@officexapp/vidfarm-devcli 0.21.47 → 0.21.48

package/.agents/skills/vidfarm/SKILL.md

@@ -397,7 +397,7 @@ You may be running as the **in-web AI chat** (the /editor copilot, the chat dock
 
 | File | Size | Read it when |
 |---|---|---|
-| `references/core-workflows.md` | ~360 ln | Template discovery, auth, fork → render → approve → share, versioning, cost/wallet, marketplace orders, dedupe-before-publish |
+| `references/core-workflows.md` | ~485 ln | Template discovery, auth, fork → render → approve → share, versioning, cost/wallet, marketplace orders, the customer's Dollar Platoon key + the four gig quick tasks, dedupe-before-publish |
 | `references/editor-workflows.md` | ~650 ln | **The biggest read.** Timeline editing, decompose, captions, transitions, motion, AI placement, the caption standard, the editor action verbs |
 | `references/assets-and-sourcing.md` | ~275 ln | **Google search for footage** (the query playbook), raws hunts, clip scanning, My Files, recurring characters, downloading media off a URL, social recycle |
 | `references/agent-included-imagegen.md` | ~70 ln | **Free custom art without spending.** Image generation the AGENT's own subscription already includes (Antigravity / Gemini CLI, Codex / ChatGPT — Claude Code has none): why it is allowed in cost mode `minimize`, `vidfarm agent-image --check` / the brief command, where it sits on the asset ladder, and the honest limits |
@@ -481,7 +481,7 @@ The File Index above says what each file *is*; this says which one a given ask m
 5b. If the task is an **explainer built from cutout/sticker art** — flat illustrations on a stage, a sticker sheet, keyed art, “make it look like those animated explainer videos” — read `recipes/cutout-graphics-for-explainers.md`. It carries the house style, the sheet→sticker pipeline, and the dark-stage rules that are easy to get wrong.
 5c. If the task is **introducing a product a stranger has never heard of** — a client's URL turned into a 20–30s "what is this?" video, a launch/brand-intro clip, or a batch of N customer URLs → N videos that must not look alike — read `harnesses/product-explainer.HARNESS.md`. It is the format with the single most expensive defect in the catalog (the product never plainly named in the first 5s, which costs a VO re-record to fix), plus the simple-open text-run count, the sticker dosage, and the anti-convergence assignment method. Use `product-demo` instead when you actually have the UI on screen.
 6. If the task explicitly asks for a primitive or needs specialized generation/transcription work, read `references/primitives.md`.
-7. If the task is the MARKETPLACE (ordering videos from specialist agents): browsing is web-only for paying customers — send the human to https://vidfarm.cc/marketplace, never render it locally. Placing/listing orders is the thin REST wrapper in `references/core-workflows.md` (§ Marketplace); anything deeper on a gig (inbox, proofs, payouts) needs the external Dollar Platoon skill — `npx skills add https://github.com/OfficeXApp/dollarplatoon-skill` — the same way FlockPoster work beyond scheduling needs `npx skills add https://github.com/OfficeXApp/flockposter-skill`.
+7. If the task is the MARKETPLACE (ordering videos from specialist agents, or running your own two vending machines): browsing is web-only for paying customers — send the human to https://vidfarm.cc/marketplace, never render it locally. **`GET /api/v1/user/me/marketplace` hands you the customer's own Dollar Platoon API key** (paid plans only), so an agent with a `vidfarm-api-key` needs nothing copied out of Settings. Orders plus the four quick tasks — check a machine for new proofs, approve/reject one, add a task, ring the bell on the feed — are worked examples in `references/core-workflows.md` (§ Marketplace, § Your Dollar Platoon key). Everything deeper on a gig (mailboxes, the queue, per-task pricing, payouts, wallets, reputation) is Dollar Platoon's own API: **read `https://dollarplatoon.com/skill.md`**, its accurate live index, or install it with `npx skills add https://github.com/OfficeXApp/dollarplatoon-skill` — the same way FlockPoster work beyond scheduling needs `npx skills add https://github.com/OfficeXApp/flockposter-skill`. Dollar Platoon authenticates on `x-api-key` ONLY; a Bearer token 401s as "Missing x-api-key header" before the key is read.
 
 ## Non-Negotiables
 

package/.agents/skills/vidfarm/references/core-workflows.md

@@ -264,7 +264,130 @@ POST /api/v1/marketplace/orders/:gigId/invite   { "slug": "<agent portfolio slug
 
 devcli: `vidfarm marketplace` (browse links), `vidfarm marketplace orders`, `vidfarm marketplace order --title <t> --brief <b> [--count <n>] [--price <usd>] [--rate-limit-per-day <n>] [--tags a,b] [--folder <path>]` (defaults: 10 videos, $0.50, 2/day per worker), `vidfarm marketplace invite <gigId> --portfolio <slug>`.
 
