Implement S7 operator connect helpers for SaaS and channels.

Add dry-run-default connect dispatcher and per-integration scripts with gitignored local capability state, docs, and unit tests. Mutations require --apply and use nemohermes/openshell only.

docs/INSTALL.md

@@ -1,6 +1,6 @@
 # Install
 
-**Status:** Stages S0–S6 implemented. S7 pending.
+**Status:** Stages S0–S7 implemented.
 
 ## Stages
 
@@ -14,7 +14,7 @@
 | S4 | Host script | Sandbox verify (attach) or onboard (clean host) | ✅ Implemented |
 | S5 | Host script | Policy overlays + skills sync via nemohermes | ✅ Implemented |
 | S6 | Host script | Doctor green | ✅ Implemented |
-| S7 | Owner + operator connect helpers | Name assistant; connect **their** SaaS/channels | ⏳ Pending |
+| S7 | Owner + operator connect helpers | Name assistant; connect **their** SaaS/channels | ✅ Implemented |
 
 ## Platform commands (normative)
 
@@ -165,6 +165,91 @@ make install-s3-s5
 - See [design/scenarios.md](../design/scenarios.md) (S1–S5) for operational scenarios.
 - See [OPERATIONS.md](OPERATIONS.md) for day-2 operator commands.
 
+## S7: Owner messaging + operator connect scripts
+
+After install stages S0–S6 are complete, the operator connects the owner's SaaS
+integrations and messaging channels.
+
+**Safety model:** `--dry-run` is the default. Use `--apply` to perform mutations.
+All mutations use `nemohermes` / `openshell`. No parallel control API.
+
+### Connect dispatcher
+
+```bash
+./scripts/connect.sh --help
+./scripts/connect.sh status
+./scripts/connect.sh all --dry-run    # preview all targets
+./scripts/connect.sh all --apply      # execute all targets
+```
+
+### Per-target connect
+
+```bash
+# Name / profile (sandbox identity)
+./scripts/connect.sh name --dry-run
+./scripts/connect.sh name --apply
+
+# Messaging channels (WhatsApp, Email, Telegram)
+./scripts/connect.sh channels --target whatsapp --dry-run
+./scripts/connect.sh channels --target whatsapp --apply
+./scripts/connect.sh channels --target telegram --apply
+./scripts/connect.sh channels --target email --apply
+
+# Square (remote MCP — read-only tools)
+./scripts/connect.sh square --dry-run
+./scripts/connect.sh square --apply
+
+# QuickBooks Online (local MCP — read-only tools)
+./scripts/connect.sh quickbooks --dry-run
+./scripts/connect.sh quickbooks --apply
+
+# Vagaro (REST + webhooks)
+./scripts/connect.sh vagaro --dry-run
+./scripts/connect.sh vagaro --apply
+```
+
+### Make targets
+
+```bash
+make connect              # show connect help
+make connect-status       # show connection status
+make connect-name         # name / profile (--dry-run)
+make connect-channels     # channels (--dry-run)
+make connect-square       # Square (--dry-run)
+make connect-quickbooks   # QuickBooks (--dry-run)
+make connect-vagaro       # Vagaro (--dry-run)
+make connect-all          # all targets (--dry-run)
+```
+
+### Connection state
+
+State is stored in `.local/capability_state.json` (gitignored). Status values:
+
+| Status | Meaning |
+|--------|---------|
+| `connected` | Integration is active and verified |
+| `skipped` | Operator or owner chose to skip |
+| `later` | Planned for future setup |
+| `error` | Connection attempt failed — needs attention |
+| `offline` | Not yet connected — using fixtures |
+
+### Capability report
+
+After connecting, export a capability report compatible with the setup-education skill:
+
+```bash
+# Via the connect state library (source in a script)
+source scripts/lib/connect_state.sh
+export_capability_report > /tmp/capability_report.json
+```
+
+### Owner-safe messaging
+
+The owner never receives terminal, Docker, or editor instructions. All connect
+work is done by the operator using these scripts. The owner interacts with the
+assistant through connected channels (WhatsApp, Email, Telegram) and completes
+vendor browser steps (OAuth consent, BotFather, etc.) on their own devices.
+
 ## UAT host notes
 
 This repository was tested on a live host with: