@smilintux/skcapstone 0.10.0 → 0.12.5

package/src/skcapstone/sync_engine.py

@@ -2,14 +2,14 @@
 Sync pipeline engine — comms path alignment for Syncthing ↔ consciousness loop.
 
 Verifies that the inbox/outbox directories used by the consciousness loop
-inotify watcher and the SKComm Syncthing transport are aligned under the
+inotify watcher and the SKComms Syncthing transport are aligned under the
 Syncthing-synced comms root, and reports pipeline health.
 
 Pipeline:
     Syncthing → {shared_root}/sync/comms/inbox/{peer}/*.skc.json
              ↓  inotify  (ConsciousnessLoop._INBOX_DIR = "sync/comms/inbox")
     ConsciousnessLoop.process_envelope()
-             ↓  skcomm.send()  — must route to SyncthingTransport with
+             ↓  skcomms.send()  — must route to SyncthingTransport with
                                  comms_root = {shared_root}/sync/comms
     SyncthingTransport → {shared_root}/sync/comms/outbox/{peer}/*.skc.json
              ↓  Syncthing propagates to peer
@@ -17,11 +17,11 @@ Pipeline:
 
 Path alignment requirement
 --------------------------
-The SKComm Syncthing transport must be configured with::
+The SKComms Syncthing transport must be configured with::
 
     comms_root: ~/.skcapstone/sync/comms
 
-in ~/.skcomm/config.yml so its outbox and inbox paths match the paths the
+in ~/.skcomms/config.yml so its outbox and inbox paths match the paths the
 consciousness loop watches via inotify.  This module provides
 :func:`verify_pipeline_paths` to detect mismatches and
 :func:`get_sync_pipeline_status` for the daemon health loop.
@@ -128,19 +128,19 @@ def ensure_comms_dirs(shared_root: Path) -> None:
 # ---------------------------------------------------------------------------
 
 
-def verify_pipeline_paths(shared_root: Path, skcomm=None) -> dict:
+def verify_pipeline_paths(shared_root: Path, skcomms=None) -> dict:
     """Verify inbox/outbox path alignment for the full sync pipeline.
 
     Checks:
 
     1. The consciousness loop's watched inbox dir exists.
     2. The outbox dir exists so responses can be written and synced.
-    3. (Optional) The active SKComm Syncthing transport's ``comms_root``
+    3. (Optional) The active SKComms Syncthing transport's ``comms_root``
        matches ``{shared_root}/sync/comms``.
 
     Args:
         shared_root: The agent SHARED_ROOT.
-        skcomm: Optional :class:`SKComm` instance to inspect transport config.
+        skcomms: Optional :class:`SKComms` instance to inspect transport config.
 
     Returns:
         Dict with keys:
@@ -148,7 +148,7 @@ def verify_pipeline_paths(shared_root: Path, skcomm=None) -> dict:
         - ``inbox_ok`` (bool) — inbox dir exists.
         - ``outbox_ok`` (bool) — outbox dir exists.
         - ``transport_aligned`` (bool | None) — transport comms_root matches
-          (None if skcomm not provided or check failed).
+          (None if skcomms not provided or check failed).
         - ``inbox_path`` (str) — absolute inbox path.
         - ``outbox_path`` (str) — absolute outbox path.
         - ``expected_comms_root`` (str) — the expected comms root.
@@ -168,9 +168,9 @@ def verify_pipeline_paths(shared_root: Path, skcomm=None) -> dict:
         issues.append(f"Outbox dir missing: {outbox}")
 
     transport_aligned: Optional[bool] = None
-    if skcomm is not None:
+    if skcomms is not None:
         try:
-            transport_aligned = _check_transport_alignment(skcomm, expected_root, issues)
+            transport_aligned = _check_transport_alignment(skcomms, expected_root, issues)
         except Exception as exc:
             logger.debug("Transport alignment check failed: %s", exc)
             issues.append(f"Transport alignment check error: {exc}")
@@ -186,11 +186,11 @@ def verify_pipeline_paths(shared_root: Path, skcomm=None) -> dict:
     }
 
 
-def _check_transport_alignment(skcomm, expected_root: Path, issues: list[str]) -> bool:
-    """Walk SKComm router transports and check the Syncthing transport's root.
+def _check_transport_alignment(skcomms, expected_root: Path, issues: list[str]) -> bool:
+    """Walk SKComms router transports and check the Syncthing transport's root.
 
