maintenance(harness): [WR-18897] Local AI coding harness (Ollama + Hermes + rs-agents)

.claude/agent-memory/rs-agents-code-reviewer/MEMORY.md

@@ -0,0 +1,3 @@
+# Memory Index
+
+- [Hermes/MCP onboarding scripts — review notes](project_hermes_mcp_onboarding.md) — connect-hermes-mcp.sh conventions, daemon-down false-success pattern, docker mcp output formats

.claude/agent-memory/rs-agents-code-reviewer/project_hermes_mcp_onboarding.md

@@ -0,0 +1,19 @@
+---
+name: hermes-mcp-onboarding
+description: Review observations for onboarding_bin Hermes/MCP wiring scripts — conventions, a verified false-success edge case, and real docker mcp output shapes
+metadata:
+  type: project
+---
+
+Onboarding bash scripts in `onboarding_bin/` that wire Hermes Agent to the Docker MCP Toolkit gateway (WR-18897 branch).
+
+**Convention baseline** (all onboarding_bin scripts follow this): `set -euo pipefail`, `export PATH="$HOME/.local/bin:/opt/homebrew/bin:..."` for launchd, `bold()/step()/warn()` printf helpers, `--soft` semantics = missing prereq warns + exit 0 so the install never fails. Modeled on `mac-mini-agent/sync-rs-agents-to-hermes.sh`.
+
+**Verified bug pattern — daemon-down false success** (connect-hermes-mcp.sh): when `docker info` fails, `DAEMON_UP=0` and the live-verify block is skipped, but `VERIFY_OK` stays initialized to 1, so the script prints "✔ Hermes is connected" even though it earlier warned "Live verification is skipped." **Why:** `VERIFY_OK` is only ever set to 0 inside checks that are gated behind `DAEMON_UP=1`. **How to apply:** when reviewing verify-gate scripts, check that the summary/success message is gated on the same condition as the checks that would justify it.
+
+**docker mcp CLI output shapes (verified live 2026-07):**
+- `docker mcp oauth ls` → `name | authorized|not authorized` table; awk `-F'|' /not authorized/` is a safe filter (no false-positive from "authorized" rows).
+- `docker mcp profile show <p>` → server count = `grep -c '^    - type:'` (4-space indent); nested `snapshot.server.type:` lines are more deeply indented so they do NOT inflate the count. Cross-checks against `docker mcp profile server ls`.
+- `docker mcp profile server ls` → `PROFILE | TYPE | IDENTIFIER` table, all profiles at once.
+
+**Non-findings to NOT re-raise:** quoted heredoc `<<'PYEOF'` means MCP_PROFILE reaches Python as pure argv data (no injection); `|| true` after `grep -c` neutralizes pipefail-on-zero-match; `if not _save_mcp_server(...)` relies on a truthy return from a private Hermes API (nit at most).

