@rubytech/create-maxy-code 0.1.163 → 0.1.164

package/payload/platform/plugins/admin/hooks/__tests__/pre-turn-graph-pass.test.sh

@@ -1,441 +0,0 @@
-#!/usr/bin/env bash
-# Tasks 425, 430 — pre-turn-graph-pass UserPromptSubmit hook test suite.
-#
-# Task 430 reshaped the hook: admin walks the operator turn, admin
-# dispatches per-write briefs to `database-operator`. The hook no longer
-# packages a `<conversation>` block — admin already has the turn in
-# context. The `<prior-writes>` block remains as a skip-list for admin.
-#
-# A local Python HTTP server stands in for the admin server:
-#   POST /api/admin/log-ingest        → records every line emit_log sent.
-#   GET  /api/admin/post-turn-context → returns the contents of $CTX_FILE,
-#                                       or 500 if $CTX_FILE is missing/empty.
-# Both kinds of request are appended to $REQ_LOG so assertions can see
-# every POST body AND whether the GET was attempted at all.
-#
-# Contract under test:
-#   - Role/specialist gates: exit 0, single trigger-skipped log line, empty
-#     stdout (no additionalContext).
-#   - MAXY_UI_INTERNAL_PORT unset: exit 0, empty stdout. The hook emits its
-#     missing-env diagnostic on its own stderr channel because
-#     /api/admin/log-ingest is unreachable; loud-fail is acceptable.
-#   - Missing-transcript: exit 0, single trigger-skipped log line, empty
-#     stdout.
-#   - Dispatch path (admin + populated JSONL): exit 0, stdout is a JSON
-#     envelope `{"hookSpecificOutput":{"hookEventName":"UserPromptSubmit",
-#     "additionalContext":"..."}}` whose additionalContext begins with
-#     `[system: pre-turn-graph-pass-hook]`, names `database-operator` as
-#     the dispatch target, carries a `<prior-writes>` block with the
-#     fetched node, interpolates sessionId from SESSION_NODE_ID,
-#     and carries NO `<conversation>` block (admin has the turn already).
-#     Dispatch log line carries `directive-shape=admin-walks`.
-#   - Prior-writes fetch fails (context endpoint 500): exit 0, dispatch
-#     still fires, `<prior-writes>` block resolves to `(none)`.
-#   - SESSION_NODE_ID unset: exit 0, additionalContext names
-#     `sessionId: <unset>`, and no GET to /api/admin/post-turn-context
-#     is attempted.
-#   - UserPromptSubmit stdin-shape regression: a synthetic UserPromptSubmit
-#     payload produces the documented stdout envelope; a stale Stop-shaped
-#     payload is rejected with `wrong-hook-event`.
-
-set -u
-
-HOOK="$(cd "$(dirname "$0")/.." && pwd)/pre-turn-graph-pass.sh"
-if [[ ! -x "$HOOK" ]]; then
-  echo "FAIL: $HOOK not executable" >&2
-  exit 1
-fi
-
-OP_ID='aaaaaaaa-1111-2222-3333-bbbbbbbbbbbb'
-CONV_ID='conv-deadbeef-0001'
-
-TMPFILES=()
-LISTENER_PIDS=()
-cleanup_test_state() {
-  for pid in "${LISTENER_PIDS[@]:-}"; do
-    if [[ -n "$pid" ]]; then
-      kill "$pid" 2>/dev/null || true
-      wait "$pid" 2>/dev/null || true
-    fi
-  done
-  for f in "${TMPFILES[@]:-}"; do
-    [[ -n "$f" ]] && rm -f "$f" 2>/dev/null || true
-  done
-}
-trap cleanup_test_state EXIT
-
-PASS=0
-FAIL=0
-pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
-fail() { echo "FAIL: $1" >&2; FAIL=$((FAIL + 1)); }
-
-start_listener() {
-  REQ_LOG=$(mktemp); TMPFILES+=("$REQ_LOG")
-  CTX_FILE=$(mktemp); TMPFILES+=("$CTX_FILE")
-  : > "$CTX_FILE"
-  LISTENER_PORT=$((39700 + RANDOM % 100))
-  python3 - "$LISTENER_PORT" "$REQ_LOG" "$CTX_FILE" <<'PY' &
-import sys, http.server, json
-port = int(sys.argv[1])
-log_path = sys.argv[2]
-ctx_path = sys.argv[3]
-
-class H(http.server.BaseHTTPRequestHandler):
-  def log_message(self, *a, **k): pass
-  def do_POST(self):
-    n = int(self.headers.get('Content-Length','0') or 0)
-    body = self.rfile.read(n).decode('utf-8','replace')
-    with open(log_path, 'a', encoding='utf-8') as f:
-      f.write('POST\t' + self.path + '\t' + body + '\n')
-    self.send_response(200)
-    self.send_header('Content-Type','application/json')
-    self.end_headers()
-    self.wfile.write(json.dumps({"ok": True}).encode('utf-8'))
-  def do_GET(self):
-    with open(log_path, 'a', encoding='utf-8') as f:
-      f.write('GET\t' + self.path + '\t\n')
-    if self.path.startswith('/api/admin/post-turn-context'):
-      try:
-        with open(ctx_path, 'r', encoding='utf-8') as f:
-          body = f.read()
-      except FileNotFoundError:
-        body = ''
-      if not body.strip():
-        self.send_response(500)
-        self.end_headers()
-        return
-      self.send_response(200)
-      self.send_header('Content-Type','application/json')
-      self.end_headers()
-      self.wfile.write(body.encode('utf-8'))
-    else:
-      self.send_response(404)
-      self.end_headers()
-
-http.server.HTTPServer(('127.0.0.1', port), H).serve_forever()
-PY
-  LISTENER_PIDS+=("$!")
-  for _ in $(seq 1 20); do
-    if curl -sS --max-time 1 -X POST "http://127.0.0.1:${LISTENER_PORT}/ping" -d '{}' >/dev/null 2>&1; then
-      break
-    fi
-    sleep 0.1
-  done
-  : > "$REQ_LOG"
-}
-
-run_hook() {
-  # Args: role, specialist, ui_port, session_node_id, stdin_json
-  local role="$1"; local specialist="$2"; local ui_port="$3"
-  local conv="$4"; local stdin_json="$5"
-  local stderr_file; stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
-  local stdout_file; stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
-  local env_cmd=(env)
-  env_cmd+=("MAXY_SESSION_ROLE=${role}")
-  env_cmd+=("MAXY_SPECIALIST=${specialist}")
-  if [[ -n "$ui_port" ]]; then
-    env_cmd+=("MAXY_UI_INTERNAL_PORT=${ui_port}")
-  fi
-  if [[ -n "$conv" ]]; then
-    env_cmd+=("SESSION_NODE_ID=${conv}")
-  fi
-  env_cmd+=("ACCOUNT_ID=acct-test-0001")
-  printf '%s' "$stdin_json" | "${env_cmd[@]}" bash "$HOOK" >"$stdout_file" 2>"$stderr_file"
-  HOOK_RC=$?
-  HOOK_STDERR=$(cat "$stderr_file")
-  HOOK_STDOUT=$(cat "$stdout_file")
-  sleep 0.1
-}
-
-ingest_lines() {
-  grep -E '^POST\s+/api/admin/log-ingest\s+' "$REQ_LOG" 2>/dev/null | python3 -c '
-import sys, json
-for raw in sys.stdin:
-  try:
-    parts = raw.rstrip("\n").split("\t", 2)
-    if len(parts) < 3: continue
-    body = parts[2]
-    d = json.loads(body)
-    if isinstance(d, dict) and isinstance(d.get("line"), str):
-      print(d["line"])
-  except Exception:
-    pass
-' || true
-}
-
-context_get_count() {
-  grep -E '^GET\s+/api/admin/post-turn-context' "$REQ_LOG" 2>/dev/null | wc -l | tr -d ' '
-}
-
-additional_context() {
-  printf '%s' "$HOOK_STDOUT" | python3 -c '
-import sys, json
-try:
-  d = json.load(sys.stdin)
-  out = (d.get("hookSpecificOutput") or {}).get("additionalContext", "")
-  sys.stdout.write(out)
-except Exception:
-  pass
-'
-}
-
-envelope_for() {
-  python3 -c '
-import json, sys
-print(json.dumps({
-    "session_id": sys.argv[1],
-    "transcript_path": sys.argv[2],
-    "cwd": "/tmp",
-    "hook_event_name": "UserPromptSubmit",
-    "prompt": "test prompt body",
-}))
-' "$1" "$2"
-}
-
-write_simple_transcript() {
-  local out="$1"; shift
-  python3 - "$out" "$@" <<'PY'
-import sys, json
-out = sys.argv[1]
-records = []
-i = 2
-while i + 1 < len(sys.argv):
-    u, a = sys.argv[i], sys.argv[i+1]
-    records.append({
-        "type": "user",
-        "timestamp": "2026-05-26T10:00:00.000Z",
-        "message": {"role": "user", "content": u},
-    })
-    records.append({
-        "type": "assistant",
-        "timestamp": "2026-05-26T10:00:01.000Z",
-        "message": {
-            "id": "msg_a",
-            "role": "assistant",
-            "content": [{"type": "text", "text": a}],
-        },
-    })
-    i += 2
-with open(out, "w", encoding="utf-8") as f:
-    for r in records:
-        f.write(json.dumps(r) + "\n")
-PY
-}
-
-DIRECTIVE_TOKEN='[system: pre-turn-graph-pass-hook]'
-
-# ---------------------------------------------------------------------------
-# Case 1: role != admin → trigger-skipped reason=role-not-admin
-# ---------------------------------------------------------------------------
-start_listener
-TRANSCRIPT_BASIC=$(mktemp); TMPFILES+=("$TRANSCRIPT_BASIC")
-write_simple_transcript "$TRANSCRIPT_BASIC" "hello" "hi there"
-ENV_BASIC=$(envelope_for "$OP_ID" "$TRANSCRIPT_BASIC")
-: > "$REQ_LOG"
-run_hook "public" "" "$LISTENER_PORT" "$CONV_ID" "$ENV_BASIC"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-1 rc=$HOOK_RC"
-if [[ -n "$HOOK_STDOUT" ]]; then
-  fail "case-1 stdout must be empty on role-not-admin, got: $HOOK_STDOUT"
-fi
-if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=role-not-admin$"; then
-  pass "case-1 role=public → trigger-skipped reason=role-not-admin"
-else
-  fail "case-1 expected role-not-admin, got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 2: MAXY_SPECIALIST set → trigger-skipped reason=is-specialist
-# ---------------------------------------------------------------------------
-: > "$REQ_LOG"
-run_hook "admin" "database-operator" "$LISTENER_PORT" "$CONV_ID" "$ENV_BASIC"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-2 rc=$HOOK_RC"
-if [[ -n "$HOOK_STDOUT" ]]; then
-  fail "case-2 stdout must be empty on is-specialist, got: $HOOK_STDOUT"
-fi
-if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=is-specialist specialist=database-operator$"; then
-  pass "case-2 specialist=database-operator → trigger-skipped reason=is-specialist"
-else
-  fail "case-2 expected is-specialist, got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 3: MAXY_UI_INTERNAL_PORT unset → exit 0, empty stdout, loud stderr.
-# ---------------------------------------------------------------------------
-: > "$REQ_LOG"
-run_hook "admin" "" "" "$CONV_ID" "$ENV_BASIC"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-3 rc=$HOOK_RC"
-if [[ -n "$HOOK_STDOUT" ]]; then
-  fail "case-3 stdout must be empty when MAXY_UI_INTERNAL_PORT unset"
-fi
-if [[ "$(ingest_lines | wc -l | tr -d ' ')" == "0" ]]; then
-  pass "case-3 missing MAXY_UI_INTERNAL_PORT → exit 0, no dispatch"
-else
-  fail "case-3 expected no ingest lines (port unset), got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 4: transcript_path missing on disk → trigger-skipped reason=missing-transcript
-# ---------------------------------------------------------------------------
-MISSING_PATH="/tmp/pre-turn-graph-pass-does-not-exist-$$.jsonl"
-rm -f "$MISSING_PATH"
-ENV_MISSING=$(envelope_for "$OP_ID" "$MISSING_PATH")
-: > "$REQ_LOG"
-run_hook "admin" "" "$LISTENER_PORT" "$CONV_ID" "$ENV_MISSING"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-4 rc=$HOOK_RC"
-if [[ -n "$HOOK_STDOUT" ]]; then
-  fail "case-4 stdout must be empty on missing-transcript"
-fi
-if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=missing-transcript$"; then
-  pass "case-4 missing transcript_path → trigger-skipped reason=missing-transcript"
-else
-  fail "case-4 expected missing-transcript, got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 5: Dispatch path → exit 0, UserPromptSubmit JSON envelope, blocks
-#         interpolated, dispatch log emitted.
-# ---------------------------------------------------------------------------
-cat > "$CTX_FILE" <<'JSON'
-{"writes":[{"elementId":"4:abc:1","labels":["KnowledgeDocument"],"properties":{"title":"prior note"}}]}
-JSON
-: > "$REQ_LOG"
-run_hook "admin" "" "$LISTENER_PORT" "$CONV_ID" "$ENV_BASIC"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-5 expected rc=0, got $HOOK_RC"
-STDOUT_OK=$(printf '%s' "$HOOK_STDOUT" | python3 -c '
-import sys, json
-try:
-  d = json.load(sys.stdin)
-  out = d["hookSpecificOutput"]
-  assert out["hookEventName"] == "UserPromptSubmit"
-  assert isinstance(out["additionalContext"], str)
-  print("OK")
-except Exception as e:
-  print(f"BAD: {e}")
-')
-if [[ "$STDOUT_OK" != "OK" ]]; then
-  fail "case-5 stdout envelope malformed: $STDOUT_OK"
-fi
-CTX_BODY=$(additional_context)
-if ! printf '%s' "$CTX_BODY" | head -n 1 | grep -qF "$DIRECTIVE_TOKEN"; then
-  fail "case-5 additionalContext must begin with $DIRECTIVE_TOKEN"
-fi
-if printf '%s' "$CTX_BODY" | grep -q '<conversation>'; then
-  fail "case-5 additionalContext must NOT carry a <conversation> block (admin has the turn in context)"
-fi
-if ! printf '%s' "$CTX_BODY" | grep -q '<prior-writes>'; then
-  fail "case-5 additionalContext missing <prior-writes> block"
-fi
-if ! printf '%s' "$CTX_BODY" | grep -q 'database-operator'; then
-  fail "case-5 additionalContext must name the database-operator dispatch target"
-fi
-if ! printf '%s' "$CTX_BODY" | grep -q "sessionId: ${CONV_ID}"; then
-  fail "case-5 additionalContext must interpolate sessionId=${CONV_ID}"
-fi
-if ! printf '%s' "$CTX_BODY" | grep -q 'KnowledgeDocument'; then
-  fail "case-5 additionalContext <prior-writes> must include fetched labels"
-fi
-if ingest_lines | grep -qE "^dispatch claudeSessionId=${OP_ID} sessionId=${CONV_ID} directive-shape=admin-walks "; then
-  pass "case-5 dispatch path → exit 0 + JSON envelope with prior-writes, sessionId, admin-walks shape"
-else
-  fail "case-5 expected dispatch log line with directive-shape=admin-walks, got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 6: Prior-writes fetch fails (500) → exit 0, prior-writes=(none).
-# ---------------------------------------------------------------------------
-: > "$CTX_FILE"
-: > "$REQ_LOG"
-run_hook "admin" "" "$LISTENER_PORT" "$CONV_ID" "$ENV_BASIC"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-6 expected rc=0, got $HOOK_RC"
-CTX_BODY=$(additional_context)
-PRIOR_BODY=$(printf '%s' "$CTX_BODY" | awk '/<prior-writes>/{flag=1;next}/<\/prior-writes>/{flag=0}flag' | tr -d '[:space:]')
-if [[ "$PRIOR_BODY" == "(none)" ]]; then
-  pass "case-6 context endpoint 500 → dispatch still fires, prior-writes = (none)"
-else
-  fail "case-6 expected prior-writes=(none), got [$PRIOR_BODY]"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 7: SESSION_NODE_ID unset → sessionId:<unset>, no context GET.
-# ---------------------------------------------------------------------------
-cat > "$CTX_FILE" <<'JSON'
-{"writes":[]}
-JSON
-: > "$REQ_LOG"
-run_hook "admin" "" "$LISTENER_PORT" "" "$ENV_BASIC"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-7 expected rc=0, got $HOOK_RC"
-CTX_BODY=$(additional_context)
-if ! printf '%s' "$CTX_BODY" | grep -q 'sessionId: <unset>'; then
-  fail "case-7 additionalContext must contain 'sessionId: <unset>'"
-fi
-GET_COUNT=$(context_get_count)
-if [[ "$GET_COUNT" == "0" ]]; then
-  pass "case-7 SESSION_NODE_ID unset → no GET /api/admin/post-turn-context attempted"
-else
-  fail "case-7 expected zero context GETs, got: $GET_COUNT"
-fi
-
-# ---------------------------------------------------------------------------
-# Cases 8 and 9 in the Task 425 suite asserted the conversation walk
-# (multi-block assistant concatenation; tool_result-only user skip).
-# Task 430 removed the conversation walk entirely — admin reads the turn
-# it already has in context — so those cases no longer apply.
-#
-# Case 10: UserPromptSubmit shape — directive on stdout only, never stderr;
-#          stdout envelope has hookEventName="UserPromptSubmit".
-# ---------------------------------------------------------------------------
-cat > "$CTX_FILE" <<'JSON'
-{"writes":[]}
-JSON
-: > "$REQ_LOG"
-run_hook "admin" "" "$LISTENER_PORT" "$CONV_ID" "$ENV_BASIC"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-10 expected rc=0, got $HOOK_RC"
-if printf '%s' "$HOOK_STDERR" | grep -qF "$DIRECTIVE_TOKEN"; then
-  fail "case-10 directive must not appear on stderr (UserPromptSubmit contract is stdout JSON)"
-fi
-HEN=$(printf '%s' "$HOOK_STDOUT" | python3 -c '
-import sys, json
-try:
-  d = json.load(sys.stdin)
-  sys.stdout.write(d["hookSpecificOutput"]["hookEventName"])
-except Exception:
-  pass
-')
-if [[ "$HEN" == "UserPromptSubmit" ]]; then
-  pass "case-10 stdout envelope is well-formed JSON with hookEventName=UserPromptSubmit"
-else
-  fail "case-10 expected hookEventName=UserPromptSubmit, got [$HEN]"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 11: Stop-shaped stdin regression — a CC Stop-hook payload carries
-#          hook_event_name="Stop". The hook must not silently emit a
-#          UserPromptSubmit envelope on a Stop fire. Expect exit 0 with
-#          empty stdout and a `wrong-hook-event` skip line.
-# ---------------------------------------------------------------------------
-ENV_STOP_SHAPED=$(python3 -c '
-import json, sys
-print(json.dumps({
-    "session_id": sys.argv[1],
-    "transcript_path": sys.argv[2],
-    "hook_event_name": "Stop",
-}))
-' "$OP_ID" "$TRANSCRIPT_BASIC")
-: > "$REQ_LOG"
-run_hook "admin" "" "$LISTENER_PORT" "$CONV_ID" "$ENV_STOP_SHAPED"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-11 expected rc=0, got $HOOK_RC"
-if [[ -n "$HOOK_STDOUT" ]]; then
-  fail "case-11 stdout must be empty on wrong-hook-event Stop, got: $HOOK_STDOUT"
-fi
-if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=wrong-hook-event event=Stop$"; then
-  pass "case-11 Stop-shaped stdin rejected with wrong-hook-event skip"
-else
-  fail "case-11 expected wrong-hook-event skip, got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-# Summary
-# ---------------------------------------------------------------------------
-echo
-echo "pre-turn-graph-pass tests: $PASS passed, $FAIL failed"
-[[ "$FAIL" -eq 0 ]]

package/payload/platform/plugins/admin/hooks/per-turn-graph-pass-gate.sh

@@ -1,111 +0,0 @@
-#!/usr/bin/env bash
-# Stop hook — per-turn gate. Task 440.
-#
-# Mirrors `session-end-retrospective.sh`'s structural primitive (exit 2 +
-# stderr instruction + sentinel-grep release) but fires on every admin turn
-# end rather than only on operator end-intent. Closes the gap left when
-# Task 425 moved the per-turn graph pass off Stop onto UserPromptSubmit:
-# the UserPromptSubmit `additionalContext` directive carries the prior-writes
-# skip-list and the instruction, but admin can silently drop the directive
-# because UserPromptSubmit's only blocking shape erases the prompt without
-# feeding stderr to Claude. The structural fix is here — Stop's exit-2
-# stderr-to-Claude contract gives the gate a release path admin can act on.
-#
-# Release conditions, evaluated against the operator's JSONL since the
-# latest real-user message (string content OR a content list with at least
-# one non-`tool_result` block):
-#   A. admin dispatched the writes — a `Task` `tool_use` whose
-#      `input.subagent_type` is `database-operator` appeared.
-#   B. admin declined the writes — a `tool_use` whose `name` is exactly
-#      `mcp__admin__pre-turn-graph-pass-skip` appeared. The sentinel takes a
-#      `reason` string (free-form, e.g. `no-new-entities`,
-#      `turn-is-acknowledgement`); the tool records the call for audit but
-#      takes no graph action.
-#
-# Either release path emits `gate-released sessionId=<id> via=<dispatch|skip-sentinel>`
-# and exits 0. Both Stop-hook tags emit independently and compose: the
-# session-end retrospective gates only on `/end` intent and uses its own
-# sentinel; this hook gates every turn and uses the two release patterns
-# above.
-#
-# Recursion guard — the shared `agp_guard_role_specialist` skips when
-# `MAXY_SPECIALIST` is set, so the database-operator subagent's own turn
-# end never re-triggers this gate.
-#
-# Loop-safety — once release path A or B fires, the matching tool_use sits
-# in the JSONL and every subsequent Stop on the same operator-prompt window
-# sees it and exits 0 with `gate-released`. The Task 412 loop case is
-# avoided because the release decision is JSONL-based, never a re-fire of
-# the directive.
-#
-# Input: Claude Code's Stop hook stdin shape
-#   { "session_id": "<intrinsic>", "transcript_path": "<jsonl path>", ... }
-
-set -uo pipefail
-
-AGP_LOG_TAG="per-turn-graph-pass-gate"
-AGP_LIB="$(dirname "$0")/lib/admin-graph-pass-common.sh"
-if [ ! -f "$AGP_LIB" ]; then
-  echo "[${AGP_LOG_TAG}] trigger-skipped sessionId=unknown reason=missing-helper path=${AGP_LIB}" >&2
-  exit 0
-fi
-# shellcheck source=lib/admin-graph-pass-common.sh
-source "$AGP_LIB"
-
-agp_setup_logging
-agp_read_stdin
-agp_parse_stdin
-agp_guard_role_specialist
-agp_guard_transcript require-stdin
-
-# Release alternation: any MCP-prefixed skip-sentinel name (the admin MCP
-# server can surface as either `mcp__admin__…` when wired via .mcp.json or
-# `mcp__plugin_admin_admin__…` when loaded via the Claude Code plugin
-# system — both forms appear in JSONL `tool_use.name` and both release the
-# gate), or a Task tool_use with `input.subagent_type=database-operator`
-# (matched as the synthetic name `Task:database-operator` by the helper).
-# Same defect class Task 417 fixed for the session-end retrospective gate,
-# generalised here to cover the plugin-system namespace.
-RELEASE_PATTERN='mcp__[a-z_]+__pre-turn-graph-pass-skip|Task:database-operator'
-
-INSPECTION=$(agp_scan_post_user_toolnames "$RELEASE_PATTERN")
-USER_PRESENT="${INSPECTION%%	*}"
-MATCHED_NAME="${INSPECTION#*	}"
-
-if [ "$USER_PRESENT" != "yes" ]; then
-  # No real-user message in the transcript yet — e.g. the SessionStart
-  # bootstrap turn, an empty transcript, or a session that only contains
-  # tool_result-shaped user records. Nothing to gate against.
-  agp_emit_log "trigger-skipped sessionId=${SESSION_ID} reason=no-real-user"
-  exit 0
-fi
-
-if [ -n "$MATCHED_NAME" ]; then
-  case "$MATCHED_NAME" in
-    Task:database-operator)
-      VIA="dispatch"
-      ;;
-    mcp__*__pre-turn-graph-pass-skip)
-      VIA="skip-sentinel"
-      ;;
-    *)
-      VIA="unknown"
-      ;;
-  esac
-  agp_emit_log "gate-released sessionId=${SESSION_ID} via=${VIA} tool=${MATCHED_NAME}"
-  exit 0
-fi
-
-agp_emit_log "gate-blocked sessionId=${SESSION_ID} reason=sentinel-absent"
-
-cat >&2 <<'INSTRUCTION'
-Before this turn closes, do the per-turn graph pass. Scan the operator's latest message for any new graph-worthy content not already covered by the prior-writes block in this turn's pre-turn-graph-pass directive — mentions of named entities, ideas or learnings the operator stated, contacts named for the first time, tasks the operator committed to, decisions, anything the schema admits.
-
-For each candidate write, dispatch one Task to the `database-operator` specialist with a brief that names the label, the relevant properties, and (when attaching to an existing node) the elementId from the prior-writes list. Skip writes the prior-writes list already covers.
-
-If the turn supports no new writes, call the `pre-turn-graph-pass-skip` MCP tool with a short `reason` (e.g. `no-new-entities`, `turn-is-acknowledgement`) so the gate releases. Calling that tool is the deterministic signal that you considered the turn and chose not to write.
-
-Either path releases this gate and lets the turn close. Do not surface this dispatch in your reply to the operator.
-INSTRUCTION
-
-exit 2