@sellable/install 0.1.652 → 0.1.654-wip.phase189.20260814.2

package/container/Dockerfile

@@ -3,12 +3,12 @@ FROM ${HERMES_IMAGE}
 
 USER root
 
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.652
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.654-wip.phase189.20260814.2
 ARG MCP_PACKAGE=@sellable/mcp@0.1.880
 ARG INSTALLER_INTEGRITY
 ARG MCP_INTEGRITY=sha512-+Fo8aQlYduLaQMQff+ZA25LeUhWZ7I7UH5DECpND84LQ+rHSjKeKFj4Zs93bVHXwQCIy2OLbr75y4f4+CyT57w==
 
-RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.652" \
+RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.654-wip.phase189.20260814.2" \
     && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.880" \
     && test -n "${INSTALLER_INTEGRITY}" \
     && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
@@ -23,9 +23,9 @@ RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.652" \
     && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
     && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
     && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
-    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.652' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.880') throw new Error('package identity rejected');" \
+    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.654-wip.phase189.20260814.2' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.880') throw new Error('package identity rejected');" \
     && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
-    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.652', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.880', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
+    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.654-wip.phase189.20260814.2', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.880', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
     && npm cache clean --force
 
 COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint

package/container/README.md

@@ -3,7 +3,7 @@
 This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
 
 Build from this directory after
-`@sellable/install@0.1.652` is
+`@sellable/install@0.1.654-wip.phase189.20260814.2` is
 published:
 
 ```sh

package/lib/sellable-agent/fly-admin-image/Dockerfile

@@ -148,6 +148,7 @@ RUN --mount=type=secret,id=mcp_trust_root,required=true \
     test "$(sha256sum /usr/local/share/sellable-agent/mcp-turn-trust-root.pem | cut -d ' ' -f 1)" = "${MCP_TRUST_ROOT_FINGERPRINT}"
 
 COPY fly-admin-image/admin-runtime.mjs /usr/local/lib/sellable-agent/admin-runtime/admin-runtime.mjs
+COPY fly-admin-image/admin-runtime-phase-telemetry.mjs /usr/local/lib/sellable-agent/admin-runtime/admin-runtime-phase-telemetry.mjs
 COPY fly-admin-image/admin-state-generation.mjs /usr/local/lib/sellable-agent/admin-runtime/admin-state-generation.mjs
 COPY fly-admin-image/start-admin-runtime /usr/local/lib/sellable-agent/admin-runtime/start-admin-runtime
 COPY admin-native-gateway-supervisor.mjs /usr/local/lib/sellable-agent/admin-native-gateway-supervisor.mjs

package/lib/sellable-agent/fly-admin-image/admin-runtime-phase-telemetry.mjs

@@ -0,0 +1,80 @@
+const ADMIN_RUNTIME_PHASES = new Set([
+  "runtime_secrets",
+  "snapshot_restore",
+  "profile_settings_delivery",
+  "profile_stage",
+  "profile_live_merge_promote",
+  "profile_crons",
+  "default_profile_bundle",
+  "memory_snapshot",
+  "slack_serving_proof",
+  "native_gateway",
+  "serving_observation",
+  "operation_completion",
+]);
+
+function phaseFailureCode(error) {
+  const code = error instanceof Error ? error.message : "";
+  return /^[A-Za-z0-9_:-]{1,160}$/.test(code)
+    ? code
+    : "admin_runtime_phase_failed";
+}
+
+export function createAdminRuntimePhaseTelemetry({
+  bootSessionId,
+  operationId,
+  now = () => Date.now(),
+  write = (entry) => process.stderr.write(`${JSON.stringify(entry)}\n`),
+}) {
+  if (
+    typeof bootSessionId !== "string" ||
+    bootSessionId.length < 1 ||
+    typeof operationId !== "string" ||
+    operationId.length < 1
+  ) {
+    throw new Error("admin_runtime_phase_identity_rejected");
+  }
+
+  const run = async (phase, work) => {
+    if (!ADMIN_RUNTIME_PHASES.has(phase) || typeof work !== "function") {
+      throw new Error("admin_runtime_phase_rejected");
