@sellable/install 0.1.801 → 0.1.803

package/container/Dockerfile

@@ -3,12 +3,12 @@ FROM ${HERMES_IMAGE}
 
 USER root
 
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.801
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.803
 ARG MCP_PACKAGE=@sellable/mcp@0.1.957
 ARG INSTALLER_INTEGRITY
 ARG MCP_INTEGRITY=sha512-tIZuO5IEanT/afamDIWdorUNMdqZA6xnjL9jGAmGqYIlIqkXdHB9slWiwfLfmM44iEp7OT98IBHJlvbpMThk6A==
 
-RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.801" \
+RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.803" \
     && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.957" \
     && test -n "${INSTALLER_INTEGRITY}" \
     && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
@@ -23,9 +23,9 @@ RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.801" \
     && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
     && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
     && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
-    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.801' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.957') throw new Error('package identity rejected');" \
+    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.803' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.957') throw new Error('package identity rejected');" \
     && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
-    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.801', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.957', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
+    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.803', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.957', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
     && npm cache clean --force
 
 COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint

package/container/README.md

@@ -3,7 +3,7 @@
 This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
 
 Build from this directory after
-`@sellable/install@0.1.801` is
+`@sellable/install@0.1.803` is
 published:
 
 ```sh

package/lib/sellable-agent/fly-customer-image/Dockerfile

@@ -8,7 +8,7 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
 
 ARG MCP_PACKAGE=@sellable/mcp@0.1.957
 ARG MCP_INTEGRITY=sha512-tIZuO5IEanT/afamDIWdorUNMdqZA6xnjL9jGAmGqYIlIqkXdHB9slWiwfLfmM44iEp7OT98IBHJlvbpMThk6A==
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.801
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.803
 ARG ADMIN_MCP_PACKAGE=@sellable/admin-mcp@0.1.202
 ARG ADMIN_MCP_INTEGRITY=sha512-ym3aye/0vQ8tfULJlKz9JFOxvIQsl1G+n3np+TTgK/tecwNblBo/j3AkTnRqH9iomKzPbZzP+n4tEQsvsU8ByA==
 ARG TUS_JS_CLIENT_VERSION=4.3.1

package/lib/sellable-agent/fly-customer-image/claude-code-runs-api.mjs

@@ -332,6 +332,9 @@ export function claudeUsageLimit(stdout, now = Date.now()) {
   return { retryAt };
 }
 
+// A failure reason the run may report: a fixed code, never raw CLI text.
+const RUN_FAILURE_CODE = /^claude_runs_[a-z_]{1,48}$/;
+
 export function parseClaudeResult(stdout, request) {
   const result = JSON.parse(stdout);
   const models = Object.keys(result.modelUsage ?? {});
@@ -341,15 +344,19 @@ export function parseClaudeResult(stdout, request) {
     result.subtype !== "success" ||
     (request.schema
       ? !record(result.structured_output)
-      : typeof result.result !== "string") ||
-    (result.permission_denials ?? []).length ||
+      : typeof result.result !== "string")
+  )
+    throw new Error("claude_runs_output_rejected");
+  if ((result.permission_denials ?? []).length)
+    throw new Error("claude_runs_permission_denied");
+  if (
     !models.length ||
     models.some(
       (model) =>
         model !== request.model && !model.startsWith(`${request.model}-`)
     )
   )
-    throw new Error("claude_runs_output_rejected");
+    throw new Error("claude_runs_model_mismatch");
   const output = request.schema
     ? JSON.stringify(result.structured_output)
     : result.result;
@@ -447,8 +454,12 @@ export function startClaudeRun(
         return reject(new Error(reason ?? "claude_runs_cli_failed"));
       try {
         resolve(parseClaudeResult(stdout, request));
-      } catch {
-        reject(new Error("claude_runs_output_rejected"));
+      } catch (error) {
+        reject(
+          error instanceof Error && RUN_FAILURE_CODE.test(error.message)
+            ? error
+            : new Error("claude_runs_output_rejected")
+        );
       }
     });
     child.stdin.on("error", () => {});
@@ -728,11 +739,9 @@ export function createClaudeRunsApi({
                   ? { status: "cancelled" }
                   : {
                       status: "failed",
-                      error: [
-                        "claude_runs_sign_in_required",
-                        "claude_runs_auth_check_unavailable",
-                        "claude_runs_usage_limited",
-                      ].includes(error.message)
+                      // The reason, so a failure can be told apart later;
+                      // anything else the CLI threw stays generic.
+                      error: RUN_FAILURE_CODE.test(error?.message ?? "")
                         ? error.message
                         : "claude_runs_generation_failed",
                     }

package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs

@@ -88,6 +88,11 @@ import {
 } from "../profile-materializer.mjs";
 import { reconcilePublicHermesSkills } from "../public-skills.mjs";
 import { createCustomerRuntimePhaseTelemetry } from "./customer-runtime-phase-telemetry.mjs";
+import {
+  endpointChainStepAdmissionDeadline,
+  endpointModelSelectionChain,
+  nextEndpointChainStep,
+} from "./endpoint-model-selection.mjs";
 import {
   holdEndpointUatNativeCompletion,
   validateEndpointUatCompletionControl,
@@ -98,11 +103,11 @@ import {
   validateEndpointModelSelection,
   validateOpenerOutputContract,
 } from "./hermes-runs-client.mjs";
-import { createConfiguredRunsClient } from "./runs-api-connections.mjs";
 import {
   createOpenerStageExecution,
   usesOpenerDraftStrategy,
 } from "./opener-stage-execution.mjs";
+import { createConfiguredRunsClient } from "./runs-api-connections.mjs";
 
 const DATA_ROOT = "/opt/data";
 const PROFILES_ROOT = join(DATA_ROOT, "profiles");
@@ -126,7 +131,7 @@ const RUNTIME_GENERATION = Number(
 const BOOT_SESSION_ID = randomUUID();
 const HERMES_VERSION = process.env.SELLABLE_AGENT_HERMES_VERSION ?? "0.21.5";
 const INSTALLER_PACKAGE =
-  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.801";
+  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.803";
 const MCP_PACKAGE =
   process.env.SELLABLE_AGENT_MCP_PACKAGE ?? "@sellable/mcp@0.1.957";
 export const ENDPOINT_MAX_CONCURRENT_RUNS = 10;
@@ -1074,6 +1079,10 @@ function endpointEventEnvelope(event, ordinal) {
           outputDigest: event.outputDigest ?? null,
           errorDigest: event.errorDigest ?? null,
           evidenceDigest: event.evidence?.digest ?? null,
+          // Which model of an endpoint's fallback chain the event belongs to.
+          ...(Number.isSafeInteger(event.chainStep)
+            ? { chainStep: event.chainStep }
+            : {}),
           ...(event.servedRuntime || event.usage
             ? {
                 servedProvider: event.servedRuntime?.provider ?? null,
@@ -1402,10 +1411,19 @@ export function endpointOpenerOutputContract(claim) {
 // A single-run opener on a caller-named model (Opus on OpenRouter) is held to
 // the same strict schema, which the bridge sends as the provider's json_schema
 // so the model cannot return malformed JSON. The machine's default model has
-// no strict transport, so it gets no contract.
-export function endpointStrictOutputContract(claim, modelSelection) {
+// no strict transport, so it gets no contract. Neither does a Codex step: the
+// bridge enforces the strict format only on OpenRouter. In a fallback chain
+// the server attaches the schema for its custom Runs steps, so a Hermes step
+// (Codex or OpenRouter) runs without it, as it would on its own.
+export function endpointStrictOutputContract(
+  claim,
+  modelSelection,
+  { chained = false } = {}
+) {
   if (
     !modelSelection ||
+    (!modelSelection.runsApiBaseUrl &&
+      (chained || modelSelection.provider === "openai-codex")) ||
     usesOpenerDraftStrategy(claim) ||
     claim?.run?.productExecution?.workKind !== "OPENER" ||
     !claim.run.productExecution.providerOutputSchema
@@ -1954,7 +1972,22 @@ export function createCustomerEndpointRelay(options = {}) {
       throw new Error("customer_endpoint_mcp_descriptor_rejected");
     }
     const apiKeyFile = getApiKeyFile({ claim, activeRuntime });
-    const runs = createRunsClient({ apiKeyFile, claim, activeRuntime });
+    // The models this run tries, in order. Each step opens its own client from
+    // a claim carrying exactly that step's selection, so the trusted
+    // connection checks are the same as for a single-model run.
+    const chain = endpointModelSelectionChain(modelSelection);
+    const chained = chain.length > 1;
+    // A one-model run is a chain of one; no selection is the Agent default.
+    const steps = chain.length ? chain : [null];
+    const stepClaim = (index) =>
+      chain.length === 0
+        ? claim
+        : { ...claim, run: { ...claim.run, modelSelection: chain[index] } };
+    const runs = createRunsClient({
+      apiKeyFile,
+      claim: stepClaim(0),
+      activeRuntime,
+    });
     const controller = new AbortController();
     const abortFromOuter = () => controller.abort(outerSignal.reason);
     outerSignal.addEventListener("abort", abortFromOuter, { once: true });
@@ -2056,7 +2089,6 @@ export function createCustomerEndpointRelay(options = {}) {
         await abortablePause(20_000, controller.signal, sleepImpl);
       }
     })();
-    let terminalEvent = null;
     let ordinal = 0;
     const pendingStreamEvents = [];
     const flushStreamEvents = async () => {
@@ -2066,104 +2098,31 @@ export function createCustomerEndpointRelay(options = {}) {
       pendingStreamEvents.splice(0, batch.length);
       held.committedSequence = sequences.at(-1);
     };
-    try {
-      if (usesOpenerDraftStrategy(claim) && modelSelection) {
-        // The three-draft stages are pinned to the Codex output-format path in
-        // the Hermes bridge; refuse rather than silently serve the default.
-        await complete(claim, identity, {
-          attemptStatus: "FAILED",
-          status: "FAILED",
-        });
-        return { ok: false, code: "OPENER_STAGE_MODEL_SELECTION_UNSUPPORTED" };
-      }
-      if (usesOpenerDraftStrategy(claim)) {
-        // Phase 206: writers are private native sessions within this one fenced
-        // claim. Only the editor's validated result reaches durable completion.
-        let stageEventChain = Promise.resolve();
-        const appendStageEvent = (event) => {
-          stageEventChain = stageEventChain.then(() =>
-            append(claim, identity, event, ordinal++)
-          );
-          return stageEventChain;
-        };
-        held.openerStages = createOpenerStageExecution({
-          runs,
-          input: claim.run.input,
-          instructions: endpointRunInstructions(claim),
-          outputContract: endpointOpenerOutputContract(claim),
-          correlation: `${claim.attempt.conversationId}:${claim.attempt.runId}:${claim.attempt.id}:${randomUUID()}`,
-          deadlineAt: new Date(deadlineMs),
-          signal: controller.signal,
-          now,
-          validateOutput: (output) =>
-            endpointProductProjection(claim.run.productExecution, output).ok,
-          onSubmitted: async ({ stage, runId, requestDigest }) => {
-            const first = held.nativeRunId === null;
-            held.nativeRunId ??= runId;
-            await appendStageEvent({
-              kind: first
-                ? "NATIVE_SUBMIT_ACCEPTED"
-                : "OPENER_STAGE_SUBMIT_ACCEPTED",
-              stage,
-              requestDigest,
-              nativeRunIdDigest: sha256(runId),
-            });
-            if (held.pendingControl) await queueControl(held.pendingControl);
-          },
-          onReceipt: async (receipt) => {
-            await appendStageEvent({
-              kind: "OPENER_STAGE_COMPLETED",
-              ...receipt,
+    const done = (result) => ({ done: true, result });
+    // Runs one model of the chain. A final outcome has already completed the
+    // attempt (`done`); a clean pre-output failure returns its class and a
+    // `finish` that completes the attempt as a single model would have.
+    const runNativeStep = async (stepIndex, stepRuns) => {
+      const selection = chain[stepIndex] ?? null;
+      // Events of a chained run name the model they belong to.
+      const tag = (event) =>
+        chained ? { ...event, chainStep: stepIndex } : event;
+      if (!stepRuns) {
+        return {
+          failure: "STEP_UNAVAILABLE",
+          finish: async () => {
+            await complete(claim, identity, {
+              attemptStatus: "FAILED",
+              status: "FAILED",
             });
+            return { ok: false, code: "FAILED" };
           },
-        });
-        const selected = await held.openerStages.run();
-        const observed = await holdEndpointUatNativeCompletion({
-          control: uatCompletionControl,
-          claim,
-          event: {
-            kind: "RUN_COMPLETED",
-            terminal: true,
-            output: selected.output,
-            outputDigest: selected.outputDigest,
-            timestamp: selected.timestamp,
-            nativeEventIdentity: selected.nativeEventIdentity,
-          },
-          now,
-          sleep: sleepImpl,
-          signal: controller.signal,
-        });
-        const late = deadlineExpired || now().getTime() >= deadlineMs;
-        await append(
-          claim,
-          identity,
-          late
-            ? {
-                kind: "LATE_COMPLETION_NOTICE",
-                outputDigest: observed.outputDigest,
-                timestamp: observed.timestamp,
-                nativeEventIdentity: observed.nativeEventIdentity,
-              }
-            : observed,
-          ordinal++
-        );
-        if (late) return { ok: true, code: "LATE_NOTICE_ONLY" };
-        const projection = endpointProductProjection(
-          claim.run.productExecution,
-          selected.output
-        );
-        if (!projection.ok) throw new Error("OPENER_STAGE_OUTPUT_INVALID");
-        const completion = await complete(claim, identity, {
-          attemptStatus: "SUCCEEDED",
-          status: "SUCCEEDED",
-          output: selected.output,
-          ...projection.completion,
-        });
-        return completion?.accepted === true
-          ? { ok: true, code: "SUCCEEDED" }
-          : { ok: false, code: "OPENER_STAGE_COMPLETION_REJECTED" };
+        };
       }
+      held.runs = stepRuns;
+      held.nativeRunId = null;
       let submitted;
+      let terminalEvent = null;
       const submitRequest = {
         input: claim.run.input,
         instructions: endpointRunInstructions(claim),
@@ -2171,17 +2130,26 @@ export function createCustomerEndpointRelay(options = {}) {
           claim.run.conversationHistory
         ),
         correlation: `${claim.attempt.conversationId}:${claim.attempt.runId}:${claim.attempt.id}`,
-        ...(modelSelection ? { modelSelection } : {}),
+        ...(selection ? { modelSelection: selection } : {}),
       };
       const strictOutputContract = endpointStrictOutputContract(
         claim,
-        modelSelection
+        selection,
+        { chained }
       );
       if (strictOutputContract)
         submitRequest.outputContract = strictOutputContract;
+      // A busy step stops waiting at its own budget so the next model still
+      // has time; the last step (or a single model) waits until the deadline.
+      const admissionDeadlineMs = endpointChainStepAdmissionDeadline({
+        startedAtMs: now().getTime(),
+        deadlineMs,
+        stepIndex,
+        stepCount: steps.length,
+      });
       while (!submitted) {
         try {
-          submitted = await runs.submit(submitRequest, {
+          submitted = await stepRuns.submit(submitRequest, {
             signal: controller.signal,
           });
         } catch (error) {
@@ -2190,22 +2158,27 @@ export function createCustomerEndpointRelay(options = {}) {
               attemptStatus: "UNCERTAIN",
               status: "UNCERTAIN",
             });
-            return { ok: false, code: "SUBMIT_AMBIGUOUS" };
+            return done({ ok: false, code: "SUBMIT_AMBIGUOUS" });
           }
           if (error?.classification !== "SUBMIT_NOT_ADMITTED") throw error;
-          const remainingMs = deadlineMs - now().getTime();
-          if (deadlineExpired || remainingMs <= 0) {
+          const notAdmittedTimeout = async () => {
             await complete(claim, identity, {
               attemptStatus: "TIMED_OUT",
               status: "TIMED_OUT",
             });
             return { ok: false, code: "SUBMIT_NOT_ADMITTED_TIMEOUT" };
-          }
+          };
+          const remainingMs = deadlineMs - now().getTime();
+          if (deadlineExpired || remainingMs <= 0)
+            return done(await notAdmittedTimeout());
+          const admissionRemainingMs = admissionDeadlineMs - now().getTime();
+          if (admissionRemainingMs <= 0)
+            return { failure: "NOT_ADMITTED", finish: notAdmittedTimeout };
           const retryAfterMs = Number.isFinite(error.retryAfterMs)
             ? Math.max(100, Math.min(5_000, error.retryAfterMs))
             : 1_000;
           await abortablePause(
-            Math.min(retryAfterMs, remainingMs),
+            Math.min(retryAfterMs, admissionRemainingMs),
             controller.signal,
             sleepImpl
           );
@@ -2219,17 +2192,17 @@ export function createCustomerEndpointRelay(options = {}) {
       await append(
         claim,
         identity,
-        {
+        tag({
           kind: "NATIVE_SUBMIT_ACCEPTED",
           requestDigest: submitted.requestDigest,
           nativeRunIdDigest: sha256(submitted.runId),
-        },
+        }),
         ordinal++
       );
       if (held.pendingControl) await queueControl(held.pendingControl);
       let streamed;
       try {
-        streamed = await runs.streamEvents(submitted.runId, {
+        streamed = await stepRuns.streamEvents(submitted.runId, {
           signal: controller.signal,
           onEvent: async (event) => {
             const observedEvent = await holdEndpointUatNativeCompletion({
@@ -2259,7 +2232,7 @@ export function createCustomerEndpointRelay(options = {}) {
                 }
               : observedEvent;
             pendingStreamEvents.push({
-              event: durableEvent,
+              event: tag(durableEvent),
               ordinal: ordinal++,
             });
             const approvalBoundary =
@@ -2283,7 +2256,7 @@ export function createCustomerEndpointRelay(options = {}) {
         }
       }
       if (!terminalEvent && !controller.signal.aborted) {
-        const status = await runs.status(submitted.runId, {
+        const status = await stepRuns.status(submitted.runId, {
           signal: controller.signal,
         });
         if (status.terminal) {
@@ -2300,7 +2273,7 @@ export function createCustomerEndpointRelay(options = {}) {
             late: deadlineExpired || now().getTime() >= deadlineMs,
           };
         } else if (status.ok === false) {
-          await append(claim, identity, status, ordinal++);
+          await append(claim, identity, tag(status), ordinal++);
         }
       }
       if (
@@ -2315,18 +2288,24 @@ export function createCustomerEndpointRelay(options = {}) {
           // Server timeout is already canonical. The committed digest-only
           // late notice above is the sole mutation; never replace timeout with
           // a second completion or expose the late output as canonical.
-          return { ok: true, code: "LATE_NOTICE_ONLY" };
+          return done({ ok: true, code: "LATE_NOTICE_ONLY" });
         }
         const productProjection = endpointProductProjection(
           claim.run.productExecution,
           terminalEvent.output
         );
         if (!productProjection.ok) {
-          await complete(claim, identity, {
-            attemptStatus: "SUCCEEDED",
-            status: "OUTPUT_CONTRACT_FAILED",
-          });
-          return { ok: false, code: "OUTPUT_CONTRACT_FAILED" };
+          // The output was never used, so another model may still write.
+          return {
+            failure: "OUTPUT_CONTRACT_FAILED",
+            finish: async () => {
+              await complete(claim, identity, {
+                attemptStatus: "SUCCEEDED",
+                status: "OUTPUT_CONTRACT_FAILED",
+              });
+              return { ok: false, code: "OUTPUT_CONTRACT_FAILED" };
+            },
+          };
         }
         await complete(claim, identity, {
           attemptStatus: "SUCCEEDED",
@@ -2334,7 +2313,7 @@ export function createCustomerEndpointRelay(options = {}) {
           output: terminalEvent.output,
           ...productProjection.completion,
         });
-        return { ok: true, code: "SUCCEEDED" };
+        return done({ ok: true, code: "SUCCEEDED" });
       }
       if (
         terminalEvent?.classification === "CANCELLED_POSITIVE" ||
@@ -2345,26 +2324,185 @@ export function createCustomerEndpointRelay(options = {}) {
           status: "CANCELLED_PRE_EFFECT",
           positiveCancellation: true,
         });
-        return { ok: true, code: "CANCELLED" };
+        return done({ ok: true, code: "CANCELLED" });
       }
       if (terminalEvent) {
-        await complete(claim, identity, {
-          attemptStatus: "FAILED",
-          status: "FAILED",
-        });
-        return { ok: false, code: "FAILED" };
+        // A native failure carries no output (Claude Code usage limit and
+        // sign-in refusals arrive this way too).
+        return {
+          failure: "NATIVE_FAILED",
+          finish: async () => {
+            await complete(claim, identity, {
+              attemptStatus: "FAILED",
+              status: "FAILED",
+            });
+            return { ok: false, code: "FAILED" };
+          },
+        };
       }
       const deadline = deadlineExpired || now().getTime() >= deadlineMs;
       await complete(claim, identity, {
         attemptStatus: deadline ? "TIMED_OUT_UNCERTAIN" : "UNCERTAIN",
         status: deadline ? "TIMED_OUT_UNCERTAIN" : "UNCERTAIN",
       });
-      return {
+      return done({
         ok: false,
         code:
           streamed?.classification ??
           (deadline ? "TIMED_OUT_UNCERTAIN" : "NATIVE_LOST_UNCERTAIN"),
-      };
+      });
+    };
+    try {
+      if (usesOpenerDraftStrategy(claim) && modelSelection) {
+        // The three-draft stages are pinned to the Codex output-format path in
+        // the Hermes bridge; refuse rather than silently serve the default.
+        await complete(claim, identity, {
+          attemptStatus: "FAILED",
+          status: "FAILED",
+        });
+        return { ok: false, code: "OPENER_STAGE_MODEL_SELECTION_UNSUPPORTED" };
+      }
+      if (usesOpenerDraftStrategy(claim)) {
+        // Phase 206: writers are private native sessions within this one fenced
+        // claim. Only the editor's validated result reaches durable completion.
+        let stageEventChain = Promise.resolve();
+        const appendStageEvent = (event) => {
+          stageEventChain = stageEventChain.then(() =>
+            append(claim, identity, event, ordinal++)
+          );
+          return stageEventChain;
+        };
+        held.openerStages = createOpenerStageExecution({
+          runs,
+          input: claim.run.input,
+          instructions: endpointRunInstructions(claim),
+          outputContract: endpointOpenerOutputContract(claim),
+          correlation: `${claim.attempt.conversationId}:${claim.attempt.runId}:${claim.attempt.id}:${randomUUID()}`,
+          deadlineAt: new Date(deadlineMs),
+          signal: controller.signal,
+          now,
+          validateOutput: (output) =>
+            endpointProductProjection(claim.run.productExecution, output).ok,
+          onSubmitted: async ({ stage, runId, requestDigest }) => {
+            const first = held.nativeRunId === null;
+            held.nativeRunId ??= runId;
+            await appendStageEvent({
+              kind: first
+                ? "NATIVE_SUBMIT_ACCEPTED"
+                : "OPENER_STAGE_SUBMIT_ACCEPTED",
+              stage,
+              requestDigest,
+              nativeRunIdDigest: sha256(runId),
+            });
+            if (held.pendingControl) await queueControl(held.pendingControl);
+          },
+          onReceipt: async (receipt) => {
+            await appendStageEvent({
+              kind: "OPENER_STAGE_COMPLETED",
+              ...receipt,
+            });
+          },
+        });
+        const selected = await held.openerStages.run();
+        const observed = await holdEndpointUatNativeCompletion({
+          control: uatCompletionControl,
+          claim,
+          event: {
+            kind: "RUN_COMPLETED",
+            terminal: true,
+            output: selected.output,
+            outputDigest: selected.outputDigest,
+            timestamp: selected.timestamp,
+            nativeEventIdentity: selected.nativeEventIdentity,
+          },
+          now,
+          sleep: sleepImpl,
+          signal: controller.signal,
+        });
+        const late = deadlineExpired || now().getTime() >= deadlineMs;
+        await append(
+          claim,
+          identity,
+          late
+            ? {
+                kind: "LATE_COMPLETION_NOTICE",
+                outputDigest: observed.outputDigest,
+                timestamp: observed.timestamp,
+                nativeEventIdentity: observed.nativeEventIdentity,
+              }
+            : observed,
+          ordinal++
+        );
+        if (late) return { ok: true, code: "LATE_NOTICE_ONLY" };
+        const projection = endpointProductProjection(
+          claim.run.productExecution,
+          selected.output
+        );
+        if (!projection.ok) throw new Error("OPENER_STAGE_OUTPUT_INVALID");
+        const completion = await complete(claim, identity, {
+          attemptStatus: "SUCCEEDED",
+          status: "SUCCEEDED",
+          output: selected.output,
+          ...projection.completion,
+        });
+        return completion?.accepted === true
+          ? { ok: true, code: "SUCCEEDED" }
+          : { ok: false, code: "OPENER_STAGE_COMPLETION_REJECTED" };
+      }
+      // A step that failed cleanly before producing any output hands the run
+      // to the next model; every other outcome completes this attempt once.
+      // Only when the failed step cannot have changed anything: a product draft
+      // run has no effects by construction, and an endpoint without tools has
+      // nothing to call. Any other run may already have used a tool, so another
+      // model must not repeat the turn.
+      const chainMayAdvance =
+        claim.run.productExecution != null ||
+        (descriptorBinding.expected.allowedToolNames ?? []).length === 0;
+      const history = [];
+      let stepIndex = 0;
+      let stepRuns = runs;
+      for (;;) {
+        const outcome = await runNativeStep(stepIndex, stepRuns);
+        if (outcome.done) return outcome.result;
+        // A stop, a gateway fence or a lost lease (which aborts the
+        // controller) ends the run as a single model would have ended it.
+        const stopRequested =
+          held.stopRequested ||
+          held.pendingControl?.kind === "STOP_PENDING" ||
+          controller.signal.aborted;
+        const decision =
+          stopRequested || !chainMayAdvance
+            ? { advance: false }
+            : nextEndpointChainStep(
+                steps,
+                history,
+                outcome.failure,
+                deadlineMs - now().getTime()
+              );
+        if (!decision.advance) return await outcome.finish();
+        await append(
+          claim,
+          identity,
+          {
+            kind: "CHAIN_STEP_ADVANCED",
+            classification: outcome.failure,
+            chainStep: stepIndex,
+          },
+          ordinal++
+        );
+        history.push(outcome.failure);
+        stepIndex = decision.stepIndex;
+        try {
+          stepRuns = createRunsClient({
+            apiKeyFile,
+            claim: stepClaim(stepIndex),
+            activeRuntime,
+          });
+        } catch {
+          // Nothing was sent for this step; it counts as a clean failure.
+          stepRuns = null;
+        }
+      }
     } catch (error) {
       if (heartbeatFailure) throw heartbeatFailure;
       if (

package/lib/sellable-agent/fly-customer-image/endpoint-model-selection.d.mts

@@ -5,6 +5,7 @@ export const ENDPOINT_MODEL_SELECTION_ALLOWLIST: Readonly<{
     "openai/gpt-6-luna",
     "anthropic/claude-sonnet-5.5",
   ];
+  "openai-codex": readonly ["gpt-6.1-sol"];
 }>;
 export const ENDPOINT_MODEL_REASONING_EFFORTS: readonly [
   "none",
@@ -13,14 +14,60 @@ export const ENDPOINT_MODEL_REASONING_EFFORTS: readonly [
   "high",
   "xhigh",
 ];
-export type EndpointModelSelection = Readonly<{
+export const ENDPOINT_MODEL_MAX_FALLBACKS: 2;
+export type EndpointModelStep = Readonly<{
   provider: string;
   model: string;
   reasoningEffort: (typeof ENDPOINT_MODEL_REASONING_EFFORTS)[number];
   runsApiBaseUrl?: string;
-  fallbackPolicy?: "STOP" | "PRODUCT_DEFAULT";
 }>;
+export type EndpointModelSelection = Readonly<
+  EndpointModelStep & {
+    fallbackPolicy?: "STOP" | "PRODUCT_DEFAULT";
+    fallbacks?: readonly EndpointModelStep[];
+  }
+>;
+export type EndpointChainFailure =
+  | "NATIVE_FAILED"
+  | "OUTPUT_CONTRACT_FAILED"
+  | "NOT_ADMITTED"
+  | "STEP_UNAVAILABLE";
+export type EndpointChainDecision =
+  | Readonly<{
+      advance: true;
+      stepIndex: number;
+      selection: EndpointModelStep;
+    }>
+  | Readonly<{
+      advance: false;
+      reason:
+        | "INVALID"
+        | "NOT_ADVANCEABLE"
+        | "CHAIN_EXHAUSTED"
+        | "NO_TIME_LEFT";
+    }>;
 export function normalizeRunsApiBaseUrl(value: unknown): string | null;
 export function compileEndpointModelSelection(
   value: unknown
 ): EndpointModelSelection | null | "invalid";
+export function endpointModelSelectionChain(
+  selection: unknown
+): EndpointModelStep[];
+export function endpointModelSelectionSource(
+  selection: { provider: string; runsApiBaseUrl?: string } | null | undefined
+): "default" | "openrouter" | "codex" | "custom";
+export const ENDPOINT_CHAIN_STEP_ADMISSION_MS: number;
+export const ENDPOINT_CHAIN_MIN_STEP_MS: number;
+export const ENDPOINT_CHAIN_ADVANCE_FAILURES: readonly EndpointChainFailure[];
+export function nextEndpointChainStep(
+  chain: readonly EndpointModelStep[],
+  history: readonly string[],
+  failure: string,
+  remainingMs?: number
+): EndpointChainDecision;
+export function endpointChainStepAdmissionDeadline(input: {
+  startedAtMs: number;
+  deadlineMs: number;
+  stepIndex: number;
+  stepCount: number;
+}): number;

package/lib/sellable-agent/fly-customer-image/endpoint-model-selection.mjs

@@ -8,6 +8,9 @@ export const ENDPOINT_MODEL_SELECTION_ALLOWLIST = Object.freeze({
     "openai/gpt-6-luna",
     "anthropic/claude-sonnet-5.5",
   ]),
+  // The Agent's own Codex model (model-auth-reconciler.mjs), served by Hermes
+  // per run from the machine's Codex subscription pool.
+  "openai-codex": Object.freeze(["gpt-6.1-sol"]),
 });
 export const ENDPOINT_MODEL_REASONING_EFFORTS = Object.freeze([
   "none",
@@ -16,6 +19,7 @@ export const ENDPOINT_MODEL_REASONING_EFFORTS = Object.freeze([
   "high",
   "xhigh",
 ]);
+export const ENDPOINT_MODEL_MAX_FALLBACKS = 2;
 
 export function normalizeRunsApiBaseUrl(value) {
   if (
@@ -45,39 +49,33 @@ export function normalizeRunsApiBaseUrl(value) {
   }
 }
 
-export function compileEndpointModelSelection(value) {
-  if (value === undefined || value === null) return null;
-  if (typeof value !== "object" || Array.isArray(value)) return "invalid";
+// One model: provider, model, effort and, for a custom Runs API, its URL.
+function compileEndpointModelStep(value, extraKeys = []) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const custom = Object.hasOwn(value, "runsApiBaseUrl");
-  const hasFallbackPolicy = Object.hasOwn(value, "fallbackPolicy");
   if (
     Object.keys(value)
-      .filter((key) => key !== "fallbackPolicy")
+      .filter((key) => !extraKeys.includes(key))
       .sort()
       .join(",") !==
     (custom
       ? "model,provider,reasoningEffort,runsApiBaseUrl"
       : "model,provider,reasoningEffort")
   )
-    return "invalid";
-  if (
-    hasFallbackPolicy &&
-    !["STOP", "PRODUCT_DEFAULT"].includes(value.fallbackPolicy)
-  )
-    return "invalid";
+    return null;
   const { provider, model, reasoningEffort } = value;
   if (
     typeof provider !== "string" ||
     typeof model !== "string" ||
     !ENDPOINT_MODEL_REASONING_EFFORTS.includes(reasoningEffort)
   )
-    return "invalid";
+    return null;
   if (
     !custom &&
     (!Object.hasOwn(ENDPOINT_MODEL_SELECTION_ALLOWLIST, provider) ||
       !ENDPOINT_MODEL_SELECTION_ALLOWLIST[provider].includes(model))
   )
-    return "invalid";
+    return null;
   const runsApiBaseUrl = custom
     ? normalizeRunsApiBaseUrl(value.runsApiBaseUrl)
     : null;
@@ -87,12 +85,150 @@ export function compileEndpointModelSelection(value) {
       !/^[a-z][a-z0-9_-]{0,63}$/.test(provider) ||
       !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,199}$/.test(model))
   )
-    return "invalid";
+    return null;
   return Object.freeze({
     provider,
     model,
     reasoningEffort,
     ...(custom ? { runsApiBaseUrl } : {}),
+  });
+}
+
+const sameStep = (left, right) =>
+  left.provider === right.provider &&
+  left.model === right.model &&
+  left.reasoningEffort === right.reasoningEffort &&
+  left.runsApiBaseUrl === right.runsApiBaseUrl;
+
+/**
+ * The top-level fields are the endpoint's first model. An optional ordered
+ * `fallbacks` list holds up to two more, each a full model choice of its own;
+ * `fallbackPolicy` applies only after every model in the chain has failed.
+ */
+export function compileEndpointModelSelection(value) {
+  if (value === undefined || value === null) return null;
+  if (typeof value !== "object" || Array.isArray(value)) return "invalid";
+  const primary = compileEndpointModelStep(value, [
+    "fallbackPolicy",
+    "fallbacks",
+  ]);
+  if (!primary) return "invalid";
+  const hasFallbackPolicy = Object.hasOwn(value, "fallbackPolicy");
+  if (
+    hasFallbackPolicy &&
+    !["STOP", "PRODUCT_DEFAULT"].includes(value.fallbackPolicy)
+  )
+    return "invalid";
+  let fallbacks = null;
+  if (Object.hasOwn(value, "fallbacks")) {
+    if (
+      !Array.isArray(value.fallbacks) ||
+      value.fallbacks.length < 1 ||
+      value.fallbacks.length > ENDPOINT_MODEL_MAX_FALLBACKS
+    )
+      return "invalid";
+    fallbacks = value.fallbacks.map((step) => compileEndpointModelStep(step));
+    if (
+      fallbacks.some(
+        (step, index) =>
+          !step ||
+          [primary, ...fallbacks.slice(0, index)].some((earlier) =>
+            sameStep(earlier, step)
+          )
+      )
+    )
+      return "invalid";
+  }
+  return Object.freeze({
+    ...primary,
     ...(hasFallbackPolicy ? { fallbackPolicy: value.fallbackPolicy } : {}),
+    ...(fallbacks ? { fallbacks: Object.freeze(fallbacks) } : {}),
   });
 }
+
+/** The models a run tries, in order; empty means the Agent's own default. */
+export function endpointModelSelectionChain(selection) {
+  const compiled = compileEndpointModelSelection(selection);
+  if (!compiled || compiled === "invalid") return [];
+  const { fallbacks = [], fallbackPolicy: _policy, ...primary } = compiled;
+  return [Object.freeze(primary), ...fallbacks];
+}
+
+/** The settings source a model belongs to: Agent default, OpenRouter, Codex or a custom Runs API. */
+export function endpointModelSelectionSource(selection) {
+  if (!selection) return "default";
+  if (selection.runsApiBaseUrl) return "custom";
+  return selection.provider === "openai-codex" ? "codex" : "openrouter";
+}
+
+// A step that cannot be admitted waits this long at most before the next
+// model takes the run. Claude Code runs take 9-15 s, so a busy slot normally
+// frees well inside it.
+export const ENDPOINT_CHAIN_STEP_ADMISSION_MS = 30_000;
+// Starting another model with less time than this left cannot finish it.
+export const ENDPOINT_CHAIN_MIN_STEP_MS = 5_000;
+// A step that failed in one of these ways produced no output, so another
+// model can write without risking a second draft or send.
+export const ENDPOINT_CHAIN_ADVANCE_FAILURES = Object.freeze([
+  "NATIVE_FAILED", // the run failed with no output (incl. Claude Code usage limit or sign-in refusals)
+  "OUTPUT_CONTRACT_FAILED", // its output failed the product contract and was not used
+  "NOT_ADMITTED", // the service stayed busy (429/503) for the step's admission budget
+  "STEP_UNAVAILABLE", // this machine could not open the step's connection; nothing was sent
+]);
+
+/**
+ * Decide whether a run moves to the next model of its chain. `history` holds
+ * the failure classes of the steps already left behind; `failure` is how the
+ * current step ended. Anything not listed in ENDPOINT_CHAIN_ADVANCE_FAILURES
+ * (an ambiguous submit, a lost stream, a stop or cancel, a late completion,
+ * success including a SUPPRESS decision, a timeout) ends the run.
+ */
+export function nextEndpointChainStep(
+  chain,
+  history,
+  failure,
+  remainingMs = Number.POSITIVE_INFINITY
+) {
+  if (
+    !Array.isArray(chain) ||
+    chain.length < 1 ||
+    chain.length > ENDPOINT_MODEL_MAX_FALLBACKS + 1 ||
+    !Array.isArray(history) ||
+    history.length >= chain.length ||
+    history.some((item) => !ENDPOINT_CHAIN_ADVANCE_FAILURES.includes(item))
+  )
+    return Object.freeze({ advance: false, reason: "INVALID" });
+  if (!ENDPOINT_CHAIN_ADVANCE_FAILURES.includes(failure))
+    return Object.freeze({ advance: false, reason: "NOT_ADVANCEABLE" });
+  const stepIndex = history.length + 1;
+  if (stepIndex >= chain.length)
+    return Object.freeze({ advance: false, reason: "CHAIN_EXHAUSTED" });
+  if (!(remainingMs >= ENDPOINT_CHAIN_MIN_STEP_MS))
+    return Object.freeze({ advance: false, reason: "NO_TIME_LEFT" });
+  return Object.freeze({
+    advance: true,
+    stepIndex,
+    selection: chain[stepIndex],
+  });
+}
+
+/**
+ * When a busy step stops waiting for admission. Every step but the last gets
+ * an equal share of the time left, at most ENDPOINT_CHAIN_STEP_ADMISSION_MS;
+ * the last step, like a single model, waits until the attempt deadline.
+ */
+export function endpointChainStepAdmissionDeadline({
+  startedAtMs,
+  deadlineMs,
+  stepIndex,
+  stepCount,
+}) {
+  if (stepIndex >= stepCount - 1) return deadlineMs;
+  const share = Math.floor(
+    (deadlineMs - startedAtMs) / (stepCount - stepIndex)
+  );
+  return Math.min(
+    deadlineMs,
+    startedAtMs + Math.max(0, Math.min(ENDPOINT_CHAIN_STEP_ADMISSION_MS, share))
+  );
+}

package/lib/sellable-agent/fly-customer-image/runs-api-health-check.mjs

@@ -1,7 +1,11 @@
 import { randomUUID } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { pathToFileURL } from "node:url";
-import { compileEndpointModelSelection } from "./endpoint-model-selection.mjs";
+import {
+  compileEndpointModelSelection,
+  endpointModelSelectionChain,
+  endpointModelSelectionSource,
+} from "./endpoint-model-selection.mjs";
 import { createHermesRunsClient } from "./hermes-runs-client.mjs";
 import {
   createConfiguredRunsClient,
@@ -132,8 +136,12 @@ export async function verifyRunsApiSelection(
     !/^[A-Za-z0-9_-]{1,128}$/.test(request.profileId ?? "")
   )
     return result("NOT_CONFIGURED");
-  const selection = compileEndpointModelSelection(request.modelSelection);
-  if (selection === "invalid") return result("NOT_CONFIGURED");
+  const compiled = compileEndpointModelSelection(request.modelSelection);
+  if (compiled === "invalid") return result("NOT_CONFIGURED");
+  // A fallback chain is verified one step per call. The control plane sends
+  // the primary step's check the whole chain, so a machine whose compiler
+  // cannot run a chain refuses it here and no chain is saved for it.
+  const selection = endpointModelSelectionChain(compiled)[0] ?? null;
   let verificationWorkKind = "STANDARD";
   if (selection?.runsApiBaseUrl) {
     const connection = runsApiConnectionsForRuntime(
@@ -156,7 +164,7 @@ export async function verifyRunsApiSelection(
       const readiness = await health(request, { env });
       if (readiness.state !== "READY") return readiness;
     }
-  } else if (request.connectionId !== (selection ? "openrouter" : "default"))
+  } else if (request.connectionId !== endpointModelSelectionSource(selection))
     return result("NOT_CONFIGURED");
   const apiKeyFile =
     env.SELLABLE_AGENT_SERVER_AUTHENTICATED_KIND === "ADMIN"

package/lib/sellable-agent/host-bootstrap.mjs

@@ -38,7 +38,7 @@ import { installAgentHostServices } from "./service-installer.mjs";
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 const VERSION = "sellable-agent-host-bootstrap/v1";
 const RECEIPT_VERSION = "sellable-agent-host-registration/v1";
-const INSTALLER_PACKAGE = "@sellable/install@0.1.801";
+const INSTALLER_PACKAGE = "@sellable/install@0.1.803";
 const MCP_PACKAGE = "@sellable/mcp@0.1.957";
 const HERMES_VERSION = "0.18.0";
 const SHA256 = /^[a-f0-9]{64}$/;

package/lib/sellable-agent/host-worker.mjs

@@ -1546,7 +1546,7 @@ export function compileClaimToProfileDesired(activeClaim, config) {
       ]) ||
       pinned.hermesCli !== "hermes" ||
       pinned.hermesVersion !== "0.18.0" ||
-      pinned.installerPackage !== "@sellable/install@0.1.801" ||
+      pinned.installerPackage !== "@sellable/install@0.1.803" ||
       pinned.mcpPackage !== "@sellable/mcp@0.1.957" ||
       !Array.isArray(policy.toolInclude) ||
       policy.toolInclude.length === 0 ||

package/lib/sellable-agent/profile-materializer.mjs

@@ -312,7 +312,7 @@ function validateDesired(desired) {
     desired.serviceCredentialGeneration < 1 ||
     desired.hermesCli !== "hermes" ||
     desired.hermesVersion !== "0.18.0" ||
-    desired.installerPackage !== "@sellable/install@0.1.801" ||
+    desired.installerPackage !== "@sellable/install@0.1.803" ||
     desired.mcpPackage !== "@sellable/mcp@0.1.957" ||
     !Array.isArray(desired.toolInclude) ||
     desired.toolInclude.length === 0 ||

package/lib/sellable-agent/provisioning-adapter.mjs

@@ -25,7 +25,7 @@ import { fileURLToPath } from "node:url";
 import { deriveContainedProfileId } from "./profile-materializer.mjs";
 
 export const PROVISIONING_ACTION = "PROVISION_HERMES_PROFILE";
-export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.801";
+export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.803";
 export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.957";
 const PINNED_INSTALL_VERSION = PINNED_INSTALL_PACKAGE.slice(
   PINNED_INSTALL_PACKAGE.lastIndexOf("@") + 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.801",
+  "version": "0.1.803",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {