@sellable/install 0.1.484 → 0.1.486-wip.phase169.20260804.2

package/lib/sellable-agent/fly-admin-image/admin-runtime.mjs

@@ -39,8 +39,12 @@ import {
 } from "../admin-artifact/node_modules/@sellable/admin-install/lib/hermes-admin-profile-factory.mjs";
 import {
   evaluateModelAuthReadback,
-  parseFlyCustomerModelCredential,
-} from "../admin-artifact/node_modules/@sellable/install/lib/sellable-agent/fly-customer-model.mjs";
+  modelAuthConfigOverlay,
+  parseModelAuthRuntimeCredential,
+  readModelAuthMaterialization,
+  reconcileHermesModelAuth,
+} from "../model-auth-reconciler.mjs";
+import { createModelHealthReporter } from "../model-health-reporter.mjs";
 import {
   buildAdminAgentServiceEnvironment,
   buildNativeHermesLaunch,
@@ -571,10 +575,40 @@ function profilePackageReceipt(
   };
 }
 
+function installAdminModelConfig(profileRoot, modelConfig) {
+  const path = join(profileRoot, "config.yaml");
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    throw new Error("admin_model_config_rejected");
+  }
+  const document = parseDocument(readFileSync(path, "utf8"));
+  if (document.errors.length > 0) {
+    throw new Error("admin_model_config_rejected");
+  }
+  document.set("model", modelConfig.model);
+  document.set(
+    "credential_pool_strategies",
+    modelConfig.credential_pool_strategies
+  );
+  document.set("fallback_providers", modelConfig.fallback_providers);
+  atomicPrivateFile(path, document.toString());
+  const readback = parseDocument(readFileSync(path, "utf8")).toJS();
+  if (
+    canonicalJson(readback.model) !== canonicalJson(modelConfig.model) ||
+    canonicalJson(readback.credential_pool_strategies) !==
+      canonicalJson(modelConfig.credential_pool_strategies) ||
+    canonicalJson(readback.fallback_providers) !==
+      canonicalJson(modelConfig.fallback_providers)
+  ) {
+    throw new Error("admin_model_config_rejected");
+  }
+}
+
 async function materializeAdminProfile({
   profileContract,
   settingsRoot,
   rootAuthPath,
+  modelConfig,
   productConfigPath,
   soul,
   slack = null,
@@ -659,6 +693,7 @@ async function materializeAdminProfile({
       return { ok: true, ...proof };
     },
   });
+  installAdminModelConfig(stageRoot, modelConfig);
   mergeHermesState(profileHome, stageRoot);
   installAdminHermesMemoryHook(stageRoot);
   stageAdminRuntimeTree(stageRoot);
@@ -924,25 +959,43 @@ function installRuntimeSecrets({ claim, secrets, desiredLifecycle }) {
   privateDirectory(SECRET_ROOT);
   const modelAuthority = claim?.runtimeContract?.model;
   const modelEnvelope = claim?.secretEnvelopes?.modelCodex;
+  const modelTuple = claim?.adminRuntimeGeneration?.tuple;
   if (
     modelAuthority?.provider !== "codex" ||
-    !Number.isSafeInteger(modelAuthority.credentialGeneration) ||
-    modelAuthority.credentialGeneration < 1 ||
+    !/^[A-Za-z0-9_.:-]{1,256}$/.test(modelAuthority.activationId ?? "") ||
+    !Number.isSafeInteger(modelAuthority.bundleGeneration) ||
+    modelAuthority.bundleGeneration < 1 ||
+    !/^[a-f0-9]{64}$/.test(modelAuthority.policyHash ?? "") ||
     !/^[a-f0-9]{16}$/.test(modelAuthority.credentialFingerprint ?? "") ||
-    modelAuthority.credentialGeneration !== modelEnvelope?.generation ||
+    modelAuthority.bundleGeneration !== modelEnvelope?.generation ||
     modelAuthority.credentialFingerprint !== modelEnvelope?.fingerprint ||
+    modelEnvelope?.activationId !== modelAuthority.activationId ||
+    modelEnvelope?.bundleGeneration !== modelAuthority.bundleGeneration ||
+    modelEnvelope?.policyHash !== modelAuthority.policyHash ||
+    modelTuple?.modelAuthActivationId !== modelAuthority.activationId ||
+    modelTuple?.modelAuthBundleGeneration !== modelAuthority.bundleGeneration ||
+    modelTuple?.modelAuthPolicyHash !== modelAuthority.policyHash ||
     !/^[A-Za-z0-9_-]{1,128}$/.test(claim?.operation?.profileId ?? "")
   ) {
     throw new Error("admin_model_auth_identity_rejected");
   }
-  const model = parseFlyCustomerModelCredential(secrets.modelCodex);
+  const model = parseModelAuthRuntimeCredential(secrets.modelCodex);
+  if (
+    model.activationId !== modelAuthority.activationId ||
+    model.bundleGeneration !== modelAuthority.bundleGeneration ||
+    model.policyHash !== modelAuthority.policyHash
+  ) {
+    throw new Error("admin_model_auth_identity_rejected");
+  }
   const rootAuthPath = join(DATA_ROOT, "auth.json");
+  const markerPath = join(RUNTIME_ROOT, "model-auth-source.json");
   const localAuthPath = join(
     PROFILES_ROOT,
     claim.operation.profileId,
     "auth.json"
   );
   const identityPath = join(RUNTIME_ROOT, "model-auth-identity.json");
+  const modelBundlePath = join(SECRET_ROOT, "model-auth-runtime-v2.json");
   const validateAuthFile = (path) => {
     const stat = lstatSync(path);
     if (stat.isSymbolicLink() || !stat.isFile() || (stat.mode & 0o077) !== 0) {
@@ -953,57 +1006,32 @@ function installRuntimeSecrets({ claim, secrets, desiredLifecycle }) {
     validateAuthFile(localAuthPath);
     rmSync(localAuthPath, { force: true });
   }
-  let priorCredentialGeneration = null;
-  if (existsSync(identityPath)) {
-    validateAuthFile(identityPath);
-    let priorIdentity;
-    try {
-      priorIdentity = JSON.parse(readFileSync(identityPath, "utf8"));
-    } catch {
-      throw new Error("admin_model_auth_identity_rejected");
-    }
-    if (
-      priorIdentity?.schemaVersion !== "sellable-admin-model-auth/v1" ||
-      priorIdentity.provider !== "codex" ||
-      !Number.isSafeInteger(priorIdentity.credentialGeneration) ||
-      priorIdentity.credentialGeneration < 1 ||
-      !/^[a-f0-9]{16}$/.test(priorIdentity.credentialFingerprint ?? "") ||
-      Object.keys(priorIdentity).sort().join("\0") !==
-        [
-          "credentialFingerprint",
-          "credentialGeneration",
-          "provider",
-          "schemaVersion",
-        ]
-          .sort()
-          .join("\0")
-    ) {
-      throw new Error("admin_model_auth_identity_rejected");
-    }
-    priorCredentialGeneration = priorIdentity.credentialGeneration;
-  }
-  const replaceRootAuth =
-    priorCredentialGeneration === null ||
-    priorCredentialGeneration !== modelAuthority.credentialGeneration ||
-    !existsSync(rootAuthPath);
-  if (existsSync(rootAuthPath)) {
-    validateAuthFile(rootAuthPath);
-    if (replaceRootAuth) rmSync(rootAuthPath, { force: true });
-  }
-  if (replaceRootAuth) {
-    atomicPrivateFile(rootAuthPath, model.hermesRootAuthJson);
-  } else {
-    // Hermes may refresh the pooled OAuth record in place. Preserve that
-    // native state until the server advances the credential generation.
-    chmodSync(rootAuthPath, 0o600);
+  atomicPrivateFile(modelBundlePath, model.authJson);
+  const modelAuthState = reconcileHermesModelAuth({
+    authStorePath: rootAuthPath,
+    markerPath,
+    credential: model,
+    lifecycle: desiredLifecycle,
+  });
+  const profileAuthPath =
+    desiredLifecycle === "ON"
+      ? rootAuthPath
+      : join(SECRET_ROOT, "model-auth-pending-start.json");
+  if (desiredLifecycle === "OFF") {
+    atomicPrivateFile(profileAuthPath, model.hermesRootAuthJson);
   }
   atomicPrivateFile(
     identityPath,
     `${JSON.stringify({
-      schemaVersion: "sellable-admin-model-auth/v1",
+      schemaVersion: "sellable-admin-model-auth/v2",
       provider: "codex",
-      credentialGeneration: modelAuthority.credentialGeneration,
+      activationId: modelAuthority.activationId,
+      bundleGeneration: modelAuthority.bundleGeneration,
+      policyHash: modelAuthority.policyHash,
       credentialFingerprint: modelAuthority.credentialFingerprint,
+      materializationStatus: modelAuthState.materialized
+        ? "current"
+        : "pending_start",
     })}\n`
   );
   atomicPrivateFile(join(SECRET_ROOT, "slack-app"), `${secrets.slackApp}\n`);
@@ -1026,13 +1054,70 @@ function installRuntimeSecrets({ claim, secrets, desiredLifecycle }) {
   );
   return {
     rootAuthPath,
+    profileAuthPath,
+    markerPath,
+    model,
+    modelAuthState,
+    modelConfig: modelAuthConfigOverlay(model),
     productConfigPath,
     runtimeGates,
     slackSecretFile,
   };
 }
 
-function proveAdminModelAuth(profile) {
+function pendingAdminModelAuthReadback(model) {
+  return Object.freeze({
+    schemaVersion: "sellable-agent-model-auth-readback/v2",
+    activationId: model.activationId,
+    bundleGeneration: model.bundleGeneration,
+    policyHash: model.policyHash,
+    provider: model.provider,
+    model: model.model,
+    fallbackDepth: model.value.openrouter.models.length,
+    desiredStatus: "converged",
+    materializedStatus: "pending_start",
+    slots: Object.freeze(
+      model.identity.slots.map((slot) =>
+        Object.freeze({
+          slotId: slot.slotId,
+          grantFingerprint: slot.grantFingerprint,
+          expiresAt: new Date(slot.expiresAt).toISOString(),
+          state: "ok",
+          lastErrorReason: null,
+          lastErrorResetAt: null,
+        })
+      )
+    ),
+    openrouter: Object.freeze({
+      keyFingerprint: model.identity.openrouterKeyFingerprint,
+      state: "ok",
+    }),
+  });
+}
+
+function proveAdminModelAuth(profile, installed, desiredLifecycle) {
+  if (desiredLifecycle === "OFF") {
+    return Object.freeze({
+      ...pendingAdminModelAuthReadback(installed.model),
+      source: "desired_converged_materialization_pending_start",
+      sourceClass: "access_only_pool_pending_start",
+      runtimeRefreshOwned: false,
+    });
+  }
+  const materialization = readModelAuthMaterialization({
+    authStorePath: installed.rootAuthPath,
+    markerPath: installed.markerPath,
+  });
+  const verdict = evaluateModelAuthReadback(materialization, {
+    activationId: installed.model.activationId,
+    bundleGeneration: installed.model.bundleGeneration,
+    policyHash: installed.model.policyHash,
+  });
+  if (!verdict.accepted) {
+    throw new Error(
+      `admin_model_auth_readback_rejected:${verdict.rejection ?? "unknown"}`
+    );
+  }
   const environment = {
     ...process.env,
     HOME: DATA_ROOT,
@@ -1049,12 +1134,10 @@ function proveAdminModelAuth(profile) {
       "-c",
       [
         "import json",
-        "from hermes_constants import get_default_hermes_root, get_hermes_home",
-        "from hermes_cli.auth import resolve_codex_runtime_credentials",
-        "value = resolve_codex_runtime_credentials(refresh_if_expiring=False)",
-        'root_auth = get_default_hermes_root() / "auth.json"',
-        'local_auth = get_hermes_home() / "auth.json"',
-        'print(json.dumps({"provider": value.get("provider"), "source": value.get("source"), "source_class": "root_fallback" if root_auth.is_file() and not local_auth.exists() else "unexpected", "auth_mode": value.get("auth_mode"), "credential_present": bool(value.get("api_key")), "local_auth_entry_count": 0 if not local_auth.exists() else 1}))',
+        "from agent.credential_pool import load_pool",
+        'pool = load_pool("openai-codex")',
+        "entry = pool.select()",
+        'print(json.dumps({"provider": "openai-codex", "source": getattr(entry, "source", None), "source_class": "access_only_pool", "credential_id": getattr(entry, "id", None), "credential_present": bool(getattr(entry, "access_token", None)), "runtime_refresh_owned": bool(getattr(entry, "refresh_token", None))}))',
       ].join(";"),
     ],
     {
@@ -1071,23 +1154,26 @@ function proveAdminModelAuth(profile) {
   } catch {
     readback = null;
   }
-  const verdict = evaluateModelAuthReadback(readback);
-  if (probe.status !== 0 || probe.error || !verdict.accepted) {
-    throw new Error(
-      `admin_model_auth_readback_rejected:${
-        probe.status !== 0 || probe.error
-          ? "probe_failed"
-          : (verdict.rejection ?? "unknown")
-      }`
-    );
+  if (
+    probe.status !== 0 ||
+    probe.error ||
+    readback?.provider !== "openai-codex" ||
+    readback?.source !== "manual:device_code" ||
+    readback?.source_class !== "access_only_pool" ||
+    !["dittto-primary", "kaigo-secondary"].includes(
+      readback?.credential_id
+    ) ||
+    readback?.credential_present !== true ||
+    readback?.runtime_refresh_owned !== false
+  ) {
+    throw new Error("access_only_snapshot_infeasible");
   }
   return Object.freeze({
-    provider: readback.provider,
+    ...materialization,
     source: readback.source,
     sourceClass: readback.source_class,
-    authMode: readback.auth_mode,
-    credentialPresent: readback.credential_present,
-    localAuthEntryCount: readback.local_auth_entry_count,
+    selectedCredentialId: readback.credential_id,
+    runtimeRefreshOwned: readback.runtime_refresh_owned,
   });
 }
 
@@ -1738,6 +1824,12 @@ function completionReceipt({
       ciphertextDigest: recovery.ciphertextDigest,
       locatorDigest: sha256(recovery.locator),
     },
+    modelAuth: {
+      activationId: modelAuth.activationId,
+      bundleGeneration: modelAuth.bundleGeneration,
+      policyHash: modelAuth.policyHash,
+      materializedStatus: modelAuth.materializedStatus,
+    },
     servers: profile.servers,
     traffic: {
       slackAccepted: false,
@@ -1772,7 +1864,13 @@ function completionReceipt({
       { code: "DUAL_MCP_PROVEN", status: "TRUE" },
       { code: "SETTINGS_GENERATION_PROVEN", status: "TRUE" },
       { code: "RECOVERY_GENERATION_PROVEN", status: "TRUE" },
-      { code: "MODEL_AUTH_PROVEN", status: "TRUE" },
+      {
+        code:
+          modelAuth.materializedStatus === "current"
+            ? "MODEL_AUTH_PROVEN"
+            : "MODEL_AUTH_DESIRED_PENDING_START",
+        status: "TRUE",
+      },
       { code: "RUNTIME_GATES_PROVEN", status: "TRUE" },
       { code: "SLACK_TRAFFIC_DISABLED", status: "TRUE" },
       { code: "NO_BOOT_INSTALL", status: "TRUE" },
@@ -1818,6 +1916,47 @@ async function flushHermesSnapshot({ client, profileId, profileRoot }) {
   }
 }
 
+function adminModelHealthReporter({ identity, exchange, installed, claim }) {
+  return createModelHealthReporter({
+    origin: ORIGIN,
+    identity: {
+      kind: "ADMIN",
+      runtimeGeneration: RUNTIME_GENERATION,
+      workloadKeyHash: exchange.publicKeyHash,
+      machineId: exchange.workerId,
+      adminRuntimeGenerationId: claim.adminRuntimeGeneration.id,
+      adminRuntimeGenerationFence: claim.adminRuntimeGeneration.fence,
+    },
+    observe: () =>
+      readModelAuthMaterialization({
+        authStorePath: installed.rootAuthPath,
+        markerPath: installed.markerPath,
+      }),
+    authorize: (body) =>
+      signedWorkerAuthorization({
+        identity,
+        exchange,
+        verb: "model-health",
+        body,
+        now: new Date(),
+        unbound: true,
+      }),
+    onError: (error) => {
+      process.stderr.write(
+        `${JSON.stringify({
+          ok: false,
+          code:
+            error instanceof Error
+              ? error.message
+              : "model_health_report_failed",
+        })}\n`
+      );
+    },
+    allowHttpLoopback: process.env.SELLABLE_AGENT_ALLOW_TEST_OIDC === "1",
+    sequencePath: join(RUNTIME_ROOT, "model-health-sequence.json"),
+  });
+}
+
 function desiredLifecycleForClaim(claim) {
   switch (claim.operation.action) {
     case "INSTANTIATE":
@@ -1996,23 +2135,64 @@ export async function runAdminCanary() {
     atomicPrivateFile(join(sourceRoot, name), value);
   }
   const rootAuthPath = join(DATA_ROOT, "auth.json");
+  const modelMarkerPath = join(canaryRoot, "model-auth-source.json");
   const productConfigPath = join(SECRET_ROOT, "canary-product-config.json");
   rmSync(rootAuthPath, { force: true });
+  rmSync(modelMarkerPath, { force: true });
   rmSync(productConfigPath, { force: true });
-  const canaryModel = parseFlyCustomerModelCredential(
+  const canaryExpiresAt = new Date(Date.now() + 60 * 60 * 1000);
+  const canaryJwt = (subject) =>
+    [
+      Buffer.from(JSON.stringify({ alg: "none", typ: "JWT" })).toString(
+        "base64url"
+      ),
+      Buffer.from(
+        JSON.stringify({ sub: subject, exp: Math.floor(canaryExpiresAt / 1000) })
+      ).toString("base64url"),
+      "phase158-canary-signature-placeholder",
+    ].join(".");
+  const canaryModel = parseModelAuthRuntimeCredential(
     JSON.stringify({
-      OPENAI_API_KEY: null,
-      auth_mode: "chatgpt",
-      last_refresh: "2026-07-29T00:00:00.000Z",
-      tokens: {
-        access_token: "phase158-canary-oauth-access-token-placeholder",
-        account_id: "phase158-canary-account",
-        id_token: "phase158-canary-oauth-id-token-placeholder",
-        refresh_token: "phase158-canary-oauth-refresh-token-placeholder",
+      schemaVersion: "sellable-agent-model-auth-runtime/v2",
+      activationId: "phase158-canary-model-auth",
+      bundleGeneration: 1,
+      policyHash: "a".repeat(64),
+      credentialPoolStrategy: "fill_first",
+      codex: [
+        {
+          slotId: "dittto-primary",
+          priority: 1,
+          accessToken: canaryJwt("phase158-canary-dittto"),
+          accountId: "phase158-canary-dittto",
+          expiresAt: canaryExpiresAt.toISOString(),
+          grantFingerprint: "a".repeat(16),
+        },
+        {
+          slotId: "kaigo-secondary",
+          priority: 2,
+          accessToken: canaryJwt("phase158-canary-kaigo"),
+          accountId: "phase158-canary-kaigo",
+          expiresAt: canaryExpiresAt.toISOString(),
+          grantFingerprint: "b".repeat(16),
+        },
+      ],
+      openrouter: {
+        apiKey: "phase158-canary-openrouter-placeholder",
+        keyFingerprint: "c".repeat(16),
+        models: [
+          "moonshotai/kimi-k3",
+          "~deepseek/deepseek-v4-flash-latest",
+          "z-ai/glm-5.2",
+        ],
       },
     })
   );
-  atomicPrivateFile(rootAuthPath, canaryModel.hermesRootAuthJson);
+  const canaryModelAuthState = reconcileHermesModelAuth({
+    authStorePath: rootAuthPath,
+    markerPath: modelMarkerPath,
+    credential: canaryModel,
+    lifecycle: "ON",
+  });
   atomicPrivateFile(
     productConfigPath,
     `${JSON.stringify({
@@ -2199,6 +2379,7 @@ export async function runAdminCanary() {
     profileContract,
     settingsRoot,
     rootAuthPath,
+    modelConfig: modelAuthConfigOverlay(canaryModel),
     productConfigPath,
     soul: {
       bytes: soulBytes,
@@ -2207,7 +2388,16 @@ export async function runAdminCanary() {
     },
     agentServiceEnv: agentServiceEnvironment,
   });
-  const modelAuth = proveAdminModelAuth(profile);
+  const modelAuth = proveAdminModelAuth(
+    profile,
+    {
+      rootAuthPath,
+      markerPath: modelMarkerPath,
+      model: canaryModel,
+      modelAuthState: canaryModelAuthState,
+    },
+    "ON"
+  );
   const attachmentHandoff = proveAdminAttachmentHandoff(profile);
   const observedSettings = settingsProof(
     settingsRoot,
@@ -2357,6 +2547,7 @@ async function runAdminProduction() {
   const controller = new AbortController();
   let activeGateway = null;
   let activeLaunch = null;
+  let activeModelHealthReporter = null;
   let shutdownMemorySnapshot = null;
   const beginShutdownSnapshot = () => {
     if (!activeLaunch || shutdownMemorySnapshot) return;
@@ -2409,6 +2600,27 @@ async function runAdminProduction() {
         });
         exchange = renewed.exchange;
         client = renewed.client;
+        await activeModelHealthReporter?.stop();
+        activeModelHealthReporter = null;
+        if (activeLaunch) {
+          activeModelHealthReporter = adminModelHealthReporter({
+            identity,
+            exchange,
+            installed: activeLaunch.installed,
+            claim: activeLaunch.claim,
+          });
+          activeModelHealthReporter.start("periodic").catch((reportError) => {
+            process.stderr.write(
+              `${JSON.stringify({
+                ok: false,
+                code:
+                  reportError instanceof Error
+                    ? reportError.message
+                    : "model_health_report_failed",
+              })}\n`
+            );
+          });
+        }
         failures = 0;
         process.stderr.write(
           `${JSON.stringify({
@@ -2466,6 +2678,8 @@ async function runAdminProduction() {
         exchange,
         client,
       });
+      await activeModelHealthReporter?.stop();
+      activeModelHealthReporter = null;
       await stopNativeGateway(activeGateway);
       activeGateway = null;
       activeLaunch = null;
@@ -2561,13 +2775,18 @@ async function runAdminProduction() {
       const profile = await materializeAdminProfile({
         profileContract,
         settingsRoot: imported.receipt.generationRoot,
-        rootAuthPath: installed.rootAuthPath,
+        rootAuthPath: installed.profileAuthPath,
+        modelConfig: installed.modelConfig,
         productConfigPath: installed.productConfigPath,
         soul: exactSoul(claim),
         slack: nativeSlackProfileInput(claim, installed),
         agentServiceEnv: adminAgentServiceEnvironment(claim),
       });
-      const modelAuth = proveAdminModelAuth(profile);
+      const modelAuth = proveAdminModelAuth(
+        profile,
+        installed,
+        desiredLifecycle
+      );
       const memorySnapshot = await flushHermesSnapshot({
         client,
         profileId: profile.profile,
@@ -2608,7 +2827,7 @@ async function runAdminProduction() {
       });
       operationHeartbeat.assertHealthy();
       const candidateLaunch =
-        desiredLifecycle === "ON" ? { profile, claim } : null;
+        desiredLifecycle === "ON" ? { profile, claim, installed } : null;
       let candidateGateway = null;
       try {
         if (candidateLaunch) {
@@ -2631,6 +2850,27 @@ async function runAdminProduction() {
       if (desiredLifecycle === "ON" && !activeLaunch) {
         throw new Error("admin_native_gateway_completion_rejected");
       }
+      if (activeLaunch) {
+        activeModelHealthReporter = adminModelHealthReporter({
+          identity,
+          exchange,
+          installed: activeLaunch.installed,
+          claim: activeLaunch.claim,
+        });
+        try {
+          await activeModelHealthReporter.start("materialized");
+        } catch (error) {
+          process.stderr.write(
+            `${JSON.stringify({
+              ok: false,
+              code:
+                error instanceof Error
+                  ? error.message
+                  : "model_health_report_failed",
+            })}\n`
+          );
+        }
+      }
       await operationHeartbeat.stop();
       operationHeartbeat = null;
       failures = 0;
@@ -2663,6 +2903,7 @@ async function runAdminProduction() {
       })}\n`
     );
   }
+  await activeModelHealthReporter?.stop();
   await stopNativeGateway(activeGateway);
   clearRuntimeSecrets();
 }

package/lib/sellable-agent/fly-customer-image/Dockerfile

@@ -5,7 +5,7 @@ USER root
 
 ARG MCP_PACKAGE=@sellable/mcp@0.1.805
 ARG MCP_INTEGRITY=sha512-ULMGwWalb14SaMgxLeeiOWjavXpnONhdD8kAkvp7rJFdiL7s30VwXX+1j/aNwijiWXqqNQ1wcsXUPqk4eWpslg==
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.484
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.486-wip.phase169.20260804.2
 ARG TUS_JS_CLIENT_VERSION=4.3.1
 ARG HERMES_VERSION=0.20.0
 ARG MCP_TRUST_ROOT_B64
@@ -56,7 +56,7 @@ RUN test -n "${MCP_TRUST_ROOT_B64}" \
              /etc/cont-init.d/02-reconcile-profiles \
     && npm cache clean --force
 
-COPY mcp-context-proxy.mjs fly-customer-model.mjs fly-customer-worker.mjs profile-materializer.mjs hermes-bridge.mjs hermes-memory-snapshot.mjs fly-runtime-identity.mjs \
+COPY mcp-context-proxy.mjs fly-customer-model.mjs fly-customer-worker.mjs profile-materializer.mjs model-auth-reconciler.mjs model-health-reporter.mjs hermes-bridge.mjs hermes-memory-snapshot.mjs fly-runtime-identity.mjs \
   /usr/local/lib/sellable-agent/
 COPY hermes-memory-dirty.mjs /opt/sellable/bin/hermes-memory-dirty
 COPY hermes-memory-reconcile.sh /opt/sellable/share/hermes-memory-reconcile.sh