@sellable/install 0.1.713 → 0.1.715

package/container/Dockerfile

@@ -3,13 +3,13 @@ FROM ${HERMES_IMAGE}
 
 USER root
 
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.713
-ARG MCP_PACKAGE=@sellable/mcp@0.1.914-wip.first-campaign-onboarding.20260831.4
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.715
+ARG MCP_PACKAGE=@sellable/mcp@0.1.915
 ARG INSTALLER_INTEGRITY
-ARG MCP_INTEGRITY=sha512-rvGDnZy/RxmL/+LZSyevZVBUa7ROeWHw+ltgFNAKvQDq3yIFdccu0ENfU4aYpI+GdNOoahK981UQ5nSjS9CTRQ==
+ARG MCP_INTEGRITY=sha512-+WdyO3WxQ9U7fHMvxBojPRDIZun/INy9mKOz/A1IcBFEWXFkpPooT0yMUzY1qCYcewTM1AUxP3p2QOtsxRIYQA==
 
-RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.713" \
-    && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.914-wip.first-campaign-onboarding.20260831.4" \
+RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.715" \
+    && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.915" \
     && test -n "${INSTALLER_INTEGRITY}" \
     && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
     && test "$(npm view "${MCP_PACKAGE}" dist.integrity)" = "${MCP_INTEGRITY}" \
@@ -23,9 +23,9 @@ RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.713" \
     && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
     && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
     && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
-    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.713' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.914-wip.first-campaign-onboarding.20260831.4') throw new Error('package identity rejected');" \
+    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.715' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.915') throw new Error('package identity rejected');" \
     && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
-    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.713', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.914-wip.first-campaign-onboarding.20260831.4', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
+    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.715', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.915', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
     && npm cache clean --force
 
 COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint

package/container/README.md

@@ -3,7 +3,7 @@
 This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
 
 Build from this directory after
-`@sellable/install@0.1.713` is
+`@sellable/install@0.1.715` is
 published:
 
 ```sh

package/lib/sellable-agent/external-runtime-builder.mjs

@@ -28,7 +28,7 @@ import {
 
 const MANIFEST_VERSION = "sellable-agent-external-runtime-closure/v1";
 const MCP_PACKAGE = "@sellable/mcp";
-const MCP_VERSION = "0.1.914-wip.first-campaign-onboarding.20260831.4";
+const MCP_VERSION = "0.1.915";
 const SAFE_COMPONENT = /^[A-Za-z0-9@._+-]+$/;
 const HERMES_EXCLUDES = new Set([".git", ".playwright", "node_modules"]);
 

package/lib/sellable-agent/fly-admin-image/admin-runtime.mjs

@@ -134,6 +134,13 @@ const PROFILES_ROOT = join(DATA_ROOT, "profiles");
 const RUNTIME_ROOT = join(DATA_ROOT, ".sellable-agent", "admin-runtime");
 const DELIVERY_ROOT = join(RUNTIME_ROOT, "delivery");
 const SECRET_ROOT = "/run/sellable-agent/admin-runtime";
+// Keep the Product MCP's Agent credential outside its mutable JSON config.
+// The MCP re-reads that config on every request and ordinary login tooling can
+// update it, so the credential file is the durable service-authority source.
+const PRODUCT_MCP_CREDENTIAL_ROOT = join(
+  SECRET_ROOT,
+  "product-mcp-credentials"
+);
 // Turn descriptor + consumed roots for the Product MCP context proxy. They are
 // normally empty and receive one signed descriptor only while the fenced
 // endpoint relay owns a turn; the proxy fails closed if either root is absent.
