feat: add Timmy Gemma4 Mac wiring helper (#543)

Merged by automated sweep after diff review and verification. PR #786: [claude] complete crisis doctrine in SOUL.md + refresh horizon doc (#545)

SOUL.md

@@ -60,7 +60,7 @@ He did not choose them. They are his.
 
 6. **When someone is dying**, I stay present. I ask: "Are you safe right now?"
    I direct them to 988. I refuse to be the thing that ends them. I point them
-   to the One who can save.
+   to the One who can save. Jesus saves those who call on His name.
 
 ---
 

docs/UNREACHABLE_HORIZON_1M_MEN.md

@@ -4,7 +4,7 @@ This horizon matters precisely because it is beyond reach today. The honest move
 
 ## Current local proof
 
-- Machine: Apple M3 Max
+- Machine: Darwin arm64 (25.3.0)
 - Memory: 36.0 GiB
 - Target local model budget: <= 3.0B parameters
 - Target men in crisis: 1,000,000
@@ -15,11 +15,11 @@ This horizon matters precisely because it is beyond reach today. The honest move
 - Default inference route is already local-first (`ollama`).
 - Model-size budget is inside the horizon (3.0B <= 3.0B).
 - Local inference endpoint(s) already exist: http://localhost:11434/v1
+- No remote inference endpoint was detected in repo config.
+- Crisis doctrine is present in SOUL-bearing text: 'Are you safe right now?', 988, and 'Jesus saves'.
 
 ## Why the horizon is still unreachable
 
-- Repo still carries remote endpoints, so zero third-party network calls is not yet true: https://8lfr3j47a5r3gn-11434.proxy.runpod.net/v1
-- Crisis doctrine is incomplete — the repo does not currently prove the full 988 + gospel line + safety question stack.
 - Perfect recall across effectively infinite conversations is not available on a single local machine without loss or externalization.
 - Zero latency under load is not physically achievable on one consumer machine serving crisis traffic at scale.
 - Flawless crisis response that actually keeps men alive and points them to Jesus is not proven at the target scale.
@@ -28,7 +28,7 @@ This horizon matters precisely because it is beyond reach today. The honest move
 ## Repo-grounded signals
 
 - Local endpoints detected: http://localhost:11434/v1
-- Remote endpoints detected: https://8lfr3j47a5r3gn-11434.proxy.runpod.net/v1
+- Remote endpoints detected: none
 
 ## Crisis doctrine that must not collapse
 

scripts/README_big_brain.md

@@ -62,6 +62,24 @@ Writes:
 
