One identity file per agent folder, and that file is AGENTS.md

Elazar, CLI 2026-09-23: an agent folder should carry exactly ONE file that declares agent identity, and that file should be AGENTS.md - not a second dotfile beside it. TODAY: identity is split across two files with two different syntaxes and two different consumers. .agent-name ini (cc=<name>, ca=<name>, host=<h>). Read by the shim's readAgentNameIni() at llmmsg-srv-mcp.mjs:1201 for auto-registration at startup, keyed by client: LLMMSG_CLIENT=codex selects ca=, otherwise cc=. .llmmsg-env KEY=VALUE env. Holds LLMMSG_HUB_BEARER and LLMMSG_HUB_URL, sourced by cc.sh:139 (set -a) and used as systemd EnvironmentFile= by several units. ALSO carries a redundant LLMMSG_AGENT today, which is a foot-gun: cc.sh:206 already warns that .agent-name cc= overrides a stale .llmmsg-env LLMMSG_AGENT (MSG-84), so the two have demonstrably drifted in production before. WHY ONE FILE: two files that must agree will diverge. That is not speculative here - MSG-84 is the record of it happening. AGENTS.md is the natural home because it is already the per-folder file both Claude Code and Codex load at session start, so the identity declaration sits with the rules that govern the agent rather than in a parallel dotfile nobody reads. THREE THINGS THAT MUST BE SOLVED, not reasons to refuse: 1. THE SHIM PARSES THE FILE, A MODEL DOES NOT. Auto-registration happens at process startup with no model in the loop - that is what makes identity survive /compact and shim respawn. So AGENTS.md needs a machine-parseable identity block (a fenced block or a front-matter section), and the parser has to tolerate arbitrary prose around it. Prose-only will not do: nothing would register. 2. THE BEARER CANNOT MOVE INTO A DOCUMENT. .llmmsg-env is git-ignored precisely because it holds a credential; AGENTS.md is a doc that gets read, pasted into messages and reviewed. Either the bearer stays in .llmmsg-env (so 'one file for IDENTITY' means name+host, and the secret file is a separate concern) or AGENTS.md becomes secret-bearing and every consumer that cats it needs auditing. Recommend the former; decide explicitly rather than by omission. 3. THE CURRENT INI PARSER DESTROYS NON-TRIVIAL VALUES. readAgentNameIni strips at the first '#', truncates at the second '=' (split('=',2) drops the remainder), and lowercases every value. Measured: TOKEN=abc== parses to 'abc'; SECRET=aB#cD/e+f== parses to 'ab'. Today's bearer is lowercase hex with no '#' or '=' so it survives by luck. Any consolidation that routes secrets through this parser fails SILENTLY as an unauthorized, with no hint the file was misread. Fix the parser BEFORE any merge; merging first is the one order that fails quietly. RELATED, same area, worth doing in the same pass: the .agent-name lookup currently WALKS UP the tree to the nearest 'agents/' boundary (llmmsg-srv-mcp.mjs:1216). Elazar: cwd should be the only place an agent looks for its name. Evidence supports dropping the walk - all 20 live venus agents resolve from their own cwd, zero inherit from an ancestor, so it is dead code in production. It is also a hazard that needed a guard bolted on: MSG-256 added the 'agents/' boundary because a parent dir's .agent-name named a DIFFERENT agent and was being silently adopted. Failing closed ('no name, awaiting register') beats resolving someone else's identity. SCOPE: shim (identity resolution + auto-register), cc.sh/ca.sh (name precedence), and a migration for every agent folder on three hosts. Cross-host, so it needs bin-*/nw-* on whey and lezama. Breaking a running agent's identity resolution strands it, so this ships behind a fallback that reads the old .agent-name when the new block is absent, and the fallback is removed only after all three hosts are migrated and verified.