@zerwiz/ymir 0.1.4 → 0.1.7

package/.agents/skills/herdr-panes/assets/tmux-backend.md

@@ -0,0 +1,115 @@
+# tmux runtime backend
+
+tmux is Brokk's verified reference runtime backend and the fully supported baseline for Eindri-homes.
+[`configuration.md`](configuration.md#runtime-backend-configbackend--fm_backend) owns shared backend selection and metadata semantics.
+
+## Setup
+
+Install tmux with `brew install tmux` or your platform package manager.
+The universal harness and toolchain requirements are in [`configuration.md`](configuration.md#toolchain).
+
+tmux is the hard default when no explicit setting or runtime auto-detection selects another backend.
+Select it explicitly with local `config/backend` containing `tmux`, with `FM_BACKEND=tmux` for one launch, or by asking Brokk to use tmux.
+An explicit selection is also the opt-out from Herdr or cmux runtime auto-detection.
+
+No provisioning is required before the first task.
+
+## Watching the Eindri
+
+For the best visible experience, launch the primary harness inside a tmux session:
+
+```sh
+tmux new -s firstmate
+```
+
+Eindri tasks become windows in that session.
+`tmux display-message -p '#S'` prints its name.
+If the primary harness runs outside tmux, Brokk creates or reuses a detached session named `firstmate`:
+
+```sh
+tmux attach -t firstmate
+```
+
+Each task window is named `fm-<id>`.
+
+```sh
+tmux list-windows -t <session-name>
+tmux select-window -t <session-name>:fm-<id>
+```
+
+Typing into an attached task window is authoritative direct intervention.
+Routine supervision does not require attachment: `bin/fm-peek.sh <id>` captures a bounded tail and `FM_HOME=<home> bin/fm-send.sh <id> '<text>'` steers the recorded endpoint.
+
+Verify setup by spawning a small task and confirming its `fm-<id>` window appears in the selected session.
+
+## Current behavior and safety
+
+### Agent liveness probe
+
+A target-existence check proves only that the pane exists.
+The deeper tmux agent-liveness probe first verifies exact window membership, then reads process names to distinguish a running harness from a bare idle shell.
+It classifies recognized Claude, Codex, OpenCode, Pi, pi-signed, Grok, Kimi, Cursor, and Muse process identities as `alive`, common shells as `dead`, an authoritatively absent window as `missing`, unreadable state as `unreadable`, and every other process as `ambiguous`.
+Only `dead` and `missing` authorize recovery because a false dead result could launch a duplicate agent.
+
+For positive attribution, the probe combines two independent name sources rather than making either one load-bearing.
+`#{pane_current_command}` and the pane tty foreground process group's kernel `comm` values expose different name fields, and which one retains executable identity is platform-dependent.
+The foreground probe also reads argv[0] so an exact harness install-path component can carry the verdict when the other fields expose a rewritten process name.
+Either source naming a verified harness is enough for `alive`, because a false `dead` is the one verdict that can start a duplicate agent on a live worktree, while a readable foreground process group settles the negative verdicts.
+
+Scoping the second source to the foreground process group rather than to the pane's descendants is deliberate: a harness-named process left running in the background of an otherwise idle pane must not read as an agent.
+The same scoping covers multi-process launchers without a special case, so the Pi Launcher path is attributed through its `pi-signed` wrapper and `pi` engine even though its title is the exact foreground command `pi-launcher`.
+Direct executable identities `pi`, `pi-signed`, and `Pi` remain accepted exactly, and similar or prefixed process names are not accepted through those exact Pi-family entries.
+Muse is likewise anchored to the exact `muse` launcher identity or the installed `muse-bin-<version>` prefix, so unrelated names such as `musescore` and `amuse` remain ambiguous.
+Cursor is identified from its exact `cursor-agent` identity or versioned install tree in the foreground process path or structured argv[0]; a bare `node` or unrelated `agent` remains ambiguous.
+
+The CI-enforced portable regression and opt-in real-harness drift guard follow the split owned by `.agents/skills/galdr-ymirsystem/SKILL.md`.
+Run the real-harness guard after any harness upgrade and before trusting refreshed evidence.
+
+### Composer, busy state, and delivery
+
+Agent liveness and composer safety are separate checks.
+The tmux reader is a thin adapter over the fleet-wide classifier in `bin/fm-composer-lib.sh`: it contributes one styled full-pane capture, the `#{cursor_y}` cursor row, and foreground-process identity probes, and the shape containing the cursor - a complete bordered box (titled bottom borders tolerated), a bare agent-glyph row with its wrapped input, opencode's left bar, or Pi's identity-corroborated separator pair - normally decides the verdict.
+Real text in an identified shape is pending, while only positively proven emptiness reads empty.
+A blank or otherwise unidentified cursor row is `unknown` and every consumer defers, except that a foreground process proven to be Cursor is re-read cursorlessly because Cursor parks its terminal cursor below its footer.
+That identity-gated exception preserves the strict container-proof rule for every other pane, so a modal dialog, a dead shell between stale rules, or a mid-redraw pane is never an injection target.
+The shared classifier accepts a shell glyph as an empty agent composer only inside a bordered container.
+A bare shell prompt is `unknown`, so away-mode escalation is never injected into a dead shell.
+
+Busy state is not read from rendered text on this backend.
+A task's busy, idle, unknown, or dead verdict comes from the semantic busy-state contract owned by `bin/fm-busy-lib.sh`; [architecture](architecture.md#busy-state-is-semantic-per-adapter) owns its boundaries.
+The one remaining rendered-tail reader is Grok's isolated fallback inside that contract, which can only classify a Grok task.
+The submit acknowledgement and away-mode supervisor-pane busy guard below still consult rendered output, but only to decide whether input can be delivered, never to decide recorded task state.
+The supervisor guard selects only the detected primary harness's signature rather than a global union of vendor patterns.
+
+`bin/fm-tmux-lib.sh` owns exact type-and-submit mechanics.
+It types a message once and retries Enter only until the composer clears.
+Only a proven empty composer is a positive delivery acknowledgement.
+Text left in established structure remains `pending`, text in ambiguous structure remains unproven, and unreadable or unsafe state remains unknown.
+An ordinary local `fm-send.sh` text steer and every remote text steer no longer ride this verified submit at all: they become durable steering-inbox records plus best-effort constant doorbell lines (`bin/fm-task-inbox-lib.sh`).
+The verdicts above are delivery-critical only for the local typed plane - harness-native invocations and explicit backend targets - where `fm-send.sh` still never retypes or assumes a confirmed submit for an unconfirmed verdict; its header owns the distinct delivered-unconfirmed exit status and operator response.
+
+OpenCode 1.18.4 has one busy-queue exception.
+While OpenCode is mid-turn, Enter queues the message but leaves its text visible until the turn completes.
+After the normal retry budget, only structurally proven pending text in a provably busy pane is accepted as queued, while an idle pane remains `pending` as a genuine swallowed Enter.
+Ambiguous pending text never receives the busy-queue conversion.
+A second, baseline-gated conversion covers harnesses whose mid-turn screen the classifier cannot identify (Pi replaces its separated composer while working): when and only when the pane was idle before the text was typed, an idle-to-busy transition across the submit's own Enter confirms delivery, the same turn-started signal Herdr reads natively.
+Without that baseline, an `unknown` verdict is preserved untouched, so a busy-looking pane can never convert an unread composer into a confirmation.
+`tests/fm-tmux-submit-busy.test.sh` covers busy and idle panes with proven, ambiguous, and cleared composers.
+
+## Limits and regression entry points
+
+- tmux is the reference path and supports Eindri-homes.
+
+```sh
+tests/fm-backend-tmux-smoke.test.sh
+tests/fm-tmux-agent-liveness.test.sh
+tests/fm-harness-liveness-drift-live-e2e.test.sh
+tests/fm-composer-ghost.test.sh
+tests/fm-kimi-harness.test.sh
+tests/fm-cursor-harness.test.sh
+tests/fm-muse-harness.test.sh
+tests/fm-tmux-submit-busy.test.sh
+tests/fm-bootstrap.test.sh
+```
+
+[`verification/runtime-backends.md`](verification/runtime-backends.md#tmux) records the active foreground-process and submit evidence.

package/.agents/skills/hnoss-design/DESIGN.md

@@ -0,0 +1,19 @@
+## DESIGN SYSTEM
+
+**Brand:** Neutral / corporate
+
+**Palette:** Black, white, gray
+
+**Typography:** Sans-serif
+
+**Posture:** Minimal, clean, functional
+
+**Rules:** No brand colors, no imagery, no decorative elements.
+
+**Export targets:** HTML, PDF, PPTX, MP4
+
+**Runtime:** OpenDesign (pi)
+
+**Install command:** `od install pi`
+
+**Status:** Installed

package/.agents/skills/hnoss-design/README.md

@@ -0,0 +1,3 @@
+# hnoss-design — design — artifacts via OpenDesign (prototypes, decks, dashboards, image, video)
+
+See `SKILL.md` for the full skill.

package/.agents/skills/hnoss-design/SKILL.md

@@ -0,0 +1,83 @@
+---
+name: hnoss
+description: >-
+  Hnoss — the design smithy. Produce brand-grade design artifacts with the
+  OpenDesign engine (nexu-io/open-design): web/desktop/mobile prototypes,
+  landing pages, live dashboards, decks, images, and motion video — rendered
+  from a DESIGN.md design system and exported to HTML/PDF/PPTX/MP4. Use when the
+  task is design: UI/UX, visual assets, decks, dashboards, or motion. Keywords —
+  design, prototype, landing page, dashboard, deck, slides, DESIGN.md,
+  opendesign, od, figma.
+argument-hint: "[prototype | deck | dashboard | image | video | design-system | install]"
+---
+
+# hnoss-design — design — artifacts via OpenDesign (prototypes, decks, dashboards, image, video)
+
+> **Norse name:** **Hnoss** (beauty, treasure). The design craft's figure.
+
+Hnoss is how Ymir makes **design artifacts**. The engine is **OpenDesign**
+(`github.com/nexu-io/open-design`, Apache-2.0) — the open-source Claude Design
+alternative: local-first, agent-native, BYOK. Ymir adopts the engine (open-source
+first); this skill is the Norse shell the **design Eindri** works through. The
+`DESIGN.md` is the brand contract; the coding agent is the design engine.
+
+## 1. The engine (open-source first)
+
+- **What it is:** a filesystem of functional **skills**, rendering **design
+  templates**, and **design systems** — your coding agent reads/writes/remixes
+  them. Output is real HTML/CSS, exported to **HTML · PDF · PPTX · MP4**.
+- **Install into a harness:**
+  ```sh
+  od mcp install <agent>        # opencode | pi | hermes | codex | cursor | claude | copilot | …
+  curl -fsSL https://open-design.ai/install.sh | sh -s <agent>   # hosted wrapper
+  ```
+- **MCP + CLI:** OpenDesign exposes a stdio **MCP server**; the `od` CLI reads the
+  **live** project files (never a stale export):
+  ```sh
+  od project list --json
+  od files list <project-id> --json
+  od files read <project-id> <relative-path>
+  od plugin list --json
+  od skills list --json
+  ```
+- **Brand contract:** every render reads the active `DESIGN.md`; 151 design
+  systems ship. Drop a `DESIGN.md` in and the picker finds it.
+
+## 2. The craft (the loop)
+
+```
+design_loop[6]{step,what}:
+  "brief","the ask — artifact type, audience, constraints"
+  "direction","lock the visual direction (the brand's DESIGN.md, or pick one)"
+  "system","bind the design system — tokens, type, color (DESIGN.md)"
+  "artifact","generate the real files — prototype / deck / dashboard / image / video"
+  "critique","read it, refine in place; export HTML/PDF/PPTX/MP4"
+  "handoff","real HTML/CSS → the builder turns it into components"
+```
+
+## 3. Artifact types
+
+web · desktop · mobile **prototypes** · live **dashboards/artifacts** ·
+**decks** (HTML/PDF/PPTX) · **images** · **video / HyperFrames** (HTML + CSS +
+GSAP → deterministic MP4).
+
+## 4. Rules
+
+1. **Brand first.** A design without a `DESIGN.md` is drift — codify the system
+   before generating.
+2. **Real files, real export.** Deliver runnable HTML/CSS and the exported asset
+   (PDF/PPTX/MP4), never a screenshot.
+3. **OSS, BYOK.** Use the OpenDesign engine; keys come from `.env.local`
+   (`OD_API_TOKEN` and provider keys) — **never inline**.
+4. **Engineering handoff.** Design output is code: the builder (**Sindri**) takes
+   it from there; Hnoss does not implement product code.
+5. **The design Eindri is domain `utgard`** (creative) or `dvalin` (crafted
+   tools), per Rule 01 — and uses this skill.
+
+## 5. Install into Ymir
+
+```sh
+od mcp install opencode        # bind the engine to OpenCode
+od mcp install pi              # and to Pi
+bin/valknut-load.sh --all      # rebind agents/skills after adding this skill
+```

package/.agents/skills/hvild-afk/README.md

@@ -0,0 +1,3 @@
+# hvild-afk — away-mode — supervision of routine wakes and batched escalations
+
+See `SKILL.md` for the full skill.

package/.agents/skills/hvild-afk/SKILL.md

@@ -0,0 +1,241 @@
+---
+name: hvild-afk
+description: >-
+  Enter away-mode supervision when the Allfather invokes /hvild, says they are going afk, `state/.hvild` exists, an incoming message starts with `BROKK_INJECT_MARK`, or any `state/.skuld-*` marker is involved.
+  It sets a durable away-mode flag so the Skuld daemon can self-handle routine wakes and escalate Allfather-relevant events plus bounded declared-external-wait rechecks as batched digests during walk-away stretches, then exits automatically when any real unmarked message returns Brokk to full per-wake responsiveness.
+user-invocable: true
+metadata:
+  internal: true
+---
+
+# hvild-afk — away-mode — supervision of routine wakes and batched escalations
+
+Away-mode supervision. When invoked, `/hvild` makes the daemon's token-saving
+tradeoff **consented** and **explicit**: the Allfather is stepping away, so the
+Skuld may triage routine wakes in bash instead of waking Brokk's
+LLM for each one. Escalations still reach the Allfather, but as one pre-read,
+batched digest rather than per-wake injections.
+
+## What it does
+
+1. **Enter the lifecycle through `bin/brokk-afk-launch.sh`.**
+   This owns the durable state write, session-scoped stale-artifact clearing,
+   terminal record, and rollback.
+   The flag survives a Brokk restart, so recovery re-enters afk when it is present.
+
+2. **Ensure the Skuld daemon is running as a tracked background process.**
+   Its hosting differs by harness.
+   Pick the right path:
+   - **Harness WITH a native in-pane tracked-background tool** (e.g. claude's
+     background bash, grok's background tool): first run
+     `bin/brokk-afk-launch.sh start-native`, then run
+     `BROKK_AFK_STATE_PREPARED=1 bin/brokk-afk-start.sh` through that native tool.
+     This is a deliberate no-separate-terminal exception because the harness-hosted job creates no terminal or layout mutation, and a shell launcher cannot invoke a harness-native background tool.
+     The launcher still owns lifecycle state and records the no-terminal mode, while the daemon inherits and auto-discovers the Allfather pane.
+     If the native launch fails, run `bin/brokk-afk-launch.sh stop` to roll back the prepared lifecycle.
+     Do not wrap it in `nohup ... &` (Codex/herdr can reap fire-and-forget shell children after a tool call returns).
+   - **Harness WITHOUT one** (e.g. pi): run `bin/brokk-afk-launch.sh start`. It is
+     the single owner of the daemon terminal: it creates a NON-VISIBLE tracked
+     terminal for the current backend (a herdr dedicated `--no-focus` workspace,
+     a detached tmux session), records its exact id, and passes the Allfather pane
+     in as `BROKK_SUPERVISOR_TARGET` so the daemon injects into the Allfather, not its
+     own new pane. **Never manufacture a terminal by splitting the Allfather's
+     active pane** (`herdr pane split`): a split co-tenants the tab and visibly
+     shrinks the Allfather's pane (docs/herdr-backend.md "Away-mode supervisor
+     support").
+   Both paths share `bin/brokk-afk-start.sh` as the daemon entry.
+   The native path tells it that the launcher already prepared lifecycle state; the terminal-backed path lets the entry perform its existing state setup inside the new terminal.
+   It exits immediately if the identity-backed daemon lock already names a live process, otherwise it execs `bin/brokk-supervise-daemon.sh` in the foreground.
+   The daemon is **presence-gated**: it injects escalations only while
+   `state/.hvild` exists, and stays quiet otherwise.
+
+3. **Do not separately arm `brokk-watch.sh`.** The daemon manages the watcher as
+   its child; the singleton lock no-ops a stray arm harmlessly.
+
+4. **Acknowledge** in `AGENTS.md` section 9 language: "Allfather, away mode is active; I will batch routine updates and surface only decisions, failures, credentials, or review-ready work until you return."
+
+## How to exit afk
+
+No `/back` is needed. The first genuine message is the return signal:
+
+- A message **without** the current operational prefix or a legacy bare marker, and **not** starting with `/hvild` -> the Allfather is back.
+  Run `bin/brokk-afk-return.sh` before acting on the message that brought the Allfather back.
+  That script owns correct-ordered daemon shutdown, durable wake presentation and post-handling acknowledgement, escalation and wedge evidence, and the return-catch-up gate.
+  If it reports a Brokk-actionable `blocked:` event, remediate it immediately through the normal lifecycle, or explicitly reclassify it with a durable reason and close its decision key with `resolved [key=...]`, then run `bin/brokk-afk-return.sh check`.
+  Once the daemon stops, resume full per-wake responsiveness through the emitted primary-harness supervision protocol while blocker handling proceeds, so the gate never creates a blind wait.
+  Do not answer a Bearings request or perform any other ordinary Allfather work until the check exits successfully.
+- A message **with** the current operational prefix (`BROKK_OPERATIONAL_PREFIX`, U+2063 INVISIBLE SEPARATOR followed by `RODD_OP: `), or a legacy bare `BROKK_INJECT_MARK` daemon escalation -> stay afk and process it.
+- Re-invoking `/hvild` while already away -> stay afk (refresh the flag); this
+  does **not** trigger an exit.
+
+Bias ambiguous cases toward exit: a present Allfather beats token savings, and
+a false exit is self-correcting (the Allfather re-runs `/hvild`).
+
+## Orthogonal to approval authority
+
+afk changes how aggressively Brokk surfaces things, **not who approves what**.
+"Away" never means "approves more" or "approves less."
+A PR ready for merge keeps the merge authority from `AGENTS.md` section 7, and a needs-decision finding keeps the `ask-user-authority` policy; anything requiring the Allfather still waits for the Allfather's explicit word.
+The daemon only batches the notification.
+
+## Operational prefix contract
+
+The daemon constructs every current injection as the `away-supervisor` kind owned by `bin/brokk-operational-input.sh`, beginning with `BROKK_OPERATIONAL_PREFIX`: `BROKK_INJECT_MARK` (U+2063 INVISIBLE SEPARATOR) followed by the stable `RODD_OP: ` label.
+The bare `BROKK_INJECT_MARK` form remains accepted for legacy daemon escalations during rollout.
+U+2063 has no normal keyboard keystroke and survives terminal transport as UTF-8 text.
+This is how Brokk tells a daemon escalation apart from a real message in the same pane.
+The operational prefix travels with the message text; it does not rely on harness-level typed-vs-injected detection, which is not portable across claude, codex, opencode, pi, pi-signed, grok, and kimi.
+
+## Busy-guard and composer guard
+
+The daemon never injects into an in-use pane. Two checks run before every
+injection, dispatched through `bin/brokk-backend.sh` for the supervisor's own
+backend (tmux or herdr; see "Auto-discovered supervisor pane" below):
+
+- **Primary-pane busy guard** - `pane_is_busy` trusts Herdr native `busy` when available, otherwise matches rendered output against only the detected primary harness's signature.
+  This narrow delivery guard never classifies a recorded worker task and never uses a global union of vendor patterns.
+- **Composer-state guard** - `inject_msg` reads the full `empty`/`pending`/`pending-unproven`/`unknown` verdict from `fm_backend_composer_state` and injects only when it is affirmatively `empty`.
+  Every other or future verdict defers, including an unreadable pane, ambiguous geometry, a blank unidentified row, and a bare shell prompt left after the agent exits.
+  Each adapter contributes only capture and capability facts to the fleet-wide screen classifier in `bin/brokk-composer-lib.sh`, which owns every shape and verdict.
+  It preserves proven idle composers as empty but requires a genuine container around shell glyphs; see `docs/herdr-backend.md` "Composer and injection safety" for the operator contract.
+  `pane_input_pending` is the tested fail-closed predicate for callers that need to know whether the composer is unsafe: it treats every result except exact `empty` as pending.
+
+A busy primary pane, or any composer verdict other than `empty`, defers the injection; the buffered escalation survives in `state/.skuld-escalations` and is retried on the next housekeeping tick.
+In afk mode the composer guard is belt-and-suspenders (no human is typing), but it protects against the race window between the Allfather returning and their message landing, a dead shell, and the daemon's own previous injection sitting unsent.
+
+**Max-defer escape (the daemon must never silently wedge).**
+If anything stays buffered past `BROKK_MAX_DEFER_SECS` (default 300), the daemon
+attempts one normal flush, which still requires an idle pane and an affirmatively empty composer.
+The alarm is defense in depth rather than a substitute for keeping every genuinely idle supported composer injectable.
+If that submit cannot be confirmed, it raises a loud, rate-limited wedge alarm:
+an ERROR in the daemon log, a durable
+`state/.skuld-inject-wedged` marker (surface it on the "while you were out"
+catch-up if present), a tmux status-line flash when applicable, and a configurable backend-independent active alert.
+`docs/wedge-alarm.md` owns the alert channel setup, and `docs/verification/supervision.md` "Wedge-alarm channels" owns active evidence.
+So a guard false-positive becomes a visible stall, never an unbounded silent no-op.
+
+## Submit model
+
+The digest is typed **once** (`send-keys -l` on tmux, `pane send-text` on
+herdr - both literal, non-submitting sends), then submitted with Enter and
+**verified** through the selected backend's submit primitive.
+Enter is retried (Enter only, never a retype) until the backend confirms the
+submit landed.
+For tmux that confirmation is normally a proven cleared composer from the shared classifier; an idle baseline transitioning to busy across this submit's own Enter also confirms that the turn started when a working harness hides its composer.
+Without that baseline, busy state never converts an `unknown` composer into confirmation.
+For herdr, idle-baseline submits first seek native agent-state showing a real turn started, then use the shared classifier when native state remains idle: a cleared composer confirms delivery, while pending text retries Enter and reaches the shared busy-queue verdict only after the retry budget.
+A bordered-empty or ghost-only composer is recognized as empty where that backend uses composer confirmation, rather than mistaken for a swallowed Enter.
+`brokk-send.sh` uses the same primitive only on its typed plane and exits non-zero when that plane's Enter is positively swallowed; ordinary local text steers use the durable inbox and do not treat doorbell submission as delivery proof.
+
+**Busy-queued Enter exception (opencode 1.18.4).** OpenCode keeps queued text visible while it is mid-turn, so tmux and herdr delegate the final delivery decision to `fm_composer_queued_enter_verdict` in `bin/brokk-composer-lib.sh` rather than treating visible text alone as a swallowed Enter.
+The daemon still clears its buffer only on the backend's `empty` success verdict; [`docs/tmux-backend.md`](../../../docs/tmux-backend.md) and [`docs/herdr-backend.md`](../../../docs/herdr-backend.md) own the backend-specific confirmation signals.
+
+## Classification policy
+
+The daemon wraps `brokk-watch.sh`, runs the watcher as a child, presents every durable wake after each actionable watcher close, classifies each presented record in bash, and acknowledges the presented generation only after routing completes.
+It self-handles the routine majority without consuming a Brokk turn.
+Allfather-relevant events, plus a bounded recheck of a declared wait that is still declared, escalate to Brokk's context as one pre-read, single-line, batched digest.
+The Allfather-relevant verb set, declared-wait vocabulary, status-span classifier, and presentation-marker contract live in shared `bin/brokk-classify-lib.sh`, while each supervisor owns its routing and fleet scan as a consumer of that policy.
+While `state/.hvild` exists the daemon owns the watcher, so the watcher reverts to one-shot and lets the daemon do the triage - the two never run their triage at the same time.
+
+Classify each wake this way:
+
+- `signal` whose newly classified status span contains Allfather-relevant events -> escalate every event in source order.
+  A nonterminal progress verb remains nonterminal even when its prose contains a legacy free-text token such as `PR ready`, `checks green`, `ready in branch`, or `merged`; only a bare legacy line with such a token escalates.
+  Other signals with no Allfather-relevant event in the span -> self-handle.
+- `signal` or `stale` whose latest status declares a wait, either a `paused:` external wait or a verified `Allfather-held` transfer, tracks the pause rather than a wedge whether its pane reads idle or busy.
+  An unreported Allfather-relevant event in the newly classified span still escalates immediately while the current declaration independently keeps the pause cadence.
+  With no unreported actionable event, the wake self-handles, and the current declaration outranks an enriched possible-wedge reason so it never escalates on the `BROKK_STALE_ESCALATE_SECS` cadence.
+  If it is still declared past `BROKK_PAUSE_RESURFACE_SECS` (default 3600s), housekeeping sends one recheck and resets the pause window.
+  The window ages against the crew's own latest status line, so only a status append that stops declaring the wait ends this routing and restores wedge detection.
+  That recheck names which human the wait is on: the external dependency for `paused:`, and the Allfather themself for a `Allfather-held` transfer, who can answer the held decision or release the hold.
+- `check` -> always escalate. Check scripts print only when Brokk should wake.
+- `stale` with a terminal status or bare legacy Allfather-relevant line -> escalate.
+  Nonterminal progress remains transient even when its prose contains a legacy free-text token or its seen-status marker already matches, so record a marker and self-handle.
+  If the pane is still idle past `BROKK_STALE_ESCALATE_SECS` (default 240s), housekeeping escalates it as a possible wedge.
+  This bounds wedge-detection latency to the threshold plus a tick: a delay, never a loss.
+  Healthy Eindri are autonomous and do not wait on Brokk mid-task.
+- `heartbeat` -> self-handle.
+  The daemon runs its own cheap bash fleet scan every `BROKK_HEARTBEAT_SCAN_SECS` (default 300s) as the catch-all for Allfather-relevant events still unread by the per-wake classifier.
+- An unknown wake reason escalates fail-safe, while status-read uncertainty follows the shared one-report-without-position-advance contract referenced under Dedupe below.
+
+Escalations are buffered up to `BROKK_ESCALATE_BATCH_SECS` (default 90s; 0 =
+immediate) and flushed as one single-line digest prefixed with the current
+operational prefix, carrying pre-read status summaries and a recommended action.
+The single-line format makes the submission unambiguous across harnesses, and
+the operational prefix lets Brokk distinguish it from a real Allfather message.
+
+## Injection hardening
+
+- **Single-line digest** - embedded newlines are collapsed to a literal
+  separator before injection, so submission is unambiguous regardless of
+  harness.
+- **Busy and composer guards on the supervisor pane** - before injecting, the daemon runs the detected-primary-harness rendered busy guard and reads `fm_backend_composer_state` directly.
+  Only `empty` permits injection; `pending` protects half-typed or swallowed input, and `unknown` protects unreadable panes and bare dead-shell prompts.
+  Every other result preserves the buffer for retry, so the daemon never merges its digest into the Allfather's half-typed line or types it into a shell.
+- The active backend passes its capture plus declarative styled, cursor, identity, and row capabilities to the shared screen classifier; all structural recognition and verdict logic remains in `bin/brokk-composer-lib.sh`.
+  Styled captures let that owner remove dim/faint and dark-TRUECOLOR ghost or placeholder text while shape detection uses the ANSI-stripped screen, so a dark border is not lost with ghost content.
+  A ghost-only or idle bordered composer such as claude's `│ > ... │` therefore reads empty without allowing an unbordered shell prompt to do the same.
+  `BROKK_COMPOSER_IDLE_RE` overrides the shared idle-placeholder regex, but a match alone never bypasses the classifier's shape-specific position and ANSI de-emphasis safety gates.
+  `BROKK_BUSY_REGEX` overrides the rendered delivery guards plus Grok's isolated task-state fallback.
+  A blank or otherwise unidentified input row carries no positive container proof and defers injection, so a modal dialog or a mid-redraw pane is never an injection target.
+- **Max-defer escape** - the daemon must never silently wedge. If anything stays
+  buffered past `BROKK_MAX_DEFER_SECS` (default 300s), the daemon attempts one
+  normal flush, which still requires an idle pane and an affirmatively empty composer. If that
+  cannot confirm a submit, it raises a loud, rate-limited wedge alarm: ERROR log,
+  durable `state/.skuld-inject-wedged` marker, a tmux status-line flash when
+  applicable, and a backend-independent active alert. A
+  composer false-positive surfaces as a visible stall, never an unbounded silent
+  no-op.
+- **Verified type-once submit model** - the digest is typed once (`send-keys -l`
+  on tmux, `pane send-text` on herdr), then submitted with Enter and verified.
+  Enter is retried, Enter only and never a retype, until the backend submit
+  primitive reports `empty` as its caller-facing success verdict.
+  For tmux that verdict normally means the shared classifier proved the composer cleared; a baseline-gated idle-to-busy transition may instead prove this Enter started the turn.
+  For herdr's idle-baseline path it means native agent-state observed a turn start, the shared classifier proved the composer cleared, or the shared queued-Enter verdict proved delivery while busy.
+  This lets ghost-only or bordered-empty composers count as empty where a composer read is the active confirmation signal.
+- **Marker strip** - `strip_injection_marker` removes the current operational
+  prefix or legacy bare marker before classification or relay, so the digest
+  text Brokk sees is clean.
+- **Portable singleton lock** - the daemon uses the repo's portable lock helper
+  (`brokk-wake-lib.sh`) instead of `flock`, which is absent on macOS.
+- **Dedupe across signal/stale/scan** - all three paths use the shared status presentation markers defined by `bin/brokk-classify-lib.sh`, so a successfully classified span is not re-escalated by another path in the same digest.
+  Never treat a reported unreadable state as classified; the shared library header owns that marker contract, and the marker does not clear or suppress possible-wedge aging for a nonterminal progress line.
+- **Auto-discovered supervisor pane** - the daemon resolves its own BACKEND
+  (tmux vs herdr) and TARGET independently, mirroring
+  `bin/brokk-backend.sh`'s own runtime auto-detection. Backend: `BROKK_SUPERVISOR_BACKEND`
+  override, then `$TMUX_PANE` set (tmux), then `$HERDR_ENV=1` with
+  `$HERDR_PANE_ID` present (herdr), then a tmux fallback. Target:
+  `BROKK_SUPERVISOR_TARGET` override (a tmux target or a herdr
+  `"<session>:<pane-id>"` target), then `$TMUX_PANE`, then
+  `"${HERDR_SESSION:-default}:${HERDR_PANE_ID}"` under herdr, then a
+  `Brokk:0` fallback with a warning. Both resolution sources are logged at
+  startup so a wrong-but-resolving fallback is detectable. Other runtime
+  backends, including zellij, orca, and cmux, are not yet supported as
+  supervisor backends; the daemon refuses loudly at startup instead of
+  misapplying tmux primitives to a pane that isn't one
+  (docs/herdr-backend.md "Away-mode supervisor support").
+
+## Stale-artifact lifecycle
+
+Treat `state/.skuld-escalations`, its `.since` sidecar, and `state/.skuld-inject-wedged` as session-scoped delivery artifacts, not as the durable work record.
+Always enter through `bin/brokk-afk-launch.sh`, which clears prior-session artifacts only for a fresh entry and preserves the current session's buffer on refresh.
+Always exit through `bin/brokk-afk-launch.sh stop`, which keeps `state/.hvild` present through the daemon's shutdown flush and clears it last.
+`docs/herdr-backend.md` "Away-mode supervisor support" owns the current mechanism, and `docs/verification/runtime-backends.md` "Away-mode transport" owns active evidence.
+
+## Reliability properties
+
+These properties must hold:
+
+- Nothing is lost after queue publication.
+  The daemon leaves every presented wake durable until routing completes and post-handling acknowledgement succeeds, so interruption replays the same work to the daemon or its successor.
+- Wedge detection is bounded-latency, not lossy.
+- Declared external waits are rechecked on a separate, bounded cadence rather than being mislabeled as wedges.
+- The catch-all scan backs up the keyword classifier.
+- The daemon preserves a single-instance portable lock, crash-loop backoff,
+  a pane-gone guard, and a signal-trapped shutdown that flushes buffered
+  escalations before exit.
+
+`BROKK_INJECT_SKIP` (default `heartbeat`) force-self-handles matching kinds,
+overriding classification.
+Use it sparingly.

package/.agents/skills/jord-projects/README.md

@@ -0,0 +1,3 @@
+# jord-projects — projects — registry + delivery posture
+
+See `SKILL.md` for the full skill.

package/.agents/skills/jord-projects/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: jord-projects
+description: >-
+  Agent-only procedure for Brokk project management.
+  Use before adding, creating, removing, or initializing a project.
+  Cloning or registering a project is add intake and uses the same trigger.
+  Owns project add, create, clone, remove, initialization, registry, delivery-mode, autonomy, and outward-consent decisions.
+user-invocable: false
+metadata:
+  internal: true
+---
+
+# jord-projects — projects — registry + delivery posture
+
+Use this procedure before adding, creating, removing, or initializing a project.
+Cloning or registering a project is add intake and uses the same trigger.
+This skill is the single owner of Brokk's project-management procedure.
+It does not replace `Eindri-home-provisioning`, which owns project clones inside persistent Eindri-home homes.
+
+## Preconditions and registry
+
+Projects live flat under `projects/`, and `data/projects.md` is the private fleet registry.
+Use the registry format and parser contract owned by the header of `bin/brokk-project-mode.sh`.
+Keep each registry description useful for identifying the project, but keep delivery posture, Allfather-private state, and detailed project knowledge in their existing designated homes.
+Do not turn the registry into project documentation.
+
+Before adding, cloning, creating, or registering any project in the main home, inspect the authoritative `data/eindri-homes.md` routing table and judge every existing natural-language `scope:` against the proposed project or domain.
+Apply `AGENTS.md` section 7's authoritative Eindri-home routing rules; if an existing scope owns that domain, route the new-project operation or work there instead of creating or registering a duplicate main-home clone.
+Absence from the main `data/projects.md` registry is never evidence that no Eindri-home owns the domain.
+If the owning Eindri-home cannot accept the route, report that concrete blocker or obtain an explicit Allfather redirection rather than silently duplicating the project in the main home.
+
+Resolve the project name, destination, delivery posture, and autonomy posture before changing local or remote state.
+Keep a newly added clone and its registry entry consistent, and roll back only artifacts created by the incomplete operation when a later initialization step fails and that rollback is safe.
+Do not overwrite or repurpose an existing path.
+
+## Delivery posture
+
+The registry records the project's standing posture, which is the Allfather's default for the work rather than any task's answer; `AGENTS.md` section 7 owns how each task's concrete mode and yolo are resolved at intake and passed explicitly to the brief, the spawn, and any promotion.
+Choose that posture when adding or creating the project:
+
+- `no-mistakes` runs the full validation pipeline before a PR.
+- `direct-PR` pushes and opens a PR without the no-mistakes pipeline.
+- `local-only` has no required remote or PR and lands only through the approved local fast-forward path.
+- `no-mistakes-prod-only` is a conditional policy rather than one flat mode: genuinely internal-only tooling, automation, contributor or operator process, and release or submission work ships `direct-PR`, while product-facing, mixed, and uncertain work ships `no-mistakes`.
+
+`no-mistakes-prod-only` is the default for a newly added or created remote-backed project when the Allfather specifies nothing, and a project with no remote defaults to `local-only`.
+State that resolved default while confirming the source, local name, and posture instead of asking the Allfather to choose from scratch, and record a flat mode instead whenever they ask for one.
+Existing registry entries keep the meaning they already have and are never migrated or reinterpreted, so a legacy entry with no bracket stays `no-mistakes`.
+Registering a conditional policy is a one-time choice and never requires classifying any change; the per-task surface classification happens at each task's intake, and internal-only is never inferred from file location or project name.
+
+The optional `+yolo` posture changes merge authority only and does not change the delivery mode.
+Default it off for every project and every posture, and enable it only on the Allfather's explicit instruction.
+`AGENTS.md` section 7 owns the merge-authority contract.
+
+## Add or clone an existing project
+
+Confirm the source URL, local project name, delivery posture, and autonomy posture, stating the resolved default for each rather than asking the Allfather to invent one.
+Clone into `projects/<name>` and add the registry entry only after the destination is known to be unused.
+A `no-mistakes` or `no-mistakes-prod-only` project must have an `origin` remote and must complete the initialization procedure below, because a conditional policy's product-facing work runs the pipeline while its internal-only work still takes the direct PR.
+A `direct-PR` project needs an `origin` remote but skips no-mistakes initialization.
+A `local-only` project may have no remote and skips no-mistakes initialization.
+
+## Create a project
+
+Creating a GitHub repository is outward-facing.
+Before making that remote change, propose the repository name, owner or organization, visibility, and delivery posture, defaulting visibility to private and the posture to `no-mistakes-prod-only`, then obtain the Allfather's explicit consent for those exact values; a stated default never replaces that consent.
+Use `gh-axi` for the approved GitHub operation and consult its current help rather than relying on remembered flags.
+After remote creation succeeds, clone it locally, add the registry entry, and initialize it according to its delivery posture.
+
+For a purely `local-only` project, create a local Git repository under its unused `projects/<name>` path, add the registry entry, and make no GitHub call.
+The Allfather's request to create that local project authorizes this local initialization, but it does not authorize an unmentioned remote repository.
+
+## Initialize
+
+Run no-mistakes initialization only for `no-mistakes` and `no-mistakes-prod-only` projects:
+
+```sh
+cd projects/<name> && no-mistakes init && no-mistakes doctor
+```
+
+Initialization configures the local gate and does not vendor a no-mistakes skill into the project.
+Do not create a commit merely because initialization ran.
+If doctor reports an environment, authentication, or daemon problem, resolve that blocker before dispatching work and never restart the shared daemon from a project operation.
+
+## Remove
+
+Project removal is destructive.
+First obtain the Allfather's explicit removal decision, then inspect the current digest and authoritative repositories for in-flight or queued work, registered Eindri-home clones, linked worktrees, dirty files, unpushed commits, and any other unlanded work.
+If any dependency or unlanded work exists, stop and report it before changing anything.
+Never issue a raw removal command from Brokk.
+Once that preflight confirms none of the above and the Allfather's approval is concrete, AGENTS.md hard rule 1's Allfather-approved project operation exception authorizes Brokk to remove the clone directly and update its registry entry to match.
+When a clone has already been removed through an approved removal, or the registry is provably stale because no clone exists, remove its registry line so navigation matches reality.

package/.agents/skills/lifecycle/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: lifecycle
+description: "How this project is started, stopped, inspected and smoke-tested — the NSR compliance harness's wiring contract. `.compliance/gates/check_wiring.sh` requires .agents/skills/lifecycle/{start,stop,status,smoke_test}.sh for a project to count as operable. Use when raising or lowering the stack, checking what is up, or proving the runtime works."
+allowed-tools: read, write, edit, bash
+---
+
+# lifecycle — start, stop, status, smoke_test
+
+The operability contract of this repository. The NorthStar compliance harness
+(`.compliance/`) looks for exactly these four scripts at exactly this path; a
+project without them is not considered wired.
+
+> **Why the name is not Norse.** Every subsystem in Ymir is named for the figure
+> whose role matches its work (see `RULES/` and
+> `galdr/assets/norse-naming.md`). This one is an **interface name**: the harness
+> is an external contract that addresses these paths by name, like
+> `.compliance/` itself. The scripts are wrappers; the procedures they call carry
+> the house names.
+
+## The four scripts
+
+```
+lifecycle[4]{script,action,delegates_to}:
+  "start.sh","raise the stack","scripts/start.sh (the real boot command)"
+  "stop.sh","lower the stack","scripts/stop.sh"
+  "status.sh","what is up, by surface","the five ports + the two desktop views"
+  "smoke_test.sh","does it actually work","HTTP, the well, the Smiðja schema, the harness bindings"
+```
+
+```bash
+.agents/skills/lifecycle/start.sh          # SPA :3888, gate :3889, Bifrost :4603, Mimir :4602, visualizer :8437
+.agents/skills/lifecycle/status.sh         # TOON: each surface up or down
+.agents/skills/lifecycle/smoke_test.sh     # exit 0 when every check passes
+.agents/skills/lifecycle/stop.sh
+```
+
+## The rule: a wrapper never rewrites what it wraps
+
+Each script **delegates**. There is one boot command (`scripts/start.sh`) and one
+stop command (`scripts/stop.sh`); these exist so a compliance gate, a CI job or a
+new operator has a single predictable address, not so the procedure can live in
+two places. If the stack changes how it boots, change `scripts/start.sh` — never
+these.
+
+`smoke_test.sh` is the one that adds something: it answers *"is it working"*
+rather than *"is a socket open"* — it fetches the SPA over HTTP, asks the well
+bridge, checks the Smiðja schema has tables, and proves the agents are bound. It
+exits non-zero on failure so a gate can rely on it.
+
+## Verify
+
+```bash
+.agents/skills/lifecycle/status.sh      # expect the surfaces that are up
+.agents/skills/lifecycle/smoke_test.sh; echo "exit=$?"
+bash .compliance/gates/check_wiring.sh --strict   # the harness's own verdict
+```