@rubytech/create-maxy-code 0.1.144 → 0.1.146

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.144",
+  "version": "0.1.146",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/neo4j/schema.cypher

@@ -363,11 +363,19 @@ ON EACH [n.name, n.firstName, n.lastName, n.givenName, n.familyName,
          n.subject, n.bodyPreview, n.fromName, n.fromAddress, n.agentAddress, n.screeningReason,
          n.authority, n.contactValue, n.toolName,
          n.displayName, n.slug, n.role,
-         n.compiledTruth];
+         n.compiledTruth, n.compiledTruthPublic];
 // `compiledTruth` (Task 306) is the authoritative-summary property the
 // compiled-truth + timeline knowledge model writes on Person/Company/Concept.
 // Indexed here so Task 308's compiledTruth boost path also benefits from BM25
 // hits against the summary text. No-op until 306 writes the property.
+//
+// `compiledTruthPublic` (Task 392) is the customer-facing twin on the four
+// public-twin labels (Organization | Concept | Project | LocalBusiness). The
+// public-agent's `memory-search` projection swaps `compiledTruth` →
+// `compiledTruthPublic` on the way out for scope='public' reads (see
+// platform/plugins/memory/mcp/src/tools/memory-search.ts). Both fields stay
+// in the BM25 union so admin queries rank on the operator's view and public
+// queries rank on the customer-facing summary.
 
 // Project node — a standalone creative-output node distinct from
 // :Section. Anchored via (:UserProfile)-[:CREATED]->(:Project), with optional
@@ -1328,15 +1336,27 @@ OPTIONS {
 };
 
 // ----------------------------------------------------------
-// Compiled-truth + timeline knowledge model (Task 306) —
+// Compiled-truth + timeline knowledge model (Task 306, extended Task 392) —
 // gbrain's "compiled truth above the rule, append-only timeline
-// below" pattern. Every :Person / :Organization / :Concept carries
+// below" pattern. Every entity subject in the admin-twin set
+// (:Person | :Organization | :Concept | :Project | :LocalBusiness) carries
 // an agent-rewritten summary (`compiledTruth`, ≤2000 chars) plus
 // a history of dated `:TimelineEvent` rows path-anchored via
 // `(entity)-[:HAS_TIMELINE_EVENT]->(:TimelineEvent)`. The
 // compiledTruth is what the agent reads when it needs a summary;
 // the timeline is what it cites and appends to.
 //
+// Public-twin (Task 392): four of the five subject labels also carry
+// `compiledTruthPublic` (≤2000 chars) — the customer-facing summary
+// the public agent surfaces. The public-twin set is
+// :Organization | :Concept | :Project | :LocalBusiness. :Person is
+// deliberately excluded: an operator's notes on a contact are private
+// by definition and have no neutral customer-facing form. The
+// public-agent `memory-search` projection (scope='public') rewrites
+// the returned property bag so `compiledTruth` is renamed to
+// `compiledTruthPublic` on public-twin labels and stripped entirely
+// on :Person.
+//
 // Naming:
 //   :TimelineEvent — distinct from :Event (scheduling plugin's
 //     schema:Event with eventId-unique). Collisions were the reason
@@ -1357,8 +1377,19 @@ OPTIONS {
 // `compiledTruth` source:
 //   compiledTruthSource = "rewriter" (default) — compiled-truth-rewriter
 //     library wrote it.
-//   compiledTruthSource = "operator" — operator overrode via the graph UI.
+//   compiledTruthSource = "operator" — operator overrode via the graph UI
+//     (legacy admin-server only) or via memory-update direct-write.
 //     Rewriter refuses to overwrite for 7 days unless forceRewrite=true.
+//
+// `compiledTruthPublic` source (Task 392):
+//   compiledTruthPublicSource = "rewriter" (default) — compiled-truth-rewriter
+//     `mode: 'public'` pass wrote it. Fires inline after a successful admin
+//     pass when the label is in the public-twin set and the admin pass was
+//     not a no-op.
+//   compiledTruthPublicSource = "operator" — operator overrode via chat
+//     (memory-update `compiledTruthPublic` direct-write argument). Public
+//     rewriter refuses to overwrite for 7 days unless forceRewrite=true.
+//     Cooldown is independent of the admin cooldown.
 // ----------------------------------------------------------
 
 CREATE CONSTRAINT timeline_event_id_unique IF NOT EXISTS
@@ -1392,3 +1423,122 @@ FOR (o:Organization) ON (o.compiledTruthUpdatedAt);
 
 CREATE INDEX concept_compiled_truth_updated_at IF NOT EXISTS
 FOR (c:Concept) ON (c.compiledTruthUpdatedAt);
+
+// Admin-twin extension (Task 392) — :Project and :LocalBusiness joined the
+// admin-twin set when the public-twin landed. Same stale-detection index.
+CREATE INDEX project_compiled_truth_updated_at IF NOT EXISTS
+FOR (p:Project) ON (p.compiledTruthUpdatedAt);
+
+CREATE INDEX local_business_compiled_truth_updated_at IF NOT EXISTS
+FOR (b:LocalBusiness) ON (b.compiledTruthUpdatedAt);
+
+// Public-twin stale-detection indexes (Task 392). Same role as the admin
+// indexes above — find public-twin nodes whose public summary lags the
+// admin summary by N days. :Person omitted by design (no public twin).
+CREATE INDEX organization_compiled_truth_public_updated_at IF NOT EXISTS
+FOR (o:Organization) ON (o.compiledTruthPublicUpdatedAt);
+
+CREATE INDEX concept_compiled_truth_public_updated_at IF NOT EXISTS
+FOR (c:Concept) ON (c.compiledTruthPublicUpdatedAt);
+
+CREATE INDEX project_compiled_truth_public_updated_at IF NOT EXISTS
+FOR (p:Project) ON (p.compiledTruthPublicUpdatedAt);
+
+CREATE INDEX local_business_compiled_truth_public_updated_at IF NOT EXISTS
+FOR (b:LocalBusiness) ON (b.compiledTruthPublicUpdatedAt);
+
+// ----------------------------------------------------------
+// :CompiledTruthRevision (Task 391) — audit history of every
+// `compiledTruth` value an entity has ever held. Captured in the
+// same transaction as the rewriter SET so revision history can
+// never desync from the live property. Pruned by dream-cycle
+// phase 5 (keep newest 20 per entity) — never written-and-pruned
+// in the same TX as the main rewrite.
+//
+// Read-only after write: graph-write-gate rejects property
+// updates and label-anchored MERGE on this label. The dream-cycle
+// prune is the only mutation path.
+//
+// MERGE doctrine: writers MUST path-anchor from the entity to
+// defend cross-account collisions:
+//   MATCH (e) WHERE elementId(e) = $entityId AND e.accountId = $accountId
+//   MERGE (e)-[:HAS_REVISION]->(r:CompiledTruthRevision {revisionId: $id})
+// Never label-only MERGE on :CompiledTruthRevision.
+//
+// `source` enum (exact, no catch-all):
+//   'rewriter' — compiled-truth-rewriter library wrote the truth.
+//   'operator' — operator overrode via a sanctioned write route.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT compiled_truth_revision_id_unique IF NOT EXISTS
+FOR (r:CompiledTruthRevision) REQUIRE r.revisionId IS UNIQUE;
+
+CREATE INDEX compiled_truth_revision_account IF NOT EXISTS
+FOR (r:CompiledTruthRevision) ON (r.accountId);
+
+CREATE INDEX compiled_truth_revision_written_at IF NOT EXISTS
+FOR (r:CompiledTruthRevision) ON (r.writtenAt);
+
+// ----------------------------------------------------------
+// :Report node — durable, keyword-routed output of admin
+// workflows (daily briefing, dream cycle, ad-hoc analyses).
+// Task 332. Append-only by design: reports are not edited
+// after write. Parented to the active :AdminConversation
+// (via :PRODUCED, injected at write time) or to the
+// account's :AdminUser when no conversation context exists.
+// `keywords` is a string array; `sourceWorkflow` names the
+// originating skill or scheduled workflow (e.g.
+// "daily-briefing", "dream-cycle"). Embedded so the existing
+// `memory-search` hybrid pipeline can surface reports
+// alongside other knowledge.
+//
+// Dream-cycle queues (Task 327): :OrphanCandidate and
+// :CitationProposal hold phase-1 and phase-4 candidates the
+// operator triages via `memory-review-queue`. Edges to
+// `:Trashed` targets get a `staleTarget: true` property
+// from phase 3 (audit preserved; no deletion). :TimelineEvent
+// citations are written additively as `citations: [string]`
+// — no new label needed.
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT report_id_unique IF NOT EXISTS
+FOR (r:Report) REQUIRE r.reportId IS UNIQUE;
+
+CREATE INDEX report_account IF NOT EXISTS
+FOR (r:Report) ON (r.accountId);
+
+CREATE INDEX report_occurred_at IF NOT EXISTS
+FOR (r:Report) ON (r.occurredAt);
+
+CREATE INDEX report_source_workflow IF NOT EXISTS
+FOR (r:Report) ON (r.sourceWorkflow);
+
+CREATE INDEX report_title IF NOT EXISTS
+FOR (r:Report) ON (r.title);
+
+CREATE VECTOR INDEX report_embedding IF NOT EXISTS
+FOR (r:Report) ON (r.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
+CREATE CONSTRAINT orphan_candidate_id_unique IF NOT EXISTS
+FOR (o:OrphanCandidate) REQUIRE o.orphanCandidateId IS UNIQUE;
+
+CREATE INDEX orphan_candidate_account IF NOT EXISTS
+FOR (o:OrphanCandidate) ON (o.accountId);
+
+CREATE INDEX orphan_candidate_target IF NOT EXISTS
+FOR (o:OrphanCandidate) ON (o.targetElementId);
+
+CREATE CONSTRAINT citation_proposal_id_unique IF NOT EXISTS
+FOR (p:CitationProposal) REQUIRE p.citationProposalId IS UNIQUE;
+
+CREATE INDEX citation_proposal_account IF NOT EXISTS
+FOR (p:CitationProposal) ON (p.accountId);
+
+CREATE INDEX citation_proposal_target IF NOT EXISTS
+FOR (p:CitationProposal) ON (p.timelineEventId);

package/payload/platform/plugins/admin/PLUGIN.md

@@ -140,7 +140,7 @@ Tools are available via the `admin` MCP server.
 - `hooks/webfetch-preflight.mjs` — short-circuits WebFetch on JS-SPA shells with a structured `WEBFETCH_CANNOT_READ_JS_SPA` error so the agent surfaces a loud failure to the owner instead of paying the 60s extraction timeout. Fail-open on any internal error.
 - `hooks/askuserquestion-investigate-gate.sh` — PreToolUse matcher=`AskUserQuestion`. Blocks the question (exit 2) when no read-only investigation tool has fired since the latest real user turn in the session JSONL. The structural fix for the failure class where the agent fabricates a menu before evidence-gathering (session `c085ec2c-46fb-4b73-8865-68cf85866ea8` 2026-05-22 — "change remote access password" → invented options "Admin PIN / Cloudflare tunnel / WiFi password" with zero prior tool_use; post-correction the agent immediately fired `remote-auth-status` → `ToolSearch` → `remote-auth-set-password`, proving it knew the moves). **Allowlist** (exact, with trailing `__<tool>` suffix-match for namespaced `mcp__plugin_<plugin>_<server>__<tool>` aliases): `ToolSearch`, `Grep`, `Glob`, `Read`, `LS`, `NotebookRead`, `Bash`, `WebFetch`, `WebSearch`, plus the read-only admin / memory MCP tools (`*-status`, `*-list`, `*-read`, `skill-find`, `memory-find-candidates`, `profile-read`, `conversation-list`, `memory-list-attachments`, `memory-read-attachment`). **Block message:** `Blocked: AskUserQuestion requires at least one investigation tool (ToolSearch, Grep, Read, *-list, *-status, *-read, skill-find, ...) earlier in this turn. Search the operator's literal phrase first.` **Log line** (stderr, one per call): `[ask-gate] decision=<allow|block> sessionId=<id8> seen=<csv|-> reason=<allowlist-hit|no-investigation|fail-open-no-transcript|fail-open-parse-error>`. **Fail-open** on missing transcript or parse error — nudges, never bricks the UI.
 - `hooks/session-end-retrospective.sh` — **Stop hook.** Fires on every assistant end_turn but exits 0 with `trigger-skipped reason=<role-not-admin|is-specialist|empty-stdin|missing-transcript|no-intent-match>` on every path EXCEPT when the operator's latest real-user message carries an end-intent token (`/end`, `/archive`, `end session`, `archive this session`, case-insensitive, must match the whole message or a standalone line — not embedded in prose). On that path the hook blocks (exit 2 + structured retrospective instruction on stderr per Stop-hook contract) and emits `[session-retrospective] gate-blocked sessionId=<id> reason=sentinel-absent` until the admin agent calls the `session-retrospective-mark-complete` MCP sentinel tool. Completion is recognised by greping the operator's own JSONL (`transcript_path` on the Stop envelope) for a `tool_use` block whose `name` equals that exact string — never by parsing prose ([[feedback_no_stdout_parsing_for_control_flow]], [[feedback_doctrine_paragraph_is_not_a_gate]]). The sentinel-grep doubles as the re-entry guard: every Stop after the sentinel call sees it and exits 0 with `gate-released sessionId=<id>`. Recursion guard: any session whose `MAXY_SPECIALIST` env is set (specialist subagent dispatched via Task tool) skips the gate. The Sidebar archive button POSTs `/:sessionId/archive` directly to the manager which kills the PTY — no Stop fires after that, so clicking archive is the operator's current escape hatch (opt-out remains deferred per the task spec). All emits go through `POST /api/admin/log-ingest`; the only stderr writer is the gate-blocked path (the instruction block the agent reads). The retrospective itself runs as one or more additional turns inside the operator's existing admin session — Task-tool delegation to `database-operator` is the existing IDENTITY.md "Recording" route, not a parallel admin session ([[feedback_deterministic_means_remove_llm]]).
-- `hooks/signal-detector-stop.sh` — **Stop hook.** Task 303 — gbrain port. Fires on every admin-agent end_turn alongside `session-end-retrospective.sh` (both registered on the Stop matcher). Inspects the operator's JSONL transcript and decides whether to dispatch the `signal-detector` specialist for background brain-compounding. Throttle gates: ≥3 new real-user turns since the most recent in-transcript Task call with `subagent_type=signal-detector` (overridable via `MAXY_SIGNAL_DETECTOR_MIN_NEW_TURNS`) AND ≥30 000 ms since the latest real-user message's `timestamp` (overridable via `MAXY_SIGNAL_DETECTOR_MIN_IDLE_MS`). Below either threshold → exit 0 with `trigger-skipped reason=below-{turn,idle}-threshold`. Recursion guard mirrors `session-end-retrospective.sh`: any session with `MAXY_SPECIALIST` set on the PTY env is skipped, plus the in-transcript Task-call grep means the very next Stop after the agent's dispatch turn sees the call and exits 0 (`reason=already-dispatched`). Gate-blocked path emits exit 2 + stderr directive `[system: signal-detector-stop-hook]` per Stop-hook contract; the admin IDENTITY.md "Stop-hook system directives" section binds the agent's response shape (perform one `Task` dispatch, emit a single-space ack, stop). First-fire bootstrap: idempotently copies the template from `$MAXY_PLATFORM_ROOT/templates/specialists/agents/signal-detector.md` into `$ACCOUNT_DIR/specialists/agents/` and appends the AGENTS.md routing line so the specialist is available platform-core without onboarding-flow surgery. All emits go through `POST /api/admin/log-ingest` under tag `signal-detector-hook`. Operator-channel doctrine: by design, only the admin agent's stop fires this hook (public/visitor channels never do — high-value signal flows through the operator, not the visitor).
+- `hooks/post-turn-graph-pass.sh` — **Stop hook.** Task 412 — supersedes the original signal-detector-stop hook (Task 303) which had three structural defects (idle gate measured assistant response duration not operator pause, recursion guard greped the wrong tool name so `newUserTurnsSinceLastRun` never reset, single-excerpt throttle dropped 2 of every 3 operator turns). Fires on every admin-agent `end_turn` alongside `session-end-retrospective.sh`. **No throttle, no idle gate, no in-transcript recursion-guard grep.** One dispatch per `end_turn`, every time. Walks the operator's JSONL once, collects every assistant `text` block and every non-`tool_result` user message as `[role: text]` pairs (oldest first), then `GET /api/admin/post-turn-context?conversationId&accountId` to fetch the actual content of every node already written under this conversationId, and dispatches `database-operator` via exit 2 + stderr directive `[system: post-turn-graph-pass-stop-hook]` per Stop-hook contract. The dispatch prompt carries two interpolated blocks — `<conversation>` and `<prior-writes>` — and the specialist body's background-pass mode reads both verbatim and decides what new graph rows the conversation supports (mentions, ideas, learnings, contacts, tasks, anything the schema admits). Duplicate writes between this background pass and the admin agent's discretionary inline `database-operator` dispatch are accepted at write time; cleanup is delegated to the dream-cycle / hygiene sweeps (Tasks 410, 411). Remaining early exits (the only two): `reason=role-not-admin` (the hook fires only on admin-agent stops by doctrine) and `reason=is-specialist` (`MAXY_SPECIALIST` env-stamped on every subagent PTY blocks the hook from recursing inside the specialist's own stop). All emits go through `POST /api/admin/log-ingest` under tag `post-turn-graph-pass`. The canonical fire line is `dispatch sessionId=<id> conversationId=<id> conversationTurns=<n> priorWritesCount=<n> contextBytes=<n> ms=<n>`; failure to see a matching `db-op: writes=<n> ms=<n>` line in the admin-resume stream within 30 s means the specialist crashed or `memory-write` rejected silently.
 - `hooks/turn-completed-graph-write.sh` — **Dormant since Task 214** — the Stop-hook registration is no longer written to account settings.json; admin delegates graph writes to `database-operator` via the Task tool. The script, envelope walker, loopback `/api/admin/claude-sessions` 127.0.0.1 bypass, `[turn-recorder]` emitters, recorder-auto-archive subscriber, and `initialMessage` envelope spec are preserved as reusable infrastructure for any future autonomous post-turn flow. Historical contract (still describes the dormant path): Stop hook fired once per completed admin-agent turn. Gates on `MAXY_SESSION_ROLE=admin` + `MAXY_SPECIALIST!=database-operator` so it never recurses into the recorder PTY or fires on public sessions. **Task 147** — the recorder is spawned via the same route Sidebar uses. ONE POST to `POST /api/admin/claude-sessions`, body carries `{specialist:'database-operator', model:'haiku', initialMessage:<json-envelope>, adminSessionId:<op>}` — no synthetic `senderId: 'turn-recorder'` marker. The Hono wrapper bypasses cookie auth on this exact method+path when the request originates from `127.0.0.1` (same trust boundary the claude-session-manager itself relies on), looks up the operator's senderId from the manager's `/<adminSessionId>/meta`, and forwards a Sidebar-shape spawn body. The `/recorder-spawn` sibling route is gone. The hook reads its UI port from `MAXY_UI_INTERNAL_PORT` (stamped on the manager systemd unit) — no fallback; absence emits `[turn-recorder] spawn-failed reason=missing-env env=MAXY_UI_INTERNAL_PORT` to stderr instead of silently 19199-ing. **Task 177** — `initialMessage` is a JSON-stringified envelope; the schema lives in [`platform/plugins/docs/references/admin-session.md`](../docs/references/admin-session.md) under "`initialMessage` JSON envelope (Task 177)". Top-level keys exactly: `turns`, `conversationId`, `accountId`, `occurredAt`. `turns` is the full conversation transcript, oldest first, newest last, with each entry `{ role: "user"|"assistant", text, ts, toolCalls? }`. No windowing, no truncation. Multi-record assistant messages collapse on `message.id`. `tool_use` and matching `tool_result` blocks attach as a single `toolCalls` entry on the owning assistant turn; the user record carrying only the `tool_result` does not create a separate user turn. No leading instruction prose. `toolCalls[].input` and `toolCalls[].output` are native JSON values, never re-stringified. (Replaces Task 175's `(operatorMessage, assistantReply)` pair, which asserted a temporal Q→A relationship the walker never enforced.) One observability line `[turn-recorder] envelope sessionId=<op> turnsCount=<n> userTurns=<n> assistantTurns=<n> toolCallTurns=<n>` precedes `spawn-request`. The envelope rides on the `/spawn` body as a trailing positional argv to `claude`, so the database-operator session's JSONL first `role=user` line is the JSON object verbatim. No separate `POST /:id/input` call, no bracketed-paste, no keystroke injection. The recorder-auto-archive subscriber stops the recorder PTY as soon as its JSONL contains an assistant message with `stop_reason === "end_turn"`. **Task 129** — every emit goes through `POST /api/admin/log-ingest` so the lines land in `server.log` keyed by the operator session id. The chain is `trigger` → `spawn-request` → `spawn-success` → `input-delivered` → `tool-call` × N → `tool-result` × N → `write-complete` → `auto-archive`; each gated-off path emits one `trigger-skipped reason=<role-not-admin|is-recorder|empty-stdin|missing-transcript|conversation-empty>` line. Failure modes — `spawn-failed`, `tool-surface-missing`, `input-failed`, `write-empty`, `auto-archive reason=stale-recorder` — each emit one named line; absence is itself a defect.
 
