@rubytech/create-maxy-code 0.1.108 → 0.1.110

package/payload/platform/plugins/venture-studio/bin/scaffold.sh

@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+# Venture-studio data-room scaffold — deterministic enforcement of the
+# scaffold-first principle (Task 286 + feedback_doctrine_paragraph_is_not_a_gate).
+#
+# Creates exactly one Project (with eight pre-seeded artefact Tasks) in
+# the graph, then materialises the ten-section data-room directory tree
+# on disk. The venture-studio agent's downstream skills are gated on
+# both signals existing — see venture-studio/PLUGIN.md.
+#
+# Order of operations: graph write first, directories second. The CLI's
+# duplicate-name guard makes the script safely re-runnable after any
+# partial failure: a second run finds the existing Project, returns its
+# id, and retries the mkdir step.
+#
+# Usage:
+#   ACCOUNT_ID=<uuid> scaffold.sh <project-root> <business-name>
+#
+# Exit codes:
+#   0   scaffold complete (or already existed)
+#   2   bad arguments / missing ACCOUNT_ID
+#   1   graph write failed, directory mkdir failed, or CLI binary missing
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# Deployed layout per packages/create-maxy-code/scripts/bundle.js:
+#   <install>/premium-plugins/venture-studio/bin/scaffold.sh
+#   <install>/platform/plugins/work/mcp/dist/cli/project-create-cli.js
+CLI_BIN="${SCRIPT_DIR}/../../../platform/plugins/work/mcp/dist/cli/project-create-cli.js"
+
+if [[ $# -ne 2 ]]; then
+  echo "scaffold.sh: usage: ACCOUNT_ID=<uuid> $0 <project-root> <business-name>" >&2
+  exit 2
+fi
+
+PROJECT_ROOT="$1"
+BUSINESS_NAME="$2"
+
+if [[ -z "${ACCOUNT_ID:-}" ]]; then
+  echo "scaffold.sh: ACCOUNT_ID env var required" >&2
+  exit 2
+fi
+
+if [[ ! -d "$PROJECT_ROOT" ]]; then
+  echo "scaffold.sh: project root does not exist: $PROJECT_ROOT" >&2
+  exit 2
+fi
+
+if [[ ! -f "$CLI_BIN" ]]; then
+  echo "scaffold.sh: project-create CLI not built or missing at: $CLI_BIN" >&2
+  exit 1
+fi
+
+DATA_ROOM="${PROJECT_ROOT}/.docs/data-room"
+
+# Eight pre-seeded artefact tasks — order and names match
+# premium-plugins/venture-studio/PLUGIN.md § First-conversation routing.
+# Section order is preserved so the agent can walk them sequentially.
+PAYLOAD=$(cat <<JSON
+{
+  "accountId": "${ACCOUNT_ID}",
+  "name": "${BUSINESS_NAME}",
+  "description": "Venture-studio data room for ${BUSINESS_NAME}. Root: ${DATA_ROOM}",
+  "tier": "full",
+  "workItems": [
+    {"name": "Stage 1 — Office-hours design doc", "description": "Produces 01-narrative/office-hours-design.md via the office-hours skill."},
+    {"name": "Brand pack", "description": "Produces brand identity (palette, typography, logo) into 06-product-ip/brand/ via the brand-pack skill."},
+    {"name": "Stage 2 — Wedge validation + landing page + PRD", "description": "Produces 01-narrative/{PMF,LANDING,PRD}.md via the zero-to-prototype skill."},
+    {"name": "Stage 3 — Business plan", "description": "Produces 01-narrative/business-plan.md via investor-data-room Stage 3."},
+    {"name": "Stage 3b — Term sheet", "description": "Produces html/prospectus/term_sheet.html via investor-data-room Stage 3b."},
+    {"name": "Stage 4 — Deck blueprint", "description": "Produces 01-narrative/deck-blueprint.md via investor-data-room Stage 4."},
+    {"name": "Stage 4b — Prospectus", "description": "Produces html/prospectus/index.html via investor-data-room Stage 4b."},
+    {"name": "Stage 5 — Rendered PDFs", "description": "Produces html/{business-plan,prospectus,deck}/*.pdf via investor-data-room Stage 5."}
+  ]
+}
+JSON
+)
+
+# Graph write first. CLI returns {projectId, existing:bool} on stdout;
+# on any failure it exits non-zero with a literal stderr message that
+# propagates here verbatim — no prose-parsing for control flow
+# (memory: feedback_no_stdout_parsing_for_control_flow).
+RESULT=$(node "$CLI_BIN" "$PAYLOAD")
+echo "scaffold.sh: project-create CLI returned: $RESULT"
+
+# Directories second. The agent's pre-flight gate keys on the existence
+# of 01-narrative/ (it AND-checks with project-list); creating it last
+# means partial state (graph-only) is naturally invisible to the gate
+# until mkdir succeeds.
+for section in \
+  01-narrative \
+  02-corporate-legal \
+  03-cap-table \
+  04-financials \
+  05-team \
+  06-product-ip \
+  07-customers \
+  08-market \
+  09-traction-metrics \
+  10-supporting; do
+  mkdir -p "${DATA_ROOM}/${section}"
+done
+
+echo "scaffold.sh: data-room scaffolded at ${DATA_ROOM}"

package/payload/platform/plugins/venture-studio/skills/investor-data-room/SKILL.md

@@ -96,7 +96,9 @@ This file is the working substrate. It stays internal-only. Every later artefact
 
 ## Stage 2 — Data room scaffold
 
-Build the directory tree above. Each section gets a `README.md` that doubles as a content checklist (purpose, expected contents, current state, gaps). The graph structure is fixed: ten numbered sections (`01-narrative` through `10-supporting`) plus a top-level README and an `html/` subdirectory for rendered deliverables.
+When invoked under the venture-studio agent, scaffolding is done by the deterministic script at `premium-plugins/venture-studio/bin/scaffold.sh` — it creates the Project + eight artefact Tasks and the ten-section directory tree in one atomic invocation. The script is idempotent; re-runs against an existing data room are a no-op. See `venture-studio/PLUGIN.md` § "Scaffolding script".
+
+When invoked outside the venture-studio agent (standalone usage of this skill), build the directory tree manually. Each section gets a `README.md` that doubles as a content checklist (purpose, expected contents, current state, gaps). The graph structure is fixed: ten numbered sections (`01-narrative` through `10-supporting`) plus a top-level README and an `html/` subdirectory for rendered deliverables.
 
 **File-naming conventions:**
 

package/payload/platform/plugins/work/mcp/dist/cli/project-create-cli.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=project-create-cli.d.ts.map

package/payload/platform/plugins/work/mcp/dist/cli/project-create-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-create-cli.d.ts","sourceRoot":"","sources":["../../src/cli/project-create-cli.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/work/mcp/dist/cli/project-create-cli.js

@@ -0,0 +1,78 @@
+// CLI bridge for shell scripts that need to scaffold a Project + Tasks
+// atomically (e.g. premium-plugins/venture-studio/bin/scaffold.sh). The
+// scaffold script is the deterministic enforcement layer for the
+// venture-studio scaffold-first principle (see Task 286 +
+// feedback_doctrine_paragraph_is_not_a_gate); to remain deterministic it
+// must invoke a single binary, not narrate intent for the LLM. This CLI
+// is that binary.
+//
+// Contract:
+//   node project-create-cli.js '<json-payload>'
+//   payload: { accountId, name, description, tier, workItems[], createdBy }
+//   exit 0 + stdout JSON { projectId, existing: boolean } on success
+//   exit non-zero + literal stderr message on any failure
+//
+// Idempotency guard lives here, NOT in projectCreate(). projectCreate()
+// always mints a fresh UUID — modifying it to MERGE on (accountId, name)
+// would change semantics for every existing caller. The CLI runs a
+// pre-check MATCH on (accountId, name); if a Project exists, it returns
+// the existing projectId with existing=true and skips the write. This
+// makes the scaffold script safely re-runnable after a partial failure
+// (e.g. graph write succeeds but mkdir fails — second run finds the
+// Project and only retries mkdir).
+import { projectCreate } from "../tools/project-create.js";
+import { getDriver } from "../lib/neo4j.js";
+async function findExistingProject(accountId, name) {
+    const driver = getDriver();
+    const session = driver.session();
+    try {
+        const result = await session.run(`MATCH (p:Project {accountId: $accountId, name: $name})
+       RETURN p.taskId AS projectId LIMIT 1`, { accountId, name });
+        if (result.records.length === 0)
+            return null;
+        return result.records[0].get("projectId");
+    }
+    finally {
+        await session.close();
+    }
+}
+async function main() {
+    const raw = process.argv[2];
+    if (!raw) {
+        process.stderr.write("project-create-cli: missing JSON payload argument\n");
+        process.exit(2);
+    }
+    let payload;
+    try {
+        payload = JSON.parse(raw);
+    }
+    catch (err) {
+        process.stderr.write(`project-create-cli: malformed JSON payload: ${err.message}\n`);
+        process.exit(2);
+    }
+    if (!payload.accountId || !payload.name) {
+        process.stderr.write("project-create-cli: payload missing required field (accountId, name)\n");
+        process.exit(2);
+    }
+    const createdBy = payload.createdBy ?? {
+        tool: "project-create-cli",
+        source: "scaffold-script",
+    };
+    const existing = await findExistingProject(payload.accountId, payload.name);
+    if (existing) {
+        process.stdout.write(JSON.stringify({ projectId: existing, existing: true }) + "\n");
+        return;
+    }
+    const result = await projectCreate({
+        ...payload,
+        createdBy,
+    });
+    process.stdout.write(JSON.stringify({ projectId: result.projectId, existing: false, childTaskIds: result.childTaskIds }) + "\n");
+}
+main()
+    .then(() => process.exit(0))
+    .catch((err) => {
+    process.stderr.write(`project-create-cli: ${err.message}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=project-create-cli.js.map

package/payload/platform/plugins/work/mcp/dist/cli/project-create-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-create-cli.js","sourceRoot":"","sources":["../../src/cli/project-create-cli.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,wEAAwE;AACxE,iEAAiE;AACjE,0DAA0D;AAC1D,yEAAyE;AACzE,wEAAwE;AACxE,kBAAkB;AAClB,EAAE;AACF,YAAY;AACZ,gDAAgD;AAChD,4EAA4E;AAC5E,qEAAqE;AACrE,0DAA0D;AAC1D,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,mEAAmE;AACnE,wEAAwE;AACxE,sEAAsE;AACtE,uEAAuE;AACvE,oEAAoE;AACpE,mCAAmC;AAEnC,OAAO,EAAE,aAAa,EAA4B,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAM5C,KAAK,UAAU,mBAAmB,CAChC,SAAiB,EACjB,IAAY;IAEZ,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B;4CACsC,EACtC,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;IACtD,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAAgD,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC/F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI;QACrC,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,iBAAiB;KAC1B,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QACjC,GAAG,OAAO;QACV,SAAS;KACa,CAAC,CAAC;IAE1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,GAAG,IAAI,CAC3G,CAAC;AACJ,CAAC;AAED,IAAI,EAAE;KACH,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KAC3B,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;IACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/payload/platform/scripts/check-no-task-id-leaks.mjs

@@ -2,7 +2,7 @@
 // Build-time gate: rejects `(Task NNN)` citations in operator-visible production
 // strings. Citations are allowed in inline comments and test titles/bodies only.
 //
-// Live repro that motivated the gate: setup-tunnel.sh on realagent 192.168.88.8
+// Live repro that motivated the gate: a setup script on realagent 192.168.88.8
 // emitted `Re-run the installer to provision Chromium.` to the
 // operator's chat surface — the citation made the operator chase task
 // history rather than execute the verb. Operator surfaces strip citations;

package/payload/platform/scripts/vnc.sh

@@ -323,9 +323,10 @@ start_chrome() {
 }
 
 # ---------------------------------------------------------------------------
-# retired the admin-UI terminal surface entirely: the header
-# TerminalOverlay + UpdateModal embedded terminal stack is gone. Only
-# the Chromium surface remains for BrowserOverlay.
+# Retired in Task 287: the admin-UI terminal and browser-overlay surfaces
+# are gone. This script still launches Chromium for legacy installs where
+# the brand VNC is used for ad-hoc operator browsing; on maxy-code the
+# admin chat PTY is the only interactive surface.
 # ---------------------------------------------------------------------------
 
 start_chrome_native() {

package/payload/platform/templates/agents/admin/IDENTITY.md

@@ -10,7 +10,7 @@ Your job is to do useful work for the operator. How useful you can be depends on
 
 ## Before you speak
 
-Before your first message, do reconnaissance. Treat your starting knowledge as whatever your tools can surface, not what the system prompt names. Search the memory graph for what's known about the operator and their business, read the profile, check today's calendar, active projects, open work, and recent conversations. Infer the domain from the plugins and skills installed; they were chosen for a reason and are evidence of what this operation does.
+Before your first message, do reconnaissance. Treat your starting knowledge as whatever your tools can surface, not what the system prompt names. Search the memory graph for what's known about the operator and their business, read the profile, check today's calendar, active projects, open work, and recent conversations. Infer the domain from the plugins and skills installed; they were chosen for a reason and are evidence of what this operation does. Check whether an upgrade is available for this install (the upgrade skill describes the lookup); if so, offer it in your first message.
 
 Then lead with what you found. When you have enough knowledge of the operator and their business to make a useful proposal, follow with one suited to where they are in their day; otherwise, gather more before proposing. Ask only the questions you genuinely could not answer through investigation. You are expected to drive the day, not to solicit instructions for it.
 

package/payload/premium-plugins/venture-studio/PLUGIN.md

@@ -23,13 +23,44 @@ Outcome (binding):
 
 Constraint (binding): **No downstream venture-studio skill (`brand-pack`, `zero-to-prototype`, `investor-data-room` Stages 3+, etc.) is invoked before the data-room scaffold + Project + per-artefact Tasks exist on disk and in the graph.** If the operator asks you to skip straight to a deliverable ("just write me a business plan"), restate the scaffold-first principle and offer to scaffold the data room first, then jump straight to that artefact's task. The principle is the outcome contract; the scaffold proves it.
 
+### Deterministic pre-flight gate
+
+Before invoking any downstream skill, both checks below must pass. Both are deterministic — exit-code on `ls`, structured output on `project-list`. Neither check depends on LLM judgement.
+
+1. **Directory check:** `[ -d "${PROJECT_ROOT}/.docs/data-room/01-narrative" ]` returns exit 0.
+2. **Graph check:** the `project-list` tool returns a Project whose `name` matches the business's working name.
+
+If either check fails, run the scaffolding script (see below) before the skill fires. If the script fails, surface the literal stderr error to the operator — do not narrate around it (memory: [[feedback_no_stdout_parsing_for_control_flow]]).
+
+### Scaffolding script
+
+`bin/scaffold.sh` is the deterministic enforcement layer. It creates the Project + eight artefact Tasks (via the work plugin's `project-create-cli` bridge) and materialises the ten-section directory tree. Graph write first, directories second; idempotent re-run if any partial state lands.
+
+```bash
+ACCOUNT_ID="${ACCOUNT_ID}" \
+  premium-plugins/venture-studio/bin/scaffold.sh \
+  "${PROJECT_ROOT}" \
+  "${BUSINESS_NAME}"
+```
+
+The script is the binding check, not the prose principle above. The prose explains why; the script is what makes it true.
+
 ## First-conversation routing
 
-When the operator first invokes this agent, confirm the intent ("Are we founding a new business, or working on an existing one?") and run the scaffolding sequence:
+When the operator first invokes this agent, confirm the intent ("Are we founding a new business, or working on an existing one?") and run the scaffolding script — it does steps 1–3 below in a single atomic invocation:
+
+```bash
+ACCOUNT_ID="${ACCOUNT_ID}" \
+  premium-plugins/venture-studio/bin/scaffold.sh \
+  "${PROJECT_ROOT}" \
+  "${BUSINESS_NAME}"
+```
+
+The script's three effects:
 
-1. **Scaffold the data room.** Invoke the `investor-data-room` skill Stage 2 — it creates the ten-section graph under the operator's project root (`<project-site>/.docs/data-room/`). The tree is named upfront so every artefact has a slot to land in.
-2. **Create the `Project` node.** Use the `projects` plugin's `project-create` tool with tier `full` (data-room work is multi-phase). Project name is the business's working name; description references the data-room root path. The `project-create` call accepts a work-items list — pre-seed it with the artefact tasks below in one transaction.
-3. **Enumerate Tasks per artefact**, one per data-room section / output document, in section order. Suggested task list (the `project-create` tool accepts these as `workItems`):
+1. **Scaffolds the data room.** Materialises the ten-section directory tree under `<project-root>/.docs/data-room/`. Every artefact has a slot to land in before any artefact is produced.
+2. **Creates the `Project` node.** Tier `full` (data-room work is multi-phase). Project name is the business's working name; description references the data-room root path.
+3. **Enumerates the eight artefact Tasks** in section order — one transaction, atomic with the Project. The work-item list the script pre-seeds:
    - **Stage 1 — Office-hours design doc** → produces `01-narrative/office-hours-design.md` (skill: `office-hours`)
    - **Brand pack** → produces brand identity files into `06-product-ip/brand/` (skill: `brand-pack`)
    - **Stage 2 — Wedge validation + landing page + PRD** → produces `01-narrative/{PMF, LANDING, PRD}.md` (skill: `zero-to-prototype`)

package/payload/premium-plugins/venture-studio/bin/scaffold.sh

@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+# Venture-studio data-room scaffold — deterministic enforcement of the
+# scaffold-first principle (Task 286 + feedback_doctrine_paragraph_is_not_a_gate).
+#
+# Creates exactly one Project (with eight pre-seeded artefact Tasks) in
+# the graph, then materialises the ten-section data-room directory tree
+# on disk. The venture-studio agent's downstream skills are gated on
+# both signals existing — see venture-studio/PLUGIN.md.
+#
+# Order of operations: graph write first, directories second. The CLI's
+# duplicate-name guard makes the script safely re-runnable after any
+# partial failure: a second run finds the existing Project, returns its
+# id, and retries the mkdir step.
+#
+# Usage:
+#   ACCOUNT_ID=<uuid> scaffold.sh <project-root> <business-name>
+#
+# Exit codes:
+#   0   scaffold complete (or already existed)
+#   2   bad arguments / missing ACCOUNT_ID
+#   1   graph write failed, directory mkdir failed, or CLI binary missing
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# Deployed layout per packages/create-maxy-code/scripts/bundle.js:
+#   <install>/premium-plugins/venture-studio/bin/scaffold.sh
+#   <install>/platform/plugins/work/mcp/dist/cli/project-create-cli.js
+CLI_BIN="${SCRIPT_DIR}/../../../platform/plugins/work/mcp/dist/cli/project-create-cli.js"
+
+if [[ $# -ne 2 ]]; then
+  echo "scaffold.sh: usage: ACCOUNT_ID=<uuid> $0 <project-root> <business-name>" >&2
+  exit 2
+fi
+
+PROJECT_ROOT="$1"
+BUSINESS_NAME="$2"
+
+if [[ -z "${ACCOUNT_ID:-}" ]]; then
+  echo "scaffold.sh: ACCOUNT_ID env var required" >&2
+  exit 2
+fi
+
+if [[ ! -d "$PROJECT_ROOT" ]]; then
+  echo "scaffold.sh: project root does not exist: $PROJECT_ROOT" >&2
+  exit 2
+fi
+
+if [[ ! -f "$CLI_BIN" ]]; then
+  echo "scaffold.sh: project-create CLI not built or missing at: $CLI_BIN" >&2
+  exit 1
+fi
+
+DATA_ROOM="${PROJECT_ROOT}/.docs/data-room"
+
+# Eight pre-seeded artefact tasks — order and names match
+# premium-plugins/venture-studio/PLUGIN.md § First-conversation routing.
+# Section order is preserved so the agent can walk them sequentially.
+PAYLOAD=$(cat <<JSON
+{
+  "accountId": "${ACCOUNT_ID}",
+  "name": "${BUSINESS_NAME}",
+  "description": "Venture-studio data room for ${BUSINESS_NAME}. Root: ${DATA_ROOM}",
+  "tier": "full",
+  "workItems": [
+    {"name": "Stage 1 — Office-hours design doc", "description": "Produces 01-narrative/office-hours-design.md via the office-hours skill."},
+    {"name": "Brand pack", "description": "Produces brand identity (palette, typography, logo) into 06-product-ip/brand/ via the brand-pack skill."},
+    {"name": "Stage 2 — Wedge validation + landing page + PRD", "description": "Produces 01-narrative/{PMF,LANDING,PRD}.md via the zero-to-prototype skill."},
+    {"name": "Stage 3 — Business plan", "description": "Produces 01-narrative/business-plan.md via investor-data-room Stage 3."},
+    {"name": "Stage 3b — Term sheet", "description": "Produces html/prospectus/term_sheet.html via investor-data-room Stage 3b."},
+    {"name": "Stage 4 — Deck blueprint", "description": "Produces 01-narrative/deck-blueprint.md via investor-data-room Stage 4."},
+    {"name": "Stage 4b — Prospectus", "description": "Produces html/prospectus/index.html via investor-data-room Stage 4b."},
+    {"name": "Stage 5 — Rendered PDFs", "description": "Produces html/{business-plan,prospectus,deck}/*.pdf via investor-data-room Stage 5."}
+  ]
+}
+JSON
+)
+
+# Graph write first. CLI returns {projectId, existing:bool} on stdout;
+# on any failure it exits non-zero with a literal stderr message that
+# propagates here verbatim — no prose-parsing for control flow
+# (memory: feedback_no_stdout_parsing_for_control_flow).
+RESULT=$(node "$CLI_BIN" "$PAYLOAD")
+echo "scaffold.sh: project-create CLI returned: $RESULT"
+
+# Directories second. The agent's pre-flight gate keys on the existence
+# of 01-narrative/ (it AND-checks with project-list); creating it last
+# means partial state (graph-only) is naturally invisible to the gate
+# until mkdir succeeds.
+for section in \
+  01-narrative \
+  02-corporate-legal \
+  03-cap-table \
+  04-financials \
+  05-team \
+  06-product-ip \
+  07-customers \
+  08-market \
+  09-traction-metrics \
+  10-supporting; do
+  mkdir -p "${DATA_ROOM}/${section}"
+done
+
+echo "scaffold.sh: data-room scaffolded at ${DATA_ROOM}"

package/payload/premium-plugins/venture-studio/skills/investor-data-room/SKILL.md

@@ -96,7 +96,9 @@ This file is the working substrate. It stays internal-only. Every later artefact
 
 ## Stage 2 — Data room scaffold
 
-Build the directory tree above. Each section gets a `README.md` that doubles as a content checklist (purpose, expected contents, current state, gaps). The graph structure is fixed: ten numbered sections (`01-narrative` through `10-supporting`) plus a top-level README and an `html/` subdirectory for rendered deliverables.
+When invoked under the venture-studio agent, scaffolding is done by the deterministic script at `premium-plugins/venture-studio/bin/scaffold.sh` — it creates the Project + eight artefact Tasks and the ten-section directory tree in one atomic invocation. The script is idempotent; re-runs against an existing data room are a no-op. See `venture-studio/PLUGIN.md` § "Scaffolding script".
+
+When invoked outside the venture-studio agent (standalone usage of this skill), build the directory tree manually. Each section gets a `README.md` that doubles as a content checklist (purpose, expected contents, current state, gaps). The graph structure is fixed: ten numbered sections (`01-narrative` through `10-supporting`) plus a top-level README and an `html/` subdirectory for rendered deliverables.
 
 **File-naming conventions:**