microvoid · smackgg · Jul 31, 2026
@@ -4,11 +4,11 @@
   "id": "nexus-service",
   "name": "Convax Account",
   "description": "Connects Convax to your Convax Account for OpenRouter chat and live image-model generation through short-lived Data Tokens.",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "companions": [
     {
       "command": "convax-nexus-mcp",
-      "version": "0.3.13",
+      "version": "0.3.14",
       "source": "packages/tools/nexus-mcp",
       "targets": [
         {

@@ -1,6 +1,6 @@
 {
   "name": "@microvoid/convax-plugin-nexus-service",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "private": true,
   "type": "module",
   "dependencies": {

@@ -3,7 +3,7 @@
   "id": "nexus-service",
   "name": "Convax Account",
   "description": "Connects Convax to your Convax Account for OpenRouter chat and live image-model generation through short-lived Data Tokens.",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "contributes": {
     "generation": {
       "models": [
@@ -18,7 +18,11 @@
           "title": "Nexus · OpenRouter Image",
           "description": "Generate an image with an image-output model available through the connected Nexus OpenRouter Provider.",
           "output": "image",
-          "acceptedInputs": []
+          "acceptedInputs": [],
+          "recovery": {
+            "schema": "convax.generation-lro/1",
+            "mode": "long-running-operation"
+          }
         }
       ]
     },

@@ -15,20 +15,29 @@ until the service adds a dedicated video Usage Inspector and quota settlement mo
 When the live image catalog is bounded, the companion marks its model field so a
 compatible host can present each image model as a direct choice. If that catalog
 cannot be loaded, has no image models, or exceeds the bounded choice limit, the
-companion omits image generation from `tools/list` instead of exposing a free-text
-model field.
+companion keeps the fixed Service and LLM tools available but omits image generation
+instead of exposing a free-text model field.
 
 The companion keeps the validated image catalog, Provider route, and short-lived
 Data Token together in one bounded in-memory route. The `tools/call` that follows
 `tools/list` reuses that exact route and never repeats authorization, Provider, or
-model discovery inside the generation call. Route credentials remain private to
-the companion and are invalidated before their token refresh window.
+model discovery inside the generation call. The selected concrete model is checked
+against that route immediately before execution; a stale catalog is invalidated and
+reloaded instead of silently using another model. Route credentials remain private
+to the companion and are invalidated before their token refresh window.
 
-Each image request sends the host operation id as `x-nexus-request-id` for safe
-diagnostic correlation. A rejected request exposes only its HTTP status, an
-allow-listed Gateway error code, and that locally generated operation id to the MCP
-caller. Response-provided identifiers, raw upstream messages, response bodies,
-prompts, and tokens never cross that diagnostic boundary.
+Each image request sends the host operation id as both `idempotency-key` and
+`x-nexus-request-id`. Before contacting Nexus, the companion durably records the
+operation and stable task receipt in its Host-provisioned private recovery
+directory. Restart recovery reuses the same operation id and request fingerprint;
+a completed result is byte-verified and replayed from the private journal without
+contacting Nexus again. A changed request, result digest, or stored artifact fails
+closed.
+
+Canvas receives one bounded failure message. Exact bounded HTTP status, allowlisted
+Gateway code, operation-correlated request id, and safe cause-chain messages stay in
+Main/sidecar logs. Response-provided identifiers, raw upstream messages, response
+bodies, prompts, tokens, and native paths never cross that diagnostic boundary.
 
 The companion owns PKCE and the loopback callback, stores the rotating Nexus refresh
 grant in a private user file, and exposes only a random loopback Gateway credential to
@@ -39,16 +48,17 @@ Nexus Plan, quota, subscription state, and allowlisted Checkout Plans from the
 authorized User API. AI budget balances are displayed in USD; during a rolling
 Nexus upgrade, legacy micro-USD quota fields are converted locally instead of being
 shown as raw quota units. The fixed `service.checkout` tool accepts only one advertised
-Plan key, reuses a private idempotency key for retries, and returns a Checkout URL
+Plan key, single-flights concurrent creation for that account and Plan, reuses a
+private idempotency key for transport retries, and returns a Checkout URL
 only to Convax Main for strict HTTPS validation and system-browser navigation.
 Redirect Checkouts open the Provider URL directly. QR Checkouts open the trusted
 Nexus Account Portal, which restores that Checkout and renders its native payment
 code without exposing a non-HTTPS Provider URL to the Convax host.
 Neither the retry record nor any Renderer-facing value contains a Nexus token,
 Provider Product id, payment credential, or Checkout URL.
 
-During a rolling Nexus API upgrade, a deployment may still return the base Access
-shape without embedded Plan or Billing metadata. The companion continues to verify
-the Workspace, Provider, and dedicated Quota endpoint in that case, reports Plan
-and Billing as unavailable, and enables Checkout only after Nexus advertises its
-authoritative allowlisted Plans.
+The authoritative base Access shape may omit optional Plan or Billing metadata; in
+that case those optional fields are unavailable by definition. Failure of any
+required Access, Provider, or Quota request fails the complete `service.status`
+operation rather than returning a partial status. Sign-out clears the durable
+Checkout attempt even when remote revoke fails.
@@ -1,6 +1,6 @@
 {
   "name": "@microvoid/convax-nexus-mcp",
-  "version": "0.3.13",
+  "version": "0.3.14",
   "private": true,
   "license": "MIT",
   "type": "module",