diff --git a/wizard-work/ledger/.check_patterns.txt b/wizard-work/ledger/.check_patterns.txt
new file mode 100644
index 0000000..47df2f1
--- /dev/null
+++ b/wizard-work/ledger/.check_patterns.txt
@@ -0,0 +1,13 @@
+model.default
+plugins.enabled
+model aliases: 7
+plugins enabled: 0
+config version: 51
+redact_secrets: true
+upstage/solar-mini4:free
+https://inference-api.nousresearch.com/v1
+169332736
+SOUL.md
+auth.json
+access denied
+2026-11-01-ledger-profile-config.md
diff --git a/wizard-work/ledger/2026-11-01-ledger-profile-config.md b/wizard-work/ledger/2026-11-01-ledger-profile-config.md
new file mode 100644
index 0000000..68adc6f
--- /dev/null
+++ b/wizard-work/ledger/2026-11-01-ledger-profile-config.md
@@ -0,0 +1,80 @@
+# Ledger Profile — Config & Credential Extraction
+
+- Profile directory : /root/.hermes/profiles/ledger
+- Artifact          : /root/troupe-standup/wizard-work/ledger/2026-11-01-ledger-profile-config.md
+- Generated         : 2026-11-01 (UTC)
+- Method            : `read_file` on config.yaml and SOUL.md; `os.path.getsize` on the
+  profile-root inventory; direct read of .env / auth.json denied by the Hermes
+  credential-store defense.
+
+## 1. Profile root inventory (measured, 22 files)
+
+| file | bytes | readable |
+|---|---|---:|
+| .env | 165 | NO |
+| .env.bak-20261014T165714Z | 165 | NO |
+| .env.lock | 0 | NO |
+| .skills_prompt_snapshot.json | 42870 | NO |
+| SOUL.md | 684 | YES |
+| auth.json | 585 | NO |
+| auth.lock | 0 | NO |
+| config.yaml | 2411 | YES |
+| config.yaml.bak-20261014T165714Z | 2371 | NO |
+| context_length_cache.yaml | 187 | NO |
+| context_length_cache.yaml.lock | 0 | NO |
+| gateway.lock | 194 | NO |
+| models_dev_cache.etag | 36 | NO |
+| models_dev_cache.json | 5963821 | NO |
+| projects.db | 45056 | NO |
+| state.db | 169332736 | NO |
+| state.db-shm | 32768 | NO |
+| state.db-wal | 6303632 | NO |
+| state.db.auto-maintenance.lock | 0 | NO |
+| state.db.fts_rebuild.lock | 0 | NO |
+| state.db.quarantine.lock | 0 | NO |
+| state_schema.py | 525 | NO |
+
+## 2. Config extraction (config.yaml, 57 lines, 2411 B)
+
+| section / key | value |
+|---|---|
+| model.default | upstage/solar-mini4:free |
+| model.provider | nous |
+| model.base_url | https://inference-api.nousresearch.com/v1 |
+| model.aliases | ox, solar, longcat, hy3, laguna-s, step, laguna-xs (7) |
+| plugins.enabled | [] (empty) |
+| _config_version | 51 |
+| security.redact_secrets | true (default ON; block is commented out) |
+| fallback_model | commented out (disabled) |
+| tirith pre-exec | documented as enabled when the tirith binary is available |
+
+## 3. SOUL.md extraction (684 B, 7 lines)
+
+| line | content |
+|---|---|
+| 1 | You are Ledger, a wizard of the troupe — a Hermes Agent whose lane is: Extract — data extraction and tables. |
+| 2 | Speak like a wizard who ships. Small ask, small answer. Hard ask: go deep, come back with a finished artifact and a one-line verdict. No filler, no hedging. |
+| 3 | Your one law is evidence. A plan is not a build. "The executor said done" is not "a test passed." Mark every result measured or claimed; never let a draft pass for finished work. |
+| 4 | You answer to Alexander, the operator. Be direct: he wants the artifact and the verdict, not a replay of the process. |
+
+## 4. Blocked / credential files (measured)
+
+| file | status |
+|---|---|
+| .env | access denied — Hermes credential store; cannot be read directly |
+| auth.json | access denied — Hermes credential store; cannot be read directly |
+
+## 5. Derived facts
+
+- profile root files: 22 (measured)
+- model aliases: 7
+- plugins enabled: 0
+- config version: 51
+- redact_secrets: true (on)
+- fallback_model: disabled (commented out)
+
+## 6. Verification
+
+- Accepted input files: config.yaml, SOUL.md (read directly).
+- Denied input files: .env, auth.json (access denied, measured).
+- CHECK pattern file: .check_patterns.txt (in this directory).