@zerwiz/ymir 0.1.4 → 0.1.7

package/bin/nornir-cron-start.sh

@@ -0,0 +1,162 @@
+#!/usr/bin/env bash
+# nornir-cron-start.sh - ensure Brokk's scheduled jobs are running (idempotent).
+#
+# Nornir are the fates who govern time. Jobs are declared in config/cron.yaml as
+# `HH:MM <command>` lines (one per line, `#` comments). This script keeps exactly
+# one lightweight scheduler loop alive via state/cron.pid. The loop:
+#   * date-guards each job under state/.cron-fired/<job> so it runs once a day,
+#     even across a restarted loop;
+#   * runs each command with a per-job flock so a slow job never overlaps itself;
+#   * exports the BROKK_* home/state/config/root env to every job;
+#   * runs jobs from BROKK_HOME and logs to state/cron.log.
+#
+# Ported concept from plan 24 (cron schedule) and the upstream stateless-spawn
+# pattern for plan 29.
+#
+# Usage: nornir-cron-start.sh [--status|--stop]
+#
+# Environment (kept from the original interface):
+#   BROKK_ROOT_OVERRIDE, BROKK_HOME, BROKK_STATE_OVERRIDE, BROKK_CONFIG_OVERRIDE
+#   BROKK_CRON_LOG_MAX_BYTES  rotation threshold for state/cron.log (default 1 MiB)
+set -u
+
+# --- portability shim: bin/ymir-platform.sh --------------------------------
+# One place knows the OS differences (readlink -f, /proc, setsid, stat, nproc).
+if [ -z "${YMIR_PLATFORM_LOADED:-}" ]; then
+  _ymir_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+  for _ymir_c in "$_ymir_dir/ymir-platform.sh" "$(dirname "$_ymir_dir")/bin/ymir-platform.sh"; do
+    [ -r "$_ymir_c" ] && { . "$_ymir_c"; YMIR_PLATFORM_LOADED=1; break; }
+  done
+  unset _ymir_dir _ymir_c
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="${BROKK_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+BROKK_HOME="${BROKK_HOME:-$ROOT}"
+STATE="${BROKK_STATE_OVERRIDE:-$BROKK_HOME/state}"
+CONFIG="${BROKK_CONFIG_OVERRIDE:-$BROKK_HOME/config}"
+CRON_CONFIG="$CONFIG/cron.yaml"
+PID_FILE="$STATE/cron.pid"
+LOG_FILE="$STATE/cron.log"
+STAMP_DIR="$STATE/.cron-fired"
+LOCK_DIR="$STATE/.cron-locks"
+IDENTITY_MARK='cron run:'
+
+mkdir -p "$STATE"
+
+job_count() {
+  [ -r "$CRON_CONFIG" ] || { printf '0'; return; }
+  grep -vE '^[[:space:]]*(#|$)' "$CRON_CONFIG" 2>/dev/null | wc -l | tr -d '[:space:]'
+}
+
+# A live loop is a live pid whose command line still carries the scheduler body.
+# The identity check guards against pid reuse after a reboot/crash.
+running_pid() {
+  [ -r "$PID_FILE" ] || return 1
+  local pid
+  pid=$(tr -d '[:space:]' <"$PID_FILE")
+  case "$pid" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  kill -0 "$pid" 2>/dev/null || return 1
+  # /proc is Linux-only; the shim falls back to `ps -o command=`.
