fix: correct PROXY_CALLERS raw key format + session 6 facts

- agent_prompts.md: store raw keys in PROXY_CALLERS (app.py hashes internally);
  pre-hashing caused double-hash → all jenkins auth failed
- context.md: session 6 facts — Phase 1 complete, PROXY_CALLERS bug fixed,
  behavior_changes table created, Jenkinsfile shell operator bug logged (id=1),
  next session: fix Jenkinsfile then launch Phase 2

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

agent-builder/agent_prompts.md

@@ -51,9 +51,11 @@ db         = vread(tok, 'postgres/secrets-proxy')
 ntfy       = vread(tok, 'ntfy/secrets-proxy-bot')
 urllib.request.urlopen(urllib.request.Request(f'{VAULT_ADDR}/v1/auth/token/revoke-self', data=b'{}', headers={'X-Vault-Token': tok, 'Content-Type':'application/json'}, method='POST'))
 
-ch = {n: hashlib.sha256(k.encode()).hexdigest() for n, k in callers.items()}
+
+# IMPORTANT: store RAW keys — app.py hashes them internally via CALLER_KEY_TO_NAME
+# Do NOT pre-hash: storing hashed keys causes double-hash, all auth fails
 lines = [
-    f'PROXY_CALLERS={json.dumps(ch)}',
+    f'PROXY_CALLERS={json.dumps(callers)}',
     'VAULT_PROD_ADDR=http://192.168.1.88:8200',
     f'VAULT_PROD_ROLE_ID={approle.get("role_id","")}',
     f'VAULT_PROD_SECRET_ID={approle.get("secret_id","")}',
@@ -480,6 +482,7 @@ Write a Python script that:
 
 Run the same restart_proxy.py pattern from id=163 (already in your instructions above).
 The script reads proxy/callers from Vault (now includes hermes) and restarts with updated PROXY_CALLERS.
+IMPORTANT: Store raw keys in PROXY_CALLERS (not pre-hashed) — app.py hashes internally. Use json.dumps(callers) not json.dumps({n: sha256(k) for n,k in callers.items()}).
 Script template is identical to P1-1 — write it fresh to /tmp/restart_proxy_161.py and run it.
 Verify: curl http://172.16.16.12:8080/health returns 200.