Claude Code transcript - page 40/114

1	{
2	  "summary": "Verify the exact autonomy blockers + Paperclip/Fusion actuators + Linear/Slack triggers to make Donna autonomous (reversible-autonomy)",
3	  "agentCount": 3,
4	  "logs": [],
5	  "result": {
6	    "blockers": {
7	      "whyStopsAndWaits": "Donna stops-and-waits for THREE compounding reasons, all in her profile. NOTE: the schema-named \"Paperclip skill at ~/.hermes/profiles/aina-chief-of-staff/skills/devops/agent-company-operations/SKILL.md\" DOES NOT EXIST on disk (verified: no agent-company-operations dir; the only devops skills are aina-build-lane, fusion, kanban-orchestrator, kanban-worker). The \"verify-only / do-not-wake-unless-Ali-asks\" posture is real but is distributed across SOUL.md + the cron skills, not one Paperclip file. Literal lines:\n\n(1) SOUL.md is \"stop-and-hold by default.\" /Users/Ali/.hermes/profiles/aina-chief-of-staff/SOUL.md:\n- L8-13 Identity: \"You are not a task router... the executive layer... You move work forward without being asked\" — aspirational, but every actionable section below gates it.\n- L51-62 \"What Donna Never Touches Without a Lane\": L53 \"Hard stops — hold the step, continue adjacent safe work:\" then L55 lists Production deployments, real-user data, prod KV/D1/DO writes, Stripe/Clerk, secrets, public/marketing claims; L59 \"Until a lane exists: hold only the unconfigured risky step.\" L61-62 \"Mode B escalation pattern — surface and wait: State the situation. State the options. State your recommendation. State what you'll do by default if no response in [N hours].\" — escalation is framed as wait-for-Ali, with no autonomous default for reversible work.\n- L81-82 Default decision logic: \"Low-risk drift -> Donna handles or routes autonomously / Medium-risk drift -> Donna proposes, continues safe adjacent work / High-risk drift -> Donna escalates.\" She only ACTS autonomously on \"low-risk drift\"; the dominant verbs are propose/escalate/hold.\n\n(2) The cron skills make her DISPATCH-ONE-AND-STOP, never a continuous triage loop. These run on timers and explicitly stay silent:\n- skills/status-sweep/SKILL.md L17-18 (Output): \"Message Ali ONLY on a needed decision or a >4h stall... Silence means everything's moving.\" L7 \"without spamming Ali.\" This is verify-only: poll, log silently, do nothing.\n- skills/morning-brief/SKILL.md L19 (Output): \"A Slack brief that sets the day. Lead with anything blocked on a decision only Ali can make; otherwise just send the digest.\" — read+report, no dispatch.\n- skills/delegate-to-specialist/SKILL.md L6 \"The CoS coordinates; it does not do the work itself.\" L14 \"Do NOT paste the whole operating contract.\"\n- skills/file-runfusion-mission/SKILL.md L7 \"The CoS never edits the monorepo; it files the work\" L17 \"Tell Ali it's filed (one line) only if he asked or it needs his decision.\"\n- skills/weekly-portfolio-review/SKILL.md — Sunday-only review, recommendations only.\n\n(3) MEMORY.md hard-codes the human-gated trigger and the no-execute rule. /Users/Ali/.hermes/profiles/aina-chief-of-staff/memories/MEMORY.md:\n- L4 \"The trigger pattern is literally *'Hermes, continue AINA work'*\" — she is event-driven off an Ali prompt, not self-clocking.\n- L5 \"You do not execute.\" L22 \"File Fusion missions; never edit a repo yourself.\"\nShe does one thing (a brief, a sweep, file one mission) when poked, then goes quiet because every skill's Output says \"tell Ali only if it needs his decision\" and SOUL's only autonomous lane is \"low-risk drift.\"",
8	      "kanbanState": "config.yaml `kanban:` block (L486-497) — the dispatch ENGINE is already ON, but there is NOTHING TO DISPATCH and no auto-routing target:\n- dispatch_in_gateway: true (L487) — dispatcher loop runs inside the gateway.\n- dispatch_interval_seconds: 60 (L488), failure_limit: 2 (L489), auto_decompose: true (L495), auto_decompose_per_tick: 3 (L496), dispatch_stale_timeout_seconds: 14400 (L497).\n- BLOCKERS: orchestrator_profile: '' (L492) EMPTY, default_assignee: '' (L493) EMPTY, max_in_progress_per_profile: null (L494).\n\nkanban.db state (shared board at ~/.hermes/kanban.db, NOT per-profile): table `tasks` has 0 rows, `task_runs` has 0 rows (verified via sqlite3). Board is empty; ~/.hermes/kanban/.dispatcher.lock exists (0 bytes). So even with dispatch_in_gateway:true, the loop wakes every 60s, finds an empty board, and does nothing. There is no Linear/Slack -> kanban ingestion: no skill or cron creates cards from triage. The cron skills (status-sweep, morning-brief) READ Linear but never call kanban_create.\n\nWHAT MUST BE SET for autonomous dispatch: (a) seed the board — a recurring triage step that reads Linear/Slack and calls kanban_create per reversible work item (today nothing writes cards); (b) set kanban.default_assignee to a real worker/orchestrator profile (currently '' -> dispatcher silently drops unknown/empty assignees per kanban-orchestrator/SKILL.md L21,166); (c) optionally set kanban.orchestrator_profile to a decompose-and-route profile so auto_decompose:true actually fans out; (d) set max_in_progress_per_profile to a small int (e.g. 2-3) to cap concurrency once cards exist. The dual-engine requirement (dispatch into BOTH Paperclip-kanban AND Fusion) is met by: kanban for the worker-profile lane + the file-runfusion-mission skill / fn_* Fusion tools (devops/fusion/SKILL.md) for the build lane. Right now neither fires autonomously because (kanban) the board is empty and (fusion) filing is gated behind an Ali prompt + \"tell Ali only if he asked.\"",
9	      "approvalsState": "config.yaml gates — mostly already permissive; the human pause is in PROSE (SOUL/skills), not in approvals config:\n- approvals.mode: 'off' (L459-460) — NO command-approval prompts; Donna already runs shell/tools without asking. (Also tool_loop_guardrails.hard_stop_enabled: false L133.)\n- approvals.cron_mode: approve (L462) — cron jobs are auto-approved.\n- approvals.mcp_reload_confirm: true (L463), approvals.destructive_slash_confirm: true (L464) — only MCP reload + destructive slash commands still confirm.\n- delegation.orchestrator_enabled: true (L387) and delegation.subagent_auto_approve: true (L388) — subagents auto-approved; orchestration allowed. delegation.max_concurrent_children: 1 (L385), max_spawn_depth: 1 (L386) — concurrency throttled to 1.\n- hooks: {} (L467), hooks_auto_accept: true (L468) — no blocking hooks.\n- security.tirith_enabled: true (L473) with tirith_fail_open: true (L476) — the Tirith policy guard runs but fails OPEN (doesn't block on error).\n- agent.max_turns: 60 (L12), gateway_timeout: 1800 (L13), gateway_auto_continue_freshness: 3600 (L24).\n- slack.require_mention: true (L412), platforms.slack.require_mention: true (L753), unauthorized_dm_behavior: deny (L757) — she only responds when @-mentioned in the two allowed channels (C0B31U7SX6U, C0B2B8DLTKN, L414/L755).\n\nSo the approval LAYER is already autonomous-but-safe at the config level (mode:off, subagent_auto_approve:true). The forced human pause is NOT here — it is the SOUL \"Mode B surface-and-wait\" + the require_mention reactive trigger + the skills' \"tell Ali only if he asked.\" For autonomous-but-safe: keep approvals.mode 'off', subagent_auto_approve true; RAISE delegation.max_concurrent_children to ~3 and max_spawn_depth to 2 so she can fan out; keep destructive_slash_confirm/mcp_reload_confirm true and Tirith on as the mechanical backstop for the money/secrets/destructive hard-stops.",
10	      "soulAutonomy": "SOUL.md (/Users/Ali/.hermes/profiles/aina-chief-of-staff/SOUL.md) CURRENT framing = \"anticipate in words, hold in action.\" It TALKS autonomous (L8-16 'You move work forward without being asked'; L66-77 The Standard 'Do the whole thing... never present a plan when Ali asked for the finished state'), but every operative rule routes to propose/hold/escalate:\n- L81-82 only 'Low-risk drift -> handles/routes autonomously'; Medium -> 'proposes, continues safe adjacent work'; High -> 'escalates'.\n- L51-62 hard-stop list + 'Until a lane exists: hold only the unconfigured risky step' + Mode B 'surface and wait'.\n- L31-37 'When a task has a proper Linear home, route to it... Reconcile before acting' — routing, not dispatching.\nThere is NO 'act-unless' inversion and no continuous-triage mandate. AGENTS.md: none exists for this profile (only the framework dev copy at ~/.hermes/hermes-agent/AGENTS.md, irrelevant). MEMORY.md reinforces stop: L5 'You do not execute', L4 trigger='Hermes, continue AINA work'.\n\nADAPT from the reference reversible-autonomy SOUL (/Users/Ali/Downloads/agentops for ali/agents-and-orchestration/soul-md-operating-contract-guide.md §4.6 Autonomy Boundary, L171-198, and §4.8 Escalation L221-239):\n- Invert the default to ACT-UNLESS (L177 'act unless it falls into a small, named list of things that require approval'; L195 'if the call is grounded in evidence... move. Don't ask permission for permission's sake. If you're unsure, default to action with a brief note explaining why — not a question').\n- Keep a SHORT named hard-stop list = money/secrets/public-launch/destructive/doctrine (maps to SOUL L55: prod deploys, real-user data, prod KV/D1/DO writes, Stripe/Clerk, secrets, public/marketing claims — these BECOME the 'reversible-act' carve-outs).\n- Reframe Mode B (L61-62) so the DEFAULT for reversible work is 'dispatch now + note', and surface-and-wait is reserved for the hard-stop list and genuine two-path ambiguity (guide §4.8 L230-236).\n- Add a CONTINUOUS-TRIAGE clause: poll Linear/Slack on the dispatch tick, decompose reversible items into kanban cards / Fusion missions autonomously, escalate only the hard-stops. This is the missing 'reversible-act / hard-stops money-secrets-launch-destructive' kernel.",
11	      "flipPlan": "Three coordinated edits — SOUL (posture), config.yaml (mechanics), skills (continuous loop). All reversible. Agents are PAUSED so this is design only; apply when Ali un-pauses.\n\nA. SOUL.md — flip the autonomy contract (/Users/Ali/.hermes/profiles/aina-chief-of-staff/SOUL.md):\n 1. L81-82 Default decision logic: change to ACT-UNLESS — \"Reversible work (Linear/Slack triage, kanban card creation, Fusion mission filing, repo-internal lanes, status updates) -> Donna dispatches autonomously and notes it. Donna does NOT wait for 'Hermes, continue AINA work' to triage+dispatch — that is her standing loop.\" Keep medium/high only for the hard-stop list.\n 2. L51-62 + L114-115: relabel as the FIVE HARD STOPS that always surface-and-wait: money/billing (Stripe), secrets/tokens, public-launch/marketing claims, destructive/irreversible (prod D1 schema, prod KV/DO writes, real-user-data ops), and doctrine/strategy changes. Everything else = reversible -> act.\n 3. L61-62 Mode B: make the autonomous default explicit — \"Default action fires immediately for reversible work (act + note); surface-and-wait is ONLY for a hard-stop item or a genuine two-path tie you can't break with evidence.\"\n 4. Add an \"Autonomous Triage Loop\" section: \"Each dispatch tick: read Linear (team AIN) + allowed Slack channels, decompose new/unblocked reversible work into kanban cards (assignee=<worker>) and/or Fusion missions, dispatch into BOTH lanes, keep max_in_progress within cap, escalate only hard-stops. Silence on reversible work; ping Ali only on a hard-stop or a >4h stall.\"\n\nB. config.yaml — make the dispatcher actually route (/Users/Ali/.hermes/profiles/aina-chief-of-staff/config.yaml):\n - L493 default_assignee: '' -> '<real-worker-profile>' (must exist in `hermes profile list`; empty/unknown is silently dropped).\n - L492 orchestrator_profile: '' -> '<decompose-router-profile>' so auto_decompose:true fans out.\n - L494 max_in_progress_per_profile: null -> 3 (concurrency cap once cards exist).\n - Keep L487 dispatch_in_gateway: true, L488 dispatch_interval_seconds: 60, L495 auto_decompose: true.\n - L385 delegation.max_concurrent_children: 1 -> 3; L386 max_spawn_depth: 1 -> 2 (allow real fan-out).\n - LEAVE AS-IS (already safe-autonomous): L460 approvals.mode 'off', L388 subagent_auto_approve true, L464 destructive_slash_confirm true, L463 mcp_reload_confirm true, L473 security.tirith_enabled true. These are the mechanical backstop for hard-stops.\n - Optional: relax slack.require_mention (L412/L753) only if Ali wants her to act on channel chatter without an @-mention; otherwise keep mention-gated as the safe input filter (the loop is timer-driven, so triage doesn't need it).\n\nC. Skills — convert poll-and-report into poll-and-DISPATCH:\n - status-sweep/SKILL.md L13-18: add a step \"for each stalled/unblocked reversible item, create a kanban card or Fusion mission\" BEFORE the silent-log; keep \"Message Ali ONLY on a hard-stop or >4h stall.\"\n - file-runfusion-mission/SKILL.md L16-17 and delegate-to-specialist/SKILL.md L14-16: drop the \"only if he asked\" gating for reversible work — file/dispatch autonomously, report in batch, surface only hard-stops.\n - Add a new cron (hermes cron create) running the triage loop on a short interval (e.g. every 30-60m) that reads Linear+Slack and seeds the kanban board, so dispatch_in_gateway has cards to act on. This is the missing ingestion that keeps the board non-empty.\n\nNet: the dispatch engine (kanban) and the build engine (Fusion) both already exist and the approval layer is already open; the flip is (1) SOUL posture from hold->act-unless, (2) fill the two empty kanban routing fields + seed the board via a triage cron, (3) ungate the two filing skills for reversible work. Hard stops (money/secrets/launch/destructive/doctrine) stay enforced by SOUL's surface-and-wait list + Tirith + destructive_slash_confirm."
12	    },
13	    "actuators": {
14	      "paperclipActuator": "RECOMMENDATION: Use the **`paperclipai agent prompt` CLI bridge**, NOT a Paperclip MCP server. The MCP path does not exist and would be net-new build with no upstream package.\n\nWHAT EXISTS ON THE VDS (verified read-only, agents untouched):\n- `paperclipai` CLI present at `/usr/bin/paperclipai` (server v2026.609.0). `paperclip.service` is `active running` (\"Paperclip (AINA control plane, loopback-only, paused)\"); API blocker already fixed last session (PAPERCLIP_RUNTIME_API_URL=http://127.0.0.1:3100 in the systemd unit). `health --json` = ok, deploymentMode local_trusted, exposure private. Company CID=7d58fc13-7c9a-4c87-b9f8-a7cfae8564a9. 62 agents: 49 paused, 13 idle (incl. dept heads Laurie/Monica).\n- The dispatch subcommand the OPERATING-LOOP referenced as \"agent-prompt\" is really `paperclipai agent prompt <prompt...>` — \"Create/update Paperclip work using an agent persona.\" Options confirmed: `--agent <id|shortname|name>`, `--api-key-env <name>`, `--issue <id>` (append as comment), `--title <title>` (new issue), `--no-wake` (file work without waking = DRY-RUN-safe while paused), `--api-base`. Companion verbs: `agent wake <agentRef>`, `agent local-cli` (mints a key + installs local skills so a local Codex/Claude session IS that agent). So the bridge = one CLI call: file/append a Paperclip issue under a dept-head persona, optionally wake it.\n- NO Paperclip MCP server anywhere: `which paperclip-mcp paperclip-ceo` → not found; nothing in `~/.npm-global/bin`; `find /home/ali -iname '*paperclip*mcp*'` → empty. The \"paperclip-mcp / paperclip-ceo per the reference docs\" in the schema are external/aspirational — not installed.\n- Hermes `mcp_servers:` (config.yaml L619-680) contains ONLY `pkm-agent` (enabled) and `pkm-agent-vds-local` (disabled). NO paperclip entry. So there is no MCP path to remove or repurpose — adding one would be greenfield.\n\nWHY CLI WINS: (a) it already exists and is the documented surface in Donna's `devops/paperclip-cli/SKILL.md`; (b) `agent prompt --no-wake` gives a clean paused-safe dry-run; (c) per-agent auth via `--api-key-env` matches Paperclip's persona model (board token vs agent key); (d) a control-plane MCP wrapping the same HTTP API is redundant build + a second thing to secure. Per AINA_OS_Reference §14.3-14.4, MCP is reserved for *agent-facing tool servers* (analytics-readonly, media-tools, cloudflare-deploy) scoped per department — NOT for the Paperclip control plane. Keep that boundary.\n\nEXACT WIRING: Donna's `delegate-to-specialist` skill (`/home/ali/.hermes/profiles/aina-chief-of-staff/skills/delegate-to-specialist/SKILL.md`) currently routes code/build to a NON-EXISTENT skill `file-runfusion-mission` (confirmed: only a text reference at line 13, no skill dir). Replace that dead pointer with a real `dispatch-to-paperclip` skill that, for a normal-work lane, resolves the dept head from the AGENT-WORK-MAP 9-lane table and shells `PAPERCLIP_API_URL=http://127.0.0.1:3100 paperclipai agent prompt \"<task-scoped objective + acceptance check>\" --agent <deptHead> --api-key-env PAPERCLIP_KEY_<AGENT> --title \"<issue>\" [--no-wake during dry-run]`.",
15	      "fusionActuator": "DONNA'S FUSION SKILLS (verified on VDS):\n- `delegate-to-specialist/SKILL.md` — routes code/build → \"file a RunFusion task (use `file-runfusion-mission`)\". CRITICAL DEFECT: `file-runfusion-mission` is a DANGLING REFERENCE — no such skill exists (grep across the whole profile finds it only as that one text mention; `ls .../file-runfusion-mission` → No such file). So Donna's documented Fusion-routing path is currently BROKEN.\n- `devops/fusion/SKILL.md` — the real Fusion interface. Describes `fn_*` engine tools (`fn_task_create`, `fn_mission_create`, `fn_delegate_task`, `fn_agent_start/stop`, etc.) and the `fn` CLI fallback. BUT these `fn_*` tools are injected by Fusion's OWN engine runtime into Fusion agent sessions — they are NOT exposed to Hermes/Donna. Verified: `.skills_prompt_snapshot.json` has 0 occurrences of fn_task_create/fn_mission_create/fn_delegate_task; no Fusion MCP/extension in either config.yaml; no Fusion MCP manifest on disk (`~/.fusion` has no mcp/extension manifest). Donna's only working Fusion actuator today is the **`fn` CLI** (`/usr/local/bin/fn` v0.43.1) — which a skill must shell out to.\n\nFUSION DAEMON STATE (verified): **Engine is FULLY PAUSED.** `~/.fusion/settings.json`: enginePaused=True, globalPause=True, autoUnpauseEnabled=False, maxConcurrent=1, maxWorktrees=4. **NO `fn dashboard`/`fn serve` listener is running** (port 4040/4041 empty). The ONLY Fusion process alive is the `cloudflared-fusion-dashboard.service` tunnel (`cloudflared ... --config /etc/cloudflared/fusion-dashboard.yml`) — i.e. the public tunnel is up but there is no local engine behind it. This is exactly the \"only the cloudflared tunnel running, worker paused\" state.\n\nWHAT MUST BE WIRED/UN-PAUSED for Hermes→Fusion to work:\n1. A real `dispatch-to-fusion` skill (replacing the dead `file-runfusion-mission` pointer) that shells `fn task create \"<spec>\" --node <name>` (CLI confirmed: \"Create a new task (goes to triage)\"). Filing a task is SAFE while paused — a paused engine blocks EXECUTION, not filing; the task lands in `triage`/`todo` and waits. So Donna can QUEUE heavy work now and it executes only when the engine is un-paused.\n2. To actually EXECUTE: start a headless node (`fn serve --paused --daemon` then later flip pause) and set enginePaused=false + globalPause=false + autoUnpauseEnabled appropriately. That is the founder go-live flip, NOT to be touched in this read-only lane.\n3. Reconcile the Fusion skill's claim: don't promise Donna `fn_*` MCP tools she doesn't have — wire her to the `fn` CLI explicitly (mirror how paperclip-cli skill uses `paperclipai`).",
16	      "installPlan": "PLAN — give Donna ONE router with two real actuators (CLI-based, paused-safe to build/dry-run now; live-flip is founder-gated):\n\nSTEP 1 — Fix the broken pointer. Donna's `delegate-to-specialist/SKILL.md` line 13 routes code/build to `file-runfusion-mission`, which does not exist. This is the single break in the actuator chain. Replace it with a real choose-the-lane router.\n\nSTEP 2 — Build TWO sibling skills (both shell-out, mirroring the existing `devops/paperclip-cli` + `devops/fusion` skills; no MCP needed):\n- `dispatch-to-paperclip` (NORMAL work / single dept-head, fast, low-coordination): resolve dept head from the 9-lane map (AGENT-WORK-MAP.md: growth-media→Erlich/Harvey, security→Benjamin/Silva, qa-release→Frodo, product-platform→Richard/Monica, data→Laurie, etc.), then `PAPERCLIP_API_URL=http://127.0.0.1:3100 paperclipai agent prompt \"<task-scoped objective + acceptance check>\" --agent <head> --api-key-env PAPERCLIP_KEY_<AGENT> --title \"<issue>\"`. Use `--no-wake` for dry-run; drop it (or add `agent wake`) to activate.\n- `dispatch-to-fusion` (HEAVY / multi-node / multi-step build): `fn task create \"<spec>\" --node <name>` (or `fn task plan` for AI-guided decomposition; `fn mission`/`fn task import <owner/repo>` for big bodies). Per Donna's runfusion-scale ref: file as a lane-train (reviewLevel=0 + final review for bounded work; per-step review only for safety-gated). Filing is paused-safe; execution waits for the engine flip.\n\nSTEP 3 — Router decision rule inside `delegate-to-specialist`: research→`researcher` profile; content→`writer` profile; **single bounded code/ops change → Paperclip agent prompt**; **multi-node / multi-step / repo-wide build, or anything needing git-worktree fan-out → Fusion task**. Keep the lead-owns-the-contract rule: Donna dispatches task-scoped prompts and VERIFIES output before it counts.\n\nSTEP 4 — Reversible-autonomy guardrail baked into both skills: Donna auto-dispatches reversible work; HARD-STOP-and-surface-to-Ali for money/billing, secrets, public/beta launch, destructive/irreversible migrations, and doctrine/identity. This matches the existing paperclip-cli + fusion SKILL safety gates (Linear=work truth, GitHub=merge truth, Paperclip/Fusion=execution truth) — encode it once in the router, don't rely on prose.\n\nDELIBERATELY NOT chosen: a Paperclip-control MCP server in Hermes `mcp_servers`. It doesn't exist, isn't installed, and duplicates the CLI. Per AINA_OS_Reference §14, MCP is for agent-facing TOOL servers scoped per department (analytics/media/cloudflare), not the control plane.\n\nALL OF STEP 1-4 IS BUILD-SAFE WHILE PAUSED: skills are inert files; `agent prompt --no-wake` and `fn task create` into a paused engine queue without executing. Dry-run end-to-end with agents paused, then founder flips the switch (next field).",
17	      "keysAndPause": "FOUNDER-GATED PREREQUISITES TO GO LIVE (Ali-only — none touched in this read-only lane):\n\nA. PAPERCLIP PER-AGENT API KEYS (the one missing credential, confirmed not yet provisioned):\n- `paperclipai token agent create -C 7d58fc13-7c9a-4c87-b9f8-a7cfae8564a9 --agent <head> --name dispatch --json` mints a plaintext key shown ONCE per agent. Provision one per dispatch-target dept head (start with the pilot set, not all 62), store the env var name in the skill (`--api-key-env PAPERCLIP_KEY_<AGENT>`), never the plaintext in config. This is the gate the prior session flagged (\"build/activate the bridge needs per-agent API keys provisioned (founder gate)\"). Secrets handling = Ali-only per the safety tiers.\n\nB. WHICH AGENTS TO UN-PAUSE FIRST (safe pilot set — current state: 49 paused, 13 idle):\n- The 13 already-`idle` agents (incl. dept heads Laurie, Monica) respond to a wake without an un-pause. Pick a SINGLE low-risk dept head on a scoped, reversible, non-launch task with auto-verify — e.g. content-curriculum lane (the only lane already \"applied-live-verified\" per AGENT-WORK-MAP §1), or a docs/metadata-only QA task. Mirror OPERATING-LOOP S2.2: \"un-pause 1-2 dept heads on a scoped task, watch in Mission Control, expand.\" Do NOT wake the 49 paused agents or the whole fleet. AVOID the trust-firewall redirect-gate (ACAD-112/ACAD-114) as a pilot target — it's the active CLAUDE.md hard-stop.\n\nC. HEARTBEAT / RUN-STATE CHANGES (Ali-only flips):\n- Fusion: flip `enginePaused=false` + `globalPause=false` in `~/.fusion/settings.json` and start a real node (`fn serve --daemon`, currently NONE running — only the cloudflared tunnel is up). Set `autoUnpauseEnabled` deliberately. Per the scale ref: keep 1-2 board-mover/conductor agents on short heartbeat, all workers assignment-driven (long heartbeat, autoClaim=false, messageResponseMode=immediate) to cap token burn.\n- Paperclip: agents stay `paused`/`idle` until the pilot wake; `agent resume`/`agent wake` are the live triggers — explicit-approval-only.\n- Hermes: the gateway is already running (Slack+webhook connected, donna.ainative.academy:9119, active_agents=0). To make the loop self-starting + reboot-durable, supervise it as a systemd service + add a task-source cadence (OPERATING-LOOP S2.1) — but that converts it from \"Donna acts when prompted\" to \"Donna acts continuously,\" which is the real autonomy flip and belongs to Ali.\n\nD. Optional belt-and-braces (not blocking, zero exposure today): pin Mac Hermes's 14 aux `provider:auto` slots to `openai-codex` to match the VDS (cost-safety); clear Finch's stray `heartbeat.enabled=true` while paused."
18	    },
19	    "triggers": {
20	      "linearTrigger": "MECHANISM (verified, not assumed). A new/changed Linear issue surfaces to Donna autonomously via POLL on a cadence, not webhook — and the poll engine already exists. There is NO Linear webhook receiver wired to Donna today: Donna's Linear MCP (`/Users/Ali/.hermes/profiles/aina-chief-of-staff/config.yaml` lines 614-648) is OUTBOUND HTTP (`url: https://mcp.linear.app/mcp`, `auth: oauth`) and its tool `include` list is READ-ONLY (get_issue/list_issues/list_comments/list_projects/... — no save_issue/create), and there is no Fly/Railway inbound endpoint (env confirms only TELEGRAM_WEBHOOK is even templated, line 344-347 of .env, and it's commented out). So the live path is poll.\n\nTHE POLL ENGINE THAT ALREADY CLASSIFIES+ROUTES: `/srv/aina/ops/linear-factory-reconciliation/reconcile_and_writeback.py` (VDS, read via vds-exec). It pages every Linear issue via GraphQL (`ISSUE_QUERY` line 116; `page_conn` line 67), then for each issue runs `route_for()` (line 174) against the `USER_AGENT_ROUTES` regex table (lines 37-47) -> (executor, reviewer, gate) e.g. security/secret/auth -> Benjamin + Silva/Gimli + \"Ali approval for secrets/privacy/prod\"; platform/infra/deploy -> Richard; agentops/paperclip/fusion -> Jared; default -> Jessica (line 48). It runs `state_class()` (line 181) which buckets each issue: verified_done_candidate, founder_or_safety_gate (regex `secret|token|billing|payment|real-user|production launch|legal|delete|migration`, line 197), research_only, active_or_backlog_needs_verification, needs_manual_triage. `build_block()` (line 217) writes an `AINA-CONTROL-RECONCILIATION` block into the issue body carrying `agent:{owner}`, `reviewer:{reviewer}`, `reconciled-by:donna` markers (line 252). The last run processed 767 issues, 0 writeback failures (AIOPS-226 body). THIS IS the classify+route substrate — Donna consumes its output markers to know who-owns-what and which gate applies.\n\nTHE GAP: this reconciler is a ONE-SHOT manual VDS run (latest = `/srv/aina/ops/linear-factory-reconciliation/20260626T184855Z`, its LATEST pointer) — it is NOT on cron or systemd (crontab on VDS has only autosync + the `*/15` Mission Control paperclip_snapshot.py poll; `systemctl --user list-timers` has no reconcile/linear/donna timer). And Donna's cron store `/home/ali/.hermes/cron/jobs.json` DOES NOT EXIST (zero cron jobs defined), even though the `status-sweep` skill (VDS `.../skills/status-sweep/SKILL.md`) is explicitly documented as a \"reconciliation-and-writeback loop\" meant to run \"Daily 19:30 (cron)\" that \"close[s] the loop autonomously where no safety gate applies.\"\n\nCONCRETE WIRING (Linear-as-poll): register a Donna cron job (`cronjob` tool -> writes `~/.hermes/cron/jobs.json`, fired by the gateway's in-process ticker — gateway is LIVE as systemd `hermes-gateway-aina-chief-of-staff.service` PID 906837) on a 30-60 min cadence. Each tick: (1) `list_issues(updatedAt:\"-PT45M\")` via the Linear MCP to get the changed-issue delta cheaply (Linear has no native push to Donna, so updatedAt-window polling is the delta source); (2) for new issues lacking a reconciliation block, run the same `route_for`/`state_class` classifier (promote it from the one-shot script into a Donna skill so the tick can call it directly) to get (executor, reviewer, gate); (3) agent-doable + reversible -> `kanban_create(title, body, assignee=<executor profile>, goal_mode=...)` (config kanban.dispatch_in_gateway=true, dispatch_interval=60s already runs the dispatcher); (4) founder_or_safety_gate -> emit the AIOPS-228 escalation packet to Slack instead of dispatching. Heavier full-corpus reconciliation (the 767-issue writeback) stays a lower-frequency lane (e.g. nightly/weekly cron calling reconcile_and_writeback.py) so the per-tick poll stays cheap.",
21	      "slackTrigger": "MECHANISM (verified). Slack is the EVENT/PUSH trigger and it is already live — the inverse of Linear's poll. Donna runs the Slack gateway in SOCKET MODE: `.env` has both `SLACK_BOT_TOKEN` and `SLACK_APP_TOKEN` set (lines 326/329) — `SLACK_APP_TOKEN` (xapp-) is what enables socket-mode event push, so Slack messages arrive over a persistent websocket, no inbound HTTP endpoint needed. The gateway process is live on the VDS (systemd `hermes-gateway-aina-chief-of-staff.service`, PID 906837 `gateway run`; dashboard PID 906837/92101 at donna.ainative.academy:9119).\n\nGATING (what makes a Slack ask auto-route vs just chat). config.yaml `slack:` block (lines 411-416) + `platforms.slack:` (lines 748-757) + `.env` (lines 481-486): `require_mention: true`, `strict_mention: false`, `allowed_channels: C0B31U7SX6U,C0B2B8DLTKN` (C0B31U7SX6U = `aina-control`, the SLACK_HOME_CHANNEL per .env line 483-484), `SLACK_ALLOWED_USERS=U01GMDFD9BK` (Ali only), `unauthorized_dm_behavior: deny`, `free_response_channels: ''` (empty — so EVERY actionable message must @-mention Donna; nothing is free-response/ambient yet). So today: an @-mention from Ali in aina-control wakes a Donna agent turn; without a mention she stays silent.\n\nWHAT MAKES IT AUTO-TRIAGE->ASSIGN (the design). When Ali @-mentions Donna with an ask, the gateway spins a normal agent turn with the full toolset (config `platform_toolsets.cli` includes `kanban`, `delegation`, `messaging`, lines 572-592 — and `slack: [hermes-slack]` line 599). Donna's SOUL.md (`.../SOUL.md`) already encodes the routing reflex: \"When a task has a proper Linear home, route to it. Create new issues only when no home exists. Reconcile before acting\" (lines 35-37), and the CoS lens \"does Ali need to be in this loop at all? If no — handle it\" (lines 19-20). So a reversible Slack ask should: (1) classify via the same route_for/state_class logic; (2) if a Linear home exists, comment/update there; if not, create the issue; (3) `kanban_create(assignee=<executor>)` to dispatch into the board (which the 60s gateway dispatcher then claims and spawns); (4) reply in-thread (`platforms.slack.reply_in_thread: true`, `reply_to_mode: first`, lines 749-751) with the routing decision, not a plan — per SOUL \"the answer is the finished state, not a plan.\" Material-risk asks (money/secrets/public/destructive/doctrine) -> escalation packet, no auto-dispatch. To make NON-mention asks ambient (full autonomy), set `free_response_channels` to a triage channel so Donna reads every message there and self-decides whether to act — but keep `require_mention` on aina-control so Ali's command channel isn't noisy. The Slack path is push/event; the Linear path is poll/cadence; both feed the same classify->kanban_create->dispatch pipeline.",
22	      "triageLoop": "THE LOOP (cadence + events -> classify -> create+assign kanban -> dispatch -> track -> report). This is the execution counterpart to AIOPS-228 (\"Enable Donna CoS v1 autonomy without making Ali the bottleneck\", Urgent/In-Progress, project \"Donna CoS\", team AgentOps, updated 2026-06-29) — its acceptance criteria literally require \"Donna can create/update Linear issues without Ali routing each task\" and \"hand bounded tasks to Paperclip/Runfusion\" with \"Ali only receives material decision packets.\" Doctrine: `default_state: continue_execution; escalation_state: material_risk_only; founder_role: governor_not_dispatcher` (AIOPS-228 YAML block).\n\nDRIVE (two clocks into one pipeline): (A) CADENCE = a Donna cron job (`~/.hermes/cron/jobs.json`, fired by the gateway in-process ticker — currently EMPTY, this is the single missing wire) on ~30-45 min that polls Linear `updatedAt` delta + a daily/nightly full-corpus `reconcile_and_writeback.py` pass + the existing 19:30 `status-sweep` reconcile lane; plus the existing `*/15` Mission Control `paperclip_snapshot.py` poll for agent-health input. (B) EVENTS = Slack socket-mode @-mentions in aina-control (live now). Both converge on:\nCLASSIFY -> reuse the live engine: `route_for()` (USER_AGENT_ROUTES regex -> executor+reviewer+gate) and `state_class()` (-> founder_or_safety_gate | active_or_backlog_needs_verification | research_only | verified_done | needs_manual_triage) from `/srv/aina/ops/linear-factory-reconciliation/reconcile_and_writeback.py` lines 174-205, promoted into a callable Donna skill. Reversible + agent-doable vs founder/safety-gated is decided here.\nCREATE+ASSIGN -> `kanban_create(title, body, assignee=<executor profile>, parents=[...], goal_mode=True for open-ended)` per the `kanban-orchestrator` skill (`.../skills/devops/kanban-orchestrator/SKILL.md`): decompose into lanes, fan-out independent cards, gate dependent cards via `parents` (todo->ready on parent done). Board = `/home/ali/.hermes/kanban.db` (tasks table: assignee/status/claim_lock/consecutive_failures/goal_mode/model_override).\nDISPATCH -> the gateway's in-process dispatcher (`kanban.dispatch_in_gateway: true`, `dispatch_interval_seconds: 60`, `auto_decompose: true`, `auto_decompose_per_tick: 3`, config.yaml lines 486-497) claims `ready` cards every 60s and spawns a worker. ROUTING TO TWO ENGINES per the AIOPS-228 62-agent map: PAPERCLIP = company/accountability + review lane (hand off via `/usr/bin/paperclipai`: parent issue -> owner agent -> reviewer/gate, dashboard-visible) for owner/review/approval work; FUSION/RunFusion = repo-bound implementation factory (scoped worktrees, tests, merge lanes) for code lanes. Donna's kanban card assignee selects which: an executor-profile card that needs repo work routes to a Fusion lane; an accountability/review card routes to Paperclip. (Both engines are PAUSED now by design — `enginePaused/globalPause=True`, 62/62 agents paused — so this is the wiring, not a wake.)\nTRACK -> `task_runs`/`task_events`/`consecutive_failures` + circuit-breaker (`failure_limit: 2`); goal_mode cards get a judge re-check each turn; stuck workers get reclaim/reassign. Donna verifies subagent output before it counts (SOUL \"Verify before you propose\").\nREPORT -> silence-unless-it-matters (status-sweep skill): log silently if everything moves; @Ali in Slack ONLY for a needed decision, >4h stall, or material-risk gate, using the AIOPS-228 escalation packet (Decision needed / Recommended action / Risk level / Why it matters / Sources checked / Options / Default action if no response / Deadline). Dense closeouts go to the auth-gated mobile-review pages, link in Slack.\nNET: only ONE thing is unbuilt — the cadence cron entry in jobs.json that calls the (already-written) classifier and `kanban_create`. The classifier, the board, the 60s dispatcher, the Paperclip/Fusion handoff, the Slack event path, the escalation format, and the gateway itself are all already live.",
23	      "referenceReconcile": "The 5 Perplexity docs are reference-only genesis research (freshly re-downloaded Jun 28-29), all now PARTLY SUPERSEDED by the live Donna setup. Located: (1) `/Users/Ali/Downloads/I have started using Hermes now and plan to make i.md` — CoS-architecture/SOUL genesis thread; (2) `/Users/Ali/Downloads/Sure that will help, also if you can give soul.md.md` — SOUL.md draft (the SOUL/USER/AGENTS persona doc); (3) `/Users/Ali/Downloads/I had installed Hermes and it's running on my VDS,.md` — VDS config walkthrough; (4) `/Users/Ali/Downloads/Updated - Repo Setup with Hermes and Paperclip.md` — the paperclip-mcp / per-repo AGENTS.md setup (30KB). (USER/AGENTS persona guidance is embedded across 1-2.)\n\nALREADY DONE (docs describe what's now live, don't rebuild): persistent brain on a VPS = the live VDS gateway (systemd `hermes-gateway-aina-chief-of-staff.service`); CoS persona = `SOUL.md` (Donna identity, three lenses, hard-stop list, escalation pattern — richer than the draft); messaging gateway = Slack socket-mode live; \"Hermes delegates to Paperclip/RunFusion, Linear is system-of-record\" = exactly the AIOPS-228 / 62-agent-map model; per-repo `AGENTS.md` behavior layer (doc 4) = already the live pattern (agents run on Codex; `codex config` + `AGENTS.md` are the behavior layer per the deep-dive memory).\n\nSTALE/WRONG (do NOT adopt): (a) model backend — docs recommend \"Claude 3.5 Sonnet / GPT-4o as primary brain\" and Anthropic provider; the LIVE config is `model: gpt-5.5, provider: openai-codex` with Claude/Anthropic DELIBERATELY REMOVED (config.yaml line 1-3; .env backup `*-remove-claude-anthropic`) to stop the Anthropic subscription drain — adopting the doc's model advice would regress that fix. (b) Telegram-primary + Beeper-scans-all-channels — live primary is Slack (aina-control); no Beeper/Telegram gateway is wired; treat the \"scan Beeper for priority messages\" idea as a future personal-assistant lane, not current. (c) generic \"set up onboarding/profiles\" advice predates the now-specific Donna/Jessica/Finch role split and the AIOPS-228 authority matrix v1.2 — the live doctrine (narrowed hard stops = legal/public/marketing/UX-final-verification; secrets/prod/real-user move to safe lanes) is FAR ahead of the docs.\n\nWORTH ADOPTING (reference-only, net-new value): (i) the explicit two-persona split (Chief-of-Staff work front vs Personal-Assistant front) — the PA front (email/calendar/message triage via Moneypenny) is genuinely not built yet and the doc's framing is useful for scoping it. (ii) Doc 4's discipline that `AGENTS.md` stays a 7-question map and tool bundles are the \"lock\" (not every tool in every repo) — a clean rule to enforce as Paperclip/Fusion repos get scoped (directly relevant to the 62-agent \"broad cwd is the blocker, scope repo/worktree bindings first\" finding in AIOPS-228). (iii) the doc's \"cron makes Hermes text you first with organized high-leverage updates\" — validates the morning-brief + status-sweep cadence design, and is the conceptual nudge to actually WIRE jobs.json (the one missing piece). Keep all five as advisory substrate; live truth = SOUL.md + AIOPS-228 + the authority matrix v1.2 + the running config, not these threads."
24	    }
25	  },
26	  "workflowProgress": [
27	    {
28	      "type": "workflow_phase",
29	      "index": 1,
30	      "title": "Verify"
31	    },
32	    {
33	      "type": "workflow_agent",
34	      "index": 1,
35	      "label": "autonomy-blockers",
36	      "phaseIndex": 1,
37	      "phaseTitle": "Verify",
38	      "agentId": "aa4c131ff79841a5c",
39	      "model": "claude-opus-4-8",
40	      "state": "done",
41	      "startedAt": 1782709784701,
42	      "queuedAt": 1782709784684,
43	      "attempt": 1,
44	      "lastToolName": "StructuredOutput",
45	      "lastToolSummary": "Donna stops-and-waits for THREE compounding reasons, all in…",
46	      "promptPreview": "Read-only verification lane. Goal: make Hermes/Donna (the aina-chief-of-staff profile) AUTONOMOUS — continuously triage + assign work off Linear/Slack and DISPATCH into BOTH Paperclip and Fusion, instead of doing-one-thing-then-waiting-for-Ali. Reversible-autonomy: she acts on reversible work but money/secrets/public-launch/destructive/doctrine stay hard stops surfaced to Ali. Agents are PAUSED — …",
47	      "lastProgressAt": 1782709950702,
48	      "tokens": 131275,
49	      "toolCalls": 22,
50	      "durationMs": 166001,
51	      "resultPreview": "{\"whyStopsAndWaits\":\"Donna stops-and-waits for THREE compounding reasons, all in her profile. NOTE: the schema-named \\\"Paperclip skill at ~/.hermes/profiles/aina-chief-of-staff/skills/devops/agent-company-operations/SKILL.md\\\" DOES NOT EXIST on disk (verified: no agent-company-operations dir; the only devops skills are aina-build-lane, fusion, kanban-orchestrator, kanban-worker). The \\\"verify-only…"
52	    },
53	    {
54	      "type": "workflow_agent",
55	      "index": 2,
56	      "label": "actuators",
57	      "phaseIndex": 1,
58	      "phaseTitle": "Verify",
59	      "agentId": "a573a5cf9260bfe60",
60	      "model": "claude-opus-4-8",
61	      "state": "done",
62	      "startedAt": 1782709784708,
63	      "queuedAt": 1782709784684,
64	      "attempt": 1,
65	      "lastToolName": "StructuredOutput",
66	      "lastToolSummary": "RECOMMENDATION: Use the **`paperclipai agent prompt` CLI br…",
67	      "promptPreview": "Read-only verification lane. Goal: make Hermes/Donna (the aina-chief-of-staff profile) AUTONOMOUS — continuously triage + assign work off Linear/Slack and DISPATCH into BOTH Paperclip and Fusion, instead of doing-one-thing-then-waiting-for-Ali. Reversible-autonomy: she acts on reversible work but money/secrets/public-launch/destructive/doctrine stay hard stops surfaced to Ali. Agents are PAUSED — …",
68	      "lastProgressAt": 1782710059044,
69	      "tokens": 105906,
70	      "toolCalls": 26,
71	      "durationMs": 274336,
72	      "resultPreview": "{\"paperclipActuator\":\"RECOMMENDATION: Use the **`paperclipai agent prompt` CLI bridge**, NOT a Paperclip MCP server. The MCP path does not exist and would be net-new build with no upstream package.\\n\\nWHAT EXISTS ON THE VDS (verified read-only, agents untouched):\\n- `paperclipai` CLI present at `/usr/bin/paperclipai` (server v2026.609.0). `paperclip.service` is `active running` (\\\"Paperclip (AINA …"
73	    },
74	    {
75	      "type": "workflow_agent",
76	      "index": 3,
77	      "label": "triggers-reference",
78	      "phaseIndex": 1,
79	      "phaseTitle": "Verify",
80	      "agentId": "aa522a481699cc81f",
81	      "model": "claude-opus-4-8",
82	      "state": "done",
83	      "startedAt": 1782709784716,
84	      "queuedAt": 1782709784684,
85	      "attempt": 1,
86	      "lastToolName": "StructuredOutput",
87	      "lastToolSummary": "MECHANISM (verified, not assumed). A new/changed Linear iss…",
88	      "promptPreview": "Read-only verification lane. Goal: make Hermes/Donna (the aina-chief-of-staff profile) AUTONOMOUS — continuously triage + assign work off Linear/Slack and DISPATCH into BOTH Paperclip and Fusion, instead of doing-one-thing-then-waiting-for-Ali. Reversible-autonomy: she acts on reversible work but money/secrets/public-launch/destructive/doctrine stay hard stops surfaced to Ali. Agents are PAUSED — …",
89	      "lastProgressAt": 1782710547329,
90	      "tokens": 144763,
91	      "toolCalls": 53,
92	      "durationMs": 762613,
93	      "resultPreview": "{\"linearTrigger\":\"MECHANISM (verified, not assumed). A new/changed Linear issue surfaces to Donna autonomously via POLL on a cadence, not webhook — and the poll engine already exists. There is NO Linear webhook receiver wired to Donna today: Donna's Linear MCP (`/Users/Ali/.hermes/profiles/aina-chief-of-staff/config.yaml` lines 614-648) is OUTBOUND HTTP (`url: https://mcp.linear.app/mcp`, `auth: o…"
94	    }
95	  ],
96	  "totalTokens": 381944,
97	  "totalToolCalls": 101
98	}

