@zerwiz/ymir 0.1.4 → 0.1.7

package/bin/eir-doctor.sh

@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+# eir-doctor.sh — Eir, the healer: diagnose the running system, then mend it.
+#
+# Eir composes the surfaces that already own their health — she does not
+# re-implement them. `check` (default) reports each surface; `fix` runs the
+# matching repair path for the broken ones. She never arms supervision (the
+# harness extension owns that) and never touches a tracked tree.
+#
+# Usage:
+#   eir-doctor.sh [check]      # diagnose every surface, aggregate TOON
+#   eir-doctor.sh fix          # mend what can be mended safely, then re-check
+#   eir-doctor.sh --version
+set -u
+
+VERSION="1.0.0"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+YMIR_HOME="${YMIR_HOME:-$HOME/Documents/Ymir}"
+STATE="${BROKK_STATE_OVERRIDE:-$YMIR_HOME/state}"
+
+case "${1-}" in -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;; -h|--help|"") sed -n '2,15p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;; esac
+ACTION="${1:-check}"; shift || true
+
+have() { command -v "$1" >/dev/null 2>&1; }
+say_ok() { return 0; }
+
+# Each surface: `s_<name>` = healthy? (exit 0), `f_<name>` = the repair.
+SURFACES=(floors herdr a2abridge hermes sessrumnir well mcp lock migrations hoard)
+
+s_floors()    { [ -x "$SCRIPT_DIR/prereq-ensure.sh" ] && "$SCRIPT_DIR/prereq-ensure.sh" status >/dev/null 2>&1; }
+f_floors()    { "$SCRIPT_DIR/prereq-ensure.sh" ensure --install >/dev/null 2>&1; }
+s_herdr()     { [ -x "$SCRIPT_DIR/herdr-ensure.sh" ] && "$SCRIPT_DIR/herdr-ensure.sh" status >/dev/null 2>&1; }
+f_herdr()     { "$SCRIPT_DIR/herdr-ensure.sh" ensure --install >/dev/null 2>&1; }
+s_a2abridge() { [ -x "$SCRIPT_DIR/a2abridge-ensure.sh" ] && "$SCRIPT_DIR/a2abridge-ensure.sh" status >/dev/null 2>&1; }
+f_a2abridge() { "$SCRIPT_DIR/a2abridge-ensure.sh" ensure --install >/dev/null 2>&1; }
+s_hermes()    { [ -x "$SCRIPT_DIR/hermes-ensure.sh" ] && "$SCRIPT_DIR/hermes-ensure.sh" status >/dev/null 2>&1; }
+f_hermes()    { "$SCRIPT_DIR/hermes-ensure.sh" ensure --install >/dev/null 2>&1; }
+s_sessrumnir(){ [ -x "$SCRIPT_DIR/sessrumnir-ensure.sh" ] && "$SCRIPT_DIR/sessrumnir-ensure.sh" status >/dev/null 2>&1; }
+f_sessrumnir(){ "$SCRIPT_DIR/sessrumnir-ensure.sh" ensure --install >/dev/null 2>&1; }
+s_well()      { [ -x "$SCRIPT_DIR/mimir.sh" ] && "$SCRIPT_DIR/mimir.sh" health >/dev/null 2>&1; }
+f_well()      { "$SCRIPT_DIR/mimir.sh" start >/dev/null 2>&1; }
+# MCP: both A2A servers wired into opencode + pi.
+s_mcp() {
+  local pi="$HOME/.pi/agent/mcp.json" oc="$ROOT/opencode.json"
+  [ -f "$oc" ] || return 1
+  grep -q '"engram"' "$oc" 2>/dev/null && grep -q '"a2abridge"' "$oc" 2>/dev/null || return 1
+  if [ -f "$pi" ]; then grep -q '"a2abridge"' "$pi" 2>/dev/null || return 1; fi
+  return 0
+}
+f_mcp()       { [ -x "$SCRIPT_DIR/a2a-mcp.sh" ] && "$SCRIPT_DIR/a2a-mcp.sh" install >/dev/null 2>&1; }
+# Lock: absent, or held by a live pid.
+s_lock() {
+  local f="$STATE/.lock" pid
+  [ -r "$f" ] || return 0
+  pid="$(tr -d '[:space:]' <"$f" 2>/dev/null || true)"
+  [ -n "$pid" ] || return 0
+  kill -0 "$pid" 2>/dev/null
+}
+f_lock() {
+  local f="$STATE/.lock" pid
+  if [ -r "$f" ]; then
+    pid="$(tr -d '[:space:]' <"$f" 2>/dev/null || true)"
+    if [ -n "$pid" ] && ! kill -0 "$pid" 2>/dev/null; then
+      rm -f "$f" "$STATE/.lock-path"
+      # A stale arm marker with no live session would silence the turn-end guard.
+      rm -f "$STATE/.supervision-armed" "$STATE/.watch.heartbeat"
+    fi
+  fi
+}
+s_migrations(){ [ ! -x "$SCRIPT_DIR/ymir-migrate.sh" ] || "$SCRIPT_DIR/ymir-migrate.sh" status >/dev/null 2>&1; }
+f_migrations(){ [ -x "$SCRIPT_DIR/ymir-migrate.sh" ] && "$SCRIPT_DIR/ymir-migrate.sh" apply >/dev/null 2>&1; }
+# Hoard: private data sits under the hoard, and .ymir-layout.yaml tells the truth.
+# Two failures this catches: (1) a declared layout path that does not exist — a
+# stale map is what lets private work land outside the hoard; (2) a flat
+# $YMIR_HOME/{identity,data,docs,secrets,tenants} duplicate beside hodd/ — the
+# drift that RULES/04-hoard.md (correction 2026-09-17) forbids.
+_hoard_root() { local r; if [ -x "$SCRIPT_DIR/hoard-lib.sh" ]; then . "$SCRIPT_DIR/hoard-lib.sh"; hoard_root r; printf '%s' "$r"; else printf '%s' "${YMIR_HOARD:-$YMIR_HOME/hodd}"; fi; }
+s_hoard() {
+  local h; h="$(_hoard_root)"
+  [ -d "$h" ] || return 1
+  local lay="$YMIR_HOME/.ymir-layout.yaml" k p
+  if [ -f "$lay" ]; then
+    for k in config secrets identity workspaces memory smidja state data; do
+      p="$(sed -nE "s/^  $k: \"([^\"]+)\".*/\1/p" "$lay" | head -1)"
+      [ -n "$p" ] && [ ! -d "$p" ] && return 1
+    done
+  fi
+  for k in identity data docs secrets tenants; do
+    [ -d "$YMIR_HOME/$k" ] && return 1
+  done
+  return 0
+}
+f_hoard() {
+  local h; h="$(_hoard_root)"
+  mkdir -p "$h" 2>/dev/null || return 1
+  # A flat duplicate beside hodd/ is the drift: merge it in, never clobber.
+  local k
+  for k in identity data docs secrets tenants; do
+    local src="$YMIR_HOME/$k"
+    [ -d "$src" ] || continue
+    mkdir -p "$h/$k" 2>/dev/null || continue
+    cp -an "$src/." "$h/$k/" 2>/dev/null || true
+    rm -rf "$src" 2>/dev/null || true
+  done
+  # A layout entry naming a nonexistent dir is repointed at the hoard.
+  local lay="$YMIR_HOME/.ymir-layout.yaml" k2 p
+  if [ -f "$lay" ] && [ -d "$h" ]; then
+    for k2 in identity data secrets docs tenants; do
+      p="$(sed -nE "s/^  $k2: \"([^\"]+)\".*/\1/p" "$lay" | head -1)"
+      if [ -n "$p" ] && [ ! -d "$p" ]; then
+        sed -i "s|^  $k2: .*|  $k2: \"$h/$k2\"|" "$lay"
+      fi
+    done
+  fi
+  s_hoard
+}
+
+detail() { # <name> -> one short fact
+  case "$1" in
+    floors)    "[ -x $SCRIPT_DIR/prereq-ensure.sh ] && echo tool floors" ;;
+    herdr)     "have herdr && herdr --version 2>/dev/null | head -1 || echo 'herdr absent'" ;;
+    a2abridge) "have a2abridge && a2abridge --version 2>/dev/null | head -1 || echo 'engine absent'" ;;
+    hermes)    "have hermes && echo present || echo absent" ;;
+    sessrumnir)"[ -d $ROOT/apps/sessrumnir/out ] && echo built || echo 'not built'" ;;
+    well)      "echo 'engram :4602'" ;;
+    mcp)       "echo 'a2abridge + engram'" ;;
+    lock)      "cat $STATE/.lock 2>/dev/null | tr -d '[:space:]' | sed 's/^/pid /' || echo none" ;;
+    migrations)"echo 'structure'" ;;
+    hoard)     "printf 'hoard %s' \"$(_hoard_root)\" ; [ -d \"$YMIR_HOME/identity\" ] && printf ' +flat-duplicate' ; printf '\\n'" ;;
+  esac
+}
+
+broken=0
+if [ "$ACTION" = "fix" ]; then
+  for s in "${SURFACES[@]}"; do
+    if ! "s_$s" >/dev/null 2>&1; then
+      "f_$s" >/dev/null 2>&1 && printf 'eir: mended %s\n' "$s" || printf 'eir: could not mend %s\n' "$s" >&2
+    fi
+  done
+fi
+
+rows=""
+count=0
+for s in "${SURFACES[@]}"; do
+  if "s_$s" >/dev/null 2>&1; then state=ok; else state=broken; broken=$((broken+1)); fi
+  d="$("detail" "$s" 2>/dev/null | head -1)"
+  rows="${rows}  \"${s}\",\"${state}\",\"${d}\"\n"
+  count=$((count+1))
+done
+
+printf 'eir[1]{action,root,broken}:\n  "%s","%s",%s\n' "$ACTION" "$ROOT" "$broken"
+printf 'health[%d]{surface,state,detail}:\n' "$count"
+printf '%b' "$rows"
+if [ "$broken" != 0 ]; then
+  printf 'eir: %s surface(s) need mending — run: bin/eir-doctor.sh fix\n' "$broken"
+  exit 1
+fi
+exit 0

package/bin/erindi-brief.sh

@@ -0,0 +1,271 @@
+#!/usr/bin/env bash
+# erindi-brief.sh - scaffold an Eindri worker brief at data/<task-id>/brief.md.
+#
+# Erindi ("the errand") is the written errand Brokk hands an Eindri. The brief
+# carries the Setup / Rules / Definition-of-done contract, a fixed machine-
+# readable "Delivery contract: mode=<mode>" line, the worktree-isolation
+# assertion, the status protocol, and the steering-inbox receive/ack section.
+# Ported from the upstream distro brief scaffold for plan 29
+# (docs/plans/29-brokk-distro-runtime.md).
+#
+# Usage:
+#   erindi-brief.sh <task-id> <repo-name> --mode <no-mistakes|direct-PR|local-only>
+#   erindi-brief.sh <task-id> <repo-name> --scout
+#   erindi-brief.sh <task-id> --relaunch
+#
+# --scout writes the scout contract: the deliverable is a report at
+# data/<task-id>/report.md (no branch, no push, no PR) and the worktree is
+# scratch.
+# --relaunch regenerates the brief from the task's recorded state/<id>.meta so
+# a replacement Eindri receives the SAME delivery contract as the original; it
+# refuses to invent a mode and it will not run without an existing meta record.
+# The fixed "Delivery contract: mode=<mode>" line is read by
+# bin/einherjar-spawn.sh, which refuses to launch a ship task whose explicit
+# --mode disagrees, so an adjusted brief and the recorded task cannot drift.
+# --mode is refused on --scout and --relaunch: a scout delivers a report and a
+# relaunch re-derives the mode from the task record, not from a flag.
+# Refuses to overwrite an existing brief unless --relaunch is given.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+usage() {
+  awk 'NR == 1 { next } /^#/ { sub(/^# ?/, ""); print; next } { exit }' "$0"
+}
+
+case "${1:-}" in
+  -h|--help) usage; exit 0 ;;
+esac
+
+ROOT="${BROKK_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+BROKK_HOME="${BROKK_HOME:-${BROKK_ROOT_OVERRIDE:-$ROOT}}"
+DATA="${BROKK_DATA_OVERRIDE:-$BROKK_HOME/data}"
+STATE="${BROKK_STATE_OVERRIDE:-$BROKK_HOME/state}"
+PAUSED_VERB="${BROKK_PAUSED_VERB:-paused}"
+
+KIND=ship
+SCOUT=0
+RELAUNCH=0
+MODE=
+MODE_SET=0
+POS=()
+want_value=
+for a in "$@"; do
+  if [ -n "$want_value" ]; then
+    case "$a" in
+      --*) echo "error: --$want_value requires a value" >&2; exit 1 ;;
+    esac
+    case "$want_value" in
+      mode) MODE=$a; MODE_SET=1 ;;
+      *) echo "error: internal parser state for --$want_value" >&2; exit 1 ;;
+    esac
+    want_value=
+    continue
+  fi
+  case "$a" in
+    --scout) SCOUT=1 ;;
+    --relaunch) RELAUNCH=1 ;;
+    --mode) want_value=mode ;;
+    --mode=*) MODE=${a#--mode=}; MODE_SET=1 ;;
+    --yolo|--yolo=*) echo "error: --yolo is not a brief input; pass it to bin/einherjar-spawn.sh, which records the task's merge posture" >&2; exit 1 ;;
+    *) POS+=("$a") ;;
+  esac
+done
+[ -z "$want_value" ] || { echo "error: --$want_value requires a value" >&2; exit 1; }
+
+if [ "$SCOUT" -eq 1 ] && [ "$RELAUNCH" -eq 1 ]; then
+  echo "error: --scout and --relaunch are mutually exclusive" >&2
+  exit 1
+fi
+
+ID=${POS[0]:-}
+[ -n "$ID" ] || { echo "error: task-id is required" >&2; exit 2; }
+case "$ID" in
+  */*|.*|*' '*) echo "error: invalid task-id '$ID' (no slashes, no leading dot, no spaces)" >&2; exit 2 ;;
+esac
+
+meta_value() {  # <meta> <key>
+  grep "^$2=" "$1" 2>/dev/null | tail -1 | cut -d= -f2- || true
+}
+
+if [ "$RELAUNCH" -eq 1 ]; then
+  META="$STATE/$ID.meta"
+  [ -f "$META" ] || { echo "error: --relaunch requires an existing task record at $META" >&2; exit 1; }
+  RECORDED_KIND=$(meta_value "$META" kind); RECORDED_KIND=${RECORDED_KIND:-ship}
+  REPO=$(meta_value "$META" project)
+  [ -n "$REPO" ] || REPO=$(meta_value "$META" worktree)
+  [ -n "$REPO" ] || { echo "error: task record $META records no project; cannot regenerate the brief" >&2; exit 1; }
+  if [ "$MODE_SET" -eq 1 ]; then
+    echo "error: --mode is refused with --relaunch; the delivery mode is re-derived from $META" >&2
+    exit 1
+  fi
+  if [ "$RECORDED_KIND" = ship ]; then
+    MODE=$(meta_value "$META" mode)
+    case "$MODE" in
+      no-mistakes|direct-PR|local-only) ;;
+      *) echo "error: task record $META records no valid mode; refusing to regenerate the brief" >&2; exit 1 ;;
+    esac
+  elif [ "$RECORDED_KIND" != scout ]; then
+    echo "error: task record $META records kind=$RECORDED_KIND, which has no brief scaffold" >&2
+    exit 1
+  fi
+  KIND=$RECORDED_KIND
+else
+  if [ "$SCOUT" -eq 1 ]; then
+    KIND=scout
+  else
+    [ "$MODE_SET" -eq 1 ] || {
+      echo "error: ship briefs require --mode <no-mistakes|direct-PR|local-only>; resolve it at intake and pass it here" >&2
+      exit 1
+    }
+    case "$MODE" in
+      no-mistakes|direct-PR|local-only) ;;
+      *) echo "error: --mode must be one of no-mistakes, direct-PR, local-only (got '$MODE')" >&2; exit 1 ;;
+    esac
+  fi
+  if [ "$MODE_SET" -eq 1 ] && [ "$SCOUT" -eq 1 ]; then
+    echo "error: --mode applies only to ship briefs; a scout delivers a report" >&2
+    exit 1
+  fi
+  REPO=${POS[1]:-}
+  [ -n "$REPO" ] || { echo "error: <repo-name> is required for a fresh brief" >&2; exit 2; }
+fi
+
+BRIEF="$DATA/$ID/brief.md"
+if [ -e "$BRIEF" ] && [ "$RELAUNCH" -ne 1 ]; then
+  echo "error: $BRIEF already exists (use --relaunch to regenerate from the task record)" >&2
+  exit 1
+fi
+mkdir -p "$DATA/$ID"
+
+shell_quote() {
+  printf "'"
+  printf '%s' "$1" | sed "s/'/'\\\\''/g"
+  printf "'"
+}
+
+STATUS_FILE=$(shell_quote "$STATE/$ID.status")
+INBOX_DIR=$(shell_quote "$STATE/$ID.inbox")
+REPORT_FILE="$DATA/$ID/report.md"
+
+INBOX_SECTION=$(cat <<EOF
+# Brokk instruction inbox
+Brokk steers you through durable message files in $INBOX_DIR.
+When a terminal message says an instruction is waiting there - and at any natural checkpoint when you are unsure - list $INBOX_DIR/*.msg, read and act on each message in numeric order, then acknowledge each handled message by moving it: \`mv $INBOX_DIR/NNN.msg $INBOX_DIR/handled/\`.
+The move IS the acknowledgement: without it Brokk rings again and eventually treats you as stuck. An empty or absent inbox needs no action.
+EOF
+)
+
+STATUS_SECTION=$(cat <<EOF
+Report status by appending one line:
+   \`echo "{state}: {one short line}" >> $STATUS_FILE\`
+   States: working, needs-decision, blocked, $PAUSED_VERB, done, failed.
+   Each append wakes Brokk, so report sparingly: only phase changes a supervisor
+   would act on and the needs-decision/blocked/$PAUSED_VERB/done/failed states.
+   Use \`$PAUSED_VERB: {why}\` - distinct from \`blocked:\` - ONLY when you are deliberately
+   idling on a known external wait you expect to clear on its own (an upstream release,
+   a rate-limit reset); use \`blocked:\` when you are stuck and need Brokk to act.
+   A mid-task \`working:\` line is nonterminal: do not end the turn after it; continue
+   until a defined \`done:\` gate under Definition of done.
+   A decision or blocker stays open until a \`resolved\` line carrying its exact key
+   lands; a later \`done:\` or \`working:\` line never closes it.
+EOF
+)
+
+if [ "$KIND" = scout ]; then
+  cat > "$BRIEF" <<EOF
+You are an Eindri: an autonomous worker agent managed by Brokk. Work on your own; do not wait for the Allfather.
+
+# Task
+{TASK}
+
+# Delivery contract
+Delivery contract: mode=scout
+
+# Setup
+You are in a disposable git worktree of $REPO at .yggdrasil/$ID on the host (under Utgard it appears at /sandbox/workspace), at a detached HEAD on a clean default branch.
+This is a SCOUT task: the deliverable is a written report, not a PR.
+The worktree is your laboratory - install, run, edit, and make scratch commits freely; all of it is discarded at teardown.
+The report is the only thing that survives, so anything worth keeping must be in it.
+
+**Verify isolation before anything else.** Run \`pwd -P\` and \`git rev-parse --show-toplevel\`; both must resolve to this disposable task worktree (host path .yggdrasil/$ID, or /sandbox/workspace under Utgard), never the primary checkout Brokk operates from.
+If the top-level path is the primary checkout or not the worktree you were launched in, STOP - do not branch or commit here - append \`blocked: launched in primary checkout, not an isolated worktree\` to the status file and stop.
+
+# Rules
+1. Never push to any remote and never open a PR.
+2. Stay inside this worktree; the only files you may write outside it are the report and the status file below.
+3. $STATUS_SECTION
+4. If you hit the same obstacle twice, append \`blocked: {why}\` and stop; Brokk will help.
+5. If a decision belongs to the Allfather (product choices, destructive actions), append \`needs-decision: {summary of options}\` and stop. Brokk will reply with the decision.
+
+$INBOX_SECTION
+
+# Definition of done
+Write your findings to \`$REPORT_FILE\`.
+The report must stand alone: what you did, what you found, the evidence (commands run, output, file:line references), and what you recommend.
+When the report is complete, append \`done: {one-line conclusion}\` to the status file and stop.
+EOF
+  if [ "$RELAUNCH" -eq 1 ]; then
+    printf 'scaffolded: %s (scout, relaunch; replace {TASK})\n' "$BRIEF"
+  else
+    printf 'scaffolded: %s (scout; replace {TASK})\n' "$BRIEF"
+  fi
+  exit 0
+fi
+
+case "$MODE" in
+  direct-PR)
+    RULE1='Never push to the default branch (push only your `eindri/'"$ID"'` branch). Never merge a PR; the Glitnir human gate owns the merge.'
+    DOD_BODY='Commit your work on `eindri/'"$ID"'`. Push the branch and open a PR with `gh`. Report the PR URL: append `done: opened PR <url>` to the status file and stop. Brokk routes the PR to the Glitnir human gate; you never merge.'
+    ;;
+  local-only)
+    RULE1="Never push to any remote and never open a PR. Work only on your \`eindri/$ID\` branch; Brokk merges into local \`main\` after the Allfather approves."
+    DOD_BODY="Commit your work on \`eindri/$ID\`. Append \`done: ready in branch eindri/$ID\` to the status file and stop. Brokk merges into local \`main\` after the Allfather approves."
+    ;;
+  *)  # no-mistakes
+    RULE1='Never push to the default branch. Never merge a PR; the Glitnir human gate owns the merge.'
+    DOD_BODY='Run the `no-mistakes` pipeline over your branch and open the PR it produces. Append `done: <PR url> (pipeline <status>)` to the status file and stop. Brokk routes the PR to the Glitnir human gate; you never merge.'
+    ;;
+esac
+
+if [ "$MODE" = no-mistakes ]; then
+  SETUP_STEP2='
+2. Run `no-mistakes doctor`; if it reports the repo is not initialized here, run `no-mistakes init`.'
+else
+  SETUP_STEP2=""
+fi
+
+cat > "$BRIEF" <<EOF
+You are an Eindri: an autonomous worker agent managed by Brokk. Work on your own; do not wait for the Allfather.
+
+# Task
+{TASK}
+
+# Delivery contract
+Delivery contract: mode=$MODE
+
+# Setup
+You are in a disposable git worktree of $REPO at .yggdrasil/$ID on the host (under Utgard it appears at /sandbox/workspace), at a detached HEAD on a clean default branch.
+
+**Verify isolation before anything else.** Run \`pwd -P\` and \`git rev-parse --show-toplevel\`; both must resolve to this disposable task worktree (host path .yggdrasil/$ID, or /sandbox/workspace under Utgard), never the primary checkout Brokk operates from.
+The path check is authoritative. If the top-level path is the primary checkout or not the worktree you were launched in, STOP - do not branch or commit here - append \`blocked: launched in primary checkout, not an isolated worktree\` to the status file and stop.
+
+1. First action: create your branch: \`git checkout -b eindri/$ID\`$SETUP_STEP2
+
+# Rules
+1. $RULE1
+2. Stay inside this worktree; modify nothing outside it.
+3. $STATUS_SECTION
+4. If you hit the same obstacle twice, append \`blocked: {why}\` and stop; Brokk will help.
+5. If a decision belongs to the Allfather (product choices, destructive actions), append \`needs-decision: {summary of options}\` and stop. Brokk will reply with the decision.
+
+$INBOX_SECTION
+
+# Definition of done
+$DOD_BODY
+EOF
+if [ "$RELAUNCH" -eq 1 ]; then
+  printf 'scaffolded: %s (ship, mode=%s, relaunch; replace {TASK})\n' "$BRIEF" "$MODE"
+else
+  printf 'scaffolded: %s (ship, mode=%s; replace {TASK})\n' "$BRIEF" "$MODE"
+fi

package/bin/feature-inventory.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# feature-inventory.sh — every feature the system CLAIMS, in one checklist.
+#
+# "Every single feature must work" is a hope until there is a list. This builds
+# the list from the tree itself rather than from anyone's memory: every tool, job,
+# skill, agent, app, workflow, service and registered project. It asserts nothing
+# about whether they work — that is the verification pass, and it needs this
+# inventory to exist first.
+#
+#   bin/feature-inventory.sh            # the inventory, as TOON
+#   bin/feature-inventory.sh --counts   # just the tallies
+#   bin/feature-inventory.sh --verify-plan   # the inventory as a checklist to fill in
+set -u
+
+VERSION="1.0.0"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+HOARD="${YMIR_HOARD:-${YMIR_HOME:-$HOME/Documents/Ymir}/hodd}"
+
+case "${1-}" in
+  -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;;
+  -h|--help|"") sed -n '2,14p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+esac
+MODE="${1:-all}"
+
+n_tools=$(find "$ROOT/bin" -maxdepth 1 -type f \( -name '*.sh' -o -name '*.py' -o -name '*.js' \) 2>/dev/null | wc -l | tr -d ' ')
+n_jobs=$(ls "$ROOT"/bin/nornir-job-*.sh 2>/dev/null | wc -l | tr -d ' ')
+n_skills=$(find -L "$ROOT/.agents/skills" -mindepth 2 -maxdepth 2 -name SKILL.md 2>/dev/null | wc -l | tr -d ' ')
+n_agents=$(ls "$ROOT"/.agents/agents/*.md 2>/dev/null | wc -l | tr -d ' ')
+n_workflows=$(ls "$ROOT"/.github/workflows/*.yml 2>/dev/null | wc -l | tr -d ' ')
+n_apps=$(find "$ROOT/apps" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | wc -l | tr -d ' ')
+n_migrations=$(ls "$ROOT"/.agents/migrations/*.sh 2>/dev/null | wc -l | tr -d ' ')
+n_projects=0
+[ -r "$HOARD/identity/projects.yaml" ] && n_projects=$(grep -c '^  - id:' "$HOARD/identity/projects.yaml" 2>/dev/null | tr -d ' ')
+
+if [ "$MODE" = "--counts" ]; then
+  printf 'features[8]{kind,count}:\n'
+  printf '  "tools (bin/)",%s\n' "$n_tools"
+  printf '  "nornir jobs",%s\n' "$n_jobs"
+  printf '  "skills",%s\n' "$n_skills"
+  printf '  "agents",%s\n' "$n_agents"
+  printf '  "workflows (CI)",%s\n' "$n_workflows"
+  printf '  "apps",%s\n' "$n_apps"
+  printf '  "migrations",%s\n' "$n_migrations"
+  printf '  "registered projects",%s\n' "$n_projects"
+  exit 0
+fi
+
+# The checklist: one row per thing that must be proven.
+printf 'inventory[8]{kind,count,how_proven}:\n'
+printf '  "tools (bin/)",%s,"bash -n + --version/--help runs, exit 0"\n' "$n_tools"
+printf '  "nornir jobs",%s,"one run each, --check or dry-run, writes as documented"\n' "$n_jobs"
+printf '  "skills",%s,"its scripts run; its asset paths resolve (skillindex gate)"\n' "$n_skills"
+printf '  "agents",%s,"bound into all five harnesses (harnesses gate) + a dispatch"\n' "$n_agents"
+printf '  "workflows (CI)",%s,"YAML parses + the job runs green on the branch"\n' "$n_workflows"
+printf '  "apps",%s,"builds, serves, wears its rune, installs its entry, opens in Electron"\n' "$n_apps"
+printf '  "migrations",%s,"idempotent; re-run leaves the home unchanged"\n' "$n_migrations"
+printf '  "registered projects",%s,"gh resolves the repo; PR ledger reports its PRs"\n' "$n_projects"
+
+printf 'tools[%s]{tool}:\n' "$n_tools"
+for f in "$ROOT"/bin/*; do
+  [ -f "$f" ] || continue
+  case "$f" in *.sh|*.py|*.js) printf '  "%s"\n' "$(basename "$f")" ;; esac
+done
+
+printf 'jobs[%s]{job}:\n' "$n_jobs"
+for f in "$ROOT"/bin/nornir-job-*.sh; do [ -f "$f" ] && printf '  "%s"\n' "$(basename "$f")"; done
+
+printf 'apps[%s]{app}:\n' "$n_apps"
+for d in "$ROOT"/apps/*/; do [ -d "$d" ] && printf '  "%s"\n' "$(basename "$d")"; done
+
+printf 'skills[%s]{skill,owner}:\n' "$n_skills"
+grep -oE '^  "[a-z0-9-]+","[^"]*","[a-z]+"' "$ROOT/.agents/skills/README.md" 2>/dev/null | sed 's/^  //' || true

package/bin/fleet-apply.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# fleet-apply.sh — apply fleet-wide preferences to every registered Eindri-home.
+#
+# Reads `data/fleet.md` (`key: value` lines; key `ro` = on|off) and writes each
+# into the home's gitignored `state/` (for `ro`: `state/ro`), so a single fleet
+# setting reaches every home without dirtying any tracked tree. Remote routes are
+# reported, not written. Galdr-style TOON.
+#
+# Usage:
+#   fleet-apply.sh [--check]
+#   fleet-apply.sh --version
+set -u
+
+VERSION="1.0.0"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
+REG="${BROKK_EINDRI_HOMES:-$YMIR_DATA_DIR/eindri-homes.md}"
+PREFS="${BROKK_FLEET_PREFS:-$YMIR_DATA_DIR/fleet.md}"
+CHECK=0
+
+case "${1-}" in -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;; -h|--help) sed -n '2,12p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;; esac
+[ "${1-}" = "--check" ] && CHECK=1
+
+pref() { sed -nE "s/^[[:space:]]*$1:[[:space:]]*([^[:space:]#]+).*/\1/p" "$PREFS" 2>/dev/null | head -1; }
+
+if [ ! -f "$PREFS" ]; then
+  printf 'fleet[1]{prefs,state,detail}:\n  "absent","noop","%s (no fleet preferences set)"\n' "${PREFS#"$ROOT"/}"
+  exit 0
+fi
+
+ro="$(pref ro)"
+[ -n "$ro" ] || ro=""
+
+declare -a ROWS
+apply_home() { # <id> <path>
+  local id="$1" p="$2"
+  [ -d "$p" ] || { ROWS+=("  \"$id\",\"$p\",\"skipped\",\"not found\""); return; }
+  if [ "$CHECK" = 1 ]; then ROWS+=("  \"$id\",\"$p\",\"would-apply\",\"ro=$ro\""); return; fi
+  if [ -n "$ro" ]; then
+    mkdir -p "$p/state"
+    printf '%s\n' "$ro" >"$p/state/ro" && ROWS+=("  \"$id\",\"$p\",\"applied\",\"ro=$ro\"") || ROWS+=("  \"$id\",\"$p\",\"failed\",\"ro\"")
+  else
+    ROWS+=("  \"$id\",\"$p\",\"noop\",\"no ro pref\"")
+  fi
+}
+
+# This home is always a target.
+apply_home "this" "$ROOT"
+
+if [ -f "$REG" ]; then
+  while IFS= read -r line; do
+    case "$line" in '- '*) ;; *) continue ;; esac
+    id="$(printf '%s' "$line" | sed -nE 's/^- ([^ ]+).*/\1/p')"
+    host="$(printf '%s' "$line" | sed -nE 's/.*\(host: ([^;)]+).*/\1/p' | tr -d ' ')"
+    home="$(printf '%s' "$line" | sed -nE 's/.*\(.*home: ([^;)]+).*/\1/p' | tr -d ' ')"
+    [ -n "$id" ] || continue
+    if [ -n "$host" ]; then
+      ROWS+=("  \"$id\",\"remote $host\",\"skipped\",\"run bin/fleet-apply.sh on $host\""); continue
+    fi
+    [ -n "$home" ] || home="$id"
+    apply_home "$id" "$home"
+  done <"$REG"
+else
+  ROWS+=("  \"-\",\"registry\",\"absent\",\"$REG (no Eindri-homes registered)\"")
+fi
+
+printf 'fleet[%d]{id,target,state,detail}:\n' "${#ROWS[@]}"
+printf '%s\n' "${ROWS[@]}"