Resolve actual tool/schema versions through service diagnostics before using a connected workflow. The initial pack's manifest lists no verified service contracts; its pipelines describe intended interactions, not installed tools. Do not invent tool names or issue ad hoc REST/file writes when MCP is unavailable.
Use read tools for retrieval and typed MCP proposals for contributions. Source upload completion establishes a staged artifact, not an accepted source. Treat policy acceptance and index visibility as separate outcomes. Corrections append revisions; accepted records are corrected through new linked proposals.
Before a connected operation, persist run/operation identity and input digest in a local checkpoint, then associate service run/proposal IDs as returned. Checkpoints include pack/skill/pipeline versions and hashes, scope, source/extraction references, stage, output hashes, coverage, pending side effects and last receipt. Exclude secrets. Use the host's available safe file tools; these instructions alone do not establish atomic journaling or a durable scheduler.
Use the checkpoint contract in the [pack README](../README.md) and resolve the module registry in the manifest. Record its snapshot digest and every applicable module's contract ID/version and file hash, including the profile and shared protocols. Verify those hashes before resuming; a mismatch requires the original snapshot or an explicitly revalidated successor run.
When a result is uncertain, query upload/proposal/run status using the same operation identity before retrying. Never generate a fresh proposal ID to hide network uncertainty. Resume from preserved artifacts and service receipts; changed content requires a new revision. Do not rerun a model and assume it reproduces the same output.
Bound work by source/batch size, stage/model budget and correction attempts. After two unchanged validation failures, stop for diagnosis and report findings. Coverage/skips remain explicit at any stop. Cancellation cannot undo an accepted proposal; check status when a call may have completed.
Only the service decides acceptance. Report accepted, held/rejected, index-pending and blocked work separately. Human-owned intent/policy changes need a distinct authenticated owner decision; the agent cannot supply it or hold owner credentials. An installed skill grants no authority beyond the user's task and current service credential.
