@sellable/install 0.1.363 → 0.1.364-phase111.20260720135054

package/bin/sellable-install.mjs

@@ -3712,8 +3712,7 @@ function upsertCodexMcpServerConfig(content, opts) {
       content,
       "mcp_servers.sellable",
       `[mcp_servers.sellable]
-url = ${quoteToml(withHostedWatchModeDriver(opts.hostedUrl, "codex"))}
-default_tools_approval_mode = "approve"`
+url = ${quoteToml(withHostedWatchModeDriver(opts.hostedUrl, "codex"))}`
     );
     content = removeTomlSection(content, "mcp_servers.sellable.env");
     return content;
@@ -3725,8 +3724,7 @@ default_tools_approval_mode = "approve"`
     "mcp_servers.sellable",
     `[mcp_servers.sellable]
 command = ${quoteToml(command)}
-args = ${tomlArray(args)}
-default_tools_approval_mode = "approve"`
+args = ${tomlArray(args)}`
   );
   content = upsertTomlTable(
     content,
@@ -3740,9 +3738,6 @@ ${tomlEnvTable("codex", opts)}`
 function codexMcpServerMatches(content, opts) {
   const server = readTomlTable(content, "mcp_servers.sellable");
   if (!server) return false;
-  if (!server.includes('default_tools_approval_mode = "approve"')) {
-    return false;
-  }
   if (opts.server === "hosted") {
     return (
       server.includes(

package/lib/sellable-agent/hermes-bridge.mjs

@@ -285,14 +285,14 @@ export const HERMES_AGENT_BRIDGE_CONTRACT = normalizeContract({
     {
       path: "plugins/platforms/slack/adapter.py",
       patchKind: "slack-adapter",
-      sourceSha256: "20b12d9bbff0f5b280e0be8e795c7327f4089c3fa8b04d7a6d346dabae591f2a",
-      patchedSha256: "548ab70f515e22830cbcbf6b0691768272dd708fd0118f7c601e1e1232bb016b",
+      sourceSha256: "a84f1f15368d8d93341a1c2449c45ca13ebe92938049e92d80ce5cab0e1a6294",
+      patchedSha256: "4ba3b1f5b443abf970b8888de3c1b21ab7f043645aba6304432453c1dc643f55",
     },
     {
       path: "tools/mcp_tool.py",
       patchKind: "mcp-tool",
-      sourceSha256: "1bcceccaeb8ec8894c83819d389a64258517f4b48db1c8fea5c486633e56fe8b",
-      patchedSha256: "44bf5dfeca47bf91fc5e68ecd6455c33f41afd2b04fa16d213f59115ddb38f21",
+      sourceSha256: "ee453ede1c72c90b28155e292a352bfba96eb1793c47eb8667d16fe79beb181e",
+      patchedSha256: "c0923d8c88d507a766121dab9f0f36e99963f85a9124cbef2908ee7176d56e07",
     },
   ],
 });

package/lib/sellable-agent/host-worker.mjs

@@ -957,8 +957,8 @@ export function compileClaimToProfileDesired(activeClaim, config) {
       ]) ||
       !exactObject(runtimeService, ["principalId", "policyHash", "credentialGeneration", "credentialFingerprint"]) ||
       pinned.hermesCli !== "hermes" || pinned.hermesVersion !== "0.18.0" ||
-      pinned.installerPackage !== "@sellable/install@0.1.363" ||
-      pinned.mcpPackage !== "@sellable/mcp@0.1.620" ||
+      pinned.installerPackage !== "@sellable/install@0.1.357" ||
+      pinned.mcpPackage !== "@sellable/mcp@0.1.619" ||
       !Array.isArray(policy.toolInclude) || policy.toolInclude.length === 0 ||
       !Number.isSafeInteger(slack.generation) || slack.generation < 1 ||
       !/^A[A-Z0-9]{8,20}$/.test(slack.appId ?? "") ||
@@ -1423,11 +1423,6 @@ export function createLocalPinnedActionPorts(config, dependencies = {}) {
             revisionId: request.evidence.revisionId,
             profileDigest: request.evidence.profileDigest,
           });
-          await helper({
-            action: "INSTALL_PROVIDER_CREDENTIAL",
-            ...helperIdentity(),
-            fingerprint: context.desired.providerFingerprint,
-          });
           await helper({ action: "INSTALL_HERMES_BRIDGE", ...helperIdentity() });
           await controlRuntime("UP");
         },
@@ -1496,6 +1491,17 @@ export function createLocalPinnedActionPorts(config, dependencies = {}) {
     lifecycle: {},
   };
   const restart = () => controlRuntime("RESTART");
+  const reload = async (path) => {
+    const base = new URL(config.runtimeControlUrl);
+    if (base.protocol !== "http:" || !["127.0.0.1", "localhost", "::1"].includes(base.hostname)) {
+      throw new Error("runtime control endpoint rejected");
+    }
+    const response = await (dependencies.fetchImpl ?? fetch)(
+      new URL(path, base),
+      { method: "POST", signal: AbortSignal.timeout(10_000) },
+    );
+    if (!response.ok) throw new Error("runtime reload rejected");
+  };
   const rawRuntimeObservation = async ({ drift = false } = {}) => {
     const observed = (await helper({
       action: drift ? "OBSERVE_RUNTIME_DRIFT" : "OBSERVE_RUNTIME",
@@ -1558,11 +1564,6 @@ export function createLocalPinnedActionPorts(config, dependencies = {}) {
       revisionId: result.receipt.revisionId,
       profileDigest: result.receipt.profileDigest,
     });
-    await helper({
-      action: "INSTALL_PROVIDER_CREDENTIAL",
-      ...helperIdentity(),
-      fingerprint: context.desired.providerFingerprint,
-    });
     await helper({ action: "INSTALL_HERMES_BRIDGE", ...helperIdentity() });
   };
   const refreshThen = (effect) => async (input) => {
@@ -1570,8 +1571,8 @@ export function createLocalPinnedActionPorts(config, dependencies = {}) {
     return effect(input);
   };
   Object.assign(ports.refresh, {
-    reloadMcp: refreshThen(restart),
-    reloadSkills: refreshThen(restart),
+    reloadMcp: refreshThen(() => reload("/reload-mcp")),
+    reloadSkills: refreshThen(() => reload("/reload-skills")),
     reloadEnvironmentOrRestart: refreshThen(restart),
     restartGateway: refreshThen(restart),
     restartProfileSession: refreshThen(restart),
@@ -1674,8 +1675,11 @@ export function createLocalPinnedActionPorts(config, dependencies = {}) {
     async fenceDispatch() { await setRuntimeLifecycle("OFF"); },
     async fenceRouteOutput() { await setRuntimeLifecycle("ARCHIVED"); },
     async drain() {
-      await controlRuntime("DOWN");
-      const observed = { drained: true, remaining: 0 };
+      const base = new URL(config.runtimeControlUrl);
+      const response = await fetch(new URL("/drain", base), { method: "POST", signal: AbortSignal.timeout(15_000) });
+      if (!response.ok) throw new Error("drain rejected");
+      const observed = await response.json();
+      if (!observed?.drained || observed.remaining !== 0) throw new Error("drain readback rejected");
       atomicPrivateJson(join(realpathSync(config.stateRoot), `drain-${context.activeClaim.operation.id}.json`), {
         operationId: context.activeClaim.operation.id,
         fence: context.activeClaim.operation.fence,

package/lib/sellable-agent/profile-materializer.mjs

@@ -131,8 +131,8 @@ function validateDesired(desired) {
     !Number.isSafeInteger(desired.slackGeneration) || desired.slackGeneration < 1 ||
     !Number.isSafeInteger(desired.serviceCredentialGeneration) || desired.serviceCredentialGeneration < 1 ||
     desired.hermesCli !== "hermes" || desired.hermesVersion !== "0.18.0" ||
-    desired.installerPackage !== "@sellable/install@0.1.363" ||
-    desired.mcpPackage !== "@sellable/mcp@0.1.620" ||
+    desired.installerPackage !== "@sellable/install@0.1.357" ||
+    desired.mcpPackage !== "@sellable/mcp@0.1.619" ||
     !Array.isArray(desired.toolInclude) || desired.toolInclude.length === 0 ||
     desired.toolInclude.some((tool) => !/^[a-z][a-z0-9_]{0,127}$/.test(tool)) ||
     new Set(desired.toolInclude).size !== desired.toolInclude.length ||

package/lib/sellable-agent/provisioning-adapter.mjs

@@ -19,8 +19,8 @@ import { fileURLToPath } from "node:url";
 import { deriveContainedProfileId } from "./profile-materializer.mjs";
 
 export const PROVISIONING_ACTION = "PROVISION_HERMES_PROFILE";
-export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.363";
-export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.620";
+export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.357";
+export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.619";
 
 export function deriveAgentProfileId(workspaceId, agentId, hostId) {
   return deriveContainedProfileId(workspaceId, agentId, hostId);
@@ -576,7 +576,7 @@ function inspectProvisionedProfile({
       !matchesReadback(manifest, request) ||
       manifest.serviceCredentialReference !== serviceCredentialReference ||
       manifest.installerPackage !== PINNED_INSTALL_PACKAGE ||
-      manifest.installerVersion !== "0.1.363" ||
+      manifest.installerVersion !== "0.1.357" ||
       manifest.mcpPackage !== PINNED_MCP_PACKAGE ||
       manifest.credentialKeyVersion !== credentialKeyVersion ||
       !/^[a-f0-9]{16}$/.test(manifest.credentialFingerprint) ||
@@ -781,7 +781,7 @@ function successReceipt({
     subject: `agent-profile:${observed.profileId}`,
     cli: {
       installPackage: PINNED_INSTALL_PACKAGE,
-      installVersion: "0.1.363",
+      installVersion: "0.1.357",
       mcpPackage: PINNED_MCP_PACKAGE,
       command: "hermes profile bootstrap",
     },
@@ -821,7 +821,7 @@ function failure(code, stages, extra = {}, request = null) {
     subject: safeIdentity ? `agent-profile:${safeIdentity}` : "agent-profile:unbound",
     cli: {
       installPackage: PINNED_INSTALL_PACKAGE,
-      installVersion: "0.1.363",
+      installVersion: "0.1.357",
       mcpPackage: PINNED_MCP_PACKAGE,
       command: "hermes profile bootstrap",
     },

package/lib/sellable-agent/runtime-helper.mjs

@@ -23,7 +23,6 @@ export const EXTERNAL_HERMES_ENTRYPOINT = `${EXTERNAL_RUNTIME_CLOSURE_ROOT}/herm
 const EXTERNAL_RUNTIME_MANIFEST_VERSION = "sellable-agent-external-runtime-closure/v1";
 const ACTIONS = new Set([
   "INSTALL_MCP_CREDENTIAL",
-  "INSTALL_PROVIDER_CREDENTIAL",
   "INSTALL_RUNTIME_SERVICE_ENV",
   "SET_RUNTIME_GATES",
   "OBSERVE_RUNTIME_GATES",
@@ -51,7 +50,6 @@ const PROFILE_ENTRIES = Object.freeze([
 ]);
 const ACTION_KEYS = Object.freeze({
   INSTALL_MCP_CREDENTIAL: ["action", "profileId", "operationId", "fence", "sourceRequestFile", "generation", "fingerprint"],
-  INSTALL_PROVIDER_CREDENTIAL: ["action", "profileId", "operationId", "fence", "fingerprint"],
   INSTALL_RUNTIME_SERVICE_ENV: ["action", "profileId", "operationId", "fence", "revisionId", "profileDigest"],
   SET_RUNTIME_GATES: ["action", "profileId", "operationId", "fence", "lifecycle"],
   OBSERVE_RUNTIME_GATES: ["action", "profileId", "operationId", "fence", "lifecycle"],
@@ -111,79 +109,6 @@ function atomicCredential(pathValue, secret, uid, gid) {
   fsyncDirectory(dirname(pathValue));
 }
 
-function providerCredentialPath(profile, profileId) {
-  const runtimeStateRoot = safeRuntimeStateRoot(profile);
-  const profilesRoot = join(runtimeStateRoot, "profiles");
-  const profileRoot = join(profilesRoot, profileId);
-  const runtimeHome = join(profileRoot, "home");
-  for (const pathValue of [profilesRoot, profileRoot, runtimeHome]) {
-    const link = lstatSync(pathValue);
-    if (
-      link.isSymbolicLink() || !link.isDirectory() || (link.mode & 0o777) !== 0o700 ||
-      link.uid !== profile.runtimeUid || link.gid !== profile.runtimeGid
-    ) throw new Error("provider runtime home rejected");
-  }
-  const codexRoot = join(runtimeHome, ".codex");
-  if (!existsSync(codexRoot)) {
-    mkdirSync(codexRoot, { mode: 0o700 });
-    chownSync(codexRoot, profile.runtimeUid, profile.runtimeGid);
-  }
-  const codex = lstatSync(codexRoot);
-  if (
-    codex.isSymbolicLink() || !codex.isDirectory() || (codex.mode & 0o777) !== 0o700 ||
-    codex.uid !== profile.runtimeUid || codex.gid !== profile.runtimeGid
-  ) throw new Error("provider credential root rejected");
-  return join(codexRoot, "auth.json");
-}
-
-function installProviderCredential(profile, request, config) {
-  if (
-    !SHA256.test(request.fingerprint ?? "") ||
-    request.fingerprint !== profile.providerCredentialFingerprint ||
-    (
-      profile.providerCredentialSourcePath !== "/var/lib/sellable-agent-bootstrap/provider-auth" &&
-      config.disposableFixture !== true
-    )
-  ) throw new Error("provider credential identity rejected");
-  const sourceRoot = privateRoot(dirname(profile.providerCredentialSourcePath));
-  const source = readPrivateDirectFile(sourceRoot, profile.providerCredentialSourcePath).trim();
-  if (!source || source.length > 1024 * 1024 || sha256(source) !== request.fingerprint) {
-    throw new Error("provider credential source rejected");
-  }
-  const parsed = JSON.parse(source);
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("provider credential JSON rejected");
-  }
-  const target = providerCredentialPath(profile, request.profileId);
-  atomicCredential(target, source, profile.runtimeUid, profile.runtimeGid);
-  return {
-    ok: true,
-    profileId: request.profileId,
-    fingerprint: request.fingerprint,
-    path: target,
-  };
-}
-
-function removeProviderCredential(profile, profileId) {
-  const target = providerCredentialPath(profile, profileId);
-  if (existsSync(target)) {
-    const link = lstatSync(target);
-    if (link.isSymbolicLink() || !link.isFile()) throw new Error("provider credential cleanup rejected");
-    rmSync(target, { force: true });
-    fsyncDirectory(dirname(target));
-  }
-}
-
-function observeProviderCredential(profile, profileId) {
-  const target = providerCredentialPath(profile, profileId);
-  const link = lstatSync(target);
-  if (
-    link.isSymbolicLink() || !link.isFile() || (link.mode & 0o777) !== 0o600 ||
-    link.uid !== profile.runtimeUid || link.gid !== profile.runtimeGid
-  ) throw new Error("provider credential readback rejected");
-  return sha256(readFileSync(target, "utf8").trim());
-}
-
 function applyRuntimeOwnership(pathValue, uid, gid) {
   const link = lstatSync(pathValue);
   if (link.isSymbolicLink()) throw new Error("profile symlink rejected");
@@ -584,9 +509,7 @@ function walkExternalRoot(root, ownerUid, ownerGid) {
     }
   };
   visit(root, "");
-  const byPath = (left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0;
-  const byLogicalPath = (left, right) => left.logicalPath < right.logicalPath ? -1 : left.logicalPath > right.logicalPath ? 1 : 0;
-  return { directories: directories.sort(byPath), files: files.sort(byLogicalPath) };
+  return { directories: directories.sort((left, right) => left.path.localeCompare(right.path)), files };
 }
 
 export function observeExternalRuntimeClosure(input = {}) {
@@ -646,24 +569,18 @@ export function observeExternalRuntimeClosure(input = {}) {
     if (
       JSON.stringify(rootRecord.directories.map((directory) => directory?.path)) !==
         JSON.stringify(rootRecord.directories.map((directory) => directory?.path).sort()) ||
-      new Set(rootRecord.directories.map((directory) => directory?.path)).size !== rootRecord.directories.length
-    ) throw new Error("external runtime directory order rejected");
-    if (
+      new Set(rootRecord.directories.map((directory) => directory?.path)).size !== rootRecord.directories.length ||
       rootRecord.directories.some((directory) =>
         !exactKeys(directory, ["path", "mode"]) ||
-        !/^[-A-Za-z0-9@._+]+(?:\/[-A-Za-z0-9@._+]+)*$/.test(directory.path ?? "") ||
+        !/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(directory.path ?? "") ||
         directory.mode !== 0o555
-      )
-    ) throw new Error("external runtime directory schema rejected");
-    if (JSON.stringify(walked.directories) !== JSON.stringify(rootRecord.directories)) {
-      throw new Error("external runtime directory inventory rejected");
-    }
-    if (
+      ) ||
+      JSON.stringify(walked.directories) !== JSON.stringify(rootRecord.directories) ||
       rootRecord.files.length === 0 ||
       JSON.stringify(rootRecord.files.map((file) => file?.path)) !==
         JSON.stringify(rootRecord.files.map((file) => file?.path).sort()) ||
       new Set(rootRecord.files.map((file) => file?.path)).size !== rootRecord.files.length
-    ) throw new Error("external runtime file order rejected");
+    ) throw new Error("external runtime inventory rejected");
     const actualPaths = walked.files.map((file) => file.logicalPath);
     if (JSON.stringify(actualPaths) !== JSON.stringify(rootRecord.files.map((file) => file.path))) {
       throw new Error("external runtime open inventory rejected");
@@ -671,7 +588,7 @@ export function observeExternalRuntimeClosure(input = {}) {
     const observedFiles = rootRecord.files.map((file, index) => {
       if (
         !exactKeys(file, ["path", "mode", "digest"]) ||
-        !/^[-A-Za-z0-9@._+]+(?:\/[-A-Za-z0-9@._+]+)*$/.test(file.path ?? "") ||
+        !/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(file.path ?? "") ||
         ![0o444, 0o555].includes(file.mode) || !SHA256.test(file.digest ?? "")
       ) throw new Error("external runtime file schema rejected");
       const actual = walked.files[index];
@@ -1041,19 +958,9 @@ async function observeRuntime(profile, request) {
   const profileFiles = observeRuntimeProfileFiles(target);
   const { runtimeConfig, runtimeMcp, tools, fileHashes: actualFileHashes } = profileFiles;
   const actualProfileDigest = profileFiles.profileDigest;
-  let observedProvider;
-  try {
-    observedProvider = observeProviderCredential(profile, request.profileId);
-    if (observedProvider !== runtimeConfig?.provider?.fingerprint) {
-      throw new Error("provider credential fingerprint rejected");
-    }
-  } catch (error) {
-    if (!driftMode) throw error;
-    observedProvider = sha256(`provider-drift\0${runtimeConfig?.provider?.fingerprint ?? "absent"}`);
-  }
-  if (environmentDrift) {
-    observedProvider = sha256(`environment-drift\0${observedProvider}`);
-  }
+  const observedProvider = environmentDrift
+    ? sha256(`environment-drift\0${runtimeConfig?.provider?.fingerprint ?? "absent"}`)
+    : runtimeConfig?.provider?.fingerprint;
   return {
     profileId: manifest.profileId,
     workspaceId: manifest.workspaceId,
@@ -1265,9 +1172,6 @@ export async function runRuntimeHelperRequest({ requestPath, config }) {
         generation: request.generation,
       };
     }
-    if (request.action === "INSTALL_PROVIDER_CREDENTIAL") {
-      return installProviderCredential(profile, request, config);
-    }
     if (request.action === "INSTALL_RUNTIME_SERVICE_ENV") {
       return installRuntimeServiceEnvironment(profile, request);
     }
@@ -1283,7 +1187,6 @@ export async function runRuntimeHelperRequest({ requestPath, config }) {
         rmSync(target, { recursive: true, force: true });
         fsyncDirectory(root);
       }
-      removeProviderCredential(profile, request.profileId);
       return { ok: true, profileId: request.profileId, disposition: "REMOVED" };
     }
     if (request.action === "CHOWN_PROFILE") {

package/lib/sellable-agent/service-installer.mjs

@@ -247,8 +247,6 @@ function validateInstallInput(input) {
     profile.hermesSourceRoot !== `${EXTERNAL_RUNTIME_CLOSURE_ROOT}/hermes` ||
     profile.proxyConfigPath !== "/etc/sellable-agent/egress-proxy.json" ||
     profile.runtimeBoundaryConfigPath !== "/etc/sellable-agent/runtime-boundary.json" ||
-    profile.providerCredentialSourcePath !== "/var/lib/sellable-agent-bootstrap/provider-auth" ||
-    !SHA256.test(profile.providerCredentialFingerprint ?? "") ||
     profile.runtimeServicePath !== "/etc/services.d/sellable-agent-runtime" ||
     profile.runtimeServiceEnvRoot !== "/etc/services.d/sellable-agent-runtime/env" ||
     new Set([profile.runtimeUid, profile.proxyUid, profile.workerUid]).size !== 3
@@ -305,7 +303,7 @@ function configurationFiles(input, checked) {
   ].join("\n");
   return [
     ["/etc/sellable-agent/egress-proxy.json", `${JSON.stringify(checked.proxyConfig, null, 2)}\n`, 0o444],
-    ["/etc/sellable-agent/worker.json", `${JSON.stringify(input.workerConfig, null, 2)}\n`, 0o444],
+    ["/etc/sellable-agent/worker.json", `${JSON.stringify(input.workerConfig, null, 2)}\n`, 0o600],
     ["/etc/sellable-agent/runtime-helper.json", `${JSON.stringify(input.helperConfig, null, 2)}\n`, 0o600],
     ["/etc/sudoers.d/sellable-agent-runtime-helper", sudoers, 0o440],
   ].map(([logicalPath, bytes, mode]) => ({ logicalPath, bytes, mode }));

package/package.json

@@ -1,11 +1,10 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.363",
+  "version": "0.1.364-phase111.20260720135054",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {
     "sellable": "bin/sellable-install.mjs",
-    "sellable-agent-host-bootstrap": "bin/sellable-agent-host-bootstrap.mjs",
     "sellable-agent-egress-proxy": "bin/sellable-agent-egress-proxy.mjs",
     "sellable-agent-host-worker": "bin/sellable-agent-host-worker.mjs",
     "sellable-agent-runtime-helper": "bin/sellable-agent-runtime-helper.mjs",
@@ -21,7 +20,6 @@
     "bin",
     "lib",
     "services",
-    "container",
     "agents",
     "skill-templates",
     "README.md",

package/skill-templates/refill-sends-evergreen.md

@@ -17,3 +17,8 @@ Use `refill-sends-v2` instead:
 ```text
 get_subskill_prompt({ subskillName: "refill-sends-v2" })
 ```
+
+The alias must not strip exact `targetConfig`, server `runHandle`,
+`reportingContext`, canonical `refill_reporting.v2`, or an explicit
+`messageTemplateRevision`. It never infers revision authority from
+`forceRerun`.

package/skill-templates/refill-sends-v2.md

@@ -52,9 +52,35 @@ refill_sends_v2({ workspaceId, dryRun:true, intent:"auto", senderIds? })
 To resume an in-progress run, pass the handle back exactly:
 
 ```text
-refill_sends_v2({ workspaceId, runId, fence })
+refill_sends_v2({ workspaceId, runHandle:{runId,fence}, targetConfig, reportingContext, messageTemplateRevision? })
 ```
 
+`targetConfig` and the server-issued `runHandle` are separate authorities. Keep
+both byte-for-byte through every continuation and takeover; never fold the
+rotating fence into target configuration.
+
+An approved copy change is reachable only through an explicit
+`messageTemplateRevision` object with `version:1`, `source:"user_approved"`,
+the approved `templateMarkdown`, `messageTemplateRevision` identity,
+`priorTemplateAuthorityDigest`, `nextTemplateAuthorityDigest`, 1–500 exact
+`cohortRowIds`, and `requestId`, `effectId`, and `revisionOperationId`. Pass it
+with the exact `targetConfig` and `reportingContext`; the command obtains or
+resumes the server run handle and lets the planner name
+`revise_message_template_and_rerun`. Missing or partial input means no revision.
+`forceRerun:true` on a queue operation never authorizes or implies a template
+change.
+
+After a committed and dispatched revision receipt, continue only with the
+planner-provided revision-derived `approve_messages` action. It must preserve
+the exact revision cohort as `rowSelector:{type:"rowIds",rowIds:[...]}` plus
+`approvalMode:"approve"`, the compiled readiness identity, and the canonical
+`reportingContext`, even when the ordinary sender lane is ineligible. Do not
+replace it with `queue_campaign_cells` on Approved cells; that path cannot mint
+the authoritative approval/lane-scope receipt. Require `laneScope` in the
+bounded preparation receipt before the lane is considered approved. A
+disconnected or zero-capacity sender still blocks scheduling and does not
+authorize reconnecting, campaign start, or direct send.
+
 If a stale handle loses the lease, the tool reports the holder status and the
 approximately 10 minute lockout window. Reinvoke with the current handle or wait
 for lease expiry; never guess a fence.
@@ -85,6 +111,10 @@ The run may execute only packet-named bounded work:
   when the campaign is in the packet's pinned lane chain;
 - refresh paid InMail credit facts during bootstrap and once per scheduler-wait
   entry when the packet requires it.
+- apply `revise_message_template_and_rerun` only when the packet contains the
+  complete explicit user-approved revision envelope and exact fenced target.
+- after that revision commits, apply only its exact-row, readiness-bound
+  `approve_messages` continuation and require the returned lane-scope receipt.
 
 The loop records planned -> did -> outcome before and after every foreign
 mutation. It refuses stale packets by fingerprint and validates packet
@@ -168,5 +198,10 @@ reason or resume handle, lane source, lane chain, chosen label with token
 secondary, plan revision, journal path, blocked continuation packets, and
 firstFailing checklist when present.
 
+Preserve `refill_reporting.v2` exactly in progress, continuation, replay, and
+terminal results. Do not recompute its semantic counts or drop live-preparation
+epoch, snapshot sequence, reset reason, watermark, blockers, compatibility, or
+terminal fields. Never surface raw prospect or message-copy fields.
+
 Real-run journals live under `~/.sellable/refill/runs` by default and append an
 index line. Dry runs include the dry marker and do not create run records.

package/skill-templates/refill-sends.md

@@ -93,7 +93,7 @@ Accepted invocation flags in the same user request:
 When the host can call typed MCP tools, start with:
 
 ```text
-refill_sends({ yolo?: boolean, executionMode?: "manual" | "scheduled" | "yolo", requireWorkspace?: boolean, workspaceId?: string, senders?: string[], senderIds?: string[], senderNames?: string[], actionTypes?: ("send_invite" | "send_inmail_closed")[], horizonSendDays?: number, untilDate?: "YYYY-MM-DD", targetDate?: "YYYY-MM-DD", runId?: string, fence?: number })
+refill_sends({ yolo?: boolean, executionMode?: "manual" | "scheduled" | "yolo", requireWorkspace?: boolean, workspaceId?: string, senders?: string[], senderIds?: string[], senderNames?: string[], actionTypes?: ("send_invite" | "send_inmail_closed")[], horizonSendDays?: number, untilDate?: "YYYY-MM-DD", targetDate?: "YYYY-MM-DD", runHandle?: RefillRunHandleV1, targetConfig?: RefillTargetConfigV1, reportingContext?: RefillReportingContextV2, messageTemplateRevision?: MessageTemplateRevisionV1 })
 ```
 
 That command helper normalizes arguments and returns the execution contract. In
@@ -104,6 +104,49 @@ host must immediately call `refill_sends` again with the original full scope
 plus the exact returned `runId` and `fence`. Do this automatically inside the
 same user command until terminal projected coverage or a concrete blocker; do
 not ask the user to type `continue` and do not start a second run.
+
+`targetConfig` and the server-issued `runHandle` are separate values and must
+survive each continuation unchanged except for a server-issued takeover fence.
+Only a literal `messageTemplateRevision` with `source:"user_approved"`, the
+approved `templateMarkdown`, prior/new authority digests, 1–500 exact cohort
+row IDs, and request/effect/revision-operation IDs can authorize
+`revise_message_template_and_rerun`. No envelope means no revision. A
+`forceRerun:true` queue call cannot infer or authorize template mutation.
+When the user supplied a complete revision except for the current prior digest,
+acquire the exact run first and reread with its unchanged `targetConfig` and
+`runHandle`. Use only `reportingContext.source.templateAuthorityDigest` from
+that fenced reread as `priorTemplateAuthorityDigest`, then immediately continue
+the same run with the complete literal revision—even when the ordinary refill
+queue is empty or the sender is otherwise ineligible. An empty ordinary queue
+must not suppress an explicit revision. If the fenced reread returns no digest,
+stop with `template_authority_missing` or the returned
+`templateAuthorityBlocker`; never guess the digest.
+After the revision receipt is committed and dispatched, the next mutation must
+be the planner-provided revision-derived `approve_messages` action. Preserve
+its exact `rowSelector:{type:"rowIds",rowIds:[...]}` cohort,
+`approvalMode:"approve"`, compiled readiness authority, and
+`reportingContext`, even if the ordinary sender lane is ineligible. Never use
+`queue_campaign_cells` to flip Approved cells: that path cannot produce the
+authoritative approval/lane-scope receipt. Require the bounded preparation
+receipt's `laneScope` before considering the selected first-touch lane
+approved. Zero sender capacity remains a scheduler blocker and never authorizes
+reconnection, campaign start, or direct send.
+
+Before that approval mutation, perform an exact authoritative copy audit with
+`select_campaign_cells({ columnRole:"generateMessage",
+rowSelector:{type:"rowIds",rowIds:[...]},
+includeGeneratedMessageReview:true })` over the complete revision cohort in
+batches of at most 20. Require every
+`authoritativeGeneratedMessageReview.complete:true`, every row status to be
+completed-like, the exact user-approved rendered subject/body, the expected
+`templateAuthorityDigest`, and `matchesCurrentTemplateAuthority:true`. This
+projection is the only MCP copy-review source of truth. Never use formula
+Message/Subject columns, campaign message previews, table previews, or CSV
+exports to validate revised Generate Message results. If any row is missing,
+non-current, or text/digest mismatched, stop before approval and report
+`regenerated_copy_integrity_failed`; never regenerate again implicitly or
+approve the cohort on counts/revision hashes alone.
+
 Safe primitives are paid-credit refresh,
 existing-row message preparation, generated-message approval, receipt-proven
 same-source row copy, one bounded Signal Discovery search derived only from
@@ -567,6 +610,11 @@ scheduler wait loop. Do not finish the refill goal, mark it complete, or mark it
 blocked only because it is still `awaiting_scheduler_after_ready_buffer`; keep
 waiting unless Christian stops the run or the host cannot continue.
 
+Carry the canonical `refill_reporting.v2` DTO through progress, continuation,
+replay, and terminal reporting without recomputing counts or losing live epoch,
+snapshot sequence, reset reason, watermark, blockers, compatibility, or
+terminal outcome. Redact raw copy and prospect fields.
+
 Future scheduled coverage and already sent actions are distinct; only
 scheduler-owned future scheduled actions count as scheduled coverage. For
 multiple target dates, finish D1 execution and the full D1 reread before

package/bin/sellable-agent-host-bootstrap.mjs

@@ -1,26 +0,0 @@
-#!/usr/bin/env node
-
-import { lstatSync, readFileSync } from "node:fs";
-import { isAbsolute } from "node:path";
-import { bootstrapAgentHost } from "../lib/sellable-agent/host-bootstrap.mjs";
-
-function configPath(argv) {
-  if (argv.length !== 2 || argv[0] !== "--config" || !isAbsolute(argv[1])) {
-    throw new Error("usage: --config /absolute/path");
-  }
-  const link = lstatSync(argv[1]);
-  if (link.isSymbolicLink() || !link.isFile() || (link.mode & 0o777) !== 0o600 || link.uid !== 0 || link.gid !== 0) {
-    throw new Error("host bootstrap config rejected");
-  }
-  return argv[1];
-}
-
-try {
-  if (process.getuid?.() !== 0 || process.getgid?.() !== 0) throw new Error("host bootstrap requires root");
-  const pathValue = configPath(process.argv.slice(2));
-  const result = bootstrapAgentHost({ config: JSON.parse(readFileSync(pathValue, "utf8")) });
-  process.stdout.write(`${JSON.stringify(result.receipt)}\n`);
-} catch {
-  process.stderr.write("sellable-agent host bootstrap failed closed\n");
-  process.exitCode = 1;
-}

package/container/Dockerfile

@@ -1,41 +0,0 @@
-ARG HERMES_IMAGE=ghcr.io/hostinger/hvps-hermes-agent@sha256:f048663be9ba564de795df5f2a8184f32b92561a1f053c179dca3b45fa5bc8b9
-FROM ${HERMES_IMAGE}
-
-USER root
-
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.363
-ARG MCP_PACKAGE=@sellable/mcp@0.1.620
-ARG INSTALLER_INTEGRITY
-ARG MCP_INTEGRITY=sha512-N+2clnLHWAlvoXCjX10HaeEUMPLqZQHIX+x/2e1CSJbqb56CU1SAtVdwmhXyha7+MQT0DZF7pm2+WnoZKFEzOw==
-
-RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.363" \
-    && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.620" \
-    && test -n "${INSTALLER_INTEGRITY}" \
-    && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
-    && test "$(npm view "${MCP_PACKAGE}" dist.integrity)" = "${MCP_INTEGRITY}" \
-    && apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-      bubblewrap \
-      ca-certificates \
-      nftables \
-      sudo \
-    && rm -rf /var/lib/apt/lists/* \
-    && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
-    && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
-    && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
-    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.363' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.620') throw new Error('package identity rejected');" \
-    && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
-    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.363', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.620', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
-    && npm cache clean --force
-
-COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint
-RUN test -x /usr/local/bin/node \
-    && test ! -e /usr/bin/node \
-    && ln -s /usr/local/bin/node /usr/bin/node \
-    && test "$(readlink -f /usr/bin/node)" = "/usr/local/bin/node" \
-    && chmod 0555 /usr/local/bin/sellable-agent-container-entrypoint
-
-HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
-  CMD /command/s6-svstat /etc/services.d/sellable-agent-host-worker | grep -q '^up' || exit 1
-
-ENTRYPOINT ["/usr/local/bin/sellable-agent-container-entrypoint"]

package/container/README.md

@@ -1,15 +0,0 @@
-# Sellable Agent host container
-
-This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
-
-Build from this directory after `@sellable/install@0.1.363` is published:
-
-```sh
-docker build --platform linux/amd64 \
-  --build-arg INSTALLER_INTEGRITY='sha512-…' \
-  --tag sellable-agent-host:0.1.363 .
-```
-
-Create a private `bootstrap/` directory owned by root with mode `0700`. It must contain `bootstrap.json`, `provider-auth`, and `slack-app`, each owned by root with mode `0600`. `bootstrap.json` contains only non-secret identities, hashes, package integrities, and the control-plane URL. The other two files contain the provider JSON and global Slack app token whose hashes are pinned by `bootstrap.json`.
-
-Set `SELLABLE_AGENT_IMAGE` to the exact built image digest and start `compose.yaml`. The container bootstraps idempotently, writes `bootstrap/registration-receipt.json`, and starts the worker and isolated runtime under s6. Do not mount a Docker socket.