+    }
+    const startedAt = now();
+    write({
+      ok: true,
+      code: "admin_runtime_phase",
+      phase,
+      status: "started",
+      elapsedMs: 0,
+      bootSessionId,
+      operationId,
+    });
+    try {
+      const result = await work();
+      write({
+        ok: true,
+        code: "admin_runtime_phase",
+        phase,
+        status: "completed",
+        elapsedMs: Math.max(0, now() - startedAt),
+        bootSessionId,
+        operationId,
+      });
+      return result;
+    } catch (error) {
+      write({
+        ok: false,
+        code: "admin_runtime_phase",
+        phase,
+        status: "failed",
+        elapsedMs: Math.max(0, now() - startedAt),
+        bootSessionId,
+        operationId,
+        errorCode: phaseFailureCode(error),
+      });
+      throw error;
+    }
+  };
+
+  return { run };
+}

package/lib/sellable-agent/fly-admin-image/admin-runtime.mjs

@@ -103,6 +103,7 @@ import {
   reconcileHermesModelAuth,
 } from "../model-auth-reconciler.mjs";
 import { createModelHealthReporter } from "../model-health-reporter.mjs";
+import { createAdminRuntimePhaseTelemetry } from "./admin-runtime-phase-telemetry.mjs";
 import {
   completeAdminStateReceiptRecovery,
   prepareAdminStateGeneration,
@@ -1004,6 +1005,7 @@ async function materializeAdminProfile({
   soul,
   slack = null,
   agentServiceEnv = {},
+  runPhase = async (_phase, work) => work(),
 }) {
   const profileHome = profileContract.profileHome;
   const profile = basename(profileHome);
@@ -1030,91 +1032,99 @@ async function materializeAdminProfile({
   const layout = adminHomeLayout(profileHome);
   // stageAdminProfile canonicalizes these two paths before staging, so the
   // Admin home working copies must exist before the factory runs.
-  deliverAdminSettings(settingsRoot, layout);
+  await runPhase("profile_settings_delivery", async () => {
+    deliverAdminSettings(settingsRoot, layout);
+  });
   const serverProofs = {};
-  const stageWithAuthority = async (stagedAuthority) => {
-    const stage = await stageAdminProfile({
-      mode: slack ? "direct_soul_native_slack" : "direct_soul",
-      lifecycleAuthorized: slack ? true : undefined,
-      ephemeralProductConfig: Boolean(slack),
-      ephemeralSlackSecrets: Boolean(slack),
-      profile,
-      profilesRoot: PROFILES_ROOT,
-      stageRoot,
-      finalProfileRoot: profileHome,
-      rootAuthPath,
-      canonicalAdminConfigPath: layout.configPath,
-      canonicalAdminStatePath: layout.statePath,
-      productConfigPath,
-      model: "gpt-5.6-sol",
-      reasoningEffort: "high",
-      soul: stagedAuthority,
-      ...(slack
-        ? {
-            slackSecretFile: slack.secretFile,
-            teamId: slack.teamId,
-            primaryChannel: slack.primaryChannel,
-            secondaryReadChannelIds: slack.secondaryReadChannelIds,
-            allowedSlackUserIds: slack.allowedSlackUserIds,
-            slackApp: slack.slackApp,
+  const stageWithAuthority = async (stagedAuthority) =>
+    runPhase("profile_stage", async () => {
+      const stage = await stageAdminProfile({
+        mode: slack ? "direct_soul_native_slack" : "direct_soul",
+        lifecycleAuthorized: slack ? true : undefined,
+        ephemeralProductConfig: Boolean(slack),
+        ephemeralSlackSecrets: Boolean(slack),
+        profile,
+        profilesRoot: PROFILES_ROOT,
+        stageRoot,
+        finalProfileRoot: profileHome,
+        rootAuthPath,
+        canonicalAdminConfigPath: layout.configPath,
+        canonicalAdminStatePath: layout.statePath,
+        productConfigPath,
+        model: "gpt-5.6-sol",
+        reasoningEffort: "high",
+        soul: stagedAuthority,
+        ...(slack
+          ? {
+              slackSecretFile: slack.secretFile,
+              teamId: slack.teamId,
+              primaryChannel: slack.primaryChannel,
+              secondaryReadChannelIds: slack.secondaryReadChannelIds,
+              allowedSlackUserIds: slack.allowedSlackUserIds,
+              slackApp: slack.slackApp,
+            }
+          : {}),
+        skillsRoot: join(ADMIN_INSTALL_ASSET_ROOT, "mcp", "skills"),
+        installRoot: layout.adminRoot,
+        adminHome: layout.adminHome,
+        installAdmin: async () =>
+          profilePackageReceipt(
+            profileContract,
+            "sellable-admin",
+            "mcp",
+            layout
+          ),
+        installProduct: async () =>
+          profilePackageReceipt(
+            profileContract,
+            "sellable",
+            "mcp",
+            layout,
+            agentServiceEnv
+          ),
+        verifyMcp: async ({ kind, profileRoot, config }) => {
+          const alias = kind === "admin" ? "sellable-admin" : "sellable";
+          const server = config.mcp_servers[alias];
+          const inventoryProof =
+            alias === "sellable" ? productMcpInventoryProofEnvironment() : null;
+          let proof;
+          try {
+            proof = await inspectMcp({
+              alias,
+              command: server.command,
+              args: server.args,
+              env: {
+                HOME: profileRoot,
+                HERMES_HOME: profileRoot,
+                ...adminToolEnv(layout),
+                ...agentServiceEnv,
+                SELLABLE_CONFIG_PATH: productConfigPath,
+                ...(server.env ?? {}),
+                ...(inventoryProof?.env ?? {}),
+              },
+              packageProof: profileContract.packages[alias].mcp,
+            });
+          } finally {
+            if (inventoryProof) {
+              rmSync(inventoryProof.root, { recursive: true, force: true });
+            }
           }
-        : {}),
-      skillsRoot: join(ADMIN_INSTALL_ASSET_ROOT, "mcp", "skills"),
-      installRoot: layout.adminRoot,
-      adminHome: layout.adminHome,
-      installAdmin: async () =>
-        profilePackageReceipt(profileContract, "sellable-admin", "mcp", layout),
-      installProduct: async () =>
-        profilePackageReceipt(
-          profileContract,
-          "sellable",
-          "mcp",
-          layout,
-          agentServiceEnv
-        ),
-      verifyMcp: async ({ kind, profileRoot, config }) => {
-        const alias = kind === "admin" ? "sellable-admin" : "sellable";
-        const server = config.mcp_servers[alias];
-        const inventoryProof =
-          alias === "sellable" ? productMcpInventoryProofEnvironment() : null;
-        let proof;
-        try {
-          proof = await inspectMcp({
-            alias,
-            command: server.command,
-            args: server.args,
-            env: {
-              HOME: profileRoot,
-              HERMES_HOME: profileRoot,
-              ...adminToolEnv(layout),
-              ...agentServiceEnv,
-              SELLABLE_CONFIG_PATH: productConfigPath,
-              ...(server.env ?? {}),
-              ...(inventoryProof?.env ?? {}),
-            },
-            packageProof: profileContract.packages[alias].mcp,
-          });
-        } finally {
-          if (inventoryProof) {
-            rmSync(inventoryProof.root, { recursive: true, force: true });
+          if (
+            JSON.stringify(proof.tools) !==
+            JSON.stringify(profileContract.tools[alias])
+          ) {
+            throw new Error("admin_runtime_tool_inventory_mismatch");
           }
-        }
-        if (
-          JSON.stringify(proof.tools) !==
-          JSON.stringify(profileContract.tools[alias])
-        ) {
-          throw new Error("admin_runtime_tool_inventory_mismatch");
-        }
-        serverProofs[alias] = proof;
-        return { ok: true, ...proof };
-      },
+          serverProofs[alias] = proof;
+          return { ok: true, ...proof };
+        },
+      });
+      if (slack) installWritableAdminSlackChannelPolicy(stageRoot, slack);
+      installAdminModelConfig(stageRoot, modelConfig);
+      installAdminHermesMemoryHook(stageRoot);
+      stageAdminRuntimeTree(stageRoot);
+      return stage;
     });
-    if (slack) installWritableAdminSlackChannelPolicy(stageRoot, slack);
-    installAdminModelConfig(stageRoot, modelConfig);
-    installAdminHermesMemoryHook(stageRoot);
-    stageAdminRuntimeTree(stageRoot);
-    return stage;
-  };
 
   let stagedAuthority = withProfileSoulLock(profile, readAuthoritativeSoul, {
     dataRoot: DATA_ROOT,
@@ -1123,79 +1133,83 @@ async function materializeAdminProfile({
   let promoted = null;
   for (let attempt = 0; attempt < 2 && !promoted; attempt += 1) {
     stage = await stageWithAuthority(stagedAuthority);
-    const committed = await withProfileSoulLock(
-      profile,
-      async () => {
-        const finalAuthority = readAuthoritativeSoul();
-        if (
-          finalAuthority.sha256 !== stagedAuthority.sha256 ||
-          !finalAuthority.bytes.equals(stagedAuthority.bytes)
-        ) {
-          rmSync(stageRoot, { recursive: true, force: true });
-          return { status: "RESTAGE", stagedAuthority: finalAuthority };
-        }
-        const liveSkillsIdentity = adminPreservedSkillsIdentity(profileHome);
-        if (liveSkillsIdentity !== null) {
-          replaceHermesState(
-            join(profileHome, "skills"),
-            join(stageRoot, "skills"),
-            {
-              preserveTargetTopLevelNames: [...ADMIN_SEALED_SKILL_DIRECTORIES],
-            }
-          );
-        }
-        mergeHermesState(profileHome, stageRoot, {
-          skipSourceTopLevelNames:
-            liveSkillsIdentity === null ? [] : ["skills"],
-        });
-        mergeAdminLiveSkillsConfig(profileHome, stageRoot);
-        installAdminBrowserToolsetDefault(profileHome, stageRoot);
-        if (
-          liveSkillsIdentity !== null &&
-          adminPreservedSkillsIdentity(stageRoot) !== liveSkillsIdentity
-        ) {
-          rmSync(stageRoot, { recursive: true, force: true });
-          return { status: "RESTAGE", stagedAuthority: finalAuthority };
-        }
-        const stagedSoulPath = join(stageRoot, "SOUL.md");
-        const stagedSoul = lstatSync(stagedSoulPath);
-        const stagedSoulBytes = readFileSync(stagedSoulPath);
-        if (
-          stagedSoul.isSymbolicLink() ||
-          !stagedSoul.isFile() ||
-          !stagedSoulBytes.equals(finalAuthority.bytes)
-        ) {
-          throw new Error("admin_runtime_staged_soul_rejected");
-        }
-        const promotion = await promoteAdminProfileAtomically({
-          profile,
-          currentRoot: profileHome,
-          stagedRoot: stageRoot,
-          backupRoot,
-        });
-        const finalSoulPath = join(profileHome, "SOUL.md");
-        const finalSoul = lstatSync(finalSoulPath);
-        const finalSoulBytes = readFileSync(finalSoulPath);
-        if (
-          finalSoul.isSymbolicLink() ||
-          !finalSoul.isFile() ||
-          finalSoul.uid !== (process.getuid?.() ?? finalSoul.uid) ||
-          finalSoul.gid !== (process.getgid?.() ?? finalSoul.gid) ||
-          !finalSoulBytes.equals(finalAuthority.bytes)
-        ) {
-          throw new Error("admin_runtime_live_soul_readback_rejected");
-        }
-        chmodSync(finalSoulPath, 0o600);
-        if ((lstatSync(finalSoulPath).mode & 0o777) !== 0o600) {
-          throw new Error("admin_runtime_live_soul_mode_rejected");
-        }
-        return {
-          status: "PROMOTED",
-          promotion,
-          observedSoulRawSha256: sha256(finalSoulBytes),
-        };
-      },
-      { dataRoot: DATA_ROOT }
+    const committed = await runPhase("profile_live_merge_promote", async () =>
+      withProfileSoulLock(
+        profile,
+        async () => {
+          const finalAuthority = readAuthoritativeSoul();
+          if (
+            finalAuthority.sha256 !== stagedAuthority.sha256 ||
+            !finalAuthority.bytes.equals(stagedAuthority.bytes)
+          ) {
+            rmSync(stageRoot, { recursive: true, force: true });
+            return { status: "RESTAGE", stagedAuthority: finalAuthority };
+          }
+          const liveSkillsIdentity = adminPreservedSkillsIdentity(profileHome);
+          if (liveSkillsIdentity !== null) {
+            replaceHermesState(
+              join(profileHome, "skills"),
+              join(stageRoot, "skills"),
+              {
+                preserveTargetTopLevelNames: [
+                  ...ADMIN_SEALED_SKILL_DIRECTORIES,
+                ],
+              }
+            );
+          }
+          mergeHermesState(profileHome, stageRoot, {
+            skipSourceTopLevelNames:
+              liveSkillsIdentity === null ? [] : ["skills"],
+          });
+          mergeAdminLiveSkillsConfig(profileHome, stageRoot);
+          installAdminBrowserToolsetDefault(profileHome, stageRoot);
+          if (
+            liveSkillsIdentity !== null &&
+            adminPreservedSkillsIdentity(stageRoot) !== liveSkillsIdentity
+          ) {
+            rmSync(stageRoot, { recursive: true, force: true });
+            return { status: "RESTAGE", stagedAuthority: finalAuthority };
+          }
+          const stagedSoulPath = join(stageRoot, "SOUL.md");
+          const stagedSoul = lstatSync(stagedSoulPath);
+          const stagedSoulBytes = readFileSync(stagedSoulPath);
+          if (
+            stagedSoul.isSymbolicLink() ||
+            !stagedSoul.isFile() ||
+            !stagedSoulBytes.equals(finalAuthority.bytes)
+          ) {
+            throw new Error("admin_runtime_staged_soul_rejected");
+          }
+          const promotion = await promoteAdminProfileAtomically({
+            profile,
+            currentRoot: profileHome,
+            stagedRoot: stageRoot,
+            backupRoot,
+          });
+          const finalSoulPath = join(profileHome, "SOUL.md");
+          const finalSoul = lstatSync(finalSoulPath);
+          const finalSoulBytes = readFileSync(finalSoulPath);
+          if (
+            finalSoul.isSymbolicLink() ||
+            !finalSoul.isFile() ||
+            finalSoul.uid !== (process.getuid?.() ?? finalSoul.uid) ||
+            finalSoul.gid !== (process.getgid?.() ?? finalSoul.gid) ||
+            !finalSoulBytes.equals(finalAuthority.bytes)
+          ) {
+            throw new Error("admin_runtime_live_soul_readback_rejected");
+          }
+          chmodSync(finalSoulPath, 0o600);
+          if ((lstatSync(finalSoulPath).mode & 0o777) !== 0o600) {
+            throw new Error("admin_runtime_live_soul_mode_rejected");
+          }
+          return {
+            status: "PROMOTED",
+            promotion,
+            observedSoulRawSha256: sha256(finalSoulBytes),
+          };
+        },
+        { dataRoot: DATA_ROOT }
+      )
     );
     if (committed.status === "PROMOTED") {
       promoted = committed;
@@ -1208,20 +1222,27 @@ async function materializeAdminProfile({
   }
   // The installer bakes absolute paths into every generated wrapper, so bin/
   // is generated once the promoted Admin home is at its final path.
-  const adminHome = installAdminHome({ settingsRoot, layout });
-  const memoryCron = await ensureHermesSnapshotCron({
-    profileId: profile,
-    profileRoot: profileHome,
-    hermesRoot: DATA_ROOT,
-    hermesCli: HERMES,
-  });
-  if (!memoryCron.ok) throw new Error(memoryCron.code);
-  const opportunitySequencesCron = await ensureHermesOpportunitySequencesCron({
-    profileId: profile,
-    profileRoot: profileHome,
-    hermesRoot: DATA_ROOT,
-    statePath: layout.statePath,
-  });
+  const { adminHome, memoryCron, opportunitySequencesCron } = await runPhase(
+    "profile_crons",
+    async () => {
+      const adminHome = installAdminHome({ settingsRoot, layout });
+      const memoryCron = await ensureHermesSnapshotCron({
+        profileId: profile,
+        profileRoot: profileHome,
+        hermesRoot: DATA_ROOT,
+        hermesCli: HERMES,
+      });
+      if (!memoryCron.ok) throw new Error(memoryCron.code);
+      const opportunitySequencesCron =
+        await ensureHermesOpportunitySequencesCron({
+          profileId: profile,
+          profileRoot: profileHome,
+          hermesRoot: DATA_ROOT,
+          statePath: layout.statePath,
+        });
+      return { adminHome, memoryCron, opportunitySequencesCron };
+    }
+  );
   return {
     stage,
     promotion: promoted.promotion,
@@ -3640,6 +3661,10 @@ async function runAdminProduction() {
         exchange,
         client,
       });
+      const phaseTelemetry = createAdminRuntimePhaseTelemetry({
+        bootSessionId: BOOT_SESSION_ID,
+        operationId: claim.operation.id,
+      });
       await activeModelHealthReporter?.stop();
       activeModelHealthReporter = null;
       await stopNativeGateway(activeGateway);
@@ -3713,30 +3738,40 @@ async function runAdminProduction() {
       // Authority is fully decidable from the claim and durable settings
       // metadata. Refuse it before consuming any lease secret so the failure
       // can be reported as exact and retryable instead of uncertain.
