@zerwiz/ymir 0.1.5 → 0.1.8

package/bin/ymir.js

@@ -1,19 +1,32 @@
 #!/usr/bin/env node
 /**
- * ymir — the CLI the npm package publishes.
+ * ymir — the CLI the npm package publishes, and the operator's front door.
  *
  * It is a thin, honest wrapper: the real work lives in the shell scripts under
- * bin/, which are the same scripts a git clone runs. This file exists because
- * npm needs a Node entry point (`bin: ymir`) and because a package user should
- * not have to know where the checkout landed.
+ * bin/ and scripts/ — the same scripts a git clone runs. This file exists
+ * because npm needs a Node entry point (`bin: ymir`) and because an operator
+ * should never have to know where the package landed.
  *
- *   ymir                 # the same as `ymir install`
- *   ymir install [--yes] # first setup (idempotent, self-healing)
- *   ymir sense           # what THIS machine is
- *   ymir validate        # prove what stands
- *   ymir migrate         # heal an older home forward
+ * The doors are named for the figure whose work they do (the naming law):
+ * Eir heals, Gróa renews, Heimdall keeps the way in, Smíðja is the smithy and
+ * its board, Hlidskjalf the high seat, Sessrúmnir the seat-hall, Mímir the well.
+ *
+ *   ymir                 first setup (the same as `ymir install`)
+ *   ymir install [...]   first setup, idempotent and self-healing
+ *   ymir raise / lower   lift the hall, or lay it down
+ *   ymir eir             what stands, and mend what does not
+ *   ymir groa            take the latest, and mend this home forward
+ *   ymir heimdall        the way in: your credential, and invites
+ *   ymir smidja          the smithy's board (:8437) — build · start · stop · status
+ *   ymir hlidskjalf      the high seat's window
+ *   ymir sessrumnir      the seat-hall's window
+ *   ymir mimir           the memory well
+ *   ymir sense           what THIS machine is
  *   ymir --version
  *
+ * Colour appears only where a human is watching (a TTY, no NO_COLOR); the data
+ * on stdout is always plain TOON.
+ *
  * Exit codes follow the scripts: 0 ok, 1 error, 2 usage.
  */
 'use strict';
@@ -27,32 +40,65 @@ const pkg = (() => {
   try { return require(path.join(ROOT, 'package.json')); } catch { return { version: '0.0.0' }; }
 })();
 
-const TASKS = {
-  install: 'ymir-install.sh',
-  validate: 'ymir-validate.sh',
-  migrate: 'ymir-migrate.sh',
-  sense: 'host-sense.sh',
+// ── the cloth (the same palette as bin/ymir-style.sh, cut from the tokens) ───
+const colour = process.stderr.isTTY && !process.env.NO_COLOR && process.env.TERM !== 'dumb';
+const wrap = (code) => (s) => (colour ? `\u001b[${code}m${s}\u001b[0m` : `${s}`);
+const bone = wrap('38;2;207;195;169');
+const bronze = wrap('38;2;201;151;79');
+const faint = wrap('38;2;107;98;80');
+const blood = wrap('38;2;194;88;74');
+const bold = wrap('1');
+
+// ── the doors ────────────────────────────────────────────────────────────────
+// verb → { script, args } — args are prepended to whatever the operator passes,
+// so a verb can be a doorway to a sub-verb of a script that has several.
+const DOORS = {
+  install:    { script: 'bin/ymir-install.sh',    about: 'first setup (idempotent, self-healing)' },
+  raise:      { script: 'scripts/start.sh',       about: 'lift the hall — SPA, gate API, Nornir, bridges, the board' },
+  lower:      { script: 'scripts/stop.sh',        about: 'lay the hall down' },
+  eir:        { script: 'bin/eir-doctor.sh',      about: 'diagnose every surface; mend what is broken' },
+  groa:       { script: 'bin/groa-update.sh',     about: 'take the latest, then mend this home forward' },
+  heimdall:   { script: 'bin/ymir-setup-auth.sh', about: 'the way in — your credential (status · set · github)' },
+  invite:     { script: 'bin/ymir-invite.sh',     about: 'let someone else in (mint · list · revoke)' },
+  smidja:     { script: 'bin/smidja-board.sh',    about: "the smithy's board on :8437 (build · start · stop · status)" },
+  hlidskjalf: { script: 'scripts/electron.sh',    about: "the high seat's window", args: ['start', '--view', 'hlidskjalf'] },
+  sessrumnir: { script: 'scripts/electron.sh',    about: "the seat-hall's window", args: ['start', '--view', 'sessrumnir'] },
+  mimir:      { script: 'bin/mimir.sh',           about: 'the memory well' },
+  sense:      { script: 'bin/host-sense.sh',      about: 'what THIS machine is' },
+  plan:       { script: 'bin/ymir-plan.sh',       about: 'what an install would do here — writes nothing' },
+  migrate:    { script: 'bin/ymir-migrate.sh',    about: "heal this home's structure forward (Gr\u00f3a's mend)" },
+  validate:   { script: 'bin/ymir-validate.sh',   about: 'alias of `ymir eir`' },
 };
 
