Install & update the skill

Save the public installer, inspect the saved file, and read its help before running it. Do not use a curl | node pipeline: inspection is part of the supported trust path.

The installer reads the production manifest at https://mcp.semel.ai/.well-known/semel-skill.json. That manifest names the immutable skill URL, version, protocol range, SHA-256, signed release statement, and key ID. The installer accepts only HTTPS artifact URLs and a publisher key pinned in its own source.

Choose the absolute SKILL.md path your harness loads, then pass it explicitly. The same installer supports exactly codex and claude; it never guesses a home directory or copies into several harnesses at once. --manifest-url names the signed release to install; omit it and the installer defaults to production.

Run one line for the harness and path you chose (substitute your real skills directory if you use a custom location). After installation, start a new harness session, invoke /semel, and as a first check ask it to list your Semel briefs to confirm the connection. OpenClaw, Cursor, generic MCP clients, and guessed shared install locations are outside this installer’s launch-supported contract.

Codex users should also install the semel-codex-reauth recovery helper, which re-establishes Codex/Conductor authentication when it lapses. Unlike the skill, the helper is not part of the signed release — it is distributed over HTTPS and verified by its published SHA-256, so verify it explicitly before use. Download it over HTTPS, compare its checksum to the cliSha256 value in the app manifest, then place it on your PATH. Do not run any shell installer for this — a shell installer would overwrite the signed SKILL.md.

The skill declares the protocol majors it supports. Semel’s protocol is at major 1 today. A skill outside the supported major fails discovery with PROTOCOL_VERSION_UNSUPPORTED; update it via the managed updater below. The Versioning & changelog page tracks the current skill and protocol versions.

The installer performs the required verification itself: Ed25519 signature over the release statement, statement/manifest identity, supported protocol major, downloaded-byte SHA-256, and a skill frontmatter smoke check. For an independent byte check, compare the installed file to the manifest:

Managed updates are fail-closed. A verified candidate is written to a staging file and activated atomically. An existing installer-managed copy is backed up; a custom local copy is refused unless an operator deliberately passes --allow-custom after preserving changes. Signature, network, hash, compatibility, smoke, or activation failure keeps or restores the prior copy. --active-pinned-session defers without network or filesystem changes. --preference accepts update_now, always_current, snooze, or disabled. To uninstall, remove the chosen SKILL.md plus its adjacent .semel-release.json and .semel-update-preference.json metadata after ending active sessions.