-      const secrets = await consumeRuntimeSecrets({
-        claim,
-        exchange,
-        client,
-      });
-      claimSecretsConsumed = true;
       const desiredLifecycle = desiredLifecycleForClaim(claim);
-      const installed = installRuntimeSecrets({
-        claim,
-        secrets,
-        desiredLifecycle,
-      });
+      const { secrets, installed } = await phaseTelemetry.run(
+        "runtime_secrets",
+        async () => {
+          const secrets = await consumeRuntimeSecrets({
+            claim,
+            exchange,
+            client,
+          });
+          claimSecretsConsumed = true;
+          const installed = installRuntimeSecrets({
+            claim,
+            secrets,
+            desiredLifecycle,
+          });
+          return { secrets, installed };
+        }
+      );
       const proofOperation = operation ?? {
         runtimeGenerationId: claim.adminRuntimeGeneration.id,
         generationFence: claim.adminRuntimeGeneration.fence,
         profileContract,
       };
-      const memoryRestore = await restoreLatestHermesSnapshot({
-        profileId: basename(profileContract.profileHome),
-        profileRoot: profileContract.profileHome,
-        hermesRoot: DATA_ROOT,
-        hermesVersion: "0.20.0",
-        fetchLatest: () => client.getMemorySnapshot(),
-      });
+      const memoryRestore = await phaseTelemetry.run(
+        "snapshot_restore",
+        async () =>
+          restoreLatestHermesSnapshot({
+            profileId: basename(profileContract.profileHome),
+            profileRoot: profileContract.profileHome,
+            hermesRoot: DATA_ROOT,
+            hermesVersion: "0.20.0",
+            fetchLatest: () => client.getMemorySnapshot(),
+          })
+      );
       if (!memoryRestore.ok) throw new Error(memoryRestore.code);
       await operationHeartbeat.reattest();
       const legacyLightfieldVenv = quarantineLegacyLightfieldVenv({
@@ -3766,6 +3801,7 @@ async function runAdminProduction() {
         soul: exactSoul(claim),
         slack: nativeSlackProfileInput(claim, installed),
         agentServiceEnv: adminAgentServiceEnvironment(claim),
+        runPhase: phaseTelemetry.run,
       });
       await operationHeartbeat.reattest();
       const materializerReceipt = adminMaterializerReceipt(
@@ -3776,21 +3812,25 @@ async function runAdminProduction() {
         kind: "ADMIN",
         claim,
       });
-      const reconciledDefaultProfile = await reconcileDefaultProfileBundle({
-        activeProjection,
-        materializerReceipt,
-        profileRoot: profile.profileHome,
-        bundleRoot: DEFAULT_PROFILE_BUNDLE_ROOT,
-        dataRoot: DATA_ROOT,
-        reattestAuthority: async () => {
-          await operationHeartbeat.reattest();
-          return activeProjection;
-        },
-        cronAdapter: adminDefaultProfileCronAdapter(
-          profile.profile,
-          profile.profileHome
-        ),
-      });
+      const reconciledDefaultProfile = await phaseTelemetry.run(
+        "default_profile_bundle",
+        async () =>
+          reconcileDefaultProfileBundle({
+            activeProjection,
+            materializerReceipt,
+            profileRoot: profile.profileHome,
+            bundleRoot: DEFAULT_PROFILE_BUNDLE_ROOT,
+            dataRoot: DATA_ROOT,
+            reattestAuthority: async () => {
+              await operationHeartbeat.reattest();
+              return activeProjection;
+            },
+            cronAdapter: adminDefaultProfileCronAdapter(
+              profile.profile,
+              profile.profileHome
+            ),
+          })
+      );
       if (!reconciledDefaultProfile.ok)
         throw new Error(reconciledDefaultProfile.code);
       const defaultProfile = reconciledDefaultProfile;
@@ -3813,11 +3853,15 @@ async function runAdminProduction() {
         profile.opportunitySequencesCron.status !== "REUSED";
       if (materializerChanged || defaultProfile.changed)
         markHermesSnapshotDirty(profile.profileHome);
-      const memorySnapshot = await flushHermesSnapshot({
-        client,
-        profileId: profile.profile,
-        profileRoot: profile.profileHome,
-      });
+      const memorySnapshot = await phaseTelemetry.run(
+        "memory_snapshot",
+        async () =>
+          flushHermesSnapshot({
+            client,
+            profileId: profile.profile,
+            profileRoot: profile.profileHome,
+          })
+      );
       await operationHeartbeat.reattest();
       const settings = settingsProof(
         imported.receipt.generationRoot,
@@ -3841,10 +3885,13 @@ async function runAdminProduction() {
         });
       }
       operationHeartbeat.assertHealthy();
-      const slackProof =
-        desiredLifecycle === "ON"
-          ? await proveAdminSlackServing(claim, secrets)
-          : false;
+      const slackProof = await phaseTelemetry.run(
+        "slack_serving_proof",
+        async () =>
+          desiredLifecycle === "ON"
+            ? proveAdminSlackServing(claim, secrets)
