@sellable/install 0.1.316 → 0.1.318

package/HERMES-SLACK-PROFILE-SCOPING.md

@@ -5,20 +5,18 @@ access.
 
 ## Default Rule
 
-For Sellable-managed customer channels, use one shared Sellable Reply Bot
-Socket Mode listener and route inbound events by exact channel id. Do not run
-multiple active Hermes profile gateways against the same `SLACK_APP_TOKEN`.
+For Sellable-managed customer channels, use one dedicated Slack app/token pair
+per active Hermes customer profile. Run native `hermes -p <profile> gateway run`
+for that profile only. Do not run multiple active Hermes profile gateways
+against the same `SLACK_APP_TOKEN`.
 
-The shared dispatcher maps `slackTeamId + channelId` to `customerSlug`,
-`workspaceId`, `hermesProfile`, and `responsePolicy`. It then invokes
-`hermes -p <profile>` with profile-local `SELLABLE_CONFIG_PATH` and
-`SELLABLE_CONFIGS_DIR`, and posts the response back to the original Slack
-channel/thread.
+The customer's Slack app is bound to the exact Slack channel id and the
+customer's profile-local Sellable MCP config. Customer profiles must not store
+or read Sellable Admin MCP credentials, admin Slack app tokens, or sibling
+profile config.
 
-Customer profiles do not store the shared raw Slack token pair; route records
-store metadata and secret references only. Use dedicated per-customer Slack
-app/token pairs only for customer-owned Slack workspaces or strict enterprise
-isolation.
+The shared dispatcher remains a fallback/research path only. Use it only when
+Sellable Admin explicitly owns one shared listener and route registry.
 
 The 2026-07-06 Hostinger POC proved the native Hermes listener for the
 `sellable-admin` profile with the existing `Sellable Reply Bot` app in
@@ -35,8 +33,9 @@ hermes --profile acme send --to slack:C0BFERDV3N0 --subject '[Hermes acme smoke]
 ```
 
 That succeeded and is useful as an internal smoke test. It does not change the
-inbound listener rule: one shared dispatcher should own Socket Mode for
-Sellable-managed channels.
+inbound listener rule: each active customer profile needs its own native Slack
+app token pair unless Sellable Admin deliberately chooses the dispatcher
+fallback.
 
 ## Which Slack Values Are Enough
 
@@ -114,17 +113,32 @@ SLACK_REQUIRE_MENTION=true
 Keep the file mode at `0600`. Do not copy raw tokens into planning docs, chat,
 or committed artifacts. Record token fingerprints only.
 
+The profile's Hermes MCP env must also include the profile-local Sellable
+config, customer workspace lock, and fail-closed guard:
+
+```yaml
+SELLABLE_CONFIG_PATH: /srv/hermes/profiles/acme/sellable/config.json
+SELLABLE_CONFIGS_DIR: /srv/hermes/profiles/acme/sellable/configs
+SELLABLE_LOCK_WORKSPACE_ID: ws_acme
+SELLABLE_REQUIRE_WORKSPACE_LOCK: "1"
+```
+
+`SELLABLE_REQUIRE_WORKSPACE_LOCK=1` means an unbound customer profile fails
+closed before making Sellable API calls instead of falling back to shared or
+admin config state. Only the `sellable-admin` profile should provision,
+inspect, or repair other profiles.
+
 For the shared dispatcher model, do not copy the shared `SLACK_BOT_TOKEN` or
 `SLACK_APP_TOKEN` into customer profile `.env` files. The dispatcher owns those
 tokens and route metadata decides the customer profile.
 
 ## Shared Dispatcher Ownership
 
-The shared Slack dispatcher and its route registry are internal Sellable Admin
-surfaces. This customer-facing installer must not create Slack apps, write
-shared listener tokens, or validate cross-customer route bundles. Sellable Admin
-owns those steps, then calls this installer only for profile-local Sellable
-runtime bootstrap inside the already-provisioned Hermes profile.
+The shared Slack dispatcher and its route registry are fallback Sellable Admin
+surfaces. This customer-facing installer must not create shared route bundles or
+write shared listener tokens. Sellable Admin owns Slack app creation and profile
+provisioning, then calls this installer for profile-local Sellable runtime
+bootstrap inside the already-provisioned Hermes profile.
 
 ## Verification
 
@@ -147,8 +161,9 @@ Expected proof:
 
 ## Current Phase 03 Status
 
-Phase 03 has proved the profile-scoped installer path, outbound Hermes send
-path, and live Slack listener for the `sellable-admin` profile. Phase 03.1 adds
-the shared dispatcher route registry as a Sellable Admin-owned onboarding
-surface so managed customer channels can be onboarded through the VPS without
-local-only browser state, manual SSH edits, or untracked processes.
+Phase 03 proved the profile-scoped installer path, outbound Hermes send path,
+and live Slack listener for the `sellable-admin` profile. Phase 03.1 now targets
+dedicated native Slack apps per customer profile, profile-local Sellable MCP
+locks, and fail-closed customer profile behavior so managed customer channels
+can be onboarded through the VPS without local-only browser state, manual SSH
+edits, or untracked processes.

package/README.md

@@ -122,11 +122,13 @@ It creates:
 /srv/hermes/profiles/acme/.env        # only when Slack token inputs are supplied
 ```
 
-Bootstrap also writes `SELLABLE_LOCK_WORKSPACE_ID=<workspace-id>` into the
-profile's Hermes MCP env. Customer profiles are therefore locked to their own
-Sellable workspace: Sellable MCP requests are forced to that workspace,
-workspace switching/creation is blocked, and workspace listings are filtered.
-Use the `sellable-admin` profile for provisioning or cross-profile inspection.
+Bootstrap also writes `SELLABLE_LOCK_WORKSPACE_ID=<workspace-id>` and
+`SELLABLE_REQUIRE_WORKSPACE_LOCK=1` into the profile's Hermes MCP env.
+Customer profiles are therefore locked to their own Sellable workspace:
+Sellable MCP requests are forced to that workspace, workspace switching/creation
+is blocked, workspace listings are filtered, and a missing lock fails closed
+instead of falling back to shared/admin config. Use the `sellable-admin` profile
+for provisioning or cross-profile inspection.
 
 See [`HERMES-SLACK-PROFILE-SCOPING.md`](./HERMES-SLACK-PROFILE-SCOPING.md) for
 the customer Slack isolation contract and Socket Mode token requirements.

package/agents/registry.json

@@ -26,8 +26,8 @@
       "ownership": "message strategy, proof inventory, token rules, skeptical-prospect review, and selected winner only",
       "codex": {
         "description": "Message Drafting worker for campaign-backed template proposals after confirm_lead_list imports a non-empty bounded review batch.",
-        "model": "gpt-5.5",
-        "modelReasoningEffort": "xhigh",
+        "model": "gpt-5.6-sol",
+        "modelReasoningEffort": "high",
         "sandboxMode": "read-only",
         "nicknameCandidates": [
           "Message Drafting",

package/bin/sellable-install.mjs

@@ -179,6 +179,8 @@ Options:
   --server <mode>           package, local, or hosted. Default: package
   --token <token>           Sellable API token. Also reads SELLABLE_TOKEN.
   --workspace-id <id>       Sellable workspace id. Also reads SELLABLE_WORKSPACE_ID.
+  --require-workspace-lock  For Hermes customer profiles, fail closed unless
+                            SELLABLE_LOCK_WORKSPACE_ID is present in MCP env.
   --api-url <url>           Sellable API URL. Default: ${DEFAULT_API_URL}
   --sellable-config-path <path>
                             Profile-scoped Sellable config path. Also reads SELLABLE_CONFIG_PATH.
@@ -222,7 +224,9 @@ Hermes profile bootstrap:
   exact channel id unless --slack-allowed-channels is supplied. Use
   customer-scoped Sellable credentials and customer-scoped Slack credentials for
   customer profiles; shared admin tokens are weaker isolation and should remain
-  internal-only.
+  internal-only. Bootstrap writes SELLABLE_REQUIRE_WORKSPACE_LOCK=1 whenever a
+  workspace id is supplied, so a customer profile fails closed if the workspace
+  lock is later removed or not yet provisioned.
 
 Hermes shared Slack dispatcher:
   Shared listener setup and route-registry validation are internal Sellable
@@ -1656,7 +1660,7 @@ Treat host capabilities as concrete functions, not prose conventions:
   import and before dispatching Message Drafting only.
 - \`launch_message_drafting\`: Claude Code uses \`Task\` with \`subagent_type\`
   \`post-find-leads-message-scout\` when listed; Codex uses the returned
-  compatibility agent or a generic \`gpt-5.5\` / \`xhigh\` Message Drafting agent.
+  compatibility agent or a generic \`gpt-5.6-sol\` / \`high\` Message Drafting agent.
 
 If a required interactive question function or MCP loader is missing, stop and
 explain the Sellable install/reload problem. Source and filter work use
@@ -3053,8 +3057,8 @@ function generateCodexAgentToml(agent) {
   const codex = agent.codex;
   return `name = ${quoteToml(agent.name)}
 description = ${quoteToml(codex.description)}
-model = ${quoteToml(codex.model || "gpt-5.5")}
-model_reasoning_effort = ${quoteToml(codex.modelReasoningEffort || "xhigh")}
+model = ${quoteToml(codex.model || "gpt-5.6-sol")}
+model_reasoning_effort = ${quoteToml(codex.modelReasoningEffort || "high")}
 sandbox_mode = ${quoteToml(codex.sandboxMode || "read-only")}
 nickname_candidates = ${tomlArray(codex.nicknameCandidates || [agent.displayName])}
 developer_instructions = ${tomlMultilineString(agent.prompt)}
@@ -3517,6 +3521,9 @@ function mcpEnvForHost(host, opts) {
   if (opts.lockWorkspaceId) {
     env.SELLABLE_LOCK_WORKSPACE_ID = opts.lockWorkspaceId;
   }
+  if (opts.requireWorkspaceLock) {
+    env.SELLABLE_REQUIRE_WORKSPACE_LOCK = "1";
+  }
   return env;
 }
 
@@ -3815,6 +3822,7 @@ function parseHermesProfileBootstrapArgs(argv) {
     force: false,
     overwriteEnv: false,
     allowDuplicateSlackTokens: false,
+    requireWorkspaceLock: false,
     verbose: false,
   };
 
@@ -3853,7 +3861,9 @@ function parseHermesProfileBootstrapArgs(argv) {
     else if (arg === "--json") opts.json = true;
     else if (arg === "--force") opts.force = true;
     else if (arg === "--overwrite-env") opts.overwriteEnv = true;
-    else if (arg === "--allow-duplicate-slack-tokens") {
+    else if (arg === "--require-workspace-lock") {
+      opts.requireWorkspaceLock = true;
+    } else if (arg === "--allow-duplicate-slack-tokens") {
       opts.allowDuplicateSlackTokens = true;
     } else if (arg === "--verbose") opts.verbose = true;
     else {
@@ -4111,6 +4121,8 @@ function runHermesProfileBootstrap(argv) {
     const slackEnvKeys = Object.entries(slackEnv)
       .filter(([, value]) => value)
       .map(([key]) => key);
+    const requireWorkspaceLock =
+      parsed.requireWorkspaceLock || Boolean(parsed.workspaceId);
     const opts = {
       ...parsed,
       host: "hermes",
@@ -4121,6 +4133,7 @@ function runHermesProfileBootstrap(argv) {
       tokenSource,
       workspaceId: parsed.workspaceId,
       lockWorkspaceId: parsed.workspaceId,
+      requireWorkspaceLock,
       apiUrl: parsed.apiUrl,
     };
 
@@ -4146,8 +4159,16 @@ function runHermesProfileBootstrap(argv) {
         activeWorkspaceId: parsed.workspaceId || null,
         activeWorkspaceName: parsed.workspaceName || null,
         workspaceLock: parsed.workspaceId
-          ? { enabled: true, workspaceId: parsed.workspaceId }
-          : { enabled: false, workspaceId: null },
+          ? {
+              enabled: true,
+              workspaceId: parsed.workspaceId,
+              required: requireWorkspaceLock,
+            }
+          : {
+              enabled: false,
+              workspaceId: null,
+              required: requireWorkspaceLock,
+            },
         tokenPresent: Boolean(token),
         tokenSource,
         tokenFingerprint: tokenFingerprint(token),
@@ -4319,6 +4340,11 @@ function runHermesProfileBootstrap(argv) {
         `Manual auth pending. Run: sellable auth set <token> --workspace-id <workspace_id> --sellable-config-path ${sellableConfigPath}`
       );
     }
+    if (requireWorkspaceLock && !parsed.workspaceId) {
+      summary.warnings.push(
+        "Sellable MCP will fail closed until sellable-admin provisions SELLABLE_LOCK_WORKSPACE_ID for this customer profile."
+      );
+    }
 
     if (opts.json) {
       console.log(JSON.stringify(summary, null, 2));

package/lib/runtime-verify.mjs

@@ -45,6 +45,14 @@ export const REQUIRED_SELLABLE_MCP_TOOLS = [
 
 export const FORBIDDEN_SELLABLE_MCP_TOOLS = ["refill_campaign_sends"];
 
+const CONNECTION_ONLY_EVERGREEN_PROMPT_CHUNK_LIMIT = 48_000;
+const CONNECTION_ONLY_EVERGREEN_MAX_PROMPT_CHUNKS = 8;
+const CONNECTION_ONLY_EVERGREEN_PROOF_NEEDLES = {
+  campaignSequenceOptions: 'campaignSequenceOptions:{ mode:"connection_only" }',
+  templateRef: 'templateRef:"connection_only"',
+  sendInviteReceipt: 'sequenceReceipt.actionTypes:["send_invite"]',
+};
+
 export const CREATE_CAMPAIGN_SMOKE_CALLS = [
   {
     name: "get_auth_status",
@@ -84,6 +92,14 @@ export const CREATE_CAMPAIGN_SMOKE_CALLS = [
       limit: 1200,
     },
   },
+  {
+    name: "get_subskill_prompt",
+    arguments: {
+      subskillName: "create-evergreen-campaigns",
+      offset: 0,
+      limit: CONNECTION_ONLY_EVERGREEN_PROMPT_CHUNK_LIMIT,
+    },
+  },
   {
     name: "refill_sends",
     arguments: {
@@ -187,6 +203,43 @@ function parseJsonText(text) {
   }
 }
 
+function emptyConnectionOnlyEvergreenProofs() {
+  return Object.fromEntries(
+    Object.keys(CONNECTION_ONLY_EVERGREEN_PROOF_NEEDLES).map((key) => [
+      key,
+      false,
+    ])
+  );
+}
+
+function getConnectionOnlyEvergreenProofs(prompt) {
+  return Object.fromEntries(
+    Object.entries(CONNECTION_ONLY_EVERGREEN_PROOF_NEEDLES).map(
+      ([key, needle]) => [key, prompt.includes(needle)]
+    )
+  );
+}
+
+function mergeConnectionOnlyEvergreenProofs(target, source) {
+  if (!source) return target;
+  for (const key of Object.keys(CONNECTION_ONLY_EVERGREEN_PROOF_NEEDLES)) {
+    target[key] = target[key] === true || source[key] === true;
+  }
+  return target;
+}
+
+function summarizeConnectionOnlyEvergreenProofs(proofs) {
+  const merged = { ...emptyConnectionOnlyEvergreenProofs(), ...(proofs || {}) };
+  const missing = Object.keys(CONNECTION_ONLY_EVERGREEN_PROOF_NEEDLES).filter(
+    (key) => merged[key] !== true
+  );
+  return {
+    ok: missing.length === 0,
+    proofs: merged,
+    missing,
+  };
+}
+
 function summarizeToolResult(name, result) {
   const text = redact(textFromToolResult(result));
   const parsed = parseJsonText(text);
@@ -230,10 +283,26 @@ function summarizeToolResult(name, result) {
   }
 
   if (name === "get_subskill_prompt" && parsed) {
+    const prompt = typeof parsed.prompt === "string" ? parsed.prompt : "";
+    const connectionOnlyEvergreenProofs =
+      parsed.name === "create-evergreen-campaigns"
+        ? getConnectionOnlyEvergreenProofs(prompt)
+        : null;
     return {
       ...summary,
       subskillName: parsed.name || null,
-      promptChars: typeof parsed.prompt === "string" ? parsed.prompt.length : 0,
+      promptChars: prompt.length,
+      promptLength:
+        typeof parsed.promptLength === "number" ? parsed.promptLength : null,
+      offset: typeof parsed.offset === "number" ? parsed.offset : null,
+      limit: typeof parsed.limit === "number" ? parsed.limit : null,
+      connectionOnlyEvergreenProofs,
+      connectionOnlyEvergreenGuidance:
+        parsed.name === "create-evergreen-campaigns"
+          ? summarizeConnectionOnlyEvergreenProofs(
+              connectionOnlyEvergreenProofs
+            ).ok
+          : null,
       hasMore: parsed.hasMore === true,
       nextOffset:
         typeof parsed.nextOffset === "number" ? parsed.nextOffset : null,
@@ -267,6 +336,7 @@ async function verifyCreateCampaignSmoke({
     .map((call) => call.name)
     .filter((name) => !available.has(name));
   const calls = [];
+  const connectionOnlyEvergreenProofs = emptyConnectionOnlyEvergreenProofs();
 
   if (missingTools.length > 0) {
     return {
@@ -280,67 +350,195 @@ async function verifyCreateCampaignSmoke({
   }
 
   for (const call of smokeCalls) {
-    const callStartedAt = new Date().toISOString();
-    try {
-      const result = await client.callTool(
-        { name: call.name, arguments: call.arguments },
-        undefined,
-        {
-          timeout: timeoutMs,
-          maxTotalTimeout: timeoutMs,
+    let nextCall = call;
+    let evergreenPromptChunks = 0;
+    const evergreenPromptOffsets = new Set();
+
+    while (nextCall) {
+      const callStartedAt = new Date().toISOString();
+      try {
+        const result = await client.callTool(
+          { name: nextCall.name, arguments: nextCall.arguments },
+          undefined,
+          {
+            timeout: timeoutMs,
+            maxTotalTimeout: timeoutMs,
+          }
+        );
+        const summary = summarizeToolResult(nextCall.name, result);
+        calls.push({
+          name: nextCall.name,
+          arguments: nextCall.arguments,
+          ok: summary.isError !== true,
+          summary,
+          startedAt: callStartedAt,
+          completedAt: new Date().toISOString(),
+        });
+        if (summary.isError === true) {
+          return {
+            ok: false,
+            missingTools: [],
+            calls,
+            error: `${nextCall.name} returned an MCP tool error`,
+            startedAt,
+            completedAt: new Date().toISOString(),
+          };
         }
-      );
-      const summary = summarizeToolResult(call.name, result);
-      calls.push({
-        name: call.name,
-        arguments: call.arguments,
-        ok: summary.isError !== true,
-        summary,
-        startedAt: callStartedAt,
-        completedAt: new Date().toISOString(),
-      });
-      if (summary.isError === true) {
+
+        const isConnectionOnlyEvergreenPrompt =
+          nextCall.name === "get_subskill_prompt" &&
+          nextCall.arguments?.subskillName === "create-evergreen-campaigns";
+        if (!isConnectionOnlyEvergreenPrompt) {
+          break;
+        }
+
+        evergreenPromptChunks += 1;
+        evergreenPromptOffsets.add(nextCall.arguments?.offset ?? 0);
+        mergeConnectionOnlyEvergreenProofs(
+          connectionOnlyEvergreenProofs,
+          summary.connectionOnlyEvergreenProofs
+        );
+
+        if (summary.hasMore !== true) {
+          break;
+        }
+        if (typeof summary.nextOffset !== "number") {
+          return {
+            ok: false,
+            missingTools: [],
+            calls,
+            connectionOnlyEvergreenGuidance:
+              summarizeConnectionOnlyEvergreenProofs(
+                connectionOnlyEvergreenProofs
+              ),
+            error:
+              "create-evergreen-campaigns prompt chunk is missing nextOffset",
+            startedAt,
+            completedAt: new Date().toISOString(),
+          };
+        }
+        if (evergreenPromptOffsets.has(summary.nextOffset)) {
+          return {
+            ok: false,
+            missingTools: [],
+            calls,
+            connectionOnlyEvergreenGuidance:
+              summarizeConnectionOnlyEvergreenProofs(
+                connectionOnlyEvergreenProofs
+              ),
+            error:
+              "create-evergreen-campaigns prompt chunk repeated nextOffset",
+            startedAt,
+            completedAt: new Date().toISOString(),
+          };
+        }
+        if (
+          evergreenPromptChunks >= CONNECTION_ONLY_EVERGREEN_MAX_PROMPT_CHUNKS
+        ) {
+          return {
+            ok: false,
+            missingTools: [],
+            calls,
+            connectionOnlyEvergreenGuidance:
+              summarizeConnectionOnlyEvergreenProofs(
+                connectionOnlyEvergreenProofs
+              ),
+            error:
+              "create-evergreen-campaigns prompt exceeded smoke chunk limit",
+            startedAt,
+            completedAt: new Date().toISOString(),
+          };
+        }
+
+        nextCall = {
+          ...nextCall,
+          arguments: {
+            ...nextCall.arguments,
+            offset: summary.nextOffset,
+            limit:
+              nextCall.arguments?.limit ||
+              CONNECTION_ONLY_EVERGREEN_PROMPT_CHUNK_LIMIT,
+          },
+        };
+      } catch (err) {
+        const error = err instanceof Error ? err.message : String(err);
+        calls.push({
+          name: nextCall.name,
+          arguments: nextCall.arguments,
+          ok: false,
+          summary: null,
+          error: redact(error),
+          startedAt: callStartedAt,
+          completedAt: new Date().toISOString(),
+        });
         return {
           ok: false,
           missingTools: [],
           calls,
-          error: `${call.name} returned an MCP tool error`,
+          error: redact(error),
           startedAt,
           completedAt: new Date().toISOString(),
         };
       }
-    } catch (err) {
-      const error = err instanceof Error ? err.message : String(err);
-      calls.push({
-        name: call.name,
-        arguments: call.arguments,
-        ok: false,
-        summary: null,
-        error: redact(error),
-        startedAt: callStartedAt,
-        completedAt: new Date().toISOString(),
-      });
-      return {
-        ok: false,
-        missingTools: [],
-        calls,
-        error: redact(error),
-        startedAt,
-        completedAt: new Date().toISOString(),
-      };
     }
   }
 
+  const connectionOnlyEvergreenGuidance =
+    summarizeConnectionOnlyEvergreenProofs(connectionOnlyEvergreenProofs);
+  if (connectionOnlyEvergreenGuidance.ok !== true) {
+    return {
+      ok: false,
+      missingTools: [],
+      calls,
+      connectionOnlyEvergreenGuidance,
+      error: `create-evergreen-campaigns prompt is missing connection-only guidance: ${connectionOnlyEvergreenGuidance.missing.join(", ")}`,
+      startedAt,
+      completedAt: new Date().toISOString(),
+    };
+  }
+
   return {
     ok: true,
     missingTools: [],
     calls,
+    connectionOnlyEvergreenGuidance,
     error: null,
     startedAt,
     completedAt: new Date().toISOString(),
   };
 }
 
+function verifyConnectionOnlyEvergreenContract(tools) {
+  const setupTool = (tools || []).find(
+    (tool) => tool?.name === "setup_evergreen_campaigns"
+  );
+  const schema = setupTool?.inputSchema || {};
+  const properties = schema.properties || {};
+  const sequenceOptions = properties.campaignSequenceOptions || {};
+  const mode = sequenceOptions.properties?.mode || {};
+  const issues = [];
+
+  if (!properties.workspaceId) {
+    issues.push("setup_evergreen_campaigns.workspaceId");
+  }
+  if (!properties.campaignSequenceOptions) {
+    issues.push("setup_evergreen_campaigns.campaignSequenceOptions");
+  }
+  if (!Array.isArray(mode.enum) || !mode.enum.includes("connection_only")) {
+    issues.push("setup_evergreen_campaigns.campaignSequenceOptions.mode");
+  }
+  if (sequenceOptions.additionalProperties !== false) {
+    issues.push(
+      "setup_evergreen_campaigns.campaignSequenceOptions.additionalProperties"
+    );
+  }
+
+  return {
+    ok: issues.length === 0,
+    issues,
+  };
+}
+
 function summarizeAttempt(result, attempt) {
   return {
     attempt,
@@ -348,6 +546,12 @@ function summarizeAttempt(result, attempt) {
     availableToolCount: result.availableTools?.length || 0,
     missingToolCount: result.missingTools?.length || 0,
     forbiddenToolCount: result.forbiddenTools?.length || 0,
+    connectionOnlyEvergreenContract: result.connectionOnlyEvergreenContract
+      ? {
+          ok: result.connectionOnlyEvergreenContract.ok === true,
+          issues: result.connectionOnlyEvergreenContract.issues || [],
+        }
+      : null,
     error: result.error || null,
     createCampaignSmoke: result.createCampaignSmoke
       ? {
@@ -419,6 +623,7 @@ async function verifySellableMcpRuntimeOnce({
   let missingTools = [...requiredTools];
   let forbiddenTools = [];
   let createCampaignSmoke = null;
+  let connectionOnlyEvergreenContract = { ok: false, issues: [] };
   let error = null;
 
   try {
@@ -432,6 +637,8 @@ async function verifySellableMcpRuntimeOnce({
     forbiddenTools = availableTools.filter((tool) =>
       FORBIDDEN_SELLABLE_MCP_TOOLS.includes(tool)
     );
+    connectionOnlyEvergreenContract =
+      verifyConnectionOnlyEvergreenContract(toolList.tools);
     if (forbiddenTools.length > 0) {
       createCampaignSmoke = {
         ok: false,
@@ -475,6 +682,7 @@ async function verifySellableMcpRuntimeOnce({
       !error &&
       missingTools.length === 0 &&
       forbiddenTools.length === 0 &&
+      connectionOnlyEvergreenContract.ok === true &&
       createCampaignSmoke?.ok === true,
     skipped: false,
     command,
@@ -483,6 +691,7 @@ async function verifySellableMcpRuntimeOnce({
     availableTools,
     missingTools,
     forbiddenTools,
+    connectionOnlyEvergreenContract,
     createCampaignSmoke,
     stderrTail: stderrLines,
     error: error ? redact(error) : null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.316",
+  "version": "0.1.318",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {

package/skill-templates/create-campaign.md

@@ -721,7 +721,7 @@ Treat host capabilities as concrete functions, not prose conventions:
   import and before dispatching Message Drafting only.
 - `launch_message_drafting`: Claude Code uses `Task` with `subagent_type`
   `post-find-leads-message-scout` when listed; Codex uses the returned
-  compatibility agent or a generic `gpt-5.5` / `xhigh` Message Drafting agent.
+  compatibility agent or a generic `gpt-5.6-sol` / `high` Message Drafting agent.
 
 If a required interactive question function or MCP loader is missing, stop and
 explain the Sellable install/reload problem. Source work uses product-native MCP
@@ -1082,8 +1082,8 @@ updates.
    In Codex, the filter-choice answer is the campaign-scoped go-ahead to use
    this single Message Drafting background agent in step-wise and YOLO modes.
    Do not ask a separate question to start it. If the named custom agent is not
-   available, spawn a generic background agent with `model: "gpt-5.5"` and
-   `reasoning_effort: "xhigh"` using the same lean campaign/table basis. If no
+   available, spawn a generic background agent with `model: "gpt-5.6-sol"` and
+   `reasoning_effort: "high"` using the same lean campaign/table basis. If no
    background-agent tool is callable, start the same full message branch inline
    before filter drafting or skip-filter message review and record it as
    `statusSource: "parent-thread-fallback"`.

package/skill-templates/create-evergreen-campaigns.md

@@ -134,6 +134,19 @@ run without user input, or similar, run in **automation mode**:
     exactly one quality-valid route-proof row when needed, and attach the
     recommended sequence, but it still must not launch campaigns, schedule
     sends, send messages, or spend paid InMail.
+  - **Connection-only evergreen completion is optional and non-default.** Use it
+    only when the prompt explicitly says connection-only, invite-only,
+    connection request only, no DMs, or no follow-ups. Pass the typed option
+    `campaignSequenceOptions:{ mode:"connection_only" }` plus an explicit
+    `workspaceId` to `setup_evergreen_campaigns`. Omit
+    `campaignSequenceOptions` for the standard tier-recommended Premium,
+    Sales Nav, Recruiter, and paid InMail behavior.
+    Connection-only completion still creates/reuses the same evergreen lanes,
+    source rows, and paused/unlaunched review state, but it attaches only the
+    canonical invite template and persists `currentStep:"send"` as the paused
+    review step. It does not require Message Drafting, generated messages,
+    route-proof approval, first DM, InMail, View Profile fallback, follow-up
+    branch, launch, scheduling, or sends.
 
 If the invoking prompt explicitly asks for interactive message polish or sample
 proof, run in **interactive polish mode** and use the confirmation/sample steps
@@ -424,7 +437,7 @@ fallback only when app thread tools are unavailable; the receipt must include
 `fallbackReason`, or backend verify rejects it.
 When visible Codex app thread tools are unavailable but local Codex CLI is
 available, the accepted durable streaming-worker command shape is:
-`codex -a never -s danger-full-access -c model_reasoning_effort=xhigh exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -`.
+`codex -a never -s danger-full-access -c model_reasoning_effort=high exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -`.
 The approval, sandbox, and reasoning-effort config flags must come before the
 `exec` subcommand for Codex CLI builds that expose `-a`/`-s`/`-c` only at top
 level. `--skip-git-repo-check` belongs after `exec` because current customer and VPS Codex CLI builds expose it
@@ -434,26 +447,26 @@ forms fail on current customer CLI installs. Pipe the lane packet prompt on
 stdin, require the worker to write `workerDispatch.receiptArtifactHint`, and
 pass exactly one lane packet per worker.
 When launching durable Codex CLI workers from an automation parent, pass an
-explicit supported worker model and explicit `xhigh` reasoning effort instead
+explicit supported worker model and explicit `high` reasoning effort instead
 of relying on the Codex CLI defaults. Use the parent runtime model when known,
 for example:
-`codex -a never -s danger-full-access -c model_reasoning_effort=xhigh exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -`.
+`codex -a never -s danger-full-access -c model_reasoning_effort=high exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -`.
 In Codex CLI, the parent runtime model is visible in the run header as
 `model: <model-name>`. Copy that exact model string into child worker launches
-first. If the parent header says `model: gpt-5.5`, launch workers with
-`-m gpt-5.5` plus `-c model_reasoning_effort=xhigh`; do not invent or probe
+first. If the parent header says `model: gpt-5.6-sol`, launch workers with
+`-m gpt-5.6-sol` plus `-c model_reasoning_effort=high`; do not invent or probe
 nearby aliases such as `gpt-5.3-codex`, `gpt-5.2`, `gpt-5-codex`,
 `codex-latest`, or `codex-mini-latest` before trying the exact parent model. A
-one-line probe must include the same `-c model_reasoning_effort=xhigh` override
+one-line probe must include the same `-c model_reasoning_effort=high` override
 and count as supported only when it exits 0 and returns the requested output; a
 session header followed by a `not supported` error is rejected, not accepted.
 Do not rely on the Codex CLI default model or default reasoning effort; some
-customer and VPS installs default to unavailable model aliases or to `high`
-reasoning. `-m gpt-5.5` alone is not enough. If a child worker reports GPT 5.5
-with `high` reasoning, treat that as a launcher bug, relaunch with the explicit
-`xhigh` config before mutation, and do not ask the user to continue through the
+customer and VPS installs default to unavailable model aliases or to reasoning
+below `high`. `-m gpt-5.6-sol` alone is not enough. If a child worker reports GPT 5.6-Sol
+with reasoning below `high`, treat that as a launcher bug, relaunch with the explicit
+`high` config before mutation, and do not ask the user to continue through the
 model-quality warning. If the parent cannot identify a supported worker model
-and launch it with `xhigh` reasoning, stop with
+and launch it with `high` reasoning, stop with
 `blocked: worker_model_unavailable` before mutation.
 When wrapping multiple local Codex CLI workers in a shell launcher, run the
 wrapper with `/bin/bash -lc` or another explicitly chosen portable shell. Do not
@@ -466,7 +479,7 @@ Do not embed `<<'WORKER_PROMPT'` heredocs inside a single quoted or double
 quoted `/bin/bash -lc '...'` command string; nested quoting is brittle and can
 truncate the first worker before mutation. For multi-worker launchers, write one
 plain prompt file per lane under the current run directory, then start each
-worker with `codex -a never -s danger-full-access -c model_reasoning_effort=xhigh exec --skip-git-repo-check -m "$WORKER_MODEL" -C "$REPO" -o
+worker with `codex -a never -s danger-full-access -c model_reasoning_effort=high exec --skip-git-repo-check -m "$WORKER_MODEL" -C "$REPO" -o
 "$worker_final_file" - < "$worker_prompt_file"`. Keep launcher shell variables
 double-quoted and keep the prompt heredoc only in a standalone script/prompt-file
 write step, not inside an already quoted shell argument. If the first launcher
@@ -572,7 +585,7 @@ launchers, write the same prompt body to `<worker-prompt-file>` and launch the
 worker with stdin redirected from that file:
 
 ```
-codex -a never -s danger-full-access -c model_reasoning_effort=xhigh exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> - <<'WORKER_PROMPT'
+codex -a never -s danger-full-access -c model_reasoning_effort=high exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> - <<'WORKER_PROMPT'
 Use $sellable:create-campaign as the governing campaign workflow for this one lane worker.
 Use the evergreen plan/packet below only for lane scope, source metadata,
 postconditions, side-effect caps, and durable receipt proof.
@@ -619,10 +632,10 @@ Do not launch, start, schedule, send, or use paid InMail.
 For filter proof, durable receipt status must be `filterDecisionReceipt.status:"applied"` only; never `completed`, `confirmed`, `done`, or aliases.
 For generated messages, `update_cell` is allowed only for the semantic Approved checkbox. Never use `update_cell` for generated message text/body/sample copy. Bad copy requires `revise_message_template_and_rerun` or brief/template revision plus Generate Message rerun. Any generated-message cell override is `blocked: generated_message_cell_override`.
 If `bootstrap_create_campaign.modelQuality.status === "warn"` because the child
-worker reports GPT 5.5 with `high` reasoning, that is a parent launcher
+worker reports GPT 5.6-Sol with reasoning below `high`, that is a parent launcher
 configuration bug, not an operator approval path inside the worker. Stop before
 mutation, tell the parent to relaunch this lane with
-`-c model_reasoning_effort=xhigh`, and do not mark the worker goal complete.
+`-c model_reasoning_effort=high`, and do not mark the worker goal complete.
 Complete only this lane. Do not end with narration only. Before your final
 response, run a local file-existence and JSON self-check for
 <receiptArtifactPath>. If the lane succeeded, write the canonical success
@@ -643,7 +656,7 @@ receipt, or an accepted Post Engagers no-source blocked/no-op receipt.
 WORKER_PROMPT
 
 # Multi-worker launcher equivalent:
-codex -a never -s danger-full-access -c model_reasoning_effort=xhigh exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> - < <worker-prompt-file>
+codex -a never -s danger-full-access -c model_reasoning_effort=high exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> - < <worker-prompt-file>
 ```
 
 If any placeholder cannot be filled from the current plan, matching
@@ -720,6 +733,9 @@ not a parent-thread summary. The receipt must include:
   creation, preserve that original packet only in a separate `parentLanePacket`
   object; do not leave `setupPlanCall.campaignId:null` or
   `setupPlanCall.tableId:null`.
+  If the parent plan used connection-only, the receipt must also include
+  `setupPlanCall.campaignSequenceOptions:{ "mode":"connection_only" }` or
+  `setupPlanCall.sequencePolicy.mode:"connection_only"`.
   Short form: For create lanes, `setupPlanCall.campaignId` and `setupPlanCall.tableId` must be the actual created campaign/table ids.
   Short form: Do not leave `setupPlanCall.campaignId:null` or `setupPlanCall.tableId:null`.
 - `createCampaignWorkflowReceipt`: proof the worker loaded the actual installed
@@ -810,22 +826,40 @@ not a parent-thread summary. The receipt must include:
   them into canonical `promptLoadedToHasMoreFalse`, `requiredAssetsLoaded`,
   `validationLoaded`, `reviewBatchRowHash`, and
   `messageDraftRecommendation`.
+  Connection-only lanes are the exception: do not include
+  `messageDraftingReceipt` or run generated-message prep unless the operator
+  separately asked for message copy. The parent verifier expects no message
+  proof for connection-only lanes.
 - `reviewBatchReceipt`: review-batch row ids/hash, generated row count,
   quality-valid route-proof row id when approved, and proof that no broad
   approve-all occurred.
+  Connection-only lanes are the exception: do not approve a route-proof row and
+  do not include a required review-batch receipt.
 - `sequenceReceipt`: exact current workflowTableId, recommended non-paid
   sequence attach/precheck result, and readback showing `hasSequence:true` when
   completion is claimed. If the tool output uses
   `attachRecommendedSequenceResult.actionTypes` or
   `nonPaidRecommendedSequence`, copy them to canonical `actionTypes` and
   `nonPaid`.
+  For connection-only lanes, do not call `attach_recommended_sequence`. Attach
+  with `attach_sequence({ tableId, templateRef:"connection_only", currentStep:"send" })`, then
+  include exact current-template proof:
+  `sequenceReceipt.hasSequence:true`,
+  `sequenceReceipt.actionTypes:["send_invite"]`, and
+  `sequenceReceipt.nonPaid:true`. Receipts that only say
+  `tool:"attach_recommended_sequence"` or include `send_dm`,
+  `send_inmail_open`, `send_inmail_closed`, or `view_profile` are failing
+  connection-only receipts.
 - final paused-send proof: if the current campaign table is `DRAFT` after the
   sequence is attached, call the product `pause_campaign({ campaignId })`
   endpoint/tool to put the unlaunched campaign into `PAUSED` review state, then
   reread the campaign/table. Do not raw-write `campaignStatus`, do not start or
   launch, and do not schedule/send. Completion requires reread proof of
-  `currentStep:"send"` and `campaignStatus:"PAUSED"`. If the raw output nests
-  this in `finalCampaignRead` or `finalTableRead`, copy it to canonical
+  `currentStep:"send"` and `campaignStatus:"PAUSED"` for standard and
+  connection-only customer-visible lanes. `send` is the product's paused
+  review step; do not use unsupported aliases such as `review` as final proof.
+  If the raw output nests this in `finalCampaignRead` or `finalTableRead`, copy
+  it to canonical
   `finalPausedSendProof.currentStep` and
   `finalPausedSendProof.campaignStatus`.
 - `verifyCall`: the exact `setup_evergreen_campaigns({ mode:"verify",
@@ -1088,9 +1122,14 @@ plain row generation. The lane worker must inline the same
    approvedGeneratedMessageCount exactly 1. Do not report completion with 2+
    approved rows.
    Approval shorthand: Do not report completion with 2+ approved rows.
-8. Continue to `attach_recommended_sequence({ campaignId, currentStep:"send" })`
-   and, if the campaign is still `DRAFT`, `pause_campaign({ campaignId })`.
-   Reread the campaign/table before claiming completion.
+8. Standard mode: continue to
+   `attach_recommended_sequence({ campaignId, currentStep:"send" })` and, if
+   the campaign is still `DRAFT`, `pause_campaign({ campaignId })`. Reread the
+   campaign/table before claiming completion.
+   Connection-only mode: skip Message Drafting and route-proof approval, call
+   `attach_sequence({ tableId, templateRef:"connection_only", currentStep:"send" })`, prove
+   `sequenceReceipt.actionTypes:["send_invite"]`, and pause/reread without
+   launching or sending.
 
 That packaged worker path must return `messageDraftingReceipt.statusSource:
 "packaged-generate-messages-worker"`. It is accepted only when the receipt
@@ -1515,11 +1554,14 @@ Message, and verify current-revision sample messages before final completion.
      - DM lanes: add a `Delivery format:` line — either `multiline (each paragraph sends as its own DM message)` or `single message`. When multiline, the template's blank-line paragraphs ARE the message boundaries — write each one as a standalone typed message.
      - **InMail lanes can never be multiline**: an InMail is one message and the recipient must reply before anything else can be sent. InMail-bound templates must read as one cohesive message — declare `Delivery format: single message (InMail — no follow-up until reply)` and never structure the copy to depend on multi-message pacing.
 
-   - The sequence is auto-selected by sender tier; do not hand-author sequence
+   - In standard mode, the sequence is auto-selected by sender tier; do not hand-author sequence
      templates here. Sales Nav/Recruiter senders may receive the unified Sales
      Nav cascade through `attach_recommended_sequence`; attaching it does not
      spend paid InMail credits by itself. Do not substitute the manual Paid
      InMail Campaign template.
+     For explicit connection-only evergreen lanes only, use the backend-owned
+     `attach_sequence({ tableId, templateRef:"connection_only", currentStep:"send" })` path and do
+     not call `attach_recommended_sequence`.
 3. **Customer-Visible Completion Contract**: a named evergreen lane that appears
    as a campaign card or campaign-backed table is not done when the shell exists.
    It is done only when the customer can open the campaign and land on final
@@ -1543,7 +1585,7 @@ Message, and verify current-revision sample messages before final completion.
       evergreen setup. Do not leave customer-visible campaigns at
       `filter-choice`, `filter-rules`, or `apply-icp-rubric` and report success.
       Do not proceed to Message Drafting until saved filters are applied.
-   - Message Drafting has run from the current campaign/table basis, using the
+   - In standard mode, Message Drafting has run from the current campaign/table basis, using the
      create-campaign message prompt/assets and validation gate. Updating
      `currentStep:"messages"` is not proof. Parent-thread handwritten copy is
      not a substitute. The proof receipt must show
@@ -1584,6 +1626,9 @@ Message, and verify current-revision sample messages before final completion.
       Fallback samples must still reject source/conversation hedges such as
       `"hope this is relevant"`, `"might be interested"`, or `"saw you in a few
       conversations"`.
+     For explicit connection-only lanes, this whole Message Drafting and sample
+     proof block is not required and must not be faked with parent-written
+     messages.
    - The first review batch exists and at least 3 review rows have generated
      messages from the approved brief. If fewer than 3 usable rows exist, report
      the actual count and why.
@@ -1596,7 +1641,7 @@ Message, and verify current-revision sample messages before final completion.
      completion, approve exactly one quality-valid generated row. If one or more
      rows are already approved, do not add more approvals during evergreen
      completion. Never broad approve all rows.
-    - The recommended tier-aware sequence is attached to the current campaign
+    - In standard mode, the recommended tier-aware sequence is attached to the current campaign
       table, and the watched campaign is on Send. Use
       `attach_recommended_sequence({ campaignId, currentStep:"send" })` when a
       safe attach is needed. After `confirm_lead_list` or any source-list copy,
@@ -1611,6 +1656,10 @@ Message, and verify current-revision sample messages before final completion.
       manual Paid InMail Campaign, and never attach/replace sequence outside the
       current table unless the current lane packet explicitly allowed sequence
       repair.
+      For explicit connection-only lanes, the current campaign table must have
+      exactly the canonical invite-only sequence:
+      `sequenceReceipt.actionTypes:["send_invite"]`. Any DM, InMail, or View
+      Profile action means the lane is not complete.
     - If the current campaign table is still `DRAFT` after sequence/readiness
       proof, call `pause_campaign({ campaignId })` and reread. `pause_campaign`
       is the product-native review-state transition; it is not a launch and does

package/skill-templates/refill-sends-v2.md

@@ -62,6 +62,11 @@ for lease expiry; never guess a fence.
 The default `intent:"auto"` inspects `managed_waterfall`,
 `dashboard_evergreen`, and `active_campaign` lane sources. Report the lane
 source and lane chain as proof for every selected sender.
+Connection-only evergreen lanes are invite-only refill targets. When the packet
+or campaign proof shows exactly `["send_invite"]`, report and execute only
+`selectedLane:"send_invite"` work; do not infer DM, InMail, Sales Nav cascade,
+paid-credit refresh, message generation, follow-up, sequence mutation,
+launch/start beyond packet authority, scheduler writes, or direct sends.
 
 If membership blocks a workspace read, report the structured
 `workspace_access` blocker instead of retrying auth or switching workspaces.

package/skill-templates/refill-sends.md

@@ -196,6 +196,11 @@ rather than asking which campaign class to fill. If a stale target plan selects
 planner before mutation.
 Short form: trust the target plan's inferred lane when it is a connection invite,
 paid-InMail refill lane, or unified Sales Nav cascade.
+Connection-only evergreen campaigns with exact `["send_invite"]` sequence proof
+are plain invite capacity: treat them as `selectedLane:"send_invite"` only. Do
+not infer DM, InMail, Sales Nav cascade, paid-credit refresh, message
+generation, follow-up, sequence mutation, launch/start, scheduling override, or
+direct-send work from a connection-only lane.
 
 Structured planner packet: