@rubytech/create-maxy-code 0.1.106 → 0.1.107

package/dist/index.js

@@ -59,7 +59,7 @@ function claudePluginEnv() {
  *  evidence. When a third brand is added under `brands/`, append its hostname
  *  here AND in the matching constant in `uninstall.ts` (intentional duplication
  *  per `uninstall.ts:` "Shell helpers (duplicated from index.ts ...)" policy). */
-const KNOWN_BRAND_HOSTNAMES = ["maxy", "realagent", "maxy-2", "maxy-3", "maxy-4"];
+const KNOWN_BRAND_HOSTNAMES = ["maxy", "maxy-code", "realagent", "realagent-code", "maxy-2", "maxy-3", "maxy-4"];
 // The device's actual hostname — may differ from BRAND.hostname if the user customized it.
 // Updated by installSystemDeps() after hostname setup; used for user-facing URLs.
 let DEVICE_HOSTNAME = BRAND.hostname;

package/dist/uninstall.js

@@ -103,7 +103,7 @@ export function isMaxyInstalled() {
  *  `.service` file — stale units, gnome-keyring disable markers, and unrelated
  *  user services are not peer evidence. When a third brand is
  *  added under `brands/`, append its hostname here. */
-const KNOWN_BRAND_HOSTNAMES = ["maxy", "realagent", "maxy-2", "maxy-3", "maxy-4"];
+const KNOWN_BRAND_HOSTNAMES = ["maxy", "maxy-code", "realagent", "realagent-code", "maxy-2", "maxy-3", "maxy-4"];
 /** Detect whether another brand is installed on this device.
  *  device-wide steps (apt package purge, Ollama binary removal, apt
  *  repo cleanup, ~/.claude / ~/.ollama wipes) must skip when a peer brand is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.106",
+  "version": "0.1.107",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/.claude-plugin/marketplace.json

@@ -39,11 +39,6 @@
       "source": "./email",
       "version": "0.1.0"
     },
-    {
-      "name": "founder-pack",
-      "source": "./founder-pack",
-      "version": "0.1.0"
-    },
     {
       "name": "linkedin-extension",
       "source": "./linkedin-extension",
@@ -84,11 +79,6 @@
       "source": "./scheduling",
       "version": "0.1.0"
     },
-    {
-      "name": "teaching",
-      "source": "./teaching",
-      "version": "0.1.0"
-    },
     {
       "name": "telegram",
       "source": "./telegram",
@@ -113,11 +103,6 @@
       "name": "workflows",
       "source": "./workflows",
       "version": "0.1.0"
-    },
-    {
-      "name": "writer-craft",
-      "source": "./writer-craft",
-      "version": "0.1.0"
     }
   ]
 }

package/payload/server/{chunk-BVDLDM6O.js → chunk-TZD23CX6.js}

@@ -2632,6 +2632,7 @@ import { resolve, join } from "path";
 import { existsSync, readFileSync } from "fs";
 var configDirName = ".maxy";
 var commercialMode = false;
+var shipsPremiumBundlesFlag = false;
 var vncDisplayNum = 99;
 var rfbPortNum = 5900;
 var websockifyPortNum = 6080;
@@ -2651,6 +2652,7 @@ if (platformRoot) {
     }
     if (typeof brand.configDir === "string") configDirName = brand.configDir;
     if (brand.commercialMode === true) commercialMode = true;
+    if (brand.shipsPremiumBundles === true) shipsPremiumBundlesFlag = true;
     if (typeof brand.vncDisplay === "number") vncDisplayNum = brand.vncDisplay;
     const brandLabel = configDirName.replace(/^\./, "");
     const required = [
@@ -2674,6 +2676,7 @@ if (platformRoot) {
 var MAXY_DIR = resolve(homedir(), configDirName);
 var BRAND_NAME = configDirName.replace(/^\./, "");
 var COMMERCIAL_MODE = commercialMode;
+var SHIPS_PREMIUM_BUNDLES = shipsPremiumBundlesFlag;
 var VNC_DISPLAY = `:${vncDisplayNum}`;
 var RFB_PORT = rfbPortNum;
 var WEBSOCKIFY_PORT = websockifyPortNum;
@@ -3429,6 +3432,38 @@ if (!existsSync4(PLATFORM_ROOT2)) {
 Set the MAXY_PLATFORM_ROOT environment variable to the absolute path of the platform directory.`
   );
 }
+var _stubDirsLoggedThisBoot = /* @__PURE__ */ new Set();
+function listValidAccounts() {
+  if (!existsSync4(ACCOUNTS_DIR)) return [];
+  const out = [];
+  const entries = readdirSync(ACCOUNTS_DIR, { withFileTypes: true });
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    if (entry.name.startsWith(".")) continue;
+    const accountDir = resolve3(ACCOUNTS_DIR, entry.name);
+    const configPath = resolve3(accountDir, "account.json");
+    if (!existsSync4(configPath)) {
+      if (!_stubDirsLoggedThisBoot.has(entry.name)) {
+        console.error(
+          `[platform] accounts-state STUB-DIR id=${entry.name} \u2014 onboarding leak; remove or repair`
+        );
+        _stubDirsLoggedThisBoot.add(entry.name);
+      }
+      continue;
+    }
+    let config;
+    try {
+      config = JSON.parse(readFileSync4(configPath, "utf-8"));
+    } catch {
+      console.error(
+        `[platform] accounts-state CORRUPT-JSON id=${entry.name} \u2014 account.json failed to parse; treating as stub`
+      );
+      continue;
+    }
+    out.push({ accountId: config.accountId, accountDir, config });
+  }
+  return out;
+}
 function resolveAccount() {
   if (!existsSync4(ACCOUNTS_DIR)) return null;
   let usersJsonUserId = null;
@@ -3622,7 +3657,10 @@ function readBundleSubPlugins(bundlePath) {
   return subs;
 }
 function walkPremiumBundles() {
-  if (BRAND_NAME === "maxy") return [];
+  if (!SHIPS_PREMIUM_BUNDLES) return [];
+  return walkPremiumBundlesOnDisk();
+}
+function walkPremiumBundlesOnDisk() {
   const stagingRoot = resolve4(PLATFORM_ROOT2, "../premium-plugins");
   if (!existsSync5(stagingRoot)) return [];
   let entries;
@@ -3735,6 +3773,36 @@ function reconcileEnabledPlugins(accountDir, config) {
     console.error(`${TAG} enabled-stamp write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
+function cleanupLeakedPremiumSubs(accountDir, config, accountId) {
+  const TAG = "[premium-auto-deliver]";
+  if (!accountDir || !config) return;
+  if (SHIPS_PREMIUM_BUNDLES) return;
+  const current = Array.isArray(config.enabledPlugins) ? config.enabledPlugins : [];
+  if (current.length === 0) return;
+  const leakedNames = /* @__PURE__ */ new Set();
+  for (const { subs } of walkPremiumBundlesOnDisk()) {
+    for (const sub of subs) leakedNames.add(sub);
+  }
+  if (leakedNames.size === 0) return;
+  const removed = [];
+  const kept = [];
+  for (const name of current) {
+    if (leakedNames.has(name)) removed.push(name);
+    else kept.push(name);
+  }
+  if (removed.length === 0) return;
+  const configPath = resolve4(accountDir, "account.json");
+  try {
+    const raw2 = readFileSync5(configPath, "utf-8");
+    const parsed = JSON.parse(raw2);
+    parsed.enabledPlugins = kept;
+    writeFileSync2(configPath, JSON.stringify(parsed, null, 2) + "\n");
+    config.enabledPlugins = kept;
+    console.log(`${TAG} cleanup accountId=${accountId ?? "unknown"} removed=[${removed.join(",")}]`);
+  } catch (err) {
+    console.error(`${TAG} cleanup write failed accountId=${accountId ?? "unknown"}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
 
 // app/lib/claude-agent/logging.ts
 var emitMissingOnResolve = (..._args) => null;
@@ -4414,6 +4482,7 @@ export {
   parseCookieValue,
   PLATFORM_ROOT2 as PLATFORM_ROOT,
   ACCOUNTS_DIR,
+  listValidAccounts,
   resolveAccount,
   resolveUserAccounts,
   fingerprintSessionKey,
@@ -4432,6 +4501,7 @@ export {
   walkPremiumBundles,
   autoDeliverPremiumPlugins,
   reconcileEnabledPlugins,
+  cleanupLeakedPremiumSubs,
   emitMissingOnResolve,
   stripAttachmentMetaSuffix,
   requirePortEnv,

package/payload/server/maxy-edge.js

@@ -19,7 +19,7 @@ import {
   streamActionEvents,
   vncLog,
   websockifyLog
-} from "./chunk-BVDLDM6O.js";
+} from "./chunk-TZD23CX6.js";
 import "./chunk-JRBCOVA4.js";
 import "./chunk-JSBRDJBE.js";
 

package/payload/server/server.js

@@ -18,6 +18,7 @@ import {
   browserViewerLog,
   canAccessAdmin,
   checkRateLimit,
+  cleanupLeakedPremiumSubs,
   clearRateLimit,
   clientIpMiddleware,
   createRemoteSession,
@@ -35,6 +36,7 @@ import {
   isPasswordValid,
   isRemoteAuthConfigured,
   launchAction,
+  listValidAccounts,
   reconcileEnabledPlugins,
   recordFailedAttempt,
   registerSession,
@@ -59,7 +61,7 @@ import {
   vncLog,
   waitForExit,
   walkPremiumBundles
-} from "./chunk-BVDLDM6O.js";
+} from "./chunk-TZD23CX6.js";
 import {
   CLOUDFLARE_TASK_DIAGNOSTICS,
   appendCloudflareSteps,
@@ -14368,6 +14370,9 @@ var bootEntitlement = bootAccountConfig ? resolveEntitlement(
 ) : null;
 autoDeliverPremiumPlugins();
 reconcileEnabledPlugins(bootAccount?.accountDir, bootAccount?.config);
+for (const acct of listValidAccounts()) {
+  cleanupLeakedPremiumSubs(acct.accountDir, acct.config, acct.accountId);
+}
 (async () => {
   if (!bootAccount) return;
   try {

package/payload/platform/plugins/founder-pack/.claude-plugin/plugin.json

@@ -1,8 +0,0 @@
-{
-  "name": "founder-pack",
-  "description": "founder-pack plugin",
-  "version": "0.1.0",
-  "author": {
-    "name": "Rubytech LLC"
-  }
-}

package/payload/platform/plugins/founder-pack/skills/investor-data-room/SKILL.md

@@ -1,258 +0,0 @@
----
-name: investor-data-room
-description: Use when a UK-domiciled founder needs to produce a full seed-raise pack from idea to deliverables: graph-structured data room, 15-section business plan, 12-slide deck blueprint, print-ready HTML+PDF for both. Trigger phrases include "build me a data room", "draft a business plan", "deck from the business plan", "print-ready PDF for the prospectus", "from office hours to investor pack", "set up the fundraise repo". The skill never speculates on financial figures or cap-table values: every number traces to a Companies House filing, a financial model worksheet, or a source citation. Public-facing artefacts contain zero internal workings (no "reconciliation pending", no "open Q" markers, no comparison-to-baseline commentary). Design tokens are harmonised across business plan, deck, and prospectus per `realagent-site/.docs/design-tokens.md`.
-allowed-tools:
-  - Bash
-  - Read
-  - Write
-  - Edit
-  - Glob
-  - Grep
-  - WebSearch
-  - WebFetch
----
-
-# investor-data-room
-
-Build a UK seed-raise pack in five stages. Each stage has an outcome contract; do not advance until the contract is met.
-
-## Outcome contract (whole skill)
-
-Complete when the data room contains:
-
-```
-<project-site>/.docs/data-room/
-  README.md                                 # data-room index, status snapshot, doctrine
-  01-narrative/
-    office-hours-design.md                  # ideation working scratchpad
-    business-plan.md                        # 15-section business plan
-    deck-blueprint.md                       # 12-slide blueprint
-  02-corporate-legal/
-    README.md                               # incorporation filings, articles, board minutes
-    incorporation-<co-house-no>-<date>.pdf  # IN01 + statement of capital + cap table
-  03-cap-table/
-    README.md                               # pre/post-investment cap table with PSC notes
-  04-financials/
-    README.md
-    model_worksheet.md                      # opening cash, capex, burn, MRR ramp, two-round
-  05-commercial/
-    README.md
-    <gtm-partner-1>.md                      # one file per named partner
-    <gtm-partner-1>-proposal.pdf
-  06-product-ip/
-    README.md
-    encrypted-document-sharing.md           # if applicable
-  07-team/
-    README.md
-    <founder-1>.pdf                         # CV per foregrounded founder
-  08-market/
-    README.md
-    sources.md                              # every market figure with citation
-    competitor-value-claims-rebuttal.md
-  09-operations/
-    README.md
-  10-supporting/
-    README.md
-  html/
-    business-plan/
-      index.html                            # A4 portrait, design tokens, premium register
-      render-pdf.mjs                        # Playwright + img2pdf + qpdf pipeline
-      business-plan.pdf                     # rendered output
-      logo-light.png logo-dark.png
-    prospectus/
-      index.html                            # A4 portrait, 10-15 page persuasive cut
-      term_sheet.html                       # A4 portrait, 6-8 page formal term sheet
-      render-pdf.mjs
-      prospectus.pdf term_sheet.pdf
-      logo-light.png logo-dark.png
-    deck/
-      index.html                            # 16:9 landscape (297mm x 167mm), 12+1 slides
-      render-pdf.mjs
-      deck.pdf
-      logo-light.png logo-dark.png
-      team/                                 # cropped headshot WebPs for slide 8 founder grid
-        <founder-firstname>-<lastname>.webp
-```
-
-Skip stages that are already complete; do not regenerate stale artefacts blindly.
-
-## Stage 1 — Office-hours ideation
-
-Drive a conversational discovery session using the `/office-hours` skill (or equivalent YC-style forcing questions: demand reality, status quo, desperate specificity, narrowest wedge, observation, future-fit). Output a single `office-hours-design.md` capturing:
-
-- Problem statement
-- Demand evidence (with numbers and dates)
-- Status quo
-- Target user and narrowest wedge
-- Constraints
-- Six to eight numbered premises (founder-confirmed)
-- Two to four narrative-shape alternatives with a recommendation
-- Financials / use-of-funds placeholders flagged as open questions
-- Founder Signal Reflection
-
-This file is the working substrate. It stays internal-only. Every later artefact derives from it.
-
-**Doctrine.** Never speculate on numbers; flag them as open questions until the founder confirms.
-
-## Stage 2 — Data room scaffold
-
-Build the directory tree above. Each section gets a `README.md` that doubles as a content checklist (purpose, expected contents, current state, gaps). The graph structure is fixed: ten numbered sections (`01-narrative` through `10-supporting`) plus a top-level README and an `html/` subdirectory for rendered deliverables.
-
-**File-naming conventions:**
-
-- `<co-house-no>` for Companies House filings (e.g. `incorporation-17237239-2026-05-22.pdf`).
-- `<founder-firstname>-<lastname>.pdf` for CVs.
-- `<gtm-partner>.md` + `<gtm-partner>-proposal.pdf` for each commercial partner.
-- All `README.md` files are markdown only.
-
-**Where the published URL lives.** If the project hosts a public prospectus or marketing microsite, keep the published artefacts at a stable path (e.g. `realagent.chat/sites/<slug>/`); the rendered HTML inside `html/<artefact>/index.html` is the source of truth and republishes from there.
-
-References: `references/data-room-structure.md` for the section-by-section purpose statements.
-
-## Stage 3 — Business plan synthesis
-
-Generate `01-narrative/business-plan.md` with **15 sections** following the canonical structure:
-
-1. Executive Summary
-2. Vision and Mission (Vision / Mission / Doctrine triad)
-3. The Company (legal entity table + pre-investment cap table)
-4. The Market (TAM/SAM/SOM + structural tailwind + self-employed wedge + domestic adjacency + international upside + pricing)
-5. The Product (what it is + wedge product + upsell path + substrate moat + conversation ingestion + network + Anthropic asymmetric capture + human-services layer)
-6. The Business Model (revenue streams + unit economics)
-7. Go-to-Market (Wedge → Beachhead → Blitzscale framework + demand evidence + GTM partners + horse-before-cart logic + geography)
-8. Competition (three failing categories + RANL differentiation + most-direct-competitor counter)
-9. Operations (technology stack + data sovereignty + IP ownership chain + compliance posture summary)
-10. Compliance and regulatory positioning (UK consumer protection + UK data/AI regime + EU AI Act + adjacent UK obligations + moat-not-tax close)
-11. Team (founders + strategic shareholders + hiring plan)
-12. Financial Plan (12.1 opening balance sheet through 12.7 use of funds)
-13. Risks and Mitigations
-14. Milestones (the N-month thesis)
-15. The bottom line (summary table + close)
-+ Appendices (titled documents only; no internal-only file pointers)
-
-**Critical rules** (all enforced; recurrence is a P0 violation):
-
-- **No internal workings** in body text. No "reconciliation pending", no "open Q", no comparison-to-baseline ("loss has grown from X to Y because…"), no cross-references to `office-hours-design.md` or any working file.
-- **Cap table is authoritative from the IN01.** Reconcile the share-capital line (`500,000 ordinary @ £0.001 nominal` vs `@ £0.01`) before writing the opening balance sheet. Inception premium (e.g. one founder paying £4,500 above nominal) reconciles £5k inception cash against £500 nominal.
-- **Every market figure cites a source.** Maintain `08-market/sources.md` with every figure used in the business plan; the body references "Appendix B" by title, never an internal file path.
-- **Financial figures derive from the model worksheet.** Cite "Appendix A" by title.
-- **No em-dashes between alphabetic words** in user-facing prose (recurring style violation in this project's history; see `references/internal-workings-scrub.md`).
-
-Compliance research is mandatory before drafting Section 10. WebSearch (or equivalent) for: DMCC Act (UK consumer protection for estate-agency), ICO ADM framework (Articles 22A–22D under UK GDPR + ICO 2025 strategy), EU AI Act (force date, high-risk classification for property-financing decisions). Cite each.
-
-References: `references/business-plan-template.md` for the section-by-section template; `references/compliance-research-checklist.md` for the UK + EU regulatory regimes to verify.
-
-## Stage 3b — Term sheet synthesis
-
-Generate `html/prospectus/term_sheet.html` as an **A4 portrait, 10-page formal term sheet** sectioned as:
-
-1. Cover + preamble + parties (Issuer / Founders / Investors / round size / minimum cheque / target close)
-2. Share economics & use of proceeds (instrument, valuation, dilution, issue price, share count, use of funds)
-3. Cap table on closing (post-money, fully diluted, total = 100%)
-4. Governance & shareholder protections (board, info rights, pre-emption, drag/tag, SEIS/EIS posture)
-5. Closing terms (governing law, IP assignment, conditions to closing, long-form docs timeline)
-6. Signatures (Company + Investor blocks)
-7. **Appendix A — High Net Worth Individual Investor Statement** (FSMA 2000 / FCA COBS 4 Annex 2 verbatim)
-8. **Appendix B — Self-Certified Sophisticated Investor Statement** (FSMA 2000 / FCA COBS 4 Annex 4 verbatim)
-9. Backpage (contact)
-
-**Doctrine for the term sheet:**
-
-- **Entity name is the IN01-filed name**, not a marketing entity. Issuer must read as the actual filed company (e.g. "Real Agent Network Limited" not "Real Agent Systems Ltd").
-- **Cap table matches the IN01 + Round 1 dilution model exactly.** Pre-investment shares + new investor Round Shares = post-investment total. No fractional shares; no rounding to the % column that breaks share totals.
-- **Founder list reads exactly as the cap table.** No phantom founders. Strategic shareholders (e.g. an investing LLP) ride in the cap table by entity name, not via their individuals.
-- **Sole director on IN01 is the director-designate.** A term sheet that names two directors when IN01 names one is a defect.
-- **SEIS/EIS posture is post-funding obligation, not closing contingency.** Never assured prior to distribution; no representation as to qualifying status. Forms no part of consideration.
-- **Confidentiality and exclusivity provisions are the only binding clauses.** Everything else non-binding until long-form docs.
-- **FCA self-certification statements are appendices to the term sheet, not separate documents.** The High Net Worth Individual Investor Statement (FSMA 2000 (Financial Promotion) Order 2005 / FCA COBS 4 Annex 2) and the Self-Certified Sophisticated Investor Statement (COBS 4 Annex 4) ship as Appendix A and Appendix B. **Use verbatim wording**; never paraphrase regulatory text. Current source: UKBAA's templated PDFs (Feb 2024 versions reflect the post-31 Jan 2024 reverted thresholds: HNW £170k income or £430k net assets; sophisticated director threshold £1.6m turnover). When the regulatory wording changes, the templates change first at UKBAA / FCA COBS Annexes; re-fetch before issue.
-
-References: `references/termsheet-template.md`.
-
-## Stage 4 — Deck blueprint synthesis
-
-Generate `01-narrative/deck-blueprint.md` as a **12-slide brief** the deck designer can execute. Each slide has Purpose, Headline (one-line message), Body (bullets + figures pulled from the business plan), Visual suggestion, and Source reference. The 12 slides:
-
-1. Cover (raise headline + founders)
-2. Vision (Vision / Mission / Doctrine)
-3. The Market (TAM + tailwind + wedge)
-4. Business Model (subscription + service layer + unit economics)
-5. Go-to-Market (Wedge → Beachhead → Blitzscale + named partners)
-6. The Product (substrate + wedge + network + asymmetric capture + services layer)
-7. Competition (three failing categories + most-direct counter)
-8. The Team (founders + strategic shareholders)
-9. Economics (P&L summary + cash flow + break-even)
-10. The Raise (size, valuation, dilution, instrument, use of funds, IP transfer, follow-on round)
-11. Milestones (M0 to M-final timeline)
-12. Other Information (compliance + platform dependency + contact)
-
-Production notes attached: format (16:9 landscape, PDF + source deck), design tokens reference (`realagent-site/.docs/design-tokens.md` or project equivalent), chart-source consistency with the financial model, speaker-note attribution.
-
-References: `references/deck-blueprint-template.md`.
-
-## Stage 5 — HTML + PDF render pipeline
-
-For each artefact that ships as a print-ready PDF (business plan, prospectus, deck), produce three files under `html/<artefact>/`:
-
-```
-index.html        # A4 portrait single HTML file, premium design tokens, sectioned by <section class="page">
-render-pdf.mjs    # Playwright + img2pdf + qpdf pipeline (image-only PDF, linearized)
-<artefact>.pdf    # rendered output (regenerate after every HTML edit)
-```
-
-**Hard constraints** (from the `property-brochure:a4-print-documents` skill):
-
-- A4 portrait: `@page { size: A4 portrait; margin: 18mm 16mm 20mm; }`
-- One `<section class="page">` per A4 page; renderer aborts if `scrollHeight` exceeds 1123px + 2px slack.
-- Page numbers via CSS counter in `.page::after { content: counter(pagenum); }`. The renderer screenshots each section, so `@page @bottom-center` rules do NOT propagate.
-- Image-only PDF: Playwright captures one PNG per section at deviceScaleFactor 3.125 (300 dpi); `img2pdf --pagesize 210mmx297mm` binds them; `qpdf --linearize --object-streams=disable` linearises.
-- Even page count for booklet binding (multiple of 4 ideal). Add or remove a supporting page if parity breaks.
-- Cover and backpage are full-bleed `--surface-deep` with `@page :first { margin: 0 }` and named `@page backpage-full`.
-- Screen-only chrome (e.g. a Download PDF pill button) uses `@media print { display: none !important; }` per the skill.
-- `execFileSync` for img2pdf and qpdf (never `execSync` with template strings: shell-injection class).
-- Verify: `qpdf --check`, `pdfinfo | grep -E "Pages|Optimized"`, **and read every page visually**. `pdfinfo` reporting "25 pages, A4" is not verification.
-
-**Design tokens.** Reference the project's `design-tokens.md` Tier 1 (raw) + Tier 2 (semantic aliases) + Tier 3 (component) layers. Premium register defaults: `--paper-25` near-white page surface, `--teal-900` ink, `--gold-500` accent, `--paper-100` cool mist (`#ECF1F2`) tinted-band surface. Update token values in one place; CSS `:root` mirrors the spec.
-
-**Logo placement.** Copy the light and dark icon variants from the project's public assets (`logo-light.png` for dark cover/backpage, `logo-dark.png` reserved for light content pages if needed) into the artefact directory. Cover top-left pairs the icon with the wordmark; backpage top-left does the same.
-
-References: `references/html-pdf-pipeline.md` for the canonical `render-pdf.mjs` source and CSS scaffold.
-
-## Doctrine (enforced across all stages)
-
-- **No internal workings in public artefacts.** Comparison-to-baseline, reconciliation-pending, open-Q markers, internal cross-references all stay in working files (`01-narrative/office-hours-design.md`, section READMEs). Public artefacts (business plan, deck, prospectus, PDFs) state the current position as a fact.
-- **Every claim cites a source.** Companies House for the cap table. The model worksheet for every financial figure. A named publication for every market figure. A specific vendor page for every competitor claim.
-- **Design tokens are the visual contract.** Update once in the tokens spec; the business plan CSS, the prospectus CSS, and the deck CSS all consume the same tokens. Never hardcode hex values inside component CSS.
-- **Even page count for booklet binding.** Multiple of 4 ideally; minimum even. Add or remove a supporting page to maintain parity if a section change breaks it.
-- **Verify by reading every rendered page.** `pdfinfo` page count is not verification. The bottom 30% of every page must reach the content margin without significant whitespace.
-
-## Slide-design patterns (collected from the deck build)
-
-- **Cap-table over labelled pie chart.** A labelled donut with seven slices puts the percentages on the chart but adds visual clutter at small slice counts. A clean post-investment cap table (Shareholder / Shares / % with a gold-rule Total row) reads faster on the slide and matches the term-sheet treatment. Default to the table; reserve the pie for slides with three to four large slices.
-- **Circular founder avatars on the team slide.** Square photos at full card width over-allocate vertical real-estate and crowd the bio + advisor band. Fixed-diameter circular avatars (e.g. 42mm × 42mm, `border-radius: 50%`, centred `margin: 0 auto`) leave room for the eyebrow + name + 3-line bio + advisor band on a 16:9 slide.
-- **Headshot crops are face-centred, not full-environment.** Crop each source PNG/JPG to a tight head + shoulders square at 1200×1200 (`magick <src> -crop WxH+X+Y +repage -resize 1200x1200 -strip <crop>.png`), then encode with `cwebp -q 88 -m 6 -mt`. Resize-then-encode never loses face fidelity at the 42mm display size. Track per-founder face position from the source dimensions and centre the crop window on it.
-- **Bio line budget on slide 8 is ~3 lines at 8.5pt.** A 4th line crashes into the advisor band's `border-top`. Trim aggressively: lead with the headline number ("33 years residential estate agency"), then 2-3 firms and 1-2 awards.
-- **Linter strips trailing text in long edits.** When editing a multi-line founder bio (or any cell where you append clauses past a verbatim sentence), the auto-formatter has rewritten the trailing fragment on this project. Always re-grep the file after the edit; if "Sole IN01 director." or "2× Capper" went missing, the edit needs a second pass with a smaller anchor.
-
-## Pitfalls to avoid (collected from the reference project)
-
-- **Renaming a directory after the URL is published.** Keep `<project-site>/.docs/data-room/html/<artefact>/index.html` stable; if the URL changes, downstream investor links break.
-- **Letting Round-2 hires inflate the Year-1 P&L.** Only Round-1 hires belong in the Year-1 income statement. Customer-success and product-engineer hires that trigger in Round 1 are in; senior platform engineer, head of growth, and CS team scale that Round 2 funds are not.
-- **Mixing "Year 1" (12-month) and "Round 1 runway" (9-month).** If the £350k buys 9 months, present a 9-month forecast; do not present a 12-month forecast that implicitly assumes Round 2 closes mid-period without modelling the Round-2 cash injection.
-- **Generic AI-bolted-onto-cloud-CRM competitors.** Treat the competitive set as three failing categories: incumbents (cloud CRM + bolted AI), Anthropic horizontal AI (inaccessible to non-tech-wizard users), and new-build cloud-SaaS AI-OS replacements (migration-required, same lock-in pattern as incumbents). Name each vendor, cite each claim from the vendor's own page, rebut with the substrate-AI inversion.
-- **Forgetting Priestley / equivalent founder-thesis anchor.** Any founder who built the same thesis years before AI made it structurally apparent should reference it: book title, first-publication date, founder's costly-signal action (e.g. "bought 200 copies and distributed them to operators in his network"). This dates the conviction and lifts the deck's signal weight.
-- **Letting the page background go light brown.** Premium register page surface (`--paper-25`) is near-white (`#FBFAF6`), not ivory. The screen-preview body background stays plain white (`#FFFFFF`).
-
-## References
-
-- `references/data-room-structure.md` — section-by-section README templates
-- `references/business-plan-template.md` — 15-section business plan template
-- `references/deck-blueprint-template.md` — 12-slide deck brief template
-- `references/html-pdf-pipeline.md` — render-pdf.mjs canonical source + CSS scaffold
-- `references/compliance-research-checklist.md` — UK + EU regulatory regimes to verify
-- `references/internal-workings-scrub.md` — the public-vs-internal doctrine, patterns to scrub, recurrence list
-- `references/design-tokens-application.md` — how to consume `realagent-site/.docs/design-tokens.md` from an artefact's `:root` block
-- `references/termsheet-template.md` — A4-portrait term-sheet structure, cap-table reconciliation, common defects
-
-## Reference project
-
-The first execution of this skill produced `realagent-site/.docs/data-room/` for Real Agent Network Limited (Companies House 17237239). Read that directory as the canonical example; the skill's job is to reproduce its structure and doctrine for any subsequent UK seed raise.

package/payload/platform/plugins/founder-pack/skills/investor-data-room/references/business-plan-template.md

@@ -1,61 +0,0 @@
-# Business plan template — 15-section structure
-
-The canonical structure used by `01-narrative/business-plan.md`. Every public-facing artefact (deck, prospectus, term sheet) derives from this file. Apply the internal-workings scrub (see `internal-workings-scrub.md`) on every revision.
-
-## Section-by-section skeleton
-
-### 1. Executive Summary
-One paragraph each: what the company is (legal entity + Companies House identifier + substrate description), what is being raised (size, pre-money, post-money, runway, Round 2 follow-on), demand evidence (numbers with dates), market size + structural tailwind, competitive set in three failing categories + the architectural inversion, bottom-line P&L summary.
-
-### 2. Vision and Mission
-Three blocks. **Vision.** Where the company ends up at full execution. **Mission.** What the company gives to its customer day one. **Doctrine.** The structural belief that everything else derives from.
-
-### 3. The Company
-Legal entity table (legal name, Companies House number, incorporation date, registered office, SIC, PSC status, sole proposed director on IN01) + pre-investment cap table (sourced from the IN01 verbatim) + post-investment dilution pointer.
-
-### 4. The Market
-Subsections: Size of the addressable market (TAM with citation per figure); Structural tailwind (margin squeeze, regulatory tailwind, or equivalent); Self-employed wedge or analogous high-growth segment; Domestic adjacency (next-vertical expansion); International upside (channel partner enabling it); Pricing and TAM (per-customer ACV × addressable count = TAM number).
-
-### 5. The Product
-Subsections: What it is (substrate description, CRM-agnostic / data-sovereign positioning); The wedge product (narrowest unit of value, public-by-default if applicable); The upsell path (wedge → high-value output → full substrate); The substrate moat (operator-data + ontological graph + flywheel); Conversation ingestion (or equivalent lock-in mechanic); The network (federation thesis); Asymmetric-capture position (the LLM-binary wrap argument, with commercial-practice insurance); Human-services layer (training, support, white-glove, anti-fragile-against-frontier-AI).
-
-### 6. The Business Model
-Revenue streams (subscription tiers + future network-effect revenue), unit economics (ACV, CAC, gross margin, churn placeholder), compute-mark-up doctrine ("never mark up the LLM compute; customer pays the LLM provider directly").
-
-### 7. Go-to-Market
-Wedge → Beachhead → Blitzscale framework (with months and funding source per phase), demand evidence (40+ EOIs, paid intents, founder dogfood, partnership status — every number cited), GTM partners (one row per named partner with role and source), horse-before-cart logic (public-first wedge that earns trust for the private high-value upsell), geography.
-
-### 8. Competition
-Three failing categories: (a) cloud-CRM-bolted-AI incumbents, (b) horizontal-AI providers inaccessible to ICP, (c) new-build cloud-SaaS replacements requiring full migration. RANL differentiation paragraph. Most-direct-competitor counter (CRM-agnostic vs migration-required is the headline rebuttal).
-
-### 9. Operations
-Technology stack (foundation model, graph store, hardware tiered by workload, network, hosting), data sovereignty paragraph, IP ownership chain (deed-of-assignment commitment), compliance posture operational summary (pointer to Section 10 for full treatment).
-
-### 10. Compliance and regulatory positioning
-Three regulatory regimes: UK consumer protection (DMCC Act for estate agency / equivalent for the vertical), UK data and AI regime (UK GDPR + ICO ADM Articles 22A–22D), EU AI Act (relevant only to international expansion). Adjacent UK obligations (Estate Agents Act / equivalent + AML + sector membership bodies). Closing: "Why compliance is the moat, not the tax".
-
-### 11. Team
-Founders (foregrounded) with role + concise career summary + key credentials + pre-investment shareholding. Strategic shareholders from incorporation (advisors, family, JV partners on the cap table from day one). Hiring plan table with month-triggered roles + salary + trigger condition.
-
-### 12. Financial Plan
-12.1 Opening balance sheet (M0 after capex). 12.2 Year-1 Income Statement (revenue + COGS + every opex line + depreciation + EBIT + corp tax + net loss). 12.3 Year-1 cash flow summary table (period-by-period opening, net flow, closing cash). 12.4 Closing balance sheet (M12). 12.5 Two-round funding strategy (timing, size, pre-money, purpose, gating evidence per round). 12.6 Contingency levers. 12.7 Use of funds (this round) by bucket.
-
-### 13. Risks and Mitigations
-Two-column table: risk + mitigation. Cover Loop / Anthropic / competitor-ships-earlier / wedge-fails-to-convert / founder-transition / counsel-delays / Round-2-market / investor-structure.
-
-### 14. Milestones (the N-month thesis)
-Month-by-month table: M0 close + closing conditions; M1 first paying customer; M3 product-engineer hire + ~10 customers; M6 wedge phase complete; M7 Round 2 raise opens; M9 Round 2 closes; M12 break-even.
-
-### 15. The bottom line
-Summary table of headline numbers (raise size, pre-money, post-money, dilution, runway, Y1 revenue/loss/cash-burn/closing-cash/ARR, break-even month, Round 2 timing/size). Closing paragraph.
-
-### Appendices
-Cited documents listed by title only. Each available to a serious investor on request; internal-only working documents are not listed.
-
-## Writing rules
-
-- **Numbers cite their source.** Every figure in the body links to an Appendix entry that is itself a publicly-shareable document.
-- **No internal commentary.** See `internal-workings-scrub.md`.
-- **No em-dashes between alphabetic words** in user-facing prose. Use colons, parentheses, semicolons, or rewrites.
-- **Even-page-count parity** if the document is printed; add a supporting page if a section change breaks parity.
-- **One pre-investment cap table source: the IN01.** Reconcile the nominal-value discrepancy (e.g. £0.001 vs £0.01) before writing the balance sheet.

package/payload/platform/plugins/founder-pack/skills/investor-data-room/references/compliance-research-checklist.md

@@ -1,53 +0,0 @@
-# Compliance research checklist
-
-Required before drafting business plan Section 10 (Compliance and regulatory positioning) for a UK-domiciled raise. Every claim must cite a primary source (ICO guidance, gov.uk, regulator strategy document) verified by WebSearch.
-
-## UK consumer-protection regime
-
-**For estate-agency / property:** Digital Markets, Competition and Consumers Act 2024 (DMCC Act). In force from 6 April 2025. Supersedes the Consumer Protection from Unfair Trading Regulations 2008 for estate-agency consumer protection. Under the DMCC Act, **omitting material information is automatically an unfair commercial practice regardless of whether the omission affected the consumer's decision**. CMA holds direct enforcement powers including fines without court process. Property brochures must include Part B material information.
-
-**For other verticals:** Identify the equivalent UK consumer-protection regime (financial services → FCA Consumer Duty; healthcare → CQC; legal services → SRA; etc.). Same pattern: cite the binding statute, name the regulator, identify the enforcement mechanism.
-
-## UK data-protection and AI regime
-
-- **UK GDPR** sits over UK data processing. Articles 22A to 22D (added by the Data Use and Access Act) govern solely automated decision-making.
-- **No UK AI-specific statute in the 2026 parliamentary session.** Labour's 2024 King's Speech committed to "appropriate legislation on the most powerful AI models" but the Bill has not been introduced. A dedicated 2026 AI Bill is not expected.
-- **ICO strategy.** June 2025 strategy "Preventing Harm, Promoting Trust" frames the regulator's approach. ICO consulting on updated Automated Decision-Making and Profiling guidance during 2025–2026, with a statutory code of practice on AI and ADM in the pipeline. First substantive enforcement guidance expected later in 2026.
-- **UK is not adopting the EU AI Act.** Sector-led approach via existing regulators. Starmer's stated position: *"instead of over-regulating these new technologies, we're seizing the opportunities they offer"*.
-
-## EU AI Act (relevant only to international expansion)
-
-- Entered into force 1 August 2024.
-- Fully applicable 2 August 2026.
-- Classifies AI systems used in credit and insurance (which overlap with mortgage and property-financing decisions) as **high-risk**. Most marketing and operational AI applications sit at lower risk tiers.
-- High-risk obligations: risk-management systems, data-quality controls, human oversight, transparency to affected individuals, conformity assessment, post-market monitoring.
-- For UK-domiciled companies, the EU AI Act binds only when serving EU customers. Document the international expansion path and confirm whether any planned product crosses into high-risk territory.
-
-## Adjacent UK obligations to verify per vertical
-
-- **Estate Agents Act 1979** for property: distinguish software vendor (out of scope) from estate agent (in scope).
-- **Money Laundering Regulations 2017 + Economic Crime and Corporate Transparency Act 2023** for AML obligations.
-- **PECR (Privacy and Electronic Communications Regulations 2003)** for electronic marketing, cookies, and tracking. Sits alongside UK GDPR. Enforced by ICO with fines up to £500,000.
-- **Sector membership bodies** (NAEA / ARLA Propertymark for property; equivalents per vertical).
-- **Client Money Protection schemes** where the business handles client money.
-
-## WebSearch protocol
-
-For each regime, search for:
-
-1. The primary statute / regulation page on gov.uk or the regulator's site.
-2. A recent (within last 12 months) legal-firm briefing summarising current state.
-3. The regulator's strategy document.
-
-Examples that worked in the reference project:
-
-- DMCC Act + Propertymark guidance withdrawal: `https://www.propertymark.co.uk/resource/material-information-guidance-withdrawn-as-the-digital-markets-competition-and-consumers-act-takes-over.html`
-- ICO AI strategy: `https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/`
-- UK AI Bill status: `https://iapp.org/news/a/king-s-speech-signals-diffuse-uk-digital-policy-agenda-but-no-ai-bill`
-- EU AI Act compliance for UK businesses: `https://www.rmoklegal.com/guides/eu-ai-act-compliance-uk`
-
-Cite the actual source URLs in the business plan's reply / Sources block (per the WebSearch tool's mandatory citation rule).
-
-## The closing argument
-
-The business plan's Section 10 ends with "Why compliance is the moat, not the tax": cloud-CRM-bolted-AI competitors inherit the vendor's data-protection posture; the product owns the agent's data sovereignty by design, so compliance is a competitive moat (especially into EU markets where the EU AI Act amplifies the cost differential).