@rubytech/create-maxy-code 0.1.417 → 0.1.423

package/dist/__tests__/brand-port-uniqueness.test.js

@@ -0,0 +1,74 @@
+// Standing check: no two brands may fight for the same host resource when
+// co-resident on one device. Two namespaces are at stake:
+//
+//   1. Host TCP ports. neo4jPort / ttydPort / rfbPort / websockifyPort /
+//      cdpPort / claudeSessionManagerPort all bind TCP on the same host, so they
+//      must be globally unique across every (brand, field) pair — not merely
+//      unique within each field. A future brand whose ttydPort equals another
+//      brand's neo4jPort would EADDRINUSE at runtime with no build event, even
+//      though each field is individually unique.
+//   2. X display numbers. vncDisplay is an Xvnc display index (:NN and its
+//      /tmp/.X<NN>-lock), a namespace distinct from TCP ports, so it must be
+//      unique across brands on its own.
+//
+// This reconciles all brands/*/brand.json on every CI run. Path resolution
+// mirrors known-brand-hostnames.test.ts.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readdirSync, readFileSync, existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve, join } from "node:path";
+// dist/__tests__/brand-port-uniqueness.test.js → maxy-code/brands
+const here = dirname(fileURLToPath(import.meta.url));
+const BRANDS_DIR = resolve(here, "../../../../brands");
+// Fields that bind a host TCP port (one shared namespace across all fields).
+const TCP_PORT_FIELDS = [
+    "neo4jPort",
+    "ttydPort",
+    "rfbPort",
+    "websockifyPort",
+    "cdpPort",
+    "claudeSessionManagerPort",
+];
+// X display index — its own namespace, unique per brand.
+const DISPLAY_FIELD = "vncDisplay";
+const ALL_FIELDS = [...TCP_PORT_FIELDS, DISPLAY_FIELD];
+function brandManifests() {
+    return readdirSync(BRANDS_DIR, { withFileTypes: true })
+        .filter((e) => e.isDirectory())
+        .map((e) => ({ name: e.name, path: join(BRANDS_DIR, e.name, "brand.json") }))
+        .filter((b) => existsSync(b.path))
+        .map((b) => ({ name: b.name, manifest: JSON.parse(readFileSync(b.path, "utf-8")) }));
+}
+test("brands/ is discoverable and every brand declares all port fields", () => {
+    const brands = brandManifests();
+    assert.ok(brands.length > 0, `no brand.json found under ${BRANDS_DIR}`);
+    for (const { name, manifest } of brands) {
+        for (const field of ALL_FIELDS) {
+            assert.equal(typeof manifest[field], "number", `brands/${name}/brand.json is missing numeric ${field}`);
+        }
+    }
+});
+test("host TCP ports are globally unique across every (brand, field)", () => {
+    const brands = brandManifests();
+    const seen = new Map(); // port -> "brand.field" that claimed it
+    for (const { name, manifest } of brands) {
+        for (const field of TCP_PORT_FIELDS) {
+            const value = manifest[field];
+            const owner = `${name}.${field}`;
+            const prior = seen.get(value);
+            assert.equal(prior, undefined, `TCP port collision: ${prior} and ${owner} both bind ${value} — they would EADDRINUSE when co-resident`);
+            seen.set(value, owner);
+        }
+    }
+});
+test("vncDisplay is unique across brands", () => {
+    const brands = brandManifests();
+    const seen = new Map();
+    for (const { name, manifest } of brands) {
+        const value = manifest[DISPLAY_FIELD];
+        const prior = seen.get(value);
+        assert.equal(prior, undefined, `vncDisplay collision: brands "${prior}" and "${name}" both use :${value}`);
+        seen.set(value, name);
+    }
+});

package/dist/known-brands.js

@@ -18,6 +18,7 @@ export const KNOWN_BRAND_HOSTNAMES = [
     "realagent",
     "realagent-code",
     "sitedesk-code",
+    "property-administrators",
     "maxy-2",
     "maxy-3",
     "maxy-4",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.417",
+  "version": "0.1.423",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/config/brand-registry.json

