@rubytech/create-maxy-code 0.1.0

package/payload/platform/neo4j/schema.cypher

@@ -0,0 +1,1104 @@
+// ============================================================
+// Maxy Phase 0 — Neo4j Graph Schema
+// Schema.org compliant node types
+// ============================================================
+
+// ----------------------------------------------------------
+// Constraints
+// ----------------------------------------------------------
+
+// Person.email must be unique (waitlist signups, future users)
+// Allows multiple nulls — phone-only contacts are not affected.
+CREATE CONSTRAINT person_email_unique IF NOT EXISTS
+FOR (p:Person) REQUIRE p.email IS UNIQUE;
+
+// Person.telephone must be unique (phone-first channels: WhatsApp, SMS, Telegram)
+// Allows multiple nulls — email-only contacts are not affected.
+CREATE CONSTRAINT person_telephone_unique IF NOT EXISTS
+FOR (p:Person) REQUIRE p.telephone IS UNIQUE;
+
+// Service.serviceId must be unique within the Maxy account
+CREATE CONSTRAINT service_id_unique IF NOT EXISTS
+FOR (s:Service) REQUIRE s.serviceId IS UNIQUE;
+
+// LocalBusiness.accountId must be unique
+CREATE CONSTRAINT local_business_account_unique IF NOT EXISTS
+FOR (b:LocalBusiness) REQUIRE b.accountId IS UNIQUE;
+
+// ----------------------------------------------------------
+// accountId enforcement — multi-tenancy boundary
+// Property existence constraints (IS NOT NULL) require Neo4j
+// Enterprise Edition. Community Edition enforces accountId via
+// the memory-write MCP tool (injects accountId at write time)
+// and agent schema reference files.
+// Drop any leftover existence constraints from prior seeds.
+// ----------------------------------------------------------
+DROP CONSTRAINT person_account_id_exists IF EXISTS;
+DROP CONSTRAINT order_account_id_exists IF EXISTS;
+DROP CONSTRAINT invoice_account_id_exists IF EXISTS;
+DROP CONSTRAINT event_account_id_exists IF EXISTS;
+DROP CONSTRAINT service_account_id_exists IF EXISTS;
+DROP CONSTRAINT task_account_id_exists IF EXISTS;
+
+// ----------------------------------------------------------
+// Indexes
+// ----------------------------------------------------------
+
+// LocalBusiness.businessType — determines which vertical schema to load
+CREATE INDEX local_business_type IF NOT EXISTS
+FOR (b:LocalBusiness) ON (b.businessType);
+
+// Question (schema:Question) — FAQ/Q&A nodes
+CREATE INDEX question_category IF NOT EXISTS
+FOR (q:Question) ON (q.category);
+
+// DefinedTerm (schema:DefinedTerm) — product feature/capability descriptions
+CREATE INDEX defined_term_category IF NOT EXISTS
+FOR (d:DefinedTerm) ON (d.category);
+
+CREATE INDEX person_status IF NOT EXISTS
+FOR (p:Person) ON (p.status);
+
+// Review (schema:Review) — competitor comparison assessments
+CREATE INDEX review_item_reviewed IF NOT EXISTS
+FOR (r:Review) ON (r.itemReviewed);
+
+// ----------------------------------------------------------
+// Vector indexes — dimensions configurable at install time (default: 768 for nomic-embed-text).
+// seed-neo4j.sh substitutes the dimension value from EMBED_DIMENSIONS env var.
+// HNSW algorithm for approximate nearest-neighbour search.
+// ----------------------------------------------------------
+
+// One vector index per label that participates in semantic search.
+// memory-search queries the index matching the label filter,
+// or queries all indexes when no label filter is given.
+
+CREATE VECTOR INDEX question_embedding IF NOT EXISTS
+FOR (q:Question) ON (q.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE VECTOR INDEX defined_term_embedding IF NOT EXISTS
+FOR (d:DefinedTerm) ON (d.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE VECTOR INDEX review_embedding IF NOT EXISTS
+FOR (r:Review) ON (r.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE VECTOR INDEX service_embedding IF NOT EXISTS
+FOR (s:Service) ON (s.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE VECTOR INDEX person_embedding IF NOT EXISTS
+FOR (p:Person) ON (p.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE VECTOR INDEX business_embedding IF NOT EXISTS
+FOR (b:LocalBusiness) ON (b.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE VECTOR INDEX price_embedding IF NOT EXISTS
+FOR (p:PriceSpecification) ON (p.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// Task node — graph-backed task management (Phase 0)
+// Schema.org: schema:Action (semantic mapping; label stays Task)
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT task_id_unique IF NOT EXISTS
+FOR (t:Task) REQUIRE t.taskId IS UNIQUE;
+
+CREATE INDEX task_status IF NOT EXISTS
+FOR (t:Task) ON (t.status);
+
+CREATE INDEX task_account IF NOT EXISTS
+FOR (t:Task) ON (t.accountId);
+
+CREATE VECTOR INDEX task_embedding IF NOT EXISTS
+FOR (t:Task) ON (t.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// CreativeWork node — agent-authored documents (session summaries etc.)
+// Schema.org: schema.org/CreativeWork
+// Session summaries use `abstract` (schema.org/abstract) for the briefing text
+// and `title` (schema.org/name) for a human-readable label.
+// Written by the admin agent during context compaction via session-compact.
+// ----------------------------------------------------------
+
+CREATE VECTOR INDEX creative_work_embedding IF NOT EXISTS
+FOR (c:CreativeWork) ON (c.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// DigitalDocument node — uploaded files ingested into the graph
+// Schema.org: schema.org/DigitalDocument (subtype of CreativeWork)
+// Written by the document-specialist via document-ingest tool
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT digital_document_id_unique IF NOT EXISTS
+FOR (d:DigitalDocument) REQUIRE d.attachmentId IS UNIQUE;
+
+CREATE INDEX digital_document_account IF NOT EXISTS
+FOR (d:DigitalDocument) ON (d.accountId);
+
+CREATE INDEX digital_document_encoding_format IF NOT EXISTS
+FOR (d:DigitalDocument) ON (d.encodingFormat);
+
+CREATE VECTOR INDEX digital_document_embedding IF NOT EXISTS
+FOR (d:DigitalDocument) ON (d.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// KnowledgeDocument / Section — single-Section document ingestion (Task 740,
+// replacing the Task 737 three-level KnowledgeDocument/Section/Chunk model).
+//
+// KnowledgeDocument -[HAS_SECTION]-> Section
+// Section          -[NEXT]-> Section          (reading-order chain)
+// KnowledgeDocument -[PARTY]-> (Person|Organization)   (contracts only)
+// KnowledgeDocument -[REFERENCES]-> (any entity)        (legacy; no new writes)
+//
+// Every classified section is one Section node. Recognised kinds carry a
+// secondary label (Section:Position, Section:Education, Section:Chapter,
+// Section:Parties, Section:Other, etc.) — anchor edges from the document
+// subject (UserProfile/LocalBusiness) point at the multi-labeled node
+// directly. The :Chunk overflow level is gone; sections store their body
+// inline. Identifying property remains attachmentId on KnowledgeDocument.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT knowledge_doc_id_unique IF NOT EXISTS
+FOR (k:KnowledgeDocument) REQUIRE k.attachmentId IS UNIQUE;
+
+CREATE INDEX knowledge_doc_account IF NOT EXISTS
+FOR (k:KnowledgeDocument) ON (k.accountId);
+
+// sourceUrl — lookup index for duplicate detection when re-ingesting a URL.
+// Not unique: user may re-ingest the same URL to get updated content.
+CREATE INDEX knowledge_doc_source_url IF NOT EXISTS
+FOR (k:KnowledgeDocument) ON (k.sourceUrl);
+
+CREATE VECTOR INDEX knowledge_doc_embedding IF NOT EXISTS
+FOR (k:KnowledgeDocument) ON (k.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE VECTOR INDEX section_embedding IF NOT EXISTS
+FOR (s:Section) ON (s.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// Pre-Task 740 :Chunk vector index — kept for backwards compatibility with
+// Sections written before the writer rewrite. New ingests do not produce
+// :Chunk nodes; the index becomes inert once landfill is purged.
+CREATE VECTOR INDEX chunk_embedding IF NOT EXISTS
+FOR (c:Chunk) ON (c.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// ConversationArchive — chunked conversation archive (Task 894 generalises
+// Task 891). Source-agnostic: WhatsApp `_chat.txt`, Telegram, Signal,
+// LinkedIn DMs, Zoom transcript, meeting minutes, iMessage, Slack — every
+// source flows through the same shape with `source` as the discriminator.
+//
+// :ConversationArchive parent + :Section:Conversation chunks (HAS_SECTION + NEXT chain).
+// MERGE-keyed on conversationIdentity = sha256(accountId + ":" + sortedParticipantElementIds).
+// :Section base label is shared with KnowledgeDocument's children — chunks
+// reuse the section_embedding vector index above and the universal fulltext
+// index below.
+//
+// :PARTICIPANT_IN edges from :Person/:AdminUser to :ConversationArchive are
+// MERGEd on every ingest (idempotent); the operator confirms each participant
+// up front via the conversation-archive skill flow.
+//
+// `source` is a closed enum ('whatsapp' | 'telegram' | 'signal' |
+// 'linkedin-messages' | 'zoom-transcript' | 'meeting-minutes' | 'imessage' |
+// 'slack' | 'other') — see `conversation-normalisers/types.ts`.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT conversation_archive_identity_unique IF NOT EXISTS
+FOR (a:ConversationArchive) REQUIRE a.conversationIdentity IS UNIQUE;
+
+CREATE INDEX conversation_archive_account IF NOT EXISTS
+FOR (a:ConversationArchive) ON (a.accountId);
+
+CREATE INDEX conversation_archive_session IF NOT EXISTS
+FOR (a:ConversationArchive) ON (a.createdBySession);
+
+CREATE INDEX conversation_archive_account_source IF NOT EXISTS
+FOR (a:ConversationArchive) ON (a.accountId, a.source);
+
+CREATE VECTOR INDEX conversation_archive_embedding IF NOT EXISTS
+FOR (a:ConversationArchive) ON (a.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// Universal full-text BM25 index for hybrid keyword search (Task 748).
+//
+// Every operator-meaningful label written by the platform is in the index union;
+// every textual property a writer assigns is in the property union. Neo4j silently
+// ignores absent properties on a given label, so over-inclusion is harmless.
+//
+// **Doctrine.** Search is "find any node in my graph that mentions this term" —
+// not "find a knowledge document". Pre-Task-748 the index name `knowledge_fulltext`
+// covered only `KnowledgeDocument | Section | Chunk` (3 of ~40 written labels), so
+// BM25 silently returned zero hits for Person/Organization/Task/Conversation/etc.
+// regardless of query. Universal coverage is the doctrine; the doctrine test at
+// `platform/lib/graph-search/src/__tests__/fulltext-coverage.test.ts` parses this
+// declaration and asserts label-set ⊇ union(GRAPH_LABEL_COLOURS, schema-declared)
+// so future label additions cannot silently re-narrow.
+//
+// Label union — every operator-meaningful label:
+//   - Business identity: LocalBusiness, Service, PriceSpecification, OpeningHoursSpecification, Organization
+//   - People: Person, UserProfile, Preference, AdminUser, AccessGrant
+//   - Knowledge: KnowledgeDocument, ConversationArchive (Task 891), Section, Chunk (legacy), DigitalDocument, CreativeWork,
+//     Question, FAQPage, DefinedTerm, Review, ImageObject
+//   - Conversational: Conversation, AdminConversation, PublicConversation, Message,
+//     UserMessage, AssistantMessage, ToolCall
+//   - Tasks/projects/events: Task, Project, Event
+//   - Workflows: Workflow, WorkflowStep, WorkflowRun, StepResult
+//   - Onboarding: OnboardingState
+//   - Email: Email, EmailAccount
+//   - CV/career sublabels: Position, Credential
+//   - Public agents: Agent (Task 837 — projection of file-based public agents)
+//
+// Property union — every textual property the schema's writers assign:
+//   - Generic: name, title, summary, body, content, text, description, headline, abstract,
+//     note, label, value, message, preview, tagline
+//   - Person: firstName, lastName, givenName, familyName, email,
+//             currentTitle (Task 753 — denormalised from [:WORKS_FOR].title for
+//             LinkedIn imports, since edge properties are invisible to a
+//             node-only fulltext index. `currentTitle` (not `title`) avoids
+//             shadowing :Position.title semantics in cross-label cypher.)
+//   - Email: subject, bodyPreview, fromName, fromAddress
+//   - EmailAccount: agentAddress
+//   - Email: screeningReason
+//   - Credential: authority
+//   - AccessGrant: contactValue
+//   - ToolCall: toolName
+//   - Agent (Task 837): displayName, slug, role
+//     `displayName` = operator-facing name; `slug` = directory-name identifier;
+//     `role` = discriminator on KnowledgeDocument projections
+//     ('identity'|'soul'|'knowledge'|'knowledge-summary') so BM25 hits surface
+//     which file backed the result. Distinct from Person.role (no shadow).
+CREATE FULLTEXT INDEX entity_search IF NOT EXISTS
+FOR (n:LocalBusiness|Service|PriceSpecification|OpeningHoursSpecification|Organization
+    |Person|UserProfile|Preference|AdminUser|AccessGrant
+    |KnowledgeDocument|ConversationArchive|Section|Chunk|DigitalDocument|CreativeWork|Question|FAQPage|DefinedTerm|Review|ImageObject
+    |Conversation|AdminConversation|PublicConversation|Message|UserMessage|AssistantMessage|ToolCall
+    |Task|Project|Event
+    |Workflow|WorkflowStep|WorkflowRun|StepResult
+    |OnboardingState|Email|EmailAccount
+    |Position|Credential|Agent)
+ON EACH [n.name, n.firstName, n.lastName, n.givenName, n.familyName,
+         n.title, n.currentTitle, n.summary, n.body, n.content, n.text, n.description, n.headline, n.abstract,
+         n.email, n.note, n.label, n.value, n.message, n.preview, n.tagline,
+         n.subject, n.bodyPreview, n.fromName, n.fromAddress, n.agentAddress, n.screeningReason,
+         n.authority, n.contactValue, n.toolName,
+         n.displayName, n.slug, n.role];
+
+// Project node (Task 740) — a standalone creative-output node distinct from
+// :Section. Anchored via (:UserProfile)-[:CREATED]->(:Project), with optional
+// (:Project)-[:UNDER]->(:Organization) when the project was done at an org.
+// Written when a CV section classifies as `Project`.
+
+CREATE INDEX project_account IF NOT EXISTS
+FOR (p:Project) ON (p.accountId);
+
+CREATE VECTOR INDEX project_embedding IF NOT EXISTS
+FOR (p:Project) ON (p.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// Position node — a role held by a UserProfile at an Organization.
+// Each role is its own node so it can carry its own title, dates, and
+// achievement bullets. Connected via:
+//   (:UserProfile)-[:HAS_POSITION]->(:Position)-[:AT]->(:Organization)
+// Multiple Positions per UserProfile (career history); one Organization
+// may host many Positions across many UserProfiles. No unique constraint.
+// Written by the document-ingest skill when a CV section classifies as
+// `Position` (Task 737).
+// ----------------------------------------------------------
+
+CREATE INDEX position_account IF NOT EXISTS
+FOR (p:Position) ON (p.accountId);
+
+CREATE VECTOR INDEX position_embedding IF NOT EXISTS
+FOR (p:Position) ON (p.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// Conversation node — persistent conversation sessions
+// One Conversation per sessionKey. Account scope is encoded by the
+// `accountId` property on the node itself — every read filters by it.
+// Public conversations carry a visitorId (browser cookie) and
+// agentSlug for session resume across page reloads and server restarts.
+// Task 621 — carries a `summary` string denormalised from the first
+// user-role message (first 200 chars, set once, no overwrites) to
+// provide a stable human-identifiable label on the /graph canvas.
+// Conversations that never receive a user message (assistant-only
+// seed, etc.) leave `summary` NULL; the /graph client's pickShortLabel
+// falls back to `Conv <shortId>` so empty conversations stay
+// distinguishable from each other.
+//
+// Task 633 — sublabels. Conversations written post-Task-633 carry one
+// of two sublabels alongside `:Conversation`:
+//   :AdminConversation  — agentType='admin' (operator-facing)
+//   :PublicConversation — agentType='public' (customer-facing)
+// Neo4j labels are set-semantic; the sublabel is added at ON CREATE SET
+// time in `ensureConversation` so the node carries both `:Conversation`
+// and the sublabel. No new constraints — the existing
+// conversation_id_unique constraint applies to Conversations regardless
+// of sublabel. The sublabel drives /graph canvas colour resolution and
+// filter popover chips per agentType without schema fragmentation.
+// Pre-Task-633 Conversations stay unlabelled and render in the base
+// :Conversation colour (sublabel backfill is a separate task).
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT conversation_id_unique IF NOT EXISTS
+FOR (c:Conversation) REQUIRE c.conversationId IS UNIQUE;
+
+CREATE CONSTRAINT conversation_session_key_unique IF NOT EXISTS
+FOR (c:Conversation) REQUIRE c.sessionKey IS UNIQUE;
+
+CREATE INDEX conversation_account IF NOT EXISTS
+FOR (c:Conversation) ON (c.accountId);
+
+CREATE INDEX conversation_agent_type IF NOT EXISTS
+FOR (c:Conversation) ON (c.agentType);
+
+CREATE INDEX conversation_visitor IF NOT EXISTS
+FOR (c:Conversation) ON (c.visitorId);
+
+CREATE INDEX conversation_user IF NOT EXISTS
+FOR (c:Conversation) ON (c.userId);
+
+CREATE INDEX conversation_group_slug IF NOT EXISTS
+FOR (c:Conversation) ON (c.groupSlug);
+
+CREATE VECTOR INDEX conversation_embedding IF NOT EXISTS
+FOR (c:Conversation) ON (c.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// Message node — individual messages within a Conversation
+// Linked via (Message)-[:PART_OF]->(Conversation) to the parent.
+// Linked via (Message)-[:NEXT]->(Message) to the next message in
+// insertion order (Task 621). The chain is linear — one outgoing
+// NEXT per message — so a Conversation with N messages has N-1
+// NEXT edges.
+//
+// Task 633 — sublabels. Messages written post-Task-633 carry one of
+// two sublabels alongside `:Message`, derived from `role`:
+//   :UserMessage      — role='user'
+//   :AssistantMessage — role='assistant'
+// system/tool role messages (not written by the current persistMessage
+// path) stay on base `:Message` only. The sublabel is set at CREATE
+// time (`CREATE (m:Message:UserMessage { ... })`) so the node carries
+// both labels atomically. No new constraints — `message_id_unique`
+// below applies to any Message node regardless of sublabel. Pre-Task-633
+// Messages stay unlabelled and render in the base :Message colour.
+//
+// Chain-fork invariant (Task 624): the write path in
+// platform/ui/app/lib/neo4j-store.ts#persistMessage holds a
+// per-conversationId async mutex around the Cypher that observes
+// the tail and CREATEs the new [:NEXT] edge. Without this, two
+// concurrent writes under READ_COMMITTED both see the same tail
+// and each CREATE an outgoing NEXT → two edges from one node.
+// Scope: single node-process only; multi-replica coordination is
+// a follow-up (see .docs/neo4j.md). Any new write path that creates
+// Message nodes on the chain (bulk import, migration, rehydrate)
+// MUST go through persistMessage or hold an equivalent lock.
+//
+// Vector-indexed for semantic search over conversation history.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT message_id_unique IF NOT EXISTS
+FOR (m:Message) REQUIRE m.messageId IS UNIQUE;
+
+// Task 1007 — Message.sessionKey is the canonical conversation pointer.
+// The legacy m.conversationId index stays until follow-up Task 1011 (final
+// cutover, after the full code-rename slice lands and no path reads
+// m.conversationId).
+CREATE INDEX message_conversation IF NOT EXISTS
+FOR (m:Message) ON (m.conversationId);
+
+CREATE INDEX message_session_key IF NOT EXISTS
+FOR (m:Message) ON (m.sessionKey);
+
+CREATE VECTOR INDEX message_embedding IF NOT EXISTS
+FOR (m:Message) ON (m.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// OnboardingState node — per-account onboarding progress
+// Tracks which setup steps have been completed and when.
+// Purpose-built for Phase 0; migrates to a Workflow node
+// when Task 13 (Workflow Builder) ships.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT onboarding_state_account_unique IF NOT EXISTS
+FOR (o:OnboardingState) REQUIRE o.accountId IS UNIQUE;
+// No separate index needed — the unique constraint creates a backing index.
+
+// ----------------------------------------------------------
+// Event node — scheduling and calendar (Phase 0)
+// Schema.org: schema:Event
+// One-time events (recurrence null) and recurring triggers
+// (recurrence = cron expression) share the same node type.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT event_id_unique IF NOT EXISTS
+FOR (e:Event) REQUIRE e.eventId IS UNIQUE;
+
+CREATE INDEX event_status IF NOT EXISTS
+FOR (e:Event) ON (e.eventStatus);
+
+CREATE INDEX event_account IF NOT EXISTS
+FOR (e:Event) ON (e.accountId);
+
+CREATE INDEX event_next_run IF NOT EXISTS
+FOR (e:Event) ON (e.nextRun);
+
+CREATE VECTOR INDEX event_embedding IF NOT EXISTS
+FOR (e:Event) ON (e.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// Workflow node — persistent named workflows with structured
+// executable steps. Each workflow has WorkflowStep children
+// for validated, machine-executable step definitions.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT workflow_id_unique IF NOT EXISTS
+FOR (w:Workflow) REQUIRE w.workflowId IS UNIQUE;
+
+CREATE INDEX workflow_account IF NOT EXISTS
+FOR (w:Workflow) ON (w.accountId);
+
+CREATE INDEX workflow_status IF NOT EXISTS
+FOR (w:Workflow) ON (w.status);
+
+CREATE VECTOR INDEX workflow_embedding IF NOT EXISTS
+FOR (w:Workflow) ON (w.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// WorkflowStep — individual executable steps within a workflow.
+// Each step references a plugin tool with parameter templates.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT workflow_step_id_unique IF NOT EXISTS
+FOR (s:WorkflowStep) REQUIRE s.stepId IS UNIQUE;
+
+CREATE INDEX workflow_step_workflow IF NOT EXISTS
+FOR (s:WorkflowStep) ON (s.workflowId);
+
+CREATE INDEX workflow_step_account IF NOT EXISTS
+FOR (s:WorkflowStep) ON (s.accountId);
+
+// ----------------------------------------------------------
+// WorkflowRun — execution history for a workflow run.
+// Records trigger, status, timing, and context.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT workflow_run_id_unique IF NOT EXISTS
+FOR (r:WorkflowRun) REQUIRE r.runId IS UNIQUE;
+
+CREATE INDEX workflow_run_workflow IF NOT EXISTS
+FOR (r:WorkflowRun) ON (r.workflowId);
+
+CREATE INDEX workflow_run_account IF NOT EXISTS
+FOR (r:WorkflowRun) ON (r.accountId);
+
+// ----------------------------------------------------------
+// StepResult — per-step outcome within a workflow run.
+// ----------------------------------------------------------
+
+CREATE INDEX step_result_run IF NOT EXISTS
+FOR (sr:StepResult) ON (sr.runId);
+
+// ----------------------------------------------------------
+// UserProfile node — structured knowledge about the business owner
+// Platform-native (no Schema.org equivalent). One per (accountId, userId).
+// Linked via (AdminUser)-[:HAS_PROFILE]->(UserProfile). Account scope is
+// encoded by the `accountId` property on the node itself.
+//
+// Created automatically on first admin session start via MERGE.
+// Properties populated progressively through conversation and
+// session-end reflection. Injected into admin system prompt at
+// session start so the agent never starts from zero.
+//
+// No vector index — UserProfile is always queried by (accountId, userId)
+// composite key. Vector search deferred to Phase 1 if multi-account
+// similarity becomes a use case.
+// ----------------------------------------------------------
+
+// Composite unique constraint: one profile per admin per account.
+// Replaces the single-key accountId constraint (Task 249) and the
+// transitional name `user_profile_account_user_unique` (Task 792 — renamed
+// for grep parity with the doctrine name in .docs/neo4j.md and the
+// per-bucket dedupe script). Old name dropped in seed-neo4j.sh MIGRATE_EOF.
+CREATE CONSTRAINT user_profile_unique_per_user IF NOT EXISTS
+FOR (up:UserProfile) REQUIRE (up.accountId, up.userId) IS UNIQUE;
+
+// ----------------------------------------------------------
+// Preference node — individual observed or stated user preference
+// Platform-native. Each Preference represents a single preference
+// with confidence scoring and evidence trails.
+//
+// Relationships:
+//   (UserProfile)-[:HAS_PREFERENCE]->(Preference)
+//   (Preference)-[:OBSERVED_IN]->(Conversation)  — evidence trail
+//
+// Categories: communication, scheduling, decision, workflow,
+//             content, interaction
+//
+// Recognised optional properties:
+//   notApplicable (boolean) — Task 888. When `true`, the Preference
+//     records that the user explicitly declared the (category, key)
+//     does not apply to them. Counted as covered for the field-level
+//     Coverage signal in `formatProfileSummary`; filtered from the
+//     user-facing body (no value to render). Immutable on the tool
+//     surface (`profile-update` rejects mode merge|contradict). Always
+//     written with confidence: 1.0. No constraint, no index — the
+//     read query in loadUserProfile / profile-read widens the WHERE
+//     to include `OR pref.notApplicable = true`.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT preference_id_unique IF NOT EXISTS
+FOR (pref:Preference) REQUIRE pref.preferenceId IS UNIQUE;
+
+CREATE INDEX preference_account IF NOT EXISTS
+FOR (pref:Preference) ON (pref.accountId);
+
+CREATE INDEX preference_user IF NOT EXISTS
+FOR (pref:Preference) ON (pref.accountId, pref.userId);
+
+CREATE INDEX preference_category IF NOT EXISTS
+FOR (pref:Preference) ON (pref.accountId, pref.userId, pref.category);
+
+CREATE VECTOR INDEX preference_embedding IF NOT EXISTS
+FOR (pref:Preference) ON (pref.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// EmailAccount — managed by the email plugin (credentials.ts)
+// Created via MERGE by email-setup. Properties:
+//   accountId, email, agentAddress, imapHost, imapPort,
+//   imapSecurity, smtpHost, smtpPort, smtpSecurity, updatedAt
+//
+// Auto-respond properties (added by email-auto-respond-config):
+//   autoRespond (boolean), respondingAgentSlug (string),
+//   pollIntervalMinutes (integer, default 5),
+//   lastRespondedUid (integer — IMAP UID high-water mark),
+//   lastPollAt (ISO 8601), consecutiveFailures (integer)
+// ----------------------------------------------------------
+
+// ----------------------------------------------------------
+// Email node — persisted inbound email messages
+// Platform-native. Each Email represents a single received
+// message, scoped to a specific recipient address (the agent's
+// agentAddress). Linked to EmailAccount via RECEIVED_BY.
+//
+// Properties:
+//   emailId          — deterministic SHA-256 (primary key for dedup)
+//   messageId        — RFC 2822 Message-ID (nullable, used for threading)
+//   inReplyTo        — RFC 2822 In-Reply-To header (nullable, parent message)
+//   toAddresses      — string[] of TO recipients
+//   ccAddresses      — string[] of CC recipients
+//   recipientAddress — partition key (the agent's agentAddress)
+//   fromAddress, fromName, subject, bodyPreview
+//   receivedAt, fetchedAt, accountId
+//   scope: "admin"   — always admin
+//   screening        — "clean" | "suspicious" | "discarded" (Haiku classification)
+//   screeningReason  — one-line explanation from classifier
+//   promptInjectionFlag — true if body targets an AI agent
+//   embedding        — vector (subject + bodyPreview), dims per EMBED_DIMENSIONS — absent for discarded
+//
+// Deduplication: emailId derived from RFC 2822 Message-ID
+// (primary) or SHA-256(uidValidity:uid:mailbox:recipientAddress)
+// when Message-ID is absent. MERGE on emailId is idempotent.
+//
+// Relationships:
+//   (Email)-[:RECEIVED_BY]->(EmailAccount)
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT email_id_unique IF NOT EXISTS
+FOR (e:Email) REQUIRE e.emailId IS UNIQUE;
+
+// Composite uniqueness: one Email per messageId + accountId.
+// Database-level safety net for the application-level messageId pre-check
+// in storeEmail. Null messageId values are excluded by Neo4j constraint
+// semantics — UID-based fallback emails are not affected.
+CREATE CONSTRAINT email_message_id_account_unique IF NOT EXISTS
+FOR (e:Email) REQUIRE (e.messageId, e.accountId) IS UNIQUE;
+
+CREATE INDEX email_message_id IF NOT EXISTS
+FOR (e:Email) ON (e.messageId);
+
+CREATE INDEX email_recipient IF NOT EXISTS
+FOR (e:Email) ON (e.recipientAddress);
+
+CREATE INDEX email_account IF NOT EXISTS
+FOR (e:Email) ON (e.accountId);
+
+CREATE INDEX email_received IF NOT EXISTS
+FOR (e:Email) ON (e.receivedAt);
+
+CREATE INDEX email_screening IF NOT EXISTS
+FOR (e:Email) ON (e.screening);
+
+CREATE VECTOR INDEX email_embedding IF NOT EXISTS
+FOR (e:Email) ON (e.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+// ----------------------------------------------------------
+// AccessGrant node — per-agent, time-bound access credentials
+// Platform-native. Each AccessGrant represents a single
+// person's access to a single gated public agent.
+//
+// Relationships:
+//   (Person)-[:HAS_ACCESS]->(AccessGrant)
+//
+// One Person can have multiple AccessGrants (different agents,
+// different time windows). Grants are created by the admin
+// agent via memory-write and consumed by the access gate API.
+//
+// No vector index — AccessGrant is always queried
+// deterministically (by token, by contact+agent, by status).
+// ----------------------------------------------------------
+
+// Composite uniqueness: one grant per contact+agent+account.
+// Prevents duplicate invitations for the same person to the
+// same agent. Also serves as a lookup index for login.
+CREATE CONSTRAINT access_grant_unique IF NOT EXISTS
+FOR (ag:AccessGrant) REQUIRE (ag.contactValue, ag.agentSlug, ag.accountId) IS UNIQUE;
+
+// Magic link token lookup — one-time use tokens for email invitations.
+CREATE INDEX access_grant_token IF NOT EXISTS
+FOR (ag:AccessGrant) ON (ag.magicToken);
+
+// Status filtering — admin listing of active/expired/revoked grants.
+CREATE INDEX access_grant_status IF NOT EXISTS
+FOR (ag:AccessGrant) ON (ag.status);
+
+// ----------------------------------------------------------
+// Agent node — projection of file-based public agents (Task 837)
+//
+// Source of truth remains the filesystem: accountDir/agents/<slug>/
+// {config.json, IDENTITY.md, SOUL.md, KNOWLEDGE.md, KNOWLEDGE-SUMMARY.md}.
+// The Agent node is a graph projection so operators can see, on /graph,
+// which public agents exist, what knowledge they have access to, and
+// which conversations they have handled. Re-running the projector
+// is idempotent and never mutates the on-disk files.
+//
+// Properties (mirrored from config.json + filesystem mtime):
+//   slug              — directory name; immutable identifier within an account
+//   displayName       — operator-facing name from config.json
+//   status            — 'active' | 'inactive' | <other> per config.json
+//   model             — Anthropic model id used by the public agent
+//   liveMemory        — bool; whether memory-search runs at message time
+//   knowledgeKeywords — string[] (live-search keyword subscriptions)
+//   role              — always 'agent' (mirrors KnowledgeDocument.role
+//                       discriminator; surfaces in BM25 hits)
+//   createdAt         — ISO 8601, set on first projection
+//   updatedAt         — ISO 8601, set on every projection
+//
+// Owned KnowledgeDocument projections (deleted on agent delete):
+//   (Agent)-[:HAS_IDENTITY]->(:KnowledgeDocument {role:'identity'})
+//   (Agent)-[:HAS_SOUL    ]->(:KnowledgeDocument {role:'soul'})
+//   (Agent)-[:HAS_KNOWLEDGE]->(:KnowledgeDocument {role:'knowledge'})
+//   (Agent)-[:HAS_KNOWLEDGE]->(:KnowledgeDocument {role:'knowledge-summary'})
+// attachmentId is namespaced as "agent:<accountId>:<slug>:<role>" so the
+// projection reuses the existing knowledge_doc_id_unique constraint without
+// a parallel uniqueness scheme. The accountId segment is load-bearing —
+// without it, two accounts with the same agent slug would collide on the
+// global unique constraint and the second projection would silently
+// re-parent the first account's doc via the MERGE+SET path. Account
+// isolation is doctrine.
+//
+// Operator-tagged docs (NOT deleted on agent delete — only edges removed):
+//   (Agent)-[:USES_KNOWLEDGE]->(:KnowledgeDocument)
+// where slug ∈ KnowledgeDocument.agents. Materialised at projection time
+// only; the runtime memory-search path continues to read k.agents directly,
+// so a doc tagged after the last projection becomes graph-visible at the
+// next re-projection but is reachable at runtime immediately. The runtime
+// path is unchanged — see [public-agent.ts:130-160].
+//
+// Conversation→Agent edge (written by ensureConversation when
+// agentType='public' and agentSlug is set):
+//   (Conversation)-[:HANDLED_BY]->(Agent)
+// OPTIONAL MATCH on the Agent so a public conversation with an orphan
+// slug still writes (single `[agent-graph] handled-by-skip` log line).
+//
+// Composite uniqueness: one Agent per (accountId, slug) — the directory
+// name is the natural key within an account, slugs collide across
+// accounts and that's allowed.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT agent_account_slug_unique IF NOT EXISTS
+FOR (a:Agent) REQUIRE (a.accountId, a.slug) IS UNIQUE;
+
+CREATE INDEX agent_account IF NOT EXISTS
+FOR (a:Agent) ON (a.accountId);
+
+// ----------------------------------------------------------
+// AdminUser node — device-level admin identity
+// Platform-native. Represents a human who administers one or
+// more accounts via the admin agent. Exists at the device level
+// (not account-scoped). Linked to accounts via ADMIN_OF.
+//
+// Properties:
+//   userId     — UUID, matches entry in ~/<brand.configDir>/users.json (Task 904; pre-Task-904 path was platform/config/users.json)
+//   name       — display name (e.g. "Adam")
+//   createdAt  — ISO 8601 timestamp
+//
+// Relationships:
+//   (AdminUser)-[:ADMIN_OF {role, grantedAt}]->(LocalBusiness)
+//   role: "owner" | "admin" — label only, no enforcement
+//   grantedAt: ISO 8601 timestamp
+//
+// No vector index — AdminUser is always queried deterministically
+// by userId. Semantic search over admin users is not a use case.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT admin_user_id_unique IF NOT EXISTS
+FOR (au:AdminUser) REQUIRE au.userId IS UNIQUE;
+
+// ----------------------------------------------------------
+// GraphPreference — per-(accountId, userId) UI metadata for /graph
+//
+// Carries the operator's persisted default filter view (labels +
+// includeTrashed) so the /graph page opens with the chosen filter
+// applied on next pageload. Never a user-facing node type — hidden
+// from filter chips via HIDDEN_BY_DEFAULT_LABELS.
+//
+// MERGE-keyed on the composite (accountId, userId). No UNIQUE
+// constraint — the composite MERGE keys are idempotent and the
+// preference is UI metadata, not load-bearing data. A constraint
+// would require both keys in a single composite, which Neo4j
+// supports but adds schema surface for no behavioural benefit.
+// ----------------------------------------------------------
+
+CREATE INDEX graph_preference_account_user IF NOT EXISTS
+FOR (p:GraphPreference) ON (p.accountId, p.userId);
+
+// ----------------------------------------------------------
+// ToolCall — durable audit trail for agent tool invocations
+//
+// Every tool_use / tool_result pair parsed from the agent stream
+// produces one ToolCall node linked to the Conversation that
+// triggered it. Workflow-dispatched tool calls (StepResult) are
+// excluded — no duplication.
+//
+// (:Conversation)-[:HAS_TOOL_CALL]->(:ToolCall)
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT tool_call_id_unique IF NOT EXISTS
+FOR (tc:ToolCall) REQUIRE tc.callId IS UNIQUE;
+
+CREATE INDEX tool_call_account_started IF NOT EXISTS
+FOR (tc:ToolCall) ON (tc.accountId, tc.startedAt);
+
+// ----------------------------------------------------------
+// Component — Task 815 admin-resume rehydration.
+//
+// Every render-component event emitted on an assistant turn
+// produces one Component node linked to its parent Message via
+// (Message)-[:HAS_COMPONENT]->(Component). The agent's narrative
+// text stays on Message.content; component name + data JSON +
+// position-relative-to-text live here. Sibling-node design (not
+// JSON-on-Message) avoids Neo4j's 128KB property soft-limit when
+// document-editor bodies are large.
+//
+// Atomicity: persisted in the same Cypher transaction as the
+// parent Message — no orphan Component possible. Reader is a
+// single round-trip via OPTIONAL MATCH + collect (sort-before-
+// collect: WITH m, c ORDER BY c.ordinal ASC, then collect).
+//
+// Properties:
+//   componentId  — UUID, primary key
+//   conversationId / accountId / messageId — denormalised for
+//     account-scoped reads and cross-account isolation audits
+//   name         — component name (document-editor, action-buttons,
+//                   single-select, etc.)
+//   data         — JSON-encoded payload string. Validated structurally
+//                   on read (parseable, non-null object); per-component
+//                   schema validation lives in validateComponentData.
+//   ordinal      — 0-indexed sequence within the parent Message,
+//                   tiebreak for components with the same textOffset.
+//   textOffset   — length of Message.content at the moment this
+//                   component arrived in the SSE stream. Reader uses
+//                   it to interleave text-runs and components when
+//                   reconstructing events: AdminEvent[].
+//   submitted    — true once a PERSISTENT_COMPONENT (action-list,
+//                   document-editor, rich-content-editor, grid-editor)
+//                   was submitted by the user. Server-side detection
+//                   of `_componentDone:true` user turns flips this.
+//   submittedAt  — datetime when submitted=true was set (null otherwise)
+//   createdAt    — datetime when the component was persisted
+//
+// (:Message)-[:HAS_COMPONENT]->(:Component)
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT component_id_unique IF NOT EXISTS
+FOR (c:Component) REQUIRE c.componentId IS UNIQUE;
+
+CREATE INDEX component_message IF NOT EXISTS
+FOR (c:Component) ON (c.messageId);
+
+CREATE INDEX component_account IF NOT EXISTS
+FOR (c:Component) ON (c.accountId);
+
+// ----------------------------------------------------------
+// :Attachment — Task 854. Sibling node hung off a :Message via
+// [:HAS_ATTACHMENT] capturing user-side file uploads (image, pdf,
+// text/markdown/csv/html, calendar, zip; see attachments.ts
+// SUPPORTED_MIME_TYPES). Mirrors :Component (Task 815).
+//
+// Properties:
+//   attachmentId   — UUID assigned at storeAttachment time; matches
+//                     the on-disk directory + Neo4j node id.
+//   conversationId — denormalised for filtered scans + cascade delete.
+//   accountId      — account-isolation. Reads MUST scope by this.
+//   messageId      — back-pointer to parent :Message.
+//   filename       — original upload name (kept for chip render).
+//   mimeType       — validated MIME (assertSupportedMime).
+//   sizeBytes      — original byte size at upload.
+//   storagePath    — absolute on-disk path. Server-only — never
+//                     surfaced to the client (chip click resolves
+//                     via attachmentId, not path).
+//   ordinal        — upload-order index within the parent turn (0-based).
+//                     Reader uses it to re-render chips in upload order.
+//   createdAt      — datetime when persisted.
+//
+// (:Message)-[:HAS_ATTACHMENT]->(:Attachment)
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT attachment_id_unique IF NOT EXISTS
+FOR (a:Attachment) REQUIRE a.attachmentId IS UNIQUE;
+
+CREATE INDEX attachment_message IF NOT EXISTS
+FOR (a:Attachment) ON (a.messageId);
+
+CREATE INDEX attachment_account IF NOT EXISTS
+FOR (a:Attachment) ON (a.accountId);
+
+// ----------------------------------------------------------
+// :Trashed — Task 576 soft-delete primitive.
+//
+// Any node soft-deleted via memory-delete / contact-delete carries this
+// label plus trashedAt / trashedBy / trashReason / _trashedKeys properties.
+// memory-empty-trash hard-deletes by `MATCH (n:Trashed) WHERE n.trashedAt < cutoff`,
+// and the trash-census + read-filter probes in memory-search hit the same
+// label. The accountId index supports per-tenant census reads — accountId-as-
+// unique-key labels (LocalBusiness, OnboardingState) have their accountId
+// nulled on trash and are missed by accountId-scoped reads, but those are
+// 1-per-account labels and rare in trash.
+// ----------------------------------------------------------
+
+CREATE INDEX trashed_account IF NOT EXISTS
+FOR (n:Trashed) ON (n.accountId);
+
+CREATE INDEX trashed_at IF NOT EXISTS
+FOR (n:Trashed) ON (n.trashedAt);
+
+// ----------------------------------------------------------
+// Person.linkedinUrl — natural key for LinkedIn-origin Persons.
+// Indexed (not uniquely constrained) so a Person can appear
+// first from another source (email-first) and later have its
+// linkedinUrl filled in without collision. Schema-base requires
+// `email or telephone` on :Person, but LinkedIn basic exports
+// rarely emit either for connections; `linkedinUrl` is the
+// reliable dedup key for the linkedin-import skill.
+// ----------------------------------------------------------
+CREATE INDEX person_linkedin_url IF NOT EXISTS
+FOR (p:Person) ON (p.linkedinUrl);
+
+// ----------------------------------------------------------
+// Credential — schema:EducationalOccupationalCredential.
+// Professional certifications (e.g. LinkedIn's Certifications.csv,
+// or credentials entered through memory-write). Natural key is
+// the triple (accountId, name, authority) — a credential is
+// identified by what it is and who issued it, within a tenant.
+// No existing Maxy label covers this semantics, so a new label
+// is warranted (unlike articles → :CreativeWork, recommendations
+// → :Review, skills → :DefinedTerm, which all reuse existing labels).
+// ----------------------------------------------------------
+CREATE CONSTRAINT credential_unique IF NOT EXISTS
+FOR (c:Credential) REQUIRE (c.accountId, c.name, c.authority) IS UNIQUE;
+
+CREATE INDEX credential_account IF NOT EXISTS
+FOR (c:Credential) ON (c.accountId);
+
+// ----------------------------------------------------------
+// Provenance indexes (Task 800) — back the shim's per-write
+// orphan check. Task 797's `executeWrite` runs an unanchored
+// `MATCH (n) WHERE n.createdBySession = $autoSession AND
+// n.createdAt >= $autoStartTimestamp AND NOT (n)--()` after
+// every operator write. Without an index this is `AllNodesScan`
+// — sub-millisecond on the current ~10K-node graph, but a
+// per-write tax that grows with graph size.
+//
+// Neo4j 5 property indexes require a label clause; there is no
+// label-free range/text/point index. The orphan check is
+// unanchored, so the planner relies on `UnionNodeByLabelsScan`
+// (Neo4j 5.6+) to combine per-label seeks. If a future EXPLAIN
+// shows `AllNodesScan` despite these indexes, the orphan-check
+// Cypher in `cypher-shim-write.ts` should be anchored with an
+// explicit label union — that's the structural fallback.
+//
+// Coverage: the five labels written most often through the raw
+// Cypher write path (Person, Organization, KnowledgeDocument,
+// Section, Task). Other written labels (Project, Position,
+// Credential, ToolCall, Conversation, etc.) still hit
+// `AllNodesScan` for the orphan check; extending coverage is a
+// separate decision, not a default.
+// ----------------------------------------------------------
+
+CREATE INDEX person_created_by_session IF NOT EXISTS
+FOR (n:Person) ON (n.createdBySession);
+
+CREATE INDEX organization_created_by_session IF NOT EXISTS
+FOR (n:Organization) ON (n.createdBySession);
+
+CREATE INDEX knowledge_doc_created_by_session IF NOT EXISTS
+FOR (n:KnowledgeDocument) ON (n.createdBySession);
+
+CREATE INDEX section_created_by_session IF NOT EXISTS
+FOR (n:Section) ON (n.createdBySession);
+
+CREATE INDEX task_created_by_session IF NOT EXISTS
+FOR (n:Task) ON (n.createdBySession);
+
+// ----------------------------------------------------------
+// CloudflareTunnel / CloudflareHostname (Task 885) — graph audit of
+// the tunnel-login deterministic flow. Written by the
+// /api/admin/cloudflare/setup endpoint after setup-tunnel.sh exits 0,
+// linked via (Task {kind:'cloudflare-tunnel-login'})-[:PRODUCED]->.
+// CloudflareHostname carries the routed FQDN; CloudflareTunnel
+// carries the connector identity. Source of truth remains the on-disk
+// cert.pem + tunnel.state + config.yml — these nodes are the graph
+// projection so operators can MATCH from a Conversation to "which
+// cloudflare resources did this onboarding produce?"
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT cloudflare_tunnel_id_unique IF NOT EXISTS
+FOR (t:CloudflareTunnel) REQUIRE t.tunnelId IS UNIQUE;
+
+CREATE INDEX cloudflare_tunnel_account IF NOT EXISTS
+FOR (t:CloudflareTunnel) ON (t.accountId);
+
+CREATE CONSTRAINT cloudflare_hostname_unique IF NOT EXISTS
+FOR (h:CloudflareHostname) REQUIRE (h.accountId, h.hostnameValue) IS UNIQUE;
+
+CREATE INDEX cloudflare_hostname_account IF NOT EXISTS
+FOR (h:CloudflareHostname) ON (h.accountId);