ".project.json");
+  const manifestPath = join11(ctx.targetDir, ".project.json");
   if (!existsSync7(manifestPath) || !ctx.targetRepo) return;
-  const current = readFileSync7(manifestPath, "utf8");
+  const current = readFileSync9(manifestPath, "utf8");
   const parsed = JSON.parse(current);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error(`${manifestPath} must contain a JSON object`);
@@ -11106,7 +11809,7 @@ function registerRenderedAgent(ctx, roleDir, role) {
   Object.defineProperty(agents, agentId, {
     value: {
       role,
-      role_dir: relative6(ctx.targetDir, roleDir),
+      role_dir: relative7(ctx.targetDir, roleDir),
       provisioning_state: "provisioned"
     },
     configurable: true,
@@ -11121,14 +11824,14 @@ function registerRenderedAgent(ctx, roleDir, role) {
 function resolveVendoredTemplate(name) {
   let dir;
   try {
-    dir = dirname6(fileURLToPath3(import.meta.url));
+    dir = dirname7(fileURLToPath4(import.meta.url));
   } catch {
     return void 0;
   }
   for (let i = 0; i < 8; i++) {
-    const candidate = join9(dir, "templates", name);
-    if (existsSync7(join9(candidate, "copier.yml"))) return candidate;
-    const parent = dirname6(dir);
+    const candidate = join11(dir, "templates", name);
+    if (existsSync7(join11(candidate, "copier.yml"))) return candidate;
+    const parent = dirname7(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -11160,11 +11863,14 @@ var RunCopierTemplate = class extends Command {
     ctx.role = safeRole;
     const roleDir = resolveContainedPath(
       ctx.targetDir,
-      join9(ctx.targetDir, "agents", "hermes", safeRole),
+      join11(ctx.targetDir, "agents", "hermes", safeRole),
       "Hermes role directory"
     );
     ctx.roleDir = roleDir;
-    ctx.runtimeRepo = `delorenj/agent-hm-${targetRepo}-${safeRole}`;
+    const nonInteractiveRefusal = (ctx.yes || ctx.quiet) && !ctx.force ? existingRoleRefusal(roleDir) : void 0;
+    if (nonInteractiveRefusal) {
+      return { success: false, outcome: "failed", message: nonInteractiveRefusal };
+    }
     const trustedCopierRequired = Boolean(ctx.deferredExternalEffects && !ctx.dryRun);
     if (trustedCopierRequired && !ctx.trustedCopier) {
       return {
@@ -11174,7 +11880,7 @@ var RunCopierTemplate = class extends Command {
       };
     }
     if (!ctx.trustedCopier) {
-      const which = spawnSync3("which", ["copier"], { encoding: "utf8" });
+      const which = spawnSync4("which", ["copier"], { encoding: "utf8" });
       if (which.status !== 0) {
         return {
           success: false,
@@ -11183,10 +11889,8 @@ var RunCopierTemplate = class extends Command {
         };
       }
     }
-    if (existsSync7(join9(roleDir, "role.yaml")) && !ctx.force) {
-      if (ctx.yes) {
-        ctx.force = true;
-      } else {
+    if (existsSync7(join11(roleDir, "role.yaml")) && !ctx.force) {
+      if (!ctx.yes && !ctx.quiet) {
         const proceed = await p2.confirm({
           message: `${safeRole}/role.yaml already exists \u2014 re-render with --overwrite?`,
           initialValue: false
@@ -11214,9 +11918,10 @@ var RunCopierTemplate = class extends Command {
       // renders repo-local files first and executes those scripts only after a
       // structural lifecycle gate has accepted the render.
       SKIP_HOST_STATE: ctx.deferredExternalEffects ? "1" : "0",
-      // Bloodbank is a fleet-shared Hermes gateway. Never provision the legacy
-      // per-profile file consumer, even when an older template still exposes it.
-      SKIP_RUNTIME_REPO: ctx.deferredExternalEffects ? "1" : ctx.skipRuntimeRepo ? "1" : "0",
+      // The legacy script/env name now owns only ignored role-local runtime
+      // setup. Structured transactions defer it until rendered eligibility;
+      // ordinary CLI deploys always run it and no flag can create a remote repo.
+      SKIP_RUNTIME_REPO: ctx.deferredExternalEffects ? "1" : "0",
       SKIP_PLANE: ctx.deferredExternalEffects ? "1" : ctx.skipPlane ? "1" : "0",
       SKIP_BLOODBANK: "1",
       SKIP_SYSTEMD: ctx.deferredExternalEffects ? "1" : ctx.skipSystemd ? "1" : "0"
@@ -11229,9 +11934,9 @@ var RunCopierTemplate = class extends Command {
       env2.PYTHONNOUSERSITE = "1";
       env2.PYTHONSAFEPATH = "1";
     }
-    const LOCAL_TEMPLATE = join9(homedir5(), "code", "hermes-agent-template");
+    const LOCAL_TEMPLATE = join11(homedir5(), "code", "hermes-agent-template");
     const vendored = resolveVendoredTemplate("hermes-agent");
-    const templateSrc = process.env.PJANGLER_HERMES_TEMPLATE || vendored || (existsSync7(join9(LOCAL_TEMPLATE, "copier.yml")) ? LOCAL_TEMPLATE : HERMES_AGENT_TEMPLATE);
+    const templateSrc = process.env.PJANGLER_HERMES_TEMPLATE || vendored || (existsSync7(join11(LOCAL_TEMPLATE, "copier.yml")) ? LOCAL_TEMPLATE : HERMES_AGENT_TEMPLATE);
     const args = [
       "copy",
       templateSrc,
@@ -11261,6 +11966,7 @@ var RunCopierTemplate = class extends Command {
       "--trust",
       "--vcs-ref=HEAD"
     ];
+    if (ctx.yes || ctx.quiet) args.push("--defaults");
     if (ctx.force) args.push("--overwrite");
     if (ctx.dryRun) {
       return {
@@ -11280,12 +11986,12 @@ var RunCopierTemplate = class extends Command {
         };
       }
     }
-    mkdirSync5(join9(ctx.targetDir, "agents", "hermes"), { recursive: true });
-    const spinner4 = ctx.quiet ? void 0 : p2.spinner();
-    spinner4?.start(`Running copier copy  (target: agents/hermes/${safeRole})`);
+    mkdirSync5(join11(ctx.targetDir, "agents", "hermes"), { recursive: true });
+    const spinner3 = ctx.quiet ? void 0 : p2.spinner();
+    spinner3?.start(`Running copier copy  (target: agents/hermes/${safeRole})`);
     const copierExecutable = ctx.trustedCopier?.executable ?? "copier";
-    const result2 = spawnSync3(copierExecutable, args, ctx.quiet ? { encoding: "utf8", env: env2, cwd: ctx.targetDir } : { stdio: "inherit", env: env2, cwd: ctx.targetDir });
-    spinner4?.stop(result2.status === 0 ? "\u2713 copier run complete" : "\u2717 copier failed");
+    const result2 = spawnSync4(copierExecutable, args, ctx.quiet ? { encoding: "utf8", env: env2, cwd: ctx.targetDir } : { stdio: "inherit", env: env2, cwd: ctx.targetDir });
+    spinner3?.stop(result2.status === 0 ? "\u2713 copier run complete" : "\u2717 copier failed");
     if (result2.status !== 0) {
       return {
         success: false,
@@ -11293,9 +11999,9 @@ var RunCopierTemplate = class extends Command {
         message: `copier exited with status ${result2.status}.${ctx.quiet && String(result2.stderr ?? "").trim() ? ` ${String(result2.stderr).trim()}` : " Check the output above; re-run with the same flags after fixing."}`
       };
     }
-    const roleManifest = join9(roleDir, "role.yaml");
+    const roleManifest = join11(roleDir, "role.yaml");
     try {
-      const current = readFileSync7(roleManifest, "utf8");
+      const current = readFileSync9(roleManifest, "utf8");
       const document = YAML4.parseDocument(current);
       if (document.errors.length) throw document.errors[0];
       document.setIn(["deployment", "local_only"], ctx.deferredExternalEffects ? true : Boolean(ctx.local));
@@ -11312,15 +12018,16 @@ var RunCopierTemplate = class extends Command {
     }
     return {
       success: true,
-      message: `\u2713 Provisioned ${roleDir}  (runtime: gh:${ctx.runtimeRepo})`
+      outcome: "changed",
+      message: `Rendered Hermes role at ${roleDir}; lifecycle postconditions are pending`
     };
   }
 };
 
 // src/commands/hermes/UntrackHermesRuntimes.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync6, readdirSync as readdirSync5 } from "fs";
-import { join as join10 } from "path";
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { existsSync as existsSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync6, readdirSync as readdirSync6 } from "fs";
+import { join as join12 } from "path";
+import { spawnSync as spawnSync5 } from "node:child_process";
 function sectionHasPath(section2, targetPath) {
   return section2.split(/\r?\n/).some((line) => /^\s*path\s*=/.test(line) && line.replace(/^\s*path\s*=\s*/, "").trim() === targetPath);
 }
@@ -11330,14 +12037,14 @@ function removeSubmodulePath(content, targetPath) {
 var UntrackHermesRuntimes = class extends Command {
   async invoke() {
     const targetDir = this.context.targetDir;
-    const rolesDir = join10(targetDir, "agents", "hermes");
+    const rolesDir = join12(targetDir, "agents", "hermes");
     if (!existsSync8(rolesDir)) {
       return {
         success: true,
         message: "No Hermes agents found (no agents/hermes directory)."
       };
     }
-    const roles = readdirSync5(rolesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+    const roles = readdirSync6(rolesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
     if (roles.length === 0) {
       return {
         success: true,
@@ -11347,12 +12054,12 @@ var UntrackHermesRuntimes = class extends Command {
     let modifiedAny = false;
     const details = [];
     for (const role of roles) {
-      const roleDir = join10("agents", "hermes", role);
-      const runtimePath = join10(roleDir, "runtime");
-      const gitignorePath = join10(roleDir, ".gitignore");
-      const gitmodulesPath = join10(targetDir, ".gitmodules");
+      const roleDir = join12("agents", "hermes", role);
+      const runtimePath = join12(roleDir, "runtime");
+      const gitignorePath = join12(roleDir, ".gitignore");
+      const gitmodulesPath = join12(targetDir, ".gitmodules");
       let isTracked = false;
-      const lsResult = spawnSync4("git", ["ls-files", "--stage", "--", runtimePath], {
+      const lsResult = spawnSync5("git", ["ls-files", "--stage", "--", runtimePath], {
         cwd: targetDir,
         encoding: "utf8"
       });
@@ -11368,14 +12075,14 @@ var UntrackHermesRuntimes = class extends Command {
       let hasStaleMapping = false;
       let gitmodulesContent = "";
       if (existsSync8(gitmodulesPath)) {
-        gitmodulesContent = readFileSync8(gitmodulesPath, "utf8");
+        gitmodulesContent = readFileSync10(gitmodulesPath, "utf8");
         const sections = gitmodulesContent.match(/^\[submodule "[^"\n]+"\][\s\S]*?(?=^\[submodule "|(?![\s\S]))/gm) ?? [];
         hasStaleMapping = sections.some((section2) => sectionHasPath(section2, runtimePath));
       }
       let isIgnored = false;
-      const fullGitignorePath = join10(targetDir, gitignorePath);
+      const fullGitignorePath = join12(targetDir, gitignorePath);
       if (existsSync8(fullGitignorePath)) {
-        const content = readFileSync8(fullGitignorePath, "utf8");
+        const content = readFileSync10(fullGitignorePath, "utf8");
         const lines = content.split(/\r?\n/).map((line) => line.trim());
         isIgnored = lines.includes("runtime/") || lines.includes("runtime");
       }
@@ -11384,7 +12091,7 @@ var UntrackHermesRuntimes = class extends Command {
         if (isTracked) {
           details.push(`untrack agents/hermes/${role}/runtime`);
           if (!this.context.dryRun) {
-            const rmResult = spawnSync4("git", ["rm", "--cached", "-r", "-f", "--", runtimePath], {
+            const rmResult = spawnSync5("git", ["rm", "--cached", "-r", "-f", "--", runtimePath], {
               cwd: targetDir,
               encoding: "utf8"
             });
@@ -11394,7 +12101,7 @@ var UntrackHermesRuntimes = class extends Command {
                 message: `\u2717 Failed to untrack ${runtimePath}: ${rmResult.stderr.trim() || `exit ${rmResult.status}`}`
               };
             }
-            const verifyResult = spawnSync4("git", ["ls-files", "--stage", "--", runtimePath], {
+            const verifyResult = spawnSync5("git", ["ls-files", "--stage", "--", runtimePath], {
               cwd: targetDir,
               encoding: "utf8"
             });
@@ -11419,7 +12126,7 @@ var UntrackHermesRuntimes = class extends Command {
           if (!this.context.dryRun) {
             let content = "";
             if (existsSync8(fullGitignorePath)) {
-              content = readFileSync8(fullGitignorePath, "utf8");
+              content = readFileSync10(fullGitignorePath, "utf8");
             }
             if (content && !content.endsWith("\n")) {
               content += "\n";
@@ -11446,8 +12153,8 @@ ${details.map((d) => `  - ${d}`).join("\n")}`
 };
 
 // src/commands/hermes/WireTelegram.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { join as join11 } from "node:path";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { join as join13 } from "node:path";
 import { existsSync as existsSync9, unlinkSync as unlinkSync3 } from "node:fs";
 import * as p3 from "@clack/prompts";
 var WireTelegram = class extends Command {
@@ -11477,7 +12184,7 @@ var WireTelegram = class extends Command {
     let token = process.env.TELEGRAM_BOT_TOKEN;
     let source = token ? "env" : null;
     if (!token) {
-      const tryOp = spawnSync5("op", ["read", vaultRef], { encoding: "utf8" });
+      const tryOp = spawnSync6("op", ["read", vaultRef], { encoding: "utf8" });
       if (tryOp.status === 0) {
         token = tryOp.stdout.trim();
         source = "op";
@@ -11516,7 +12223,7 @@ var WireTelegram = class extends Command {
         initialValue: true
       });
       if (!p3.isCancel(persist) && persist) {
-        const create = spawnSync5(
+        const create = spawnSync6(
           "op",
           [
             "item",
@@ -11543,28 +12250,32 @@ var WireTelegram = class extends Command {
     if (p3.isCancel(allowedAnswer)) {
       return { success: false, message: "\u2717 Aborted; Telegram step deferred." };
     }
-    const script = join11(roleDir, ".scripts", "30-telegram.sh");
+    const script = join13(roleDir, ".scripts", "30-telegram.sh");
     if (!existsSync9(script)) {
       return {
         success: false,
-        message: `\u2717 ${script} not found.  Did copier finish?  Re-run with --skip-runtime-repo=0 if you skipped it.`
+        message: `\u2717 ${script} not found. Did Copier finish rendering the Hermes role?`
       };
     }
-    const marker = join11(roleDir, ".scripts", ".done-30-telegram");
+    const marker = join13(roleDir, ".scripts", ".done-30-telegram");
     if (existsSync9(marker)) unlinkSync3(marker);
-    const spinner4 = p3.spinner();
-    spinner4.start("Verifying token + wiring profile");
-    const result2 = spawnSync5("bash", [script], {
+    const spinner3 = p3.spinner();
+    spinner3.start("Verifying token + wiring profile");
+    const result2 = spawnSync6("bash", [script], {
       stdio: "inherit",
       env: {
         ...process.env,
+        // Interactive wiring is an explicit host-state operation: it writes the
+        // profile. Set the gate rather than inheriting whatever a deferred MCP
+        // render left in the environment, which would silently no-op this run.
+        SKIP_HOST_STATE: "0",
         SKIP_TELEGRAM: "0",
         TELEGRAM_BOT_TOKEN: token,
         TELEGRAM_ALLOWED_USERS: String(allowedAnswer).trim()
       },
       cwd: roleDir
     });
-    spinner4.stop(result2.status === 0 ? "\u2713 Telegram wired" : "\u2717 Telegram step failed");
+    spinner3.stop(result2.status === 0 ? "\u2713 Telegram wired" : "\u2717 Telegram step failed");
     if (result2.status !== 0) {
       return { success: false, message: "Telegram wire-up failed.  See output above." };
     }
@@ -11577,164 +12288,67 @@ function cap(s) {
 }
 
 // src/commands/hermes/WireEmail.ts
-import { spawnSync as spawnSync6 } from "node:child_process";
-import { join as join12 } from "node:path";
-import { existsSync as existsSync10, unlinkSync as unlinkSync4 } from "node:fs";
-import * as p4 from "@clack/prompts";
 var WireEmail = class extends Command {
   async invoke() {
     const ctx = this.context;
-    if (ctx.skipEmail) {
-      return { success: true, message: "" };
-    }
-    if (ctx.quiet) {
-      return {
-        success: false,
-        outcome: "failed",
-        message: "Email wiring is interactive and unavailable during quiet/non-interactive Hermes execution"
-      };
-    }
-    if (ctx.dryRun) {
-      return { success: true, message: this.formatMessage("Would create CF Email Routing rule") };
-    }
-    const { targetRepo, role, roleDir } = ctx;
-    if (!targetRepo || !role || !roleDir) {
-      return { success: false, message: "Cannot wire email: missing target_repo/role/roleDir" };
-    }
-    const script = join12(roleDir, ".scripts", "50-email.sh");
-    if (!existsSync10(script)) {
-      return { success: false, message: `\u2717 ${script} not found` };
-    }
-    let token = process.env.CF_EMAIL_ROUTING_TOKEN;
-    if (!token) {
-      const tryOp = spawnSync6(
-        "op",
-        ["read", "op://DeLoSecrets/Cloudflare-EmailRouting/token"],
-        { encoding: "utf8" }
-      );
-      if (tryOp.status === 0) {
-        token = tryOp.stdout.trim();
-      }
-    }
-    if (!token) {
-      p4.log.warn("CF Email Routing token not found.  Required scopes:");
-      p4.log.info(
-        [
-          "  Zone (delo.sh)  \u2192  Email Routing Rules     : Edit",
-          "  Zone (delo.sh)  \u2192  Email Routing Settings  : Read",
-          "  Account         \u2192  Email Routing Addresses : Read",
-          "Create at: https://dash.cloudflare.com/profile/api-tokens"
-        ].join("\n")
-      );
-      const provideNow = await p4.confirm({
-        message: "Paste a token now?  (skipping leaves email unwired until you re-run.)",
-        initialValue: false
-      });
-      if (p4.isCancel(provideNow) || !provideNow) {
-        return { success: true, message: "\u2192 Email skipped (no token).  Re-run later." };
-      }
-      const tokenAnswer = await p4.password({
-        message: "CF token (will be passed via env, not stored)",
-        mask: "\u2022",
-        validate: (v) => String(v ?? "").trim() ? void 0 : "required"
-      });
-      if (p4.isCancel(tokenAnswer)) {
-        return { success: true, message: "\u2192 Email skipped (cancelled)" };
-      }
-      token = String(tokenAnswer).trim();
-      const persist = await p4.confirm({
-        message: "Save to op://DeLoSecrets/Cloudflare-EmailRouting/token for next time?",
-        initialValue: true
-      });
-      if (!p4.isCancel(persist) && persist) {
-        const create = spawnSync6(
-          "op",
-          [
-            "item",
-            "create",
-            "--category=API Credential",
-            "--vault=DeLoSecrets",
-            "--title=Cloudflare-EmailRouting",
-            `token=${token}`
-          ],
-          { stdio: "inherit" }
-        );
-        if (create.status !== 0) {
-          p4.log.warn("Could not store in 1Password \u2014 token is still set for this run.");
-        }
-      }
+    if (ctx.skipEmail !== false) {
+      return { success: true, outcome: "skipped", message: "" };
     }
-    const marker = join12(roleDir, ".scripts", ".done-50-email");
-    if (existsSync10(marker)) unlinkSync4(marker);
-    const spinner4 = p4.spinner();
-    spinner4.start("Creating Cloudflare Email Routing rule");
-    const result2 = spawnSync6("bash", [script], {
-      stdio: "inherit",
-      env: { ...process.env, SKIP_EMAIL: "0", CF_EMAIL_ROUTING_TOKEN: token },
-      cwd: roleDir
-    });
-    spinner4.stop(result2.status === 0 ? "\u2713 Email rule created" : "\u2717 Email step failed");
-    if (result2.status !== 0) {
-      return { success: false, message: "Email rule creation failed.  See output above." };
-    }
-    return {
-      success: true,
-      message: `\u2713 Email: ${targetRepo}-${role}@delo.sh  \u2192  jaradd@gmail.com`
-    };
+    return { success: false, outcome: "failed", message: EMAIL_UNSUPPORTED_MESSAGE };
   }
 };
 
 // src/commands/hermes/PrintHermesSummary.ts
-import * as p5 from "@clack/prompts";
+import { existsSync as existsSync10, readFileSync as readFileSync11 } from "node:fs";
+import { join as join14 } from "node:path";
+import YAML5 from "yaml";
+function readServiceState(roleDir) {
+  if (!roleDir || !existsSync10(join14(roleDir, "role.yaml"))) return { gateway: "planned", heartbeat: "planned" };
+  try {
+    const role = YAML5.parse(readFileSync11(join14(roleDir, "role.yaml"), "utf8"));
+    return {
+      gateway: typeof role?.service_state?.gateway === "string" ? role.service_state.gateway : "unknown",
+      heartbeat: typeof role?.service_state?.heartbeat === "string" ? role.service_state.heartbeat : "unknown"
+    };
+  } catch {
+    return { gateway: "unknown", heartbeat: "unknown" };
+  }
+}
+function renderHermesSummary(ctx) {
+  const outcome = ctx.deploymentOutcome ?? (ctx.dryRun ? "planned" : "failed");
+  const service = readServiceState(ctx.roleDir);
+  const deferrals = [...new Set(ctx.deploymentDeferrals ?? [])];
+  const title = outcome === "planned" ? "Hermes deployment plan (no changes applied)" : outcome === "verified-deferred" ? "Hermes deployment healthy with deferred capabilities" : outcome === "verified" ? "Hermes deployment verified" : "Hermes deployment not verified";
+  const lines = [
+    title,
+    `agent_id: ${ctx.agentId ?? "planned"}`,
+    `role_dir: ${ctx.roleDir ?? join14(ctx.targetDir, "agents", "hermes", ctx.role ?? "pm")}`,
+    `runtime: local role runtime (${join14(ctx.roleDir ?? join14(ctx.targetDir, "agents", "hermes", ctx.role ?? "pm"), "runtime")})`,
+    `heartbeat: ${service.heartbeat}`,
+    `gateway: ${service.gateway}`
+  ];
+  if (deferrals.length) lines.push(`deferred: ${deferrals.join(", ")}`);
+  for (const assertion of ctx.deploymentPostconditions ?? []) lines.push(`verified: ${assertion}`);
+  if (outcome === "planned") lines.push("Apply by rerunning without --dry-run.");
+  return lines.join("\n");
+}
 var PrintHermesSummary = class extends Command {
   async invoke() {
     const ctx = this.context;
-    const { targetRepo, role, agentId, runtimeRepo, skipTelegram, skipEmail } = ctx;
-    const botHandle = `${targetRepo?.toLowerCase().replace(/-/g, "_")}_${role?.toLowerCase()}_bot`;
-    const email = `${targetRepo}-${role}@delo.sh`;
-    const gw = `hermes-${agentId}-gateway.service`;
-    const hb = `hermes-${agentId}-heartbeat.timer`;
-    const lines = [];
-    lines.push(`agent_id     ${agentId}`);
-    lines.push(`role dir     ${ctx.roleDir}`);
-    lines.push(`runtime      gh:${runtimeRepo}`);
-    lines.push(`telegram     @${botHandle}${skipTelegram ? "   (NOT yet wired)" : ""}`);
-    if (!skipEmail) lines.push(`email        ${email}`);
-    lines.push("");
-    lines.push("Start daemons:");
-    lines.push(`  systemctl --user start ${hb}`);
-    if (!skipTelegram) {
-      lines.push(`  systemctl --user start ${gw}`);
-    } else {
-      lines.push(`  # gateway needs Telegram wired first (re-run with --skip-telegram=0)`);
-    }
-    lines.push("  # Bloodbank commands arrive through the fleet-shared Hermes gateway");
-    lines.push("");
-    lines.push("Talk locally:");
-    lines.push(`  ${ctx.roleDir}/hermes chat "status"`);
-    if (skipTelegram) {
-      lines.push("");
-      lines.push("Wire Telegram later:");
-      lines.push("  pjangler hermes-agent          # re-run and answer yes when asked");
-    }
-    if (!ctx.quiet) {
-      p5.note(lines.join("\n"), `Provisioned ${agentId}`);
-      p5.outro("Done.");
-    }
-    return { success: true, outcome: "unchanged", message: "" };
+    return { success: ctx.deploymentOutcome !== "failed", outcome: "unchanged", message: renderHermesSummary(ctx) };
   }
 };
 
 // src/commands/hermes/ApplyDeferredExternalEffects.ts
 import { spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join13 } from "node:path";
-import YAML5 from "yaml";
+import { existsSync as existsSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join15 } from "node:path";
+import YAML6 from "yaml";
 var ApplyDeferredExternalEffects = class extends Command {
   async invoke() {
     const ctx = this.context;
     const selected = ctx.deferredExternalEffects;
-    if (!selected || !selected.runtimeRepo && !selected.ticketBoard && !selected.systemd) {
+    if (!selected || !selected.ticketBoard && !selected.systemd) {
       return { success: true, outcome: "unchanged", message: "Hermes external effects not selected" };
     }
     if (!ctx.roleDir) {
@@ -11748,24 +12362,25 @@ var ApplyDeferredExternalEffects = class extends Command {
       SKIP_EMAIL: "1",
       SKIP_SLACK: "1",
       SKIP_BLOODBANK: "1",
-      SKIP_RUNTIME_REPO: selected.runtimeRepo ? "0" : "1",
+      // Role-local runtime is already converged by ApplyDeferredHostEffects.
+      // External consent can never dispatch the retired GitHub runtime model.
+      SKIP_RUNTIME_REPO: "1",
       SKIP_PLANE: selected.ticketBoard ? "0" : "1",
       SKIP_SYSTEMD: selected.systemd ? "0" : "1"
     };
     scrubInteractiveChannelCredentials(env2);
     if (!selected.ticketBoard) scrubTicketProviderCredentials(env2);
-    const roleManifest = join13(ctx.roleDir, "role.yaml");
+    const roleManifest = join15(ctx.roleDir, "role.yaml");
     const scripts = [
-      ...selected.runtimeRepo ? ["20-runtime-repo.sh"] : [],
       ...selected.ticketBoard ? ["42-ticket-provider.sh"] : [],
       ...selected.systemd ? ["70-systemd.sh"] : [],
-      // Refresh fleet metadata after a board binding or runtime/systemd state
+      // Refresh fleet metadata after a board binding or systemd state
       // changes. 80-registry.sh is idempotent and performs no provider call.
       "80-registry.sh"
     ];
     const logs = [];
     for (const script of scripts) {
-      const path = join13(ctx.roleDir, ".scripts", script);
+      const path = join15(ctx.roleDir, ".scripts", script);
       if (!existsSync11(path)) {
         return { success: false, outcome: "failed", message: `Deferred Hermes script is missing: ${path}` };
       }
@@ -11778,8 +12393,8 @@ var ApplyDeferredExternalEffects = class extends Command {
       }
     }
     try {
-      const current = readFileSync9(roleManifest, "utf8");
-      const document = YAML5.parseDocument(current);
+      const current = readFileSync12(roleManifest, "utf8");
+      const document = YAML6.parseDocument(current);
       if (document.errors.length) throw document.errors[0];
       document.setIn(["deployment", "local_only"], Boolean(ctx.local));
       document.setIn(["deployment", "systemd"], selected.systemd ? "required" : "deferred");
@@ -11804,7 +12419,7 @@ ${logs.join("\n")}` : ""}`
 // src/commands/hermes/ApplyDeferredHostEffects.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
 import { existsSync as existsSync12 } from "node:fs";
-import { join as join14 } from "node:path";
+import { join as join16 } from "node:path";
 var ApplyDeferredHostEffects = class extends Command {
   async invoke() {
     const ctx = this.context;
@@ -11830,16 +12445,18 @@ var ApplyDeferredHostEffects = class extends Command {
       SKIP_EMAIL: "1",
       SKIP_SLACK: "1",
       SKIP_BLOODBANK: "1",
-      SKIP_RUNTIME_REPO: "1",
+      // The legacy name controls role-local runtime/profile convergence only.
+      // It is a required host/local phase, never a GitHub repository effect.
+      SKIP_RUNTIME_REPO: "0",
       SKIP_PLANE: "1",
       SKIP_SYSTEMD: "1"
     };
     scrubTicketProviderCredentials(env2);
     scrubInteractiveChannelCredentials(env2);
-    const scripts = ["01-config.sh", "05-fleet-env.sh", "10-hermes-profile.sh"];
+    const scripts = ["01-config.sh", "05-fleet-env.sh", "10-hermes-profile.sh", "20-runtime-repo.sh"];
     const logs = [];
     for (const script of scripts) {
-      const path = join14(ctx.roleDir, ".scripts", script);
+      const path = join16(ctx.roleDir, ".scripts", script);
       if (!existsSync12(path)) {
         return { success: false, outcome: "failed", message: `Deferred Hermes host script is missing: ${path}` };
       }
@@ -11863,7 +12480,56 @@ ${logs.join("\n")}` : ""}`
 // src/recipes/HermesAgentRecipe.ts
 init_tree_diff();
 init_preflight();
-import { resolve as resolve6 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync13 } from "node:fs";
+import { join as join17, resolve as resolve6 } from "node:path";
+import YAML7 from "yaml";
+function deploymentDeferrals(ctx) {
+  const deferred = [];
+  if (ctx.local || ctx.skipPlane) deferred.push("ticket-board provisioning");
+  if (ctx.local || ctx.skipSystemd) deferred.push("systemd service activation");
+  const projectManifest = join17(ctx.targetDir, ".project.json");
+  if (!ctx.skipPlane && existsSync13(projectManifest)) {
+    try {
+      const project = JSON.parse(readFileSync13(projectManifest, "utf8"));
+      const state = project.ticket_provider?.state;
+      if (typeof state === "string" && state !== "linked") deferred.push(`ticket board (${state})`);
+    } catch {
+      deferred.push("ticket board state unreadable");
+    }
+  }
+  const rolePath = ctx.roleDir ? join17(ctx.roleDir, "role.yaml") : "";
+  if (rolePath && existsSync13(rolePath)) {
+    try {
+      const role = YAML7.parse(readFileSync13(rolePath, "utf8"));
+      const gateway = role?.service_state?.gateway;
+      const heartbeat = role?.service_state?.heartbeat;
+      if (typeof gateway === "string" && gateway !== "active") deferred.push(`gateway (${gateway})`);
+      if (typeof heartbeat === "string" && heartbeat !== "active") deferred.push(`heartbeat (${heartbeat})`);
+    } catch {
+      deferred.push("service state unreadable");
+    }
+  } else if (!ctx.dryRun) {
+    deferred.push("role service state unavailable");
+  }
+  return [...new Set(deferred)];
+}
+async function summaryResult(ctx) {
+  const summary = await new PrintHermesSummary(ctx).invoke();
+  return {
+    recipeId: "hermes-agent",
+    ok: summary.success,
+    dryRun: Boolean(ctx.dryRun),
+    changedFiles: [],
+    logs: summary.message ? [summary.message] : [],
+    errors: summary.success ? [] : [summary.message || "Hermes summary could not be rendered"],
+    phases: [{
+      id: "hermes.summary",
+      status: summary.success ? "unchanged" : "failed",
+      changedFiles: [],
+      message: summary.message || void 0
+    }]
+  };
+}
 var HermesAgentRecipe = class extends Recipe {
   checks = createHermesChecks();
   metadata = {
@@ -11872,13 +12538,14 @@ var HermesAgentRecipe = class extends Recipe {
     description: "Add and reconcile a Hermes agent role",
     dependencies: [],
     commands: [
-      "EnsureTemplateConfig",
       "PromptForAgentConfig",
+      "ValidateHermesOptions",
+      "EnsureTemplateConfig",
       "RunCopierTemplate",
       "UntrackHermesRuntimes",
       "WireTelegram",
       "WireEmail",
-      "PrintHermesSummary"
+      "PrintHermesSummary (postconditions only)"
     ],
     publicRuleIds: this.checks.map((check) => check.id)
   };
@@ -11889,13 +12556,13 @@ var HermesAgentRecipe = class extends Recipe {
     const errors = [];
     const changedFiles = [];
     const ingredients = [
-      EnsureTemplateConfig,
       PromptForAgentConfig,
+      ValidateHermesOptions,
+      EnsureTemplateConfig,
       RunCopierTemplate,
       UntrackHermesRuntimes,
       WireTelegram,
-      WireEmail,
-      PrintHermesSummary
+      WireEmail
     ];
     for (const [ingredientIndex, CommandClass] of ingredients.entries()) {
       if (typeof CommandClass !== "function") {
@@ -11964,30 +12631,46 @@ var HermesAgentRecipe = class extends Recipe {
     if (!commandResult.ok) return commandResult;
     const lifecycle = await this.initializeOwnedChecks(ctx);
     const localResult = mergeInitResults(this.metadata.id, Boolean(ctx.dryRun), [commandResult, lifecycle]);
-    if (!localResult.ok || ctx.dryRun) return localResult;
+    if (!localResult.ok) return localResult;
     const hermesContext = ctx;
-    if (hermesContext.deferredExternalEffects?.owner !== "hermes") return localResult;
+    if (ctx.dryRun) {
+      hermesContext.deploymentOutcome = "planned";
+      hermesContext.deploymentDeferrals = deploymentDeferrals(hermesContext);
+      hermesContext.deploymentPostconditions = ["dry-run made no repository or host changes"];
+      return mergeInitResults(this.metadata.id, true, [localResult, await summaryResult(ctx)]);
+    }
     const selected = hermesContext.deferredExternalEffects;
-    if (!selected.runtimeRepo && !selected.ticketBoard && !selected.systemd) return localResult;
-    const beforeExternal = snapshotTree(ctx.targetDir);
-    const external = await new ApplyDeferredExternalEffects(ctx).invoke();
-    const externalChanges = changedTreePaths(ctx.targetDir, beforeExternal, snapshotTree(ctx.targetDir));
-    const externalResult = {
-      recipeId: this.metadata.id,
-      ok: external.success,
-      dryRun: false,
-      changedFiles: externalChanges,
-      logs: external.message ? [external.message] : [],
-      errors: external.success ? [] : [external.message || "Deferred Hermes external effects failed"],
-      phases: [{
-        id: "hermes.external-effects",
-        status: external.success ? "changed" : "failed",
-        changedFiles: external.success ? externalChanges : [],
-        message: external.message || void 0
-      }]
-    };
-    if (!externalResult.ok) return mergeInitResults(this.metadata.id, false, [localResult, externalResult]);
-    const findings = this.audit(ctx).filter((finding2) => finding2.status !== "pass" && finding2.status !== "skip");
+    if (selected?.owner === "project" || ctx.quiet && !selected) return localResult;
+    let appliedResult = localResult;
+    if (selected?.owner === "hermes" && (selected.ticketBoard || selected.systemd)) {
+      const beforeExternal = snapshotTree(ctx.targetDir);
+      const external = await new ApplyDeferredExternalEffects(ctx).invoke();
+      const externalChanges = changedTreePaths(ctx.targetDir, beforeExternal, snapshotTree(ctx.targetDir));
+      const externalResult = {
+        recipeId: this.metadata.id,
+        ok: external.success,
+        dryRun: false,
+        changedFiles: externalChanges,
+        logs: external.message ? [external.message] : [],
+        errors: external.success ? [] : [external.message || "Deferred Hermes external effects failed"],
+        phases: [{
+          id: "hermes.external-effects",
+          status: external.success ? "changed" : "failed",
+          changedFiles: external.success ? externalChanges : [],
+          message: external.message || void 0
+        }]
+      };
+      appliedResult = mergeInitResults(this.metadata.id, false, [localResult, externalResult]);
+      if (!externalResult.ok) return appliedResult;
+    }
+    const crossChecks = [
+      ...createMiseChecks().filter((check) => check.id === "mise.config-root"),
+      ...createProjectChecks().filter((check) => check.id === "sot.project-json")
+    ];
+    const findings = [
+      ...this.audit(ctx),
+      ...crossChecks.map((check) => check.audit(ctx))
+    ].filter((finding2) => finding2.status !== "pass" && finding2.status !== "skip");
     const verification = {
       recipeId: this.metadata.id,
       ok: findings.length === 0,
@@ -12002,7 +12685,18 @@ var HermesAgentRecipe = class extends Recipe {
         message: findings.length ? "Hermes postcondition audit failed" : "Hermes postcondition audit passed"
       }]
     };
-    return mergeInitResults(this.metadata.id, false, [localResult, externalResult, verification]);
+    const verifiedResult = mergeInitResults(this.metadata.id, false, [appliedResult, verification]);
+    if (!verification.ok) {
+      hermesContext.deploymentOutcome = "failed";
+      return verifiedResult;
+    }
+    hermesContext.deploymentDeferrals = deploymentDeferrals(hermesContext);
+    hermesContext.deploymentOutcome = hermesContext.deploymentDeferrals.length ? "verified-deferred" : "verified";
+    hermesContext.deploymentPostconditions = [
+      "Hermes lifecycle audit passed",
+      "mise PATH and canonical project manifest passed"
+    ];
+    return mergeInitResults(this.metadata.id, false, [verifiedResult, await summaryResult(ctx)]);
   }
   printNextSteps() {
   }
@@ -12181,22 +12875,22 @@ var NodeRecipe = class extends Recipe {
 // src/recipes/ProjectRecipe.ts
 init_project();
 import { spawnSync as spawnSync13 } from "node:child_process";
-import { existsSync as existsSync18, lstatSync as lstatSync10, readFileSync as readFileSync16, rmSync as rmSync4 } from "node:fs";
-import { dirname as dirname11, isAbsolute as isAbsolute5, join as join22, relative as relativePath, resolve as resolve13 } from "node:path";
+import { existsSync as existsSync19, lstatSync as lstatSync12, readFileSync as readFileSync19, rmSync as rmSync5 } from "node:fs";
+import { dirname as dirname11, isAbsolute as isAbsolute5, join as join24, relative as relativePath, resolve as resolve13 } from "node:path";
 init_tree_diff();
 
 // src/recipes/NotebookRecipe.ts
 init_project();
-import { existsSync as existsSync17, readFileSync as readFileSync15 } from "node:fs";
-import { join as join21 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync18 } from "node:fs";
+import { join as join23 } from "node:path";
 
 // src/notebook/checks.ts
 init_config();
 init_notes();
 init_output();
 init_state();
-import { existsSync as existsSync15, readFileSync as readFileSync12 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync16 } from "node:fs";
+import { join as join19 } from "node:path";
 var NOTEBOOK_RULE_IDS = [
   "notebook.configuration",
   "notebook.binding",
@@ -12213,10 +12907,10 @@ function result(check, status, summary, changedFiles = [], details = []) {
   return { id: check.id, title: check.title, status, summary, changedFiles, details };
 }
 function manifestNotebook(repo) {
-  const path = join16(repo, ".project.json");
-  if (!existsSync15(path)) return null;
+  const path = join19(repo, ".project.json");
+  if (!existsSync16(path)) return null;
   try {
-    const parsed = JSON.parse(readFileSync12(path, "utf8"));
+    const parsed = JSON.parse(readFileSync16(path, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
     const notebook = parsed.notebook;
     return notebook && typeof notebook === "object" && !Array.isArray(notebook) ? notebook : null;
@@ -12484,8 +13178,8 @@ init_notes();
 init_git_evidence();
 init_types();
 import { spawnSync as spawnSync10 } from "node:child_process";
-import { realpathSync as realpathSync6 } from "node:fs";
-import { relative as relative9, resolve as resolve10, sep as sep5 } from "node:path";
+import { realpathSync as realpathSync7 } from "node:fs";
+import { relative as relative10, resolve as resolve10, sep as sep5 } from "node:path";
 var DEFAULT_OVERVIEW_REFERENCES = [".project.json", "README.md", "AGENTS.md", "CLAUDE.md", "docs/architecture.md"];
 function git2(repo, args, timeout) {
   const result2 = spawnSync10("git", args, { cwd: repo, encoding: "utf8", maxBuffer: 1024 * 1024, timeout, shell: false });
@@ -12493,9 +13187,9 @@ function git2(repo, args, timeout) {
 }
 function normalizedReference(repo, value) {
   if (!value || value.includes("\0") || value.startsWith("/") || value.split(/[\\/]/u).includes("..")) throw new NotebookError("INVALID_INPUT", `Overview reference is not a contained relative path: ${value}`);
-  const root = realpathSync6(repo);
+  const root = realpathSync7(repo);
   const candidate = resolve10(root, value);
-  const rel = relative9(root, candidate).split(sep5).join("/");
+  const rel = relative10(root, candidate).split(sep5).join("/");
   if (!rel || rel === ".." || rel.startsWith("../")) throw new NotebookError("INVALID_INPUT", `Overview reference escapes the repository: ${value}`);
   return rel.normalize("NFC");
 }
@@ -12621,44 +13315,21 @@ init_reconcile();
 init_config();
 
 // src/notebook/hooks.ts
-import { spawn, spawnSync as spawnSync11 } from "node:child_process";
-import { createHash as createHash7, randomUUID as randomUUID5 } from "node:crypto";
-import { chmodSync as chmodSync4, closeSync as closeSync6, constants as constants5, copyFileSync as copyFileSync3, existsSync as existsSync16, fstatSync as fstatSync4, fsyncSync as fsyncSync4, lstatSync as lstatSync9, mkdirSync as mkdirSync7, openSync as openSync6, readFileSync as readFileSync14, readSync as readSync3, readdirSync as readdirSync7, realpathSync as realpathSync7, renameSync as renameSync5, rmSync as rmSync3, symlinkSync as symlinkSync2, unlinkSync as unlinkSync6, writeFileSync as writeFileSync10 } from "node:fs";
-import { basename as basename7, dirname as dirname10, isAbsolute as isAbsolute3, join as join20, parse as parse3, relative as relative10, resolve as resolve11, sep as sep6 } from "node:path";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
-
-// src/utils/version.ts
-import { readFileSync as readFileSync13 } from "node:fs";
-import { dirname as dirname9, join as join19 } from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
-var PJANGLER_VERSION = (() => {
-  try {
-    let dir = dirname9(fileURLToPath4(import.meta.url));
-    for (let i = 0; i < 4; i++) {
-      try {
-        const raw = readFileSync13(join19(dir, "package.json"), "utf8");
-        return JSON.parse(raw).version ?? "0.0.0";
-      } catch {
-        const parent = dirname9(dir);
-        if (parent === dir) break;
-        dir = parent;
-      }
-    }
-  } catch {
-  }
-  return "0.0.0";
-})();
-
-// src/notebook/hooks.ts
+init_version();
 init_git_evidence();
 init_notes();
 init_state();
 init_types();
+import { spawn, spawnSync as spawnSync11 } from "node:child_process";
+import { createHash as createHash7, randomUUID as randomUUID5 } from "node:crypto";
+import { chmodSync as chmodSync4, closeSync as closeSync6, constants as constants5, copyFileSync as copyFileSync3, existsSync as existsSync17, fstatSync as fstatSync4, fsyncSync as fsyncSync4, lstatSync as lstatSync11, mkdirSync as mkdirSync7, openSync as openSync6, readFileSync as readFileSync17, readSync as readSync3, readdirSync as readdirSync8, realpathSync as realpathSync8, renameSync as renameSync6, rmSync as rmSync4, symlinkSync as symlinkSync2, unlinkSync as unlinkSync5, writeFileSync as writeFileSync10 } from "node:fs";
+import { basename as basename8, dirname as dirname10, isAbsolute as isAbsolute3, join as join22, parse as parse3, relative as relative11, resolve as resolve11, sep as sep6 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 function bundledSkillCandidates() {
   const candidates = [];
   let cursor = dirname10(fileURLToPath5(import.meta.url));
   for (let depth = 0; depth < 8; depth++) {
-    candidates.push(join20(cursor, "dist", "assets", "project-notebook-skill"), join20(cursor, "assets", "project-notebook-skill"));
+    candidates.push(join22(cursor, "dist", "assets", "project-notebook-skill"), join22(cursor, "assets", "project-notebook-skill"));
     const parent = dirname10(cursor);
     if (parent === cursor) break;
     cursor = parent;
@@ -12676,13 +13347,13 @@ function assertOwnedSkillTree(source) {
   assertNoSymlinkComponents2(source);
   const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
   const walk = (directory) => {
-    const directoryStat = lstatSync9(directory);
+    const directoryStat = lstatSync11(directory);
     if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) throw new NotebookError("CONFLICT", "Project Notebook skill source contains a non-directory component");
     if (uid !== void 0 && directoryStat.uid !== uid) throw new NotebookError("CONFLICT", "Project Notebook skill source is not owned by the current user");
     if (directoryStat.mode & 3586) throw new NotebookError("CONFLICT", "Project Notebook skill source has unsafe directory mode bits");
-    for (const entry of readdirSync7(directory, { withFileTypes: true })) {
-      const path = join20(directory, entry.name);
-      const stat = lstatSync9(path);
+    for (const entry of readdirSync8(directory, { withFileTypes: true })) {
+      const path = join22(directory, entry.name);
+      const stat = lstatSync11(path);
       if (stat.isSymbolicLink()) throw new NotebookError("CONFLICT", "Project Notebook skill source contains a symlink");
       if (entry.isDirectory()) walk(path);
       else if (!entry.isFile()) throw new NotebookError("CONFLICT", "Project Notebook skill source contains a non-regular entry");
@@ -12697,17 +13368,17 @@ function assertOwnedSkillTree(source) {
 function enumerateSkillPayload(source) {
   const result2 = [];
   const walk = (directory) => {
-    for (const entry of readdirSync7(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name, "en"))) {
-      const path = join20(directory, entry.name);
-      const rel = relative10(source, path).split(sep6).join("/");
+    for (const entry of readdirSync8(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name, "en"))) {
+      const path = join22(directory, entry.name);
+      const rel = relative11(source, path).split(sep6).join("/");
       if (!rel.includes("/") && (rel === "export-manifest.json" || rel === "SHA256SUMS" || rel === ".source.yaml")) continue;
       if (!safeSkillRelativePath(rel)) throw new NotebookError("CONFLICT", `Project Notebook skill export path is unsafe: ${rel}`);
-      const stat = lstatSync9(path);
+      const stat = lstatSync11(path);
       if (stat.isSymbolicLink()) throw new NotebookError("CONFLICT", "Project Notebook skill export contains a symlink");
       if (entry.isDirectory()) walk(path);
       else if (entry.isFile()) {
         const expectedMode = rel.endsWith(".sh") || rel.startsWith("scripts/") ? "0755" : "0644";
-        result2.push({ path: rel, sha256: createHash7("sha256").update(readFileSync14(path)).digest("hex"), mode: expectedMode });
+        result2.push({ path: rel, sha256: createHash7("sha256").update(readFileSync17(path)).digest("hex"), mode: expectedMode });
       } else throw new NotebookError("CONFLICT", "Project Notebook skill export contains a non-regular entry");
     }
   };
@@ -12715,9 +13386,9 @@ function enumerateSkillPayload(source) {
   return result2.sort((a, b) => a.path.localeCompare(b.path, "en"));
 }
 function parsePackedManifest(source) {
-  const manifestPath = join20(source, "export-manifest.json");
-  if (!existsSync16(manifestPath)) return null;
-  const value = JSON.parse(readFileSync14(manifestPath, "utf8"));
+  const manifestPath = join22(source, "export-manifest.json");
+  if (!existsSync17(manifestPath)) return null;
+  const value = JSON.parse(readFileSync17(manifestPath, "utf8"));
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new NotebookError("CONFLICT", "Project Notebook skill export manifest is invalid");
   const manifest = value;
   if (manifest.schema_version !== 1 || manifest.skill !== "project-notebook" || !Array.isArray(manifest.files)) throw new NotebookError("CONFLICT", "Project Notebook skill export manifest is incompatible");
@@ -12726,10 +13397,10 @@ function parsePackedManifest(source) {
     if (!entry || typeof entry.path !== "string" || !/^[a-f0-9]{64}$/u.test(entry.sha256) || !/^(?:0644|0755)$/u.test(entry.mode)) throw new NotebookError("CONFLICT", "Project Notebook skill export entry is invalid");
     if (!safeSkillRelativePath(entry.path) || paths.has(entry.path)) throw new NotebookError("CONFLICT", "Project Notebook skill export path is unsafe or duplicated");
     paths.add(entry.path);
-    const path = join20(source, ...entry.path.split("/"));
-    const stat = lstatSync9(path);
+    const path = join22(source, ...entry.path.split("/"));
+    const stat = lstatSync11(path);
     if (!stat.isFile() || stat.isSymbolicLink()) throw new NotebookError("CONFLICT", "Project Notebook skill export contains a non-regular entry");
-    const actual = createHash7("sha256").update(readFileSync14(path)).digest("hex");
+    const actual = createHash7("sha256").update(readFileSync17(path)).digest("hex");
     if (actual !== entry.sha256) throw new NotebookError("CONFLICT", `Project Notebook skill digest mismatch: ${entry.path}`);
     const actualMode = stat.mode & 511;
     const executable = entry.mode === "0755";
@@ -12741,12 +13412,12 @@ function parsePackedManifest(source) {
   if (JSON.stringify(actualPaths) !== JSON.stringify(manifest.files.map((entry) => entry.path))) throw new NotebookError("CONFLICT", "Project Notebook skill manifest does not exactly enumerate its payload");
   const sums = `${manifest.files.map((entry) => `${entry.sha256}  ${entry.path}`).join("\n")}
 `;
-  if (!existsSync16(join20(source, "SHA256SUMS")) || readFileSync14(join20(source, "SHA256SUMS"), "utf8") !== sums) throw new NotebookError("CONFLICT", "Project Notebook skill SHA256SUMS is missing or stale");
+  if (!existsSync17(join22(source, "SHA256SUMS")) || readFileSync17(join22(source, "SHA256SUMS"), "utf8") !== sums) throw new NotebookError("CONFLICT", "Project Notebook skill SHA256SUMS is missing or stale");
   return manifest;
 }
 function expectedPackedSkill() {
   for (const candidate of bundledSkillCandidates()) {
-    if (!existsSync16(join20(candidate, "export-manifest.json"))) continue;
+    if (!existsSync17(join22(candidate, "export-manifest.json"))) continue;
     assertOwnedSkillTree(candidate);
     const manifest = parsePackedManifest(candidate);
     if (!manifest) continue;
@@ -12813,13 +13484,13 @@ function verifyProjectNotebookSkillExport(source) {
 function resolveProjectNotebookSkillSource(env2 = process.env) {
   if (env2.PJ_PROJECT_NOTEBOOK_SKILL_ROOT) {
     const explicit = resolve11(env2.PJ_PROJECT_NOTEBOOK_SKILL_ROOT);
-    if (!existsSync16(join20(explicit, "SKILL.md"))) throw new NotebookError("NOT_CONFIGURED", "Configured Project Notebook skill source is unavailable");
+    if (!existsSync17(join22(explicit, "SKILL.md"))) throw new NotebookError("NOT_CONFIGURED", "Configured Project Notebook skill source is unavailable");
     verifyProjectNotebookSkillExport(explicit);
     return explicit;
   }
   if (env2.PJ_SKILLS_REGISTRY_ROOT) {
     const canonical = resolve11(env2.PJ_SKILLS_REGISTRY_ROOT, "all-skills", "project-notebook");
-    if (existsSync16(join20(canonical, "SKILL.md"))) {
+    if (existsSync17(join22(canonical, "SKILL.md"))) {
       verifyProjectNotebookSkillExport(canonical);
       return canonical;
     }
@@ -12834,7 +13505,7 @@ var REPAIR_COMMAND = "pj notebook skill --apply";
 function probeCanonicalSkillexRootProjection(skillsRoot, link) {
   let rootLink;
   try {
-    rootLink = lstatSync9(skillsRoot);
+    rootLink = lstatSync11(skillsRoot);
   } catch (error) {
     if (error.code === "ENOENT") return { state: "absent" };
     throw error;
@@ -12845,21 +13516,21 @@ function probeCanonicalSkillexRootProjection(skillsRoot, link) {
     assertNoSymlinkComponents2(dirname10(skillsRoot));
     const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
     if (uid !== void 0 && rootLink.uid !== uid) throw new Error("owner");
-    const globalRoot = realpathSync7(skillsRoot);
+    const globalRoot = realpathSync8(skillsRoot);
     assertNoSymlinkComponents2(globalRoot);
-    const globalStat = lstatSync9(globalRoot);
+    const globalStat = lstatSync11(globalRoot);
     if (!globalStat.isDirectory() || globalStat.isSymbolicLink()) throw new Error("root-type");
     if (uid !== void 0 && globalStat.uid !== uid) throw new Error("root-owner");
     if (globalStat.mode & 3586) throw new Error("root-mode");
     const skillSetsRoot = dirname10(globalRoot);
-    if (basename7(globalRoot) !== "global" || basename7(skillSetsRoot) !== "skill-sets") throw new Error("layout");
+    if (basename8(globalRoot) !== "global" || basename8(skillSetsRoot) !== "skill-sets") throw new Error("layout");
     const checkoutRoot = dirname10(skillSetsRoot);
-    const expectedSource = join20(checkoutRoot, "all-skills", "project-notebook");
-    const linkStat = lstatSync9(link);
+    const expectedSource = join22(checkoutRoot, "all-skills", "project-notebook");
+    const linkStat = lstatSync11(link);
     if (!linkStat.isSymbolicLink()) throw new Error("projection-type");
     if (uid !== void 0 && linkStat.uid !== uid) throw new Error("projection-owner");
-    const projectedSource = realpathSync7(link);
-    if (projectedSource !== realpathSync7(expectedSource)) throw new Error("projection-target");
+    const projectedSource = realpathSync8(link);
+    if (projectedSource !== realpathSync8(expectedSource)) throw new Error("projection-target");
     if (!isVerifiedCanonicalSkillexProjection(projectedSource)) {
       return {
         state: "declined",
@@ -12892,27 +13563,27 @@ function installPackagedProjectNotebookSkill(input = {}) {
   const digest = createHash7("sha256").update(JSON.stringify(manifest)).digest("hex");
   const home = env2.HOME;
   if (!home || !resolve11(home).startsWith("/")) throw new NotebookError("NOT_CONFIGURED", "A trusted HOME is required to install the Project Notebook skill");
-  const skillsRoot = join20(home, ".agents", "skills");
-  const link = join20(skillsRoot, "project-notebook");
+  const skillsRoot = join22(home, ".agents", "skills");
+  const link = join22(skillsRoot, "project-notebook");
   const probe = probeCanonicalSkillexRootProjection(skillsRoot, link);
   if (probe.state === "adopted") return { installed: false, path: link, digest };
   if (probe.state === "declined") return { installed: false, path: link, digest, blocked: probe.block };
-  const dataRoot = resolve11(env2.XDG_DATA_HOME || join20(home, ".local", "share"), "pjangler", "skills", "project-notebook");
-  const payload = join20(dataRoot, `${PJANGLER_VERSION}-${digest}`);
+  const dataRoot = resolve11(env2.XDG_DATA_HOME || join22(home, ".local", "share"), "pjangler", "skills", "project-notebook");
+  const payload = join22(dataRoot, `${PJANGLER_VERSION}-${digest}`);
   assertNoSymlinkComponents2(dirname10(dataRoot), true);
   mkdirSync7(dataRoot, { recursive: true, mode: 448 });
   assertNoSymlinkComponents2(dataRoot);
-  const dataStat = lstatSync9(dataRoot);
+  const dataStat = lstatSync11(dataRoot);
   if (!dataStat.isDirectory() || dataStat.isSymbolicLink() || typeof process.getuid === "function" && dataStat.uid !== process.getuid()) throw new NotebookError("CONFLICT", "Project Notebook skill data root is not a current-user directory");
   chmodSync4(dataRoot, 448);
-  if (!existsSync16(payload)) {
-    const staging = join20(dataRoot, `.staging-${randomUUID5()}`);
+  if (!existsSync17(payload)) {
+    const staging = join22(dataRoot, `.staging-${randomUUID5()}`);
     mkdirSync7(staging, { recursive: false, mode: 448 });
     try {
       for (const entry of manifest.files) {
-        const destination = join20(staging, ...entry.path.split("/"));
+        const destination = join22(staging, ...entry.path.split("/"));
         mkdirSync7(dirname10(destination), { recursive: true, mode: 493 });
-        copyFileSync3(join20(source, ...entry.path.split("/")), destination);
+        copyFileSync3(join22(source, ...entry.path.split("/")), destination);
         const mode = entry.mode === "0755" ? 493 : 420;
         chmodSync4(destination, mode);
         const fd = openSync6(destination, constants5.O_RDONLY | (constants5.O_NOFOLLOW ?? 0));
@@ -12924,27 +13595,27 @@ function installPackagedProjectNotebookSkill(input = {}) {
           closeSync6(fd);
         }
       }
-      writeFileSync10(join20(staging, "export-manifest.json"), `${JSON.stringify(manifest, null, 2)}
+      writeFileSync10(join22(staging, "export-manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `, { mode: 420, flag: "wx" });
-      writeFileSync10(join20(staging, "SHA256SUMS"), `${manifest.files.map((entry) => `${entry.sha256}  ${entry.path}`).join("\n")}
+      writeFileSync10(join22(staging, "SHA256SUMS"), `${manifest.files.map((entry) => `${entry.sha256}  ${entry.path}`).join("\n")}
 `, { mode: 420, flag: "wx" });
       verifyProjectNotebookSkillExport(staging);
-      renameSync5(staging, payload);
+      renameSync6(staging, payload);
     } finally {
-      if (existsSync16(staging)) rmSync3(staging, { recursive: true, force: true });
+      if (existsSync17(staging)) rmSync4(staging, { recursive: true, force: true });
     }
   } else {
-    const stat = lstatSync9(payload);
+    const stat = lstatSync11(payload);
     if (!stat.isDirectory() || stat.isSymbolicLink()) throw new NotebookError("CONFLICT", "Installed Project Notebook payload is not a real directory");
     verifyProjectNotebookSkillExport(payload);
   }
   assertNoSymlinkComponents2(skillsRoot, true);
   mkdirSync7(skillsRoot, { recursive: true, mode: 448 });
   assertNoSymlinkComponents2(skillsRoot);
-  let linkExists = existsSync16(link);
+  let linkExists = existsSync17(link);
   if (!linkExists) {
     try {
-      lstatSync9(link);
+      lstatSync11(link);
       linkExists = true;
     } catch {
     }
@@ -12961,10 +13632,10 @@ function installPackagedProjectNotebookSkill(input = {}) {
         repair: REPAIR_COMMAND
       }
     });
-    const stat = lstatSync9(link);
+    const stat = lstatSync11(link);
     if (!stat.isSymbolicLink()) return foreign(["the path is a real file or directory, not a PJ\xE1ngler-owned link"]);
-    const target = realpathSync7(link);
-    if (target !== realpathSync7(payload) && !isVerifiedCanonicalSkillexProjection(target)) {
+    const target = realpathSync8(link);
+    if (target !== realpathSync8(payload) && !isVerifiedCanonicalSkillexProjection(target)) {
       return foreign(isCanonicalSkillexProjectionPath(target) ? describeProjectNotebookSkillDrift(target) : [`the link targets ${target}, which is neither the pinned payload nor a canonical Skillex projection`]);
     }
     try {
@@ -12982,25 +13653,25 @@ function collectSupersededPayloads(dataRoot, keep) {
   const kept = /* @__PURE__ */ new Set();
   for (const path of keep) {
     try {
-      kept.add(realpathSync7(path));
+      kept.add(realpathSync8(path));
     } catch {
     }
   }
   const removed = [];
   let entries;
   try {
-    entries = readdirSync7(dataRoot);
+    entries = readdirSync8(dataRoot);
   } catch {
     return removed;
   }
   for (const name of entries) {
     if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?-[0-9a-f]{64}$/u.test(name)) continue;
-    const candidate = join20(dataRoot, name);
+    const candidate = join22(dataRoot, name);
     try {
-      const stat = lstatSync9(candidate);
+      const stat = lstatSync11(candidate);
       if (!stat.isDirectory() || stat.isSymbolicLink()) continue;
-      if (kept.has(realpathSync7(candidate))) continue;
-      rmSync3(candidate, { recursive: true, force: true });
+      if (kept.has(realpathSync8(candidate))) continue;
+      rmSync4(candidate, { recursive: true, force: true });
       removed.push(candidate);
     } catch {
     }
@@ -13011,8 +13682,8 @@ function repairProjectNotebookSkillProjection(input = {}) {
   const env2 = input.env ?? process.env;
   const home = env2.HOME;
   if (!home || !resolve11(home).startsWith("/")) throw new NotebookError("NOT_CONFIGURED", "A trusted HOME is required to repair the Project Notebook skill projection");
-  const skillsRoot = join20(home, ".agents", "skills");
-  const link = join20(skillsRoot, "project-notebook");
+  const skillsRoot = join22(home, ".agents", "skills");
+  const link = join22(skillsRoot, "project-notebook");
   const probe = probeCanonicalSkillexRootProjection(skillsRoot, link);
   if (probe.state === "adopted") return { status: "clean", summary: "Canonical Skillex projection already matches the version-pinned export", source: probe.source, drift: [], changed_files: [] };
   if (probe.state !== "declined") {
@@ -13025,9 +13696,9 @@ function repairProjectNotebookSkillProjection(input = {}) {
   assertOwnedSkillTree(source);
   const present = [];
   const walk = (directory) => {
-    for (const entry of readdirSync7(directory, { withFileTypes: true })) {
-      const path = join20(directory, entry.name);
-      const rel = relative10(source, path).split(sep6).join("/");
+    for (const entry of readdirSync8(directory, { withFileTypes: true })) {
+      const path = join22(directory, entry.name);
+      const rel = relative11(source, path).split(sep6).join("/");
       if (entry.isDirectory()) {
         walk(path);
         continue;
@@ -13040,11 +13711,11 @@ function repairProjectNotebookSkillProjection(input = {}) {
   walk(source);
   const stale = present.filter((rel) => !wanted.has(rel)).sort();
   const changed = expected.manifest.files.filter((entry) => {
-    const path = join20(source, ...entry.path.split("/"));
-    if (!existsSync16(path)) return true;
-    const stat = lstatSync9(path);
+    const path = join22(source, ...entry.path.split("/"));
+    if (!existsSync17(path)) return true;
+    const stat = lstatSync11(path);
     if (!stat.isFile()) return true;
-    if (createHash7("sha256").update(readFileSync14(path)).digest("hex") !== entry.sha256) return true;
+    if (createHash7("sha256").update(readFileSync17(path)).digest("hex") !== entry.sha256) return true;
     const mode = stat.mode & 511;
     const executable = entry.mode === "0755";
     return executable && (mode & 64) === 0 || !executable && (mode & 73) !== 0;
@@ -13059,15 +13730,15 @@ function repairProjectNotebookSkillProjection(input = {}) {
       summary: `Would restore ${affected.length} file(s) in ${source} from the version-pinned export`,
       source,
       drift: probe.block.details,
-      changed_files: affected.map((rel) => join20(source, ...rel.split("/")))
+      changed_files: affected.map((rel) => join22(source, ...rel.split("/")))
     };
   }
-  for (const rel of stale) rmSync3(join20(source, ...rel.split("/")), { force: true });
+  for (const rel of stale) rmSync4(join22(source, ...rel.split("/")), { force: true });
   for (const rel of changed) {
-    const destination = join20(source, ...rel.split("/"));
+    const destination = join22(source, ...rel.split("/"));
     const entry = expected.manifest.files.find((item) => item.path === rel);
     mkdirSync7(dirname10(destination), { recursive: true, mode: 493 });
-    copyFileSync3(join20(expected.source, ...rel.split("/")), destination);
+    copyFileSync3(join22(expected.source, ...rel.split("/")), destination);
     chmodSync4(destination, entry.mode === "0755" ? 493 : 420);
   }
   verifyProjectNotebookSkillExport(source);
@@ -13076,21 +13747,21 @@ function repairProjectNotebookSkillProjection(input = {}) {
     summary: `Restored ${affected.length} file(s) in ${source} from the version-pinned export; commit the change in the Skillex checkout`,
     source,
     drift: probe.block.details,
-    changed_files: affected.map((rel) => join20(source, ...rel.split("/")))
+    changed_files: affected.map((rel) => join22(source, ...rel.split("/")))
   };
 }
 function inspectProjectNotebookIntegration(env2 = process.env) {
   const home = env2.HOME;
   if (!home) return { skill_installed: false, hooks_projected: false, details: ["HOME is unavailable"] };
-  const skillsRoot = join20(home, ".agents", "skills");
-  const link = join20(skillsRoot, "project-notebook");
+  const skillsRoot = join22(home, ".agents", "skills");
+  const link = join22(skillsRoot, "project-notebook");
   try {
     const expected = expectedPackedSkill();
-    const dataRoot = resolve11(env2.XDG_DATA_HOME || join20(home, ".local", "share"), "pjangler", "skills", "project-notebook");
-    const expectedPayload = join20(dataRoot, `${PJANGLER_VERSION}-${expected.digest}`);
+    const dataRoot = resolve11(env2.XDG_DATA_HOME || join22(home, ".local", "share"), "pjangler", "skills", "project-notebook");
+    const expectedPayload = join22(dataRoot, `${PJANGLER_VERSION}-${expected.digest}`);
     const probe = probeCanonicalSkillexRootProjection(skillsRoot, link);
     if (probe.state === "declined") return { skill_installed: false, hooks_projected: false, details: probe.block.details, blocked: probe.block };
-    const stat = lstatSync9(link);
+    const stat = lstatSync11(link);
     if (!stat.isSymbolicLink()) {
       return {
         skill_installed: false,
@@ -13099,8 +13770,8 @@ function inspectProjectNotebookIntegration(env2 = process.env) {
         blocked: { code: "projection-foreign", summary: `${link} is not a PJ\xE1ngler-owned link`, details: ["the path is a real file or directory"], repair: REPAIR_COMMAND }
       };
     }
-    const source = realpathSync7(link);
-    const packedPayloadMatches = existsSync16(expectedPayload) && source === realpathSync7(expectedPayload);
+    const source = realpathSync8(link);
+    const packedPayloadMatches = existsSync17(expectedPayload) && source === realpathSync8(expectedPayload);
     if (!packedPayloadMatches && !isVerifiedCanonicalSkillexProjection(source)) {
       const details = isCanonicalSkillexProjectionPath(source) ? describeProjectNotebookSkillDrift(source) : [`the link targets ${source}, which is neither the version-pinned payload nor a canonical Skillex projection`];
       return {
@@ -13127,8 +13798,8 @@ function inspectProjectNotebookIntegration(env2 = process.env) {
   }
 }
 function projectorArguments(source, command, input) {
-  const script = join20(source, "scripts", "project-hooks.py");
-  const args = [script, command, "--master", join20(source, "hooks", "hooks.master.json"), "--fragment", join20(source, "hooks", "claude.settings.json"), "--target", input.target];
+  const script = join22(source, "scripts", "project-hooks.py");
+  const args = [script, command, "--master", join22(source, "hooks", "hooks.master.json"), "--fragment", join22(source, "hooks", "claude.settings.json"), "--target", input.target];
   if (command === "check") args.push("--json");
   else if (input.stateHome) args.push("--state-home", input.stateHome);
   return args;
@@ -13150,7 +13821,7 @@ function checkProjectNotebookHooks(input = {}) {
   verifyProjectNotebookSkillExport(source);
   const home = env2.HOME;
   if (!home) throw new NotebookError("NOT_CONFIGURED", "HOME is required to check Project Notebook hooks");
-  const target = resolve11(input.target ?? env2.PJ_PROJECT_NOTEBOOK_CLAUDE_SETTINGS ?? join20(home, ".claude", "settings.json"));
+  const target = resolve11(input.target ?? env2.PJ_PROJECT_NOTEBOOK_CLAUDE_SETTINGS ?? join22(home, ".claude", "settings.json"));
   const result2 = spawnSync11("/usr/bin/python3", ["-I", ...projectorArguments(source, "check", { target })], { encoding: "utf8", env: projectorEnvironment(env2), timeout: 5e3, maxBuffer: 1048576 });
   if (result2.status !== 0 && result2.status !== 1) throw new NotebookError("CONFLICT", (result2.stderr || "Project Notebook projector check failed").trim().slice(0, 512));
   try {
@@ -13165,17 +13836,17 @@ function installProjectNotebookIntegration(input = {}) {
   const env2 = input.env ?? process.env;
   const skill = installPackagedProjectNotebookSkill({ source: input.source, env: env2 });
   if (skill.blocked) return { skill, hooksChanged: false, blocked: skill.blocked };
-  const source = realpathSync7(skill.path);
+  const source = realpathSync8(skill.path);
   const home = env2.HOME;
   if (!home) throw new NotebookError("NOT_CONFIGURED", "HOME is required to install Project Notebook hooks");
-  const target = resolve11(input.target ?? env2.PJ_PROJECT_NOTEBOOK_CLAUDE_SETTINGS ?? join20(home, ".claude", "settings.json"));
-  const stateHome = resolve11(env2.XDG_STATE_HOME || join20(home, ".local", "state"));
+  const target = resolve11(input.target ?? env2.PJ_PROJECT_NOTEBOOK_CLAUDE_SETTINGS ?? join22(home, ".claude", "settings.json"));
+  const stateHome = resolve11(env2.XDG_STATE_HOME || join22(home, ".local", "state"));
   const result2 = spawnSync11("/usr/bin/python3", ["-I", ...projectorArguments(source, "install", { target, stateHome })], { encoding: "utf8", env: projectorEnvironment(env2), timeout: 5e3, maxBuffer: 1048576 });
   if (result2.status !== 0) {
     if (skill.installed) {
       try {
-        const stat = lstatSync9(skill.path);
-        if (stat.isSymbolicLink() && realpathSync7(skill.path) === source) unlinkSync6(skill.path);
+        const stat = lstatSync11(skill.path);
+        if (stat.isSymbolicLink() && realpathSync8(skill.path) === source) unlinkSync5(skill.path);
       } catch {
       }
     }
@@ -13192,10 +13863,10 @@ function assertNoSymlinkComponents2(path, allowMissing = false) {
   const root = parse3(absolute).root;
   let cursor = root;
   for (const component of absolute.slice(root.length).split(sep6).filter(Boolean)) {
-    cursor = join20(cursor, component);
+    cursor = join22(cursor, component);
     let stat;
     try {
-      stat = lstatSync9(cursor);
+      stat = lstatSync11(cursor);
     } catch (error) {
       if (allowMissing && error.code === "ENOENT") return;
       throw error;
@@ -13281,13 +13952,13 @@ async function prepareNotebookObservationResolved(module, resolved, config, loca
       health: healthy ? "healthy" : "drifted",
       notebook_check: notebookCheck,
       notebook,
-      scoped_notes: notes.map((note2) => ({
-        id: note2.id,
-        title: note2.title,
-        note_type: note2.note_type,
-        created_at: note2.created_at,
-        updated_at: note2.updated_at,
-        envelope_logical_id: parseNoteEnvelope(note2.content)?.envelope.logical_id ?? null
+      scoped_notes: notes.map((note) => ({
+        id: note.id,
+        title: note.title,
+        note_type: note.note_type,
+        created_at: note.created_at,
+        updated_at: note.updated_at,
+        envelope_logical_id: parseNoteEnvelope(note.content)?.envelope.logical_id ?? null
       })),
       overview,
       error: null
@@ -13350,9 +14021,9 @@ function ensureFinalNoteContent(value, maxBytes) {
   return value;
 }
 function getScoped(notes, noteId) {
-  const note2 = notes.find((item) => item.id === noteId);
-  if (!note2) throw new NotebookError("NOT_FOUND", `Note is not a proven member of this project notebook: ${noteId}`);
-  return note2;
+  const note = notes.find((item) => item.id === noteId);
+  if (!note) throw new NotebookError("NOT_FOUND", `Note is not a proven member of this project notebook: ${noteId}`);
+  return note;
 }
 var NotebookModule = class {
   registryPath;
@@ -13564,8 +14235,8 @@ var NotebookModule = class {
   async deleteNote(repo, noteId, confirmed) {
     if (!confirmed) throw new NotebookError("INVALID_INPUT", "Note deletion requires confirmation or --yes");
     const { ctx, notes, notebookId } = await this.scoped(repo);
-    const note2 = getScoped(notes, noteId);
-    const parsed = parseNoteEnvelope(note2.content);
+    const note = getScoped(notes, noteId);
+    const parsed = parseNoteEnvelope(note.content);
     if (parsed && parsed.envelope.project_slug !== ctx.config.project_slug) throw new NotebookError("CROSS_PROJECT", "Managed note envelope belongs to a different project");
     if (noteId === ctx.config.binding.overview_note_id || parsed?.envelope.kind === "overview") throw new NotebookError("CONFLICT", "The stable Project Overview note cannot be deleted");
     await ctx.client.deleteOwnedNote(notebookId, noteId);
@@ -13674,17 +14345,17 @@ init_remote_mutation_journal();
 function integrationEnvironment(module, ctx) {
   const env2 = { ...module.environment, HOME: ctx.homeDir };
   if (module.environment.HOME !== ctx.homeDir) {
-    env2.XDG_DATA_HOME = join21(ctx.homeDir, ".local", "share");
-    env2.XDG_STATE_HOME = join21(ctx.homeDir, ".local", "state");
-    env2.PJ_PROJECT_NOTEBOOK_CLAUDE_SETTINGS = join21(ctx.homeDir, ".claude", "settings.json");
+    env2.XDG_DATA_HOME = join23(ctx.homeDir, ".local", "share");
+    env2.XDG_STATE_HOME = join23(ctx.homeDir, ".local", "state");
+    env2.PJ_PROJECT_NOTEBOOK_CLAUDE_SETTINGS = join23(ctx.homeDir, ".claude", "settings.json");
   }
   return env2;
 }
 function resolvedForPlan(plan) {
-  const manifestPath = join21(plan.project.repo_path, ".project.json");
+  const manifestPath = join23(plan.project.repo_path, ".project.json");
   let manifest = plan.manifest;
-  if (existsSync17(manifestPath)) {
-    const parsed = JSON.parse(readFileSync15(manifestPath, "utf8"));
+  if (existsSync18(manifestPath)) {
+    const parsed = JSON.parse(readFileSync18(manifestPath, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${manifestPath} must contain a JSON object`);
     manifest = parsed;
   }
@@ -13845,7 +14516,7 @@ function unsafeToRemove(targetDir) {
   while (!seen.has(cursor)) {
     seen.add(cursor);
     try {
-      const stat = lstatSync10(cursor);
+      const stat = lstatSync12(cursor);
       if (stat.isSymbolicLink()) {
         return cursor === absolute ? `${absolute} is a symlink; removing it would leave the tree it points at orphaned` : `${cursor} is a symlink on the path to ${absolute}; a recursive remove would traverse it`;
       }
@@ -13873,12 +14544,12 @@ function publicMigration(report) {
   };
 }
 function hasGitRepository(runtime, targetDir) {
-  if (!existsSync18(join22(targetDir, ".git"))) return false;
+  if (!existsSync19(join24(targetDir, ".git"))) return false;
   return runtime.runGit(targetDir, ["rev-parse", "--is-inside-work-tree"]).status === 0;
 }
 function refreshPlanFromCanonicalManifest(plan) {
-  const manifestPath = join22(plan.project.repo_path, ".project.json");
-  const manifest = JSON.parse(readFileSync16(manifestPath, "utf8"));
+  const manifestPath = join24(plan.project.repo_path, ".project.json");
+  const manifest = JSON.parse(readFileSync19(manifestPath, "utf8"));
   if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
     throw new Error(`${manifestPath} must contain a JSON object`);
   }
@@ -13898,12 +14569,25 @@ function refreshPlanFromCanonicalManifest(plan) {
   if (!manifestTicket || typeof manifestTicket !== "object") {
     throw new Error(`${manifestPath} ticket_provider is missing`);
   }
+  const manifestIdentifier = String(manifestTicket.identifier ?? "");
+  const manifestBoardId = String(manifestTicket.board_id ?? "");
+  const manifestType = String(manifestTicket.type ?? "");
+  const recorded = plan.project.ticket_provider;
+  const carriesProvenance = (recorded?.identifier ?? "") === manifestIdentifier && (recorded?.board_id ?? "") === manifestBoardId;
+  const identifierSource = (carriesProvenance ? recorded?.identifier_source : void 0) ?? "proposed";
+  const manifestConfirmedAt = typeof manifestTicket.board_confirmed_at === "string" ? manifestTicket.board_confirmed_at.trim() : "";
+  const boardConfirmedAt = manifestConfirmedAt || ((recorded?.board_id ?? "") === manifestBoardId ? recorded?.board_confirmed_at ?? "" : "");
+  const keyIsProven = !providerAssignsIdentifiers(manifestType) || identifierSource === "provider";
+  const manifestState = typeof manifestTicket.state === "string" ? manifestTicket.state : void 0;
   const ticketProvider = {
-    type: String(manifestTicket.type ?? ""),
+    type: manifestType,
     workspace: String(manifestTicket.workspace ?? ""),
-    identifier: String(manifestTicket.identifier ?? ""),
-    board_id: String(manifestTicket.board_id ?? ""),
-    state: manifestTicket.state
+    identifier: manifestIdentifier,
+    identifier_source: identifierSource,
+    ...carriesProvenance && identifierSource === "provider" && recorded?.identifier_fetched_at ? { identifier_fetched_at: recorded.identifier_fetched_at } : {},
+    board_id: manifestBoardId,
+    ...boardConfirmedAt ? { board_confirmed_at: boardConfirmedAt } : {},
+    state: manifestState === "skipped" ? "skipped" : manifestBoardId && boardConfirmedAt && keyIsProven ? "linked" : "planned"
   };
   plan.manifest = manifest;
   plan.project.agents = agents;
@@ -13950,7 +14634,7 @@ var ProjectRecipe = class extends Recipe {
     const logs = [];
     const errors = [];
     const changedFiles = [];
-    const targetExistedAtStart = existsSync18(targetDir);
+    const targetExistedAtStart = existsSync19(targetDir);
     const transactionContext = {
       ...ctx,
       targetDir,
@@ -14039,7 +14723,6 @@ var ProjectRecipe = class extends Recipe {
           force: Boolean(ctx.force),
           skipTelegram: true,
           skipEmail: true,
-          skipRuntimeRepo: agentAction.context.skipRuntimeRepo,
           skipPlane: agentAction.context.skipPlane,
           skipBloodbank: agentAction.context.skipBloodbank,
           skipSystemd: agentAction.context.skipSystemd,
@@ -14113,7 +14796,7 @@ var ProjectRecipe = class extends Recipe {
         if (hasGitRepository(this.runtime, targetDir)) {
           phases.push({ id: "project.git", status: "unchanged", changedFiles: [], message: "Git repository already initialized" });
         } else {
-          const gitPath = join22(targetDir, ".git");
+          const gitPath = join24(targetDir, ".git");
           for (const { args, label, options } of [
             { args: ["init", "--initial-branch=main"], label: "git init" },
             { args: ["add", "-A"], label: "git add" },
@@ -14129,7 +14812,7 @@ var ProjectRecipe = class extends Recipe {
               phases.push({ id: `project.git:${label}`, status: "failed", changedFiles: changedFiles.includes(gitPath) ? [gitPath] : [], message: errors.at(-1) });
               break;
             }
-            if (label === "git init" && existsSync18(gitPath)) changedFiles.push(gitPath);
+            if (label === "git init" && existsSync19(gitPath)) changedFiles.push(gitPath);
             logs.push(`${label}: ok`);
           }
           if (errors.length === 0) {
@@ -14137,7 +14820,7 @@ var ProjectRecipe = class extends Recipe {
             const headReady = repositoryReady && this.runtime.runGit(targetDir, ["rev-parse", "--verify", "HEAD"]).status === 0;
             if (!headReady) {
               errors.push("git postcondition failed: repository or initial commit is missing");
-              phases.push({ id: "project.git:postcondition", status: "failed", changedFiles: existsSync18(gitPath) ? [gitPath] : [], message: errors.at(-1) });
+              phases.push({ id: "project.git:postcondition", status: "failed", changedFiles: existsSync19(gitPath) ? [gitPath] : [], message: errors.at(-1) });
             } else {
               if (!changedFiles.includes(gitPath)) changedFiles.push(gitPath);
               phases.push({ id: "project.git", status: "changed", changedFiles: [gitPath], message: "Git repository initialized and committed" });
@@ -14207,7 +14890,7 @@ var ProjectRecipe = class extends Recipe {
         }
       }
       const deferred = provisionedAgentContext?.deferredExternalEffects;
-      if (errors.length === 0 && deferred?.owner === "project" && (deferred.runtimeRepo || deferred.ticketBoard || deferred.systemd)) {
+      if (errors.length === 0 && deferred?.owner === "project" && (deferred.ticketBoard || deferred.systemd)) {
         externalDispatchStarted = true;
         rollbackEligible = false;
         const beforeExternal = snapshotTree(targetDir);
@@ -14270,7 +14953,7 @@ var ProjectRecipe = class extends Recipe {
         message: errors.at(-1)
       });
     }
-    if (errors.length > 0 && mode === "create" && !targetExistedAtStart && rollbackEligible && existsSync18(targetDir)) {
+    if (errors.length > 0 && mode === "create" && !targetExistedAtStart && rollbackEligible && existsSync19(targetDir)) {
       const unsafe = unsafeToRemove(targetDir);
       if (unsafe) {
         errors.push(`fresh-target rollback refused: ${unsafe}`);
@@ -14281,10 +14964,10 @@ var ProjectRecipe = class extends Recipe {
           message: errors.at(-1)
         });
       } else try {
-        rmSync4(targetDir, { recursive: true, force: true });
+        rmSync5(targetDir, { recursive: true, force: true });
         const insideTarget = (path) => {
-          const relative11 = relativePath(resolve13(targetDir), resolve13(path));
-          return relative11 === "" || !relative11.startsWith("..") && !isAbsolute5(relative11);
+          const relative12 = relativePath(resolve13(targetDir), resolve13(path));
+          return relative12 === "" || !relative12.startsWith("..") && !isAbsolute5(relative12);
         };
         const orphaned = [...new Set(changedFiles.filter((path) => !insideTarget(path)))].sort();
         changedFiles.length = 0;
@@ -14626,8 +15309,8 @@ var recipeRegistry = new RecipeRegistry([
 
 // src/commands/AgentHooksCommands.ts
 import { homedir as homedir8 } from "node:os";
-import { join as join23, dirname as dirname12 } from "node:path";
-import { existsSync as existsSync19, cpSync as cpSync2, mkdirSync as mkdirSync8, readFileSync as readFileSync17, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join25, dirname as dirname12 } from "node:path";
+import { existsSync as existsSync20, cpSync as cpSync2, mkdirSync as mkdirSync8, readFileSync as readFileSync20, writeFileSync as writeFileSync11 } from "node:fs";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 init_project();
 var AGENT_HOOKS_SKIP_MESSAGE = "\u21B7 agent-hooks layer skipped: global ~/.agents/hooks detected (these hooks already run globally).\n   Set PJ_AGENT_HOOKS_LAYER=1 to install the project-scoped layer anyway.";
@@ -14639,16 +15322,16 @@ function resolveTemplateRoot() {
   try {
     let dir = dirname12(fileURLToPath6(import.meta.url));
     for (let i = 0; i < 8; i++) {
-      candidates.push(join23(dir, "templates", "commonproject", "template"));
+      candidates.push(join25(dir, "templates", "commonproject", "template"));
       const parent = dirname12(dir);
       if (parent === dir) break;
       dir = parent;
     }
   } catch {
   }
-  candidates.push(join23(homedir8(), "code", "pjangler", "templates", "commonproject", "template"));
+  candidates.push(join25(homedir8(), "code", "pjangler", "templates", "commonproject", "template"));
   for (const c of candidates) {
-    if (existsSync19(join23(c, ".agents", "hooks", "hooks.master.json"))) return c;
+    if (existsSync20(join25(c, ".agents", "hooks", "hooks.master.json"))) return c;
   }
   throw new Error(
     "Could not locate the CommonProject template. Set PJANGLER_COMMONPROJECT_TEMPLATE to <repo>/templates/commonproject/template."
