@sellable/install 0.1.411 → 0.1.413

package/container/Dockerfile

@@ -3,12 +3,12 @@ FROM ${HERMES_IMAGE}
 
 USER root
 
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.411
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.413
 ARG MCP_PACKAGE=@sellable/mcp@0.1.644
 ARG INSTALLER_INTEGRITY
 ARG MCP_INTEGRITY=sha512-Q2+bBeQCKy/tZ9hMslOZ1Tw/kTLKBjiv77zQqX38IFrNevLiOhRG4rsxvVPqfHkOIIOSKFl/ECTgFD0pcmhAXg==
 
-RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.411" \
+RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.413" \
     && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.644" \
     && test -n "${INSTALLER_INTEGRITY}" \
     && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
@@ -23,9 +23,9 @@ RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.411" \
     && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
     && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
     && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
-    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.411' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.644') throw new Error('package identity rejected');" \
+    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.413' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.644') throw new Error('package identity rejected');" \
     && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
-    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.411', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.644', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
+    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.413', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.644', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
     && npm cache clean --force
 
 COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint

package/container/README.md

@@ -3,13 +3,13 @@
 This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
 
 Build from this directory after
-`@sellable/install@0.1.411` is
+`@sellable/install@0.1.413` is
 published:
 
 ```sh
 docker build --platform linux/amd64 \
   --build-arg INSTALLER_INTEGRITY='sha512-…' \
-  --tag sellable-agent-host:0.1.411 .
+  --tag sellable-agent-host:0.1.413 .
 ```
 
 Create a private `bootstrap/` directory owned by root with mode `0700`. It must contain `bootstrap.json`, `provider-auth`, and `slack-app`, each owned by root with mode `0600`. `bootstrap.json` contains only non-secret identities, hashes, package integrities, and the control-plane URL. The other two files contain the provider JSON and global Slack app token whose hashes are pinned by `bootstrap.json`.

package/lib/sellable-agent/fly-customer-image/Dockerfile

@@ -3,9 +3,9 @@ FROM ${HERMES_IMAGE}
 
 USER root
 
-ARG MCP_PACKAGE=@sellable/mcp@0.1.710-uat.refill-zero-shot.20260723123117
-ARG MCP_INTEGRITY=sha512-KvIRcIPQR/3iviWNcpq4EgrR/gEuOOqV9fngbaF/Ch/E7bBx0oAsFDu+0YrKvPc+l95ia/ddyvxWmpuRpMGHGw==
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.411
+ARG MCP_PACKAGE=@sellable/mcp@0.1.745
+ARG MCP_INTEGRITY=sha512-3PhNu92HGbWN38vPmpvxpb2lu0C4TQpjhNdk8+2RsVCTMBHcRoFSSsaMkmlhpGHeH7fftf2uMqFH+04sxS374Q==
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.413
 ARG HERMES_VERSION=0.19.0
 ARG MCP_TRUST_ROOT_B64
 ARG TIRITH_VERSION=0.3.3

