@sellable/install 0.1.800 → 0.1.802

package/container/Dockerfile

@@ -3,12 +3,12 @@ FROM ${HERMES_IMAGE}
 
 USER root
 
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.800
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.802
 ARG MCP_PACKAGE=@sellable/mcp@0.1.957
 ARG INSTALLER_INTEGRITY
 ARG MCP_INTEGRITY=sha512-tIZuO5IEanT/afamDIWdorUNMdqZA6xnjL9jGAmGqYIlIqkXdHB9slWiwfLfmM44iEp7OT98IBHJlvbpMThk6A==
 
-RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.800" \
+RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.802" \
     && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.957" \
     && test -n "${INSTALLER_INTEGRITY}" \
     && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
@@ -23,9 +23,9 @@ RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.800" \
     && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
     && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
     && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
-    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.800' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.957') throw new Error('package identity rejected');" \
+    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.802' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.957') throw new Error('package identity rejected');" \
     && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
-    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.800', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.957', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
+    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.802', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.957', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
     && npm cache clean --force
 
 COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint

package/container/README.md

@@ -3,7 +3,7 @@
 This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
 
 Build from this directory after
-`@sellable/install@0.1.800` is
+`@sellable/install@0.1.802` is
 published:
 
 ```sh

package/lib/sellable-agent/fly-customer-image/Dockerfile

@@ -8,7 +8,7 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
 
 ARG MCP_PACKAGE=@sellable/mcp@0.1.957
 ARG MCP_INTEGRITY=sha512-tIZuO5IEanT/afamDIWdorUNMdqZA6xnjL9jGAmGqYIlIqkXdHB9slWiwfLfmM44iEp7OT98IBHJlvbpMThk6A==
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.800
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.802
 ARG ADMIN_MCP_PACKAGE=@sellable/admin-mcp@0.1.202
 ARG ADMIN_MCP_INTEGRITY=sha512-ym3aye/0vQ8tfULJlKz9JFOxvIQsl1G+n3np+TTgK/tecwNblBo/j3AkTnRqH9iomKzPbZzP+n4tEQsvsU8ByA==
 ARG TUS_JS_CLIENT_VERSION=4.3.1

package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs

@@ -88,6 +88,11 @@ import {
 } from "../profile-materializer.mjs";
 import { reconcilePublicHermesSkills } from "../public-skills.mjs";
 import { createCustomerRuntimePhaseTelemetry } from "./customer-runtime-phase-telemetry.mjs";
+import {
+  endpointChainStepAdmissionDeadline,
+  endpointModelSelectionChain,
+  nextEndpointChainStep,
+} from "./endpoint-model-selection.mjs";
 import {
   holdEndpointUatNativeCompletion,
   validateEndpointUatCompletionControl,
@@ -98,11 +103,11 @@ import {
   validateEndpointModelSelection,
   validateOpenerOutputContract,
 } from "./hermes-runs-client.mjs";
-import { createConfiguredRunsClient } from "./runs-api-connections.mjs";
 import {
   createOpenerStageExecution,
   usesOpenerDraftStrategy,
 } from "./opener-stage-execution.mjs";
+import { createConfiguredRunsClient } from "./runs-api-connections.mjs";
 
 const DATA_ROOT = "/opt/data";
 const PROFILES_ROOT = join(DATA_ROOT, "profiles");
@@ -126,7 +131,7 @@ const RUNTIME_GENERATION = Number(
 const BOOT_SESSION_ID = randomUUID();
 const HERMES_VERSION = process.env.SELLABLE_AGENT_HERMES_VERSION ?? "0.21.5";
 const INSTALLER_PACKAGE =
-  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.800";
+  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.802";
 const MCP_PACKAGE =
   process.env.SELLABLE_AGENT_MCP_PACKAGE ?? "@sellable/mcp@0.1.957";
 export const ENDPOINT_MAX_CONCURRENT_RUNS = 10;
@@ -1074,6 +1079,10 @@ function endpointEventEnvelope(event, ordinal) {
           outputDigest: event.outputDigest ?? null,
           errorDigest: event.errorDigest ?? null,
           evidenceDigest: event.evidence?.digest ?? null,
+          // Which model of an endpoint's fallback chain the event belongs to.