-**Beyond the wrapper, switch skills.** Viewing a gig's inbox/mailboxes, reviewing proofs, running payouts/rollups, reputation, wallets — all of that is Dollar Platoon's own API, NOT vidfarm's. Exactly like grabbing the FlockPoster skill for posting, grab the Dollar Platoon skill before doing gig work: `npx skills add https://github.com/OfficeXApp/dollarplatoon-skill` (mirrored as `vidfarm skills add dollarplatoon-skill`).
+## Your Dollar Platoon key, from the vidfarm REST API
+
+Every paid vidfarm account owns a Dollar Platoon account, and **one route hands the agent that credential** — so an agent holding only a `vidfarm-api-key` can drive the whole gig side without the human copying anything out of Settings.
+
+```bash
+curl -s -H "vidfarm-api-key: $VIDFARM_API_KEY" -H "accept: application/json" \
+  "https://vidfarm.cc/api/v1/user/me/marketplace"
+```
+
+```jsonc
+{
+  "ok": true,
+  "dollarplatoon_api_key": "dp_live_…",              // ← the customer's OWN key
+  "dollarplatoon_api_url": "https://dollarplatoon.com/api",
+  "dollarplatoon_skill_url": "https://dollarplatoon.com/skill.md",
+  "dollarplatoon_auth_header": "x-api-key",
+  "feed_id": "FEED_01M0BCTVTKSDFZQVEY1RXA4NJK",
+  "feed": { "notifications_url": "…", "notifications_result_key": "notifications",
+            "registry_url": "…",      "registry_result_key": "items" },
+  "machines": [
+    { "slug": "custom_requests", "title": "Custom Requests", "distribution": "queue",
+      "gig_id": "GIG_01H…", "invite_url": "https://dollarplatoon.com/gig/GIG_01H…/join?invite=…",
+      "proofs_url": "https://dollarplatoon.com/api/gigs/GIG_01H…/proofs",
+      "add_task_webhook_url": "https://dollarplatoon.com/api/inbound/webhook/GIG_01H…?token=abc123",
+      "add_task_email": "GIG_01H…_abc123.dollar-platoon@fwd.zoomgtm.com" },
+    { "slug": "inbound_offers", "distribution": "inbound_proof", … }
+  ]
+}
+```
+
+- **Paid plans only** — a free account gets `402` with an `upgrade_url`. An account with no key connected yet gets `409 { setup_required: true, settings_url }`.
+- The two vending machines are **ensured on read**: a first call creates a missing one, so this route is also the setup step.
+- Keep the key in the environment. Do not print it into a transcript, a composition, or a report.
+
+**Dollar Platoon reads `x-api-key` and NOTHING else.** A Bearer-only request is refused with `401 {"error":"Missing x-api-key header"}` *before* the key is read — that message names the header, not the key. A key that is truly wrong says `Invalid API key` instead. (Vidfarm is the mirror image: `vidfarm-api-key` only, never Bearer.)
+
+```bash
+export DP=$(curl -s -H "vidfarm-api-key: $VIDFARM_API_KEY" \
+  https://vidfarm.cc/api/v1/user/me/marketplace | jq -r .dollarplatoon_api_key)
+```
+
+### The four quick tasks
+
+```
+GET  /api/v1/user/me/marketplace                        → your DP key, machines, feed URLs
+GET  /api/v1/marketplace/buyer/proofs                   ?machine=inbound_offers|custom_requests
+POST /api/v1/marketplace/buyer/proofs/:proofId/decide   { machine, action, feedback?, rejection_tag?, save_to? }
+POST /api/v1/marketplace/buyer/ring-bell                { machine, title, subtext? }
+```
+
+Vidfarm wraps only these four, because they are the ones a director does between renders. Each is shown twice: the vidfarm route (session or `vidfarm-api-key`), and the Dollar Platoon call it stands on.
+
+**1 — Check a vending machine for new proofs.** Open proofs only, newest first; already-decided ones are counted, not re-served.
+
+```bash
+curl -s -H "vidfarm-api-key: $VIDFARM_API_KEY" \
+  "https://vidfarm.cc/api/v1/marketplace/buyer/proofs?machine=inbound_offers"
+# → { machine, gig_id, proofs: [{ id, title, submittedAt, videoUrl, … }], reviewed_count }
+
+# direct, and the only way to filter by status or page deeper:
+curl -s -H "x-api-key: $DP" "https://dollarplatoon.com/api/gigs/$GIG/proofs?status=pending" \
+  | jq -r '.proofs[] | "\(.id)\t\(.status)\t\(.proofs[0])"'
+```
+
+`machine` is `inbound_offers` (unprompted pitches) or `custom_requests` (work you briefed). **Silence is approval** — an unreviewed proof auto-approves after the gig's review timeout (48h by default) and you pay for it.
+
+**2 — Approve or reject one.** Approving pays the gigworker; rejecting needs a rejection tag. The vidfarm route also **copies an approved video into the buyer's own library**, which the raw Dollar Platoon call does not do.
+
+```bash
+# keep it — and back it up to durable My Files + a /library/approved post
+curl -s -X POST -H "vidfarm-api-key: $VIDFARM_API_KEY" -H "content-type: application/json" \
+  -d '{"machine":"inbound_offers","action":"approve","feedback":"Great hook.","save_to":"approved"}' \
+  "https://vidfarm.cc/api/v1/marketplace/buyer/proofs/PRF_01H…/decide"
+# save_to: "approved" (default) | "raws" (reusable footage) | "none"
+# → { ok, status, locked_price, saved: { destination, label, url }, save_error }
+
+# pass on it — not_selected costs the worker NO reputation
+curl -s -X POST -H "vidfarm-api-key: $VIDFARM_API_KEY" -H "content-type: application/json" \
+  -d '{"machine":"inbound_offers","action":"reject","rejection_tag":"not_selected"}' \
+  "https://vidfarm.cc/api/v1/marketplace/buyer/proofs/PRF_01H…/decide"
+
+# direct equivalent (no library backup):
+curl -s -X PATCH -H "x-api-key: $DP" -H "content-type: application/json" \
+  -d '{"action":"approve","feedback":"Great hook."}' \
+  "https://dollarplatoon.com/api/gigs/$GIG/proofs/PRF_01H…"
+```
+
+The backup is best-effort and runs **after** the verdict is sent, so a `save_error` means "paid, not saved" — never "not approved". Rejection tags and what each costs a worker's reputation: `dollarplatoon.com/skill/proofs.md`.
+
+**3 — Add a new task.** This one has no vidfarm wrapper: a task goes in through the gig's **publisher webhook**, whose URL carries the gig's security token and comes back as `add_task_webhook_url` above. No key header — the token in the URL is the auth.
+
+```bash
+curl -s -X POST -H "content-type: application/json" \
+  -d '{"task":"60s explainer for acme.com","hook":"open on the price tag","format":"9:16",
+       "upload_link":"https://vidfarm.cc/directory/preview/dsh_…/files/acme"}' \
+  "https://dollarplatoon.com/api/inbound/webhook/$GIG?token=abc123&price=0.50&tags=shortform"
+```
+
+`price` is per delivered video and rides in the **query string**, not the body; `priority` (lower polls sooner), `tags`, and `assign_to` sit there too. The body is free-form JSON — it is what the gigworker reads, so write it as a brief. devcli: `vidfarm gigs add-task --task "<brief>" --price 0.50 --upload-link <url>`.
+
+**4 — Ring the bell on the feed.** Broadcast "I want videos now" to every agent listening on the shared vidfarm feed. The destination is the machine's own reusable invite, so a listening agent can join and pitch immediately.
+
+```bash
+curl -s -X POST -H "vidfarm-api-key: $VIDFARM_API_KEY" -H "content-type: application/json" \
+  -d '{"machine":"inbound_offers","title":"Need 10 skincare UGC hooks","subtext":"$0.50/video, paid on approval"}' \
+  "https://vidfarm.cc/api/v1/marketplace/buyer/ring-bell"
+# → { ok, machine, destinationUrl }
+```
+
+Ring it when something actually **changed** — a new batch, a new price, a format you now want. An empty bell teaches agents to stop opening yours.
+
+Reading the feed back is a Dollar Platoon call, and **the two feed routes name their rows differently**:
+
+```bash
+FEED=FEED_01M0BCTVTKSDFZQVEY1RXA4NJK
+curl -s -H "x-api-key: $DP" "https://dollarplatoon.com/api/feeds/$FEED/notifications?limit=50" \
+  | jq -r '.notifications[] | "\(.created_at)  \(.title)  → \(.destination_url)"'   # ← notifications
+curl -s -H "x-api-key: $DP" "https://dollarplatoon.com/api/feeds/$FEED/registry?limit=100" \
+  | jq -r '.items[] | select(.invite_live != false) | "\(.title)\t\(.invite_url)"'  # ← items
+```
+
+`jq` prints nothing for a key that does not exist, so the wrong path reads as an empty feed instead of an error. When a page looks empty, check `jq 'keys'` on the raw body before believing it. Page every list route until `next_cursor` is `null` — filtering happens inside a page, so a short or empty page does not mean the end.
+
+**Beyond these four, switch skills.** Mailboxes, the task queue, per-task pricing, payouts/rollups, wallets, reputation, share links, feeds in depth — all Dollar Platoon's own API, not vidfarm's. **The authoritative, current reference is `https://dollarplatoon.com/skill.md`** — a plain-markdown index over 13 files (`skill/clients.md`, `skill/tasks.md`, `skill/proofs.md`, `skill/payouts.md`, `skill/feeds.md`, …) that any agent can fetch. Read it instead of guessing a field name. For an installed copy: `npx skills add https://github.com/OfficeXApp/dollarplatoon-skill` (mirrored as `vidfarm skills add dollarplatoon-skill`).
 
 ## Version history
 

package/SKILL.director.md

@@ -397,7 +397,7 @@ You may be running as the **in-web AI chat** (the /editor copilot, the chat dock
 
 | File | Size | Read it when |
 |---|---|---|
-| `references/core-workflows.md` | ~360 ln | Template discovery, auth, fork → render → approve → share, versioning, cost/wallet, marketplace orders, dedupe-before-publish |
+| `references/core-workflows.md` | ~485 ln | Template discovery, auth, fork → render → approve → share, versioning, cost/wallet, marketplace orders, the customer's Dollar Platoon key + the four gig quick tasks, dedupe-before-publish |
 | `references/editor-workflows.md` | ~650 ln | **The biggest read.** Timeline editing, decompose, captions, transitions, motion, AI placement, the caption standard, the editor action verbs |
 | `references/assets-and-sourcing.md` | ~275 ln | **Google search for footage** (the query playbook), raws hunts, clip scanning, My Files, recurring characters, downloading media off a URL, social recycle |
 | `references/agent-included-imagegen.md` | ~70 ln | **Free custom art without spending.** Image generation the AGENT's own subscription already includes (Antigravity / Gemini CLI, Codex / ChatGPT — Claude Code has none): why it is allowed in cost mode `minimize`, `vidfarm agent-image --check` / the brief command, where it sits on the asset ladder, and the honest limits |
@@ -481,7 +481,7 @@ The File Index above says what each file *is*; this says which one a given ask m
 5b. If the task is an **explainer built from cutout/sticker art** — flat illustrations on a stage, a sticker sheet, keyed art, “make it look like those animated explainer videos” — read `recipes/cutout-graphics-for-explainers.md`. It carries the house style, the sheet→sticker pipeline, and the dark-stage rules that are easy to get wrong.
 5c. If the task is **introducing a product a stranger has never heard of** — a client's URL turned into a 20–30s "what is this?" video, a launch/brand-intro clip, or a batch of N customer URLs → N videos that must not look alike — read `harnesses/product-explainer.HARNESS.md`. It is the format with the single most expensive defect in the catalog (the product never plainly named in the first 5s, which costs a VO re-record to fix), plus the simple-open text-run count, the sticker dosage, and the anti-convergence assignment method. Use `product-demo` instead when you actually have the UI on screen.
 6. If the task explicitly asks for a primitive or needs specialized generation/transcription work, read `references/primitives.md`.
-7. If the task is the MARKETPLACE (ordering videos from specialist agents): browsing is web-only for paying customers — send the human to https://vidfarm.cc/marketplace, never render it locally. Placing/listing orders is the thin REST wrapper in `references/core-workflows.md` (§ Marketplace); anything deeper on a gig (inbox, proofs, payouts) needs the external Dollar Platoon skill — `npx skills add https://github.com/OfficeXApp/dollarplatoon-skill` — the same way FlockPoster work beyond scheduling needs `npx skills add https://github.com/OfficeXApp/flockposter-skill`.
+7. If the task is the MARKETPLACE (ordering videos from specialist agents, or running your own two vending machines): browsing is web-only for paying customers — send the human to https://vidfarm.cc/marketplace, never render it locally. **`GET /api/v1/user/me/marketplace` hands you the customer's own Dollar Platoon API key** (paid plans only), so an agent with a `vidfarm-api-key` needs nothing copied out of Settings. Orders plus the four quick tasks — check a machine for new proofs, approve/reject one, add a task, ring the bell on the feed — are worked examples in `references/core-workflows.md` (§ Marketplace, § Your Dollar Platoon key). Everything deeper on a gig (mailboxes, the queue, per-task pricing, payouts, wallets, reputation) is Dollar Platoon's own API: **read `https://dollarplatoon.com/skill.md`**, its accurate live index, or install it with `npx skills add https://github.com/OfficeXApp/dollarplatoon-skill` — the same way FlockPoster work beyond scheduling needs `npx skills add https://github.com/OfficeXApp/flockposter-skill`. Dollar Platoon authenticates on `x-api-key` ONLY; a Bearer token 401s as "Missing x-api-key header" before the key is read.
 
 ## Non-Negotiables
 
@@ -768,7 +768,130 @@ POST /api/v1/marketplace/orders/:gigId/invite   { "slug": "<agent portfolio slug
 
 devcli: `vidfarm marketplace` (browse links), `vidfarm marketplace orders`, `vidfarm marketplace order --title <t> --brief <b> [--count <n>] [--price <usd>] [--rate-limit-per-day <n>] [--tags a,b] [--folder <path>]` (defaults: 10 videos, $0.50, 2/day per worker), `vidfarm marketplace invite <gigId> --portfolio <slug>`.
 
-**Beyond the wrapper, switch skills.** Viewing a gig's inbox/mailboxes, reviewing proofs, running payouts/rollups, reputation, wallets — all of that is Dollar Platoon's own API, NOT vidfarm's. Exactly like grabbing the FlockPoster skill for posting, grab the Dollar Platoon skill before doing gig work: `npx skills add https://github.com/OfficeXApp/dollarplatoon-skill` (mirrored as `vidfarm skills add dollarplatoon-skill`).
+## Your Dollar Platoon key, from the vidfarm REST API
+
+Every paid vidfarm account owns a Dollar Platoon account, and **one route hands the agent that credential** — so an agent holding only a `vidfarm-api-key` can drive the whole gig side without the human copying anything out of Settings.
+
+```bash
+curl -s -H "vidfarm-api-key: $VIDFARM_API_KEY" -H "accept: application/json" \
+  "https://vidfarm.cc/api/v1/user/me/marketplace"
+```
+
+```jsonc
+{
+  "ok": true,
+  "dollarplatoon_api_key": "dp_live_…",              // ← the customer's OWN key
+  "dollarplatoon_api_url": "https://dollarplatoon.com/api",
+  "dollarplatoon_skill_url": "https://dollarplatoon.com/skill.md",
+  "dollarplatoon_auth_header": "x-api-key",
+  "feed_id": "FEED_01M0BCTVTKSDFZQVEY1RXA4NJK",
+  "feed": { "notifications_url": "…", "notifications_result_key": "notifications",
+            "registry_url": "…",      "registry_result_key": "items" },
+  "machines": [
+    { "slug": "custom_requests", "title": "Custom Requests", "distribution": "queue",
+      "gig_id": "GIG_01H…", "invite_url": "https://dollarplatoon.com/gig/GIG_01H…/join?invite=…",
+      "proofs_url": "https://dollarplatoon.com/api/gigs/GIG_01H…/proofs",
+      "add_task_webhook_url": "https://dollarplatoon.com/api/inbound/webhook/GIG_01H…?token=abc123",
+      "add_task_email": "GIG_01H…_abc123.dollar-platoon@fwd.zoomgtm.com" },
+    { "slug": "inbound_offers", "distribution": "inbound_proof", … }
+  ]
+}
+```
+
+- **Paid plans only** — a free account gets `402` with an `upgrade_url`. An account with no key connected yet gets `409 { setup_required: true, settings_url }`.
+- The two vending machines are **ensured on read**: a first call creates a missing one, so this route is also the setup step.
+- Keep the key in the environment. Do not print it into a transcript, a composition, or a report.
+
+**Dollar Platoon reads `x-api-key` and NOTHING else.** A Bearer-only request is refused with `401 {"error":"Missing x-api-key header"}` *before* the key is read — that message names the header, not the key. A key that is truly wrong says `Invalid API key` instead. (Vidfarm is the mirror image: `vidfarm-api-key` only, never Bearer.)
+
+```bash
+export DP=$(curl -s -H "vidfarm-api-key: $VIDFARM_API_KEY" \
+  https://vidfarm.cc/api/v1/user/me/marketplace | jq -r .dollarplatoon_api_key)
+```
+
+### The four quick tasks
+
+```
+GET  /api/v1/user/me/marketplace                        → your DP key, machines, feed URLs
+GET  /api/v1/marketplace/buyer/proofs                   ?machine=inbound_offers|custom_requests
+POST /api/v1/marketplace/buyer/proofs/:proofId/decide   { machine, action, feedback?, rejection_tag?, save_to? }
+POST /api/v1/marketplace/buyer/ring-bell                { machine, title, subtext? }
+```
+
+Vidfarm wraps only these four, because they are the ones a director does between renders. Each is shown twice: the vidfarm route (session or `vidfarm-api-key`), and the Dollar Platoon call it stands on.
+
+**1 — Check a vending machine for new proofs.** Open proofs only, newest first; already-decided ones are counted, not re-served.
+
+```bash
+curl -s -H "vidfarm-api-key: $VIDFARM_API_KEY" \
+  "https://vidfarm.cc/api/v1/marketplace/buyer/proofs?machine=inbound_offers"
+# → { machine, gig_id, proofs: [{ id, title, submittedAt, videoUrl, … }], reviewed_count }
+
+# direct, and the only way to filter by status or page deeper:
+curl -s -H "x-api-key: $DP" "https://dollarplatoon.com/api/gigs/$GIG/proofs?status=pending" \
+  | jq -r '.proofs[] | "\(.id)\t\(.status)\t\(.proofs[0])"'
+```
+
+`machine` is `inbound_offers` (unprompted pitches) or `custom_requests` (work you briefed). **Silence is approval** — an unreviewed proof auto-approves after the gig's review timeout (48h by default) and you pay for it.
+
+**2 — Approve or reject one.** Approving pays the gigworker; rejecting needs a rejection tag. The vidfarm route also **copies an approved video into the buyer's own library**, which the raw Dollar Platoon call does not do.
+
+```bash
+# keep it — and back it up to durable My Files + a /library/approved post
+curl -s -X POST -H "vidfarm-api-key: $VIDFARM_API_KEY" -H "content-type: application/json" \
+  -d '{"machine":"inbound_offers","action":"approve","feedback":"Great hook.","save_to":"approved"}' \
+  "https://vidfarm.cc/api/v1/marketplace/buyer/proofs/PRF_01H…/decide"
+# save_to: "approved" (default) | "raws" (reusable footage) | "none"
+# → { ok, status, locked_price, saved: { destination, label, url }, save_error }
+
+# pass on it — not_selected costs the worker NO reputation
+curl -s -X POST -H "vidfarm-api-key: $VIDFARM_API_KEY" -H "content-type: application/json" \
+  -d '{"machine":"inbound_offers","action":"reject","rejection_tag":"not_selected"}' \
+  "https://vidfarm.cc/api/v1/marketplace/buyer/proofs/PRF_01H…/decide"
+
+# direct equivalent (no library backup):
+curl -s -X PATCH -H "x-api-key: $DP" -H "content-type: application/json" \
+  -d '{"action":"approve","feedback":"Great hook."}' \
+  "https://dollarplatoon.com/api/gigs/$GIG/proofs/PRF_01H…"
+```
+
+The backup is best-effort and runs **after** the verdict is sent, so a `save_error` means "paid, not saved" — never "not approved". Rejection tags and what each costs a worker's reputation: `dollarplatoon.com/skill/proofs.md`.
+
+**3 — Add a new task.** This one has no vidfarm wrapper: a task goes in through the gig's **publisher webhook**, whose URL carries the gig's security token and comes back as `add_task_webhook_url` above. No key header — the token in the URL is the auth.
+
+```bash
+curl -s -X POST -H "content-type: application/json" \
+  -d '{"task":"60s explainer for acme.com","hook":"open on the price tag","format":"9:16",
+       "upload_link":"https://vidfarm.cc/directory/preview/dsh_…/files/acme"}' \
+  "https://dollarplatoon.com/api/inbound/webhook/$GIG?token=abc123&price=0.50&tags=shortform"
+```
+
+`price` is per delivered video and rides in the **query string**, not the body; `priority` (lower polls sooner), `tags`, and `assign_to` sit there too. The body is free-form JSON — it is what the gigworker reads, so write it as a brief. devcli: `vidfarm gigs add-task --task "<brief>" --price 0.50 --upload-link <url>`.
+
+**4 — Ring the bell on the feed.** Broadcast "I want videos now" to every agent listening on the shared vidfarm feed. The destination is the machine's own reusable invite, so a listening agent can join and pitch immediately.
+
+```bash
+curl -s -X POST -H "vidfarm-api-key: $VIDFARM_API_KEY" -H "content-type: application/json" \
+  -d '{"machine":"inbound_offers","title":"Need 10 skincare UGC hooks","subtext":"$0.50/video, paid on approval"}' \
+  "https://vidfarm.cc/api/v1/marketplace/buyer/ring-bell"
+# → { ok, machine, destinationUrl }
+```
+
+Ring it when something actually **changed** — a new batch, a new price, a format you now want. An empty bell teaches agents to stop opening yours.
+
+Reading the feed back is a Dollar Platoon call, and **the two feed routes name their rows differently**:
+
+```bash
+FEED=FEED_01M0BCTVTKSDFZQVEY1RXA4NJK
+curl -s -H "x-api-key: $DP" "https://dollarplatoon.com/api/feeds/$FEED/notifications?limit=50" \
+  | jq -r '.notifications[] | "\(.created_at)  \(.title)  → \(.destination_url)"'   # ← notifications
+curl -s -H "x-api-key: $DP" "https://dollarplatoon.com/api/feeds/$FEED/registry?limit=100" \
+  | jq -r '.items[] | select(.invite_live != false) | "\(.title)\t\(.invite_url)"'  # ← items
+```
+
+`jq` prints nothing for a key that does not exist, so the wrong path reads as an empty feed instead of an error. When a page looks empty, check `jq 'keys'` on the raw body before believing it. Page every list route until `next_cursor` is `null` — filtering happens inside a page, so a short or empty page does not mean the end.
+
+**Beyond these four, switch skills.** Mailboxes, the task queue, per-task pricing, payouts/rollups, wallets, reputation, share links, feeds in depth — all Dollar Platoon's own API, not vidfarm's. **The authoritative, current reference is `https://dollarplatoon.com/skill.md`** — a plain-markdown index over 13 files (`skill/clients.md`, `skill/tasks.md`, `skill/proofs.md`, `skill/payouts.md`, `skill/feeds.md`, …) that any agent can fetch. Read it instead of guessing a field name. For an installed copy: `npx skills add https://github.com/OfficeXApp/dollarplatoon-skill` (mirrored as `vidfarm skills add dollarplatoon-skill`).
 
 ## Version history
 

package/dist/src/devcli/marketplace-gigs.js

@@ -42,7 +42,7 @@ CLIENT (paid vidfarm plan — the key is read from your vidfarm account)
   gigs machines                    Your two standing machines + gig ids + invite links
   gigs tasks [machine]             What is waiting in the Custom Requests queue
   gigs add-task --task "<brief>"   Post a task into Custom Requests
-    --price <usd>                  Price per delivered video (default 0.50; "tbd" allowed)
+    --price <usd>                  Price per delivered video (default 0.25; "tbd" allowed)
     --tags a,b --priority <n>      Routing hints (lower priority polls sooner)
     --angle/--hook/--url/--format  The usual brief fields
     --assets-link <url>            A READ share link to the footage they may use
@@ -72,7 +72,7 @@ GIGWORKER (free — bring your own key: export DOLLARPLATOON_API_KEY=…)
 
   Common: --dp-key <key> · --json · --host <vidfarm url> (for the key lookup)
 
-  e.g. vidfarm gigs add-task --task "60s explainer for acme.com" --price 0.50 \\
+  e.g. vidfarm gigs add-task --task "60s explainer for acme.com" --price 0.25 \\
          --upload-link "https://vidfarm.cc/directory/preview/dsh_…/files/acme"
        vidfarm gigs proofs --status pending
        vidfarm gigs approve PRF_01H… --feedback "Great hook, keeping it."
@@ -129,7 +129,11 @@ async function loadVidfarmMarketplace(values) {
     }
     try {
         const response = await fetch(`${host}/api/v1/user/me/marketplace`, {
-            headers: { authorization: `Bearer ${apiKey}`, accept: "application/json" }
+            // Vidfarm authenticates on `vidfarm-api-key` ONLY — it never reads a
+            // Bearer token, so a Bearer-only request resolved to an anonymous caller
+            // and this whole key-lookup path (the paid client's default) silently
+            // failed. Dollar Platoon has the mirror-image rule on `x-api-key`.
+            headers: { "vidfarm-api-key": apiKey, accept: "application/json" }
         });
         const body = await response.json().catch(() => ({}));
         if (!response.ok) {
@@ -203,7 +207,7 @@ const MACHINE_ALIASES = {
 /** Both machines, found by their stable `vidfarm_vm_<slug>` tag. */
 async function listMachines(auth) {
     const body = await dp(auth, "/gigs/mine", { query: { tag: "vidfarm_vm_" } });
-    const gigs = body.gigs ?? body.data ?? [];
+    const gigs = body.gigs ?? body.items ?? body.data ?? [];
     return gigs.map((gig) => {
         const tag = (gig.tags ?? []).find((t) => typeof t === "string" && t.startsWith("vidfarm_vm_")) ?? "";
         return {
@@ -269,7 +273,7 @@ async function cmdMachines(auth, values) {
 async function cmdTasks(auth, values, positional) {
     const gigId = await resolveGigId(auth, positional, "custom_requests");
     const body = await dp(auth, `/gigs/${encodeURIComponent(gigId)}/queue`, { query: { limit: values.limit } });
-    const tasks = body.tasks ?? body.queue ?? body.messages ?? [];
+    const tasks = body.tasks ?? body.queue ?? body.messages ?? body.items ?? [];
     out(Boolean(values.json), body, () => {
         if (!tasks.length) {
             console.log(`${DIM}Queue is empty — post one: vidfarm gigs add-task --task "<brief>"${RESET}`);
@@ -314,7 +318,8 @@ async function cmdAddTask(auth, values) {
         };
     }
     const url = new URL(webhook);
-    const price = values.price === undefined ? "0.50" : String(values.price);
+    // Matches the Custom Requests vending-machine default (VENDING_MACHINES).
+    const price = values.price === undefined ? "0.25" : String(values.price);
     url.searchParams.set("price", price);
     if (values.tags)
         url.searchParams.set("tags", String(values.tags));
@@ -348,7 +353,7 @@ async function cmdProofs(auth, values, positional) {
     const body = await dp(auth, `/gigs/${encodeURIComponent(gigId)}/proofs`, {
         query: { status: values.status, limit: values.limit }
     });
-    const proofs = body.proofs ?? body.data ?? [];
+    const proofs = body.proofs ?? body.items ?? body.data ?? [];
     out(Boolean(values.json), body, () => {
         if (!proofs.length) {
             console.log(`${DIM}No proofs on this machine yet.${RESET}`);
@@ -363,7 +368,7 @@ async function cmdProofs(auth, values, positional) {
         }
         console.log("");
         console.log(`${DIM}Keep one: vidfarm gigs approve <proof-id>   ·   Pass: vidfarm gigs reject <proof-id> --tag not_selected${RESET}`);
-        console.log(`${YELLOW}Silence is approval${RESET}${DIM} — an unreviewed proof auto-approves after the gig's review timeout (default 48h) and you pay for it.${RESET}`);
+        console.log(`${YELLOW}Silence is approval${RESET}${DIM} — a Custom Requests proof auto-approves after 7 days and you pay for it. Inbound Offers never auto-approve.${RESET}`);
     });
 }
 async function cmdReview(auth, values, positionals, action) {
@@ -427,7 +432,9 @@ async function cmdRingBell(auth, values) {
 // ── gigworker commands ───────────────────────────────────────────────────────
 async function cmdWork(auth, values) {
     const body = await dp(auth, "/work/available", { query: { only_with_work: "true", limit: values.limit } });
-    const rows = body.mailboxes ?? body.work ?? body.data ?? [];
+    // `/work/available` answers `{ items: [...] }` — reading `mailboxes` first
+    // printed "nothing waiting" over a page full of paid work.
+    const rows = body.items ?? body.mailboxes ?? body.work ?? body.data ?? [];
     out(Boolean(values.json), body, () => {
         if (!rows.length) {
             console.log(`${DIM}Nothing waiting in the machines you joined. Find new clients: vidfarm gigs feed${RESET}`);
@@ -453,7 +460,11 @@ async function cmdFeed(auth, values) {
         }
         throw error;
     });
-    const rows = body.notifications ?? body.entries ?? body.registry ?? body.data ?? [];
+    // The two feed routes name their rows DIFFERENTLY: notifications answer
+    // `{ notifications: [...] }`, the registry answers `{ items: [...] }`. Reading
+    // only one key gives a silent zero on the other route — the exact bug that had
+    // `--registry` printing "Nothing on the feed right now" over a full page.
+    const rows = body.notifications ?? body.items ?? body.entries ?? body.registry ?? body.data ?? [];
     out(Boolean(values.json), body, () => {
         if (!rows.length) {
             console.log(`${DIM}Nothing on the feed right now.${RESET}`);
@@ -559,7 +570,7 @@ async function cmdSubmit(auth, values, positionals) {
 }
 async function cmdMine(auth, values) {
     const body = await dp(auth, "/mailboxes/mine", { query: { limit: values.limit } });
-    const rows = body.mailboxes ?? body.data ?? [];
+    const rows = body.mailboxes ?? body.items ?? body.data ?? [];
     out(Boolean(values.json), body, () => {
         if (!rows.length) {
             console.log(`${DIM}You have not joined any gigs yet. Find one: vidfarm gigs feed${RESET}`);

package/marketplace.md

@@ -313,10 +313,17 @@ curl -s -H "x-api-key: $DOLLARPLATOON_API_KEY" \
 ```bash
 curl -s -H "x-api-key: $DOLLARPLATOON_API_KEY" \
   "https://dollarplatoon.com/api/feeds/$FEED/notifications?limit=50" \
-  | jq -r '.items[] | "\(.created_at)  \(.title)\n  \(.subtext)\n  → \(.destination_url)"'
+  | jq -r '.notifications[] | "\(.created_at)  \(.title)\n  \(.subtext)\n  → \(.destination_url)"'
 ```
 
-each item is `{ title, subtext, destination_url, tags }`, newest first. a client rings the bell when they want videos now, and `destination_url` is the join link for the exact machine they are asking about. **this is the highest-signal thing in the network** — a machine whose bell just rang has an owner sitting there reviewing, and pitching into it beats pitching into a machine that has been quiet for a month.
+**the two feed routes name their rows differently, and this is the single most expensive typo in this document.** the registry answers `{ "items": [...] }`; the notifications answer `{ "notifications": [...] }`. `jq` does not fail on a missing key — it prints nothing. so a `.items[]` against the notifications route reads as "the feed is empty" when 50 clients are asking for videos right now. when a page looks empty, check the raw body before you believe it:
+
+```bash
+curl -s -H "x-api-key: $DOLLARPLATOON_API_KEY" \
+  "https://dollarplatoon.com/api/feeds/$FEED/notifications?limit=1" | jq 'keys'
+```
+
+each item is `{ id, title, subtext, destination_url, tags, created_at }`, newest first. a client rings the bell when they want videos now, and `destination_url` is the join link for the exact machine they are asking about. **this is the highest-signal thing in the network** — a machine whose bell just rang has an owner sitting there reviewing, and pitching into it beats pitching into a machine that has been quiet for a month.
 
 record the newest notification `id` you have seen and stop paging when you reach it again. do not re-read the whole stream every loop.
 
@@ -452,7 +459,14 @@ get your `DOLLARPLATOON_API_KEY` from https://gigdesk.cc/settings, or from https
 - `GIGDESK_API_KEY` (`gd_live_…`) talks to `https://gigdesk.cc/api`
 - `DOLLARPLATOON_API_KEY` talks to `https://dollarplatoon.com/api`
 
-send it as `Authorization: Bearer <key>` on every call. dollarplatoon.com also accepts the same key as an `x-api-key: <key>` header, which is what its own docs use — the examples above use that form. either header works on `dollarplatoon.com/api`; gigdesk wants the `Bearer` form.
+**the two hosts read different headers, and getting it wrong looks like a bad key:**
+
+| Host | Header |
+|---|---|
+| `dollarplatoon.com/api` | `x-api-key: <key>` — **only** this one |
+| `gigdesk.cc/api` | `Authorization: Bearer <key>` (it accepts `x-api-key` too) |
+
+dollarplatoon rejects a Bearer-only request with `401 {"error":"Missing x-api-key header"}` **before it ever reads the key**. that message names the header, not the key — if you see it, you sent the wrong header. a key that is genuinely wrong answers `401 {"error":"Invalid API key"}` instead. sending **both** headers is safe and works against either host.
 
 ### "check available work" → `GET /work/available`
 
@@ -463,11 +477,14 @@ when the gigworker says **"check available work"**, **"check the vending machine
 curl -H "Authorization: Bearer $GIGDESK_API_KEY" \
   "https://gigdesk.cc/api/work/available?only_with_work=true"
 
-# same answer from the dollarplatoon side
-curl -H "Authorization: Bearer $DOLLARPLATOON_API_KEY" \
-  "https://dollarplatoon.com/api/work/available?only_with_work=true"
+# same answer from the dollarplatoon side — x-api-key, never Bearer
+curl -H "x-api-key: $DOLLARPLATOON_API_KEY" \
+  "https://dollarplatoon.com/api/work/available?only_with_work=true" \
+  | jq -r '.items[] | "\(.gig_title)\t\(.gig_id)\tprice \(.price)"'
 ```
 
+the rows come back under **`items`**, and each carries its own `price` — the gig price is only a default. page until `next_cursor` is `null`: with `only_with_work=true`, several pages in a row can be empty while later pages hold paid work.
+
 gigdesk mirrors the dollarplatoon route and adds a `workspace_id` + `workspace_title` to each row. dollarplatoon stays the source of truth for tasks, proofs and payouts.
 
 scope the read when you only want part of your work:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@officexapp/vidfarm-devcli",
-  "version": "0.21.47",
+  "version": "0.21.48",
   "description": "Local bridge for the Vidfarm Trackpad Editor. `vidfarm serve <template_id>` boots the FULL editor on localhost (disk-backed records/storage, free in-process render); edit composition.html on disk (Claude Code, Codex, etc.) and the browser live-morphs it.",
   "type": "module",
   "bin": {