     Args:
-        skcomm: SKComm instance (has ``router`` or ``_router`` attribute).
+        skcomms: SKComms instance (has ``router`` or ``_router`` attribute).
         expected_root: The expected comms root path.
         issues: Mutable list; problem strings are appended here.
 
@@ -198,7 +198,7 @@ def _check_transport_alignment(skcomm, expected_root: Path, issues: list[str]) -
         ``True`` if aligned (or no Syncthing transport registered),
         ``False`` on mismatch.
     """
-    router = getattr(skcomm, "router", None) or getattr(skcomm, "_router", None)
+    router = getattr(skcomms, "router", None) or getattr(skcomms, "_router", None)
     if router is None:
         return True  # can't check — assume ok
 
@@ -214,7 +214,7 @@ def _check_transport_alignment(skcomm, expected_root: Path, issues: list[str]) -
             issues.append(
                 f"SyncthingTransport comms_root mismatch — "
                 f"expected {expected_root}, got {actual_root}. "
-                f"Set comms_root: {expected_root} in ~/.skcomm/config.yml"
+                f"Set comms_root: {expected_root} in ~/.skcomms/config.yml"
             )
             aligned = False
     return aligned

package/src/skcapstone/sync_watcher.py

@@ -574,8 +574,8 @@ class SyncWatcher:
             try:
                 self._observer.stop()
                 self._observer.join(timeout=5)
-            except Exception:
-                pass
+            except Exception as exc:
+                logger.warning("Error stopping SyncWatcher observer: %s", exc)
             self._observer = None
         logger.info("SyncWatcher stopped.")
 

package/src/skcapstone/systemd.py

@@ -35,10 +35,10 @@ def _require_linux() -> None:
 
 SERVICE_NAME = "skcapstone.service"
 SOCKET_NAME = "skcapstone-api.socket"
-HEARTBEAT_SERVICE = "skcomm-heartbeat.service"
-HEARTBEAT_TIMER = "skcomm-heartbeat.timer"
-QUEUE_DRAIN_SERVICE = "skcomm-queue-drain.service"
-QUEUE_DRAIN_TIMER = "skcomm-queue-drain.timer"
+HEARTBEAT_SERVICE = "skcomms-heartbeat.service"
+HEARTBEAT_TIMER = "skcomms-heartbeat.timer"
+QUEUE_DRAIN_SERVICE = "skcomms-queue-drain.service"
+QUEUE_DRAIN_TIMER = "skcomms-queue-drain.timer"
 
 ALL_UNITS = [
     SERVICE_NAME,
@@ -53,7 +53,7 @@ TIMER_UNITS = [HEARTBEAT_TIMER, QUEUE_DRAIN_TIMER]
 
 SYSTEMD_USER_DIR = Path.home() / ".config" / "systemd" / "user"
 
-BUNDLED_DIR = Path(__file__).parent.parent.parent / "systemd"
+BUNDLED_DIR = Path(__file__).parent / "data" / "systemd"
 
 
 @dataclass
@@ -121,24 +121,32 @@ def systemd_available() -> bool:
 
 
 def install_service(
+    agent_name: Optional[str] = None,
     unit_dir: Optional[Path] = None,
     source_dir: Optional[Path] = None,
     enable: bool = True,
     start: bool = True,
 ) -> dict:
-    """Install the skcapstone systemd user service.
+    """Install the skcapstone systemd user service for an agent.
 