@@ -8,6 +8,14 @@
       "websockifyPort": 6080,
       "cdpPort": 9222
     },
+    {
+      "hostname": "property-administrators",
+      "configDir": ".property-administrators",
+      "vncDisplay": 102,
+      "rfbPort": 5903,
+      "websockifyPort": 6083,
+      "cdpPort": 9225
+    },
     {
       "hostname": "realagent-code",
       "configDir": ".realagent-code",

package/payload/platform/lib/active-rules/dist/index.d.ts

@@ -0,0 +1,35 @@
+export declare const SAME_SUBJECT_COSINE = 0.85;
+export declare const INJECTION_RULE_CAP = 12;
+export declare const ACTIVE_CANDIDATE_FLOOR = 0.4;
+export declare const ACTIVE_CANDIDATE_LIMIT = 30;
+export interface RuleCandidate {
+    preferenceId: string;
+    category: string;
+    key: string;
+    value: string;
+    confidence: number;
+    observedAt: string;
+    embedding: number[] | null;
+}
+export interface ActiveRule {
+    preferenceId: string;
+    category: string;
+    key: string;
+    value: string;
+    confidence: number;
+    observedAt: string;
+}
+export declare function cosine(a: number[], b: number[]): number;
+export declare function deconflictBySubject(records: RuleCandidate[], cosineThreshold?: number): ActiveRule[];
+export declare function formatStandingRulesBlock(rules: ActiveRule[], cap?: number): string;
+interface MinimalSession {
+    run: (q: string, p: Record<string, unknown>) => Promise<{
+        records: Array<{
+            get(k: string): unknown;
+        }>;
+    }>;
+}
+export declare function queryActiveRuleCandidates(session: MinimalSession, accountId: string): Promise<RuleCandidate[]>;
+export declare function activeRuleSet(session: MinimalSession, accountId: string, cap?: number): Promise<ActiveRule[]>;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/active-rules/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAYvD;AAOD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,aAAa,EAAE,EACxB,eAAe,GAAE,MAA4B,GAC5C,UAAU,EAAE,CAgBd;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,UAAU,EAAE,EACnB,GAAG,GAAE,MAA2B,GAC/B,MAAM,CAIR;AAED,UAAU,cAAc;IACtB,GAAG,EAAE,CACH,CAAC,EAAE,MAAM,EACT,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KACvB,OAAO,CAAC;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/D;AAOD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,aAAa,EAAE,CAAC,CA6B1B;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,UAAU,EAAE,CAAC,CAGvB"}

package/payload/platform/lib/active-rules/dist/index.js

@@ -0,0 +1,94 @@
+"use strict";
+// The one definition of "this account's active, de-conflicted, bounded
+// rule-set" (Task 1486). Consumed by the memory plugin's profile-read
+// (agent-callable) and by the three inbound gateways (per-turn injection). Kept
+// free of neo4j-driver types so both an MCP process and the UI can import the
+// built dist.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACTIVE_CANDIDATE_LIMIT = exports.ACTIVE_CANDIDATE_FLOOR = exports.INJECTION_RULE_CAP = exports.SAME_SUBJECT_COSINE = void 0;
+exports.cosine = cosine;
+exports.deconflictBySubject = deconflictBySubject;
+exports.formatStandingRulesBlock = formatStandingRulesBlock;
+exports.queryActiveRuleCandidates = queryActiveRuleCandidates;
+exports.activeRuleSet = activeRuleSet;
+exports.SAME_SUBJECT_COSINE = 0.85;
+exports.INJECTION_RULE_CAP = 12;
+exports.ACTIVE_CANDIDATE_FLOOR = 0.4;
+exports.ACTIVE_CANDIDATE_LIMIT = 30;
+function cosine(a, b) {
+    if (!a.length || !b.length || a.length !== b.length)
+        return 0;
+    let dot = 0;
+    let na = 0;
+    let nb = 0;
+    for (let i = 0; i < a.length; i++) {
+        dot += a[i] * b[i];
+        na += a[i] * a[i];
+        nb += b[i] * b[i];
+    }
+    if (na === 0 || nb === 0)
+        return 0;
+    return dot / (Math.sqrt(na) * Math.sqrt(nb));
+}
+// records MUST be confidence-desc on entry. Greedy: the first record of a
+// cluster is the winner; any later record within cosineThreshold of an
+// already-kept winner is a rephrasing and is dropped. A record with no usable
+// embedding is never folded — it is kept as its own subject (we cannot prove it
+// is a duplicate).
+function deconflictBySubject(records, cosineThreshold = exports.SAME_SUBJECT_COSINE) {
+    const winners = [];
+    for (const r of records) {
+        const emb = r.embedding;
+        const isDup = Array.isArray(emb) &&
+            emb.length > 0 &&
+            winners.some((w) => Array.isArray(w.embedding) &&
+                w.embedding.length > 0 &&
+                cosine(emb, w.embedding) >= cosineThreshold);
+        if (!isDup)
+            winners.push(r);
+    }
+    return winners.map(({ embedding: _embedding, ...rest }) => rest);
+}
+function formatStandingRulesBlock(rules, cap = exports.INJECTION_RULE_CAP) {
+    if (rules.length === 0)
+        return "";
+    const lines = rules.slice(0, cap).map((r) => `- ${r.value}`);
+    return `## Standing rules\n${lines.join("\n")}`;
+}
+// The candidate query: this account's admin-scope preferences, not trashed, not
+// a "does not apply" declination, above the injection floor, ordered so the
+// highest-confidence / most-recent wins de-confliction. Returns `embedding` for
+// the clustering step. The trashed predicate mirrors graph-trash's
+// `notTrashed()` exactly (label + deletedAt) so this lib stays dependency-free.
+async function queryActiveRuleCandidates(session, accountId) {
+    // ACTIVE_CANDIDATE_LIMIT is inlined as a Cypher literal rather than bound as a
+    // param: a plain JS number bound to `LIMIT $p` serializes as a FLOAT and Neo4j
+    // rejects it ("not a valid value. Must be a non-negative integer"). This lib
+    // is dependency-free (no neo4j-driver), so it cannot call `neo4j.int()`; the
+    // constant is a hardcoded integer, so inlining it is safe and gate-clean.
+    const result = await session.run(`
+    MATCH (pref:Preference {accountId: $accountId, scope: 'admin'})
+    WHERE NOT pref:Trashed AND pref.deletedAt IS NULL
+      AND coalesce(pref.notApplicable, false) = false
+      AND pref.confidence >= $floor
+    RETURN pref.preferenceId AS preferenceId, pref.category AS category,
+           pref.key AS key, pref.value AS value, pref.confidence AS confidence,
+           pref.observedAt AS observedAt, pref.embedding AS embedding
+    ORDER BY pref.confidence DESC, pref.observedAt DESC
+    LIMIT ${exports.ACTIVE_CANDIDATE_LIMIT}
+    `, { accountId, floor: exports.ACTIVE_CANDIDATE_FLOOR });
+    return result.records.map((r) => ({
+        preferenceId: r.get("preferenceId"),
+        category: r.get("category"),
+        key: r.get("key"),
+        value: r.get("value"),
+        confidence: r.get("confidence"),
+        observedAt: r.get("observedAt") ?? "",
+        embedding: r.get("embedding") ?? null,
+    }));
+}
+async function activeRuleSet(session, accountId, cap = exports.INJECTION_RULE_CAP) {
+    const candidates = await queryActiveRuleCandidates(session, accountId);
+    return deconflictBySubject(candidates).slice(0, cap);
+}
+//# sourceMappingURL=index.js.map

