@sellable/install 0.1.651 → 0.1.653-wip.phase189.20260814.1

package/container/Dockerfile

@@ -3,12 +3,12 @@ FROM ${HERMES_IMAGE}
 
 USER root
 
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.651
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.653-wip.phase189.20260814.1
 ARG MCP_PACKAGE=@sellable/mcp@0.1.880
 ARG INSTALLER_INTEGRITY
 ARG MCP_INTEGRITY=sha512-+Fo8aQlYduLaQMQff+ZA25LeUhWZ7I7UH5DECpND84LQ+rHSjKeKFj4Zs93bVHXwQCIy2OLbr75y4f4+CyT57w==
 
-RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.651" \
+RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.653-wip.phase189.20260814.1" \
     && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.880" \
     && test -n "${INSTALLER_INTEGRITY}" \
     && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
@@ -23,9 +23,9 @@ RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.651" \
     && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
     && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
     && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
-    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.651' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.880') throw new Error('package identity rejected');" \
+    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.653-wip.phase189.20260814.1' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.880') throw new Error('package identity rejected');" \
     && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
-    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.651', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.880', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
+    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.653-wip.phase189.20260814.1', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.880', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
     && npm cache clean --force
 
 COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint

package/container/README.md

@@ -3,7 +3,7 @@
 This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
 
 Build from this directory after
-`@sellable/install@0.1.651` is
+`@sellable/install@0.1.653-wip.phase189.20260814.1` is
 published:
 
 ```sh

package/lib/sellable-agent/admin-native-gateway-supervisor.mjs

@@ -0,0 +1,24 @@
+export const ADMIN_NATIVE_GATEWAY_MAX_LOCAL_RESTARTS = 3;
+
+export function nativeGatewayRunning(gateway) {
+  const child = gateway?.child;
+  return Boolean(
+    child &&
+      child.exitCode === null &&
+      child.signalCode === null &&
+      child.killed !== true
+  );
+}
+
+export function nextAdminNativeGatewayRecovery({ attempts }) {
+  const completedAttempts = Number.isInteger(attempts)
+    ? Math.max(0, attempts)
+    : 0;
+  if (completedAttempts >= ADMIN_NATIVE_GATEWAY_MAX_LOCAL_RESTARTS) {
+    return {
+      action: "EXHAUSTED",
+      attempt: ADMIN_NATIVE_GATEWAY_MAX_LOCAL_RESTARTS,
+    };
+  }
+  return { action: "RESTART", attempt: completedAttempts + 1 };
+}

package/lib/sellable-agent/fly-admin-image/Dockerfile

@@ -148,8 +148,10 @@ RUN --mount=type=secret,id=mcp_trust_root,required=true \
     test "$(sha256sum /usr/local/share/sellable-agent/mcp-turn-trust-root.pem | cut -d ' ' -f 1)" = "${MCP_TRUST_ROOT_FINGERPRINT}"
 
 COPY fly-admin-image/admin-runtime.mjs /usr/local/lib/sellable-agent/admin-runtime/admin-runtime.mjs
+COPY fly-admin-image/admin-runtime-phase-telemetry.mjs /usr/local/lib/sellable-agent/admin-runtime/admin-runtime-phase-telemetry.mjs
 COPY fly-admin-image/admin-state-generation.mjs /usr/local/lib/sellable-agent/admin-runtime/admin-state-generation.mjs
 COPY fly-admin-image/start-admin-runtime /usr/local/lib/sellable-agent/admin-runtime/start-admin-runtime
+COPY admin-native-gateway-supervisor.mjs /usr/local/lib/sellable-agent/admin-native-gateway-supervisor.mjs
 COPY abandoned-runtime-scratch.mjs /usr/local/lib/sellable-agent/abandoned-runtime-scratch.mjs
 COPY mcp-context-proxy.mjs /usr/local/lib/sellable-agent/mcp-context-proxy.mjs
 COPY mcp-runtime-binding.mjs /usr/local/lib/sellable-agent/mcp-runtime-binding.mjs
@@ -237,6 +239,7 @@ RUN set -eux; \
       /usr/local/lib/sellable-agent/admin-runtime/admin-runtime.mjs \
       /usr/local/lib/sellable-agent/admin-runtime/admin-state-generation.mjs \
       /usr/local/lib/sellable-agent/admin-runtime/start-admin-runtime \
+      /usr/local/lib/sellable-agent/admin-native-gateway-supervisor.mjs \
       /usr/local/lib/sellable-agent/abandoned-runtime-scratch.mjs \
       /usr/local/lib/sellable-agent/mcp-context-proxy.mjs \
       /usr/local/lib/sellable-agent/mcp-runtime-binding.mjs \

package/lib/sellable-agent/fly-admin-image/admin-runtime-phase-telemetry.mjs

@@ -0,0 +1,80 @@
+const ADMIN_RUNTIME_PHASES = new Set([
+  "runtime_secrets",
+  "snapshot_restore",
+  "profile_settings_delivery",
+  "profile_stage",
+  "profile_live_merge_promote",
+  "profile_crons",
+  "default_profile_bundle",
+  "memory_snapshot",
+  "slack_serving_proof",
+  "native_gateway",
+  "serving_observation",
+  "operation_completion",
+]);
+
+function phaseFailureCode(error) {
+  const code = error instanceof Error ? error.message : "";
+  return /^[A-Za-z0-9_:-]{1,160}$/.test(code)
+    ? code
+    : "admin_runtime_phase_failed";
+}
+
+export function createAdminRuntimePhaseTelemetry({
+  bootSessionId,
+  operationId,
+  now = () => Date.now(),
+  write = (entry) => process.stderr.write(`${JSON.stringify(entry)}\n`),
+}) {
+  if (
+    typeof bootSessionId !== "string" ||
+    bootSessionId.length < 1 ||
+    typeof operationId !== "string" ||
+    operationId.length < 1
+  ) {
+    throw new Error("admin_runtime_phase_identity_rejected");
+  }
+
+  const run = async (phase, work) => {
+    if (!ADMIN_RUNTIME_PHASES.has(phase) || typeof work !== "function") {
+      throw new Error("admin_runtime_phase_rejected");
+    }
+    const startedAt = now();
+    write({
+      ok: true,
+      code: "admin_runtime_phase",
+      phase,
+      status: "started",
+      elapsedMs: 0,
+      bootSessionId,
+      operationId,
+    });
+    try {
+      const result = await work();
+      write({
+        ok: true,
+        code: "admin_runtime_phase",
+        phase,
+        status: "completed",
+        elapsedMs: Math.max(0, now() - startedAt),
+        bootSessionId,
+        operationId,
+      });
+      return result;
+    } catch (error) {
+      write({
+        ok: false,
+        code: "admin_runtime_phase",
+        phase,
+        status: "failed",
+        elapsedMs: Math.max(0, now() - startedAt),
+        bootSessionId,
+        operationId,
+        errorCode: phaseFailureCode(error),
+      });
+      throw error;
+    }
+  };
+
+  return { run };
+}

package/lib/sellable-agent/fly-admin-image/admin-runtime.mjs

@@ -28,6 +28,7 @@ import { createRequire } from "node:module";
 import { basename, dirname, join } from "node:path";
 import { createInterface } from "node:readline";
 
+import { pruneAbandonedRuntimeScratch } from "../abandoned-runtime-scratch.mjs";
 import {
   buildAdminSettingsManifest,
   encodeAdminSettingsBundle,
@@ -45,6 +46,15 @@ import {
   isOperationBoundBackupClaim,
 } from "../admin-artifact/node_modules/@sellable/install/lib/sellable-agent/fly-customer-worker.mjs";
 import sodium from "../admin-artifact/node_modules/libsodium-wrappers/dist/modules-esm/libsodium-wrappers.mjs";
+import {
+  nativeGatewayRunning,
+  nextAdminNativeGatewayRecovery,
+} from "../admin-native-gateway-supervisor.mjs";
+import {
+  bindDefaultProfileProbeCron,
+  buildDefaultProfileProjection,
+  reconcileDefaultProfileBundle,
+} from "../default-profile-reconciler.mjs";
 import {
   SELLABLE_BROWSER_TOOLSET_DEFAULT_MARKER,
   sellableSlackToolsetsForMaterialization,
@@ -63,18 +73,13 @@ import {
   renewFlyAdminControlSession,
   signedWorkerAuthorization,
 } from "../fly-runtime-identity.mjs";
+import { proveDefaultProfileNativeSkills } from "../fly-skills-bridge.mjs";
 import {
   executeExternalSoulBridgeOperation,
   observeProfileSoul,
   prepareSoulLockRoot,
   withProfileSoulLock,
 } from "../fly-soul-bridge.mjs";
-import { proveDefaultProfileNativeSkills } from "../fly-skills-bridge.mjs";
-import {
-  bindDefaultProfileProbeCron,
-  buildDefaultProfileProjection,
-  reconcileDefaultProfileBundle,
-} from "../default-profile-reconciler.mjs";
 import {
   HERMES_SNAPSHOT_HOOKS,
   HERMES_SNAPSHOT_HOOK_ALLOWLIST_BYTES,
@@ -98,12 +103,12 @@ import {
   reconcileHermesModelAuth,
 } from "../model-auth-reconciler.mjs";
 import { createModelHealthReporter } from "../model-health-reporter.mjs";
+import { createAdminRuntimePhaseTelemetry } from "./admin-runtime-phase-telemetry.mjs";
 import {
   completeAdminStateReceiptRecovery,
   prepareAdminStateGeneration,
   recoverAdminStateReceiptMismatch,
 } from "./admin-state-generation.mjs";
-import { pruneAbandonedRuntimeScratch } from "../abandoned-runtime-scratch.mjs";
 
 export const ADMIN_RUNTIME_SETTINGS_DIRECTORY =
   "/run/sellable-agent/admin-settings";
@@ -268,7 +273,10 @@ function adminMaterializerReceipt(profileId, profileRoot) {
     fileHashes: Object.fromEntries(
       paths
         .filter((relative) => existsSync(join(profileRoot, relative)))
-        .map((relative) => [relative, sha256(readFileSync(join(profileRoot, relative)))])
+        .map((relative) => [
+          relative,
+          sha256(readFileSync(join(profileRoot, relative))),
+        ])
     ),
   };
 }
@@ -997,6 +1005,7 @@ async function materializeAdminProfile({
   soul,
   slack = null,
   agentServiceEnv = {},
+  runPhase = async (_phase, work) => work(),
 }) {
   const profileHome = profileContract.profileHome;
   const profile = basename(profileHome);
@@ -1023,91 +1032,99 @@ async function materializeAdminProfile({
   const layout = adminHomeLayout(profileHome);
   // stageAdminProfile canonicalizes these two paths before staging, so the
   // Admin home working copies must exist before the factory runs.
