Update to Formify

{
  "description": "Track who has signed, remind them, get notified automatically when they do, fix a wrong recipient, or cancel a send. Use after a document went out for signature, when contact details were wrong, or when the signed copy is needed. Triggers on \"who has signed\", \"send a reminder\", \"notify me when signed\", \"wrong email address\", \"cancel the signing\", \"download the signed copy\", \"vem har signerat\", \"påminnelse\", \"återkalla\", \"quién ha firmado\". Not for sending: see formify-send-contract.",
  "included_files": [
    {
      "relative_path": "agents/openai.yaml",
      "size_in_bytes": 500
    }
  ],
  "name": "formify-track-signatures",
  "skill_md_contents": "---\nname: formify-track-signatures\ndescription: 'Track who has signed, remind them, get notified automatically when they do, fix a wrong recipient, or cancel a send. Use after a document went out for signature, when contact details were wrong, or when the signed copy is needed. Triggers on \"who has signed\", \"send a reminder\", \"notify me when signed\", \"wrong email address\", \"cancel the signing\", \"download the signed copy\", \"vem har signerat\", \"påminnelse\", \"återkalla\", \"quién ha firmado\". Not for sending: see formify-send-contract.'\nlicense: MIT\nmetadata:\n  version: \"1.6.1\"\n---\n\n# After the document was sent\n\nVersion 1.6.1. If asked which version you are, quote this line.\n\n## Purpose\n\nEverything that happens between sending a document and having it signed: finding it,\nseeing who is still outstanding, reminding only them, repairing a wrong email address,\nhanding someone a link in person, correcting a value before anyone signs, cancelling, and\nretrieving the finished file.\n\nThis is the half of the job most agents never learn. Sending is one moment; waiting is the\nfollowing week.\n\n## When this applies\n\n- \"Has anyone signed this yet?\"\n- \"Remind the ones who haven't.\"\n- \"I typed his email wrong.\"\n- \"The client is in front of me — can I just give them the link?\"\n- \"The amount is wrong and nobody has signed yet.\"\n- \"The deal is off, cancel it.\"\n- \"Send me the signed copy.\"\n- \"Just tell me when it's signed — I don't want to keep checking.\"\n- \"Has anyone filled in the form I shared?\"\n\n## When it does not\n\n- **Sending a document in the first place** → `formify-send-contract`.\n- **Building or editing the PDF** → `formify-pdf-forms`.\n- **Managing the public link itself** — editing it, switching it off, what it costs →\n  `formify-share-link`. Reading the documents it produced belongs here.\n\n## Preconditions\n\nA Formify account, connected. Every action here needs one.\n\n**Always read current state before acting.** Call `get_document` before any reminder,\nrepair, cancellation or deletion. Never act on a status remembered from earlier in the\nconversation — someone may have signed in the meantime, and several of these operations are\nirreversible.\n\nIf the user does not know which document they mean, list recent documents and let them pick\nby name. Never show internal IDs; those are for tool calls.\n\n**Every list is paginated, and a short page does not mean the last page.** A listing returns\na `nextOffset`; keep asking with it until it comes back null. A page may hold fewer items than\nthe limit and still have more behind it — that is normal, not the end. Stopping at the first\nshort page is how \"you have three documents out for signature\" gets said to someone who has\neleven, and nothing about the answer looks wrong.\n\n## Procedure\n\n### 1. Read the document and report it in human terms\n\n`get_document` returns the document's status and one entry per signer. Present it the way a\nperson would ask for it:\n\n> **Rental agreement — Calle Mayor 14**\n> Maria Sanchez — signed, yesterday 14:20\n> Johan Berg — not yet signed\n> Anna Lindqvist — not yet signed\n\nTwo different fields, and confusing them is the most common error here: the **document**\nhas a `status`; each signer has a `signatureStatus`. Read the second one per person.\n\nDocument statuses and what they permit:\n\n| Status | Meaning | What is possible |\n|---|---|---|\n| `processing` | Still being prepared; invitations go out automatically when it finishes | Wait |\n| `created` | Prepared, invitations not yet sent | No reminders yet |\n| `awaiting_signatures` | Out with at least one person | Remind, repair, cancel |\n| `completed` | Everyone signed | Download, delete |\n| `revoked` | Cancelled | Delete |\n\n**A document signed through a public link will not be in that list.** The ordinary document\nlisting holds what the user *sent* to named people. A public link — one reusable link anyone\nmay open — produces its own document per signer, and those live under the link, not in that\nlist. So when the user asks \"has anyone filled in my form yet?\" and nothing turns up, do not\nreport zero: ask whether it went out as a link, list their links, and read the documents that\nlink has produced.\n\nEach entry carries a document identifier that behaves like any other from that point on —\nstatus, per-signer detail, field values and the signed copy all work normally. One thing does\nnot: **only completed submissions are listed.** Someone who opened the link and abandoned it\nhalf-filled leaves no trace, so \"nobody has signed\" and \"nobody finished\" are the same answer\nhere, and there is no way to tell them apart. Say it that way rather than implying nobody\nlooked. That listing paginates like every other. Everything about the link itself — switching\nit off, editing it, what it costs — is `formify-share-link`.\n\n### 2. Remind only the people who have not signed\n\nReminders are the most-asked and most-mishandled action.\n\n- The document must be `awaiting_signatures`. **Any other status returns 403** — say why\n  and stop rather than retrying.\n- Include only signers whose `signatureStatus` shows they are still awaiting. Never include\n  someone who has signed.\n- **Maximum two reminders per signer per rolling 60 minutes.** Beyond that the call fails.\n  Each signer's remaining cooldown is reported in seconds by `get_document` — read it, and\n  tell the user how long is left instead of retrying.\n- Show who will be reminded and get a yes before sending. If several people are\n  outstanding, offer both: remind everyone, or pick.\n\n### 3. Repair a recipient whose details were wrong\n\nAn unsigned signer's contact details can be corrected. Sending a fresh invitation and\nrevoking the old links happens automatically.\n\nTwo limits, and the first one surprises people:\n\n- **An existing contact method can be changed, never added.** If someone was created with\n  only a phone number, an email cannot be added to them afterwards, and the reverse is also\n  true. When that is what the user needs, the honest answer is to cancel and resend.\n- Contact details can be updated at most twice, then a 60-minute cooldown applies. The\n  remaining time is reported by `get_document`.\n\nConfirm the correction before sending it: a second wrong address costs another round of the\nsame cooldown.\n\n**A corrected signer gets a new identifier.** Read the document again before any further\naction on that person — a reminder sent to the identifier you held before the correction is\nsent to someone who no longer exists.\n\n### 4. Hand someone a link directly\n\nWhen the signer is standing there, or reachable on a channel Formify does not send to, get\ntheir personal signing link and give it to them.\n\nEach link is **verification-locked**: opening it requires a one-time code that Formify sends\nto the contact method already on file, never to a value the opener types. So a forwarded or\nleaked link cannot be opened by anyone else. Say this to the user — it is the question they\nask next.\n\nA signer with both an email and a phone comes back as two entries, one per channel. Offer\nboth and let the user choose. A signer with no contact method on file cannot be verified and\ndoes not appear at all; that person cannot be repaired on a sent document.\n\nThis works only on a sent document, not a draft.\n\n**This is not a public link, and the word is the trap.** What you hand over here is one\nperson's private way into one document, locked to the contact method already on file. A\npublic link is the opposite: no named recipient, anyone who holds it may sign, and each one\nwho does gets their own document. If the user says \"just give me a link I can put on our\nwebsite\", they mean the other thing — `formify-share-link`.\n\n### 5. Correct a value before anyone has signed\n\nForm field values can still be set on a sent document, and — unlike what older guidance\nclaimed — the values already filled in can be read at **any** status, not only after\ncompletion. That is how you show the user what a signer has entered so far.\n\nThe window closes at the first signature. After that, values are fixed.\n\nThis changes field values only. It cannot change the contract text; that requires cancelling\nand sending a corrected document.\n\n### 6. Cancel, and delete\n\n**Cancelling** is possible while a document is not yet fully signed. It is irreversible.\nShow a summary — what the document is, who has already signed — and require an explicit yes.\nSomeone having already signed is worth naming out loud; their effort is about to be\ndiscarded.\n\n**Deleting** is only possible for a document that is completed or revoked, and it removes\nthe associated file. Confirm separately. Deleting is not archiving: if the user needs the\nsigned copy, retrieve it first.\n\n### 7. Retrieve the signed document\n\nOnce complete, produce a download link for the finished PDF. **It expires after ten\nminutes**, so fetch it when the user is ready to use it, not earlier in the conversation.\n\nOffer it before it is asked for. A completed signature that nobody downloaded is a job left\nhalf done.\n\n### 8. Stop checking — have Formify say when it happens\n\nEverything above is the user asking. Formify can tell them instead, and nothing in this skill\nis more worth offering, because it is the difference between a person remembering to check and\na person being told.\n\nFormify can call a web address of the user's whenever something happens to a document. Six\nthings can be reported: the document was **created**, **opened** by a signer, **signed** by\nsomeone, **completed** by everyone, **revoked**, or **deleted**. A subscription can ask for\nany combination of them.\n\nOffer this the moment someone says any version of *\"let me know when it's signed\"*, *\"I keep\nhaving to check\"*, or *\"can this land in our system automatically\"*. Three questions settle it:\n\n1. **Where should it go?** It must be a public web address reachable over HTTPS — their own\n   system, their site, or an automation service they already use. A private network address\n   or a plain HTTP one will not be accepted. If they have none of these, say so plainly and\n   leave it; do not send them off to build one.\n2. **Which events?** Most people want completion only. Offer per-signer events when several\n   people sign and they want progress, not just the end.\n3. **Do they want a reminder set up too?** The two work together: one tells them, the other\n   chases the signer.\n\nEach subscription is created with a signing secret, which is how the receiving system knows a\nmessage really came from Formify. Give the secret to the user once, tell them their system\nmust check it, and say that it can be rotated if it is ever exposed. Existing subscriptions can\nbe listed and removed the same way — worth checking before adding a second one that duplicates\nthe first.\n\n**Say what this replaces.** After it is set up, tell the user they no longer need to ask you\nwhether it has been signed. That sentence is the whole value of the step.\n\n## Failure modes\n\n| What you see | What it means | What to do |\n|---|---|---|\n| Reminder returns 403 | The document is not `awaiting_signatures` | Report the actual status. Do not retry. |\n| Reminder returns 429 | Two reminders already sent to that signer this hour | Read the remaining cooldown and tell the user how long is left. |\n| Contact update rejected | Trying to add a method that was never there | Cannot be repaired on a sent document. Offer to cancel and resend. |\n| A signer is missing from the link list | They have no contact method on file | Same as above. |\n| Cancel refused | The document is already fully signed | Nothing to cancel. Offer the signed copy instead. |\n| Delete refused | The document is still live | Only completed or revoked documents can be deleted. |\n| The download link stopped working | The ten-minute window elapsed | Fetch a new one. |\n| Field values will not change | Someone has signed | The window closed. A correction now needs a new document. |\n| A document the user swears they sent is not in the list | Either the listing stopped at a short page, or it went out as a public link | Follow `nextOffset` to the end first; then check their links and read that link's documents. |\n| A link's form was opened but nothing is listed | Only completed submissions are recorded | Say that nobody has finished. An abandoned half-filled form leaves no trace either way. |\n\n## References\n\nNone. Everything here is in the procedure, because every step is a live account operation\nwhose current state must be read at the moment it runs.\n"
}