@open-everywhere/create 0.6.0 → 0.8.0

package/template/agent/model/models.ts

@@ -7,6 +7,8 @@ import {
   registerDefaultAgentModelId,
 } from "@open-everywhere/core/agent/model/default-model.js";
 import { getSettings } from "@open-everywhere/core/agent/settings/settings.js";
+import { viaProblem, type ModelTargets } from "@open-everywhere/core/agent/model/targets.js";
+import { registerBareModelRoutes } from "@open-everywhere/core/agent/model/bare-model-via.js";
 import { SETTINGS_OVERRIDES } from "../settings/settings.js";
 import { resolveStack, resolveTranscription, type ModelRole, type ModelRoleSpec, type ModelStack } from "./stacks.js";
 
@@ -19,6 +21,10 @@ const STACK: ModelStack = resolveStack(STACK_ALIAS, {});
 
 // A deploy can retarget the primary (`models.force` / `models.primary` in agent/settings/settings.ts).
 // Core owns that precedence, so read the primary back from it.
+// Every role's `via` names a `models.targets` entry (OPE-2556). Fail LOUD at config load: an unknown target would
+// otherwise fail every call of that role at run time.
+assertStackVia(STACK, MODEL_SETTINGS.targets);
+
 registerDefaultAgentModelId(STACK.primary.id);
 
 export const MODELS = {
@@ -29,6 +35,9 @@ export const MODELS = {
   judge: STACK.judge,
 } as const satisfies Record<string, ModelRoleSpec>;
 
+// A bare model id (a declared subagent's `model`) goes through the target of the role that names it, else the primary's.
+registerBareModelRoutes(Object.values(MODELS));
+
 /** The alias of the stack this process resolved — for `/oe status`. */
 export const MODEL_STACK = STACK_ALIAS;
 /** The meeting bot's speech-to-text role: a primary and a fallback route (stacks.ts TRANSCRIPTION). */
@@ -38,6 +47,8 @@ export const PRIMARY_MODEL = MODELS.primary.id;
 export const UTILITY_MODEL = MODELS.utility.id;
 export const VISION_MODEL = MODELS.vision.id;
 export const SUPERVISOR_MODEL = MODELS.supervisor.id;
+/** The supervisor role's `models.targets` entry (OPE-2556): the org domain's supervisor route carries it. */
+export const SUPERVISOR_VIA = MODELS.supervisor.via;
 export const JUDGE_MODEL = MODELS.judge.id;
 export const PRIMARY_MODEL_CONTEXT_WINDOW_TOKENS = MODELS.primary.contextWindowTokens;
 
@@ -62,3 +73,9 @@ export function allowListForStack(stack: ModelStack, extra: readonly ModelPolicy
 export function modelAllowList(extra: readonly ModelPolicyAllowEntry[] = []): ModelPolicyAllowEntry[] {
   return allowListForStack(MODELS, extra);
 }
+
+/** Throw when a stack role's `via` names no `models.targets` entry. Exported for tests. */
+export function assertStackVia(stack: ModelStack, targets: ModelTargets): void {
+  const bad = (Object.keys(stack) as ModelRole[]).flatMap((role) => viaProblem(stack[role].via, targets, `stack role "${role}"`) ?? []);
+  if (bad.length > 0) throw new Error(`open-everywhere: ${bad.join("; ")}`);
+}

package/template/agent/model/stacks.ts

@@ -9,7 +9,9 @@
 //   judge      — the auto-approval judge.
 //
 // Every id is an AI Gateway model id. Add a stack by adding an entry, and give each new id a rate in
-// agent/spend/model-pricing.ts, or a USD spend cap cannot see its cost.
+// agent/spend/model-pricing.ts, or a USD spend cap cannot see its cost. A role's `via` names the
+// `models.targets` entry its calls go through: the European stack uses the `mistral` target in
+// agent/settings/settings.ts (only the Mistral provider, zero retention).
 
 import type { ModelTier } from "@open-everywhere/core/agent/memory/domain.js";
 import type { TranscriptionRoleSpec } from "@open-everywhere/adapters/agent/model/transcription-routes.js";
@@ -21,17 +23,19 @@ export interface ModelRoleSpec {
   readonly tier: ModelTier;
   /** The model's context window. eve compacts at `agent.compactionThresholdPercent` of it. */
   readonly contextWindowTokens: number;
+  /** The `models.targets` entry this role's calls go through (OPE-2556). Absent: `"gateway"`. An unknown name fails config load. */
+  readonly via?: string;
 }
 
 export type ModelStack = Readonly<Record<ModelRole, ModelRoleSpec>>;
 
 export const STACKS = {
   "chinese-open-weights": {
-    primary: { id: "deepseek/deepseek-v4-flash-0731", tier: "high", contextWindowTokens: 1_000_000 },
-    utility: { id: "deepseek/deepseek-v4-flash-0731", tier: "low", contextWindowTokens: 1_000_000 },
+    primary: { id: "deepseek/deepseek-v4.1-flash", tier: "high", contextWindowTokens: 1_000_000 },
+    utility: { id: "deepseek/deepseek-v4.1-flash", tier: "low", contextWindowTokens: 1_000_000 },
     vision: { id: "alibaba/qwen3-vl-instruct", tier: "low", contextWindowTokens: 131_072 },
-    supervisor: { id: "deepseek/deepseek-v4-flash-0731", tier: "low", contextWindowTokens: 1_000_000 },
-    judge: { id: "deepseek/deepseek-v4-flash-0731", tier: "low", contextWindowTokens: 1_000_000 },
+    supervisor: { id: "deepseek/deepseek-v4.1-flash", tier: "low", contextWindowTokens: 1_000_000 },
+    judge: { id: "deepseek/deepseek-v4.1-flash", tier: "low", contextWindowTokens: 1_000_000 },
   },
   "american-closed": {
     primary: { id: "openai/gpt-6-luna", tier: "high", contextWindowTokens: 1_050_000 },
@@ -40,6 +44,14 @@ export const STACKS = {
     supervisor: { id: "openai/gpt-6-luna", tier: "low", contextWindowTokens: 1_050_000 },
     judge: { id: "openai/gpt-6-luna", tier: "low", contextWindowTokens: 1_050_000 },
   },
+  // Mistral Small 4 (Apache 2.0) in every role, vision included, served by Mistral with zero retention.
+  "european-open-weights": {
+    primary: { id: "mistral/mistral-small", tier: "high", contextWindowTokens: 262_144, via: "mistral" },
+    utility: { id: "mistral/mistral-small", tier: "low", contextWindowTokens: 262_144, via: "mistral" },
+    vision: { id: "mistral/mistral-small", tier: "low", contextWindowTokens: 262_144, via: "mistral" },
+    supervisor: { id: "mistral/mistral-small", tier: "low", contextWindowTokens: 262_144, via: "mistral" },
+    judge: { id: "mistral/mistral-small", tier: "low", contextWindowTokens: 262_144, via: "mistral" },
+  },
 } as const satisfies Record<string, ModelStack>;
 
 export type StackAlias = keyof typeof STACKS;
@@ -78,7 +90,7 @@ export function resolveStack(alias: string, overrides: StackOverrides = {}): Mod
 // Speech to text for the meeting bot: a primary and a fallback route per stack, on two different providers, so
 // one provider outage falls through to the other. A route names its transport too: the AI Gateway, DeepInfra
 // (key: `oe secret set DEEPINFRA_API_KEY`), or your own OpenAI-compatible speech server. These defaults are
-// pending a bake-off (`npm run bakeoff:stt` in the Open Everywhere repository).
+// pending a bake-off (the `bakeoff:stt` script of the Open Everywhere repository).
 export const TRANSCRIPTION = {
   "chinese-open-weights": {
     primary: { via: "deepinfra", id: "Qwen/Qwen3-ASR-1.7B" },
@@ -88,6 +100,11 @@ export const TRANSCRIPTION = {
     primary: { via: "gateway", id: "microsoft/mai-transcribe-2" },
     fallback: { via: "gateway", id: "spacexai/grok-stt" },
   },
+  // Mistral's Voxtral on your own speech server, then Qwen3-ASR on a second one: audio stays on your machines.
+  "european-open-weights": {
+    primary: { via: "self-hosted", id: "mistralai/Voxtral-Mini-3B-2507", baseUrl: "http://voxtral:8000/v1" },
+    fallback: { via: "self-hosted", id: "Qwen/Qwen3-ASR-1.7B", baseUrl: "http://qwen3-asr:8000/v1" },
+  },
 } as const satisfies Record<StackAlias, TranscriptionRoleSpec>;
 
 /** Fully local: your own speech server only. For a Docker deployment with no cloud model. */

package/template/agent/routines/collectors.ts

@@ -65,6 +65,28 @@
 // "merged is not live" case from the OPE-151 audit, and it is the one where getting it backwards is
 // most expensive: telling a customer their bug is fixed because a deploy read timed out.
 //
+// ── The chief-of-staff watch (OPE-2422) ───────────────────────────────────────────────────────
+//
+// The PERSONAL WATCH reads each person's own sources on a schedule and messages them in their DM when it finds
+// something that needs them, such as two meetings that overlap. A source is one of the collectors above, read
+// AS the person (the reader receives `forPrincipal`), plus the detector that reads its body:
+//
+//   ROUTINE_COLLECTORS: [{
+//     name: "calendar.next-3-days",
+//     tool: "gcal__list_events",                          // the person's own calendar connector
+//     args: { timeMin: "now", timeMax: "+3d", singleEvents: true },
+//     describe: "the person's own calendar for the next three days",
+//     personal: true,                                     // read AS one person; the watch names only these
+//   }],
+//   PERSONAL_WATCH: { sources: [{ collector: "calendar.next-3-days", detect: "calendar-conflicts" }] },
+//
+// 🔴 ON BY DEFAULT FOR EVERY MEMBER once a source is declared here: each member of the organisation who talks to
+// the agent in their own DM is watched at `less`, and turns it to `more` or `none` with `/oe watch` or the Home tab.
+// With no source declared, the watch makes no read and sends nothing. The boot refuses a source whose collector is
+// not `personal: true`, and a personal read reaches only a reader registered with
+// `registerRoutineCollectorReader(reader, { personal: true })` — a reader that promises to read as `forPrincipal`
+// with that person's own sign-in, and to throw when it cannot (routines/collector.ts).
+
 // ── THE READER SEAM ────────────────────────────────────────────────────────────────────────────
 //
 // 🔴 A COLLECTOR ONLY RUNS WHERE A READER IS REGISTERED, AND CORE SHIPS NONE. The dispatcher tick is
@@ -77,6 +99,7 @@
 
 import { registerRoutineCollectors, type RoutineCollectorDef } from "@open-everywhere/core/agent/routines/collector.js";
 import { registerRoutineGates, type RoutineGateDef } from "@open-everywhere/core/agent/routines/gate.js";
+import { registerPersonalWatch, type PersonalWatchDecl } from "@open-everywhere/core/agent/personal-watch/watch.js";
 
 /** The reads this deployment lets a routine run before its fire. Empty by default — declare one
  *  here and it becomes nameable by `create_routine`, and by nothing else. */
@@ -85,5 +108,10 @@ export const ROUTINE_COLLECTORS: readonly RoutineCollectorDef[] = [];
 /** The conditions this deployment lets a routine fire behind. Empty by default. */
 export const ROUTINE_GATES: readonly RoutineGateDef[] = [];
 
+/** The chief-of-staff watch's sources. Empty by default: the watch reads nothing until one is declared. */
+export const PERSONAL_WATCH: PersonalWatchDecl = { sources: [] };
+
 registerRoutineCollectors(ROUTINE_COLLECTORS);
 registerRoutineGates(ROUTINE_GATES);
+// After the collectors: a watch source names a declared collector, and the registration refuses one it cannot find.
+registerPersonalWatch(PERSONAL_WATCH);

package/template/agent/settings/settings.ts

@@ -9,8 +9,11 @@
 //
 // Examples:
 //   identity: { name: "Ada" },        // the name the agent answers to
-//   models: { stack: "chinese-open-weights" },   // every model role at once
-//   sandbox: { selfHostBackend: "justbash" },     // the backend a Docker-image build must declare
+//   models: { stack: "chinese-open-weights" },   // every model role at once (or "european-open-weights")
+//   models: { dataPolicy: { zeroRetention: true } },  // every model call: only zero-retention providers
+//   models: { targets: { gateway: { kind: "vercel-ai-gateway", providers: { only: ["openai", "azure"] } } } },  // only these providers
+//   After a change to `models`, run `npm run check:model-config`: it names a model no provider can serve.
+//   sandbox: { selfHostBackend: "docker" },       // a per-session container; needs a Docker daemon at build time
 //
 // Every behaviour choice that used to be an env var lives here too (OPE-2411): the model pins
 // (`models.*`), the admin control plane (`control.*`), the directory sync (`directory.*`), AWS
@@ -31,4 +34,20 @@ export const SETTINGS_OVERRIDES = defineSettings({
   // refuses: no browser tool mounts, no host opens, and the boot logs one line that names the
   // platform. Set `enabled: false` to turn the browser off, and to silence that line off Vercel.
   browser: { enabled: true },
+  // The sandbox backend off Vercel. eve provisions the sandbox template at BUILD time, on this
+  // backend, so it decides where `npm run build` works: `justbash` needs nothing, and `docker` needs
+  // a running Docker daemon at build time. The image (Dockerfile) builds with no daemon, so the
+  // Docker route needs `justbash`, and so does a local build on a machine without Docker.
+  // justbash shares the app process's filesystem: development-grade isolation. On Vercel this line
+  // has no effect: the Vercel Sandbox always runs there.
+  sandbox: { selfHostBackend: "justbash" },
+  // Where model calls go. `gateway` is the shipped target. `mistral` is the European stack's route
+  // (`european-open-weights` in agent/model/stacks.ts): only the `mistral` provider, and every call
+  // demands zero retention. A role with no `via` uses `gateway`, so this entry changes no other call.
+  models: {
+    targets: {
+      gateway: { kind: "vercel-ai-gateway" },
+      mistral: { kind: "vercel-ai-gateway", providers: { only: ["mistral"] }, dataPolicy: { zeroRetention: true } },
+    },
+  },
 });

package/template/agent/spend/model-pricing.ts

@@ -11,11 +11,13 @@ import { defineModelPricing, assertModelPricingValid, type ModelPricingTable } f
 
 const pricing: ModelPricingTable = defineModelPricing({
   // chinese-open-weights: primary, utility, supervisor and judge.
-  "deepseek/deepseek-v4-flash-0731": { inPerMtok: 0.14, outPerMtok: 0.28 },
+  "deepseek/deepseek-v4.1-flash": { inPerMtok: 0.3, outPerMtok: 1.2 },
   // chinese-open-weights: vision.
   "alibaba/qwen3-vl-instruct": { inPerMtok: 0.2, outPerMtok: 0.88 },
   // american-closed: vision.
   "google/gemini-3.8-flash": { inPerMtok: 0.75, outPerMtok: 3.75 },
+  // european-open-weights: every role.
+  "mistral/mistral-small": { inPerMtok: 0.15, outPerMtok: 0.6 },
 });
 
 assertModelPricingValid(pricing);

package/template/claude/skills/quickstart-open-everywhere/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: quickstart-open-everywhere
-description: Set up, configure or deploy an Open Everywhere app — from a fresh scaffold to an agent that answers in Slack. Use when the user wants to set up Open Everywhere, deploy it, or connect Slack, Notion or GitHub. Two routes are supported, Vercel and Docker, and step 1 is to ask which. Drives the open-everywhere-ops MCP server (preflight, surface_manifest, scaffold_env, scaffold_credential_key, secret_set/list/rm) and the `@open-everywhere/create --check --json` status report.
+description: Set up, configure or deploy an Open Everywhere app — from a fresh scaffold to an agent that answers in Slack. Use when the user wants to set up Open Everywhere, deploy it, or connect Slack, Notion or GitHub. Two routes are supported, Vercel and Docker, and step 1 is to ask which. Drives the open-everywhere-ops MCP server (preflight, surface_manifest, surface_app_create, scaffold_env, scaffold_credential_key, secret_set/list/rm, sovereignty), the `@open-everywhere/create --check --json` status report and the `npm run check:model-config` model check.
 ---
 
 # Quickstart Open Everywhere
@@ -79,6 +79,10 @@ To turn it off, `OE_TELEMETRY=off` (or `DO_NOT_TRACK=1`) must be set on the DEPL
 `printf off | npx vercel env add OE_TELEMETRY production`. On the Docker route, put it in the
 container's environment. Every boot prints a line that says whether telemetry is on.
 
+eve's own CLI telemetry is separate: Open Everywhere sets `EVE_TELEMETRY_DISABLED=1` where it
+starts eve (its npm scripts and `Dockerfile`), and `OE_TELEMETRY` does not change it. For an `eve`
+command run by hand, or an app scaffolded before 0.8.0, read the eve section of the page above.
+
 ## Status, at every step
 
 - `npx @open-everywhere/create --check --json` — the step list as data: `satisfied`, `detail`, and a
@@ -92,6 +96,56 @@ Re-run both after each step. They are the only answer to "what is left to do": t
 tool. The same step list, written for a human, is
 `https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/setup-steps.md`.
 
+## Check the model config, after every model setting
+
+Run `npm run check:model-config` after the model settings are written, and before the deploy that
+carries them. The Vercel route runs it at its build step, and the Docker route at its model route
+step. Run it again after each change to `models` in `agent/settings/settings.ts` (`dataPolicy`,
+`targets`, `force`), to the stack in `agent/model/stacks.ts`, or to a model route of a domain or a
+role. The command is the same in both homes. For each model, it reads the public list of endpoints
+from the model's target: the AI Gateway, unless `models.targets` names another URL. So it needs the
+network and no credential. It changes nothing.
+
+Read the result to the user in plain words:
+
+- **Exit 0, no `✗` line and no `?` line.** Each model the app can use has a provider that meets
+  every demand. Go on.
+- **A `?` line that says "did not answer", "answered HTTP" or "not in the expected shape".** The
+  check did not run for that model. This is not a green. Fix the network, then run it again. A
+  target URL that "does not serve the endpoints read" (a relay) cannot be checked here: say so.
+- **A `?` line that says a `providers.only` name "serves none of the checked models".** The name is
+  most likely a typo. Show it to the user.
+- **A `?` line that says "does not say whether".** The gateway does not publish that fact, so the
+  demand is unknown. Name the model and the demand to the user, then go on.
+- **Exit 1, a `✗` line.** Each line names one demand and one model. Read it to the user:
+  - `region eu: no provider for deepseek/deepseek-v4.1-flash` (or `zeroRetention`, `noTraining`,
+    `providers.only`): no provider meets the demand. Under it every call of that model fails
+    closed: the call errors, and it never goes to a provider outside the demand. The choices are a
+    stack whose models meet the demand, a wider `providers.only` list, or fewer rows in
+    `models.dataPolicy` or in the target's own `dataPolicy`.
+  - `models.dataPolicy and target <name> name two different regions`: no call can meet both.
+    Keep one region.
+  - `the gateway does not know this model`: correct the model id in the stack or the route.
+  - `models.targets names no such target`: add the target to `models.targets`, or correct the
+    `via` name.
+
+  **Do not deploy on this red.** Let the user pick the fix, then run the check again. One role
+  differs: transcription tries the fallback route that `agent/model/stacks.ts` names when the
+  primary route fails. So a red on the primary transcription model sends the audio to the fallback
+  route. Check that route too.
+
+After the deploy, `--check --host` reads the same check in the `model-route` row of the status
+route. That row names no model, so on a `no` there, run `npm run check:model-config` for the names.
+An app scaffolded before 0.8.0 has no `check:model-config` script: its upgrade notes say how to add it.
+
+## Tell the user where their data lives
+
+Before the first deploy, offer the data map once: `npx oe sovereignty --host vercel` (or
+`--host docker`), or the `sovereignty` ops tool. For each piece of data it says where it lives,
+which region, and which company could be compelled to hand it over. It reads the app's own config
+and changes nothing. Give the user the short version. Run it again after a change to the model
+settings or the store.
+
 ## The Vercel route
 
 1. **Install.** If `node_modules` is missing: `npm install`. Its `postinstall` runs `oe-eve-patch`,
@@ -132,7 +186,8 @@ tool. The same step list, written for a human, is
    `agent/memory/config/domains/org.ts` set `admins: ["slack/<team-id>/<member-id>"]`. Offer to
    commit both edits. They take effect on the next deploy, so make them before it.
    Then OFFER the optional window step below. Do not make it for the user unasked.
-8. **Build.** `npm run build`. It must pass.
+8. **Build.** `npm run build`. It must pass. Then `npm run check:model-config`, and read it as
+   "Check the model config" above says. A `✗` line stops the route here.
 9. **Deployment env.** `.env.local` never ships, so the deployment reads only what you set ON it.
    The names are `OE_CREDENTIAL_ENCRYPTION_KEY`, `SLACK_BOT_TOKEN` and `SLACK_SIGNING_SECRET`. The
    Neon integration already set `DATABASE_URL` there, and that one value resolves both stores — so
@@ -170,20 +225,28 @@ Then:
 1. **Install and build.** `npm install`, then `npm run build`.
 2. **Postgres.** Provision one the container can reach. The user runs `npx oe env set DATABASE_URL`
    and pastes its connection string at the prompt. That one value resolves both stores to postgres;
-   set no provider selector.
+   set no provider selector. The compose stack of step 6 also carries a Postgres of its own.
 3. **Key.** `scaffold_credential_key`.
 4. **Model route.** There is no OIDC off Vercel, so the user supplies `AI_GATEWAY_API_KEY` (Vercel
    → AI Gateway → API Keys issues one for any host) with `npx oe env set AI_GATEWAY_API_KEY`. Running a different model backend instead is
    an **adapter swap in app code**
    (`https://github.com/open-everywhere/open-everywhere/blob/main/docs/extending/adapter-model.md`),
    which `--check` cannot see: that step stays `missing` on the Docker route either way, so read it
-   and move on rather than chasing a green it cannot give.
+   and move on rather than chasing a green it cannot give. On the gateway, run
+   `npm run check:model-config` once the model settings are written, and read it as "Check the
+   model config" above says. A `✗` line stops the route here.
 5. **Slack app.** Exactly as steps 5–7 of the Vercel route.
-6. **Run it.** Build the image and run it on the server, with the contract's environment set and a
-   public HTTPS URL in front. The Open Everywhere repository's own `Dockerfile` and
-   `docker-compose.yml` are the starting point
-   (`https://github.com/open-everywhere/open-everywhere`); a scaffolded app ships neither, so copy
-   them from there.
+6. **Run it.** The app ships its own `Dockerfile` and `docker-compose.yml`: the image, the egress
+   proxy (`deploy/egress-proxy/`), Postgres and its WebSocket bridge. On the server, the user puts
+   the contract's environment in `.env`, with `OE_EGRESS_PROXY_TOKEN` (`openssl rand -hex 32`) and
+   a `POSTGRES_PASSWORD`, then runs `docker compose up --build`. The compose file sets
+   `DATABASE_URL` to its own `postgres` service. For the managed Postgres of step 2 instead, put
+   its `DATABASE_URL` in `.env`, then delete the app's `DATABASE_URL` and `OE_NEON_WS_PROXY` lines
+   and the `postgres` and `neon-wsproxy` services from the compose file. Put a TLS-terminating
+   reverse proxy in front that forwards `/eve/` and `/.well-known/workflow/`.
+   Tell the user plainly: this stack runs the `justbash` sandbox backend, so the agent's shell
+   shares the app process's filesystem and environment, every `.env` value included. That is
+   development grade, and it does not meet the contract's `sandbox-backend` requirement.
 7. **Prove it, then the Slack URLs and the hello.** As steps 11–13 of the Vercel route, with
    `--route docker --host https://<host>`.
 
@@ -233,6 +296,30 @@ person in chat cannot add one.
 With no server declared, nothing changes: the build writes no connection for one, and only the
 shipped connections (Notion) stay mounted.
 
+## Optional: connect GitHub
+
+Offer this step after the first deploy, when the user wants the agent to work in GitHub. The
+GitHub App is one click: the ops server generates its manifest, and GitHub hands the App's keys
+back to a page on this computer, so the user copies nothing.
+
+1. Call `surface_app_create { surface: "github", baseUrl: "https://<host>" }`. Pass
+   `owner: "<org login>"` to create the App under an organization. The default App also answers
+   @mentions on issues and pull requests; `variant: "source-control"` creates one for checkout,
+   pull requests and ticket actions only.
+2. Give the user the `openUrl` from the reply. It is a local page: they open it in a browser on
+   this computer. GitHub opens with the App filled in. They check the name (GitHub App names are
+   unique, so they change it if GitHub says it is taken) and confirm.
+3. Call `surface_app_create { surface: "github", action: "status" }`. `state: "done"` lists the
+   env names written to `.env.local` and the App's install link. Keep the link for step 5.
+4. On the Vercel route, push each name in `written` exactly as in step 9, then redeploy. On the
+   Docker route, add each one to the server's `.env` (Docker step 6), then restart the stack.
+5. Only after that redeploy or restart, ask the user to open the install link and install the App
+   on the repositories the agent works in. The install sends one `installation` delivery, and the
+   deployment learns the installation from it. Before the redeploy the deployment does not hold the
+   App's webhook secret, so it refuses that delivery and never learns the installation.
+
+The tool never returns a value, and it refuses to overwrite names `.env.local` already holds.
+
 ## Develop locally
 
 Only when the user asks to change or debug the agent — never as a setup step. The user creates

package/template/claude/skills/upgrade-open-everywhere/SKILL.md

@@ -37,7 +37,7 @@ npm view @open-everywhere/core version
 **Read the installed one, not the pin.** `oe upgrade` writes the pins before it installs, so an
 upgrade that stopped part way leaves a manifest that names a version the app is not running.
 
-The ten packages publish in lockstep, so one version answers for all of them. Agree the target
+The eleven packages publish in lockstep, so one version answers for all of them. Agree the target
 with the user before you go on. Taking the latest is the normal choice.
 
 ## 2. Read the notes between the two versions
@@ -55,13 +55,19 @@ nothing. Each entry names:
 | CONFIG | a change to this app's own config files. A codemod applies some; the rest are yours. |
 | ENV + / ENV - | an env NAME the deployment starts or stops needing. The admin sets the value. |
 | MANUAL | a step outside the files — a dashboard change, a URL to re-paste, a key to rotate. |
+| DEFAULT | behaviour the release turns on with no config change. It applies at the next deploy. The line says which setting turns it off, if one does. |
 
 The installed copy of the record cannot know about a release published after it, so `--plan`
 says plainly which crossed versions it has no entry for. The full window is printed again in
 step 3, after the install puts the target's own copy on disk. The same text is in
 `node_modules/@open-everywhere/core/UPGRADING.md`.
 
-**Stop and ask the user** when the window holds a breaking change, an env change or a manual step.
+The installed core prints no DEFAULT line for the target. To see the target's new defaults before
+the install, run the target's own `oe`:
+`npx -p @open-everywhere/core@<target> oe upgrade --plan --to <target>`.
+
+**Stop and ask the user** when the window holds a breaking change, an env change, a manual step or
+a new default.
 Those are decisions, not steps.
 
 `--plan` also prints a **template drift** report. It compares every file the scaffold copied into
@@ -116,7 +122,12 @@ In order, and it stops at the first step that fails:
 4. run the config codemods the target's notes name, and print the migrations that are yours;
 5. `oe build --accept` — this rewrites `roster.lock.json`;
 6. `npm run typecheck`;
-7. `npm run build`.
+7. `npm run build`. eve prepares the sandbox template at build time. Off Vercel an app whose
+   `sandbox.selfHostBackend` is `docker` needs a running Docker daemon for that (this template
+   declares `justbash`, which needs nothing). When the build fails, `docker version` does not
+   answer, and the app's `build` script ends in `eve build`, a core at 0.8.0 or later builds
+   again with `npm run build -- --skip-sandbox-prewarm` and says so in one line. eve says that output may not be deployable, so do not start or deploy
+   it. A Vercel deploy builds again on Vercel.
 
 A failed step prints which one and leaves the tree where it stopped. Fix the cause and run
 `oe upgrade` again: it RESUMES, from whichever step stopped it.
@@ -158,7 +169,8 @@ thing the agent can do. If a line surprises you, say so to the user before the p
 is the review surface, and it is the only one.
 
 Then run the app's own checks once more if anything above was fixed by hand:
-`npm run typecheck && npm run build`.
+`npm run typecheck && npm run build`. If the build stops because no Docker daemon runs, add
+`-- --skip-sandbox-prewarm` to the build, as `oe upgrade` does, and do not deploy that output.
 
 Then act on the template drift report. A core that carries it prints it again after the install;
 if this run printed no "Template drift" heading, run `npx oe upgrade --to <target> --plan` now to get it. For
@@ -185,6 +197,7 @@ Commit on a branch, never on the default branch. The body carries:
 - what changed in `roster.lock.json`, in your own words;
 - **the env names the deployment needs before this merges**, names only;
 - the manual steps, and who does each one.
+- each new default, and the setting the user chose for it, or that no setting turns it off.
 - the template files you synced or deleted, and each SYNC or DELETE line you left as it is, with the reason.
 
 Then stop. The admin reviews the lock diff and merges. The merge deploys.

package/template/deploy/egress-proxy/Dockerfile

@@ -0,0 +1,30 @@
+# Open Everywhere egress proxy — Squid (Tier A/B) + the Node policy control service.
+# The SOLE container with a WAN route in docker-compose.yml; the app reaches the internet
+# only by proxying through here. See deploy/egress-proxy/README.md.
+#
+# Base on node:24-alpine (NOT plain alpine, whose `nodejs` package is too old for
+# `--experimental-strip-types`). Node 24 runs the TypeScript control service directly via
+# native type stripping — no build step. node:24-alpine puts node at /usr/local/bin; the
+# squid external_acl helper references /usr/bin/node, so we symlink it below.
+FROM node:24-alpine
+
+# squid = the forward proxy + ssl_bump; openssl = CA generation for Tier B; wget = the
+# entrypoint health probe. (nodejs comes from the base image.)
+RUN apk add --no-cache squid openssl wget ca-certificates \
+  && ln -sf "$(command -v node)" /usr/bin/node \
+  && mkdir -p /opt/oe-egress/control /var/lib/squid /opt/oe-egress/ca
+
+WORKDIR /opt/oe-egress
+
+# Config + scripts + control service (kept alongside so the entrypoint copies a writable
+# squid.conf and can drop the Tier B overlay in conditionally).
+COPY squid.conf tier-b.conf gen-ca.sh install-ca.sh entrypoint.sh ./
+COPY control/ ./control/
+RUN chmod +x gen-ca.sh install-ca.sh entrypoint.sh
+
+# 3128 = the forward proxy the app points HTTPS_PROXY at. The control service (8080) is
+# reachable on the internal network so the app can POST policy; the ACL helper hits it on
+# loopback. Not exposed to the host.
+EXPOSE 3128 8080
+
+ENTRYPOINT ["/bin/sh", "/opt/oe-egress/entrypoint.sh"]