@rubytech/create-maxy-code 0.1.0

package/payload/platform/scripts/seed-neo4j.sh

@@ -0,0 +1,590 @@
+#!/usr/bin/env bash
+# ============================================================
+# seed-neo4j.sh — Phase 0 setup
+# Creates the account from templates and applies Neo4j schema.
+# Product knowledge is ingested post-installation via the admin
+# agent, not seeded as cypher.
+# ============================================================
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
+TEMPLATES_DIR="$PROJECT_DIR/templates"
+# Accounts live at {installDir}/data/accounts/ — outside the platform/ wipe zone.
+INSTALL_DIR="$(dirname "$PROJECT_DIR")"
+ACCOUNTS_DIR="$INSTALL_DIR/data/accounts"
+NEO4J_DIR="$PROJECT_DIR/neo4j"
+
+# NEO4J_URI is hard-required (Task 787). The previous default
+# `bolt://localhost:7687` would silently route the seed to the wrong Neo4j on
+# any brand-dedicated install — masking every other defect downstream.
+if [ -z "${NEO4J_URI:-}" ]; then
+  echo "Error: NEO4J_URI required (no default — see Task 787)" >&2
+  exit 1
+fi
+NEO4J_USER="${NEO4J_USER:-neo4j}"
+
+# Read password from the file created during setup
+NEO4J_PASSWORD_FILE="$PROJECT_DIR/config/.neo4j-password"
+if [ -n "${NEO4J_PASSWORD:-}" ]; then
+  : # Explicit env var takes precedence
+elif [ -f "$NEO4J_PASSWORD_FILE" ]; then
+  NEO4J_PASSWORD=$(cat "$NEO4J_PASSWORD_FILE")
+else
+  echo "Error: Neo4j password not found."
+  echo "  Expected at: $NEO4J_PASSWORD_FILE"
+  echo "  Or set NEO4J_PASSWORD environment variable."
+  exit 1
+fi
+
+CYPHER_SHELL="cypher-shell"
+
+# ------------------------------------------------------------------
+# 1. Create account from templates
+# ------------------------------------------------------------------
+
+# Resolve existing account by identity (users.json[0].userId) or mint a new one on fresh install.
+# Orphan siblings under data/accounts/ — non-matching dirs left behind by Task 380's userId
+# regeneration — are swept to data/accounts/.trash/<uuid>-<ISO8601-ts>/. Multi-candidate with
+# no identity match aborts loud; .trash/ is operator-emptied, never auto-cleaned.
+# shellcheck source=lib/resolve-account-dir.sh
+. "$SCRIPT_DIR/lib/resolve-account-dir.sh"
+# Resolve brand-aware persistent users.json path before the resolver runs.
+# Mirrors the resolution lower in this file (around the post-Task-904 USERS_FILE
+# block); duplicated here because resolve_and_sweep_account_dir runs first.
+_RESOLVER_CONFIG_DIR_NAME=".maxy"
+if [ -f "$PROJECT_DIR/config/brand.json" ]; then
+  _RESOLVER_BRAND_CFG_DIR=$(python3 -c "import json; print(json.load(open('$PROJECT_DIR/config/brand.json')).get('configDir',''))" 2>/dev/null || true)
+  [ -n "$_RESOLVER_BRAND_CFG_DIR" ] && _RESOLVER_CONFIG_DIR_NAME="$_RESOLVER_BRAND_CFG_DIR"
+fi
+USERS_FILE="$HOME/$_RESOLVER_CONFIG_DIR_NAME/users.json" resolve_and_sweep_account_dir
+
+mkdir -p "$ACCOUNT_DIR/agents/admin" "$ACCOUNT_DIR/.claude" "$ACCOUNT_DIR/specialists/.claude-plugin" "$ACCOUNT_DIR/specialists/agents"
+
+# Claude Code discovers project-level .claude/ (agents, settings) relative to the
+# nearest .git root. Without a .git in the account directory, Claude Code traverses
+# up to ~/maxy/.git and misses everything in accountDir/.claude/. Initialise a git
+# repo so the account directory IS the project root for Claude Code.
+[ -d "$ACCOUNT_DIR/.git" ] || git init -q "$ACCOUNT_DIR"
+
+# Claude Code permissions — project-level settings now work since the account dir
+# has .git. Write permissions to the account's own .claude/settings.json.
+ACCOUNT_SETTINGS="$ACCOUNT_DIR/.claude/settings.json"
+
+# Wildcard permissions for all plugin MCP servers (core + optional).
+# Including optional plugins here is safe — permissions without a running
+# MCP server are inert. This ensures tools are allowed when the user
+# enables an optional plugin, without requiring a re-seed.
+MAXY_PERMISSIONS='["Read","Edit","Write","Bash","Glob","Grep","Agent","mcp__memory__*","mcp__contacts__*","mcp__telegram__*","mcp__admin__*","mcp__cloudflare__*","mcp__tasks__*","mcp__scheduling__*","mcp__email__*","mcp__workflows__*","mcp__web__*","mcp__plugin_playwright_playwright__*"]'
+
+# Append wildcard permissions for any optional plugins not already covered
+PLUGINS_DIR="$(dirname "$0")/../plugins"
+if [ -d "$PLUGINS_DIR" ]; then
+  for PLUGIN_DIR in "$PLUGINS_DIR"/*/; do
+    PLUGIN_NAME="$(basename "$PLUGIN_DIR")"
+    # Skip plugins already in the static list
+    case "$MAXY_PERMISSIONS" in
+      *"mcp__${PLUGIN_NAME}__"*) continue ;;
+    esac
+    # Only add if plugin has an MCP server
+    if [ -d "$PLUGIN_DIR/mcp" ]; then
+      MAXY_PERMISSIONS="${MAXY_PERMISSIONS%]},\"mcp__${PLUGIN_NAME}__*\"]"
+    fi
+  done
+fi
+
+# Always overwrite — Rubytech-controlled. Project-level settings take
+# precedence over global, so each account is properly isolated.
+#
+# Hook commands use $PLATFORM_ROOT (set by claude-agent.ts at spawn time)
+# to locate scripts relative to the platform installation, not the account dir.
+#
+# Hooks wired:
+#   PreToolUse — pre-tool-use.sh: admin write boundaries
+#                playwright-file-guard.sh: intercepts browser_navigate with file:// URLs
+#                webfetch-preflight.mjs: detects JS-SPA shells before WebFetch's
+#                  60s extraction timeout (Task 536). Fail-open on any error;
+#                  on positive SPA detection exits 2 with WEBFETCH_CANNOT_READ_JS_SPA.
+#                archive-ingest-surface-gate.sh (Task 855 → Task 894):
+#                  narrows the database-operator subagent's effective surface
+#                  during conversation-archive ingestion to exactly one Bash
+#                  entry (memory/bin/conversation-archive-ingest.sh --source
+#                  <enum>) plus read-only neighbours. The Task-894 generalised
+#                  ingest path replaces the WhatsApp-specific Task-855 path.
+#                  Defensive blocks remain on the deleted legacy MCP tool names
+#                  (mcp__memory__whatsapp-export-{parse,preview,insight-write,
+#                  insight-pass}, mcp__memory__memory-archive-write when
+#                  archiveType=whatsapp-export). Preserves the plugin-source edit,
+#                  JS test-runner, and post-parse-error blocks (LinkedIn and
+#                  future per-source archive parsers still use the legacy MCP
+#                  path until they migrate to deterministic Bash entries).
+#                  Wired at three points: explicit Edit/Write/NotebookEdit/Bash
+#                  matchers, a no-matcher PreToolUse entry (catches the legacy
+#                  MCP tools and post-parse-error gate fires on every tool),
+#                  and a PostToolUse regex matcher for parse tools.
+#                UserPromptSubmit — archive-ingest-surface-gate.sh clears the
+#                  parse-error flag when the operator's next prompt arrives.
+HOOKS_PATH="\$PLATFORM_ROOT/plugins/admin/hooks"
+cat > "$ACCOUNT_SETTINGS" << SETTINGS_EOF
+{
+  "permissions": {
+    "allow": $MAXY_PERMISSIONS
+  },
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Write",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/pre-tool-use.sh admin" },
+          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
+        ]
+      },
+      {
+        "matcher": "Edit",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/pre-tool-use.sh admin" },
+          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
+        ]
+      },
+      {
+        "matcher": "NotebookEdit",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
+        ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/pre-tool-use.sh admin" },
+          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
+        ]
+      },
+      {
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
+        ]
+      },
+      {
+        "matcher": "mcp__plugin_playwright_playwright__browser_navigate",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/playwright-file-guard.sh" }
+        ]
+      },
+      {
+        "matcher": "WebFetch",
+        "hooks": [
+          { "type": "command", "command": "node $HOOKS_PATH/webfetch-preflight.mjs" }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "mcp__.*__.*-(export|import)-parse$",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
+        ]
+      }
+    ]
+  }
+}
+SETTINGS_EOF
+
+# Always overwrite IDENTITY.md — Rubytech-controlled, pure behaviour.
+cp "$TEMPLATES_DIR/agents/admin/IDENTITY.md" "$ACCOUNT_DIR/agents/admin/IDENTITY.md"
+if [ -d "$ACCOUNT_DIR/agents/public" ]; then
+  cp "$TEMPLATES_DIR/agents/public/IDENTITY.md" "$ACCOUNT_DIR/agents/public/IDENTITY.md"
+else
+  echo "  Skipping agents/public — directory does not exist (user has not created a public agent)"
+fi
+
+# Always overwrite specialist plugin — Rubytech-controlled, not user-editable.
+# Specialists are a Claude Code plugin loaded via --plugin-dir. The plugin lives at
+# accountDir/specialists/ with .claude-plugin/plugin.json and agents/*.md.
+# The admin agent dispatches them as specialists:{name} via the Agent tool.
+cp "$TEMPLATES_DIR/specialists/.claude-plugin/plugin.json" "$ACCOUNT_DIR/specialists/.claude-plugin/plugin.json"
+
+# Remove orphaned core specialist files before copying fresh templates.
+# Core specialists (no '--' in filename) are Rubytech-controlled and fully replaced
+# on every seed. Premium plugin agents (filename contains '--') are preserved —
+# they are managed by the admin agent when plugins are activated/deactivated.
+for _existing in "$ACCOUNT_DIR/specialists/agents/"*.md; do
+  [ -f "$_existing" ] || continue
+  case "$(basename "$_existing")" in
+    *--*) continue ;;  # Premium plugin agent — preserve
+  esac
+  rm -f "$_existing"
+done
+
+for specialist in "$TEMPLATES_DIR/specialists/agents/"*.md; do
+  [ -f "$specialist" ] && cp "$specialist" "$ACCOUNT_DIR/specialists/agents/$(basename "$specialist")"
+done
+
+# Clean up stale .claude/agents/*.md from previous seed format.
+# The old format placed specialists here as slash-command agents — that never worked
+# for programmatic dispatch. Safe to remove; .claude/ dir stays for settings.json.
+rm -f "$ACCOUNT_DIR/.claude/agents/"*.md 2>/dev/null || true
+
+# SOUL.md — user-controlled personalisation. Only create if missing. Never overwrite.
+[ -f "$ACCOUNT_DIR/agents/admin/SOUL.md" ] || cp "$TEMPLATES_DIR/agents/admin/SOUL.md" "$ACCOUNT_DIR/agents/admin/SOUL.md"
+
+# Public agent files — only provision if the user has created a public agent (directory exists).
+# config.json is what makes the agent visible in the sidebar; creating it here would
+# resurrect an agent the user deliberately deleted.
+if [ -d "$ACCOUNT_DIR/agents/public" ]; then
+  [ -f "$ACCOUNT_DIR/agents/public/SOUL.md" ] || cp "$TEMPLATES_DIR/agents/public/SOUL.md" "$ACCOUNT_DIR/agents/public/SOUL.md"
+  [ -f "$ACCOUNT_DIR/agents/public/config.json" ] || cp "$TEMPLATES_DIR/agents/public/config.json" "$ACCOUNT_DIR/agents/public/config.json"
+fi
+
+# AGENTS.md — specialist registry. Pre-populated from templates, maintained by admin agent at runtime.
+# Always overwrite on re-seed (Rubytech-controlled initial state, like IDENTITY.md).
+# Dispatch format: specialists:{name} via the Agent tool.
+printf '# Installed Roles\n\nDispatch via the Agent tool with `subagent_type: "specialists:{name}"`.\n\n' > "$ACCOUNT_DIR/agents/admin/AGENTS.md"
+for specialist in "$ACCOUNT_DIR/specialists/agents/"*.md; do
+  [ -f "$specialist" ] || continue
+  # Extract name and description from YAML frontmatter
+  _name=$(sed -n 's/^name: *//p' "$specialist" | head -1)
+  _desc=$(sed -n 's/^description: *"*//p' "$specialist" | sed 's/"$//' | head -1)
+  [ -z "$_name" ] && continue
+  # Skip Phase 1 stubs — not yet functional
+  echo "$_desc" | grep -qi "Phase 1" && continue
+  printf -- '- **specialists:%s**: %s\n' "$_name" "$_desc" >> "$ACCOUNT_DIR/agents/admin/AGENTS.md"
+done
+
+# Create account.json only if it doesn't exist (business config is in the graph).
+# Reads defaults from the template so there is a single source of truth.
+if [ ! -f "$ACCOUNT_DIR/account.json" ]; then
+  TEMPLATE="$TEMPLATES_DIR/account.json"
+  if [ -f "$TEMPLATE" ]; then
+    sed "s/\"accountId\": *\"[^\"]*\"/\"accountId\":\"$ACCOUNT_ID\"/" "$TEMPLATE" \
+      | sed "s/\"tier\": *\"[^\"]*\"/\"tier\":\"solo\"/" \
+      > "$ACCOUNT_DIR/account.json"
+  else
+    echo "ERROR: account.json template not found at $TEMPLATE" >&2
+    exit 1
+  fi
+fi
+
+# Backfill defaultAgent in account.json if missing (existing accounts pre-Task 108).
+# Uses the first non-admin agent directory that has a config.json.
+if [ -f "$ACCOUNT_DIR/account.json" ] && ! grep -q '"defaultAgent"' "$ACCOUNT_DIR/account.json"; then
+  _DEFAULT_SLUG=""
+  for _AGENT_DIR in "$ACCOUNT_DIR/agents"/*/; do
+    _AGENT_NAME="$(basename "$_AGENT_DIR")"
+    [ "$_AGENT_NAME" = "admin" ] && continue
+    [ -f "$_AGENT_DIR/config.json" ] && { _DEFAULT_SLUG="$_AGENT_NAME"; break; }
+  done
+  if [ -n "$_DEFAULT_SLUG" ]; then
+    # Insert defaultAgent before the closing brace
+    sed -i'' "s/}$/,\"defaultAgent\":\"$_DEFAULT_SLUG\"}/" "$ACCOUNT_DIR/account.json"
+    echo "  Backfilled defaultAgent=$_DEFAULT_SLUG in account.json"
+  fi
+fi
+
+# ------------------------------------------------------------------
+# Seed enabledPlugins from brand.json plugins.defaultEnabled
+# ------------------------------------------------------------------
+# Fresh accounts: replaces the template's empty [] with defaultEnabled.
+# Existing accounts: additive merge — adds missing defaultEnabled entries,
+# never removes plugins the user enabled manually.
+# Dependency validation: skips any defaultEnabled plugin whose PLUGIN.md
+# `requires:` dependencies are not satisfied by core or defaultEnabled.
+BRAND_JSON="$PROJECT_DIR/config/brand.json"
+if [ -f "$BRAND_JSON" ] && [ -f "$ACCOUNT_DIR/account.json" ]; then
+  python3 -c "
+import json, os, sys
+
+brand_path = '$BRAND_JSON'
+account_path = '$ACCOUNT_DIR/account.json'
+plugins_dir = '$PROJECT_DIR/plugins'
+
+with open(brand_path) as f:
+    brand = json.load(f)
+
+plugins_cfg = brand.get('plugins', {})
+default_enabled = plugins_cfg.get('defaultEnabled', [])
+core = set(plugins_cfg.get('core', []))
+
+if not default_enabled:
+    print('  [seed] no defaultEnabled plugins in brand.json — skipping')
+    sys.exit(0)
+
+# Dependency validation: check each plugin's PLUGIN.md requires field.
+# A dependency is satisfied if it appears in core or in defaultEnabled.
+satisfied = core | set(default_enabled)
+validated = []
+for plugin in default_enabled:
+    plugin_md = os.path.join(plugins_dir, plugin, 'PLUGIN.md')
+    requires = []
+    if os.path.isfile(plugin_md):
+        in_frontmatter = False
+        in_requires = False
+        with open(plugin_md) as f:
+            for line in f:
+                stripped = line.rstrip()
+                if stripped == '---':
+                    if in_frontmatter:
+                        break
+                    in_frontmatter = True
+                    continue
+                if not in_frontmatter:
+                    continue
+                if stripped.startswith('requires:'):
+                    # Handle inline list: requires: [a, b]
+                    inline = stripped.split(':', 1)[1].strip()
+                    if inline.startswith('['):
+                        requires = [x.strip().strip('\"').strip(\"'\") for x in inline.strip('[]').split(',') if x.strip()]
+                        in_requires = False
+                    else:
+                        in_requires = True
+                    continue
+                if in_requires:
+                    if stripped.startswith('  - '):
+                        requires.append(stripped.lstrip(' -').strip())
+                    else:
+                        in_requires = False
+    unmet = [r for r in requires if r not in satisfied]
+    if unmet:
+        print(f'  [seed] WARNING: skipping defaultEnabled plugin \"{plugin}\" — unmet requires: {unmet}')
+    else:
+        validated.append(plugin)
+
+with open(account_path) as f:
+    account = json.load(f)
+
+existing = account.get('enabledPlugins', [])
+existing_set = set(existing)
+added = [p for p in validated if p not in existing_set]
+account['enabledPlugins'] = existing + added
+
+with open(account_path, 'w') as f:
+    json.dump(account, f, indent=2)
+    f.write('\n')
+
+if not existing:
+    print(f'  [seed] seeded enabledPlugins: {validated}')
+elif added:
+    print(f'  [seed] merged into enabledPlugins: +{added} (existing: {existing})')
+else:
+    print(f'  [seed] enabledPlugins already contains all defaultEnabled entries')
+"
+fi
+
+echo "  Account $ACCOUNT_ID at $ACCOUNT_DIR"
+
+# ------------------------------------------------------------------
+# 1b. Create first admin user (migration from .admin-pin)
+# ------------------------------------------------------------------
+
+CONFIG_DIR="$PROJECT_DIR/config"
+
+# Resolve the brand-specific config directory.
+# Mirrors the logic in platform/ui/app/lib/paths.ts.
+_CONFIG_DIR_NAME=".maxy"
+if [ -f "$CONFIG_DIR/brand.json" ]; then
+  _BRAND_CFG_DIR=$(python3 -c "import json; print(json.load(open('$CONFIG_DIR/brand.json')).get('configDir',''))" 2>/dev/null || true)
+  [ -n "$_BRAND_CFG_DIR" ] && _CONFIG_DIR_NAME="$_BRAND_CFG_DIR"
+fi
+ADMIN_PIN_FILE="$HOME/$_CONFIG_DIR_NAME/.admin-pin"
+# Task 904 — users.json lives under $HOME/$_CONFIG_DIR_NAME, not the wipe zone.
+USERS_FILE="$HOME/$_CONFIG_DIR_NAME/users.json"
+mkdir -p "$HOME/$_CONFIG_DIR_NAME"
+
+# Only create users.json if it doesn't exist AND .admin-pin exists (migration case).
+# Fresh installs: users.json is created by set-pin POST during onboarding.
+# .admin-pin is legacy — no longer read by the platform (Task 431).
+if [ ! -f "$USERS_FILE" ] && [ -f "$ADMIN_PIN_FILE" ]; then
+  USER_ID="$(cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c 'import uuid; print(uuid.uuid4())')"
+  PIN_HASH="$(cat "$ADMIN_PIN_FILE")"
+
+  # Create users.json with the first user entry.
+  # PINs are stored as SHA-256 hashes — same format as .admin-pin.
+  cat > "$USERS_FILE" << USERS_EOF
+[{"userId":"$USER_ID","name":"Owner","pin":"$PIN_HASH"}]
+USERS_EOF
+  echo "  [seed] created initial user: userId=$USER_ID"
+
+  # Add the user to account.json's admins array.
+  # The template includes "admins": [] — populate it with the owner entry.
+  if [ -f "$ACCOUNT_DIR/account.json" ]; then
+    python3 -c "
+import json, sys
+with open('$ACCOUNT_DIR/account.json', 'r') as f:
+    config = json.load(f)
+config.setdefault('admins', [])
+if not any(a.get('userId') == '$USER_ID' for a in config['admins']):
+    config['admins'].append({'userId': '$USER_ID', 'role': 'owner'})
+with open('$ACCOUNT_DIR/account.json', 'w') as f:
+    json.dump(config, f, indent=2)
+    f.write('\n')
+"
+    echo "  Added userId=$USER_ID as owner to account.json admins"
+  fi
+elif [ -f "$USERS_FILE" ]; then
+  # Re-run: users.json exists. Read the first user's ID for Neo4j seeding.
+  USER_ID=$(python3 -c "import json; print(json.load(open('$USERS_FILE'))[0]['userId'])" 2>/dev/null || true)
+  [ -n "$USER_ID" ] && echo "  Existing users.json found, userId=$USER_ID"
+
+  # Backfill admins in account.json if missing (existing accounts pre-Task 248).
+  if [ -f "$ACCOUNT_DIR/account.json" ] && ! grep -q '"admins"' "$ACCOUNT_DIR/account.json"; then
+    python3 -c "
+import json
+with open('$ACCOUNT_DIR/account.json', 'r') as f:
+    config = json.load(f)
+config['admins'] = [{'userId': '$USER_ID', 'role': 'owner'}]
+with open('$ACCOUNT_DIR/account.json', 'w') as f:
+    json.dump(config, f, indent=2)
+    f.write('\n')
+"
+    echo "  Backfilled admins array in account.json"
+  fi
+else
+  echo "  No .admin-pin found — skipping users.json creation (fresh install)"
+  USER_ID=""
+fi
+
+# ------------------------------------------------------------------
+# 2. Apply Neo4j schema (constraints + indexes only)
+# ------------------------------------------------------------------
+if ! command -v "$CYPHER_SHELL" &> /dev/null; then
+    echo "Error: cypher-shell not found. Install Neo4j or add cypher-shell to PATH."
+    exit 1
+fi
+
+echo "==> Connecting to Neo4j at $NEO4J_URI as $NEO4J_USER"
+
+# Schema migrations run before the main schema apply so renames don't collide
+# with the new declarations. Each statement is idempotent (`IF EXISTS`):
+#   - Task 249: `user_profile_account_unique` replaced by composite (accountId, userId).
+#   - Task 249: `preference_category` index replaced by (accountId, userId, category).
+#   - Task 748: `knowledge_fulltext` (3 labels) replaced by `entity_search` (~40 labels)
+#     with the universal label/property union. The new index is created by the
+#     schema apply below; dropping the old name here is what lets cypher-shell
+#     run both in one pass without conflict.
+echo "==> Migrating schema: dropping renamed/obsolete constraints + indexes..."
+"$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" << 'MIGRATE_EOF'
+DROP CONSTRAINT user_profile_account_unique IF EXISTS;
+DROP CONSTRAINT user_profile_account_user_unique IF EXISTS;
+DROP INDEX preference_category IF EXISTS;
+DROP INDEX knowledge_fulltext IF EXISTS;
+MIGRATE_EOF
+
+# Vector index dimensions — configurable at install time via --embed-model.
+# The installer sets EMBED_DIMENSIONS in the environment; default 768 (nomic-embed-text).
+EMBED_DIMENSIONS="${EMBED_DIMENSIONS:-768}"
+echo "==> Applying schema (constraints, indexes, vector indexes — ${EMBED_DIMENSIONS} dims)..."
+
+SCHEMA_CYPHER=$(sed "s/\`vector\.dimensions\`: 768/\`vector.dimensions\`: ${EMBED_DIMENSIONS}/g" "$NEO4J_DIR/schema.cypher")
+
+# Verify the substitution produced the expected dimension value
+if [ "$EMBED_DIMENSIONS" != "768" ] && ! echo "$SCHEMA_CYPHER" | grep -q "\`vector.dimensions\`: ${EMBED_DIMENSIONS}"; then
+  echo "WARNING: Expected dimension ${EMBED_DIMENSIONS} not found in schema output — indexes may use default 768"
+fi
+
+echo "$SCHEMA_CYPHER" | "$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI"
+
+# ------------------------------------------------------------------
+# Task 1007 — sessionKey backfill (idempotent, runs every seed pass).
+#
+# Conversation and Message rows minted before Task 985 carry only
+# `conversationId`. The new canonical identifier is `sessionKey` (same
+# UUID shape). This block copies conversationId → sessionKey on every
+# row where sessionKey is still null, leaving rows that already carry
+# sessionKey untouched. Re-runs are no-ops. The legacy
+# `conversation_id_unique` constraint and `m.conversationId` index
+# stay until the full code-rename slice lands and no path reads the
+# legacy field; the drop happens in Task 1007's open completion scope.
+# ------------------------------------------------------------------
+echo "==> Backfilling sessionKey on :Conversation and :Message..."
+BACKFILL_RESULT=$("$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" --format plain << 'BACKFILL_EOF'
+MATCH (c:Conversation)
+WHERE c.sessionKey IS NULL AND c.conversationId IS NOT NULL
+SET c.sessionKey = c.conversationId
+RETURN count(c) AS conversations_backfilled;
+MATCH (m:Message)
+WHERE m.sessionKey IS NULL AND m.conversationId IS NOT NULL
+SET m.sessionKey = m.conversationId
+RETURN count(m) AS messages_backfilled;
+MATCH (c:Conversation) WHERE c.sessionKey IS NULL RETURN count(c) AS conversations_null_after;
+MATCH (m:Message) WHERE m.sessionKey IS NULL RETURN count(m) AS messages_null_after;
+BACKFILL_EOF
+)
+# Emit the migration-1007 adherence lines on stderr so they land in server.log
+# the same as every other log line. Non-zero null counts after backfill are P0:
+# they indicate orphan rows that carry neither identifier and need operator
+# attention before the constraint flip in Task 1011.
+echo "$BACKFILL_RESULT" | python3 -c "
+import sys, re
+rows = [r.strip() for r in sys.stdin.read().splitlines() if r.strip() and not r.strip().startswith(('conversations_', 'messages_'))]
+nums = [int(r) for r in rows if re.fullmatch(r'\d+', r)]
+if len(nums) >= 4:
+    conv_bf, msg_bf, conv_null, msg_null = nums[0], nums[1], nums[2], nums[3]
+    print(f'[migration-1007] conversation-row-backfill rows={conv_bf} outcome=ok', file=sys.stderr)
+    print(f'[migration-1007] message-row-backfill rows={msg_bf} outcome=ok', file=sys.stderr)
+    print(f'[migration-1007] adherence-check label=Conversation rows-with-null-sessionkey={conv_null}', file=sys.stderr)
+    print(f'[migration-1007] adherence-check label=Message rows-with-null-sessionkey={msg_null}', file=sys.stderr)
+    if conv_null > 0 or msg_null > 0:
+        print(f'[migration-1007] adherence-check P0=true reason=null-sessionkey-after-backfill', file=sys.stderr)
+else:
+    print(f'[migration-1007] backfill output unparseable rows={len(nums)}', file=sys.stderr)
+"
+
+# ------------------------------------------------------------------
+# 3. Create AdminUser node + ADMIN_OF relationship
+# ------------------------------------------------------------------
+
+if [ -n "${USER_ID:-}" ]; then
+  # Escape single quotes for Cypher string interpolation (e.g. O'Brien → O''Brien).
+  USER_NAME=$(python3 -c "import json; n=json.load(open('$USERS_FILE'))[0]['name']; print(n.replace(\"'\",\"''\"))" 2>/dev/null || echo "Owner")
+  CREATED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+  echo "==> Creating AdminUser node for userId=$USER_ID"
+  # Task 912 — stamp accountId + role='owner' at seed so the graph-write gate's
+  # account-scoped MATCH (au:AdminUser {accountId: $accountId}) succeeds on the
+  # first user-domain write. Pre-912 the seed only set name + createdAt, leaving
+  # accountId NULL and tripping the Task 685 gate on every fresh install. The
+  # ON MATCH branch COALESCEs to preserve any existing non-null value.
+  "$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" << CYPHER_EOF
+MERGE (au:AdminUser {userId: '$USER_ID'})
+ON CREATE SET au.accountId = '$ACCOUNT_ID',
+              au.role = 'owner',
+              au.name = '$USER_NAME',
+              au.createdAt = '$CREATED_AT'
+ON MATCH SET au.accountId = COALESCE(au.accountId, '$ACCOUNT_ID'),
+             au.role = COALESCE(au.role, 'owner'),
+             au.name = '$USER_NAME'
+WITH au
+MATCH (b:LocalBusiness {accountId: '$ACCOUNT_ID'})
+MERGE (au)-[r:ADMIN_OF]->(b)
+ON CREATE SET r.role = 'owner', r.grantedAt = '$CREATED_AT'
+RETURN au.userId, b.accountId;
+CYPHER_EOF
+  echo "  [seed] AdminUser stamped userId=${USER_ID:0:8} accountId=${ACCOUNT_ID:0:8} role=owner"
+
+  # ------------------------------------------------------------------
+  # 3b. Backfill orphaned conversations (Task 380)
+  # ------------------------------------------------------------------
+  # When userId was regenerated on every install, conversations created with
+  # previous userIds became invisible. Reassign them to the current userId.
+  # Scoped to this accountId. Only touches conversations where userId is set
+  # but doesn't match the current user (NULL userId is Task 378's domain).
+  echo "==> Backfilling orphaned admin conversations for userId=$USER_ID"
+  BACKFILL_RESULT=$("$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" << BACKFILL_EOF
+MATCH (c:Conversation {accountId: '$ACCOUNT_ID', agentType: 'admin'})
+WHERE c.userId IS NOT NULL AND c.userId <> '$USER_ID'
+WITH c, c.userId AS oldUserId
+SET c.userId = '$USER_ID'
+RETURN count(c) AS reassigned, collect(DISTINCT oldUserId) AS oldUserIds;
+BACKFILL_EOF
+  )
+  echo "  [backfill] $BACKFILL_RESULT"
+fi
+
+echo "  Done."