+          ...(Number.isSafeInteger(event.chainStep)
+            ? { chainStep: event.chainStep }
+            : {}),
           ...(event.servedRuntime || event.usage
             ? {
                 servedProvider: event.servedRuntime?.provider ?? null,
@@ -1402,10 +1411,19 @@ export function endpointOpenerOutputContract(claim) {
 // A single-run opener on a caller-named model (Opus on OpenRouter) is held to
 // the same strict schema, which the bridge sends as the provider's json_schema
 // so the model cannot return malformed JSON. The machine's default model has
-// no strict transport, so it gets no contract.
-export function endpointStrictOutputContract(claim, modelSelection) {
+// no strict transport, so it gets no contract. Neither does a Codex step: the
+// bridge enforces the strict format only on OpenRouter. In a fallback chain
+// the server attaches the schema for its custom Runs steps, so a Hermes step
+// (Codex or OpenRouter) runs without it, as it would on its own.
+export function endpointStrictOutputContract(
+  claim,
+  modelSelection,
+  { chained = false } = {}
+) {
   if (
     !modelSelection ||
+    (!modelSelection.runsApiBaseUrl &&
+      (chained || modelSelection.provider === "openai-codex")) ||
     usesOpenerDraftStrategy(claim) ||
     claim?.run?.productExecution?.workKind !== "OPENER" ||
     !claim.run.productExecution.providerOutputSchema
@@ -1954,7 +1972,22 @@ export function createCustomerEndpointRelay(options = {}) {
       throw new Error("customer_endpoint_mcp_descriptor_rejected");
     }
     const apiKeyFile = getApiKeyFile({ claim, activeRuntime });
-    const runs = createRunsClient({ apiKeyFile, claim, activeRuntime });
+    // The models this run tries, in order. Each step opens its own client from
+    // a claim carrying exactly that step's selection, so the trusted
+    // connection checks are the same as for a single-model run.
+    const chain = endpointModelSelectionChain(modelSelection);
+    const chained = chain.length > 1;
+    // A one-model run is a chain of one; no selection is the Agent default.
+    const steps = chain.length ? chain : [null];
+    const stepClaim = (index) =>
+      chain.length === 0
+        ? claim
+        : { ...claim, run: { ...claim.run, modelSelection: chain[index] } };
+    const runs = createRunsClient({
+      apiKeyFile,
+      claim: stepClaim(0),
+      activeRuntime,
+    });
     const controller = new AbortController();
     const abortFromOuter = () => controller.abort(outerSignal.reason);
     outerSignal.addEventListener("abort", abortFromOuter, { once: true });
@@ -2056,7 +2089,6 @@ export function createCustomerEndpointRelay(options = {}) {
         await abortablePause(20_000, controller.signal, sleepImpl);
       }
     })();
-    let terminalEvent = null;
     let ordinal = 0;
     const pendingStreamEvents = [];
     const flushStreamEvents = async () => {
@@ -2066,104 +2098,31 @@ export function createCustomerEndpointRelay(options = {}) {
       pendingStreamEvents.splice(0, batch.length);
       held.committedSequence = sequences.at(-1);
     };
-    try {
-      if (usesOpenerDraftStrategy(claim) && modelSelection) {
-        // The three-draft stages are pinned to the Codex output-format path in
-        // the Hermes bridge; refuse rather than silently serve the default.
-        await complete(claim, identity, {
-          attemptStatus: "FAILED",
-          status: "FAILED",
-        });
-        return { ok: false, code: "OPENER_STAGE_MODEL_SELECTION_UNSUPPORTED" };
-      }
-      if (usesOpenerDraftStrategy(claim)) {
-        // Phase 206: writers are private native sessions within this one fenced
-        // claim. Only the editor's validated result reaches durable completion.
