@zerwiz/ymir 0.1.4 → 0.1.5

package/bin/eir-doctor.sh

@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+# eir-doctor.sh — Eir, the healer: diagnose the running system, then mend it.
+#
+# Eir composes the surfaces that already own their health — she does not
+# re-implement them. `check` (default) reports each surface; `fix` runs the
+# matching repair path for the broken ones. She never arms supervision (the
+# harness extension owns that) and never touches a tracked tree.
+#
+# Usage:
+#   eir-doctor.sh [check]      # diagnose every surface, aggregate TOON
+#   eir-doctor.sh fix          # mend what can be mended safely, then re-check
+#   eir-doctor.sh --version
+set -u
+
+VERSION="1.0.0"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+YMIR_HOME="${YMIR_HOME:-$HOME/Documents/Ymir}"
+STATE="${BROKK_STATE_OVERRIDE:-$YMIR_HOME/state}"
+
+case "${1-}" in -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;; -h|--help|"") sed -n '2,15p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;; esac
+ACTION="${1:-check}"; shift || true
+
+have() { command -v "$1" >/dev/null 2>&1; }
+say_ok() { return 0; }
+
+# Each surface: `s_<name>` = healthy? (exit 0), `f_<name>` = the repair.
+SURFACES=(floors herdr a2abridge hermes sessrumnir well mcp lock migrations)
+
+s_floors()    { [ -x "$SCRIPT_DIR/prereq-ensure.sh" ] && "$SCRIPT_DIR/prereq-ensure.sh" status >/dev/null 2>&1; }
+f_floors()    { "$SCRIPT_DIR/prereq-ensure.sh" ensure --install >/dev/null 2>&1; }
+s_herdr()     { [ -x "$SCRIPT_DIR/herdr-ensure.sh" ] && "$SCRIPT_DIR/herdr-ensure.sh" status >/dev/null 2>&1; }
+f_herdr()     { "$SCRIPT_DIR/herdr-ensure.sh" ensure --install >/dev/null 2>&1; }
+s_a2abridge() { [ -x "$SCRIPT_DIR/a2abridge-ensure.sh" ] && "$SCRIPT_DIR/a2abridge-ensure.sh" status >/dev/null 2>&1; }
+f_a2abridge() { "$SCRIPT_DIR/a2abridge-ensure.sh" ensure --install >/dev/null 2>&1; }
+s_hermes()    { [ -x "$SCRIPT_DIR/hermes-ensure.sh" ] && "$SCRIPT_DIR/hermes-ensure.sh" status >/dev/null 2>&1; }
+f_hermes()    { "$SCRIPT_DIR/hermes-ensure.sh" ensure --install >/dev/null 2>&1; }
+s_sessrumnir(){ [ -x "$SCRIPT_DIR/sessrumnir-ensure.sh" ] && "$SCRIPT_DIR/sessrumnir-ensure.sh" status >/dev/null 2>&1; }
+f_sessrumnir(){ "$SCRIPT_DIR/sessrumnir-ensure.sh" ensure --install >/dev/null 2>&1; }
+s_well()      { [ -x "$SCRIPT_DIR/mimir.sh" ] && "$SCRIPT_DIR/mimir.sh" health >/dev/null 2>&1; }
+f_well()      { "$SCRIPT_DIR/mimir.sh" start >/dev/null 2>&1; }
+# MCP: both A2A servers wired into opencode + pi.
+s_mcp() {
+  local pi="$HOME/.pi/agent/mcp.json" oc="$ROOT/opencode.json"
+  [ -f "$oc" ] || return 1
+  grep -q '"engram"' "$oc" 2>/dev/null && grep -q '"a2abridge"' "$oc" 2>/dev/null || return 1
+  if [ -f "$pi" ]; then grep -q '"a2abridge"' "$pi" 2>/dev/null || return 1; fi
+  return 0
+}
+f_mcp()       { [ -x "$SCRIPT_DIR/a2a-mcp.sh" ] && "$SCRIPT_DIR/a2a-mcp.sh" install >/dev/null 2>&1; }
+# Lock: absent, or held by a live pid.
+s_lock() {
+  local f="$STATE/.lock" pid
+  [ -r "$f" ] || return 0
+  pid="$(tr -d '[:space:]' <"$f" 2>/dev/null || true)"
+  [ -n "$pid" ] || return 0
+  kill -0 "$pid" 2>/dev/null
+}
+f_lock() {
+  local f="$STATE/.lock" pid
+  if [ -r "$f" ]; then
+    pid="$(tr -d '[:space:]' <"$f" 2>/dev/null || true)"
+    if [ -n "$pid" ] && ! kill -0 "$pid" 2>/dev/null; then
+      rm -f "$f" "$STATE/.lock-path"
+      # A stale arm marker with no live session would silence the turn-end guard.
+      rm -f "$STATE/.supervision-armed" "$STATE/.watch.heartbeat"
+    fi
+  fi
+}
+s_migrations(){ [ ! -x "$SCRIPT_DIR/ymir-migrate.sh" ] || "$SCRIPT_DIR/ymir-migrate.sh" status >/dev/null 2>&1; }
+f_migrations(){ [ -x "$SCRIPT_DIR/ymir-migrate.sh" ] && "$SCRIPT_DIR/ymir-migrate.sh" apply >/dev/null 2>&1; }
+
+detail() { # <name> -> one short fact
+  case "$1" in
+    floors)    "[ -x $SCRIPT_DIR/prereq-ensure.sh ] && echo tool floors" ;;
+    herdr)     "have herdr && herdr --version 2>/dev/null | head -1 || echo 'herdr absent'" ;;
+    a2abridge) "have a2abridge && a2abridge --version 2>/dev/null | head -1 || echo 'engine absent'" ;;
+    hermes)    "have hermes && echo present || echo absent" ;;
+    sessrumnir)"[ -d $ROOT/apps/sessrumnir/out ] && echo built || echo 'not built'" ;;
+    well)      "echo 'engram :4602'" ;;
+    mcp)       "echo 'a2abridge + engram'" ;;
+    lock)      "cat $STATE/.lock 2>/dev/null | tr -d '[:space:]' | sed 's/^/pid /' || echo none" ;;
+    migrations)"echo 'structure'" ;;
+  esac
+}
+
+broken=0
+if [ "$ACTION" = "fix" ]; then
+  for s in "${SURFACES[@]}"; do
+    if ! "s_$s" >/dev/null 2>&1; then
+      "f_$s" >/dev/null 2>&1 && printf 'eir: mended %s\n' "$s" || printf 'eir: could not mend %s\n' "$s" >&2
+    fi
+  done
+fi
+
+rows=""
+count=0
+for s in "${SURFACES[@]}"; do
+  if "s_$s" >/dev/null 2>&1; then state=ok; else state=broken; broken=$((broken+1)); fi
+  d="$("detail" "$s" 2>/dev/null | head -1)"
+  rows="${rows}  \"${s}\",\"${state}\",\"${d}\"\n"
+  count=$((count+1))
+done
+
+printf 'eir[1]{action,root,broken}:\n  "%s","%s",%s\n' "$ACTION" "$ROOT" "$broken"
+printf 'health[%d]{surface,state,detail}:\n' "$count"
+printf '%b' "$rows"
+if [ "$broken" != 0 ]; then
+  printf 'eir: %s surface(s) need mending — run: bin/eir-doctor.sh fix\n' "$broken"
+  exit 1
+fi
+exit 0

package/bin/erindi-brief.sh

@@ -0,0 +1,271 @@
+#!/usr/bin/env bash
+# erindi-brief.sh - scaffold an Eindri worker brief at data/<task-id>/brief.md.
+#
+# Erindi ("the errand") is the written errand Brokk hands an Eindri. The brief
+# carries the Setup / Rules / Definition-of-done contract, a fixed machine-
+# readable "Delivery contract: mode=<mode>" line, the worktree-isolation
+# assertion, the status protocol, and the steering-inbox receive/ack section.
+# Ported from the upstream distro brief scaffold for plan 29
+# (docs/plans/29-brokk-distro-runtime.md).
+#
+# Usage:
+#   erindi-brief.sh <task-id> <repo-name> --mode <no-mistakes|direct-PR|local-only>
+#   erindi-brief.sh <task-id> <repo-name> --scout
+#   erindi-brief.sh <task-id> --relaunch
+#
+# --scout writes the scout contract: the deliverable is a report at
+# data/<task-id>/report.md (no branch, no push, no PR) and the worktree is
+# scratch.
+# --relaunch regenerates the brief from the task's recorded state/<id>.meta so
+# a replacement Eindri receives the SAME delivery contract as the original; it
+# refuses to invent a mode and it will not run without an existing meta record.
+# The fixed "Delivery contract: mode=<mode>" line is read by
+# bin/einherjar-spawn.sh, which refuses to launch a ship task whose explicit
+# --mode disagrees, so an adjusted brief and the recorded task cannot drift.
+# --mode is refused on --scout and --relaunch: a scout delivers a report and a
+# relaunch re-derives the mode from the task record, not from a flag.
+# Refuses to overwrite an existing brief unless --relaunch is given.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+usage() {
+  awk 'NR == 1 { next } /^#/ { sub(/^# ?/, ""); print; next } { exit }' "$0"
+}
+
+case "${1:-}" in
+  -h|--help) usage; exit 0 ;;
+esac
+
+ROOT="${BROKK_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+BROKK_HOME="${BROKK_HOME:-${BROKK_ROOT_OVERRIDE:-$ROOT}}"
+DATA="${BROKK_DATA_OVERRIDE:-$BROKK_HOME/data}"
+STATE="${BROKK_STATE_OVERRIDE:-$BROKK_HOME/state}"
+PAUSED_VERB="${BROKK_PAUSED_VERB:-paused}"
+
+KIND=ship
+SCOUT=0
+RELAUNCH=0
+MODE=
+MODE_SET=0
+POS=()
+want_value=
+for a in "$@"; do
+  if [ -n "$want_value" ]; then
+    case "$a" in
+      --*) echo "error: --$want_value requires a value" >&2; exit 1 ;;
+    esac
+    case "$want_value" in
+      mode) MODE=$a; MODE_SET=1 ;;
+      *) echo "error: internal parser state for --$want_value" >&2; exit 1 ;;
+    esac
+    want_value=
+    continue
+  fi
+  case "$a" in
+    --scout) SCOUT=1 ;;
+    --relaunch) RELAUNCH=1 ;;
+    --mode) want_value=mode ;;
+    --mode=*) MODE=${a#--mode=}; MODE_SET=1 ;;
+    --yolo|--yolo=*) echo "error: --yolo is not a brief input; pass it to bin/einherjar-spawn.sh, which records the task's merge posture" >&2; exit 1 ;;
+    *) POS+=("$a") ;;
+  esac
+done
+[ -z "$want_value" ] || { echo "error: --$want_value requires a value" >&2; exit 1; }
+
+if [ "$SCOUT" -eq 1 ] && [ "$RELAUNCH" -eq 1 ]; then
+  echo "error: --scout and --relaunch are mutually exclusive" >&2
+  exit 1
+fi
+
+ID=${POS[0]:-}
+[ -n "$ID" ] || { echo "error: task-id is required" >&2; exit 2; }
+case "$ID" in
+  */*|.*|*' '*) echo "error: invalid task-id '$ID' (no slashes, no leading dot, no spaces)" >&2; exit 2 ;;
+esac
+
+meta_value() {  # <meta> <key>
+  grep "^$2=" "$1" 2>/dev/null | tail -1 | cut -d= -f2- || true
+}
+
+if [ "$RELAUNCH" -eq 1 ]; then
+  META="$STATE/$ID.meta"
+  [ -f "$META" ] || { echo "error: --relaunch requires an existing task record at $META" >&2; exit 1; }
+  RECORDED_KIND=$(meta_value "$META" kind); RECORDED_KIND=${RECORDED_KIND:-ship}
+  REPO=$(meta_value "$META" project)
+  [ -n "$REPO" ] || REPO=$(meta_value "$META" worktree)
+  [ -n "$REPO" ] || { echo "error: task record $META records no project; cannot regenerate the brief" >&2; exit 1; }
+  if [ "$MODE_SET" -eq 1 ]; then
+    echo "error: --mode is refused with --relaunch; the delivery mode is re-derived from $META" >&2
+    exit 1
+  fi
+  if [ "$RECORDED_KIND" = ship ]; then
+    MODE=$(meta_value "$META" mode)
+    case "$MODE" in
+      no-mistakes|direct-PR|local-only) ;;
+      *) echo "error: task record $META records no valid mode; refusing to regenerate the brief" >&2; exit 1 ;;
+    esac
+  elif [ "$RECORDED_KIND" != scout ]; then
+    echo "error: task record $META records kind=$RECORDED_KIND, which has no brief scaffold" >&2
+    exit 1
+  fi
+  KIND=$RECORDED_KIND
+else
+  if [ "$SCOUT" -eq 1 ]; then
+    KIND=scout
+  else
+    [ "$MODE_SET" -eq 1 ] || {
+      echo "error: ship briefs require --mode <no-mistakes|direct-PR|local-only>; resolve it at intake and pass it here" >&2
+      exit 1
+    }
+    case "$MODE" in
+      no-mistakes|direct-PR|local-only) ;;
+      *) echo "error: --mode must be one of no-mistakes, direct-PR, local-only (got '$MODE')" >&2; exit 1 ;;
+    esac
+  fi
+  if [ "$MODE_SET" -eq 1 ] && [ "$SCOUT" -eq 1 ]; then
+    echo "error: --mode applies only to ship briefs; a scout delivers a report" >&2
+    exit 1
+  fi
+  REPO=${POS[1]:-}
+  [ -n "$REPO" ] || { echo "error: <repo-name> is required for a fresh brief" >&2; exit 2; }
+fi
+
+BRIEF="$DATA/$ID/brief.md"
+if [ -e "$BRIEF" ] && [ "$RELAUNCH" -ne 1 ]; then
+  echo "error: $BRIEF already exists (use --relaunch to regenerate from the task record)" >&2
+  exit 1
+fi
+mkdir -p "$DATA/$ID"
+
+shell_quote() {
+  printf "'"
+  printf '%s' "$1" | sed "s/'/'\\\\''/g"
+  printf "'"
+}
+
+STATUS_FILE=$(shell_quote "$STATE/$ID.status")
+INBOX_DIR=$(shell_quote "$STATE/$ID.inbox")
+REPORT_FILE="$DATA/$ID/report.md"
+
+INBOX_SECTION=$(cat <<EOF
+# Brokk instruction inbox
+Brokk steers you through durable message files in $INBOX_DIR.
+When a terminal message says an instruction is waiting there - and at any natural checkpoint when you are unsure - list $INBOX_DIR/*.msg, read and act on each message in numeric order, then acknowledge each handled message by moving it: \`mv $INBOX_DIR/NNN.msg $INBOX_DIR/handled/\`.
+The move IS the acknowledgement: without it Brokk rings again and eventually treats you as stuck. An empty or absent inbox needs no action.
+EOF
+)
+
+STATUS_SECTION=$(cat <<EOF
+Report status by appending one line:
+   \`echo "{state}: {one short line}" >> $STATUS_FILE\`
+   States: working, needs-decision, blocked, $PAUSED_VERB, done, failed.
+   Each append wakes Brokk, so report sparingly: only phase changes a supervisor
+   would act on and the needs-decision/blocked/$PAUSED_VERB/done/failed states.
+   Use \`$PAUSED_VERB: {why}\` - distinct from \`blocked:\` - ONLY when you are deliberately
+   idling on a known external wait you expect to clear on its own (an upstream release,
+   a rate-limit reset); use \`blocked:\` when you are stuck and need Brokk to act.
+   A mid-task \`working:\` line is nonterminal: do not end the turn after it; continue
+   until a defined \`done:\` gate under Definition of done.
+   A decision or blocker stays open until a \`resolved\` line carrying its exact key
+   lands; a later \`done:\` or \`working:\` line never closes it.
+EOF
+)
+
+if [ "$KIND" = scout ]; then
+  cat > "$BRIEF" <<EOF
+You are an Eindri: an autonomous worker agent managed by Brokk. Work on your own; do not wait for the Allfather.
+
+# Task
+{TASK}
+
+# Delivery contract
+Delivery contract: mode=scout
+
+# Setup
+You are in a disposable git worktree of $REPO at .yggdrasil/$ID on the host (under Utgard it appears at /sandbox/workspace), at a detached HEAD on a clean default branch.
+This is a SCOUT task: the deliverable is a written report, not a PR.
+The worktree is your laboratory - install, run, edit, and make scratch commits freely; all of it is discarded at teardown.
+The report is the only thing that survives, so anything worth keeping must be in it.
+
+**Verify isolation before anything else.** Run \`pwd -P\` and \`git rev-parse --show-toplevel\`; both must resolve to this disposable task worktree (host path .yggdrasil/$ID, or /sandbox/workspace under Utgard), never the primary checkout Brokk operates from.
+If the top-level path is the primary checkout or not the worktree you were launched in, STOP - do not branch or commit here - append \`blocked: launched in primary checkout, not an isolated worktree\` to the status file and stop.
+
+# Rules
+1. Never push to any remote and never open a PR.
+2. Stay inside this worktree; the only files you may write outside it are the report and the status file below.
+3. $STATUS_SECTION
+4. If you hit the same obstacle twice, append \`blocked: {why}\` and stop; Brokk will help.
+5. If a decision belongs to the Allfather (product choices, destructive actions), append \`needs-decision: {summary of options}\` and stop. Brokk will reply with the decision.
+
+$INBOX_SECTION
+
+# Definition of done
+Write your findings to \`$REPORT_FILE\`.
+The report must stand alone: what you did, what you found, the evidence (commands run, output, file:line references), and what you recommend.
+When the report is complete, append \`done: {one-line conclusion}\` to the status file and stop.
+EOF
+  if [ "$RELAUNCH" -eq 1 ]; then
+    printf 'scaffolded: %s (scout, relaunch; replace {TASK})\n' "$BRIEF"
+  else
+    printf 'scaffolded: %s (scout; replace {TASK})\n' "$BRIEF"
+  fi
+  exit 0
+fi
+
+case "$MODE" in
+  direct-PR)
+    RULE1='Never push to the default branch (push only your `eindri/'"$ID"'` branch). Never merge a PR; the Glitnir human gate owns the merge.'
+    DOD_BODY='Commit your work on `eindri/'"$ID"'`. Push the branch and open a PR with `gh`. Report the PR URL: append `done: opened PR <url>` to the status file and stop. Brokk routes the PR to the Glitnir human gate; you never merge.'
+    ;;
+  local-only)
+    RULE1="Never push to any remote and never open a PR. Work only on your \`eindri/$ID\` branch; Brokk merges into local \`main\` after the Allfather approves."
+    DOD_BODY="Commit your work on \`eindri/$ID\`. Append \`done: ready in branch eindri/$ID\` to the status file and stop. Brokk merges into local \`main\` after the Allfather approves."
+    ;;
+  *)  # no-mistakes
+    RULE1='Never push to the default branch. Never merge a PR; the Glitnir human gate owns the merge.'
+    DOD_BODY='Run the `no-mistakes` pipeline over your branch and open the PR it produces. Append `done: <PR url> (pipeline <status>)` to the status file and stop. Brokk routes the PR to the Glitnir human gate; you never merge.'
+    ;;
+esac
+
+if [ "$MODE" = no-mistakes ]; then
+  SETUP_STEP2='
+2. Run `no-mistakes doctor`; if it reports the repo is not initialized here, run `no-mistakes init`.'
+else
+  SETUP_STEP2=""
+fi
+
+cat > "$BRIEF" <<EOF
+You are an Eindri: an autonomous worker agent managed by Brokk. Work on your own; do not wait for the Allfather.
+
+# Task
+{TASK}
+
+# Delivery contract
+Delivery contract: mode=$MODE
+
+# Setup
+You are in a disposable git worktree of $REPO at .yggdrasil/$ID on the host (under Utgard it appears at /sandbox/workspace), at a detached HEAD on a clean default branch.
+
+**Verify isolation before anything else.** Run \`pwd -P\` and \`git rev-parse --show-toplevel\`; both must resolve to this disposable task worktree (host path .yggdrasil/$ID, or /sandbox/workspace under Utgard), never the primary checkout Brokk operates from.
+The path check is authoritative. If the top-level path is the primary checkout or not the worktree you were launched in, STOP - do not branch or commit here - append \`blocked: launched in primary checkout, not an isolated worktree\` to the status file and stop.
+
+1. First action: create your branch: \`git checkout -b eindri/$ID\`$SETUP_STEP2
+
+# Rules
+1. $RULE1
+2. Stay inside this worktree; modify nothing outside it.
+3. $STATUS_SECTION
+4. If you hit the same obstacle twice, append \`blocked: {why}\` and stop; Brokk will help.
+5. If a decision belongs to the Allfather (product choices, destructive actions), append \`needs-decision: {summary of options}\` and stop. Brokk will reply with the decision.
+
+$INBOX_SECTION
+
+# Definition of done
+$DOD_BODY
+EOF
+if [ "$RELAUNCH" -eq 1 ]; then
+  printf 'scaffolded: %s (ship, mode=%s, relaunch; replace {TASK})\n' "$BRIEF" "$MODE"
+else
+  printf 'scaffolded: %s (ship, mode=%s; replace {TASK})\n' "$BRIEF" "$MODE"
+fi

package/bin/fleet-apply.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# fleet-apply.sh — apply fleet-wide preferences to every registered Eindri-home.
+#
+# Reads `data/fleet.md` (`key: value` lines; key `ro` = on|off) and writes each
+# into the home's gitignored `state/` (for `ro`: `state/ro`), so a single fleet
+# setting reaches every home without dirtying any tracked tree. Remote routes are
+# reported, not written. Galdr-style TOON.
+#
+# Usage:
+#   fleet-apply.sh [--check]
+#   fleet-apply.sh --version
+set -u
+
+VERSION="1.0.0"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+REG="${BROKK_EINDRI_HOMES:-$ROOT/data/eindri-homes.md}"
+PREFS="${BROKK_FLEET_PREFS:-$ROOT/data/fleet.md}"
+CHECK=0
+
+case "${1-}" in -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;; -h|--help) sed -n '2,12p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;; esac
+[ "${1-}" = "--check" ] && CHECK=1
+
+pref() { sed -nE "s/^[[:space:]]*$1:[[:space:]]*([^[:space:]#]+).*/\1/p" "$PREFS" 2>/dev/null | head -1; }
+
+if [ ! -f "$PREFS" ]; then
+  printf 'fleet[1]{prefs,state,detail}:\n  "absent","noop","%s (no fleet preferences set)"\n' "${PREFS#"$ROOT"/}"
+  exit 0
+fi
+
+ro="$(pref ro)"
+[ -n "$ro" ] || ro=""
+
+declare -a ROWS
+apply_home() { # <id> <path>
+  local id="$1" p="$2"
+  [ -d "$p" ] || { ROWS+=("  \"$id\",\"$p\",\"skipped\",\"not found\""); return; }
+  if [ "$CHECK" = 1 ]; then ROWS+=("  \"$id\",\"$p\",\"would-apply\",\"ro=$ro\""); return; fi
+  if [ -n "$ro" ]; then
+    mkdir -p "$p/state"
+    printf '%s\n' "$ro" >"$p/state/ro" && ROWS+=("  \"$id\",\"$p\",\"applied\",\"ro=$ro\"") || ROWS+=("  \"$id\",\"$p\",\"failed\",\"ro\"")
+  else
+    ROWS+=("  \"$id\",\"$p\",\"noop\",\"no ro pref\"")
+  fi
+}
+
+# This home is always a target.
+apply_home "this" "$ROOT"
+
+if [ -f "$REG" ]; then
+  while IFS= read -r line; do
+    case "$line" in '- '*) ;; *) continue ;; esac
+    id="$(printf '%s' "$line" | sed -nE 's/^- ([^ ]+).*/\1/p')"
+    host="$(printf '%s' "$line" | sed -nE 's/.*\(host: ([^;)]+).*/\1/p' | tr -d ' ')"
+    home="$(printf '%s' "$line" | sed -nE 's/.*\(.*home: ([^;)]+).*/\1/p' | tr -d ' ')"
+    [ -n "$id" ] || continue
+    if [ -n "$host" ]; then
+      ROWS+=("  \"$id\",\"remote $host\",\"skipped\",\"run bin/fleet-apply.sh on $host\""); continue
+    fi
+    [ -n "$home" ] || home="$id"
+    apply_home "$id" "$home"
+  done <"$REG"
+else
+  ROWS+=("  \"-\",\"registry\",\"absent\",\"$REG (no Eindri-homes registered)\"")
+fi
+
+printf 'fleet[%d]{id,target,state,detail}:\n' "${#ROWS[@]}"
+printf '%s\n' "${ROWS[@]}"

package/bin/github-deploy.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# github-deploy.sh — zero-trust deploys (W0035). Sync secrets from the local env
+# into GitHub (never into commits), dispatch a deploy workflow, and watch runs.
+# Requires the `gh` CLI, authenticated. Galdr-style TOON.
+#
+# Usage:
+#   github-deploy.sh secrets [--env staging|production] [--repo owner/name] [--project <id>]
+#   github-deploy.sh dispatch <staging|production> [--repo owner/name] [--project <id>]
+#   github-deploy.sh status [--repo owner/name] [--project <id>]
+#   github-deploy.sh --version
+#
+# Secrets synced (only those present in .env.local):
+#   NETLIFY_AUTH_TOKEN NETLIFY_SITE_ID VERCEL_TOKEN GITHUB_TOKEN TELEGRAM_BOT_TOKEN
+set -u
+
+VERSION="1.0.0"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+ENV_FILE="${BROKK_ENV_FILE:-$ROOT/.env.local}"
+SECRETS="NETLIFY_AUTH_TOKEN NETLIFY_SITE_ID VERCEL_TOKEN GITHUB_TOKEN TELEGRAM_BOT_TOKEN"
+
+case "${1-}" in
+  -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;;
+  -h|--help|"") sed -n '2,16p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+esac
+
+CMD="${1-}"; shift || true
+command -v gh >/dev/null 2>&1 || { printf 'error: gh not installed\nhelp: install the GitHub CLI\n' >&2; exit 1; }
+gh auth status >/dev/null 2>&1 || { printf 'error: gh not authenticated\nhelp: gh auth login\n' >&2; exit 1; }
+
+REPO=""; ENVIRONMENT=""; PROJ=""
+ARGS=()
+while [ $# -gt 0 ]; do case "$1" in
+  --repo) REPO=${2-}; shift 2 ;;
+  --project) PROJ=${2-}; shift 2 ;;
+  --env) ENVIRONMENT=${2-}; shift 2 ;;
+  *) ARGS+=("$1"); shift ;;
+esac; done
+if [ -n "$PROJ" ] && [ -x "$SCRIPT_DIR/project-git.sh" ]; then
+  REPO="$("$SCRIPT_DIR/project-git.sh" "$PROJ" --field owner)/$("$SCRIPT_DIR/project-git.sh" "$PROJ" --field repo)"
+fi
+REPO_ARG=(); [ -n "$REPO" ] && REPO_ARG=(--repo "$REPO")
+
+case "$CMD" in
+  secrets)
+    [ -r "$ENV_FILE" ] || { printf 'error: env file not found: %s\nhelp: put the secrets in .env.local\n' "$ENV_FILE" >&2; exit 1; }
+    printf 'secrets[%s]{name,scope,status}:\n' "$(echo "$SECRETS" | wc -w | tr -d ' ')"
+    for s in $SECRETS; do
+      v=$(grep -E "^${s}=" "$ENV_FILE" 2>/dev/null | head -1 | cut -d= -f2-)
+      if [ -z "$v" ]; then printf '  "%s","%s","absent-in-env"\n' "$s" "${ENVIRONMENT:-repo}"; continue; fi
+      if [ -n "$ENVIRONMENT" ]; then
+        printf '%s' "$v" | gh secret set "$s" --env "$ENVIRONMENT" "${REPO_ARG[@]}" >/dev/null 2>&1 && printf '  "%s","%s","set"\n' "$s" "$ENVIRONMENT" || printf '  "%s","%s","FAILED"\n' "$s" "$ENVIRONMENT"
+      else
+        printf '%s' "$v" | gh secret set "$s" "${REPO_ARG[@]}" >/dev/null 2>&1 && printf '  "%s","repo","set"\n' "$s" || printf '  "%s","repo","FAILED"\n' "$s"
+      fi
+    done
+    ;;
+
+  dispatch)
+    env_name=${ARGS[0]:-}
+    case "$env_name" in
+      staging|production) ;;
+      *) printf 'error: dispatch needs staging|production\nhelp: bin/github-deploy.sh dispatch staging\n' >&2; exit 2 ;;
+    esac
+    if gh workflow run "deploy-${env_name}.yml" "${REPO_ARG[@]}" >/dev/null 2>&1; then
+      printf 'dispatched[1]{workflow,environment,status}:\n  "deploy-%s.yml","%s","queued"\n' "$env_name" "$env_name"
+    else
+      printf 'error: dispatch failed (workflow present? gh authenticated for the repo?)\n' >&2; exit 1
+    fi
+    ;;
+
+  status)
+    printf 'runs[%s]{workflow,status,conclusion,created}:\n' "$(gh run list --limit 5 "${REPO_ARG[@]}" 2>/dev/null | wc -l | tr -d ' ')"
+    gh run list --limit 5 --json name,status,conclusion,createdAt "${REPO_ARG[@]}" 2>/dev/null | python3 -c 'import json,sys
+try: d=json.load(sys.stdin)
+except: d=[]
+for r in d: print(f"  \"{r.get(\"name\",\"\")}\",\"{r.get(\"status\",\"\")}\",\"{r.get(\"conclusion\",\"\")}\",\"{r.get(\"createdAt\",\"\")[:16]}\"")'
+    ;;
+
+  *) printf 'error: unknown command %s\nhelp: bin/github-deploy.sh [secrets|dispatch|status|--version]\n' "$CMD" >&2; exit 2 ;;
+esac

package/bin/gjallarhorn-expose.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# gjallarhorn-expose.sh — put EVERY app on its own public hostname (Gjallarhorn).
+#
+# The dev machine wears the name; the server does not. So the hostnames carry a
+# machine suffix (`dell` here) and this script refuses to run without one — a
+# server must never acquire the laptop's names.
+#
+#   bin/gjallarhorn-expose.sh plan     # the hostnames and where each points
+#   bin/gjallarhorn-expose.sh apply    # write the config, create the routes, raise the tunnel
+#   bin/gjallarhorn-expose.sh status   # what is exposed right now
+#
+# Hostnames come from the apps this machine actually serves (a port that answers)
+# plus YMIR_TUNNEL_SUFFIX: <app><suffix>.zerwiz.org. Nothing is invented: an app
+# with no HTTP surface (the desktop shells) is listed as skipped, not faked.
+set -u
+
+VERSION="1.0.0"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+TUNNEL="${YMIR_TUNNEL_NAME:-ymir}"
+DOMAIN="${YMIR_TUNNEL_DOMAIN:-zerwiz.org}"
+SUFFIX="${YMIR_TUNNEL_SUFFIX:-dell}"
+CONFIG="${YMIR_TUNNEL_CONFIG:-$HOME/.cloudflared/config-$TUNNEL.yml}"
+
+have() { command -v "$1" >/dev/null 2>&1; }
+up() { (exec 3<>"/dev/tcp/127.0.0.1/$1") 2>/dev/null; }
+
+case "${1:-plan}" in
+  -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;;
+  -h|--help|"") sed -n '2,16p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+esac
+ACTION="${1:-plan}"
+
+# host_key port app-path
+APPS=(
+  "ymir:$(( ${#SUFFIX} ? 3889 : 3889 ))"
+  "hlidskjalf:3889"
+  "odrerir:4322"
+  "smidja:8437"
+  "smidjafactory:8437"
+)
+
+if [ -z "$SUFFIX" ]; then
+  printf 'gjallarhorn[1]{step,status,detail}:\n'
+  printf '  "expose","SKIP","no YMIR_TUNNEL_SUFFIX — this is not the dev machine; the server does not wear its names"\n'
+  exit 0
+fi
+
+plan() {
+  printf 'gjallarhorn_expose[%d]{host,port,state}:\n' "${#APPS[@]}"
+  for row in "${APPS[@]}"; do
+    local app="${row%%:*}" port="${row##*:}"
+    printf '  "%s%s.%s","%s","%s"\n' "$app" "$SUFFIX" "$DOMAIN" "$port" \
+      "$(up "$port" && printf up || printf down)"
+  done
+  printf 'gjallarhorn_skipped[2]{app,reason}:\n'
+  printf '  "sessrumnir","electron desktop shell — no HTTP surface to expose"\n'
+  printf '  "hlidskjalf-mobile","Expo app — installed on a phone, not served"\n'
+}
+
+case "$ACTION" in
+  plan|status) plan; exit 0 ;;
+  apply) : ;;
+  *) printf 'error: unknown action %s\nhelp: bin/gjallarhorn-expose.sh [plan|apply|status]\n' "$ACTION" >&2; exit 2 ;;
+esac
+
+have cloudflared || { printf 'error: cloudflared not found\nhelp: install cloudflared, then re-run\n' >&2; exit 1; }
+
+# 1. the config: one ingress rule per app that actually answers
+mkdir -p "$(dirname "$CONFIG")"
+{
+  printf '# Gjallarhorn — this machine (%s). Generated by bin/gjallarhorn-expose.sh.\n' "$SUFFIX"
+  printf 'tunnel: %s\n' "$TUNNEL"
+  printf 'credentials-file: %s/.cloudflared/%s.json\n' "$HOME" "$TUNNEL"
+  printf 'ingress:\n'
+  for row in "${APPS[@]}"; do
+    app="${row%%:*}"; port="${row##*:}"
+    printf '  - hostname: %s%s.%s\n    service: http://127.0.0.1:%s\n' "$app" "$SUFFIX" "$DOMAIN" "$port"
+  done
+  printf '  - service: http_status:404\n'
+} >"$CONFIG"
+
+# 2. the routes (idempotent: an existing record is left alone)
+made=0
+for row in "${APPS[@]}"; do
+  app="${row%%:*}"
+  cloudflared tunnel route dns "$TUNNEL" "$app$SUFFIX.$DOMAIN" >/dev/null 2>&1 && made=$((made+1))
+done
+
+# 3. raise it
+started="already"
+if ! pgrep -f "cloudflared.*tunnel.*--config $CONFIG" >/dev/null 2>&1; then
+  nohup cloudflared tunnel --config "$CONFIG" run "$TUNNEL" >"$ROOT/state/gjallarhorn.log" 2>&1 &
+  started="pid $!"
+  sleep 4
+fi
+
+printf 'gjallarhorn_apply[3]{what,detail,count}:\n'
+printf '  "config","%s","%s"\n' "${CONFIG#"$HOME"/}" "${#APPS[@]}"
+printf '  "routes","%s%s.%s","%s"\n' "" "$SUFFIX" "$DOMAIN" "$made"
+printf '  "tunnel","%s","%s"\n' "$started" "$TUNNEL"
+plan