Implement install stages S3–S5: package, policy, and skills sync.

Attach/onboard sandbox from agents/hermes, additive OpenShell policy overlays, and nemohermes skill install for scaffold skills. No doctor/connect and no push.

docs/INSTALL.md

@@ -1,16 +1,18 @@
 # Install
 
-**Status:** Stages S0–S2 implemented. S3–S7 pending.
+**Status:** Stages S0–S5 implemented. S6–S7 pending.
 
 ## Stages
 
 | Stage | Where | Outcome | Status |
-|-------|--------|---------|--------|
+|-------|-------|---------|--------|
 | S0 | Human | Host per [DEPLOYER_HOST.md](DEPLOYER_HOST.md) | ✅ Procedural |
 | S0b | Host script | Docker installed if missing | ✅ Implemented |
 | S1 | Host script | Repo env, `.env` from `.env.example` | ✅ Implemented |
 | S2 | Host script | Main + aux vision config; vision smoke | ✅ Implemented |
-| S3–S5 | Host → Compose / `nemohermes` | Stack, sandbox, policy, skills | ⏳ Pending |
+| S3 | Host script | Stack alignment (compose docs; OpenShell owns sandbox) | ✅ Implemented |
+| S4 | Host script | Sandbox verify (attach) or onboard (clean host) | ✅ Implemented |
+| S5 | Host script | Policy overlays + skills sync via nemohermes | ✅ Implemented |
 | S6 | Host script | Doctor green | ⏳ Pending |
 | S7 | Owner + operator connect helpers | Name assistant; connect **their** SaaS/channels | ⏳ Pending |
 
@@ -86,20 +88,79 @@ make install-s2
 
 **If the gateway is not yet connected:** the script validates the endpoint and skips the `openshell` write. S3+ will handle full gateway configuration.
 
-## Run all stages (S0b–S2)
+## S3: Stack alignment
+
+```bash
+./scripts/install.sh --stage s3
+# or
+make install-s3
+```
+
+**What it does:**
+- Documents that OpenShell manages the Hermes sandbox container.
+- The product compose file (`deploy/compose/docker-compose.yml`) is optional — used only for local MCP and webhook services at S7+.
+- No action needed for UAT attach path.
+
+**Key principle:** OpenShell owns the sandbox. The product does NOT define the sandbox in `docker-compose.yml`.
+
+## S4: Sandbox verification or onboard
+
+```bash
+./scripts/install/s4-sandbox.sh              # attach mode (default)
+./scripts/install/s4-sandbox.sh --mode attach
+./scripts/install/s4-sandbox.sh --mode onboard
+./scripts/install/s4-sandbox.sh --mode onboard --dry-run
+# or
+make install-s4
+```
+
+**Attach mode (default):**
+- Verifies the sandbox exists and is healthy.
+- Checks that the agent package (`agents/hermes/`) is present.
+- No destructive operations.
+
+**Onboard mode (clean host):**
+- Creates a new sandbox from the agent package using `nemohermes onboard`.
+- If a sandbox with the same name already exists, falls back to attach mode for safety.
+- Use `--dry-run` to preview without executing.
+
+## S5: Policy overlays + skills sync
+
+```bash
+./scripts/install/s5-policy-skills.sh        # policy + skills
+./scripts/install/s5-policy-skills.sh --policy-only
+./scripts/install/s5-policy-skills.sh --skills-only
+# or
+make install-s5
+```
+
+**What it does:**
+1. **Policy:** Applies the inference policy overlay from `policy/openshell/overlays/inference.yaml` via `nemohermes policy-add`. Existing balanced-tier presets (npm, pypi, huggingface, brew) are preserved.
+2. **Skills:** Iterates skill directories under `skills/` (skipping `_lib`) and installs each via `nemohermes skill install`. Skills without `SKILL.md` are skipped with a warning.
+
+**Additive only:** policy-add never removes existing presets. Skills install is idempotent.
+
+## Run all stages (S0b–S5)
 
 ```bash
 ./scripts/install.sh
 # or
 make install
-# or
-make install-s0-s2
 ```
 
-## After install (S0–S2)
+## Run S3–S5 only (attach path)
+
+```bash
+./scripts/install.sh --stage s3-s5
+# or
+make install-s3-s5
+```
+
+## After install (S0–S5)
 
 - Verify `.env` values are correct for your environment.
-- Continue with S3+ when implemented (compose stack, sandbox creation, policy, skills).
+- Check policy: `nemohermes <name> policy-list`
+- Continue with S6 (doctor) when implemented.
 - See [SETUP_UX.md](SETUP_UX.md) for owner-facing setup after full install.
 - See [design/scenarios.md](../design/scenarios.md) (S1–S5) for operational scenarios.