# Foster ↔ Michel correlated-return Phase 3

This package upgrades the existing Phase 2 bridge so Michel's completed verification returns through Foster to the originating Telegram chat, topic, and triggering message.

## Install

Run as the same Linux user that owns the existing `foster-michel-tunnel.service`:

```bash
unzip foster-michel-phase3.zip -d foster-michel-phase3
cd foster-michel-phase3
chmod 700 install.sh
./install.sh
```

If auto-discovery cannot find the active Hermes directories:

```bash
FOSTER_AGENT_DIR=/absolute/path/to/hermes-agent \
FOSTER_HERMES_HOME=/absolute/path/to/active/hermes/home \
./install.sh
```

Success marker:

```text
SAL_PHASE3_STATUS=SUCCESS
```

## What it changes

- Installs the native `ask_michel_verify` tool into Foster's Hermes Agent.
- Captures platform/chat/topic/user/message routing through Hermes ContextVars.
- Adds an HMAC-authenticated `michel-result` deliver-only webhook route.
- Preserves direct reply anchors for webhook cross-platform delivery.
- Upgrades the SSH service with a restricted reverse callback forward:
  `Windows 127.0.0.1:18645 → Linux 127.0.0.1:8765`.
- Preserves the Phase 2 request forward:
  `Linux 127.0.0.1:18644 → Windows 127.0.0.1:8644`.
- Installs an `ask-michel` skill telling Foster when and how to use the native tool.

The callback secret is retrieved over authenticated SFTP and is never printed.