diff -r 6963cf9e2b9d -r cadaf4872eb3 README.md
--- a/README.md	Sat May 09 00:38:10 2026 +0000
+++ b/README.md	Sat May 09 00:39:50 2026 +0000
@@ -57,23 +57,58 @@
 
     repoman setup                     # interactive
     repoman setup --non-interactive   # accept defaults
-    repoman setup --with-llm          # include local LLM stack (ollama + hermes)
+
+The wizard creates the Incus project `repoman`, detects your host LAN IP (used by
+profiles that wire containers to host services), and writes the initial registry.
+
+After setup, install the vendor profile library:
+
+    repoman profile install --all
+
+## Profile library
 
-The wizard creates the Incus project `repoman`, verifies your `claude-share` profile
-exists, and (with `--with-llm`) creates an `llm-share` profile that wires containers
-to your host's ollama daemon over LAN.
+repoman ships a vendor profile library at `/usr/local/share/repoman/profiles/`.
+v0.4 includes three profiles:
 
-## Local LLM stack
+- **`claude-share`** — bind `~/.claude` and `~/.local/bin/claude` into containers
+  so they share the host's Claude CLI auth, history, and plugins.
+- **`llm-share`** — bind `/usr/local/bin/ollama` and `~/.ollama` into containers,
+  set `OLLAMA_HOST=http://<host-lan-ip>:11434` so containers reach the host's
+  ollama daemon over LAN.
+- **`dotfiles`** — bind `~/.gitconfig` and `~/.hgrc` (extend with your own).
+
+Manage profiles via `repoman profile`:
 
-`repoman setup --with-llm` provisions:
+    repoman profile list
+    repoman profile install <name>
+    repoman profile install --all
+    repoman profile diff <name>            # show drift between file and incus state
+    repoman profile show <name>            # print rendered YAML
+    repoman profile remove <name>          # remove from incus (file untouched)
+
+### Customizing profiles
+
+To override a vendor profile, copy it to your user dir and edit:
+
+    cp /usr/local/share/repoman/profiles/dotfiles.yml ~/.config/repoman/profiles.d/
+    $EDITOR ~/.config/repoman/profiles.d/dotfiles.yml
+    repoman profile install dotfiles       # applies the user version (shadows vendor)
 
-- An Incus profile `llm-share` that bind-mounts `/usr/local/bin/ollama` (read-only)
-  and `~/.ollama/`, and sets `OLLAMA_HOST=http://<host-lan-ip>:11434` in the
-  container environment.
-- Registry default `[defaults].llm.enabled = true`.
+User profiles in `~/.config/repoman/profiles.d/` always win over vendor profiles
+of the same name. `repoman profile list` shows the active source for each.
+
+## Migrating from v0.3
 
-Containers created after `--with-llm` setup automatically inherit the `llm-share`
-profile and can reach the host's ollama daemon at the configured LAN address.
+If you ran `repoman setup --with-llm` on v0.3, your registry is at schema 2 and
+includes a `[defaults.llm]` block. v0.4 reads that block on first load, extracts
+the ollama_url's host portion into `[host].lan_ip`, and writes the registry as
+schema 3 on the next save. No action required — the migration is automatic and
+lossless for the one fact that's still useful.
+
+The `--hermes` / `--no-hermes` / `--purge-hermes` flags are gone (those were
+already reverted in v0.3 before tagging). Hermes (and similar agents that need
+per-container installs) is the user's responsibility: shell into the container
+with `repoman shell <name>` and run the install yourself.
 
 ## Smoke test (requires Incus + NFS)
 
diff -r 6963cf9e2b9d -r cadaf4872eb3 VISION.md
--- a/VISION.md	Sat May 09 00:38:10 2026 +0000
+++ b/VISION.md	Sat May 09 00:39:50 2026 +0000
@@ -40,7 +40,8 @@
 
 | Subcommand | Purpose |
 |---|---|
-| `repoman setup` | First-time host setup. Creates Incus project `repoman`, ensures profiles exist (`claude-share` user-managed, `llm-share` repoman-managed), validates LAN ollama reachability if --with-llm. Idempotent. **Shipped in v0.3.** |
+| `repoman setup` | First-time host setup. Creates Incus project `repoman`, detects host LAN IP, writes initial registry. Idempotent. **Shipped in v0.3, trimmed in v0.4 (no longer touches profiles or LLM stack).** |
+| `repoman profile {list, install, diff, remove, show}` | Manage Incus profiles from the vendor library at `/usr/local/share/repoman/profiles/` and the user override dir at `~/.config/repoman/profiles.d/`. **Shipped in v0.4.** |
 | `repoman new <name> [--repo <dir>] [--image <img>]` | Create a new managed container. Bind-mounts the repo, applies profiles, restarts. Interactive form prompts for unset values. |
 | `repoman list` | List managed containers: name, state, IP, repo path, image, last sync. Reads from registry + reconciles against `incus list --project repoman`. |
 | `repoman shell <name>` | Drop into the container as the local user, in the repo's directory. Replaces the verbose `incus shell --user 1000 --cwd ...` invocation. |
diff -r 6963cf9e2b9d -r cadaf4872eb3 reef.toml
--- a/reef.toml	Sat May 09 00:38:10 2026 +0000
+++ b/reef.toml	Sat May 09 00:39:50 2026 +0000
@@ -1,6 +1,6 @@
 [package]
 name = "repoman"
-version = "0.3.0"
+version = "0.4.0"
 author = "Chris Tusa <christusa@gmail.com>"
 description = "Per-project Incus containers + opinionated NFS/ZFS backup"
 license = "MIT"
diff -r 6963cf9e2b9d -r cadaf4872eb3 src/cli.reef
--- a/src/cli.reef	Sat May 09 00:38:10 2026 +0000
+++ b/src/cli.reef	Sat May 09 00:39:50 2026 +0000
@@ -926,7 +926,7 @@
 end cmd_profile_show
 
 fn version_string(): string
-    return "repoman 0.3.0"
+    return "repoman 0.4.0"
 end version_string
 
 proc print_usage()