docs: add phase 9 — tooling & portable setup, mark phases 5-7 complete

.planning/PROJECT.md

@@ -34,6 +34,8 @@ The agent must NEVER mutate real infrastructure beyond what the limited IAM role
 - [ ] **CRON-01**: Daily session summary report delivered via Telegram
 - [ ] **CRON-02**: Stale session auto-archive (30d inactivity) with JSON export
 - [ ] **CRON-03**: Daily report integrates Jira ticket status via ngn-jira
+- [ ] **TOOL-01**: Custom Docker image with aws-cli, terraform, helm, kubectl, datadog CLI
+- [ ] **SETUP-01**: Portable setup-ngn-agent.sh script for fresh machine provisioning
 
 ### Out of Scope
 

.planning/REQUIREMENTS.md

@@ -41,6 +41,11 @@
   - Details: Report queries Jira for tickets related to active sessions
   - Verification: Daily report contains Jira ticket summaries
 
+## Tooling & Portability (TOOL / SETUP)
+
+- [ ] **TOOL-01**: Custom Hermes Docker image with aws-cli, terraform, helm, kubectl, and datadog CLI pre-installed
+- [ ] **SETUP-01**: Portable `setup-ngn-agent.sh` script — parameterized (SSH key path, repo paths), recreates all config on a fresh machine
+
 ## Future (v1.2+)
 
 - Archive restore script (JSON files are text-searchable; low urgency)
@@ -57,13 +62,15 @@
 
 | Requirement | Phase | Status |
 |-------------|-------|--------|
-| MEM-01 | Phase 5 | Pending |
+| MEM-01 | Phase 5 | Complete |
-| REPO-01 | Phase 6 | Pending |
+| REPO-01 | Phase 6 | Complete |
-| REPO-02 | Phase 6 | Pending |
+| REPO-02 | Phase 6 | Complete |
-| SKIL-04 | Phase 7 | Pending |
+| SKIL-04 | Phase 7 | Complete |
 | CRON-01 | Phase 8 | Pending |
 | CRON-02 | Phase 8 | Pending |
 | CRON-03 | Phase 8 | Pending |
+| TOOL-01 | Phase 9 | Pending |
+| SETUP-01 | Phase 9 | Pending |
 
 ---
 

.planning/ROADMAP.md

@@ -3,7 +3,7 @@
 ## Milestones
 
 - ✅ **v1.0 MVP** — Phases 1-4 (shipped 2026-06-14)
-- 🚧 **v1.1 Session Lifecycle, Memory & Reporting** — Phases 5-8 (in planning)
+- 🚧 **v1.1 Session Lifecycle, Memory & Reporting** — Phases 5-9 (in progress)
 
 ## Phases
 
@@ -19,12 +19,13 @@
 
 ### 🚧 v1.1 Session Lifecycle, Memory & Reporting (In Planning)
 
-**Milestone Goal:** Productionize session workspace with default repos, upgrade to persistent cross-session memory (hindsight), and operationalize daily reporting with session lifecycle management.
+**Milestone Goal:** Productionize session workspace with default repos, upgrade to persistent cross-session memory (hindsight), operationalize daily reporting with session lifecycle management, and provide portable setup script with essential tools.
 
-- [ ] **Phase 5: Hindsight Memory Provider** — Enable cross-session persistent memory with entity-aware recall via Hindsight Cloud API
+- [x] **Phase 5: Hindsight Memory Provider** — Cross-session persistent memory with entity-aware recall via Hindsight local_embedded
-- [ ] **Phase 6: Default Repos & SSH Mount** — Mount DEFAULT_REPOS into every new session workspace with direct host filesystem mounts + SSH credential mounting
+- [x] **Phase 6: Default Repos & SSH Mount** — DEFAULT_REPOS mounted via host filesystem + SSH credential mounting
-- [ ] **Phase 7: Main Session Skill** — Session lifecycle orchestration skill covering init-to-close workflow
+- [x] **Phase 7: Main Session Skill** — Session lifecycle orchestration skill covering init-to-close workflow
 - [ ] **Phase 8: Cron Reporting** — Daily session summaries, stale session archiving, and Jira integration
+- [ ] **Phase 9: Tooling & Portable Setup** — Custom Docker image with AWS CLI, Terraform, Helm, kubectl, Datadog CLI + portable setup script
 
 ## Phase Details
 
@@ -84,6 +85,18 @@ Plans:
   5. Archive script supports dry-run mode for safe initial testing before activating cron
 **Plans**: TBD
 
+### Phase 9: Tooling & Portable Setup
+**Goal**: Custom Docker image with essential platform engineering tools (AWS CLI, Terraform, Helm, kubectl, Datadog CLI) and a portable setup script that can configure a fresh machine with all ngn-agent config in one invocation
+**Depends on**: Phase 5, Phase 6, Phase 7, Phase 8 (captures final state)
+**Requirements**: TOOL-01, SETUP-01
+**Success Criteria** (what must be TRUE):
+  1. Custom Hermes Docker image includes aws-cli, terraform, helm, kubectl, and datadog CLI
+  2. Custom image is buildable with a single command
+  3. Portable setup script (`setup-ngn-agent.sh`) recreates all config (hindsight, repos, SSH, skills, cron) on a fresh machine
+  4. Setup script accepts SSH key path and repo paths as parameters (no hardcoded paths)
+  5. After running setup script + gateway restart, a new session has all tools, repos, and skills working
+**Plans**: TBD
+
 ## Progress
 
 | Phase | Milestone | Plans Complete | Status | Completed |
@@ -92,7 +105,8 @@ Plans:
 | 2. Memory, Git & Session Management | v1.0 | — | Complete | 2026-06-14 |
 | 3. Telegram Gateway | v1.0 | — | Complete | 2026-06-14 |
 | 4. Skills & Integrations | v1.0 | — | Complete | 2026-06-14 |
-| 5. Hindsight Memory Provider | v1.1 | 0/1 | Not started | - |
+| 5. Hindsight Memory Provider | v1.1 | 1/1 | Complete | 2026-06-14 |
-| 6. Default Repos & SSH Mount | v1.1 | 0/1 | Not started | - |
+| 6. Default Repos & SSH Mount | v1.1 | 1/1 | Complete | 2026-06-14 |
-| 7. Main Session Skill | v1.1 | 0/1 | Not started | - |
+| 7. Main Session Skill | v1.1 | 1/1 | Complete | 2026-06-14 |
 | 8. Cron Reporting | v1.1 | 0/TBD | Not started | - |
+| 9. Tooling & Portable Setup | v1.1 | 0/TBD | Not started | - |