@delorenj/pjangler 1.4.6 → 1.5.3

package/templates/hermes-agent/template/.scripts/sentinel/docs/autonomous-delegated-review.md

@@ -1,162 +0,0 @@
-# Autonomous adversarial review (act, do not wait)
-
-Status: sentinel engine protocol (provider-agnostic)
-
-## Purpose
-
-When a ticket reaches the review lane, the sentinel runs an
-**independent adversarial review** of the work against the operator's locked
-intent and acts on the verdict autonomously. This is the **normal per-pass
-path** for review-lane tickets — not a deliberately narrow escape hatch, and not
-the only sanctioned path. The reviewer is an **adversarial microscope**: it
-actively tries to break the work, surface unmet acceptance criteria, hidden
-regressions, and drift. On a clean adversarial verdict the loop treats the
-ticket as done and moves on — through the ticket-provider adapter
-(`tp transition <id> <state>`) — and emits a BloodBank decision event carrying
-the full report. This works identically on Linear, Plane, or Trello.
-
-The operator's verification is **deferred** to end-of-product QA over the review
-lane, backed by a queryable decision trail. A downstream regression rollback is
-the safety valve. The loop does NOT wait on a human to approve or close
-reviewed work.
-
-## Anti-stall rule
-
-The continuous ticket sentinel MUST act on the adversarial verdict autonomously.
-It MUST NOT idle, stop, or end a pass solely because reviewed work awaits human
-approval. "Looks good, waiting on the operator" is **never** a resting state and
-never a terminal pass state. For any review-lane ticket there are exactly three
-legitimate outcomes:
-
-- the independent adversarial review has run and the ticket is **accepted**
-  (treat as done, move on); or
-- the review **held** it on a real finding (back to / stays active); or
-- the ticket has a genuine **out-of-scope blocker** (recorded and waited on).
-
-There is no fourth "waiting for the operator's sign-off" state.
-
-## Out-of-scope blockers (not cleared by review)
-
-The review does not clear an out-of-scope blocker. Record the blocker and wait,
-exactly as before:
-
-- Blocked on external credentials, third-party access, or paid actions.
-- Blocked on an undecided product decision.
-- Acceptance criteria not actually satisfied by repository evidence.
-- Depends on another open, unblocked issue.
-
-## Preconditions
-
-1. **Review-lane ticket** — issue is `in_review`, complete, with no out-of-scope
-   blocker outstanding.
-2. **Evidence exists** — complete evidence file under
-   `_bmad-output/implementation-artifacts/issue-evidence/<ISSUE>.md`.
-3. **Independent reviewer available** — the reviewer agent id MUST differ from
-   the implementer recorded in the evidence (`Worker:` / `Implemented by:`) and
-   from the delegating PM. An implementer NEVER clears their own work.
-
-There is no mandatory grace window. `reconcile.grace_hours` (role.yaml;
-override env `RECONCILE_GRACE_HOURS`) defaults to `0` and is an
-optional operator knob only — set `>0` to reintroduce a wait. The reviewer does
-not wait for the operator's first right of refusal; it reviews and acts.
-
-## Locked intent baseline
-
-Drift is measured against fixed intent, assembled from: the issue's acceptance
-criteria; the active milestone (`tp active_milestone`) and the project's horizon
-model; the product north star; and any locked planning/decision artifacts. The
-reviewer does not re-litigate intent.
-
-## Drift rubric
-
-- **significant (HOLD)** — an AC unmet; user-facing capability added/removed
-  beyond the ACs or milestone; contradicts a locked decision/north star; pulls
-  Later work into Now or touches another milestone; contradicts locked
-  architecture; introduces a new external dependency/credential/paid action.
-- **minor (accept allowed)** — internal refactors, extra tests, naming, cosmetic
-  deviations within locked intent, docs.
-- **none** — matches locked intent and ACs.
-
-Only `none`/`minor` with no unresolved critical/high findings may be accepted.
-
-## Decision
-
-Run from the role's bin (couples gate + drift + event + acceptance):
-
-```bash
-.scripts/sentinel/bin/issue-autonomous-review.sh <ISSUE> <REPORT>
-```
-
-- **accepted** — independent adversarial review cleared it (drift `none|minor`,
-  no unresolved critical/high findings, independence satisfied, close gate
-  passes); the loop treats the ticket as done and moves on; event emitted with
-  `decision=accepted`. The ticket comment states the autonomous acceptance and
-  points to the review report — it does NOT request approval.
-- **held** — any adversarial gate fails; the ticket goes back to / stays active;
-  event `decision=held` with the reason. When in doubt, hold.
-
-The close gate (evidence completeness) remains a HARD, AUTOMATED lock: the
-script will not emit an `accepted` decision while the close gate fails, drift is
-`significant`, an unresolved critical/high finding stands, or independence is
-not satisfied.
-
-## Treat review as done
-
-An adversarially-**accepted** `in_review` ticket equals `completed` for
-dependents and flow. By default the ticket STAYS in the review lane — it is the
-operator's deferred-QA queue — and is NOT auto-transitioned to `completed`.
-`--close` is an OPTIONAL flag (operator QA sweep) and is omitted by the normal
-loop:
-
-```bash
-.scripts/sentinel/bin/issue-autonomous-review.sh <ISSUE> <REPORT> --close
-```
-
-## Decision record
-
-The verdict is carried by the script's exit code (`0` accepted, `3` held) and
-its stdout/stderr, plus the review report and the ticket comment it posts. The
-durable accountability trail is the review report + evidence file in the repo.
-No event is published; see `bloodbank-events.md` for why the old
-`repo.issue.*` family was retired.
-
-## Downstream regression rollback
-
-Deferring operator QA means a later dependent can prove a review-accepted
-feature is ACTUALLY BROKEN. When that happens, move the accepted ticket back to
-active (`started` if a worker takes it now, else `unstarted`) as a PREREQUISITE
-of the dependent, via the adapter (`tp transition <id> <state>`), and comment
-naming the dependent + symptom. Record the rollback in the ticket comment and
-the issue evidence file. The dependent is blocked on the prerequisite until it
-is fixed. This is expected and healthy — it is the trade
-for deferring operator QA, not a failure.
-
-## Review report shape
-
-Write `<ISSUE>.review.md`; the script validates it:
-
-```markdown
-# Autonomous Review Report: <ISSUE>
-## Issue
-- Linear/Plane/Trello issue: <ISSUE>
-- Review lane reason:
-## Reviewer
-- Reviewer agent: <independent-agent-id>
-- Independent of implementer: yes
-## Locked Intent Baseline
-- Acceptance criteria source:
-- Milestone / horizon:
-## Drift Assessment
-- Drift assessment: none        # none | minor | significant
-## Adversarial Findings
-- Critical/high findings: none
-## Decision
-- Decision: accept              # accept | hold (legacy `close` tolerated)
-```
-
-## Operator override
-
-`reconcile.auto_review: false` (role.yaml) or `RECONCILE_AUTO_REVIEW=off`
-disables autonomous acceptance. Autonomous acceptances are traceable via the
-review report, the issue evidence file, and the ticket comment the script
-posts.

package/templates/hermes-agent/template/.scripts/sentinel/docs/bloodbank-events.md

@@ -1,42 +0,0 @@
-# Sentinel workflow events
-
-Status: Sentinel engine protocol (provider-agnostic)
-
-## Purpose
-
-The board remains the human command center and issue evidence files remain the
-close gate. Neither depends on an event trail: `bin/issue-close-gate.sh` and
-`bin/issue-autonomous-review.sh` report their verdicts on stdout/stderr and via
-their exit codes, and publish nothing.
-
-The `repo.issue.*` family the sentinel loop used to mint was retired on
-2026-08-28. It was never published to NATS and never consumed by anything, and
-its shape was invalid twice over: it embedded the repo slug inside the type
-(`bloodbank.v1.repo.<repo>.issue.…`) and `issue` is not in the Bloodbank §7
-entity allowlist. There is no correct version of it to migrate to, so it is
-gone rather than renamed.
-
-## Emitter
-
-`bin/emit-event.py` stays as a dependency-free local emitter for a family a
-future pass genuinely needs:
-
-```bash
-.scripts/sentinel/bin/emit-event.py <event_type> --field key=value [...]