@@ -14674,10 +15357,10 @@ var CopyAgentHooksTree = class extends Command {
     const created = [];
     const skipped = [];
     for (const { rel, dir } of items) {
-      const src = join23(templateRoot, rel);
-      const dest = join23(this.context.targetDir, rel);
-      if (!existsSync19(src)) continue;
-      if (existsSync19(dest) && !this.context.force) {
+      const src = join25(templateRoot, rel);
+      const dest = join25(this.context.targetDir, rel);
+      if (!existsSync20(src)) continue;
+      if (existsSync20(dest) && !this.context.force) {
         skipped.push(rel);
         continue;
       }
@@ -14703,14 +15386,14 @@ var WireMiseAgentHooks = class _WireMiseAgentHooks extends Command {
     if (!resolveAgentHooksLayer2()) {
       return { success: true, message: this.formatMessage(AGENT_HOOKS_SKIP_MESSAGE) };
     }
-    const misePath = join23(this.context.targetDir, "mise.toml");
-    if (!existsSync19(misePath)) {
+    const misePath = join25(this.context.targetDir, "mise.toml");
+    if (!existsSync20(misePath)) {
       return {
         success: false,
         message: "\u26A0\uFE0F  No mise.toml found \u2014 run `pjangler init mise` first, then re-run."
       };
     }
-    let content = readFileSync17(misePath, "utf8");
+    let content = readFileSync20(misePath, "utf8");
     if (content.includes(_WireMiseAgentHooks.MARKER)) {
       return { success: true, message: this.formatMessage("\u2713 mise.toml already wired for agent-hooks") };
     }
@@ -14910,7 +15593,7 @@ if __name__ == "__main__":
 
 // src/commands/AddMiseCodegraphScript.ts
 import { chmodSync as chmodSync5 } from "fs";
-import { join as join24 } from "path";
+import { join as join26 } from "path";
 var AddMiseCodegraphScript = class extends Command {
   async invoke() {
     const filePath = ".mise/scripts/codegraph.sh";
@@ -14964,7 +15647,7 @@ fi
 `;
     this.writeFile(filePath, content);
     if (!this.context.dryRun) {
-      chmodSync5(join24(this.context.targetDir, filePath), 493);
+      chmodSync5(join26(this.context.targetDir, filePath), 493);
     }
     return {
       success: true,
@@ -15000,14 +15683,14 @@ SECRET_KEY=""
 };
 
 // src/parity/index.ts
-import { existsSync as existsSync20 } from "node:fs";
+import { existsSync as existsSync21 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { dirname as dirname13, join as join25, resolve as resolve14 } from "node:path";
+import { dirname as dirname13, join as join27, resolve as resolve14 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 function resolvePjanglerRoot2() {
   let dir = dirname13(fileURLToPath7(import.meta.url));
   while (dir !== dirname13(dir)) {
-    if (existsSync20(join25(dir, "package.json")) && existsSync20(join25(dir, "templates", "commonproject", "copier.yml"))) return dir;
+    if (existsSync21(join27(dir, "package.json")) && existsSync21(join27(dir, "templates", "commonproject", "copier.yml"))) return dir;
     dir = dirname13(dir);
   }
   return resolve14(process.cwd());
@@ -15169,15 +15852,18 @@ function getRecipeInfo(name) {
   return RECIPE_REGISTRY[name] || null;
 }
 
+// src/mcp-server.ts
+init_version();
+
 // src/describe/index.ts
-import { existsSync as existsSync21, readFileSync as readFileSync18, readdirSync as readdirSync8, statSync as statSync4 } from "node:fs";
-import { join as join27, resolve as resolve15 } from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync21, readdirSync as readdirSync9, statSync as statSync4 } from "node:fs";
+import { join as join29, resolve as resolve15 } from "node:path";
 init_project();
 
 // src/describe/activity.ts
 import { spawn as spawn2, spawnSync as spawnSync14 } from "node:child_process";
 import { statSync as statSync3 } from "node:fs";
-import { join as join26 } from "node:path";
+import { join as join28 } from "node:path";
 var ACTIVE_WINDOW_SECONDS = 24 * 60 * 60;
 var MAX_DIRTY_STATS = 500;
 var GIT_TIMEOUT_MS = 5e3;
@@ -15306,7 +15992,7 @@ function uncommittedSource(repo, paths) {
   let newest = 0;
   for (const path of paths.slice(0, MAX_DIRTY_STATS)) {
     try {
-      const mtime = Math.floor(statSync3(join26(repo, path)).mtimeMs / 1e3);
+      const mtime = Math.floor(statSync3(join28(repo, path)).mtimeMs / 1e3);
       if (mtime > newest) newest = mtime;
     } catch {
     }
@@ -15415,7 +16101,7 @@ var CONFIG_FILES = [
 ];
 function readJson(path) {
   try {
-    const parsed = JSON.parse(readFileSync18(path, "utf8"));
+    const parsed = JSON.parse(readFileSync21(path, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
   } catch {
     return void 0;
@@ -15435,39 +16121,39 @@ function describeType(repo) {
   const languages = [];
   const roles = [];
   const evidence = [];
-  const note2 = (signal, file) => evidence.push(`${signal} (${file})`);
+  const note = (signal, file) => evidence.push(`${signal} (${file})`);
   for (const marker of LANGUAGE_MARKERS) {
-    if (!existsSync21(join27(repo, marker.file))) continue;
+    if (!existsSync22(join29(repo, marker.file))) continue;
     if (!languages.includes(marker.language)) {
       languages.push(marker.language);
-      note2(marker.language, marker.file);
+      note(marker.language, marker.file);
     }
   }
   try {
-    const dotnet = readdirSync8(repo).find((entry) => entry.endsWith(".csproj") || entry.endsWith(".sln"));
+    const dotnet = readdirSync9(repo).find((entry) => entry.endsWith(".csproj") || entry.endsWith(".sln"));
     if (dotnet && !languages.includes("dotnet")) {
       languages.push("dotnet");
-      note2("dotnet", dotnet);
+      note("dotnet", dotnet);
     }
   } catch {
   }
-  const pkg = readJson(join27(repo, "package.json"));
+  const pkg = readJson(join29(repo, "package.json"));
   if (pkg) {
-    if (existsSync21(join27(repo, "tsconfig.json"))) {
+    if (existsSync22(join29(repo, "tsconfig.json"))) {
       const index = languages.indexOf("javascript");
       if (index >= 0) languages.splice(index, 1);
       if (!languages.includes("typescript")) {
         languages.unshift("typescript");
-        note2("typescript", "tsconfig.json");
+        note("typescript", "tsconfig.json");
       }
     }
     if (pkg.bin) {
       roles.push("cli");
-      note2("cli", "package.json#bin");
+      note("cli", "package.json#bin");
     }
     if (pkg.workspaces) {
       roles.push("monorepo");
-      note2("monorepo", "package.json#workspaces");
+      note("monorepo", "package.json#workspaces");
     }
     const dependencies = {
       ...pkg.dependencies,
@@ -15475,7 +16161,7 @@ function describeType(repo) {
     };
     if (Object.keys(dependencies).some((name) => name.startsWith("@modelcontextprotocol/"))) {
       roles.push("mcp-server");
-      note2("mcp-server", "package.json#@modelcontextprotocol");
+      note("mcp-server", "package.json#@modelcontextprotocol");
     }
   }
   const roleMarkers = [
@@ -15487,14 +16173,14 @@ function describeType(repo) {
     ["hermes-fleet-host", "agents/hermes"]
   ];
   for (const [role, marker] of roleMarkers) {
-    if (!existsSync21(join27(repo, marker))) continue;
+    if (!existsSync22(join29(repo, marker))) continue;
     roles.push(role);
-    note2(role, marker);
+    note(role, marker);
   }
   return { primaryLanguage: languages[0], languages, roles, evidence };
 }
 function describeIdentity(repo, registryPath2) {
-  const manifestPath = join27(repo, ".project.json");
+  const manifestPath = join29(repo, ".project.json");
   const manifest = readJson(manifestPath);
   const drift = [];
   let record;
@@ -15581,12 +16267,12 @@ function describeSubsystems(repo, findings) {
     const markers = SUBSYSTEM_MARKERS[metadata.id] ?? [];
     const evidence = metadata.id === "notebook" ? (() => {
       try {
-        const manifest = JSON.parse(readFileSync18(join27(repo, ".project.json"), "utf8"));
+        const manifest = JSON.parse(readFileSync21(join29(repo, ".project.json"), "utf8"));
         return manifest.notebook && typeof manifest.notebook === "object" ? [".project.json#notebook"] : [];
       } catch {
         return [];
       }
-    })() : markers.filter((marker) => existsSync21(join27(repo, marker)));
+    })() : markers.filter((marker) => existsSync22(join29(repo, marker)));
     const rules = (byRecipe.get(metadata.id) ?? []).map((finding2) => ({
       id: finding2.id,
       title: finding2.title,
@@ -15605,7 +16291,7 @@ function describeNotebook(repo, registryPath2) {
   try {
     const registry = loadProjectRegistry(registryPath2);
     const project = Object.values(registry.projects).find((entry) => resolve15(entry.repo_path) === resolve15(repo));
-    const manifest = existsSync21(join27(repo, ".project.json")) ? JSON.parse(readFileSync18(join27(repo, ".project.json"), "utf8")) : void 0;
+    const manifest = existsSync22(join29(repo, ".project.json")) ? JSON.parse(readFileSync21(join29(repo, ".project.json"), "utf8")) : void 0;
     const declared = Boolean(project?.notebook || manifest?.notebook && typeof manifest.notebook === "object");
     if (!declared) return { declared: false, bindingState: null, notebookId: null, overviewNoteId: null, health: null, remoteCheck: "skip", captureAdmission: null };
     const config = loadEffectiveNotebookConfig(repo, registryPath2);
@@ -15623,7 +16309,7 @@ function describeNotebook(repo, registryPath2) {
   }
 }
 function describeConfigFiles(repo) {
-  return CONFIG_FILES.filter((spec) => existsSync21(join27(repo, spec.path))).map((spec) => ({ path: spec.path, purpose: spec.purpose, subsystem: spec.subsystem }));
+  return CONFIG_FILES.filter((spec) => existsSync22(join29(repo, spec.path))).map((spec) => ({ path: spec.path, purpose: spec.purpose, subsystem: spec.subsystem }));
 }
 function describeNextSteps(description, findings) {
   const steps = [];
@@ -15702,7 +16388,7 @@ function describeNextSteps(description, findings) {
 }
 function describeProject(input = {}) {
   const repo = resolve15(input.repoArg ?? process.cwd());
-  if (!existsSync21(repo)) throw new Error(`Path does not exist: ${repo}`);
+  if (!existsSync22(repo)) throw new Error(`Path does not exist: ${repo}`);
   if (!statSync4(repo).isDirectory()) throw new Error(`Not a directory: ${repo}`);
   const registryPath2 = input.registryPath ?? projectRegistryPath();
   const report = recipeRegistry.auditRecipes(lifecycleContext(repo, true, false, { registryPath: registryPath2 }));
@@ -15855,6 +16541,7 @@ var server = new McpServer({
 });
 var TICKET_PROVIDER_SCHEMA = z.enum(["plane", "trello"]);
 var BOARD_URL_COMPAT_SCHEMA = z.string().optional().describe("Deprecated compatibility input. Ignored; board URLs are derived at runtime and are never persisted.").meta({ deprecated: true });
+var RUNTIME_REPO_COMPAT_SCHEMA = z.boolean().optional().describe("Deprecated no-op. Hermes always converges ignored role-local runtime state and never provisions a per-agent GitHub repository.").meta({ deprecated: true });
 function safePathSegmentSchema(label) {
   return z.string().superRefine((value, context) => {
     try {
@@ -15875,20 +16562,16 @@ var GENERIC_RECIPE_NAMES = getRecipeNames().filter((name) => !INTERACTIVE_RECIPE
 if (GENERIC_RECIPE_NAMES.length === 0) throw new Error("No non-interactive recipes are registered for generic MCP execution");
 function validateExternalEffectConsent(input, options) {
   const selected = {
-    runtimeRepo: input.provisionRuntimeRepo === true,
     ticketBoard: input.provisionTicketBoard === true,
     systemd: input.enableSystemd === true
   };
-  const anySelected = selected.runtimeRepo || selected.ticketBoard || selected.systemd;
+  const anySelected = selected.ticketBoard || selected.systemd;
   if (anySelected && input.live !== true) {
     throw new Error("External Hermes effects require live=true in addition to explicit positive opt-ins");
   }
   if (anySelected && options.requireNonLocal && input.local !== false) {
     throw new Error("External Hermes effects require local=false in addition to live=true and explicit positive opt-ins");
   }
-  if (selected.runtimeRepo && input.skipRuntimeRepo === true) {
-    throw new Error("provisionRuntimeRepo=true contradicts skipRuntimeRepo=true");
-  }
   if (selected.ticketBoard && input.skipPlane === true) {
     throw new Error("provisionTicketBoard=true contradicts skipPlane=true");
   }
@@ -15902,7 +16585,7 @@ function validateExternalEffectConsent(input, options) {
 }
 function resolveTargetDir(targetDir) {
   const dir = resolve16(targetDir ?? process.cwd());
-  if (!existsSync22(dir)) {
+  if (!existsSync23(dir)) {
     throw new Error(`Target directory does not exist: ${dir}`);
   }
   if (!statSync5(dir).isDirectory()) {
@@ -15913,7 +16596,7 @@ function resolveTargetDir(targetDir) {
 function resolvePjanglerRoot3() {
   let dir = dirname14(fileURLToPath8(import.meta.url));
   while (dir !== dirname14(dir)) {
-    if (existsSync22(join28(dir, "package.json")) && existsSync22(join28(dir, "templates", "commonproject", "copier.yml"))) {
+    if (existsSync23(join30(dir, "package.json")) && existsSync23(join30(dir, "templates", "commonproject", "copier.yml"))) {
       return dir;
     }
     dir = dirname14(dir);
@@ -15934,7 +16617,6 @@ function publicProjectPlan(plan) {
       return {
         ...action,
         context: {
-          skipRuntimeRepo: action.context.skipRuntimeRepo,
           skipPlane: action.context.skipPlane,
           skipSystemd: action.context.skipSystemd
         }
@@ -15949,7 +16631,10 @@ function publicCompositeProjectResponse(payload, plan) {
   return {
     ...payload,
     ...hasNestedPlan ? { plan: projectedPlan } : {},
-    ...provisionsAgent ? { bloodbankMode: "fleet-shared" } : {}
+    ...provisionsAgent ? {
+      bloodbankMode: "fleet-shared",
+      runtimeMode: "role-local-ignored"
+    } : {}
   };
 }
 async function executeRegisteredProjectPlan(plan, agentContext, lifecycleOverrides = {}, trustedCopier) {
@@ -15967,7 +16652,6 @@ async function executeRegisteredProjectPlan(plan, agentContext, lifecycleOverrid
       ...agentContext,
       trustedCopier,
       deferredExternalEffects: {
-        runtimeRepo: !plannedAgent.context.skipRuntimeRepo,
         ticketBoard: !plannedAgent.context.skipPlane,
         systemd: !plannedAgent.context.skipSystemd,
         owner: "project"
@@ -16009,7 +16693,7 @@ function projectPreflightFailure(plan, errors, audit) {
   };
 }
 function preflightExistingHermesScaffold(targetDir) {
-  if (!existsSync22(join28(targetDir, "agents", "hermes"))) return void 0;
+  if (!existsSync23(join30(targetDir, "agents", "hermes"))) return void 0;
   const owner = recipeRegistry.ownerOf("hermes.pm-scaffold");
   if (!owner) return "Hermes lifecycle owner is unavailable";
   const finding2 = owner.check.audit(lifecycleContext(targetDir, true));
@@ -16249,7 +16933,7 @@ server.registerTool(
       agentRole: AGENT_ROLE_SCHEMA.optional(),
       agentPurpose: z.string().optional(),
       local: z.boolean().optional(),
-      provisionRuntimeRepo: z.boolean().optional().describe("Explicitly opt in to runtime-repository provisioning; also requires live=true and local=false."),
+      provisionRuntimeRepo: RUNTIME_REPO_COMPAT_SCHEMA,
       provisionTicketBoard: z.boolean().optional().describe("Explicitly opt in to ticket-board provisioning; also requires live=true, local=false, and skipPlane!=true."),
       enableSystemd: z.boolean().optional().describe("Explicitly opt in to systemd installation/enablement; also requires live=true and local=false."),
       force: z.boolean().optional(),
@@ -16270,10 +16954,10 @@ server.registerTool(
       const projectSlug = validateSafePathSegment(input.projectSlug ?? slugify(input.projectName), "Project slug");
       const explicitTargetDir = input.targetDir ? resolve16(input.targetDir) : void 0;
       const parentDir = resolve16(input.parentDir ?? (explicitTargetDir ? dirname14(explicitTargetDir) : process.cwd()));
-      if (!existsSync22(parentDir) || !statSync5(parentDir).isDirectory()) throw new Error(`Parent directory does not exist: ${parentDir}`);
+      if (!existsSync23(parentDir) || !statSync5(parentDir).isDirectory()) throw new Error(`Parent directory does not exist: ${parentDir}`);
       const targetDir = resolveContainedPath(
         parentDir,
-        explicitTargetDir ?? join28(parentDir, projectSlug),
+        explicitTargetDir ?? join30(parentDir, projectSlug),
         "Bootstrap target"
       );
       const overwrite = input.overwrite ?? input.force ?? false;
@@ -16285,7 +16969,7 @@ server.registerTool(
       if (externalEffects.ticketBoard && ticketProvider === "plane" && !boardId) {
         throw new Error("boardId or planeProjectId is required when skipPlane=false for Plane; keep skipPlane=true for safe local bootstrap");
       }
-      if (!dryRun && existsSync22(targetDir) && !overwrite) throw new Error(`Target already exists: ${targetDir} (set force/overwrite=true to re-render)`);
+      if (!dryRun && existsSync23(targetDir) && !overwrite) throw new Error(`Target already exists: ${targetDir} (set force/overwrite=true to re-render)`);
       const plan = planProjectInit({
         name: input.projectName,
         description: input.projectDescription,
@@ -16297,12 +16981,13 @@ server.registerTool(
         agentRole: input.agentRole ?? "pm",
         apply: !dryRun,
         live: input.live ?? false,
-        provisionRuntimeRepo: externalEffects.runtimeRepo,
         provisionTicketBoard: externalEffects.ticketBoard,
         enableSystemd: externalEffects.systemd,
         skipPlane,
         registryPath: input.registryPath,
-        projectIdentifier: input.projectIdentifier ?? projectSlug.slice(0, 4).toUpperCase(),
+        // A PROPOSAL only. The provider assigns the real identifier and
+        // `pj project identity` reads it back; MCP never mints a board key.
+        projectIdentifier: input.projectIdentifier ?? proposeProjectIdentifier(projectSlug),
         ticketProvider,
         boardId,
         boardUrl: input.boardUrl,
@@ -16334,7 +17019,6 @@ server.registerTool(
         force: overwrite,
         skipTelegram: true,
         skipEmail: true,
-        skipRuntimeRepo: plannedAgent?.kind === "hermes.provision-agent" ? plannedAgent.context.skipRuntimeRepo : true,
         skipPlane: plannedAgent?.kind === "hermes.provision-agent" ? plannedAgent.context.skipPlane : true,
         skipBloodbank: true,
         skipSystemd: plannedAgent?.kind === "hermes.provision-agent" ? plannedAgent.context.skipSystemd : true
@@ -16381,7 +17065,7 @@ server.registerTool(
       agentRole: AGENT_ROLE_SCHEMA.optional(),
       apply: z.boolean().optional(),
       live: z.boolean().optional(),
-      provisionRuntimeRepo: z.boolean().optional().describe("Explicitly opt in to Hermes runtime-repository provisioning; also requires live=true."),
+      provisionRuntimeRepo: RUNTIME_REPO_COMPAT_SCHEMA,
       provisionTicketBoard: z.boolean().optional().describe("Explicitly opt in to ticket-board provisioning; also requires live=true and skipPlane!=true."),
       enableSystemd: z.boolean().optional().describe("Explicitly opt in to Hermes systemd installation/enablement; also requires live=true."),
       skipPlane: z.boolean().optional().describe("Disable project-board planning and provider invocation even when live=true."),
@@ -16408,7 +17092,6 @@ server.registerTool(
         agentRole: input.agentRole,
         apply: input.apply ?? false,
         live: input.live ?? false,
-        provisionRuntimeRepo: externalEffects.runtimeRepo,
         provisionTicketBoard: externalEffects.ticketBoard,
         enableSystemd: externalEffects.systemd,
         skipPlane: input.skipPlane ?? false,
@@ -16421,7 +17104,7 @@ server.registerTool(
         registryPath: input.registryPath,
         force: input.force ?? false,
         overwrite: input.force ?? false,
-        scaffold: !(input.targetDir && existsSync22(join28(resolve16(input.targetDir), ".git")))
+        scaffold: !(input.targetDir && existsSync23(join30(resolve16(input.targetDir), ".git")))
       });
       if (!input.apply) return asText(publicCompositeProjectResponse(publicProjectPlan(plan), plan));
       const preflight = preflightProjectApply(plan, resolvePjanglerRoot3());
@@ -16589,11 +17272,11 @@ server.registerTool(
       local: z.boolean().optional(),
       apply: z.boolean().optional(),
       live: z.boolean().optional(),
-      provisionRuntimeRepo: z.boolean().optional().describe("Explicitly opt in to runtime-repository provisioning; requires live=true and local=false."),
+      provisionRuntimeRepo: RUNTIME_REPO_COMPAT_SCHEMA,
       provisionTicketBoard: z.boolean().optional().describe("Explicitly opt in to ticket-board provisioning; requires live=true, local=false, and skipPlane!=true."),
       enableSystemd: z.boolean().optional().describe("Explicitly opt in to systemd installation/enablement; requires live=true, local=false, and skipSystemd!=true."),
       force: z.boolean().optional(),
-      skipRuntimeRepo: z.boolean().optional(),
+      skipRuntimeRepo: RUNTIME_REPO_COMPAT_SCHEMA,
       skipPlane: z.boolean().optional(),
       skipSystemd: z.boolean().optional(),
       ticketProvider: TICKET_PROVIDER_SCHEMA.optional()
@@ -16665,7 +17348,7 @@ server.registerTool(
         quiet: true,
         local,
         live,
-        targetRepo: input.targetRepo ?? basename8(resolvedTarget),
+        targetRepo: input.targetRepo ?? basename9(resolvedTarget),
         role: normalizeAgentRole(input.role),
         agentPurpose: input.agentPurpose,
         soulTone: input.soulTone,
@@ -16681,13 +17364,11 @@ server.registerTool(
         // unreachable and therefore cannot consume JSON-RPC stdin.
         skipTelegram: true,
         skipEmail: true,
-        skipRuntimeRepo: !externalEffects.runtimeRepo,
         skipPlane: !externalEffects.ticketBoard,
         skipBloodbank: true,
         skipSystemd: !externalEffects.systemd || process.platform === "darwin",
         trustedCopier,
         deferredExternalEffects: {
-          runtimeRepo: externalEffects.runtimeRepo,
           ticketBoard: externalEffects.ticketBoard,
           systemd: externalEffects.systemd,
           owner: "hermes"
@@ -16703,6 +17384,7 @@ server.registerTool(
           apply,
           live,
           bloodbankMode: "fleet-shared",
+          runtimeMode: "role-local-ignored",
           guidance: parityGuidance(),
           context: {
             targetRepo: context.targetRepo,
@@ -16711,7 +17393,6 @@ server.registerTool(
             dryRun: context.dryRun,
             quiet: context.quiet,
             force: context.force,
-            skipRuntimeRepo: context.skipRuntimeRepo,
             skipPlane: context.skipPlane,
             skipSystemd: context.skipSystemd
           },
@@ -16729,3 +17410,4 @@ server.registerTool(
 );
 var transport = new StdioServerTransport();
 await server.connect(transport);
+//# sourceMappingURL=mcp-server.js.map