@sellable/install 0.1.484 → 0.1.486-wip.phase169.20260804.2

package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs

@@ -16,12 +16,13 @@ import {
 } from "node:fs";
 import { dirname, join } from "node:path";
 import {
-  FLY_CUSTOMER_MODEL_ID,
-  FLY_CUSTOMER_MODEL_PROVIDER,
-  FLY_CUSTOMER_MODEL_REASONING_EFFORT,
   evaluateModelAuthReadback,
-  parseFlyCustomerModelCredential,
-} from "../fly-customer-model.mjs";
+  modelAuthConfigOverlay,
+  parseModelAuthRuntimeCredential,
+  readModelAuthMaterialization,
+  reconcileHermesModelAuth,
+} from "../model-auth-reconciler.mjs";
+import { createModelHealthReporter } from "../model-health-reporter.mjs";
 import {
   buildNativeHermesLaunch,
   clearCustomerRuntimeSecrets,
@@ -37,6 +38,7 @@ import {
   loadOrCreateFlyRuntimeIdentity,
   obtainFlyOidcToken,
   renewFlyCustomerControlSession,
+  signedWorkerAuthorization,
 } from "../fly-runtime-identity.mjs";
 import {
   ensureHermesSnapshotCron,
@@ -48,7 +50,6 @@ import {
   materializeNativeSlackCustomerProfile,
   validateNativeSlackCustomerProfile,
 } from "../profile-materializer.mjs";
-import { reconcileHermesRootModelAuth } from "./model-auth-store.mjs";
 
 const DATA_ROOT = "/opt/data";
 const PROFILES_ROOT = join(DATA_ROOT, "profiles");
@@ -70,7 +71,7 @@ const RUNTIME_GENERATION = Number(
 const BOOT_SESSION_ID = randomUUID();
 const HERMES_VERSION = process.env.SELLABLE_AGENT_HERMES_VERSION ?? "0.20.0";
 const INSTALLER_PACKAGE =
-  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.484";
+  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.486-wip.phase169.20260804.2";
 const MCP_PACKAGE =
   process.env.SELLABLE_AGENT_MCP_PACKAGE ??
   "@sellable/mcp@0.1.805";
@@ -182,6 +183,22 @@ function compileDesired(claim, trustRootPem) {
   ) {
     throw new Error("customer_claim_contract_rejected");
   }
+  const modelEnvelope = claim.secretEnvelopes.modelCodex;
+  if (
+    model.provider !== "codex" ||
+    !/^[A-Za-z0-9_.:-]{1,256}$/.test(model.activationId ?? "") ||
+    !Number.isSafeInteger(model.bundleGeneration) ||
+    model.bundleGeneration < 1 ||
+    !/^[a-f0-9]{64}$/.test(model.policyHash ?? "") ||
+    !/^[a-f0-9]{16}$/.test(model.credentialFingerprint ?? "") ||
+    modelEnvelope.generation !== model.bundleGeneration ||
+    modelEnvelope.fingerprint !== model.credentialFingerprint ||
+    modelEnvelope.activationId !== model.activationId ||
+    modelEnvelope.bundleGeneration !== model.bundleGeneration ||
+    modelEnvelope.policyHash !== model.policyHash
+  ) {
+    throw new Error("customer_model_auth_identity_rejected");
+  }
   const routeGenerations = [
     ...new Set(selectedBindings.map((binding) => binding.routeGeneration)),
   ];
@@ -245,7 +262,10 @@ function compileDesired(claim, trustRootPem) {
       routeGeneration: routeGenerations[0],
       membershipGeneration: membershipGenerations[0],
       serviceCredentialGeneration: service.credentialGeneration,
-      modelCredentialGeneration: model.credentialGeneration,
+      modelCredentialGeneration: model.bundleGeneration,
+      modelActivationId: model.activationId,
+      modelBundleGeneration: model.bundleGeneration,
+      modelPolicyHash: model.policyHash,
       runtimeGeneration: RUNTIME_GENERATION,
       selectedChannelIds,
       defaultChannelId: defaultBinding.channelId,
@@ -456,15 +476,25 @@ function writeRuntimeHermesConfig({
   const testModelOrigin = allowTestProviders()
     ? process.env.SELLABLE_AGENT_TEST_MODEL_ORIGIN
     : null;
-  const modelCredential = parseFlyCustomerModelCredential(secrets.modelCodex);
-  const modelAuthPath = join(secretRoot, "auth.json");
-  atomicFile(modelAuthPath, modelCredential.authJson, 0o600);
-  const modelAuthState = reconcileHermesRootModelAuth({
+  const modelCredential = parseModelAuthRuntimeCredential(secrets.modelCodex);
+  if (
+    modelCredential.activationId !== desired.modelActivationId ||
+    modelCredential.bundleGeneration !== desired.modelBundleGeneration ||
+    modelCredential.policyHash !== desired.modelPolicyHash
+  ) {
+    throw new Error("customer_model_auth_identity_rejected");
+  }
+  const modelBundlePath = join(secretRoot, "model-auth-runtime-v2.json");
+  atomicFile(modelBundlePath, modelCredential.authJson, 0o600);
+  const modelLifecycle =
+    claim.operation.action === "INSTANTIATE" ? "OFF" : "ON";
+  const modelAuthState = reconcileHermesModelAuth({
     authStorePath: hermesRootAuthStorePath,
     markerPath: hermesRootAuthMarkerPath,
-    modelCredential,
-    generation: desired.modelCredentialGeneration,
+    credential: modelCredential,
+    lifecycle: modelLifecycle,
   });
+  const modelConfig = modelAuthConfigOverlay(modelCredential);
   atomicJson(runtimeConfigPath, {
     ...baseConfig,
     ...(testModelOrigin
@@ -487,12 +517,7 @@ function writeRuntimeHermesConfig({
           ],
         }
       : {
-          model: {
-            default: FLY_CUSTOMER_MODEL_ID,
-            provider: FLY_CUSTOMER_MODEL_PROVIDER,
-            reasoning_effort: FLY_CUSTOMER_MODEL_REASONING_EFFORT,
-            generation: desired.modelCredentialGeneration,
-          },
+          ...modelConfig,
         }),
     mcp_servers: {
       ...baseConfig.mcp_servers,
@@ -520,10 +545,10 @@ function writeRuntimeHermesConfig({
   });
   const gatesPath = join(secretRoot, "gates.json");
   atomicJson(gatesPath, {
-    lifecycle: "ON",
-    dispatch: "ENABLED",
-    route: "OPEN",
-    output: "OPEN",
+    lifecycle: modelLifecycle,
+    dispatch: modelLifecycle === "ON" ? "ENABLED" : "DISABLED",
+    route: modelLifecycle === "ON" ? "OPEN" : "CLOSED",
+    output: modelLifecycle === "ON" ? "OPEN" : "CLOSED",
   });
   atomicJson(join(runtimeConfigRoot, "runtime-identity.json"), {
     runtimeId: RUNTIME_ID,
@@ -536,16 +561,20 @@ function writeRuntimeHermesConfig({
     membershipGeneration: desired.membershipGeneration,
     serviceCredentialGeneration: desired.serviceCredentialGeneration,
     modelCredentialGeneration: desired.modelCredentialGeneration,
+    modelActivationId: desired.modelActivationId,
+    modelBundleGeneration: desired.modelBundleGeneration,
+    modelPolicyHash: desired.modelPolicyHash,
   });
   return {
     runtimeHome: runtimeConfigRoot,
     runtimeConfigPath,
     runtimeMcpPath,
     gatesPath,
-    modelAuthPath,
+    modelBundlePath,
     hermesRootAuthStorePath,
     hermesRootAuthMarkerPath,
     modelAuthSourceFingerprint: modelAuthState.sourceFingerprint,
+    modelAuthState,
     modelCredential,
   };
 }
@@ -585,7 +614,7 @@ function applicationRuntimeEnv({ desired, runtimeConfig, secrets }) {
     HERMES_HOME: DATA_ROOT,
     SELLABLE_HERMES_PROFILE_ID: desired.profileId,
     HERMES_CONFIG_PATH: runtimeConfig.runtimeConfigPath,
-    CODEX_HOME: dirname(runtimeConfig.modelAuthPath),
+    CODEX_HOME: dirname(runtimeConfig.modelBundlePath),
     SELLABLE_AGENT_RUNTIME: "1",
     SELLABLE_AGENT_RUNTIME_GATE_FILE: runtimeConfig.gatesPath,
     SLACK_HOME_CHANNEL: desired.defaultChannelId,
@@ -745,59 +774,100 @@ async function proveProvisionedApplication({
   profileDigest,
 }) {
   const runtimeEnv = applicationRuntimeEnv({ desired, runtimeConfig, secrets });
-  const [hermesVersion, mcpVersion, modelAuth] = await Promise.all([
+  const materializedModelAuth = runtimeConfig.modelAuthState.materialized;
+  const [hermesVersion, mcpVersion, hermesModelAuth] = await Promise.all([
     run(HERMES, ["--version"], { env: runtimeEnv, timeoutMs: 180_000 }),
     run(MCP, ["--version"], { env: runtimeEnv, timeoutMs: 180_000 }),
-    run(
-      HERMES_PYTHON,
-      [
-        "-c",
-        [
-          "import json",
-          "from pathlib import Path",
-          "from hermes_constants import get_default_hermes_root, get_hermes_home",
-          "from hermes_cli.auth import resolve_codex_runtime_credentials",
-          "value = resolve_codex_runtime_credentials(refresh_if_expiring=False)",
-          'root_auth = get_default_hermes_root() / "auth.json"',
-          'root_auth_marker = get_default_hermes_root() / ".sellable-agent" / "model-auth-source.json"',
-          'local_auth = get_hermes_home() / "auth.json"',
-          "marker = json.loads(root_auth_marker.read_text()) if root_auth_marker.is_file() else {}",
-          'print(json.dumps({"provider": value.get("provider"), "source": value.get("source"), "source_class": "root_fallback" if root_auth.is_file() and not local_auth.exists() else "unexpected", "auth_mode": value.get("auth_mode"), "credential_present": bool(value.get("api_key")), "local_auth_entry_count": 0 if not local_auth.exists() else 1, "source_fingerprint": marker.get("sourceFingerprint"), "credential_generation": marker.get("generation")}))',
-        ].join(";"),
-      ],
-      {
-        env: { ...runtimeEnv, HERMES_HOME: runtimeConfig.runtimeHome },
-        timeoutMs: 180_000,
-      }
-    ),
+    materializedModelAuth
+      ? run(
+          HERMES_PYTHON,
+          [
+            "-c",
+            [
+              "import json",
+              "from agent.credential_pool import load_pool",
+              'pool = load_pool("openai-codex")',
+              "entry = pool.select() if pool else None",
+              'print(json.dumps({"provider": "openai-codex", "source": "credential_pool", "credential_present": bool(entry and entry.runtime_api_key), "credential_id": getattr(entry, "id", None), "runtime_refresh_owned": bool(getattr(entry, "refresh_token", None))}))',
+            ].join(";"),
+          ],
+          {
+            env: { ...runtimeEnv, HERMES_HOME: runtimeConfig.runtimeHome },
+            timeoutMs: 180_000,
+          }
+        )
+      : Promise.resolve({
+          status: 0,
+          stdout: JSON.stringify({ materialization_pending_start: true }),
+          stderr: "",
+        }),
   ]);
-  let modelAuthReadback = null;
+  let hermesModelAuthReadback = null;
   try {
-    modelAuthReadback = JSON.parse(modelAuth.stdout);
+    hermesModelAuthReadback = JSON.parse(hermesModelAuth.stdout);
   } catch {
-    modelAuthReadback = null;
+    hermesModelAuthReadback = null;
   }
-  const modelAuthVerdict = evaluateModelAuthReadback(modelAuthReadback, {
-    sourceFingerprint: runtimeConfig.modelAuthSourceFingerprint,
-    generation: desired.modelCredentialGeneration,
-  });
-  if (modelAuth.status !== 0 || !modelAuthVerdict.accepted) {
-    // Name the failed invariant: a bare rejection sent the 2026-07-28 outage
-    // hunting the credential itself when the credential was valid and only its
-    // storage shape in the root auth store had changed.
+  const modelAuthReadback = materializedModelAuth
+    ? readModelAuthMaterialization({
+        authStorePath: runtimeConfig.hermesRootAuthStorePath,
+        markerPath: runtimeConfig.hermesRootAuthMarkerPath,
+      })
+    : {
+        schemaVersion: "sellable-agent-model-auth-readback/v2",
+        activationId: desired.modelActivationId,
+        bundleGeneration: desired.modelBundleGeneration,
+        policyHash: desired.modelPolicyHash,
+        provider: "openai-codex",
+        model: runtimeConfig.modelCredential.model,
+        fallbackDepth:
+          runtimeConfig.modelCredential.value.openrouter.models.length,
+        desiredStatus: "converged",
+        materializedStatus: "pending_start",
+        slots: runtimeConfig.modelCredential.identity.slots.map((slot) => ({
+          slotId: slot.slotId,
+          grantFingerprint: slot.grantFingerprint,
+          expiresAt: new Date(slot.expiresAt).toISOString(),
+          state: "ok",
+          lastErrorReason: null,
+          lastErrorResetAt: null,
+        })),
+        openrouter: {
+          keyFingerprint:
+            runtimeConfig.modelCredential.identity.openrouterKeyFingerprint,
+          state: "ok",
+        },
+      };
+  const modelAuthVerdict = materializedModelAuth
+    ? evaluateModelAuthReadback(modelAuthReadback, {
+        activationId: desired.modelActivationId,
+        bundleGeneration: desired.modelBundleGeneration,
+        policyHash: desired.modelPolicyHash,
+      })
+    : { accepted: true, rejection: null };
+  if (
+    materializedModelAuth &&
+    (hermesModelAuth.status !== 0 ||
+      hermesModelAuthReadback?.provider !== "openai-codex" ||
+      hermesModelAuthReadback?.source !== "credential_pool" ||
+      hermesModelAuthReadback?.credential_present !== true ||
+      hermesModelAuthReadback?.runtime_refresh_owned !== false ||
+      !["dittto-primary", "kaigo-secondary"].includes(
+        hermesModelAuthReadback?.credential_id
+      ))
+  ) {
+    throw new Error("access_only_snapshot_infeasible");
+  }
+  if (!modelAuthVerdict.accepted) {
     throw new Error(
-      `customer_model_auth_readback_rejected:${
-        modelAuth.status !== 0
-          ? "probe_failed"
-          : (modelAuthVerdict.rejection ?? "unknown")
-      }`
+      `customer_model_auth_readback_rejected:${modelAuthVerdict.rejection ?? "unknown"}`
     );
   }
   if (
     hermesVersion.status !== 0 ||
     mcpVersion.status !== 0 ||
     /Lazy-installing|pip install|npm install/i.test(
-      `${hermesVersion.stdout}\n${hermesVersion.stderr}\n${mcpVersion.stdout}\n${mcpVersion.stderr}\n${modelAuth.stdout}\n${modelAuth.stderr}`
+      `${hermesVersion.stdout}\n${hermesVersion.stderr}\n${mcpVersion.stdout}\n${mcpVersion.stderr}\n${hermesModelAuth.stdout}\n${hermesModelAuth.stderr}`
     )
   ) {
     throw new Error("customer_runtime_binary_rejected");
@@ -806,7 +876,10 @@ async function proveProvisionedApplication({
     profileDigest,
     hermesOutput: hermesVersion.stdout,
     mcpOutput: mcpVersion.stdout,
-    modelAuthOutput: modelAuth.stdout,
+    modelAuthOutput: `${hermesModelAuth.stdout}\n${JSON.stringify(
+      modelAuthReadback
+    )}`,
+    modelAuthReadback,
   };
 }
 
@@ -935,7 +1008,13 @@ function completionReceipt({
             { code: "NATIVE_SLACK_GATEWAY", status: "TRUE" },
           ]),
       { code: "MCP_PREBAKED", status: "TRUE" },
-      { code: "CODEX_OAUTH_READBACK", status: "TRUE" },
+      {
+        code:
+          claim.operation.action === "INSTANTIATE"
+            ? "MODEL_AUTH_DESIRED_PENDING_START"
+            : "CODEX_OAUTH_READBACK",
+        status: "TRUE",
+      },
       { code: "NO_BOOT_INSTALL", status: "TRUE" },
       { code: "DEDICATED_SLACK_APP", status: "TRUE" },
     ],
@@ -978,7 +1057,52 @@ async function flushHermesSnapshot({ client, profileId, profileRoot }) {
   }
 }
 
-async function processOperation({ claim, exchange, client }) {
+function runtimeModelHealthReporter({ identity, exchange, runtimeConfig }) {
+  return createModelHealthReporter({
+    origin: ORIGIN,
+    identity: {
+      kind: "CUSTOMER",
+      runtimeGeneration: RUNTIME_GENERATION,
+      workloadKeyHash: exchange.publicKeyHash,
+      machineId: exchange.workerId,
+      adminRuntimeGenerationId: null,
+      adminRuntimeGenerationFence: null,
+    },
+    observe: () =>
+      readModelAuthMaterialization({
+        authStorePath: runtimeConfig.hermesRootAuthStorePath,
+        markerPath: runtimeConfig.hermesRootAuthMarkerPath,
+      }),
+    authorize: (body) =>
+      signedWorkerAuthorization({
+        identity,
+        exchange,
+        verb: "model-health",
+        body,
+        now: new Date(),
+        unbound: true,
+      }),
+    onError: (error) => {
+      process.stderr.write(
+        `${JSON.stringify({
+          ok: false,
+          code:
+            error instanceof Error
+              ? error.message
+              : "model_health_report_failed",
+        })}\n`
+      );
+    },
+    allowHttpLoopback: allowTestProviders(),
+    sequencePath: join(
+      DATA_ROOT,
+      ".sellable-agent",
+      "model-health-sequence.json"
+    ),
+  });
+}
+
+async function processOperation({ claim, exchange, client, identity }) {
   const trustRootPem = readFileSync(TRUST_ROOT, "utf8");
   const { desired, toolInclude } = compileDesired(claim, trustRootPem);
   mkdirSync(PROFILES_ROOT, { recursive: true, mode: 0o700 });
@@ -1042,6 +1166,27 @@ async function processOperation({ claim, exchange, client }) {
   const completed = await client.complete(receipt);
   if (completed?.accepted !== true)
     throw new Error("customer_completion_rejected");
+  let modelHealthReporter = null;
+  if (claim.operation.action !== "INSTANTIATE") {
+    modelHealthReporter = runtimeModelHealthReporter({
+      identity,
+      exchange,
+      runtimeConfig,
+    });
+    try {
+      await modelHealthReporter.start("materialized");
+    } catch (error) {
+      process.stderr.write(
+        `${JSON.stringify({
+          ok: false,
+          code:
+            error instanceof Error
+              ? error.message
+              : "model_health_report_failed",
+        })}\n`
+      );
+    }
+  }
   atomicJson(join(DATA_ROOT, "sellable-agent-runtime-proof.json"), {
     ok: true,
     runtimeId: RUNTIME_ID,
@@ -1052,6 +1197,7 @@ async function processOperation({ claim, exchange, client }) {
     revisionId: desired.revisionId,
     observedLifecycle: receipt.observedLifecycle,
     profileDigest: proof.profileDigest,
+    modelAuth: proof.modelAuthReadback,
     runtimeUid: process.getuid?.() ?? null,
     runtimeGid: process.getgid?.() ?? null,
     profileMode: (lstatSync(profileRoot).mode & 0o777)
@@ -1078,6 +1224,7 @@ async function processOperation({ claim, exchange, client }) {
     trustRootPem,
     action: claim.operation.action,
     gateway: proof.gateway ?? null,
+    modelHealthReporter,
   };
 }
 
@@ -1220,8 +1367,14 @@ async function main() {
         exchange,
         client,
       });
+      await activeRuntime?.modelHealthReporter?.stop();
       await stopNativeGateway(activeRuntime?.gateway);
-      activeRuntime = await processOperation({ claim, exchange, client });
+      activeRuntime = await processOperation({
+        claim,
+        exchange,
+        client,
+        identity,
+      });
       operationHeartbeat.assertHealthy();
       await operationHeartbeat.stop();
       operationHeartbeat = null;
@@ -1256,6 +1409,7 @@ async function main() {
     );
   }
   await stopNativeGateway(activeRuntime?.gateway);
+  await activeRuntime?.modelHealthReporter?.stop();
   if (activeRuntime?.desired.profileId) {
     clearCustomerRuntimeSecrets({
       secretsRoot: SECRET_ROOT,

package/lib/sellable-agent/fly-customer-image/model-auth-store.mjs

@@ -1,143 +1,6 @@
-import { createHash, randomUUID } from "node:crypto";
-import {
-  chmodSync,
-  existsSync,
-  lstatSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  writeFileSync,
-} from "node:fs";
-import { dirname } from "node:path";
-
-const MARKER_VERSION = 1;
-const MARKER_KEYS = ["generation", "sourceFingerprint", "version"];
-
-const sha256 = (value) => createHash("sha256").update(value).digest("hex");
-
-function assertRegularFileOrMissing(path) {
-  if (!existsSync(path)) return;
-  const entry = lstatSync(path);
-  if (entry.isSymbolicLink() || !entry.isFile()) {
-    throw new Error("customer_model_auth_store_rejected");
-  }
-}
-
-function atomicPrivateFile(path, bytes) {
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
-  writeFileSync(temporary, bytes, { flag: "wx", mode: 0o600 });
-  chmodSync(temporary, 0o600);
-  renameSync(temporary, path);
-  chmodSync(path, 0o600);
-}
-
-function readMarker(path) {
-  assertRegularFileOrMissing(path);
-  if (!existsSync(path)) return null;
-  try {
-    const marker = JSON.parse(readFileSync(path, "utf8"));
-    if (
-      !marker ||
-      typeof marker !== "object" ||
-      Array.isArray(marker) ||
-      Object.keys(marker).sort().join("\0") !==
-        [...MARKER_KEYS].sort().join("\0") ||
-      marker.version !== MARKER_VERSION ||
-      !Number.isSafeInteger(marker.generation) ||
-      marker.generation < 1 ||
-      !/^[a-f0-9]{16}$/.test(marker.sourceFingerprint)
-    ) {
-      return null;
-    }
-    return marker;
-  } catch {
-    return null;
-  }
-}
-
-function usableHermesRootAuth(path) {
-  if (!existsSync(path)) return false;
-  try {
-    const value = JSON.parse(readFileSync(path, "utf8"));
-    const provider = value?.providers?.["openai-codex"];
-    const pool = value?.credential_pool?.["openai-codex"];
-    return Boolean(
-      value?.active_provider === "openai-codex" &&
-        provider?.auth_mode === "chatgpt" &&
-        provider.tokens &&
-        ["id_token", "access_token", "refresh_token", "account_id"].every(
-          (key) =>
-            typeof provider.tokens[key] === "string" &&
-            provider.tokens[key].length > 0
-        ) &&
-        Array.isArray(pool) &&
-        pool.length > 0
-    );
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Reconcile Hermes' persistent root auth store with the sealed control-plane
- * credential without undoing a later in-place OAuth refresh.
- *
- * The marker is written only after the matching auth store is durable. A
- * missing or mismatched marker therefore means the root store must be reseeded,
- * even when runtime-identity.json already records the new generation after an
- * interrupted or overlapping reconciliation.
- */
-export function reconcileHermesRootModelAuth({
-  authStorePath,
-  markerPath,
-  modelCredential,
-  generation,
-}) {
-  if (
-    typeof authStorePath !== "string" ||
-    !authStorePath ||
-    typeof markerPath !== "string" ||
-    !markerPath ||
-    !Number.isSafeInteger(generation) ||
-    generation < 1 ||
-    !modelCredential ||
-    typeof modelCredential.authJson !== "string" ||
-    typeof modelCredential.hermesRootAuthJson !== "string"
-  ) {
-    throw new Error("customer_model_auth_store_rejected");
-  }
-
-  assertRegularFileOrMissing(authStorePath);
-  const sourceFingerprint = sha256(modelCredential.authJson).slice(0, 16);
-  const priorMarker = readMarker(markerPath);
-  const markerMatches =
-    priorMarker?.generation === generation &&
-    priorMarker.sourceFingerprint === sourceFingerprint;
-  const authStoreUsable = usableHermesRootAuth(authStorePath);
-
-  if (!markerMatches || !authStoreUsable) {
-    atomicPrivateFile(authStorePath, modelCredential.hermesRootAuthJson);
-    atomicPrivateFile(
-      markerPath,
-      `${JSON.stringify(
-        {
-          version: MARKER_VERSION,
-          generation,
-          sourceFingerprint,
-        },
-        null,
-        2
-      )}\n`
-    );
-  } else {
-    chmodSync(authStorePath, 0o600);
-    chmodSync(markerPath, 0o600);
-  }
-
-  return Object.freeze({
-    sourceFingerprint,
-    generation,
-    reseeded: !markerMatches || !authStoreUsable,
-  });
-}
+// Compatibility-only export. Runtime behavior lives in the neutral module
+// copied byte-for-byte into both CUSTOMER and ADMIN image contexts.
+export {
+  reconcileHermesModelAuth,
+  reconcileHermesModelAuth as reconcileHermesRootModelAuth,
+} from "../model-auth-reconciler.mjs";