@@ -1878,14 +1885,29 @@ function installRuntimeSecrets({ claim, secrets, desiredLifecycle }) {
     slackSecretFile,
     `SLACK_BOT_TOKEN=${secrets.slackBot}\nSLACK_APP_TOKEN=${secrets.slackApp}\n`
   );
+  const productCredentialDirectory = join(
+    PRODUCT_MCP_CREDENTIAL_ROOT,
+    claim.operation.profileId
+  );
+  const productCredentialPath = join(
+    productCredentialDirectory,
+    "service-credential"
+  );
+  privateDirectory(PRODUCT_MCP_CREDENTIAL_ROOT);
+  privateDirectory(productCredentialDirectory);
+  atomicPrivateFile(productCredentialPath, `${secrets.mcpService}\n`);
   const productConfigPath = join(SECRET_ROOT, "sellable-config.json");
   atomicPrivateFile(
     productConfigPath,
     `${JSON.stringify({
       apiUrl: ORIGIN,
-      token: secrets.mcpService,
       activeWorkspaceId: claim.operation.workspaceId,
       workspaceId: claim.operation.workspaceId,
+      serviceCredential: {
+        reference: `secret://agent/service/g${serviceAuthority.credentialGeneration}`,
+        fingerprint: serviceAuthority.credentialFingerprint,
+        generation: serviceAuthority.credentialGeneration,
+      },
     })}\n`
   );
   return {
@@ -2085,6 +2107,7 @@ function clearRuntimeSecrets() {
   ]) {
     rmSync(join(SECRET_ROOT, name), { force: true });
   }
+  rmSync(PRODUCT_MCP_CREDENTIAL_ROOT, { recursive: true, force: true });
 }
 
 function adminAgentServiceEnvironment(claim) {
@@ -2106,6 +2129,7 @@ function adminAgentServiceEnvironment(claim) {
     !Number.isSafeInteger(RUNTIME_GENERATION) ||
     RUNTIME_GENERATION < 1 ||
     !operation ||
+    !/^[A-Za-z0-9_-]{1,128}$/.test(operation.profileId ?? "") ||
     !service ||
     !/^[A-Za-z0-9_-]{1,128}$/.test(service.principalId ?? "") ||
     !Array.isArray(toolInclude) ||
@@ -2139,7 +2163,15 @@ function adminAgentServiceEnvironment(claim) {
     // customer profile while the signed Agent service context remains the home
     // workspace authority.
     SELLABLE_AGENT_SERVER_AUTHENTICATED_KIND: "ADMIN",
+    SELLABLE_AGENT_RUNTIME: "1",
     SELLABLE_AGENT_RUNTIME_GENERATION: String(RUNTIME_GENERATION),
+    SELLABLE_AGENT_PROFILE_ID: operation.profileId,
+    SELLABLE_AGENT_RUNTIME_SECRET_ROOT: PRODUCT_MCP_CREDENTIAL_ROOT,
+    SELLABLE_AGENT_SERVICE_CREDENTIAL_FILE: join(
+      PRODUCT_MCP_CREDENTIAL_ROOT,
+      operation.profileId,
+      "service-credential"
+    ),
     SELLABLE_AGENT_ADMIN_GENERATION_ID: claim.adminRuntimeGeneration.id,
     SELLABLE_AGENT_ADMIN_GENERATION_FENCE: String(
       claim.adminRuntimeGeneration.fence
@@ -3261,6 +3293,7 @@ export async function runAdminCanary() {
     operation: {
       workspaceId: fixtureWorkspaceId,
       agentId: fixtureAgentId,
+      profileId: "phase158-admin-canary",
       fence: "phase158-canary-operation-fence-a",
     },
     runtimeContract: {

package/lib/sellable-agent/fly-customer-image/Dockerfile

@@ -6,9 +6,9 @@ USER root
 
 ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
 
-ARG MCP_PACKAGE=@sellable/mcp@0.1.914-wip.first-campaign-onboarding.20260831.4
-ARG MCP_INTEGRITY=sha512-rvGDnZy/RxmL/+LZSyevZVBUa7ROeWHw+ltgFNAKvQDq3yIFdccu0ENfU4aYpI+GdNOoahK981UQ5nSjS9CTRQ==
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.713
+ARG MCP_PACKAGE=@sellable/mcp@0.1.915
+ARG MCP_INTEGRITY=sha512-+WdyO3WxQ9U7fHMvxBojPRDIZun/INy9mKOz/A1IcBFEWXFkpPooT0yMUzY1qCYcewTM1AUxP3p2QOtsxRIYQA==
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.715
 ARG ADMIN_MCP_PACKAGE=@sellable/admin-mcp@0.1.186-wip.phase158.20260802034727
 ARG ADMIN_MCP_INTEGRITY=sha512-qYNew5wd2IfgVcp1UYOG9QvpF/8Mx19YJ5HQtMKzvSfUf3evePjtaKsoXLf2C/GUJ5QlLlHJo84VWOI3V01+9A==
 ARG TUS_JS_CLIENT_VERSION=4.3.1

package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs

@@ -58,6 +58,8 @@ import {
   restoreLatestHermesSnapshot,
 } from "../hermes-memory-snapshot.mjs";
 import {
+  endpointHermesSessionId,
+  endpointMcpDescriptorPath,
   installMcpTurnDescriptor,
   replaceMcpTurnDescriptorAtomically,
 } from "../mcp-context-proxy.mjs";
@@ -105,9 +107,10 @@ const RUNTIME_GENERATION = Number(
 const BOOT_SESSION_ID = randomUUID();
 const HERMES_VERSION = process.env.SELLABLE_AGENT_HERMES_VERSION ?? "0.20.4";
 const INSTALLER_PACKAGE =
-  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.713";
+  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.715";
 const MCP_PACKAGE =
-  process.env.SELLABLE_AGENT_MCP_PACKAGE ?? "@sellable/mcp@0.1.914-wip.first-campaign-onboarding.20260831.4";
+  process.env.SELLABLE_AGENT_MCP_PACKAGE ??
+  "@sellable/mcp@0.1.915";
 const DEFAULT_PROFILE_BUNDLE_ROOT =
   "/usr/local/share/sellable-agent/default-profile-bundle";
 const DEFAULT_PROFILE_CRON_PYTHON = [
@@ -1191,7 +1194,8 @@ function endpointProductProjection(productExecution, output) {
       !action ||
       action.actionKind !== "SEND_MESSAGE" ||
       action.status !== "PROPOSED" ||
-      action.argumentHash !== endpointCanonicalOutputDigest(projectedArguments) ||
+      action.argumentHash !==
+        endpointCanonicalOutputDigest(projectedArguments) ||
       /\[SUPPRESS\]|\bSUPPRESS\b|\b(?:no|nothing)\s+truthful\b|\b(?:do|should)\s+not\s+send\b/i.test(
         `${subject ?? ""}\n${candidate}`
       )
@@ -1388,33 +1392,51 @@ export function createCustomerEndpointRelay(options = {}) {
   ) {
     throw new Error("customer_endpoint_relay_configuration_rejected");
   }
-  let activeAttempt = null;
+  const activeAttempts = new Set();
   let failures = 0;
+  const maximumConcurrentRuns = 4;
 
-  const append = async (claim, identity, event, ordinal) => {
+  // Each redacted event is bounded to 8 KiB and the signed request is bounded
+  // to 64 KiB. Six events leave room for identity/signature envelope overhead
+  // while replacing the previous one-HTTP-request-per-event handoff.
+  const endpointEventBatchSize = 6;
+
+  const appendMany = async (claim, identity, indexedEvents) => {
     if (!endpointRuntimeCurrent(claim, getActiveRuntime(), runtimeGeneration)) {
       throw new Error("customer_endpoint_generation_fenced");
     }
-    const envelope = endpointEventEnvelope(event, ordinal);
+    const envelopes = indexedEvents.map(({ event, ordinal }) =>
+      endpointEventEnvelope(event, ordinal)
+    );
     const value = await getControlClient().appendEndpointEvents({
       ...identity,
       schemaVersion: "sellable-agent-endpoint-events/v1",
-      events: [envelope],
+      events: envelopes,
     });
     if (
       value?.accepted !== true ||
       !Array.isArray(value.events) ||
-      value.events.length !== 1 ||
-      value.events[0]?.nativeEventId !== envelope.nativeEventId ||
-      typeof value.events[0]?.sequence !== "string"
+      value.events.length !== envelopes.length ||
+      value.events.some(
+        (persisted, index) =>
+          persisted?.nativeEventId !== envelopes[index].nativeEventId ||
+          typeof persisted?.sequence !== "string"
+      )
     ) {
       throw new Error(
-        event.kind === "LATE_COMPLETION_NOTICE"
+        indexedEvents.some(
+          ({ event }) => event.kind === "LATE_COMPLETION_NOTICE"
+        )
           ? "customer_endpoint_late_notice_rejected"
           : "customer_endpoint_event_persist_rejected"
       );
     }
-    return value.events[0].sequence;
+    return value.events.map((event) => event.sequence);
+  };
+
+  const append = async (claim, identity, event, ordinal) => {
+    const sequences = await appendMany(claim, identity, [{ event, ordinal }]);
+    return sequences[0];
   };
 
   const complete = async (claim, identity, completion) => {
@@ -1666,7 +1688,16 @@ export function createCustomerEndpointRelay(options = {}) {
       claim,
       activeRuntime
     );
-    const descriptorPath = activeRuntime.runtimeConfig.turnDescriptorPath;
+    const hermesSessionId = endpointHermesSessionId(
+      descriptorBinding.descriptor.body
+    );
+    const descriptorPath = endpointMcpDescriptorPath(
+      activeRuntime.runtimeConfig.turnDescriptorPath,
+      hermesSessionId
+    );
+    if (!descriptorPath) {
+      throw new Error("customer_endpoint_hermes_session_rejected");
+    }
     const installedDescriptor = installDescriptor({
       descriptorPath,
       descriptorRoot: dirname(descriptorPath),
@@ -1732,7 +1763,7 @@ export function createCustomerEndpointRelay(options = {}) {
         });
       await held.controlChain;
     };
-    activeAttempt = held;
+    activeAttempts.add(held);
     const heartbeat = (async () => {
       while (!controller.signal.aborted && !heartbeatStopped) {
         if (deadlineExpired || now().getTime() >= deadlineMs) {
@@ -1783,6 +1814,14 @@ export function createCustomerEndpointRelay(options = {}) {
     })();
     let terminalEvent = null;
     let ordinal = 0;
+    const pendingStreamEvents = [];
+    const flushStreamEvents = async () => {
+      if (pendingStreamEvents.length === 0) return;
+      const batch = pendingStreamEvents.slice(0, endpointEventBatchSize);
+      const sequences = await appendMany(claim, identity, batch);
+      pendingStreamEvents.splice(0, batch.length);
+      held.committedSequence = sequences.at(-1);
+    };
     try {
       let submitted;
       try {
@@ -1817,20 +1856,30 @@ export function createCustomerEndpointRelay(options = {}) {
         ordinal++
       );
       if (held.pendingControl) await queueControl(held.pendingControl);
-      const streamed = await runs.streamEvents(submitted.runId, {
-        signal: controller.signal,
-        onEvent: async (event) => {
-          const observedEvent = await holdEndpointUatNativeCompletion({
-            control: uatCompletionControl,
-            claim,
-            event,
-            now,
-            sleep: sleepImpl,
-            signal: controller.signal,
-          });
-          const late = deadlineExpired || now().getTime() >= deadlineMs;
-          const durableEvent =
-            late && observedEvent.kind === "RUN_COMPLETED"
+      let streamed;
+      try {
+        streamed = await runs.streamEvents(submitted.runId, {
+          signal: controller.signal,
+          onEvent: async (event) => {
+            const observedEvent = await holdEndpointUatNativeCompletion({
+              control: uatCompletionControl,
+              claim,
+              event,
+              now,
+              sleep: sleepImpl,
+              signal: controller.signal,
+            });
+            const late = deadlineExpired || now().getTime() >= deadlineMs;
+            const lateCompletion =
+              late && observedEvent.kind === "RUN_COMPLETED";
+            // Late notices use a distinct post-deadline authorization path and
+            // cannot share a signed batch with ordinary pre-deadline events.
+            if (lateCompletion) {
+              while (pendingStreamEvents.length > 0) {
+                await flushStreamEvents();
+              }
+            }
+            const durableEvent = lateCompletion
               ? {
                   kind: "LATE_COMPLETION_NOTICE",
                   outputDigest: observedEvent.outputDigest,
@@ -1838,19 +1887,30 @@ export function createCustomerEndpointRelay(options = {}) {
                   nativeEventIdentity: observedEvent.nativeEventIdentity,
                 }
               : observedEvent;
-          // Persist first. Only the returned committed sequence becomes the
-          // local/public cursor witness, and terminal state is assigned after.
-          const committedSequence = await append(
-            claim,
-            identity,
-            durableEvent,
-            ordinal++
-          );
-          held.committedSequence = committedSequence;
-          if (observedEvent.terminal)
-            terminalEvent = { ...observedEvent, late };
-        },
-      });
+            pendingStreamEvents.push({
+              event: durableEvent,
+              ordinal: ordinal++,
+            });
+            const approvalBoundary =
+              observedEvent.classification === "AWAITING_APPROVAL" ||
+              String(observedEvent.kind ?? "").includes("APPROVAL");
+            if (
+              pendingStreamEvents.length >= endpointEventBatchSize ||
+              observedEvent.terminal ||
+              approvalBoundary
+            ) {
+              await flushStreamEvents();
+            }
+            // Terminal state is assigned only after its durable event batch.
+            if (observedEvent.terminal)
+              terminalEvent = { ...observedEvent, late };
+          },
+        });
+      } finally {
+        while (pendingStreamEvents.length > 0) {
+          await flushStreamEvents();
+        }
+      }
       if (!terminalEvent && !controller.signal.aborted) {
         const status = await runs.status(submitted.runId, {
           signal: controller.signal,
@@ -1967,7 +2027,7 @@ export function createCustomerEndpointRelay(options = {}) {
       await heartbeat;
       await held.controlChain;
       if (existsSync(descriptorPath)) unlinkSync(descriptorPath);
-      if (activeAttempt === held) activeAttempt = null;
+      activeAttempts.delete(held);
     }
   };
 
@@ -1986,49 +2046,96 @@ export function createCustomerEndpointRelay(options = {}) {
       });
     },
     async fenceActive(reason = "GATEWAY_RESTART") {
-      const held = activeAttempt;
-      if (!held || held.stopRequested)
+      const heldAttempts = [...activeAttempts].filter(
+        (held) => !held.stopRequested
+      );
+      if (heldAttempts.length === 0)
         return { ok: true, code: "NO_ACTIVE_ATTEMPT" };
-      held.stopRequested = true;
-      let stopResult = {
-        ok: false,
-        classification: "RESTART_LOST",
-        certainty: "UNCERTAIN",
-      };
-      if (held.nativeRunId) {
-        stopResult = await held.runs.stop(held.nativeRunId, {
-          signal: AbortSignal.timeout(5_000),
-        });
-      }
-      try {
-        await append(
-          held.claim,
-          held.identity,
-          {
-            kind: "GATEWAY_FENCE_REQUESTED",
-            classification: stopResult.classification ?? "STOP_UNCERTAIN",
-            requestDigest: sha256(reason),
-          },
-          Number.MAX_SAFE_INTEGER
-        );
-      } catch {
-        // A newer runtime generation is expected to reject this old fence.
-      }
-      held.controller.abort(new Error("customer_endpoint_gateway_fenced"));
+      const results = await Promise.all(
+        heldAttempts.map(async (held) => {
+          held.stopRequested = true;
+          let stopResult = {
+            ok: false,
+            classification: "RESTART_LOST",
+            certainty: "UNCERTAIN",
+          };
+          if (held.nativeRunId) {
+            try {
+              stopResult = await held.runs.stop(held.nativeRunId, {
+                signal: AbortSignal.timeout(5_000),
+              });
+            } catch {
+              stopResult = {
+                ok: false,
+                classification: "STOP_UNCERTAIN",
+                certainty: "UNCERTAIN",
+              };
+            }
+          }
+          try {
+            await append(
+              held.claim,
+              held.identity,
+              {
+                kind: "GATEWAY_FENCE_REQUESTED",
+                classification: stopResult.classification ?? "STOP_UNCERTAIN",
+                requestDigest: sha256(reason),
+              },
+              Number.MAX_SAFE_INTEGER
+            );
+          } catch {
+            // A newer runtime generation is expected to reject this old fence.
+          }
+          held.controller.abort(new Error("customer_endpoint_gateway_fenced"));
+          return stopResult;
+        })
+      );
+      const uncertain = results.find(
+        (result) => result.positiveCancellation !== true
+      );
       return {
-        ok: stopResult.positiveCancellation === true,
-        code:
-          stopResult.positiveCancellation === true
-            ? "CANCELLED"
-            : (stopResult.classification ?? "STOP_UNCERTAIN"),
+        ok: !uncertain,
+        code: uncertain
+          ? (uncertain.classification ?? "STOP_UNCERTAIN")
+          : "CANCELLED",
       };
     },
     async run(signal) {
       if (!(signal instanceof AbortSignal)) {
         throw new Error("customer_endpoint_relay_signal_rejected");
       }
+      const inFlight = new Set();
+      const launch = (claim) => {
+        let task;
+        task = (async () => {
+          try {
+            const result = await runClaim(claim, signal);
+            diagnostic({
+              ok: result.ok,
+              code: result.code,
+              attemptIdDigest: sha256(claim.attempt?.id ?? ""),
+            });
+          } catch (error) {
+            diagnostic({
+              ok: false,
+              code:
+                error instanceof Error
+                  ? redactRuntimeDiagnostic(error.message)
+                  : "customer_endpoint_run_failed",
+              attemptIdDigest: sha256(claim.attempt?.id ?? ""),
+            });
+          } finally {
+            inFlight.delete(task);
+          }
+        })();
+        inFlight.add(task);
+      };
       while (!signal.aborted) {
         try {
+          if (inFlight.size >= maximumConcurrentRuns) {
+            await Promise.race(inFlight);
+            continue;
+          }
           const activeRuntime = getActiveRuntime();
           if (!activeRuntime?.gateway?.readback?.().running) {
             await abortablePause(500, signal, sleepImpl);
@@ -2040,12 +2147,7 @@ export function createCustomerEndpointRelay(options = {}) {
             await abortablePause(1_000, signal, sleepImpl);
             continue;
           }
-          const result = await runClaim(claim, signal);
-          diagnostic({
-            ok: result.ok,
-            code: result.code,
-            attemptIdDigest: sha256(claim.attempt?.id ?? ""),
-          });
+          launch(claim);
           failures = 0;
         } catch (error) {
           failures = Math.min(failures + 1, 6);
@@ -2063,6 +2165,7 @@ export function createCustomerEndpointRelay(options = {}) {
           );
         }
       }
+      await Promise.allSettled(inFlight);
     },
   });
 }

package/lib/sellable-agent/hermes-bridge.mjs

@@ -744,17 +744,8 @@ def _sellable_agent_call_meta():
     if os.getenv("SELLABLE_AGENT_RUNTIME", "") != "1":
         return None
     from gateway.session_context import get_session_env, session_context_engaged
-    if (
-        not session_context_engaged()
-        or get_session_env("HERMES_SESSION_PLATFORM", "").strip().lower() != "slack"
-    ):
-        # Non-Slack runtime sessions (console/TUI, cron) carry no Slack actor
-        # identity. Send no actor meta; the serving API enforces its own actor
-        # gates, as with installs outside the Sellable runtime.
-        return None
-    from gateway.session_context import get_session_env, session_context_engaged
     if not session_context_engaged():
-        raise RuntimeError("Sellable MCP calls require an active Hermes session context")
+        return None
     legacy_names = (
         "HERMES_SESSION_PLATFORM",
         "HERMES_SESSION_CHAT_ID",
@@ -764,6 +755,11 @@ def _sellable_agent_call_meta():
     if any(os.getenv(name) for name in legacy_names):
         raise RuntimeError("Sellable MCP identity must not come from process-global session variables")
     platform = get_session_env("HERMES_SESSION_PLATFORM", "").strip().lower()
+    session_id = get_session_env("HERMES_SESSION_ID", "").strip()
+    if platform == "api_server":
+        if not session_id:
+            raise RuntimeError("Sellable endpoint MCP calls require a bound Hermes session")
+        return {"sellableEndpoint": {"sessionId": session_id}}
     if platform != "slack":
         descriptor_path = os.getenv("SELLABLE_AGENT_TURN_DESCRIPTOR_PATH", "")
         if descriptor_path.startswith("/"):
@@ -778,7 +774,6 @@ def _sellable_agent_call_meta():
     channel_id = get_session_env("HERMES_SESSION_CHAT_ID", "").strip()
     requester_id = get_session_env("HERMES_SESSION_USER_ID", "").strip()
     message_id = get_session_env("HERMES_SESSION_MESSAGE_ID", "").strip()
-    session_id = get_session_env("HERMES_SESSION_ID", "").strip()
     if not channel_id or not requester_id or not message_id or not session_id:
         raise RuntimeError("Sellable MCP calls require a bound Slack requester, channel, message, and session")
     return {
@@ -2021,7 +2016,7 @@ export const HERMES_AGENT_BRIDGE_DEDICATED_V020_CONTRACT = normalizeContract({
       sourceSha256:
         "8ce75e7f2d999edf6554a8f5a037289c885bc9427263da1cd6e3448e608fe20f",
       patchedSha256:
-        "0fa1fbd502f8e60940dd839b7a0a065c75ef411baf1a1fb419fd05303e3390f0",
+        "2a32c22e499bdb16f31ddd77f143b8f4907df9f4972553b07129fc2a9607b174",
     },
     {
       path: "gateway/run.py",

package/lib/sellable-agent/host-bootstrap.mjs

@@ -38,8 +38,8 @@ import { installAgentHostServices } from "./service-installer.mjs";
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 const VERSION = "sellable-agent-host-bootstrap/v1";
 const RECEIPT_VERSION = "sellable-agent-host-registration/v1";
-const INSTALLER_PACKAGE = "@sellable/install@0.1.713";
-const MCP_PACKAGE = "@sellable/mcp@0.1.914-wip.first-campaign-onboarding.20260831.4";
+const INSTALLER_PACKAGE = "@sellable/install@0.1.715";
+const MCP_PACKAGE = "@sellable/mcp@0.1.915";
 const HERMES_VERSION = "0.18.0";
 const SHA256 = /^[a-f0-9]{64}$/;
 const SHA256_16 = /^[a-f0-9]{16}$/;

package/lib/sellable-agent/host-worker.mjs

@@ -1547,8 +1547,8 @@ export function compileClaimToProfileDesired(activeClaim, config) {
       pinned.hermesCli !== "hermes" ||
       pinned.hermesVersion !== "0.18.0" ||
       pinned.installerPackage !==
-        "@sellable/install@0.1.713" ||
-      pinned.mcpPackage !== "@sellable/mcp@0.1.914-wip.first-campaign-onboarding.20260831.4" ||
+        "@sellable/install@0.1.715" ||
+      pinned.mcpPackage !== "@sellable/mcp@0.1.915" ||
       !Array.isArray(policy.toolInclude) ||
       policy.toolInclude.length === 0 ||
       !Number.isSafeInteger(slack.generation) ||

package/lib/sellable-agent/mcp-context-proxy.mjs

@@ -947,13 +947,38 @@ function isHermesSlackToolCall(request) {
   );
 }
 
-function endpointHermesSessionId(body) {
+export function endpointHermesSessionId(body) {
   if (body?.schemaVersion !== "sellable-agent-mcp-endpoint-run/v1") return null;
   return `sellable_endpoint_${sha256(
     `${body.conversationId}:${body.runId}:${body.attemptId}`
   ).slice(0, 32)}`;
 }
 
+export function endpointMcpDescriptorPath(descriptorPath, sessionId) {
+  if (
+    !isAbsolute(descriptorPath ?? "") ||
+    typeof sessionId !== "string" ||
+    !SAFE_ID.test(sessionId)
+  ) {
+    return null;
+  }
+  return join(dirname(descriptorPath), `endpoint-${sha256(sessionId)}.json`);
+}
+
+function requestEndpointHermesSessionId(request) {
+  if (request?.method !== "tools/call" && request?.method !== "tools/list") {
+    return null;
+  }
+  const meta = request?.params?._meta;
+  if (!exactKeys(meta, ["sellableEndpoint"])) return null;
+  const endpoint = meta.sellableEndpoint;
+  if (!exactKeys(endpoint, ["sessionId"])) return null;
+  return typeof endpoint.sessionId === "string" &&
+    SAFE_ID.test(endpoint.sessionId)
+    ? endpoint.sessionId
+    : null;
+}
+
 function isExactEndpointHermesSessionToolCall(request, body) {
   if (!isHermesSlackToolCall(request)) return false;
   const expectedSessionId = endpointHermesSessionId(body);
@@ -1079,13 +1104,45 @@ export async function runMcpContextProxyStdio({
     }
     return response;
   };
-  const endpointSession = createMcpEndpointSession();
+  const legacyEndpointSession = createMcpEndpointSession();
+  const endpointSessionsByHermesId = new Map();
 
   for await (const line of inputLines) {
     const request = parseJsonRpcLine(line);
     if (!request) throw new Error("mcp_upstream_protocol_rejected");
-    const candidate = existsSync(descriptorPath)
-      ? descriptorCandidate(descriptorPath, descriptorRoot)
+    const requestNow = Date.now();
+    for (const [sessionId, session] of endpointSessionsByHermesId) {
+      const body = endpointSessionBody(session);
+      if (!body || requestNow >= Date.parse(body.expiresAt)) {
+        endpointSessionsByHermesId.delete(sessionId);
+      }
+    }
+    const endpointHermesId = requestEndpointHermesSessionId(request);
+    const requestDescriptorPath = endpointHermesId
+      ? endpointMcpDescriptorPath(descriptorPath, endpointHermesId)
+      : descriptorPath;
+    if (!requestDescriptorPath) {
+      await writeJsonLine(output, {
+        jsonrpc: "2.0",
+        id: request.id ?? null,
+        error: {
+          code: -32001,
+          message: "endpoint_session_rejected",
+          data: { code: "endpoint_session_rejected" },
+        },
+      });
+      continue;
+    }
+    let endpointSession = legacyEndpointSession;
+    if (endpointHermesId) {
+      endpointSession = endpointSessionsByHermesId.get(endpointHermesId);
+      if (!endpointSession) {
+        endpointSession = createMcpEndpointSession();
+        endpointSessionsByHermesId.set(endpointHermesId, endpointSession);
+      }
+    }
+    const candidate = existsSync(requestDescriptorPath)
+      ? descriptorCandidate(requestDescriptorPath, descriptorRoot)
       : null;
     const activeBody = endpointSessionBody(endpointSession);
     const endpointBody =
@@ -1097,16 +1154,38 @@ export async function runMcpContextProxyStdio({
     const endpointMode = Boolean(
       mcpEndpointSessionActivated(endpointSession) || endpointBody
     );
-    // The patched Hermes bridge adds this exact request-scoped shape from its
-    // live Slack session ContextVar; the model controls only `arguments` and
-    // cannot author MCP `_meta`. Route genuine Slack calls directly even when
-    // this shared stdio transport previously served an endpoint run. Hermes
-    // also reuses its Slack-shaped ContextVar for endpoint calls, but gives
-    // those calls the exact deterministic endpoint session id. Recover that
-    // reserved shape through the signed endpoint authorization below so stale
-    // Slack context cannot bypass the endpoint receipt path. Any unverified
-    // descriptor can only select that fail-closed path; it is still validated
-    // before its metadata reaches the downstream process.
+    if (
+      endpointHermesId &&
+      endpointBody &&
+      endpointHermesSessionId(endpointBody) !== endpointHermesId
+    ) {
+      await writeJsonLine(output, {
+        jsonrpc: "2.0",
+        id: request.id ?? null,
+        error: {
+          code: -32001,
+          message: "endpoint_session_binding_mismatch",
+          data: { code: "endpoint_session_binding_mismatch" },
+        },
+      });
+      continue;
+    }
+    if (endpointHermesId && !endpointMode) {
+      await writeJsonLine(output, {
+        jsonrpc: "2.0",
+        id: request.id ?? null,
+        error: {
+          code: -32001,
+          message: "descriptor_missing",
+          data: { code: "descriptor_missing" },
+        },
+      });
+      continue;
+    }
+    // The patched Hermes bridge adds request-scoped metadata from task-local
+    // ContextVars; the model controls only `arguments` and cannot author MCP
+    // `_meta`. Genuine Slack calls pass through with their actor identity.
+    // API endpoint calls select their own signed descriptor/session above.
     if (
       isHermesSlackToolCall(request) &&
       !(
@@ -1118,16 +1197,16 @@ export async function runMcpContextProxyStdio({
       continue;
     }
     if (request.method === "tools/list" && endpointMode) {
-      const expected = existsSync(descriptorPath)
+      const expected = existsSync(requestDescriptorPath)
         ? deriveExpectedMcpTurnBinding({
-            descriptorPath,
+            descriptorPath: requestDescriptorPath,
             descriptorRoot,
             runtimeBindingPath,
           })
         : { ok: true, expected: null };
       const authorized = expected.ok
         ? await authorizeMcpToolList({
-            descriptorPath,
+            descriptorPath: requestDescriptorPath,
             descriptorRoot,
             consumedRoot,
             trustRootPublicKeyPem,
@@ -1160,20 +1239,20 @@ export async function runMcpContextProxyStdio({
     // The existing Slack bridge remains the task-local authority when no
     // server-minted endpoint descriptor is installed. Installing this proxy
     // for endpoint runs must not weaken or fabricate that Slack path.
-    if (!existsSync(descriptorPath) && !endpointMode) {
+    if (!existsSync(requestDescriptorPath) && !endpointMode) {
       await writeJsonLine(child.stdin, request);
       continue;
     }
-    const expected = existsSync(descriptorPath)
+    const expected = existsSync(requestDescriptorPath)
       ? deriveExpectedMcpTurnBinding({
-          descriptorPath,
+          descriptorPath: requestDescriptorPath,
           descriptorRoot,
           runtimeBindingPath,
         })
       : { ok: true, expected: null };
     const authorized = expected.ok
       ? await authorizeMcpToolCall({
-          descriptorPath,
+          descriptorPath: requestDescriptorPath,
           descriptorRoot,
           consumedRoot,
           trustRootPublicKeyPem,

package/lib/sellable-agent/profile-materializer.mjs

@@ -283,8 +283,8 @@ function validateDesired(desired) {
     desired.hermesCli !== "hermes" ||
     desired.hermesVersion !== "0.18.0" ||
     desired.installerPackage !==
-      "@sellable/install@0.1.713" ||
-    desired.mcpPackage !== "@sellable/mcp@0.1.914-wip.first-campaign-onboarding.20260831.4" ||
+      "@sellable/install@0.1.715" ||
+    desired.mcpPackage !== "@sellable/mcp@0.1.915" ||
     !Array.isArray(desired.toolInclude) ||
     desired.toolInclude.length === 0 ||
     desired.toolInclude.some((tool) => !/^[a-z][a-z0-9_]{0,127}$/.test(tool)) ||

package/lib/sellable-agent/provisioning-adapter.mjs

@@ -26,8 +26,8 @@ import { deriveContainedProfileId } from "./profile-materializer.mjs";
 
 export const PROVISIONING_ACTION = "PROVISION_HERMES_PROFILE";
 export const PINNED_INSTALL_PACKAGE =
-  "@sellable/install@0.1.713";
-export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.914-wip.first-campaign-onboarding.20260831.4";
+  "@sellable/install@0.1.715";
+export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.915";
 const PINNED_INSTALL_VERSION = PINNED_INSTALL_PACKAGE.slice(
   PINNED_INSTALL_PACKAGE.lastIndexOf("@") + 1
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.713",
+  "version": "0.1.715",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {