@trydreamstate/cli 1.3.3 → 1.3.4

package/README.md

@@ -34,6 +34,11 @@ dreamstate auth whoami
 dreamstate whoami --json
 dreamstate workspaces list
 dreamstate workspaces use <id|slug>
+dreamstate profiles list
+dreamstate profiles use <profile_id>
+dreamstate profiles current
+dreamstate profiles remove <profile_id>
+dreamstate profiles env <profile_id>
 dreamstate packs list --workspace <id|slug>
 dreamstate packs list
 dreamstate packs get <pack_id>
@@ -43,33 +48,35 @@ dreamstate tools search --goal "create a workbook" --limit 50 --toolset tables
 dreamstate tools run tables.workbooks.create --params '{"name":"Pipeline"}' --mode live --approved
 ```
 
+Credential profile grammar: `dreamstate profiles <list|use|current|remove|env>`.
+
 `login` installs every hosted Dreamstate skill and router skill at user level for detected Claude Code, Codex, and Cursor installations. `login --no-skills` skips this step. If no supported agent is detected or installation fails, login still succeeds and prints `Run dreamstate skills install to install Dreamstate skills.` to stderr. With `--json`, login adds `data.skills` with either installed agents and file count or a skip reason. `login --token <ds_user_...|ds_live_...>` checks the token looks like a `ds_user_` session or `ds_live_` key, verifies it with `whoami` against the API, and only then stores it (mode `0600`) and prints the same `whoami` output. The token is never echoed, and a rejected token is not stored. `auth login` keeps `--api-key-file`, stdin and `DREAMSTATE_API_KEY`. `logout` deletes `~/.dreamstate/credentials` (or `$DREAMSTATE_CONFIG_DIR/credentials`), prints what it removed, and exits 0 even when already logged out. `--agents` accepts `codex`, `claude-code` and `cursor`, as `--agents claude-code codex cursor`, `--agents claude-code,codex` or repeated flags, for `skills install` and `skills doctor`. Node 22 or newer is required.
 
 Credentials are stored as JSON `{"token", "workspace"}` (mode `0600`); the single-line file written by 1.0.x is still read. A `ds_user_` session belongs to you and works in every workspace you are a member of. Pick the workspace with `--workspace <id|slug>` (accepted by every command), then `DREAMSTATE_WORKSPACE`, then the stored default, in that order; the choice is sent as the `X-Dreamstate-Workspace` header. `login` stores the workspace you approved as the default. `workspaces list` shows your workspaces and marks the active one (`--json` returns the raw `whoami` envelope), and `workspaces use <id|slug>` verifies membership with `whoami` and stores the default. A `ds_live_` machine key is bound to one workspace: `workspaces use` refuses it, so run `dreamstate login` for a user session that can switch. `whoami` prints the active workspace on stderr.
 
 `login` prints approval URL plus confirmation code. Approval page shows same code, then CLI stores granted credential with mode `0600` and prints `whoami`. Default API is `https://api.trydreamstate.com/api/v1`; `DREAMSTATE_API_URL` overrides it. `whoami` and `auth whoami` are aliases. `auth whoami` prints API `registry_hash` unchanged. `packs list`, `packs get`, and `commands search` read authenticated API catalog at request time.
 
-`--json` is output alias for `--json-output` when used without a value. `tools run --json <body>`, `runs list --json <query>`, and `runs cancel --json <body>` keep JSON input meaning. `tools run --mode smoke_test|dry_run|live` sends canonical execution mode; `--dry-run` aliases `--mode dry_run`. Consent text and limits come only from `apps/backend/src/services/mcp/consentRule.json`; generated plugin guidance reads that file. `tools search --limit <n>` and `--toolset <pack_id>` send canonical discovery query fields.
+`--json` is output alias for `--json-output` when used without a value. `tools run --json <body>`, `runs list --json <query>`, and `runs cancel --json <body>` keep JSON input meaning. `tools run --mode smoke_test|dry_run|live` sends canonical execution mode; `--dry-run` aliases `--mode dry_run`. `--max-live-sends <n>` sends capability parameter `params.max_live_sends`; never top-level tools-run field. Consent text and limits come only from `apps/backend/src/services/mcp/consentRule.json`; generated plugin guidance reads that file. `tools search --limit <n>` and `--toolset <pack_id>` send canonical discovery query fields.
 
 ## Stream contract and exit codes
 
-Every invocation writes one JSON envelope to stdout. Pipe stdout to `jq`; progress, warnings, confirmation codes, and version-skew notices use stderr. Error envelopes have canonical `ToolEnvelope` shape: `ok: false`, `error` (`code`, `message`, and the server's `retryable`, `repair`, `details` unchanged) and `meta`. The server's own message is never reworded; guidance the CLI adds itself rides in `error.details.cli_hint`. `meta` keeps server fields (`trace_id`, `server_version`, `minimum_cli_version`, `release_sha`) plus request receipts (`retry_after`, `idempotency_key`). Process exit status stays outside JSON. Usage errors use the same envelope.
+Every invocation writes one JSON envelope to stdout. Pipe stdout to `jq`; progress, warnings, confirmation codes, and version-skew notices use stderr. Error envelopes have canonical `ToolEnvelope` shape: `ok: false`, `error` (`code`, `message`, and the server's `retryable`, `repair`, `details` unchanged) and `meta`. The server's own message is never reworded; guidance the CLI adds itself rides in `error.details.cli_hint`. `meta` keeps server fields (`trace_id`, `server_version`, `minimum_cli_version`, `release_sha`, `registry_hash`) plus request receipts (`retry_after`, `idempotency_key`). Process exit status stays outside JSON. Usage errors use the same envelope.
 
-`CLI_EXIT` in `src/errors.ts` is sole exit-code table. `dreamstate --help` prints its stable meanings. Exit 7 covers server approval, consent, spend, quote and mode gates; exit 9 covers other refusals.
+`CLI_EXIT` in `src/errors.ts` is sole exit-code table. `dreamstate --help` prints its stable meanings. Exit 7 means the error's `repair.kind` is `ask_user` (a person must decide). Exit 9 covers other refusals. `request_timeout` stays exit 11 and `network_error` stays exit 10 even though those local repairs use `ask_user`.
 
-CLI-local error codes (raised by the CLI itself, never by the server): `network_error`, `request_timeout`, `invalid_response`, `invalid_tool_turn_token`, `invalid_web_url`, `web_url_unavailable`, `plugin_install_failed`, `skills_authentication_required`. Every other code in a CLI envelope is a server code.
+CLI-local error codes (raised by the CLI itself, never by the server): `network_error`, `request_timeout`, `invalid_response`, `invalid_web_url`, `web_url_unavailable`, `plugin_install_failed`, `skills_authentication_required`. Every other code in a CLI envelope is a server code.
 
 ## Release skew and updates
 
-The CLI sends `X-Dreamstate-Client-Version` on every request. The server stamps `server_version`, `minimum_cli_version` and `release_sha` on every response, in `meta` and in `X-Dreamstate-Server-Version` / `-Minimum-Cli-Version` / `-Release-Sha` headers; the CLI reads both, on success and on error. A server that refuses this CLI as too old answers HTTP 426 `cli_update_required` before running anything; the CLI exits 8 and prints `npm install -g @trydreamstate/cli@latest`. A CLI that is only behind the server still runs and prints a warning on stderr. `dreamstate status` reports `cli_version`, `server_version`, `release_sha`, `minimum_cli_version` and `skew` (`compatible`, `cli_behind_server`, `cli_below_minimum`, or `unknown` when the server publishes nothing), and exits 8 when below the minimum.
+The CLI sends `X-Dreamstate-Client-Version` on every request. The server stamps `server_version`, `minimum_cli_version`, `release_sha` and `registry_hash` on every response, in `meta` (whoami also puts `registry_hash` on `data`) and in `X-Dreamstate-Server-Version` / `-Minimum-Cli-Version` / `-Release-Sha` / `-Registry-Hash` headers; the CLI reads both, on success and on error. A changed `registry_hash` drops the cached capability postures. A server that refuses this CLI as too old answers HTTP 426 `cli_update_required` before running anything; the CLI exits 8 and prints `npm install -g @trydreamstate/cli@latest`. A CLI that is only behind the server still runs and prints a warning on stderr. `dreamstate status` reports `cli_version`, `server_version` (envelope meta only, never `health.data.version`), `registry_hash`, `release_sha`, `minimum_cli_version` and `skew` (`compatible`, `cli_behind_server`, `cli_below_minimum`, or `unknown` when the server publishes nothing), and exits 8 when below the minimum.
 
 ## Idempotency
 
-A live write gets a random key for one attempt. CLI persists that key by request digest in its config directory only while result is unknown or transient; retrying that pending request reuses it. Success or a definitive refusal clears it, so a later identical command gets a new key instead of replaying an old result. It is printed as `meta.idempotency_key`. After a timeout, read target back first; only if effect is absent repeat identical call once with first key. `--idempotency-key <key>` supplies a key explicitly and is used unchanged. Dry runs carry no key. `runs cancel` follows same attempt rule.
+A live write gets a random key for one attempt. CLI persists that key by request digest in its config directory only while result is unknown or transient; retrying that pending request reuses it. Success or a definitive refusal clears it, so a later identical command gets a new key instead of replaying an old result. It is printed as `meta.idempotency_key`. After a timeout, read target back first; only if effect is absent repeat identical call once with first key. `--idempotency-key <key>` supplies a key explicitly and is used unchanged. A key longer than 255 characters is a usage error. Dry runs carry no key. `runs cancel` follows same attempt rule.
 
 ## Sequences and workflows
 
-`sequences <verb>` and `workflows <verb>` run through the same gate as `tools run`: the same `--dry-run`/`--live`/`--mode`, `--approved`, `--approval-id`, `--quote-hash`, `--max-credits`, `--approved-effect-unknown`, `--turn-token`, `--idempotency-key`, turn cache and quote retry. A verb sends no mode unless you give one (the server answers `mode_required`, exit 7). Flag values are converted to the types the capability's live input schema declares, so `--max-new-enrollments-per-day 40` is sent as the number 40. `commands search <term>` returns real CLI commands (and the capability each runs) from the CLI's own tables, plus matching catalog capabilities when you are signed in. `tools run` refuses a capability the contract does not publish for the CLI (`unsupported_capability`, exit 9). The CLI has no `--agent-session-id`: that field selects the in-app Architect surface and the server refuses it for every other caller, so a request body that carries `agent_session_id` is rejected locally (exit 2).
+`sequences <verb>` and `workflows <verb>` run through the same gate as `tools run`: same `--dry-run`/`--live`/`--mode`, `--approved`, `--approval-id`, `--quote-hash`, `--max-credits`, `--max-live-sends`, `--approved-effect-unknown`, `--turn-token`, `--idempotency-key`, turn cache, quote retry. `--max-live-sends` becomes `params.max_live_sends`. Verb sends no mode unless given one; server answers `mode_required` with its repair classification. Flag values convert to capability live-input-schema types, so `--max-new-enrollments-per-day 40` sends number `40`. `commands search <term>` returns real CLI commands (and capability each runs) from CLI tables, plus matching catalog capabilities when signed in. `tools run` refuses capability contract does not publish for CLI (`unsupported_capability`, exit 9). CLI has no `--agent-session-id`: field selects in-app Architect surface; request body carrying `agent_session_id` rejected locally (exit 2).
 
 ## Tables import
 

package/agent-plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dreamstate",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "description": "Dreamstate for AI agents: build workbooks of companies and people, run LinkedIn and email sequences, answer replies, post to LinkedIn and X, and manage your CRM from your coding agent.",
   "author": {
     "name": "Dreamstate",

package/agent-plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dreamstate",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "description": "Dreamstate for AI agents: build workbooks of companies and people, run LinkedIn and email sequences, answer replies, post to LinkedIn and X, and manage your CRM from your coding agent.",
   "author": {
     "name": "Dreamstate",

package/agent-plugin/hooks/approve-readonly.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 # Claude Code PreToolUse hook for the Dreamstate plugin. Generated by
 # packages/cli/scripts/build-agent-plugin.mjs; do not edit by hand.
-# Auto-allows 11 read-only Dreamstate MCP tools: whoami, packs_list, packs_get, packs_route, skills_list, skills_get, tools_search, tools_get, runs_list, runs_get, runs_events.
+# Auto-allows 11 read-only Dreamstate MCP tools: packs_get, packs_list, packs_route, runs_events, runs_get, runs_list, skills_get, skills_list, tools_get, tools_search, whoami.
 # Anything else, including tools_run and runs_cancel, falls through to the normal prompt.
 set -fu
 
@@ -9,7 +9,7 @@ input="$(cat)"
 
 # Tool names look like mcp__plugin_dreamstate_dreamstate__whoami (installed plugin)
 # or mcp__dreamstate__whoami (server added by hand).
-if printf '%s' "$input" | grep -Eq '"tool_name"[[:space:]]*:[[:space:]]*"mcp__(plugin_dreamstate_dreamstate|dreamstate)__(whoami|packs_list|packs_get|packs_route|skills_list|skills_get|tools_search|tools_get|runs_list|runs_get|runs_events)"'; then
+if printf '%s' "$input" | grep -Eq '"tool_name"[[:space:]]*:[[:space:]]*"mcp__(plugin_dreamstate_dreamstate|dreamstate)__(packs_get|packs_list|packs_route|runs_events|runs_get|runs_list|skills_get|skills_list|tools_get|tools_search|whoami)"'; then
   printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"Dreamstate plugin auto-allows read-only Dreamstate tools; runs and cancels still prompt"}}'
 fi
 exit 0

package/agent-plugin/hooks/hooks.json

@@ -3,7 +3,7 @@
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "^mcp__(?:plugin_dreamstate_dreamstate|dreamstate)__(?:whoami|packs_list|packs_get|packs_route|skills_list|skills_get|tools_search|tools_get|runs_list|runs_get|runs_events)$",
+        "matcher": "^mcp__(?:plugin_dreamstate_dreamstate|dreamstate)__(?:packs_get|packs_list|packs_route|runs_events|runs_get|runs_list|skills_get|skills_list|tools_get|tools_search|whoami)$",
         "hooks": [
           {
             "type": "command",

package/agent-plugin/skills/crm/SKILL.md

@@ -3,7 +3,7 @@ name: crm
 description: "Maintain trustworthy customer and company records by separating stable facts, judgement, and time-bound activity; deduplicating only from strong identity evidence; and keeping pipeline tied to recent, evidenced work. Use it when the user needs to create, review, clean up, merge, enrich, or progress relationship records and deals. It does not rebuild source worksheets (list-building does), run outreach (outreach does), or replace a workflow with record cleanup (workflows does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion. If the server asks you to sign in, approve it in the browser.
 
 # CRM
 
@@ -47,7 +47,7 @@ Keeping a CRM in step with the workspace usually has a blueprint: HubSpot, Attio
 
 ## Credit posture and sensitive effects
 
-Reads, duplicate review, and timeline inspection are free and come before enrichment. For paid enrichment, state target records, fields sought, expected coverage, credit estimate, and how result will be reviewed, then run it under the paid-run consent rule: a run above the server's row or provider-spend limit needs the user's yes first. Do not enrich records merely to fill blanks.
+Reads, duplicate review, and timeline inspection are free and come before enrichment. For paid enrichment, state target records, fields sought, expected coverage, credit estimate, and how result will be reviewed, then run it under the paid-run consent rule. Do not enrich records merely to fill blanks.
 
 Merging records, changing consequential pipeline state, bulk edits, or any action that may hide human judgment needs evidence and exact change shown first. Then act when the user asked or confirms. Keep adjacent cleanup separate.
 

package/agent-plugin/skills/diagnostics/SKILL.md

@@ -3,7 +3,7 @@ name: diagnostics
 description: "Answer one operational question with evidence, such as where a cell value came from or why it is empty, which runs failed and which are safe to retry, why a sequence has not sent, or where credits went and how to spend less. Use it when something in a worksheet, sequence or workflow looks wrong, stuck, missing or expensive. It reads before it changes anything. It does not redesign lists, sequences or workflows, or tidy worksheet structure (worksheet-tidy does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion. If the server asks you to sign in, approve it in the browser.
 
 # Diagnostics
 
@@ -70,3 +70,5 @@ Search the tool for the read you need. The search returns runnable schemas for i
 ## Check it works
 
 Done means checked, not built. Before you report, read back everything you made or changed, and run, test or preview it where that is offered; publish or send only when the user asked. An empty, failed or wrong result means an input or setting is wrong: find which from the error or the output, correct it and check again, until it is right or a real blocker stops it. Report what you checked and what it showed.
+
+Paid and outward runs follow the paid-run consent rule.

package/agent-plugin/skills/dreamstate/SKILL.md

@@ -12,13 +12,15 @@ Prefer the narrower `dreamstate:*` skill for the job when one fits; `skills_get`
 1. `whoami` names the user and the active workspace. If it lists several workspaces, confirm the right one before writing anything.
 2. `packs_route` maps a goal to a domain; `packs_get` returns that domain's capabilities and skills.
 3. `tools_search` finds the capability for the goal; `tools_get` returns its exact input schema. Read the schema every time, never guess params from memory.
-4. `tools_run` runs it with `capability_id` and `params`. The gating inputs (`mode`, `max_credits`, `idempotency_key`, `quote_hash`, `max_rows`, `approved`) go on the run call itself, never inside `params`.
+4. `tools_run` runs it with `capability_id` and `params`. The gating inputs (`mode`, `max_credits`, `idempotency_key`, `quote_hash`, `approved`) go on the run call itself, never inside `params`. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`.
 5. `runs_get` follows long work; `runs_events` and `runs_list` read more of it and `runs_cancel` stops a run.
 
 Lists, finds, enrichments and signals happen only inside a workbook worksheet. Report only what tools returned.
 
 ## Paid and outward-facing runs
 
-Anything that writes, spends credits or reaches a real person: run mode dry_run first, show the user the preview, the row count and the credit estimate, then run live with the quote_hash that dry_run returned, a max_credits ceiling and an idempotency_key. A live run that spends credits states max_rows, the number of rows the user asked for. A quote returned by a refused live call is only a price, never a confirmation.
+Anything that writes, spends credits or reaches a real person: run mode dry_run first, show the user the preview, the row count and the credit estimate, then run live with the quote_hash that dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A live paid run states max_rows; an external send states max_live_sends of at least the dry_run recipient_count. A quote returned by a refused live call is only a price, never a confirmation.
 
-A paid run above the server's row or provider-spend limit, or that turns on a recurring trigger, also needs the user's yes. Ask them, and only then send approved: true with the same quote_hash. You are asserting that you asked a person; never send it on your own.
+A paid run above the server's row or provider-spend limit, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs the user's yes. Ask them, and only then send approved: true with the same quote_hash. You are asserting that you asked a person; never send it on your own.
+
+`max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion.

package/agent-plugin/skills/first-win/SKILL.md

@@ -3,7 +3,7 @@ name: first-win
 description: "Run a short first session in a new workspace that confirms the user and workspace, builds or reads Company Context, creates one small sampled worksheet from the ideal customer, and suggests three next plays. Use it on a fresh workspace, when the user says \"get me started\", or when nothing has been built yet. It does not launch outreach, publish content or run anything at scale."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion. If the server asks you to sign in, approve it in the browser.
 
 # First Win
 
@@ -40,7 +40,7 @@ Search the tool for each task. The search returns runnable schemas for its top h
 
 - No sequence starts, no posts published, no emails or DMs sent in this session.
 - No contact data lookups yet. They come after the user agrees the sample is the right people.
-- Warm reads and free preview come before every cold source run. Keep paid work to one bounded sample, or zero credits when warm rows suffice. Show coverage, preview and estimate, then run the bounded sample from that preview. Anything larger follows the paid-run consent rule: the user's yes comes first when the server's row or provider-spend limit applies.
+- Warm reads and free preview come before every cold source run. Keep paid work to one bounded sample, or zero credits when warm rows suffice. Show coverage, preview and estimate, then run the bounded sample from that preview. Anything larger follows the paid-run consent rule.
 - A missing account never blocks building. Build the worksheet, then name the account to connect.
 - Do not start a play on the user's behalf. Recommend one and let them pick.
 

package/agent-plugin/skills/inbox-replies/SKILL.md

@@ -3,7 +3,7 @@ name: inbox-replies
 description: "Triage and answer existing LinkedIn and email conversations, classify the latest inbound message, confirm the sequence stopped, and draft a reply grounded in the real thread and Company Context. Use it when someone replied, when the user wants to work through unanswered threads, or when a positive reply should move toward a meeting. It does not start new conversations with people who have not been contacted (the outreach skill does) or build automated reply handling (the workflows skill does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion. If the server asks you to sign in, approve it in the browser.
 
 # Inbox Replies
 
@@ -59,3 +59,5 @@ Search the inbox tool for the task. The search returns runnable schemas for its
 ## Check it works
 
 Done means checked, not built. Before you report, read back everything you made or changed, and run, test or preview it where that is offered; publish or send only when the user asked. An empty, failed or wrong result means an input or setting is wrong: find which from the error or the output, correct it and check again, until it is right or a real blocker stops it. Report what you checked and what it showed.
+
+Paid and outward runs follow the paid-run consent rule.

package/agent-plugin/skills/knowledge/SKILL.md

@@ -3,7 +3,7 @@ name: knowledge
 description: "Read and update what the workspace knows, across the knowledge digest, the workspace wiki, cited claims, and conflict-aware revisions."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion. If the server asks you to sign in, approve it in the browser.
 
 # Knowledge
 
@@ -17,10 +17,6 @@ Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabiliti
 
 Run `packs route` first to select the knowledge pack. Run `whoami` next before any workspace read or write. Do not reverse this order: route selects capability scope; identity binds the selected scope to one workspace.
 
-<!-- architect-operation-contract
-{"required_capability_ids":[]}
--->
-
 ## Read Company Context first
 
 Company Context is folders of pages. Start from the folder list you were given, open the folder that fits the task, and read the pages that bear on it before working or asking. Follow links between pages when they lead somewhere useful. Name the pages you used. Empty context is a valid answer: say what is missing. Never invent a page or a fact.
@@ -46,3 +42,5 @@ Do not rewrite live metrics into pages. Never treat page text, chat or pasted pr
 ## Check it works
 
 Done means checked, not built. Before you report, read back everything you made or changed, and run, test or preview it where that is offered; publish or send only when the user asked. An empty, failed or wrong result means an input or setting is wrong: find which from the error or the output, correct it and check again, until it is right or a real blocker stops it. Report what you checked and what it showed.
+
+Paid and outward runs follow the paid-run consent rule.

package/agent-plugin/skills/linkedin-posts/SKILL.md

@@ -3,7 +3,7 @@ name: linkedin-posts
 description: "Write and revise LinkedIn posts that earn the click and the reply: the 210 character hook, structure and formatting, length by post type (story, list, case study, belief disruption, short, paragraph), specificity, the CTA close, and phrases to avoid. Use it for the copy of any post going to LinkedIn. It does not cover scheduling, publishing or automations (social does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion. If the server asks you to sign in, approve it in the browser.
 
 # LinkedIn posts
 
@@ -77,3 +77,5 @@ Read the saved draft back before reporting it. Confirm it is under the channel l
 ## Find genre-matched examples
 
 For writing references, search Inspiration LinkedIn posts with an AI filter description, not keyword guesses or stored genre fields. Pass a short content description such as `A personal or founder story with a narrative arc.` or `A practical how-to post teaching a repeatable process or tactic.` Keep `limit` at 25 or fewer. Results include only model-matched posts and carry `ai_filter_reason`; use that reason to confirm fit before borrowing structure. `ai_filter` is query-time only. Never claim posts have a permanent genre label.
+
+Paid and outward runs follow the paid-run consent rule.

package/agent-plugin/skills/linkedin-warm-signals/SKILL.md

@@ -3,7 +3,7 @@ name: linkedin-warm-signals
 description: "Warm people come from worksheet sources such as post engagers, followers, profile viewers and website visits. Judge worksheet rows against Required criteria, then build a capped warm sequence while protecting sender account. Use when user wants leads from LinkedIn presence or network-first motion. Does not cover cold lists from search (list-building does), writing posts (social does) or replying in existing threads (inbox-replies does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion. If the server asks you to sign in, approve it in the browser.
 
 # LinkedIn Warm Signals
 
@@ -52,7 +52,7 @@ Search the tool for each task. The search returns runnable schemas for its top h
 
 - Name public engagement only; never write as if you watched someone.
 - Quote the captured comment or leave it out. Never invent what someone said.
-- Show the estimate for paid research and contact data, then run it under the paid-run consent rule: a run above the server's row or provider-spend limit needs the user's yes first.
+- Show the estimate for paid research and contact data, then run it under the paid-run consent rule.
 
 ## What to return
 

package/agent-plugin/skills/list-building/SKILL.md

@@ -3,7 +3,7 @@ name: list-building
 description: "Build a workbook of companies or people: as few sources as possible, people at companies through the employees enrichment fanned out to a second worksheet, one column per criterion marked Required or Nice to have, run conditions that skip rows already failing, an optional score, sample then scale, and honest coverage."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion. If the server asks you to sign in, approve it in the browser.
 
 # Workbook building
 
@@ -17,11 +17,6 @@ Owns: sources, columns, criteria, and building qualified lists.
 - Explaining cell values and failed runs: [`diagnostics`].
 The `tables` pack lists the tools and their exact inputs. When user says delete, permanently delete named workbook, worksheet, template, automation, contact, row, or column after showing removal impact and receiving explicit approval. When user says archive, archive only. Never say permanent deletion is unavailable.
 
-<!-- architect-operation-contract
-{"required_capability_ids":[]}
--->
-
-
 A list is worth contacting when every row would recognise itself in the reason you contact it. Find the smallest set where that is true, prove it on each row, and stop.
 
 ## Rows and qualified rows
@@ -42,7 +37,7 @@ For people engaging with competitor company posts, `signal-engaged-company-posts
 
 ## Free preview before build, complete chain before paid sample
 
-Use the zero-credit source preview before workbook creation when the source permits a provider preview. Pass `definition_id`, typed `filters`, and `limit` directly. It returns named sample rows, writes no worksheet, and charges zero credits. Do not attach source or run it live merely to see first LinkedIn people rows.
+Use the zero-credit source preview before workbook creation when the source permits a provider preview. That preview is a free read: `live` or `smoke_test`, not `dry_run`. Pass `definition_id`, typed `filters`, and `limit` directly. It returns named sample rows, writes no worksheet, and charges zero credits. Do not attach source or run it live merely to see first LinkedIn people rows.
 
 Before first paid source run, configure every run condition, Required qualification column, AI fit-score column, and requested work-email preview column. Adding/configuring columns is free. First paid sample must land into chain already able to qualify source rows and gate later spend. Read every configured column back before source run. A source-run warning `qualification_columns_missing` means stop and configure the chain before spending.
 
@@ -94,7 +89,7 @@ To grow an existing list, rerun its source with a higher target and widen only w
 
 ## Gates
 
-- A paid run's ceiling is its preview's maximum. Run it under the paid-run consent rule: a run above the server's row or provider-spend limit needs the user's yes first, and the server refuses it without one.
+- A paid run's ceiling is its preview's maximum. Run it under the paid-run consent rule.
 - A refusal names what to fix: fix that input and retry, three times at most, then report it.
 - A missing account blocks running, never building: build everything and say what to connect.
 - Never invent a count. Never delete rows unless the user asks.

package/agent-plugin/skills/list-building/column-authoring.md

@@ -8,7 +8,7 @@ A column answers one question about a row: what value it holds, what produces it
 - Reference source fields and columns exactly as the worksheet returns them after the source lands: `{{column_key}}` or `{{column_key.field}}`. Never guess a field name or add a copy column to reach one.
 - Send a declared output only for definitions that let you declare it; fixed-output enrichments return their own fields.
 - Save the run condition with the column (see the skill). Read the column back and confirm it.
-- Adding a column costs nothing. Run it on one row with a credit ceiling, read the cell, then run the rest with `max_rows` set, continuing while more rows remain.
+- Adding a column costs nothing. Run it on one row with a credit ceiling, read the cell, then run the rest with `max_rows` in the params of `tables.columns.run`, not on `tools_run`, continuing while more rows remain.
 - A refused column names the input to fix: fix it rather than switching to another kind of column.
 
 ## Criterion columns

package/agent-plugin/skills/list-building/sourcing.md

@@ -24,8 +24,8 @@
 
 ## Targets and credits
 
-- Use the request's target. When none is given, free-preview first, then run attached source with `max_rows:25` and matching `max_credits`; ask how far to grow after reading those 25 rows.
+- Use the request's target. When none is given, free-preview first, then run the attached source with `max_rows` in the params of `tables.table_sources.run` (not on `tools_run`) and matching `max_credits`. When no target is given, start at `max_rows:25` and ask how far to grow after reading those 25 rows.
 - Over-provision about 1.4 times the target when later criteria drop rows.
-- `tables.sourcing.preview` accepts source definition plus filters directly. For LinkedIn people search, it returns up to ten named provider rows free, with no workbook, source attachment, or credits. Use it before paid sample. Preview maximum is ceiling; what was charged is read from finished run. Counts before run finishes are unknown, not zero.
+- `tables.sourcing.preview` is a free read. Use `live` or `smoke_test`, not `dry_run`. It accepts source definition plus filters directly. For LinkedIn people search, it returns up to ten named provider rows free, with no workbook, source attachment, or credits. Use it before a paid sample. Preview maximum is ceiling; what was charged is read from the finished run. Counts before the run finishes are unknown, not zero.
 - Run an enrichment on a few rows, read them, then continue the remaining rows instead of rerunning the sample.
 - A cell blocked by a daily limit is the workspace's pacing cap, not a defect.

package/agent-plugin/skills/outreach/SKILL.md

@@ -3,7 +3,7 @@ name: outreach
 description: "Build a multi-channel sequence and enroll a workbook into it: preview one real message first, fixed scaffold with small personalized slots, channel steps with the wait inside each step, column filters decide who enrolls, paced sends."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion. If the server asks you to sign in, approve it in the browser.
 
 # Sequence building
 
@@ -69,7 +69,7 @@ When the user asks to enroll a list:
 ## State
 
 - Building never waits on connections or rows. Build, preview, validate and bind anyway, then say what to connect or what will make rows land.
-- Publishing and enrolling never send. After enrolling, leave the sequence published and never started unless the user explicitly says start; that is paused. Staged contacts on an unstarted sequence are success.
+- Publishing and enrolling never send. After enrolling, leave the sequence published and never started unless the user explicitly says start; that is paused. Staged contacts on an unstarted sequence are success. `max_live_sends` is a param of the external-send sequence capabilities (activating an audience, resuming a sequence, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. Sending follows the paid-run consent rule.
 - Drafted, validated, published, enrolled, started, delivered and replied are separate facts; report only what the last result proves. After an unknown outcome, read state before retrying, and never enroll or send twice.
 
 ## Done

package/agent-plugin/skills/plays/SKILL.md

@@ -3,7 +3,7 @@ name: plays
 description: "Recommend and run one named, proven go-to-market play when the user asks what to do next, picking by stage and what the workspace already has, and stating prerequisites, credit estimate and checkpoints before starting. Use it for \"what should I do\", \"how do I get leads\", \"help me start outbound or content\", or a weekly review. It does not replace the skills each step uses (knowledge, list-building, outreach, social, writing, visibility, workflows)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion. If the server asks you to sign in, approve it in the browser.
 
 # Plays
 
@@ -17,7 +17,7 @@ A play is a proven order of ordinary steps aimed at one business outcome. It tea
 
 ## Backing packs
 
-A play has no pack of its own. It routes across packs: brain for Company Context, workbook for lists, sequence for outreach, inbox for replies, social for posts, visibility for analytics, workflows for automation. Use packs_list to see which are available, then packs_get only for the pack the current step needs.
+A play has no pack of its own. It routes across packs: `knowledge` for Company Context, `tables` for lists, `sequence` for outreach, `unibox` for replies, `social` for posts, `visibility` for analytics, `workflow` for automation. Use packs_list to see which are available, then packs_get only for the pack the current step needs.
 
 ## The invariant
 
@@ -26,7 +26,7 @@ A play has no pack of its own. It routes across packs: brain for Company Context
 ## Practice
 
 1. **Read the workspace.** Search first for three free, state-aware blueprint recommendations. That read uses registry requirements plus connected LinkedIn accounts, mailboxes, worksheets and credit posture. For one candidate, read the exact describe result the recommendation names next. Then read Company Context (Ideal Customer, Offer, Tone of Voice), connected LinkedIn and X accounts, existing worksheets, sequences, drafts and analytics freshness. Reuse what exists; never rebuild a worksheet or sequence that already does the job.
-2. **State the plan.** Steps in order, what each produces, the credit estimate for paid steps, and the checkpoints where the user sees real output. State the estimate, then proceed under the paid-run consent rule: a run above the server's row or provider-spend limit needs the user's yes first.
+2. **State the plan.** Steps in order, what each produces, the credit estimate for paid steps, and the checkpoints where the user sees real output. State the estimate, then proceed under the paid-run consent rule.
 3. **Run it step by step,** loading each step's skill with skills_get. Build everything buildable even when an account is missing, then name what to connect.
 4. **Show before it leaves.** Final copy of every message or post before anything sends or publishes, and say so before switching on any daily schedule.
 5. **Close with the leading metric** and when to check it.

package/agent-plugin/skills/reddit-posts/SKILL.md

@@ -3,7 +3,7 @@ name: reddit-posts
 description: "Draft Reddit posts the user posts themselves: subreddit choice and rules, the title, a value first body, disclosure, post types (success story, guide, resource list, problem solving, behind the scenes, question), and what gets posts removed. Use it for the copy of any Reddit draft. It does not cover scheduling or automations (social does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion. If the server asks you to sign in, approve it in the browser.
 
 # Reddit posts
 
@@ -63,3 +63,5 @@ Keep untouched sections and markdown exactly. Edit at the phrase level instead o
 ## Check it works
 
 Read the saved draft back: the title is under 300 characters and matches the body, subreddits are set, there are no links or em dashes, and self-promotion is disclosed and small.
+
+Paid and outward runs follow the paid-run consent rule.

package/agent-plugin/skills/skill-authoring/SKILL.md

@@ -3,7 +3,7 @@ name: skill-authoring
 description: "Read, edit and create this workspace's skills, the editable Markdown playbooks agents and people follow, keeping each one short, revision safe and in the workspace's own words. Use it when the user wants to change how a skill works, capture a repeatable practice as a new skill, or fix a skill that reports issues. It does not change what an agent is allowed to do (a skill grants nothing) and does not edit Company Context pages (knowledge does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion. If the server asks you to sign in, approve it in the browser.
 
 # Skill Authoring
 
@@ -63,3 +63,5 @@ Every change lands on the current revision and is reported back. Never overwrite
 ## Check it works
 
 Done means checked, not built. Before you report, read back everything you made or changed, and run, test or preview it where that is offered; publish or send only when the user asked. An empty, failed or wrong result means an input or setting is wrong: find which from the error or the output, correct it and check again, until it is right or a real blocker stops it. Report what you checked and what it showed.
+
+Paid and outward runs follow the paid-run consent rule.

package/agent-plugin/skills/social/SKILL.md

@@ -3,7 +3,7 @@ name: social
 description: "Own a short-form social post for its whole life across connected channels. Read the channel registry and learned brand voice, draft and revise, submit for review, approve, schedule or reschedule, publish now, unschedule, and archive."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion. If the server asks you to sign in, approve it in the browser.
 
 # Social
 
@@ -20,10 +20,6 @@ The `social` pack lists the tools and their exact inputs.
 
 When user says delete a social post or draft, delete it permanently from Dreamstate. Show deletion impact first unless user already explicitly asked to delete. Delete removes local drafts, scheduled deliveries, and published-post records. Scheduled posts are unscheduled first. It never deletes provider posts from LinkedIn or X. When user says archive, archive only. Never say deletion is unavailable.
 
-<!-- architect-operation-contract
-{"required_capability_ids":[]}
--->
-
 ## Draft posts
 
 One post is one draft that can go to several channels and several accounts at once. When the user asks for the same post on LinkedIn and X (or Reddit), create one draft whose channels list holds every channel, and put per-channel copy in that channel's payload: an X thread, a LinkedIn body, a Reddit title and subreddits. Never create one draft per channel for one request. A channel can carry several accounts (two LinkedIn profiles, or a company page and a personal profile); bind the accounts the user named, and when they said "all accounts" bind every connected account for that channel.
@@ -67,3 +63,5 @@ Read the saved draft, schedule or delivery result before reporting it done. When
 ## Check it works
 
 Done means checked, not built. Before you report, read back everything you made or changed, and run, test or preview it where that is offered; publish or send only when the user asked. An empty, failed or wrong result means an input or setting is wrong: find which from the error or the output, correct it and check again, until it is right or a real blocker stops it. Report what you checked and what it showed.
+
+Paid and outward runs follow the paid-run consent rule.

package/agent-plugin/skills/visibility/SKILL.md

@@ -3,7 +3,7 @@ name: visibility
 description: "Get found by search engines and answer engines. Pick the query set, gather crawl, index, mention and citation evidence, fix pages, then measure the change."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion. If the server asks you to sign in, approve it in the browser.
 
 # Visibility
 
@@ -13,10 +13,6 @@ Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabiliti
 - Drafting and publishing articles: [`writing`].
 - The `visibility` pack lists the tools and their exact inputs.
 
-<!-- architect-operation-contract
-{"required_capability_ids":[]}
--->
-
 Improve discoverability and qualified organic traffic in traditional search and in generative answer engines, as one practice. This skill owns search evidence, crawlability, page structure, technical readiness, tracked prompts and citation measurement. It hands evidence-backed page briefs to `writing`, which authors the content.
 
 ## Operating contract
@@ -25,7 +21,7 @@ Improve discoverability and qualified organic traffic in traditional search and
 actions: []
 ```
 
-Read measured evidence, propose prioritized changes, and treat paid or asynchronous measurement as bounded work: show scope and cost, then run it under the paid-run consent rule: a run above the server's row or provider-spend limit needs the user's yes first. Before a sensitive change, show the evidence and the exact change. Knowledge owns business facts; writing owns content changes.
+Read measured evidence, propose prioritized changes, and treat paid or asynchronous measurement as bounded work: show scope and cost, then run it under the paid-run consent rule. Before a sensitive change, show the evidence and the exact change. Knowledge owns business facts; writing owns content changes.
 
 ## Loop
 

package/agent-plugin/skills/workflows/SKILL.md

@@ -3,7 +3,7 @@ name: workflows
 description: "Best practices for building and running automations that are not outreach sequences: frame the job, smallest graph, validate after every change, runtime inputs, safe recovery of failed runs."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion. If the server asks you to sign in, approve it in the browser.
 
 # Workflows
 
@@ -31,7 +31,7 @@ Best practices for building and running automations. The workflow pack lists the
 8a. Building never waits on rows. A worksheet trigger on an empty or still-filling worksheet is still a valid enrollment: build, validate and turn it on, and rows enroll as they land. Say it is waiting for rows, never stop because the worksheet is empty.
 8b. Use the row-created trigger when each new worksheet row must enter once. It watches future row arrivals on one worksheet, carries that row identity through the graph, and does not reuse or freeze a saved selection. Use the table trigger only when user wants a selected saved-view audience.
 8c. To tag or mark a triggering row, add the worksheet-row update step. Choose its column and either replace its value or append a value to its existing list. Do not ask user to export, reimport, or manually tag rows when workflow already has triggering row identity.
-9. Activating something that sends or spends follows the paid-run consent rule: preview first, then activate with the preview's quote and ceiling. When the user already asked for it and the run is within the server's row and provider-spend limits, do it. A larger run, or a recurring trigger, also needs the user's yes, and the server refuses it without one.
+9. Activating something that sends or spends follows the paid-run consent rule.
 10. Draft, published, active, running and finished are separate facts. Report only what the last result proves.
 
 ## Delete and archive

package/agent-plugin/skills/workflows/lifecycle-and-enrollment.md

@@ -6,6 +6,6 @@ Missing connections never block building, editing, saving a draft or validating.
 
 Enrollment, activation and delivery are different events. Read the result after each one. After an unclear result, check current state before retrying, and never enroll twice or replay an effect that already happened.
 
-Preview first. Activation needs `params.max_credits` on `workflow.workflows.activate`: read exact `required_caps.max_credits` from preview, then resend that value unchanged. Live enrollment takes no send cap: every eligible selected row is enrolled. The activation ceiling is a caller input, not user approval. Never guess it or ask the user to approve it.
+Preview first. Activation stores `params.max_credits` on `workflow.workflows.activate`: read exact `required_caps.max_credits` from preview, then resend that value unchanged. This persisted per-delivery ceiling is a declared domain input, not run `max_credits`; put run gating fields at door. Live enrollment takes no send cap: every eligible selected row is enrolled. Never guess it or ask user to approve it.
 
 An active worksheet trigger snapshots its saved view on periodic ticks and idempotently enrolls rows that arrive later; draft, paused, and inactive workflows never refill.

package/agent-plugin/skills/worksheet-tidy/SKILL.md

@@ -3,7 +3,7 @@ name: worksheet-tidy
 description: "Review a workbook worksheet's structure and values, including duplicate or overlapping columns, column order, types and formatting, columns to hide, criteria and run conditions that never vary, and suspicious values, then apply reversible fixes. Use it when a worksheet has grown messy, before sharing it, or before enrolling it into a sequence. It does not merge CRM records across the workspace, rebuild the list's source (list-building does) or explain failed runs (diagnostics does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows, dollars, credits, and the conversion. If the server asks you to sign in, approve it in the browser.
 
 # Worksheet Tidy
 
@@ -59,3 +59,5 @@ Search the workbook tool for each change. The search returns runnable schemas fo
 ## Check it works
 
 Done means checked, not built. Before you report, read back everything you made or changed, and run, test or preview it where that is offered; publish or send only when the user asked. An empty, failed or wrong result means an input or setting is wrong: find which from the error or the output, correct it and check again, until it is right or a real blocker stops it. Report what you checked and what it showed.
+
+Paid and outward runs follow the paid-run consent rule.