+// Names the law has not given a home are kept for a while, so a muscle memory
+// built yesterday still works — and says what to type instead.
+const RENAMED = { validate: 'eir', auth: 'heimdall', desktop: 'hlidskjalf', doctor: 'eir', update: 'groa' };
+
 function usage() {
-  process.stdout.write(
-    `ymir ${pkg.version} — the single-tenant agent operating system\n\n` +
-    'Usage:\n' +
-    '  ymir                 first setup (same as `ymir install`)\n' +
-    '  ymir install [--yes] first setup, idempotent and self-healing\n' +
-    '  ymir sense           report THIS machine (distro, session, desktop, capabilities)\n' +
-    '  ymir validate        verify the running system\n' +
-    '  ymir migrate         heal an older home forward\n' +
-    '  ymir --version\n\n' +
-    'Output is TOON. The scripts are the source of truth; this CLI only points at them.\n'
-  );
+  const lines = [];
+  lines.push('');
+  lines.push(`  ${bronze('\u16c9')}  ${bold('Ymir')} ${faint(pkg.version)}`);
+  lines.push(`     ${faint('the single-tenant agent operating system')}`);
+  lines.push('');
+  lines.push(bold('  The doors'));
+  for (const [verb, d] of Object.entries(DOORS)) {
+    lines.push(`    ${bronze(verb.padEnd(11))} ${faint(d.about)}`);
+  }
+  lines.push('');
+  lines.push(bold('  Composed by hand'));
+  lines.push(`    ${bronze('ymir groa migrate'.padEnd(11))} ${faint("heal this home's structure (run by groa / install)")}`);
+  lines.push(`    ${bronze('ymir heimdall set'.padEnd(11))} ${faint('set the operator password (or `github`)')}`);
+  lines.push('');
+  lines.push(faint('  A bare `ymir` runs the first setup. Output is TOON; colour only on a TTY.'));
+  lines.push('');
+  process.stdout.write(lines.join('\n') + '\n');
 }
 
 function run(script, args) {
-  const file = path.join(ROOT, 'bin', script);
+  const file = path.join(ROOT, script);
   if (!fs.existsSync(file)) {
-    process.stderr.write(`error: ${path.relative(ROOT, file)} is missing from this install\n`);
-    process.stderr.write('help: reinstall — npm i -g @zerwiz/ymir, or git clone the distro\n');
+    process.stderr.write(`${blood('error:')} ${script} is missing from this install\n`);
+    process.stderr.write(`${faint('help: reinstall — npm i -g @zerwiz/ymir, or git clone the distro')}\n`);
     process.exit(1);
   }
   const r = spawnSync('bash', [file, ...args], { stdio: 'inherit' });
@@ -62,17 +108,19 @@ function run(script, args) {
 const argv = process.argv.slice(2);
 const first = argv[0];
 
-if (!first) run(TASKS.install, []);
+if (!first) run(DOORS.install.script, []);
 if (first === '--version' || first === '-v' || first === '-V') {
   process.stdout.write(`${pkg.version}\n`);
   process.exit(0);
 }
 if (first === '--help' || first === '-h' || first === 'help') { usage(); process.exit(0); }
 
-const script = TASKS[first];
-if (!script) {
-  process.stderr.write(`error: unknown command ${first}\n`);
-  process.stderr.write('help: ymir [install|sense|validate|migrate|--version]\n');
+let door = DOORS[first];
+if (!door) {
+  const replacement = RENAMED[first];
+  process.stderr.write(`${blood('error:')} unknown door ${bold(first)}\n`);
+  if (replacement) process.stderr.write(`${faint(`help: the door is named \`ymir ${replacement}\` now (the naming law — a figure does the work)`)}\n`);
+  process.stderr.write(`${faint('help: `ymir --help` lists every door')}\n`);
   process.exit(2);
 }
-run(script, argv.slice(1));
+run(door.script, [...(door.args || []), ...argv.slice(1)]);

package/docs/design.md

@@ -226,7 +226,7 @@ everywhere; never put bronze text on bronze.
 - **Runecoded, not emoji.** A minimal, hand-drawn-style rune set replaces emoji
   in all UI: 16×16 and 24×24 grid, 2px stroke, chisel bevel on primary.
 - System subsystems each carry one rune-glyph (reuse Algiz-family geometry:
-  Bifrost gate, Ratatoskr squirrel, the Well). Map is in `midgard/design-system/icons.md` (TBD) — created from this doc.
+  Bifrost gate, Ratatoskr squirrel, the Well). Map is in `midgard/design-system/icons.md` and the library in `midgard/design-system/runes.md`.
 - Status dot: filled rune ring (ok) / half-ring (warn) / broken ring (danger), never color-only.
 
 ### 4.5 Surface & texture
@@ -345,7 +345,7 @@ All components read tokens from `tokens.css`; color-only states are forbidden
 
 - `docs/design.md` — this document (master).
 - `midgard/design-system/tokens.css` — the consumable design tokens.
-- `midgard/design-system/icons.md` — rune-glyph map (to create).
+- `midgard/design-system/icons.md` — rune-glyph map (21 glyphs, drawn in `icons/*.svg`).
 - `docs/ymir-rut.md` Part 3 — the original Rut design-system specification this
   document implements.
 - `docs/lore.md` §VI — house lineage behind the house accents.

package/docs/lore.md

@@ -818,9 +818,13 @@ what belongs to all houses, nothing to one.
 | Path | What it holds |
 |------|---------------|
 | `midgard/design-system/` | Theme tokens, icons, rune glyphs, component rules |
-| `midgard/company_wiki/` | Cross-tenant company knowledge |
 | `midgard/github_org_repos/` | GitHub organization repo inventory |
 | `midgard/shared-packages/` | Shared npm/Python packages |
+
+Midgard holds **public-by-design** cross-tenant assets only. Company knowledge —
+policies, vision, specs, client names — is **tenant data** and lives at
+`$YMIR_HOME/hodd/identity/companies/`. A company wiki here would publish that
+company's internals in a public repo.
 | `midgard/infrastructure/` | DB schemas, Caddyfile, cloudflared, oauth2-proxy |
 
 **Rule:** Midgard is shared. No realm may mutate another realm's Midgard assets.

package/docs/runbooks/agents.md

@@ -6,7 +6,7 @@ symlinked into each harness.
 ## Where agents live
 
 - **Canonical:** `.agents/agents/<name>-<craft>.md` (edit these only).
-- **Bindings:** `.opencode/agent/*.md` and `.pi/agents/*.md` are symlinks.
+- **Bindings:** `.opencode/agents/*.md` and `.pi/agents/*.md` are symlinks.
 
 Rebind after any change:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zerwiz/ymir",
-  "version": "0.1.5",
+  "version": "0.1.8",
   "description": "Ymir \u2014 the single-tenant agent operating system. Omarchy-first, host-aware, self-healing.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/zerwiz/ymir",
@@ -29,7 +29,6 @@
     "bin/",
     ".agents/",
     "scripts/",
-    "config/",
     "RULES/",
     "docs/",
     "packaging/",
@@ -38,7 +37,12 @@
     "CHANGELOG.md",
     "LICENSE",
     "NOTICE",
-    "!**/node_modules/**"
+    "!**/node_modules/**",
+    "!.agents/memory/kaia.engram*",
+    "!.agents/memory/well/*.jsonl",
+    "!.agents/memory/*.db",
+    "!**/__pycache__/",
+    "!**/*.pyc"
   ],
   "engines": {
     "node": ">=20"
@@ -53,5 +57,11 @@
   "scripts": {
     "test": "bash .agents/skills/galdr-ymirsystem/scripts/compliance-check.sh",
     "compliance": "bash .agents/skills/galdr-ymirsystem/scripts/compliance-check.sh"
+  },
+  "optionalDependencies": {
+    "@zerwiz/hlidskjalf": "^0.1.0",
+    "@zerwiz/odrerir": "^0.1.0",
+    "@zerwiz/sessrumnir": "^0.1.8-alpha",
+    "@zerwiz/smidja-factory": "^0.1.0"
   }
 }

package/scripts/electron.sh

@@ -26,6 +26,19 @@ fi
 VERSION="1.1.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
 APP="$ROOT/apps/hlidskjalf"
 Odrerir_app="$ROOT/apps/odrerir"
 NO_INSTALL=0
@@ -85,6 +98,23 @@ pid_of() {
   printf '%s' "$(printf '%s\n' "$pids" | head -1)"
 }
 
+stop_view() {  # stop ONE view's pids - and only that view's
+  local v="$1" pids
+  pids="$(view_pids "$v")"
+  if [ -z "$pids" ]; then
+    printf 'electron: %s already stopped\n' "$v"
+    rm -f "$(pid_file "$v")"
+    return 0
+  fi
+  local list; list="$(printf '%s' "$pids" | tr '\n' ',')"
+  printf '%s\n' "$pids" | xargs -r kill 2>/dev/null || true
+  sleep 0.5
+  local left; left="$(view_pids "$v")"
+  [ -z "$left" ] || printf '%s\n' "$left" | xargs -r kill -KILL 2>/dev/null || true
+  rm -f "$(pid_file "$v")"
+  printf 'electron: stopped %s pid(s)=%s\n' "$v" "${list%,}"
+}
+
 case "$ACTION" in
   status)
     printf 'electron[%s]{view,state,pid}:\n' "${#VIEWS[@]}"
@@ -93,15 +123,13 @@ case "$ACTION" in
     done
     exit 0 ;;
   stop)
-    for v in "${VIEWS[@]}"; do
-      local pids; pids="$(view_pids "$v")"
-      if [ -n "$pids" ]; then
-        # Kill every live pid for this view (the shim era could leave several).
-        printf '%s\n' "$pids" | while IFS= read -r p; do [ -n "$p" ] && kill "$p" 2>/dev/null || true; done
-        printf 'electron: stopped %s pid(s)=%s\n' "$v" "$(printf '%s' "$pids" | tr '\n' ',' | sed 's/,$//')"
-      fi
-      rm -f "$(pid_file "$v")"
-    done
+    # ONLY the view asked for. Walking every view here is why `stop --view odrerir`
+    # used to take the smithy's window down with it.
+    if [ "$VIEW" = both ]; then
+      for v in "${VIEWS[@]}"; do stop_view "$v"; done
+    else
+      stop_view "$VIEW"
+    fi
     printf 'electron: stopped\n'
     exit 0 ;;
   start|hlidskjalf|smidja|odrerir) [ "$ACTION" = smidja ] && VIEW=smidja; [ "$ACTION" = odrerir ] && VIEW=odrerir ;;
@@ -109,7 +137,7 @@ case "$ACTION" in
 esac
 
 command -v npm >/dev/null 2>&1 || { printf 'error: npm not found\nhelp: install node/npm to run the desktop shell\n' >&2; exit 1; }
-mkdir -p "$ROOT/state"
+mkdir -p "$YMIR_STATE_DIR"
 
 if [ ! -x "$APP/node_modules/.bin/electron" ]; then
   if [ "$NO_INSTALL" = 1 ]; then
@@ -151,14 +179,39 @@ fi
 app_dir() { case "$1" in odrerir) printf '%s' "$Odrerir_app" ;; *) printf '%s' "$APP" ;; esac; }
 view_host() { case "$1" in smidja) printf '%s' 'http://127.0.0.1:8437/' ;; odrerir) printf '%s' 'http://127.0.0.1:4322/' ;; *) printf '%s' 'http://127.0.0.1:3888/' ;; esac; }
 