-        let stageEventChain = Promise.resolve();
-        const appendStageEvent = (event) => {
-          stageEventChain = stageEventChain.then(() =>
-            append(claim, identity, event, ordinal++)
-          );
-          return stageEventChain;
-        };
-        held.openerStages = createOpenerStageExecution({
-          runs,
-          input: claim.run.input,
-          instructions: endpointRunInstructions(claim),
-          outputContract: endpointOpenerOutputContract(claim),
-          correlation: `${claim.attempt.conversationId}:${claim.attempt.runId}:${claim.attempt.id}:${randomUUID()}`,
-          deadlineAt: new Date(deadlineMs),
-          signal: controller.signal,
-          now,
-          validateOutput: (output) =>
-            endpointProductProjection(claim.run.productExecution, output).ok,
-          onSubmitted: async ({ stage, runId, requestDigest }) => {
-            const first = held.nativeRunId === null;
-            held.nativeRunId ??= runId;
-            await appendStageEvent({
-              kind: first
-                ? "NATIVE_SUBMIT_ACCEPTED"
-                : "OPENER_STAGE_SUBMIT_ACCEPTED",
-              stage,
-              requestDigest,
-              nativeRunIdDigest: sha256(runId),
-            });
-            if (held.pendingControl) await queueControl(held.pendingControl);
-          },
-          onReceipt: async (receipt) => {
-            await appendStageEvent({
-              kind: "OPENER_STAGE_COMPLETED",
-              ...receipt,
+    const done = (result) => ({ done: true, result });
+    // Runs one model of the chain. A final outcome has already completed the
+    // attempt (`done`); a clean pre-output failure returns its class and a
+    // `finish` that completes the attempt as a single model would have.
+    const runNativeStep = async (stepIndex, stepRuns) => {
+      const selection = chain[stepIndex] ?? null;
+      // Events of a chained run name the model they belong to.
+      const tag = (event) =>
+        chained ? { ...event, chainStep: stepIndex } : event;
+      if (!stepRuns) {
+        return {
+          failure: "STEP_UNAVAILABLE",
+          finish: async () => {
+            await complete(claim, identity, {
+              attemptStatus: "FAILED",
+              status: "FAILED",
             });
+            return { ok: false, code: "FAILED" };
           },
-        });
-        const selected = await held.openerStages.run();
-        const observed = await holdEndpointUatNativeCompletion({
-          control: uatCompletionControl,
-          claim,
-          event: {
-            kind: "RUN_COMPLETED",
-            terminal: true,
-            output: selected.output,
-            outputDigest: selected.outputDigest,
-            timestamp: selected.timestamp,
-            nativeEventIdentity: selected.nativeEventIdentity,
-          },
-          now,
-          sleep: sleepImpl,
-          signal: controller.signal,
-        });
-        const late = deadlineExpired || now().getTime() >= deadlineMs;
-        await append(
-          claim,
-          identity,
-          late
-            ? {
-                kind: "LATE_COMPLETION_NOTICE",
-                outputDigest: observed.outputDigest,
-                timestamp: observed.timestamp,
-                nativeEventIdentity: observed.nativeEventIdentity,
-              }
-            : observed,
-          ordinal++
-        );
-        if (late) return { ok: true, code: "LATE_NOTICE_ONLY" };
-        const projection = endpointProductProjection(
-          claim.run.productExecution,
-          selected.output
-        );
-        if (!projection.ok) throw new Error("OPENER_STAGE_OUTPUT_INVALID");
-        const completion = await complete(claim, identity, {
-          attemptStatus: "SUCCEEDED",
-          status: "SUCCEEDED",
-          output: selected.output,
-          ...projection.completion,
-        });
-        return completion?.accepted === true
-          ? { ok: true, code: "SUCCEEDED" }
-          : { ok: false, code: "OPENER_STAGE_COMPLETION_REJECTED" };
+        };
       }
+      held.runs = stepRuns;
+      held.nativeRunId = null;
       let submitted;
+      let terminalEvent = null;
       const submitRequest = {
         input: claim.run.input,
         instructions: endpointRunInstructions(claim),
@@ -2171,17 +2130,26 @@ export function createCustomerEndpointRelay(options = {}) {
           claim.run.conversationHistory
         ),
         correlation: `${claim.attempt.conversationId}:${claim.attempt.runId}:${claim.attempt.id}`,
-        ...(modelSelection ? { modelSelection } : {}),
+        ...(selection ? { modelSelection: selection } : {}),
       };
       const strictOutputContract = endpointStrictOutputContract(
         claim,
-        modelSelection
+        selection,
+        { chained }
       );
       if (strictOutputContract)
         submitRequest.outputContract = strictOutputContract;
+      // A busy step stops waiting at its own budget so the next model still
+      // has time; the last step (or a single model) waits until the deadline.
+      const admissionDeadlineMs = endpointChainStepAdmissionDeadline({
+        startedAtMs: now().getTime(),
+        deadlineMs,
+        stepIndex,
+        stepCount: steps.length,
+      });
       while (!submitted) {
         try {
-          submitted = await runs.submit(submitRequest, {
+          submitted = await stepRuns.submit(submitRequest, {
             signal: controller.signal,
           });
         } catch (error) {
@@ -2190,22 +2158,27 @@ export function createCustomerEndpointRelay(options = {}) {
               attemptStatus: "UNCERTAIN",
               status: "UNCERTAIN",
             });
-            return { ok: false, code: "SUBMIT_AMBIGUOUS" };
+            return done({ ok: false, code: "SUBMIT_AMBIGUOUS" });
           }
           if (error?.classification !== "SUBMIT_NOT_ADMITTED") throw error;
-          const remainingMs = deadlineMs - now().getTime();
-          if (deadlineExpired || remainingMs <= 0) {
+          const notAdmittedTimeout = async () => {
             await complete(claim, identity, {
               attemptStatus: "TIMED_OUT",
               status: "TIMED_OUT",
             });
             return { ok: false, code: "SUBMIT_NOT_ADMITTED_TIMEOUT" };
-          }
+          };
+          const remainingMs = deadlineMs - now().getTime();
+          if (deadlineExpired || remainingMs <= 0)
+            return done(await notAdmittedTimeout());
+          const admissionRemainingMs = admissionDeadlineMs - now().getTime();
+          if (admissionRemainingMs <= 0)
+            return { failure: "NOT_ADMITTED", finish: notAdmittedTimeout };
           const retryAfterMs = Number.isFinite(error.retryAfterMs)
             ? Math.max(100, Math.min(5_000, error.retryAfterMs))
             : 1_000;
           await abortablePause(
-            Math.min(retryAfterMs, remainingMs),
+            Math.min(retryAfterMs, admissionRemainingMs),
             controller.signal,
             sleepImpl
           );
@@ -2219,17 +2192,17 @@ export function createCustomerEndpointRelay(options = {}) {
       await append(
         claim,
         identity,
-        {
+        tag({
           kind: "NATIVE_SUBMIT_ACCEPTED",
           requestDigest: submitted.requestDigest,
           nativeRunIdDigest: sha256(submitted.runId),
-        },
+        }),
         ordinal++
       );
       if (held.pendingControl) await queueControl(held.pendingControl);
       let streamed;
       try {
-        streamed = await runs.streamEvents(submitted.runId, {
+        streamed = await stepRuns.streamEvents(submitted.runId, {
           signal: controller.signal,
           onEvent: async (event) => {
             const observedEvent = await holdEndpointUatNativeCompletion({
@@ -2259,7 +2232,7 @@ export function createCustomerEndpointRelay(options = {}) {
                 }
               : observedEvent;
             pendingStreamEvents.push({
-              event: durableEvent,
+              event: tag(durableEvent),
               ordinal: ordinal++,
             });
             const approvalBoundary =
@@ -2283,7 +2256,7 @@ export function createCustomerEndpointRelay(options = {}) {
         }
       }
       if (!terminalEvent && !controller.signal.aborted) {
-        const status = await runs.status(submitted.runId, {
+        const status = await stepRuns.status(submitted.runId, {
           signal: controller.signal,
         });
         if (status.terminal) {
@@ -2300,7 +2273,7 @@ export function createCustomerEndpointRelay(options = {}) {
             late: deadlineExpired || now().getTime() >= deadlineMs,
           };
         } else if (status.ok === false) {
-          await append(claim, identity, status, ordinal++);
+          await append(claim, identity, tag(status), ordinal++);
         }
       }
       if (
@@ -2315,18 +2288,24 @@ export function createCustomerEndpointRelay(options = {}) {
           // Server timeout is already canonical. The committed digest-only
           // late notice above is the sole mutation; never replace timeout with
           // a second completion or expose the late output as canonical.
-          return { ok: true, code: "LATE_NOTICE_ONLY" };
+          return done({ ok: true, code: "LATE_NOTICE_ONLY" });
         }
         const productProjection = endpointProductProjection(
           claim.run.productExecution,
           terminalEvent.output
         );
         if (!productProjection.ok) {
-          await complete(claim, identity, {
-            attemptStatus: "SUCCEEDED",
-            status: "OUTPUT_CONTRACT_FAILED",
-          });
-          return { ok: false, code: "OUTPUT_CONTRACT_FAILED" };
+          // The output was never used, so another model may still write.
+          return {
+            failure: "OUTPUT_CONTRACT_FAILED",
+            finish: async () => {
+              await complete(claim, identity, {
+                attemptStatus: "SUCCEEDED",
+                status: "OUTPUT_CONTRACT_FAILED",
+              });
+              return { ok: false, code: "OUTPUT_CONTRACT_FAILED" };
+            },
+          };
         }
         await complete(claim, identity, {
           attemptStatus: "SUCCEEDED",
@@ -2334,7 +2313,7 @@ export function createCustomerEndpointRelay(options = {}) {
           output: terminalEvent.output,
           ...productProjection.completion,
         });
-        return { ok: true, code: "SUCCEEDED" };
+        return done({ ok: true, code: "SUCCEEDED" });
       }
       if (
         terminalEvent?.classification === "CANCELLED_POSITIVE" ||
@@ -2345,26 +2324,185 @@ export function createCustomerEndpointRelay(options = {}) {
           status: "CANCELLED_PRE_EFFECT",
           positiveCancellation: true,
         });
-        return { ok: true, code: "CANCELLED" };
+        return done({ ok: true, code: "CANCELLED" });
       }
       if (terminalEvent) {
-        await complete(claim, identity, {
-          attemptStatus: "FAILED",
-          status: "FAILED",
-        });
-        return { ok: false, code: "FAILED" };
+        // A native failure carries no output (Claude Code usage limit and
+        // sign-in refusals arrive this way too).
+        return {
+          failure: "NATIVE_FAILED",
+          finish: async () => {
+            await complete(claim, identity, {
+              attemptStatus: "FAILED",
+              status: "FAILED",
+            });
+            return { ok: false, code: "FAILED" };
+          },
+        };
       }
       const deadline = deadlineExpired || now().getTime() >= deadlineMs;
       await complete(claim, identity, {
         attemptStatus: deadline ? "TIMED_OUT_UNCERTAIN" : "UNCERTAIN",
         status: deadline ? "TIMED_OUT_UNCERTAIN" : "UNCERTAIN",
       });
-      return {
+      return done({
         ok: false,
         code:
           streamed?.classification ??
           (deadline ? "TIMED_OUT_UNCERTAIN" : "NATIVE_LOST_UNCERTAIN"),
-      };
+      });
+    };
+    try {
+      if (usesOpenerDraftStrategy(claim) && modelSelection) {
+        // The three-draft stages are pinned to the Codex output-format path in
+        // the Hermes bridge; refuse rather than silently serve the default.
+        await complete(claim, identity, {
+          attemptStatus: "FAILED",
+          status: "FAILED",
+        });
+        return { ok: false, code: "OPENER_STAGE_MODEL_SELECTION_UNSUPPORTED" };
+      }
+      if (usesOpenerDraftStrategy(claim)) {
+        // Phase 206: writers are private native sessions within this one fenced
+        // claim. Only the editor's validated result reaches durable completion.
+        let stageEventChain = Promise.resolve();
+        const appendStageEvent = (event) => {
+          stageEventChain = stageEventChain.then(() =>
+            append(claim, identity, event, ordinal++)
+          );
+          return stageEventChain;
+        };
+        held.openerStages = createOpenerStageExecution({
+          runs,
+          input: claim.run.input,
+          instructions: endpointRunInstructions(claim),
+          outputContract: endpointOpenerOutputContract(claim),
+          correlation: `${claim.attempt.conversationId}:${claim.attempt.runId}:${claim.attempt.id}:${randomUUID()}`,
+          deadlineAt: new Date(deadlineMs),
+          signal: controller.signal,
+          now,
+          validateOutput: (output) =>
+            endpointProductProjection(claim.run.productExecution, output).ok,
+          onSubmitted: async ({ stage, runId, requestDigest }) => {
+            const first = held.nativeRunId === null;
+            held.nativeRunId ??= runId;
+            await appendStageEvent({
+              kind: first
+                ? "NATIVE_SUBMIT_ACCEPTED"
+                : "OPENER_STAGE_SUBMIT_ACCEPTED",
+              stage,
+              requestDigest,
+              nativeRunIdDigest: sha256(runId),
+            });
+            if (held.pendingControl) await queueControl(held.pendingControl);
+          },
+          onReceipt: async (receipt) => {
+            await appendStageEvent({
+              kind: "OPENER_STAGE_COMPLETED",
+              ...receipt,
+            });
+          },
+        });
+        const selected = await held.openerStages.run();
+        const observed = await holdEndpointUatNativeCompletion({
+          control: uatCompletionControl,
+          claim,
+          event: {
+            kind: "RUN_COMPLETED",
+            terminal: true,
+            output: selected.output,
+            outputDigest: selected.outputDigest,
+            timestamp: selected.timestamp,
+            nativeEventIdentity: selected.nativeEventIdentity,
+          },
+          now,
+          sleep: sleepImpl,
+          signal: controller.signal,
+        });
+        const late = deadlineExpired || now().getTime() >= deadlineMs;
+        await append(
+          claim,
+          identity,
+          late
+            ? {
+                kind: "LATE_COMPLETION_NOTICE",
+                outputDigest: observed.outputDigest,
+                timestamp: observed.timestamp,
+                nativeEventIdentity: observed.nativeEventIdentity,
+              }
+            : observed,
+          ordinal++
+        );
+        if (late) return { ok: true, code: "LATE_NOTICE_ONLY" };
+        const projection = endpointProductProjection(
+          claim.run.productExecution,
+          selected.output
+        );
+        if (!projection.ok) throw new Error("OPENER_STAGE_OUTPUT_INVALID");
+        const completion = await complete(claim, identity, {
+          attemptStatus: "SUCCEEDED",
+          status: "SUCCEEDED",
+          output: selected.output,
+          ...projection.completion,
+        });
+        return completion?.accepted === true
+          ? { ok: true, code: "SUCCEEDED" }
+          : { ok: false, code: "OPENER_STAGE_COMPLETION_REJECTED" };
+      }
+      // A step that failed cleanly before producing any output hands the run
+      // to the next model; every other outcome completes this attempt once.
+      // Only when the failed step cannot have changed anything: a product draft
+      // run has no effects by construction, and an endpoint without tools has
+      // nothing to call. Any other run may already have used a tool, so another
+      // model must not repeat the turn.
+      const chainMayAdvance =
+        claim.run.productExecution != null ||
+        (descriptorBinding.expected.allowedToolNames ?? []).length === 0;
+      const history = [];
+      let stepIndex = 0;
+      let stepRuns = runs;
+      for (;;) {
+        const outcome = await runNativeStep(stepIndex, stepRuns);
+        if (outcome.done) return outcome.result;
+        // A stop, a gateway fence or a lost lease (which aborts the
+        // controller) ends the run as a single model would have ended it.
+        const stopRequested =
+          held.stopRequested ||
+          held.pendingControl?.kind === "STOP_PENDING" ||
+          controller.signal.aborted;
+        const decision =
+          stopRequested || !chainMayAdvance
+            ? { advance: false }
+            : nextEndpointChainStep(
+                steps,
+                history,
+                outcome.failure,
+                deadlineMs - now().getTime()
+              );
+        if (!decision.advance) return await outcome.finish();
+        await append(
+          claim,
+          identity,
+          {
+            kind: "CHAIN_STEP_ADVANCED",
+            classification: outcome.failure,
+            chainStep: stepIndex,
+          },
+          ordinal++
+        );
+        history.push(outcome.failure);
+        stepIndex = decision.stepIndex;
+        try {
+          stepRuns = createRunsClient({
+            apiKeyFile,
+            claim: stepClaim(stepIndex),
+            activeRuntime,
+          });
+        } catch {
+          // Nothing was sent for this step; it counts as a clean failure.
+          stepRuns = null;
+        }
+      }
     } catch (error) {
       if (heartbeatFailure) throw heartbeatFailure;
       if (