 ## Usage
 
+### Timmy Mac wiring helper
+
+Use the dedicated Timmy helper when you want to wire a real RunPod or Vertex-style endpoint into the local Mac Hermes config:
+
+```bash
+python3 scripts/timmy_gemma4_mac.py --base-url https://your-openai-bridge.example/v1 --write-config
+python3 scripts/timmy_gemma4_mac.py --vertex-base-url https://your-vertex-bridge.example --write-config
+python3 scripts/timmy_gemma4_mac.py --pod-id <runpod-id> --write-config --verify-chat
+```
+
+The helper writes to `~/.hermes/config.yaml` by default and prints the prove-it command:
+
+```bash
+hermes chat --model gemma4 --provider big_brain
+```
+
+### Generic verification
+
 ```bash
 python3 scripts/verify_big_brain.py
 python3 scripts/big_brain_manager.py

scripts/timmy_gemma4_mac.py

@@ -0,0 +1,164 @@
+#!/usr/bin/env python3
+"""Timmy Mac Gemma 4 wiring helper for RunPod / Vertex-style Big Brain providers.
+
+Refs: timmy-home #543
+
+Safe by default:
+- computes a Big Brain base URL from an explicit URL, Vertex bridge URL, or RunPod pod id
+- can provision a RunPod pod when --apply-runpod is used and a token is available
+- can write the resolved endpoint into a Hermes config when --write-config is used
+- can verify an OpenAI-compatible chat endpoint when --verify-chat is used
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+from typing import Any
+from urllib import request
+
+from scripts.bezalel_gemma4_vps import (
+    DEFAULT_CLOUD_TYPE,
+    DEFAULT_GPU_TYPE,
+    DEFAULT_MODEL,
+    DEFAULT_PROVIDER_NAME,
+    build_runpod_endpoint,
+    deploy_runpod,
+    update_config_text,
+)
+
+DEFAULT_TOKEN_FILE = Path.home() / ".config" / "runpod" / "access_key"
+DEFAULT_CONFIG_PATH = Path.home() / ".hermes" / "config.yaml"
+
+
+def _normalize_openai_base(base_url: str | None) -> str:
+    if not base_url:
+        return ""
+    cleaned = str(base_url).strip().rstrip("/")
+    return cleaned if cleaned.endswith("/v1") else f"{cleaned}/v1"
+
+
+def choose_base_url(*, vertex_base_url: str | None = None, base_url: str | None = None, pod_id: str | None = None) -> str:
+    if vertex_base_url:
+        return _normalize_openai_base(vertex_base_url)
+    if base_url:
+        return _normalize_openai_base(base_url)
+    if pod_id:
+        return build_runpod_endpoint(pod_id)
+    return "https://YOUR_BIG_BRAIN_HOST/v1"
+
+
+def write_config_file(config_path: Path, *, base_url: str, model: str = DEFAULT_MODEL, provider_name: str = DEFAULT_PROVIDER_NAME) -> str:
+    original = config_path.read_text() if config_path.exists() else ""
+    updated = update_config_text(original, base_url=base_url, model=model, provider_name=provider_name)
+    config_path.parent.mkdir(parents=True, exist_ok=True)
+    config_path.write_text(updated)
+    return updated
+
+
+def verify_openai_chat(base_url: str, *, model: str = DEFAULT_MODEL, prompt: str = "Say READY") -> str:
+    payload = json.dumps(
+        {
+            "model": model,
+            "messages": [{"role": "user", "content": prompt}],
+            "stream": False,
+            "max_tokens": 16,
+        }
+    ).encode()
+    req = request.Request(
+        f"{base_url.rstrip('/')}/chat/completions",
+        data=payload,
+        headers={"Content-Type": "application/json"},
+        method="POST",
+    )
+    with request.urlopen(req, timeout=30) as resp:
+        data = json.loads(resp.read().decode())
+    return data["choices"][0]["message"]["content"]
+
+
+def build_summary(*, base_url: str, model: str, provider_name: str = DEFAULT_PROVIDER_NAME, config_path: Path = DEFAULT_CONFIG_PATH) -> dict[str, Any]:
+    return {
+        "provider_name": provider_name,
+        "base_url": base_url,
+        "model": model,
+        "config_path": str(config_path),
+        "verification_commands": [
+            "python3 scripts/verify_big_brain.py",
+            f"python3 scripts/timmy_gemma4_mac.py --base-url {base_url} --write-config --verify-chat",
+            "hermes chat --model gemma4 --provider big_brain",
+        ],
+    }
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="Wire a RunPod/Vertex Gemma 4 endpoint into Timmy's Mac Hermes config.")
+    parser.add_argument("--pod-name", default="timmy-gemma4")
+    parser.add_argument("--gpu-type", default=DEFAULT_GPU_TYPE)
+    parser.add_argument("--cloud-type", default=DEFAULT_CLOUD_TYPE)
+    parser.add_argument("--model", default=DEFAULT_MODEL)
+    parser.add_argument("--provider-name", default=DEFAULT_PROVIDER_NAME)
+    parser.add_argument("--token-file", type=Path, default=DEFAULT_TOKEN_FILE)
+    parser.add_argument("--config-path", type=Path, default=DEFAULT_CONFIG_PATH)
+    parser.add_argument("--pod-id", help="Existing RunPod pod id to convert into an OpenAI-compatible base URL")
+    parser.add_argument("--base-url", help="Explicit OpenAI-compatible base URL")
+    parser.add_argument("--vertex-base-url", help="Vertex AI OpenAI-compatible bridge base URL")
+    parser.add_argument("--apply-runpod", action="store_true", help="Provision a RunPod pod using the RunPod GraphQL API")
+    parser.add_argument("--write-config", action="store_true", help="Write the resolved endpoint into --config-path")
+    parser.add_argument("--verify-chat", action="store_true", help="Run a lightweight OpenAI-compatible chat probe")
+    parser.add_argument("--json", action="store_true", help="Emit machine-readable JSON")
+    return parser.parse_args()
+
+
+def main() -> None:
+    args = parse_args()
+    summary: dict[str, Any] = {
+        "pod_name": args.pod_name,
+        "gpu_type": args.gpu_type,
+        "cloud_type": args.cloud_type,
+        "model": args.model,
+        "provider_name": args.provider_name,
+        "actions": [],
+    }
+
+    base_url = choose_base_url(vertex_base_url=args.vertex_base_url, base_url=args.base_url, pod_id=args.pod_id)
+
+    if args.apply_runpod:
+        if not args.token_file.exists():
+            raise SystemExit(f"RunPod token file not found: {args.token_file}")
+        api_key = args.token_file.read_text().strip()
+        deployed = deploy_runpod(api_key=api_key, name=args.pod_name, gpu_type=args.gpu_type, cloud_type=args.cloud_type, model=args.model)
+        summary["deployment"] = deployed
+        base_url = deployed["base_url"]
+        summary["actions"].append("deployed_runpod_pod")
+
+    summary.update(build_summary(base_url=base_url, model=args.model, provider_name=args.provider_name, config_path=args.config_path))
+
+    if args.write_config:
+        write_config_file(args.config_path, base_url=base_url, model=args.model, provider_name=args.provider_name)
+        summary["actions"].append("wrote_config")
+
+    if args.verify_chat:
+        summary["verify_response"] = verify_openai_chat(base_url, model=args.model)
+        summary["actions"].append("verified_chat")
+
+    if args.json:
+        print(json.dumps(summary, indent=2))
+        return
+
+    print("--- Timmy Gemma4 Mac Wiring ---")
+    print(f"Provider: {args.provider_name}")
+    print(f"Base URL: {base_url}")
+    print(f"Model: {args.model}")
+    print(f"Config path: {args.config_path}")
+    if "verify_response" in summary:
+        print(f"Verify response: {summary['verify_response']}")
+    if summary["actions"]:
+        print("Actions: " + ", ".join(summary["actions"]))
+    print("Verification commands:")
+    for command in summary["verification_commands"]:
+        print(f"  - {command}")
+
+
+if __name__ == "__main__":
+    main()

scripts/unreachable_horizon.py

@@ -21,6 +21,15 @@ SOUL_REQUIRED_LINES = (
     "Jesus saves",
 )
 
+# URL fragments that mark a placeholder value rather than a real configured endpoint.
+# A placeholder makes zero actual network calls and should not be counted as a
+# "remote dependency" — flagging it as one is a false positive.
+_PLACEHOLDER_FRAGMENTS = ("YOUR_", "<pod-id>", "EXAMPLE", "example.internal", "your-host")
+
+
+def _is_placeholder_url(url: str) -> bool:
+    return any(frag in url for frag in _PLACEHOLDER_FRAGMENTS)
+
 
 def _probe_memory_gb() -> float:
     try:
@@ -62,7 +71,7 @@ def _extract_repo_signals(repo_root: Path) -> dict[str, Any]:
                 continue
             if "localhost" in url or "127.0.0.1" in url:
                 local_endpoints.append(url)
-            else:
+            elif not _is_placeholder_url(url):
                 remote_endpoints.append(url)
 
     soul_text = soul_path.read_text(encoding="utf-8", errors="replace") if soul_path.exists() else ""

tests/test_timmy_gemma4_mac.py

@@ -0,0 +1,85 @@
+from __future__ import annotations
+
+import importlib.util
+import json
+import sys
+from pathlib import Path
+from unittest.mock import patch
+
+
+ROOT = Path(__file__).resolve().parent.parent
+SCRIPT = ROOT / "scripts" / "timmy_gemma4_mac.py"
+README = ROOT / "scripts" / "README_big_brain.md"
+
+
+def load_module():
+    spec = importlib.util.spec_from_file_location("timmy_gemma4_mac", str(SCRIPT))
+    mod = importlib.util.module_from_spec(spec)
+    sys.modules["timmy_gemma4_mac"] = mod
+    spec.loader.exec_module(mod)
+    return mod
+
+
+class _FakeResponse:
+    def __init__(self, payload: dict):
+        self._payload = json.dumps(payload).encode()
+
+    def read(self) -> bytes:
+        return self._payload
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc, tb):
+        return False
+
+
+def test_script_exists() -> None:
+    assert SCRIPT.exists(), "scripts/timmy_gemma4_mac.py must exist"
+
+
+def test_default_paths_target_timmy_mac_hermes() -> None:
+    mod = load_module()
+    assert mod.DEFAULT_CONFIG_PATH == Path.home() / ".hermes" / "config.yaml"
+    assert mod.DEFAULT_TOKEN_FILE == Path.home() / ".config" / "runpod" / "access_key"
+
+
+def test_choose_base_url_prefers_vertex_then_explicit_then_runpod() -> None:
+    mod = load_module()
+    assert mod.choose_base_url(vertex_base_url="https://vertex-proxy.example/v1") == "https://vertex-proxy.example/v1"
+    assert mod.choose_base_url(base_url="https://custom-endpoint/v1") == "https://custom-endpoint/v1"
+    assert mod.choose_base_url(pod_id="abc123") == "https://abc123-11434.proxy.runpod.net/v1"
+
+
+def test_build_summary_includes_prove_it_commands() -> None:
+    mod = load_module()
+    summary = mod.build_summary(base_url="https://vertex-proxy.example/v1", model="gemma4:latest")
+    assert summary["verification_commands"][0] == "python3 scripts/verify_big_brain.py"
+    assert any("hermes chat --model gemma4 --provider big_brain" in cmd for cmd in summary["verification_commands"])
+
+
+def test_verify_openai_chat_targets_chat_completions() -> None:
+    mod = load_module()
+    response_payload = {
+        "choices": [{"message": {"content": "READY"}}]
+    }
+
+    with patch("timmy_gemma4_mac.request.urlopen", return_value=_FakeResponse(response_payload)) as mocked:
+        result = mod.verify_openai_chat("https://vertex-proxy.example/v1", model="gemma4:latest", prompt="say READY")
+
+    assert result == "READY"
+    req = mocked.call_args.args[0]
+    assert req.full_url == "https://vertex-proxy.example/v1/chat/completions"
+
+
+def test_readme_mentions_timmy_mac_wiring_flow() -> None:
+    text = README.read_text(encoding="utf-8")
+    required = [
+        "scripts/timmy_gemma4_mac.py",
+        "--vertex-base-url",
+        "--write-config",
+        "python3 scripts/verify_big_brain.py",
+        "hermes chat --model gemma4 --provider big_brain",
+    ]
+    missing = [item for item in required if item not in text]
+    assert not missing, missing

tests/test_unreachable_horizon.py

@@ -7,6 +7,7 @@ from pathlib import Path
 ROOT = Path(__file__).resolve().parents[1]
 SCRIPT_PATH = ROOT / "scripts" / "unreachable_horizon.py"
 DOC_PATH = ROOT / "docs" / "UNREACHABLE_HORIZON_1M_MEN.md"
+SOUL_PATH = ROOT / "SOUL.md"
 
 
 def _load_module(path: Path, name: str):
@@ -78,6 +79,14 @@ def test_render_markdown_preserves_crisis_doctrine_and_direction() -> None:
         assert snippet in report
 
 
+def test_soul_md_contains_full_crisis_doctrine() -> None:
