@zerwiz/ymir 0.1.16 → 0.1.18

package/data/projects.md

@@ -0,0 +1,28 @@
+# Projects Inventory
+
+## Active Projects
+
+### Ymir Platform Development
+- Status: Initial setup
+- Description: Core development of the Ymir agent platform
+- Owner: zerwiz (Allfather)
+- Priority: High
+
+## Project Structure
+
+Each project follows the naming convention:
+{team}-{project-name}
+
+Projects are tracked in svartalfaheim/{realm}/workspace/development/
+
+## Onboarding Process
+1. Define scope and requirements 
+2. Establish team structure
+3. Set up monitoring and alerting
+4. Deploy initial configuration
+5. Validate integration
+
+## Resources
+- Git repository: main Ymir platform repo
+- CI/CD pipeline: configured via .github/workflows/
+- Monitoring: integrated with Mimirsbrunn

package/data/realm.md

@@ -0,0 +1 @@
+wayof

package/deploy/Containerfile

@@ -0,0 +1,27 @@
+# Ymir baked image — an OPTIONAL alternative to bind-mounting the checkout.
+#
+# Build with either engine (the core resolves engines; this file does not care):
+#   podman build -f deploy/Containerfile -t ymir:local .
+#   docker build -f deploy/Containerfile -t ymir:local .
+#
+# The bind-mount examples in deploy/quadlet and deploy/compose are simpler for a
+# self-host box (updates are `git pull`). Use this image when you want an
+# immutable release: pin a tag, roll back by tag.
+#
+# Durable state still needs volumes: state/, workspace/, .agents/memory/,
+# agents/, and apps/*/dist. The image bakes only code.
+
+FROM docker.io/oven/bun:1
+
+# The core needs git, python3 (the memory well/CLI), curl, and TLS roots.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      git python3 python3-venv curl ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /opt/ymir
+COPY . /opt/ymir
+ENV YMIR_ROOT=/opt/ymir
+
+EXPOSE 38888 38889 54370
+CMD ["bash", "-lc", "cd /opt/ymir && bash scripts/start.sh"]

package/deploy/README.md

@@ -0,0 +1,104 @@
+# Deploy — the agnostic deployment layer
+
+Ymir's **core is host-agnostic**: one portable runtime, no provider assumptions.
+A *deployment* is a thin host-managed layer **over** that core — never inside it.
+This directory ships the neutral contract and example layers; adopt whichever
+matches the host.
+
+## The neutral contract
+
+Any deployment must provide exactly these; nothing more is expected of it:
+
+```
+contract[6]{needs,example}:
+  "the checkout","the Ymir repo available at a path (bind-mount or baked image)"
+  "a runtime","git · python3 · curl · bun (the core runs on any of Docker/Podman/bare)"
+  "env","HLIDSKJALF_AUTH + realm/env from .env.local (never inline, never committed)"
+  "persistent state","state/, workspace/, .agents/memory/, agents/, apps/*/dist — writable and durable"
+  "ports","SPA :38888 · gate :38889 · Smíðja visualizer :54370 (5-digit ≤ 65535, env-driven: HLIDSKJALF_PORT · HLIDSKJALF_API_PORT · SMIDJA_VIZ_API_PORT) · well :4602 · Bifrost :4603 internal"
+  "a raise command","scripts/start.sh (lower with scripts/stop.sh)"
+```
+
+The engine is resolved by the core (`bin/ymir-platform.sh` → `ymir_container_engine`),
+not by the deployment. A layer never names `docker` or `podman`.
+
+## Shapes (pick one; they are equivalent)
+
+| Shape | When | Path |
+|---|---|---|
+| **Bare** | a dedicated box, or a container you already manage | `scripts/start.sh` directly |
+| **Quadlet** (Podman + systemd) | a Fedora/RHEL host running rootless Podman | `deploy/quadlet/ymir.container` |
+| **Compose** (Docker or `podman-compose`) | a Docker host or mixed fleet | `deploy/compose/compose.yaml` |
+
+```
+# bare
+scripts/start.sh
+
+# quadlet (rootless, per-user)
+cp deploy/quadlet/ymir.container ~/.config/containers/systemd/
+systemctl --user daemon-reload && systemctl --user start ymir.service
+
+# compose
+cp deploy/env.example .env   # then edit; never commit
+docker compose -f deploy/compose/compose.yaml up -d
+# or: podman-compose -f deploy/compose/compose.yaml up -d
+```
+
+## Baked image (optional)
+
+Prefer an immutable release to a bind-mounted checkout? Build `deploy/Containerfile`
+with either engine and point the Quadlet/Compose `Image=` at your tag:
+
+```bash
+podman build -f deploy/Containerfile -t ymir:0.1.0 .   # or: docker build …
+```
+
+Durable state still needs volumes (`state/`, `workspace/`, `.agents/memory/`,
+`agents/`, `apps/*/dist`) — the image bakes only code. Validated: the Quadlet unit
+passes Podman's own generator (`/usr/libexec/podman/quadlet -dryrun -user`).
+
+## Isolation on a **shared** server
+
+When Ymir shares a machine with other services, the **container is the boundary**:
+rootless Podman gives Ymir its own mount namespace, user namespace, cgroup limits,
+SELinux labels, and no host root. That is what stops Ymir from disturbing the rest
+of the box — not bwrap.
+
+The confinement layers, from the outside in:
+
+```
+isolation[3]{layer,boundary,when}:
+  "Host ↔ Ymir","the container (Quadlet/Compose): rootless, cap-drop ALL, no-new-privileges, :Z labels","always, on a shared host"
+  "Ymir ↔ agent command","bwrap — scopes a single model-generated command to one worktree","only when the probe passes; never required"
+  "Ymir ↔ untrusted code","Utgard (a nested container) or the container itself","for code the agent writes and runs"
+```
+
+### bwrap inside the Quadlet
+
+bwrap needs to create a **nested user namespace**. Rootless Podman containers are
+already inside a user namespace, and many hardened configs disallow nesting — then
+bwrap fails with `Creating new namespace failed: Operation not permitted`.
+
+So: **do not force it.** The core probes with `bin/ymir-isolation.sh probe` and falls
+back to the container boundary when nested namespaces are unavailable. If you want
+bwrap *inside* the Quadlet, the container must opt in (and that loosens it — weigh
+it against the boundary you gain):
+
+```ini
+# deploy/quadlet/ymir.container — enable ONLY if you want bwrap inside
+UserNS=keep-id
+AddCapability=SYS_ADMIN
+# and, where the host's seccomp profile blocks clone3/unshare:
+# SecurityOpt=seccomp=unconfined
+```
+
+The recommended posture on a shared server is **no bwrap inside**: trust the
+rootless container as the wall, and run untrusted code in Utgard. Enable the block
+above only when you have a specific need to confine individual commands and accept
+the looser container.
+
+## Portability (Rule 05)
+
+A layer is gated on its host and reports a clean skip elsewhere — the Quadlet layer
+is a no-op on macOS, and Compose is a no-op on a bare box. When the core changes,
+every layer here is updated in the same change.

package/deploy/compose/compose.yaml

@@ -0,0 +1,45 @@
+# Ymir via Compose — works with `docker compose` and `podman-compose`.
+#
+#   cp deploy/env.example .env      # then edit; never commit
+#   docker compose -f deploy/compose/compose.yaml up -d
+#   podman-compose -f deploy/compose/compose.yaml up -d
+#
+# YMIR_ROOT is the host path to the checkout (default: this repo). The core
+# resolves the container engine itself; this file never names one beyond the
+# compose driver you invoke.
+
+services:
+  ymir:
+    image: docker.io/oven/bun:1
+    container_name: ymir
+    working_dir: /opt/ymir
+    command: ["bash", "-lc", "cd /opt/ymir && bash scripts/start.sh"]
+    volumes:
+      # `:Z` relabels for SELinux hosts; harmless elsewhere.
+      - ${YMIR_ROOT:-../..}:/opt/ymir:Z
+    ports:
+      # Loopback-only (127.0.0.1) so Ymir is never exposed externally; 5-digit to
+      # avoid collisions on a shared host. Keep in step with HLIDSKJALF_PORT /
+      # HLIDSKJALF_API_PORT / SMIDJA_VIZ_API_PORT.
+      - "127.0.0.1:38888:38888"   # SPA
+      - "127.0.0.1:38889:38889"   # gate API
+      - "127.0.0.1:54370:54370"   # Smíðja visualizer
+    env_file:
+      - ${YMIR_ENV:-../../.env.local}
+    environment:
+      # Override durable state if you keep it outside the checkout.
+      YMIR_ROOT: /opt/ymir
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    tmpfs:
+      - /tmp
+    # Podman rootless: keep the host user so the bind mount stays yours.
+    # Docker users: comment this out (Docker only accepts `host`/`private`).
+    userns_mode: keep-id
+    restart: unless-stopped
+
+    # --- bwrap inside the container (OPTIONAL; loosens the boundary) ----------
+    # cap_add: [SYS_ADMIN]
+    # security_opt: ["no-new-privileges:true", "seccomp=unconfined"]

package/deploy/env.example

@@ -0,0 +1,30 @@
+# Ymir deployment environment — copy and edit, keep 0600, never commit.
+# Referenced by deploy/quadlet/ymir.container (EnvironmentFile) and
+# deploy/compose/compose.yaml (env_file).
+
+# The operator's own credentials: user:password. Everyone else enters by invite.
+# NEVER inline this in a committed file — this example is a reference only.
+HLIDSKJALF_AUTH=
+
+# The memory well's HTTP bridge (in-container default).
+MIMIRSBRUNN_URL=http://127.0.0.1:4602
+
+# GitHub sign-in (optional; the password door always works without it).
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+
+# --- container engine (only if you must force one) --------------------------
+# The core auto-detects docker|podman; set this only to override.
+# YMIR_CONTAINER_ENGINE=podman
+
+# --- ports -------------------------------------------------------------------
+# 5-digit by default so a shared host is unlikely to collide. The SPA, the gate
+# API, and the visualizer each take one; keep the Quadlet/Compose PublishPort in
+# step with these.
+HLIDSKJALF_PORT=38888          # SPA
+HLIDSKJALF_API_PORT=38889      # gate API
+SMIDJA_VIZ_API_PORT=54370      # Smíðja visualizer
+# Inside a container the SPA must bind all interfaces so the published (loopback)
+# port can reach it; bare local dev keeps the 127.0.0.1 default.
+HLIDSKJALF_HOST=0.0.0.0
+# SMIDJA_VIZ_URL=http://127.0.0.1:54370

package/deploy/quadlet/ymir.container

@@ -0,0 +1,57 @@
+# Ymir as a rootless Podman Quadlet (systemd --user).
+#
+# Install (per-user, rootless):
+#   mkdir -p ~/.config/containers/systemd ~/.config/ymir
+#   cp deploy/quadlet/ymir.container ~/.config/containers/systemd/
+#   cp deploy/env.example ~/.config/ymir/ymir.env      # then edit (0600)
+#   systemctl --user daemon-reload && systemctl --user start ymir.service
+#
+# The container is the isolation boundary against other services on the host.
+# bwrap inside the container is OFF by default (see deploy/README.md).
+
+[Unit]
+Description=Ymir substrate — Hlidskjalf, gate API, memory well
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+Image=docker.io/oven/bun:1
+ContainerName=ymir
+
+# The checkout, bind-mounted; state lives with it, so updates are `git pull`.
+# `:Z` relabels for SELinux (harmless where SELinux is off).
+Volume=%h/dev/Way-Of/ymir:/opt/ymir:Z
+
+WorkingDir=/opt/ymir
+EnvironmentFile=%h/.config/ymir/ymir.env
+
+# Host ports, bound to LOOPBACK only (127.0.0.1) so Ymir is never exposed on the
+# host's external interfaces — a shared server stays shared, not public. 5-digit
+# so a shared host is unlikely to collide; keep in step with HLIDSKJALF_PORT /
+# HLIDSKJALF_API_PORT / SMIDJA_VIZ_API_PORT. The well/Bifrost stay internal.
+PublishPort=127.0.0.1:38889:38889
+PublishPort=127.0.0.1:38888:38888
+PublishPort=127.0.0.1:54370:54370
+
+# Hardening: rootless, no new privileges, drop every capability. Ymir needs none.
+NoNewPrivileges=true
+DropCapability=ALL
+Tmpfs=/tmp
+
+# Map the host user so the bind-mounted checkout stays owned by you.
+UserNS=keep-id
+
+# --- bwrap inside the container (OPTIONAL; loosens the boundary) --------------
+# Enable only if you want per-command bwrap confinement. Uncommenting grants the
+# container the ability to create nested namespaces.
+# AddCapability=SYS_ADMIN
+# SecurityOpt=seccomp=unconfined
+
+Exec=bash -lc 'cd /opt/ymir && bash scripts/start.sh'
+
+[Service]
+Restart=on-failure
+TimeoutStartSec=0
+
+[Install]
+WantedBy=default.target

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zerwiz/ymir",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "Ymir \u2014 the single-tenant agent operating system. Omarchy-first, host-aware, self-healing.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/zerwiz/ymir",
@@ -43,7 +43,15 @@
     "!.agents/memory/well/*.jsonl",
     "!.agents/memory/*.db",
     "!**/__pycache__/",
-    "!**/*.pyc"
+    "!**/*.pyc",
+    ".pi/",
+    ".opencode/",
+    ".claude/",
+    ".codex/",
+    ".cursor/",
+    "assets/",
+    "data/",
+    "deploy/"
   ],
   "engines": {
     "node": ">=20"
@@ -59,12 +67,6 @@
     "test": "bash .agents/skills/galdr-ymirsystem/scripts/compliance-check.sh",
     "compliance": "bash .agents/skills/galdr-ymirsystem/scripts/compliance-check.sh"
   },
-  "optionalDependencies": {
-    "@zerwiz/hlidskjalf": "0.1.1",
-    "@zerwiz/odrerir": "0.1.1",
-    "@zerwiz/sessrumnir": "0.1.9",
-    "@zerwiz/smidja-factory": "^0.1.0"
-  },
   "dependencies": {
     "@zerwiz/hlidskjalf": "^0.1.1",
     "@zerwiz/odrerir": "^0.1.1",