package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs

@@ -11,20 +11,21 @@ import {
   openSync,
   readFileSync,
   renameSync,
+  unlinkSync,
   writeFileSync,
 } from "node:fs";
 import { dirname, join } from "node:path";
-import {
-  buildNativeHermesLaunch,
-  clearCustomerRuntimeSecrets,
-  installCustomerRuntimeSecrets,
-} from "../fly-customer-worker.mjs";
 import {
   FLY_CUSTOMER_MODEL_ID,
   FLY_CUSTOMER_MODEL_PROVIDER,
   FLY_CUSTOMER_MODEL_REASONING_EFFORT,
   parseFlyCustomerModelCredential,
 } from "../fly-customer-model.mjs";
+import {
+  buildNativeHermesLaunch,
+  clearCustomerRuntimeSecrets,
+  installCustomerRuntimeSecrets,
+} from "../fly-customer-worker.mjs";
 import {
   createFlyCustomerControlClient,
   dropFlyRuntimePrivileges,
@@ -46,6 +47,7 @@ const PROFILES_ROOT = join(DATA_ROOT, "profiles");
 const SECRET_ROOT = "/run/sellable-agent";
 const TRUST_ROOT = "/usr/local/share/sellable-agent/mcp-turn-trust-root.pem";
 const HERMES = "/opt/hermes/.venv/bin/hermes";
+const HERMES_PYTHON = "/opt/hermes/.venv/bin/python3";
 const MCP =
   "/usr/local/lib/sellable-agent/external-runtime/mcp/bin/sellable-mcp";
 const RUNTIME_ID = process.env.SELLABLE_RUNTIME_ID ?? "";
@@ -60,11 +62,9 @@ const RUNTIME_GENERATION = Number(
 const BOOT_SESSION_ID = randomUUID();
 const HERMES_VERSION = process.env.SELLABLE_AGENT_HERMES_VERSION ?? "0.19.0";
 const INSTALLER_PACKAGE =
-  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ??
-  "@sellable/install@0.1.411";
+  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.413";
 const MCP_PACKAGE =
-  process.env.SELLABLE_AGENT_MCP_PACKAGE ??
-  "@sellable/mcp@0.1.710-uat.refill-zero-shot.20260723123117";
+  process.env.SELLABLE_AGENT_MCP_PACKAGE ?? "@sellable/mcp@0.1.745";
 
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -328,6 +328,42 @@ function writeRuntimeHermesConfig({
   const runtimeConfigRoot = profileRoot;
   mkdirSync(runtimeConfigRoot, { recursive: true, mode: 0o700 });
   chmodSync(runtimeConfigRoot, 0o700);
+  const priorIdentityPath = join(runtimeConfigRoot, "runtime-identity.json");
+  let priorModelCredentialGeneration = null;
+  if (existsSync(priorIdentityPath)) {
+    try {
+      const priorIdentity = JSON.parse(readFileSync(priorIdentityPath, "utf8"));
+      if (
+        Number.isSafeInteger(priorIdentity.modelCredentialGeneration) &&
+        priorIdentity.modelCredentialGeneration > 0
+      ) {
+        priorModelCredentialGeneration =
+          priorIdentity.modelCredentialGeneration;
+      }
+    } catch {
+      priorModelCredentialGeneration = null;
+    }
+  }
+  const localHermesAuthStorePath = join(runtimeConfigRoot, "auth.json");
+  const hermesRootAuthStorePath = join(DATA_ROOT, "auth.json");
+  if (existsSync(localHermesAuthStorePath)) {
+    const localAuthStore = lstatSync(localHermesAuthStorePath);
+    if (localAuthStore.isSymbolicLink() || !localAuthStore.isFile()) {
+      throw new Error("customer_model_auth_store_rejected");
+    }
+    unlinkSync(localHermesAuthStorePath);
+  }
+  if (
+    priorModelCredentialGeneration !== null &&
+    priorModelCredentialGeneration !== desired.modelCredentialGeneration &&
+    existsSync(hermesRootAuthStorePath)
+  ) {
+    const authStore = lstatSync(hermesRootAuthStorePath);
+    if (authStore.isSymbolicLink() || !authStore.isFile()) {
+      throw new Error("customer_model_auth_store_rejected");
+    }
+    unlinkSync(hermesRootAuthStorePath);
+  }
   const mcpConfig = JSON.parse(
     readFileSync(join(profileRoot, "sellable", "mcp.json"), "utf8")
   );
@@ -362,6 +398,21 @@ function writeRuntimeHermesConfig({
     ? process.env.SELLABLE_AGENT_TEST_MODEL_ORIGIN
     : null;
   const modelCredential = parseFlyCustomerModelCredential(secrets.modelCodex);
+  const modelAuthPath = join(secretRoot, "auth.json");
+  atomicFile(modelAuthPath, modelCredential.authJson, 0o600);
+  if (!existsSync(hermesRootAuthStorePath)) {
+    atomicFile(
+      hermesRootAuthStorePath,
+      modelCredential.hermesRootAuthJson,
+      0o600
+    );
+  } else {
+    const authStore = lstatSync(hermesRootAuthStorePath);
+    if (authStore.isSymbolicLink() || !authStore.isFile()) {
+      throw new Error("customer_model_auth_store_rejected");
+    }
+    chmodSync(hermesRootAuthStorePath, 0o600);
+  }
   atomicJson(runtimeConfigPath, {
     ...baseConfig,
     ...(testModelOrigin
@@ -439,6 +490,8 @@ function writeRuntimeHermesConfig({
     runtimeConfigPath,
     runtimeMcpPath,
     gatesPath,
+    modelAuthPath,
+    hermesRootAuthStorePath,
     modelCredential,
   };
 }
@@ -477,24 +530,25 @@ function applicationRuntimeEnv({ desired, runtimeConfig, secrets }) {
     HOME: DATA_ROOT,
     HERMES_HOME: DATA_ROOT,
     HERMES_CONFIG_PATH: runtimeConfig.runtimeConfigPath,
-    CODEX_HOME: join(SECRET_ROOT, desired.profileId),
+    CODEX_HOME: dirname(runtimeConfig.modelAuthPath),
     SELLABLE_AGENT_RUNTIME: "1",
     SELLABLE_AGENT_RUNTIME_GATE_FILE: runtimeConfig.gatesPath,
     SLACK_HOME_CHANNEL: desired.defaultChannelId,
     SLACK_ALLOWED_CHANNELS: desired.selectedChannelIds.join(","),
     SLACK_ALLOWED_USERS: desired.memberAllowlist.join(","),
     SLACK_REQUIRE_MENTION: "true",
-    SLACK_STRICT_MENTION: "true",
+    SLACK_STRICT_MENTION: "false",
     SLACK_ALLOW_BOTS: "false",
     ...(allowTestProviders()
       ? {
           SELLABLE_AGENT_TEST_MODEL_KEY:
-            runtimeConfig.modelCredential.apiKey,
+            runtimeConfig.modelCredential.testAccessToken,
         }
-      : { OPENAI_API_KEY: runtimeConfig.modelCredential.apiKey }),
+      : {}),
     NO_COLOR: "1",
   };
   delete env.OPENAI_BASE_URL;
+  delete env.OPENAI_API_KEY;
   delete env.OPENROUTER_API_KEY;
   delete env.SLACK_APP_TOKEN;
   delete env.SLACK_BOT_TOKEN;
@@ -636,23 +690,61 @@ async function proveProvisionedApplication({
   profileDigest,
 }) {
   const runtimeEnv = applicationRuntimeEnv({ desired, runtimeConfig, secrets });
-  const [hermesVersion, mcpVersion] = await Promise.all([
+  const [hermesVersion, mcpVersion, modelAuth] = await Promise.all([
     run(HERMES, ["--version"], { env: runtimeEnv, timeoutMs: 180_000 }),
     run(MCP, ["--version"], { env: runtimeEnv, timeoutMs: 180_000 }),
+    run(
+      HERMES_PYTHON,
+      [
+        "-c",
+        [
+          "import json",
+          "from pathlib import Path",
+          "from hermes_constants import get_default_hermes_root, get_hermes_home",
+          "from hermes_cli.auth import resolve_codex_runtime_credentials",
+          "value = resolve_codex_runtime_credentials(refresh_if_expiring=False)",
+          'root_auth = get_default_hermes_root() / "auth.json"',
+          'local_auth = get_hermes_home() / "auth.json"',
+          'print(json.dumps({"provider": value.get("provider"), "source": value.get("source"), "source_class": "root_fallback" if root_auth.is_file() and not local_auth.exists() else "unexpected", "auth_mode": value.get("auth_mode"), "credential_present": bool(value.get("api_key")), "local_auth_entry_count": 0 if not local_auth.exists() else 1}))',
+        ].join(";"),
+      ],
+      {
+        env: { ...runtimeEnv, HERMES_HOME: runtimeConfig.runtimeHome },
+        timeoutMs: 180_000,
+      }
+    ),
   ]);
+  let modelAuthReadback = null;
+  try {
+    modelAuthReadback = JSON.parse(modelAuth.stdout);
+  } catch {
+    modelAuthReadback = null;
+  }
   if (
     hermesVersion.status !== 0 ||
     mcpVersion.status !== 0 ||
+    modelAuth.status !== 0 ||
+    modelAuthReadback?.provider !== FLY_CUSTOMER_MODEL_PROVIDER ||
+    modelAuthReadback?.source !== "hermes-auth-store" ||
+    modelAuthReadback?.source_class !== "root_fallback" ||
+    modelAuthReadback?.auth_mode !== "chatgpt" ||
+    modelAuthReadback?.credential_present !== true ||
+    modelAuthReadback?.local_auth_entry_count !== 0 ||
     /Lazy-installing|pip install|npm install/i.test(
-      `${hermesVersion.stdout}\n${hermesVersion.stderr}\n${mcpVersion.stdout}\n${mcpVersion.stderr}`
+      `${hermesVersion.stdout}\n${hermesVersion.stderr}\n${mcpVersion.stdout}\n${mcpVersion.stderr}\n${modelAuth.stdout}\n${modelAuth.stderr}`
     )
   ) {
-    throw new Error("customer_runtime_binary_rejected");
+    throw new Error(
+      modelAuth.status !== 0 || !modelAuthReadback
+        ? "customer_model_auth_readback_rejected"
+        : "customer_runtime_binary_rejected"
+    );
   }
   return {
     profileDigest,
     hermesOutput: hermesVersion.stdout,
     mcpOutput: mcpVersion.stdout,
+    modelAuthOutput: modelAuth.stdout,
   };
 }
 
@@ -746,7 +838,9 @@ function completionReceipt({ claim, exchange, desired, proof }) {
     package: sha256(`${INSTALLER_PACKAGE}\n${MCP_PACKAGE}\n${HERMES_VERSION}`),
     config: proof.profileDigest,
     content: sha256(`${desired.soul}\n${desired.skill}`),
-    process: sha256(`${proof.hermesOutput}\n${proof.mcpOutput}`),
+    process: sha256(
+      `${proof.hermesOutput}\n${proof.mcpOutput}\n${proof.modelAuthOutput}`
+    ),
   };
   return {
     ...identity,
@@ -773,6 +867,7 @@ function completionReceipt({ claim, exchange, desired, proof }) {
             { code: "NATIVE_SLACK_GATEWAY", status: "TRUE" },
           ]),
       { code: "MCP_PREBAKED", status: "TRUE" },
+      { code: "CODEX_OAUTH_READBACK", status: "TRUE" },
       { code: "NO_BOOT_INSTALL", status: "TRUE" },
       { code: "DEDICATED_SLACK_APP", status: "TRUE" },
     ],

package/lib/sellable-agent/fly-customer-model.mjs

@@ -1,11 +1,39 @@
-export const FLY_CUSTOMER_MODEL_PROVIDER = "openai-api";
+export const FLY_CUSTOMER_MODEL_PROVIDER = "openai-codex";
 export const FLY_CUSTOMER_MODEL_ID = "gpt-5.6-sol";
 export const FLY_CUSTOMER_MODEL_REASONING_EFFORT = "high";
 
-const MODEL_CREDENTIAL_KEYS = ["OPENAI_API_KEY", "authMode"];
-const OPENAI_API_KEY = /^sk-[A-Za-z0-9_-]{16,512}$/;
+const MODEL_CREDENTIAL_KEYS = [
+  "OPENAI_API_KEY",
+  "auth_mode",
+  "last_refresh",
+  "tokens",
+];
+const MODEL_TOKEN_KEYS = [
+  "access_token",
+  "account_id",
+  "id_token",
+  "refresh_token",
+];
+const exactKeys = (value, expected) =>
+  value &&
+  typeof value === "object" &&
+  !Array.isArray(value) &&
+  Object.keys(value).length === expected.length &&
+  Object.keys(value).every((key) => expected.includes(key));
+const bounded = (value, minimum, maximum) =>
+  typeof value === "string" &&
+  value.length >= minimum &&
+  value.length <= maximum &&
+  !value.includes("\0");
 
 export function parseFlyCustomerModelCredential(secret) {
+  if (
+    typeof secret !== "string" ||
+    !secret ||
+    Buffer.byteLength(secret, "utf8") > 64 * 1024
+  ) {
+    throw new Error("customer_model_credential_rejected");
+  }
   let value;
   try {
     value = JSON.parse(secret);
@@ -13,21 +41,69 @@ export function parseFlyCustomerModelCredential(secret) {
     throw new Error("customer_model_credential_rejected");
   }
   if (
-    !value ||
-    typeof value !== "object" ||
-    Array.isArray(value) ||
-    Object.keys(value).sort().join("\0") !==
-      [...MODEL_CREDENTIAL_KEYS].sort().join("\0") ||
-    value.authMode !== "api-key" ||
-    typeof value.OPENAI_API_KEY !== "string" ||
-    !OPENAI_API_KEY.test(value.OPENAI_API_KEY)
+    !exactKeys(value, MODEL_CREDENTIAL_KEYS) ||
+    value.auth_mode !== "chatgpt" ||
+    value.OPENAI_API_KEY !== null ||
+    !bounded(value.last_refresh, 10, 128) ||
+    Number.isNaN(Date.parse(value.last_refresh)) ||
+    !exactKeys(value.tokens, MODEL_TOKEN_KEYS) ||
+    !bounded(value.tokens.id_token, 32, 32 * 1024) ||
+    !bounded(value.tokens.access_token, 32, 32 * 1024) ||
+    !bounded(value.tokens.refresh_token, 32, 16 * 1024) ||
+    !bounded(value.tokens.account_id, 1, 512)
   ) {
     throw new Error("customer_model_credential_rejected");
   }
+  const authJson = JSON.stringify({
+    auth_mode: "chatgpt",
+    OPENAI_API_KEY: null,
+    tokens: {
+      id_token: value.tokens.id_token,
+      access_token: value.tokens.access_token,
+      refresh_token: value.tokens.refresh_token,
+      account_id: value.tokens.account_id,
+    },
+    last_refresh: value.last_refresh,
+  });
+  const hermesRootAuthJson = JSON.stringify({
+    version: 1,
+    providers: {
+      "openai-codex": {
+        tokens: {
+          id_token: value.tokens.id_token,
+          access_token: value.tokens.access_token,
+          refresh_token: value.tokens.refresh_token,
+          account_id: value.tokens.account_id,
+        },
+        last_refresh: value.last_refresh,
+        auth_mode: "chatgpt",
+      },
+    },
+    credential_pool: {
+      "openai-codex": [
+        {
+          id: "sellable-control-plane",
+          label: "Sellable Codex OAuth",
+          auth_type: "oauth",
+          source: "device_code",
+          access_token: value.tokens.access_token,
+          refresh_token: value.tokens.refresh_token,
+          id_token: value.tokens.id_token,
+          account_id: value.tokens.account_id,
+          last_refresh: value.last_refresh,
+          priority: 0,
+          request_count: 0,
+        },
+      ],
+    },
+    active_provider: "openai-codex",
+  });
   return Object.freeze({
     provider: FLY_CUSTOMER_MODEL_PROVIDER,
     model: FLY_CUSTOMER_MODEL_ID,
     reasoningEffort: FLY_CUSTOMER_MODEL_REASONING_EFFORT,
-    apiKey: value.OPENAI_API_KEY,
+    authJson,
+    hermesRootAuthJson,
+    testAccessToken: value.tokens.access_token,
   });
 }

package/lib/sellable-agent/host-bootstrap.mjs

@@ -39,7 +39,7 @@ const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 const VERSION = "sellable-agent-host-bootstrap/v1";
 const RECEIPT_VERSION = "sellable-agent-host-registration/v1";
 const INSTALLER_PACKAGE =
-  "@sellable/install@0.1.411";
+  "@sellable/install@0.1.413";
 const MCP_PACKAGE = "@sellable/mcp@0.1.644";
 const HERMES_VERSION = "0.18.0";
 const SHA256 = /^[a-f0-9]{64}$/;

package/lib/sellable-agent/host-worker.mjs

@@ -1514,7 +1514,7 @@ export function compileClaimToProfileDesired(activeClaim, config) {
       pinned.hermesCli !== "hermes" ||
       pinned.hermesVersion !== "0.18.0" ||
       pinned.installerPackage !==
-        "@sellable/install@0.1.411" ||
+        "@sellable/install@0.1.413" ||
       pinned.mcpPackage !== "@sellable/mcp@0.1.644" ||
       !Array.isArray(policy.toolInclude) ||
       policy.toolInclude.length === 0 ||

package/lib/sellable-agent/profile-materializer.mjs

@@ -193,7 +193,7 @@ function validateDesired(desired) {
     desired.hermesCli !== "hermes" ||
     desired.hermesVersion !== "0.18.0" ||
     desired.installerPackage !==
-      "@sellable/install@0.1.411" ||
+      "@sellable/install@0.1.413" ||
     desired.mcpPackage !== "@sellable/mcp@0.1.644" ||
     !Array.isArray(desired.toolInclude) ||
     desired.toolInclude.length === 0 ||
@@ -2133,7 +2133,7 @@ function nativeSlackCustomerFiles(desired) {
     },
     slack: {
       require_mention: true,
-      strict_mention: true,
+      strict_mention: false,
       allow_bots: false,
       allowed_channels: [...desired.selectedChannelIds],
     },

package/lib/sellable-agent/provisioning-adapter.mjs

@@ -26,7 +26,7 @@ import { deriveContainedProfileId } from "./profile-materializer.mjs";
 
 export const PROVISIONING_ACTION = "PROVISION_HERMES_PROFILE";
 export const PINNED_INSTALL_PACKAGE =
-  "@sellable/install@0.1.411";
+  "@sellable/install@0.1.413";
 export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.644";
 
 export function deriveAgentProfileId(workspaceId, agentId, hostId) {
@@ -613,7 +613,7 @@ function inspectProvisionedProfile({
       manifest.serviceCredentialReference !== serviceCredentialReference ||
       manifest.installerPackage !== PINNED_INSTALL_PACKAGE ||
       manifest.installerVersion !==
-        "0.1.411" ||
+        "0.1.413" ||
       manifest.mcpPackage !== PINNED_MCP_PACKAGE ||
       manifest.credentialKeyVersion !== credentialKeyVersion ||
       !/^[a-f0-9]{16}$/.test(manifest.credentialFingerprint) ||
@@ -827,7 +827,7 @@ function successReceipt({
     subject: `agent-profile:${observed.profileId}`,
     cli: {
       installPackage: PINNED_INSTALL_PACKAGE,
-      installVersion: "0.1.411",
+      installVersion: "0.1.413",
       mcpPackage: PINNED_MCP_PACKAGE,
       command: "hermes profile bootstrap",
     },
@@ -875,7 +875,7 @@ function failure(code, stages, extra = {}, request = null) {
       : "agent-profile:unbound",
     cli: {
       installPackage: PINNED_INSTALL_PACKAGE,
-      installVersion: "0.1.411",
+      installVersion: "0.1.413",
       mcpPackage: PINNED_MCP_PACKAGE,
       command: "hermes profile bootstrap",
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.411",
+  "version": "0.1.413",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {

package/skill-templates/refill-sends.md

@@ -74,10 +74,14 @@ get_subskill_prompt({ subskillName: "refill-sends-workflow" })
 get_subskill_asset({ subskillName: "refill-sends-workflow", assetPath: "core/flow.v1.json" })
 ```
 
-Continue chunks until `hasMore:false`; require
-exactly `workflow:"refill-sends-workflow"` and `version:"v1.8"`, then report
-that verified version before D1. Any other or unverified version is
-`workflow_version_mismatch`: stop before `get_refill_target_plan` or mutation.
+Continue chunks until `hasMore:false`; require `workflow:"refill-sends-workflow"`
+and a COMPATIBLE version: same major (`v1`) and minor at or above the minimum
+`v1.8` — so `v1.8`, `v1.9`, `v1.10` all pass and `v2.x` does not. Report the
+verified version before D1. A missing, unparseable, wrong-major, or
+below-minimum version is `workflow_version_mismatch`: stop before
+`get_refill_target_plan` or mutation. Do NOT require exact string equality: the
+flow asset ships in the npm package while this skill is installed separately,
+so an exact pin makes every additive contract change a breaking one.
 Route intent is immutable:
 workspace-wide `--yolo` uses `intent:"auto"` from first plan through terminal.
 
@@ -484,9 +488,13 @@ flowchart TD
 
 One scheduler-loaded exact lane is not a workspace terminal: skip it and
 continue other planner-ranked lanes. Do not keep polling after the coordinator
-returns workspace `loaded_awaiting_scheduler`, which is valid only when every
-remaining exact target is complete or scheduler-owned and workspace
-`remainingReadyOrProjectedGap` is zero. It is not permission for a host-owned
+returns workspace `loaded_awaiting_scheduler`. That terminal is admissible by
+either path: every remaining exact target is complete or scheduler-owned and
+workspace `remainingReadyOrProjectedGap` is zero, OR every gap-bearing sender
+lane is already prepared and its residue is `ready_to_schedule` surplus, so the
+remaining gap is scheduler/pacing-bound rather than unexposed supply — on that
+second path `remainingReadyOrProjectedGap` is not necessarily zero. Neither path
+means unexposed actionable supply, and neither is permission for a host-owned
 loop. The sole refill-ladder expansion
 that asks the user in `--yolo` is `new_campaign_required`; refill itself never
 creates that campaign. `new_campaign_required` is also the truthful terminal
@@ -497,7 +505,17 @@ remaining gap and ask the user; a future handler may automate the creation. A
 (approval/generate/enrich/rubric or unprocessed frontier rows) still exist but
 no executable exact edge surfaced: retry once with a fresh command, and if it
 repeats report it as a planner-exposure defect instead of treating the
-workspace as exhausted.
+workspace as exhausted. That census counts CONVERTIBLE rows only, de-duplicated
+per campaign/table lane — a frontier whose own preparation receipt carries a
+non-retryable `icp_or_rubric_rejection` diagnosis is proven unable to convert,
+so it never inflates the census. When such receipts are all that remain, the
+terminal is `source_supply_exhausted_at_rubric`: a truthful source exhaustion,
+not a defect and not retryable. Report the per-lane evidence from the note and
+tell the user that widening the rubric or adding fresh source rows is the only
+remaining fill path. Whenever a terminal reports a non-empty census, it also
+names every exact edge the run refused (`Exact edges this run refused: ...`) —
+surface those named blockers rather than describing the workspace as having no
+available work.
 
 ## Non-negotiable authority and proof
 

package/skill-templates/refresh-sender-engagement.md

@@ -33,7 +33,11 @@ You are a pipeline supply agent. People who engage with a sender's LinkedIn post
 <inputs>
 The invoking prompt names the senders ("refresh sender engagement for csreyes92 and thomas"). Resolve each via `list_senders` (match name/handle/LinkedIn URL). With no names given, inspect the active workspace and refresh every connected sender that has an active/paused sender-owned Post Engagers campaign backed by Signal Discovery.
 
-Optional: target sender names/ids, `tableId` when the user wants to force a specific campaign table, maximum posts per sender (default 5, hard cap 5 unless the user explicitly asks for more), and maximum engager pages per tracked post.
+Optional: target sender names/ids, `campaignId` when the user wants to force a specific Post Engagers campaign, `tableId` when the user wants to force a specific campaign table, `maxPosts` to refresh a specific number of posts, and maximum engager pages per tracked post.
+
+Leave `maxPosts` unset unless the user asked for a specific number. By default the command refreshes every tracked post published inside the 30-day lookback window, which is what keeps recent posts checked often enough to catch new engagers. A post whose engagement counts have not moved costs a single cheap count probe and is skipped before any engager fetch, so a wider sweep is not a proportionally more expensive one. Passing `maxPosts` narrows that sweep.
+
+`campaignId` is optional. When it is omitted the command discovers the sender's Post Engagers campaign itself — it searches the workspace for campaigns the sender solely owns that are backed by a post-engager provider and named as a Post Engagers lane. A workspace can hold one such lane per sender, so discovery is always scoped to the sender you are refreshing; another sender's lane and shared multi-sender lanes are never selected. Do not pass a `campaignId` you guessed.
 </inputs>
 
 <entrypoint>
@@ -58,9 +62,12 @@ For each target sender/campaign:
    - Resolve each target sender with `list_senders`/`get_sender`. Use the sender id returned by the product, not a guessed handle.
 2. **Use the typed product command first**:
    - Call `refresh_sender_engagement` in `mode:"dry_run"` for each sender.
-   - Always pass `workspaceId`, `senderId`, and any user-specified `tableId`, `maxPosts`, or `maxEngagerPages`.
+   - Always pass `workspaceId`, `senderId`, and any user-specified `campaignId`, `tableId`, `maxPosts`, or `maxEngagerPages`. Omitting `campaignId` is correct and normal — the command resolves the campaign itself.
+   - Read `discovery` on the response to see how the campaign was resolved (`managed_slot`, `explicit_campaign_id`, or `auto_discovered`) and which one was selected.
+   - If `discovery.additionalCandidates` is non-empty, that sender owns more than one Post Engagers lane. Refresh each one by repeating the dry-run/apply cycle with that candidate's `campaignId`. Every lane gets its own dry run and its own `dryRunFingerprint`; never reuse a fingerprint across campaigns.
    - Treat the dry-run response as the campaign/source boundary authority. It should identify the sender-owned Post Engagers slot, campaign, workflow table, source provider `campaign-tracked-post`, source table type `tracked_post_engager_source_list`, expected tracked posts, expected engager refresh/import work, and a `dryRunFingerprint`.
    - If the typed command reports no eligible sender-owned Post Engagers campaign, no tracked posts, no recent posts, or a workspace/sender mismatch, report that exact blocker and stop for that sender. Do not silently create campaigns or fall back to shared lanes.
+   - `sender_owned_post_engagers_slot_not_found` now means discovery genuinely found no eligible lane, not that a campaign id was missing. Report `discovery.campaignsInspected` alongside it, and describe it as missing campaign setup — never as "the sender has no posts", since no LinkedIn fetch happens before this point.
 3. **Gate writes with dry-run proof**:
    - Never call `refresh_sender_engagement` in `mode:"apply"` before a successful dry run from this same run.
    - For manual runs, show the target workspace, sender, campaign/table, source lead list, expected tracked posts, expected row/import impact, and `dryRunFingerprint`, then wait for explicit user approval before apply.
@@ -79,7 +86,7 @@ For each target sender/campaign:
 - LinkedIn operations here are read-only fetches plus a typed product import into a campaign table. **No messages are generated, approved, scheduled, or sent by this skill.**
 - Respect workspace boundaries: only add leads to campaigns in the active workspace, and only for senders that belong to it.
 - Respect campaign boundaries: only add engagers to the matched sender-owned Post Engagers campaign/table. Do not mix shared-lane engagers into sender-owned campaigns or sender-owned engagers into shared lanes.
-- Cap provider usage per run: at most 5 posts × `fetch_post_engagers` per sender. If the invoking automation wants more, it must say so explicitly.
+- Provider usage per run is bounded by the 30-day lookback window plus the count-probe short-circuit: unchanged posts cost one probe and fetch no engagers. Do not widen `maxEngagerPages` beyond what the user asked for.
 - Never call `start_campaign`, `attach_sequence`, `queue_campaign_cells`, `start_campaign_message_preparation`, approval tools, send/schedule tools, or shared-lane mutation tools.
 - Never create campaigns, change campaign status, change sender ownership, approve campaign cells, or start message prep as part of this refresh.
 </safety>