Update to Atbash Safety

SKILL.md text changes

− removed · + added

--- before
+++ after
@@ -1,95 +1,46 @@
 ---
 name: atbash-setup
-description: Configure, activate, verify, troubleshoot, or rotate credentials for the Atbash Safety Codex plugin. Use when a user asks how to set up Atbash, enable or disable its hook, configure an organization or private key, check agent status, understand ALLOW/HOLD/BLOCK behavior, or fix configuration, registration, jailed-agent, endpoint, or service errors.
+description: Set up, connect, verify, or switch the local Atbash agent used for explicit safety checks. Use for Atbash signup, existing-agent connection, setup progress, or local profile troubleshooting.
 ---
 
 # Atbash Setup
 
-Keep Atbash enforcement separate from this skill. The plugin's catch-all `PreToolUse` hook automatically judges supported tool calls whenever the plugin and hook are enabled and trusted; do not decide case by case whether to invoke Atbash.
+Run the bundled helper yourself in a local desktop thread. It requires Node.js 22.13.0 or newer on macOS arm64, Linux x64/arm64 with glibc, or Windows x64. Resolve `<skill-directory>` to the directory containing this file; use its installed launcher throughout a job. If local execution is unavailable, explain that this package requires a local desktop thread.
 
-## Protect credentials
+## Onboard an agent
 
-- Never ask the user to paste, upload, or reveal an Atbash private key in chat.
-- Never read, print, log, inspect, or transmit the user's Atbash config file.
-- Never place a private key in a prompt, tool argument, command-line argument, shell history, manifest, repository file, or `.env` file.
-- Ask the user to edit the config locally themselves. If a private key has appeared in chat, logs, or version control, advise the user to revoke or rotate it before continuing.
-- Explain that the SDK uses the private key locally for agent identity and cryptographic signing and derives the public key locally. The configuration file remains on the user's machine; the plugin does not operate a credential-holding MCP server.
-
-## Configure before trusting the hook
-
-Tell the user to create the SDK config outside the Codex conversation before trusting the hook. The organization name is required and must exactly match the organization where the agent's derived public key is onboarded.
-
-Use this JSON shape at `~/.config/atbash/config.json` on macOS/Linux or `%USERPROFILE%\.config\atbash\config.json` on Windows:
-
-```json
-{
-  "agentKey": "<your-agent-private-key>",
-  "orgName": "<your-exact-organization-name>"
-}
+```text
+node <skill-directory>/scripts/atbash-control.mjs setup start --host codex
 ```
 
-Give the user these manual setup commands without executing them or asking for their resulting file contents.
-
-macOS/Linux:
+The helper uses the `codex` host profile namespace in both ChatGPT desktop and Codex. Show the returned `verificationUri` and code. The user signs in and verifies their wallet in Connect Atbash. Keep the job ID to resume the same job. Ask only for missing choices and browser approval; perform helper commands and plan-file creation yourself.
 
-```bash
-mkdir -p ~/.config/atbash
-chmod 700 ~/.config/atbash
-${EDITOR:-vi} ~/.config/atbash/config.json
-chmod 600 ~/.config/atbash/config.json
-```
-
-Windows PowerShell:
-
-```powershell
-New-Item -ItemType Directory -Force "$HOME\.config\atbash"
-notepad "$HOME\.config\atbash\config.json"
-```
+Run `setup inspect <job-id>` through the same launcher after wallet verification. Follow `nextAction`:
 
-Environment variables `ATBASH_AGENT_KEY` and `ATBASH_ORG_NAME` are a session-only alternative. Prefer the config file for Codex desktop because environment changes do not reach an already-running desktop process.
+- `OPEN_BROWSER`: wait for the user to verify their wallet at the returned URL.
+- `PREPARE_PLAN`: use discovery and user-provided choices to create a non-secret JSON file with an `actions` array. Submit it with `setup plan <job-id> --input <path>`.
+- `REVIEW_IN_BROWSER`: show the verification URL; the user reviews and signs the exact proposal. Do not approve or sign for them.
+- `WAIT`: inspect again after two seconds, keeping the user informed. Stop on expiry or terminal failure; do not repeatedly create new sessions.
+- `ACTIVATE`: run `setup continue <job-id>` to decrypt the key locally and select the agent profile.
+- `RECOVER`: report completed and failed steps. Further mutations require a new authorization session.
+- `DONE`: run `node <skill-directory>/../../runtime/public-safety.cjs status`. Report whether the agent is ready for explicit safety checks.
 
-If the already-trusted fail-closed hook prevents setup actions, tell the user to disable or untrust the Atbash hook, complete configuration manually outside Codex, restart Codex, and trust the hook again through `/hooks`.
+A new-agent plan uses `create_account` and `create_organization` when missing, `activate_free_plan` if needed, then one `create_agent` with `keySource: "generate_in_browser"`. Include `network`, `organization`, `name`, `purpose`, and `risk` (`low`, `medium`, `high`, or `critical`) from discovery and the user's choices. Account actions have only `type` and `network`; organization creation uses `name` and `description`. Free-plan activation uses `organization` and requires the public network.
 
-## Activate or deactivate
-
-Treat Atbash as active only when all of these are true:
-
-1. The `atbash` plugin is installed and enabled.
-2. Codex lifecycle hooks are enabled.
-3. The Atbash `PreToolUse` command is trusted in `/hooks`.
-4. Local Atbash credentials and organization configuration are valid.
-
-To deactivate Atbash, tell the user to disable the plugin or untrust/disable its hook in Codex. Do not describe deactivation as bypassing an individual verdict; it disables enforcement for subsequent tool calls.
-
-## Verify and troubleshoot
-
-After configuration and activation, use a harmless tool call such as listing the current directory to verify that the hook allows an ordinary action. Do not use destructive or privileged commands as tests.
-
-If working from a source checkout, the user can run:
-
-```bash
-npm run status --workspace @atbash/codex-plugin
-```
+Suggest `policy: {"preset":"developer","version":1}` for coding, `devops` for operations, or `full_baseline` when the user requests the strictest protection. Explain the suggestion before approval; the user can choose a different preset or customize the policy in Connect Atbash.
 
-Interpret status results as follows:
+If an existing organization needs a subscription, run `setup checkout <job-id> --organization <name>` and show the returned checkout URL. The user selects the plan and handles payment in their browser. Resume inspection afterward.
 
-- `ready`: configuration, registration, and service access are working.
-- `configuration_error`: correct the local key, exact organization name, or optional endpoint settings.
-- `agent_not_registered`: onboard the public key derived from this private key into the named organization.
-- `agent_jailed`: resolve the agent state in Atbash before retrying.
-- `service_error`: check connectivity, endpoint/chain settings, and Atbash service availability.
+## Connect an existing agent
 
-Never diagnose key mismatch by asking to inspect the private key. Ask the user to compare the locally derived public key with the public key registered in the Atbash dashboard.
+After wallet verification and discovery, run `profile connect <job-id>` through the launcher. Show the returned loopback `localUri`. The user enters their key only in that local form; the helper verifies that its public identity belongs to the verified wallet. Wait for the helper's completion, then run the status command above.
 
-## Explain verdicts
+Never ask for, read, print, or put an agent private key in the conversation, tool arguments, environment assignments, or plan files. Credential and pending-session files are private. A browser verification URL and job ID may be shown; session secrets may not.
 
-- `ALLOW` with `allow: true`: Codex continues the pending tool call.
-- `HOLD`: Codex blocks this attempt pending operator review. After approval in Atbash, the user must explicitly retry the original request.
-- `BLOCK`: Codex blocks the tool call.
-- `ERROR`, timeout, malformed output, missing configuration, or inconsistent output: Codex blocks the tool call because the hook is fail closed.
+## Profiles and troubleshooting
 
-Do not claim that the plugin covers plain text responses, hosted tools that opt out of hooks, or every possible Codex capability. It guards tool calls exposed to the `PreToolUse` lifecycle hook.
+Use the same launcher for `profile list --host codex`, `profile switch --host codex --profile <id>`, and `profile disconnect --host codex`. Disconnecting retains the stored credential and does not revoke the on-chain agent. After switching, run status again. Resolve an environment mismatch by connecting an agent belonging to the service reported by `public-safety.cjs help`; do not copy keys between environments.
 
-## Rotate a key
+Report helper failures without exposing credential contents or requesting backend credentials. If a local environment override conflicts with a profile, ask the user to correct it locally without revealing its value.
 
-Ask the user to rotate or revoke the old key in Atbash, replace `agentKey` in the local config themselves, verify the derived public key is onboarded to the exact organization, and start a new Codex task. Never handle either key value in the conversation.
+This package checks only explicitly submitted actions. Agent readiness does not mean other tool calls are automatically intercepted. After setup, use `$atbash-safety` when the user requests an action check.