@zerwiz/ymir 0.1.5 → 0.1.8

package/bin/eir-doctor.sh

@@ -18,6 +18,11 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 YMIR_HOME="${YMIR_HOME:-$HOME/Documents/Ymir}"
 STATE="${BROKK_STATE_OVERRIDE:-$YMIR_HOME/state}"
 
+# The cloth: colour and marks for the human reading this report; the TOON rows on
+# stdout stay the data (bin/ymir-style.sh).
+if [ -z "${YMIR_STYLE_LOADED:-}" ]; then . "$SCRIPT_DIR/ymir-style.sh"; YMIR_STYLE_LOADED=1; fi
+style_init
+
 case "${1-}" in -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;; -h|--help|"") sed -n '2,15p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;; esac
 ACTION="${1:-check}"; shift || true
 
@@ -25,7 +30,7 @@ have() { command -v "$1" >/dev/null 2>&1; }
 say_ok() { return 0; }
 
 # Each surface: `s_<name>` = healthy? (exit 0), `f_<name>` = the repair.
-SURFACES=(floors herdr a2abridge hermes sessrumnir well mcp lock migrations)
+SURFACES=(floors herdr a2abridge hermes sessrumnir shells well mcp lock migrations hoard)
 
 s_floors()    { [ -x "$SCRIPT_DIR/prereq-ensure.sh" ] && "$SCRIPT_DIR/prereq-ensure.sh" status >/dev/null 2>&1; }
 f_floors()    { "$SCRIPT_DIR/prereq-ensure.sh" ensure --install >/dev/null 2>&1; }
@@ -37,6 +42,34 @@ s_hermes()    { [ -x "$SCRIPT_DIR/hermes-ensure.sh" ] && "$SCRIPT_DIR/hermes-ens
 f_hermes()    { "$SCRIPT_DIR/hermes-ensure.sh" ensure --install >/dev/null 2>&1; }
 s_sessrumnir(){ [ -x "$SCRIPT_DIR/sessrumnir-ensure.sh" ] && "$SCRIPT_DIR/sessrumnir-ensure.sh" status >/dev/null 2>&1; }
 f_sessrumnir(){ "$SCRIPT_DIR/sessrumnir-ensure.sh" ensure --install >/dev/null 2>&1; }
+# The desktop shells: absent is healthy (the web surfaces stand alone), PARTIAL is
+# not — npm gated the Electron postinstall, so the window cannot open while every
+# build still passes (bin/electron-lib.sh).
+shell_dirs() {
+  local a d
+  for a in hlidskjalf odrerir sessrumnir; do
+    for d in "$ROOT/apps/$a" "$ROOT/node_modules/@zerwiz/$a"; do
+      [ -d "$d" ] && { printf '%s\n' "$d"; break; }
+    done
+  done
+}
+s_shells() {
+  local d state
+  while IFS= read -r d; do
+    state="$(electron_runtime_state "$d" 2>/dev/null || true)"
+    [ "$state" = partial ] && return 1
+  done < <(shell_dirs)
+  return 0
+}
+f_shells() {
+  printf 'eir: the shells need YOUR hand — npm gated the runtime download:\n' >&2
+  electron_remedy >&2
+  return 1
+}
+if [ -z "${YMIR_ELECTRON_LIB_LOADED:-}" ] && [ -r "$SCRIPT_DIR/electron-lib.sh" ]; then
