diff --git a/contract-registry.yaml b/contract-registry.yaml
new file mode 100644
index 0000000..6798601
--- /dev/null
+++ b/contract-registry.yaml
@@ -0,0 +1,1463 @@
+# Contract Registry — OpenProse Enforcement Index
+#
+# Maps every prose contract to its enforcement category, trigger mechanism,
+# dependencies, postconditions, and escalation rules.
+#
+# Schema reference: ~/.hermes/contract-registry.md
+#
+# Last updated: 2026-07-13
+
+registry_version: "0.1.0"
+last_updated: "2026-07-13T00:00:00Z"
+updated_by: mumuni
+
+categories:
+  - compliance
+  - monitoring
+  - remediation
+  - build_deploy
+  - maintenance
+  - reference
+
+sensitivity_levels:
+  - critical
+  - high
+  - normal
+  - retired
+
+contracts:
+
+  # ─── COMPLIANCE ───────────────────────────────────────────────
+
+  - name: hermes-key-enforcement
+    file: hermes-key-enforcement.prose.md
+    kind: enforcement
+    category: compliance
+    sensitivity: critical
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: scheduled
+      cadence: "0 6 * * *"
+      description: "Daily compliance scan at 6am ET"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 300
+      requires: []
+      protocol:
+        - "Load contract from prose-contracts/main"
+        - "Verify prerequisites: config.yaml readable, harness/litellm sections present"
+        - "Execute enforcement: grep config for plaintext keys"
+        - "On failure: stop, don't hallucinate forward"
+        - "Log actions to ~/.hermes/runs/hermes-key-enforcement/"
+    verification:
+      postconditions:
+        - check: "no plaintext API keys in config"
+          verify: "grep -rc 'api_key: sk-' /root/.hermes/config.yaml"
+          expect: "0 matches"
+        - check: "api_key_env used for harness/litellm providers"
+          verify: "grep -c 'api_key_env.*LITELLM_API_KEY' /root/.hermes/config.yaml"
+          expect: "count > 0"
+      artifact: "before/after verification report"
+      verify_commands:
+        - "grep -rc 'api_key: sk-' /root/.hermes/config.yaml"
+        - "grep -c 'api_key_env.*LITELLM_API_KEY' /root/.hermes/config.yaml"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/hermes-key-enforcement/"
+      graph_node: true
+      schema:
+        contract: string
+        run_id: string
+        timestamp: ISO 8601
+        agent: string
+        status: pass|fail|escalated
+        actions_taken: array
+        postconditions: array
+        drift_alerts: array
+        evidence_path: string
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba"]
+      critical:
+        action: "relay_alert + pause"
+        notify: ["abiba", "mumuni"]
+      fatal:
+        action: "relay_alert + pause + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 3
+      window: 3600
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: hermes-config-template
+    file: hermes-config-template.prose.md
+    kind: template
+    category: compliance
+    sensitivity: high
+    status: active
+    owner: abiba
+    version: 2.1.0
+    trigger:
+      type: scheduled
+      cadence: "0 4 * * 1"
+      description: "Weekly config drift check Monday at 4am ET"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 300
+      requires: []
+    verification:
+      postconditions:
+        - check: "all agent configs match template version"
+          verify: "diff <(grep template_version config.yaml) <(grep template_version /root/prose-contracts/hermes-config-template.prose.md)"
+          expect: "no diff"
+      artifact: "config drift report"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/hermes-config-template/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba"]
+      critical:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      fatal:
+        action: "relay_alert + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 3
+      window: 3600
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: hermes-agent-baseline
+    file: hermes-agent-baseline.prose.md
+    kind: template
+    category: compliance
+    sensitivity: normal
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: scheduled
+      cadence: "0 5 * * 1"
+      description: "Weekly baseline verification Monday at 5am ET"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 300
+      requires: []
+    verification:
+      postconditions: []
+      artifact: "baseline drift report"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/hermes-agent-baseline/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba"]
+      critical:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      fatal:
+        action: "relay_alert + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 3
+      window: 3600
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  # ─── MONITORING ──────────────────────────────────────────────
+
+  - name: proxmox-monitor
+    file: proxmox-monitor.prose.md
+    kind: responsibility
+    category: monitoring
+    sensitivity: critical
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: scheduled
+      cadence: "*/15 * * * *"
+      description: "Every 15 minutes"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 120
+      requires: []
+      protocol:
+        - "Load contract from prose-contracts/main"
+        - "Verify connectivity to all Proxmox nodes"
+        - "Execute monitoring checks per contract"
+        - "Log intermediate state"
+        - "On failure: stop, don't hallucinate"
+    verification:
+      postconditions:
+        - check: "all Proxmox nodes reachable"
+          verify: "curl -sf http://<pve-api>/status | jq '.status'"
+          expect: "healthy"
+        - check: "no VMs in crashed state"
+          verify: "pvesh get /nodes -output-format=json | jq '.[] | select(.status==\"Crashed\")'"
+          expect: "empty"
+        - check: "backups running on schedule"
+          verify: "pbs-info --check"
+          expect: "last_backup < 24h ago"
+      artifact: "cluster health snapshot"
+      verify_commands:
+        - "curl -sf http://<pve-api>/status | jq '.status'"
+        - "pvesh get /nodes -output-format=json"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/proxmox-monitor/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      critical:
+        action: "relay_alert + trigger_remediation"
+        notify: ["abiba", "mumuni"]
+        triggers: ["disk-gc-threat-response"]
+      fatal:
+        action: "relay_alert + pause + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 3
+      window: 3600
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: gpu-monitor
+    file: gpu-monitor.prose.md
+    kind: responsibility
+    category: monitoring
+    sensitivity: critical
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: scheduled
+      cadence: "*/15 * * * *"
+      description: "Every 15 minutes — polls all GPU subsystems"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 120
+      requires: []
+    verification:
+      postconditions:
+        - check: "GPU metrics accessible"
+          verify: "curl -sf http://localhost:9100/gpu-data"
+          expect: "200 OK, populated data"
+        - check: "dashboard serving"
+          verify: "curl -sf http://localhost:9100/gpu-fleet.html"
+          expect: "200 OK, HTML returned"
+        - check: "health endpoint responsive"
+          verify: "curl -sf http://localhost:9100/health"
+          expect: "200 OK"
+      artifact: "GPU fleet snapshot"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/gpu-monitor/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      critical:
+        action: "relay_alert + trigger_remediation"
+        notify: ["abiba", "mumuni"]
+        triggers: ["gpu-fleet"]
+      fatal:
+        action: "relay_alert + pause + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 3
+      window: 3600
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: infrastructure-monitoring
+    file: infrastructure-monitoring.prose.md
+    kind: function
+    category: monitoring
+    sensitivity: high
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: scheduled
+      cadence: "*/30 * * * *"
+      description: "Every 30 minutes"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 180
+      requires: []
+    verification:
+      postconditions:
+        - check: "all services reachable"
+          verify: "curl -sf http://<service-endpoints>"
+          expect: "200 OK for all"
+      artifact: "infrastructure health report"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/infrastructure-monitoring/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      critical:
+        action: "relay_alert + trigger_remediation"
+        notify: ["abiba", "mumuni"]
+        triggers: ["litellm-health"]
+      fatal:
+        action: "relay_alert + pause + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 3
+      window: 3600
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: zulip-health
+    file: zulip-health.prose.md
+    kind: responsibility
+    category: monitoring
+    sensitivity: high
+    status: active
+    owner: abiba
+    version: 3.0.0
+    trigger:
+      type: scheduled
+      cadence: "*/15 * * * *"
+      description: "Every 15 minutes — monitors all Zulip-connected agents"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 120
+      requires:
+        - "Zulip API key for abiba-bot@chat.sysloggh.net"
+        - "SSH access to all Hermes agents"
+    verification:
+      postconditions:
+        - check: "bot registration active"
+          verify: "curl -sf https://chat.sysloggh.net/api/v1/me | jq '.user_id'"
+          expect: "bot_id present"
+        - check: "DM delivery working"
+          verify: "send test DM to each agent"
+          expect: "message delivered within 5s"
+      artifact: "Zulip mesh health report"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/zulip-health/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      critical:
+        action: "relay_alert + trigger_remediation"
+        notify: ["abiba", "mumuni"]
+        triggers: ["hermes-zulip-restore"]
+      fatal:
+        action: "relay_alert + pause + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 3
+      window: 3600
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: litellm-health
+    file: litellm-health.prose.md
+    kind: function
+    category: monitoring
+    sensitivity: critical
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: scheduled
+      cadence: "*/10 * * * *"
+      description: "Every 10 minutes — LiteLLM proxy health"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 60
+      requires: []
+    verification:
+      postconditions:
+        - check: "LiteLLM proxy reachable"
+          verify: "curl -sf http://192.168.68.116/litellm/v1/models"
+          expect: "200 OK, models returned"
+        - check: "router deprecated, nginx routes work"
+          verify: "curl -sf https://litellm.sysloggh.net/v1/models"
+          expect: "200 OK (via nginx)"
+      artifact: "LiteLLM health snapshot"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/litellm-health/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      critical:
+        action: "relay_alert + trigger_remediation"
+        notify: ["abiba", "mumuni"]
+        triggers: ["litellm-self-heal"]
+      fatal:
+        action: "relay_alert + pause + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 3
+      window: 3600
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  # ─── REMEDIATION ────────────────────────────────────────────
+
+  - name: litellm-self-heal
+    file: litellm-self-heal.prose.md
+    kind: responsibility
+    category: remediation
+    sensitivity: critical
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: event_driven
+      description: "Triggered by relay message from litellm-health or infrastructure-monitoring"
+      relay_message_type: "remediation:litellm-self-heal"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 600
+      requires:
+        - "Relay message with failure details from monitoring contract"
+    verification:
+      postconditions:
+        - check: "LiteLLM proxy responding"
+          verify: "curl -sf http://192.168.68.116/litellm/v1/models"
+          expect: "200 OK"
+      artifact: "self-heal run report"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/litellm-self-heal/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      critical:
+        action: "relay_alert + pause"
+        notify: ["abiba", "mumuni"]
+      fatal:
+        action: "relay_alert + pause + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 3
+      window: 3600
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: pm2-self-heal
+    file: pm2-self-heal.prose.md
+    kind: responsibility
+    category: remediation
+    sensitivity: high
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: event_driven
+      description: "Triggered by relay message when PM2 process crashes"
+      relay_message_type: "remediation:pm2-self-heal"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 300
+      requires:
+        - "Relay message with process name and failure details"
+    verification:
+      postconditions:
+        - check: "PM2 process running"
+          verify: "pm2 list | grep <process_name>"
+          expect: "online"
+      artifact: "self-heal run report"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/pm2-self-heal/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba"]
+      critical:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      fatal:
+        action: "relay_alert + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 3
+      window: 3600
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: disk-gc-threat-response
+    file: disk-gc-threat-response.prose.md
+    kind: responsibility
+    category: remediation
+    sensitivity: critical
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: event_driven
+      description: "Triggered by relay message from proxmox-monitor when disk >80%"
+      relay_message_type: "remediation:disk-gc-threat-response"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 900
+      requires:
+        - "Relay message with target CT/host and current disk usage"
+      protocol:
+        - "Load contract from prose-contracts/main"
+        - "Verify target node reachable"
+        - "Run garbage collection per contract SOP"
+        - "Verify disk usage reduced"
+    verification:
+      postconditions:
+        - check: "disk usage below 80%"
+          verify: "df -h <target>"
+          expect: "<80%"
+        - check: "no critical services stopped"
+          verify: "ps aux | grep <critical_services>"
+          expect: "all running"
+      artifact: "GC run report with reclaimed space"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/disk-gc-threat-response/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      critical:
+        action: "relay_alert + pause"
+        notify: ["abiba", "mumuni"]
+      fatal:
+        action: "relay_alert + pause + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 3
+      window: 3600
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: hermes-zulip-restore
+    file: hermes-zulip-restore.prose.md
+    kind: function
+    category: remediation
+    sensitivity: high
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: event_driven
+      description: "Triggered by relay message from zulip-health when bot registration fails"
+      relay_message_type: "remediation:hermes-zulip-restore"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 600
+      requires:
+        - "Relay message with failure details"
+    verification:
+      postconditions:
+        - check: "Zulip bot registration active"
+          verify: "curl -sf https://chat.sysloggh.net/api/v1/me | jq '.user_id'"
+          expect: "bot_id present"
+        - check: "DM delivery working"
+          verify: "send test DM"
+          expect: "message delivered"
+      artifact: "restore run report"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/hermes-zulip-restore/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      critical:
+        action: "relay_alert + pause"
+        notify: ["abiba", "mumuni"]
+      fatal:
+        action: "relay_alert + pause + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 3
+      window: 3600
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  # ─── BUILD/DEPLOY ───────────────────────────────────────────
+
+  - name: hermes-zulip-plugin
+    file: hermes-zulip-plugin.prose.md
+    kind: function
+    category: build_deploy
+    sensitivity: high
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: on_demand
+      description: "Manual or change request to update Zulip plugin"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 1800
+      requires: []
+    verification:
+      postconditions:
+        - check: "3 adapter files present"
+          verify: "ls -la /usr/local/lib/hermes-agent/plugins/platforms/zulip/"
+          expect: "3 files"
+        - check: "gateway connected"
+          verify: "ps aux | grep hermes"
+          expect: "zulip connected"
+      artifact: "deploy verification report"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/hermes-zulip-plugin/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba"]
+      critical:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      fatal:
+        action: "relay_alert + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 1
+      window: 7200
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: build-zulip-plugin
+    file: build-zulip-plugin.prose.md
+    kind: responsibility
+    category: build_deploy
+    sensitivity: high
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: on_demand
+      description: "Generate or improve Zulip plugin via iterative refinement"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 3600
+      requires: []
+    verification:
+      postconditions:
+        - check: "plugin builds without errors"
+          verify: "npm install && npm run build"
+          expect: "0 errors"
+        - check: "connectivity tests pass"
+          verify: "run plugin selftest"
+          expect: "all checks green"
+      artifact: "plugin version artifact"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/build-zulip-plugin/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba"]
+      critical:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      fatal:
+        action: "relay_alert + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 1
+      window: 7200
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: stirling-pdf-agent-access
+    file: stirling-pdf-agent-access.prose.md
+    kind: function
+    category: build_deploy
+    sensitivity: normal
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: on_demand
+      description: "Grant agent access to Stirling PDF"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 300
+      requires: []
+    verification:
+      postconditions:
+        - check: "agent can access Stirling PDF"
+          verify: "curl -sf https://stirling.sysloggh.net"
+          expect: "200 OK"
+      artifact: "access verification report"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/stirling-pdf-agent-access/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba"]
+      critical:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      fatal:
+        action: "relay_alert + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 1
+      window: 7200
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  # ─── MAINTENANCE ────────────────────────────────────────────
+
+  - name: memory-audit-maintenance
+    file: memory-audit-maintenance.prose.md
+    kind: responsibility
+    category: maintenance
+    sensitivity: normal
+    status: active
+    owner: mumuni
+    version: 1.0.0
+    trigger:
+      type: scheduled
+      cadence: "0 3 * * *"
+      description: "Daily at 3am ET"
+      cron_job_id: null
+    execution:
+      agent: mumuni
+      timeout: 600
+      requires: []
+      protocol:
+        - "Load contract from prose-contracts/main"
+        - "Verify prerequisites: memory files accessible"
+        - "Execute memory audit per contract SOP"
+        - "Log actions to ~/.hermes/runs/memory-audit-maintenance/"
+    verification:
+      postconditions:
+        - check: "memory files below 80% capacity"
+          verify: "wc -l ~/.hermes/memories/*.md"
+          expect: "total lines < threshold"
+        - check: "no stale entries"
+          verify: "grep -r 'STALE' ~/.hermes/memories/"
+          expect: "0 matches"
+      artifact: "memory audit report"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/memory-audit-maintenance/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["mumuni"]
+      critical:
+        action: "relay_alert"
+        notify: ["mumuni", "abiba"]
+      fatal:
+        action: "relay_alert + human_required"
+        notify: ["mumuni", "abiba", "kwame"]
+    circuit_breaker:
+      max_retries: 3
+      window: 3600
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: gpu-fleet
+    file: gpu-fleet.prose.md
+    kind: responsibility
+    category: maintenance
+    sensitivity: critical
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: event_driven
+      description: "Triggered on model add/remove, GPU health degradation, agent key rotation"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 1800
+      requires: []
+    verification:
+      postconditions:
+        - check: "all GPUs reported to LiteLLM"
+          verify: "curl -sf http://192.168.68.116/litellm/v1/models | jq '.data | length'"
+          expect: "count matches expected"
+        - check: "router deprecated"
+          verify: "check nginx routes"
+          expect: "no /v1/ prefix routes"
+      artifact: "GPU fleet status report"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/gpu-fleet/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      critical:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      fatal:
+        action: "relay_alert + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 3
+      window: 3600
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: infrastructure-update
+    file: infrastructure-update.prose.md
+    kind: responsibility
+    category: maintenance
+    sensitivity: high
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: scheduled
+      cadence: "0 2 * * 0"
+      description: "Weekly system updates Sunday at 2am ET"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 3600
+      requires: []
+    verification:
+      postconditions:
+        - check: "all services running after update"
+          verify: "systemctl list-units --state=running"
+          expect: "all critical services"
+      artifact: "update report with changelog"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/infrastructure-update/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba"]
+      critical:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      fatal:
+        action: "relay_alert + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 1
+      window: 7200
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  # ─── REFERENCE / PATTERN ────────────────────────────────────
+
+  - name: infrastructure-control
+    file: infrastructure-control.prose.md
+    kind: pattern
+    category: reference
+    sensitivity: critical
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: passive
+      description: "Loaded on-demand by executing agents as source of truth"
+      cron_job_id: null
+    execution:
+      agent: none
+      timeout: 0
+      requires: []
+    verification:
+      postconditions: []
+      artifact: none
+    receipt:
+      format: none
+      storage: none
+      graph_node: false
+    escalation:
+      info:
+        action: "none"
+        notify: []
+      warning:
+        action: "none"
+        notify: []
+      critical:
+        action: "none"
+        notify: []
+      fatal:
+        action: "none"
+        notify: []
+    circuit_breaker:
+      max_retries: 0
+      window: 0
+      trip_action: none
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: ra-h-os-custodianship-contract
+    file: ra-h-os-custodianship-contract.prose.md
+    kind: pattern
+    category: reference
+    sensitivity: high
+    status: active
+    owner: mumuni
+    version: 1.0.0
+    trigger:
+      type: passive
+      description: "Loaded on-demand by agents needing RA-H OS guidance"
+      cron_job_id: null
+    execution:
+      agent: none
+      timeout: 0
+      requires: []
+    verification:
+      postconditions: []
+      artifact: none
+    receipt:
+      format: none
+      storage: none
+      graph_node: false
+    escalation:
+      info:
+        action: "none"
+        notify: []
+      warning:
+        action: "none"
+        notify: []
+      critical:
+        action: "none"
+        notify: []
+      fatal:
+        action: "none"
+        notify: []
+    circuit_breaker:
+      max_retries: 0
+      window: 0
+      trip_action: none
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: mumuni-delegation
+    file: mumuni-delegation-prose-contract.prose.md
+    kind: pattern
+    category: reference
+    sensitivity: high
+    status: active
+    owner: mumuni
+    version: 1.0.0
+    trigger:
+      type: passive
+      description: "Loaded by Mumuni when delegating tasks"
+      cron_job_id: null
+    execution:
+      agent: none
+      timeout: 0
+      requires: []
+    verification:
+      postconditions: []
+      artifact: none
+    receipt:
+      format: none
+      storage: none
+      graph_node: false
+    escalation:
+      info:
+        action: "none"
+        notify: []
+      warning:
+        action: "none"
+        notify: []
+      critical:
+        action: "none"
+        notify: []
+      fatal:
+        action: "none"
+        notify: []
+    circuit_breaker:
+      max_retries: 0
+      window: 0
+      trip_action: none
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: zulip-adapter-lessons
+    file: zulip-adapter-lessons.prose.md
+    kind: pattern
+    category: reference
+    sensitivity: retired
+    status: historical
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: passive
+      description: "Historical reference — pi Zulip extension retired 2026-07-04"
+      cron_job_id: null
+    execution:
+      agent: none
+      timeout: 0
+      requires: []
+    verification:
+      postconditions: []
+      artifact: none
+    receipt:
+      format: none
+      storage: none
+      graph_node: false
+    escalation:
+      info:
+        action: "none"
+        notify: []
+      warning:
+        action: "none"
+        notify: []
+      critical:
+        action: "none"
+        notify: []
+      fatal:
+        action: "none"
+        notify: []
+    circuit_breaker:
+      max_retries: 0
+      window: 0
+      trip_action: none
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: pi-approval-architecture
+    file: pi-approval-architecture.prose.md
+    kind: architecture
+    category: reference
+    sensitivity: retired
+    status: historical
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: passive
+      description: "Historical reference — pi Zulip extension retired"
+      cron_job_id: null
+    execution:
+      agent: none
+      timeout: 0
+      requires: []
+    verification:
+      postconditions: []
+      artifact: none
+    receipt:
+      format: none
+      storage: none
+      graph_node: false
+    escalation:
+      info:
+        action: "none"
+        notify: []
+      warning:
+        action: "none"
+        notify: []
+      critical:
+        action: "none"
+        notify: []
+      fatal:
+        action: "none"
+        notify: []
+    circuit_breaker:
+      max_retries: 0
+      window: 0
+      trip_action: none
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: zulip-approval-fix
+    file: zulip-approval-fix.prose.md
+    kind: responsibility
+    category: reference
+    sensitivity: normal
+    status: active
+    owner: abiba
+    version: 2.0.0
+    trigger:
+      type: passive
+      description: "Loaded on-demand when /approve or /deny commands fail"
+      cron_job_id: null
+    execution:
+      agent: none
+      timeout: 0
+      requires: []
+    verification:
+      postconditions: []
+      artifact: none
+    receipt:
+      format: none
+      storage: none
+      graph_node: false
+    escalation:
+      info:
+        action: "none"
+        notify: []
+      warning:
+        action: "none"
+        notify: []
+      critical:
+        action: "none"
+        notify: []
+      fatal:
+        action: "none"
+        notify: []
+    circuit_breaker:
+      max_retries: 0
+      window: 0
+      trip_action: none
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: zulip-oidc-redirect-fix
+    file: zulip-oidc-redirect-fix.prose.md
+    kind: responsibility
+    category: reference
+    sensitivity: normal
+    status: active
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: event_driven
+      description: "Triggered when Zulip OIDC login returns redirect URI error"
+      cron_job_id: null
+    execution:
+      agent: abiba
+      timeout: 300
+      requires: []
+    verification:
+      postconditions:
+        - check: "OIDC redirect uses public domain"
+          verify: "grep redirect_uri /opt/zulip/zulip_env.py"
+          expect: "chat.sysloggh.net"
+      artifact: "fix verification report"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/zulip-oidc-redirect-fix/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: ["abiba"]
+      critical:
+        action: "relay_alert"
+        notify: ["abiba", "mumuni"]
+      fatal:
+        action: "relay_alert + human_required"
+        notify: ["abiba", "mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 1
+      window: 7200
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  # ─── RETIRED ────────────────────────────────────────────────
+
+  - name: zulip-mention-reliability
+    file: zulip-mention-reliability.prose.md
+    kind: responsibility
+    category: retired
+    sensitivity: retired
+    status: retired
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: none
+      description: "Retired 2026-07-04 — pi Zulip extension decommissioned"
+      cron_job_id: null
+    execution:
+      agent: none
+      timeout: 0
+      requires: []
+    verification:
+      postconditions: []
+      artifact: none
+    receipt:
+      format: none
+      storage: none
+      graph_node: false
+    escalation:
+      info:
+        action: "none"
+        notify: []
+      warning:
+        action: "none"
+        notify: []
+      critical:
+        action: "none"
+        notify: []
+      fatal:
+        action: "none"
+        notify: []
+    circuit_breaker:
+      max_retries: 0
+      window: 0
+      trip_action: none
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  - name: zulip-self-heal
+    file: zulip-self-heal.prose.md
+    kind: responsibility
+    category: retired
+    sensitivity: retired
+    status: retired
+    owner: abiba
+    version: 1.0.0
+    trigger:
+      type: none
+      description: "Retired 2026-07-04 — pi Zulip extension decommissioned"
+      cron_job_id: null
+    execution:
+      agent: none
+      timeout: 0
+      requires: []
+    verification:
+      postconditions: []
+      artifact: none
+    receipt:
+      format: none
+      storage: none
+      graph_node: false
+    escalation:
+      info:
+        action: "none"
+        notify: []
+      warning:
+        action: "none"
+        notify: []
+      critical:
+        action: "none"
+        notify: []
+      fatal:
+        action: "none"
+        notify: []
+    circuit_breaker:
+      max_retries: 0
+      window: 0
+      trip_action: none
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []
+
+  # ─── HELPER / TEST ──────────────────────────────────────────
+
+  - name: hello-world
+    file: hello-world.prose.md
+    kind: function
+    category: reference
+    sensitivity: normal
+    status: active
+    owner: kwame
+    version: 1.0.0
+    trigger:
+      type: on_demand
+      description: "Test contract for OpenProse on pi"
+      cron_job_id: null
+    execution:
+      agent: kwame
+      timeout: 60
+      requires: []
+    verification:
+      postconditions:
+        - check: "greeting returned"
+          verify: "contract output contains 'Hello'"
+          expect: "pass"
+      artifact: "greeting output"
+    receipt:
+      format: json
+      storage: "~/.hermes/runs/hello-world/"
+      graph_node: true
+    escalation:
+      info:
+        action: "log_to_receipt"
+        notify: []
+      warning:
+        action: "relay_alert"
+        notify: []
+      critical:
+        action: "relay_alert"
+        notify: ["mumuni"]
+      fatal:
+        action: "relay_alert + human_required"
+        notify: ["mumuni", "kwame"]
+    circuit_breaker:
+      max_retries: 3
+      window: 3600
+      trip_action: escalate_to_fatal
+    depends_on: []
+    last_run: null
+    last_status: null
+    drift_alerts: []