.claude/settings.local.json

@@ -24,7 +24,62 @@
       "Bash(brew tap *)",
       "Bash(/opt/homebrew/bin/hermes --version)",
       "Read(//Users/andyb/.local/bin/**)",
-      "Read(//Users/andyb/.hermes/**)"
+      "Read(//Users/andyb/.hermes/**)",
+      "Bash(brew list *)",
+      "WebFetch(domain:hermes-agent.nousresearch.com)",
+      "Bash(hermes --help)",
+      "Bash(python3 -c \"import yaml,sys; d=yaml.safe_load\\(open\\('meta/configs/hermes.yml'\\)\\); print\\(yaml.dump\\(d\\)\\)\")",
+      "Bash(yamllint -d default meta/configs/hermes.yml)",
+      "Bash(yamllint meta/configs/homebrew_base.yml)",
+      "Bash(awk '{ if \\(length > 80\\) print FILENAME\":\"NR\": \"length\" cols\" }' meta/configs/homebrew_base.yml meta/configs/security.yml meta/configs/version_control.yml)",
+      "Bash(ruby -ryaml -e 'p YAML.load_file\\(\"meta/configs/hermes.yml\"\\)')",
+      "Bash(yamllint -f parsable .)",
+      "Bash(grep -oE '\\\\\\(\\(document-start|comments-indentation|[a-z-]+\\)\\\\\\)$')",
+      "Read(//Users/andyb/.claude/**)",
+      "Read(//Users/andyb/Retail-Success/repos/**)",
+      "Bash(scutil --get LocalHostName)",
+      "Bash(command -v hermes)",
+      "Bash(hermes --version)",
+      "Bash(command -v ollama)",
+      "Bash(ollama --version)",
+      "Bash(ollama list *)",
+      "Bash(hermes dashboard *)",
+      "Bash(lsof -nP -iTCP:9119 -sTCP:LISTEN)",
+      "Bash(hermes model *)",
+      "Bash(kill %1)",
+      "Bash(command -v devtunnel)",
+      "Bash(devtunnel list *)",
+      "Bash(ps -p 31628 -o pid,etime,command)",
+      "Bash(brew services *)",
+      "Bash(lsof -nP -iTCP:11434 -sTCP:LISTEN)",
+      "Bash(ollama show *)",
+      "Read(//Users/andyb/**)",
+      "Bash(OLLAMA_HOST=http://localhost:11434 ollama pull gemma3:4b)",
+      "Bash(ollama run *)",
+      "Bash(pkill -f \"ollama serve\")",
+      "Bash(export OLLAMA_FLASH_ATTENTION=1 OLLAMA_KV_CACHE_TYPE=q8_0 OLLAMA_CONTEXT_LENGTH=65536)",
+      "Bash(/opt/homebrew/bin/ollama serve *)",
+      "Bash(awk '{print} /Plugin discovery complete/{exit}')",
+      "Bash(ollama ps *)",
+      "Bash(sysctl -n vm.swapusage)",
+      "Bash(memory_pressure)",
+      "Bash(chmod +x mac-mini-agent/verify-ollama-hermes.sh)",
+      "Bash(break)",
+      "Bash(bash mac-mini-agent/verify-ollama-hermes.sh)",
+      "Bash(hermes skills *)",
+      "Bash(hermes plugins *)",
+      "Bash(bash -n mac-mini-agent/sync-rs-agents-to-hermes.sh)",
+      "Bash(bash -n onboarding_bin/install-hermes-agent.sh)",
+      "Bash(bash mac-mini-agent/sync-rs-agents-to-hermes.sh)",
+      "Bash(HOME=/tmp/nohome RS_AGENTS_SKILLS_SRC=/tmp/nonexistent bash mac-mini-agent/sync-rs-agents-to-hermes.sh --soft)",
+      "Bash(sed 's/\\\\x1b\\\\[[0-9;]*m//g')",
+      "Bash(hermes prompt-size *)",
+      "Bash(:)",
+      "Bash(launchctl start *)",
+      "Bash(sed 's/\\\\x1b\\\\[[0-9;]*m//g' /tmp/rs-agents-sync.out.log)",
+      "Bash(docker mcp *)",
+      "Bash(grep -iA2 profile)",
+      "Bash(docker info *)"
     ]
   }
 }

.yamllint.yml

@@ -1,9 +1,15 @@
 extends: default
-indentation: 2
-line-length: 120
 
+# NOTE: yamllint rules must live under `rules:`. `indentation`, `line-length`,
+# and `min-spaces-from-content` were previously at the top level / under the
+# wrong key, which made yamllint error out with "invalid config" on every file.
 rules:
-  min-spaces-from-content: 1
+  # Character-limit rule turned off — no maximum line length is enforced.
+  line-length: disable
+  indentation:
+    spaces: 2
+  comments:
+    min-spaces-from-content: 1
   truthy:
     check-keys: false
   document-start:
@@ -14,3 +20,7 @@ ignore: |
   /node_modules/*.yml
   /node_modules/*.yamllint
   /bin/
+  # Vendored dotbot submodules — third-party YAML, not ours to lint.
+  meta/dotbot/
+  meta/dotbot-brew/
+  meta/dotbot-vscode/

CLAUDE.md

@@ -15,7 +15,7 @@ Read this before editing anything — the flow spans several files:
    - `./install-standalone <config...>` — runs `meta/base.yml` then the named configs only. No brew plugin dir.
    - ⚠️ The README references `./install`; **that script does not exist**. Use the two above.
 
-2. **Profiles** — `meta/profiles/<name>` is a plain newline-delimited list of config names (no extension). Existing: `base`, `devops`, `react`, `ruby`. A profile = the ordered set of configs for a stack.
+2. **Profiles** — `meta/profiles/<name>` is a plain newline-delimited list of config names (no extension). Existing: `base`, `devops`, `react`, `ruby`, `ai`. A profile = the ordered set of configs for a stack. (`ai` runs the `hermes` config, which installs the Hermes Agent via its own first-party installer — `onboarding_bin/install-hermes-agent.sh` — *not* Homebrew, because Hermes self-updates via `hermes update`.)
 
 3. **Configs** — `meta/configs/<name>.yml` are dotbot directive files (`link`, `shell`, `clean`, and brew bundles). `meta/base.yml` always runs first (sets link defaults, inits submodules, cleans `~` / `~/.config`).
 

README.md

@@ -159,7 +159,7 @@ submodules are already declared in `.gitmodules` and are fetched automatically b
 `install-profile` (do NOT run `git submodule add` — it will error):
 
 ```bash
-./install-profile base        # then: ./install-profile react | ruby | devops
+./install-profile base        # then: ./install-profile react | ruby | devops | ai
 ```
 
 > If you hit Homebrew permission errors, fix ownership of the brew prefix with