feat: hermes-bsd source snapshot + zot harness + telegram token

- Stage hermes-bsd as shallow clone in /home/clawdie/ai/ (next to colibri/zot)
- Switch default harness from pi to zot (COLIBRI_PI_BINARY=zot)
- Add TELEGRAM_BOT_TOKEN placeholder to provider.env and sample
- Removes stale zot-rpc-driver blocker comment (colibri#143 resolved)

build.sh

@@ -1288,6 +1288,9 @@ branch, commit, modified state, ISO version, and build channel at image build ti
 clawdie-ai (TypeScript) is no longer included — it is being phased out in favor
 of the colibri (Rust) control plane. The `clawdie` name is retained as the brand
 and bare-metal installer identity.
+
+hermes-bsd (Python) is the agent CLI and gateway — powers the Telegram bot,
+agent-to-agent relay, and the operator's primary chat interface.
 EOF
     seed_live_ai_source_repo "${SCRIPT_DIR}" "clawdie-iso"
     seed_live_ai_source_repo "${_resolved_colibri_repo}" "colibri"
@@ -1295,6 +1298,9 @@ EOF
     # just Colibri (Rust). Skipped automatically if the zot checkout is absent.
     resolve_zot_paths
     seed_live_ai_source_repo "${_resolved_zot_repo}" "zot"
+    # Hermes Agent source — the agent CLI + gateway for Telegram bot and
+    # agent-to-agent relay. Skipped silently if the checkout is absent.
+    seed_live_ai_source_repo "${HERMES_REPO:-/home/clawdie/ai/hermes-bsd}" "hermes-bsd"
     chroot "${MOUNT_POINT}" chown -R clawdie:clawdie /home/clawdie/ai
 }
 

scripts/stage-colibri-iso.sh

@@ -113,10 +113,17 @@ cat > "${ETC_DIR}/provider.env" <<'EOF'
 VAULT_SERVER="https://vault.smilepowered.org"
 BW_SERVER="https://vault.smilepowered.org"
 
-# Auto-spawn one Pi agent on daemon startup once a DeepSeek key is present
+# Auto-spawn one zot agent on daemon startup once a DeepSeek key is present
 # (the Operator Image OOTB flow). The daemon sources this file, so the spawned
-# Pi inherits the provider keys set here.
+# agent inherits the provider keys set here.
 COLIBRI_AUTOSPAWN_PI="YES"
+# zot is the default harness — pi is available but zot has richer provider
+# support (DeepSeek native, OpenRouter, ~25 providers) and a built-in
+# Telegram bot mode. Set COLIBRI_PI_BINARY=pi to switch back.
+COLIBRI_PI_BINARY="zot"
+# Telegram bot token — set this to enable the bot channel (@your_bot).
+# Leave blank to use CLI/TUI/Dashboard channels only.
+# TELEGRAM_BOT_TOKEN=""
 EOF
 chmod 0600 "${ETC_DIR}/provider.env" 2>/dev/null || true
 
@@ -155,16 +162,14 @@ BW_SERVER="https://vault.smilepowered.org"
 # DEEPSEEK_ENDPOINT="https://api.deepseek.com/chat/completions"
 # DEEPSEEK_MODEL="deepseek-v4-pro"
 #
+# Telegram bot (optional):
+# TELEGRAM_BOT_TOKEN="123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11"
+#
 # Behavior toggles (non-secret):
-# COLIBRI_AUTOSPAWN_PI="YES"            # auto-spawn one Pi on daemon startup
-# COLIBRI_PI_BINARY="pi"               # Pi executable name/path; zot is staged on
-#                                      # the image but needs the zot-rpc driver
-#                                      # before it can autospawn (spawner uses
-#                                      # stdin(Stdio::null()) — zot needs stdin).
-#                                      # See: ADR-agent-harness-consolidation.md
-#                                      # + colibri#143 (zot-rpc-driver).
-# COLIBRI_AUTOSPAWN_PI_ARGS="--mode json"   # Pi argv
-# COLIBRI_MCP_EXTERNAL_CALL="1"        # allow Pi (via colibri-mcp) to call
+# COLIBRI_AUTOSPAWN_PI="YES"            # auto-spawn one agent on daemon startup
+# COLIBRI_PI_BINARY="zot"              # agent harness: zot (default) | pi
+# COLIBRI_AUTOSPAWN_PI_ARGS="--mode json"   # agent argv
+# COLIBRI_MCP_EXTERNAL_CALL="1"        # allow agent (via colibri-mcp) to call
 #                                      # external MCP servers; set by
 #                                      # clawdie-enable-mother
 EOF