-```
-
-It appends to `_bmad-output/implementation-artifacts/bloodbank-events.jsonl`
-(git-ignored dev spool) using the Hermes CloudEvents envelope shape. Nothing in
-the engine calls it today.
-
-## Naming, before you add one
-
-Event types are exactly four tokens — `bloodbank.<domain>.<entity>.<action>` —
-with `<domain>` and `<entity>` drawn from the allowlists in
-`~/code/33GOD/bloodbank/docs/event-naming.md` (§6/§7). Repo and agent identity
-go in `data.repo` / `actor.agent_id`, never in a type or subject token. Schema
-revision lives in `dataschema`/`schemaref`, never in the type.
-
-Add a family when something will actually consume it — register the schema in
-the BloodBank schema tree first, then emit. A type nobody reads is a type that
-rots into the wrong shape.

package/templates/hermes-agent/template/.scripts/sentinel/docs/continuous-ticket-orchestration.md

@@ -1,77 +0,0 @@
-# Continuous ticket orchestration (sentinel engine)
-
-Status: sentinel engine protocol (provider-agnostic)
-
-## Invariant
-
-If a ready ticket exists, exactly one implementation worker must be actively
-moving it, or the sentinel records why none can. Prefer one live thread over
-a quiet backlog. WIP limit: one active worker ticket.
-
-The sentinel owns the watch loop. Workers (codex, opencode, copilot, …) own
-implementation. The sentinel clears review-lane work via the autonomous
-adversarial review (act, do not wait) protocol
-(`autonomous-delegated-review.md`), and still does not write application code or
-approve merges.
-
-## Ticket access
-
-All board access goes through the adapter (`tp`, from
-`.scripts/lib/ticket-provider.sh`) and reasons in normalized states:
-`backlog | unstarted | started | in_review | completed`. Never call the provider
-directly — the engine is identical across Linear, Plane, and Trello.
-
-## Work-state feed
-
-Every heartbeat/pass keeps `runtime/continuous-ticket-sentinel-state.json`
-current and machine-readable: `source`, `agent_id`, `repo`, `ticket_provider`,
-`status` (`idle|checking|active|blocked|stalled|error`), `active_issue`,
-`summary`, `reason`, `session`, `worktree`, `updated_at`, `last_activity_at`,
-`log_path`.
-
-## Source order (each pass)
-
-1. Active milestone (`tp active_milestone`) and issues (`tp list_issues`). Plane's
-   issue list is project-wide: current-cycle visibility is exactly the rows with
-   `in_active_milestone:true`, not every returned issue.
-2. Local evidence under `_bmad-output/implementation-artifacts/issue-evidence/`.
-3. Live worker state: zellij sessions, worktrees, branches, recent git.
-
-When sources disagree, record a truth-check note and keep the issue open.
-
-## Ticket selection (when no worker active)
-
-1. A blocked/review ticket needing only agent-doable evidence repair.
-2. An unblocked issue in the current milestone.
-3. A small, high-priority backlog issue when the milestone has no ready ticket.
-
-Move the chosen issue to `started` (`tp transition <id> started`) and create/
-refresh its evidence file before spawning exactly one worker.
-
-## Stop conditions
-
-Stop without spawning only when: the board/evidence cannot be inspected; every
-candidate is blocked by external evidence/credentials/product decisions (a
-ticket blocked **only** on human review is NOT a stop condition — run it through
-the independent adversarial review and act on the verdict immediately, no
-waiting; and a dependent blocked **only** on a review-accepted feature is NOT
-blocked); a worker is already active and healthy; or the next action needs
-destructive git ops / production credentials / a paid action.
-
-The loop never ends a pass with work parked waiting on the operator.
-
-## Review and closure
-
-1. Run ticket verification.
-2. Run the close gate: `.scripts/sentinel/bin/issue-close-gate.sh <ISSUE>`.
-3. Run the independent adversarial review — an adversarial microscope, with the
-   reviewer agent NOT the implementer (`autonomous-delegated-review.md`). On a
-   clean adversarial verdict the loop autonomously treats the ticket as done
-   (leaving it in the review lane as the operator's deferred-QA queue) and moves
-   on with no grace wait. A real finding holds it back to active.
-4. Gate fail → leave open, record missing evidence.
-5. Downstream regression rollback: if a later dependent proves a
-   review-accepted feature is actually broken, move it back to active as a
-   prerequisite of the dependent and record the rollback.
-
-Board status is not proof. Repository evidence and the close gate are proof.

package/templates/hermes-agent/template/.scripts/sentinel.prompt.md.jinja

@@ -1,116 +0,0 @@
-# {{ display_name }} — continuous ticket sentinel pass
-
-Run one continuous ticket orchestration pass for the **{{ target_repo }}** repo.
-A cheap systemd heartbeat already decided this full pass is needed.
-
-Working repo: the git root containing this role at `agents/hermes/{{ role }}/`.
-Ticket provider: **{{ ticket_provider }}** (reached only through the adapter — see below).
-
-You are the **{{ target_repo }} PM**, running your continuous board-reconciliation
-pass. Act autonomously, but stay inside the project contracts. Read
-`agents/hermes/{{ role }}/SOUL.md` and the engine docs under
-`.scripts/sentinel/docs/` before acting:
-`continuous-ticket-orchestration.md`, `autonomous-delegated-review.md`,
-`bloodbank-events.md`.
-
-## Ticket access — adapter only
-
-Never call {{ ticket_provider }} directly. Use the adapter:
-
-```bash
-.scripts/lib/ticket-provider.sh        # defines tp(); source it, then:
-tp active_milestone                    # JSON {id,name,state}
-tp list_issues                         # JSON [{id,key,title,state,state_type,...}]
-tp get_issue <id>                      # JSON incl. description + comments + attachments
-tp comment <id> "<body>"               # post a PM/review note
-tp transition <id> <normalized-state>  # backlog|unstarted|started|in_review|completed|cancelled
-tp create_issue "<title>" "<desc>"    # file a NEW ticket; --if-absent to dedupe by title
-```
-
-Reason in **normalized states**, not provider terms. This pass works identically
-on Linear, Plane, or Trello.
-
-## Pass
-
-**Trigger.** This pass runs both on the cheap heartbeat timer AND on a live
-**Plane board event** — a `bloodbank.evt.repo.task.*` event (repo identity lives
-in `data.repo`, never in the subject) delivered by the `plane-webhook-bridge`. If a specific ticket event triggered you, FIRST
-`tp get_issue <that ticket>`, read the change, and react to it (triage / refine /
-comment / transition per the lifecycle) before the general reconcile below.
-
-1. Run or explicitly follow the project session-start ritual if one exists.
-2. Reconcile: active milestone (`tp active_milestone`), issues (`tp list_issues`),
-   local evidence under `_bmad-output/implementation-artifacts/issue-evidence/`,
-   and live worker state (zellij sessions, worktrees, git).
-3. If one worker ticket is `started` and healthy, monitor it and record state.
-4. If no worker is active and a ready unblocked issue exists, delegate exactly
-   one worker (see the orchestration doc), move the issue to `started`, and
-   create/refresh its evidence file. Do not self-accept review here.
-5. **Independent adversarial review — a NORMAL per-pass action.** For any
-   `in_review` ticket whose evidence is complete and for which an independent
-   reviewer exists (a reviewer agent id NOT equal to the implementer recorded in
-   the evidence, `Worker:` / `Implemented by:`), run the **independent
-   adversarial review** in `docs/autonomous-delegated-review.md`. Delegate to that
-   independent reviewer and have it run, as a rigorous adversarial review:
-
-   ```bash
-   .scripts/sentinel/bin/issue-autonomous-review.sh <ISSUE> <REPORT>
-   ```
-
-   (NO `--close`.) This is an adversarial microscope: it holds the work against
-   the locked-intent baseline (acceptance criteria, active milestone / horizon
-   model, product north star, locked product/architecture decisions), scores
-   drift `none | minor | significant` (`significant` → HOLD), surfaces any
-   unresolved critical/high finding (→ HOLD), enforces reviewer independence, and
-   the close gate (evidence completeness) stays a hard automated lock. Then ACT on
-   the verdict autonomously — do not wait on the operator:
-   - **Accepted** (drift `none|minor`, no unresolved critical/high findings,
-     independence satisfied, close gate passes): autonomously TREAT THE TICKET AS
-     DONE. Leave it in the review lane as the operator's deferred-QA queue (do NOT
-     auto-transition to `completed`; `--close` is an optional operator-QA-sweep
-     flag the loop omits). Record the adversarial review report and post ONE
-     ticket comment stating the autonomous acceptance with a
-     pointer to the report — never a "waiting on you" comment, no grace wait. A
-     dependent blocked only on this review-accepted feature is now unblocked.
-   - **Held** (a real finding or gate failure): the ticket goes back to active
-     (`started` if a worker takes it now, else `unstarted`); record the hold
-     reasons in the review report and a ticket comment.
-6. **Regression rollback.** If a later dependent proves a review-accepted feature
-   is ACTUALLY BROKEN, move that feature back to active (`started` if a worker
-   takes it now, else `unstarted`) as a PREREQUISITE of the dependent; comment
-   naming the dependent + symptom, and record the rollback (issue, surfaced_by,
-   reason) in the issue evidence file. The dependent stays blocked on the prerequisite
-   until it is fixed. This is expected and healthy — it is the trade for deferring
-   operator QA, not a failure.
-7. **External blockers only** (credentials, third-party access, paid actions,
-   undecided product decisions): record the blocker and wait on it. Do NOT
-   auto-review these.
-8. **Anti-stall.** Never end a pass with work parked waiting on the operator's
-   approval or sign-off. "Looks good, waiting on the operator" is never a terminal
-   pass state. The only legitimate review-lane outcomes are: **accepted** (treat
-   as done, move on), **held** (back to active), or a genuine **out-of-scope
-   blocker** (recorded and waited on). There is no fourth "waiting for the
-   operator's sign-off" state.
-
-**Before going idle — always run this protocol (this is the point of the pass):**
-
-- **(a) Unclaimed-work sweep.** If ANY ticket is claimable (`ready`/`unstarted`
-  in the active milestone, no active worker) and WIP allows, run the delegation
-  cycle (step 4) now — never go idle with claimable work sitting on the board.
-- **(b) In-progress status sweep.** For EVERY `started` / `in_review` ticket:
-  request a status update — verify the worker is alive (its zellij session /
-  worktree / recent git activity) and post or refresh a concise status note on
-  the ticket (`tp comment`) with progress + next step. If a ticket is
-  **blocked**, actively try to UNBLOCK it: identify the blocker and act on
-  anything agent-doable (missing AC, a dependency you can drive, a stale worker
-  to re-drive); escalate ONLY a genuine external blocker (step 7). A silent or
-  stalled worker is re-driven or flagged — never left silent.
-
-9. Update `runtime/continuous-ticket-sentinel-state.json`: `active` /
-   `blocked` / `idle` / `stalled` with the required fields (`source`, `agent_id`,
-   `repo`, `ticket_provider`, `status`, `summary`, `reason`, `updated_at`,
-   `last_activity_at`, `log_path`).
-10. Run or follow the session-end ritual; report board status, issues touched,
-    evidence touched, and the active worker issue or blocker.
-
-Do not rely on a hard-coded seed ticket. Query the board every pass.

package/templates/hermes-agent/template/.scripts/store-onepassword-secret.py

@@ -1,260 +0,0 @@
-#!/usr/bin/env python3
-"""Store process-only secrets in 1Password and print op:// references.
-
-Secret values are read from stdin and are never placed in argv, a temporary
-file, stdout, or an ``op`` child environment. Item JSON travels only over an
-anonymous pipe to the 1Password CLI. Credential pairs are staged in a new,
-versioned item and both fields are verified before either reference is emitted.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import re
-import shutil
-import subprocess
-import sys
-import uuid
-
-
-def fail(message: str) -> "None":
-    raise SystemExit(f"1Password secret storage failed: {message}")
-
-
-def op_run(args: list[str], *, payload: str | None = None) -> subprocess.CompletedProcess[str]:
-    allowed = (
-        "PATH",
-        "HOME",
-        "USERPROFILE",
-        "APPDATA",
-        "LOCALAPPDATA",
-        "SystemRoot",
-        "TMPDIR",
-        "TMP",
-        "TEMP",
-        "XDG_CONFIG_HOME",
-        "XDG_RUNTIME_DIR",
-        "OP_ACCOUNT",
-        "OP_CONNECT_HOST",
-        "OP_CONNECT_TOKEN",
-        "OP_LOAD_DESKTOP_APP_SETTINGS",
-        "OP_SERVICE_ACCOUNT_TOKEN",
-    )
-    env = {name: os.environ[name] for name in allowed if name in os.environ}
-    env.update(
-        (name, value)
-        for name, value in os.environ.items()
-        if name.startswith("OP_SESSION_")
-    )
-    env["NO_COLOR"] = "1"
-    return subprocess.run(
-        [OP, *args],
-        input=payload,
-        text=True,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE,
-        check=False,
-        env=env,
-        timeout=30,
-    )
-
-
-OP = shutil.which("op") or ""
-if not OP:
-    fail("the op CLI is not installed")
-
-if len(sys.argv) == 3 and sys.argv[1] == "--validate-reference":
-    reference = sys.argv[2]
-    if not reference.startswith("op://") or any(ch in reference for ch in "\r\n\0"):
-        fail("invalid 1Password reference")
-    resolved = op_run(["read", "--", reference])
-    if resolved.returncode != 0 or not resolved.stdout.rstrip("\n"):
-        fail("the configured reference did not resolve")
-    raise SystemExit(0)
-
-if len(sys.argv) == 4 and sys.argv[1] == "--delete-item-id":
-    vault, item_id = sys.argv[2:]
-    if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._ -]{0,126}", vault):
-        fail("vault name contains unsupported characters")
-    if not re.fullmatch(r"[A-Za-z0-9_-]{1,128}", item_id):
-        fail("invalid immutable item id")
-    deleted = op_run(["item", "delete", item_id, "--vault", vault, "--archive"])
-    if deleted.returncode != 0:
-        fail("staged item cleanup was rejected")
-    raise SystemExit(0)
-
-pair_mode = len(sys.argv) == 6 and sys.argv[1] == "--store-pair"
-single_staged_mode = len(sys.argv) == 5 and sys.argv[1] == "--store-staged"
-staged_mode = pair_mode or single_staged_mode
-if pair_mode:
-    vault, item, field_one, field_two = sys.argv[2:]
-    if field_one == field_two or not all(
-        re.fullmatch(r"[a-z][a-z0-9_]{0,63}", field)
-        for field in (field_one, field_two)
-    ):
-        fail("pair field names are invalid or not distinct")
-elif single_staged_mode:
-    vault, item, field_one = sys.argv[2:]
-    if not re.fullmatch(r"[a-z][a-z0-9_]{0,63}", field_one):
-        fail("staged field name is invalid")
-else:
-    if len(sys.argv) != 3:
-        fail(
-            "usage: store-onepassword-secret.py <vault> <item>, "
-            "--store-staged <vault> <item-prefix> <field>, or "
-            "--store-pair <vault> <item-prefix> <field-one> <field-two>"
-        )
-    vault, item = sys.argv[1:]
-safe = re.compile(r"[A-Za-z0-9][A-Za-z0-9._ -]{0,126}")
-if not safe.fullmatch(vault) or not safe.fullmatch(item):
-    fail("vault or item name contains unsupported characters")
-
-payload = sys.stdin.read()
-if pair_mode:
-    values = payload.split("\n")
-    if len(values) != 2 or not all(values):
-        fail("credential pair input must contain exactly two non-empty lines")
-    secrets = [(field_one, values[0]), (field_two, values[1])]
-elif single_staged_mode:
-    if payload.endswith("\n"):
-        payload = payload[:-1]
-    secrets = [(field_one, payload)]
-else:
-    if payload.endswith("\n"):
-        payload = payload[:-1]
-    secrets = [("password", payload)]
-if any(not value or any(ch in value for ch in "\r\n\0") for _, value in secrets):
-    fail("refusing to store an empty or multiline value")
-
-if staged_mode:
-    if len(item) > 105:
-        fail("item prefix is too long for a versioned item")
-    item = f"{item}-v-{uuid.uuid4().hex[:16]}"
-    document = {
-        "title": item,
-        "category": "PASSWORD",
-        "fields": [
-            {
-                "id": field,
-                "type": "CONCEALED",
-                "label": field,
-                "value": value,
-            }
-            for field, value in secrets
-        ]
-        + [
-            {
-                "id": "notesPlain",
-                "type": "STRING",
-                "purpose": "NOTES",
-                "label": "notesPlain",
-                "value": (
-                    "Managed by hermes-agent-template as a staged credential; "
-                    "rotate through the provisioner."
-                ),
-            }
-        ],
-    }
-    stored = op_run(
-        ["item", "create", "--vault", vault, "--format=json", "-"],
-        payload=json.dumps(document),
-    )
-    if stored.returncode != 0:
-        fail("op rejected the staged credential update")
-    try:
-        created = json.loads(stored.stdout)
-        item_id = str(created.get("id") or "")
-    except (AttributeError, TypeError, json.JSONDecodeError):
-        fail("op item create returned invalid JSON")
-    if not re.fullmatch(r"[A-Za-z0-9_-]{1,128}", item_id):
-        fail("op item create omitted an immutable item id")
-    references = [f"op://{vault}/{item_id}/{field}" for field, _ in secrets]
-    for reference, (_, expected) in zip(references, secrets, strict=True):
-        verified = op_run(["read", "--", reference])
-        if verified.returncode != 0 or verified.stdout.rstrip("\n") != expected:
-            # The item is not active until the caller commits its refs. Archive
-            # this failed stage by immutable id; never guess/delete by title.
-            op_run(["item", "delete", item_id, "--vault", vault, "--archive"])
-            fail("a staged credential field did not verify; cleanup attempted")
-    print("\n".join([item_id, *references]))
-    raise SystemExit(0)
-
-listed = op_run(["item", "list", "--vault", vault, "--format=json"])
-if listed.returncode != 0:
-    fail("vault access/authentication was rejected")
-try:
-    rows = json.loads(listed.stdout)
-except (TypeError, json.JSONDecodeError):
-    fail("op item list returned invalid JSON")
-
-matches = [row for row in rows if isinstance(row, dict) and row.get("title") == item]
-if len(matches) > 1:
-    fail("multiple items have the requested title")
-
-if matches:
-    item_id = str(matches[0].get("id") or "")
-    if not item_id:
-        fail("the existing item has no id")
-    fetched = op_run(["item", "get", item_id, "--vault", vault, "--format=json"])
-    if fetched.returncode != 0:
-        fail("the existing item could not be read")
-    try:
-        document = json.loads(fetched.stdout)
-    except (TypeError, json.JSONDecodeError):
-        fail("op item get returned invalid JSON")
-    fields = document.get("fields")
-    if not isinstance(fields, list):
-        fail("the existing item has no fields list")
-    concealed_field = next(
-        (field for field in fields if isinstance(field, dict) and field.get("id") == "password"),
-        None,
-    )
-    if concealed_field is None:
-        concealed_field = {
-            "id": "password",
-            "type": "CONCEALED",
-            "purpose": "PASSWORD",
-            "label": "password",
-        }
-        fields.append(concealed_field)
-    concealed_field["value"] = secrets[0][1]
-    stored = op_run(
-        ["item", "edit", item_id, "--vault", vault],
-        payload=json.dumps(document),
-    )
-else:
-    document = {
-        "title": item,
-        "category": "PASSWORD",
-        "fields": [
-            {
-                "id": "password",
-                "type": "CONCEALED",
-                "purpose": "PASSWORD",
-                "label": "password",
-                "value": secrets[0][1],
-            },
-            {
-                "id": "notesPlain",
-                "type": "STRING",
-                "purpose": "NOTES",
-                "label": "notesPlain",
-                "value": "Managed by hermes-agent-template; rotate through the provisioner.",
-            },
-        ],
-    }
-    stored = op_run(
-        ["item", "create", "--vault", vault, "-"],
-        payload=json.dumps(document),
-    )
-
-if stored.returncode != 0:
-    fail("op rejected the item update")
-
-reference = f"op://{vault}/{item}/password"
-verified = op_run(["read", "--", reference])
-if verified.returncode != 0 or verified.stdout.rstrip("\n") != secrets[0][1]:
-    fail("the stored reference did not resolve to the supplied value")
-
-print(reference)