+  . "$SCRIPT_DIR/electron-lib.sh"; YMIR_ELECTRON_LIB_LOADED=1
+fi
+
 s_well()      { [ -x "$SCRIPT_DIR/mimir.sh" ] && "$SCRIPT_DIR/mimir.sh" health >/dev/null 2>&1; }
 f_well()      { "$SCRIPT_DIR/mimir.sh" start >/dev/null 2>&1; }
 # MCP: both A2A servers wired into opencode + pi.
@@ -69,6 +102,51 @@ f_lock() {
 }
 s_migrations(){ [ ! -x "$SCRIPT_DIR/ymir-migrate.sh" ] || "$SCRIPT_DIR/ymir-migrate.sh" status >/dev/null 2>&1; }
 f_migrations(){ [ -x "$SCRIPT_DIR/ymir-migrate.sh" ] && "$SCRIPT_DIR/ymir-migrate.sh" apply >/dev/null 2>&1; }
+# Hoard: private data sits under the hoard, and .ymir-layout.yaml tells the truth.
+# Two failures this catches: (1) a declared layout path that does not exist — a
+# stale map is what lets private work land outside the hoard; (2) a flat
+# $YMIR_HOME/{identity,data,docs,secrets,tenants} duplicate beside hodd/ — the
+# drift that RULES/04-hoard.md (correction 2026-09-17) forbids.
+_hoard_root() { local r; if [ -x "$SCRIPT_DIR/hoard-lib.sh" ]; then . "$SCRIPT_DIR/hoard-lib.sh"; hoard_root r; printf '%s' "$r"; else printf '%s' "${YMIR_HOARD:-$YMIR_HOME/hodd}"; fi; }
+s_hoard() {
+  local h; h="$(_hoard_root)"
+  [ -d "$h" ] || return 1
+  local lay="$YMIR_HOME/.ymir-layout.yaml" k p
+  if [ -f "$lay" ]; then
+    for k in config secrets identity workspaces memory smidja state data; do
+      p="$(sed -nE "s/^  $k: \"([^\"]+)\".*/\1/p" "$lay" | head -1)"
+      [ -n "$p" ] && [ ! -d "$p" ] && return 1
+    done
+  fi
+  for k in identity data docs secrets tenants; do
+    [ -d "$YMIR_HOME/$k" ] && return 1
+  done
+  return 0
+}
+f_hoard() {
+  local h; h="$(_hoard_root)"
+  mkdir -p "$h" 2>/dev/null || return 1
+  # A flat duplicate beside hodd/ is the drift: merge it in, never clobber.
+  local k
+  for k in identity data docs secrets tenants; do
+    local src="$YMIR_HOME/$k"
+    [ -d "$src" ] || continue
+    mkdir -p "$h/$k" 2>/dev/null || continue
+    cp -an "$src/." "$h/$k/" 2>/dev/null || true
+    rm -rf "$src" 2>/dev/null || true
+  done
+  # A layout entry naming a nonexistent dir is repointed at the hoard.
+  local lay="$YMIR_HOME/.ymir-layout.yaml" k2 p
+  if [ -f "$lay" ] && [ -d "$h" ]; then
+    for k2 in identity data secrets docs tenants; do
+      p="$(sed -nE "s/^  $k2: \"([^\"]+)\".*/\1/p" "$lay" | head -1)"
+      if [ -n "$p" ] && [ ! -d "$p" ]; then
+        sed -i "s|^  $k2: .*|  $k2: \"$h/$k2\"|" "$lay"
+      fi
+    done
+  fi
+  s_hoard
+}
 
