@delorenj/pjangler 1.4.5 → 1.5.2

package/templates/hermes-agent/template/.scripts/checkpoint.sh

@@ -1,82 +0,0 @@
-#!/usr/bin/env bash
-# Legacy checkpoint compatibility for installations whose runtime is still a
-# nested Git repository. Pure-local runtimes intentionally skip this script.
-# Idempotent — exits 0 with no commit if there are no changes.
-#
-# Secret-scan gate (PJAN): before committing, the staged diff is scanned for
-# high-signal credentials. On a hit the checkpoint ABORTS — it unstages, does
-# NOT commit or push, logs loudly, and exits non-zero — so the known
-# auto-commit secret-leak recurrence cannot re-leak through the heartbeat.
-set -euo pipefail
-
-RUNTIME_DIR="$(cd "$(dirname "$0")/../runtime" && pwd)"
-cd "$RUNTIME_DIR"
-
-# Skip when the pure-local runtime has no Git metadata.
-[[ -d .git || -f .git ]] || exit 0
-
-# Returns 0 when the staged diff looks clean, 1 when a likely secret is present.
-secret_scan_ok() {
-  local added
-  added="$(git diff --cached -U0 --no-color 2>/dev/null | grep -E '^\+' | grep -vE '^\+\+\+ ' || true)"
-  [[ -n "$added" ]] || return 0
-
-  # Dependency-free, high-signal patterns (distinctive prefixes → ~zero false
-  # positives) over ADDED lines only.
-  if printf '%s\n' "$added" | grep -Eq \
-    'AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|-----BEGIN [A-Z ]*PRIVATE KEY-----|gh[posru]_[A-Za-z0-9]{20,}|xox[baprs]-[0-9A-Za-z-]{10,}|sk-[A-Za-z0-9]{20,}|glpat-[A-Za-z0-9_-]{20,}|AIza[0-9A-Za-z_-]{35}'; then
-    return 1
-  fi
-
-  # Deeper scan when gitleaks is installed (exit 1 == leaks found; other
-  # non-zero == tool/usage error, which we ignore so checkpoints aren't blocked).
-  if command -v gitleaks >/dev/null 2>&1; then
-    local rc=0
-    git diff --cached --no-color 2>/dev/null | gitleaks stdin --no-banner --redact >/dev/null 2>&1 || rc=$?
-    [[ "$rc" -eq 1 ]] && return 1
-  fi
-  return 0
-}
-
-# A checkpoint on a DETACHED HEAD belongs to no branch: `git push origin HEAD`
-# cannot resolve a destination, so every commit stays local forever. One runtime
-# reached 232 orphaned commits this way before anyone noticed.
-BRANCH="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"
-if [ "$BRANCH" = "HEAD" ]; then
-  printf '[checkpoint] ABORT: %s is on a DETACHED HEAD — refusing to create commits that can never be pushed.\n' "$RUNTIME_DIR" >&2
-  printf '[checkpoint] Fix: git -C %s switch -c main && git -C %s push -u origin main\n' "$RUNTIME_DIR" "$RUNTIME_DIR" >&2
-  exit 4
-fi
-
-# Report an existing backlog BEFORE adding to it, so a broken push is visible on
-# the very next tick instead of compounding silently for months.
-backlog="$(git rev-list --count "origin/$BRANCH..HEAD" 2>/dev/null || echo 0)"
-if [ "$backlog" -ge 10 ]; then
-  printf '[checkpoint] WARNING: %s already has %s UNPUSHED commit(s) on %s.\n' "$RUNTIME_DIR" "$backlog" "$BRANCH" >&2
-fi
-
-git add -A
-if git diff --cached --quiet; then
-  exit 0
-fi
-
-if ! secret_scan_ok; then
-  printf '[checkpoint] ABORT: potential secret in staged runtime changes — not committing/pushing.\n' >&2
-  printf '[checkpoint] Inspect: git -C %s diff --cached   (remove the secret or add a .gitignore rule)\n' "$RUNTIME_DIR" >&2
-  git reset -q || true
-  exit 3
-fi
-
-git -c commit.gpgsign=false commit -m "checkpoint $(date -Iseconds)" >/dev/null
-
-# The push MUST be observable. This line used to be
-#   git push origin HEAD 2>&1 | tail -1 || true
-# where `|| true` swallowed every failure — diverged branch, auth, network —
-# and the pipe masked git's exit status on top of it. Run hourly, that turns a
-# broken push into an invisible, unbounded pile of local-only commits.
-if ! git push origin "$BRANCH" >/dev/null 2>&1; then
-  ahead="$(git rev-list --count "origin/$BRANCH..HEAD" 2>/dev/null || echo '?')"
-  printf '[checkpoint] PUSH FAILED for %s (%s commit(s) exist ONLY on this disk).\n' "$RUNTIME_DIR" "$ahead" >&2
-  printf '[checkpoint] Diagnose: git -C %s push origin %s\n' "$RUNTIME_DIR" "$BRANCH" >&2
-  exit 5
-fi

package/templates/hermes-agent/template/.scripts/config.example.toml

@@ -1,70 +0,0 @@
-# hermes-agent-template — distributable configuration
-#
-# This file holds every environment-specific default the provisioning scripts
-# need. Copy it to ~/.config/hermes-agent-template/config.toml (the first
-# provisioning run does this for you) and edit the values for YOUR machine.
-#
-# Resolution precedence for each value (highest wins):
-#   explicit env var  >  ~/.hermes/fleet.env  >  this file  >  built-in fallback
-#
-# Override the config location with $HERMES_TEMPLATE_CONFIG if you keep it
-# somewhere other than $XDG_CONFIG_HOME/hermes-agent-template/config.toml.
-
-[fleet]
-# Absolute path to the shared Hermes executable every agent launcher execs.
-hermes_bin = "~/.local/share/hermes-agent/releases/0408fec7a153e6c32c064acd2b8053917f1525f1/.venv/bin/hermes"
-# Checkout of the shared hermes-agent repo.
-hermes_repo = "~/.local/share/hermes-agent/releases/0408fec7a153e6c32c064acd2b8053917f1525f1"
-# Canonical CommonProject migration CLI. Runtime provisioning delegates named
-# profile topology to this command; it never rewrites profile links itself.
-pjangler_bin = "pj"
-# Reviewed fleet runtime publication. Provisioning metadata and clean installs
-# must agree on this fork/ref/SHA; do not substitute upstream main.
-hermes_git_url = "https://github.com/delorenj/hermes-agent.git"
-hermes_git_ref = "main"
-hermes_git_sha = "0408fec7a153e6c32c064acd2b8053917f1525f1"
-# Fallback runtime scaffold dir — used only when an agent's vendored
-# ./.runtime-scaffold is missing.
-runtime_scaffold_dir = "~/code/hermes-agent-template/runtime-scaffold"
-# Shared fleet source-of-truth env file + fleet registry. ~ is expanded.
-fleet_env = "~/.hermes/fleet.env"
-registry_file = "~/.hermes/agents-registry.yaml"
-# Shared auth roots. HERMES_OAUTH_FILE is the Hermes provider OAuth store
-# (including openai-codex); CODEX_HOME is for Codex CLI/app-server auth.
-oauth_file = "~/.hermes/auth.json"
-codex_home = "~/.codex"
-# Canonical external skills dir mirrored into each agent profile.
-canonical_skills_dir = "/home/delorenj/.agents/skills"
-# Optional Vox plugin + service defaults for Hermes PM agents.
-vox_plugin_name = "vox"
-vox_plugin_dir = "~/code/voxxy/plugins/tts/vox"
-vox_voice = "carlin"
-vox_url = "https://vox.delo.sh"
-# Channel credentials are written directly to Password items in this vault;
-# only op:// references are recorded in named-profile config.delta.yaml.
-onepassword_vault = "DeLoSecrets"
-onepassword_item_prefix = "hermes-agent"
-# Canonical PM config.yaml the provisioner seeds each runtime's config.yaml from.
-# This is the fleet-wide Hermes inference/skill config (model, toolsets, etc.)
-# every agent runtime starts from. ~ is expanded.
-# canonical_pm_config = "~/.hermes/config.yaml"
-# Skills symlinked into every agent's runtime skills root.
-symlinked_runtime_skills = [
-  "delonet-conventions",
-  "delonet-dotenv",
-  "hermes-pm-template-maintenance",
-  "hindsight",
-  "33god-projects",
-  "subagent-driven-development",
-]
-
-[github]
-# LEGACY INERT COMPATIBILITY METADATA ONLY. Older role manifests may still
-# carry this owner field. Current provisioning does not create, attach,
-# synchronize, restore, archive, or remove runtime storage from this value.
-runtime_repo_owner = ""
-
-[plane]
-# Plane instance base URL and workspace slug (one project per agent).
-base = "https://plane.delo.sh"
-workspace = "33god"

package/templates/hermes-agent/template/.scripts/credential-launch.sh

@@ -1,85 +0,0 @@
-#!/usr/bin/env bash
-# Secret-free systemd entrypoint. Decrypted values are read only from the
-# service manager's volatile credential directory and never printed or written.
-set -euo pipefail
-
-ROLE_DIR="$(cd "$(dirname "$0")/.." && pwd)"
-ROLE_YAML="$ROLE_DIR/role.yaml"
-
-yaml_get() {
-  python3 - "$ROLE_YAML" "$1" <<'PYEOF'
-import re, sys
-from pathlib import Path
-text = Path(sys.argv[1]).read_text()
-parts = sys.argv[2].split(".")
-if len(parts) == 2:
-    match = re.search(
-        rf"(?m)^{re.escape(parts[0])}:[ \t]*\n((?:[ \t]+\S.*\n?)*)", text
-    )
-    text = match.group(1) if match else ""
-key = parts[-1]
-match = re.search(rf'(?m)^\s*{re.escape(key)}:\s*"?([^"\n]*)"?\s*$', text)
-print(match.group(1).strip() if match else "")
-PYEOF
-}
-
-AGENT_ID="$(yaml_get agent_id)"
-PROFILE_NAME="$(yaml_get profile)"
-[[ -n "$AGENT_ID" && -n "$PROFILE_NAME" ]] \
-  || { printf 'credential-launch: incomplete role identity\n' >&2; exit 2; }
-[[ -n "${HERMES_BIN:-}" && -x "$HERMES_BIN" ]] \
-  || { printf 'credential-launch: HERMES_BIN is not executable\n' >&2; exit 1; }
-
-mode="${1:-}"
-[[ "$mode" == "gateway" || "$mode" == "heartbeat" ]] \
-  || { printf 'credential-launch: expected gateway or heartbeat\n' >&2; exit 2; }
-
-FLEET_HOME="${HERMES_FLEET_HOME:-$HOME/.hermes}"
-PROFILE_HOME="$FLEET_HOME/profiles/${PROFILE_NAME:-$AGENT_ID}"
-[[ -d "$PROFILE_HOME" && ! -L "$PROFILE_HOME" ]] \
-  || { printf 'credential-launch: named profile is not a real directory\n' >&2; exit 1; }
-export HERMES_HOME="$PROFILE_HOME"
-
-if ! REPO_ROOT="$(git -C "$ROLE_DIR" rev-parse --show-toplevel 2>/dev/null)"; then
-  REPO_ROOT="$ROLE_DIR"
-fi
-export TERMINAL_CWD="$REPO_ROOT"
-
-# Do not forward a stale/raw channel value inherited from the service manager,
-# login shell, or a legacy runtime EnvironmentFile. Hermes hydrates the named
-# profile's validated 1Password references after this launcher execs it.
-unset TELEGRAM_BOT_TOKEN SLACK_BOT_TOKEN SLACK_APP_TOKEN
-
-load_credential() {
-  local credential_id="$1" env_name="$2" credential_file value
-  [[ "$env_name" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] \
-    || { printf 'credential-launch: invalid credential environment name\n' >&2; exit 2; }
-  credential_file="${CREDENTIALS_DIRECTORY:-}/$credential_id"
-  [[ -n "${CREDENTIALS_DIRECTORY:-}" && -r "$credential_file" ]] || return 0
-  value="$(<"$credential_file")"
-  printf -v "$env_name" '%s' "$value"
-  export "$env_name"
-  unset value
-}
-
-MODEL_KEY_ENV="$(yaml_get model.key_env)"
-if [[ -n "$MODEL_KEY_ENV" ]]; then
-  load_credential model_api_key "$MODEL_KEY_ENV"
-fi
-
-if [[ "$mode" == "heartbeat" ]]; then
-  exec "$ROLE_DIR/.scripts/heartbeat.sh"
-fi
-
-gateway_args=(gateway run --replace)
-MODEL_NAME="$(yaml_get model.name)"
-MODEL_PROVIDER="$(yaml_get model.provider)"
-MODEL_BASE_URL="$(yaml_get model.base_url)"
-MODEL_API_MODE="$(yaml_get model.api_mode)"
-[[ -z "$MODEL_NAME" ]] || gateway_args+=(--model "$MODEL_NAME")
-[[ -z "$MODEL_PROVIDER" ]] || gateway_args+=(--provider "$MODEL_PROVIDER")
-[[ -z "$MODEL_BASE_URL" ]] || gateway_args+=(--base-url "$MODEL_BASE_URL")
-[[ -z "$MODEL_API_MODE" ]] || gateway_args+=(--api-mode "$MODEL_API_MODE")
-[[ -z "$MODEL_KEY_ENV" ]] || gateway_args+=(--key-env "$MODEL_KEY_ENV")
-
-exec "$HERMES_BIN" "${gateway_args[@]}"

package/templates/hermes-agent/template/.scripts/heartbeat.sh

@@ -1,283 +0,0 @@
-#!/usr/bin/env bash
-# Unified agent heartbeat: continuous board-reconciliation sentinel pass +
-# gated runtime checkpoint, fused into one systemd-timer tick.
-#
-# Runs often (systemd timer, ~1 min). Only invokes Hermes for a full
-# reconciliation pass when local state says no worker is active, the worker
-# heartbeat is stale, or the last full run is outside the cooldown window. The
-# full pass executes the role's sentinel.prompt.md, which reasons about tickets
-# through the ticket-provider adapter (Linear | Plane | Trello) — never a
-# hardcoded backend. After the sentinel decision (skip OR full), it
-# opportunistically checkpoints only legacy nested-Git runtimes at most once
-# per HEARTBEAT_CHECKPOINT_MIN_INTERVAL_SECONDS, so memory/session state stays
-# durable without pushing every minute.
-set -euo pipefail
-
-ROLE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"   # agents/hermes/<role>
-RUNTIME="$ROLE_DIR/runtime"
-RUN_HOME="${HERMES_HOME:-$RUNTIME}"
-PROMPT_FILE="$ROLE_DIR/.scripts/sentinel.prompt.md"
-STATE_FILE="$RUNTIME/continuous-ticket-sentinel-state.json"
-LOCK_FILE="$RUNTIME/continuous-ticket-sentinel.lock"
-ROLE_YAML="$ROLE_DIR/role.yaml"
-FLEET_ENV="${HERMES_FLEET_ENV:-$HOME/.hermes/fleet.env}"
-FLEET_ENV_LIBRARY="$ROLE_DIR/.scripts/lib/fleet-env.sh"
-FLEET_ENV_PARSER="$ROLE_DIR/.scripts/lib/parse-fleet-env.py"
-LOG_FILE="$RUNTIME/logs/heartbeat.log"
-CHECKPOINT_BIN="$ROLE_DIR/.scripts/checkpoint.sh"
-CHECKPOINT_STAMP="$RUNTIME/.last-checkpoint"
-
-if [[ ! -f "$FLEET_ENV_LIBRARY" || -L "$FLEET_ENV_LIBRARY" \
-   || ! -f "$FLEET_ENV_PARSER" || -L "$FLEET_ENV_PARSER" ]]; then
-  echo "heartbeat: trusted fleet environment loader unavailable" >&2
-  exit 1
-fi
-# shellcheck source=lib/fleet-env.sh
-builtin source "$FLEET_ENV_LIBRARY"
-load_fleet_environment "$FLEET_ENV" "$FLEET_ENV_PARSER"
-
-# Hermes binary: explicit env > ~/.config/hermes-agent/hermes-bin > PATH.
-HERMES_BIN="${HERMES_BIN:-${HERMES_FLEET_BIN:-}}"
-if [[ -z "$HERMES_BIN" ]]; then
-  if [[ -r "$HOME/.config/hermes-agent/hermes-bin" ]]; then
-    HERMES_BIN="$(cat "$HOME/.config/hermes-agent/hermes-bin")"
-  else
-    HERMES_BIN="$(command -v hermes || echo hermes)"
-  fi
-fi
-
-ACTIVE_MAX_IDLE_SECONDS="${SENTINEL_ACTIVE_MAX_IDLE_SECONDS:-600}"
-FULL_RUN_COOLDOWN_SECONDS="${SENTINEL_FULL_RUN_COOLDOWN_SECONDS:-300}"
-BLOCKED_FULL_RUN_COOLDOWN_SECONDS="${SENTINEL_BLOCKED_FULL_RUN_COOLDOWN_SECONDS:-900}"
-CHECKPOINT_MIN_INTERVAL_SECONDS="${HEARTBEAT_CHECKPOINT_MIN_INTERVAL_SECONDS:-3600}"
-
-# Opportunistic runtime checkpoint, fused into the heartbeat. Runs at most once
-# per interval; checkpoint.sh is itself a no-op on a clean tree, so this only
-# commits+pushes when there is genuinely new state AND enough time has passed
-# since the last push. Never fails the heartbeat — checkpoint is best-effort.
-maybe_checkpoint() {
-  [[ -x "$CHECKPOINT_BIN" ]] || return 0
-  local now last
-  now="$(date +%s)"
-  last="$(cat "$CHECKPOINT_STAMP" 2>/dev/null || echo 0)"
-  [[ "$last" =~ ^[0-9]+$ ]] || last=0
-  if (( now - last >= CHECKPOINT_MIN_INTERVAL_SECONDS )); then
-    printf '%s' "$now" > "$CHECKPOINT_STAMP" 2>/dev/null || true
-    printf '[heartbeat] checkpoint tick (>= %ss since last push)\n' "$CHECKPOINT_MIN_INTERVAL_SECONDS"
-    "$CHECKPOINT_BIN" || true
-  fi
-}
-
-yaml_value() {
-  python3 - "$ROLE_YAML" "$1" <<'PYEOF'
-import re, sys
-from pathlib import Path
-path, key = sys.argv[1:3]
-text = Path(path).read_text()
-m = re.search(rf'(?m)^\s*{re.escape(key)}:\s*"?([^"\n]*)"?\s*$', text)
-print(m.group(1).strip() if m else "")
-PYEOF
-}
-
-yaml_block_value() {
-  python3 - "$ROLE_YAML" "$1" "$2" <<'PYEOF'
-import re, sys
-from pathlib import Path
-path, block_name, key = sys.argv[1:4]
-text = Path(path).read_text()
-m = re.search(rf'(?m)^{re.escape(block_name)}:[ \t]*\n((?:[ \t]+\S.*\n?)*)', text)
-block = m.group(1) if m else ""
-me = re.search(rf'(?m)^[ \t]+{re.escape(key)}:[ \t]*([^\n#]*)', block)
-value = me.group(1).strip() if me else ""
-print(value.strip().strip('"').strip("'"))
-PYEOF
-}
-
-# True only when role.yaml has a reconcile: block with enabled: true. Block-aware
-# so an unrelated `enabled:` leaf elsewhere in the file can't flip it on.
-reconcile_enabled() {
-  python3 - "$ROLE_YAML" <<'PYEOF'
-import re, sys
-from pathlib import Path
-text = Path(sys.argv[1]).read_text()
-m = re.search(r'(?m)^reconcile:[ \t]*\n((?:[ \t]+\S.*\n?)*)', text)
-block = m.group(1) if m else ""
-me = re.search(r'(?m)^[ \t]+enabled:[ \t]*"?([A-Za-z]+)"?', block)
-print("true" if (me and me.group(1).lower() == "true") else "false")
-PYEOF
-}
-
-AGENT_ID="$(yaml_value agent_id)"
-REPO_NAME="$(yaml_value repo)"
-PROVIDER="$(yaml_block_value ticket_provider name)"
-
-repo_root() {
-  local dir="$ROLE_DIR"
-  for _ in 1 2 3 4 5; do
-    dir="$(dirname "$dir")"
-    if [[ -d "$dir/.git" || -f "$dir/.git" ]]; then printf '%s\n' "$dir"; return 0; fi
-  done
-  return 1
-}
-REPO_ROOT="$(repo_root)"
-cd "$REPO_ROOT"
-mkdir -p "$RUNTIME/logs"
-
-# Single-run lock. Prefer flock (Linux); fall back to an atomic mkdir lock so
-# this also works on macOS, which doesn't ship flock.
-if command -v flock >/dev/null 2>&1; then
-  exec 9>"$LOCK_FILE"
-  if ! flock -n 9; then
-    printf '[heartbeat] another heartbeat/full run is active; skipping\n'; exit 0
-  fi
-else
-  LOCK_DIR="$LOCK_FILE.d"
-  if ! mkdir "$LOCK_DIR" 2>/dev/null; then
-    # Steal a stale lock older than 60 minutes (a crashed run left it behind).
-    if [ -n "$(find "$LOCK_DIR" -maxdepth 0 -mmin +60 2>/dev/null)" ]; then
-      rmdir "$LOCK_DIR" 2>/dev/null && mkdir "$LOCK_DIR" 2>/dev/null \
-        || { printf '[heartbeat] another run active; skipping\n'; exit 0; }
-    else
-      printf '[heartbeat] another heartbeat/full run is active; skipping\n'; exit 0
-    fi
-  fi
-  trap 'rmdir "$LOCK_DIR" 2>/dev/null' EXIT
-fi
-
-# Reconcile gate: the autonomous board-reconciliation pass runs only when
-# role.yaml's reconcile.enabled is true. Deployed PMs default on; setting it
-# false explicitly opts into checkpoint-only operation.
-if [[ "$(reconcile_enabled)" != "true" ]]; then
-  printf '[heartbeat] reconcile disabled (reconcile.enabled != true) — checkpoint-only tick\n'
-  maybe_checkpoint
-  exit 0
-fi
-
-decision="$(
-  python3 - "$STATE_FILE" "$ACTIVE_MAX_IDLE_SECONDS" "$FULL_RUN_COOLDOWN_SECONDS" "$BLOCKED_FULL_RUN_COOLDOWN_SECONDS" <<'PYEOF'
-import json, subprocess, sys, time
-from pathlib import Path
-state_path = Path(sys.argv[1]); active_max_idle = int(sys.argv[2])
-full_run_cooldown = int(sys.argv[3]); blocked_full_run_cooldown = int(sys.argv[4])
-now = time.time()
-state = {}
-if state_path.exists():
-    try: state = json.loads(state_path.read_text())
-    except Exception: state = {}
-session = str(state.get("session") or ""); status = str(state.get("status") or "")
-worktree = str(state.get("worktree") or "")
-def iso_epoch(value):
-    if not value: return 0
-    try: return time.mktime(time.strptime(str(value).replace("Z","+0000"), "%Y-%m-%dT%H:%M:%S%z"))
-    except Exception:
-        try:
-            from datetime import datetime
-            return datetime.fromisoformat(str(value).replace("Z","+00:00")).timestamp()
-        except Exception: return 0
-if status in {"blocked","stalled","error"}:
-    last_blocked_run = (float(state.get("last_full_run_epoch") or 0)
-        or iso_epoch(state.get("last_runner_completed_at")) or iso_epoch(state.get("updated_at")))
-    if last_blocked_run and (now - last_blocked_run) < blocked_full_run_cooldown:
-        print("skip:blocker-cooldown"); raise SystemExit(0)
-if status in {"active","delegated","working"} and session:
-    process_active = False
-    try:
-        result = subprocess.run(["ps","-u",str(__import__("os").getuid()),"-o","pid=,command="],
-            check=False, text=True, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, timeout=5)
-        markers = ("codex exec","opencode run","auggie","gemini","kimi","copilot")
-        process_active = any(((session and session in line) or (worktree and worktree in line))
-            and any(m in line for m in markers) for line in result.stdout.splitlines())
-    except Exception: process_active = False
-    log_path = Path.home()/".local"/"state"/"zellij"/"sessions"/session/"zellij.log"
-    log_recent = log_path.exists() and (now - log_path.stat().st_mtime) <= active_max_idle
-    marker_recent = False
-    last_activity = iso_epoch(state.get("last_activity_at")) or iso_epoch(state.get("updated_at"))
-    if last_activity: marker_recent = (now - last_activity) <= active_max_idle
-    if process_active and (log_recent or marker_recent):
-        print("skip:active-worker"); raise SystemExit(0)
-last_full_run = float(state.get("last_full_run_epoch") or 0)
-if last_full_run and (now - last_full_run) < full_run_cooldown: print("skip:cooldown")
-else: print("run:full")
-PYEOF
-)"
-
-write_state() {  # write_state <json-merge-via-python args...>
-  python3 - "$STATE_FILE" "$AGENT_ID" "$REPO_NAME" "$LOG_FILE" "$@" "$PROVIDER"
-}
-
-case "$decision" in
-  skip:*)
-    write_state "$decision" <<'PYEOF'
-import json, sys, time
-from datetime import datetime, timezone
-from pathlib import Path
-path = Path(sys.argv[1]); agent_id, repo, log_path, decision, provider = sys.argv[2:7]
-state = json.loads(path.read_text()) if path.exists() else {}
-now_iso = datetime.fromtimestamp(time.time(), timezone.utc).isoformat()
-state.update({"source":"hermes-continuous-ticket-sentinel","agent_id":agent_id,"repo":repo,
-    "ticket_provider":provider,"log_path":log_path,"last_heartbeat_at":now_iso,"last_decision":decision})
-state.setdefault("updated_at", now_iso); state.setdefault("summary", state.get("reason") or decision)
-tmp = path.with_suffix(path.suffix + ".tmp"); tmp.write_text(json.dumps(state, indent=2, sort_keys=True)+"\n"); tmp.replace(path)
-PYEOF
-    printf '[heartbeat] %s\n' "$decision"
-    maybe_checkpoint
-    exit 0
-    ;;
-esac
-
-write_state "$decision" <<'PYEOF'
-import json, sys, time
-from datetime import datetime, timezone
-from pathlib import Path
-path = Path(sys.argv[1]); agent_id, repo, log_path, decision, provider = sys.argv[2:7]
-state = json.loads(path.read_text()) if path.exists() else {}
-now = time.time()
-state.update({"source":"hermes-continuous-ticket-sentinel","agent_id":agent_id,"repo":repo,
-    "ticket_provider":provider,"status":"checking",
-    "summary":"PM is reconciling the ticket board, evidence, and worker state.",
-    "log_path":log_path,"last_heartbeat_at":datetime.fromtimestamp(now,timezone.utc).isoformat(),
-    "last_decision":decision,"last_full_run_epoch":now,
-    "last_full_run_started_at":datetime.fromtimestamp(now,timezone.utc).isoformat()})
-tmp = path.with_suffix(path.suffix + ".tmp"); tmp.write_text(json.dumps(state, indent=2, sort_keys=True)+"\n"); tmp.replace(path)
-PYEOF
-
-# Coexistence WIP=1 lease (momo E2/S2.3): don't full-drive if the human-drivable
-# Momo holds it — it's driving the same board. A crashed holder's lease expires
-# (ttl) so the board is never wedged. Release on any exit.
-WIP_LOCK="$RUNTIME/wip-driver.lock"
-if ! python3 "$ROLE_DIR/.scripts/momo-wip-lock.py" acquire "$WIP_LOCK" "hermes:$AGENT_ID" --ttl 3600 >/dev/null 2>&1; then
-  printf '[heartbeat] WIP lease held by Momo — skipping full reconcile pass this tick\n'
-  maybe_checkpoint
-  exit 0
-fi
-trap 'python3 "$ROLE_DIR/.scripts/momo-wip-lock.py" release "$WIP_LOCK" "hermes:$AGENT_ID" >/dev/null 2>&1 || true' EXIT
-
-prompt="$(<"$PROMPT_FILE")"
-set +e
-env HERMES_HOME="$RUN_HOME" "$HERMES_BIN" chat -Q --source cron --max-turns 90 -q "$prompt"
-status=$?
-set -e
-
-runner_exit="$(
-  python3 - "$STATE_FILE" "$status" "$AGENT_ID" "$REPO_NAME" "$LOG_FILE" <<'PYEOF'
-import json, sys, time
-from datetime import datetime, timezone
-from pathlib import Path
-path = Path(sys.argv[1]); exit_code = int(sys.argv[2]); agent_id, repo, log_path = sys.argv[3:6]
-state = json.loads(path.read_text()) if path.exists() else {}
-now_iso = datetime.fromtimestamp(time.time(), timezone.utc).isoformat()
-state.update({"source":"hermes-continuous-ticket-sentinel","agent_id":agent_id,"repo":repo,
-    "log_path":log_path,"last_heartbeat_at":now_iso})
-state["last_runner_exit_code"] = exit_code; state["last_runner_completed_at"] = now_iso
-state.setdefault("last_full_run_epoch", time.time())
-if state.get("status") == "checking":
-    state["status"] = "idle" if exit_code == 0 else "error"
-    state["summary"] = ("PM completed the reconciliation pass without claiming work."
-        if exit_code == 0 else "PM reconciliation failed; inspect the heartbeat log.")
-    state.setdefault("updated_at", now_iso)
-tmp = path.with_suffix(path.suffix + ".tmp"); tmp.write_text(json.dumps(state, indent=2, sort_keys=True)+"\n"); tmp.replace(path)
-print(0 if state.get("status") in {"active","blocked","stalled","idle"} else exit_code)
-PYEOF
-)"
-maybe_checkpoint
-exit "$runner_exit"