@rubytech/create-maxy-code 0.1.265 → 0.1.267

package/payload/premium-plugins/writer-craft/mcp/src/tools/voice-retrieve-conditioning.ts

@@ -30,9 +30,11 @@ import neo4j, { type Session } from "neo4j-driver";
 import { getSession } from "../lib/neo4j.js";
 import { notTrashed } from "../lib/voice-corpus.js";
 import {
-  VOICE_CORPUS_WHERE,
   voiceCorpusWhereWithFormat,
+  voiceCorpusWhereWithFormatAndAuthor,
+  ORG_USER_ID,
   type VoiceFormat,
+  type VoiceScope,
 } from "../lib/voice-corpus.js";
 
 const DEFAULT_TOKEN_BUDGET_SHORT = 16_000;
@@ -56,6 +58,13 @@ export interface VoiceRetrieveConditioningParams {
      */
     length?: "short" | "long";
     register?: string;
+    /**
+     * Voice scope (Task 676). `'personal'` (default) retrieves the caller's own
+     * profile and author-filtered exemplars, falling back to the org profile
+     * when the caller has none. `'org'` retrieves the account/house profile and
+     * account-wide exemplars, degrading to the default register when absent.
+     */
+    scope?: VoiceScope;
   };
   tokenBudget?: number;
 }
@@ -71,14 +80,21 @@ export interface VoiceExemplar {
  * Outcome discriminator (Task 493). Three mutually-exclusive states so the
  * drafting agent and operator can tell genuine no-data apart from a failed
  * lookup — both previously collapsed into the same empty payload:
- *   - "ok"      — query ran; a style card and/or exemplars were returned.
- *   - "no-data" — query ran; no profile exists and the corpus is empty.
- *   - "error"   — the lookup failed (blank identity, driver/connection
- *                 fault, or Cypher error). `error` carries the message.
- * Drafting degrades gracefully to default register on both "no-data" and
- * "error"; the caller must only report "no profile exists" on "no-data".
+ *   - "ok"          — query ran; a style card and/or exemplars were returned
+ *                     for the requested scope.
+ *   - "fallback-org"— a personal request found no personal profile/corpus, so
+ *                     the org profile was returned instead (Task 676). Drafting
+ *                     uses the org voice; this is the standing signal that the
+ *                     caller has no personal attribution yet.
+ *   - "no-data"     — query ran; no profile exists and the corpus is empty for
+ *                     the requested scope (and, for personal, no org fallback).
+ *   - "error"       — the lookup failed (blank identity, driver/connection
+ *                     fault, or Cypher error). `error` carries the message.
+ * Drafting degrades gracefully to default register on "no-data" and "error";
+ * "fallback-org" still injects a (org) style card. The caller must only report
+ * "no profile exists" on "no-data".
  */
-export type VoiceRetrieveStatus = "ok" | "no-data" | "error";
+export type VoiceRetrieveStatus = "ok" | "fallback-org" | "no-data" | "error";
 
 export interface VoiceRetrieveConditioningResult {
   styleCard: string | null;
@@ -113,39 +129,15 @@ export async function voiceRetrieveConditioning(
     (length === "long" ? DEFAULT_TOKEN_BUDGET_LONG : DEFAULT_TOKEN_BUDGET_SHORT);
   const charBudget = tokenBudget * CHARS_PER_TOKEN;
   const format = brief.format;
-  const corpusWhere = voiceCorpusWhereWithFormat(format);
+  const scope: VoiceScope = brief.scope ?? "personal";
+  const topic = (brief.topic ?? "").trim();
+  const usesTopic = topic.length > 0;
 