-    Copies unit files to ~/.config/systemd/user/, reloads the
-    daemon, and optionally enables + starts the service.
+    When *agent_name* is provided, installs the template unit
+    ``skcapstone@.service`` and enables ``skcapstone@<agent>.service``.
+    This supports multiple agents running as independent services on
+    the same machine.
+
+    When *agent_name* is None, falls back to the single-agent
+    ``skcapstone.service`` unit for backwards compatibility.
 
     Args:
+        agent_name: Agent name (e.g. "jarvis"). Uses template unit.
         unit_dir: Target directory for unit files.
         source_dir: Directory containing the .service/.socket files.
         enable: Whether to enable the service at login.
         start: Whether to start the service immediately.
 
     Returns:
-        dict: Result with 'installed', 'enabled', 'started' bools.
+        dict: Result with 'installed', 'enabled', 'started' bools
+              and 'service_name' for the installed unit.
     """
     _require_linux()
     target = unit_dir or SYSTEMD_USER_DIR
@@ -146,15 +154,41 @@ def install_service(
 
     target.mkdir(parents=True, exist_ok=True)
 
-    result = {"installed": False, "enabled": False, "started": False, "timers_enabled": False}
-
-    service_src = source / SERVICE_NAME
-    if not service_src.exists():
-        logger.error("Service unit not found: %s", service_src)
-        return result
-
-    copied = 0
+    result = {
+        "installed": False,
+        "enabled": False,
+        "started": False,
+        "timers_enabled": False,
+        "service_name": "",
+    }
+
+    # Determine which unit to use
+    if agent_name:
+        # Multi-agent: use template unit skcapstone@.service
+        template_name = "skcapstone@.service"
+        instance_name = f"skcapstone@{agent_name}.service"
+        template_src = source / template_name
+        if not template_src.exists():
+            logger.error("Template unit not found: %s", template_src)
+            return result
+        shutil.copy2(template_src, target / template_name)
+        service_unit = instance_name
+        result["service_name"] = instance_name
+    else:
+        # Single-agent fallback
+        service_src = source / SERVICE_NAME
+        if not service_src.exists():
+            logger.error("Service unit not found: %s", service_src)
+            return result
+        shutil.copy2(service_src, target / SERVICE_NAME)
+        service_unit = SERVICE_NAME
+        result["service_name"] = SERVICE_NAME
+
+    # Copy ancillary units (socket, timers, etc.)
+    copied = 1  # already copied the main unit
     for unit_name in ALL_UNITS:
+        if unit_name == SERVICE_NAME:
+            continue  # already handled above
         src = source / unit_name
         if src.exists():
             shutil.copy2(src, target / unit_name)
@@ -162,10 +196,10 @@ def install_service(
 
     _systemctl("daemon-reload")
     result["installed"] = True
-    logger.info("Installed %d unit file(s) to %s", copied, target)
+    logger.info("Installed %d unit file(s) to %s (service: %s)", copied, target, service_unit)
 
     if enable:
-        r = _systemctl("enable", SERVICE_NAME)
+        r = _systemctl("enable", service_unit)
         result["enabled"] = r.returncode == 0
 
         timers_ok = True
@@ -177,7 +211,7 @@ def install_service(
         result["timers_enabled"] = timers_ok
 
     if start:
-        r = _systemctl("start", SERVICE_NAME)
+        r = _systemctl("start", service_unit)
         result["started"] = r.returncode == 0
 
         for timer in TIMER_UNITS:
@@ -336,7 +370,7 @@ WatchdogSec=120
 NoNewPrivileges=true
 ProtectSystem=strict
 ProtectHome=read-only
-ReadWritePaths=%h/.skcapstone %h/.capauth %h/.cloud9 %h/.skcomm %h/.skchat
+ReadWritePaths=%h/.skcapstone %h/.capauth %h/.cloud9 %h/.skcomms %h/.skchat
 PrivateTmp=true
 ProtectKernelTunables=true
 ProtectControlGroups=true

package/src/skcapstone/team_comms.py

@@ -1,7 +1,7 @@
 """
-Team Communications — SKComm/SKChat wiring for deployed agent teams.
+Team Communications — SKComms/SKChat wiring for deployed agent teams.
 
