@zerwiz/ymir 0.1.5 → 0.1.7

package/bin/eir-doctor.sh

@@ -25,7 +25,7 @@ have() { command -v "$1" >/dev/null 2>&1; }
 say_ok() { return 0; }
 
 # Each surface: `s_<name>` = healthy? (exit 0), `f_<name>` = the repair.
-SURFACES=(floors herdr a2abridge hermes sessrumnir well mcp lock migrations)
+SURFACES=(floors herdr a2abridge hermes sessrumnir well mcp lock migrations hoard)
 
 s_floors()    { [ -x "$SCRIPT_DIR/prereq-ensure.sh" ] && "$SCRIPT_DIR/prereq-ensure.sh" status >/dev/null 2>&1; }
 f_floors()    { "$SCRIPT_DIR/prereq-ensure.sh" ensure --install >/dev/null 2>&1; }
@@ -69,6 +69,51 @@ f_lock() {
 }
 s_migrations(){ [ ! -x "$SCRIPT_DIR/ymir-migrate.sh" ] || "$SCRIPT_DIR/ymir-migrate.sh" status >/dev/null 2>&1; }
 f_migrations(){ [ -x "$SCRIPT_DIR/ymir-migrate.sh" ] && "$SCRIPT_DIR/ymir-migrate.sh" apply >/dev/null 2>&1; }
+# Hoard: private data sits under the hoard, and .ymir-layout.yaml tells the truth.
+# Two failures this catches: (1) a declared layout path that does not exist — a
+# stale map is what lets private work land outside the hoard; (2) a flat
+# $YMIR_HOME/{identity,data,docs,secrets,tenants} duplicate beside hodd/ — the
+# drift that RULES/04-hoard.md (correction 2026-09-17) forbids.
+_hoard_root() { local r; if [ -x "$SCRIPT_DIR/hoard-lib.sh" ]; then . "$SCRIPT_DIR/hoard-lib.sh"; hoard_root r; printf '%s' "$r"; else printf '%s' "${YMIR_HOARD:-$YMIR_HOME/hodd}"; fi; }
+s_hoard() {
+  local h; h="$(_hoard_root)"
+  [ -d "$h" ] || return 1
+  local lay="$YMIR_HOME/.ymir-layout.yaml" k p
+  if [ -f "$lay" ]; then
+    for k in config secrets identity workspaces memory smidja state data; do
+      p="$(sed -nE "s/^  $k: \"([^\"]+)\".*/\1/p" "$lay" | head -1)"
+      [ -n "$p" ] && [ ! -d "$p" ] && return 1
+    done
+  fi
+  for k in identity data docs secrets tenants; do
+    [ -d "$YMIR_HOME/$k" ] && return 1
+  done
+  return 0
+}
+f_hoard() {
+  local h; h="$(_hoard_root)"
+  mkdir -p "$h" 2>/dev/null || return 1
+  # A flat duplicate beside hodd/ is the drift: merge it in, never clobber.
+  local k
+  for k in identity data docs secrets tenants; do
+    local src="$YMIR_HOME/$k"
+    [ -d "$src" ] || continue
+    mkdir -p "$h/$k" 2>/dev/null || continue
+    cp -an "$src/." "$h/$k/" 2>/dev/null || true
+    rm -rf "$src" 2>/dev/null || true
+  done
+  # A layout entry naming a nonexistent dir is repointed at the hoard.
+  local lay="$YMIR_HOME/.ymir-layout.yaml" k2 p
+  if [ -f "$lay" ] && [ -d "$h" ]; then
+    for k2 in identity data secrets docs tenants; do
+      p="$(sed -nE "s/^  $k2: \"([^\"]+)\".*/\1/p" "$lay" | head -1)"
+      if [ -n "$p" ] && [ ! -d "$p" ]; then
+        sed -i "s|^  $k2: .*|  $k2: \"$h/$k2\"|" "$lay"
+      fi
+    done
+  fi
+  s_hoard
+}
 
 detail() { # <name> -> one short fact
   case "$1" in
@@ -81,6 +126,7 @@ detail() { # <name> -> one short fact
     mcp)       "echo 'a2abridge + engram'" ;;
     lock)      "cat $STATE/.lock 2>/dev/null | tr -d '[:space:]' | sed 's/^/pid /' || echo none" ;;
     migrations)"echo 'structure'" ;;
+    hoard)     "printf 'hoard %s' \"$(_hoard_root)\" ; [ -d \"$YMIR_HOME/identity\" ] && printf ' +flat-duplicate' ; printf '\\n'" ;;
   esac
 }
 

package/bin/feature-inventory.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# feature-inventory.sh — every feature the system CLAIMS, in one checklist.
+#
+# "Every single feature must work" is a hope until there is a list. This builds
+# the list from the tree itself rather than from anyone's memory: every tool, job,
+# skill, agent, app, workflow, service and registered project. It asserts nothing
+# about whether they work — that is the verification pass, and it needs this
+# inventory to exist first.
+#
+#   bin/feature-inventory.sh            # the inventory, as TOON
+#   bin/feature-inventory.sh --counts   # just the tallies
+#   bin/feature-inventory.sh --verify-plan   # the inventory as a checklist to fill in
+set -u
+
+VERSION="1.0.0"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+HOARD="${YMIR_HOARD:-${YMIR_HOME:-$HOME/Documents/Ymir}/hodd}"
+
+case "${1-}" in
+  -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;;
+  -h|--help|"") sed -n '2,14p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+esac
+MODE="${1:-all}"
+
+n_tools=$(find "$ROOT/bin" -maxdepth 1 -type f \( -name '*.sh' -o -name '*.py' -o -name '*.js' \) 2>/dev/null | wc -l | tr -d ' ')
+n_jobs=$(ls "$ROOT"/bin/nornir-job-*.sh 2>/dev/null | wc -l | tr -d ' ')
+n_skills=$(find -L "$ROOT/.agents/skills" -mindepth 2 -maxdepth 2 -name SKILL.md 2>/dev/null | wc -l | tr -d ' ')
+n_agents=$(ls "$ROOT"/.agents/agents/*.md 2>/dev/null | wc -l | tr -d ' ')
+n_workflows=$(ls "$ROOT"/.github/workflows/*.yml 2>/dev/null | wc -l | tr -d ' ')
+n_apps=$(find "$ROOT/apps" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | wc -l | tr -d ' ')
+n_migrations=$(ls "$ROOT"/.agents/migrations/*.sh 2>/dev/null | wc -l | tr -d ' ')
+n_projects=0
+[ -r "$HOARD/identity/projects.yaml" ] && n_projects=$(grep -c '^  - id:' "$HOARD/identity/projects.yaml" 2>/dev/null | tr -d ' ')
+
+if [ "$MODE" = "--counts" ]; then
+  printf 'features[8]{kind,count}:\n'
+  printf '  "tools (bin/)",%s\n' "$n_tools"
+  printf '  "nornir jobs",%s\n' "$n_jobs"
+  printf '  "skills",%s\n' "$n_skills"
+  printf '  "agents",%s\n' "$n_agents"
+  printf '  "workflows (CI)",%s\n' "$n_workflows"
+  printf '  "apps",%s\n' "$n_apps"
+  printf '  "migrations",%s\n' "$n_migrations"
+  printf '  "registered projects",%s\n' "$n_projects"
+  exit 0
+fi
+
+# The checklist: one row per thing that must be proven.
+printf 'inventory[8]{kind,count,how_proven}:\n'
+printf '  "tools (bin/)",%s,"bash -n + --version/--help runs, exit 0"\n' "$n_tools"
+printf '  "nornir jobs",%s,"one run each, --check or dry-run, writes as documented"\n' "$n_jobs"
+printf '  "skills",%s,"its scripts run; its asset paths resolve (skillindex gate)"\n' "$n_skills"
+printf '  "agents",%s,"bound into all five harnesses (harnesses gate) + a dispatch"\n' "$n_agents"
+printf '  "workflows (CI)",%s,"YAML parses + the job runs green on the branch"\n' "$n_workflows"
+printf '  "apps",%s,"builds, serves, wears its rune, installs its entry, opens in Electron"\n' "$n_apps"
+printf '  "migrations",%s,"idempotent; re-run leaves the home unchanged"\n' "$n_migrations"
+printf '  "registered projects",%s,"gh resolves the repo; PR ledger reports its PRs"\n' "$n_projects"
+
+printf 'tools[%s]{tool}:\n' "$n_tools"
+for f in "$ROOT"/bin/*; do
+  [ -f "$f" ] || continue
+  case "$f" in *.sh|*.py|*.js) printf '  "%s"\n' "$(basename "$f")" ;; esac
+done
+
+printf 'jobs[%s]{job}:\n' "$n_jobs"
+for f in "$ROOT"/bin/nornir-job-*.sh; do [ -f "$f" ] && printf '  "%s"\n' "$(basename "$f")"; done
+
+printf 'apps[%s]{app}:\n' "$n_apps"
+for d in "$ROOT"/apps/*/; do [ -d "$d" ] && printf '  "%s"\n' "$(basename "$d")"; done
+
+printf 'skills[%s]{skill,owner}:\n' "$n_skills"
+grep -oE '^  "[a-z0-9-]+","[^"]*","[a-z]+"' "$ROOT/.agents/skills/README.md" 2>/dev/null | sed 's/^  //' || true

package/bin/fleet-apply.sh

@@ -14,8 +14,21 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-REG="${BROKK_EINDRI_HOMES:-$ROOT/data/eindri-homes.md}"
-PREFS="${BROKK_FLEET_PREFS:-$ROOT/data/fleet.md}"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
+REG="${BROKK_EINDRI_HOMES:-$YMIR_DATA_DIR/eindri-homes.md}"
+PREFS="${BROKK_FLEET_PREFS:-$YMIR_DATA_DIR/fleet.md}"
 CHECK=0
 
 case "${1-}" in -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;; -h|--help) sed -n '2,12p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;; esac

package/bin/github-deploy.sh

@@ -16,7 +16,20 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-ENV_FILE="${BROKK_ENV_FILE:-$ROOT/.env.local}"
+
+# The operator's settings and secrets live in the home they chose, never in the
+# code tree — a packaged install replaces its tree on upgrade, and a credential
+# must never sit in a tree that ships (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_settings_dir YMIR_SETTINGS_DIR
+hoard_local_env YMIR_ENV_FILE
+ENV_FILE="${BROKK_ENV_FILE:-$YMIR_ENV_FILE}"
 SECRETS="NETLIFY_AUTH_TOKEN NETLIFY_SITE_ID VERCEL_TOKEN GITHUB_TOKEN TELEGRAM_BOT_TOKEN"
 
 case "${1-}" in

package/bin/gjallarhorn-expose.sh

@@ -17,6 +17,19 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
 TUNNEL="${YMIR_TUNNEL_NAME:-ymir}"
 DOMAIN="${YMIR_TUNNEL_DOMAIN:-zerwiz.org}"
 SUFFIX="${YMIR_TUNNEL_SUFFIX:-dell}"
@@ -31,13 +44,16 @@ case "${1:-plan}" in
 esac
 ACTION="${1:-plan}"
 
-# host_key port app-path
+# Every public hostname points at the GATE (:3889), never at an app's own port:
+# the gate holds the login and proxies on by host, so the web door is locked for
+# every app. An app port here would be a hole straight past the login.
+GATE_PORT="${HLIDSKJALF_API_PORT:-3889}"
 APPS=(
-  "ymir:$(( ${#SUFFIX} ? 3889 : 3889 ))"
-  "hlidskjalf:3889"
-  "odrerir:4322"
-  "smidja:8437"
-  "smidjafactory:8437"
+  "ymir:$GATE_PORT"
+  "hlidskjalf:$GATE_PORT"
+  "odrerir:$GATE_PORT"
+  "smidja:$GATE_PORT"
+  "smidjafactory:$GATE_PORT"
 )
 
 if [ -z "$SUFFIX" ]; then
@@ -71,7 +87,9 @@ mkdir -p "$(dirname "$CONFIG")"
 {
   printf '# Gjallarhorn — this machine (%s). Generated by bin/gjallarhorn-expose.sh.\n' "$SUFFIX"
   printf 'tunnel: %s\n' "$TUNNEL"
-  printf 'credentials-file: %s/.cloudflared/%s.json\n' "$HOME" "$TUNNEL"
+  # No credentials-file line: cloudflared resolves <UUID>.json for a named
+  # tunnel itself. Guessing the filename (ymir.json) is what made it refuse to
+  # start, and a tunnel that will not start answers 530 to the world.
   printf 'ingress:\n'
   for row in "${APPS[@]}"; do
     app="${row%%:*}"; port="${row##*:}"
@@ -81,16 +99,31 @@ mkdir -p "$(dirname "$CONFIG")"
 } >"$CONFIG"
 
 # 2. the routes (idempotent: an existing record is left alone)
+# Route by the tunnel's own UUID, never by its name. `route dns <name> <host>`
+# resolves the name through the account certificate, which can point at a
+# DIFFERENT (even deleted) tunnel: every hostname then answers 530 while the
+# named tunnel runs happily beside it. Resolve the UUID first, then route.
+TUNNEL_ID="$(cloudflared tunnel info "$TUNNEL" 2>/dev/null | grep -m1 -oE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}')"
+[ -n "$TUNNEL_ID" ] || TUNNEL_ID="$TUNNEL"
 made=0
 for row in "${APPS[@]}"; do
   app="${row%%:*}"
-  cloudflared tunnel route dns "$TUNNEL" "$app$SUFFIX.$DOMAIN" >/dev/null 2>&1 && made=$((made+1))
+  cloudflared tunnel route dns --overwrite-dns "$TUNNEL_ID" "$app$SUFFIX.$DOMAIN" >/dev/null 2>&1 && made=$((made+1))
 done
 
+# 2b. the gate must know which host belongs to which app (it routes by host)
+HOSTMAP="$YMIR_STATE_DIR/gjallarhorn-hosts.env"
+{
+  printf '# Written by bin/gjallarhorn-expose.sh — the gate routes these hosts.\n'
+  printf 'YMIR_PRIMARY_HOST=ymir%s.%s\n' "$SUFFIX" "$DOMAIN"
+  printf 'SMIDJA_HOST=smidja%s.%s\n' "$SUFFIX" "$DOMAIN"
+  printf 'ODRERIR_HOST=odrerir%s.%s\n' "$SUFFIX" "$DOMAIN"
+} >"$HOSTMAP"
+
 # 3. raise it
 started="already"
 if ! pgrep -f "cloudflared.*tunnel.*--config $CONFIG" >/dev/null 2>&1; then
-  nohup cloudflared tunnel --config "$CONFIG" run "$TUNNEL" >"$ROOT/state/gjallarhorn.log" 2>&1 &
+  nohup cloudflared tunnel --config "$CONFIG" run "$TUNNEL" >"$YMIR_STATE_DIR/gjallarhorn.log" 2>&1 &
   started="pid $!"
   sleep 4
 fi
@@ -98,5 +131,6 @@ fi
 printf 'gjallarhorn_apply[3]{what,detail,count}:\n'
 printf '  "config","%s","%s"\n' "${CONFIG#"$HOME"/}" "${#APPS[@]}"
 printf '  "routes","%s%s.%s","%s"\n' "" "$SUFFIX" "$DOMAIN" "$made"
+printf '  "hostmap","%s","the gate routes by host"\n' "${HOSTMAP#"$ROOT"/}"
 printf '  "tunnel","%s","%s"\n' "$started" "$TUNNEL"
 plan

package/bin/gjallarhorn-notify.sh

@@ -13,7 +13,20 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-ENV_FILE="${BROKK_ENV_FILE:-$ROOT/.env.local}"
+
+# The operator's settings and secrets live in the home they chose, never in the
+# code tree — a packaged install replaces its tree on upgrade, and a credential
+# must never sit in a tree that ships (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_settings_dir YMIR_SETTINGS_DIR
+hoard_local_env YMIR_ENV_FILE
+ENV_FILE="${BROKK_ENV_FILE:-$YMIR_ENV_FILE}"
 
 usage() { sed -n '2,11p' "$0" | sed 's/^# \{0,1\}//'; }
 

package/bin/gjallarhorn-purge.sh

@@ -11,7 +11,20 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-ENV_FILE="${BROKK_ENV_FILE:-$ROOT/.env.local}"
+
+# The operator's settings and secrets live in the home they chose, never in the
+# code tree — a packaged install replaces its tree on upgrade, and a credential
+# must never sit in a tree that ships (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_settings_dir YMIR_SETTINGS_DIR
+hoard_local_env YMIR_ENV_FILE
+ENV_FILE="${BROKK_ENV_FILE:-$YMIR_ENV_FILE}"
 DOMAIN="${YMIR_DOMAIN:-${YMIR_TUNNEL_HOST:-}}"
 [ -n "$DOMAIN" ] || { printf 'gjallarhorn-purge: set YMIR_DOMAIN (or YMIR_TUNNEL_HOST)\n' >&2; exit 2; }
 ZONE_NAME="${CLOUDFLARE_ZONE_NAME:-}"

package/bin/gjallarhorn-tunnel.sh

@@ -19,10 +19,23 @@ fi
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
 CONFIG="${YMIR_TUNNEL_CONFIG:-$HOME/.cloudflared/config-ymir.yml}"
 TUNNEL="${YMIR_TUNNEL_NAME:-ymir}"
-PID_FILE="$ROOT/state/gjallarhorn.pid"
-LOG_FILE="$ROOT/state/gjallarhorn.log"
+PID_FILE="$YMIR_STATE_DIR/gjallarhorn.pid"
+LOG_FILE="$YMIR_STATE_DIR/gjallarhorn.log"
 
 case "${1-}" in -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;; -h|--help|"") sed -n '2,10p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;; esac
 ACTION="${1:-status}"; shift || true
@@ -59,7 +72,7 @@ esac
 
 command -v cloudflared >/dev/null 2>&1 || { printf 'error: cloudflared not found\nhelp: install cloudflared\n' >&2; exit 1; }
 [ -r "$CONFIG" ] || { printf 'error: tunnel config not found: %s\nhelp: cp midgard/infrastructure/ingress/cloudflared-ymir.yml ~/.cloudflared/config-ymir.yml\n' "$CONFIG" >&2; exit 1; }
-mkdir -p "$ROOT/state"
+mkdir -p "$YMIR_STATE_DIR"
 if running; then printf 'gjallarhorn[1]{state,host}:\n  "already up","%s"\n' "$HOST"; exit 0; fi
 
 nohup cloudflared tunnel --config "$CONFIG" run "$TUNNEL" >"$LOG_FILE" 2>&1 &

package/bin/groa-update.sh

@@ -25,7 +25,15 @@ VERSION="2.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 YMIR_HOME="${YMIR_HOME:-$HOME/Documents/Ymir}"
-REG="${BROKK_EINDRI_HOMES:-$YMIR_HOME/data/eindri-homes.md}"
+# The registry lives in the hoard (RULES/04-hoard.md; correction 2026-09-17).
+# Resolve through hoard-lib so the path can never drift again.
+if [ -r "$SCRIPT_DIR/hoard-lib.sh" ]; then
+  # shellcheck source=bin/hoard-lib.sh
+  . "$SCRIPT_DIR/hoard-lib.sh"; hoard_root _hoard
+else
+  _hoard="${YMIR_HOARD:-$YMIR_HOME/hodd}"
+fi
+REG="${BROKK_EINDRI_HOMES:-$_hoard/data/eindri-homes.md}"
 REMOTE=""; BRANCH=""; CHECK=0
 
 case "${1-}" in -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;; -h|--help) sed -n '2,21p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;; esac

package/bin/hall-snapshot.sh

@@ -17,13 +17,32 @@
 set -u
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="${BROKK_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-STATE="${BROKK_STATE_OVERRIDE:-$ROOT/state}"
+
+# The operator's settings and secrets live in the home they chose, never in the
+# code tree — a packaged install replaces its tree on upgrade, and a credential
+# must never sit in a tree that ships (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_settings_dir YMIR_SETTINGS_DIR
+hoard_local_env YMIR_ENV_FILE
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+STATE="${BROKK_STATE_OVERRIDE:-$YMIR_STATE_DIR}"
 OUT="${1:-$ROOT/apps/odrerir/public/livehall.json}"
 
 runes_file="${BROKK_RUNES_FILE:-${YMIR_HOME:-$HOME/Documents/Ymir}/hodd/memory/runes_audit.md}"
 PROJECTS_FILE="${YMIR_HOME:-$HOME/Documents/Ymir}/hodd/identity/projects.yaml"
 projects_file="$PROJECTS_FILE"
-cron_file="$ROOT/config/cron.yaml"
+cron_file="$YMIR_SETTINGS_DIR/cron.yaml"
 
 # --- tally the pieces ---
 runes=$(grep -c '^{' "$runes_file" 2>/dev/null || echo 0)

package/bin/herdr-run.sh

@@ -37,7 +37,20 @@ set -u
 VERSION="2.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-STATE_DIR="${BROKK_STATE_OVERRIDE:-$ROOT/state}"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
+STATE_DIR="${BROKK_STATE_OVERRIDE:-$YMIR_STATE_DIR}"
 TAB_LOG="$STATE_DIR/herdr-seats"
 SETTLE="${YMIR_HERDR_SETTLE:-300}"
 
@@ -302,7 +315,15 @@ case "$ACTION" in
           h="$(printf '%s' "$r"   | cut -d'"' -f6)"
           pv="$(printf '%s' "$r"  | cut -d'"' -f8)"
           md="$(printf '%s' "$r"  | cut -d'"' -f10)"
-          [ -n "$h" ] && KIND="$h"
+          # The harness FOLLOWS the model: a local provider is pi's work, an
+          # online one is opencode's. Trusting a field position here seated
+          # pi with an online model id, so the worker started and sat IDLE -
+          # "sent but never started" - while the dispatch row reported success.
+          case "${md:-}:${pv:-}:${h:-}" in
+            *llama*|*lmstudio*|*ollama*) KIND=pi ;;
+            "")                          KIND=pi ;;   # nothing resolved: stay local
+            *)                           KIND=opencode ;;
+          esac
           [ -n "$md" ] && MODEL_ARGS=(-- --model "$pv/$md")
           printf 'herdr-run[1]{model,harness,provider,model_id}:\n  "%s","%s","%s","%s"\n' "$MODEL_REQ" "$h" "$pv" "$md" >&2 ;;
       esac

package/bin/hlidskjalf-agents.sh

@@ -0,0 +1,172 @@
+#!/usr/bin/env bash
+# hlidskjalf-agents.sh — WHO IS ACTUALLY STANDING, and what they are doing.
+#
+# The control plane showed the ROSTER: the twenty profiles that *could* run.
+# A roster is a leaflet; the panes are the truth. This reads the live pane list
+# (herdr) and emits the sessions that exist right now, so the Fleet gate shows a
+# fleet rather than a painting of one — every opencode and pi session, with its
+# kind, its state, its pane and where it works.
+#
+#   bin/hlidskjalf-agents.sh            # JSON (what /api/agents serves)
+#   bin/hlidskjalf-agents.sh --toon     # TOON (for a human at a terminal)
+#
+# State comes from the pane's own reported status. Nothing here infers liveness
+# from a process list or from prose: if herdr does not say an agent is there, it
+# is not on the board.
+set -u
+
+VERSION="1.0.0"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+HERDR="${HERDR_BIN_PATH:-herdr}"
+MODE="json"
+[ "${1:-}" = "--toon" ] && MODE="toon"
+case "${1-}" in -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;;
+  -h|--help) sed -n '2,16p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;; esac
+
+command -v "$HERDR" >/dev/null 2>&1 || { [ "$MODE" = json ] && printf '[]\n' || printf 'agents[0]{name}:\n'; exit 0; }
+
+raw="$("$HERDR" pane list 2>/dev/null)"
+
+MODE="$MODE" RAW="$raw" python3 - <<'PY'
+import json, os, sys
+
+mode = os.environ.get("MODE", "json")
+raw = os.environ.get("RAW", "")
+
+ROSTER_DIR = os.environ.get("ROSTER_DIR", ".agents/agents")
+
+def panes():
+    """The STANDING seats: a herdr pane an agent runs in. A pane is the WHERE."""
+    try:
+        d = json.loads(raw)
+    except Exception:
+        return []
+    pl = (d.get("result") or {}).get("panes") or d.get("panes") or []
+    out = []
+    for p in pl:
+        agent = p.get("agent") or ""
+        if not agent and p.get("agent_status") in (None, "", "unknown"):
+            continue
+        title = (p.get("terminal_title_stripped") or p.get("terminal_title") or "").strip()
+        out.append({
+            "id": p.get("pane_id", ""),
+            "name": title.split("|")[0].strip() or agent or p.get("pane_id", ""),
+            "harness": agent or "agent",
+            "state": p.get("agent_status") or "unknown",
+            "title": title,
+            "cwd": p.get("foreground_cwd") or p.get("cwd") or "",
+            "workspace": p.get("workspace_id", ""),
+            "task": title.split("|", 1)[1].strip() if "|" in title else "",
+            "matched": False,
+        })
+    return out
+
+
+def roster():
+    """The AGENTS, from the canonical roster (.agents/agents/*.md).
+
+    A pane is the where; this is the WHO. Emitting panes alone is why the Fleet
+    showed thirteen OpenCode terminals and not one of the smiths who might be
+    standing in them. The roster is canonical (RULES/02); a harness seat is not an
+    agent, and an agent is not its seat.
+    """
+    try:
+        files = sorted(f for f in os.listdir(ROSTER_DIR) if f.endswith(".md"))
+    except Exception:
+        return []
+    out = []
+    for f in files:
+        stem = f[:-3]
+        parts = stem.split("-")
+        model = mode = domain = ""
+        try:
+            with open(os.path.join(ROSTER_DIR, f)) as fh:
+                txt = fh.read(6000)
+            if txt.startswith("---"):
+                for line in txt.split("---", 2)[1].splitlines():
+                    if line.startswith("model:") and not model:
+                        model = line.split(":", 1)[1].strip()
+                    if line.startswith("mode:") and not mode:
+                        mode = line.split(":", 1)[1].strip()
+                    if line.startswith("domain:") and not domain:
+                        domain = line.split(":", 1)[1].strip()
+        except Exception:
+            pass
+        out.append({
+            "stem": stem,
+            "figure": parts[0],
+            "craft": parts[1] if len(parts) > 1 else "agent",
+            "model": model,
+            "mode": mode,
+            "domain": domain,
+        })
+    return out
+
+
+ps = panes()
+rs = roster()
+rows = []
+
+def card(name, role, model, state, domain="ymirlabs", pane=None, task="", where=""):
+    status = {"working": "nominal", "idle": "nominal", "unseated": "seated"}.get(state, "degraded")
+    return {
+        "id": pane["id"] if pane else "roster:" + name,
+        "name": name,
+        "role": role,
+        "realm": "work",
+        "domain": domain,
+        "status": status,
+        "capabilities": [],
+        "skills": [],
+        "interface": {
+            "protocol": "a2a/1.0",
+            "endpoint": ("local://%s" % pane["id"]) if pane else "",
+            "signed": False,
+        },
+        "model": model or (pane["harness"] if pane else ""),
+        "uptime": 0,
+        "tasksDone": 0,
+        "kind": role,
+        "state": state,
+        "pane": pane["id"] if pane else "",
+        "cwd": (pane["cwd"] if pane else where),
+        "task": task,
+        "live": ({
+            "kind": pane["harness"], "state": state, "pane": pane["id"],
+            "workspace": pane["workspace"], "cwd": pane["cwd"], "task": pane["task"],
+        } if pane else None),
+    }
+
+# THE AGENTS FIRST — every smith on the roster, seated or not. An unseated agent is
+# still an agent; hiding it made the board look like a rack of terminals.
+for a in rs:
+    hit = None
+    for p in ps:
+        hay = ("%s %s %s" % (p["name"], p["harness"], p["title"])).lower()
+        if a["figure"] and a["figure"] in hay:
+            p["matched"] = True
+            hit = p
+            break
+    rows.append(card(a["figure"], a["craft"], a["model"],
+                     hit["state"] if hit else "unseated",
+                     domain=a["domain"] or "ymirlabs",
+                     pane=hit, task=hit["task"] if hit else ""))
+
+# Harness seats that answer to no one on the roster: kept visible, named honestly.
+for p in ps:
+    if not p["matched"]:
+        rows.append(card(p["name"], p["harness"], p["harness"], p["state"], pane=p,
+                         task=p["task"]))
+
+if mode == "json":
+    print(json.dumps(rows))
+    raise SystemExit
+
+print("agents[%d]{name,kind,state,pane,cwd,task}:" % len(rows))
+for r in rows:
+    q = lambda s: '"%s"' % str(s).replace('"', '\\"')
+    print("  %s,%s,%s,%s,%s,%s" % (q(r["name"]), q(r["kind"]), q(r["state"]), q(r["pane"]), q(r["cwd"]), q(r["task"])))
+if not rows:
+    print("agents: 0 live sessions — nothing is standing")
+PY