@sellable/mcp 0.1.374 → 0.1.376

package/README.md

@@ -16,10 +16,11 @@ Each message gets 5+ minutes of Claude attention with deep research - no other t
 
 ### Prompt Source Of Truth
 
-There are five public Sellable entrypoints shared across hosts:
+There are six public Sellable entrypoints shared across hosts:
 
 - `sellable:create-campaign`
 - `sellable:create-ab-test`
+- `sellable:create-evergreen-campaigns`
 - `sellable:foundation`
 - `sellable:content`
 - `sellable:create-post`
@@ -35,6 +36,11 @@ review-copy campaigns from:
 
 - `mcp/sellable/skills/create-ab-test/SKILL.md`
 
+The create-evergreen-campaigns public wrapper reconciles standing evergreen
+campaign lanes and loads the command-backed setup workflow from:
+
+- `mcp/sellable/skills/create-evergreen-campaigns/SKILL.md`
+
 The foundation public wrapper loads the core identity/company memory workflow
 from:
 
@@ -179,9 +185,11 @@ The installer does the full local setup:
 
 After the installer passes, fully quit and reopen Codex Desktop. Start a new
 thread and select `Sellable Create Campaign`, `Sellable Create A/B Test`,
-`Sellable Foundation`, `Sellable Content`, or `Sellable Create Post`; or invoke
+`Sellable Create Evergreen Campaigns`, `Sellable Foundation`,
+`Sellable Content`, or `Sellable Create Post`; or invoke
 `$sellable:create-campaign`, `$sellable:create-ab-test`,
-`$sellable:foundation`, `$sellable:content`, or `$sellable:create-post`. If the app still says
+`$sellable:create-evergreen-campaigns`, `$sellable:foundation`,
+`$sellable:content`, or `$sellable:create-post`. If the app still says
 `mcp__sellable__*` tools are missing after the installer passes, check that
 `~/.codex/config.toml` contains both `[marketplaces.sellable]` and
 `[plugins."sellable@sellable"]`.
@@ -194,22 +202,26 @@ Use these names consistently:
 
 - Claude Code command: `/sellable:create-campaign`
 - Claude Code command: `/sellable:create-ab-test`
+- Claude Code command: `/sellable:create-evergreen-campaigns`
 - Claude Code command: `/sellable:foundation`
 - Claude Code command: `/sellable:content`
 - Claude Code command: `/sellable:create-post`
 - Codex command: `$sellable:create-campaign`
 - Codex command: `$sellable:create-ab-test`
+- Codex command: `$sellable:create-evergreen-campaigns`
 - Codex command: `$sellable:foundation`
 - Codex command: `$sellable:content`
 - Codex command: `$sellable:create-post`
 - Codex Desktop plugin: `sellable@sellable`
 - Codex visible skill: `Sellable Create Campaign`
 - Codex visible skill: `Sellable Create A/B Test`
+- Codex visible skill: `Sellable Create Evergreen Campaigns`
 - Codex visible skill: `Sellable Foundation`
 - Codex visible skill: `Sellable Content`
 - Codex visible skill: `Sellable Create Post`
 - Codex skill frontmatter name: `create-campaign`
 - Codex skill frontmatter name: `create-ab-test`
+- Codex skill frontmatter name: `create-evergreen-campaigns`
 - Codex skill frontmatter name: `foundation`
 - Codex skill frontmatter name: `content`
 - Codex skill frontmatter name: `create-post`

package/dist/tools/setup-evergreen-campaigns.js

@@ -6,7 +6,7 @@ async function postSetupEvergreenCampaigns(body) {
 export const setupEvergreenCampaignsToolDefinitions = [
     {
         name: "setup_evergreen_campaigns",
-        description: "Evergreen campaign setup plan/verify command. Use plan mode first to inspect exact workspace/sender/campaign/table/source state and receive immutable lane packets. `selectedSenderIds` is a legacy shorthand for both scopes; prefer `postEngagerSenderIds` for the Post Engagers sender scope and `sharedSenderIds` for the shared lane sender scope when they differ. The command plans one Post Engagers lane per post-engager sender plus shared Signal Discovery and Shared Cold Fallback lanes for the shared sender set. yolo is only a parent-skill auto-execution hint for safe lane packets; this backend command remains read-only in plan mode and verifies receipts in verify mode. Each lane packet includes workerDispatch with acceptedRuntimes, rejectedRuntimes, requiresVisibleThreadOrDurableReceipt, and receiptArtifactHint; `multi_agent_v1.spawn_agent`/opaque spawn_agent is not accepted for mutating command proof unless the parent has visible thread or durable receipt proof. In local Codex, call `codex_app.list_projects` first, then `codex_app.create_thread` with a local project target; do not create a worktree for lane execution. When safe-yolo needs normal setup work, the parent skill may ask for bounded delegated approval: one approval over the current planRevision, selected action ids, caps, allowed side-effect classes, and stop conditions lets lane workers execute without per-substep approval while staying inside that packet. Lane workers must explicitly load and use the installed `$sellable:create-campaign` wrapper as the nested workflow entrypoint, then load `create-campaign-v2` and `create-campaign-v2/core/flow.v2.json`; they must execute creation, source import, create-campaign workflow steps, generate-messages, sequence attachment, pause_campaign review-state transition when the current table is still DRAFT, and review readiness through that existing create-campaign workflow/subskills, then return receipts here for verification. Customer-visible verify receipts must set status:'succeeded' or status:'completed'; status:'passed', status:'pass', and status:'passed_with_warnings' are rejected as primary success statuses. Receipts must include createCampaignStepReceipt with setupPlanCall, createCampaignWorkflowReceipt, campaignBriefReceipt, sourceDecisionReceipt, filterDecisionReceipt, messageDraftingReceipt, reviewBatchReceipt, sequenceReceipt, and verifyCall nested inside createCampaignStepReceipt; top-level-only copies of those objects are not enough and are not promoted by verify. setupPlanCall must use canonical keys: planRevision, actionId, laneKey, workspaceId, senderIds, campaignId, tableId, createIntent. Do not use laneActionId, lanePacketActionId, delegatedPlanRevision, delegatedActionId, or requestedCall text as a substitute for those canonical fields. createCampaignWorkflowReceipt must include skillCommand:'$sellable:create-campaign', skillName:'create-campaign', wrapperSkillLoaded:true, workflowPromptName:'create-campaign-v2', workflowPromptLoadedToHasMoreFalse:true, workflowAssetPath:'create-campaign-v2/core/flow.v2.json', workflowAssetLoaded:true, workerRuntime, workerThreadId or receiptArtifactPath, durableReceiptWritten when using a receipt file, and notAdHoc:true. messageDraftingReceipt must use exactly statusSource:'branch' or statusSource:'packaged-generate-messages-worker'; descriptive aliases such as statusSource:'package-readback-local-thread' are rejected. It must include proof that generate-messages was loaded, start_campaign_message_preparation/get_campaign_message_preparation_status ran when the packaged worker path is used, validationResult:'passed', a passed qualityReview, and at least 3 concrete sampleMessages with rowId, generatedMessageText, verdict, and issues; Do not substitute `message` for `generatedMessageText`; Do not substitute `passVerdict` for `verdict`. Before writing durable receipts, run a receipt self-check: top-level `planRevision`, `actionId`, `laneKey`, `laneType`, `workspaceId`, and `senderIds` must exist; if the self-check fails, fix the receipt before ending. Use start_campaign_message_preparation with approvalMode:\"mark_ready\" only for evergreen setup. Never call `start_campaign_message_preparation` with `approvalMode:\"approve\"`; approve exactly one semantic Approved cell through select_campaign_cells/update_cell and final proof must show approvedGeneratedMessageCount exactly 1. Shared Cold Fallback samples with a standalone name followed by 'Hey there' are rejected. This command does not launch campaigns, does not schedule sends, does not assign scheduler-owned send fields, does not raw-write campaign status, does not archive/delete cleanup targets, and does not spend paid credits.",
+        description: "Evergreen campaign setup plan/verify command. Use plan mode first to inspect exact workspace/sender/campaign/table/source state and receive immutable lane packets. `selectedSenderIds` is a legacy shorthand for both scopes; prefer `postEngagerSenderIds` for the Post Engagers sender scope and `sharedSenderIds` for the shared lane sender scope when they differ. The command plans one Post Engagers lane per post-engager sender plus shared Signal Discovery and Shared Cold Fallback lanes for the shared sender set. yolo is only a parent-skill auto-execution hint for safe lane packets; this backend command remains read-only in plan mode and verifies receipts in verify mode. Package-backed prompt authority: lane workers must use get_subskill_prompt and get_subskill_asset for `$sellable:create-campaign`, create-campaign-v2, generate-messages, and assets; filesystem prompt fallback is a failed UAT. Use mcp__sellable only for workspace selection and product mutations/readbacks. Do not use mcp__sellable_admin, direct DB, Prisma, or SQL as execution proof. Worker-local replans are read-only drift checks and must preserve the exact parent sender scopes, including postEngagerSenderIds:[] when intentionally empty and the exact sharedSenderIds array; if scope, planRevision, actionId, or laneKey drifts, stop with blocked:worker_plan_scope_drift before mutation. Each lane packet includes workerDispatch with acceptedRuntimes, rejectedRuntimes, requiresVisibleThreadOrDurableReceipt, receiptArtifactHint, receiptRunId, and receiptMustBeWrittenAfter; pre-existing receipts at old deterministic paths are stale and must not be used, so stop with blocked:stale_receipt_artifact if the receipt was not freshly written for the current receiptRunId. `multi_agent_v1.spawn_agent`/opaque spawn_agent is not accepted for mutating command proof unless the parent has visible thread or durable receipt proof. In local Codex, call `codex_app.list_projects` first, then `codex_app.create_thread` with a local project target; do not create a worktree for lane execution. When safe-yolo needs normal setup work, the parent skill may ask for bounded delegated approval: one approval over the current planRevision, selected action ids, caps, allowed side-effect classes, and stop conditions lets lane workers execute without per-substep approval while staying inside that packet. Lane workers must explicitly load and use the installed `$sellable:create-campaign` wrapper as the nested workflow entrypoint, then load `create-campaign-v2` and `create-campaign-v2/core/flow.v2.json`; they must execute creation, source import, create-campaign workflow steps, generate-messages, sequence attachment, pause_campaign review-state transition when the current table is still DRAFT, and review readiness through that existing create-campaign workflow/subskills, then return receipts here for verification. Customer-visible verify receipts must set status:'succeeded' or status:'completed'; status:'passed', status:'pass', and status:'passed_with_warnings' are rejected as primary success statuses. Receipts must include createCampaignStepReceipt with setupPlanCall, createCampaignWorkflowReceipt, campaignBriefReceipt, sourceDecisionReceipt, filterDecisionReceipt, messageDraftingReceipt, reviewBatchReceipt, sequenceReceipt, and verifyCall nested inside createCampaignStepReceipt; top-level-only copies of those objects are not enough and are not promoted by verify. setupPlanCall must use canonical keys: planRevision, actionId, laneKey, workspaceId, senderIds, campaignId, tableId, createIntent. Do not use laneActionId, lanePacketActionId, delegatedPlanRevision, delegatedActionId, or requestedCall text as a substitute for those canonical fields. createCampaignWorkflowReceipt must include skillCommand:'$sellable:create-campaign', skillName:'create-campaign', wrapperSkillLoaded:true, workflowPromptName:'create-campaign-v2', workflowPromptLoadedToHasMoreFalse:true, workflowAssetPath:'create-campaign-v2/core/flow.v2.json', workflowAssetLoaded:true, workerRuntime, workerThreadId or receiptArtifactPath, durableReceiptWritten when using a receipt file, and notAdHoc:true. messageDraftingReceipt must use exactly statusSource:'branch' or statusSource:'packaged-generate-messages-worker'; descriptive aliases such as statusSource:'package-readback-local-thread' are rejected. It must include proof that generate-messages was loaded, start_campaign_message_preparation/get_campaign_message_preparation_status ran when the packaged worker path is used, validationResult:'passed', a passed qualityReview, and at least 3 concrete sampleMessages with rowId, generatedMessageText, verdict, and issues; Do not substitute `message` for `generatedMessageText`; Do not substitute `passVerdict` for `verdict`. Before writing durable receipts, run a receipt self-check: top-level `planRevision`, `actionId`, `laneKey`, `laneType`, `workspaceId`, and `senderIds` must exist; if the self-check fails, fix the receipt before ending. Use start_campaign_message_preparation with approvalMode:\"mark_ready\" only for evergreen setup. Never call `start_campaign_message_preparation` with `approvalMode:\"approve\"`; approve exactly one semantic Approved cell through select_campaign_cells/update_cell and final proof must show approvedGeneratedMessageCount exactly 1. Shared Cold Fallback samples with a standalone name followed by 'Hey there' are rejected. This command does not launch campaigns, does not schedule sends, does not assign scheduler-owned send fields, does not raw-write campaign status, does not archive/delete cleanup targets, and does not spend paid credits.",
         inputSchema: {
             type: "object",
             properties: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/mcp",
-  "version": "0.1.374",
+  "version": "0.1.376",
   "type": "module",
   "description": "Sellable MCP server for Claude Code and Codex campaign workflows",
   "main": "dist/index.js",

package/skills/create-evergreen-campaigns/SKILL.md

@@ -73,6 +73,29 @@ readback, and setup plan/verify results. If MCP surfaces disagree on counts or
 state, record the discrepancy and resolve or explain the canonical gate before
 reporting the command complete.
 
+Package-backed prompt authority: when this command or any lane worker says to
+load `$sellable:create-campaign`, `create-campaign-v2`, `generate-messages`, or
+any referenced workflow asset, the package-backed MCP loaders are the source of
+truth. Use `get_subskill_prompt` and `get_subskill_asset` until `hasMore:false`.
+Do not locate, open, read, or summarize local skill files from repo paths,
+installed plugin cache paths, or any filesystem shortcut. Do not use repo-local,
+plugin-cache, or filesystem `SKILL.md` files as workflow authority, even when a
+session header shows a path. If package-backed prompt or asset loaders are not
+callable, stop with `blocked: package_prompt_loader_unavailable`; filesystem
+prompt fallback is a failed UAT and is not proof that the packaged command works.
+Short form: Do not use repo-local, plugin-cache, or filesystem `SKILL.md`.
+Short form: filesystem prompt fallback is a failed UAT.
+
+Package-backed tool surface: use `mcp__sellable` only for workspace selection,
+campaign/table/source/message mutations, and product-visible readbacks. Do not
+use `mcp__sellable_admin`, admin workspace setters, direct DB tools, Prisma, or
+SQL as part of command execution proof. Before any worker mutation, record
+normal-surface workspace proof with
+`set_active_workspace({ workspaceId, userConfirmed:true })` or the equivalent
+`mcp__sellable` call, then reread the active workspace.
+Short form: mcp__sellable only.
+Short form: Do not use `mcp__sellable_admin`.
+
 Plan shape:
 
 - one Post Engagers lane per sender in the **Post Engagers sender scope**;
@@ -154,6 +177,20 @@ execution boundary, not guidance. Read and preserve `workerDispatch.acceptedRunt
 `workerDispatch.rejectedRuntimes`, and `workerDispatch.receiptArtifactHint`
 before dispatch.
 
+Worker-local replans are read-only drift checks, never a replacement execution
+basis. The parent planRevision, selectedActionIds, actionId, laneKey, workspace
+id, and sender scopes remain authoritative for the worker receipt. If a worker
+calls `setup_evergreen_campaigns({ mode:"plan", ... })` before mutation, that
+call must include the exact original sender scopes from the parent plan,
+including `postEngagerSenderIds:[]` when the Post Engagers scope is intentionally
+empty, and the exact `sharedSenderIds` array. If a worker-local plan omits
+`postEngagerSenderIds:[]`, changes `sharedSenderIds`, returns a different
+planRevision/actionId/laneKey, or introduces any Post Engagers lane outside the
+parent packet, do not mutate and do not use it as `setupPlanCall` proof; stop
+with `blocked: worker_plan_scope_drift` and ask the parent to re-plan.
+Short form: If a worker-local plan omits `postEngagerSenderIds:[]`, do not use it as `setupPlanCall` proof.
+Short form: stop with `blocked: worker_plan_scope_drift`.
+
 Worker fan-out must use visible or durable execution. Preferred in local Codex
 is a visible Codex thread created with the actual Codex app thread tools:
 first call `codex_app.list_projects`, select the current repo project, then
@@ -162,8 +199,18 @@ environment:{type:"local"}}`. Do not create a worktree target for evergreen
 UAT or lane execution. The parent must record the returned thread id, pass
 exactly one lane packet into that thread, and require the worker to write the
 lane receipt at the artifact path named by
-`workerDispatch.receiptArtifactHint`. A streaming worker or branch worker is
-acceptable only when it writes a durable per-lane receipt artifact as it works.
+`workerDispatch.receiptArtifactHint`. That path is run-specific and must include
+the packet's `workerDispatch.receiptRunId`. Before dispatch, if a file already
+exists at the hinted path, do not trust or verify it; move it aside or choose the
+fresh hinted path from a new plan. A valid receipt must be written after
+`workerDispatch.receiptMustBeWrittenAfter`, reread by the parent after the
+worker exits, and contain the current `planRevision`, `actionId`, `laneKey`,
+`receiptArtifactPath`, and `durableReceiptWritten:true`. If a receipt predates
+the current run, uses an old path without `receiptRunId`, or was not freshly
+written by the current worker, stop with `blocked: stale_receipt_artifact`
+before parent verify or completion. A streaming worker or branch worker is
+acceptable only when it writes a fresh durable per-lane receipt artifact as it
+works.
 `multi_agent_v1.spawn_agent`, raw `spawn_agent`, or any opaque Task/subagent
 runtime that cannot expose a visible thread id or durable receipt artifact is
 not accepted as command-level UAT proof and must not be used for mutating
@@ -329,7 +376,7 @@ verification unless the same object also appears inside
       "workflowAssetLoaded": true,
       "workerRuntime": "separate-codex-thread",
       "workerThreadId": "<visible local Codex thread id>",
-      "receiptArtifactPath": ".planning/artifacts/uat/69/lane-receipts/<planRevision>/<actionId>-<laneKey>.json",
+      "receiptArtifactPath": ".planning/artifacts/uat/69/lane-receipts/<planRevision>/<receiptRunId>/<actionId>-<laneKey>.json",
       "durableReceiptWritten": true,
       "notAdHoc": true
     },