 detail() { # <name> -> one short fact
   case "$1" in
@@ -81,6 +159,8 @@ detail() { # <name> -> one short fact
     mcp)       "echo 'a2abridge + engram'" ;;
     lock)      "cat $STATE/.lock 2>/dev/null | tr -d '[:space:]' | sed 's/^/pid /' || echo none" ;;
     migrations)"echo 'structure'" ;;
+    shells)    'shell_dirs | while IFS= read -r d; do printf "%s %s; " "$(basename "$d")" "$(electron_runtime_state "$d" 2>/dev/null || true)"; done' ;;
+    hoard)     "printf 'hoard %s' \"$(_hoard_root)\" ; [ -d \"$YMIR_HOME/identity\" ] && printf ' +flat-duplicate' ; printf '\\n'" ;;
   esac
 }
 
@@ -105,6 +185,14 @@ done
 printf 'eir[1]{action,root,broken}:\n  "%s","%s",%s\n' "$ACTION" "$ROOT" "$broken"
 printf 'health[%d]{surface,state,detail}:\n' "$count"
 printf '%b' "$rows"
+# For the eye, on stderr: marks and colour; for the pipe, the TOON above.
+if [ -t 2 ]; then
+  printf '\n' >&2
+  while IFS='|' read -r surface state detail; do
+    [ -n "$surface" ] || continue
+    style_line "$state" "$surface" "$detail"
+  done <<<"$(printf '%b' "$rows" | sed 's/^  //; s/"//g; s/,/|/; s/,/|/')"
+fi
 if [ "$broken" != 0 ]; then
   printf 'eir: %s surface(s) need mending — run: bin/eir-doctor.sh fix\n' "$broken"
   exit 1

package/bin/electron-lib.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# electron-lib.sh — is a desktop shell's runtime actually there?
+#
+# The trap this exists for: npm blocks a package's install scripts by default
+# (npm 11.16+ warns, npm 12 refuses), and Electron's postinstall is what downloads
+# its ~100 MB runtime. Without it the install still reports SUCCESS and the web app
+# still builds — `node_modules/electron/dist/` is simply partial and `path.txt` is
+# never written. So the shell fails to launch while every check says healthy, and
+# nobody is told.
+#
+# Ymir refuses that silence: a shell is only "ready" when the runtime verifies.
+# Source-safe, functions only.
+#
+#   electron_runtime_state <app-dir>   ok | partial | absent   (exit 0 only for ok)
+#   electron_remedy                    the exact command that mends a partial one
+set -u
+
+electron_runtime_state() {  # <app-dir>
+  local dir="${1-}"
+  [ -n "$dir" ] && [ -d "$dir" ] || { printf 'absent'; return 1; }
+  [ -d "$dir/node_modules/electron" ] || { printf 'absent'; return 1; }
+  # path.txt is written by the postinstall; dist/electron is what it points at.
+  if [ -f "$dir/node_modules/electron/path.txt" ] \
+     && [ -x "$dir/node_modules/electron/dist/electron" ]; then
+    printf 'ok'; return 0
+  fi
+  printf 'partial'; return 1
+}
+
+electron_remedy() {
+  printf 'the runtime download was skipped by npm — approve and rebuild:\n'
+  printf '  npm install-scripts approve electron && npm rebuild electron\n'
+  printf 'yonder: bin/ymir-install.sh --no-desktop if the web surfaces are enough'
+}

package/bin/feature-inventory.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# feature-inventory.sh — every feature the system CLAIMS, in one checklist.
+#
+# "Every single feature must work" is a hope until there is a list. This builds
+# the list from the tree itself rather than from anyone's memory: every tool, job,
+# skill, agent, app, workflow, service and registered project. It asserts nothing
+# about whether they work — that is the verification pass, and it needs this
+# inventory to exist first.
+#
+#   bin/feature-inventory.sh            # the inventory, as TOON
+#   bin/feature-inventory.sh --counts   # just the tallies
+#   bin/feature-inventory.sh --verify-plan   # the inventory as a checklist to fill in
+set -u
+
+VERSION="1.0.0"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+HOARD="${YMIR_HOARD:-${YMIR_HOME:-$HOME/Documents/Ymir}/hodd}"
+
+case "${1-}" in
+  -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;;
+  -h|--help|"") sed -n '2,14p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+esac
+MODE="${1:-all}"
+
+n_tools=$(find "$ROOT/bin" -maxdepth 1 -type f \( -name '*.sh' -o -name '*.py' -o -name '*.js' \) 2>/dev/null | wc -l | tr -d ' ')
+n_jobs=$(ls "$ROOT"/bin/nornir-job-*.sh 2>/dev/null | wc -l | tr -d ' ')
+n_skills=$(find -L "$ROOT/.agents/skills" -mindepth 2 -maxdepth 2 -name SKILL.md 2>/dev/null | wc -l | tr -d ' ')
+n_agents=$(ls "$ROOT"/.agents/agents/*.md 2>/dev/null | wc -l | tr -d ' ')
+n_workflows=$(ls "$ROOT"/.github/workflows/*.yml 2>/dev/null | wc -l | tr -d ' ')
+n_apps=$(find "$ROOT/apps" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | wc -l | tr -d ' ')
+n_migrations=$(ls "$ROOT"/.agents/migrations/*.sh 2>/dev/null | wc -l | tr -d ' ')
+n_projects=0
+[ -r "$HOARD/identity/projects.yaml" ] && n_projects=$(grep -c '^  - id:' "$HOARD/identity/projects.yaml" 2>/dev/null | tr -d ' ')
+
+if [ "$MODE" = "--counts" ]; then
+  printf 'features[8]{kind,count}:\n'
+  printf '  "tools (bin/)",%s\n' "$n_tools"
+  printf '  "nornir jobs",%s\n' "$n_jobs"
+  printf '  "skills",%s\n' "$n_skills"
+  printf '  "agents",%s\n' "$n_agents"
+  printf '  "workflows (CI)",%s\n' "$n_workflows"
+  printf '  "apps",%s\n' "$n_apps"
+  printf '  "migrations",%s\n' "$n_migrations"
+  printf '  "registered projects",%s\n' "$n_projects"
+  exit 0
+fi
+
+# The checklist: one row per thing that must be proven.
+printf 'inventory[8]{kind,count,how_proven}:\n'
+printf '  "tools (bin/)",%s,"bash -n + --version/--help runs, exit 0"\n' "$n_tools"
+printf '  "nornir jobs",%s,"one run each, --check or dry-run, writes as documented"\n' "$n_jobs"
+printf '  "skills",%s,"its scripts run; its asset paths resolve (skillindex gate)"\n' "$n_skills"
+printf '  "agents",%s,"bound into all five harnesses (harnesses gate) + a dispatch"\n' "$n_agents"
+printf '  "workflows (CI)",%s,"YAML parses + the job runs green on the branch"\n' "$n_workflows"
+printf '  "apps",%s,"builds, serves, wears its rune, installs its entry, opens in Electron"\n' "$n_apps"
+printf '  "migrations",%s,"idempotent; re-run leaves the home unchanged"\n' "$n_migrations"
+printf '  "registered projects",%s,"gh resolves the repo; PR ledger reports its PRs"\n' "$n_projects"
+
+printf 'tools[%s]{tool}:\n' "$n_tools"
+for f in "$ROOT"/bin/*; do
+  [ -f "$f" ] || continue
+  case "$f" in *.sh|*.py|*.js) printf '  "%s"\n' "$(basename "$f")" ;; esac
+done
+
+printf 'jobs[%s]{job}:\n' "$n_jobs"
+for f in "$ROOT"/bin/nornir-job-*.sh; do [ -f "$f" ] && printf '  "%s"\n' "$(basename "$f")"; done
+
+printf 'apps[%s]{app}:\n' "$n_apps"
+for d in "$ROOT"/apps/*/; do [ -d "$d" ] && printf '  "%s"\n' "$(basename "$d")"; done
+
+printf 'skills[%s]{skill,owner}:\n' "$n_skills"
+grep -oE '^  "[a-z0-9-]+","[^"]*","[a-z]+"' "$ROOT/.agents/skills/README.md" 2>/dev/null | sed 's/^  //' || true

package/bin/fleet-apply.sh

@@ -14,8 +14,21 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-REG="${BROKK_EINDRI_HOMES:-$ROOT/data/eindri-homes.md}"
-PREFS="${BROKK_FLEET_PREFS:-$ROOT/data/fleet.md}"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
+REG="${BROKK_EINDRI_HOMES:-$YMIR_DATA_DIR/eindri-homes.md}"
+PREFS="${BROKK_FLEET_PREFS:-$YMIR_DATA_DIR/fleet.md}"
 CHECK=0
 
 case "${1-}" in -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;; -h|--help) sed -n '2,12p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;; esac

package/bin/github-deploy.sh

@@ -16,7 +16,20 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-ENV_FILE="${BROKK_ENV_FILE:-$ROOT/.env.local}"
+
+# The operator's settings and secrets live in the home they chose, never in the
+# code tree — a packaged install replaces its tree on upgrade, and a credential
+# must never sit in a tree that ships (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_settings_dir YMIR_SETTINGS_DIR
+hoard_local_env YMIR_ENV_FILE
+ENV_FILE="${BROKK_ENV_FILE:-$YMIR_ENV_FILE}"
 SECRETS="NETLIFY_AUTH_TOKEN NETLIFY_SITE_ID VERCEL_TOKEN GITHUB_TOKEN TELEGRAM_BOT_TOKEN"
 
 case "${1-}" in

package/bin/gjallarhorn-expose.sh

@@ -17,6 +17,19 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
 TUNNEL="${YMIR_TUNNEL_NAME:-ymir}"
 DOMAIN="${YMIR_TUNNEL_DOMAIN:-zerwiz.org}"
 SUFFIX="${YMIR_TUNNEL_SUFFIX:-dell}"
@@ -31,13 +44,16 @@ case "${1:-plan}" in
 esac
 ACTION="${1:-plan}"
 
-# host_key port app-path
+# Every public hostname points at the GATE (:3889), never at an app's own port:
+# the gate holds the login and proxies on by host, so the web door is locked for
+# every app. An app port here would be a hole straight past the login.
+GATE_PORT="${HLIDSKJALF_API_PORT:-3889}"
 APPS=(
-  "ymir:$(( ${#SUFFIX} ? 3889 : 3889 ))"
-  "hlidskjalf:3889"
-  "odrerir:4322"
-  "smidja:8437"
-  "smidjafactory:8437"
+  "ymir:$GATE_PORT"
+  "hlidskjalf:$GATE_PORT"
+  "odrerir:$GATE_PORT"
+  "smidja:$GATE_PORT"
+  "smidjafactory:$GATE_PORT"
 )
 
 if [ -z "$SUFFIX" ]; then
@@ -71,7 +87,9 @@ mkdir -p "$(dirname "$CONFIG")"
 {
   printf '# Gjallarhorn — this machine (%s). Generated by bin/gjallarhorn-expose.sh.\n' "$SUFFIX"
   printf 'tunnel: %s\n' "$TUNNEL"
-  printf 'credentials-file: %s/.cloudflared/%s.json\n' "$HOME" "$TUNNEL"
+  # No credentials-file line: cloudflared resolves <UUID>.json for a named
+  # tunnel itself. Guessing the filename (ymir.json) is what made it refuse to
+  # start, and a tunnel that will not start answers 530 to the world.
   printf 'ingress:\n'
   for row in "${APPS[@]}"; do
     app="${row%%:*}"; port="${row##*:}"
@@ -81,16 +99,31 @@ mkdir -p "$(dirname "$CONFIG")"
 } >"$CONFIG"
 
 # 2. the routes (idempotent: an existing record is left alone)
+# Route by the tunnel's own UUID, never by its name. `route dns <name> <host>`
+# resolves the name through the account certificate, which can point at a
+# DIFFERENT (even deleted) tunnel: every hostname then answers 530 while the
+# named tunnel runs happily beside it. Resolve the UUID first, then route.
+TUNNEL_ID="$(cloudflared tunnel info "$TUNNEL" 2>/dev/null | grep -m1 -oE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}')"
+[ -n "$TUNNEL_ID" ] || TUNNEL_ID="$TUNNEL"
 made=0
 for row in "${APPS[@]}"; do
   app="${row%%:*}"
-  cloudflared tunnel route dns "$TUNNEL" "$app$SUFFIX.$DOMAIN" >/dev/null 2>&1 && made=$((made+1))
+  cloudflared tunnel route dns --overwrite-dns "$TUNNEL_ID" "$app$SUFFIX.$DOMAIN" >/dev/null 2>&1 && made=$((made+1))
 done
 
+# 2b. the gate must know which host belongs to which app (it routes by host)
+HOSTMAP="$YMIR_STATE_DIR/gjallarhorn-hosts.env"
+{
+  printf '# Written by bin/gjallarhorn-expose.sh — the gate routes these hosts.\n'
+  printf 'YMIR_PRIMARY_HOST=ymir%s.%s\n' "$SUFFIX" "$DOMAIN"
+  printf 'SMIDJA_HOST=smidja%s.%s\n' "$SUFFIX" "$DOMAIN"
+  printf 'ODRERIR_HOST=odrerir%s.%s\n' "$SUFFIX" "$DOMAIN"
+} >"$HOSTMAP"
+
 # 3. raise it
 started="already"
 if ! pgrep -f "cloudflared.*tunnel.*--config $CONFIG" >/dev/null 2>&1; then
-  nohup cloudflared tunnel --config "$CONFIG" run "$TUNNEL" >"$ROOT/state/gjallarhorn.log" 2>&1 &
+  nohup cloudflared tunnel --config "$CONFIG" run "$TUNNEL" >"$YMIR_STATE_DIR/gjallarhorn.log" 2>&1 &
   started="pid $!"
   sleep 4
 fi
@@ -98,5 +131,6 @@ fi
 printf 'gjallarhorn_apply[3]{what,detail,count}:\n'
 printf '  "config","%s","%s"\n' "${CONFIG#"$HOME"/}" "${#APPS[@]}"
 printf '  "routes","%s%s.%s","%s"\n' "" "$SUFFIX" "$DOMAIN" "$made"
+printf '  "hostmap","%s","the gate routes by host"\n' "${HOSTMAP#"$ROOT"/}"
 printf '  "tunnel","%s","%s"\n' "$started" "$TUNNEL"
 plan

package/bin/gjallarhorn-notify.sh

@@ -13,7 +13,20 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-ENV_FILE="${BROKK_ENV_FILE:-$ROOT/.env.local}"
+
+# The operator's settings and secrets live in the home they chose, never in the
+# code tree — a packaged install replaces its tree on upgrade, and a credential
+# must never sit in a tree that ships (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_settings_dir YMIR_SETTINGS_DIR
+hoard_local_env YMIR_ENV_FILE
+ENV_FILE="${BROKK_ENV_FILE:-$YMIR_ENV_FILE}"
 
 usage() { sed -n '2,11p' "$0" | sed 's/^# \{0,1\}//'; }
 

package/bin/gjallarhorn-purge.sh

@@ -11,7 +11,20 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-ENV_FILE="${BROKK_ENV_FILE:-$ROOT/.env.local}"
+
+# The operator's settings and secrets live in the home they chose, never in the
+# code tree — a packaged install replaces its tree on upgrade, and a credential
+# must never sit in a tree that ships (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_settings_dir YMIR_SETTINGS_DIR
+hoard_local_env YMIR_ENV_FILE
+ENV_FILE="${BROKK_ENV_FILE:-$YMIR_ENV_FILE}"
 DOMAIN="${YMIR_DOMAIN:-${YMIR_TUNNEL_HOST:-}}"
 [ -n "$DOMAIN" ] || { printf 'gjallarhorn-purge: set YMIR_DOMAIN (or YMIR_TUNNEL_HOST)\n' >&2; exit 2; }
 ZONE_NAME="${CLOUDFLARE_ZONE_NAME:-}"

package/bin/gjallarhorn-tunnel.sh

@@ -19,10 +19,23 @@ fi
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
 CONFIG="${YMIR_TUNNEL_CONFIG:-$HOME/.cloudflared/config-ymir.yml}"
 TUNNEL="${YMIR_TUNNEL_NAME:-ymir}"
-PID_FILE="$ROOT/state/gjallarhorn.pid"
-LOG_FILE="$ROOT/state/gjallarhorn.log"
+PID_FILE="$YMIR_STATE_DIR/gjallarhorn.pid"
+LOG_FILE="$YMIR_STATE_DIR/gjallarhorn.log"
 
 case "${1-}" in -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;; -h|--help|"") sed -n '2,10p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;; esac
 ACTION="${1:-status}"; shift || true
@@ -59,7 +72,7 @@ esac
 
 command -v cloudflared >/dev/null 2>&1 || { printf 'error: cloudflared not found\nhelp: install cloudflared\n' >&2; exit 1; }
 [ -r "$CONFIG" ] || { printf 'error: tunnel config not found: %s\nhelp: cp midgard/infrastructure/ingress/cloudflared-ymir.yml ~/.cloudflared/config-ymir.yml\n' "$CONFIG" >&2; exit 1; }
-mkdir -p "$ROOT/state"
+mkdir -p "$YMIR_STATE_DIR"
 if running; then printf 'gjallarhorn[1]{state,host}:\n  "already up","%s"\n' "$HOST"; exit 0; fi
 
 nohup cloudflared tunnel --config "$CONFIG" run "$TUNNEL" >"$LOG_FILE" 2>&1 &

package/bin/groa-update.sh

@@ -25,7 +25,15 @@ VERSION="2.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 YMIR_HOME="${YMIR_HOME:-$HOME/Documents/Ymir}"
-REG="${BROKK_EINDRI_HOMES:-$YMIR_HOME/data/eindri-homes.md}"
+# The registry lives in the hoard (RULES/04-hoard.md; correction 2026-09-17).
+# Resolve through hoard-lib so the path can never drift again.
+if [ -r "$SCRIPT_DIR/hoard-lib.sh" ]; then
+  # shellcheck source=bin/hoard-lib.sh
+  . "$SCRIPT_DIR/hoard-lib.sh"; hoard_root _hoard
+else
+  _hoard="${YMIR_HOARD:-$YMIR_HOME/hodd}"
+fi
+REG="${BROKK_EINDRI_HOMES:-$_hoard/data/eindri-homes.md}"
 REMOTE=""; BRANCH=""; CHECK=0
 
 case "${1-}" in -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;; -h|--help) sed -n '2,21p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;; esac

package/bin/hall-snapshot.sh

@@ -17,13 +17,32 @@
 set -u
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="${BROKK_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
-STATE="${BROKK_STATE_OVERRIDE:-$ROOT/state}"
+
+# The operator's settings and secrets live in the home they chose, never in the
+# code tree — a packaged install replaces its tree on upgrade, and a credential
+# must never sit in a tree that ships (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_settings_dir YMIR_SETTINGS_DIR
+hoard_local_env YMIR_ENV_FILE
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+STATE="${BROKK_STATE_OVERRIDE:-$YMIR_STATE_DIR}"
 OUT="${1:-$ROOT/apps/odrerir/public/livehall.json}"
 
 runes_file="${BROKK_RUNES_FILE:-${YMIR_HOME:-$HOME/Documents/Ymir}/hodd/memory/runes_audit.md}"
 PROJECTS_FILE="${YMIR_HOME:-$HOME/Documents/Ymir}/hodd/identity/projects.yaml"
 projects_file="$PROJECTS_FILE"
-cron_file="$ROOT/config/cron.yaml"
+cron_file="$YMIR_SETTINGS_DIR/cron.yaml"
 
 # --- tally the pieces ---
 runes=$(grep -c '^{' "$runes_file" 2>/dev/null || echo 0)

package/bin/herdr-run.sh

@@ -37,7 +37,20 @@ set -u
 VERSION="2.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-STATE_DIR="${BROKK_STATE_OVERRIDE:-$ROOT/state}"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
+STATE_DIR="${BROKK_STATE_OVERRIDE:-$YMIR_STATE_DIR}"
 TAB_LOG="$STATE_DIR/herdr-seats"
 SETTLE="${YMIR_HERDR_SETTLE:-300}"
 
@@ -302,7 +315,15 @@ case "$ACTION" in
           h="$(printf '%s' "$r"   | cut -d'"' -f6)"
           pv="$(printf '%s' "$r"  | cut -d'"' -f8)"
           md="$(printf '%s' "$r"  | cut -d'"' -f10)"
-          [ -n "$h" ] && KIND="$h"
+          # The harness FOLLOWS the model: a local provider is pi's work, an
+          # online one is opencode's. Trusting a field position here seated
+          # pi with an online model id, so the worker started and sat IDLE -
+          # "sent but never started" - while the dispatch row reported success.
+          case "${md:-}:${pv:-}:${h:-}" in
+            *llama*|*lmstudio*|*ollama*) KIND=pi ;;
+            "")                          KIND=pi ;;   # nothing resolved: stay local
+            *)                           KIND=opencode ;;
+          esac
           [ -n "$md" ] && MODEL_ARGS=(-- --model "$pv/$md")
           printf 'herdr-run[1]{model,harness,provider,model_id}:\n  "%s","%s","%s","%s"\n' "$MODEL_REQ" "$h" "$pv" "$md" >&2 ;;
       esac