-  // getSession() is inside the try so driver-construction / connection-config
-  // faults (NEO4J_URI unset, password file missing) are caught, logged, and
-  // returned as the error state rather than escaping the function silently
-  // (Task 493).
-  let session: Session | undefined;
-  try {
-    session = getSession();
-    // 1. Style card — per-format profile.
-    const profile = await session.run(
-      `MATCH (a:AdminUser {accountId: $accountId, userId: $userId})
-       OPTIONAL MATCH (a)-[:HAS_VOICE_PROFILE]->(p:VoiceProfile {accountId: $accountId, userId: $userId, format: $format})
-       RETURN p.styleCard AS styleCard`,
-      { accountId, userId, format },
-    );
-    const styleCard = (profile.records[0]?.get("styleCard") as string | null) ?? null;
-
-    // 2. Exemplars — filtered to brief.format. Keyword-aware when topic is set.
-    //
-    // Body resolution (Task 471):
-    //   - For :KnowledgeDocument with HAS_SECTION children, concatenate
-    //     child :Section bodies in `position` order. KD.body is null after
-    //     Task 465 server-slicing.
-    //   - Other labels read n.body directly via the COALESCE fallback chain.
-    //
-    // The topic filter runs against the computed body, so a topic that
-    // appears only in n.summary (LLM abstract) no longer matches — by
-    // design: the corpus surfaces verbatim prose, not the abstract.
-    const topic = (brief.topic ?? "").trim();
-    const usesTopic = topic.length > 0;
-
-    const bodyComputeBlock = `WITH n, coalesce(n.dateSent, n.datePublished, n.firstMessageAt, n.dateCreated, n.createdAt) AS ts
+  // Body resolution (Task 471): for :KnowledgeDocument with HAS_SECTION
+  // children, concatenate child :Section bodies in `position` order (KD.body is
+  // null after Task 465 server-slicing); other labels read n.body via the
+  // COALESCE chain. The topic filter runs against the computed body.
+  const bodyComputeBlock = `WITH n, coalesce(n.dateSent, n.datePublished, n.firstMessageAt, n.dateCreated, n.createdAt) AS ts
          OPTIONAL MATCH (n)-[:HAS_SECTION]->(s:Section)
          WHERE ${notTrashed("s")}
          WITH n, ts, s ORDER BY s.position
@@ -156,74 +148,116 @@ export async function voiceRetrieveConditioning(
            ELSE coalesce(n.body, n.abstract, n.subject, n.title, n.summary, '')
          END AS body`;
 
