@delorenj/pjangler 1.4.2 → 1.4.4

package/dist/prompt.js

@@ -241,7 +241,7 @@ function planeBase(env = process.env, home = homedir()) {
   if (fromConfig) return fromConfig.replace(/\/+$/, "");
   return DEFAULT_PLANE_BASE;
 }
-function planeWorkspace(provider, env, home) {
+function planeWorkspace(provider, env = process.env, home = homedir()) {
   const fromManifest = provider.workspace?.trim();
   if (fromManifest) return fromManifest;
   const config = readTemplateConfig(env, home);
@@ -402,3 +402,4 @@ export {
   promptLine,
   readPromptFacts
 };
+//# sourceMappingURL=prompt.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delorenj/pjangler",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "description": "Project subsystem bootstrapper CLI",
   "type": "module",
   "main": "dist/index.js",
@@ -12,6 +12,8 @@
   },
   "files": [
     "dist",
+    "!dist/**/*.map",
+    "contracts",
     "templates/commonproject/copier.yml",
     "templates/commonproject/template",
     "templates/hermes-agent/copier.yml",
@@ -23,7 +25,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "build": "esbuild src/index.ts src/mcp-server.ts src/prompt.ts --bundle --packages=external --platform=node --format=esm --outdir=dist && node scripts/export-project-notebook-skill.mjs",
+    "build": "esbuild src/index.ts src/mcp-server.ts src/prompt.ts --bundle --packages=external --platform=node --format=esm --sourcemap --outdir=dist && node scripts/export-project-notebook-skill.mjs",
     "check:audit:prod": "npm audit --omit=dev",
     "check:lock": "node scripts/check-package-lock-parity.mjs",
     "check:submodules": "node scripts/check-submodule-contract.mjs",
@@ -33,12 +35,15 @@
     "typecheck": "tsc --noEmit",
     "test:bmad-installer-contract": "node tests/bmad-installer-contract-regressions.mjs",
     "test:pjan-77": "node tests/pjan-77-notebook-domain-regressions.mjs && node tests/pjan-77-notebook-adapter-contract.mjs && node tests/pjan-77-notebook-lifecycle-regressions.mjs && node tests/pjan-77-notebook-cli-contract.mjs && node tests/pjan-77-notebook-hooks-capture.mjs && node tests/pjan-77-notebook-security-isolation.mjs && node tests/pjan-77-notebook-release-gates.mjs",
-    "test": "npm run check:lock && node tests/package-lock-parity-regressions.mjs && npm run check:submodules && npm run check:tracked-secrets && node tests/portable-test-paths-regressions.mjs && node tests/release-regressions.mjs && node tests/submodule-contract-regressions.mjs && node tests/secret-publication-gate-regressions.mjs && node tests/bmad-version-surface-regressions.mjs && node tests/bmad-transaction-regressions.mjs && node tests/parity-migrate-regressions.mjs && node tests/hermes-profile-inheritance-regressions.mjs && node tests/pjan-57-lifecycle-recipes-regressions.mjs && node tests/pjan-57-dogfood-regressions.mjs && node tests/generated-project-lifecycle-regressions.mjs && node tests/pack-flatten-regressions.mjs && node tests/pack-flatten-cross-engine-regressions.mjs && node tests/registry-cache-parity-regressions.mjs && node tests/registry-root-ladder-regressions.mjs && node tests/pjan-23-regressions.mjs && node tests/pjan-24-regressions.mjs && node tests/pjan-28-regressions.mjs && node tests/pjan-30-regressions.mjs && node tests/pjan-31a-regressions.mjs && node tests/pjan-36-regressions.mjs && node tests/pjan-43-regressions.mjs && node tests/pjan-48-regressions.mjs && node tests/pjan-49-regressions.mjs && node tests/pjan-50-regressions.mjs && node tests/pjan-65-regressions.mjs && node tests/pjan-67-lifecycle-preflight-regressions.mjs && node tests/pjan-67-regressions.mjs && node tests/pjan-67-trusted-lifecycle-regressions.mjs && node tests/pjan-71-regressions.mjs && node tests/pjan-72-regressions.mjs && node tests/pjan-75-regressions.mjs && node tests/pjan-76-regressions.mjs && node tests/skillex-init-regressions.mjs && node tests/pjan-84-global-scope-regressions.mjs && node tests/pjan-84-registry-flag-regressions.mjs && node tests/pjan-84-finding-scope-regressions.mjs && node tests/pjan-84-orphan-adoption-regressions.mjs && node tests/fleet-shared-bloodbank-regressions.mjs && node tests/mcp-catalog-regressions.mjs && node tests/mcp-server-regressions.mjs && node tests/project-registry-regressions.mjs && node tests/pg-registry-regressions.mjs && node tests/momo-lifecycle-plane-regressions.mjs && npm run test:pjan-77",
+    "test": "node scripts/run-tests.mjs",
     "migrate:up": "node-pg-migrate --migrations-dir migrations up",
     "migrate:down": "node-pg-migrate --migrations-dir migrations down",
     "migrate:create": "node-pg-migrate --migrations-dir migrations create",
     "prepublishOnly": "npm run check:lock && npm run check:submodules -- --remote --recursive --archive --npm && npm run build && npm run check:tracked-secrets",
-    "test:hermes-profile-inheritance": "node tests/hermes-profile-inheritance-regressions.mjs"
+    "test:hermes-profile-inheritance": "node tests/hermes-profile-inheritance-regressions.mjs",
+    "test:coverage": "npm run build && NODE_OPTIONS=--max-old-space-size=12288 c8 --exclude='**/.pjan-*/**' --reporter=json-summary --reporter=text-summary --src=src --report-dir=coverage node scripts/run-tests.mjs",
+    "coverage:check": "node scripts/coverage-ratchet.mjs",
+    "coverage:apply": "node scripts/coverage-ratchet.mjs --apply"
   },
   "keywords": [
     "cli",
@@ -60,6 +65,7 @@
   "devDependencies": {
     "@types/node": "^25.9.1",
     "@types/pg": "^8.15.0",
+    "c8": "^10.1.3",
     "esbuild": "^0.25.0",
     "node-pg-migrate": "^8.0.0",
     "typescript": "^5"

package/templates/hermes-agent/copier.yml

@@ -13,8 +13,8 @@
 #   2. Creates ignored local state at agents/hermes/<role>/runtime/ and delegates
 #      named-profile wiring to `pj migrate hermes.runtime-singleton`
 #   4. Creates a Plane project in 33god workspace
-#   6. Prompts for a BotFather Telegram token, stores in ignored runtime state
-#   7. Optionally wires a dedicated Slack app+bot pair into runtime/.env
+#   6. Verifies a BotFather token, stores it in 1Password, and maps an op:// reference
+#   7. Optionally does the same for a dedicated Slack app+bot pair
 #   8. Records fleet-shared Bloodbank routing identity (no profile consumer)
 #   9. Installs a profile gateway + heartbeat timer (reconcile + checkpoint)
 #  10. Appends to ~/.hermes/agents-registry.yaml
@@ -34,6 +34,10 @@ _envops:
   variable_end_string: "}}"
   comment_start_string: "{#"
   comment_end_string: "#}"
+_exclude:
+  - "**/__pycache__"
+  - "**/*.pyc"
+  - "**/*.pyo"
 
 # ─── Questions (only what we can't derive) ───────────────────────────────
 
@@ -111,6 +115,11 @@ soul_tone:
     - formal
     - terse
 
+reconcile_enabled:
+  type: bool
+  help: "Run autonomous PM ticket-board reconciliation from the heartbeat timer"
+  default: true
+
 # ─── Derived (never asked) ───────────────────────────────────────────────
 
 agent_id:
@@ -169,5 +178,9 @@ _tasks:
   - "./.scripts/99-summary.sh"
 
 _skip_if_exists:
-  - hermes
+  # role.yaml contains verified channel identities and explicit operator
+  # choices (including reconcile_enabled=false).  A forced Copier refresh must
+  # preserve those durable values; the idempotent tasks below reconcile any
+  # newly-required fields and lifecycle assets around them.
+  - role.yaml
   - runtime

package/templates/hermes-agent/template/.runtime-scaffold/memories/MEMORY.md

@@ -8,7 +8,7 @@ short and high-signal — anything that should ALWAYS be in context.
 You are **{{display_name}}**, the `{{role}}` agent for the `{{repo}}` repo.
 Your scope is the repo at the project root. You communicate via Telegram
 (`@{{repo}}_{{role}}_bot`) and canonical Bloodbank repo events on
-`bloodbank.evt.v1.repo.>`, filtered by `data.repo = {{repo}}`.
+`bloodbank.evt.repo.>`, filtered by `data.repo = {{repo}}`.
 
 ## Operator
 
@@ -37,9 +37,12 @@ preambles.
 
 Always emit envelope-shaped events with `actor.agent_id = {{agent_id}}` and
 `producer = hermes-agent:{{agent_id}}` for every consequential action.
-Event type format: `bloodbank.v1.<domain>.<entity>.<action>` (5 tokens,
-lowercase, past-tense action for events). Naming spec lives at
-`~/code/33GOD/bloodbank/docs/event-naming.md`.
+Event type format: `bloodbank.<domain>.<entity>.<action>` (4 tokens,
+lowercase, past-tense action for events). The NATS subject inserts a kind
+marker as segment 2 — `bloodbank.<evt|cmd|rpy>.<domain>.<entity>.<action>`
+(5 tokens). There is no version token in either shape; a breaking payload
+change earns a new action or entity, never a `v<n>` segment. Naming spec
+lives at `~/code/33GOD/bloodbank/docs/event-naming.md`.
 
 ## Recent context
 

package/templates/hermes-agent/template/.scripts/10-hermes-profile.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Create the initial named Hermes profile and sanitize cloned chat credentials.
+# Create or reconcile the initial named Hermes profile without cloning secrets.
 # The directory remains REAL. Step 20 delegates final shared-vs-owned link
 # topology to `pj migrate hermes.runtime-singleton`; no template step may
 # replace the profile itself with a symlink.
@@ -13,104 +13,104 @@ fi
 source "$(dirname "$0")/_lib.sh"
 load_role_env
 
-already_done 10-hermes-profile && { log "[10] profile already created — skipping"; exit 0; }
+PROFILE_HOME="$HOME/.hermes/profiles/$PROFILE_NAME"
+
+# Older deployments made the named profile itself a symlink into project
+# state.  Following that link here would make the cleanup below delete files
+# from the link target before the singleton-runtime migration can preserve
+# them.  Refuse the legacy topology before any profile mutation.
+if [[ -L "$PROFILE_HOME" ]]; then
+  die "legacy named profile symlink detected at $PROFILE_HOME; refusing mutation. Run: pj migrate hermes.runtime-singleton '$(project_repo_path 2>/dev/null || printf '%s' "$ROLE_DIR")'"
+fi
+PROFILE_DELTA_SEEDER="$ROLE_DIR/.scripts/lib/profile-config-seed.py"
+[[ -f "$PROFILE_DELTA_SEEDER" && ! -L "$PROFILE_DELTA_SEEDER" ]] \
+  || die "trusted profile config seed helper is unavailable: $PROFILE_DELTA_SEEDER"
+
+already_done 10-hermes-profile \
+  && log "[10] profile marker found — revalidating required profile contract"
+
+# Skillex projects the canonical global catalog into ~/.agents/skills. These
+# six skills are the immutable deployed PM contract, not optional suggestions.
+# Validate the complete set before any profile mutation so a partial/missing
+# projection cannot warn and then be falsely reported as provisioned.
+CANONICAL_SKILLS_DIR="${CANONICAL_SKILLS_DIR:-$(config_get fleet.canonical_skills_dir "$HOME/.agents/skills")}"
+CORE_RUNTIME_SKILLS=(
+  33god-projects
+  delonet-conventions
+  delonet-dotenv
+  hermes-pm-template-maintenance
+  hindsight
+  subagent-driven-development
+)
+OPTIONAL_RUNTIME_SKILLS_TEXT="${SYMLINKED_RUNTIME_SKILLS:-$(config_get fleet.symlinked_runtime_skills '')}"
+read -r -a OPTIONAL_RUNTIME_SKILLS <<< "$OPTIONAL_RUNTIME_SKILLS_TEXT"
+SYMLINKED_RUNTIME_SKILLS=("${CORE_RUNTIME_SKILLS[@]}")
+for skill_name in "${OPTIONAL_RUNTIME_SKILLS[@]}"; do
+  [[ -n "$skill_name" ]] || continue
+  skill_present=0
+  for required_name in "${SYMLINKED_RUNTIME_SKILLS[@]}"; do
+    [[ "$required_name" == "$skill_name" ]] && { skill_present=1; break; }
+  done
+  [[ $skill_present -eq 1 ]] || SYMLINKED_RUNTIME_SKILLS+=("$skill_name")
+done
+missing_runtime_skills=()
+for skill_name in "${SYMLINKED_RUNTIME_SKILLS[@]}"; do
+  [[ -f "$CANONICAL_SKILLS_DIR/$skill_name/SKILL.md" ]] \
+    || missing_runtime_skills+=("$skill_name")
+done
+if [[ ${#missing_runtime_skills[@]} -gt 0 ]]; then
+  clear_done 10-hermes-profile
+  die "required Skillex projection missing SKILL.md for: ${missing_runtime_skills[*]} (run the global Skillex sync, then rerun)"
+fi
+log "[10] required Skillex skills validated: ${SYMLINKED_RUNTIME_SKILLS[*]}"
 
 log "[10] creating hermes profile: $PROFILE_NAME"
-PROFILE_HOME="$HOME/.hermes/profiles/$PROFILE_NAME"
 
 if [[ -d "$PROFILE_HOME" ]]; then
   log "    profile dir already exists; reusing"
 else
-  # --clone (NOT --clone-all): copies config.yaml, .env, SOUL.md only.
-  # --clone-all has a recursion bug — it copies the entire ~/.hermes tree,
-  #   including profiles/ itself, producing nested profiles/<name>/profiles/<name>/...
-  # We do explicit skill + plugin + hooks copies below to avoid that.
-  "$HERMES_BIN" profile create "$PROFILE_NAME" --clone --no-alias
+  # `--clone` copies the default profile's .env before a provisioner can
+  # inspect it, transiently materializing every credential in the new profile.
+  # Start clean; required skills and the project SOUL are installed below.
+  "$HERMES_BIN" profile create "$PROFILE_NAME" --no-alias
 fi
 
-# Manually copy the inheritable bits that --clone doesn't get.
-# These are content-only dirs; safe to mirror without recursion risk.
-log "    mirroring skills, plugins, hooks from default profile"
-for sub in skills plugins hooks cron skins; do
-  src="$HOME/.hermes/$sub"
-  dst="$PROFILE_HOME/$sub"
-  if [[ -d "$src" && "$src" != "$PROFILE_HOME"* ]]; then
-    mkdir -p "$dst"
-    # cp -R, dereferencing symlinks; -u to preserve newer if dst exists
-    cp -RLu "$src/." "$dst/" 2>/dev/null || cp -RL "$src/." "$dst/" 2>/dev/null || true
-  fi
-done
-
 # Strip any inherited gateway/runtime state so this profile boots clean.
 rm -f "$PROFILE_HOME/gateway.pid" "$PROFILE_HOME/gateway_state.json" \
       "$PROFILE_HOME/processes.json" "$PROFILE_HOME/state.db" 2>/dev/null || true
 # Belt-and-suspenders: if a profiles/ dir somehow exists, remove it
 [[ -d "$PROFILE_HOME/profiles" ]] && rm -rf "$PROFILE_HOME/profiles"
 
-# Strip inherited messaging-platform credentials from the cloned .env.
-# `profile create --clone` copies the DEFAULT profile's .env verbatim — and the
-# default profile is an operator's own agent (e.g. Condaleeza on Slack). Without
-# this, every sub-agent inherits the parent's bot token and would (a) hijack the
-# parent's Slack/Telegram socket if it ever connects, and (b) crash-loop: the
-# gateway treats an inherited-but-unusable platform as "configured", fails to
-# connect it, and exits non-fatal only when ZERO platforms are configured. A
-# sub-agent must establish its OWN identity via the Wire steps (30-telegram etc),
-# never borrow the parent's.
+# A new profile gets an empty Hermes-created .env. Existing profiles are never
+# migrated opportunistically: if a legacy deployment still has raw channel
+# credentials, fail closed and leave the approval-gated migration to the fleet
+# operator. Only key names are reported; values are never printed.
 PROFILE_ENV="$PROFILE_HOME/.env"
 if [[ -f "$PROFILE_ENV" ]]; then
-  # Some Hermes versions implement `profile create --clone` by symlinking the
-  # cloned .env back to the default profile.  Never sanitize through that
-  # symlink: doing so would delete the operator's fleet-wide provider secrets.
-  # Break only the .env link into a private, mode-0600 copy first.
-  if [[ -L "$PROFILE_ENV" ]]; then
-    log "    detaching cloned .env symlink before profile-local sanitization"
-    PROFILE_ENV_COPY="$PROFILE_HOME/.env.profile-local.$$"
-    cp -L "$PROFILE_ENV" "$PROFILE_ENV_COPY"
-    chmod 600 "$PROFILE_ENV_COPY"
-    mv -fT "$PROFILE_ENV_COPY" "$PROFILE_ENV"
-  fi
-  log "    stripping inherited platform credentials from profile .env"
   python3 - "$PROFILE_ENV" <<'PYEOF'
-import re, sys, pathlib
+import sys, pathlib
 p = pathlib.Path(sys.argv[1])
-# Identity-bearing platform creds that must be per-agent, not inherited.
 keys = (
-    "SLACK_BOT_TOKEN", "SLACK_APP_TOKEN", "SLACK_ALLOWED_USERS",
-    "SLACK_SIGNING_SECRET", "SLACK_HOME_CHANNEL",
-    "TELEGRAM_BOT_TOKEN", "TELEGRAM_ALLOWED_USERS",
-    "DISCORD_BOT_TOKEN", "DISCORD_ALLOWED_USERS", "DISCORD_HOME_CHANNEL",
-    "DISCORD_HOME_CHANNEL_NAME",
+    "SLACK_BOT_TOKEN", "SLACK_APP_TOKEN", "SLACK_SIGNING_SECRET",
+    "TELEGRAM_BOT_TOKEN", "DISCORD_BOT_TOKEN",
 )
-# Only touch *uncommented* assignments (leave the template's `# KEY=` examples).
-pat = re.compile(r"^\s*(?:%s)=" % "|".join(keys))
-lines = p.read_text().splitlines(keepends=True)
-kept = [ln for ln in lines if not pat.match(ln)]
-if len(kept) != len(lines):
-    p.write_text("".join(kept))
+found = []
+for raw in p.read_text(encoding="utf-8").splitlines():
+    line = raw.strip()
+    if not line or line.startswith("#"):
+        continue
+    if line.startswith("export "):
+        line = line[7:].lstrip()
+    name, sep, value = line.partition("=")
+    if sep and name.strip() in keys and value.strip():
+        found.append(name.strip())
+if found:
+    raise SystemExit(
+        "raw channel credential assignments require the approval-gated "
+        "1Password migration: " + ", ".join(sorted(set(found)))
+    )
 PYEOF
-  chmod 600 "$PROFILE_ENV"
-fi
-
-if [[ "$ROLE" == "pm" ]]; then
-  VOX_URL_VALUE="${VOX_URL:-$(config_get fleet.vox_url 'https://vox.delo.sh')}"
-  if [[ -n "$VOX_URL_VALUE" ]]; then
-    log "    ensuring VOX_URL is present for PM voice mode"
-    python3 - "$PROFILE_ENV" "$VOX_URL_VALUE" <<'PYEOF'
-import pathlib, sys
-
-path = pathlib.Path(sys.argv[1])
-vox_url = sys.argv[2]
-lines = path.read_text().splitlines() if path.exists() else []
-for idx, line in enumerate(lines):
-    if line.startswith("VOX_URL="):
-        lines[idx] = f'VOX_URL="{vox_url}"'
-        break
-else:
-    lines.append(f'VOX_URL="{vox_url}"')
-path.write_text("\n".join(lines) + "\n")
-PYEOF
-    chmod 600 "$PROFILE_ENV"
-  fi
+  [[ -L "$PROFILE_ENV" ]] || chmod 600 "$PROFILE_ENV"
 fi
 
 # Never persist a project-specific terminal.cwd through the named profile.
@@ -127,15 +127,13 @@ fi
 # Seed an EMPTY delta: a new agent should be identical to the fleet base, and
 # every line here is an override someone must justify later.
 PROFILE_DELTA="$PROFILE_HOME/config.delta.yaml"
-if [[ ! -f "$PROFILE_DELTA" ]]; then
+profile_delta_seed_result="$(
+  python3 -I "$PROFILE_DELTA_SEEDER" --profile "$PROFILE_HOME"
+)" || die "config.delta.yaml seed reconciliation failed"
+if [[ "$profile_delta_seed_result" == "seeded" ]]; then
   log "    seeding empty config.delta.yaml (override-only SSOT)"
-  cat > "$PROFILE_DELTA" <<'DELTA_EOF'
-# Override-only delta for this Hermes profile.
-# Merged over ~/.hermes/config.yaml to produce config.yaml (which is GENERATED).
-# Empty == identical to the fleet base. Add ONLY what must differ.
-{}
-DELTA_EOF
-  chmod 600 "$PROFILE_DELTA"
+elif [[ "$profile_delta_seed_result" != "exists" ]]; then
+  die "profile config seed helper returned an invalid result"
 fi
 
 # Pin the identity-memory bank explicitly rather than relying on the fleet
@@ -166,7 +164,6 @@ else
 fi
 
 # Canonical shared-skill source of truth + local PM fallback sync.
-CANONICAL_SKILLS_DIR="${CANONICAL_SKILLS_DIR:-$(config_get fleet.canonical_skills_dir '/home/delorenj/.agents/skills')}"
 CANONICAL_PM_SKILL_SRC="$CANONICAL_SKILLS_DIR/subagent-driven-development"
 LOCAL_PM_SKILL_DST="$PROFILE_HOME/skills/software-development/subagent-driven-development"
 
@@ -186,17 +183,14 @@ if [[ -d "$CANONICAL_SKILLS_DIR" ]]; then
 
   # Ensure key PM/local-ops skills are symlinked into runtime/profile skills root.
   # This preserves canonical ownership and keeps updates instant across agents.
-  read -r -a SYMLINKED_RUNTIME_SKILLS <<< "${SYMLINKED_RUNTIME_SKILLS:-$(config_get fleet.symlinked_runtime_skills 'delonet-conventions delonet-dotenv hermes-pm-template-maintenance hindsight subagent-driven-development')}"
   mkdir -p "$PROFILE_HOME/skills"
 
   for skill_name in "${SYMLINKED_RUNTIME_SKILLS[@]}"; do
     src="$CANONICAL_SKILLS_DIR/$skill_name"
     dst="$PROFILE_HOME/skills/$skill_name"
 
-    if [[ ! -f "$src/SKILL.md" ]]; then
-      warn "    skipping runtime skill symlink (missing SKILL.md): $src"
-      continue
-    fi
+    [[ -f "$src/SKILL.md" ]] \
+      || die "required Skillex skill disappeared during provisioning: $src/SKILL.md"
 
     if [[ -L "$dst" && "$(readlink "$dst")" == "$src" ]]; then
       log "    runtime skill symlink already set: $dst -> $src"
@@ -208,7 +202,7 @@ if [[ -d "$CANONICAL_SKILLS_DIR" ]]; then
     log "    symlinked runtime skill: $dst -> $src"
   done
 else
-  warn "    canonical skills dir missing: $CANONICAL_SKILLS_DIR"
+  die "canonical Skillex projection directory disappeared during provisioning: $CANONICAL_SKILLS_DIR"
 fi
 
 if [[ -f "$CANONICAL_PM_SKILL_SRC/SKILL.md" ]]; then
@@ -216,7 +210,7 @@ if [[ -f "$CANONICAL_PM_SKILL_SRC/SKILL.md" ]]; then
   mkdir -p "$LOCAL_PM_SKILL_DST"
   cp -f "$CANONICAL_PM_SKILL_SRC/SKILL.md" "$LOCAL_PM_SKILL_DST/SKILL.md"
 else
-  warn "    canonical PM skill missing: $CANONICAL_PM_SKILL_SRC/SKILL.md"
+  die "required canonical PM skill disappeared during provisioning: $CANONICAL_PM_SKILL_SRC/SKILL.md"
 fi
 
 # Install the project's SOUL.md into the profile so the agent loads it.

package/templates/hermes-agent/template/.scripts/20-runtime-repo.sh

@@ -70,7 +70,25 @@ PYEOF
 # Never let a literal secret reach the runtime. The scaffold is rendered from
 # templates, so a leaked credential shows up here before anything is copied.
 python3 "$(dirname "$0")/secret-scan.py" "$TMP"
-cp -an "$TMP/." "$RUNTIME_LOCAL/"
+python3 - "$TMP" "$RUNTIME_LOCAL" <<'PYEOF'
+import os, pathlib, shutil, sys
+
+source = pathlib.Path(sys.argv[1])
+target = pathlib.Path(sys.argv[2])
+for current in sorted(source.rglob("*")):
+    relative = current.relative_to(source)
+    destination = target / relative
+    if current.is_dir():
+        destination.mkdir(parents=True, exist_ok=True)
+        continue
+    if os.path.lexists(destination):
+        continue
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    if current.is_symlink():
+        destination.symlink_to(os.readlink(current))
+    else:
+        shutil.copy2(current, destination, follow_symlinks=False)
+PYEOF
 
 # Seed mutable identity/config only when no local value exists.
 if [[ "$ROLE" == "reporter" ]]; then
@@ -148,29 +166,34 @@ log "    singleton profile verified by pj migrate hermes.runtime-singleton: $PRO
 # config.yaml is fleet-shared in the singleton topology.  The manual and
 # service launchers pass TERMINAL_CWD process-locally for this role instead.
 
-profile_config_set() {
-  local key="$1"
-  [[ -x "$HERMES_BIN" ]] \
-    || die "Hermes CLI is not executable; cannot configure named profile: $HERMES_BIN"
-  if ! env HERMES_HOME="$PROFILE_HOME" "$HERMES_BIN" config set "$@" >/dev/null; then
-    die "required Hermes config write failed for named profile $PROFILE_NAME: $key"
-  fi
-}
-
 if [[ "$ROLE" == "pm" ]]; then
-  VOXXY_PLUGIN_DIR="${VOXXY_PLUGIN_DIR:-$(config_get fleet.voxxy_plugin_dir "$HOME/code/voxxy/plugins/tts/voxxy")}"
-  if [[ -d "$VOXXY_PLUGIN_DIR" ]]; then
-    mkdir -p "$RUNTIME_LOCAL/plugins/tts"
-    ln -sfn "$VOXXY_PLUGIN_DIR" "$RUNTIME_LOCAL/plugins/tts/voxxy"
-    log "    linked Voxxy plugin into runtime"
+  VOX_PLUGIN_NAME="${VOX_PLUGIN_NAME:-$(config_get fleet.vox_plugin_name 'vox')}"
+  VOX_VOICE="${VOX_VOICE:-$(config_get fleet.vox_voice 'carlin')}"
+  VOX_PLUGIN_DIR="${VOX_PLUGIN_DIR:-$(config_get fleet.vox_plugin_dir "$HOME/code/voxxy/plugins/tts/$VOX_PLUGIN_NAME")}"
+  if [[ -d "$VOX_PLUGIN_DIR" ]]; then
+    mkdir -p "$PROFILE_HOME/plugins/tts"
+    ln -sfn "$VOX_PLUGIN_DIR" "$PROFILE_HOME/plugins/tts/$VOX_PLUGIN_NAME"
+    profile_voice_contract_set "$PROFILE_HOME" "$VOX_PLUGIN_NAME" "$VOX_VOICE" \
+      || die "could not write the canonical PM voice contract to config.delta.yaml"
+    python3 - "$PROFILE_HOME/config.yaml" "$VOX_PLUGIN_NAME" "$VOX_VOICE" <<'PYEOF' \
+      || die "PM voice config is not the canonical vox/carlin contract"
+import pathlib, sys
+try:
+    import yaml
+except ImportError:
+    raise SystemExit("PyYAML is required to validate PM voice config")
+config = yaml.safe_load(pathlib.Path(sys.argv[1]).read_text(encoding="utf-8")) or {}
+plugin, voice = sys.argv[2:4]
+enabled = ((config.get("plugins") or {}).get("enabled") or [])
+tts = config.get("tts") or {}
+actual_voice = ((tts.get(plugin) or {}).get("voice") or tts.get("voice") or "")
+if f"tts/{plugin}" not in enabled or tts.get("provider") != plugin or actual_voice != voice:
+    raise SystemExit(1)
+PYEOF
+    log "    PM voice verified: provider=$VOX_PLUGIN_NAME voice=$VOX_VOICE"
   else
-    warn "    Voxxy plugin dir missing: $VOXXY_PLUGIN_DIR"
+    log "    optional Vox plugin not installed; PM voice activation deferred"
   fi
-
-  profile_config_set plugins.enabled.0 tts/voxxy
-  profile_config_set tts.provider voxxy
-  profile_config_set tts.voice rick
-  log "    set PM named-profile TTS provider -> voxxy"
 fi
 
 mark_done 20-runtime-repo