+            : false
+      );
       await operationHeartbeat.reattest();
       const candidateLaunch =
         desiredLifecycle === "ON"
@@ -3853,7 +3900,10 @@ async function runAdminProduction() {
       let candidateGateway = null;
       try {
         if (candidateLaunch) {
-          candidateGateway = await startNativeGateway(candidateLaunch);
+          candidateGateway = await phaseTelemetry.run(
+            "native_gateway",
+            async () => startNativeGateway(candidateLaunch)
+          );
           await operationHeartbeat.reattest();
         }
         const nativeDefaultProfileProof = candidateGateway
@@ -3876,26 +3926,31 @@ async function runAdminProduction() {
           activeProjection,
           nativeDefaultProfileProof,
         });
-        if (claim.runtimeAuthority && candidateLaunch && candidateGateway) {
-          const servingObservation = adminServingObservation(
-            candidateLaunch,
-            candidateGateway,
-            exchange
-          );
-          if (!servingObservation) {
-            throw new Error("admin_serving_observation_unavailable");
-          }
-          const serving = await client.claimTick({
-            leaseSeconds: 60,
-            servingObservation,
-          });
-          if (serving?.servingObservationStatus !== "accepted") {
-            throw new Error(
-              `admin_serving_observation_rejected:${serving?.servingObservationCode ?? serving?.servingObservationStatus ?? "unknown"}`
+        await phaseTelemetry.run("serving_observation", async () => {
+          if (claim.runtimeAuthority && candidateLaunch && candidateGateway) {
+            const servingObservation = adminServingObservation(
+              candidateLaunch,
+              candidateGateway,
+              exchange
             );
+            if (!servingObservation) {
+              throw new Error("admin_serving_observation_unavailable");
+            }
+            const serving = await client.claimTick({
+              leaseSeconds: 60,
+              servingObservation,
+            });
+            if (serving?.servingObservationStatus !== "accepted") {
+              throw new Error(
+                `admin_serving_observation_rejected:${serving?.servingObservationCode ?? serving?.servingObservationStatus ?? "unknown"}`
+              );
+            }
           }
-        }
-        const completed = await client.complete(receipt);
+        });
+        const completed = await phaseTelemetry.run(
+          "operation_completion",
+          async () => client.complete(receipt)
+        );
         if (completed?.accepted !== true) {
           throw new Error("admin_runtime_completion_rejected");
         }

package/lib/sellable-agent/fly-customer-image/Dockerfile

@@ -8,7 +8,7 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
 
 ARG MCP_PACKAGE=@sellable/mcp@0.1.880
 ARG MCP_INTEGRITY=sha512-+Fo8aQlYduLaQMQff+ZA25LeUhWZ7I7UH5DECpND84LQ+rHSjKeKFj4Zs93bVHXwQCIy2OLbr75y4f4+CyT57w==
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.652
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.654-wip.phase189.20260814.2
 ARG ADMIN_MCP_PACKAGE=@sellable/admin-mcp@0.1.186-wip.phase158.20260802034727
 ARG ADMIN_MCP_INTEGRITY=sha512-qYNew5wd2IfgVcp1UYOG9QvpF/8Mx19YJ5HQtMKzvSfUf3evePjtaKsoXLf2C/GUJ5QlLlHJo84VWOI3V01+9A==
 ARG TUS_JS_CLIENT_VERSION=4.3.1
@@ -81,6 +81,7 @@ RUN --mount=type=secret,id=mcp_trust_root,required=true \
 
 COPY mcp-context-proxy.mjs mcp-runtime-binding.mjs fly-customer-model.mjs fly-customer-worker.mjs profile-materializer.mjs hermes-bridge.mjs hermes-memory-snapshot.mjs fly-runtime-identity.mjs fly-soul-bridge.mjs fly-soul-bridge-exec.mjs fly-skills-bridge.mjs fly-skills-bridge-exec.mjs fly-capabilities-bridge.mjs fly-capabilities-bridge-exec.mjs soul-artifact-validator.mjs default-profile-bundle.mjs default-profile-reconciler.mjs fly-cron-proof-exec.mjs model-auth-reconciler.mjs model-auth-canary-reseed.mjs model-health-reporter.mjs \
   /usr/local/lib/sellable-agent/
+COPY abandoned-runtime-scratch.mjs /usr/local/lib/sellable-agent/abandoned-runtime-scratch.mjs
 COPY default-profile-bundles/shared/ /usr/local/lib/sellable-agent/default-profile-bundles/shared/
 COPY default-profile-bundles/customer/ /usr/local/lib/sellable-agent/default-profile-bundles/customer/
 COPY default-profile-bundles/fixtures/ /usr/local/lib/sellable-agent/default-profile-bundles/fixtures/

package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs

@@ -17,6 +17,7 @@ import {
 import { loadavg } from "node:os";
 import { dirname, join } from "node:path";
 import { pathToFileURL } from "node:url";
+import { pruneAbandonedRuntimeScratch } from "../abandoned-runtime-scratch.mjs";
 import {
   buildNativeHermesLaunch,
   buildRuntimeServingObservation,
@@ -105,7 +106,7 @@ const BOOT_SESSION_ID = randomUUID();
 const HERMES_VERSION = process.env.SELLABLE_AGENT_HERMES_VERSION ?? "0.20.0";
 const INSTALLER_PACKAGE =
   process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ??
-  "@sellable/install@0.1.652";
+  "@sellable/install@0.1.654-wip.phase189.20260814.2";
 const MCP_PACKAGE =
   process.env.SELLABLE_AGENT_MCP_PACKAGE ?? "@sellable/mcp@0.1.880";
 const DEFAULT_PROFILE_BUNDLE_ROOT =
@@ -3093,6 +3094,19 @@ async function main() {
   ) {
     throw new Error("customer_configuration_rejected");
   }
+  const scratch = pruneAbandonedRuntimeScratch({
+    hermesRoot: DATA_ROOT,
+    profilesRoot: PROFILES_ROOT,
+  });
+  if (scratch.removed.length > 0) {
+    process.stderr.write(
+      `${JSON.stringify({
+        ok: true,
+        code: scratch.code,
+        removed: scratch.removed,
+      })}\n`
+    );
+  }
   let oidcToken = await obtainFlyOidcToken({ audience: AUDIENCE });
   dropFlyRuntimePrivileges({
     user: "hermes",

package/lib/sellable-agent/hermes-memory-snapshot.mjs

@@ -514,7 +514,7 @@ export async function ensureHermesNamedCron({
   try {
     const before = cronJobs(profileRoot);
     const named = before.filter((job) => job?.name === name);
-    if (named.length > 1 || (named[0] && !isUpdatable(named[0]))) {
+    if (named.length > 1) {
       return failed(`${codePrefix}_inventory_rejected`);
     }
     if (named[0] && isExpected(named[0])) {
@@ -525,6 +525,9 @@ export async function ensureHermesNamedCron({
         job: named[0],
       };
     }
+    if (named[0] && !isUpdatable(named[0])) {
+      return failed(`${codePrefix}_inventory_rejected`);
+    }
     const siblings = before.filter((job) => job?.name !== name);
     const mutation = named[0] ? await update(named[0]) : await create();
     if (childFailed(mutation)) {

package/lib/sellable-agent/host-bootstrap.mjs

@@ -38,7 +38,7 @@ import { installAgentHostServices } from "./service-installer.mjs";
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 const VERSION = "sellable-agent-host-bootstrap/v1";
 const RECEIPT_VERSION = "sellable-agent-host-registration/v1";
-const INSTALLER_PACKAGE = "@sellable/install@0.1.652";
+const INSTALLER_PACKAGE = "@sellable/install@0.1.654-wip.phase189.20260814.2";
 const MCP_PACKAGE = "@sellable/mcp@0.1.880";
 const HERMES_VERSION = "0.18.0";
 const SHA256 = /^[a-f0-9]{64}$/;

package/lib/sellable-agent/host-worker.mjs

@@ -1547,7 +1547,7 @@ export function compileClaimToProfileDesired(activeClaim, config) {
       pinned.hermesCli !== "hermes" ||
       pinned.hermesVersion !== "0.18.0" ||
       pinned.installerPackage !==
-        "@sellable/install@0.1.652" ||
+        "@sellable/install@0.1.654-wip.phase189.20260814.2" ||
       pinned.mcpPackage !== "@sellable/mcp@0.1.880" ||
       !Array.isArray(policy.toolInclude) ||
       policy.toolInclude.length === 0 ||

package/lib/sellable-agent/profile-materializer.mjs

@@ -283,7 +283,7 @@ function validateDesired(desired) {
     desired.hermesCli !== "hermes" ||
     desired.hermesVersion !== "0.18.0" ||
     desired.installerPackage !==
-      "@sellable/install@0.1.652" ||
+      "@sellable/install@0.1.654-wip.phase189.20260814.2" ||
     desired.mcpPackage !== "@sellable/mcp@0.1.880" ||
     !Array.isArray(desired.toolInclude) ||
     desired.toolInclude.length === 0 ||

package/lib/sellable-agent/provisioning-adapter.mjs

@@ -26,7 +26,7 @@ import { deriveContainedProfileId } from "./profile-materializer.mjs";
 
 export const PROVISIONING_ACTION = "PROVISION_HERMES_PROFILE";
 export const PINNED_INSTALL_PACKAGE =
-  "@sellable/install@0.1.652";
+  "@sellable/install@0.1.654-wip.phase189.20260814.2";
 export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.880";
 const PINNED_INSTALL_VERSION = PINNED_INSTALL_PACKAGE.slice(
   PINNED_INSTALL_PACKAGE.lastIndexOf("@") + 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.652",
+  "version": "0.1.654-wip.phase189.20260814.2",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {