@sellable/mcp 0.1.369 → 0.1.371

package/dist/tools/setup-evergreen-campaigns.js

@@ -6,7 +6,7 @@ async function postSetupEvergreenCampaigns(body) {
 export const setupEvergreenCampaignsToolDefinitions = [
     {
         name: "setup_evergreen_campaigns",
-        description: "Evergreen campaign setup plan/verify command. Use plan mode first to inspect exact workspace/sender/campaign/table/source state and receive immutable lane packets. `selectedSenderIds` is a legacy shorthand for both scopes; prefer `postEngagerSenderIds` for the Post Engagers sender scope and `sharedSenderIds` for the shared lane sender scope when they differ. The command plans one Post Engagers lane per post-engager sender plus shared Signal Discovery and Shared Cold Fallback lanes for the shared sender set. yolo is only a parent-skill auto-execution hint for safe lane packets; this backend command remains read-only in plan mode and verifies receipts in verify mode. Each lane packet includes workerDispatch with acceptedRuntimes, rejectedRuntimes, requiresVisibleThreadOrDurableReceipt, and receiptArtifactHint; `multi_agent_v1.spawn_agent`/opaque spawn_agent is not accepted for mutating command proof unless the parent has visible thread or durable receipt proof. When safe-yolo needs normal setup work, the parent skill may ask for bounded delegated approval: one approval over the current planRevision, selected action ids, caps, allowed side-effect classes, and stop conditions lets lane workers execute without per-substep approval while staying inside that packet. Lane workers must explicitly load and use the installed `$sellable:create-campaign` wrapper as the nested workflow entrypoint, then load `create-campaign-v2` and `create-campaign-v2/core/flow.v2.json`; they must execute creation, source import, create-campaign workflow steps, generate-messages, sequence attachment, pause_campaign review-state transition when the current table is still DRAFT, and review readiness through that existing create-campaign workflow/subskills, then return receipts here for verification. Customer-visible verify receipts must set status:'succeeded' or status:'completed' and must include createCampaignStepReceipt with setupPlanCall, createCampaignWorkflowReceipt, campaignBriefReceipt, sourceDecisionReceipt, filterDecisionReceipt, messageDraftingReceipt, reviewBatchReceipt, sequenceReceipt, and verifyCall nested inside createCampaignStepReceipt; top-level-only copies of those objects are not enough. createCampaignWorkflowReceipt must include skillCommand:'$sellable:create-campaign', skillName:'create-campaign', wrapperSkillLoaded:true, workflowPromptName:'create-campaign-v2', workflowPromptLoadedToHasMoreFalse:true, workflowAssetPath:'create-campaign-v2/core/flow.v2.json', workflowAssetLoaded:true, workerRuntime, workerThreadId or receiptArtifactPath, durableReceiptWritten when using a receipt file, and notAdHoc:true. messageDraftingReceipt must use statusSource:'branch' or statusSource:'packaged-generate-messages-worker' and include proof that generate-messages was loaded, start_campaign_message_preparation/get_campaign_message_preparation_status ran when the packaged worker path is used, validationResult:'passed', a passed qualityReview, and at least 3 concrete sampleMessages with row ids, generated message text, pass verdicts, and no issues; Shared Cold Fallback samples with a standalone name followed by 'Hey there' are rejected. This command does not launch campaigns, does not schedule sends, does not assign scheduler-owned send fields, does not raw-write campaign status, does not archive/delete cleanup targets, and does not spend paid credits.",
+        description: "Evergreen campaign setup plan/verify command. Use plan mode first to inspect exact workspace/sender/campaign/table/source state and receive immutable lane packets. `selectedSenderIds` is a legacy shorthand for both scopes; prefer `postEngagerSenderIds` for the Post Engagers sender scope and `sharedSenderIds` for the shared lane sender scope when they differ. The command plans one Post Engagers lane per post-engager sender plus shared Signal Discovery and Shared Cold Fallback lanes for the shared sender set. yolo is only a parent-skill auto-execution hint for safe lane packets; this backend command remains read-only in plan mode and verifies receipts in verify mode. Each lane packet includes workerDispatch with acceptedRuntimes, rejectedRuntimes, requiresVisibleThreadOrDurableReceipt, and receiptArtifactHint; `multi_agent_v1.spawn_agent`/opaque spawn_agent is not accepted for mutating command proof unless the parent has visible thread or durable receipt proof. When safe-yolo needs normal setup work, the parent skill may ask for bounded delegated approval: one approval over the current planRevision, selected action ids, caps, allowed side-effect classes, and stop conditions lets lane workers execute without per-substep approval while staying inside that packet. Lane workers must explicitly load and use the installed `$sellable:create-campaign` wrapper as the nested workflow entrypoint, then load `create-campaign-v2` and `create-campaign-v2/core/flow.v2.json`; they must execute creation, source import, create-campaign workflow steps, generate-messages, sequence attachment, pause_campaign review-state transition when the current table is still DRAFT, and review readiness through that existing create-campaign workflow/subskills, then return receipts here for verification. Customer-visible verify receipts must set status:'succeeded' or status:'completed' and must include createCampaignStepReceipt with setupPlanCall, createCampaignWorkflowReceipt, campaignBriefReceipt, sourceDecisionReceipt, filterDecisionReceipt, messageDraftingReceipt, reviewBatchReceipt, sequenceReceipt, and verifyCall nested inside createCampaignStepReceipt; top-level-only copies of those objects are not enough. createCampaignWorkflowReceipt must include skillCommand:'$sellable:create-campaign', skillName:'create-campaign', wrapperSkillLoaded:true, workflowPromptName:'create-campaign-v2', workflowPromptLoadedToHasMoreFalse:true, workflowAssetPath:'create-campaign-v2/core/flow.v2.json', workflowAssetLoaded:true, workerRuntime, workerThreadId or receiptArtifactPath, durableReceiptWritten when using a receipt file, and notAdHoc:true. messageDraftingReceipt must use statusSource:'branch' or statusSource:'packaged-generate-messages-worker' and include proof that generate-messages was loaded, start_campaign_message_preparation/get_campaign_message_preparation_status ran when the packaged worker path is used, validationResult:'passed', a passed qualityReview, and at least 3 concrete sampleMessages with rowId, generatedMessageText, verdict, and issues; Do not substitute `message` for `generatedMessageText`; Do not substitute `passVerdict` for `verdict`. Before writing durable receipts, run a receipt self-check: top-level `planRevision`, `actionId`, `laneKey`, `laneType`, `workspaceId`, and `senderIds` must exist; if the self-check fails, fix the receipt before ending. Use start_campaign_message_preparation with approvalMode:\"mark_ready\" only for evergreen setup. Never call `start_campaign_message_preparation` with `approvalMode:\"approve\"`; approve exactly one semantic Approved cell through select_campaign_cells/update_cell and final proof must show approvedGeneratedMessageCount exactly 1. Shared Cold Fallback samples with a standalone name followed by 'Hey there' are rejected. This command does not launch campaigns, does not schedule sends, does not assign scheduler-owned send fields, does not raw-write campaign status, does not archive/delete cleanup targets, and does not spend paid credits.",
         inputSchema: {
             type: "object",
             properties: {
@@ -75,7 +75,7 @@ export const setupEvergreenCampaignsToolDefinitions = [
                     type: "array",
                     maxItems: 20,
                     items: { type: "object" },
-                    description: "Required for verify. Structured lane worker receipts from create-campaign/source/message/sequence execution. Customer-visible lanes must use status:'succeeded' or status:'completed' and include createCampaignStepReceipt with setupPlanCall, createCampaignWorkflowReceipt, campaignBriefReceipt, sourceDecisionReceipt, filterDecisionReceipt, messageDraftingReceipt, reviewBatchReceipt, sequenceReceipt, and verifyCall nested inside createCampaignStepReceipt. createCampaignWorkflowReceipt proves the lane worker loaded `$sellable:create-campaign`, `create-campaign-v2`, and `create-campaign-v2/core/flow.v2.json`; it must also include a visible workerThreadId or durable receiptArtifactPath with durableReceiptWritten:true. top-level-only proof copies are not enough.",
+                    description: "Required for verify. Structured lane worker receipts from create-campaign/source/message/sequence execution. Customer-visible lanes must use status:'succeeded' or status:'completed' and include createCampaignStepReceipt with setupPlanCall, createCampaignWorkflowReceipt, campaignBriefReceipt, sourceDecisionReceipt, filterDecisionReceipt, messageDraftingReceipt, reviewBatchReceipt, sequenceReceipt, and verifyCall nested inside createCampaignStepReceipt. createCampaignWorkflowReceipt proves the lane worker loaded `$sellable:create-campaign`, `create-campaign-v2`, and `create-campaign-v2/core/flow.v2.json`; it must also include a visible workerThreadId or durable receiptArtifactPath with durableReceiptWritten:true. messageDraftingReceipt.sampleMessages must use rowId, generatedMessageText, verdict, and issues. top-level-only proof copies are not enough.",
                 },
             },
             required: [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/mcp",
-  "version": "0.1.369",
+  "version": "0.1.371",
   "type": "module",
   "description": "Sellable MCP server for Claude Code and Codex campaign workflows",
   "main": "dist/index.js",

package/skills/create-evergreen-campaigns/SKILL.md

@@ -63,6 +63,16 @@ immediately with `blocked: setup_evergreen_campaigns_unavailable`. Do not fall
 back to ad hoc create-campaign calls, inventory-only guesses, or direct shell
 creation when the command-backed plan is missing.
 
+MCP/product-visible proof only: every success claim must be observable through
+the installed Sellable MCP tools and product-visible readbacks a normal user or
+agent can access. Do not inspect the product database directly to prove success.
+Direct SQL, Prisma, or DB snapshots are diagnostic only; they are not success proof for command completion. Receipts must cite MCP tool calls, command
+responses, prompt/asset loads, and product-visible readbacks such as campaign
+context, campaign message preview, table rows, cell selectors, sequence
+readback, and setup plan/verify results. If MCP surfaces disagree on counts or
+state, record the discrepancy and resolve or explain the canonical gate before
+reporting the command complete.
+
 Plan shape:
 
 - one Post Engagers lane per sender in the **Post Engagers sender scope**;
@@ -252,6 +262,22 @@ not a parent-thread summary. The receipt must include:
   planRevision, selectedActionIds, receipts })` call/result used before the
   parent reports completion.
 
+Before writing the durable receipt, run a receipt self-check. The top-level
+receipt must include top-level `planRevision`, `actionId`, `laneKey`,
+`laneType`, `workspaceId`, and `senderIds`, plus campaign/table/source ids and
+row/message/approval counts. Inside
+`createCampaignStepReceipt.messageDraftingReceipt`, `sampleMessages[]` must
+include `rowId`, `generatedMessageText`, `verdict`, and `issues`. Do not
+substitute `message` for `generatedMessageText`. Do not substitute
+`passVerdict` for `verdict`. If the self-check fails, fix the receipt before
+ending; do not leave the parent to infer canonical fields from top-level
+aliases or narrative text.
+Self-check shorthand: top-level `planRevision`, `actionId`, `laneKey`, `laneType`, `workspaceId`, and `senderIds` must exist before worker completion.
+Self-check shorthand: `sampleMessages[]` must include `rowId`, `generatedMessageText`, `verdict`, and `issues`.
+Self-check shorthand: Do not substitute `message` for `generatedMessageText`.
+Self-check shorthand: Do not substitute `passVerdict` for `verdict`.
+Self-check shorthand: If the self-check fails, fix the receipt before ending.
+
 Use these canonical receipt leaf names exactly. Do not substitute looser aliases
 like `generateMessagesPromptLoad`, `requiredAssetLoads`,
 `validationPromptLoad`, `reviewBatchBasisHash`, `reviewRowIds`,
@@ -392,12 +418,24 @@ path itself in the worker thread:
    targetPreparedMessages, maxRowsToCheck, approvalMode:"mark_ready",
    autoContinue:true })` inside the same lane worker, with bounded caps from the
    lane packet.
+   Never call `start_campaign_message_preparation` with `approvalMode:"approve"`
+   for evergreen setup. Generate/readiness and approval are separate safety
+   steps: first mark rows ready, then inspect generated copy, then approve
+   exactly one semantic Approved cell through `select_campaign_cells` and
+   `update_cell`.
+   Approval shorthand: approve exactly one semantic Approved cell.
 4. Poll `get_campaign_message_preparation_status` until no queued/active cells
    remain or a bounded stop reason is returned.
 5. Use `get_campaign_messages_preview` or `select_campaign_cells` to inspect
    generated rows, quality-review at least 3 samples, approve exactly one
    quality-valid route-proof row when none is already approved, and prove no
    broad approve-all happened.
+   If a packaged worker or earlier run left more than one generated row
+   approved, set any extra approved cells back to false through semantic
+   Approved-cell selection before completion. Final proof must show
+   approvedGeneratedMessageCount exactly 1. Do not report completion with 2+
+   approved rows.
+   Approval shorthand: Do not report completion with 2+ approved rows.
 6. Continue to `attach_recommended_sequence({ campaignId, currentStep:"send" })`
    and, if the campaign is still `DRAFT`, `pause_campaign({ campaignId })`.
    Reread the campaign/table before claiming completion.