@zerwiz/ymir 0.1.4 → 0.1.5

package/.agents/backend/model-bridge.py

@@ -0,0 +1,290 @@
+#!/usr/bin/env python3
+"""model-bridge.py — expose a model provider to pi via an OpenAI-compatible
+local endpoint.
+
+Why: pi resolves models from ~/.pi/agent/models.json, which cannot read the API
+key from the repo's .env. This bridge listens on 127.0.0.1, reads the provider
+credential from .env, and proxies /v1/* to the selected provider. pi then just
+registers the provider with baseUrl=http://127.0.0.1:PORT/v1 and any placeholder
+key.
+
+Providers (YMIR_MODEL_PROVIDER):
+    opencode-go   (default)  OpenCode Zen Go gateway — REQUIRES OPENCODE_GO_API_KEY
+    lmstudio                 LM Studio on localhost — NO KEY REQUIRED
+    openai-compatible        any OpenAI-compatible server — optional key
+
+The Allfather chooses. No provider is forced to need a key: LM Studio runs
+entirely locally and the bridge starts with no credential at all.
+
+Endpoints (OpenAI-compatible):
+    GET  /v1/models                          -> model list (for pi listing)
+    POST /v1/chat/completions                -> proxied (JSON or SSE stream)
+
+Usage:
+    python3 model-bridge.py [--port 4603] [--env /path/.env] [--provider NAME]
+
+Env:
+    YMIR_MODEL_PROVIDER       opencode-go | lmstudio | openai-compatible
+    YMIR_MODEL_BASE_URL       override the provider's base URL
+    YMIR_MODEL_API_KEY        credential for the selected provider
+    OPENCODE_GO_API_KEY       credential when provider=opencode-go
+    LMSTUDIO_BASE_URL         default http://127.0.0.1:1234/v1
+    OPENCODE_GO_BASE_URL      default https://opencode.ai/zen/go/v1
+    OPENCODE_GO_BRIDGE_PORT   default 4603
+"""
+import argparse
+import json
+import os
+import sys
+import urllib.request
+import urllib.error
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+DEFAULT_PORT = 4603
+
+# Provider catalogue. `key_env` lists the env names checked, in order; an empty
+# key requirement (lmstudio) means the bridge starts with no credential.
+PROVIDERS = {
+    "opencode-go": {
+        "base_url": "https://opencode.ai/zen/go/v1",
+        "base_url_env": "OPENCODE_GO_BASE_URL",
+        "key_env": ["OPENCODE_GO_API_KEY", "YMIR_MODEL_API_KEY"],
+        "requires_key": True,
+    },
+    "lmstudio": {
+        "base_url": "http://127.0.0.1:1234/v1",
+        "base_url_env": "LMSTUDIO_BASE_URL",
+        "key_env": ["LMSTUDIO_API_KEY", "YMIR_MODEL_API_KEY"],
+        "requires_key": False,
+    },
+    "openai-compatible": {
+        "base_url": "",
+        "base_url_env": "YMIR_MODEL_BASE_URL",
+        "key_env": ["YMIR_MODEL_API_KEY"],
+        "requires_key": False,
+    },
+}
+
+# The opencode-go catalog (from `opencode models`, 2026-08-31).
+# Bare model ids — the gateway rejects the `opencode-go/` prefix.
+MODELS = [
+    {"id": "deepseek-v4-flash", "contextWindow": 131072, "input": ["text"]},
+    {"id": "deepseek-v4-flash-vision-exp", "contextWindow": 131072, "input": ["text", "image"]},
+    {"id": "deepseek-v4-pro", "contextWindow": 131072, "input": ["text"]},
+    {"id": "glm-5.1", "contextWindow": 131072, "input": ["text"]},
+]
+
+# Resolved at startup.
+KEY = ""
+BASE_URL = ""
+PROVIDER = "opencode-go"
+
+
+def load_env(path: str) -> dict:
+    env = {}
+    try:
+        with open(path) as f:
+            for line in f:
+                line = line.strip()
+                if not line or line.startswith("#") or "=" not in line:
+                    continue
+                k, _, v = line.partition("=")
+                env[k.strip()] = v.strip().strip('"').strip("'")
+    except FileNotFoundError:
+        pass
+    return env
+
+
+def resolve_provider(env: dict, cli_provider: str | None) -> str:
+    name = (cli_provider or env.get("YMIR_MODEL_PROVIDER")
+            or os.environ.get("YMIR_MODEL_PROVIDER") or "opencode-go").strip()
+    if name not in PROVIDERS:
+        print(f"[bridge] ERROR: unknown provider '{name}'. "
+              f"Choose one of: {', '.join(PROVIDERS)}", file=sys.stderr)
+        raise SystemExit(2)
+    return name
+
+
+def resolve_base_url(env: dict, spec: dict) -> str:
+    for holder in (env, os.environ):
+        v = holder.get("YMIR_MODEL_BASE_URL")
+        if v:
+            return v
+    v = env.get(spec["base_url_env"]) or os.environ.get(spec["base_url_env"])
+    return v or spec["base_url"]
+
+
+def resolve_key(env: dict, spec: dict) -> str:
+    for name in spec["key_env"]:
+        v = env.get(name) or os.environ.get(name)
+        if v:
+            return v
+    return ""
+
+
+def is_https(url: str) -> bool:
+    return url.startswith("https://")
+
+
+def split_url(url: str) -> tuple[str, str]:
+    rest = url.split("://", 1)[1]
+    host, _, path = rest.partition("/")
+    return host, "/" + path if path else ""
+
+
+class Handler(BaseHTTPRequestHandler):
+    protocol_version = "HTTP/1.1"
+
+    def log_message(self, fmt, *args):  # quieter, timestamped
+        print(f"[bridge] {self.log_date_time_string()} {fmt % args}", flush=True)
+
+    def _send(self, code: int, body: bytes, ctype: str) -> None:
+        self.send_response(code)
+        self.send_header("Content-Type", ctype)
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def _models(self) -> list:
+        # Ask the provider what it serves; fall back to the static catalogue.
+        try:
+            req = urllib.request.Request(_upstream("models"),
+                                         headers=_auth_headers())
+            with urllib.request.urlopen(req, timeout=10) as r:
+                data = json.loads(r.read())
+            return data.get("data", [])
+        except Exception:
+            return [{"id": m["id"], "object": "model"} for m in MODELS]
+
+    def do_GET(self):
+        if self.path.split("?")[0] == "/v1/models":
+            payload = {"object": "list", "data": self._models()}
+            self._send(200, json.dumps(payload).encode(), "application/json")
+        else:
+            self._send(404, json.dumps({"error": "not found"}).encode(), "application/json")
+
+    def do_POST(self):
+        if self.path.split("?")[0] != "/v1/chat/completions":
+            self._send(404, json.dumps({"error": "not found"}).encode(), "application/json")
+            return
+        try:
+            length = int(self.headers.get("Content-Length", 0))
+            body = self.rfile.read(length) if length else b"{}"
+            req = json.loads(body)
+            mid = req.get("model", "")
+            # opencode-go rejects the `opencode-go/` prefix; strip provider prefixes.
+            if PROVIDER == "opencode-go" and "/" in mid and mid.split("/", 1)[0] != "openai":
+                req["model"] = mid.split("/", 1)[1]
+            body = json.dumps(req).encode()
+            self._proxy(body, req.get("stream", False))
+        except Exception as e:
+            print(f"[bridge] proxy error: {e}", flush=True)
+            try:
+                self._send(500, json.dumps({"error": str(e)}).encode(), "application/json")
+            except Exception:
+                pass
+
+    def _proxy(self, body: bytes, stream: bool) -> None:
+        req = urllib.request.Request(
+            _upstream("chat/completions"),
+            data=body,
+            headers=_auth_headers(stream),
+            method="POST",
+        )
+        try:
+            resp = urllib.request.urlopen(req, timeout=300)
+        except urllib.error.HTTPError as e:
+            # Relay the provider's error verbatim so the operator sees the cause.
+            payload = e.read()
+            self._send(e.code, payload, e.headers.get("Content-Type", "application/json"))
+            return
+        self.send_response(resp.status)
+        ctype = resp.headers.get("Content-Type", "application/json")
+        self.send_header("Content-Type", ctype)
+        self.send_header("Cache-Control", "no-cache")
+        if stream:
+            # no Content-Length: frame as chunked so the client gets EOF at
+            # the terminating 0-chunk even though upstream SSE never closes
+            self.send_header("Transfer-Encoding", "chunked")
+            self.send_header("Connection", "close")
+            chunked = True
+        else:
+            cl = resp.headers.get("Content-Length")
+            if cl:
+                self.send_header("Content-Length", cl)
+            chunked = False
+        self.end_headers()
+        while True:
+            chunk = resp.read(4096)
+            if not chunk:
+                break
+            try:
+                if chunked:
+                    self.wfile.write(f"{len(chunk):x}\r\n".encode() + chunk + b"\r\n")
+                else:
+                    self.wfile.write(chunk)
+                self.wfile.flush()
+            except (BrokenPipeError, ConnectionResetError):
+                break  # client went away; upstream closes with us
+        if chunked:
+            try:
+                self.wfile.write(b"0\r\n\r\n")
+                self.wfile.flush()
+            except (BrokenPipeError, ConnectionResetError):
+                pass
+
+
+def _upstream(suffix: str) -> str:
+    return BASE_URL.rstrip("/") + "/" + suffix
+
+
+def _auth_headers(stream: bool = False) -> dict:
+    h = {"Content-Type": "application/json",
+         "Accept": "text/event-stream" if stream else "application/json"}
+    if KEY:
+        h["Authorization"] = f"Bearer {KEY}"
+    return h
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("--port", type=int,
+                    default=int(os.environ.get("OPENCODE_GO_BRIDGE_PORT", DEFAULT_PORT)))
+    ap.add_argument("--env", default=os.environ.get("ENV_FILE",
+                    str(__import__("pathlib").Path(__file__).resolve().parents[1] / ".env")))
+    ap.add_argument("--provider", default=None,
+                    help="opencode-go | lmstudio | openai-compatible")
+    args = ap.parse_args()
+
+    global KEY, BASE_URL, PROVIDER
+    env = load_env(args.env)
+    PROVIDER = resolve_provider(env, args.provider)
+    spec = PROVIDERS[PROVIDER]
+    BASE_URL = resolve_base_url(env, spec)
+    KEY = resolve_key(env, spec)
+
+    if spec["requires_key"] and not KEY:
+        print(f"[bridge] ERROR: provider '{PROVIDER}' requires a key. Set "
+              f"{' or '.join(spec['key_env'])} in {args.env}, or choose a "
+              f"keyless provider such as 'lmstudio'.", file=sys.stderr)
+        return 1
+    if not BASE_URL:
+        print(f"[bridge] ERROR: provider '{PROVIDER}' has no base URL. Set "
+              f"YMIR_MODEL_BASE_URL in {args.env}.", file=sys.stderr)
+        return 1
+
+    host, path = split_url(BASE_URL)
+    keynote = "no key required" if not KEY else f"key from {args.env}"
+    print(f"[bridge] provider '{PROVIDER}' on 127.0.0.1:{args.port}/v1 "
+          f"-> {host}{path.rstrip('/')}/chat/completions ({keynote})", flush=True)
+
+    srv = ThreadingHTTPServer(("127.0.0.1", args.port), Handler)
+    try:
+        srv.serve_forever()
+    except KeyboardInterrupt:
+        print("\n[bridge] stopped", flush=True)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/.agents/backend/opencode-go-bridge.py

@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+"""opencode-go-bridge.py — backward-compatible entry point.
+
+The bridge grew a provider choice, so the implementation now lives in
+`model-bridge.py`. This shim keeps every existing reference to
+`opencode-go-bridge.py` working by delegating with `--provider opencode-go`.
+
+Prefer `model-bridge.py` (or `bin/bifrost-bridge.sh --provider NAME`) for new
+work; the full provider list is opencode-go, lmstudio, openai-compatible.
+"""
+import os
+import sys
+
+
+def main() -> int:
+    # Load model-bridge.py by path (its name is not a valid module identifier).
+    import importlib.util
+    here = os.path.dirname(os.path.abspath(__file__))
+    spec = importlib.util.spec_from_file_location(
+        "model_bridge", os.path.join(here, "model-bridge.py"))
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    # Force the legacy provider unless the caller already chose one.
+    if "--provider" not in sys.argv:
+        sys.argv += ["--provider", "opencode-go"]
+    return mod.main()
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/.agents/bus/README.md

@@ -0,0 +1,12 @@
+# RATATOSKR — Inter-Agent Message Bus
+
+Low-latency event queue carrying messages between agents, realms, and services.
+
+## Planned Files
+- `protocol.ts` — `InterAgentMessage` schema (sender/recipient/type/payload/status)
+- `messages.json` — active message queue state (exists)
+
+## Message Flow
+1. Broker (Redis or file-backed) dispatches messages
+2. Inbox consumers (agents) poll for pending tasks
+3. All messages audited to `workspace/memory/runes_audit.md`

package/.agents/bus/messages.json

@@ -0,0 +1 @@
+[]

package/.agents/config/agents.machine.example.yaml

@@ -0,0 +1,16 @@
+# config/agents.<hostname>.yaml — a per-machine OVERLAY for the personal setup.
+#
+# Copies next to config/agents.yaml and is deep-merged over it when the
+# hostname matches (short form, before the first dot). Override the hostname
+# with YMIR_AGENTS_MACHINE. Use it so each machine runs its own model/harness
+# combination from one repo. Private (gitignored); this .example is the shape.
+
+# Example: this machine's hnoss runs a bigger local model, and its default
+# fallback differs.
+# agents:
+#   hnoss: { model: "llama.cpp/qwen3.6-35b-q4_k_s" }
+#   brokk: { model: opencode-go/deepseek-v4.1-flash }
+# providers:
+#   llama.cpp:
+#     base_url: "http://127.0.0.1:8080/v1"
+# default_model: opencode-go/deepseek-v4.1-flash

package/.agents/config/agents.yaml

@@ -0,0 +1,50 @@
+# config/agents.yaml — the Allfather's own combination of smiths and models.
+#
+# THIS IS YOUR FILE. Edit it, then run:  bin/agents-config.sh apply
+# No other Ymir file hardcodes a model for you; this YAML is the one place.
+# Any agent without its own `model:` inherits `default_model`.
+
+version: 1
+
+# The harness is chosen by where the model lives — local through pi, online
+# through opencode. An agent may still name `harness:` to override the rule.
+harness:
+  local: pi              # a model on a local provider runs through pi
+  online: opencode       # a hosted model runs through opencode
+  local_providers: [llama.cpp, llama-cpp, lmstudio]
+  # The same local server is named differently per harness; translate on the way.
+  providers:
+    llama.cpp: { pi: llama-cpp }
+
+# The fallback smith for any agent that does not name a model.
+default_model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl
+
+# Local, keyless model servers. `apply` writes these into the project harness
+# config (opencode.json) so a model listed here is immediately usable. A bare
+# alias (no @quant) is auto-resolved against the server's /v1/models.
+providers:
+  llama.cpp:
+    npm: "@ai-sdk/openai-compatible"
+    name: "llama-server (local)"
+    base_url: "http://127.0.0.1:8080/v1"
+    models:
+      # A local llama.cpp router needs the EXACT served id (the @quant suffix);
+      # `apply` resolves the bare alias below to the id the server reports.
+      - frontend-design-expert-8b
+
+# agent name -> { model, harness?, primary? }. Omit model to inherit
+# default_model. Omit harness to follow the local/online rule above.
+# `primary: true` marks the agent runnable directly (mode: all), not only
+# dispatchable by another agent.
+agents:
+  brokk:   { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }
+  # Hnoss the Shaper runs local (no cloud key) -> pi, and is directly runnable.
+  hnoss:   { model: "llama.cpp/qwen3.6-35b-a3b@q2_k_xl", primary: true }
+  sindri:  { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }
+  bragi:   { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }
+  huginn:  { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }
+  kvasir:  { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }
+  mimir:   { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }
+  snotra:  { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }
+  forseti: { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }
+  galdr:   { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }

package/.agents/config/agents.yaml.example

@@ -0,0 +1,72 @@
+# config/agents.yaml.example — TEMPLATE for the Allfather's personal setup.
+#
+# Installation copies this to config/agents.yaml when none exists
+# (bin/ymir-install.sh step: host) — or run: bin/agents-config.sh init
+# Edit config/agents.yaml, then: bin/agents-config.sh apply
+# config/agents.yaml is gitignored: it is YOURS, private, and pushable to a
+# private repo. Override its path with YMIR_AGENTS_YAML=/path/to/yours.yaml.
+# Any agent without its own `model:` inherits `default_model`.
+
+version: 1
+
+# The harness is chosen by where the model lives — local through pi, online
+# through opencode. An agent may still name `harness:` to override the rule.
+harness:
+  local: pi              # a model on a local provider runs through pi
+  online: opencode       # a hosted model runs through opencode
+  local_providers: [llama.cpp, llama-cpp, lmstudio, apodex]
+  # The same local server is named differently per harness; translate on the way.
+  providers:
+    llama.cpp: { pi: llama-cpp }
+
+# The fallback smith for any agent that does not name a model.
+default_model: opencode-go/deepseek-v4.1-flash
+
+# Local, keyless model servers. `apply` writes these into the project harness
+# config (opencode.json) so a model listed here is immediately usable. A bare
+# alias (no @quant) is auto-resolved against the server's /v1/models.
+providers:
+  llama.cpp:
+    npm: "@ai-sdk/openai-compatible"
+    name: "llama-server (local)"
+    base_url: "http://127.0.0.1:8080/v1"
+    models:
+      # A local llama.cpp router needs the EXACT served id (the @quant suffix);
+      # `apply` resolves the bare alias below to the id the server reports.
+      - frontend-design-expert-8b
+  apodex:
+    npm: "@ai-sdk/openai-compatible"
+    name: "apodex-mini (local)"
+    base_url: "http://127.0.0.1:1234/v1"
+    models:
+      - apodex-1.0-mini
+
+# agent name -> { model, harness?, primary? }. Omit model to inherit
+# default_model. Omit harness to follow the local/online rule above.
+# `primary: true` marks the agent runnable directly (mode: all), not only
+# dispatchable by another agent.
+agents:
+  brokk:   { model: opencode-go/deepseek-v4.1-flash }
+  # Hnoss the Shaper runs local (no cloud key) -> pi, and is directly runnable.
+  hnoss:   { model: "llama.cpp/frontend-design-expert-8b", primary: true }
+  sindri:  { model: opencode-go/deepseek-v4.1-flash }
+  bragi:   { model: opencode-go/deepseek-v4.1-flash }
+  huginn:  { model: "apodex/apodex-1.0-mini" }
+  kvasir:  { model: opencode-go/deepseek-v4.1-flash }
+  mimir:   { model: opencode-go/deepseek-v4.1-flash }
+  snotra:  { model: opencode-go/deepseek-v4.1-flash }
+  forseti: { model: opencode-go/deepseek-v4.1-flash }
+  galdr:   { model: opencode-go/deepseek-v4.1-flash }
+  tyr:     { model: opencode-go/deepseek-v4.1-flash }
+  saga:    { model: opencode-go/deepseek-v4.1-flash }
+  muninn:  { model: opencode-go/deepseek-v4.1-flash }
+  urdh:    { model: opencode-go/deepseek-v4.1-flash }
+  frigg:   { model: opencode-go/deepseek-v4.1-flash }
+  vor:     { model: opencode-go/deepseek-v4.1-flash }
+  syn:     { model: opencode-go/deepseek-v4.1-flash }
+  jord:    { model: opencode-go/deepseek-v4.1-flash }
+  groa:    { model: opencode-go/deepseek-v4.1-flash }
+  volundr: { model: opencode-go/deepseek-v4.1-flash }
+
+# How many LOCAL models this machine may run at once (most boxes: 1).
+local_concurrency: 1

package/.agents/config/crew-dispatch.json

@@ -0,0 +1,22 @@
+{
+  "rules": [
+    {
+      "when": "General coding tasks, implementation, refactoring, or bug fixes",
+      "use": { "harness": "opencode", "model": "opencode/nemotron-3-ultra-free", "effort": "medium" },
+      "why": "Nemotron 3 Ultra Free provides strong reasoning for coding tasks at no cost via opencode"
+    },
+    {
+      "when": "Investigation, diagnosis, planning, or ambiguous design work requiring deep reasoning",
+      "use": { "harness": "opencode", "model": "opencode/nemotron-3-ultra-free", "effort": "xhigh" },
+      "why": "Maximum reasoning for open-ended investigation and design work"
+    },
+    {
+      "when": "Trivial mechanical edits such as rote renames, formatting sweeps, or simple file gathering",
+      "use": { "harness": "opencode", "model": "opencode/nemotron-3-ultra-free", "effort": "low" },
+      "why": "Fast, cheap profile for narrow low-ambiguity tasks"
+    }
+  ],
+  "default": [
+    { "harness": "opencode", "model": "opencode/nemotron-3-ultra-free", "effort": "medium" }
+  ]
+}

package/.agents/config/cron.yaml

@@ -0,0 +1,9 @@
+# Nornir cron schedule — real jobs
+# Format: HH:MM <command>. Started idempotently by bin/nornir-cron-start.sh at
+# every session start. Private (gitignored).
+
+07:00 bin/nornir-job-daily-briefing.sh
+06:00 bin/nornir-job-observer.sh
+00:30 bin/nornir-job-skillopt-sleep.sh
+00:15 bin/nornir-job-memory-housekeeping.sh
+00:00 bin/nornir-job-git-sync.sh

package/.agents/config/eindri-dispatch.json

@@ -0,0 +1,67 @@
+{
+  "version": 1,
+  "platform": "ymir",
+  "notes": "Brokk reads these rules before dispatching an Eindri and passes only concrete --harness/--model/--effort flags to bin/einherjar-spawn.sh. opencode is the primary Ymir harness; pi is the verified secondary harness. Model tokens must match a model opencode/pi can run on this host, or be omitted to use the harness default. effort values: low|medium|high|xhigh|max.",
+  "rules": [
+    {
+      "when": "General implementation, refactoring, or bug fixes in a codebase",
+      "use": [
+        {
+          "harness": "opencode",
+          "model": "opencode-go/deepseek-v4.1-flash",
+          "effort": "medium"
+        }
+      ],
+      "why": "opencode is the primary Ymir harness; the flash model is the verified build model for implementation work"
+    },
+    {
+      "when": "Deep investigation, diagnosis, planning, or ambiguous design work requiring deep reasoning",
+      "use": [
+        {
+          "harness": "opencode",
+          "model": "opencode-go/deepseek-v4.1-flash",
+          "effort": "xhigh"
+        }
+      ],
+      "why": "Maximum reasoning for open-ended investigation and design work on the primary harness"
+    },
+    {
+      "when": "Trivial mechanical edits such as rote renames, formatting sweeps, or simple file gathering",
+      "use": [
+        {
+          "harness": "opencode",
+          "model": "opencode-go/deepseek-v4.1-flash",
+          "effort": "low"
+        }
+      ],
+      "why": "Fast, cheap profile for narrow low-ambiguity tasks"
+    },
+    {
+      "when": "Long-running autonomous or background execution: supervision branches, unattended sweeps, or persistent workers",
+      "use": [
+        {
+          "harness": "pi",
+          "effort": "medium"
+        }
+      ],
+      "why": "Pi is the verified secondary Ymir harness for persistent and background workers; omitting model uses Pi's configured default"
+    },
+    {
+      "when": "The Allfather names a model, a family/quant, or a locality (local/online)",
+      "use": [
+        {
+          "resolve": "bin/model-resolve.sh resolve \"<request>\"",
+          "then": "pass the returned --harness/--model to bin/einherjar-spawn.sh"
+        }
+      ],
+      "why": "Resolve a friendly request to an exact servable id: local -> pi, online -> opencode. If it returns unresolved (or the requested quant is unavailable, e.g. 'iq2' -> nearest), ASK the Allfather with ask_user_question; never guess. Local runs are serialized by bin/local-model-lock.sh."
+    }
+  ],
+  "default": [
+    {
+      "harness": "opencode",
+      "model": "opencode-go/deepseek-v4.1-flash",
+      "effort": "medium"
+    }
+  ]
+}

package/.agents/config/eindri-harness

@@ -0,0 +1 @@
+opencode

package/.agents/config/startup-memory-budget

@@ -0,0 +1 @@
+7500

package/.agents/config/tailscale-sync.yaml

@@ -0,0 +1,27 @@
+# config/tailscale-sync.example.yaml — TEMPLATE for the Allfather's machine mesh.
+#
+# Copies to the private, gitignored config/tailscale-sync.yaml on install, or
+# run: bin/tailscale-sync.sh init
+# Override the path with YMIR_TAILSCALE_SYNC.
+#
+# Sync is peer-to-peer over Tailscale (rsync over ssh, addressed by MagicDNS).
+# There is no central server and no relay unless the Allfather adds one.
+
+machine: zerwiz
+
+# The allowlist: only these tailnet hosts may be synced with. Use the MagicDNS
+# name (e.g. `ymir-desktop`) or the tailnet IP.
+peers:
+  - host: omarchy-1
+  - host: zerwizserver
+
+# What may move. Paths are on both ends; ~ expands on each machine.
+paths:
+  - ~/.pi/agent/models.json
+  - ~/.pi/agent/models-store.json
+  - ~/.pi/agent/settings.json
+  - ~/.pi/agent/trust.json
+
+# auth.json holds live credentials. Leave false unless the Allfather trusts
+# every listed peer to hold them; Tailscale encrypts the wire, not the trust.
+include_auth: false

package/.agents/filebrowser/.filebrowser.json

@@ -0,0 +1,6 @@
+{
+  "port": 80,
+  "baseURL": "/files",
+  "root": "/srv",
+  "address": "0.0.0.0"
+}

package/.agents/filebrowser/README.md

@@ -0,0 +1,11 @@
+# SKRYMIR — Web File Browser Config
+
+Web-based drive interface for users to view, upload, and edit workspace files.
+
+## Planned Files
+- `.filebrowser.json` — root config mapping `/files` route (exists)
+- `filebrowser.db` — user auth, roles, scoped permissions (created at runtime)
+
+## Scoping
+- `./svartalfaheim` mounted at `/srv/realms`
+- `./midgard` mounted at `/srv/shared`

package/.agents/gateway/README.md

@@ -0,0 +1,12 @@
+# BIFROST — Reverse Proxy & Gateway
+
+HTTP routing, external traffic ingress, WebSocket tunneling, and authentication guard.
+
+## Planned Files
+- `nginx.conf` — routes UI, WebSocket streams, webhook listeners
+
+## Routes
+- `/` → Hlidskjalf portal
+- `/files/` → Skrymir file browser
+- `/webhooks/github` → Mjollnir issue listener
+- `/oauth2/` → Heimdall GitHub OAuth

package/.agents/github/README.md

@@ -0,0 +1,15 @@
+# HEIMDALL & MJOLLNIR — GitHub Integration
+
+Zero-trust GitHub CI/CD, webhook security, and autonomous Issue-to-PR pipeline.
+
+## Webhooks
+- `webhooks/issue_listener.ts` — receives `issues.opened` events, verifies HMAC
+
+## Workflows
+- `workflows/deploy-staging.yml`
+- `workflows/deploy-production.yml`
+
+## Rules
+- Webhooks verified via HMAC signature
+- Secrets injected via `gh secret set` — never committed
+- Mjollnir never force-merges