-    const cypher = usesTopic
-      ? `MATCH (n)
-         WHERE ${corpusWhere}
-         ${bodyComputeBlock}
-         WHERE toLower(body) CONTAINS toLower($topic)
-         RETURN elementId(n) AS id,
-                labels(n) AS labels,
-                body,
-                coalesce(n.subject, n.title, n.name, '') AS source,
-                ts
-         ORDER BY ts IS NULL, ts DESC
-         LIMIT $k`
-      : `MATCH (n)
-         WHERE ${corpusWhere}
-         ${bodyComputeBlock}
-         RETURN elementId(n) AS id,
-                labels(n) AS labels,
-                body,
-                coalesce(n.subject, n.title, n.name, '') AS source,
-                ts
-         ORDER BY ts IS NULL, ts DESC
-         LIMIT $k`;
-
-    const result = await session.run(cypher, {
-      accountId,
-      format,
-      topic,
-      // neo4j-driver serializes a plain JS number as a Cypher float (15 → 15.0),
-      // which LIMIT rejects ("not a valid value. Must be a non-negative integer").
-      // Send it as a Neo4j integer.
-      k: neo4j.int(k),
-    });
-
-    let charsUsed = 0;
-    const exemplars: VoiceExemplar[] = [];
-    for (const r of result.records) {
-      const body = (r.get("body") as string | null) ?? "";
-      if (body.length === 0) continue;
-      const labels = (r.get("labels") as string[]) ?? [];
-      const label =
-        labels.find((l) =>
-          ["KnowledgeDocument", "Message", "SocialPost", "Conversation"].includes(l),
-        ) ?? labels[0] ?? "Unknown";
-      const remaining = charBudget - charsUsed;
-      if (remaining <= 0) break;
-      const truncated = body.length > remaining ? body.slice(0, remaining) : body;
-      exemplars.push({
-        nodeId: r.get("id") as string,
-        label,
-        body: truncated,
-        source: ((r.get("source") as string | null) ?? "").slice(0, 200),
+  // getSession() is inside the try so driver-construction / connection-config
+  // faults (NEO4J_URI unset, password file missing) are caught, logged, and
+  // returned as the error state rather than escaping the function silently
+  // (Task 493).
+  let session: Session | undefined;
+  try {
+    session = getSession();
+
+    // One scoped lookup: the profile style card (keyed on the profile's userId)
+    // plus K voice-matched exemplars over the scope's corpus. Org passes the
+    // account-wide corpus + `__org__`; personal passes the author-filtered
+    // corpus + the operator's userId. Each call gets a fresh char budget.
+    const lookup = async (
+      profileUserId: string,
+      exemplarWhere: string,
+      exemplarParams: Record<string, unknown>,
+    ): Promise<{ styleCard: string | null; exemplars: VoiceExemplar[] }> => {
+      const profile = await session!.run(
+        `OPTIONAL MATCH (p:VoiceProfile {accountId: $accountId, userId: $profileUserId, format: $format})
+         RETURN p.styleCard AS styleCard`,
+        { accountId, profileUserId, format },
+      );
+      const styleCard =
+        (profile.records[0]?.get("styleCard") as string | null) ?? null;
+
+      const cypher = usesTopic
+        ? `MATCH (n)
+           WHERE ${exemplarWhere}
+           ${bodyComputeBlock}
+           WHERE toLower(body) CONTAINS toLower($topic)
+           RETURN elementId(n) AS id, labels(n) AS labels, body,
+                  coalesce(n.subject, n.title, n.name, '') AS source, ts
+           ORDER BY ts IS NULL, ts DESC
+           LIMIT $k`
+        : `MATCH (n)
+           WHERE ${exemplarWhere}
+           ${bodyComputeBlock}
+           RETURN elementId(n) AS id, labels(n) AS labels, body,
+                  coalesce(n.subject, n.title, n.name, '') AS source, ts
+           ORDER BY ts IS NULL, ts DESC
+           LIMIT $k`;
+
+      const result = await session!.run(cypher, {
+        ...exemplarParams,
+        topic,
+        // neo4j-driver serializes a plain JS number as a Cypher float (15 →
+        // 15.0), which LIMIT rejects. Send a Neo4j integer.
+        k: neo4j.int(k),
       });
-      charsUsed += truncated.length;
+
+      let charsUsed = 0;
+      const exemplars: VoiceExemplar[] = [];
+      for (const r of result.records) {
+        const body = (r.get("body") as string | null) ?? "";
+        if (body.length === 0) continue;
+        const labels = (r.get("labels") as string[]) ?? [];
+        const label =
+          labels.find((l) =>
+            ["KnowledgeDocument", "Message", "SocialPost", "Conversation"].includes(l),
+          ) ?? labels[0] ?? "Unknown";
+        const remaining = charBudget - charsUsed;
+        if (remaining <= 0) break;
+        const truncated = body.length > remaining ? body.slice(0, remaining) : body;
+        exemplars.push({
+          nodeId: r.get("id") as string,
+          label,
+          body: truncated,
+          source: ((r.get("source") as string | null) ?? "").slice(0, 200),
+        });
+        charsUsed += truncated.length;
+      }
+      return { styleCard, exemplars };
+    };
+
+    const hasData = (r: { styleCard: string | null; exemplars: VoiceExemplar[] }) =>
+      (r.styleCard !== null && r.styleCard.length > 0) || r.exemplars.length > 0;
+
+    const orgLookup = () =>
+      lookup(ORG_USER_ID, voiceCorpusWhereWithFormat(format), { accountId, format });
+
+    let result: { styleCard: string | null; exemplars: VoiceExemplar[] };
+    let status: VoiceRetrieveStatus;
+    if (scope === "personal") {
+      const personal = await lookup(
+        userId,
+        voiceCorpusWhereWithFormatAndAuthor(format),
+        { accountId, format, voiceAuthor: userId },
+      );
+      if (hasData(personal)) {
+        result = personal;
+        status = "ok";
+      } else {
+        // No personal profile/corpus yet — borrow the org (house) voice rather
+        // than the bare default register (Task 676).
+        const org = await orgLookup();
+        result = org;
+        status = hasData(org) ? "fallback-org" : "no-data";
+      }
+    } else {
+      const org = await orgLookup();
+      result = org;
+      status = hasData(org) ? "ok" : "no-data";
     }
 
     process.stderr.write(
-      `[voice-retrieve] task=${brief.topic ?? length} format=${format} styleCardBytes=${
-        styleCard?.length ?? 0
-      } exemplarCount=${exemplars.length} tokenBudget=${tokenBudget}\n`,
+      `[voice-retrieve] scope=${scope} format=${format} status=${status} ` +
+        `styleCardBytes=${result.styleCard?.length ?? 0} exemplarCount=${result.exemplars.length} tokenBudget=${tokenBudget}\n`,
     );
 