+service_up() { curl -s -o /dev/null --max-time 3 "$1" 2>/dev/null; }
+wait_for_service() {
+  local u="$1" i
+  for i in $(seq 1 120); do service_up "$u" && return 0; sleep 0.5; done
+  return 1
+}
+# Does the compositor hold a window of this class at all? A process with no window
+# cannot be focused, and focusing nothing is exactly the silence a click must not get.
+window_present() {
+  command -v hyprctl >/dev/null 2>&1 || return 0   # no compositor to ask: assume yes
+  hyprctl clients 2>/dev/null | grep -qi "$1"
+}
+
 start_one() {
   local v="$1" f l
   f="$(pid_file "$v")"; l="$(log_file "$v")"
+  # THE SYSTEM FIRST. A shell whose backing service is down draws an empty window,
+  # and a window that never mapped cannot be focused. Clicking an icon must raise
+  # THE SYSTEM, so the service is converged before the window is judged.
+  local host; host="$(view_host "$v")"
+  if ! service_up "$host"; then
+    printf 'electron: %s has no service at %s — raising the system\n' "$v" "$host" >&2
+    ( nohup bash "$ROOT/scripts/start.sh" >/dev/null 2>&1 </dev/null & )
+    if ! wait_for_service "$host"; then
+      printf 'electron: %s still does not answer at %s — see $YMIR_STATE_DIR/\n' "$v" "$host" >&2
+    fi
+    # A process that lived through the outage is windowless; it must be reborn.
+    if is_running "$v"; then stop_view "$v"; fi
+  fi
   if is_running "$v"; then
-    # A speed-start must RAISE the app, not report that it is already up. The
+    # A bound key must RAISE the app, never report that it is already up. The
     # window lives on its own numbered desktop by design, so "nothing happens"
-    # is exactly what a bound key must not do. focuswindow also switches to that
-    # desktop when the window is elsewhere.
+    # is exactly what a click must not do. focuswindow also switches desktops.
     local cls state=already-up
     cls="$(view_mark "$v")"   # the window class, from the one place that defines it
     if command -v hyprctl >/dev/null 2>&1; then
@@ -167,8 +220,14 @@ start_one() {
       # string form is a syntax error there. This is the working idiom.
       hyprctl dispatch "hl.dsp.focus({window=\"class:^${cls}\$\"})" >/dev/null 2>&1 && state=raised
     fi
-    printf 'electron[1]{view,state,pid}:\n  "%s","%s",%s\n' "$v" "$state" "$(pid_of "$v")"
-    return 0
+    # A process whose window is gone cannot be focused — reborn, not silent.
+    if [ "$state" = already-up ] && ! window_present "$cls"; then
+      printf 'electron: %s is running without a window — restarting it\n' "$v" >&2
+      stop_view "$v"
+    else
+      printf 'electron[1]{view,state,pid}:\n  "%s","%s",%s\n' "$v" "$state" "$(pid_of "$v")"
+      return 0
+    fi
   fi
   # Launch the REAL Electron binary, not the .bin node shim, so the recorded pid
   # is the app itself (the shim spawns and would leave a stale/incorrect pid).

package/scripts/lower.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# lower.sh — the whole house in one word: the windows first, then the web.
+#
+# The shells are lowered BEFORE the services, so no window is left watching a
+# port that has just gone away. That order is the whole point of owning both
+# lifecycles in one place.
+#
+#   scripts/lower.sh              # every shell + the services
+#   scripts/lower.sh --desktop    # the shells only
+#   scripts/lower.sh --web        # the services only
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+WHAT="all"
+case "${1-}" in
+  --web) WHAT=web ;;
+  --desktop) WHAT=desktop ;;
+  -h|--help|"") sed -n '2,12p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+esac
+
+if [ "$WHAT" != "web" ]; then
+  printf '\n— the windows —\n'
+  if [ -x "$ROOT/bin/sessrumnir.sh" ]; then
+    "$ROOT/bin/sessrumnir.sh" stop || printf 'lower: sessrumnir did not stop cleanly\n' >&2
+  fi
+  "$ROOT/scripts/electron.sh" stop || printf 'lower: electron.sh stop reported errors\n' >&2
+fi
+
+if [ "$WHAT" != "desktop" ]; then
+  printf '\n— the web —\n'
+  "$ROOT/scripts/stop.sh" || printf 'lower: stop.sh reported errors\n' >&2
+fi

package/scripts/raise.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# raise.sh — the whole house in one word: the web AND the windows.
+#
+# scripts/start.sh raises the services; scripts/electron.sh raises the desktop
+# shells. Two lifecycles that never met — which is why "the electrons are not
+# running" was true while 28 processes stood, and why a web restart left the
+# shells pointing at a dead port. This is the pair of hands.
+#
+#   scripts/raise.sh              # services + every desktop shell
+#   scripts/raise.sh --web        # the services only
+#   scripts/raise.sh --desktop    # the shells only
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+WHAT="all"
+case "${1-}" in
+  --web) WHAT=web ;;
+  --desktop) WHAT=desktop ;;
+  -h|--help|"") sed -n '2,12p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+esac
+
+if [ "$WHAT" != "desktop" ]; then
+  printf '\n— the web —\n'
+  "$ROOT/scripts/start.sh" || printf 'raise: start.sh reported errors\n' >&2
+fi
+
+if [ "$WHAT" != "web" ]; then
+  printf '\n— the windows —\n'
+  # Every shell, by name: hlidskjalf is the default view; smidja and odrerir need
+  # their own start; sessrumnir is its own app.
+  "$ROOT/scripts/electron.sh" start || printf 'raise: hlidskjalf failed\n' >&2
+  for v in smidja odrerir; do
+    "$ROOT/scripts/electron.sh" start --view "$v" || printf 'raise: %s failed\n' "$v" >&2
+  done
+  if [ -x "$ROOT/bin/sessrumnir.sh" ]; then
+    "$ROOT/bin/sessrumnir.sh" start || printf 'raise: sessrumnir failed\n' >&2
+  fi
+  printf '\n'
+  "$ROOT/scripts/electron.sh" status
+fi

package/scripts/start.sh

@@ -17,10 +17,57 @@ if [ -z "${YMIR_PLATFORM_LOADED:-}" ]; then
 fi
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# Where the smithy's parts live: apps/smidja-factory in a clone, or the
+# @zerwiz/smidja-factory package in an npm install (bin/smidja-lib.sh).
+if [ -z "${YMIR_SMIDJA_LIB_LOADED:-}" ]; then
+  _ys="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_ys/smidja-lib.sh" "$(dirname "$_ys")/bin/smidja-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_SMIDJA_LIB_LOADED=1; break; }
+  done
+  unset _ys _yc
+fi
+smidja_visualizer_dir SMIDJA_VIZ
+smidja_factory_dir SMIDJA_FACTORY
+
+
+# The operator's settings and secrets live in the home they chose, never in the
+# code tree — a packaged install replaces its tree on upgrade, and a credential
+# must never sit in a tree that ships (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_settings_dir YMIR_SETTINGS_DIR
+hoard_local_env YMIR_ENV_FILE
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
 APP="$ROOT/apps/hlidskjalf"
 RUN="$ROOT/.run"
 PID_FILE="$RUN/hlidskjalf.pid"
 LOG="$RUN/hlidskjalf.log"
+
+# Load the platform env once (Rule 04): the gate, the Bifrost bridge and Mimir
+# all read their credentials from .env.local — 0600, gitignored, never printed.
+# The bun gate reads process.env, and nothing loaded the file for it, so a
+# credential set by bin/ymir-setup-auth.sh never reached it — and the gate treats
+# an empty GATE_AUTH as "open". Loaded before the ports below so those may be
+# overridden from it too.
+if [ -r "$YMIR_ENV_FILE" ]; then
+  set +eu
+  set -a
+  # shellcheck disable=SC1090,SC1091
+  . "$YMIR_ENV_FILE" || true
+  set +a
+  set -eu
+fi
+
 PORT="${HLIDSKJALF_PORT:-3888}"
 
 mkdir -p "$RUN"
@@ -43,6 +90,11 @@ fi
 # Raise the gate API (real runtime data) when bun is available. Demo mode works
 # without it; live data needs it.
 API_PORT="${HLIDSKJALF_API_PORT:-3889}"
+# The public hostnames the gate fronts (written by bin/gjallarhorn-expose.sh):
+# without them the gate cannot route a host to its app, and the login page for
+# that app would never be reached.
+[ -r "$YMIR_STATE_DIR/gjallarhorn-hosts.env" ] && . "$YMIR_STATE_DIR/gjallarhorn-hosts.env" && \
+  export SMIDJA_HOST ODRERIR_HOST YMIR_PRIMARY_HOST
 API_PID_FILE="$RUN/hlidskjalf-api.pid"
 API_LOG="$RUN/hlidskjalf-api.log"
 if command -v bun >/dev/null 2>&1; then
@@ -66,7 +118,7 @@ if [ -x "$ROOT/bin/nornir-cron-start.sh" ]; then
   if "$ROOT/bin/nornir-cron-start.sh" >/dev/null 2>&1; then echo "Nornir cron: started"; else echo "Nornir cron: start failed" >&2; fi
 fi
 if [ -x "$ROOT/bin/bifrost-bridge.sh" ]; then
-  if BROKK_ENV_FILE="$ROOT/.env.local" "$ROOT/bin/bifrost-bridge.sh" --start >/dev/null 2>&1; then echo "Bifrost bridge: up"; else echo "Bifrost bridge: not up (needs OPENCODE_GO_API_KEY)" >&2; fi
+  if BROKK_ENV_FILE="$YMIR_ENV_FILE" "$ROOT/bin/bifrost-bridge.sh" --start >/dev/null 2>&1; then echo "Bifrost bridge: up"; else echo "Bifrost bridge: not up (needs OPENCODE_GO_API_KEY)" >&2; fi
 fi
 # The well — Mimirsbrunn (engram) on :4602; the gate API and mimir.sh drink here.
 if [ -x "$ROOT/bin/mimir-bridge.sh" ]; then
@@ -76,12 +128,22 @@ fi
 # Smíðja's eye — the Vue trace visualizer (API :8437, UI :8438). Reads the repo's
 # own smidja.db and exposes the Sessions/Trace/Decisions/Stats views behind the
 # Hlidskjalf Sessions gate's "Open visualizer" button.
-VIZ_DIR="$ROOT/.agents/skills/smidja-factory/apps/visualizer"
+VIZ_DIR="${SMIDJA_VIZ:-}"
 VIZ_API_PORT="${SMIDJA_VIZ_API_PORT:-8437}"
 VIZ_UI_PORT="${SMIDJA_VIZ_UI_PORT:-8438}"
 VIZ_API_PID_FILE="$RUN/smidja-viz-api.pid"
 VIZ_UI_PID_FILE="$RUN/smidja-viz-ui.pid"
-SMIDJA_DB_PATH="${SMIDJA_DB:-$ROOT/apps/smidja/smidja_data/smidja.db}"
+SMIDJA_DB_PATH="${SMIDJA_DB:-}"
+# The smithy DB follows the HOME: 0003-private-data-separation moved it to
+# $YMIR_HOME/smidja/smidja.db. Prefer an existing DB there, then an in-repo copy
+# for a checkout that keeps its own; SMIDJA_DB overrides either.
+if [ -z "$SMIDJA_DB_PATH" ]; then
+  for _db in "${YMIR_HOME:-$HOME/Documents/Ymir}/smidja/smidja.db" \
+             "$ROOT/apps/smidja/smidja_data/smidja.db"; do
+    [ -f "$_db" ] && { SMIDJA_DB_PATH="$_db"; break; }
+  done
+  SMIDJA_DB_PATH="${SMIDJA_DB_PATH:-${YMIR_HOME:-$HOME/Documents/Ymir}/smidja/smidja.db}"
+fi
 if command -v bun >/dev/null 2>&1 && [ -d "$VIZ_DIR" ]; then
   [ -d "$VIZ_DIR/node_modules" ] || (cd "$VIZ_DIR" && bun install >/dev/null 2>&1 || true)
   # The API serves the UI from ./dist. Without a build it answers the API but

package/.agents/config/agents.yaml

@@ -1,50 +0,0 @@
-# config/agents.yaml — the Allfather's own combination of smiths and models.
-#
-# THIS IS YOUR FILE. Edit it, then run:  bin/agents-config.sh apply
-# No other Ymir file hardcodes a model for you; this YAML is the one place.
-# Any agent without its own `model:` inherits `default_model`.
-
-version: 1
-
-# The harness is chosen by where the model lives — local through pi, online
-# through opencode. An agent may still name `harness:` to override the rule.
-harness:
-  local: pi              # a model on a local provider runs through pi
-  online: opencode       # a hosted model runs through opencode
-  local_providers: [llama.cpp, llama-cpp, lmstudio]
-  # The same local server is named differently per harness; translate on the way.
-  providers:
-    llama.cpp: { pi: llama-cpp }
-
-# The fallback smith for any agent that does not name a model.
-default_model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl
-
-# Local, keyless model servers. `apply` writes these into the project harness
-# config (opencode.json) so a model listed here is immediately usable. A bare
-# alias (no @quant) is auto-resolved against the server's /v1/models.
-providers:
-  llama.cpp:
-    npm: "@ai-sdk/openai-compatible"
-    name: "llama-server (local)"
-    base_url: "http://127.0.0.1:8080/v1"
-    models:
-      # A local llama.cpp router needs the EXACT served id (the @quant suffix);
-      # `apply` resolves the bare alias below to the id the server reports.
-      - frontend-design-expert-8b
-
-# agent name -> { model, harness?, primary? }. Omit model to inherit
-# default_model. Omit harness to follow the local/online rule above.
-# `primary: true` marks the agent runnable directly (mode: all), not only
-# dispatchable by another agent.
-agents:
-  brokk:   { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }
-  # Hnoss the Shaper runs local (no cloud key) -> pi, and is directly runnable.
-  hnoss:   { model: "llama.cpp/qwen3.6-35b-a3b@q2_k_xl", primary: true }
-  sindri:  { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }
-  bragi:   { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }
-  huginn:  { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }
-  kvasir:  { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }
-  mimir:   { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }
-  snotra:  { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }
-  forseti: { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }
-  galdr:   { model: llama.cpp/qwen3.6-35b-a3b@q2_k_xl }

package/.agents/config/tailscale-sync.yaml

@@ -1,27 +0,0 @@
-# config/tailscale-sync.example.yaml — TEMPLATE for the Allfather's machine mesh.
-#
-# Copies to the private, gitignored config/tailscale-sync.yaml on install, or
-# run: bin/tailscale-sync.sh init
-# Override the path with YMIR_TAILSCALE_SYNC.
-#
-# Sync is peer-to-peer over Tailscale (rsync over ssh, addressed by MagicDNS).
-# There is no central server and no relay unless the Allfather adds one.
-
-machine: zerwiz
-
-# The allowlist: only these tailnet hosts may be synced with. Use the MagicDNS
-# name (e.g. `ymir-desktop`) or the tailnet IP.
-peers:
-  - host: omarchy-1
-  - host: zerwizserver
-
-# What may move. Paths are on both ends; ~ expands on each machine.
-paths:
-  - ~/.pi/agent/models.json
-  - ~/.pi/agent/models-store.json
-  - ~/.pi/agent/settings.json
-  - ~/.pi/agent/trust.json
-
-# auth.json holds live credentials. Leave false unless the Allfather trusts
-# every listed peer to hold them; Tailscale encrypts the wire, not the trust.
-include_auth: false