-Bootstraps a local file-based SKComm channel for each deployed team so that
+Bootstraps a local file-based SKComms channel for each deployed team so that
 agents can message each other without external infrastructure. Each agent gets
 its own inbox directory; messages are plain JSON envelopes written atomically
 to the recipient's inbox folder.
@@ -34,7 +34,7 @@ logger = logging.getLogger(__name__)
 # Sentinel value: the queen/manager role name used to discover the broadcast sender
 _QUEEN_ROLES = frozenset({"manager", "queen"})
 
-# File suffix used by the SKComm file transport
+# File suffix used by the SKComms file transport
 _ENVELOPE_SUFFIX = ".skc.json"
 
 
@@ -105,9 +105,9 @@ def _build_envelope(
     content: str,
     thread_id: Optional[str] = None,
 ) -> dict:
-    """Build a minimal SKComm-compatible envelope dict.
+    """Build a minimal SKComms-compatible envelope dict.
 
-    Uses the same schema as skcomm.models.MessageEnvelope so downstream
+    Uses the same schema as skcomms.models.MessageEnvelope so downstream
     consumers can deserialize with MessageEnvelope.from_bytes().
 
     Args:
@@ -121,7 +121,7 @@ def _build_envelope(
     """
     now = datetime.now(timezone.utc).isoformat()
     return {
-        "skcomm_version": "1.0.0",
+        "skcomms_version": "1.0.0",
         "envelope_id": str(uuid.uuid4()),
         "sender": sender,
         "recipient": recipient,
@@ -276,7 +276,7 @@ def send_to_teammate(
 ) -> str:
     """Send a message from one agent to another within the same team.
 
-    Writes a SKComm-compatible envelope JSON file to the recipient's inbox
+    Writes a SKComms-compatible envelope JSON file to the recipient's inbox
     directory. Optionally logs the activity to the coordination board.
 
     Args:
@@ -392,7 +392,7 @@ def receive_messages(
         board: Optional Board instance for activity logging.
 
     Returns:
-        List[dict]: Raw envelope dicts (skcomm MessageEnvelope schema).
+        List[dict]: Raw envelope dicts (skcomms MessageEnvelope schema).
     """
     envelopes = _drain_inbox(agent_name, channel)
 

package/src/skcapstone/team_engine.py

@@ -472,7 +472,7 @@ class TeamEngine:
         deployment: TeamDeployment,
         blueprint: BlueprintManifest,
     ) -> TeamChannel:
-        """Bootstrap SKComm file channel for all agents in a deployment.
+        """Bootstrap SKComms file channel for all agents in a deployment.
 
         Identifies the queen agent from the blueprint's coordination config
         (falling back to any agent with role=manager) and provisions per-agent

package/src/skcapstone/testrunner.py

@@ -7,7 +7,7 @@ terminal — no CI server, no IDE, no special tooling.
 
 Usage:
     skcapstone test                     # run all packages
-    skcapstone test --package skcomm    # run one package
+    skcapstone test --package skcomms    # run one package
     skcapstone test --fast              # stop on first failure
     skcapstone test --json-out          # machine-readable results
 """
@@ -26,10 +26,10 @@ from typing import Optional
 ECOSYSTEM_PACKAGES = [
     {"name": "skcapstone", "path": "skcapstone", "tests": "skcapstone/tests"},
     {"name": "capauth", "path": "capauth", "tests": "capauth/tests"},
-    {"name": "skcomm", "path": "skcomm", "tests": "skcomm/tests"},
+    {"name": "skcomms", "path": "skcomms", "tests": "skcomms/tests"},
     {"name": "skchat", "path": "skchat", "tests": "skchat/tests"},
     {"name": "skmemory", "path": "skmemory", "tests": "skmemory/tests"},
-    {"name": "cloud9-python", "path": "cloud9-python", "tests": "cloud9-python/tests"},
+    {"name": "cloud9", "path": "cloud9", "tests": "cloud9/tests"},
 ]
 
 

package/src/skcapstone/trust_graph.py

@@ -117,6 +117,8 @@ def build_trust_graph(home: Path) -> TrustGraph:
 
 def _add_self_node(home: Path, graph: TrustGraph) -> None:
     """Add the local agent as the central node."""
+    manifest_data: dict[str, Any] = {}
+
     identity_file = home / "identity" / "identity.json"
     if identity_file.exists():
         try:
@@ -130,20 +132,53 @@ def _add_self_node(home: Path, graph: TrustGraph) -> None:
                 fingerprint=data.get("fingerprint"),
                 metadata={"capauth_managed": data.get("capauth_managed", False)},
             ))
-            return
         except (json.JSONDecodeError, OSError):
             pass
 
     manifest = home / "manifest.json"
     if manifest.exists():
         try:
-            data = json.loads(manifest.read_text(encoding="utf-8"))
-            name = data.get("name", "self")
-            graph.agent_name = name
-            graph.add_node(TrustNode(id=name, label=name, node_type="agent"))
+            manifest_data = json.loads(manifest.read_text(encoding="utf-8"))
+            if not graph.nodes:
+                name = manifest_data.get("name", "self")
+                graph.agent_name = name
+                graph.add_node(TrustNode(id=name, label=name, node_type="agent"))
         except (json.JSONDecodeError, OSError):
             pass
 
+    _add_operator_edge(manifest_data, graph)
+
+
+def _add_operator_edge(manifest_data: dict[str, Any], graph: TrustGraph) -> None:
+    """Add an explicit human-operator relationship from manifest metadata."""
+    operator = manifest_data.get("operator")
+    if not isinstance(operator, dict):
+        return
+
+    name = str(operator.get("name", "")).strip()
+    if not name or not graph.agent_name:
+        return
+
+    node_id = str(operator.get("fingerprint", "")).strip() or f"operator:{name}"
+    graph.add_node(TrustNode(
+        id=node_id,
+        label=name,
+        node_type="peer",
+        fingerprint=str(operator.get("fingerprint", "")).strip() or None,
+        metadata={
+            "relationship": operator.get("relationship", "human-operator"),
+            "entity_type": operator.get("entity_type", "human"),
+            "source": operator.get("source", "manifest"),
+        },
+    ))
+    graph.add_edge(TrustEdge(
+        source=graph.agent_name,
+        target=node_id,
+        edge_type="operator",
+        label=operator.get("relationship", "human-operator"),
+        strength=1.0,
+    ))
+
 
 def _add_token_edges(home: Path, graph: TrustGraph) -> None:
     """Add edges from capability token issuance (issuer trusts subject)."""

package/src/skcapstone/unified_search.py

@@ -1,7 +1,7 @@
 """
 Unified Search — full-text search across all agent data stores.
 
-Searches memories, conversations, and SKComm messages in one query.
+Searches memories, conversations, and SKComms messages in one query.
 Results are ranked by a combined relevance + recency score.
 
 Data stores searched:
@@ -15,6 +15,7 @@ from __future__ import annotations
 
 import json
 import logging
+import os
 import re
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
@@ -140,8 +141,16 @@ def _search_memories(
         List of SearchResult objects from the memory store.
     """
     results: list[SearchResult] = []
-    agent_name = os.environ.get("SKCAPSTONE_AGENT", "lumina")
-    mem_dir = home / "agents" / agent_name / "memory"
+    from . import active_agent_name
+
+    agent_name = os.environ.get("SKCAPSTONE_AGENT") or active_agent_name()
+    if home.parent.name == "agents":
+        # home is already an agent-specific dir (e.g. ~/.skcapstone/agents/lumina)
+        mem_dir = home / "memory"
+    elif agent_name:
+        mem_dir = home / "agents" / agent_name / "memory"
+    else:
+        mem_dir = home / "memory"
     if not mem_dir.exists():
         return results
 
@@ -252,7 +261,7 @@ def _search_messages(
     home: Path,
     pattern: re.Pattern,
 ) -> list[SearchResult]:
-    """Search archived SKComm envelope files (.skc.json).
+    """Search archived SKComms envelope files (.skc.json).
 
