@rubytech/create-maxy-code 0.1.32 → 0.1.34

package/payload/platform/plugins/cloudflare/scripts/list-cf-domains.ts

@@ -17,8 +17,8 @@
 //     routing and cannot drift without breaking their entire dashboard; it
 //     is the most stable surface to key off.
 //
-// Why href-only (no page-text fallback): Task 599 removed an earlier
-// <main>-wide FQDN text walker ("Source B") after a reproduction returned
+// Why href-only (no page-text fallback): an earlier
+// <main>-wide FQDN text walker ("Source B") was removed after a reproduction returned
 // `count=1` with a bogus string (`leg.interest` — a static footer FQDN-shape
 // that hit the regex). The walker's non-empty result short-circuited the
 // poll-to-success branch before zones hydrated 500 ms later, silently
@@ -52,13 +52,13 @@ import { fileURLToPath } from "node:url";
 // for in-process tests (`scrapeCurrentPage` / `scrapeDomains` under JSDOM)
 // does not require an installed brand on disk.
 //
-// Task 954 source-of-truth contract:
+// source-of-truth contract:
 //   Runtime: brand.json `cdpPort` at `${MAXY_PLATFORM_ROOT}/config/brand.json`
 //     is authoritative. Wrapper exports MAXY_PLATFORM_ROOT and BRAND. Missing
 //     env / file / field → loud-fail with one of three named reasons. The
 //     pre-Task-954 silent CDP-port default made every non-Maxy brand fail
 //     `cdp-unreachable` because the helper hit Maxy's port instead of the
-//     brand's; Task 787 / NEO4J_URI sets the precedent that runtime config
+//     brand's / NEO4J_URI sets the precedent that runtime config
 //     never falls back silently.
 //
 //   Test overrides: when BOTH `LIST_CF_DOMAINS_CDP_HOST` and
@@ -83,10 +83,10 @@ type Reason =
   | "navigate-failed"
   | "table-wait-timeout"
   | "runtime-error"
-  // Task 954 — config-class failures. The first three short-circuit before
+  // config-class failures. The first three short-circuit before
   // any CDP work begins; the route maps them to `field='config'` so the
   // form renders a config-card naming the brand + path instead of a Retry
-  // button (retrying re-fires the same wrongly-resolved spawn — Task 787
+  // button (retrying re-fires the same wrongly-resolved spawn
   // pattern).
   | "brand-config-missing"
   | "cdp-port-unresolved";
@@ -106,10 +106,10 @@ function logPhase(line: string): void {
   process.stderr.write(`[list-cf-domains] ${line}\n`);
 
   // Stream log: direct write by the TS helper (not via wrapper tee) so phase
-  // lines reach the per-conversation file the Task 592 tailer reads, even on
+  // lines reach the per-conversation file the tailer reads, even on
   // exit 0 where runFormSpawn discards `result.stderr`. Format parity with
   // `_stream-log.sh phase_line`: `[<ISO-ts>] [script:<scope>] <content>\n` —
-  // the `script:` prefix is Task 605's chat-surface namespace so the line
+  // the `script:` prefix is the chat-surface namespace so the line
   // passes the tightened tailer regex (`[mcp:*]` / `[init]` / `[api-wait-*]`
   // lines in the same file are excluded by construction). Asserted by the
   // vitest regression under platform/ui/__tests__. Sync append so the
@@ -143,7 +143,7 @@ interface CdpEndpoint {
   source: "env-override" | "brand.json";
 }
 
-// Task 954 — single source of truth for the CDP endpoint. Called once from
+// single source of truth for the CDP endpoint. Called once from
 // `main()` so the JSDOM scrape test (which imports `scrapeCurrentPage`
 // directly without invoking `main`) does not need an installed brand.
 function resolveCdpEndpoint(): CdpEndpoint {
@@ -425,7 +425,7 @@ export function scrapeCurrentPage(
 
   // The only scrape source: `/<accountId>/<host>` hrefs — the canonical CF
   // routing pattern the overview page uses to link each zone to its
-  // management screens. Task 599 removed a full-<main> FQDN text walker
+  // management screens. The full-<main> FQDN text walker was removed
   // after it returned a bogus FQDN-shaped string from static page copy
   // (see module header). When this source returns empty, the caller's
   // `empty-or-drift` branch snapshots the page HTML for diagnosis — loud
@@ -456,7 +456,7 @@ export type CdpEvaluator = (expression: string) => Promise<unknown>;
 
 // Trailing-run length (consecutive polls at `max_count`) the complete-line
 // asserts before it declares `unstable=false`. Two iterations at 500 ms each
-// = 1 s of continuous observation at the high-water mark. Task 615 removed
+// = 1 s of continuous observation at the high-water mark. removed
 // the early-exit on this threshold (it shortcuts multi-zone accounts where
 // the first zone hydrates one poll ahead of the second — the plateau at the
 // intermediate count trips the threshold before the final zone arrives);
@@ -465,9 +465,9 @@ const STABLE_POLL_THRESHOLD = 2;
 
 // Cap on `document.documentElement.outerHTML` captured into the dump file.
 // The observed Cloudflare dashboard outerHTML is ~1 MB; 5 MB is 5× headroom
-// and still fits comfortably in one `writeFile` syscall on the Pi. Pre-Task
-// 615 this was 100 KB — the dump ended mid-`<head>` CSS on every scrape,
-// rendering the forensic artifact premise of Task 608 silently broken: the
+// and still fits comfortably in one `writeFile` syscall on the Pi. An earlier
+// 100 KB cap truncated the dump mid-`<head>` CSS on every scrape,
+// rendering the forensic artifact silently broken: the
 // zone table lived past the cutoff and `grep <zone-host> <dump>` always
 // returned nothing, forcing re-scrapes to answer post-hoc questions.
 const OUTER_HTML_CAPTURE_MAX_CHARS = 5_000_000;
@@ -510,7 +510,7 @@ async function dumpHtml(
     // CONFIG_DIR is set by list-cf-domains.sh before the spawn. A silent
     // fallback would dump logs into the wrong brand's directory on a Real
     // Agent install — a silent-miswrite masking the wrapper-side break it
-    // came from. Per Task 473 doctrine: loud-fail on absent runtime-derived
+    // came from. doctrine: loud-fail on absent runtime-derived
     // values.
     const configDir = process.env.CONFIG_DIR;
     if (!configDir) {
@@ -568,7 +568,7 @@ function dumpField(result: DumpResult, mode: DumpMode): string {
 
 export async function scrapeDomains(evaluator: CdpEvaluator): Promise<string[]> {
   const deadline = Date.now() + SCRAPE_POLL_MS;
-  // Task 615: pure poll-to-deadline. The earlier "first N stable polls wins"
+  // pure poll-to-deadline. The earlier "first N stable polls wins"
   // heuristic short-circuited on the first plateau a multi-zone dashboard
   // rendered — a 2-zone account whose second zone hydrates one poll later
   // than the first would lock `count=1` before the second zone arrived.

package/payload/platform/plugins/cloudflare/scripts/reset-tunnel.sh

@@ -21,7 +21,7 @@ set -euo pipefail
 
 # --------------------------------------------------------------------------
 # Shared stream-log helpers (require STREAM_LOG_PATH, phase_line, tee_subprocess).
-# Task 556: any cloudflared subprocess this script spawns is teed line-by-line
+# any cloudflared subprocess this script spawns is teed line-by-line
 # into the per-conversation stream log so the chat UI tailer renders live
 # progress — same contract as setup-tunnel.sh.
 # --------------------------------------------------------------------------

package/payload/platform/plugins/cloudflare/scripts/setup-tunnel.sh

@@ -20,7 +20,7 @@
 # `DISPLAY=${DISPLAY:-${BRAND_VNC_DISPLAY}} /usr/bin/chromium <url> &` — no reliance on
 # cloudflared's optimistic xdg-open, no CDP auto-click, no DOM matcher.
 # The operator clicks the zone row + Authorize on the VNC themselves.
-# This is the wrappers-faithfully-relay-third-party-cli doctrine (Task 858);
+# This is the wrappers-faithfully-relay-third-party-cli doctrine;
 # any layer that auto-clicks Authorize for the operator is forbidden.
 # cloudflared's stdout+stderr is teed line-by-line into STREAM_LOG_PATH so
 # the chat UI's server-side tailer renders live progress in-turn.
@@ -31,8 +31,8 @@ set -euo pipefail
 # (see packages/create-maxy-code/src/index.ts:installTunnelScripts), so the raw
 # BASH_SOURCE[0] points at $HOME, not the scripts directory where the sibling
 # helpers (_stream-log.sh, tunnel-ingress.ts) live. Factored to SCRIPT_DIR so
-# Task 600's stream-log-contract scanner can statically resolve the
-# tunnel-ingress.ts target (Task 054).
+# the stream-log-contract scanner can statically resolve the
+# tunnel-ingress.ts target.
 SCRIPT_DIR="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
 
 # --------------------------------------------------------------------------
@@ -59,7 +59,7 @@ shift 2
 HOSTNAMES=("$@")
 
 # --------------------------------------------------------------------------
-# Task 009 — SSH/SMB ingress env vars.
+# SSH/SMB ingress env vars.
 #
 # SSH and SMB hostnames arrive via environment, NOT positional argv, so the
 # existing form/endpoint contract (which passes admin/public/apex as
@@ -99,7 +99,7 @@ phase_line setup-tunnel step=start brand="${BRAND}" port="${PORT}" hostnames="${
 CFG_DIR="${HOME}/.${BRAND}/cloudflared"
 mkdir -p "${CFG_DIR}"
 
-# Per-brand X display (Task 553). Each brand owns its own Xtigervnc display
+# Per-brand X display. Each brand owns its own Xtigervnc display
 # so the Chromium tab opened to drive the OAuth Authorize click lands in
 # THIS brand's isolated VNC, not whichever brand booted first on a shared
 # device. Read from the brand manifest if MAXY_PLATFORM_ROOT is exported
@@ -117,14 +117,14 @@ if [ -n "${SETUP_TUNNEL_BRAND_JSON}" ] && command -v jq >/dev/null 2>&1; then
   fi
 fi
 
-# Task 929 — read the install-time-resolved non-snap Chromium binary path so
+# read the install-time-resolved non-snap Chromium binary path so
 # the OAuth-URL spawn below uses the same binary vnc.sh's start_chrome runs.
 # Hardcoded `/usr/bin/chromium` would re-introduce the snap-AppArmor failure
 # on Ubuntu Noble laptop. The installer writes this file under platform/config/
 # during installSystemDeps; the spawn at step=browser-spawn fails loud if the
 # file is absent rather than silently falling back to /usr/bin/chromium.
 #
-# Task 957 — four discrete branches (env-unset / file-missing / file-empty /
+# four discrete branches (env-unset / file-missing / file-empty /
 # binary-not-executable) so the failure message names the actual condition.
 # Pre-957 the four were conflated into one "cannot resolve a non-snap Chromium
 # binary" message, which masked the env-propagation defect that closed three
@@ -179,11 +179,11 @@ fi
 #                                                   click, poll for cert.pem,
 #                                                   mv.
 #
-# Control flow when both certs are missing (Task 858 — wrappers faithfully
+# Control flow when both certs are missing
 # relay third-party CLI):
 #   1. Spawn cloudflared with stdout+stderr teed line-by-line to
 #      $STREAM_LOG_PATH with prefix [script:setup-tunnel:cloudflared]
-#      (Task 605's chat-surface namespace — see _stream-log.sh header).
+#      (the chat-surface namespace — see _stream-log.sh header).
 #   2. Extract the authorize URL with a tolerant regex as it streams.
 #   3. The instant the URL is extracted, mechanically open it on the Pi
 #      VNC chromium via `DISPLAY=${DISPLAY:-${BRAND_VNC_DISPLAY}} /usr/bin/chromium <url> &`.
@@ -203,7 +203,7 @@ fi
 # Every failure branch exits 1 loudly naming the cause.
 # --------------------------------------------------------------------------
 
-# Pre-flight cert-promotion (Task 855). When ${CFG_DIR}/cert.pem is missing
+# Pre-flight cert-promotion. When ${CFG_DIR}/cert.pem is missing
 # but the OAuth-default ~/.cloudflared/cert.pem is present, a prior run
 # reached the cloudflared callback but did not survive to the brand-scoped
 # mv at the end of Step 1. The cert is bound to the account already; the
@@ -252,7 +252,7 @@ if [ ! -f "${CFG_DIR}/cert.pem" ]; then
   CHROMIUM_UNIT=""
   cleanup_oauth() {
     [ -n "${CF_PIPELINE_PID}" ] && kill "${CF_PIPELINE_PID}" 2>/dev/null || true
-    # Task 982 — stop the transient chromium unit on any early exit between
+    # stop the transient chromium unit on any early exit between
     # browser-spawn and the explicit step=browser-close site below. Best-
     # effort: no phase_line here because the EXIT trap fires on every path
     # (including the happy one where step=browser-close already ran and
@@ -318,14 +318,14 @@ if [ ! -f "${CFG_DIR}/cert.pem" ]; then
   # to re-target the same URL on the VNC; same end-effect as this spawn.
   printf 'OAUTH_URL: %s\n' "${AUTH_URL}"
 
-  # Mechanically open the URL on the Pi VNC chromium (Task 858). Chromium
+  # Mechanically open the URL on the Pi VNC chromium. Chromium
   # is already running on this brand's ${BRAND_VNC_DISPLAY} with CDP enabled
   # (vnc.sh start_chrome at boot); invoking the resolved binary <url> against
   # a running instance IPCs the URL into it as a new tab. Replaces
   # cloudflared's own optimistic xdg-open, which does not reliably target
   # the brand's VNC display in this environment.
   #
-  # Task 982 — chromium is launched under a transient systemd-user unit so
+  # chromium is launched under a transient systemd-user unit so
   # the full process tree (including any standalone chromium that lands
   # when no existing instance is running for IPC) lives in its own cgroup.
   # On cert.pem arrival the unit is stopped, SIGTERMing the whole cgroup
@@ -338,7 +338,7 @@ if [ ! -f "${CFG_DIR}/cert.pem" ]; then
   # Binary path: SETUP_TUNNEL_CHROMIUM_BIN is read at startup from
   # ${MAXY_PLATFORM_ROOT}/config/chromium-binary.path — `/usr/bin/chromium`
   # on Pi Bookworm and `/usr/bin/google-chrome-stable` on Ubuntu Noble laptop
-  # where the system chromium is snap-confined (Task 929). Hardcoding
+  # where the system chromium is snap-confined. Hardcoding
   # `/usr/bin/chromium` here would re-introduce the AppArmor SingletonLock
   # failure on the laptop.
   CHROMIUM_UNIT="maxy-oauth-chromium-${BRAND}-$$.service"
@@ -400,7 +400,7 @@ if [ ! -f "${CFG_DIR}/cert.pem" ]; then
     # Heartbeat every 2 s after the click. t=0 is the browser-drive
     # phase line above; the first heartbeat fires at t=2. Without this line
     # the tailer sees silence for the full 1-20 s round-trip — the exact
-    # state Task 588 forbids.
+    # state the heartbeat contract forbids.
     if [ "${LOGIN_WAIT}" -gt 0 ] && [ $((LOGIN_WAIT % 2)) -eq 0 ]; then
       phase_line setup-tunnel step=oauth-login result=awaiting-cert \
         elapsed="${LOGIN_WAIT}s" timeout="${LOGIN_TIMEOUT}s"
@@ -413,7 +413,7 @@ if [ ! -f "${CFG_DIR}/cert.pem" ]; then
   phase_line setup-tunnel step=oauth-login result=ok \
     path="${CFG_DIR}/cert.pem" waited="${LOGIN_WAIT}s"
 
-  # Task 982 — SIGTERM the OAuth chromium cgroup now that cert.pem has
+  # SIGTERM the OAuth chromium cgroup now that cert.pem has
   # landed. The transient unit was created above at step=browser-spawn; if
   # chromium IPCs'd to a running brand-VNC instance and exited cleanly, the
   # unit is already auto-collected and `systemctl stop` returns 0 (no-such-
@@ -454,7 +454,7 @@ if [ ! -f "${CFG_DIR}/cert.pem" ]; then
 fi
 
 # --------------------------------------------------------------------------
-# Step 2+3: Resolve the tunnel identity from operator input (Task 886 §B).
+# Step 2+3: Resolve the tunnel identity from operator input.
 #
 # Pre-Task-886 the script derived TUNNEL_NAME locally as "${BRAND}-$(hostname
 # -s)" and reused-or-created. That breaks the same doctrine as pre-Task-589
@@ -538,10 +538,10 @@ echo "tunnel: ${TUNNEL_NAME} (${TUNNEL_ID}) [${TUNNEL_SOURCE}]"
 # parent zone is not on Cloudflare, refuse the whole run before calling
 # `cloudflared tunnel route dns`.
 #
-# DESIGN NOTE — what this catches and what it does NOT catch (Task 559):
+# DESIGN NOTE — what this catches and what it does NOT catch:
 #   CATCHES: parent zone does not exist, or its NS records do not point
 #     at Cloudflare's nameservers. Pre-529 the shell relied on a post-
-#     flight sed of cloudflared's stdout for this defence; Task 559
+#     flight sed of cloudflared's stdout for this defence
 #     deletes that parser because it rejects the idempotent no-op output
 #     shape (session 25674fe3) and replaces it with this inline NS probe.
 #     Same primitive the MCP path uses in
@@ -552,7 +552,7 @@ echo "tunnel: ${TUNNEL_NAME} (${TUNNEL_ID}) [${TUNNEL_SOURCE}]"
 #     exist as of 2026-04) or persisting the bound account's zones at
 #     tunnel-login time (deferred — separate task). The wrong-account
 #     case is detected post-hoc by tunnel-status's hostname probe, not
-#     here. This is an explicitly accepted gap per Task 559's scope.
+#     here. This is an explicitly accepted gap per the scope.
 #
 # Probe uses 1.1.1.1 directly to bypass the device's local resolver
 # (matching Resolver.setServers in the MCP path) — avoids cache /
@@ -628,7 +628,7 @@ phase_line setup-tunnel step=zone-preflight result=ok \
 # another zone on the account. Skip CLI routing for apex; collect for the
 # ACTION REQUIRED summary at the end.
 #
-# Control flow (Task 559): cloudflared's exit code is the sole decision
+# Control flow: cloudflared's exit code is the sole decision
 # signal. No stdout parsing. `cloudflared tunnel route dns --overwrite-dns`
 # exits 0 on every legitimate outcome (create, overwrite, already-correct
 # no-op) and non-zero on every legitimate failure. The pre-flight above
@@ -651,7 +651,7 @@ for H in "${HOSTNAMES[@]}"; do
   ROUTE_LOG="$(mktemp -t maxy-route-dns.XXXXXX)"
   # tee_subprocess_capture streams cloudflared's combined stdout+stderr
   # into STREAM_LOG_PATH line-by-line with the [script:setup-tunnel:cloudflared]
-  # tag (live-tailable — Task 605 chat-surface namespace) AND passes the same output through this shell's
+  # tag (live-tailable chat-surface namespace) AND passes the same output through this shell's
   # stdout so the `> "${ROUTE_LOG}"` redirection can capture it for the
   # failure-path phase_line. Exit code is cloudflared's PIPESTATUS[0].
   if tee_subprocess_capture setup-tunnel:cloudflared -- \
@@ -673,7 +673,7 @@ for H in "${HOSTNAMES[@]}"; do
 done
 
 # --------------------------------------------------------------------------
-# Task 009 — Rehydrate SSH/SMB hostnames from tunnel.state when env unset.
+# Rehydrate SSH/SMB hostnames from tunnel.state when env unset.
 #
 # A re-run without SSH_HOSTNAME / SMB_HOSTNAME should keep the previously
 # configured ingress rather than silently dropping them. The Node helper
@@ -703,9 +703,9 @@ if [ -z "${SSH_HOSTNAME}${SMB_HOSTNAME}" ] && [ -f "${CFG_DIR}/tunnel.state" ];
 fi
 
 # --------------------------------------------------------------------------
-# Task 009 — Samba presence probe (gates SMB ingress on Task 034 stanza).
+# Samba presence probe (gates SMB ingress stanza).
 #
-# Per Task 034, the brand's Samba stanza `[<brand>]` is written to
+#, the brand's Samba stanza `[<brand>]` is written to
 # /etc/samba/smb.conf at install time. If the stanza is absent, this Pi
 # has no SMB share to expose and the SMB ingress is skipped loudly.
 # Probe via grep on the Pi filesystem (NOT brand.json — Samba is a
@@ -724,7 +724,7 @@ if [ -n "${SMB_HOSTNAME}" ]; then
 fi
 
 # --------------------------------------------------------------------------
-# Task 009 — Step 4b: Route DNS for SSH/SMB hostnames (after HTTPS pass).
+# Step 4b: Route DNS for SSH/SMB hostnames (after HTTPS pass).
 #
 # Two-phase ordering: HTTPS hostnames are routed first (loop above). If a
 # subsequent SSH or SMB route DNS fails, emit `*-ingress-deferred` and
@@ -858,7 +858,7 @@ fi
 rm -f "${STATE_SPEC_FILE}"
 
 # --------------------------------------------------------------------------
-# Task 009 — Access policy ACTION REQUIRED.
+# Access policy ACTION REQUIRED.
 #
 # The Cloudflare Access policy that gates these new SSH/SMB hostnames must
 # be authored in the dashboard by the operator: CF API/SDK is banned
@@ -918,7 +918,7 @@ fi
 # admin agent invokes it via the Bash tool. `systemctl --user restart
 # ${BRAND}.service` from inside that cgroup SIGTERMs the whole cgroup —
 # the node server, the claude subprocess, the Bash child, and this script
-# itself (Task 558). Dispatching the restart to a transient systemd-run
+# itself. Dispatching the restart to a transient systemd-run
 # unit is the ONLY primitive that creates a new cgroup outside the service
 # — setsid/nohup/disown/& all inherit cgroup membership, and
 # `systemd-run --scope` runs in the caller's scope.

package/payload/platform/plugins/cloudflare/scripts/tunnel-ingress.ts

@@ -1,4 +1,4 @@
-// Task 009 — Pure tunnel-ingress rendering + state I/O.
+// Pure tunnel-ingress rendering + state I/O.
 //
 // Mirror of `samba-provision.ts`: pure decision functions in this file with
 // no side effects; `setup-tunnel.sh` orchestrates I/O around them. Invoked
@@ -24,7 +24,7 @@
 
 import { readFileSync, existsSync, appendFileSync } from "node:fs";
 
-// Task 054 — STREAM_LOG_PATH writer (Task 598/600 contract). The four CLI
+// STREAM_LOG_PATH writer (contract). The four CLI
 // subcommands invoked from setup-tunnel.sh (probe-samba, render-config,
 // render-state, action-req) emit a `phase=<cmd>-start` line on entry and
 // `phase=<cmd>-ok` / `phase=<cmd>-fail` on exit. Pattern ported verbatim
@@ -156,8 +156,8 @@ export function readPersistedHostnames(statePath: string): {
 // ---------------------------------------------------------------------------
 
 /**
- * Probe whether Task 034's per-brand Samba stanza exists in /etc/samba/smb.conf.
- * The brand stanza header is `[<brand>]` at the start of a line (Task 034's
+ * Probe whether the per-brand Samba stanza exists in /etc/samba/smb.conf.
+ * The brand stanza header is `[<brand>]` at the start of a line (the
  * `renderBrandStanza` output). Source of truth is the Pi filesystem, not
  * brand.json — Samba is provisioned by the installer's post-install step,
  * not declared up-front.
@@ -244,7 +244,7 @@ const isCli =
 
 if (isCli) {
   const [, , cmd, ...rest] = process.argv;
-  // Track which subcommands carry the Task 054 stream-log contract — for these
+  // Track which subcommands carry the stream-log contract — for these
   // we emit start/ok/fail phase pairs. Unknown subcommands and read-state are
   // out of scope per the task (read-state has no setup-tunnel.sh caller line).
   const instrumented = new Set(["probe-samba", "render-config", "render-state", "action-req"]);

package/payload/platform/plugins/cloudflare/skills/setup-tunnel/SKILL.md

@@ -22,7 +22,7 @@ Any Cloudflare action outside these four surfaces is a discipline violation —
 
 Use this when the operator wants Cloudflare set up (or re-set up) end-to-end on the device. The script handles OAuth login, tunnel creation, DNS routing for each subdomain, config.yml + tunnel.state, and dispatches the `${BRAND}.service` restart to a transient `systemd-run` unit — all in one invocation. The restart fires a few seconds after the script exits so the script does not kill its own cgroup when invoked via the Bash tool; the chat UI receives a `server_shutdown` SSE frame and reconnects automatically. Post-restart hostname verification is out of scope for the script (connector is not up when the script exits) — verify via the next admin turn or manually with `curl -I https://<hostname>`. Apex hostnames cannot be routed by the CLI; when one is passed, the script prints an `ACTION REQUIRED` block naming the exact dashboard record to edit.
 
-Step 1's OAuth flow is a state machine over two observable variables: the brand-scoped cert path (`${CFG_DIR}/cert.pem`) and the OAuth-default cert path (`~/.cloudflared/cert.pem`). When the brand-scoped cert is missing but the default-path cert is present from any prior partial run, the wrapper promotes it (`mv`) and emits `step=oauth-login result=ok reason=cert-promoted-from-default-path` without re-spawning cloudflared. When both are missing, the wrapper spawns `cloudflared tunnel login`, extracts the argotunnel URL from its stdout, and the instant the URL surfaces, mechanically opens it on the brand's VNC chromium under a transient `systemd-run --user --unit=maxy-oauth-chromium-${BRAND}-$$.service` so the chromium process tree lives in its own cgroup (Task 982 — pre-Task-982 the spawn was `&` fire-and-forget and orphaned chromium on display `:101` when no pre-existing brand-VNC chromium was available for IPC). The launch uses the install-time-resolved binary (`SETUP_TUNNEL_CHROMIUM_BIN` from `${MAXY_PLATFORM_ROOT}/config/chromium-binary.path` so Ubuntu Noble laptop's snap-replaced Google Chrome is honoured per Task 929) — emitting `step=browser-spawn result=ok unit=<transient-unit>` and `step=browser-drive mode=operator-click`. The operator clicks the zone row + Authorize on the VNC; cloudflared's callback writes `~/.cloudflared/cert.pem`; the wrapper's cert-poll (180 s budget) picks it up and `mv`s it to the brand-scoped path; the wrapper then `systemctl --user stop`s the transient unit, emitting `step=browser-close result=ok` (or `result=orphan reason=stop-failed` when SIGTERM didn't reach the cgroup — operator-visible signal that an orphan chromium MAY still be alive). There is no CDP auto-click, no DOM matcher, no consent-page driver — the wrapper's job is to faithfully relay `cloudflared tunnel login`, never to layer automation on top.
+Step 1's OAuth flow is a state machine over two observable variables: the brand-scoped cert path (`${CFG_DIR}/cert.pem`) and the OAuth-default cert path (`~/.cloudflared/cert.pem`). When the brand-scoped cert is missing but the default-path cert is present from any prior partial run, the wrapper promotes it (`mv`) and emits `step=oauth-login result=ok reason=cert-promoted-from-default-path` without re-spawning cloudflared. When both are missing, the wrapper spawns `cloudflared tunnel login`, extracts the argotunnel URL from its stdout, and the instant the URL surfaces, mechanically opens it on the brand's VNC chromium under a transient `systemd-run --user --unit=maxy-oauth-chromium-${BRAND}-$$.service` so the chromium process tree lives in its own cgroup (earlier the spawn was `&` fire-and-forget and orphaned chromium on display `:101` when no pre-existing brand-VNC chromium was available for IPC). The launch uses the install-time-resolved binary (`SETUP_TUNNEL_CHROMIUM_BIN` from `${MAXY_PLATFORM_ROOT}/config/chromium-binary.path` so Ubuntu Noble laptop's snap-replaced Google Chrome is honoured) — emitting `step=browser-spawn result=ok unit=<transient-unit>` and `step=browser-drive mode=operator-click`. The operator clicks the zone row + Authorize on the VNC; cloudflared's callback writes `~/.cloudflared/cert.pem`; the wrapper's cert-poll (180 s budget) picks it up and `mv`s it to the brand-scoped path; the wrapper then `systemctl --user stop`s the transient unit, emitting `step=browser-close result=ok` (or `result=orphan reason=stop-failed` when SIGTERM didn't reach the cgroup — operator-visible signal that an orphan chromium MAY still be alive). There is no CDP auto-click, no DOM matcher, no consent-page driver — the wrapper's job is to faithfully relay `cloudflared tunnel login`, never to layer automation on top.
 
 ### How inputs reach the script
 
@@ -46,7 +46,7 @@ Example ({{productName}} on `maxy.bot` with a public subdomain and the `maxy.cha
 ~/setup-tunnel.sh maxy 19200 admin.maxy.bot public.maxy.bot maxy.chat
 ```
 
-### Optional SSH and SMB ingress (Task 009)
+### Optional SSH and SMB ingress
 
 The same script also wires the off-LAN SSH and SMB ingress when the
 corresponding hostnames are passed via environment variables (NOT positional
@@ -66,7 +66,7 @@ Behaviour:
   `[tunnel-install] {ssh,smb}-ingress-deferred` and leaves the HTTPS
   ingress durable (no rollback, no `exit 1`).
 - `SSH_HOSTNAME` adds an ingress entry `service: ssh://localhost:22`.
-- `SMB_HOSTNAME` adds `service: tcp://localhost:445`, gated on Task 034's
+- `SMB_HOSTNAME` adds `service: tcp://localhost:445`, gated's
   Samba stanza being present in `/etc/samba/smb.conf`. Absent stanza →
   `[tunnel-install] smb-ingress-skipped reason=samba-not-provisioned` and
   the SMB pass is skipped entirely.

package/payload/platform/plugins/contacts/mcp/dist/lib/neo4j.js

@@ -15,8 +15,8 @@ function readPassword() {
 }
 export function getDriver() {
     if (!driver) {
-        // Task 580: NEO4J_URI must be explicit. Silent default to :7687 was the
-        // vector for Task 577's orphan data in Maxy's DB from a realagent install.
+        // NEO4J_URI must be explicit. Silent default to:7687 was the
+        // vector for the orphan data in Maxy's DB from a realagent install.
         const uri = process.env.NEO4J_URI;
         if (!uri) {
             throw new Error("[contacts] NEO4J_URI unset — refusing to default to bolt://localhost:7687");

package/payload/platform/plugins/contacts/mcp/dist/lib/neo4j.js.map

@@ -1 +1 @@
-{"version":3,"file":"neo4j.js","sourceRoot":"","sources":["../../src/lib/neo4j.ts"],"names":[],"mappings":"AAAA,OAAO,KAA0B,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,IAAI,MAAM,GAAkB,IAAI,CAAC;AAEjC,SAAS,YAAY;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAElE,MAAM,YAAY,GAAG,OAAO,CAC1B,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EACxE,wBAAwB,CACzB,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,yCAAyC,YAAY,gCAAgC,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC;QAC/C,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"neo4j.js","sourceRoot":"","sources":["../../src/lib/neo4j.ts"],"names":[],"mappings":"AAAA,OAAO,KAA0B,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,IAAI,MAAM,GAAkB,IAAI,CAAC;AAEjC,SAAS,YAAY;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAElE,MAAM,YAAY,GAAG,OAAO,CAC1B,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EACxE,wBAAwB,CACzB,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,yCAAyC,YAAY,gCAAgC,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,6DAA6D;QAC7D,oEAAoE;QACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC;QAC/C,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/payload/platform/plugins/contacts/mcp/dist/lib/resolve-person.d.ts

@@ -8,7 +8,7 @@
  * Used by: contact-delete, contact-update, contact-export, contact-erase.
  * NOT used by: contact-create (dedup OR logic), contact-lookup (name search).
  *
- * Task 602 — trashed Person nodes are excluded by default. `contact-erase`
+ * trashed Person nodes are excluded by default. `contact-erase`
  * passes `includeTrashed: true` because GDPR Article 17 must cascade-delete
  * trashed persons too (they were marked but not yet emptied). Trashed
  * persons also have nulled email/telephone (UNIQUE_KEYS_BY_LABEL snapshot),

package/payload/platform/plugins/contacts/mcp/dist/lib/resolve-person.js

@@ -8,7 +8,7 @@
  * Used by: contact-delete, contact-update, contact-export, contact-erase.
  * NOT used by: contact-create (dedup OR logic), contact-lookup (name search).
  *
- * Task 602 — trashed Person nodes are excluded by default. `contact-erase`
+ * trashed Person nodes are excluded by default. `contact-erase`
  * passes `includeTrashed: true` because GDPR Article 17 must cascade-delete
  * trashed persons too (they were marked but not yet emptied). Trashed
  * persons also have nulled email/telephone (UNIQUE_KEYS_BY_LABEL snapshot),

package/payload/platform/plugins/contacts/mcp/dist/tools/contact-create.js

@@ -28,7 +28,7 @@ export async function contactCreate(params) {
     try {
         // Dedup only fires when a stable identifier (email/telephone) is present.
         // With no identifier the agent has explicitly chosen to write a sparse
-        // Person; dedup/conflict resolution moves downstream (Task 894 doctrine:
+        // Person; dedup/conflict resolution moves downstream
         // "agent and user manage dedup and conflicts").
         const dedupConditions = [];
         const dedupParams = { accountId };
@@ -85,7 +85,7 @@ export async function contactCreate(params) {
         if (embedding.length > 0) {
             props.embedding = embedding;
         }
-        // Task 997 — direct admin asks ("add Anneke as person") need a PRODUCED
+        // direct admin asks ("add Anneke as person") need a PRODUCED
         // edge from the active :AdminConversation rather than a synthetic :Task.
         // The admin server stamps `CONVERSATION_NODE_ID` in the spawn env; the
         // helper resolves the node, verifies accountId parity, and prepends the

package/payload/platform/plugins/contacts/mcp/dist/tools/contact-create.js.map

@@ -1 +1 @@
-{"version":3,"file":"contact-create.js","sourceRoot":"","sources":["../../src/tools/contact-create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,8CAA8C,CAAC;AAC1E,OAAO,EACL,kBAAkB,EAClB,4BAA4B,GAG7B,MAAM,8CAA8C,CAAC;AAEtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,wBAAwB,CAAC;AACtE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC;AAElE,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,YAAY,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;QAC9D,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAuBD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B;IAE3B,MAAM,EACJ,SAAS,EACT,UAAU,EACV,KAAK,EACL,SAAS,EACT,QAAQ,EACR,MAAM,EACN,MAAM,GAAG,UAAU,EACnB,SAAS,EACT,aAAa,EACb,SAAS,GACV,GAAG,MAAM,CAAC;IAEX,MAAM,eAAe,GAAG,KAAK,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC;IAE1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,gDAAgD;QAChD,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,MAAM,WAAW,GAA4B,EAAE,SAAS,EAAE,CAAC;QAE3D,IAAI,eAAe,EAAE,CAAC;YACpB,eAAe,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACzC,WAAW,CAAC,KAAK,GAAG,eAAe,CAAC;QACtC,CAAC;QACD,IAAI,eAAe,EAAE,CAAC;YACpB,eAAe,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACjD,WAAW,CAAC,SAAS,GAAG,eAAe,CAAC;QAC1C,CAAC;QAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,oDAAoD;YACpD,sEAAsE;YACtE,qEAAqE;YACrE,sCAAsC;YACtC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC;kBACU,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,UAAU,CAAC,GAAG,CAAC;mFACa,EAC3E,WAAW,CACZ,CAAC;YAEF,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAkB,CAAC;gBACvE,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAEhD,CAAC;gBACT,MAAM,iBAAiB,GAAG,YAAY,IAAI,YAAY,IAAI,SAAS,CAAC;gBAEpE,OAAO;oBACL,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAW;oBACnD,UAAU,EAAE,iBAAiB;oBAC7B,OAAO,EAAE,KAAK;oBACd,aAAa,EAAE,IAAI;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAA4B;YACrC,MAAM;YACN,MAAM;YACN,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,SAAS;YAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3C,IAAI,eAAe;YAAE,KAAK,CAAC,KAAK,GAAG,eAAe,CAAC;QACnD,IAAI,eAAe;YAAE,KAAK,CAAC,SAAS,GAAG,eAAe,CAAC;QACvD,IAAI,UAAU;YAAE,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QAC9C,IAAI,QAAQ;YAAE,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAExC,MAAM,cAAc,GAAG,eAAe;YACpC,CAAC,CAAC,IAAI,eAAe,GAAG;YACxB,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,MAAM,gBAAgB,GACpB,WAAW,QAAQ,IAAI,WAAW,IAAI,cAAc,YAAY,MAAM,YAAY,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QACpG,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC3D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC9B,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,kCAAkC;QAClC,MAAM,qBAAqB,GAAG,MAAM,4BAA4B,CAAC;YAC/D,OAAO;YACP,aAAa;YACb,SAAS,EAAE,SAAS,IAAI,EAAE;YAC1B,WAAW,EAAE,CAAC,QAAQ,CAAC;YACvB,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YACpD,YAAY,EAAE,cAAc;YAC5B,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACtC,OAAO;YACP,MAAM,EAAE,CAAC,QAAQ,CAAC;YAClB,KAAK;YACL,aAAa,EAAE,qBAAqB;YACpC,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzE,MAAM,iBAAiB,GACrB,eAAe,IAAI,eAAe,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC,CAAC;QAEtE,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,iBAAiB;YAC7B,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,KAAK;SACrB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}
+{"version":3,"file":"contact-create.js","sourceRoot":"","sources":["../../src/tools/contact-create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,8CAA8C,CAAC;AAC1E,OAAO,EACL,kBAAkB,EAClB,4BAA4B,GAG7B,MAAM,8CAA8C,CAAC;AAEtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,wBAAwB,CAAC;AACtE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC;AAElE,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,YAAY,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;QAC9D,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAuBD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B;IAE3B,MAAM,EACJ,SAAS,EACT,UAAU,EACV,KAAK,EACL,SAAS,EACT,QAAQ,EACR,MAAM,EACN,MAAM,GAAG,UAAU,EACnB,SAAS,EACT,aAAa,EACb,SAAS,GACV,GAAG,MAAM,CAAC;IAEX,MAAM,eAAe,GAAG,KAAK,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC;IAE1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,0EAA0E;QAC1E,uEAAuE;QACvE,qDAAqD;QACrD,gDAAgD;QAChD,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,MAAM,WAAW,GAA4B,EAAE,SAAS,EAAE,CAAC;QAE3D,IAAI,eAAe,EAAE,CAAC;YACpB,eAAe,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACzC,WAAW,CAAC,KAAK,GAAG,eAAe,CAAC;QACtC,CAAC;QACD,IAAI,eAAe,EAAE,CAAC;YACpB,eAAe,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACjD,WAAW,CAAC,SAAS,GAAG,eAAe,CAAC;QAC1C,CAAC;QAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,oDAAoD;YACpD,sEAAsE;YACtE,qEAAqE;YACrE,sCAAsC;YACtC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC;kBACU,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,UAAU,CAAC,GAAG,CAAC;mFACa,EAC3E,WAAW,CACZ,CAAC;YAEF,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAkB,CAAC;gBACvE,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAEhD,CAAC;gBACT,MAAM,iBAAiB,GAAG,YAAY,IAAI,YAAY,IAAI,SAAS,CAAC;gBAEpE,OAAO;oBACL,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAW;oBACnD,UAAU,EAAE,iBAAiB;oBAC7B,OAAO,EAAE,KAAK;oBACd,aAAa,EAAE,IAAI;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAA4B;YACrC,MAAM;YACN,MAAM;YACN,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,SAAS;YAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3C,IAAI,eAAe;YAAE,KAAK,CAAC,KAAK,GAAG,eAAe,CAAC;QACnD,IAAI,eAAe;YAAE,KAAK,CAAC,SAAS,GAAG,eAAe,CAAC;QACvD,IAAI,UAAU;YAAE,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QAC9C,IAAI,QAAQ;YAAE,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAExC,MAAM,cAAc,GAAG,eAAe;YACpC,CAAC,CAAC,IAAI,eAAe,GAAG;YACxB,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,MAAM,gBAAgB,GACpB,WAAW,QAAQ,IAAI,WAAW,IAAI,cAAc,YAAY,MAAM,YAAY,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QACpG,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC3D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC9B,CAAC;QAED,6DAA6D;QAC7D,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,kCAAkC;QAClC,MAAM,qBAAqB,GAAG,MAAM,4BAA4B,CAAC;YAC/D,OAAO;YACP,aAAa;YACb,SAAS,EAAE,SAAS,IAAI,EAAE;YAC1B,WAAW,EAAE,CAAC,QAAQ,CAAC;YACvB,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YACpD,YAAY,EAAE,cAAc;YAC5B,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACtC,OAAO;YACP,MAAM,EAAE,CAAC,QAAQ,CAAC;YAClB,KAAK;YACL,aAAa,EAAE,qBAAqB;YACpC,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzE,MAAM,iBAAiB,GACrB,eAAe,IAAI,eAAe,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC,CAAC;QAEtE,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,iBAAiB;YAC7B,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,KAAK;SACrB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}

package/payload/platform/plugins/contacts/mcp/dist/tools/group-create.js

@@ -30,7 +30,7 @@ export async function groupCreate(params) {
         }
         // Pre-resolve every participant so we reject the whole call if fewer
         // than one matches — creating a group Conversation with zero live
-        // participants is a write-doctrine orphan (Task 673). Participant
+        // participants is a write-doctrine orphan. Participant
         // PARTICIPATES_IN edges are added inside the same transaction as the
         // Conversation node to guarantee ≥1 adjacency at commit time.
         const resolvedParticipants = [];

package/payload/platform/plugins/contacts/mcp/dist/tools/group-create.js.map

@@ -1 +1 @@
-{"version":3,"file":"group-create.js","sourceRoot":"","sources":["../../src/tools/group-create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,8CAA8C,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAkB,MAAM,8CAA8C,CAAC;AAE9F,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,IAAI;SACd,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,IAAI,IAAI,OAAO,CAAC;AACzB,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAyB;IACzD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAE5E,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,cAAc,GAAG,UAAU,EAAE,CAAC;IACpC,IAAI,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,qEAAqE;QACrE,8DAA8D;QAC9D,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC;eACS,UAAU,CAAC,GAAG,CAAC;8BACA,EACxB,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAC/B,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7D,SAAS,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACzD,CAAC;QAED,qEAAqE;QACrE,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,oBAAoB,GAAuE,EAAE,CAAC;QACpG,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CACzB;;;;iBAIS,UAAU,CAAC,GAAG,CAAC;gEACgC,EACxD,EAAE,SAAS,EAAE,UAAU,EAAE,CAC1B,CAAC;YACF,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,oBAAoB,CAAC,IAAI,CAAC;oBACxB,UAAU;oBACV,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAW;oBAC1C,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAW;iBAC9C,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,sEAAsE,YAAY,CAAC,MAAM,oBAAoB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iEAAiE,CAClM,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,cAAc,CAC/B;YACE,cAAc;YACd,SAAS;YACT,SAAS,EAAE,QAAQ;YACnB,SAAS;YACT,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,OAAO;YACb,SAAS;YACT,SAAS;YACT,SAAS,EAAE,OAAO;SACnB,EACD,SAAS,CACV,CAAC;QAEF,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACtC,MAAM,EAAE,CAAC,GAAG,CACV;;;;;;4EAMoE,EACpE;gBACE,KAAK,EAAE,UAAU;gBACjB,cAAc,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;aAC5D,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CACnC;qCAC+B,EAC/B,EAAE,SAAS,EAAE,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,CAAuB,CAAC;QAC/E,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACtE,MAAM,YAAY,GAAG,GAAG,OAAO,MAAM,SAAS,EAAE,CAAC;QAEjD,OAAO,CAAC,KAAK,CACX,sBAAsB,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,SAAS,iBAAiB,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAChK,CAAC;QAEF,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}
+{"version":3,"file":"group-create.js","sourceRoot":"","sources":["../../src/tools/group-create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,8CAA8C,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAkB,MAAM,8CAA8C,CAAC;AAE9F,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,IAAI;SACd,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,IAAI,IAAI,OAAO,CAAC;AACzB,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAyB;IACzD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAE5E,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,cAAc,GAAG,UAAU,EAAE,CAAC;IACpC,IAAI,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,qEAAqE;QACrE,8DAA8D;QAC9D,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC;eACS,UAAU,CAAC,GAAG,CAAC;8BACA,EACxB,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAC/B,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7D,SAAS,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACzD,CAAC;QAED,qEAAqE;QACrE,kEAAkE;QAClE,uDAAuD;QACvD,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,oBAAoB,GAAuE,EAAE,CAAC;QACpG,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CACzB;;;;iBAIS,UAAU,CAAC,GAAG,CAAC;gEACgC,EACxD,EAAE,SAAS,EAAE,UAAU,EAAE,CAC1B,CAAC;YACF,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,oBAAoB,CAAC,IAAI,CAAC;oBACxB,UAAU;oBACV,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAW;oBAC1C,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAW;iBAC9C,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,sEAAsE,YAAY,CAAC,MAAM,oBAAoB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iEAAiE,CAClM,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,cAAc,CAC/B;YACE,cAAc;YACd,SAAS;YACT,SAAS,EAAE,QAAQ;YACnB,SAAS;YACT,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,OAAO;YACb,SAAS;YACT,SAAS;YACT,SAAS,EAAE,OAAO;SACnB,EACD,SAAS,CACV,CAAC;QAEF,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACtC,MAAM,EAAE,CAAC,GAAG,CACV;;;;;;4EAMoE,EACpE;gBACE,KAAK,EAAE,UAAU;gBACjB,cAAc,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;aAC5D,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CACnC;qCAC+B,EAC/B,EAAE,SAAS,EAAE,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,CAAuB,CAAC;QAC/E,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACtE,MAAM,YAAY,GAAG,GAAG,OAAO,MAAM,SAAS,EAAE,CAAC;QAEjD,OAAO,CAAC,KAAK,CACX,sBAAsB,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,SAAS,iBAAiB,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAChK,CAAC;QAEF,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}

package/payload/platform/plugins/docs/references/deployment.md

@@ -52,7 +52,36 @@ Grep for both in `~/.<brand>/logs/install-*.log`. Absence after a clean install
 
 The first user-domain write the agent attempts (e.g. recording who the operator is) hits the graph-write gate's `Write blocked (no-admin-user)` or `Write blocked (no-local-business)` error. The agent then asks the persona question, persists the answer through the `business-profile` skill or `profile-update.personFields`, and proceeds. The error itself is the signal — grep `Write blocked` in `~/.<brand>/logs/server.log` to confirm.
 
-Cloudflare, WhatsApp, Telegram, and any other dormant capability surfaces on owner request via the `<dormant-plugins>` rule in `platform/templates/agents/admin/IDENTITY.md`. Execution is the existing plugin skill (`cloudflare:setup-tunnel`, etc.) — no banner, no per-step flag.
+Cloudflare, WhatsApp, Telegram, and any other dormant capability surfaces on owner request via the `<dormant-plugins>` sentinel the manager injects per-spawn. Execution is the existing plugin skill (`cloudflare:setup-tunnel`, etc.) — no banner, no per-step flag.
+
+### Per-spawn system-prompt sentinels
+
+Every PTY spawn injects an `--append-system-prompt` block composed of six sentinel sections in fixed order:
+
+| Sentinel | Source | Behaviour on resolve failure |
+|---|---|---|
+| `<host>` | brand.json + boot-time LAN resolution | spawn refuses with `host-context-unresolved` |
+| `<attachment-ceiling>` | hard-coded 30 MiB rule | always present |
+| `<identity>` | `<accountDir>/agents/<role>/IDENTITY.md` | spawn refuses with `identity-unresolved` |
+| `<soul>` | `<accountDir>/agents/<role>/SOUL.md` | spawn refuses with `identity-unresolved` |
+| `<about-owner>` | upstream `loadUserProfile` + `formatProfileSummary` (UI process) | sentinel carries `coverage-unresolved: <reason>`; spawn proceeds |
+| `<dormant-plugins>` | installed-minus-enabled set from `platform/plugins/` and `account.json` | sentinel omitted when set is empty |
+
+Diagnostic line per spawn (`~/.<brand>/logs/server.log`):
+
+```
+[pty-spawn] sessionId=<id> appendSystemPromptBytes=<n> identityBytes=<n> soulBytes=<n> aboutOwnerBytes=<n> dormantPluginsBytes=<n> accountDir=<path> role=<admin|public> hostname=<h> lanIPv4=<ip> adminUrl=<url> tunnelUrl=<url|none>
+```
+
+Zero `aboutOwnerBytes` on a fresh-account spawn (sparse profile) is a regression: the upstream resolver returned ok:false with a reason, and the operator should see `coverage-unresolved: <reason>` in the agent's first turn. Zero `dormantPluginsBytes` on a Maxy install with `cloudflare` not enabled is likewise a regression.
+
+The manager also runs a boot-time self-test that renders a fixture compose call against synthetic inputs and refuses to start if any sentinel is missing:
+
+```
+[claude-session-manager] startup-self-test system-prompt-sentinels=ok
+```
+
+LOUD-FAIL output is `startup-self-test system-prompt-sentinels=fail missing=<tag>` followed by an immediate process exit. Catches IDENTITY-promise-vs-emitter drift at boot rather than at the first real spawn.
 
 ## Service Management
 

package/payload/platform/plugins/docs/references/plugins-guide.md

@@ -18,7 +18,6 @@ These are part of {{productName}}'s foundation and cannot be disabled:
 | `memory` | Graph memory — search, write, reindex, and ingest knowledge |
 | `maxy-guide` | User guide and platform documentation (this plugin) |
 | `cloudflare` | Cloudflare Tunnel — remote access via your custom domain |
-| `anthropic` | Claude connection — API key acquisition and configuration |
 | `scheduling` | Calendar and scheduling — events, appointments, recurring triggers. Any activity involving time (date, timestamp, day of week, month, duration) routes through `time-resolve` first. Two read-only tools (`current-datetime`, `time-resolve`) are always available to every public agent regardless of enabled plugins. |
 | `email` | Agent email account — setup, read, send, reply, search, auto-respond |
 | `tasks` | Task lifecycle — create, update, list, relate, complete |
@@ -67,8 +66,6 @@ Install verbatim:
 - `claude plugin install meeting-prep-agent@claude-for-financial-services`
 - `claude plugin install pdf-viewer@knowledge-work-plugins`
 
-Onboarding observability for this group: Step 1 emits `[plugin-onboarding] group=anthropic-verticals presented=3` when the three entries are offered, then `[plugin-onboarding] group=anthropic-verticals accepted=<n> declined=<n>` when Step 1 completes — derived from your submission against the closed set above. Grep `~/.{productName}/logs/server.log` for the full prefix to see both halves of the funnel.
-
 ### Premium Plugins
 
 Brand decides which premium plugins ship. Maxy installs ship only `platform/plugins/*`. Real Agent installs ship every plugin under `platform/plugins/*` plus every bundle under `premium-plugins/*`. There is no per-account purchase record; brand identity is the gate.
@@ -76,12 +73,12 @@ Brand decides which premium plugins ship. Maxy installs ship only `platform/plug
 | Plugin | Type | What it does | Public agent |
 |--------|------|-------------|-------------|
 | `teaching` | Skills | Interactive tutoring, lesson planning, and study pack generation from your knowledge base | Yes — all 3 skills serve students and parents |
-| `real-agent` | Bundle (11 sub-plugins) | UK estate agency skills — sales, listings, vendor management, buyer management, lead generation, coaching, business operations, onboarding, teaching, Loop CRM, and property brochures. 3 specialist roles (negotiator, valuer, compliance) | 5 sub-plugins (estate-sales, buyers, estate-coaching, estate-teaching, estate-onboarding) |
+| `real-agent` | Bundle (10 sub-plugins) | UK estate agency skills — sales, listings, vendor management, buyer management, lead generation, coaching, business operations, teaching, Loop CRM, and property brochures. 3 specialist roles (negotiator, valuer, compliance) | 4 sub-plugins (estate-sales, buyers, estate-coaching, estate-teaching) |
 | `writer-craft` | Skills + Agent | Manuscript review and writing craft — story architecture, reader engagement, prose craft, editorial practice, and multi-level review | No — writing craft serves the author |
 
 **How it works:** Every boot {{productName}} delivers the brand's premium plugins from staging into `platform/plugins/` and stamps `enabledPlugins` against what is actually on disk. No conversation needed — the brand's full set is active from the first turn after install. Updates and reinstalls re-deliver from staging.
 
-Some premium plugins are **bundles** — multiple sub-plugins shipped under one directory in `premium-plugins/`, each independently activatable. For example, Real Agent ships 11 sub-plugins covering different aspects of estate agency work. They are all enabled by default. Sub-plugins you don't want active can be turned off individually with "disable <name>"; enabling or disabling individual sub-plugins does not affect the others.
+Some premium plugins are **bundles** — multiple sub-plugins shipped under one directory in `premium-plugins/`, each independently activatable. For example, Real Agent ships 10 sub-plugins covering different aspects of estate agency work. They are all enabled by default. Sub-plugins you don't want active can be turned off individually with "disable <name>"; enabling or disabling individual sub-plugins does not affect the others.
 
 If you ask {{productName}} about a tool from a plugin your brand does not ship (for example, a Maxy install asking about a Real Agent Loop CRM tool), {{productName}} responds with a structured `<tool-surface-error>` envelope naming the missing plugin and the remedy, rather than improvising with a generic alternative.
 

package/payload/platform/plugins/docs/references/troubleshooting.md

@@ -537,12 +537,12 @@ sudo systemctl --user start maxy-ui
 
 **Steady-state invariants at `/` (post-Task-067):**
 
-- `grep -c '\[admin-ui\] onboarding-banner-mount' ~/.maxy/logs/admin-ui-console.log` equals page-load count plus onboarding-flip count, not the render count. Sustained climb at idle means the banner mount log regressed back into the render body (Task 050 fix).
+- `grep -c '\[admin-ui\] onboarding-banner-mount' ~/.maxy/logs/admin-ui-console.log` equals page-load count plus onboarding-flip count, not the render count. Sustained climb at idle means the banner mount log regressed back into the render body (fix).
 - `grep -c '\[admin-ui\] sessions-poll' ~/.maxy/logs/admin-ui-console.log` over a 60-minute idle window equals zero. The hook no longer installs a `setInterval`; every `sessions-poll` line is operator-triggered (initial mount, refresh button, post-mutation refetch). One or more lines during operator idle means `setInterval` was reinstated.
 - `outcome=error` lines name a real fetch failure on an operator-triggered refetch, set the `error` field, and surface in the sidebar.
 
-**Reconcile signal (Task 067):**
+**Reconcile signal:**
 
 - `grep -c '\[admin-ui\] sidebar-meta-pane-reconcile' ~/.maxy/logs/admin-ui-console.log` should equal the count of End / Resume / Purge clicks while the metadata pane was open. A `to=gone` line without a paired Close click means the pane's auto-close logic regressed.
 
-**Why this matters.** The render-body log was misleading: it read as "the admin agent is checking onboarding state continuously", when in fact `onboardingComplete` had not changed at all. The Task 050 fix moved the log into `useEffect(…, [])`; Task 067 then dropped the per-tick poll entirely, so a quiet console is now the steady state. With both fixes in place, console output is a faithful record of what the page actually did each operator click.
+**Why this matters.** The render-body log was misleading: it read as "the admin agent is checking onboarding state continuously", when in fact `onboardingComplete` had not changed at all. The fix moved the log into `useEffect(…, [])` then dropped the per-tick poll entirely, so a quiet console is now the steady state. With both fixes in place, console output is a faithful record of what the page actually did each operator click.