-    // An empty-string styleCard with no exemplars is no-data, not ok — a blank
-    // card conditions nothing, so reporting "ok" would be the same lie this
-    // discriminator exists to prevent (Task 493).
-    const hasStyleCard = styleCard !== null && styleCard.length > 0;
-    const status: VoiceRetrieveStatus =
-      hasStyleCard || exemplars.length > 0 ? "ok" : "no-data";
-    return { styleCard, exemplars, status };
+    return { styleCard: result.styleCard, exemplars: result.exemplars, status };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     process.stderr.write(`[voice-retrieve] error: ${message}\n`);

package/payload/premium-plugins/writer-craft/mcp/src/tools/voice-tag-content.ts

@@ -34,12 +34,41 @@ export const AUTHORSHIP_MODES: ReadonlySet<AuthorshipMode> = new Set([
   "unknown",
 ]);
 
+/**
+ * Resolve the corpus author for a tag write (Task 676). An explicit, non-blank
+ * `author` wins; otherwise the tagging operator's `userId`. Throws when neither
+ * is available (no `author` argument and no `ADMIN_USER_ID` in spawn env), so a
+ * tag can never silently land with a null author.
+ *
+ * This is why single-operator accounts get personal attribution for free: with
+ * `author` omitted, the sole operator is the implicit author, so their personal
+ * corpus equals the account-wide corpus and prior behaviour is reproduced.
+ */
+export function resolveVoiceAuthor(
+  author: string | undefined,
+  operatorUserId: string | null,
+): string {
+  const explicit = (author ?? "").trim();
+  if (explicit) return explicit;
+  if (operatorUserId) return operatorUserId;
+  throw new Error(
+    "voice-tag-content: author required — no ADMIN_USER_ID in spawn env and no author given.",
+  );
+}
+
 export interface VoiceTagContentParams {
   nodeIds: string[];
   mode: AuthorshipMode;
   accountId: string;
   /** Writing format (required). Editorial classification — operator-supplied. */
   format: VoiceFormat;
+  /**
+   * The corpus author (a userId) to stamp on each node (Task 676). Resolve via
+   * `resolveVoiceAuthor` before calling — explicit author, else the tagging
+   * operator. Personal distillation filters on this; org distillation ignores
+   * it (account-wide).
+   */
+  voiceAuthor: string;
 }
 
 export interface VoiceTagContentResult {
@@ -51,7 +80,7 @@ export interface VoiceTagContentResult {
 export async function voiceTagContent(
   params: VoiceTagContentParams,
 ): Promise<VoiceTagContentResult> {
-  const { nodeIds, mode, accountId, format } = params;
+  const { nodeIds, mode, accountId, format, voiceAuthor } = params;
 
   if (!AUTHORSHIP_MODES.has(mode)) {
     throw new Error(
@@ -74,6 +103,14 @@ export async function voiceTagContent(
   if (!Array.isArray(nodeIds) || nodeIds.length === 0) {
     return { updated: 0, skipped: 0, skippedReasons: {} };
   }
+  // voiceAuthor is checked after the empty-nodeIds early return: an empty tag is
+  // a no-op, so there is nothing to attribute. With nodes to tag, the author
+  // must be resolved (index.ts always supplies it via resolveVoiceAuthor).
+  if (!voiceAuthor) {
+    throw new Error(
+      "voice-tag-content: voiceAuthor is required (resolve via resolveVoiceAuthor before calling).",
+    );
+  }
 
   const session = getSession();
   const now = new Date().toISOString();
@@ -102,7 +139,8 @@ export async function voiceTagContent(
                })
          SET n.authorshipMode = $mode,
              n.authorshipTaggedAt = $now,
-             n.format = $format
+             n.format = $format,
+             n.voiceAuthor = $voiceAuthor
          RETURN elementId(n) AS id`,
         {
           ids: batch,
@@ -110,6 +148,7 @@ export async function voiceTagContent(
           mode,
           now,
           format,
+          voiceAuthor,
           primaryLabels: [...TAGGABLE_PRIMARY_LABELS],
         },
       );
@@ -125,8 +164,11 @@ export async function voiceTagContent(
     await session.close();
   }
 
+  // Tagging is always a personal-attribution act: every tagged node carries an
+  // author and feeds both that author's personal walk and the account-wide org
+  // walk. There is no org-only corpus node, so scope is constant `personal`.
   process.stderr.write(
-    `[voice-tag] mode=${mode} format=${format} accountId=${accountId} updated=${updated} skipped=${
+    `[voice-tag] mode=${mode} format=${format} scope=personal author=${voiceAuthor} accountId=${accountId} updated=${updated} skipped=${
       nodeIds.length - updated
     }\n`,
   );

package/payload/premium-plugins/writer-craft/skills/voice-mirror/SKILL.md

@@ -12,8 +12,8 @@ The skill is built on five deterministic MCP tools served by the `writer-craft`
 | Tool | Purpose |
 |------|---------|
 | `voice-tag-content` | Stamp historical or new content nodes with `authorshipMode` and operator-supplied `format`. Bulk-tags arrays of node ids. |
-| `voice-distil-profile` | Walk the operator's `human-only` corpus for a given `format` and produce a `:VoiceProfile {styleCard, generatedAt, corpusSize, feedbackEntries, format}` node. Without a `format`, enumerates all formats present in the corpus and distils each. |
-| `voice-retrieve-conditioning` | Return `{styleCard, exemplars[]}` for a drafting brief. Requires `brief.format` (one of the six corpus formats). K=5 for short-form, K=15 for long-form. Token-budget bounded. |
+| `voice-distil-profile` | Walk the `human-only` corpus for a given `format` and `scope` and produce a `:VoiceProfile {styleCard, generatedAt, corpusSize, feedbackEntries, format, scope}` node. `scope='personal'` (default) walks one author; `scope='org'` walks the whole account. Without a `format`, enumerates all formats present in that scope's corpus and distils each. |
+| `voice-retrieve-conditioning` | Return `{styleCard, exemplars[], status}` for a drafting brief. Requires `brief.format`; `brief.scope` (default `personal`) picks personal vs org voice, with a personal→org fallback. K=5 for short-form, K=15 for long-form. Token-budget bounded. |
 | `voice-record-feedback` | When the operator edits an agent draft, write a `:VoiceEdit {originalText, editedText, intent, occurredAt, format}-[:FEEDBACK_FOR]->(:VoiceProfile {format})` node. The `intent` field is a Haiku-summarised diff. |
 | `voice-ingest-session-text` | Write operator turns from the current session as `:Message {format:'text', authorshipMode:'human-only'}` corpus nodes. The agent reads its own operator turns from context and passes them as `turns`. Deduplicates via `contentHash`. Invoked on demand when the operator asks to capture this session's voice. |
 
@@ -76,10 +76,11 @@ Query for `:KnowledgeDocument | :SocialPost | :Message` nodes belonging to this
 - `1,3,7 human-only email` — tag a subset with mode + format.
 - `2 human-led-agent-assisted note` — single-item.
 - `5 agent-led-human-reviewed marketing-copy` — single-item.
+- `1-10 human-only article author:joel` — attribute the batch to a named author (a `userId`) rather than the tagging operator.
 - `skip` — leave the batch as `unknown` and advance.
 - `stop` — exit the backfill; the next session resumes from where the operator left off.
 
-`format` is required on every command; the tool will not infer it. If the operator omits the format, ask before tagging. Bulk-tag via `voice-tag-content` once per operator response. Emit `[voice-tag] mode=<mode> format=<format> count=<n>` per write.
+`format` is required on every command; the tool will not infer it. If the operator omits the format, ask before tagging. `author:<userId>` is optional — **omit it and the content is attributed to the tagging operator**, so single-operator accounts get personal attribution for free and behave exactly as before. Name an author only on a multi-operator account when tagging someone else's writing. Bulk-tag via `voice-tag-content` once per operator response. Emit `[voice-tag] mode=<mode> format=<format> scope=personal author=<userId> count=<n>` per write.
 
 ### 2b. Chat archives — paginate per conversation-document parent
 
@@ -90,7 +91,7 @@ For each conversation-document `:KnowledgeDocument` (with `conversationIdentity`
 - `not me` — tag every chunk as `agent-only` (e.g. a Slack channel where the operator only forwarded other people's messages).
 - `skip` / `stop` — same semantics as 2a.
 
-Bulk-tag via `voice-tag-content` with the list of `:Section` element IDs the conversation-document contains, passing `format='text'` (chat archives are unambiguously text-format). The skill emits `[voice-tag] mode=<mode> format=<format> count=<chunk-count>` once per conversation.
+Bulk-tag via `voice-tag-content` with the list of `:Section` element IDs the conversation-document contains, passing `format='text'` (chat archives are unambiguously text-format). Attribution defaults to the tagging operator; on a multi-operator account, pass `author:<userId>` to attribute the conversation to the operator who actually owns it. The skill emits `[voice-tag] mode=<mode> format=<format> scope=personal author=<userId> count=<chunk-count>` once per conversation.
 
 Authorship at conversation granularity is a deliberate UX trade-off: chunks within a conversation almost always share the same operator's voice, and per-chunk tagging at archive scale would burn the operator's attention. The `mixed` opt-in covers the rare case where it matters.
 
@@ -112,7 +113,7 @@ This runs only on the admin seat (the tool is admin-allowlisted). Accounts witho
 
