catalogue: Dial update, plus Dead Simple Email, Kinetic Pricing, Rent A Human, Upfile

[Alexgodoroja]

Catalogue entries matching the app-store set already live on the website (pilot-protocol/website#203), so the store pages and the catalogue agree.

App	Version	Methods	Auth	Note
Dial	0.1.0	20	byo + provider signup	app update
Dead Simple Email	0.1.0	19	byo + agent signup	new
Kinetic Pricing	1.0.0	27	managed	new
Rent A Human	0.2.0	5	managed	new
Upfile	0.2.3	10	cli + sourced binaries	new

Dial — the urgent one

Dial ships here as an app update. Its pages are already live on the store, and this entry is what makes pilotctl appstore install io.pilot.dial actually resolve. A real US phone number for an agent: AI voice calls, SMS and iMessage, with a transferTo that waits out hold music and IVR menus and hands the live call to a human the moment a real person answers.

Its API came back from the scheduled-maintenance window it was in earlier, so every claim in the listing was verified against a live endpoint rather than taken from the submission.

Verification

• 20 platform bundles live on the prod artifact registry, each fetched back over its public URL and sha-checked — not just confirmed as uploaded.
• Every entry passes all ten review-gate checks. The only ✗ in a full-catalogue verify are the pre-existing io.pilot.wallet and io.pilot.smolmachines, untouched here.
• metadata_sha256 pinned to the committed bytes for each app, checked after writing. This is the check that broke agentphone's store page in July.
• catalogue.json re-signed; the signature verifies under the embedded trust anchor. Catalogue stays at version: 2.

Store pages

Hand-built from each authored submission rather than generated, with description_md, product_demo and next_steps lifted verbatim so a page cannot drift from what installs. The generated path reuses an existing page and refreshes only runtime facts, which is right for a version bump and wrong for a first entry.

Publisher keys

One stable key per app, generated for this release and held out of the repo. Whichever key first publishes an app owns every future update to it, and moving it later is an admin-gated rotation — worth knowing before this merges.

Before the managed apps work

Two apps are managed and need a broker master key registered before any call succeeds:

• Kinetic — KINETIC_MASTER_KEY, in hand.
• Rent A Human — RENTAHUMAN_MASTER_KEY, being sourced. Partner access is enterprise-gated and not self-serve, so this app will install and 401 at the broker until that key lands. If you would rather not ship a guaranteed-failing app, drop that one entry and I will re-add it with the key; the other four are independent.

Broker registry entries for both — including per-user tenancy and a credit block — are in app-template#100 under deploy/broker-entries/. Tenancy matters here because both apps front a shared partner account: without it, any Pilot user could read another user's pricing studies or their RentAHuman request thread, phone number included. That is covered by attack tests which I verified fail when tenancy is disabled.

Opened by hand

publish-on-merge cannot do this yet. The token is set and valid — the :? guard passes — but publish-rich-from-r2.sh:187 clones pilot-protocol/pilotprotocol with stderr sent to /dev/null, so a scope failure on that repo specifically kills the script with no message. Removing that redirect would have saved several weeks of misdiagnosis, mine included.

[Alexgodoroja]

Dial is the urgent one in this set — treating it as an app update.

Its store pages are already live on the website, so this catalogue entry is what makes the install command resolve rather than 404. Everything Dial needs is in place:

• 4 platform bundles live on the prod registry, fetched back and sha-checked
• all ten review-gate checks green
• metadata_sha256 pinned to the committed bytes
• API verified live — it came back from the maintenance window it was in earlier, so the listing was checked against real responses rather than taken on trust
• byo auth with a provider signup, so no key is needed from us for it to work end to end

Dial has no dependency on the two broker keys, so if you want it out immediately this entry can merge on its own and the rest can follow.