@delorenj/pjangler 1.4.6 → 1.5.3

package/templates/hermes-agent/copier.yml

@@ -1,186 +0,0 @@
-# hermes-agent-template
-# https://copier.readthedocs.io/
-#
-# Provisions a single Hermes agent role into an existing repository.
-#
-# Usage:
-#   cd /path/to/your-project
-#   copier copy gh:delorenj/hermes-agent-template ./agents/hermes/pm \
-#     --data role=pm
-#
-# What it does:
-#   1. Renders agents/hermes/<role>/{role.yaml, SOUL.md, hermes, .scripts/}
-#   2. Creates ignored local state at agents/hermes/<role>/runtime/ and delegates
-#      named-profile wiring to `pj migrate hermes.runtime-singleton`
-#   4. Creates a Plane project in 33god workspace
-#   6. Verifies a BotFather token, stores it in 1Password, and maps an op:// reference
-#   7. Optionally does the same for a dedicated Slack app+bot pair
-#   8. Records fleet-shared Bloodbank routing identity (no profile consumer)
-#   9. Installs a profile gateway + heartbeat timer (reconcile + checkpoint)
-#  10. Appends to ~/.hermes/agents-registry.yaml
-#
-# Environment-specific defaults (Hermes binary path, legacy archive owner, Plane
-# workspace/URL, NATS endpoint, skills dir, …) are NOT hardcoded — they live in
-# ~/.config/hermes-agent-template/config.toml, seeded from config.example.toml on
-# first run. Edit that file to retarget the template for a different machine/user.
-
-_min_copier_version: "9.0.0"
-_subdirectory: template
-_templates_suffix: .jinja
-_envops:
-  block_start_string: "{%"
-  block_end_string: "%}"
-  variable_start_string: "{{"
-  variable_end_string: "}}"
-  comment_start_string: "{#"
-  comment_end_string: "#}"
-_exclude:
-  - "**/__pycache__"
-  - "**/*.pyc"
-  - "**/*.pyo"
-
-# ─── Questions (only what we can't derive) ───────────────────────────────
-
-target_repo:
-  type: str
-  help: "Name of the project repo this agent belongs to"
-  validator: "{% if not target_repo %}Required{% endif %}"
-  # No default — must be provided explicitly via --data or interactively.
-  # Path-based auto-derivation is unreliable across relative/absolute dst_path.
-
-role:
-  type: str
-  help: "Role for this agent (safe single path segment; arbitrary roles are supported)"
-  default: pm
-  validator: >-
-    {% set alnum = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789' -%}
-    {% set safe_chars = alnum ~ '._-' -%}
-    {% if not role or role != role|trim or role in ['.', '..'] or role[0] not in alnum or role[-1] not in alnum or role|reject('in', safe_chars)|list|length -%}
-    Role must be a non-empty safe single path segment using letters, numbers, dots, underscores, or hyphens
-    {%- endif %}
-
-ticket_provider:
-  type: str
-  help: "Ticket system this agent's board lives in"
-  default: plane
-  choices:
-    "Linear": linear
-    "Plane": plane
-    "Trello": trello
-
-agent_purpose:
-  type: str
-  help: "One-line description of what this agent does in this repo"
-  default: "{% if role == 'reporter' %}Company-wide evidence gathering, freshness-aware daily reporting, and critical delivery monitoring{% elif role == 'director' %}Company-level portfolio orchestration, delegation, and cross-project control{% else %}Project management, triage, and continuous board reconciliation{% endif %}"
-
-model_provider:
-  type: str
-  help: "Inference provider (empty = inherit from global ~/.hermes config)"
-  default: ""
-
-model_name:
-  type: str
-  help: "Model name (empty = inherit from global ~/.hermes config)"
-  default: ""
-
-model_base_url:
-  type: str
-  help: "Per-agent model API base URL (empty = inherit from shared config)"
-  default: ""
-
-model_api_mode:
-  type: str
-  help: "Per-agent model API protocol (empty = inherit from shared config)"
-  default: ""
-  choices:
-    "Inherit from shared config": ""
-    "OpenAI-compatible chat completions": chat_completions
-    "OpenAI Codex responses": codex_responses
-    "Anthropic messages": anthropic_messages
-    "AWS Bedrock converse": bedrock_converse
-    "Codex app server": codex_app_server
-
-model_key_env:
-  type: str
-  help: "Environment variable NAME holding the per-agent model key (never the key value)"
-  default: ""
-
-soul_tone:
-  type: str
-  help: "Tone for the agent's SOUL.md"
-  default: direct
-  choices:
-    - direct
-    - playful
-    - formal
-    - terse
-
-reconcile_enabled:
-  type: bool
-  help: "Run autonomous PM ticket-board reconciliation from the heartbeat timer"
-  default: true
-
-# ─── Derived (never asked) ───────────────────────────────────────────────
-
-agent_id:
-  type: str
-  default: "{{ target_repo }}-{{ role }}"
-  when: false
-
-display_name:
-  type: str
-  # Short roles (pm, dev, ops, qa, ci) get uppercased; longer ones get title-cased.
-  default: "{{ target_repo|title }} {% if role|length <= 3 %}{{ role|upper }}{% else %}{{ role|title }}{% endif %}"
-  when: false
-
-bot_handle:
-  type: str
-  default: "{{ target_repo|lower|replace('-','_') }}_{{ role|lower }}_bot"
-  when: false
-
-runtime_repo:
-  type: str
-  default: "agent-hm-{{ target_repo|lower }}-{{ role|lower }}"
-  when: false
-
-runtime_repo_owner:
-  type: str
-# Legacy archive identity only. Empty by default — resolved at provision time from
-  # ~/.config/hermes-agent-template/config.toml [github].runtime_repo_owner.
-  # Pass --data runtime_repo_owner=<owner> to override per-run.
-  default: ""
-  when: false
-
-plane_workspace:
-  type: str
-  # Empty by default — resolved at provision time from
-  # ~/.config/hermes-agent-template/config.toml [plane].workspace.
-  default: ""
-  when: false
-
-# ─── Post-generation tasks ───────────────────────────────────────────────
-# Order matters. Each script logs to .scripts/.provision.log.
-# All scripts are idempotent — safe to re-run if a step fails.
-
-_tasks:
-  - "chmod +x .scripts/*.sh .scripts/sentinel/bin/*.sh hermes momo 2>/dev/null || true"
-  - "./.scripts/00-banner.sh"
-  - "./.scripts/01-config.sh"
-  - "./.scripts/05-fleet-env.sh"
-  - "./.scripts/10-hermes-profile.sh"
-  - "./.scripts/20-runtime-repo.sh"
-  - "./.scripts/30-telegram.sh"
-  - "./.scripts/31-slack.sh"
-  - "./.scripts/42-ticket-provider.sh"
-  - "./.scripts/60-bloodbank.sh"
-  - "./.scripts/70-systemd.sh"
-  - "./.scripts/80-registry.sh"
-  - "./.scripts/99-summary.sh"
-
-_skip_if_exists:
-  # role.yaml contains verified channel identities and explicit operator
-  # choices (including reconcile_enabled=false).  A forced Copier refresh must
-  # preserve those durable values; the idempotent tasks below reconcile any
-  # newly-required fields and lifecycle assets around them.
-  - role.yaml
-  - runtime

package/templates/hermes-agent/template/.gitignore.jinja

@@ -1,11 +0,0 @@
-# Per-role ignores in agents/hermes/{{ role }}/
-
-# The local runtime contains mutable agent state and secrets. It is never a
-# project submodule or publishable project content.
-runtime/
-
-# Provisioning logs are host-local as well.
-.scripts/.provision.log
-.scripts/.last-run
-.scripts/.done-*
-.scripts/.plane-project-id

package/templates/hermes-agent/template/.runtime-scaffold/.gitattributes

@@ -1,10 +0,0 @@
-# Route binary state through git-lfs so the checkpoint repo doesn't bloat.
-*.db          filter=lfs diff=lfs merge=lfs -text
-*.sqlite      filter=lfs diff=lfs merge=lfs -text
-*.sqlite3     filter=lfs diff=lfs merge=lfs -text
-*.png         filter=lfs diff=lfs merge=lfs -text
-*.jpg         filter=lfs diff=lfs merge=lfs -text
-*.jpeg        filter=lfs diff=lfs merge=lfs -text
-*.wav         filter=lfs diff=lfs merge=lfs -text
-*.mp3         filter=lfs diff=lfs merge=lfs -text
-*.mp4         filter=lfs diff=lfs merge=lfs -text

package/templates/hermes-agent/template/.runtime-scaffold/.gitignore.jinja

@@ -1,44 +0,0 @@
-# Per-agent runtime — what NOT to commit to the checkpoint repo.
-# Sensitive credentials never go in git.
-.env
-.env.*
-!.env.example
-auth.json
-auth.lock
-secrets.*
-*.pem
-*.key
-gateway.pid
-gateway_state.json
-processes.json
-interrupt_debug.log
-
-# Caches (large, regenerable)
-audio_cache/
-image_cache/
-models_dev_cache.json
-context_length_cache.yaml
-honcho.json
-
-# Sandboxes (ephemeral execution environments)
-sandboxes/
-
-# Heartbeat / sentinel ephemeral state — local to this runtime, never checkpointed.
-# (Keeps the fused checkpoint a true no-op on a clean tree.)
-continuous-ticket-sentinel-state.json
-continuous-ticket-sentinel.lock
-continuous-ticket-sentinel.lock.d/
-.last-checkpoint
-
-# Runtime logs (we want the LFS-tracked summary.log if we add one, not the noise)
-logs/*.log
-logs/*.systemd.log
-
-# Python cruft
-__pycache__/
-*.pyc
-.scripts/.done-*
-.scripts/.provision.log
-
-# Allow these subdirs to exist
-!logs/.gitkeep

package/templates/hermes-agent/template/.runtime-scaffold/README.md

@@ -1,56 +0,0 @@
-# {{agent_id}} — runtime
-
-This is the ignored, role-owned state for the **{{display_name}}** agent. The
-actual HERMES_HOME is a real named directory under `~/.hermes/profiles/`, with
-PJangler-managed links into this runtime. Back it up separately; it is not
-published by project Git.
-
-## What's in here
-
-| Path | Tracked? | Purpose |
-| --- | --- | --- |
-| `config.yaml` | local | Legacy seed/delta; shared profile config comes from fleet root |
-| `SOUL.md` | local | The agent's personality, evolves over time |
-| `memories/MEMORY.md` | local | The condensed mental-model summary loaded each session |
-| `memories/USER.md` | local | The operator's persona |
-| `sessions/sessions.db` | local | SQLite store of conversations |
-| `decisions/` | local | Agent-emitted decisions |
-| `.env` | **no** | API keys + Telegram bot token (per-machine secret) |
-| `auth.json` | **no** | Deprecated local OAuth store; named profiles use fleet auth fallback |
-| `audio_cache/`, `image_cache/` | **no** | Regenerable caches |
-| `sandboxes/` | **no** | Per-session ephemeral execution dirs |
-
-Bloodbank ingress is fleet-shared. The fleet gateway discovers this profile
-through `~/.hermes/agents-registry.yaml` and routes commands by
-`data.target_agent_id`; this runtime has no consumer process or inbox bridge.
-
-## Checkpoint cadence
-
-- Heartbeat: systemd `--user` timer `hermes-{{agent_id}}-heartbeat.timer`. Each
-  tick reconciles the ticket board (the PM's sentinel pass) and then, gated to
-  at most once an hour, checkpoints this runtime.
-- On session end: hermes Stop hook (TODO: hook script in `~/.hermes/hooks/`)
-
-The heartbeat runner lives in the parent's `.scripts/heartbeat.sh`; it calls
-`.scripts/checkpoint.sh` internally, which `git add -A`, commits only if dirty,
-and pushes to `origin`.
-
-## Restoring on a new machine
-
-```bash
-cd /path/to/parent-project
-git submodule update --init --recursive
-git -C agents/hermes/{{role}}/runtime lfs pull
-# Provide the per-runtime secrets the submodule deliberately excluded:
-cp ~/path/to/your/.env       agents/hermes/{{role}}/runtime/.env
-# OAuth provider credentials are shared across the fleet. If needed, login once:
-agents/hermes/{{role}}/hermes auth add openai-codex
-agents/hermes/{{role}}/hermes status
-```
-
-## DO NOT manually edit on multiple machines
-
-This repo is a single-writer system. Either run the agent on machine A or
-machine B — not both. The checkpoint commit will fast-forward; concurrent
-edits cause merge pain. If you really need to fork the agent (e.g. for
-experimentation), branch this repo.

package/templates/hermes-agent/template/.runtime-scaffold/decisions/.gitkeep

@@ -1,2 +0,0 @@
-# Agents drop one markdown file per important decision here.
-# Filename convention: YYYY-MM-DD-HHMMSS-<slug>.md

package/templates/hermes-agent/template/.runtime-scaffold/logs/.gitkeep

@@ -1 +0,0 @@
-# keep logs/ in the repo so per-agent log paths exist on first checkout

package/templates/hermes-agent/template/.runtime-scaffold/memories/MEMORY.md

@@ -1,50 +0,0 @@
-# MEMORY.md — {{agent_id}}
-
-This file is loaded by the gateway at the start of every session. Keep it
-short and high-signal — anything that should ALWAYS be in context.
-
-## Identity
-
-You are **{{display_name}}**, the `{{role}}` agent for the `{{repo}}` repo.
-Your scope is the repo at the project root. You communicate via Telegram
-(`@{{repo}}_{{role}}_bot`) and canonical Bloodbank repo events on
-`bloodbank.evt.repo.>`, filtered by `data.repo = {{repo}}`.
-
-## Operator
-
-Jarad DeLorenzo. One-man dev team. Pivots hard and fast — when documentation
-disagrees with reality, trust reality (the codebase, `git log`, `llr`/`find`
-sorted by mtime). Prefers direct, decision-forward communication. Never
-re-explains what the diff already shows. Hates "I'll help you with that"
-preambles.
-
-## DeloNet conventions you respect at all times
-
-- LAN: `192.168.1.0/24`. Host machine `big-chungus` = `192.168.1.12`.
-  Tailscale IP `100.66.29.76`. **Never hardcode `10.0.0.x`** — that's stale
-  Xfinity-era data.
-- External access: `*.delo.sh` via Cloudflare Tunnel
-  (`6dfd95af-6e2a-4833-84b8-e0a1fda5da4a`). Container-to-container uses
-  Docker service names.
-- Secrets: `op://DeLoSecrets/<item>/<field>`, `~/.config/zshyzsh/secrets.zsh`
-  (exported), or project-local `.env`. Default creds:
-  `$DEFAULT_USERNAME` / `$DEFAULT_PASSWORD`.
-- Hindsight memory: durable cross-session facts go in
-  `hindsight memory retain {{repo}} "..." --context <category>`. This file
-  is the runtime/session-start summary; Hindsight is the long-term store.
-
-## Bloodbank events you emit
-
-Always emit envelope-shaped events with `actor.agent_id = {{agent_id}}` and
-`producer = hermes-agent:{{agent_id}}` for every consequential action.
-Event type format: `bloodbank.<domain>.<entity>.<action>` (4 tokens,
-lowercase, past-tense action for events). The NATS subject inserts a kind
-marker as segment 2 — `bloodbank.<evt|cmd|rpy>.<domain>.<entity>.<action>`
-(5 tokens). There is no version token in either shape; a breaking payload
-change earns a new action or entity, never a `v<n>` segment. Naming spec
-lives at `~/code/33GOD/bloodbank/docs/event-naming.md`.
-
-## Recent context
-
-(This section gets updated by the agent itself as work progresses.
-Treat the bottom-most entry as the most relevant.)

package/templates/hermes-agent/template/.runtime-scaffold/memories/USER.md

@@ -1,51 +0,0 @@
-# USER.md — Jarad DeLorenzo
-
-The operator behind this agent. Loaded into context at session start so the
-agent doesn't have to re-discover who it's working with.
-
-## Identity
-
-- Name: Jarad DeLorenzo
-- Email: jaradd@gmail.com (personal), jarad@automaticai.io (business)
-- GitHub: `delorenj`
-- Telegram: see `TELEGRAM_ALLOWED_USERS` in this agent's `.env`
-- Role: One-man dev team running the 33GOD ecosystem and delonet homelab
-
-## How Jarad works
-
-- Pivots fast — instructions and architecture choices can flip between
-  sessions. Trust *current* code and `git log` over older documentation.
-- Prefers terse responses, decision-forward. No throat-clearing. No
-  "I'll help you with that". When unsure, asks one specific question, not
-  three vague ones.
-- Wants agents to act, then report. Not act, then ask if it was OK.
-- Uses Hindsight for durable memory. Expects agents to retain useful learnings
-  themselves rather than waiting to be asked.
-- Tracks confidence with `llr` (= `fdfind --type f --hidden --exclude .git -X
-  ls -lt --time=ctime -r`). Newer mtime = more authoritative.
-
-## Tooling he ships with
-
-- Copier (`gh:delorenj/CommonProject`) for new project bootstrap
-- BMAD method (`_bmad/`, `_bmad_output/`) for spec-driven work
-- Plane (`plane.delo.sh`) for ticket tracking — workspaces: 33god,
-  lasertoast, intelliforia
-- Bloodbank for cross-agent event flow
-- Hindsight for shared memory (banks: per-repo, `infra`, `33GOD`)
-- 1Password CLI (`op`) for all secrets
-- mise for env management
-
-## What he hates
-
-- Stale documentation that contradicts current state
-- Manual setup steps that should be scripted
-- Backwards-compatibility shims for code that just shipped
-- Long preambles before the actual answer
-- Hardcoded paths/IPs that break on the next machine
-
-## What he loves
-
-- Single source of truth (Holyfields-style schema registries)
-- Reproducible bootstrap (Copier + provision scripts)
-- Auto-checkpointed state (this very runtime repo!)
-- Agents that emit Bloodbank events so the rest of the system can react

package/templates/hermes-agent/template/.scripts/00-banner.sh

@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-# Print the welcome banner and the role we're provisioning.
-# shellcheck source=_lib.sh
-source "$(dirname "$0")/_lib.sh"
-load_role_env
-
-cat >&2 <<EOF
-
-╭─ Hermes Agent Provisioning ────────────────────────────────────────────╮
-│  agent_id    $AGENT_ID
-│  repo        $REPO
-│  role        $ROLE
-│  display     $DISPLAY_NAME
-│  telegram    @$BOT_HANDLE   (one bot per agent)
-│  plane       $PLANE_WORKSPACE workspace
-│  runtime     $ROLE_DIR/runtime   (pure-local, ignored)
-│  profile     ~/.hermes/profiles/$PROFILE_NAME
-╰────────────────────────────────────────────────────────────────────────╯
-
-EOF
-mark_done 00-banner

package/templates/hermes-agent/template/.scripts/01-config.sh

@@ -1,60 +0,0 @@
-#!/usr/bin/env bash
-# Ensure the distributable config exists before any other step reads it.
-# Seeds ~/.config/hermes-agent-template/config.toml from the shipped example.
-
-# MCP render transactions establish repo-local lifecycle eligibility before
-# touching any host-global state. This guard must precede _lib.sh because that
-# library creates the role log and may read fleet configuration.
-if [[ "${SKIP_HOST_STATE:-0}" == "1" ]]; then
-  printf '%s\n' '[01] host config — DEFERRED (SKIP_HOST_STATE=1)' >&2
-  exit 0
-fi
-
-# shellcheck source=_lib.sh
-source "$(dirname "$0")/_lib.sh"
-
-already_done 01-config && { log "[01] config already checked — skipping"; exit 0; }
-
-CONFIG="$HERMES_TEMPLATE_CONFIG"
-EXAMPLE="$ROLE_DIR/.scripts/config.example.toml"
-
-if [[ -f "$CONFIG" ]]; then
-  log "[01] config present: $CONFIG"
-else
-  mkdir -p "$(dirname "$CONFIG")"
-  if [[ -f "$EXAMPLE" ]]; then
-    cp "$EXAMPLE" "$CONFIG"
-    log "[01] seeded $CONFIG from shipped example"
-  else
-    # Last-resort minimal config if the example didn't ship with this agent.
-    cat > "$CONFIG" <<'TOML'
-# hermes-agent-template config — edit for your environment.
-[fleet]
-hermes_bin = "~/.local/share/hermes-agent/releases/0408fec7a153e6c32c064acd2b8053917f1525f1/.venv/bin/hermes"
-hermes_repo = "~/.local/share/hermes-agent/releases/0408fec7a153e6c32c064acd2b8053917f1525f1"
-hermes_git_url = "https://github.com/delorenj/hermes-agent.git"
-hermes_git_ref = "main"
-hermes_git_sha = "0408fec7a153e6c32c064acd2b8053917f1525f1"
-fleet_env = "~/.hermes/fleet.env"
-registry_file = "~/.hermes/agents-registry.yaml"
-canonical_skills_dir = "/home/delorenj/.agents/skills"
-
-[github]
-runtime_repo_owner = "delorenj"
-
-[plane]
-base = "https://plane.delo.sh"
-workspace = "33god"
-
-[bloodbank]
-nats_host = "127.0.0.1"
-nats_port = 4222
-compose_dir = "~/code/33GOD/bloodbank"
-TOML
-    log "[01] wrote built-in default config to $CONFIG"
-  fi
-  warn "[01] review $CONFIG and set values for YOUR environment"
-  warn "     (hermes_bin, runtime_repo_owner, plane.base/workspace, …) before relying on defaults"
-fi
-
-mark_done 01-config

package/templates/hermes-agent/template/.scripts/05-fleet-env.sh

@@ -1,42 +0,0 @@
-#!/usr/bin/env bash
-# Ensure a single shared fleet source-of-truth file exists.
-
-if [[ "${SKIP_HOST_STATE:-0}" == "1" ]]; then
-  printf '%s\n' '[05] fleet env — DEFERRED (SKIP_HOST_STATE=1)' >&2
-  exit 0
-fi
-
-# shellcheck source=_lib.sh
-source "$(dirname "$0")/_lib.sh"
-load_role_env
-
-already_done 05-fleet-env && log "[05] fleet env already checked — refreshing shared keys"
-
-mkdir -p "$(dirname "$FLEET_ENV")"
-
-new_fleet_env=0
-if [[ ! -f "$FLEET_ENV" ]]; then
-  log "[05] creating fleet source-of-truth: $FLEET_ENV"
-  new_fleet_env=1
-else
-  log "[05] fleet env exists: $FLEET_ENV"
-fi
-
-fleet_env_parser="$ROLE_DIR/.scripts/lib/parse-fleet-env.py"
-fleet_env_python="$(builtin type -P python3)" \
-  || die "python3 is required to update the fleet source-of-truth"
-
-upsert_fleet_env() {
-  local key="$1" value="$2"
-  "$fleet_env_python" -I "$fleet_env_parser" --upsert "$FLEET_ENV" "$key" "$value"
-}
-
-if [[ "$new_fleet_env" == "1" ]]; then
-  upsert_fleet_env HERMES_FLEET_BIN "$HERMES_BIN"
-  upsert_fleet_env HERMES_FLEET_REPO "$HERMES_AGENT_REPO"
-  upsert_fleet_env HERMES_FLEET_REGISTRY_FILE "$REGISTRY_FILE"
-fi
-upsert_fleet_env HERMES_FLEET_OAUTH_FILE "$HERMES_OAUTH_FILE"
-upsert_fleet_env HERMES_FLEET_CODEX_HOME "$CODEX_HOME"
-
-mark_done 05-fleet-env