 ## Flow — drafting-time conditioning
 
-Drafting skills (email composition, Postiz, property-brochure, prospectus) call `voice-retrieve-conditioning` transparently before assembling their prompt. The skill takes a brief — `{topic, format, length, register}` — where `format` is the target corpus format and returns:
+Drafting skills (email composition, Postiz, property-brochure, prospectus) call `voice-retrieve-conditioning` transparently before assembling their prompt. The skill takes a brief — `{topic, format, length, register, scope}` — where `format` is the target corpus format and `scope` picks whose voice to draft in. Default `scope` is `personal` (the calling operator's own voice); a drafting skill whose output goes out under the business name passes `scope: "org"` for the house voice. Email composition stays personal; property-brochure and the investor/prospectus skills request `org`. It returns:
 
 ```yaml
 styleCard: |
@@ -132,27 +133,28 @@ exemplars:
 
 Drafting skills inject both blocks into their prompt. Opt-out is per-skill: declare `voiceMirror: false` in the skill's frontmatter and the calling site skips the fetch. Default is on.
 
-The tool returns `{styleCard, exemplars, status}` with a discriminated `status` (Task 493):
+The tool returns `{styleCard, exemplars, status}` with a discriminated `status` (Task 493, extended Task 676):
 
-- **`ok`** — a profile and/or exemplars were returned; inject both blocks.
-- **`no-data`** — the lookup ran but no `:VoiceProfile` exists for this format and the corpus is empty (too small, or distillation never run). Fall back to default register; if the operator asks, this is the only state where you say "you have no voice profile yet".
+- **`ok`** — a profile and/or exemplars were returned for the requested scope; inject both blocks.
+- **`fallback-org`** — a `personal` request found no personal profile/corpus, so the **org (house) voice** was returned instead. Inject the (org) blocks and draft normally. This is the standing signal that the calling operator has no personal attribution yet — the account is running on the house voice. Don't tell the operator they have "no profile"; they have the house one.
+- **`no-data`** — the lookup ran but no `:VoiceProfile` exists for this scope and the corpus is empty (and, for a personal request, no org profile either). Fall back to default register; this is the only state where you say "you have no voice profile yet".
 - **`error`** — the lookup failed (the payload carries an `error` message). Fall back to default register *exactly as for no-data* so drafting never crashes — but **never** tell the operator they have no profile; the profile state is unknown because the lookup errored.
 
-In all three states drafting proceeds: `no-data` and `error` both degrade to the default register, no draft refusal. The distinction matters only for what you tell the operator about *why* their voice was not applied.
+In all four states drafting proceeds. `ok` and `fallback-org` inject a style card; `no-data` and `error` degrade to the default register. The distinction matters only for what you tell the operator about *why* a given voice was (or was not) applied.
 
-Emit `[voice-retrieve] task=<brief> format=<format> styleCardBytes=<n> exemplarCount=<k> tokenBudget=<n>` per call.
+Emit `[voice-retrieve] scope=<scope> format=<format> status=<status> styleCardBytes=<n> exemplarCount=<k> tokenBudget=<n>` per call.
 
 ## Flow — feedback capture
 
 When the operator edits an agent draft (in the email composer's edit loop, or in any drafting skill that supports inline edits), capture the diff:
 
-1. The calling skill passes `{originalText, editedText, format}` to `voice-record-feedback`.
+1. The calling skill passes `{originalText, editedText, format, scope}` to `voice-record-feedback`. `scope` matches the scope the draft was retrieved at — an edit on an org draft passes `scope: "org"`.
 2. The tool runs a Haiku diff summarisation to produce an `intent` field — a one-sentence description of what the operator changed and why. Example intents: "shorter and dropped the apology", "switched to first person", "removed sign-off", "added a specific date".
-3. The tool writes `(:VoiceEdit {originalText, editedText, intent, occurredAt, userId, accountId, format})-[:FEEDBACK_FOR]->(:VoiceProfile {format})` for the operator's profile.
+3. The tool writes `(:VoiceEdit {originalText, editedText, intent, occurredAt, userId, scope, accountId, format})-[:FEEDBACK_FOR]->(:VoiceProfile {format})` for the scoped profile. An org edit routes to the org profile (`userId='__org__'`); a personal edit to the operator's own. The real editor is always preserved via `(:AdminUser)-[:AUTHORED]->(:VoiceEdit)`, even on org edits.
 
-Feedback accumulates between distillations. The next `voice-distil-profile` run reads every `:VoiceEdit` linked to the profile and feeds the intents into the style-card refinement.
+Feedback accumulates between distillations. The next `voice-distil-profile` run at the matching scope reads every `:VoiceEdit` linked to that profile and feeds the intents into the style-card refinement.
 
-Emit `[voice-record-feedback] userId=<id> format=<format> intent="<haiku-summary>" diffBytes=<n>`.
+Emit `[voice-record-feedback] scope=<scope> userId=<id|__org__> format=<format> intent="<haiku-summary>" diffBytes=<n>`.
 
 ## Distillation cadence
 
@@ -184,21 +186,30 @@ When `eligible=0` (every named document failed the predicate) surface the `ineli
 
 Amend mode does not apply to the on-demand session-text capture path. Session-text ingest stays on the full-corpus path; amend is operator-initiated only.
 
-## Per-operator scope
+## Org and personal scope
 
-One `:VoiceProfile` per `(accountId, userId, format)`. Multi-author accounts (an agency with several operators) get one profile per person per format. Identity is the `(accountId, userId, format)` triple, enforced by the schema constraint.
+Every account holds, per format, **one org (house) profile and any number of personal profiles** at once (Task 676):
+
+- **Personal** — one operator's own voice. Key `(accountId, userId, format)`, `scope='personal'`, anchored on the operator's `:AdminUser`. Distilled from that operator's author-tagged content only (`n.voiceAuthor = userId`).
+- **Org** — the account/house voice. Key `(accountId, '__org__', format)`, `scope='org'`, anchored on the account's `:LocalBusiness`. Distilled from the **whole account** (every author's content), not one person's.
+
+`__org__` is a reserved sentinel userId. It keeps the existing `(accountId, userId, format)` unique constraint valid with no migration — exactly one org profile per `(account, format)` — and a real operator must never hold it.
+
+Which voice a draft uses is the `scope` on the retrieval brief: `"my voice"` → personal, `"the house/org voice"` → org. A personal request with no personal profile yet falls back to the org profile (`status: "fallback-org"`); an org request with no org profile degrades to the default register (`status: "no-data"`).
+
+**Single-operator accounts are unchanged.** With author omitted at tag time, the sole operator is the implicit author, so their personal corpus equals the account-wide corpus and personal distillation reproduces the prior single profile. Legacy content tagged before Task 676 carries no `voiceAuthor`; it appears only in the account-wide org walk until re-tagged, and personal drafts fall back to the org voice in the meantime (legacy `voiceAuthor` backfill is Task 678; author inference from source metadata is Task 679).
 
 ## Observability
 
 | Tag | When |
 |-----|------|
-| `[voice-tag] mode=<mode> format=<format> nodeId=<id> count=<n>` | Every tag write. |
-| `[voice-distil] userId=<id> format=<format> corpusSize=<n> generatedAt=<iso> feedbackEntries=<n>` | Each distillation. |
-| `[voice-distil] skip reason=<below-threshold\|recent> format=<format>` | When the cadence guard fires. |
-| `[voice-distil] mode=amend userId=<id> format=<format> nodeIds=<count> existingProfile=<elementId\|none> eligible=<n> ineligible=<n> exemplars=<n>` | Each amend-mode call. `eligible=0` means surface `ineligible[]` to the operator, never silently no-op. |
-| `[voice-distil] mode=write userId=<id> format=<format> amended=true amendedFromNodeIds=<count> ...` | Amend-write fired (operator-initiated update persisted). |
-| `[voice-retrieve] task=<topic> format=<format> styleCardBytes=<n> exemplarCount=<k> tokenBudget=<n>` | Each retrieval. |
-| `[voice-record-feedback] userId=<id> format=<format> intent="<haiku-summary>" diffBytes=<n>` | Each feedback write. |
+| `[voice-tag] mode=<mode> format=<format> scope=personal author=<userId> count=<n>` | Every tag write. `author=` is the resolved value (operator's id when omitted). |
+| `[voice-distil] scope=<scope> userId=<id\|__org__> anchor=<AdminUser\|LocalBusiness> format=<format> corpusSize=<n> generatedAt=<iso> feedbackEntries=<n>` | Each distillation write. Org also carries `sentinel=__org__`. |
+| `[voice-distil] scope=<scope> userId=<id\|__org__> format=<format> skip reason=<below-threshold\|recent\|empty-corpus>` | When the cadence/empty guard fires. |
+| `[voice-distil] scope=<scope> mode=amend userId=<id\|__org__> format=<format> nodeIds=<count> existingProfile=<elementId\|none> eligible=<n> ineligible=<n> exemplars=<n>` | Each amend-mode call. `eligible=0` means surface `ineligible[]` to the operator, never silently no-op. |
+| `[voice-distil] scope=<scope> mode=write userId=<id\|__org__> anchor=<…> format=<format> amended=true amendedFromNodeIds=<count> ...` | Amend-write fired (operator-initiated update persisted). |
+| `[voice-retrieve] scope=<scope> format=<format> status=<ok\|fallback-org\|no-data\|error> styleCardBytes=<n> exemplarCount=<k> tokenBudget=<n>` | Each retrieval. `status=fallback-org` proves the personal→org fallback fired. |
+| `[voice-record-feedback] scope=<scope> userId=<id\|__org__> format=<format> intent="<haiku-summary>" diffBytes=<n>` | Each feedback write. |
 | `[voice-ingest-session-text] sessionId=<id> adminUser=<id> turns=<n> bytes=<n> skipped=<m>` | On-demand session-text capture. |
 
 **Confirms working:** `[voice-retrieve] exemplarCount≥1` precedes every drafting-skill prompt assembly when the calling skill has not opted out. `[voice-distil]` appears at least once per 30-day window per active format per operator. `[voice-ingest-session-text] turns≥1` appears when the operator asks to capture a session's voice.

package/payload/server/{chunk-SOLVVUST.js → chunk-W4EM7RK4.js}

@@ -5590,6 +5590,8 @@ var clientIpMiddleware = async (c, next) => {
 };
 
 export {
+  HtmlEscapedCallbackPhase,
+  resolveCallback,
   Hono2 as Hono,
   getRequestListener,
   serve,

package/payload/server/maxy-edge.js

@@ -14,7 +14,7 @@ import {
   sanitizeClientCorrId,
   vncLog,
   websockifyLog
-} from "./chunk-SOLVVUST.js";
+} from "./chunk-W4EM7RK4.js";
 import "./chunk-PFF6I7KP.js";
 
 // server/edge.ts