 ## Session identifiers (Task 135)

package/payload/platform/plugins/admin/hooks/post-turn-graph-pass.sh

@@ -0,0 +1,251 @@
+#!/usr/bin/env bash
+# Stop hook — post-turn graph pass. Task 412.
+#
+# Fires on every admin-agent assistant end_turn. Dispatches the
+# `database-operator` specialist with the full conversation (as
+# `[role: text]` pairs) plus the actual content of every node already
+# written under this `conversationId`. The specialist decides what new
+# graph rows the conversation supports and writes them.
+#
+# No throttle, no idle gate, no recursion-guard transcript grep. The two
+# remaining early exits are doctrinal:
+#   - MAXY_SESSION_ROLE must equal "admin"  → reason=role-not-admin
+#   - MAXY_SPECIALIST must be empty         → reason=is-specialist
+# (Same `MAXY_SPECIALIST` env-stamp model that blocks the hook from
+# recursing inside a subagent's own stop. The specialist sees the
+# operator's transcript via the dispatch prompt, not via its own PTY.)
+#
+# Duplicate writes between this background pass and the admin agent's
+# discretionary inline `database-operator` dispatch are accepted at
+# write time; cleanup is delegated to the dream-cycle / hygiene sweeps
+# (Tasks 410, 411).
+#
+# Input: Claude Code's Stop hook stdin shape
+#   { "session_id": "<intrinsic>", "transcript_path": "<jsonl path>", ... }
+#
+# Output: exit 2 + the dispatch directive on stderr per Stop-hook
+# contract. The admin IDENTITY.md "Stop-hook system directives" section
+# binds the agent's response: perform the single Agent dispatch, emit a
+# single-space ack, stop.
+
+set -uo pipefail
+
+UI_PORT="${MAXY_UI_INTERNAL_PORT:-}"
+if [ -z "$UI_PORT" ]; then
+  echo "[post-turn-graph-pass] trigger-skipped sessionId=unknown reason=missing-env env=MAXY_UI_INTERNAL_PORT" >&2
+  exit 0
+fi
+UI_BASE="http://127.0.0.1:${UI_PORT}"
+LOG_INGEST_URL="${UI_BASE}/api/admin/log-ingest"
+CONTEXT_URL="${UI_BASE}/api/admin/post-turn-context"
+
+emit_log() {
+  local line="$1"
+  curl -sS -o /dev/null -X POST \
+    -H 'Content-Type: application/json' \
+    --max-time 2 \
+    --data "$(python3 -c '
+import sys, json
+print(json.dumps({"tag": "post-turn-graph-pass", "level": "info", "line": sys.argv[1]}))
+' "$line")" \
+    "$LOG_INGEST_URL" 2>/dev/null || true
+}
+
+INPUT=""
+if [ ! -t 0 ]; then
+  INPUT=$(cat)
+fi
+
+PARSED=$(printf '%s' "$INPUT" | python3 -c '
+import sys, json
+try:
+    d = json.load(sys.stdin)
+    sid = d.get("session_id", "") or ""
+    tpath = d.get("transcript_path", "") or ""
+    print(f"{sid}\t{tpath}")
+except Exception:
+    print("\t")
+' 2>/dev/null)
+SESSION_ID="${PARSED%%	*}"
+TRANSCRIPT_PATH="${PARSED#*	}"
+SESSION_ID_REPORTED="${SESSION_ID:-unknown}"
+
+if [ "${MAXY_SESSION_ROLE:-}" != "admin" ]; then
+  emit_log "trigger-skipped sessionId=${SESSION_ID_REPORTED} reason=role-not-admin"
+  exit 0
+fi
+if [ -n "${MAXY_SPECIALIST:-}" ]; then
+  emit_log "trigger-skipped sessionId=${SESSION_ID_REPORTED} reason=is-specialist specialist=${MAXY_SPECIALIST}"
+  exit 0
+fi
+if [ -z "$INPUT" ]; then
+  emit_log "trigger-skipped sessionId=${SESSION_ID_REPORTED} reason=empty-stdin"
+  exit 0
+fi
+if [ -z "$SESSION_ID" ] || [ -z "$TRANSCRIPT_PATH" ] || [ ! -f "$TRANSCRIPT_PATH" ]; then
+  emit_log "trigger-skipped sessionId=${SESSION_ID_REPORTED} reason=missing-transcript"
+  exit 0
+fi
+
+CONVERSATION_ID="${CONVERSATION_NODE_ID:-}"
+
+# Walk the transcript and emit the conversation as `[role: text]` pairs,
+# oldest first. User turns whose only content is `tool_result` blocks are
+# skipped (they carry the Stop-hook feedback envelope and other tool
+# plumbing, not operator intent). Multi-block assistant turns concatenate
+# their `text` blocks; `tool_use` blocks are dropped.
+CONVERSATION=$(TRANSCRIPT_PATH="$TRANSCRIPT_PATH" python3 - <<'PY'
+import os, json, sys
+
+def assistant_text(rec):
+    msg = rec.get("message", {}) or {}
+    if msg.get("role") != "assistant":
+        return ""
+    content = msg.get("content")
+    if isinstance(content, str):
+        return content
+    if isinstance(content, list):
+        parts = []
+        for b in content:
+            if isinstance(b, dict) and b.get("type") == "text":
+                t = b.get("text")
+                if isinstance(t, str):
+                    parts.append(t)
+        return "".join(parts)
+    return ""
+
+def user_text(rec):
+    msg = rec.get("message", {}) or {}
+    if msg.get("role") != "user":
+        return None
+    content = msg.get("content")
+    if isinstance(content, str):
+        return content
+    if isinstance(content, list):
+        parts = []
+        saw_non_tool_result = False
+        for b in content:
+            if not isinstance(b, dict):
+                continue
+            btype = b.get("type")
+            if btype == "tool_result":
+                continue
+            saw_non_tool_result = True
+            if btype == "text":
+                t = b.get("text")
+                if isinstance(t, str):
+                    parts.append(t)
+        if not saw_non_tool_result:
+            return None
+        return "".join(parts)
+    return None
+
+path = os.environ["TRANSCRIPT_PATH"]
+out_lines = []
+try:
+    with open(path, "r", encoding="utf-8") as f:
+        for raw in f:
+            raw = raw.strip()
+            if not raw:
+                continue
+            try:
+                rec = json.loads(raw)
+            except Exception:
+                continue
+            if not isinstance(rec, dict):
+                continue
+            rtype = rec.get("type")
+            if rtype == "user":
+                t = user_text(rec)
+                if t is None:
+                    continue
+                out_lines.append(f"[user: {t.strip()}]")
+            elif rtype == "assistant":
+                t = assistant_text(rec)
+                if not t.strip():
+                    continue
+                out_lines.append(f"[assistant: {t.strip()}]")
+except Exception as e:
+    sys.stderr.write(f"transcript-walk-failed: {e}\n")
+    sys.exit(0)
+
+print("\n\n".join(out_lines))
+PY
+)
+CONVERSATION_TURNS=$(printf '%s\n' "$CONVERSATION" | grep -c '^\[' || true)
+CONTEXT_BYTES=${#CONVERSATION}
+
+# Fetch the actual content of every node already written under this
+# conversation, account-scoped. The route runs loopback-only — the hook
+# is in-process on the device, same trust boundary as `/log-ingest`.
+PRIOR_WRITES="(none)"
+PRIOR_WRITES_COUNT=0
+if [ -n "$CONVERSATION_ID" ]; then
+  CONTEXT_JSON=$(curl -sS --max-time 5 -G \
+    --data-urlencode "conversationId=${CONVERSATION_ID}" \
+    --data-urlencode "accountId=${ACCOUNT_ID:-}" \
+    "$CONTEXT_URL" 2>/dev/null || echo '')
+  if [ -n "$CONTEXT_JSON" ]; then
+    PARSED_CTX=$(printf '%s' "$CONTEXT_JSON" | python3 -c '
+import sys, json
+try:
+    d = json.load(sys.stdin)
+except Exception:
+    print("0\t")
+    sys.exit(0)
+writes = d.get("writes") or []
+if not isinstance(writes, list):
+    print("0\t")
+    sys.exit(0)
+lines = []
+for w in writes:
+    if not isinstance(w, dict):
+        continue
+    eid = w.get("elementId") or ""
+    labels = w.get("labels") or []
+    props = w.get("properties") or {}
+    if isinstance(labels, list):
+        labels_str = ":".join(str(x) for x in labels)
+    else:
+        labels_str = str(labels)
+    try:
+        props_str = json.dumps(props, ensure_ascii=False, sort_keys=True)
+    except Exception:
+        props_str = "{}"
+    lines.append(f"- ({eid}) :{labels_str} {props_str}")
+print(f"{len(writes)}\t" + "\n".join(lines))
+' 2>/dev/null)
+    PRIOR_WRITES_COUNT="${PARSED_CTX%%	*}"
+    PRIOR_WRITES_BODY="${PARSED_CTX#*	}"
+    if [ -n "$PRIOR_WRITES_BODY" ]; then
+      PRIOR_WRITES="$PRIOR_WRITES_BODY"
+    fi
+  fi
+fi
+
+emit_log "dispatch sessionId=${SESSION_ID} conversationId=${CONVERSATION_ID:-<unset>} conversationTurns=${CONVERSATION_TURNS} priorWritesCount=${PRIOR_WRITES_COUNT} contextBytes=${CONTEXT_BYTES} ms=0"
+
+# Emit the dispatch directive on stderr per Stop-hook contract.
+cat >&2 <<DIRECTIVE
+[system: post-turn-graph-pass-stop-hook]
+Dispatch the database-operator specialist NOW using the Task tool. Do not respond to the operator; this is a background graph-write pass and the operator does not see this turn. After the specialist returns its one-line summary, emit a single space character and stop.
+
+Agent dispatch parameters:
+  subagent_type: database-operator
+  prompt: |
+    accountId: ${ACCOUNT_ID:-<unset>}
+    sessionId: ${SESSION_ID}
+    conversationId: ${CONVERSATION_ID:-<unset>}
+
+    Background post-turn graph pass. Given the conversation below and the list of nodes already written under this conversationId, derive any new graph rows the conversation supports (mentions, ideas, learnings, contacts, tasks — anything the schema admits) and write them. Skip writes the prior list already covers; rely on MERGE semantics for the rest. Return one line in the form: db-op: writes=<n> ms=<n>
+
+    <conversation>
+    ${CONVERSATION}
+    </conversation>
+
+    <prior-writes>
+    ${PRIOR_WRITES}
+    </prior-writes>
+DIRECTIVE
+
+exit 2

package/payload/platform/plugins/admin/skills/datetime/SKILL.md

@@ -1,14 +1,16 @@
 ---
 name: datetime
 description: >
-  Timezone queries: current time in any city or timezone, time conversion between
-  zones, UTC offset, and DST status. Trigger phrases: "what time is it in",
-  "convert time", "timezone", "time difference", "DST".
+  Timezone queries (current time, conversion, UTC offset, DST) and
+  relative-date arithmetic (last Tuesday, two weeks ago, Q3 last year).
+  Trigger phrases: "what time is it in", "convert time", "timezone",
+  "time difference", "DST", "last X", "N days/weeks/months ago",
+  "this/next/previous X", "Qn YYYY", "Qn last year".
 ---
 
 # Datetime & Timezone Queries
 
-Answer timezone-related questions using the server's `<datetime>` context and Node.js `Intl.DateTimeFormat` for cross-zone lookups.
+Answer timezone-related questions and relative-date arithmetic using Node.js — never freelance the math. Relative dates and quarter forms must go through the deterministic one-liner in this skill; the same algorithm runs server-side in the memory plugin's `relative-date.ts`, so chat answers stay consistent with timeline rows the operator sees in the graph.
 
 ## When to Activate
 
@@ -16,6 +18,7 @@ Answer timezone-related questions using the server's `<datetime>` context and No
 - User asks to convert a time between timezones
 - User asks about UTC offset, time difference, or DST status for a location
 - User asks "what time is it?" with a location qualifier
+- User uses a relative date: "last Tuesday", "two weeks ago", "yesterday", "this Christmas", "Q3 last year", "Q1 2025"
 
 For simple "what time is it?" without a location, answer directly from the `<datetime>` block in the system prompt — no tool use needed.
 
@@ -84,8 +87,63 @@ For less common cities, use Bash to search the IANA database:
 node -e "console.log(Intl.supportedValuesOf('timeZone').filter(z => z.toLowerCase().includes('SEARCH_TERM'.toLowerCase())).join('\n'))"
 ```
 
+## Relative date arithmetic
+
+When the operator references a relative date — "last Tuesday", "two weeks ago", "yesterday", "this Christmas", "Q3 2024", "Q1 last year" — never compute the result by hand. The agent loses track of weekday offsets, leap-day arithmetic, and quarter-start months. Use this deterministic one-liner. The reference timestamp defaults to now; pass an ISO string as the second argument to anchor against an earlier moment (e.g. when the operator's message timestamp matters).
+
+```bash
+node -e "
+const REF = process.argv[2] ? new Date(process.argv[2]) : new Date();
+const TXT = process.argv[1];
+const WEEKDAYS = {sun:0,sunday:0,mon:1,monday:1,tue:2,tues:2,tuesday:2,wed:3,weds:3,wednesday:3,thu:4,thur:4,thurs:4,thursday:4,fri:5,friday:5,sat:6,saturday:6};
+const NUMS = {one:1,two:2,three:3,four:4,five:5,six:6,seven:7,eight:8,nine:9,ten:10,eleven:11,twelve:12};
+const sod = d => { const o=new Date(d); o.setUTCHours(0,0,0,0); return o; };
+const addD = (d,n) => { const o=new Date(d); o.setUTCDate(o.getUTCDate()+n); return o; };
+const addM = (d,n) => { const o=new Date(d); o.setUTCMonth(o.getUTCMonth()+n); return o; };
+const addY = (d,n) => { const o=new Date(d); o.setUTCFullYear(o.getUTCFullYear()+n); return o; };
+const base = sod(REF);
+let m;
+if (/\\bevery(\\s+other)?\\s+/i.test(TXT)) { console.log('null (recurring)'); process.exit(0); }
+if (m = TXT.match(/\\b(yesterday|today|tomorrow)\\b/i)) {
+  const w = m[1].toLowerCase();
+  console.log((w==='yesterday'?addD(base,-1):w==='tomorrow'?addD(base,1):base).toISOString());
+} else if (m = TXT.match(/\\b(last|next|this)\\s+([A-Za-z]+)\\b/i)) {
+  const q = m[1].toLowerCase(), t = WEEKDAYS[m[2].toLowerCase()];
+  if (t === undefined) { console.log('null'); process.exit(0); }
+  const dow = base.getUTCDay();
+  let delta;
+  if (q==='last') { delta = t-dow; if (delta>=0) delta-=7; }
+  else if (q==='next') { delta = t-dow; if (delta<=0) delta+=7; }
+  else { const id = dow===0?7:dow, it = t===0?7:t; delta = it-id; }
+  console.log(addD(base, delta).toISOString());
+} else if (m = TXT.match(/\\b(a|an|\\d+|one|two|three|four|five|six|seven|eight|nine|ten|eleven|twelve)\\s+(day|week|month|year)s?\\s+ago\\b/i)) {
+  const w = m[1].toLowerCase();
+  const n = (w==='a'||w==='an')?1:(NUMS[w]??Number(w));
+  const u = m[2].toLowerCase();
+  const d = u==='day'?addD(base,-n):u==='week'?addD(base,-7*n):u==='month'?addM(base,-n):addY(base,-n);
+  console.log(d.toISOString());
+} else if (TXT.match(/\\b(?:this\\s+)?Christmas\\b/i)) {
+  console.log(new Date(Date.UTC(base.getUTCFullYear(),11,25)).toISOString());
+} else if (TXT.match(/\\b(?:this\\s+)?New\\s+Year(?:'s)?(?:\\s+Day)?\\b/i)) {
+  console.log(new Date(Date.UTC(base.getUTCFullYear(),0,1)).toISOString());
+} else if (m = TXT.match(/\\bQ([1-4])\\s+(\\d{2}|\\d{4})\\b/i)) {
+  let y = Number(m[2]); if (y<100) y+=2000;
+  console.log(new Date(Date.UTC(y,(Number(m[1])-1)*3,1)).toISOString());
+} else if (m = TXT.match(/\\bQ([1-4])\\s+(last|this|next)\\s+year\\b/i)) {
+  const refY = base.getUTCFullYear();
+  const y = m[2].toLowerCase()==='last'?refY-1:m[2].toLowerCase()==='next'?refY+1:refY;
+  console.log(new Date(Date.UTC(y,(Number(m[1])-1)*3,1)).toISOString());
+} else { console.log('null'); }
+" "PHRASE" "OPTIONAL_REF_ISO"
+```
+
+Replace `PHRASE` with the relative phrase ("last Tuesday", "Q3 2024") and optionally `OPTIONAL_REF_ISO` with the ISO reference timestamp.
+
+The algorithm mirrors `platform/plugins/memory/mcp/src/lib/relative-date.ts` — the server-side parser the timeline extractor uses. Recurring forms ("every other Friday") return `null` by design. Phrases that don't match return `null`.
+
 ## Boundaries
 
-- Answers timezone questions only — not scheduling, reminders, or alarms.
+- Answers timezone questions and relative-date arithmetic only — not scheduling, reminders, or alarms.
 - Uses the server's system clock. If the server clock is wrong, answers will be wrong.
 - Historical timezone data (e.g., "what time was it in Tokyo on 15 March 1990?") depends on the Node.js ICU dataset and may be inaccurate for dates before 1970.
+- Relative-date parser handles single-date phrases only; multi-date ranges ("from March through May") are out of scope.

package/payload/platform/plugins/docs/references/internals.md

@@ -297,6 +297,22 @@ This makes the failure visible to the agent, which can relay it to the user. Deg
 
 ---
 
+## Reports — durable workflow output (Task 332)
+
+The `:Report` label is the platform's durable shape for workflow output the operator may want back later — daily briefings, dream cycle runs, ad-hoc analyses. Three MCP tools own the surface, all on the memory plugin:
+
+- `memory-report-write` — append-only writer. Validates body ≤ 10,000 chars, embeds title+body, and CREATEs a `:Report` node. Idempotent on `(accountId, title, occurredAt-within-same-minute)` — a second call with the same title in the same minute returns the existing node instead of duplicating. Parented to the active `:Conversation` via `:PRODUCED` when `CONVERSATION_NODE_ID` is set (the chat-driven default); falls back to the account's `:AdminUser` so the graph-hierarchy doctrine holds even outside a conversation.
+- `memory-report-read-latest` — fetches the newest `:Report` (default `limit=1`) tagged with a given keyword. The expected route for any operator phrasing of "latest X", "last night's X", "show me X report".
+- `memory-report-list` — metadata-only paginated listing (newest first), with optional `keyword` and `sourceWorkflow` filters. Use to scan the catalogue without paying for full bodies.
+
+Every operation emits one log line: `[reports] op=<write|read-latest|list> reportId=<short> keywords=<csv> ms=<n>` (with `idempotent=1` on a write that resolved to an existing node, `hits=<n>` on reads, `total=<n>` on list).
+
+Routing is not classifier-side. The admin agent's `IDENTITY.md` carries the rule under **Recalling reports**: "latest <X>" / "last night's <X>" / "show me <X> report" → first tool call is `memory-report-read-latest`. The intent classifier (Task 304's `retrievalClass`) already differentiates temporal vs entity vs event reads; reports route off the literal phrase, not a new class.
+
+The first caller is the `briefing` skill (`platform/plugins/scheduling/skills/briefing/SKILL.md`), which persists each run as a `:Report` with `title: "Daily briefing <YYYY-MM-DD>"`, `keywords: ["daily-briefing", "<YYYY-MM-DD>"]`, `sourceWorkflow: "daily-briefing"`. Dream-cycle (Task 327) and ad-hoc analyses are expected to follow the same pattern.
+
+---
+
 ## Graph Expansion
 
 After the top results are selected (by combined score or by LLM ranking), each result node is expanded by traversing its immediate relationships.

package/payload/platform/plugins/docs/references/memory-guide.md

@@ -116,6 +116,16 @@ Every node also carries a provenance stamp — which agent wrote it, in which se
 
 **Two write surfaces, one substrate.** General agents write through schema-aware helpers — {{productName}} can record a new contact, a new commitment, a new preference without ever typing a database query, and the helper enforces the connection-and-provenance rule above structurally. The graph-steward role (the specialist {{productName}} dispatches when you ask for graph hygiene — "merge those two duplicate contacts," "wire those four tasks to the meeting," "rename the legacy label across the graph") additionally has a raw Cypher write tool for the multi-step operations the helpers cannot express. The steward role internalises the same connection-and-provenance discipline in its prompt; a post-write audit emits a warning on every breach so the same rules apply to both surfaces. Both paths feed the same hourly orphan trend and the same forensic provenance fields — read-side, you cannot tell the two apart, and that is the point.
 
+## Public-facing summaries for customer-readable subjects
+
+Some entities in your graph are knowable by people outside your team — companies you work with, projects you've delivered, the business itself. For those entities ({{productName}} treats `:Organization`, `:Concept`, `:Project`, and `:LocalBusiness` this way), {{productName}} maintains two summaries: a private one only you and your specialist agents see, and a customer-facing public one your public agents are allowed to surface.
+
+Whenever {{productName}} updates the private summary on one of these entities, it automatically rewrites the public summary in the same step using a separate prompt that strips operator-voice ("needs follow-up", "action: chase next week"), internal sentiment, and anything that reads like a note-to-self. The two summaries stay in lockstep without you doing anything.
+
+If you want to write the public summary yourself — for instance, because the auto-generated version misses something you want customers to see — just tell {{productName}} the wording you want for the public summary on that entity, and {{productName}} will write it directly. It stays locked in for seven days; after that, the next automatic refresh can take over again, unless you re-pin it.
+
+People entries (`:Person`) are deliberately excluded from this dual-summary system. Notes about contacts are private by definition and never get a public-facing form.
+
 ## Privacy
 
 All memory is stored on your local Raspberry Pi. The Neo4j database never leaves your network. {{productName}} does not sync memory to any cloud service or third party.

package/payload/platform/plugins/docs/references/platform.md

@@ -54,7 +54,7 @@ Roles are installed during setup and listed when {{productName}} introduces itse
 
 {{productName}} maintains a graph database (Neo4j) of everything you've told it. People, conversations, preferences, and context are stored as connected nodes. When you ask {{productName}} something, it searches this graph to retrieve relevant context before responding.
 
-**The recording loop.** A background recorder watches every completed admin-agent turn. Once your turn finishes and the reply is on screen, a Stop hook fires the `database-operator` specialist as a single-shot headless Claude Code session: the filtered transcript is written to the recorder's stdin and stdin is closed, so claude processes one turn, writes through the wrapped graph writers, and exits. The row archives the moment claude exits — no long-lived hidden PTY. The admin agent itself does not write to the graph. The recorder runs on a cheap fast model so the recording adds nothing to your perceived latency, and its session never appears in the sidebar or anywhere on the operator UI. To disable it for an account, remove the `Stop` hook entry from that account's `~/.<brand>/.claude/settings.json`; there is no toggle.
+**The recording loop.** Once your turn finishes and the reply is on screen, a Stop hook (`post-turn-graph-pass.sh`) fires the `database-operator` specialist as a background dispatch. The dispatch carries the full conversation as `[role: text]` pairs plus the list of every node already written under this conversation, fetched via `GET /api/admin/post-turn-context`. The specialist decides what new graph rows the conversation supports — mentions of named entities, ideas, learnings, contacts, tasks, anything the schema admits — and writes them. Duplicate writes between this background pass and any inline write the admin agent dispatched mid-turn are accepted and cleaned up by the dream-cycle / hygiene sweeps. There is no throttle and no idle gate: one dispatch per `end_turn`. The admin agent can also dispatch `database-operator` inline at its own discretion when a write must complete before the assistant response ends. To disable the background pass for an account, remove the `post-turn-graph-pass.sh` Stop-hook entry from that account's `~/.<brand>/.claude/settings.json`; there is no toggle.
 
 The memory graph is stored on your Pi. It never leaves your network.