     Handles both the legacy schema (payload.text) and the newer
     schema (payload.content).
@@ -262,7 +271,7 @@ def _search_messages(
         pattern: Compiled search pattern.
 
     Returns:
-        List of SearchResult objects from SKComm messages.
+        List of SearchResult objects from SKComms messages.
     """
     results: list[SearchResult] = []
 
@@ -387,7 +396,7 @@ def search(
     """Search across all agent data stores.
 
     Performs full-text regex matching against memories, conversations,
-    SKComm messages, and journal entries. Results are ranked by a
+    SKComms messages, and journal entries. Results are ranked by a
     combined relevance × recency score, highest first.
 
     Args:

package/src/skcapstone/uninstall_wizard.py

@@ -35,6 +35,9 @@ from rich.table import Table
 
 from . import AGENT_HOME
 
+import logging
+logger = logging.getLogger(__name__)
+
 console = Console()
 
 
@@ -236,7 +239,8 @@ def _transfer_to_device(
             d for name, d in registry.get("devices", {}).items()
             if name != hostname and d.get("is_datastore")
         ]
-    except Exception:
+    except Exception as e:
+        logger.warning("uninstall_wizard.py: %s", e)
         other_devices = []
 
     if not other_devices:
@@ -310,6 +314,7 @@ def _deregister_from_vault_registry(home_path: Path) -> None:
     except ImportError:
         console.print("[dim]skref not installed — skipping[/]")
     except Exception as exc:
+        logger.warning("uninstall_wizard.py: %s", exc)
         console.print(f"[yellow]{exc}[/]")
 
 
@@ -331,6 +336,7 @@ def _teardown_tailscale() -> None:
     except ImportError:
         console.print("[dim]skref not installed — skipping[/]")
     except Exception as exc:
+        logger.warning("uninstall_wizard.py: %s", exc)
         console.print(f"[yellow]{exc}[/]")
 
 
@@ -369,6 +375,7 @@ def _remove_syncthing_folder(home_path: Path) -> None:
 
         console.print("[dim]no matching folder found[/]")
     except Exception as exc:
+        logger.warning("uninstall_wizard.py: %s", exc)
         console.print(f"[dim]could not reach Syncthing API: {exc}[/]")
         console.print(
             "  [dim]You may need to remove the shared folder manually\n"
@@ -450,8 +457,8 @@ def _uninstall_packages() -> None:
 
     console.print("  Uninstalling packages...", end=" ")
     packages = [
-        "skcapstone", "capauth", "skmemory", "skcomm",
-        "cloud9-protocol", "skref", "skchat",
+        "skcapstone", "capauth", "skmemory", "skcomms",
+        "cloud9", "skref", "skchat",
     ]
     try:
         result = subprocess.run(
@@ -529,6 +536,7 @@ def _export_backup(home_path: Path) -> Optional[Path]:
         )
         return archive_path
     except Exception as exc:
+        logger.warning("uninstall_wizard.py: %s", exc)
         console.print(f"[red]failed: {exc}[/]")
         return None
 

package/src/skcapstone/version_check.py

@@ -9,20 +9,22 @@ standalone ``skcapstone version-check`` CLI command.
 from __future__ import annotations
 
 import json
+import logging
 import urllib.request
 import urllib.error
 from dataclasses import dataclass, field
 from typing import Optional
 
+logger = logging.getLogger(__name__)
 
 ECOSYSTEM_PACKAGES = [
     "skmemory",
     "skcapstone",
     "capauth",
     "sksecurity",
-    "skcomm",
+    "skcomms",
     "skchat",
-    "cloud9-protocol",
+    "cloud9",
 ]
 
 
@@ -82,7 +84,8 @@ def _get_installed_version(package_name: str) -> Optional[str]:
         from importlib.metadata import version
 
         return version(package_name)
-    except Exception:
+    except Exception as e:
+        logger.debug("version_check.py metadata lookup failed: %s", e)
         # Try import-based fallback for packages with dashes
         try:
             mod_name = package_name.replace("-", "_")
@@ -90,7 +93,8 @@ def _get_installed_version(package_name: str) -> Optional[str]:
 
             mod = importlib.import_module(mod_name)
             return getattr(mod, "__version__", None)
-        except Exception:
+        except Exception as e:
+            logger.debug("version_check.py import fallback failed: %s", e)
             return None
 
 

package/src/skcapstone/warmth_anchor.py

@@ -287,7 +287,8 @@ def _calibrate_from_memories(home: Path, cal: AnchorCalibration) -> None:
 
     try:
         memories = list_memories(home, limit=50)
-    except Exception:
+    except Exception as e:
+        logger.warning("warmth_anchor.py: %s", e)
         return
 
     if not memories:
@@ -314,7 +315,8 @@ def _calibrate_from_coordination(home: Path, cal: AnchorCalibration) -> None:
         board = Board(home)
         views = board.get_task_views()
         agents = board.load_agents()
-    except Exception:
+    except Exception as e:
+        logger.warning("warmth_anchor.py: %s", e)
         return
 
     done = sum(1 for v in views if v.status.value == "done")

package/src/skcapstone/whoami.py

@@ -48,7 +48,7 @@ class IdentityCard(BaseModel):
         trust_status: Current trust state (active, degraded, missing).
         consciousness: Agent consciousness level.
         memory_count: How many memories the agent holds.
-        contact_uris: Ways to reach this agent (skcomm, email, nostr, etc.).
+        contact_uris: Ways to reach this agent (skcomms, email, nostr, etc.).
         hostname: Machine the card was generated on.
         created_at: When this card was generated.
     """
@@ -246,10 +246,10 @@ def _load_capabilities(home: Path, card: IdentityCard) -> None:
         logger.debug("capauth not installed — skipping capauth:identity capability")
 
     try:
-        import skcomm  # noqa: F401
-        caps.append("skcomm:messaging")
+        import skcomms  # noqa: F401
+        caps.append("skcomms:messaging")
     except ImportError:
-        logger.debug("skcomm not installed — skipping skcomm:messaging capability")
+        logger.debug("skcomms not installed — skipping skcomms:messaging capability")
 
     try:
         import skchat  # noqa: F401

package/systemd/skcapstone.service

@@ -16,20 +16,18 @@ MemoryMax=4G
 # Keep Ollama models warm for 5 minutes between requests
 Environment=PYTHONUNBUFFERED=1
 Environment=OLLAMA_KEEP_ALIVE=5m
+Environment=SKAGENT=lumina
 Environment=SKCAPSTONE_AGENT=lumina
+Environment=SKMEMORY_AGENT=lumina
 # Journal logging
 StandardOutput=journal
 StandardError=journal
 SyslogIdentifier=skcapstone
 
-# Security hardening
+# Security hardening (relaxed — ProtectHome=read-only breaks if any
+# ReadWritePaths dir is missing on the host)
 NoNewPrivileges=true
-ProtectSystem=strict
-ProtectHome=read-only
-ReadWritePaths=%h/.skcapstone %h/.skenv %h/.capauth %h/.cloud9 %h/.skcomm %h/.skchat
 PrivateTmp=true
-ProtectKernelTunables=true
-ProtectControlGroups=true
 
 [Install]
 WantedBy=default.target