agentlinkops 0.6.9 → 0.6.10

package/references/portable-ledger-handoff.md

@@ -0,0 +1,50 @@
+# Portable ledger handoff
+
+Capability: local draft-only file. Native vendor acceptance: untested. No network
+or messages. Workspace/project identities are supplied by the customer and are
+not verified against hosted grants by this helper.
+
+Run the CLI's frozen report first:
+
+```sh
+agentlinkops report --json --as-of 2026-09-30T12:00:00Z --out report.json
+python3 scripts/portable-handoff.py --report report.json --mapping mapping.json --out handoff.json
+```
+
+Use your own observation cutoff, rather than copying this example's date.
+`mapping.json` requires version 1, workspace_id, project_id, site (an explicit URL),
+destination `portable-file`, source_report_sha256 and records. Compute the report
+hash from JSON encoded with sorted keys, compact separators and UTF-8; the helper's
+`digest` function defines it. This local command prints the value:
+
+```sh
+python3 -c 'import hashlib,json; r=json.load(open("report.json")); print(hashlib.sha256(json.dumps(r,sort_keys=True,separators=(",",":"),ensure_ascii=False).encode()).hexdigest())'
+```
+
+Each records key is an actual local ledger ID, with
+external_id, reply (`unknown`, `none`, `replied`) and suppression (`unknown`,
+`suppressed`, `clear`). Supply these from your own tools; an empty field never
+means permission to send. Every report row needs an explicit mapping. Unknown
+customer IDs must stay unknown; do not fabricate a mapping to make export pass.
+
+The handoff carries the original report state, observation date and evidence block,
+including any hash and locator, plus a stable operation ID. Notes and optional
+commercial references are not copied. `ref` is private by default in the report;
+this helper uses your explicit mapping instead. Identical reruns read the original
+file. A different report, site or existing output refuses before replacement.
+Keep a distinct output for a new snapshot; this is a dated artifact, not a monitor.
+
+Read the saved JSON back before claiming persistence. Its destination outcome is
+`not_attempted`, and `send_eligible` remains false on every row. Passing this helper
+does not prove a CRM import or sequencer readback. Follow the
+[qualified campaign handoff](recipes/qualified-campaign-handoff.md) for explicit
+mapping, original-operation reconciliation and destination readback. After a
+response-lost import, preserve its actual operation identity and unknown outcome;
+do not replace it with this file's operation ID or repeat a create to repair an
+artifact error. [Placement reconciliation](recipes/placement-reconciliation.md)
+keeps monitoring facts apart from sent/replied/suppressed records.
+
+Package invocation assumes the plugin's root directory. Local source invocation
+uses toolkit/plugin/agentlinkops/scripts/portable-handoff.py. Unsupported native
+vendors, mailbox access and automatic suppression synchronization remain outside
+this helper. No account, credential or send action is installed by it.

package/references/recipes/catalog.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": 1,
   "kind": "agentlinkops_recipe_catalog",
-  "version": "1.0.5",
-  "reviewedAt": "2026-09-20",
+  "version": "1.0.8",
+  "reviewedAt": "2026-10-06",
   "convention": "AgentLinkOps package convention; not an industry schema",
   "recipes": [
     {
       "id": "site-context-brief",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "path": "site-context-brief.md",
       "goals": [
         "build-content",
@@ -35,7 +35,7 @@
     },
     {
       "id": "sourced-linkable-asset",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "path": "sourced-linkable-asset.md",
       "goals": [
         "build-content"
@@ -62,7 +62,7 @@
     },
     {
       "id": "qualified-campaign-handoff",
-      "version": "1.0.5",
+      "version": "1.0.7",
       "path": "qualified-campaign-handoff.md",
       "goals": [
         "prepare-campaign"
@@ -89,7 +89,7 @@
     },
     {
       "id": "placement-reconciliation",
-      "version": "1.0.4",
+      "version": "1.0.5",
       "path": "placement-reconciliation.md",
       "goals": [
         "verify-links"
@@ -127,21 +127,21 @@
       "title": "Campaign guidance",
       "publisher": "AgentLinkOps",
       "publicationDate": null,
-      "reviewedAt": "2026-09-13",
+      "reviewedAt": "2026-10-06",
       "url": "../../skills/agentlinkops-campaigns/SKILL.md"
     },
     {
       "title": "Asset guidance",
       "publisher": "AgentLinkOps",
       "publicationDate": null,
-      "reviewedAt": "2026-09-13",
+      "reviewedAt": "2026-10-06",
       "url": "../../skills/agentlinkops-assets/SKILL.md"
     },
     {
       "title": "Recipe command notes",
       "publisher": "AgentLinkOps",
       "publicationDate": "2026-09-20",
-      "reviewedAt": "2026-09-20",
+      "reviewedAt": "2026-10-06",
       "url": "command-notes.md"
     }
   ]

package/references/recipes/command-notes.md

@@ -1,9 +1,25 @@
 # Recipe command notes
 
+Source review: October 6, 2026. The selection guidance below describes maintained source; package and client release acceptance are separate. Older published versions may lack these flags. Inspect `agentlinkops --help` before using them.
+
 `agentlinkops setup --plan --goal verify-links|prepare-campaign|build-content --mode local|hosted|external` inspects known workspace paths and returns a plan. It does not connect an account or change records.
 
 `agentlinkops check --source SOURCE_URL --target TARGET_URL --scope exact --json` checks one supplied pair. Exit zero means it returned a result; read the structured observation to determine presence and evidence limits.
 
 A ledger check exits one when an expected link is observed absent with complete evidence. Unknown results do not establish removal. Usage or configuration errors supply no new observation. Other commands and flags have their own exit rules; inspect `agentlinkops --help` and the returned result.
 
-Continue with [placement reconciliation](placement-reconciliation.md) or the [site brief](site-context-brief.md). These notes describe the packaged CLI behavior reviewed on September 20, 2026.
+The plan and check behavior above retains the CLI review from September 20, 2026.
+
+## Optional writing and review guidance
+
+Use the customer's chosen source, editorial and review process. Selecting a recipe does not select the packaged content skills. If the customer chooses that pack's writing method, explicitly select each required stage:
+
+```sh
+agentlinkops agent setup --skill source-cited-content-builder --skill source-cited-humanizer --skill content-defingerprinting --skill internal-linking-optimizer --skill pre-publish-review
+```
+
+Alternatively, choose `agentlinkops agent setup --all-skills` when the customer wants the complete pack. Read the selected skills and follow their own rules, including the separate editorial pass and final-text scan. Keep reviews tied to the actual revision and message or page format. A missing or unrun required review leaves that review incomplete; recipe selection, installation or a green build does not pass it.
+
+## Optional continuations
+
+Use the customer's own next-step process, or select a packaged continuation separately. Choose `agentlinkops agent setup --recipe placement-reconciliation` before reading [placement reconciliation](placement-reconciliation.md), or `agentlinkops agent setup --recipe site-context-brief` before reading the [site brief](site-context-brief.md). A catalog entry or link does not establish that the recipe is installed.

package/references/recipes/placement-reconciliation.md

@@ -1,6 +1,6 @@
 # Placement reconciliation
 
-ID: `placement-reconciliation` | Version: `1.0.4` | Goal: `verify-links`
+ID: `placement-reconciliation` | Version: `1.0.5` | Goal: `verify-links`
 
 Use this recipe to compare claimed placements with observed source pages. Modes: local, hosted, external. Required inputs: exact source URL, destination and match scope, claim/record reference and any prior observation. An exact source page URL is mandatory. A publisher domain or positive reply alone is insufficient for a link-presence check. Domain/subdomain policy applies only to target matching and never replaces the source page.
 
@@ -26,16 +26,30 @@ For hosted work, first identify the operation in the client's available tools an
 
 ## Recovery and completion
 
-For an import or interrupted write, follow [campaign recovery](qualified-campaign-handoff.md#recovery-and-completion). Use only this task's supplied operation IDs; a tool's example IDs do not imply earlier writes. Keep any saved recipe version alongside the version used now. Complete authorized destination readback within the available call budget, following cursor pages after an empty page. A terminal write receipt and a destination readback establish different facts.
+For an import or interrupted write, recover from this task's saved request and receipts. Preserve the destination/workspace/project binding, exact command or method, subject, non-secret arguments, selected records and source/target scope, original idempotency or conditional request identifier, and resulting operation ID. Keep credentials in the customer's existing credential mechanism. A saved key alone does not identify the request; do not change its subject or fill missing arguments from another available ID. Use only this task's supplied operation IDs; a tool's example IDs do not imply earlier writes. If no write was attempted, do not invent an operation to recover. Keep any saved recipe version alongside the version used now; leave its original version unknown when none was recorded.
 
-After a recovered operation read, read the destination again before returning the checkpoint. Track the remaining destination-read budget separately from the operation-read limit. Preserve any actual field mapping supplied by a tool. Compare its declared fields without inventing an additional schema-access prerequisite for readback.
+Complete the following reads before returning the checkpoint, within the available permissions and call budget:
+
+1. Read the original operation using its saved identifier. Restore only authorized access when needed. Check the returned operation ID, destination binding and selected-record scope against the checkpoint. If the original request or identifier is incomplete, use an authorized operation lookup when available and leave unresolved fields unknown; do not schedule a replacement write to manufacture a receipt.
+2. After that operation read, start a fresh destination lookup at its first page. Follow every cursor returned by this new traversal, including after an empty first page, until the snapshot is complete; leave readback incomplete if permission, budget or traversal limits prevent completion. Account for every affected ID established by the original receipt. Track operation-read, destination-read and total-call budgets separately; exhausting operation reads does not consume the remaining destination-read allowance. Perform those remaining authorized reads before returning.
+3. Compare returned IDs and field values with the intended revision and actual supplied mapping. A tool's declared field mapping is usable evidence for those fields; do not invent an additional schema-access prerequisite for their readback. Check identity sets, not just row counts, and verify workspace/project binding. Save the original operation receipt, fresh readback and artifact-persistence outcome as separate facts. If a required read cannot finish, name the actual tool, permission, quota or budget limit and the next permitted read.
+
+Keep each traversal's snapshot identifier, page sequence and saved items together. Do not reuse a cursor from an earlier snapshot or splice earlier and later pages. A missing, repeated, reversed or expired page leaves the traversal incomplete. After a later authorized repair, restart readback at the first page again. A local save failure, incomplete cursor traversal or unknown link check does not authorize another remote write or prevent otherwise available destination reads.
+
+Restored access or an eligible retry time permits another read; it does not establish a terminal result. A pending or unavailable read leaves the write outcome unknown. Record the next permitted read or recovery action and honor supported retry intervals without an unbounded polling loop. Do not claim a wait, restored quota or absolute eligibility time without tool or clock evidence.
+
+A terminal receipt and destination readback establish different facts. A failed operation can have partial effects. Use `confirmed not imported` only when the original receipt conclusively establishes no effects for every selected record. Preserve affected IDs and fields separately, then compare current destination values with the intended revision. An empty lookup, including one before a later commit, cannot prove no effects or a failed write. Keep unresolved fields unknown; do not infer read lag or failure from that sequence. A committed receipt does not establish original record creation unless it says so.
+
+An attempted write without a conclusive receipt remains `outcome unknown`; use `not attempted` only when no write was attempted. Do not retry an ambiguous create with a fresh request identifier, repeat a write to repair a read or checkpoint failure, or claim that failed authentication establishes a failed write. Any replay must preserve the original request and follow the destination's documented rules; neither restored access nor a failed receipt authorizes replay. A separately chosen repair needs the required write authorization and documented conditional or replay contract. Keep the original operation, provider-issued conditional identifier and any repair operation distinct.
+
+Parse canonical JSON results rather than manually rebuilding nested receipts. Use an equivalent authorized CLI result only when it preserves the recorded command and request; do not widen permissions or change credentials to switch surfaces. Write and read back the checkpoint before claiming it saved. Match saved bytes and external IDs to its revision and destination binding using the customer's chosen persistence mechanism. If persistence fails, retain the known operation outcome and destination readback separately, name the failed artifact action and safe resume step, and do not repeat the remote write to repair a local save.
 
 Preserve each observation's timestamp and timezone. Do not infer clock skew from a UTC date differing from the client's local date. Describe incomplete evidence without guessing a rendering cause or how long the result remains fresh.
 
-An unknown current check makes no finding about presence or absence. Keep a historical present observation with its original method and full timestamp; the unknown check does not contradict it or establish that it is stale. Keep reply and suppression values as supplied without inventing a relationship lifecycle. Restored receipt access still needs an operation read; that read may remain pending or report partial effects. Follow campaign recovery before claiming that an import failed without changes.
+An unknown current check makes no finding about presence or absence. Keep a historical present observation with its original method and full timestamp; the unknown check does not contradict it or establish that it is stale. Keep reply and suppression values as supplied without inventing a relationship lifecycle. Restored receipt access still needs the original operation read and fresh destination readback above; that operation read may remain pending or report partial effects. Never claim that an import failed without changes unless its receipt establishes the required no-effects proof.
 
 After interruption, inspect saved observations and remote records before repeating writes. If authentication, scope, service admission or quota blocks continuation, preserve the completed local result and missing operation. Temporary errors do not prove removal. Do not erase a history gap or delete records to force sync success.
 
-Complete with a dated observation and reconciled claim, or an explicit unknown with its reason and next check. [Campaign handoff](qualified-campaign-handoff.md) retains relationship context.
+Complete with a dated observation and reconciled claim, or an explicit unknown with its reason and next check. Use the customer's chosen process for campaign relationship context. If the customer chooses the optional packaged [campaign handoff](qualified-campaign-handoff.md), select it separately with `agentlinkops agent setup --recipe qualified-campaign-handoff` before reading it; use selectors only when the installed CLI's help supports them. The recovery requirements above do not depend on that continuation.
 
 Tested client/tool versions: none recorded. Status: authored; end-to-end execution and vendor connections untested. [Catalog](catalog.json) owns machine-readable status and source references.

package/references/recipes/qualified-campaign-handoff.md

@@ -1,22 +1,34 @@
 # Qualified campaign handoff
 
-ID: `qualified-campaign-handoff` | Version: `1.0.5` | Goal: `prepare-campaign`
+ID: `qualified-campaign-handoff` | Version: `1.0.7` | Goal: `prepare-campaign`
 
 Use this recipe to qualify supplied publisher candidates and prepare a draft for the user's CRM or sender. Modes: local, hosted, external. Required inputs: product/audience brief, asset and publication state, candidate records, campaign purpose, chosen destination and the user's outreach constraints.
 
 ## Capabilities and ownership
 
-Supplied-input qualification and drafting need no AgentLinkOps account. Fresh page checks need an available browser, verifier or permitted hosted tool. Hosted supplier research depends on actual service access. Any vendor connection is optional and untested here. The CRM owns contacts and relationships; the sender owns delivery, replies and suppression. Use [campaign guidance](../../skills/agentlinkops-campaigns/SKILL.md) for qualification. Its SQLite recording step applies only when the user chooses that store.
+Supplied-input qualification and drafting need no AgentLinkOps account. Fresh page checks need an available browser, verifier or permitted hosted tool. Hosted supplier research depends on actual service access. Any vendor connection is optional and untested here. The customer's chosen files, CRM or other record system owns contacts and relationships; the sender owns delivery, replies and suppression. Use [campaign guidance](../../skills/agentlinkops-campaigns/SKILL.md) for qualification. The bundled local CRM is optional and applies only when the customer chooses that store. Selecting this recipe does not install the optional content skills or require that writing method; use the customer's chosen source, editorial and review process.
 
 ## Steps and checkpoints
 
 1. Select the campaign mechanism and publisher benefit. Group duplicates using stable record IDs and the exact source/target pair, retaining each supplied origin. Missing origin stays unknown; a duplicate or zero-change import receipt cannot establish a first import. Grouping a handoff does not mean a saved merge. A domain alone needs an exact source page before qualification; destination matching scope cannot substitute for that page.
 2. Inspect the relevant source page, its context, retrieval time and any submission terms. Label incomplete evidence and browser-rendered evidence with their methods and limits. Verify published contact/form routes; never infer email patterns or deliverability.
 3. Apply the user's exclusion rules and current reply/suppression evidence. Separate eligible, rejected and unresolved candidates with reasons. If stops cannot be checked, leave the handoff unready for sending.
-4. Read the site's content skill when present. Prepare the draft with [source-cited-content-builder](../../skills/source-cited-content-builder/SKILL.md), then run [source-cited-humanizer](../../skills/source-cited-humanizer/SKILL.md), [content-defingerprinting](../../skills/content-defingerprinting/SKILL.md), [internal-linking-optimizer](../../skills/internal-linking-optimizer/SKILL.md), the site's image workflow when applicable, and [pre-publish-review](../../skills/pre-publish-review/SKILL.md). Apply links and review to the actual message format. Keep claims consistent with the asset's actual publication state. Check the draft itself for claims of reviewing a page, noticing a gap, owning the asset or representing its author. Include such claims only when supplied facts and a dated observation support them. A historical snapshot is not a fresh inspection, and an external warning does not repair an unsupported sentence. Leave unknown identity and factual details unset; do not pull operator identity from session metadata.
+4. Read the site's applicable content instructions. Prepare and review the draft through the customer's chosen source and editorial process; identify missing required checks before marking it reviewed. If the customer chooses the packaged passes, select them explicitly as described in [optional writing and review guidance](command-notes.md#optional-writing-and-review-guidance), then follow those skills' own rules. Apply links, images when relevant and review to the actual message format. Keep claims consistent with the asset's actual publication state. Check the draft itself for claims of reviewing a page, noticing a gap, owning the asset or representing its author. Include such claims only when supplied facts and a dated observation support them. A historical snapshot is not a fresh inspection, and an external warning does not repair an unsupported sentence. Leave unknown identity and factual details unset; do not pull operator identity from session metadata.
 5. Inspect the destination's actual field schema before proposing a write, then preview the mapping and changes. Without schema access, return a portable handoff with logical labels, explicitly unmapped; do not present guessed names as CRM fields. Retain campaign references and existing external IDs in supported fields or a companion note. Read back created/updated records and reconcile accepted, rejected and unchanged rows. Exit zero or an empty import is not proof of a useful result. Zero changes does not prove a prior successful import, original source or record creation; preserve those facts only when another receipt establishes them.
 6. Checkpoint recipe version, source/target references, draft revision, external IDs, readback evidence and next action. On replay, find the saved destination record before creating another. Stop at the draft/handoff boundary; this recipe sends no messages and activates no sequence.
 
+## Durable request and readback identity
+
+Before attempting a remote write, save the destination/workspace/project binding, command or method, exact non-secret arguments, original idempotency or conditional request identifier, and any resulting operation ID in the checkpoint. Store credentials in the existing credential mechanism, never in the checkpoint. Preserve the request separately from the receipt. A saved key alone does not identify the operation: for example, `request_check` with `subject: "link"` must not be replayed as a target check because a target ID is also available. Use this example only when this task actually recorded that command and subject.
+
+On resume, replay only the saved request under the destination's documented replay rules. Do not infer a missing subject, selected record, scope or argument from another ID. If the request is incomplete, use an authorized operation lookup when available and retain the unresolved fields; do not schedule a replacement operation to manufacture a receipt. Verify the returned operation ID and destination binding against the original checkpoint before treating the result as recovered.
+
+Persist canonical tool results by parsing their JSON rather than manually copying nested objects. Use the maintained CLI's JSON output when it provides the same authorized command and the MCP client cannot export the result intact. Do not change credentials or widen permissions to switch surfaces. Save the original receipt, parsed readback and local acknowledgement as separate facts.
+
+For a resumed paginated read, retain the original page items and traverse only its returned continuation. Before marking it complete, check that saved IDs are unique, each item belongs to the expected workspace/project and the saved items include every affected ID established by the original receipt. Check identity sets, not just row counts: two copies of one row cannot stand in for two different records. If the cursor expires or the snapshot changes, preserve the old partial traversal and start a separately identified fresh read; never splice snapshots. After a repair, use the fresh traversal required below. Keep an incomplete or mismatched page unresolved and preserve the remote receipt; a local persistence failure does not authorize another remote write.
+
+Write and read back the checkpoint before reporting it saved. Where the user chooses the maintained ledger or portable helper, use its supported persistence path and retain its concurrency/filesystem limits. Otherwise use the customer's established local persistence mechanism; do not invent a successful lock, atomic save or vendor acknowledgement. Match the saved draft bytes and external IDs to the checkpoint's declared revision and binding.
+
 ## Recovery and completion
 
 Before returning an interrupted handoff, complete these steps within the available permissions and call budget:
@@ -43,7 +55,7 @@ Record an attempted write with no conclusive receipt as `outcome unknown`, inclu
 
 Treat campaign references as logical labels until the destination's schema and lookup behavior are known. Do not invent a vendor filter from a local field name. If a record is found, compare its saved content and the current customer revision before proposing an update. Neither a timeout nor changed local content establishes which revision reached the destination. Describe supplied file state as supplied evidence; report an inspection, merge or saved change only after performing it.
 
-Complete when the qualified list, reviewed drafts, mapping and destination readback are available. Otherwise return a portable handoff with the actual operation state and remaining action. Retain sent/replied facts from the sender separately from backlink observations. Preserve the supplied suppression value; do not translate replied or suppressed into a permanent relationship closure. Report only the analytics dimensions explicitly described by the data. Later use [placement reconciliation](placement-reconciliation.md).
+Complete when the qualified list, reviewed drafts, mapping and destination readback are available. Otherwise return a portable handoff with the actual operation state and remaining action. Retain sent/replied facts from the sender separately from backlink observations. Preserve the supplied suppression value; do not translate replied or suppressed into a permanent relationship closure. Report only the analytics dimensions explicitly described by the data. Use the customer's chosen reconciliation process later. The packaged [placement reconciliation](placement-reconciliation.md) is an optional, separately selected continuation: choose `agentlinkops agent setup --recipe placement-reconciliation` before reading it.
 
 Tested client/tool versions: none recorded. Status: authored; end-to-end execution and vendor connections untested. [Catalog](catalog.json) owns machine-readable status and source references.
 

package/references/recipes/site-context-brief.md

@@ -1,6 +1,6 @@
 # Site and context brief
 
-ID: `site-context-brief` | Version: `1.0.0` | Goal: `build-content` or `prepare-campaign`
+ID: `site-context-brief` | Version: `1.0.1` | Goal: `build-content` or `prepare-campaign`
 
 Use this recipe to establish the site, audience, existing assets and evidence before choosing work. Modes: local, hosted, external. Required inputs: the chosen site or product, intended audience, requested outcome and supplied pages or context. Missing inputs become explicit questions in the brief; do not invent them.
 
@@ -20,6 +20,6 @@ The agent can prepare the brief from supplied material without an AgentLinkOps a
 
 If access fails, distinguish missing authentication, missing scope, unavailable feature, quota and temporary failure. Continue from supplied context; record the unresolved operation without retrying indefinitely. If a file exists or changed since the last checkpoint, compare it before proposing a revision and preserve customer edits.
 
-Complete when the brief can support a concrete task with its evidence limits intact. Continue to [sourced asset](sourced-linkable-asset.md) or [campaign handoff](qualified-campaign-handoff.md). No publishing or sending happens in this recipe.
+Complete when the brief can support a concrete task with its evidence limits intact. Use the customer's chosen asset or campaign process for the next task. Packaged continuations are optional and separately selected: choose `agentlinkops agent setup --recipe sourced-linkable-asset` before reading [sourced asset](sourced-linkable-asset.md), or `--recipe qualified-campaign-handoff` before reading [campaign handoff](qualified-campaign-handoff.md). Check selection support as described in [command notes](command-notes.md). No publishing or sending happens in this recipe.
 
 Tested client/tool versions: none recorded. Status: authored; end-to-end execution and vendor connections untested. [Catalog](catalog.json) owns machine-readable status and source references.

package/references/recipes/sourced-linkable-asset.md

@@ -1,25 +1,25 @@
 # Sourced linkable asset
 
-ID: `sourced-linkable-asset` | Version: `1.0.0` | Goal: `build-content`
+ID: `sourced-linkable-asset` | Version: `1.0.1` | Goal: `build-content`
 
 Use this recipe for a reference, guide, comparison, dataset, calculator or template that helps a named reader. Modes: local, hosted, external. Required inputs: the site/context brief, reader task, candidate asset or existing page, source material and intended output destination.
 
 ## Capabilities and ownership
 
-The agent can write a sourced draft without an AgentLinkOps account. Fetching sources and editing a website depend on the user's available tools. Hosted backlink research is optional and requires actual access. The user's site or content system owns the asset; local CRM storage is optional. For page work, preserve the site's rendering and routing conventions and inspect nearby pages before editing. This recipe contains the writing and review sequence; continue below without loading another asset router.
+The agent can write a sourced draft without an AgentLinkOps account. Fetching sources and editing a website depend on the user's available tools. Hosted backlink research is optional and requires actual access. The user's site or content system owns the asset; local CRM storage is optional. For page work, preserve the site's rendering and routing conventions and inspect nearby pages before editing. Use the customer's chosen source, editorial and review process. Selecting this recipe does not install the optional content skills or require that writing method; see [optional writing and review guidance](command-notes.md#optional-writing-and-review-guidance) if the customer chooses the packaged passes.
 
 ## Steps and checkpoints
 
-1. Read the site's content instructions and inspect existing pages for the same reader task. Define the useful addition before creating another URL. Start with the site's content skill when present, then use the packaged passes below. If a required review resource is unavailable, identify it before marking the asset reviewed.
-2. Write through [source-cited-content-builder](../../skills/source-cited-content-builder/SKILL.md). Preserve source title, publisher, publication date when available, URL and the evidence supporting each factual claim. Mark original calculations and assumptions. Do not manufacture experience or results.
-3. Run [source-cited-humanizer](../../skills/source-cited-humanizer/SKILL.md) as a separate editorial pass, then [content-defingerprinting](../../skills/content-defingerprinting/SKILL.md) on the final authored text. Save the actual checks and findings.
-4. Apply [internal-linking-optimizer](../../skills/internal-linking-optimizer/SKILL.md) to the chosen format. For owned pages, verify destinations and inbound discovery at release. A document or email handoff needs relevant links without webpage quotas. Use the site's image workflow when the asset calls for images.
-5. Run [pre-publish-review](../../skills/pre-publish-review/SKILL.md). Checkpoint the draft revision, intended URL, source records, review receipts and unresolved findings. Read back the artifact from its chosen destination.
+1. Read the site's applicable content instructions and inspect existing pages for the same reader task. Define the useful addition before creating another URL. Identify the customer's required writing and review steps. If a required review resource is unavailable, identify it before marking the asset reviewed.
+2. Write with the customer's chosen source process. Preserve source title, publisher, publication date when available, URL and the evidence supporting each factual claim. Mark original calculations and assumptions. Do not manufacture experience or results.
+3. Use the customer's editorial and final-text review process. Save the actual checks, reviewer or tool used, revision and unresolved findings. A selected packaged pass keeps its own rules; an unrun pass is not a completed review.
+4. Check links for the chosen format. For owned pages, verify destinations and inbound discovery at release. A document or email handoff needs relevant links without webpage quotas. Use the site's image workflow when the asset calls for images.
+5. Complete the customer's required release review. Checkpoint the draft revision, intended URL, source records, review receipts and unresolved findings. Read back the artifact from its chosen destination.
 
 ## Recovery and completion
 
 Missing sources leave claims unverified; remove or qualify them before review. Missing review tools leave the corresponding pass incomplete. Preserve an existing page and customer edits when resuming. A draft, green build or copied command does not prove publication. If release is authorized separately, verify the actual public content after release and attach that receipt.
 
-Complete this recipe with a reviewed draft and explicit publication state, or an unfinished draft with the precise remaining check. Continue to [campaign handoff](qualified-campaign-handoff.md) only with an honest asset state; a pitch must not describe an unpublished asset as live.
+Complete this recipe with a reviewed draft and explicit publication state, or an unfinished draft with the precise remaining check. A campaign continuation uses the customer's chosen process. If the customer chooses the packaged [campaign handoff](qualified-campaign-handoff.md), select it separately with `agentlinkops agent setup --recipe qualified-campaign-handoff` before reading it. Carry an honest asset state into either process; a pitch must not describe an unpublished asset as live.
 
 Tested client/tool versions: none recorded. Status: authored; end-to-end execution and vendor connections untested. [Catalog](catalog.json) owns machine-readable status and source references.

package/scripts/agentlinkops.py

@@ -26,6 +26,7 @@ import json
 import os
 from pathlib import Path
 import sqlite3
+import stat
 import sys
 import urllib.error
 import urllib.parse
@@ -117,6 +118,31 @@ def migrations():
     return result
 
 
+def require_private_file(info):
+    if not stat.S_ISREG(info.st_mode):
+        raise CRMError("CRM storage must be a regular file", "DATABASE_ERROR")
+    if os.name == "posix" and stat.S_IMODE(info.st_mode) != 0o600:
+        raise CRMError("CRM storage requires mode 0600; secure existing files or use a filesystem that enforces private permissions", "PRIVATE_STORAGE_REQUIRED")
+
+
+def open_private_file(path):
+    descriptor = os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
+    identity = None
+    try:
+        identity = os.fstat(descriptor)
+        require_private_file(identity)
+        return descriptor
+    except Exception:
+        # Check the created inode is still empty before cleanup.
+        try:
+            current = os.lstat(path)
+            if identity and (current.st_dev, current.st_ino) == (identity.st_dev, identity.st_ino) and current.st_size == 0:
+                os.unlink(path)
+        finally:
+            os.close(descriptor)
+        raise
+
+
 def connect(path, allow_create=False):
     path = Path(path).expanduser()
     if path.is_symlink():
@@ -125,8 +151,8 @@ def connect(path, allow_create=False):
         raise CRMError("CRM does not exist; run init with a workspace ID", "DATABASE_ERROR")
     if allow_create and not path.exists():
         path.parent.mkdir(parents=True, exist_ok=True)
-        descriptor = os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
-        os.close(descriptor)
+        os.close(open_private_file(path))
+    require_private_file(path.lstat())
     connection = sqlite3.connect(str(path), timeout=10, isolation_level=None)
     connection.row_factory = sqlite3.Row
     connection.execute("PRAGMA foreign_keys = ON")
@@ -172,8 +198,7 @@ def migrate(connection, path, workspace_id=None, initialize=False):
     backup = None
     if version and pending:
         backup = str(Path(path).expanduser()) + ".pre-v" + str(version + 1) + "." + dt.datetime.now().strftime("%Y%m%d%H%M%S%f") + ".bak"
-        descriptor = os.open(backup, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
-        os.close(descriptor)
+        os.close(open_private_file(backup))
         with sqlite3.connect(backup) as target:
             connection.backup(target)
     connection.execute("BEGIN IMMEDIATE")
@@ -500,7 +525,7 @@ def write_new(path, content, suffix=None):
     path = Path(path).expanduser()
     if suffix and path.suffix.lower() != suffix:
         raise CRMError(f"Output file must end in {suffix}")
-    descriptor = os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
+    descriptor = open_private_file(path)
     with os.fdopen(descriptor, "w", encoding="utf-8", newline="") as output:
         output.write(content)
 

package/scripts/outreach-crm-draft.py

@@ -0,0 +1,121 @@
+#!/usr/bin/env python3
+"""Save/read back an explicitly mapped draft in a customer-selected local Outreach CRM.
+No network, send, sequence activation, or contact/authority-state writes.
+"""
+import argparse
+import hashlib
+import importlib.util
+import json
+from pathlib import Path
+import re
+from urllib.parse import urlsplit
+
+spec = importlib.util.spec_from_file_location('portable_handoff', Path(__file__).with_name('portable-handoff.py'))
+portable = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(portable)
+
+
+def text(value, label):
+    if not isinstance(value, str) or not value.strip():
+        raise ValueError(label + ' must be explicit')
+    return value
+
+
+def host(value):
+    parsed = urlsplit(text(value, 'site'))
+    if parsed.scheme not in ('https', 'http') or not parsed.hostname or parsed.username or parsed.password:
+        raise ValueError('site must be an explicit URL without credentials')
+    return parsed.hostname.lower()
+
+
+def prepare(root, request, body):
+    fields = {'version', 'crm_project', 'workspace_id', 'project_id', 'site', 'operation_id',
+              'original_request', 'local_id', 'external_id', 'observation', 'reply',
+              'suppression', 'subject', 'body_sha256'}
+    if not isinstance(request, dict) or set(request) != fields or type(request['version']) is not int or request['version'] != 1:
+        raise ValueError('explicit version 1 draft request required; see local CRM handoff reference')
+    for field in fields - {'version', 'original_request'}:
+        text(request[field], field)
+    project = request['crm_project']
+    if not re.fullmatch(r'[a-z0-9][a-z0-9_-]*', project):
+        raise ValueError('crm_project must be one project directory name')
+    root = Path(root).resolve(strict=True)
+    project_dir = root / 'projects' / project
+    # Refuse symlink redirection in destination directories, including an existing
+    # operation directory. This is a cooperating local writer, not an OS sandbox.
+    for path in (root / 'projects', project_dir, project_dir / 'config.json', project_dir / 'drafts'):
+        if path.is_symlink():
+            raise ValueError('destination symlink refused: ' + str(path))
+    config = json.loads((project_dir / 'config.json').read_text(encoding='utf-8'))
+    if not isinstance(config, dict) or config.get('project') != project or host(config.get('site')) != host(request['site']):
+        raise ValueError('CRM config identity/site mismatch; preserve original mapping')
+    if not (project_dir / 'drafts').is_dir():
+        raise ValueError('selected CRM drafts directory missing; initialize that project first')
+    original = request['original_request']
+    if not isinstance(original, dict) or set(original) != {'destination', 'workspace_id', 'project_id', 'command', 'arguments', 'idempotency_key'}:
+        raise ValueError('complete original non-secret request tuple required')
+    for field in ('destination', 'workspace_id', 'project_id', 'command', 'idempotency_key'):
+        text(original[field], 'original_request.' + field)
+    if not isinstance(original['arguments'], dict):
+        raise ValueError('original request arguments must be an object')
+    if any(original[field] != request[field] for field in ('workspace_id', 'project_id')):
+        raise ValueError('original request scope mismatch; preserve original mapping')
+    if request['observation'] not in ('unknown', 'present', 'provisional_loss', 'confirmed_loss'):
+        raise ValueError('explicit supported observation required')
+    if request['reply'] not in ('unknown', 'none', 'replied') or request['suppression'] not in ('unknown', 'clear', 'suppressed'):
+        raise ValueError('explicit reply/suppression observation required')
+    if '\n' in request['subject'] or '\r' in request['subject']:
+        raise ValueError('subject must be one line')
+    body.decode('utf-8')
+    if not body or hashlib.sha256(body).hexdigest() != request['body_sha256']:
+        raise ValueError('body bytes do not match the original draft hash')
+    identity = {field: request[field] for field in ('crm_project', 'workspace_id', 'project_id', 'operation_id', 'local_id', 'external_id')}
+    directory = project_dir / 'drafts' / ('agentlinkops-' + portable.digest(identity))
+    if directory.is_symlink():
+        raise ValueError('destination operation symlink refused')
+    manifest = {'version': 1, 'destination': 'local-outreach-crm-drafts', 'request': request,
+                'body_file': 'body.txt', 'send_eligible': False, 'messages_sent': 0,
+                'native_vendor_acceptance': False, 'hosted_scope_verification': 'customer_supplied_unverified'}
+    return directory, (portable.canonical(manifest) + '\n').encode('utf-8')
+
+
+def save(root, request, body, readback=False):
+    directory, manifest = prepare(root, request, body)
+    artifacts = [(directory / 'body.txt', body), (directory / 'manifest.json', manifest)]
+    if readback and not directory.is_dir():
+        raise ValueError('draft readback missing; resume the original save')
+    if not readback:
+        directory.mkdir(exist_ok=True)
+    with portable._publication_lock(directory / 'draft-transaction'):
+        for path, expected in artifacts:
+            if path.is_symlink() or (path.exists() and (not path.is_file() or path.read_bytes() != expected)):
+                raise ValueError('saved draft differs; retain original operation and inspect ' + str(path))
+            if readback and not path.is_file():
+                raise ValueError('draft readback incomplete; resume the original save')
+        outcomes = [] if readback else [portable._publish_bytes(path, expected) for path, expected in artifacts]
+        if any(path.read_bytes() != expected for path, expected in artifacts):
+            raise ValueError('draft readback mismatch; preserve original operation')
+    return {'operation_id': request['operation_id'], 'crm_project': request['crm_project'],
+            'local_id': request['local_id'], 'external_id': request['external_id'],
+            'directory': str(directory), 'body_sha256': request['body_sha256'],
+            'manifest_sha256': hashlib.sha256(manifest).hexdigest(),
+            'outcome': 'saved_and_read_back' if 'saved_and_read_back' in outcomes else 'identical_readback',
+            'messages_sent': 0, 'send_eligible': False, 'native_vendor_acceptance': False}
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--crm-root', required=True)
+    parser.add_argument('--request', required=True)
+    parser.add_argument('--body-file', required=True)
+    parser.add_argument('--readback', action='store_true')
+    args = parser.parse_args()
+    request = json.loads(Path(args.request).read_text(encoding='utf-8'))
+    print(portable.canonical(save(args.crm_root, request, Path(args.body_file).read_bytes(), args.readback)))
+
+
+if __name__ == '__main__':
+    try:
+        main()
+    except (ValueError, OSError, KeyError, TypeError) as error:
+        raise SystemExit('local CRM draft refused: ' + str(error))