-  deliverAdminSettings(settingsRoot, layout);
+  await runPhase("profile_settings_delivery", async () => {
+    deliverAdminSettings(settingsRoot, layout);
+  });
   const serverProofs = {};
-  const stageWithAuthority = async (stagedAuthority) => {
-    const stage = await stageAdminProfile({
-      mode: slack ? "direct_soul_native_slack" : "direct_soul",
-      lifecycleAuthorized: slack ? true : undefined,
-      ephemeralProductConfig: Boolean(slack),
-      ephemeralSlackSecrets: Boolean(slack),
-      profile,
-      profilesRoot: PROFILES_ROOT,
-      stageRoot,
-      finalProfileRoot: profileHome,
-      rootAuthPath,
-      canonicalAdminConfigPath: layout.configPath,
-      canonicalAdminStatePath: layout.statePath,
-      productConfigPath,
-      model: "gpt-5.6-sol",
-      reasoningEffort: "high",
-      soul: stagedAuthority,
-      ...(slack
-        ? {
-            slackSecretFile: slack.secretFile,
-            teamId: slack.teamId,
-            primaryChannel: slack.primaryChannel,
-            secondaryReadChannelIds: slack.secondaryReadChannelIds,
-            allowedSlackUserIds: slack.allowedSlackUserIds,
-            slackApp: slack.slackApp,
+  const stageWithAuthority = async (stagedAuthority) =>
+    runPhase("profile_stage", async () => {
+      const stage = await stageAdminProfile({
+        mode: slack ? "direct_soul_native_slack" : "direct_soul",
+        lifecycleAuthorized: slack ? true : undefined,
+        ephemeralProductConfig: Boolean(slack),
+        ephemeralSlackSecrets: Boolean(slack),
+        profile,
+        profilesRoot: PROFILES_ROOT,
+        stageRoot,
+        finalProfileRoot: profileHome,
+        rootAuthPath,
+        canonicalAdminConfigPath: layout.configPath,
+        canonicalAdminStatePath: layout.statePath,
+        productConfigPath,
+        model: "gpt-5.6-sol",
+        reasoningEffort: "high",
+        soul: stagedAuthority,
+        ...(slack
+          ? {
+              slackSecretFile: slack.secretFile,
+              teamId: slack.teamId,
+              primaryChannel: slack.primaryChannel,
+              secondaryReadChannelIds: slack.secondaryReadChannelIds,
+              allowedSlackUserIds: slack.allowedSlackUserIds,
+              slackApp: slack.slackApp,
+            }
+          : {}),
+        skillsRoot: join(ADMIN_INSTALL_ASSET_ROOT, "mcp", "skills"),
+        installRoot: layout.adminRoot,
+        adminHome: layout.adminHome,
+        installAdmin: async () =>
+          profilePackageReceipt(
+            profileContract,
+            "sellable-admin",
+            "mcp",
+            layout
+          ),
+        installProduct: async () =>
+          profilePackageReceipt(
+            profileContract,
+            "sellable",
+            "mcp",
+            layout,
+            agentServiceEnv
+          ),
+        verifyMcp: async ({ kind, profileRoot, config }) => {
+          const alias = kind === "admin" ? "sellable-admin" : "sellable";
+          const server = config.mcp_servers[alias];
+          const inventoryProof =
+            alias === "sellable" ? productMcpInventoryProofEnvironment() : null;
+          let proof;
+          try {
+            proof = await inspectMcp({
+              alias,
+              command: server.command,
+              args: server.args,
+              env: {
+                HOME: profileRoot,
+                HERMES_HOME: profileRoot,
+                ...adminToolEnv(layout),
+                ...agentServiceEnv,
+                SELLABLE_CONFIG_PATH: productConfigPath,
+                ...(server.env ?? {}),
+                ...(inventoryProof?.env ?? {}),
+              },
+              packageProof: profileContract.packages[alias].mcp,
+            });
+          } finally {
+            if (inventoryProof) {
+              rmSync(inventoryProof.root, { recursive: true, force: true });
+            }
           }
-        : {}),
-      skillsRoot: join(ADMIN_INSTALL_ASSET_ROOT, "mcp", "skills"),
-      installRoot: layout.adminRoot,
-      adminHome: layout.adminHome,
-      installAdmin: async () =>
-        profilePackageReceipt(profileContract, "sellable-admin", "mcp", layout),
-      installProduct: async () =>
-        profilePackageReceipt(
-          profileContract,
-          "sellable",
-          "mcp",
-          layout,
-          agentServiceEnv
-        ),
-      verifyMcp: async ({ kind, profileRoot, config }) => {
-        const alias = kind === "admin" ? "sellable-admin" : "sellable";
-        const server = config.mcp_servers[alias];
-        const inventoryProof =
-          alias === "sellable" ? productMcpInventoryProofEnvironment() : null;
-        let proof;
-        try {
-          proof = await inspectMcp({
-            alias,
-            command: server.command,
-            args: server.args,
-            env: {
-              HOME: profileRoot,
-              HERMES_HOME: profileRoot,
-              ...adminToolEnv(layout),
-              ...agentServiceEnv,
-              SELLABLE_CONFIG_PATH: productConfigPath,
-              ...(server.env ?? {}),
-              ...(inventoryProof?.env ?? {}),
-            },
-            packageProof: profileContract.packages[alias].mcp,
-          });
-        } finally {
-          if (inventoryProof) {
-            rmSync(inventoryProof.root, { recursive: true, force: true });
+          if (
+            JSON.stringify(proof.tools) !==
+            JSON.stringify(profileContract.tools[alias])
+          ) {
+            throw new Error("admin_runtime_tool_inventory_mismatch");
           }
-        }
-        if (
-          JSON.stringify(proof.tools) !==
-          JSON.stringify(profileContract.tools[alias])
-        ) {
-          throw new Error("admin_runtime_tool_inventory_mismatch");
-        }
-        serverProofs[alias] = proof;
-        return { ok: true, ...proof };
-      },
+          serverProofs[alias] = proof;
+          return { ok: true, ...proof };
+        },
+      });
+      if (slack) installWritableAdminSlackChannelPolicy(stageRoot, slack);
+      installAdminModelConfig(stageRoot, modelConfig);
+      installAdminHermesMemoryHook(stageRoot);
+      stageAdminRuntimeTree(stageRoot);
+      return stage;
     });
-    if (slack) installWritableAdminSlackChannelPolicy(stageRoot, slack);
-    installAdminModelConfig(stageRoot, modelConfig);
-    installAdminHermesMemoryHook(stageRoot);
-    stageAdminRuntimeTree(stageRoot);
-    return stage;
-  };
 
   let stagedAuthority = withProfileSoulLock(profile, readAuthoritativeSoul, {
     dataRoot: DATA_ROOT,
@@ -1116,79 +1133,83 @@ async function materializeAdminProfile({
   let promoted = null;
   for (let attempt = 0; attempt < 2 && !promoted; attempt += 1) {
     stage = await stageWithAuthority(stagedAuthority);
-    const committed = await withProfileSoulLock(
-      profile,
-      async () => {
-        const finalAuthority = readAuthoritativeSoul();
-        if (
-          finalAuthority.sha256 !== stagedAuthority.sha256 ||
-          !finalAuthority.bytes.equals(stagedAuthority.bytes)
-        ) {
-          rmSync(stageRoot, { recursive: true, force: true });
-          return { status: "RESTAGE", stagedAuthority: finalAuthority };
-        }
-        const liveSkillsIdentity = adminPreservedSkillsIdentity(profileHome);
-        if (liveSkillsIdentity !== null) {
-          replaceHermesState(
-            join(profileHome, "skills"),
-            join(stageRoot, "skills"),
-            {
-              preserveTargetTopLevelNames: [...ADMIN_SEALED_SKILL_DIRECTORIES],
-            }
-          );
-        }
-        mergeHermesState(profileHome, stageRoot, {
-          skipSourceTopLevelNames:
-            liveSkillsIdentity === null ? [] : ["skills"],
-        });
-        mergeAdminLiveSkillsConfig(profileHome, stageRoot);
-        installAdminBrowserToolsetDefault(profileHome, stageRoot);
-        if (
-          liveSkillsIdentity !== null &&
-          adminPreservedSkillsIdentity(stageRoot) !== liveSkillsIdentity
-        ) {
-          rmSync(stageRoot, { recursive: true, force: true });
-          return { status: "RESTAGE", stagedAuthority: finalAuthority };
-        }
-        const stagedSoulPath = join(stageRoot, "SOUL.md");
-        const stagedSoul = lstatSync(stagedSoulPath);
-        const stagedSoulBytes = readFileSync(stagedSoulPath);
-        if (
-          stagedSoul.isSymbolicLink() ||
-          !stagedSoul.isFile() ||
-          !stagedSoulBytes.equals(finalAuthority.bytes)
-        ) {
-          throw new Error("admin_runtime_staged_soul_rejected");
-        }
-        const promotion = await promoteAdminProfileAtomically({
-          profile,
-          currentRoot: profileHome,
-          stagedRoot: stageRoot,
-          backupRoot,
-        });
-        const finalSoulPath = join(profileHome, "SOUL.md");
-        const finalSoul = lstatSync(finalSoulPath);
-        const finalSoulBytes = readFileSync(finalSoulPath);
-        if (
-          finalSoul.isSymbolicLink() ||
-          !finalSoul.isFile() ||
-          finalSoul.uid !== (process.getuid?.() ?? finalSoul.uid) ||
-          finalSoul.gid !== (process.getgid?.() ?? finalSoul.gid) ||
-          !finalSoulBytes.equals(finalAuthority.bytes)
-        ) {
-          throw new Error("admin_runtime_live_soul_readback_rejected");
-        }
-        chmodSync(finalSoulPath, 0o600);
-        if ((lstatSync(finalSoulPath).mode & 0o777) !== 0o600) {
-          throw new Error("admin_runtime_live_soul_mode_rejected");
-        }
-        return {
-          status: "PROMOTED",
-          promotion,
-          observedSoulRawSha256: sha256(finalSoulBytes),
-        };
-      },
-      { dataRoot: DATA_ROOT }
+    const committed = await runPhase("profile_live_merge_promote", async () =>
+      withProfileSoulLock(
+        profile,
+        async () => {
+          const finalAuthority = readAuthoritativeSoul();
+          if (
+            finalAuthority.sha256 !== stagedAuthority.sha256 ||
+            !finalAuthority.bytes.equals(stagedAuthority.bytes)
+          ) {
+            rmSync(stageRoot, { recursive: true, force: true });
+            return { status: "RESTAGE", stagedAuthority: finalAuthority };
+          }
+          const liveSkillsIdentity = adminPreservedSkillsIdentity(profileHome);
+          if (liveSkillsIdentity !== null) {
+            replaceHermesState(
+              join(profileHome, "skills"),
+              join(stageRoot, "skills"),
+              {
+                preserveTargetTopLevelNames: [
+                  ...ADMIN_SEALED_SKILL_DIRECTORIES,
+                ],
+              }
+            );
+          }
+          mergeHermesState(profileHome, stageRoot, {
+            skipSourceTopLevelNames:
+              liveSkillsIdentity === null ? [] : ["skills"],
+          });
+          mergeAdminLiveSkillsConfig(profileHome, stageRoot);
+          installAdminBrowserToolsetDefault(profileHome, stageRoot);
+          if (
+            liveSkillsIdentity !== null &&
+            adminPreservedSkillsIdentity(stageRoot) !== liveSkillsIdentity
+          ) {
+            rmSync(stageRoot, { recursive: true, force: true });
+            return { status: "RESTAGE", stagedAuthority: finalAuthority };
+          }
+          const stagedSoulPath = join(stageRoot, "SOUL.md");
+          const stagedSoul = lstatSync(stagedSoulPath);
+          const stagedSoulBytes = readFileSync(stagedSoulPath);
+          if (
+            stagedSoul.isSymbolicLink() ||
+            !stagedSoul.isFile() ||
+            !stagedSoulBytes.equals(finalAuthority.bytes)
+          ) {
+            throw new Error("admin_runtime_staged_soul_rejected");
+          }
+          const promotion = await promoteAdminProfileAtomically({
+            profile,
+            currentRoot: profileHome,
+            stagedRoot: stageRoot,
+            backupRoot,
+          });
+          const finalSoulPath = join(profileHome, "SOUL.md");
+          const finalSoul = lstatSync(finalSoulPath);
+          const finalSoulBytes = readFileSync(finalSoulPath);
+          if (
+            finalSoul.isSymbolicLink() ||
+            !finalSoul.isFile() ||
+            finalSoul.uid !== (process.getuid?.() ?? finalSoul.uid) ||
+            finalSoul.gid !== (process.getgid?.() ?? finalSoul.gid) ||
+            !finalSoulBytes.equals(finalAuthority.bytes)
+          ) {
+            throw new Error("admin_runtime_live_soul_readback_rejected");
+          }
+          chmodSync(finalSoulPath, 0o600);
+          if ((lstatSync(finalSoulPath).mode & 0o777) !== 0o600) {
+            throw new Error("admin_runtime_live_soul_mode_rejected");
+          }
+          return {
+            status: "PROMOTED",
+            promotion,
+            observedSoulRawSha256: sha256(finalSoulBytes),
+          };
+        },
+        { dataRoot: DATA_ROOT }
+      )
     );
     if (committed.status === "PROMOTED") {
       promoted = committed;
@@ -1201,20 +1222,27 @@ async function materializeAdminProfile({
   }
   // The installer bakes absolute paths into every generated wrapper, so bin/
   // is generated once the promoted Admin home is at its final path.
-  const adminHome = installAdminHome({ settingsRoot, layout });
-  const memoryCron = await ensureHermesSnapshotCron({
-    profileId: profile,
-    profileRoot: profileHome,
-    hermesRoot: DATA_ROOT,
-    hermesCli: HERMES,
-  });
-  if (!memoryCron.ok) throw new Error(memoryCron.code);
-  const opportunitySequencesCron = await ensureHermesOpportunitySequencesCron({
-    profileId: profile,
-    profileRoot: profileHome,
-    hermesRoot: DATA_ROOT,
-    statePath: layout.statePath,
-  });
+  const { adminHome, memoryCron, opportunitySequencesCron } = await runPhase(
+    "profile_crons",
+    async () => {
+      const adminHome = installAdminHome({ settingsRoot, layout });
+      const memoryCron = await ensureHermesSnapshotCron({
+        profileId: profile,
+        profileRoot: profileHome,
+        hermesRoot: DATA_ROOT,
+        hermesCli: HERMES,
+      });
+      if (!memoryCron.ok) throw new Error(memoryCron.code);
+      const opportunitySequencesCron =
+        await ensureHermesOpportunitySequencesCron({
+          profileId: profile,
+          profileRoot: profileHome,
+          hermesRoot: DATA_ROOT,
+          statePath: layout.statePath,
+        });
+      return { adminHome, memoryCron, opportunitySequencesCron };
+    }
+  );
   return {
     stage,
     promotion: promoted.promotion,
@@ -1453,8 +1481,7 @@ function operationSnapshotIdentity(claim, exchange) {
 function adminServingObservation(activeLaunch, activeGateway, exchange) {
   try {
     const authority = activeLaunch?.claim?.runtimeAuthority;
-    const running =
-      activeGateway?.child?.exitCode === null && !activeGateway.child.killed;
+    const running = nativeGatewayRunning(activeGateway);
     const productMcp = activeLaunch?.profile?.servers?.find(
       (server) => server.alias === "sellable"
     );
@@ -2813,7 +2840,7 @@ async function startNativeGateway({ profile, claim }) {
 }
 
 async function stopNativeGateway(gateway) {
-  if (!gateway?.child || gateway.child.exitCode !== null) return;
+  if (!nativeGatewayRunning(gateway)) return;
   gateway.child.kill("SIGTERM");
   const stopped = await Promise.race([
     gateway.closed.then(() => true),
@@ -2825,6 +2852,100 @@ async function stopNativeGateway(gateway) {
   }
 }
 
+async function recoverUnexpectedNativeGateway({
+  activeLaunch,
+  activeGateway,
+  activeModelHealthReporter,
+  identity,
+  exchange,
+  attempts,
+}) {
+  const recovery = nextAdminNativeGatewayRecovery({ attempts });
+  await activeModelHealthReporter?.stop();
+  await stopNativeGateway(activeGateway);
+  if (recovery.action === "EXHAUSTED") {
+    process.stderr.write(
+      `${JSON.stringify({
+        ok: false,
+        code: "admin_native_gateway_restart_exhausted",
+        attempts: recovery.attempt,
+        manualRetryAvailable: true,
+      })}\n`
+    );
+    return {
+      activeGateway: null,
+      activeModelHealthReporter: null,
+      attempts: recovery.attempt,
+      exhausted: true,
+    };
+  }
+  let candidateGateway = null;
+  try {
+    process.stderr.write(
+      `${JSON.stringify({
+        ok: false,
+        code: "admin_native_gateway_exit_detected",
+        attempt: recovery.attempt,
+      })}\n`
+    );
+    candidateGateway = await startNativeGateway(activeLaunch);
+    if (!nativeGatewayRunning(candidateGateway)) {
+      throw new Error("admin_native_gateway_local_restart_failed");
+    }
+    const nextModelHealthReporter = adminModelHealthReporter({
+      identity,
+      exchange,
+      installed: activeLaunch.installed,
+      claim: activeLaunch.claim,
+    });
+    try {
+      await nextModelHealthReporter.start("gateway-recovered");
+    } catch (error) {
+      process.stderr.write(
+        `${JSON.stringify({
+          ok: false,
+          code:
+            error instanceof Error
+              ? error.message
+              : "model_health_report_failed",
+        })}\n`
+      );
+    }
+    process.stderr.write(
+      `${JSON.stringify({
+        ok: true,
+        code: "admin_native_gateway_local_restart",
+        attempt: recovery.attempt,
+        processIdentity: `gateway-${candidateGateway.child.pid}-${activeLaunch.claim.operation.fence}`,
+      })}\n`
+    );
+    return {
+      activeGateway: candidateGateway,
+      activeModelHealthReporter: nextModelHealthReporter,
+      attempts: recovery.attempt,
+      exhausted: false,
+    };
+  } catch (error) {
+    await stopNativeGateway(candidateGateway);
+    process.stderr.write(
+      `${JSON.stringify({
+        ok: false,
+        code:
+          error instanceof Error
+            ? error.message
+            : "admin_native_gateway_local_restart_failed",
+        attempt: recovery.attempt,
+      })}\n`
+    );
+    return {
+      activeGateway: null,
+      activeModelHealthReporter: null,
+      attempts: recovery.attempt,
+      exhausted: false,
+    };
+  }
+}
+
 export async function runAdminCanary() {
   const step = process.env.SELLABLE_AGENT_ADMIN_CANARY_STEP;
   const recoverySecretPath =
@@ -3379,6 +3500,8 @@ async function runAdminProduction() {
   process.once("SIGTERM", stop);
   let operationHeartbeat = null;
   let soulClaimTracker = null;
+  let gatewayRestartAttempts = 0;
+  let gatewayRestartExhaustionReported = false;
   let failures = 0;
   while (!controller.signal.aborted) {
     let claimedOperation = null;
@@ -3454,6 +3577,23 @@ async function runAdminProduction() {
       if (controller.signal.aborted) break;
       if (!claim) {
         if (activeLaunch) {
+          if (
+            !nativeGatewayRunning(activeGateway) &&
+            !gatewayRestartExhaustionReported
+          ) {
+            const recovery = await recoverUnexpectedNativeGateway({
+              activeLaunch,
+              activeGateway,
+              activeModelHealthReporter,
+              identity,
+              exchange,
+              attempts: gatewayRestartAttempts,
+            });
+            activeGateway = recovery.activeGateway;
+            activeModelHealthReporter = recovery.activeModelHealthReporter;
+            gatewayRestartAttempts = recovery.attempts;
+            gatewayRestartExhaustionReported = recovery.exhausted;
+          }
           await reconcileHermesSnapshot({
             profileId: activeLaunch.profile.profile,
             profileRoot: activeLaunch.profile.profileHome,
@@ -3521,6 +3661,10 @@ async function runAdminProduction() {
         exchange,
         client,
       });
+      const phaseTelemetry = createAdminRuntimePhaseTelemetry({
+        bootSessionId: BOOT_SESSION_ID,
+        operationId: claim.operation.id,
+      });
       await activeModelHealthReporter?.stop();
       activeModelHealthReporter = null;
       await stopNativeGateway(activeGateway);
@@ -3594,31 +3738,42 @@ async function runAdminProduction() {
       // Authority is fully decidable from the claim and durable settings
       // metadata. Refuse it before consuming any lease secret so the failure
       // can be reported as exact and retryable instead of uncertain.
-      const secrets = await consumeRuntimeSecrets({
-        claim,
-        exchange,
-        client,
-      });
-      claimSecretsConsumed = true;
       const desiredLifecycle = desiredLifecycleForClaim(claim);
-      const installed = installRuntimeSecrets({
-        claim,
-        secrets,
-        desiredLifecycle,
-      });
+      const { secrets, installed } = await phaseTelemetry.run(
+        "runtime_secrets",
+        async () => {
+          const secrets = await consumeRuntimeSecrets({
+            claim,
+            exchange,
+            client,
+          });
+          claimSecretsConsumed = true;
+          const installed = installRuntimeSecrets({
+            claim,
+            secrets,
+            desiredLifecycle,
+          });
+          return { secrets, installed };
+        }
+      );
       const proofOperation = operation ?? {
         runtimeGenerationId: claim.adminRuntimeGeneration.id,
         generationFence: claim.adminRuntimeGeneration.fence,
         profileContract,
       };
-      const memoryRestore = await restoreLatestHermesSnapshot({
-        profileId: basename(profileContract.profileHome),
-        profileRoot: profileContract.profileHome,
-        hermesRoot: DATA_ROOT,
-        hermesVersion: "0.20.0",
-        fetchLatest: () => client.getMemorySnapshot(),
-      });
+      const memoryRestore = await phaseTelemetry.run(
+        "snapshot_restore",
+        async () =>
+          restoreLatestHermesSnapshot({
+            profileId: basename(profileContract.profileHome),
+            profileRoot: profileContract.profileHome,
+            hermesRoot: DATA_ROOT,
+            hermesVersion: "0.20.0",
+            fetchLatest: () => client.getMemorySnapshot(),
+          })
+      );
       if (!memoryRestore.ok) throw new Error(memoryRestore.code);
+      await operationHeartbeat.reattest();
       const legacyLightfieldVenv = quarantineLegacyLightfieldVenv({
         profileId: basename(profileContract.profileHome),
         profileRoot: profileContract.profileHome,
@@ -3646,7 +3801,9 @@ async function runAdminProduction() {
         soul: exactSoul(claim),
         slack: nativeSlackProfileInput(claim, installed),
         agentServiceEnv: adminAgentServiceEnvironment(claim),
+        runPhase: phaseTelemetry.run,
       });
+      await operationHeartbeat.reattest();
       const materializerReceipt = adminMaterializerReceipt(
         profile.profile,
         profile.profileHome
@@ -3655,21 +3812,25 @@ async function runAdminProduction() {
         kind: "ADMIN",
         claim,
       });
-      const reconciledDefaultProfile = await reconcileDefaultProfileBundle({
-        activeProjection,
-        materializerReceipt,
-        profileRoot: profile.profileHome,
-        bundleRoot: DEFAULT_PROFILE_BUNDLE_ROOT,
-        dataRoot: DATA_ROOT,
-        reattestAuthority: async () => {
-          await operationHeartbeat.reattest();
-          return activeProjection;
-        },
-        cronAdapter: adminDefaultProfileCronAdapter(
-          profile.profile,
-          profile.profileHome
-        ),
-      });
+      const reconciledDefaultProfile = await phaseTelemetry.run(
+        "default_profile_bundle",
+        async () =>
+          reconcileDefaultProfileBundle({
+            activeProjection,
+            materializerReceipt,
+            profileRoot: profile.profileHome,
+            bundleRoot: DEFAULT_PROFILE_BUNDLE_ROOT,
+            dataRoot: DATA_ROOT,
+            reattestAuthority: async () => {
+              await operationHeartbeat.reattest();
+              return activeProjection;
+            },
+            cronAdapter: adminDefaultProfileCronAdapter(
+              profile.profile,
+              profile.profileHome
+            ),
+          })
+      );
       if (!reconciledDefaultProfile.ok)
         throw new Error(reconciledDefaultProfile.code);
       const defaultProfile = reconciledDefaultProfile;
@@ -3692,11 +3853,16 @@ async function runAdminProduction() {
         profile.opportunitySequencesCron.status !== "REUSED";
       if (materializerChanged || defaultProfile.changed)
         markHermesSnapshotDirty(profile.profileHome);
-      const memorySnapshot = await flushHermesSnapshot({
-        client,
-        profileId: profile.profile,
-        profileRoot: profile.profileHome,
-      });
+      const memorySnapshot = await phaseTelemetry.run(
+        "memory_snapshot",
+        async () =>
+          flushHermesSnapshot({
+            client,
+            profileId: profile.profile,
+            profileRoot: profile.profileHome,
+          })
+      );
+      await operationHeartbeat.reattest();
       const settings = settingsProof(
         imported.receipt.generationRoot,
         imported.receipt.settingsDigest
@@ -3719,10 +3885,14 @@ async function runAdminProduction() {
         });
       }
       operationHeartbeat.assertHealthy();
-      const slackProof =
-        desiredLifecycle === "ON"
-          ? await proveAdminSlackServing(claim, secrets)
-          : false;
+      const slackProof = await phaseTelemetry.run(
+        "slack_serving_proof",
+        async () =>
+          desiredLifecycle === "ON"
+            ? proveAdminSlackServing(claim, secrets)
+            : false
+      );
+      await operationHeartbeat.reattest();
       const candidateLaunch =
         desiredLifecycle === "ON"
           ? { profile, claim, installed, slackProof }
@@ -3730,7 +3900,11 @@ async function runAdminProduction() {
       let candidateGateway = null;
       try {
         if (candidateLaunch) {
-          candidateGateway = await startNativeGateway(candidateLaunch);
+          candidateGateway = await phaseTelemetry.run(
+            "native_gateway",
+            async () => startNativeGateway(candidateLaunch)
+          );
+          await operationHeartbeat.reattest();
         }
         const nativeDefaultProfileProof = candidateGateway
           ? proveDefaultProfileNativeSkills({
@@ -3752,26 +3926,31 @@ async function runAdminProduction() {
           activeProjection,
           nativeDefaultProfileProof,
         });
-        if (claim.runtimeAuthority && candidateLaunch && candidateGateway) {
-          const servingObservation = adminServingObservation(
-            candidateLaunch,
-            candidateGateway,
-            exchange
-          );
-          if (!servingObservation) {
-            throw new Error("admin_serving_observation_unavailable");
-          }
-          const serving = await client.claimTick({
-            leaseSeconds: 60,
-            servingObservation,
-          });
-          if (serving?.servingObservationStatus !== "accepted") {
-            throw new Error(
-              `admin_serving_observation_rejected:${serving?.servingObservationCode ?? serving?.servingObservationStatus ?? "unknown"}`
+        await phaseTelemetry.run("serving_observation", async () => {
+          if (claim.runtimeAuthority && candidateLaunch && candidateGateway) {
+            const servingObservation = adminServingObservation(
+              candidateLaunch,
+              candidateGateway,
+              exchange
             );
+            if (!servingObservation) {
+              throw new Error("admin_serving_observation_unavailable");
+            }
+            const serving = await client.claimTick({
+              leaseSeconds: 60,
+              servingObservation,
+            });
+            if (serving?.servingObservationStatus !== "accepted") {
+              throw new Error(
+                `admin_serving_observation_rejected:${serving?.servingObservationCode ?? serving?.servingObservationStatus ?? "unknown"}`
+              );
+            }
           }
-        }
-        const completed = await client.complete(receipt);
+        });
+        const completed = await phaseTelemetry.run(
+          "operation_completion",
+          async () => client.complete(receipt)
+        );
         if (completed?.accepted !== true) {
           throw new Error("admin_runtime_completion_rejected");
         }
@@ -3818,6 +3997,8 @@ async function runAdminProduction() {
       }
       await operationHeartbeat.stop();
       operationHeartbeat = null;
+      gatewayRestartAttempts = 0;
+      gatewayRestartExhaustionReported = false;
       failures = 0;
     } catch (error) {
       try {

package/lib/sellable-agent/fly-customer-image/Dockerfile

@@ -8,7 +8,7 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
 
 ARG MCP_PACKAGE=@sellable/mcp@0.1.880
 ARG MCP_INTEGRITY=sha512-+Fo8aQlYduLaQMQff+ZA25LeUhWZ7I7UH5DECpND84LQ+rHSjKeKFj4Zs93bVHXwQCIy2OLbr75y4f4+CyT57w==
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.651
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.653-wip.phase189.20260814.1
 ARG ADMIN_MCP_PACKAGE=@sellable/admin-mcp@0.1.186-wip.phase158.20260802034727
 ARG ADMIN_MCP_INTEGRITY=sha512-qYNew5wd2IfgVcp1UYOG9QvpF/8Mx19YJ5HQtMKzvSfUf3evePjtaKsoXLf2C/GUJ5QlLlHJo84VWOI3V01+9A==
 ARG TUS_JS_CLIENT_VERSION=4.3.1

package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs

@@ -105,7 +105,7 @@ const BOOT_SESSION_ID = randomUUID();
 const HERMES_VERSION = process.env.SELLABLE_AGENT_HERMES_VERSION ?? "0.20.0";
 const INSTALLER_PACKAGE =
   process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ??
-  "@sellable/install@0.1.651";
+  "@sellable/install@0.1.653-wip.phase189.20260814.1";
 const MCP_PACKAGE =
   process.env.SELLABLE_AGENT_MCP_PACKAGE ?? "@sellable/mcp@0.1.880";
 const DEFAULT_PROFILE_BUNDLE_ROOT =

package/lib/sellable-agent/host-bootstrap.mjs

@@ -38,7 +38,7 @@ import { installAgentHostServices } from "./service-installer.mjs";
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 const VERSION = "sellable-agent-host-bootstrap/v1";
 const RECEIPT_VERSION = "sellable-agent-host-registration/v1";
-const INSTALLER_PACKAGE = "@sellable/install@0.1.651";
+const INSTALLER_PACKAGE = "@sellable/install@0.1.653-wip.phase189.20260814.1";
 const MCP_PACKAGE = "@sellable/mcp@0.1.880";
 const HERMES_VERSION = "0.18.0";
 const SHA256 = /^[a-f0-9]{64}$/;

package/lib/sellable-agent/host-worker.mjs

@@ -1547,7 +1547,7 @@ export function compileClaimToProfileDesired(activeClaim, config) {
       pinned.hermesCli !== "hermes" ||
       pinned.hermesVersion !== "0.18.0" ||
       pinned.installerPackage !==
-        "@sellable/install@0.1.651" ||
+        "@sellable/install@0.1.653-wip.phase189.20260814.1" ||
       pinned.mcpPackage !== "@sellable/mcp@0.1.880" ||
       !Array.isArray(policy.toolInclude) ||
       policy.toolInclude.length === 0 ||

package/lib/sellable-agent/profile-materializer.mjs

@@ -283,7 +283,7 @@ function validateDesired(desired) {
     desired.hermesCli !== "hermes" ||
     desired.hermesVersion !== "0.18.0" ||
     desired.installerPackage !==
-      "@sellable/install@0.1.651" ||
+      "@sellable/install@0.1.653-wip.phase189.20260814.1" ||
     desired.mcpPackage !== "@sellable/mcp@0.1.880" ||
     !Array.isArray(desired.toolInclude) ||
     desired.toolInclude.length === 0 ||

package/lib/sellable-agent/provisioning-adapter.mjs

@@ -26,7 +26,7 @@ import { deriveContainedProfileId } from "./profile-materializer.mjs";
 
 export const PROVISIONING_ACTION = "PROVISION_HERMES_PROFILE";
 export const PINNED_INSTALL_PACKAGE =
-  "@sellable/install@0.1.651";
+  "@sellable/install@0.1.653-wip.phase189.20260814.1";
 export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.880";
 const PINNED_INSTALL_VERSION = PINNED_INSTALL_PACKAGE.slice(
   PINNED_INSTALL_PACKAGE.lastIndexOf("@") + 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.651",
+  "version": "0.1.653-wip.phase189.20260814.1",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {