@rubytech/create-maxy-code 0.1.33 → 0.1.35

package/payload/platform/plugins/cloudflare/scripts/list-cf-domains.ts

@@ -17,8 +17,8 @@
 //     routing and cannot drift without breaking their entire dashboard; it
 //     is the most stable surface to key off.
 //
-// Why href-only (no page-text fallback): Task 599 removed an earlier
-// <main>-wide FQDN text walker ("Source B") after a reproduction returned
+// Why href-only (no page-text fallback): an earlier
+// <main>-wide FQDN text walker ("Source B") was removed after a reproduction returned
 // `count=1` with a bogus string (`leg.interest` — a static footer FQDN-shape
 // that hit the regex). The walker's non-empty result short-circuited the
 // poll-to-success branch before zones hydrated 500 ms later, silently
@@ -52,13 +52,13 @@ import { fileURLToPath } from "node:url";
 // for in-process tests (`scrapeCurrentPage` / `scrapeDomains` under JSDOM)
 // does not require an installed brand on disk.
 //
-// Task 954 source-of-truth contract:
+// source-of-truth contract:
 //   Runtime: brand.json `cdpPort` at `${MAXY_PLATFORM_ROOT}/config/brand.json`
 //     is authoritative. Wrapper exports MAXY_PLATFORM_ROOT and BRAND. Missing
 //     env / file / field → loud-fail with one of three named reasons. The
 //     pre-Task-954 silent CDP-port default made every non-Maxy brand fail
 //     `cdp-unreachable` because the helper hit Maxy's port instead of the
-//     brand's; Task 787 / NEO4J_URI sets the precedent that runtime config
+//     brand's / NEO4J_URI sets the precedent that runtime config
 //     never falls back silently.
 //
 //   Test overrides: when BOTH `LIST_CF_DOMAINS_CDP_HOST` and
@@ -83,10 +83,10 @@ type Reason =
   | "navigate-failed"
   | "table-wait-timeout"
   | "runtime-error"
-  // Task 954 — config-class failures. The first three short-circuit before
+  // config-class failures. The first three short-circuit before
   // any CDP work begins; the route maps them to `field='config'` so the
   // form renders a config-card naming the brand + path instead of a Retry
-  // button (retrying re-fires the same wrongly-resolved spawn — Task 787
+  // button (retrying re-fires the same wrongly-resolved spawn
   // pattern).
   | "brand-config-missing"
   | "cdp-port-unresolved";
@@ -106,10 +106,10 @@ function logPhase(line: string): void {
   process.stderr.write(`[list-cf-domains] ${line}\n`);
 
   // Stream log: direct write by the TS helper (not via wrapper tee) so phase
-  // lines reach the per-conversation file the Task 592 tailer reads, even on
+  // lines reach the per-conversation file the tailer reads, even on
   // exit 0 where runFormSpawn discards `result.stderr`. Format parity with
   // `_stream-log.sh phase_line`: `[<ISO-ts>] [script:<scope>] <content>\n` —
-  // the `script:` prefix is Task 605's chat-surface namespace so the line
+  // the `script:` prefix is the chat-surface namespace so the line
   // passes the tightened tailer regex (`[mcp:*]` / `[init]` / `[api-wait-*]`
   // lines in the same file are excluded by construction). Asserted by the
   // vitest regression under platform/ui/__tests__. Sync append so the
@@ -143,7 +143,7 @@ interface CdpEndpoint {
   source: "env-override" | "brand.json";
 }
 
-// Task 954 — single source of truth for the CDP endpoint. Called once from
+// single source of truth for the CDP endpoint. Called once from
 // `main()` so the JSDOM scrape test (which imports `scrapeCurrentPage`
 // directly without invoking `main`) does not need an installed brand.
 function resolveCdpEndpoint(): CdpEndpoint {
@@ -425,7 +425,7 @@ export function scrapeCurrentPage(
 
   // The only scrape source: `/<accountId>/<host>` hrefs — the canonical CF
   // routing pattern the overview page uses to link each zone to its
-  // management screens. Task 599 removed a full-<main> FQDN text walker
+  // management screens. The full-<main> FQDN text walker was removed
   // after it returned a bogus FQDN-shaped string from static page copy
   // (see module header). When this source returns empty, the caller's
   // `empty-or-drift` branch snapshots the page HTML for diagnosis — loud
@@ -456,7 +456,7 @@ export type CdpEvaluator = (expression: string) => Promise<unknown>;
 
 // Trailing-run length (consecutive polls at `max_count`) the complete-line
 // asserts before it declares `unstable=false`. Two iterations at 500 ms each
-// = 1 s of continuous observation at the high-water mark. Task 615 removed
+// = 1 s of continuous observation at the high-water mark. removed
 // the early-exit on this threshold (it shortcuts multi-zone accounts where
 // the first zone hydrates one poll ahead of the second — the plateau at the
 // intermediate count trips the threshold before the final zone arrives);
@@ -465,9 +465,9 @@ const STABLE_POLL_THRESHOLD = 2;
 
 // Cap on `document.documentElement.outerHTML` captured into the dump file.
 // The observed Cloudflare dashboard outerHTML is ~1 MB; 5 MB is 5× headroom
-// and still fits comfortably in one `writeFile` syscall on the Pi. Pre-Task
-// 615 this was 100 KB — the dump ended mid-`<head>` CSS on every scrape,
-// rendering the forensic artifact premise of Task 608 silently broken: the
+// and still fits comfortably in one `writeFile` syscall on the Pi. An earlier
+// 100 KB cap truncated the dump mid-`<head>` CSS on every scrape,
+// rendering the forensic artifact silently broken: the
 // zone table lived past the cutoff and `grep <zone-host> <dump>` always
 // returned nothing, forcing re-scrapes to answer post-hoc questions.
 const OUTER_HTML_CAPTURE_MAX_CHARS = 5_000_000;
@@ -510,7 +510,7 @@ async function dumpHtml(
     // CONFIG_DIR is set by list-cf-domains.sh before the spawn. A silent
     // fallback would dump logs into the wrong brand's directory on a Real
     // Agent install — a silent-miswrite masking the wrapper-side break it
-    // came from. Per Task 473 doctrine: loud-fail on absent runtime-derived
+    // came from. doctrine: loud-fail on absent runtime-derived
     // values.
     const configDir = process.env.CONFIG_DIR;
     if (!configDir) {
@@ -568,7 +568,7 @@ function dumpField(result: DumpResult, mode: DumpMode): string {
 
 export async function scrapeDomains(evaluator: CdpEvaluator): Promise<string[]> {
   const deadline = Date.now() + SCRAPE_POLL_MS;
-  // Task 615: pure poll-to-deadline. The earlier "first N stable polls wins"
+  // pure poll-to-deadline. The earlier "first N stable polls wins"
   // heuristic short-circuited on the first plateau a multi-zone dashboard
   // rendered — a 2-zone account whose second zone hydrates one poll later
   // than the first would lock `count=1` before the second zone arrived.

package/payload/platform/plugins/cloudflare/scripts/reset-tunnel.sh

@@ -21,7 +21,7 @@ set -euo pipefail
 
 # --------------------------------------------------------------------------
 # Shared stream-log helpers (require STREAM_LOG_PATH, phase_line, tee_subprocess).
-# Task 556: any cloudflared subprocess this script spawns is teed line-by-line
+# any cloudflared subprocess this script spawns is teed line-by-line
 # into the per-conversation stream log so the chat UI tailer renders live
 # progress — same contract as setup-tunnel.sh.
 # --------------------------------------------------------------------------

package/payload/platform/plugins/cloudflare/scripts/setup-tunnel.sh

@@ -20,7 +20,7 @@
 # `DISPLAY=${DISPLAY:-${BRAND_VNC_DISPLAY}} /usr/bin/chromium <url> &` — no reliance on
 # cloudflared's optimistic xdg-open, no CDP auto-click, no DOM matcher.
 # The operator clicks the zone row + Authorize on the VNC themselves.
-# This is the wrappers-faithfully-relay-third-party-cli doctrine (Task 858);
+# This is the wrappers-faithfully-relay-third-party-cli doctrine;
 # any layer that auto-clicks Authorize for the operator is forbidden.
 # cloudflared's stdout+stderr is teed line-by-line into STREAM_LOG_PATH so
 # the chat UI's server-side tailer renders live progress in-turn.
@@ -31,8 +31,8 @@ set -euo pipefail
 # (see packages/create-maxy-code/src/index.ts:installTunnelScripts), so the raw
 # BASH_SOURCE[0] points at $HOME, not the scripts directory where the sibling
 # helpers (_stream-log.sh, tunnel-ingress.ts) live. Factored to SCRIPT_DIR so
-# Task 600's stream-log-contract scanner can statically resolve the
-# tunnel-ingress.ts target (Task 054).
+# the stream-log-contract scanner can statically resolve the
+# tunnel-ingress.ts target.
 SCRIPT_DIR="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
 
 # --------------------------------------------------------------------------
@@ -59,7 +59,7 @@ shift 2
 HOSTNAMES=("$@")
 
 # --------------------------------------------------------------------------
-# Task 009 — SSH/SMB ingress env vars.
+# SSH/SMB ingress env vars.
 #
 # SSH and SMB hostnames arrive via environment, NOT positional argv, so the
 # existing form/endpoint contract (which passes admin/public/apex as
@@ -99,7 +99,7 @@ phase_line setup-tunnel step=start brand="${BRAND}" port="${PORT}" hostnames="${
 CFG_DIR="${HOME}/.${BRAND}/cloudflared"
 mkdir -p "${CFG_DIR}"
 
-# Per-brand X display (Task 553). Each brand owns its own Xtigervnc display
+# Per-brand X display. Each brand owns its own Xtigervnc display
 # so the Chromium tab opened to drive the OAuth Authorize click lands in
 # THIS brand's isolated VNC, not whichever brand booted first on a shared
 # device. Read from the brand manifest if MAXY_PLATFORM_ROOT is exported
@@ -117,14 +117,14 @@ if [ -n "${SETUP_TUNNEL_BRAND_JSON}" ] && command -v jq >/dev/null 2>&1; then
   fi
 fi
 
-# Task 929 — read the install-time-resolved non-snap Chromium binary path so
+# read the install-time-resolved non-snap Chromium binary path so
 # the OAuth-URL spawn below uses the same binary vnc.sh's start_chrome runs.
 # Hardcoded `/usr/bin/chromium` would re-introduce the snap-AppArmor failure
 # on Ubuntu Noble laptop. The installer writes this file under platform/config/
 # during installSystemDeps; the spawn at step=browser-spawn fails loud if the
 # file is absent rather than silently falling back to /usr/bin/chromium.
 #
-# Task 957 — four discrete branches (env-unset / file-missing / file-empty /
+# four discrete branches (env-unset / file-missing / file-empty /
 # binary-not-executable) so the failure message names the actual condition.
 # Pre-957 the four were conflated into one "cannot resolve a non-snap Chromium
 # binary" message, which masked the env-propagation defect that closed three
@@ -179,11 +179,11 @@ fi
 #                                                   click, poll for cert.pem,
 #                                                   mv.
 #
-# Control flow when both certs are missing (Task 858 — wrappers faithfully
+# Control flow when both certs are missing
 # relay third-party CLI):
 #   1. Spawn cloudflared with stdout+stderr teed line-by-line to
 #      $STREAM_LOG_PATH with prefix [script:setup-tunnel:cloudflared]
-#      (Task 605's chat-surface namespace — see _stream-log.sh header).
+#      (the chat-surface namespace — see _stream-log.sh header).
 #   2. Extract the authorize URL with a tolerant regex as it streams.
 #   3. The instant the URL is extracted, mechanically open it on the Pi
 #      VNC chromium via `DISPLAY=${DISPLAY:-${BRAND_VNC_DISPLAY}} /usr/bin/chromium <url> &`.
@@ -203,7 +203,7 @@ fi
 # Every failure branch exits 1 loudly naming the cause.
 # --------------------------------------------------------------------------
 
-# Pre-flight cert-promotion (Task 855). When ${CFG_DIR}/cert.pem is missing
+# Pre-flight cert-promotion. When ${CFG_DIR}/cert.pem is missing
 # but the OAuth-default ~/.cloudflared/cert.pem is present, a prior run
 # reached the cloudflared callback but did not survive to the brand-scoped
 # mv at the end of Step 1. The cert is bound to the account already; the
@@ -252,7 +252,7 @@ if [ ! -f "${CFG_DIR}/cert.pem" ]; then
   CHROMIUM_UNIT=""
   cleanup_oauth() {
     [ -n "${CF_PIPELINE_PID}" ] && kill "${CF_PIPELINE_PID}" 2>/dev/null || true
-    # Task 982 — stop the transient chromium unit on any early exit between
+    # stop the transient chromium unit on any early exit between
     # browser-spawn and the explicit step=browser-close site below. Best-
     # effort: no phase_line here because the EXIT trap fires on every path
     # (including the happy one where step=browser-close already ran and
@@ -318,14 +318,14 @@ if [ ! -f "${CFG_DIR}/cert.pem" ]; then
   # to re-target the same URL on the VNC; same end-effect as this spawn.
   printf 'OAUTH_URL: %s\n' "${AUTH_URL}"
 
-  # Mechanically open the URL on the Pi VNC chromium (Task 858). Chromium
+  # Mechanically open the URL on the Pi VNC chromium. Chromium
   # is already running on this brand's ${BRAND_VNC_DISPLAY} with CDP enabled
   # (vnc.sh start_chrome at boot); invoking the resolved binary <url> against
   # a running instance IPCs the URL into it as a new tab. Replaces
   # cloudflared's own optimistic xdg-open, which does not reliably target
   # the brand's VNC display in this environment.
   #
-  # Task 982 — chromium is launched under a transient systemd-user unit so
+  # chromium is launched under a transient systemd-user unit so
   # the full process tree (including any standalone chromium that lands
   # when no existing instance is running for IPC) lives in its own cgroup.
   # On cert.pem arrival the unit is stopped, SIGTERMing the whole cgroup
@@ -338,7 +338,7 @@ if [ ! -f "${CFG_DIR}/cert.pem" ]; then
   # Binary path: SETUP_TUNNEL_CHROMIUM_BIN is read at startup from
   # ${MAXY_PLATFORM_ROOT}/config/chromium-binary.path — `/usr/bin/chromium`
   # on Pi Bookworm and `/usr/bin/google-chrome-stable` on Ubuntu Noble laptop
-  # where the system chromium is snap-confined (Task 929). Hardcoding
+  # where the system chromium is snap-confined. Hardcoding
   # `/usr/bin/chromium` here would re-introduce the AppArmor SingletonLock
   # failure on the laptop.
   CHROMIUM_UNIT="maxy-oauth-chromium-${BRAND}-$$.service"
@@ -400,7 +400,7 @@ if [ ! -f "${CFG_DIR}/cert.pem" ]; then
     # Heartbeat every 2 s after the click. t=0 is the browser-drive
     # phase line above; the first heartbeat fires at t=2. Without this line
     # the tailer sees silence for the full 1-20 s round-trip — the exact
-    # state Task 588 forbids.
+    # state the heartbeat contract forbids.
     if [ "${LOGIN_WAIT}" -gt 0 ] && [ $((LOGIN_WAIT % 2)) -eq 0 ]; then
       phase_line setup-tunnel step=oauth-login result=awaiting-cert \
         elapsed="${LOGIN_WAIT}s" timeout="${LOGIN_TIMEOUT}s"
@@ -413,7 +413,7 @@ if [ ! -f "${CFG_DIR}/cert.pem" ]; then
   phase_line setup-tunnel step=oauth-login result=ok \
     path="${CFG_DIR}/cert.pem" waited="${LOGIN_WAIT}s"
 
-  # Task 982 — SIGTERM the OAuth chromium cgroup now that cert.pem has
+  # SIGTERM the OAuth chromium cgroup now that cert.pem has
   # landed. The transient unit was created above at step=browser-spawn; if
   # chromium IPCs'd to a running brand-VNC instance and exited cleanly, the
   # unit is already auto-collected and `systemctl stop` returns 0 (no-such-
@@ -454,7 +454,7 @@ if [ ! -f "${CFG_DIR}/cert.pem" ]; then
 fi
 
 # --------------------------------------------------------------------------
-# Step 2+3: Resolve the tunnel identity from operator input (Task 886 §B).
+# Step 2+3: Resolve the tunnel identity from operator input.
 #
 # Pre-Task-886 the script derived TUNNEL_NAME locally as "${BRAND}-$(hostname
 # -s)" and reused-or-created. That breaks the same doctrine as pre-Task-589
@@ -538,10 +538,10 @@ echo "tunnel: ${TUNNEL_NAME} (${TUNNEL_ID}) [${TUNNEL_SOURCE}]"
 # parent zone is not on Cloudflare, refuse the whole run before calling
 # `cloudflared tunnel route dns`.
 #
-# DESIGN NOTE — what this catches and what it does NOT catch (Task 559):
+# DESIGN NOTE — what this catches and what it does NOT catch:
 #   CATCHES: parent zone does not exist, or its NS records do not point
 #     at Cloudflare's nameservers. Pre-529 the shell relied on a post-
-#     flight sed of cloudflared's stdout for this defence; Task 559
+#     flight sed of cloudflared's stdout for this defence
 #     deletes that parser because it rejects the idempotent no-op output
 #     shape (session 25674fe3) and replaces it with this inline NS probe.
 #     Same primitive the MCP path uses in
@@ -552,7 +552,7 @@ echo "tunnel: ${TUNNEL_NAME} (${TUNNEL_ID}) [${TUNNEL_SOURCE}]"
 #     exist as of 2026-04) or persisting the bound account's zones at
 #     tunnel-login time (deferred — separate task). The wrong-account
 #     case is detected post-hoc by tunnel-status's hostname probe, not
-#     here. This is an explicitly accepted gap per Task 559's scope.
+#     here. This is an explicitly accepted gap per the scope.
 #
 # Probe uses 1.1.1.1 directly to bypass the device's local resolver
 # (matching Resolver.setServers in the MCP path) — avoids cache /
@@ -628,7 +628,7 @@ phase_line setup-tunnel step=zone-preflight result=ok \
 # another zone on the account. Skip CLI routing for apex; collect for the
 # ACTION REQUIRED summary at the end.
 #
-# Control flow (Task 559): cloudflared's exit code is the sole decision
+# Control flow: cloudflared's exit code is the sole decision
 # signal. No stdout parsing. `cloudflared tunnel route dns --overwrite-dns`
 # exits 0 on every legitimate outcome (create, overwrite, already-correct
 # no-op) and non-zero on every legitimate failure. The pre-flight above
@@ -651,7 +651,7 @@ for H in "${HOSTNAMES[@]}"; do
   ROUTE_LOG="$(mktemp -t maxy-route-dns.XXXXXX)"
   # tee_subprocess_capture streams cloudflared's combined stdout+stderr
   # into STREAM_LOG_PATH line-by-line with the [script:setup-tunnel:cloudflared]
-  # tag (live-tailable — Task 605 chat-surface namespace) AND passes the same output through this shell's
+  # tag (live-tailable chat-surface namespace) AND passes the same output through this shell's
   # stdout so the `> "${ROUTE_LOG}"` redirection can capture it for the
   # failure-path phase_line. Exit code is cloudflared's PIPESTATUS[0].
   if tee_subprocess_capture setup-tunnel:cloudflared -- \
@@ -673,7 +673,7 @@ for H in "${HOSTNAMES[@]}"; do
 done
 
 # --------------------------------------------------------------------------
-# Task 009 — Rehydrate SSH/SMB hostnames from tunnel.state when env unset.
+# Rehydrate SSH/SMB hostnames from tunnel.state when env unset.
 #
 # A re-run without SSH_HOSTNAME / SMB_HOSTNAME should keep the previously
 # configured ingress rather than silently dropping them. The Node helper
@@ -703,9 +703,9 @@ if [ -z "${SSH_HOSTNAME}${SMB_HOSTNAME}" ] && [ -f "${CFG_DIR}/tunnel.state" ];
 fi
 
 # --------------------------------------------------------------------------
-# Task 009 — Samba presence probe (gates SMB ingress on Task 034 stanza).
+# Samba presence probe (gates SMB ingress stanza).
 #
-# Per Task 034, the brand's Samba stanza `[<brand>]` is written to
+#, the brand's Samba stanza `[<brand>]` is written to
 # /etc/samba/smb.conf at install time. If the stanza is absent, this Pi
 # has no SMB share to expose and the SMB ingress is skipped loudly.
 # Probe via grep on the Pi filesystem (NOT brand.json — Samba is a
@@ -724,7 +724,7 @@ if [ -n "${SMB_HOSTNAME}" ]; then
 fi
 
 # --------------------------------------------------------------------------
-# Task 009 — Step 4b: Route DNS for SSH/SMB hostnames (after HTTPS pass).
+# Step 4b: Route DNS for SSH/SMB hostnames (after HTTPS pass).
 #
 # Two-phase ordering: HTTPS hostnames are routed first (loop above). If a
 # subsequent SSH or SMB route DNS fails, emit `*-ingress-deferred` and
@@ -858,7 +858,7 @@ fi
 rm -f "${STATE_SPEC_FILE}"
 
 # --------------------------------------------------------------------------
-# Task 009 — Access policy ACTION REQUIRED.
+# Access policy ACTION REQUIRED.
 #
 # The Cloudflare Access policy that gates these new SSH/SMB hostnames must
 # be authored in the dashboard by the operator: CF API/SDK is banned
@@ -918,7 +918,7 @@ fi
 # admin agent invokes it via the Bash tool. `systemctl --user restart
 # ${BRAND}.service` from inside that cgroup SIGTERMs the whole cgroup —
 # the node server, the claude subprocess, the Bash child, and this script
-# itself (Task 558). Dispatching the restart to a transient systemd-run
+# itself. Dispatching the restart to a transient systemd-run
 # unit is the ONLY primitive that creates a new cgroup outside the service
 # — setsid/nohup/disown/& all inherit cgroup membership, and
 # `systemd-run --scope` runs in the caller's scope.

package/payload/platform/plugins/cloudflare/scripts/tunnel-ingress.ts

@@ -1,4 +1,4 @@
-// Task 009 — Pure tunnel-ingress rendering + state I/O.
+// Pure tunnel-ingress rendering + state I/O.
 //
 // Mirror of `samba-provision.ts`: pure decision functions in this file with
 // no side effects; `setup-tunnel.sh` orchestrates I/O around them. Invoked
@@ -24,7 +24,7 @@
 
 import { readFileSync, existsSync, appendFileSync } from "node:fs";
 
-// Task 054 — STREAM_LOG_PATH writer (Task 598/600 contract). The four CLI
+// STREAM_LOG_PATH writer (contract). The four CLI
 // subcommands invoked from setup-tunnel.sh (probe-samba, render-config,
 // render-state, action-req) emit a `phase=<cmd>-start` line on entry and
 // `phase=<cmd>-ok` / `phase=<cmd>-fail` on exit. Pattern ported verbatim
@@ -156,8 +156,8 @@ export function readPersistedHostnames(statePath: string): {
 // ---------------------------------------------------------------------------
 
 /**
- * Probe whether Task 034's per-brand Samba stanza exists in /etc/samba/smb.conf.
- * The brand stanza header is `[<brand>]` at the start of a line (Task 034's
+ * Probe whether the per-brand Samba stanza exists in /etc/samba/smb.conf.
+ * The brand stanza header is `[<brand>]` at the start of a line (the
  * `renderBrandStanza` output). Source of truth is the Pi filesystem, not
  * brand.json — Samba is provisioned by the installer's post-install step,
  * not declared up-front.
@@ -244,7 +244,7 @@ const isCli =
 
 if (isCli) {
   const [, , cmd, ...rest] = process.argv;
-  // Track which subcommands carry the Task 054 stream-log contract — for these
+  // Track which subcommands carry the stream-log contract — for these
   // we emit start/ok/fail phase pairs. Unknown subcommands and read-state are
   // out of scope per the task (read-state has no setup-tunnel.sh caller line).
   const instrumented = new Set(["probe-samba", "render-config", "render-state", "action-req"]);

package/payload/platform/plugins/cloudflare/skills/setup-tunnel/SKILL.md

@@ -22,7 +22,7 @@ Any Cloudflare action outside these four surfaces is a discipline violation —
 
 Use this when the operator wants Cloudflare set up (or re-set up) end-to-end on the device. The script handles OAuth login, tunnel creation, DNS routing for each subdomain, config.yml + tunnel.state, and dispatches the `${BRAND}.service` restart to a transient `systemd-run` unit — all in one invocation. The restart fires a few seconds after the script exits so the script does not kill its own cgroup when invoked via the Bash tool; the chat UI receives a `server_shutdown` SSE frame and reconnects automatically. Post-restart hostname verification is out of scope for the script (connector is not up when the script exits) — verify via the next admin turn or manually with `curl -I https://<hostname>`. Apex hostnames cannot be routed by the CLI; when one is passed, the script prints an `ACTION REQUIRED` block naming the exact dashboard record to edit.
 
-Step 1's OAuth flow is a state machine over two observable variables: the brand-scoped cert path (`${CFG_DIR}/cert.pem`) and the OAuth-default cert path (`~/.cloudflared/cert.pem`). When the brand-scoped cert is missing but the default-path cert is present from any prior partial run, the wrapper promotes it (`mv`) and emits `step=oauth-login result=ok reason=cert-promoted-from-default-path` without re-spawning cloudflared. When both are missing, the wrapper spawns `cloudflared tunnel login`, extracts the argotunnel URL from its stdout, and the instant the URL surfaces, mechanically opens it on the brand's VNC chromium under a transient `systemd-run --user --unit=maxy-oauth-chromium-${BRAND}-$$.service` so the chromium process tree lives in its own cgroup (Task 982 — pre-Task-982 the spawn was `&` fire-and-forget and orphaned chromium on display `:101` when no pre-existing brand-VNC chromium was available for IPC). The launch uses the install-time-resolved binary (`SETUP_TUNNEL_CHROMIUM_BIN` from `${MAXY_PLATFORM_ROOT}/config/chromium-binary.path` so Ubuntu Noble laptop's snap-replaced Google Chrome is honoured per Task 929) — emitting `step=browser-spawn result=ok unit=<transient-unit>` and `step=browser-drive mode=operator-click`. The operator clicks the zone row + Authorize on the VNC; cloudflared's callback writes `~/.cloudflared/cert.pem`; the wrapper's cert-poll (180 s budget) picks it up and `mv`s it to the brand-scoped path; the wrapper then `systemctl --user stop`s the transient unit, emitting `step=browser-close result=ok` (or `result=orphan reason=stop-failed` when SIGTERM didn't reach the cgroup — operator-visible signal that an orphan chromium MAY still be alive). There is no CDP auto-click, no DOM matcher, no consent-page driver — the wrapper's job is to faithfully relay `cloudflared tunnel login`, never to layer automation on top.
+Step 1's OAuth flow is a state machine over two observable variables: the brand-scoped cert path (`${CFG_DIR}/cert.pem`) and the OAuth-default cert path (`~/.cloudflared/cert.pem`). When the brand-scoped cert is missing but the default-path cert is present from any prior partial run, the wrapper promotes it (`mv`) and emits `step=oauth-login result=ok reason=cert-promoted-from-default-path` without re-spawning cloudflared. When both are missing, the wrapper spawns `cloudflared tunnel login`, extracts the argotunnel URL from its stdout, and the instant the URL surfaces, mechanically opens it on the brand's VNC chromium under a transient `systemd-run --user --unit=maxy-oauth-chromium-${BRAND}-$$.service` so the chromium process tree lives in its own cgroup (earlier the spawn was `&` fire-and-forget and orphaned chromium on display `:101` when no pre-existing brand-VNC chromium was available for IPC). The launch uses the install-time-resolved binary (`SETUP_TUNNEL_CHROMIUM_BIN` from `${MAXY_PLATFORM_ROOT}/config/chromium-binary.path` so Ubuntu Noble laptop's snap-replaced Google Chrome is honoured) — emitting `step=browser-spawn result=ok unit=<transient-unit>` and `step=browser-drive mode=operator-click`. The operator clicks the zone row + Authorize on the VNC; cloudflared's callback writes `~/.cloudflared/cert.pem`; the wrapper's cert-poll (180 s budget) picks it up and `mv`s it to the brand-scoped path; the wrapper then `systemctl --user stop`s the transient unit, emitting `step=browser-close result=ok` (or `result=orphan reason=stop-failed` when SIGTERM didn't reach the cgroup — operator-visible signal that an orphan chromium MAY still be alive). There is no CDP auto-click, no DOM matcher, no consent-page driver — the wrapper's job is to faithfully relay `cloudflared tunnel login`, never to layer automation on top.
 
 ### How inputs reach the script
 
@@ -46,7 +46,7 @@ Example ({{productName}} on `maxy.bot` with a public subdomain and the `maxy.cha
 ~/setup-tunnel.sh maxy 19200 admin.maxy.bot public.maxy.bot maxy.chat
 ```
 
-### Optional SSH and SMB ingress (Task 009)
+### Optional SSH and SMB ingress
 
 The same script also wires the off-LAN SSH and SMB ingress when the
 corresponding hostnames are passed via environment variables (NOT positional
@@ -66,7 +66,7 @@ Behaviour:
   `[tunnel-install] {ssh,smb}-ingress-deferred` and leaves the HTTPS
   ingress durable (no rollback, no `exit 1`).
 - `SSH_HOSTNAME` adds an ingress entry `service: ssh://localhost:22`.
-- `SMB_HOSTNAME` adds `service: tcp://localhost:445`, gated on Task 034's
+- `SMB_HOSTNAME` adds `service: tcp://localhost:445`, gated's
   Samba stanza being present in `/etc/samba/smb.conf`. Absent stanza →
   `[tunnel-install] smb-ingress-skipped reason=samba-not-provisioned` and
   the SMB pass is skipped entirely.

package/payload/platform/plugins/contacts/mcp/dist/lib/neo4j.js

@@ -15,8 +15,8 @@ function readPassword() {
 }
 export function getDriver() {
     if (!driver) {
-        // Task 580: NEO4J_URI must be explicit. Silent default to :7687 was the
-        // vector for Task 577's orphan data in Maxy's DB from a realagent install.
+        // NEO4J_URI must be explicit. Silent default to:7687 was the
+        // vector for the orphan data in Maxy's DB from a realagent install.
         const uri = process.env.NEO4J_URI;
         if (!uri) {
             throw new Error("[contacts] NEO4J_URI unset — refusing to default to bolt://localhost:7687");

package/payload/platform/plugins/contacts/mcp/dist/lib/neo4j.js.map

@@ -1 +1 @@
-{"version":3,"file":"neo4j.js","sourceRoot":"","sources":["../../src/lib/neo4j.ts"],"names":[],"mappings":"AAAA,OAAO,KAA0B,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,IAAI,MAAM,GAAkB,IAAI,CAAC;AAEjC,SAAS,YAAY;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAElE,MAAM,YAAY,GAAG,OAAO,CAC1B,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EACxE,wBAAwB,CACzB,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,yCAAyC,YAAY,gCAAgC,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC;QAC/C,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"neo4j.js","sourceRoot":"","sources":["../../src/lib/neo4j.ts"],"names":[],"mappings":"AAAA,OAAO,KAA0B,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,IAAI,MAAM,GAAkB,IAAI,CAAC;AAEjC,SAAS,YAAY;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAElE,MAAM,YAAY,GAAG,OAAO,CAC1B,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EACxE,wBAAwB,CACzB,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,yCAAyC,YAAY,gCAAgC,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,6DAA6D;QAC7D,oEAAoE;QACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC;QAC/C,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/payload/platform/plugins/contacts/mcp/dist/lib/resolve-person.d.ts

@@ -8,7 +8,7 @@
  * Used by: contact-delete, contact-update, contact-export, contact-erase.
  * NOT used by: contact-create (dedup OR logic), contact-lookup (name search).
  *
- * Task 602 — trashed Person nodes are excluded by default. `contact-erase`
+ * trashed Person nodes are excluded by default. `contact-erase`
  * passes `includeTrashed: true` because GDPR Article 17 must cascade-delete
  * trashed persons too (they were marked but not yet emptied). Trashed
  * persons also have nulled email/telephone (UNIQUE_KEYS_BY_LABEL snapshot),

package/payload/platform/plugins/contacts/mcp/dist/lib/resolve-person.js

@@ -8,7 +8,7 @@
  * Used by: contact-delete, contact-update, contact-export, contact-erase.
  * NOT used by: contact-create (dedup OR logic), contact-lookup (name search).
  *
- * Task 602 — trashed Person nodes are excluded by default. `contact-erase`
+ * trashed Person nodes are excluded by default. `contact-erase`
  * passes `includeTrashed: true` because GDPR Article 17 must cascade-delete
  * trashed persons too (they were marked but not yet emptied). Trashed
  * persons also have nulled email/telephone (UNIQUE_KEYS_BY_LABEL snapshot),

package/payload/platform/plugins/contacts/mcp/dist/tools/contact-create.js

@@ -28,7 +28,7 @@ export async function contactCreate(params) {
     try {
         // Dedup only fires when a stable identifier (email/telephone) is present.
         // With no identifier the agent has explicitly chosen to write a sparse
-        // Person; dedup/conflict resolution moves downstream (Task 894 doctrine:
+        // Person; dedup/conflict resolution moves downstream
         // "agent and user manage dedup and conflicts").
         const dedupConditions = [];
         const dedupParams = { accountId };
@@ -85,7 +85,7 @@ export async function contactCreate(params) {
         if (embedding.length > 0) {
             props.embedding = embedding;
         }
-        // Task 997 — direct admin asks ("add Anneke as person") need a PRODUCED
+        // direct admin asks ("add Anneke as person") need a PRODUCED
         // edge from the active :AdminConversation rather than a synthetic :Task.
         // The admin server stamps `CONVERSATION_NODE_ID` in the spawn env; the
         // helper resolves the node, verifies accountId parity, and prepends the

package/payload/platform/plugins/contacts/mcp/dist/tools/contact-create.js.map

@@ -1 +1 @@
-{"version":3,"file":"contact-create.js","sourceRoot":"","sources":["../../src/tools/contact-create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,8CAA8C,CAAC;AAC1E,OAAO,EACL,kBAAkB,EAClB,4BAA4B,GAG7B,MAAM,8CAA8C,CAAC;AAEtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,wBAAwB,CAAC;AACtE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC;AAElE,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,YAAY,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;QAC9D,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAuBD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B;IAE3B,MAAM,EACJ,SAAS,EACT,UAAU,EACV,KAAK,EACL,SAAS,EACT,QAAQ,EACR,MAAM,EACN,MAAM,GAAG,UAAU,EACnB,SAAS,EACT,aAAa,EACb,SAAS,GACV,GAAG,MAAM,CAAC;IAEX,MAAM,eAAe,GAAG,KAAK,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC;IAE1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,gDAAgD;QAChD,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,MAAM,WAAW,GAA4B,EAAE,SAAS,EAAE,CAAC;QAE3D,IAAI,eAAe,EAAE,CAAC;YACpB,eAAe,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACzC,WAAW,CAAC,KAAK,GAAG,eAAe,CAAC;QACtC,CAAC;QACD,IAAI,eAAe,EAAE,CAAC;YACpB,eAAe,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACjD,WAAW,CAAC,SAAS,GAAG,eAAe,CAAC;QAC1C,CAAC;QAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,oDAAoD;YACpD,sEAAsE;YACtE,qEAAqE;YACrE,sCAAsC;YACtC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC;kBACU,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,UAAU,CAAC,GAAG,CAAC;mFACa,EAC3E,WAAW,CACZ,CAAC;YAEF,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAkB,CAAC;gBACvE,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAEhD,CAAC;gBACT,MAAM,iBAAiB,GAAG,YAAY,IAAI,YAAY,IAAI,SAAS,CAAC;gBAEpE,OAAO;oBACL,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAW;oBACnD,UAAU,EAAE,iBAAiB;oBAC7B,OAAO,EAAE,KAAK;oBACd,aAAa,EAAE,IAAI;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAA4B;YACrC,MAAM;YACN,MAAM;YACN,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,SAAS;YAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3C,IAAI,eAAe;YAAE,KAAK,CAAC,KAAK,GAAG,eAAe,CAAC;QACnD,IAAI,eAAe;YAAE,KAAK,CAAC,SAAS,GAAG,eAAe,CAAC;QACvD,IAAI,UAAU;YAAE,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QAC9C,IAAI,QAAQ;YAAE,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAExC,MAAM,cAAc,GAAG,eAAe;YACpC,CAAC,CAAC,IAAI,eAAe,GAAG;YACxB,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,MAAM,gBAAgB,GACpB,WAAW,QAAQ,IAAI,WAAW,IAAI,cAAc,YAAY,MAAM,YAAY,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QACpG,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC3D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC9B,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,kCAAkC;QAClC,MAAM,qBAAqB,GAAG,MAAM,4BAA4B,CAAC;YAC/D,OAAO;YACP,aAAa;YACb,SAAS,EAAE,SAAS,IAAI,EAAE;YAC1B,WAAW,EAAE,CAAC,QAAQ,CAAC;YACvB,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YACpD,YAAY,EAAE,cAAc;YAC5B,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACtC,OAAO;YACP,MAAM,EAAE,CAAC,QAAQ,CAAC;YAClB,KAAK;YACL,aAAa,EAAE,qBAAqB;YACpC,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzE,MAAM,iBAAiB,GACrB,eAAe,IAAI,eAAe,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC,CAAC;QAEtE,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,iBAAiB;YAC7B,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,KAAK;SACrB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}
+{"version":3,"file":"contact-create.js","sourceRoot":"","sources":["../../src/tools/contact-create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,8CAA8C,CAAC;AAC1E,OAAO,EACL,kBAAkB,EAClB,4BAA4B,GAG7B,MAAM,8CAA8C,CAAC;AAEtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,wBAAwB,CAAC;AACtE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC;AAElE,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,YAAY,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;QAC9D,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAuBD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B;IAE3B,MAAM,EACJ,SAAS,EACT,UAAU,EACV,KAAK,EACL,SAAS,EACT,QAAQ,EACR,MAAM,EACN,MAAM,GAAG,UAAU,EACnB,SAAS,EACT,aAAa,EACb,SAAS,GACV,GAAG,MAAM,CAAC;IAEX,MAAM,eAAe,GAAG,KAAK,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC;IAE1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,0EAA0E;QAC1E,uEAAuE;QACvE,qDAAqD;QACrD,gDAAgD;QAChD,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,MAAM,WAAW,GAA4B,EAAE,SAAS,EAAE,CAAC;QAE3D,IAAI,eAAe,EAAE,CAAC;YACpB,eAAe,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACzC,WAAW,CAAC,KAAK,GAAG,eAAe,CAAC;QACtC,CAAC;QACD,IAAI,eAAe,EAAE,CAAC;YACpB,eAAe,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACjD,WAAW,CAAC,SAAS,GAAG,eAAe,CAAC;QAC1C,CAAC;QAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,oDAAoD;YACpD,sEAAsE;YACtE,qEAAqE;YACrE,sCAAsC;YACtC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC;kBACU,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,UAAU,CAAC,GAAG,CAAC;mFACa,EAC3E,WAAW,CACZ,CAAC;YAEF,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAkB,CAAC;gBACvE,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAEhD,CAAC;gBACT,MAAM,iBAAiB,GAAG,YAAY,IAAI,YAAY,IAAI,SAAS,CAAC;gBAEpE,OAAO;oBACL,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAW;oBACnD,UAAU,EAAE,iBAAiB;oBAC7B,OAAO,EAAE,KAAK;oBACd,aAAa,EAAE,IAAI;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAA4B;YACrC,MAAM;YACN,MAAM;YACN,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,SAAS;YAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3C,IAAI,eAAe;YAAE,KAAK,CAAC,KAAK,GAAG,eAAe,CAAC;QACnD,IAAI,eAAe;YAAE,KAAK,CAAC,SAAS,GAAG,eAAe,CAAC;QACvD,IAAI,UAAU;YAAE,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QAC9C,IAAI,QAAQ;YAAE,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAExC,MAAM,cAAc,GAAG,eAAe;YACpC,CAAC,CAAC,IAAI,eAAe,GAAG;YACxB,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,MAAM,gBAAgB,GACpB,WAAW,QAAQ,IAAI,WAAW,IAAI,cAAc,YAAY,MAAM,YAAY,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QACpG,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC3D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC9B,CAAC;QAED,6DAA6D;QAC7D,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,kCAAkC;QAClC,MAAM,qBAAqB,GAAG,MAAM,4BAA4B,CAAC;YAC/D,OAAO;YACP,aAAa;YACb,SAAS,EAAE,SAAS,IAAI,EAAE;YAC1B,WAAW,EAAE,CAAC,QAAQ,CAAC;YACvB,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YACpD,YAAY,EAAE,cAAc;YAC5B,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACtC,OAAO;YACP,MAAM,EAAE,CAAC,QAAQ,CAAC;YAClB,KAAK;YACL,aAAa,EAAE,qBAAqB;YACpC,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzE,MAAM,iBAAiB,GACrB,eAAe,IAAI,eAAe,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC,CAAC;QAEtE,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,iBAAiB;YAC7B,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,KAAK;SACrB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}

package/payload/platform/plugins/contacts/mcp/dist/tools/group-create.js

@@ -30,7 +30,7 @@ export async function groupCreate(params) {
         }
         // Pre-resolve every participant so we reject the whole call if fewer
         // than one matches — creating a group Conversation with zero live
-        // participants is a write-doctrine orphan (Task 673). Participant
+        // participants is a write-doctrine orphan. Participant
         // PARTICIPATES_IN edges are added inside the same transaction as the
         // Conversation node to guarantee ≥1 adjacency at commit time.
         const resolvedParticipants = [];

package/payload/platform/plugins/contacts/mcp/dist/tools/group-create.js.map

@@ -1 +1 @@
-{"version":3,"file":"group-create.js","sourceRoot":"","sources":["../../src/tools/group-create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,8CAA8C,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAkB,MAAM,8CAA8C,CAAC;AAE9F,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,IAAI;SACd,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,IAAI,IAAI,OAAO,CAAC;AACzB,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAyB;IACzD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAE5E,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,cAAc,GAAG,UAAU,EAAE,CAAC;IACpC,IAAI,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,qEAAqE;QACrE,8DAA8D;QAC9D,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC;eACS,UAAU,CAAC,GAAG,CAAC;8BACA,EACxB,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAC/B,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7D,SAAS,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACzD,CAAC;QAED,qEAAqE;QACrE,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,oBAAoB,GAAuE,EAAE,CAAC;QACpG,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CACzB;;;;iBAIS,UAAU,CAAC,GAAG,CAAC;gEACgC,EACxD,EAAE,SAAS,EAAE,UAAU,EAAE,CAC1B,CAAC;YACF,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,oBAAoB,CAAC,IAAI,CAAC;oBACxB,UAAU;oBACV,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAW;oBAC1C,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAW;iBAC9C,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,sEAAsE,YAAY,CAAC,MAAM,oBAAoB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iEAAiE,CAClM,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,cAAc,CAC/B;YACE,cAAc;YACd,SAAS;YACT,SAAS,EAAE,QAAQ;YACnB,SAAS;YACT,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,OAAO;YACb,SAAS;YACT,SAAS;YACT,SAAS,EAAE,OAAO;SACnB,EACD,SAAS,CACV,CAAC;QAEF,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACtC,MAAM,EAAE,CAAC,GAAG,CACV;;;;;;4EAMoE,EACpE;gBACE,KAAK,EAAE,UAAU;gBACjB,cAAc,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;aAC5D,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CACnC;qCAC+B,EAC/B,EAAE,SAAS,EAAE,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,CAAuB,CAAC;QAC/E,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACtE,MAAM,YAAY,GAAG,GAAG,OAAO,MAAM,SAAS,EAAE,CAAC;QAEjD,OAAO,CAAC,KAAK,CACX,sBAAsB,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,SAAS,iBAAiB,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAChK,CAAC;QAEF,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}
+{"version":3,"file":"group-create.js","sourceRoot":"","sources":["../../src/tools/group-create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,8CAA8C,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAkB,MAAM,8CAA8C,CAAC;AAE9F,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,IAAI;SACd,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,IAAI,IAAI,OAAO,CAAC;AACzB,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAyB;IACzD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAE5E,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,cAAc,GAAG,UAAU,EAAE,CAAC;IACpC,IAAI,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,qEAAqE;QACrE,8DAA8D;QAC9D,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC;eACS,UAAU,CAAC,GAAG,CAAC;8BACA,EACxB,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAC/B,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7D,SAAS,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACzD,CAAC;QAED,qEAAqE;QACrE,kEAAkE;QAClE,uDAAuD;QACvD,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,oBAAoB,GAAuE,EAAE,CAAC;QACpG,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CACzB;;;;iBAIS,UAAU,CAAC,GAAG,CAAC;gEACgC,EACxD,EAAE,SAAS,EAAE,UAAU,EAAE,CAC1B,CAAC;YACF,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,oBAAoB,CAAC,IAAI,CAAC;oBACxB,UAAU;oBACV,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAW;oBAC1C,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAW;iBAC9C,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,sEAAsE,YAAY,CAAC,MAAM,oBAAoB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iEAAiE,CAClM,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,cAAc,CAC/B;YACE,cAAc;YACd,SAAS;YACT,SAAS,EAAE,QAAQ;YACnB,SAAS;YACT,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,OAAO;YACb,SAAS;YACT,SAAS;YACT,SAAS,EAAE,OAAO;SACnB,EACD,SAAS,CACV,CAAC;QAEF,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACtC,MAAM,EAAE,CAAC,GAAG,CACV;;;;;;4EAMoE,EACpE;gBACE,KAAK,EAAE,UAAU;gBACjB,cAAc,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;aAC5D,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CACnC;qCAC+B,EAC/B,EAAE,SAAS,EAAE,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,CAAuB,CAAC;QAC/E,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACtE,MAAM,YAAY,GAAG,GAAG,OAAO,MAAM,SAAS,EAAE,CAAC;QAEjD,OAAO,CAAC,KAAK,CACX,sBAAsB,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,SAAS,iBAAiB,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAChK,CAAC;QAEF,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}

package/payload/platform/plugins/docs/references/deployment.md

@@ -52,7 +52,36 @@ Grep for both in `~/.<brand>/logs/install-*.log`. Absence after a clean install
 
 The first user-domain write the agent attempts (e.g. recording who the operator is) hits the graph-write gate's `Write blocked (no-admin-user)` or `Write blocked (no-local-business)` error. The agent then asks the persona question, persists the answer through the `business-profile` skill or `profile-update.personFields`, and proceeds. The error itself is the signal — grep `Write blocked` in `~/.<brand>/logs/server.log` to confirm.
 
-Cloudflare, WhatsApp, Telegram, and any other dormant capability surfaces on owner request via the `<dormant-plugins>` rule in `platform/templates/agents/admin/IDENTITY.md`. Execution is the existing plugin skill (`cloudflare:setup-tunnel`, etc.) — no banner, no per-step flag.
+Cloudflare, WhatsApp, Telegram, and any other dormant capability surfaces on owner request via the `<dormant-plugins>` sentinel the manager injects per-spawn. Execution is the existing plugin skill (`cloudflare:setup-tunnel`, etc.) — no banner, no per-step flag.
+
+### Per-spawn system-prompt sentinels
+
+Every PTY spawn injects an `--append-system-prompt` block composed of six sentinel sections in fixed order:
+
+| Sentinel | Source | Behaviour on resolve failure |
+|---|---|---|
+| `<host>` | brand.json + boot-time LAN resolution | spawn refuses with `host-context-unresolved` |
+| `<attachment-ceiling>` | hard-coded 30 MiB rule | always present |
+| `<identity>` | `<accountDir>/agents/<role>/IDENTITY.md` | spawn refuses with `identity-unresolved` |
+| `<soul>` | `<accountDir>/agents/<role>/SOUL.md` | spawn refuses with `identity-unresolved` |
+| `<about-owner>` | upstream `loadUserProfile` + `formatProfileSummary` (UI process) | sentinel carries `coverage-unresolved: <reason>`; spawn proceeds |
+| `<dormant-plugins>` | installed-minus-enabled set from `platform/plugins/` and `account.json` | sentinel omitted when set is empty |
+
+Diagnostic line per spawn (`~/.<brand>/logs/server.log`):
+
+```
+[pty-spawn] sessionId=<id> appendSystemPromptBytes=<n> identityBytes=<n> soulBytes=<n> aboutOwnerBytes=<n> dormantPluginsBytes=<n> accountDir=<path> role=<admin|public> hostname=<h> lanIPv4=<ip> adminUrl=<url> tunnelUrl=<url|none>
+```
+
+Zero `aboutOwnerBytes` on a fresh-account spawn (sparse profile) is a regression: the upstream resolver returned ok:false with a reason, and the operator should see `coverage-unresolved: <reason>` in the agent's first turn. Zero `dormantPluginsBytes` on a Maxy install with `cloudflare` not enabled is likewise a regression.
+
+The manager also runs a boot-time self-test that renders a fixture compose call against synthetic inputs and refuses to start if any sentinel is missing:
+
+```
+[claude-session-manager] startup-self-test system-prompt-sentinels=ok
+```
+
+LOUD-FAIL output is `startup-self-test system-prompt-sentinels=fail missing=<tag>` followed by an immediate process exit. Catches IDENTITY-promise-vs-emitter drift at boot rather than at the first real spawn.
 
 ## Service Management
 

package/payload/platform/plugins/docs/references/platform.md

@@ -65,7 +65,7 @@ There is no dashboard, no settings panel, no menus. Everything is done through c
 
 The chat input auto-grows as you type — it expands to fit your message and shrinks back when you delete text. You can also drag the resize handle above the input to set a custom height.
 
-The admin interface is a three-pane layout: a sidebar on the left with your brand mark, navigation (Chat, People, Agents, Projects, Tasks, Artefacts), and your recent conversations; the chat in the middle; and an artefact pane on the right that opens when you select a document, click a project, or open Browser, Data, or Graph from the menu — holding the surface side-by-side with the conversation so the chat stays live while you work in it. The sidebar's nav rows swap the list view in place — Chat shows recent conversations, Projects shows your active work projects, and Artefacts lists every KnowledgeDocument plus this account's agent templates (your admin agent's IDENTITY, SOUL, and KNOWLEDGE files plus one entry per enabled specialist). The People, Agents, and Tasks rows are graph shortcuts: clicking each opens the artefact-pane Graph filtered to every Person, every public Agent, or every Task in your account respectively, with no side-list — the graph itself is the result. Public agents become first-class graph entities the moment you create them, with edges to their IDENTITY/SOUL/KNOWLEDGE files, edges to every knowledge document they have access to, and edges from every conversation they have handled, so a single Agents click reveals the whole shape of who knows what and who has been talking to whom. Click an artefact row to open the document. KnowledgeDocuments and your admin agent's templates are editable — type in the document and changes save automatically; specialist agent templates are read-only because they ship with Maxy and your edits would be overwritten on the next install. PDF artefacts render inline so you can read them without leaving the pane. If your browser doesn't have a built-in PDF viewer, a Download button appears instead. Artefacts that have no readable file backing them (orphan rows, files removed from disk, unsupported content types) show a one-line banner explaining the skip instead of opening to a blank pane. Click a project row to open the Graph view focused on that project's neighbourhood — clicking a second project swaps the focus rather than stacking on top. The chat / artefact divider is drag-resizable — drag the line between the columns to make either side wider; double-click it to reset to half of the available width (viewport minus sidebar), clamped to the chat / artefact min-width floors. Your chosen width is remembered across reloads. On wider screens (>1280px) all three panes are visible. The sidebar narrows at 1280px, the artefact pane hides at 1080px (Browser, Data, and Graph then open as full-window pages instead), and the sidebar collapses to a 56px icon rail at 820px. On every viewport the chat header reads left to right as a triptych: a dedicated sidebar toggle (the panel-right icon, which swaps to panel-right-open when the sidebar is showing), the brand mark next to the title in the centre, and the menu burger on the right. Tap the sidebar toggle to show or hide the sidebar — on phones (<720px) it slides the drawer in or out, on wider screens it collapses or expands the sidebar column. The brand mark in the centre is decorative; clicks go through the dedicated toggle so the affordance is unambiguous. The drawer animation only fires on tap (220ms slide in or out); resizing your window across the 720px boundary snaps the layout without animation, so you never see a half-open flash. At ≤640px the session metadata pane stacks each label above its value instead of the desktop two-column grid, and the row of action buttons (Open in new tab / Open JSONL / Rename / Pin / Archive / End or Purge) collapses behind a single Actions trigger that opens a popover upward from the foot of the pane. Breakpoint summary: >1280px = full sidebar + chat + artefact pane (drag-resizable divider); 1280px→1080px = sidebar narrows; 1080px→820px = artefact pane hides (Browser/Data/Graph open as full-window pages instead); 820px→720px = sidebar collapses to 56px icon rail; ≤720px = sidebar becomes off-canvas drawer (vertical stack of brand mark, nav, recents list, foot — same shape as the desktop sidebar, just on top of the chat instead of beside it). When the sidebar is collapsed to the 56px icon rail, clicking the Artefacts icon expands the rail back open so the artefact list is visible — the row was previously a silent no-op in collapsed state.
+The admin interface is a three-pane layout: a sidebar on the left with navigation (Sessions, People, Agents, Projects, Tasks, Artefacts) and your recent conversations; the chat in the middle; and an artefact pane on the right that opens when you select a document, click a project, or open Browser, Data, or Graph from the menu, holding the surface side-by-side with the conversation so the chat stays live while you work in it. At the very top of the sidebar list, a labelled "+ New session" pill spawns a fresh Claude Code session, and a small Mode trigger sits next to it: clicking the trigger opens a popover whose header reads "Mode" and lists the four permission modes (Ask, Accept edits, Plan, Auto) with the current selection check-marked. The sidebar's nav rows swap the list view in place: Sessions shows recent conversations, Projects shows your active work projects, and Artefacts lists every KnowledgeDocument plus this account's agent templates (your admin agent's IDENTITY, SOUL, and KNOWLEDGE files plus one entry per enabled specialist). Each recent session row carries a small status dot (filled sage for alive, hollow circle for ended) so you can read the live state at a glance without parsing the subtitle. The People, Agents, and Tasks rows are graph shortcuts: clicking each opens the artefact-pane Graph filtered to every Person, every public Agent, or every Task in your account respectively, with no side-list, because the graph itself is the result. Public agents become first-class graph entities the moment you create them, with edges to their IDENTITY/SOUL/KNOWLEDGE files, edges to every knowledge document they have access to, and edges from every conversation they have handled, so a single Agents click reveals the whole shape of who knows what and who has been talking to whom. Click an artefact row to open the document. KnowledgeDocuments and your admin agent's templates are editable: type in the document and changes save automatically; specialist agent templates are read-only because they ship with Maxy and your edits would be overwritten on the next install. PDF artefacts render inline so you can read them without leaving the pane. If your browser doesn't have a built-in PDF viewer, a Download button appears instead. Artefacts that have no readable file backing them (orphan rows, files removed from disk, unsupported content types) show a one-line banner explaining the skip instead of opening to a blank pane. Click a project row to open the Graph view focused on that project's neighbourhood; clicking a second project swaps the focus rather than stacking on top. The chat and artefact divider is drag-resizable: drag the line between the columns to make either side wider; double-click it to reset to half of the available width (viewport minus sidebar), clamped to the chat and artefact min-width floors. Your chosen width is remembered across reloads. On wider screens (>1280px) all three panes are visible. The sidebar narrows at 1280px, the artefact pane hides at 1080px (Browser, Data, and Graph then open as full-window pages instead), and the sidebar collapses to a 56px icon rail at 820px. On every viewport the chat header reads left to right as a triptych: a dedicated sidebar toggle (the panel-right icon, which swaps to panel-right-open when the sidebar is showing), the brand mark next to the title in the centre, and the menu burger on the right. This header toggle is the sole sidebar-toggle button; the sidebar itself no longer carries a duplicate. Tap the sidebar toggle to show or hide the sidebar: on phones (<720px) it slides the drawer in or out, on wider screens it collapses or expands the sidebar column. The brand mark in the centre is decorative; clicks go through the dedicated toggle so the affordance is unambiguous. The drawer animation only fires on tap (220ms slide in or out); resizing your window across the 720px boundary snaps the layout without animation, so you never see a half-open flash. At ≤640px the session metadata pane stacks each label above its value instead of the desktop two-column grid, and the row of action buttons (Open in new tab / Open JSONL / Rename / Pin / Archive / End or Purge) collapses behind a single Actions trigger that opens a popover upward from the foot of the pane. Breakpoint summary: >1280px = full sidebar + chat + artefact pane (drag-resizable divider); 1280px→1080px = sidebar narrows; 1080px→820px = artefact pane hides (Browser/Data/Graph open as full-window pages instead); 820px→720px = sidebar collapses to 56px icon rail; ≤720px = sidebar becomes off-canvas drawer (vertical stack of nav, recents list, foot, the same shape as the desktop sidebar, just on top of the chat instead of beside it).
 
 Page titles are brand-aware: the browser tab shows your product name (e.g. `Real Agent` instead of `Maxy`) on every shell — chat, graph, and data — so a non-default brand never leaks the default name in tab strips or browser history.