@rubytech/create-maxy-code 0.1.164 → 0.1.166

package/payload/platform/scripts/seed-neo4j.sh

@@ -1,19 +1,18 @@
 #!/usr/bin/env bash
 # ============================================================
-# seed-neo4j.sh — Phase 0 setup
-# Creates the account from templates and applies Neo4j schema.
-# Product knowledge is ingested post-installation via the admin
-# agent, not seeded as cypher.
+# seed-neo4j.sh — Neo4j schema + root-node seeding
+# Applies the schema (constraints, indexes, vector indexes) and
+# MERGEs the per-account root :LocalBusiness and owner :AdminUser
+# nodes. Account directory creation, Claude Code settings, hooks
+# wiring, and specialist templates live in `setup-account.sh`.
+# This script does no filesystem setup beyond reading what
+# setup-account.sh wrote.
 # ============================================================
 
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
-TEMPLATES_DIR="$PROJECT_DIR/templates"
-# Accounts live at {installDir}/data/accounts/ — outside the platform/ wipe zone.
-INSTALL_DIR="$(dirname "$PROJECT_DIR")"
-ACCOUNTS_DIR="$INSTALL_DIR/data/accounts"
 NEO4J_DIR="$PROJECT_DIR/neo4j"
 
 # NEO4J_URI is hard-required. The previous default
@@ -41,426 +40,20 @@ fi
 CYPHER_SHELL="cypher-shell"
 
 # ------------------------------------------------------------------
-# 1. Create account from templates
+# 1. Resolve the account dir (must already exist; setup-account.sh
+#    is the creator). The resolver is idempotent — calling it here
+#    re-finds the same ACCOUNT_DIR / ACCOUNT_ID setup-account.sh
+#    minted.
 # ------------------------------------------------------------------
-
-# Resolve existing account by identity (users.json[0].userId) or mint a new one on fresh install.
-# Orphan siblings under data/accounts/ — non-matching dirs left behind by the userId
-# regeneration — are swept to data/accounts/.trash/<uuid>-<ISO8601-ts>/. Multi-candidate with
-# no identity match aborts loud; .trash/ is operator-emptied, never auto-cleaned.
 # shellcheck source=lib/resolve-account-dir.sh
 . "$SCRIPT_DIR/lib/resolve-account-dir.sh"
 # shellcheck source=lib/read-brand-json.sh
 . "$SCRIPT_DIR/lib/read-brand-json.sh"
-# Resolve brand-aware persistent users.json path before the resolver runs.
-# Mirrors the resolution lower in this file (around the post-Task-904 USERS_FILE
-# block); duplicated here because resolve_and_sweep_account_dir runs first.
 _RESOLVER_CONFIG_DIR_NAME=".maxy"
 read_brand_json_key "$PROJECT_DIR/config/brand.json" "configDir"
 [ -n "$BRAND_JSON_VALUE" ] && _RESOLVER_CONFIG_DIR_NAME="$BRAND_JSON_VALUE"
 USERS_FILE="$HOME/$_RESOLVER_CONFIG_DIR_NAME/users.json" resolve_and_sweep_account_dir
 
-mkdir -p "$ACCOUNT_DIR/agents/admin" "$ACCOUNT_DIR/agents/public" "$ACCOUNT_DIR/.claude" "$ACCOUNT_DIR/specialists/.claude-plugin" "$ACCOUNT_DIR/specialists/agents"
-
-# Claude Code discovers project-level .claude/ (agents, settings) relative to the
-# nearest .git root. Without a .git in the account directory, Claude Code traverses
-# up to ~/maxy/.git and misses everything in accountDir/.claude/. Initialise a git
-# repo so the account directory IS the project root for Claude Code.
-[ -d "$ACCOUNT_DIR/.git" ] || git init -q "$ACCOUNT_DIR"
-
-# Claude Code permissions — project-level settings now work since the account dir
-# has .git. Write permissions to the account's own .claude/settings.json.
-ACCOUNT_SETTINGS="$ACCOUNT_DIR/.claude/settings.json"
-
-# Wildcard permissions for all plugin MCP servers (core + optional).
-# Including optional plugins here is safe — permissions without a running
-# MCP server are inert. This ensures tools are allowed when the user
-# enables an optional plugin, without requiring a re-seed.
-MAXY_PERMISSIONS='["Read","Edit","Write","Bash","Glob","Grep","Agent","mcp__memory__*","mcp__contacts__*","mcp__telegram__*","mcp__admin__*","mcp__cloudflare__*","mcp__work__*","mcp__scheduling__*","mcp__email__*","mcp__workflows__*","mcp__web__*","mcp__plugin_playwright_playwright__*"]'
-
-# Append wildcard permissions for any optional plugins not already covered
-PLUGINS_DIR="$(dirname "$0")/../plugins"
-if [ -d "$PLUGINS_DIR" ]; then
-  for PLUGIN_DIR in "$PLUGINS_DIR"/*/; do
-    PLUGIN_NAME="$(basename "$PLUGIN_DIR")"
-    # Skip plugins already in the static list
-    case "$MAXY_PERMISSIONS" in
-      *"mcp__${PLUGIN_NAME}__"*) continue ;;
-    esac
-    # Only add if plugin has an MCP server
-    if [ -d "$PLUGIN_DIR/mcp" ]; then
-      MAXY_PERMISSIONS="${MAXY_PERMISSIONS%]},\"mcp__${PLUGIN_NAME}__*\"]"
-    fi
-  done
-fi
-
-# Always overwrite — Rubytech-controlled. Project-level settings take
-# precedence over global, so each account is properly isolated.
-#
-# Hook commands use $PLATFORM_ROOT (set by claude-agent.ts at spawn time)
-# to locate scripts relative to the platform installation, not the account dir.
-#
-# Hooks wired:
-#   PreToolUse — pre-tool-use.sh: admin write boundaries
-#                playwright-file-guard.sh: intercepts browser_navigate with file:// URLs
-#                webfetch-preflight.mjs: detects JS-SPA shells before WebFetch's
-#                  60s extraction timeout. Fail-open on any error;
-#                  on positive SPA detection exits 2 with WEBFETCH_CANNOT_READ_JS_SPA.
-#                archive-ingest-surface-gate.sh:
-#                  narrows the database-operator subagent's effective surface
-#                  during conversation-archive ingestion to exactly one Bash
-#                  entry (memory/bin/conversation-archive-ingest.sh --source
-#                  <enum>) plus read-only neighbours. Defensive blocks on
-#                  withdrawn MCP tool names (mcp__memory__whatsapp-export-
-#                  {parse,preview,insight-write,insight-pass},
-#                  mcp__memory__memory-archive-write when
-#                  archiveType=whatsapp-export) remain so any future
-#                  reintroduction loud-fails. Preserves the plugin-source
-#                  edit, JS test-runner, and post-parse-error blocks.
-#                  Wired at three points: explicit Edit/Write/NotebookEdit/Bash
-#                  matchers, a no-matcher PreToolUse entry (the
-#                  post-parse-error gate fires on every tool),
-#                  and a PostToolUse regex matcher for parse tools.
-#                UserPromptSubmit — archive-ingest-surface-gate.sh clears the
-#                  parse-error flag when the operator's next prompt arrives.
-#                askuserquestion-investigate-gate.sh (Task 241): PreToolUse
-#                  matcher=AskUserQuestion. Blocks the question when no
-#                  read-only investigation tool has fired since the latest
-#                  real user turn in the session JSONL. Fail-open on
-#                  missing transcript or parse error. One [ask-gate]
-#                  decision line per call.
-#
-# Task 214 — the per-turn Stop-hook registration that fired
-# turn-completed-graph-write.sh once per admin turn is no longer written.
-# The script, envelope walker, loopback /api/admin/claude-sessions 127.0.0.1
-# bypass, [turn-recorder] emitters, recorder-auto-archive subscriber, and
-# initialMessage envelope spec are preserved as dormant infrastructure for
-# any future autonomous post-turn flow. Admin now delegates graph writes
-# to database-operator via the Task tool inside its own session.
-#
-# Task 282 — Stop hook session-end-retrospective.sh wired below. Fires on
-# every assistant end_turn but exits 0 with `trigger-skipped reason=…`
-# on every path EXCEPT when the operator's latest real-user message
-# carries an end-intent token (/end, /archive, end session,
-# archive this session). On that path it blocks (exit 2 + stderr
-# instruction block) until the admin agent calls the
-# session-retrospective-mark-complete MCP sentinel tool, whose tool_use
-# in the JSONL is the release signal. Recursion guard: any session
-# carrying MAXY_SPECIALIST=<name> (specialist subagent) skips the gate.
-HOOKS_PATH="\$PLATFORM_ROOT/plugins/admin/hooks"
-cat > "$ACCOUNT_SETTINGS" << SETTINGS_EOF
-{
-  "permissions": {
-    "allow": $MAXY_PERMISSIONS
-  },
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Write",
-        "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/pre-tool-use.sh admin" },
-          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
-        ]
-      },
-      {
-        "matcher": "Edit",
-        "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/pre-tool-use.sh admin" },
-          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
-        ]
-      },
-      {
-        "matcher": "NotebookEdit",
-        "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
-        ]
-      },
-      {
-        "matcher": "Bash",
-        "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/pre-tool-use.sh admin" },
-          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
-        ]
-      },
-      {
-        "matcher": "mcp__plugin_memory_memory__memory-write",
-        "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/pre-tool-use.sh admin" }
-        ]
-      },
-      {
-        "matcher": "mcp__plugin_memory_memory__memory-update",
-        "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/pre-tool-use.sh admin" }
-        ]
-      },
-      {
-        "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
-        ]
-      },
-      {
-        "matcher": "mcp__plugin_playwright_playwright__browser_navigate",
-        "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/playwright-file-guard.sh" }
-        ]
-      },
-      {
-        "matcher": "WebFetch",
-        "hooks": [
-          { "type": "command", "command": "node $HOOKS_PATH/webfetch-preflight.mjs" }
-        ]
-      },
-      {
-        "matcher": "AskUserQuestion",
-        "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/askuserquestion-investigate-gate.sh" }
-        ]
-      }
-    ],
-    "PostToolUse": [
-      {
-        "matcher": "mcp__.*__.*-(export|import)-parse$",
-        "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
-        ]
-      }
-    ],
-    "UserPromptSubmit": [
-      {
-        "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
-        ]
-      }
-    ],
-    "Stop": [
-      {
-        "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/session-end-retrospective.sh" }
-        ]
-      }
-    ]
-  }
-}
-SETTINGS_EOF
-
-# Always overwrite IDENTITY.md — Rubytech-controlled, pure behaviour.
-cp "$TEMPLATES_DIR/agents/admin/IDENTITY.md" "$ACCOUNT_DIR/agents/admin/IDENTITY.md"
-cp "$TEMPLATES_DIR/agents/public/IDENTITY.md" "$ACCOUNT_DIR/agents/public/IDENTITY.md"
-echo "  agents/public/IDENTITY.md installed"
-
-# Always overwrite specialist plugin — Rubytech-controlled, not user-editable.
-# Specialists are a Claude Code plugin loaded via --plugin-dir. The plugin lives at
-# accountDir/specialists/ with .claude-plugin/plugin.json and agents/*.md.
-# The admin agent dispatches them as specialists:{name} via the Agent tool.
-cp "$TEMPLATES_DIR/specialists/.claude-plugin/plugin.json" "$ACCOUNT_DIR/specialists/.claude-plugin/plugin.json"
-
-# Remove orphaned core specialist files before copying fresh templates.
-# Core specialists (no '--' in filename) are Rubytech-controlled and fully replaced
-# on every seed. Premium plugin agents (filename contains '--') are preserved —
-# they are managed by the admin agent when plugins are activated/deactivated.
-for _existing in "$ACCOUNT_DIR/specialists/agents/"*.md; do
-  [ -f "$_existing" ] || continue
-  case "$(basename "$_existing")" in
-    *--*) continue ;;  # Premium plugin agent — preserve
-  esac
-  rm -f "$_existing"
-done
-
-for specialist in "$TEMPLATES_DIR/specialists/agents/"*.md; do
-  [ -f "$specialist" ] && cp "$specialist" "$ACCOUNT_DIR/specialists/agents/$(basename "$specialist")"
-done
-
-# Clean up stale .claude/agents/*.md from previous seed format.
-# The old format placed specialists here as slash-command agents — that never worked
-# for programmatic dispatch. Safe to remove; .claude/ dir stays for settings.json.
-rm -f "$ACCOUNT_DIR/.claude/agents/"*.md 2>/dev/null || true
-
-# SOUL.md — user-controlled personalisation. Only create if missing. Never overwrite.
-[ -f "$ACCOUNT_DIR/agents/admin/SOUL.md" ] || cp "$TEMPLATES_DIR/agents/admin/SOUL.md" "$ACCOUNT_DIR/agents/admin/SOUL.md"
-
-# Public agent SOUL.md + config.json — create if missing, never overwrite.
-# IDENTITY.md is handled in the Rubytech-controlled block above.
-[ -f "$ACCOUNT_DIR/agents/public/SOUL.md" ] || cp "$TEMPLATES_DIR/agents/public/SOUL.md" "$ACCOUNT_DIR/agents/public/SOUL.md"
-[ -f "$ACCOUNT_DIR/agents/public/config.json" ] || cp "$TEMPLATES_DIR/agents/public/config.json" "$ACCOUNT_DIR/agents/public/config.json"
-
-# AGENTS.md — specialist registry. Pre-populated from templates, maintained by admin agent at runtime.
-# Always overwrite on re-seed (Rubytech-controlled initial state, like IDENTITY.md).
-# Dispatch format: specialists:{name} via the Agent tool.
-printf '# Installed Roles\n\nDispatch via the Agent tool with `subagent_type: "specialists:{name}"`.\n\n' > "$ACCOUNT_DIR/agents/admin/AGENTS.md"
-for specialist in "$ACCOUNT_DIR/specialists/agents/"*.md; do
-  [ -f "$specialist" ] || continue
-  # Extract name and description from YAML frontmatter
-  _name=$(sed -n 's/^name: *//p' "$specialist" | head -1)
-  _desc=$(sed -n 's/^description: *"*//p' "$specialist" | sed 's/"$//' | head -1)
-  [ -z "$_name" ] && continue
-  # Skip Phase 1 stubs — not yet functional
-  echo "$_desc" | grep -qi "Phase 1" && continue
-  printf -- '- **specialists:%s**: %s\n' "$_name" "$_desc" >> "$ACCOUNT_DIR/agents/admin/AGENTS.md"
-done
-
-# Create account.json only if it doesn't exist (business config is in the graph).
-# Reads defaults from the template so there is a single source of truth.
-if [ ! -f "$ACCOUNT_DIR/account.json" ]; then
-  TEMPLATE="$TEMPLATES_DIR/account.json"
-  if [ -f "$TEMPLATE" ]; then
-    sed "s/\"accountId\": *\"[^\"]*\"/\"accountId\":\"$ACCOUNT_ID\"/" "$TEMPLATE" \
-      | sed "s/\"tier\": *\"[^\"]*\"/\"tier\":\"solo\"/" \
-      > "$ACCOUNT_DIR/account.json"
-  else
-    echo "ERROR: account.json template not found at $TEMPLATE" >&2
-    exit 1
-  fi
-fi
-
-# Backfill defaultAgent in account.json if missing (existing accounts earlier).
-# Uses the first non-admin agent directory that has a config.json.
-if [ -f "$ACCOUNT_DIR/account.json" ] && ! grep -q '"defaultAgent"' "$ACCOUNT_DIR/account.json"; then
-  _DEFAULT_SLUG=""
-  for _AGENT_DIR in "$ACCOUNT_DIR/agents"/*/; do
-    _AGENT_NAME="$(basename "$_AGENT_DIR")"
-    [ "$_AGENT_NAME" = "admin" ] && continue
-    [ -f "$_AGENT_DIR/config.json" ] && { _DEFAULT_SLUG="$_AGENT_NAME"; break; }
-  done
-  if [ -n "$_DEFAULT_SLUG" ]; then
-    # Insert defaultAgent before the closing brace
-    sed -i'' "s/}$/,\"defaultAgent\":\"$_DEFAULT_SLUG\"}/" "$ACCOUNT_DIR/account.json"
-    echo "  Backfilled defaultAgent=$_DEFAULT_SLUG in account.json"
-  fi
-fi
-
-# ------------------------------------------------------------------
-# Seed enabledPlugins from brand.json plugins.defaultEnabled
-# ------------------------------------------------------------------
-# Fresh accounts: replaces the template's empty [] with defaultEnabled.
-# Existing accounts: additive merge — adds missing defaultEnabled entries,
-# never removes plugins the user enabled manually.
-# Dependency validation: skips any defaultEnabled plugin whose PLUGIN.md
-# `requires:` dependencies are not satisfied by core or defaultEnabled.
-BRAND_JSON="$PROJECT_DIR/config/brand.json"
-if [ -f "$BRAND_JSON" ] && [ -f "$ACCOUNT_DIR/account.json" ]; then
-  python3 -c "
-import json, os, sys
-
-brand_path = '$BRAND_JSON'
-account_path = '$ACCOUNT_DIR/account.json'
-plugins_dir = '$PROJECT_DIR/plugins'
-
-with open(brand_path) as f:
-    brand = json.load(f)
-
-plugins_cfg = brand.get('plugins', {})
-default_enabled = plugins_cfg.get('defaultEnabled', [])
-core = set(plugins_cfg.get('core', []))
-
-if not default_enabled:
-    print('  [seed] no defaultEnabled plugins in brand.json — skipping')
-    sys.exit(0)
-
-# Dependency validation: check each plugin's PLUGIN.md requires field.
-# A dependency is satisfied if it appears in core or in defaultEnabled.
-satisfied = core | set(default_enabled)
-validated = []
-for plugin in default_enabled:
-    plugin_md = os.path.join(plugins_dir, plugin, 'PLUGIN.md')
-    requires = []
-    if os.path.isfile(plugin_md):
-        in_frontmatter = False
-        in_requires = False
-        with open(plugin_md) as f:
-            for line in f:
-                stripped = line.rstrip()
-                if stripped == '---':
-                    if in_frontmatter:
-                        break
-                    in_frontmatter = True
-                    continue
-                if not in_frontmatter:
-                    continue
-                if stripped.startswith('requires:'):
-                    # Handle inline list: requires: [a, b]
-                    inline = stripped.split(':', 1)[1].strip()
-                    if inline.startswith('['):
-                        requires = [x.strip().strip('\"').strip(\"'\") for x in inline.strip('[]').split(',') if x.strip()]
-                        in_requires = False
-                    else:
-                        in_requires = True
-                    continue
-                if in_requires:
-                    if stripped.startswith('  - '):
-                        requires.append(stripped.lstrip(' -').strip())
-                    else:
-                        in_requires = False
-    unmet = [r for r in requires if r not in satisfied]
-    if unmet:
-        print(f'  [seed] WARNING: skipping defaultEnabled plugin \"{plugin}\" — unmet requires: {unmet}')
-    else:
-        validated.append(plugin)
-
-with open(account_path) as f:
-    account = json.load(f)
-
-existing = account.get('enabledPlugins', [])
-existing_set = set(existing)
-added = [p for p in validated if p not in existing_set]
-account['enabledPlugins'] = existing + added
-
-with open(account_path, 'w') as f:
-    json.dump(account, f, indent=2)
-    f.write('\n')
-
-if not existing:
-    print(f'  [seed] seeded enabledPlugins: {validated}')
-elif added:
-    print(f'  [seed] merged into enabledPlugins: +{added} (existing: {existing})')
-else:
-    print(f'  [seed] enabledPlugins already contains all defaultEnabled entries')
-"
-fi
-
-echo "  Account $ACCOUNT_ID at $ACCOUNT_DIR"
-
-# ------------------------------------------------------------------
-# 1b. Resolve first admin userId from users.json
-# ------------------------------------------------------------------
-# users.json is created by the set-pin POST during onboarding. The seed
-# script reads it to stamp the AdminUser node; it never creates users.json.
-
-CONFIG_DIR="$PROJECT_DIR/config"
-
-# Resolve the brand-specific config directory.
-# Mirrors the logic in platform/ui/app/lib/paths.ts.
-_CONFIG_DIR_NAME=".maxy"
-read_brand_json_key "$CONFIG_DIR/brand.json" "configDir"
-[ -n "$BRAND_JSON_VALUE" ] && _CONFIG_DIR_NAME="$BRAND_JSON_VALUE"
-# users.json lives under $HOME/$_CONFIG_DIR_NAME, not the wipe zone.
-USERS_FILE="$HOME/$_CONFIG_DIR_NAME/users.json"
-mkdir -p "$HOME/$_CONFIG_DIR_NAME"
-
-if [ -f "$USERS_FILE" ]; then
-  USER_ID=$(python3 -c "import json; print(json.load(open('$USERS_FILE'))[0]['userId'])" 2>/dev/null || true)
-  [ -n "$USER_ID" ] && echo "  Existing users.json found, userId=$USER_ID"
-
-  # Ensure account.json admins[] contains the owner. Idempotent.
-  if [ -n "$USER_ID" ] && [ -f "$ACCOUNT_DIR/account.json" ]; then
-    python3 -c "
-import json
-with open('$ACCOUNT_DIR/account.json', 'r') as f:
-    config = json.load(f)
-config.setdefault('admins', [])
-if not any(a.get('userId') == '$USER_ID' for a in config['admins']):
-    config['admins'].append({'userId': '$USER_ID', 'role': 'owner'})
-    with open('$ACCOUNT_DIR/account.json', 'w') as f:
-        json.dump(config, f, indent=2)
-        f.write('\n')
-    print('  Stamped userId=$USER_ID as owner in account.json admins')
-"
-  fi
-else
-  echo "  No users.json found — skipping AdminUser seed (set-pin POST creates it)"
-  USER_ID=""
-fi
-
 # ------------------------------------------------------------------
 # 2. Apply Neo4j schema (constraints + indexes only)
 # ------------------------------------------------------------------
@@ -486,7 +79,7 @@ fi
 echo "$SCHEMA_CYPHER" | "$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI"
 
 # ------------------------------------------------------------------
-# 2.5 Bootstrap root :LocalBusiness for the account
+# 3. Bootstrap root :LocalBusiness for the account
 # ------------------------------------------------------------------
 # Every node in the graph hierarchy (Project, Task, Person, Organisation,
 # KnowledgeDocument) anchors to a :LocalBusiness via accountId. Without a
@@ -505,6 +98,7 @@ echo "$SCHEMA_CYPHER" | "$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a
 # default filled in on re-seed. createdAt is set ON CREATE only, so re-runs
 # preserve the original timestamp.
 
+BRAND_JSON="$PROJECT_DIR/config/brand.json"
 read_brand_json_key "$BRAND_JSON" "vertical"
 LOCALBUSINESS_BUSINESS_TYPE=$(derive_business_type "$BRAND_JSON_VALUE")
 LOCALBUSINESS_BT_CYPHER=$(business_type_cypher "$LOCALBUSINESS_BUSINESS_TYPE")
@@ -547,10 +141,22 @@ fi
 echo "  [install-invariant] localbusiness-bootstrap accountId=${ACCOUNT_ID:0:8} businessType=$LOCALBUSINESS_BT_LOG result=$LOCALBUSINESS_RESULT"
 
 # ------------------------------------------------------------------
-# 3. Create AdminUser node + ADMIN_OF relationship
+# 4. Create AdminUser node + ADMIN_OF relationship
 # ------------------------------------------------------------------
+# Resolve owner userId from users.json (set-pin POST creates it).
+# Same brand-aware resolution as setup-account.sh.
+CONFIG_DIR="$PROJECT_DIR/config"
+_CONFIG_DIR_NAME=".maxy"
+read_brand_json_key "$CONFIG_DIR/brand.json" "configDir"
+[ -n "$BRAND_JSON_VALUE" ] && _CONFIG_DIR_NAME="$BRAND_JSON_VALUE"
+USERS_FILE="$HOME/$_CONFIG_DIR_NAME/users.json"
+
+USER_ID=""
+if [ -f "$USERS_FILE" ]; then
+  USER_ID=$(python3 -c "import json; print(json.load(open('$USERS_FILE'))[0]['userId'])" 2>/dev/null || true)
+fi
 
-if [ -n "${USER_ID:-}" ]; then
+if [ -n "$USER_ID" ]; then
   # Escape single quotes for Cypher string interpolation (e.g. O'Brien → O''Brien).
   USER_NAME=$(python3 -c "import json; n=json.load(open('$USERS_FILE'))[0]['name']; print(n.replace(\"'\",\"''\"))" 2>/dev/null || echo "Owner")
   CREATED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
@@ -576,6 +182,8 @@ ON CREATE SET r.role = 'owner', r.grantedAt = '$CREATED_AT'
 RETURN au.userId, b.accountId;
 CYPHER_EOF
   echo "  [seed] AdminUser stamped userId=${USER_ID:0:8} accountId=${ACCOUNT_ID:0:8} role=owner"
+else
+  echo "  No users.json found — skipping AdminUser seed (set-pin POST creates it)"
 fi
 
 echo "  Done."