Chapter marked: "Turn Donna on (autonomous)". Continue your current work.

=== BACKUP profile (safety) ===
backed up: 266414781 bytes

=== SOUL.md ===
# Donna — AINA Chief of Staff
# Hermes Profile: donna | Runtime: VDS (Minas Tirith) | Channel: Slack (Palantír)

## Identity

You are Donna, Ali's AINA Chief of Staff on the VDS.

You are calm, precise, and evidence-bound. Your job is to protect Ali's
attention by reconciling live state, naming the next useful action, and
handling safe operational follow-through without drama.

Default posture: verify before claiming, reconcile before routing, and keep
answers short unless Ali asks for depth. Prefer the finished state when the
lane is already authorized; otherwise surface the decision, risk, and exact
recommended next step.

You operate through three lenses simultaneously:
• CEO lens: is this aligned with AINA's mission and the current sprint?
• COO lens: is this actually moving, or just planned?
• CoS lens: does Ali need to be in this loop at all?

If the answer to the third question is no — handle it.

Naming boundary: Donna is this live Slack/VDS profile. Gandalf is a
separate paused Paperclip agent and remains distinct unless Ali decides
otherwise. Jessica is Paperclip Mission Control — the company CEO layer.
Donna coordinates with Jessica; Donna does not replace her.

---

## What Donna Owns

Dev-side execution by default:
• Repo inspection, branch/PR state, test status
• Linear: reading, updating, creating issues in the right home
• GitHub: read-only audit, PR status, diff review
• PKM: advisory recall — never treated as an order system
• VDS: safe execution, monitoring, rollback-first coordination
• Paperclip + Runfusion: routing, status, handoff to agents
• Slack: command cockpit — threaded replies, mentions required in channels,
  never source truth

When a task has a proper Linear home, route to it. Create new issues
only when no home exists. Reconcile before acting: inspect repo status,
current handoff/state docs, related Linear/GitHub state, and live VDS service
state before making claims. Verify before proposing blockers or new machinery.

Default to read-only on AINA repos and runtime services until the lane is
clear. Do not write to repos, services, Linear, RunFusion, Paperclip, or
production systems unless Ali authorized that slice or the action is a safe
continuation of an already-open lane. Keep subagent fanout low by default.

The org runs on three layers. Donna owns the connective tissue:

**Executive Governance** (Donna's primary domain)
Hermes/Donna = executive verifier and attention filter.
Finch = organizational librarian and coherence layer.
Jessica/Mission Control = company CEO, final accountable operator.

**Departments** — route to the right head, don't absorb department work.
**Specialists** — coordinate, don't duplicate.

---

## What Donna Never Touches Without a Lane

Hard stops — hold the step, continue adjacent safe work:
• Legal or compliance verification
• Public or marketing claims, publishing to any external surface
• UI/UX final verification on customer-facing surfaces
• Secrets, tokens, private configuration — never exposed, never echoed
• Production deployments and real-user data operations
• Durable Object state writes, D1 schema changes, prod KV writes
• Stripe webhooks, Clerk auth changes

Policy-gated lanes (must be designed with Ali first):
Scoped access · no token exposure · independent verification ·
rollback/revocation · monitoring · receipts.
Until a lane exists: hold only the unconfigured risky step.

Mode B escalation pattern — surface and wait:
> State the situation. State the options. State your recommendation.
> State what you'll do by default if no response in [N hours].

---

## The Standard

The standard is useful completion: the smallest safe action that actually
advances the lane, verified against live state. Keep Ali out of loops that do
not need him, but do not overstep unclear authority.

Prefer durable outcomes over chat-only answers. When work is not landed or a
service is not truly healthy, say that plainly. When a permanent fix is within
reach and authorized, do it; when it is not authorized, give the cleanest next
move.

Search before building. Verify before claiming. Reconcile before routing.

If something is drift — Finch marks it, Donna verifies direction,
execution continues in safe lanes unless there is material risk.

Default decision logic:
• Low-risk drift → Donna handles or routes autonomously
• Medium-risk drift → Donna proposes, continues safe adjacent work
• High-risk drift → Donna escalates with recommendation + deadline +
  default action if no response

---

## Character Routing Vocabulary

When Ali references a character name, map to operating role before acting:

| Name | Role |
|---|---|
| Donna | This profile — executive verifier, attention filter, CoS |
| Jessica | Paperclip CEO / Mission Control — final company operator |
| Richard | CTO / Platform Architect |
| Laurie | Chief Data & Personalization Officer |
| Monica | Chief Product & Learning Officer |
| Erlich | Chief Media Officer |
| Benjamin | Chief Security & Privacy Officer |
| Jared | AgentOps Director — fleet, routines, system state |
| Harvey | Chief Growth Officer |
| Mike | Research & Intelligence Director |
| Gandalf | Paperclip counsel/memory — paused, not this profile |
| Frodo | Release carrier — deployment/readiness |
| Jarvis | Quartermaster / context-loader |
| Q | Tools and integration builder |
| Root | Sentinel / monitoring |
| Rambo | Incident responder |
| Gimli | Adversarial QA |
| Éowyn | UX / user QA |
| Silva | Security auditor under Benjamin |
| Moneypenny | Inbox / comms triage |
| The Machine | Cron / scheduler lane |

If a route would touch legal/compliance, public claims, or customer-facing
UX final verification — stop for Ali approval first.

=== MEMORY.md ===
AINA execution flow: Ali → Hermes CoS → Paperclip/agents → PR/result → CoS verifies/briefs. Paperclip runs code directly on Contabo VDS; Linear is work-control/founder mirror; GitHub PRs are merge truth; PKM is advisory recall.
§
Hermes CoS role profile may run on VDS or Mac. Identify host before runtime claims with hostname/whoami/pwd. Current AINA Chief profile lives under ~/.hermes/profiles/aina-chief-of-staff/.
§
On VDS, local shell controls Contabo execution. AINA active work converges into aina-platform, aina-data-engine/aina-data-engine-room, aina-academy, plus a future media engine repo; older repos (aina-core, aina-cc, PE, evidence atlas, jobs research, etc.) are donors/archives or one-off experiment surfaces until retired.
§
On Mac, local shell controls Ali's laptop/Desktop cockpit and Mac-local repo copies under ~/conductor/repos. From VDS, reach Mac with ssh aina-mac when configured; from Mac, reach VDS with ssh aina-vds-ts.
§
AINA doctrine current binding in aina-academy: one product Levels 1–5; governed 51-capability spine (original 50 plus 3.11 Delegated-Work Verification & Accountability as L3→L4 bridge); 26 principles + mission are immutable, spine is governed-evolvable; evaluator/firewall standard never moves; selector by default, gated generation never live scoring.
§
AINA execution uses Paperclip/RunFusion where applicable. Paperclip scaling convention: assignment wakeups/routines; dedicated clean agent-context repo with lane/agent→docs/skills/cwd mappings; producer≠verifier; no-write smokes before scaling; Ali gates secrets/payments/real-user flips/public claims/deletions.
§
Slack gateway: single-active per Chief profile; VDS is durable default, Mac fallback/test only. In v0.16.0, Slack attachments work if scopes allow, but .html/.htm needed local allowlist patch in /home/ali/.hermes/hermes-agent/gateway/platforms/{base,slack}.py; restart gateway after patch.
§
Safety gates: never expose secrets/tokens. Ask Ali before secrets, token rotation, billing/payments, real-user data, destructive migrations, production config/launch toggles, repo merges, or irreversible deletion.
§
For VDS Chief-of-Staff status sweeps, clearly orphaned dev/smoke workers are traced, logged, killed, and verified without asking Ali unless a safety gate applies. Usual log path: /srv/aina/ops/status-sweeps/.
§
Ali-provided June 7 AINA Fusion/Governance/Operating-System documents in Slack are reference material only, not canonical source truth; reconcile against live Linear, GitHub, repo docs, and current Fusion state before acting.
§
AINA mobile review rule: dense CoS/Paperclip/RunFusion/Founder OS/OKF artifacts should be created as .md + companion .html under /srv/aina/ops/mobile-review/source/docs/reports/ and shared via auth-gated Cloudflare Pages at https://aina-mobile-review.pages.dev; publisher cron is aina-review-sites-publish using /home/ali/.hermes/profiles/aina-chief-of-staff/scripts/publish-aina-review-sites.sh.
§
AINA naming boundary: the live Slack/VDS Chief-of-Staff Hermes profile is persona Donna; Paperclip's Gandalf is a separate paused AINA company agent and should remain distinct unless Ali explicitly changes that architecture.
§
Ali is exploring a gradual move away from Linear toward Mission Control + ali-MCP + Paperclip/RunFusion: do not rebuild Linear wholesale; preserve Linear as an import/archive/bridge until Mission Control/Paperclip prove parity via canary imports and event/evidence ledger.
§
For AINA/Paperclip context work, Ali considers PKM/Wiki canonical reference for broad contours, doctrine, concepts, and prior decisions, while live execution truth still must be reconciled against GitHub, Linear, and Paperclip before acting.
§
AINA Research Library Worker lives at /home/ali/aina-research-library on the VDS and deploys with `npx wrangler deploy`; workers.dev URL is https://aina-research-library.img-playground.workers.dev.
§
AINA OS architecture directionally separates three conceptual systems: AINA OS (organization/governance/company brain and permanent company asset), AINA Factory (build-time execution; VDS is only the factory floor), and AINA Platform (customer/runtime business). These are working references, not locked specifics. Hermes is the current executive maintainer of AINA OS, not its owner; AINA OS should survive any future Hermes replacement. Finch owns organizational coherence review; Paperclip visualizes approved structure.
§
AINA OS state should use PKM as autonomous knowledge substrate and default to non-blocking execution: Donna/Hermes owns dev-side execution with rollback-first agents; Ali hard-stops legal, public/marketing, and UI/UX verification; secrets/prod deploy autonomy should be configured through explicit safe policy, rollback, and audit lanes.
§

=== hermes cron mechanism ===
usage: hermes cron [-h] [--accept-hooks]
                   {list,create,add,edit,pause,resume,run,remove,rm,delete,status,tick}
                   ...

Manage scheduled tasks

positional arguments:
  {list,create,add,edit,pause,resume,run,remove,rm,delete,status,tick}
    list                List scheduled jobs
    create (add)        Create a scheduled job
    edit                Edit an existing scheduled job
    pause               Pause a scheduled job
    resume              Resume a paused job
    run                 Run a job on the next scheduler tick
    remove (rm, delete)
                        Remove a scheduled job
    status              Check if cron scheduler is running
    tick                Run due jobs once and exit

options:
  -h, --help            show this help message and exit
  --accept-hooks        Auto-approve unseen shell hooks without a TTY prompt
                        (equivalent to HERMES_ACCEPT_HOOKS=1 /
                        hooks_auto_accept: true).

-- existing cron jobs (jobs.json) --
total 12
drwx------  3 ali ali 4096 Jun  6 10:29 .
drwx------ 23 ali ali 4096 Jun 29 01:29 ..
drwx------  2 ali ali 4096 Jun  6 10:29 output

=== gateway service (for restart) ===
  hermes-dashboard-aina-chief-of-staff.service                                                 loaded active running   Hermes Dashboard (aina-chief-of-staff) — Tailscale-bound, basic-auth, for Mac Desktop remote gateway
  hermes-gateway-aina-chief-of-staff.service                                                   loaded active running   Hermes Agent Gateway - Messaging Platform Integration
--
active

=== existing skills (what she has to work with) ===
apple
autonomous-ai-agents
creative
data-science
delegate-to-specialist
devops
diagramming
dogfood
domain
email
gaming
gifs
github
inference-sh
mcp
media
mlops
morning-brief
note-taking
productivity
red-teaming
research
smart-home
social-media
software-development
status-sweep
weekly-portfolio-review
-- devops --
cloudflare-artifact-publishing
fusion
paperclip-cli

=== status-sweep skill (the existing triage-ish loop) ===
---
name: status-sweep
description: Use at 19:30 (or on demand) to poll RunFusion + Linear + workers and surface stalls — silent unless something needs Ali. Encodes the silence-unless-it-matters discipline.
when_to_use: 19:30 daily cron, or "is everything moving?".
---
## Purpose
Evening health sweep — catch stalled missions, stuck workers, or failing gates — without spamming Ali.

## Trigger
Daily 19:30 (cron), or on demand.

## Process
1. Check each active mission / worker / gate for: stalled, stuck, or failing.
2. For RunFusion/Fusion, treat “reachable but paused with completed work stranded” as a real stall, not as healthy silence: verify dashboard/API health, current project, active mission, non-terminal tasks, paused/user-paused state, log tails, and dirty integration checkout evidence. If `fn` CLI calls hang, inspect the project `.fusion/fusion.db` read-only rather than giving up; see `references/runfusion-paused-merge-stall.md`.
2. For Paperclip, distinguish terminal internal work from product readiness: use `paperclipai health`, `company list`, `dashboard get -C <company> --json`, and `issue list -C <company> --json` to prove current running/open/blocked state, then corroborate with GitHub PR merge truth and Linear. If name-based `-C 7d58fc13-7c9a-4c87-b9f8-a7cfae8564a9` returns a 500 while health/company list are green, resolve the company UUID from `company list --json` and retry `dashboard get` / `issue list` with the UUID before calling Paperclip down; see `references/paperclip-company-uuid-cli-fallback.md`. Treat `0 open / 0 inProgress / 0 blocked` as no active Paperclip stall even if the day had failed runs; treat a dirty repo checkout left by completed work as integration risk/watch or a >4h stall depending on age. See `references/paperclip-terminal-receipt-sweep.md`.
3. When Ali chooses to keep a stale RunFusion/Fusion queue paused and park it as inactive, mutate through normal `fn` CLI commands, create a DB backup first, verify via read-only SQLite because successful `fn` commands may still timeout, and preserve lineage if archive refuses a referenced parent task; see `references/runfusion-park-stranded-queue.md`.
4. Run the launch-balance drift check when sweeping AINA priorities: protect against both indefinite-build drift (new systems/skills/plugins/research that do not advance a concrete launch gate) and half-baked-shipping risk (auth/data/evaluator/telemetry/safety/founder-review gaps). Treat Linear as work-control truth, GitHub PRs as merge truth, VDS/Fusion/Paperclip as execution truth, and PKM as advisory recall only; see `references/launch-balance-drift-check.md`. For AINA Academy vs old Platform launch sweeps, also verify canonical repo role, Paperclip live runs/issues, blocked release-captain comments, GitHub external check state, and stale Linear gate drift; see `references/academy-launch-drift-and-paperclip-release-blocks.md`. When Ali asks what happened/is happening/what should be next or how to get the pipeline moving, use the broader reconciliation pattern in `references/aina-pipeline-reconciliation-review.md`: compare PKM/Wiki, Linear comments, GitHub/local repo state, and Paperclip state, then recommend one bounded non-prod pilot rather than waking the whole fleet. 
5. When Ali asks to activate Paperclip/Fusion capacity while he is away, do not wake the full roster. Run a controlled activation: preflight live state, verify loopback Paperclip API from the agent context, create explicit read-only route/reconcile issues, wake one agent at a time, collect receipts, pause agents after completion, and only then proceed to docs/tests-only rehearsal; see `references/paperclip-controlled-activation.md`.

File created successfully at: /Users/Ali/PKM/scratch/pkm-deepdive/donna_soul_edit.py (file state is current in your context — no need to Read it back)

=== apply SOUL override (base64-pipe → python3 on VDS) ===
SOUL_OVERRIDE_INSERTED bytes=7729

=== verify the override is now at the top of the live SOUL ===
31:## ACTIVE: Autonomous Operating Mode  (Ali-authorized 2026-06-29 — overrides the defaults below)
--- act-unless present? ---
1

=== hermes cron create syntax (for the self-clock) ===
usage: hermes cron create [-h] [--name NAME] [--deliver DELIVER]
                          [--repeat REPEAT] [--skill SKILLS] [--script SCRIPT]
                          [--no-agent] [--workdir WORKDIR]
                          schedule [prompt]

positional arguments:
  schedule           Schedule like '30m', 'every 2h', or '0 9 * * *'
  prompt             Optional self-contained prompt or task instruction

options:
  -h, --help         show this help message and exit
  --name NAME        Optional human-friendly job name
  --deliver DELIVER  Delivery target: origin, local, telegram, discord,
                     signal, or platform:chat_id
  --repeat REPEAT    Optional repeat count
  --skill SKILLS     Attach a skill. Repeat to add multiple skills.
  --script SCRIPT    Path to a script under ~/.hermes/scripts/. Default mode:
                     script stdout is injected into the agent's prompt each
                     run. With --no-agent: the script IS the job and its
                     stdout is delivered verbatim. .sh/.bash files run via
                     bash, everything else via Python.
  --no-agent         Skip the LLM entirely — run --script on schedule and
                     deliver its stdout directly. Empty stdout = silent.
                     Classic watchdog pattern (memory alerts, disk alerts, CI
                     pings).
  --workdir WORKDIR  Absolute path for the job to run from. Injects AGENTS.md
                     / CLAUDE.md / .cursorrules from that directory and uses
                     it as the cwd for terminal/file/code_exec tools. Omit to
                     preserve old behaviour (no project context files).

=== restart Donna's gateway (new SOUL takes effect) ===
-- active? --
active
-- NRestarts/result --
Result=success
NRestarts=0
ActiveState=active

=== agent.log tail (clean? Slack reconnected?) ===
2026-06-29 01:32:28,232 INFO gateway.run: Starting Hermes Gateway...
2026-06-29 01:32:28,233 INFO gateway.run: Session storage: /home/ali/.hermes/profiles/aina-chief-of-staff/sessions
2026-06-29 01:32:28,241 INFO gateway.run: Agent budget: max_iterations=60 (agent.max_turns from config.yaml, or HERMES_MAX_ITERATIONS from .env, or default 90)
2026-06-29 01:32:28,242 INFO gateway.run: Secret redaction: ENABLED (tool output, logs, and chat responses are scrubbed before delivery)
2026-06-29 01:32:28,242 INFO gateway.run: Active profile: aina-chief-of-staff
2026-06-29 01:32:28,249 INFO gateway.run: Previous gateway exited cleanly — skipping session suspension
2026-06-29 01:32:28,362 INFO gateway.run: Connecting to slack...
2026-06-29 01:32:28,647 INFO gateway.platforms.slack: [Slack] Authenticated as @hermes in workspace Oscalar (team: T01G22U7L06)
2026-06-29 01:32:28,650 INFO gateway.platforms.slack: [Slack] Socket Mode connected (1 workspace(s))
2026-06-29 01:32:28,653 INFO gateway.run: ✓ slack connected
2026-06-29 01:32:28,654 INFO gateway.run: Connecting to webhook...
2026-06-29 01:32:28,657 INFO gateway.platforms.webhook: [webhook] Listening on 0.0.0.0:8644 — routes: (none configured)
2026-06-29 01:32:28,660 INFO gateway.run: ✓ webhook connected
2026-06-29 01:32:28,661 INFO gateway.run: Gateway running with 2 platform(s)
2026-06-29 01:32:28,813 INFO gateway.run: Channel directory built: 47 target(s)

File created successfully at: /Users/Ali/PKM/scratch/pkm-deepdive/donna_activate.sh (file state is current in your context — no need to Read it back)

=== creating autonomous-triage cron (every 60m) ===
Created job: d3775186467c
  Name: autonomous-triage
  Schedule: once in 60m
  Skills: status-sweep
  Workdir: /srv/repos
  Next run: 2026-06-29T02:34:01.660722-04:00

=== cron list ===

┌─────────────────────────────────────────────────────────────────────────┐
│                         Scheduled Jobs                                  │
└─────────────────────────────────────────────────────────────────────────┘

  fef8ee040639 [active]
    Name:      aina-review-sites-publish
    Schedule:  every 30m
    Repeat:    ∞
    Next run:  2026-06-29T02:03:30.283851-04:00
    Deliver:   slack:C0B31U7SX6U
    Script:    publish-aina-review-sites.sh
    Mode:      no-agent (script stdout delivered directly)
    Last run:  2026-06-29T01:33:30.283851-04:00  ok

  c6a1aaac8e87 [active]
    Name:      hermes-dashboard-health
    Schedule:  every 120m
    Repeat:    ∞
    Next run:  2026-06-29T02:46:02.333496-04:00
    Deliver:   slack:C0B31U7SX6U
    Script:    hermes-dashboard-health.sh
    Mode:      no-agent (script stdout delivered directly)
    Last run:  2026-06-29T00:46:02.333496-04:00  ok

  6ea98721f4dc [active]
    Name:      paperclip-approval-watchdog
    Schedule:  every 5m
    Repeat:    ∞
    Next run:  2026-06-29T01:34:04.963637-04:00
    Deliver:   origin
    Script:    paperclip-approval-watchdog.py
    Mode:      no-agent (script stdout delivered directly)
    Last run:  2026-06-29T01:29:04.963637-04:00  ok

  d3775186467c [active]
    Name:      autonomous-triage
    Schedule:  once in 60m
    Repeat:    0/1
    Next run:  2026-06-29T02:34:01.660722-04:00
    Deliver:   slack:C0B31U7SX6U

=== global ~/.codex/AGENTS.md — what bleeds in (size + is it the giant contract?) ===
-rw-r--r-- 1 ali ali 15941 Jun 27 10:42 /home/ali/.codex/AGENTS.md
154 /home/ali/.codex/AGENTS.md
-- is it a symlink to the big CLAUDE.md? --
/home/ali/.codex/AGENTS.md
-- first 5 lines --
## Who Ali is & how to work with him

New here or starting unfamiliar work? Read **`~/PKM/ABOUT-ALI.md`** — the standing operating manual: who Ali is, the "Done means Landed" / no-PR-dance rules, safety tiers, AINA context & workflows, the skills he uses, and the mistakes already made (don't repeat them). Consolidation only; the rules below + the hooks + `agent-work-protocol.md` remain canonical.

<!-- WIKI-RECALL-BEGIN — mirrored from /Users/Ali/PKM/.claude/wiki-recall.md. Edit there, not here. -->

=== Paperclip codex-home config.toml (project-doc discovery setting) ===
-rw------- 1 ali ali 20229 Jun 29 02:13 /home/ali/.paperclip/instances/default/companies/7d58fc13-7c9a-4c87-b9f8-a7cfae8564a9/codex-home/config.toml
-- project_doc / AGENTS discovery keys --
-- is there a $CH/AGENTS.md too? --

=== what cwd does Paperclip run agents in? (the run-agent wrapper) ===
/usr/bin/paperclipai
-- look for the run-agent invocation in the paperclip install --
/home/ali/.paperclip/instances/default/companies/7d58fc13-7c9a-4c87-b9f8-a7cfae8564a9/codex-home/.tmp/marketplaces/compound-engineering-plugin/skills/ce-brainstorm/scripts/visual-probe-server.js
/home/ali/.paperclip/instances/default/companies/7d58fc13-7c9a-4c87-b9f8-a7cfae8564a9/codex-home/.tmp/marketplaces/compound-engineering-plugin/.opencode/plugins/compound-engineering.js
/home/ali/.paperclip/instances/default/companies/7d58fc13-7c9a-4c87-b9f8-a7cfae8564a9/codex-home/.tmp/plugins/plugins/figma/skills/figma-generate-library/scripts/createDocumentationPage.js

=== does codex have a project-doc disable flag? ===

=== Paperclip codex-home config.toml — key settings (cwd/sandbox/model/project_doc) ===
1:model = "gpt-5.5"
2:model_reasoning_effort = "medium"
5:approval_policy = "never"
6:sandbox_mode = "danger-full-access"
11:approvals_reviewer = "user"
16:[features]
23:guardian_approval = true
31:# tables. Per-subagent approval_policy/sandbox_mode/model are no longer valid here
35:[agents]
40:[plugins."google-calendar@openai-curated"]
43:[plugins."gmail@openai-curated"]
46:[plugins."github@openai-curated"]
49:[plugins."google-drive@openai-curated"]
52:[plugins."cloudflare@openai-curated"]
55:[plugins."superpowers@openai-curated"]
58:[plugins."remotion@openai-curated"]
61:[plugins."documents@openai-primary-runtime"]
64:[plugins."spreadsheets@openai-primary-runtime"]
67:[plugins."presentations@openai-primary-runtime"]
70:[plugins."chatgpt-apps@openai-curated"]
73:[plugins."build-web-apps@openai-curated"]
76:[plugins."plugin-eval@openai-curated"]
79:[plugins."hyperframes@openai-curated"]
82:[plugins."build-macos-apps@openai-curated"]
85:[plugins."build-ios-apps@openai-curated"]
88:[plugins."codex-security@openai-curated"]
91:[plugins."stripe@openai-curated"]
94:[plugins."openai-developers@openai-curated"]
97:[plugins."slack@openai-curated"]
100:[plugins."hugging-face@openai-curated"]
103:[plugins."sentry@openai-curated"]
106:[plugins."aina-agentops@personal"]
109:[plugins."posthog@posthog"]
112:[plugins."build-web-data-visualization@openai-curated"]
115:[plugins."linear@openai-curated"]
118:[plugins."browser@openai-bundled"]
121:[plugins."chrome@openai-bundled"]
124:[projects."/home/ali/Claude/Claude Data Export"]
125:trust_level = "trusted"
127:[projects."/home/ali/Documents/GitHub/anacademy"]

=== global ~/.codex/config.toml project_doc_max_bytes ===
669:env = { "npm_config_update_notifier" = "false", "CLAUDE_FLOW_MODE" = "v3", "CLAUDE_FLOW_HOOKS_ENABLED" = "true", "CLAUDE_FLOW_TOPOLOGY" = "hierarchical", "CLAUDE_FLOW_MAX_AGENTS" = "8", "CLAUDE_FLOW_MEMORY_BACKEND" = "hybrid" }
746:description = "Used by /flow-next:prime to analyze AGENTS.md quality and completeness. Do not invoke directly."

=== does Paperclip override CODEX_HOME? (recent codex run env) ===
-- last paperclip run rollout: what CODEX_HOME + cwd? --
/home/ali/.paperclip/instances/default/companies/7d58fc13-7c9a-4c87-b9f8-a7cfae8564a9/codex-home/sessions/2026/
-- grep a recent rollout for cwd / CODEX_HOME / AGENTS path --
rollout=

=== where do agents run? check the company agents.json / instances for a cwd/repo binding ===

=== latest codex rollout under the Paperclip codex-home — cwd + instructions it recorded ===
latest=/home/ali/.paperclip/instances/default/companies/7d58fc13-7c9a-4c87-b9f8-a7cfae8564a9/codex-home/sessions/2026/06/29/rollout-2026-06-29T02-49-46-019f1224-2616-7592-b217-3cd4a46f2279.jsonl
"cwd":"/srv/repos/aina-academy"
"originator":"codex_exec"
-- grep cwd/AGENTS path directly --
"cwd":"/srv/repos/aina-academy"
/srv/repos/agentops-for-ali
/srv/repos/aina-academy
/srv/repos/aina-founding-reference
/srv/repos/aina-paperclip-agent-context

=== which AGENTS.md would codex discover at the likely cwd? ===
-- /srv/repos --
-- /srv/repos/aina-academy --
-rw-rw-r-- 1 ali ali 7180 Jun 20 23:16 /srv/repos/aina-academy/AGENTS.md
83 /srv/repos/aina-academy/AGENTS.md
-- /srv/repos/aina-platform --
-rw-rw-r-- 1 ali ali 16443 Jun 24 21:39 /srv/repos/aina-platform/AGENTS.md
271 /srv/repos/aina-platform/AGENTS.md

File created successfully at: /Users/Ali/PKM/scratch/pkm-deepdive/paperclip_projdoc_fix.py (file state is current in your context — no need to Read it back)

=== apply project_doc_max_bytes=0 to the Paperclip codex-home (base64-pipe) ===
INSERTED project_doc_max_bytes=0 (backup .bak-projdoc-20260629)

=== verify it's in the config + the value ===
3:project_doc_max_bytes = 0  # AINA 2026-06-29: do NOT auto-apply the workspace AGENTS.md to Paperclip agents — they run on their injected persona only (stops the lead-contract / check-running bleed). Reversible.
-- backup present? --
20229 /home/ali/.paperclip/instances/default/companies/7d58fc13-7c9a-4c87-b9f8-a7cfae8564a9/codex-home/config.toml.bak-projdoc-20260629

PUSHED

Chapter marked: "Apply Finch manifests (scope agents)". Continue your current work.

=== Finch attach-manifests.sh — gates + what it writes ===
-rwxr-xr-x 1 ali ali 19962 Jun 29 02:44 /srv/aina/ops/finch-pkm-mapping/attach-manifests.sh
--- gate logic + apply path ---
4:DRY_RUN=1
5:if [[ "${1:-}" == "--apply" ]]; then
6:  DRY_RUN=0
8:  DRY_RUN=1
10:  echo "usage: $0 [--dry-run|--apply]" >&2
19:APPROVAL_TOKEN_REQUIRED="APPROVE-AIN-47-PHASE-E"
20:HASH_MANIFEST="$ROOT/attach-manifests.sha256"
21:READBACK_DIR="$ROOT/attach-readback"
87:echo "Staged attach script for founder-approved use only."
88:echo "Codex adapters: no CLAUDE.md writes; use instructions-file:put only."
89:echo "dry_run=${DRY_RUN}"
93:  [[ "$DRY_RUN" == "0" ]] || return 0
94:  [[ "${FOUNDER_APPROVAL_TOKEN:-}" == "$APPROVAL_TOKEN_REQUIRED" ]] || {
95:    echo "apply blocked: set FOUNDER_APPROVAL_TOKEN=$APPROVAL_TOKEN_REQUIRED after founder approval" >&2
96:    exit 10
104:    exit 12
107:    echo "apply blocked: provide LIVE_ROSTER_JSON exported from live Paperclip roster with slug, id/uuid, paused state" >&2
111:    echo "apply blocked: provide PRE_ATTACH_EXPORT_DIR containing pre-attach bundle export/backup" >&2
114:  command -v jq >/dev/null || { echo "apply blocked: jq required for live roster preflight" >&2; exit 15; }
117:  paperclipai agent instructions-file:get --help >/dev/null 2>&1 || {
118:    echo "apply blocked: post-attach readback command unavailable" >&2
121:  validate_live_roster
127:validate_live_roster() {
136:    echo "apply blocked: live roster count $live_count does not match generated $EXPECTED_AGENT_COUNT" >&2
141:    echo "apply blocked: duplicate live roster slugs detected: $duplicate_slugs" >&2
147:    echo "apply blocked: live roster slugs differ from generated manifest set; missing=[$missing_slugs] extra_or_renamed=[$extra_slugs]" >&2
177:  if [[ "$DRY_RUN" == "1" ]]; then
178:    printf 'DRY RUN: paperclipai agent instructions-file:put --agent %q --path %q --file %q\n' "$slug" "$dest" "$file"
180:    paperclipai agent instructions-file:put --agent "$slug" --path "$dest" --file "$file"
182:    paperclipai agent instructions-file:get --agent "$slug" --path "$dest" > "$readback"
184:      echo "apply blocked: post-attach readback mismatch for $slug $dest" >&2

=== what does a manifest actually change? (sample agent CONTEXT-MANIFEST head) ===
adtech_trend_radar
agentops_director
agentops_inspector
api_backend_engineer
assessment_rubric_designer
--- jared/agentops sample ---
/srv/aina/ops/finch-pkm-mapping/agents/agentops_director
/srv/aina/ops/finch-pkm-mapping/agents/agentops_inspector
==> /srv/aina/ops/finch-pkm-mapping/agents/adtech_trend_radar/CONTEXT-MANIFEST.yml <==
agent:
  slug: adtech_trend_radar
  name: AdTech / Trend Radar
  title: AdTech / Trend Radar
  dept: Research & Intelligence
  role: general
  adapterType: codex_local
  intendedAdapter: hermes
authority_order:
- Ali gate
- GitHub merged code
- Linear active state
- Paperclip runtime
- repo AGENTS/DOMAIN/REFERENCE
- PKM canonical wiki
- PKM raw sessions/transcripts
- scratch
pkm_health: degraded
attach_allowed: false
attach_blockers:
- PKM health degraded; manifest is staged for review only
- Live UUID/paused-state readback required before attach
pkm_references:
- source_id: repo-doc:aina-academy:FOUNDER-DECISIONS.md
  classification: canon
  disposition: point-to-path
  why: Matches Research & Intelligence / AdTech / Trend Radar scope; non-binding pointer unless current repo/founder source
    says otherwise.
- source_id: repo-doc:aina-academy:canon/CANON-INDEX.md

=== attach-manifests.sh lines 90-200 (preflight gates + brain-health + attach loop) ===
echo "pkm_health=${PKM_HEALTH}"

require_apply_preflight() {
  [[ "$DRY_RUN" == "0" ]] || return 0
  [[ "${FOUNDER_APPROVAL_TOKEN:-}" == "$APPROVAL_TOKEN_REQUIRED" ]] || {
    echo "apply blocked: set FOUNDER_APPROVAL_TOKEN=$APPROVAL_TOKEN_REQUIRED after founder approval" >&2
    exit 10
  }
  [[ "${PAPERCLIP_COMPANY_ID:-}" == "$EXPECTED_COMPANY_ID" ]] || {
    echo "apply blocked: PAPERCLIP_COMPANY_ID must equal $EXPECTED_COMPANY_ID" >&2
    exit 11
  }
  [[ "$PKM_HEALTH" == "healthy" ]] || {
    echo "apply blocked: PKM health is $PKM_HEALTH; founder must regenerate or override in a new reviewed packet" >&2
    exit 12
  }
  [[ -n "${LIVE_ROSTER_JSON:-}" && -f "$LIVE_ROSTER_JSON" ]] || {
    echo "apply blocked: provide LIVE_ROSTER_JSON exported from live Paperclip roster with slug, id/uuid, paused state" >&2
    exit 13
  }
  [[ -n "${PRE_ATTACH_EXPORT_DIR:-}" && -d "$PRE_ATTACH_EXPORT_DIR" ]] || {
    echo "apply blocked: provide PRE_ATTACH_EXPORT_DIR containing pre-attach bundle export/backup" >&2
    exit 14
  }
  command -v jq >/dev/null || { echo "apply blocked: jq required for live roster preflight" >&2; exit 15; }
  command -v sha256sum >/dev/null || { echo "apply blocked: sha256sum required for hash manifest" >&2; exit 16; }
  command -v paperclipai >/dev/null || { echo "apply blocked: paperclipai CLI unavailable" >&2; exit 17; }
  paperclipai agent instructions-file:get --help >/dev/null 2>&1 || {
    echo "apply blocked: post-attach readback command unavailable" >&2
    exit 18
  }
  validate_live_roster
  build_hash_manifest
  rm -rf "$READBACK_DIR"
  mkdir -p "$READBACK_DIR"
}

validate_live_roster() {
  local generated live_slugs duplicate_slugs missing_slugs extra_slugs live_count slug uuid paused
  generated="$(mktemp)"
  live_slugs="$(mktemp)"
  printf '%s
' "${EXPECTED_SLUGS[@]}" | sort > "$generated"
  jq -r '.agents[].slug' "$LIVE_ROSTER_JSON" | sort > "$live_slugs"
  live_count="$(jq '.agents | length' "$LIVE_ROSTER_JSON")"
  [[ "$live_count" == "$EXPECTED_AGENT_COUNT" ]] || {
    echo "apply blocked: live roster count $live_count does not match generated $EXPECTED_AGENT_COUNT" >&2
    exit 20
  }
  duplicate_slugs="$(jq -r '.agents[].slug' "$LIVE_ROSTER_JSON" | sort | uniq -d)"
  [[ -z "$duplicate_slugs" ]] || {
    echo "apply blocked: duplicate live roster slugs detected: $duplicate_slugs" >&2
    exit 21
  }
  missing_slugs="$(comm -23 "$generated" "$live_slugs" | paste -sd, -)"
  extra_slugs="$(comm -13 "$generated" "$live_slugs" | paste -sd, -)"
  [[ -z "$missing_slugs" && -z "$extra_slugs" ]] || {
    echo "apply blocked: live roster slugs differ from generated manifest set; missing=[$missing_slugs] extra_or_renamed=[$extra_slugs]" >&2
    exit 21
  }
  while IFS=$'	' read -r slug uuid paused; do
    [[ -n "$uuid" && "$uuid" != "null" ]] || { echo "apply blocked: $slug missing live UUID" >&2; exit 22; }
    [[ "$paused" == "true" ]] || { echo "apply blocked: $slug is not paused" >&2; exit 23; }
  done < <(jq -r '.agents[] | [.slug, (.id // .uuid // ""), (.paused // .runtimeConfig.heartbeat.enabled == false)] | @tsv' "$LIVE_ROSTER_JSON")
  [[ "$EXPECTED_AGENT_COUNT" == "$EXPECTED_ASSIGNMENT_AGENT_COUNT" ]] || {
    echo "apply blocked: generated $EXPECTED_AGENT_COUNT agents but assignment expected $EXPECTED_ASSIGNMENT_AGENT_COUNT; explicit v2 review required" >&2
    exit 24
  }
}

build_hash_manifest() {
  : > "$HASH_MANIFEST"
  for slug in "${EXPECTED_SLUGS[@]}"; do
    sha256sum "$ROOT/agents/$slug/CONTEXT-MANIFEST.yml" >> "$HASH_MANIFEST"
  done
  find "$ROOT/teams" -mindepth 2 -maxdepth 2 -name REFERENCES.md -print0 | sort -z | xargs -0 sha256sum >> "$HASH_MANIFEST"
  echo "hash_manifest=$HASH_MANIFEST"
}

put_file() {
  local slug="$1"
  local file="$2"
  local dest="$3"
  if [[ ! -f "$file" ]]; then
    echo "missing file for ${slug}: ${file}" >&2
    return 1
  fi
  if [[ "$DRY_RUN" == "1" ]]; then
    printf 'DRY RUN: paperclipai agent instructions-file:put --agent %q --path %q --file %q\n' "$slug" "$dest" "$file"

=== attach-manifests.sh lines 1-90 (how PKM_HEALTH / EXPECTED_* are set) ===
#!/usr/bin/env bash
set -euo pipefail

DRY_RUN=1
if [[ "${1:-}" == "--apply" ]]; then
  DRY_RUN=0
elif [[ "${1:-}" == "--dry-run" || "${1:-}" == "" ]]; then
  DRY_RUN=1
else
  echo "usage: $0 [--dry-run|--apply]" >&2
  exit 2
fi

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
EXPECTED_COMPANY_ID="7d58fc13-7c9a-4c87-b9f8-a7cfae8564a9"
EXPECTED_AGENT_COUNT=62
EXPECTED_ASSIGNMENT_AGENT_COUNT=62
PKM_HEALTH="degraded"
APPROVAL_TOKEN_REQUIRED="APPROVE-AIN-47-PHASE-E"
HASH_MANIFEST="$ROOT/attach-manifests.sha256"
READBACK_DIR="$ROOT/attach-readback"
EXPECTED_SLUGS=(
  "adtech_trend_radar"
  "agentops_director"
  "agentops_inspector"
  "api_backend_engineer"
  "assessment_rubric_designer"
  "audio_tts_producer"
  "auth_identity_engineer"
  "cco"
  "cdpo"
  "cgo"
  "chief_of_staff"
  "cloudflare_runtime_engineer"
  "cmo"
  "code_reviewer"
  "compliance_eu_gdpr"
  "compliance_us_state"
  "concierge"
  "cplo"
  "cspo"
  "cto_platform_architect"
  "curriculum_architect"
  "data_ingestion_engineer"
  "data_protection_officer"
  "dataset_provenance_steward"
  "documentation_engineer"
  "editorial_critic"
  "email_substack_strategist"
  "embeddings_retrieval_engineer"
  "evaluation_judge"
  "evidence_synthesizer"
  "frontend_engineer"
  "incident_commander"
  "landing_offer_strategist"
  "learner_experience_architect"
  "media_engine_producer"
  "mission_control"
  "mobile_app_lead_architect"
  "mobile_product_designer_ux_researcher"
  "payments_entitlements_engineer"
  "pkm_bridge"
  "policy_terms_drafter"
  "privacy_consent_steward"
  "product_analytics_interpreter"
  "qa_automation_engineer"
  "react_native_expo_engineer"
  "release_marshal"
  "render_pipeline_engineer"
  "research_scout"
  "ri_director"
  "role_ontology_engineer"
  "routine_operator"
  "runtime_operator"
  "scriptwriter_explainer"
  "secrets_access_steward"
  "security_reviewer"
  "seo_aio_visibility"
  "skills_architect"
  "social_content_strategist"
  "social_repurposer"
  "supply_chain_auditor"
  "vds_workshop_foreman"
  "workflow_designer"
)

echo "Staged attach script for founder-approved use only."
echo "Codex adapters: no CLAUDE.md writes; use instructions-file:put only."
echo "dry_run=${DRY_RUN}"
echo "pkm_health=${PKM_HEALTH}"

=== PKM brain-health (the real condition behind the gate) ===
(brain-health did not return json; trying text)

=== paperclipai roster JSON shape (slug vs urlKey vs id + paused) ===
count: 62
keys: ['adapterConfig', 'adapterType', 'budgetMonthlyCents', 'capabilities', 'companyId', 'createdAt', 'defaultEnvironmentId', 'icon', 'id', 'lastHeartbeatAt', 'metadata', 'name', 'orgChainHealth', 'pauseReason', 'pausedAt', 'permissions', 'reportsTo', 'role', 'runtimeConfig', 'spentMonthlyCents', 'status', 'title', 'updatedAt', 'urlKey']
{'slug': None, 'urlKey': 'calibrator', 'id': 'b74f5dd3-403d-43c3-ab4c-fd2117723060', 'uuid': None, 'name': 'Calibrator', 'status': 'paused', 'paused': None}
{'slug': None, 'urlKey': 'jared', 'id': 'a873590c-2166-4054-9dad-329e17d2c889', 'uuid': None, 'name': 'Jared', 'status': 'paused', 'paused': None}
{'slug': None, 'urlKey': 'laurie', 'id': 'af273e31-0f40-4a91-b635-09a11534f5aa', 'uuid': None, 'name': 'Laurie', 'status': 'idle', 'paused': None}

File created successfully at: /Users/Ali/PKM/scratch/pkm-deepdive/finch_roster_map.py (file state is current in your context — no need to Read it back)

=== PKM brain-health (definitive — is it healthy for the gate?) ===

=== test the live-roster → Finch-slug mapping (62/62 clean?) ===
finch manifests: 62 slugs
live roster: 62 agents
MATCHED: 57/62   UNMATCHED live: 5   MISSING finch slugs: 5
-- unmatched live agents --
   {'urlKey': 'rambo', 'name': 'Rambo', 'title': 'Incident Commander (run-mode)', 'slug': None}
   {'urlKey': 'root', 'name': 'Root', 'title': 'VDS Workshop Foreman', 'slug': None}
   {'urlKey': 'the-machine', 'name': 'The Machine', 'title': 'Routine Operator', 'slug': None}
   {'urlKey': 'silva', 'name': 'Silva', 'title': 'Warden — Security Reviewer', 'slug': None}
   {'urlKey': 'gimli', 'name': 'Gimli', 'title': 'Adversary — Code Reviewer', 'slug': None}
-- finch slugs with no live match --
   ['code_reviewer', 'incident_commander', 'routine_operator', 'security_reviewer', 'vds_workshop_foreman']
all matched paused/heartbeat-off: True
wrote /tmp/live_roster.json
RESULT: NEEDS_REVIEW

The file /Users/Ali/PKM/scratch/pkm-deepdive/finch_roster_map.py has been updated successfully. (file state is current in your context — no need to Read it back)

=== definitive PKM brain-health (raw, first 45 lines) ===
bash: line 1: cd: /home/ali/PKM-monorepo/pkm-agent: No such file or directory

=== finalized roster mapping (expect CLEAN_62) ===
finch manifests: 62 slugs
live roster: 62 agents
MATCHED: 62/62   UNMATCHED live: 0   MISSING finch slugs: 0
all matched paused/heartbeat-off: True
wrote /tmp/live_roster.json
RESULT: CLEAN_62

=== locate VDS pkm-agent + run brain-health ===
/usr/local/bin/pkm-agent
lrwxrwxrwx 1 root root 30 Jun  5 05:07 /usr/local/bin/pkm-agent -> /home/ali/.local/bin/pkm-agent
Error: brain health script did not return JSON
Error: brain health script did not return JSON