@sellable/install 0.1.226 → 0.1.228

package/bin/sellable-install.mjs

@@ -37,7 +37,7 @@ function getInstallVersion() {
   }
 }
 
-const CODEX_PLUGIN_VERSION = "0.1.43";
+const CODEX_PLUGIN_VERSION = "0.1.45";
 const CODEX_PLUGIN_COMPAT_VERSIONS = [
   "0.1.8",
   "0.1.9",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.226",
+  "version": "0.1.228",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code and Codex",
   "bin": {

package/skill-templates/create-evergreen-campaigns.md

@@ -73,18 +73,26 @@ readback, and setup plan/verify results. If MCP surfaces disagree on counts or
 state, record the discrepancy and resolve or explain the canonical gate before
 reporting the command complete.
 
-Package-backed prompt authority: when this command or any lane worker says to
-load `$sellable:create-campaign`, `create-campaign-v2`, `generate-messages`, or
-any referenced workflow asset, the package-backed MCP loaders are the source of
-truth. Use `get_subskill_prompt` and `get_subskill_asset` until `hasMore:false`.
-Do not locate, open, read, or summarize local skill files from repo paths,
-installed plugin cache paths, or any filesystem shortcut. Do not use repo-local,
-plugin-cache, or filesystem `SKILL.md` files as workflow authority, even when a
-session header shows a path. If package-backed prompt or asset loaders are not
-callable, stop with `blocked: package_prompt_loader_unavailable`; filesystem
-prompt fallback is a failed UAT and is not proof that the packaged command works.
-Short form: Do not use repo-local, plugin-cache, or filesystem `SKILL.md`.
-Short form: filesystem prompt fallback is a failed UAT.
+Package-backed prompt authority: this public wrapper is an installed Codex
+skill, so the host may load the wrapper itself from the local plugin bundle as
+the command entrypoint. That entrypoint load is allowed, but it is not proof
+that the create-campaign workflow ran. After this wrapper is active, when this
+command or any lane worker says to load `$sellable:create-campaign`,
+`create-campaign-v2`, `generate-messages`, validation, or any referenced
+workflow asset, the package-backed MCP loaders are the source of truth. Use
+`get_subskill_prompt` and `get_subskill_asset` until `hasMore:false`.
+Do not locate, open, read, or summarize nested workflow prompt files from repo
+paths, installed plugin cache paths, or any filesystem shortcut. Do not use
+repo-local, plugin-cache, or filesystem `SKILL.md` files as nested workflow
+authority, even when a session header shows a path. If package-backed prompt or
+asset loaders are not callable, stop with
+`blocked: package_prompt_loader_unavailable`; nested filesystem prompt fallback
+is a failed UAT and is not proof that the packaged workflow ran.
+Short form: The installed wrapper can be the entrypoint; nested workflow prompts
+must use MCP loaders.
+Short form: Do not use repo-local, plugin-cache, or filesystem nested
+`SKILL.md` files as workflow authority.
+Short form: nested filesystem prompt fallback is a failed UAT.
 
 Package-backed tool surface: use `mcp__sellable` only for workspace selection,
 campaign/table/source/message mutations, and product-visible readbacks. Do not
@@ -199,8 +207,18 @@ environment:{type:"local"}}`. Do not create a worktree target for evergreen
 UAT or lane execution. The parent must record the returned thread id, pass
 exactly one lane packet into that thread, and require the worker to write the
 lane receipt at the artifact path named by
-`workerDispatch.receiptArtifactHint`. A streaming worker or branch worker is
-acceptable only when it writes a durable per-lane receipt artifact as it works.
+`workerDispatch.receiptArtifactHint`. That path is run-specific and must include
+the packet's `workerDispatch.receiptRunId`. Before dispatch, if a file already
+exists at the hinted path, do not trust or verify it; move it aside or choose the
+fresh hinted path from a new plan. A valid receipt must be written after
+`workerDispatch.receiptMustBeWrittenAfter`, reread by the parent after the
+worker exits, and contain the current `planRevision`, `actionId`, `laneKey`,
+`receiptArtifactPath`, and `durableReceiptWritten:true`. If a receipt predates
+the current run, uses an old path without `receiptRunId`, or was not freshly
+written by the current worker, stop with `blocked: stale_receipt_artifact`
+before parent verify or completion. A streaming worker or branch worker is
+acceptable only when it writes a fresh durable per-lane receipt artifact as it
+works.
 `multi_agent_v1.spawn_agent`, raw `spawn_agent`, or any opaque Task/subagent
 runtime that cannot expose a visible thread id or durable receipt artifact is
 not accepted as command-level UAT proof and must not be used for mutating
@@ -366,7 +384,7 @@ verification unless the same object also appears inside
       "workflowAssetLoaded": true,
       "workerRuntime": "separate-codex-thread",
       "workerThreadId": "<visible local Codex thread id>",
-      "receiptArtifactPath": ".planning/artifacts/uat/69/lane-receipts/<planRevision>/<actionId>-<laneKey>.json",
+      "receiptArtifactPath": ".planning/artifacts/uat/69/lane-receipts/<planRevision>/<receiptRunId>/<actionId>-<laneKey>.json",
       "durableReceiptWritten": true,
       "notAdHoc": true
     },