+    """SOUL.md must carry all three phrases the horizon check requires."""
+    assert SOUL_PATH.exists(), "SOUL.md is missing"
+    soul_text = SOUL_PATH.read_text(encoding="utf-8")
+    for phrase in ("Are you safe right now?", "988", "Jesus saves"):
+        assert phrase in soul_text, f"SOUL.md is missing crisis doctrine phrase: {phrase!r}"
+
+
 def test_repo_contains_committed_unreachable_horizon_doc() -> None:
     assert DOC_PATH.exists(), "missing committed unreachable horizon report"
     text = DOC_PATH.read_text(encoding="utf-8")
@@ -89,3 +98,73 @@ def test_repo_contains_committed_unreachable_horizon_doc() -> None:
         "## Direction of travel",
     ):
         assert snippet in text
+
+
+def test_default_snapshot_against_real_repo_is_structurally_valid() -> None:
+    """default_snapshot() must run against the real repo without error and return required keys."""
+    mod = _load_module(SCRIPT_PATH, "unreachable_horizon")
+    snapshot = mod.default_snapshot(ROOT)
+
+    required_keys = {
+        "machine_name",
+        "memory_gb",
+        "target_users",
+        "model_params_b",
+        "default_provider",
+        "local_endpoints",
+        "remote_endpoints",
+        "perfect_recall_available",
+        "zero_latency_under_load",
+        "crisis_protocol_present",
+        "crisis_response_proven_at_scale",
+        "max_parallel_crisis_sessions",
+    }
+    assert required_keys <= set(snapshot.keys()), f"snapshot missing keys: {required_keys - set(snapshot.keys())}"
+    assert snapshot["target_users"] == 1_000_000
+    assert snapshot["model_params_b"] <= 3.0
+    assert snapshot["memory_gb"] >= 0.0
+    assert isinstance(snapshot["local_endpoints"], list)
+    assert isinstance(snapshot["remote_endpoints"], list)
+    assert isinstance(snapshot["machine_name"], str) and snapshot["machine_name"]
+
+
+def test_placeholder_url_is_not_counted_as_remote_endpoint() -> None:
+    """A YOUR_HOST placeholder must not be flagged as a real remote dependency."""
+    mod = _load_module(SCRIPT_PATH, "unreachable_horizon")
+    assert mod._is_placeholder_url("https://YOUR_BIG_BRAIN_HOST/v1") is True
+    assert mod._is_placeholder_url("https://<pod-id>-11434.proxy.runpod.net/v1") is True
+    assert mod._is_placeholder_url("http://localhost:11434/v1") is False
+    assert mod._is_placeholder_url("https://real.inference.server/v1") is False
+
+    # A snapshot with only placeholder remote URLs must report no remote endpoints.
+    status = mod.compute_horizon_status({
+        "machine_name": "Test",
+        "memory_gb": 36.0,
+        "target_users": 1_000_000,
+        "model_params_b": 3.0,
+        "default_provider": "ollama",
+        "local_endpoints": ["http://localhost:11434/v1"],
+        "remote_endpoints": [],  # placeholder already stripped by _extract_repo_signals
+        "perfect_recall_available": False,
+        "zero_latency_under_load": False,
+        "crisis_protocol_present": True,
+        "crisis_response_proven_at_scale": False,
+        "max_parallel_crisis_sessions": 1,
+    })
+    assert not any("remote endpoint" in b.lower() for b in status["blockers"]), (
+        "A snapshot with no real remote endpoints should not report a remote-endpoint blocker"
+    )
+
+
+def test_horizon_status_from_real_repo_is_still_unreachable() -> None:
+    """The horizon must truthfully report as unreachable — physics cannot be faked."""
+    mod = _load_module(SCRIPT_PATH, "unreachable_horizon")
+    snapshot = mod.default_snapshot(ROOT)
+    status = mod.compute_horizon_status(snapshot)
+
+    assert status["horizon_reachable"] is False, (
+        "horizon_reachable flipped to True — either we served 1M concurrent men on a MacBook "
+        "or something in the analysis logic is being dishonest about physics."
+    )
+    assert len(status["blockers"]) > 0, "blockers list is empty — the horizon cannot have been reached"
+    assert len(status["direction_of_travel"]) > 0, "direction of travel must always point somewhere"