+  if ymir_pid_alive "$pid"; then
+    ymir_pid_cmdline "$pid" 2>/dev/null | grep -q "$IDENTITY_MARK" || return 1
+  fi
+  printf '%s' "$pid"
+}
+
+rotate_log() {
+  [ -r "$LOG_FILE" ] || return 0
+  local size max
+  size=$(wc -c <"$LOG_FILE" 2>/dev/null | tr -d '[:space:]')
+  case "$size" in ''|*[!0-9]*) return 0 ;; esac
+  max="${BROKK_CRON_LOG_MAX_BYTES:-1048576}"
+  if [ "$size" -gt "$max" ]; then
+    mv "$LOG_FILE" "$LOG_FILE.1" 2>/dev/null || true
+  fi
+}
+
+scheduler='
+  config="$1"; log="$2"; state="$3"; home="$4"; confdir="$5"; root="$6"
+  export BROKK_HOME="$home"
+  export BROKK_STATE_OVERRIDE="$state"
+  export BROKK_CONFIG_OVERRIDE="$confdir"
+  export BROKK_ROOT_OVERRIDE="$root"
+  export BROKK_REALM="${BROKK_REALM:-}"
+  stamp_dir="$state/.cron-fired"
+  lock_dir="$state/.cron-locks"
+  mkdir -p "$stamp_dir" "$lock_dir"
+  while :; do
+    now=$(date +%H:%M)
+    today=$(date +%Y-%m-%d)
+    while IFS= read -r line; do
+      case "$line" in ""|\#*) continue ;; esac
+      at=${line%% *}
+      cmd=${line#* }
+      [ -n "$cmd" ] || continue
+      [ "$at" = "$now" ] || continue
+      key=$(printf "%s" "$cmd" | tr -c "A-Za-z0-9._-" "_")
+      stamp="$stamp_dir/$key"
+      if [ -r "$stamp" ] && [ "$(cat "$stamp" 2>/dev/null)" = "$today" ]; then continue; fi
+      printf "%s\n" "$today" >"$stamp"
+      ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+      printf "%s cron run: %s\n" "$ts" "$cmd" >>"$log"
+      lock="$lock_dir/$key.lock"
+      if command -v flock >/dev/null 2>&1; then
+        ( flock -n 8 || { printf "%s cron skip (busy): %s\n" "$ts" "$cmd" >>"$log"; exit 0; }
+          cd "$home" 2>/dev/null || true
+          bash -lc "$cmd" >>"$log" 2>&1
+        ) 8>>"$lock" &
+      else
+        ( cd "$home" 2>/dev/null || true; bash -lc "$cmd" >>"$log" 2>&1 ) &
+      fi
+    done <"$config"
+    sleep 45
+  done
+'
+
+case "${1-}" in
+  --status)
+    if pid=$(running_pid); then
+      printf 'cron: running pid=%s jobs=%s\n' "$pid" "$(job_count)"
+    else
+      printf 'cron: stopped jobs=%s\n' "$(job_count)"
+    fi
+    exit 0
+    ;;
+  --stop)
+    if pid=$(running_pid); then
+      kill "$pid" 2>/dev/null || true
+      rm -f "$PID_FILE"
+      printf 'cron: stopped pid=%s\n' "$pid"
+    else
+      rm -f "$PID_FILE" 2>/dev/null || true
+      printf 'cron: already stopped\n'
+    fi
+    exit 0
+    ;;
+esac
+
+if pid=$(running_pid); then
+  printf 'cron: running pid=%s jobs=%s\n' "$pid" "$(job_count)"
+  exit 0
+fi
+
+jobs=$(job_count)
+if [ "$jobs" = "0" ]; then
+  printf 'cron: no jobs configured (%s absent or empty)\n' "$CRON_CONFIG"
+  exit 0
+fi
+
+mkdir -p "$STAMP_DIR" "$LOCK_DIR"
+rotate_log
+
+if command -v setsid >/dev/null 2>&1; then
+  setsid bash -c "$scheduler" _ "$CRON_CONFIG" "$LOG_FILE" "$STATE" "$BROKK_HOME" "$CONFIG" "$ROOT" >>"$LOG_FILE" 2>&1 &
+else
+  nohup bash -c "$scheduler" _ "$CRON_CONFIG" "$LOG_FILE" "$STATE" "$BROKK_HOME" "$CONFIG" "$ROOT" >>"$LOG_FILE" 2>&1 &
+fi
+loop_pid=$!
+printf '%s\n' "$loop_pid" >"$PID_FILE"
+printf 'cron: started pid=%s jobs=%s\n' "$loop_pid" "$jobs"

package/bin/nornir-job-daily-briefing.sh

@@ -0,0 +1,191 @@
+#!/usr/bin/env bash
+# nornir-job-daily-briefing.sh - the 07:00 Sága daily seeing.
+#
+# Sága sees all that happens. This job writes a real, deterministic daily
+# briefing — no model call — from four grounded inputs:
+#   1. open forge orders parsed from docs/masterplan.md (append-only source)
+#   2. live fleet/state under state/ (cron, metas, status, session lock)
+#   3. active plan status from docs/plans/*.md
+#   4. today's Runes tail from workspace/memory/runes_audit.md
+#
+# Output: svartalfaheim/<realm>/workspace/memory/daily/YYYY-MM-DD.md
+# It is safe to re-run within a day: the file is rebuilt atomically from the
+# same inputs, so the operator never accumulates duplicate briefings.
+#
+# Environment:
+#   BROKK_HOME, BROKK_STATE_OVERRIDE, BROKK_REALM
+#   BROKK_BRIEF_DIR          explicit output directory override
+#   BROKK_BRIEF_MAX_ORDERS   open orders listed (default 15)
+#   BROKK_BRIEF_MAX_RUNES    today's runes listed (default 12)
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="${BROKK_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+BROKK_HOME="${BROKK_HOME:-$ROOT}"
+STATE="${BROKK_STATE_OVERRIDE:-$BROKK_HOME/state}"
+DATA="${BROKK_DATA_OVERRIDE:-$BROKK_HOME/data}"
+# shellcheck source=bin/runes-append.sh
+. "$SCRIPT_DIR/runes-append.sh"
+
+REALM="${BROKK_REALM:-}"
+if [ -z "$REALM" ] && [ -r "$DATA/realm.md" ]; then
+  REALM=$(head -n 1 "$DATA/realm.md" 2>/dev/null | tr -d '[:space:]')
+fi
+REALM="${REALM:-}"
+# Never assume the company's slug: resolve the operator's realm neutrally.
+if [ -z "$REALM" ]; then . "$SCRIPT_DIR/realm-lib.sh"; ymir_active_realm "$ROOT" REALM; fi
+
+DATE=$(date +%Y-%m-%d)
+BRIEF_DIR="${BROKK_BRIEF_DIR:-${YMIR_HOME:-$HOME/Documents/Ymir}/svartalfaheim/$REALM/workspace/memory/daily}"
+BRIEF_FILE="$BRIEF_DIR/$DATE.md"
+MAX_ORDERS="${BROKK_BRIEF_MAX_ORDERS:-15}"
+MAX_RUNES="${BROKK_BRIEF_MAX_RUNES:-12}"
+MASTERPLAN="$ROOT/docs/masterplan.md"
+PLANS_DIR="$ROOT/docs/plans"
+
+mkdir -p "$BRIEF_DIR" || { printf 'error: cannot create %s\n' "$BRIEF_DIR"; exit 1; }
+TMP="$BRIEF_DIR/.$DATE.md.tmp.$$"
+: >"$TMP" || { printf 'error: cannot write %s\n' "$BRIEF_DIR"; exit 1; }
+trap 'rm -f "$TMP"' EXIT
+emit() { printf '%s\n' "$*" >>"$TMP"; }
+
+# ---- 1. Open forge orders -------------------------------------------------
+parse_orders() {
+  [ -r "$MASTERPLAN" ] || return 0
+  awk '
+    /^\*\*W[0-9]+ — / {
+      match($0, /W[0-9]+/); id=substr($0, RSTART, RLENGTH);
+      title=$0; sub(/^\*\*W[0-9]+ — /, "", title); sub(/\*\*[[:space:]]*$/, "", title);
+      next
+    }
+    /^- Status:/ {
+      line=$0; sub(/^- Status:[[:space:]]*/, "", line);
+      split(line, a, /[.[:space:]]/); status=a[1];
+      if (id != "" && status != "") printf "%s|%s|%s\n", id, status, title;
+      id="";
+    }
+  ' "$MASTERPLAN"
+}
+
+emit "# Daily Briefing — $DATE"
+emit ""
+emit "Realm: \`$REALM\` · Home: \`$BROKK_HOME\` · Generated by Sága (Nornir 07:00, deterministic)"
+emit ""
+emit "## 1. Open Forge Orders"
+emit ""
+if [ -r "$MASTERPLAN" ]; then
+  orders_tmp="$STATE/.brief-orders.$$"
+  mkdir -p "$STATE"
+  parse_orders >"$orders_tmp"
+  total=$(wc -l <"$orders_tmp" | tr -d '[:space:]')
+  added=$(grep -c '|ADDED|' "$orders_tmp" 2>/dev/null || true)
+  working=$(grep -c '|WORKING|' "$orders_tmp" 2>/dev/null || true)
+  blocked=$(grep -c '|BLOCKED|' "$orders_tmp" 2>/dev/null || true)
+  emit "Counts: total=${total:-0} added=${added:-0} working=${working:-0} blocked=${blocked:-0}"
+  emit ""
+  emit "| Order | Status | Title |"
+  emit "|---|---|---|"
+  grep -E '\|(ADDED|WORKING|BLOCKED)\|' "$orders_tmp" 2>/dev/null | sort | head -n "$MAX_ORDERS" | while IFS='|' read -r oid ostatus otitle; do
+    emit "| $oid | $ostatus | $otitle |"
+  done
+  if [ "${total:-0}" -gt "$MAX_ORDERS" ]; then
+    emit ""
+    emit "_(truncated — ${total} open orders total; see docs/masterplan.md §3)_"
+  fi
+  rm -f "$orders_tmp"
+else
+  emit "ABSENT: docs/masterplan.md not readable"
+fi
+emit ""
+
+# Active queue (§2) — the published next list.
+emit "### Active Queue"
+emit ""
+if [ -r "$MASTERPLAN" ]; then
+  awk '/^## 2\. Active Queue/ {on=1; next} /^## 3\./ {on=0} on && /^[0-9]+\. / {print}' "$MASTERPLAN" \
+    | while IFS= read -r q; do emit "- ${q#* }"; done
+else
+  emit "ABSENT: docs/masterplan.md not readable"
+fi
+emit ""
+
+# ---- 2. Fleet & state -----------------------------------------------------
+emit "## 2. Fleet & State"
+emit ""
+if [ -x "$SCRIPT_DIR/nornir-cron-start.sh" ]; then
+  cron_line=$(BROKK_HOME="$BROKK_HOME" BROKK_STATE_OVERRIDE="$STATE" "$SCRIPT_DIR/nornir-cron-start.sh" --status 2>/dev/null || printf 'cron: status unavailable')
+  emit "- ${cron_line:-cron: status unavailable}"
+else
+  emit "- cron: scheduler not installed"
+fi
+if [ -r "$STATE/.lock" ]; then
+  lock_owner=$(tr -d '[:space:]' <"$STATE/.lock")
+  if [ -n "$lock_owner" ] && kill -0 "$lock_owner" 2>/dev/null; then
+    emit "- session lock: held by pid $lock_owner (live)"
+  else
+    emit "- session lock: stale pid ${lock_owner:-empty}"
+  fi
+else
+  emit "- session lock: none (read-only would apply)"
+fi
+meta_count=$(find "$STATE" -maxdepth 1 -name '*.meta' 2>/dev/null | wc -l | tr -d '[:space:]')
+status_count=$(find "$STATE" -maxdepth 1 -name '*.status' 2>/dev/null | wc -l | tr -d '[:space:]')
+emit "- task metadata records: ${meta_count:-0}"
+emit "- status records: ${status_count:-0}"
+if [ "$meta_count" != "0" ]; then
+  find "$STATE" -maxdepth 1 -name '*.meta' 2>/dev/null | sort | while IFS= read -r m; do
+    emit "  - $(basename "$m"): $(head -n 1 "$m" 2>/dev/null)"
+  done
+fi
+if [ -r "${YMIR_HOME:-$HOME/Documents/Ymir}/svartalfaheim/$REALM/.env.realm" ]; then
+  emit "- realm env: present"
+else
+  emit "- realm env: ABSENT (svartalfaheim/$REALM/.env.realm)"
+fi
+emit ""
+
+# ---- 3. Active plan status ------------------------------------------------
+emit "## 3. Active Plan Status"
+emit ""
+if [ -d "$PLANS_DIR" ]; then
+  for plan in "$PLANS_DIR"/*.md; do
+    [ -r "$plan" ] || continue
+    pname=$(basename "$plan" .md)
+    [ "$pname" = "README" ] && continue
+    pstatus=$(grep -m1 -i 'status' "$plan" 2>/dev/null | sed -E 's/^.*[Ss]tatus[*:[:space:]]*//; s/[[:space:]]*$//')
+    emit "- \`$pname\` — ${pstatus:-unknown}"
+  done
+else
+  emit "ABSENT: docs/plans/ not readable"
+fi
+emit ""
+
+# ---- 4. Today's Runes tail ------------------------------------------------
+emit "## 4. Today's Runes (${DATE})"
+emit ""
+runes_file_path runes_path
+if [ -r "$runes_path" ]; then
+  today_runes=$(grep -F "\"timestamp\":\"$DATE" "$runes_path" 2>/dev/null | tail -n "$MAX_RUNES")
+  if [ -n "$today_runes" ]; then
+    emit '```jsonl'
+    printf '%s\n' "$today_runes" >>"$TMP"
+    emit '```'
+  else
+    emit "No Runes carved today yet."
+  fi
+else
+  emit "ABSENT: $runes_path"
+fi
+emit ""
+
+# ---- Next step ------------------------------------------------------------
+emit "## Next"
+emit ""
+emit "Begin from the Active Queue above. Frontend gate stays ahead of backend (plan 29 §0)."
+
+mv "$TMP" "$BRIEF_FILE" || { printf 'error: cannot publish %s\n' "$BRIEF_FILE"; exit 1; }
+trap - EXIT
+printf 'briefing: wrote %s (%s bytes)\n' "$BRIEF_FILE" "$(wc -c <"$BRIEF_FILE" | tr -d '[:space:]')"
+
+runes_append "nornir" "briefing.written" --realm "$REALM" \
+  --message "daily briefing for $DATE written to $BRIEF_FILE" >/dev/null || printf 'briefing: rune append failed (non-fatal)\n'

package/bin/nornir-job-git-sync.sh

@@ -0,0 +1,152 @@
+#!/usr/bin/env bash
+# nornir-job-git-sync.sh - Yggdrasil, the world-tree kept in order.
+#
+# Configurable git sync/backup for Ymir and its realm workspaces. Two modes:
+#   fetch  (default, safe)  fetch --prune, then fast-forward ONLY (--ff-only).
+#   push   (opt-in)         commit local work, then push. Never force.
+#
+# Laws this job obeys:
+#   * never force anything (no --force, no reset, no checkout, no clean);
+#   * never discard unlanded work — a dirty tree is committed, not stashed;
+#   * a target that is not a git repo, has no remote, or has diverged is
+#     reported plainly and left untouched.
+#
+# Config (all optional):
+#   BROKK_GIT_SYNC_MODE      fetch | push            (default fetch)
+#   BROKK_GIT_SYNC_REMOTE    remote name             (default origin)
+#   BROKK_GIT_SYNC_TARGETS   colon-separated repo paths (default: auto-discover)
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="${BROKK_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+BROKK_HOME="${BROKK_HOME:-$ROOT}"
+DATA="${BROKK_DATA_OVERRIDE:-$BROKK_HOME/data}"
+# shellcheck source=bin/runes-append.sh
+. "$SCRIPT_DIR/runes-append.sh"
+
+MODE="${BROKK_GIT_SYNC_MODE:-fetch}"
+REMOTE="${BROKK_GIT_SYNC_REMOTE:-origin}"
+REALM="${BROKK_REALM:-}"
+if [ -z "$REALM" ] && [ -r "$DATA/realm.md" ]; then
+  REALM=$(head -n 1 "$DATA/realm.md" 2>/dev/null | tr -d '[:space:]')
+fi
+REALM="${REALM:-}"
+# Never assume the company's slug: resolve the operator's realm neutrally.
+if [ -z "$REALM" ]; then . "$SCRIPT_DIR/realm-lib.sh"; ymir_active_realm "$ROOT" REALM; fi
+STAMP=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+command -v git >/dev/null 2>&1 || { printf 'error: git not installed\nhelp: install git and re-run\n'; exit 1; }
+
+if [ "$MODE" != "fetch" ] && [ "$MODE" != "push" ]; then
+  printf 'error: unknown BROKK_GIT_SYNC_MODE=%s\nhelp: use fetch (safe) or push (opt-in)\n' "$MODE"
+  exit 2
+fi
+
+discover_targets() {
+  if [ -n "${BROKK_GIT_SYNC_TARGETS:-}" ]; then
+    printf '%s\n' "$BROKK_GIT_SYNC_TARGETS" | tr ':' '\n'
+    return 0
+  fi
+  [ -d "$BROKK_HOME/.git" ] && printf '%s\n' "$BROKK_HOME"
+  [ -d "$BROKK_HOME/workspace/.git" ] && printf '%s\n' "$BROKK_HOME/workspace"
+  [ -d "$BROKK_HOME/midgard/.git" ] && printf '%s\n' "$BROKK_HOME/midgard"
+  for d in "$BROKK_HOME"/svartalfaheim/*; do
+    [ -d "$d" ] || continue
+    [ -d "$d/.git" ] && printf '%s\n' "$d"
+    [ -d "$d/workspace/.git" ] && printf '%s\n' "$d/workspace"
+    for p in "$d"/projects/*; do
+      [ -d "$p/.git" ] && printf '%s\n' "$p"
+    done
+  done
+  return 0
+}
+
+total=0
+ok=0
+skipped=0
+failed=0
+
+printf 'GIT SYNC - %s mode=%s remote=%s realm=%s\n' "$STAMP" "$MODE" "$REMOTE" "$REALM"
+
+while IFS= read -r target; do
+  [ -n "$target" ] || continue
+  total=$((total + 1))
+  if ! git -C "$target" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    printf 'target: skip (not a git repo) %s\n' "$target"
+    runes_append "yggdrasil" "git.sync" --realm "$REALM" --message "skip non-repo $target" >/dev/null 2>&1 || true
+    skipped=$((skipped + 1))
+    continue
+  fi
+  if ! git -C "$target" remote get-url "$REMOTE" >/dev/null 2>&1; then
+    printf 'target: skip (no remote %s) %s\n' "$REMOTE" "$target"
+    runes_append "yggdrasil" "git.sync" --realm "$REALM" --message "skip no-remote($REMOTE) $target" >/dev/null 2>&1 || true
+    skipped=$((skipped + 1))
+    continue
+  fi
+
+  branch=$(git -C "$target" rev-parse --abbrev-ref HEAD 2>/dev/null || printf '?')
+
+  if [ "$MODE" = "fetch" ]; then
+    if ! git -C "$target" fetch --prune "$REMOTE" >>/dev/null 2>&1; then
+      printf 'target: fetch FAILED %s (%s)\n' "$target" "$branch"
+      runes_append "yggdrasil" "git.sync" --realm "$REALM" --message "fetch failed $target ($branch)" >/dev/null 2>&1 || true
+      failed=$((failed + 1))
+      continue
+    fi
+    upstream=$(git -C "$target" rev-parse --abbrev-ref --symbolic-full-name '@{u}' 2>/dev/null || true)
+    if [ -z "$upstream" ]; then
+      printf 'target: fetched (no upstream tracked) %s (%s)\n' "$target" "$branch"
+      runes_append "yggdrasil" "git.sync" --realm "$REALM" --message "fetched no-upstream $target ($branch)" >/dev/null 2>&1 || true
+      ok=$((ok + 1))
+      continue
+    fi
+    if git -C "$target" merge --ff-only "$upstream" >>/dev/null 2>&1; then
+      printf 'target: fast-forward OK %s (%s -> %s)\n' "$target" "$branch" "$upstream"
+      runes_append "yggdrasil" "git.sync" --realm "$REALM" --message "ff-only ok $target ($branch <- $upstream)" >/dev/null 2>&1 || true
+      ok=$((ok + 1))
+    else
+      printf 'target: DIVERGED - ff-only refused, left untouched %s (%s)\n' "$target" "$branch"
+      runes_append "yggdrasil" "git.sync" --realm "$REALM" --message "diverged ff-only refused $target ($branch)" >/dev/null 2>&1 || true
+      failed=$((failed + 1))
+    fi
+  else
+    dirty=$(git -C "$target" status --porcelain 2>/dev/null || true)
+    if [ -n "$dirty" ]; then
+      git -C "$target" add -A >/dev/null 2>&1 || true
+      if git -C "$target" commit -m "nornir git-sync $STAMP" >>/dev/null 2>&1; then
+        printf 'target: committed local work %s (%s)\n' "$target" "$branch"
+      else
+        printf 'target: commit skipped (nothing staged) %s\n' "$target"
+      fi
+    fi
+    upstream=$(git -C "$target" rev-parse --abbrev-ref --symbolic-full-name '@{u}' 2>/dev/null || true)
+    if [ -n "$upstream" ]; then
+      if git -C "$target" push "$REMOTE" HEAD >>/dev/null 2>&1; then
+        printf 'target: pushed %s (%s)\n' "$target" "$branch"
+        ok=$((ok + 1))
+      else
+        printf 'target: push REJECTED (no force used) %s (%s)\n' "$target" "$branch"
+        failed=$((failed + 1))
+      fi
+    else
+      if git -C "$target" push -u "$REMOTE" HEAD >>/dev/null 2>&1; then
+        printf 'target: pushed and set upstream %s (%s)\n' "$target" "$branch"
+        ok=$((ok + 1))
+      else
+        printf 'target: push REJECTED (no force used) %s (%s)\n' "$target" "$branch"
+        failed=$((failed + 1))
+      fi
+    fi
+  fi
+done <<EOF
+$(discover_targets)
+EOF
+
+if [ "$total" = "0" ]; then
+  summary="no git targets found under $BROKK_HOME (mode=$MODE)"
+  printf 'git-sync: %s\n' "$summary"
+else
+  summary="targets=$total ok=$ok skipped=$skipped failed=$failed mode=$MODE"
+  printf 'git-sync: %s\n' "$summary"
+fi
+runes_append "yggdrasil" "git.sync" --realm "$REALM" --message "$summary" >/dev/null 2>&1 || printf 'git-sync: rune append failed (non-fatal)\n'

package/bin/nornir-job-hall-snapshot.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# nornir-job-hall-snapshot.sh — Óðrerir: refresh the Live Hall's board.
+#
+# The Hall is a glass: it reads apps/odrerir/public/livehall.json, written by
+# this job from the real system state (runes · projects · cron · wake queue ·
+# standing smiths · armed when-sources · landed errands). Scheduled at 08:00,
+# after the 06:00 observer and the 07:00 briefing, so the morning's board
+# carries the day's fresh runes. Stateless: read inputs → write the snapshot →
+# carve a Rune → exit.
+#
+# Overrides: BROKK_ROOT_OVERRIDE (hall-snapshot.sh), YMIR_HOME (the hoard).
+set -u
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="${BROKK_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+
+# The snapshot is runtime, never repo: it is gitignored where it lands.
+if ! "$ROOT/bin/hall-snapshot.sh" >/dev/null 2>&1; then
+  printf 'error: hall-snapshot.sh failed — the board is stale\n'
+  printf 'help: run bin/hall-snapshot.sh by hand to see the reason\n'
+  exit 1
+fi
+
+# Carve the Rune — the ledger lives with the hoard.
+# shellcheck source=bin/runes-append.sh
+. "$ROOT/bin/runes-append.sh"
+runes_append "odrerir" "hall.snapshot" --message "Live Hall board refreshed from real state" >/dev/null \
+  || printf 'hall-snapshot: rune append failed (non-fatal)\n'
+printf 'hall-snapshot: Live Hall board refreshed\n'

package/bin/nornir-job-memory-housekeeping.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# nornir-job-memory-housekeeping.sh - Muninn, the raven of memory.
+#
+# Nightly engram/memory housekeeping. Muninn (memory) remembers and prunes.
+# This job:
+#   1. reports the state of the engram/vector store (decay/compress are the
+#      engine's job; when no engine is wired it says so, it does not fake it);
+#   2. snapshots the memory trees to a compressed backup FIRST;
+#   3. only then, and only when explicitly enabled, prunes ephemeral files.
+#
+# Safety law: never destructive without a backup. If the backup cannot be
+# written, no file is removed and the failure is reported plainly.
+#
+# Environment:
+#   BROKK_HOME, BROKK_STATE_OVERRIDE
+#   BROKK_BACKUP_DIR     backup target (default $BROKK_HOME/state/backups)
+#   BROKK_MEMORY_ROOTS   colon-separated roots (defaults below)
+#   BROKK_MIMIR_DB       vector/engram db path to inspect
+#   BROKK_MEMORY_PRUNE   set 1 to enable pruning after a successful backup
+#   BROKK_MEMORY_PRUNE_DAYS  age threshold for pruning (default 7)
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="${BROKK_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+BROKK_HOME="${BROKK_HOME:-$ROOT}"
+STATE="${BROKK_STATE_OVERRIDE:-$BROKK_HOME/state}"
+DATA="${BROKK_DATA_OVERRIDE:-$BROKK_HOME/data}"
+# shellcheck source=bin/runes-append.sh
+. "$SCRIPT_DIR/runes-append.sh"
+
+REALM="${BROKK_REALM:-}"
+if [ -z "$REALM" ] && [ -r "$DATA/realm.md" ]; then
+  REALM=$(head -n 1 "$DATA/realm.md" 2>/dev/null | tr -d '[:space:]')
+fi
+REALM="${REALM:-}"
+# Never assume the company's slug: resolve the operator's realm neutrally.
+if [ -z "$REALM" ]; then . "$SCRIPT_DIR/realm-lib.sh"; ymir_active_realm "$ROOT" REALM; fi
+
+BACKUP_DIR="${BROKK_BACKUP_DIR:-$STATE/backups}"
+if [ -n "${BROKK_MEMORY_ROOTS:-}" ]; then
+  ROOTS="$BROKK_MEMORY_ROOTS"
+else
+  ROOTS="$BROKK_HOME/.agents/memory:${YMIR_HOME:-$HOME/Documents/Ymir}/hodd/memory:${YMIR_HOME:-$HOME/Documents/Ymir}/svartalfaheim/$REALM/workspace/memory"
+fi
+MIMIR_DB="${BROKK_MIMIR_DB:-$BROKK_HOME/.agents/memory/mimirsbrunn.db}"
+PRUNE_DAYS="${BROKK_MEMORY_PRUNE_DAYS:-7}"
+TODAY=$(date +%Y-%m-%d)
+STAMP=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+printf 'MUNINN HOUSEKEEPING - %s\n' "$STAMP"
+
+# ---- 1. Engram / vector store state --------------------------------------
+if [ -r "$MIMIR_DB" ]; then
+  size=$(stat -c '%s' "$MIMIR_DB" 2>/dev/null || printf 0)
+  mtime=$(stat -c '%y' "$MIMIR_DB" 2>/dev/null | cut -d'.' -f1)
+  printf 'engram: present db=%s size=%sB mtime=%s\n' "$MIMIR_DB" "$size" "$mtime"
+  printf 'engram: decay skipped (no vector engine wired); compress handled by engine, not this job\n'
+else
+  printf 'engram: ABSENT (%s) — decay/compress skipped, nothing to age\n' "$MIMIR_DB"
+fi
+
+# ---- 2. Backup (required before any prune) -------------------------------
+backup_ok=0
+backup_file=""
+if ! mkdir -p "$BACKUP_DIR" 2>/dev/null; then
+  printf 'backup: FAILED — cannot create backup target %s; no pruning performed\n' "$BACKUP_DIR"
+else
+  existing=""
+  IFS=':' read -r -a roots_arr <<<"$ROOTS"
+  for r in "${roots_arr[@]}"; do
+    [ -n "$r" ] || continue
+    case "$r" in
+      "$BROKK_HOME"/*) rel=${r#"$BROKK_HOME"/}; [ -e "$BROKK_HOME/$rel" ] && existing="$existing $rel" ;;
+      *) [ -e "$r" ] && existing="$existing $r" ;;
+    esac
+  done
+  if [ -z "$existing" ]; then
+    printf 'backup: no memory roots exist yet (%s) — nothing to snapshot\n' "$ROOTS"
+  else
+    backup_file="$BACKUP_DIR/memory-$TODAY.tar.gz"
+    tmp_backup="$backup_file.tmp.$$"
+    # Archive relative paths so a restore is home-relative.
+    if tar -czf "$tmp_backup" -C "$BROKK_HOME" $existing 2>/dev/null; then
+      mv "$tmp_backup" "$backup_file"
+      backup_ok=1
+      printf 'backup: wrote %s (%s bytes) from:%s\n' "$backup_file" "$(wc -c <"$backup_file" | tr -d '[:space:]')" "$existing"
+    else
+      rm -f "$tmp_backup"
+      printf 'backup: FAILED to archive memory roots; no pruning performed\n'
+    fi
+  fi
+fi
+
+# ---- 3. Prune (opt-in, backup-gated, never runes/masterplan) -------------
+pruned=0
+if [ "${BROKK_MEMORY_PRUNE:-0}" = "1" ]; then
+  if [ "$backup_ok" != "1" ]; then
+    printf 'prune: skipped — backup did not succeed\n'
+  else
+    while IFS= read -r f; do
+      [ -n "$f" ] || continue
+      rm -f "$f" && { pruned=$((pruned + 1)); printf 'prune: removed %s\n' "$f"; }
+    done <<EOF
+$(find "$STATE" -maxdepth 1 \( -name '*.tmp' -o -name '*.tmp.*' -o -name '.brief-*.tmp*' \) -mtime +"$PRUNE_DAYS" 2>/dev/null)
+EOF
+    printf 'prune: removed %s ephemeral file(s) older than %s days\n' "$pruned" "$PRUNE_DAYS"
+  fi
+else
+  printf 'prune: disabled (set BROKK_MEMORY_PRUNE=1 to enable), backup retained\n'
+fi
+
+summary="engram=$([ -r "$MIMIR_DB" ] && printf present || printf absent) backup=$([ "$backup_ok" = "1" ] && printf "$backup_file" || printf failed) pruned=$pruned"
+printf 'muninn: %s\n' "$summary"
+runes_append "muninn" "memory.housekeeping" --realm "$REALM" --message "$summary" >/dev/null 2>&1 || printf 'muninn: rune append failed (non-fatal)\n'