package/payload/platform/lib/active-rules/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,uEAAuE;AACvE,sEAAsE;AACtE,gFAAgF;AAChF,8EAA8E;AAC9E,cAAc;;;AA0Bd,wBAYC;AAOD,kDAmBC;AAED,4DAOC;AAcD,8DAgCC;AAED,sCAOC;AA9HY,QAAA,mBAAmB,GAAG,IAAI,CAAC;AAC3B,QAAA,kBAAkB,GAAG,EAAE,CAAC;AACxB,QAAA,sBAAsB,GAAG,GAAG,CAAC;AAC7B,QAAA,sBAAsB,GAAG,EAAE,CAAC;AAqBzC,SAAgB,MAAM,CAAC,CAAW,EAAE,CAAW;IAC7C,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACnC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,0EAA0E;AAC1E,uEAAuE;AACvE,8EAA8E;AAC9E,gFAAgF;AAChF,mBAAmB;AACnB,SAAgB,mBAAmB,CACjC,OAAwB,EACxB,kBAA0B,2BAAmB;IAE7C,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC;QACxB,MAAM,KAAK,GACT,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAClB,GAAG,CAAC,MAAM,GAAG,CAAC;YACd,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,EAAE,CACJ,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC1B,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBACtB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,eAAe,CAC9C,CAAC;QACJ,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,wBAAwB,CACtC,KAAmB,EACnB,MAAc,0BAAkB;IAEhC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7D,OAAO,sBAAsB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAClD,CAAC;AASD,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,mEAAmE;AACnE,gFAAgF;AACzE,KAAK,UAAU,yBAAyB,CAC7C,OAAuB,EACvB,SAAiB;IAEjB,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B;;;;;;;;;YASQ,8BAAsB;KAC7B,EACD,EAAE,SAAS,EAAE,KAAK,EAAE,8BAAsB,EAAE,CAC7C,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAW;QAC7C,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAW;QACrC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAW;QAC3B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAW;QAC/B,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAW;QACzC,UAAU,EAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAY,IAAI,EAAE;QACjD,SAAS,EAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAqB,IAAI,IAAI;KAC3D,CAAC,CAAC,CAAC;AACN,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,OAAuB,EACvB,SAAiB,EACjB,MAAc,0BAAkB;IAEhC,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,mBAAmB,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC"}

package/payload/platform/lib/active-rules/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "@maxy/active-rules",
+  "version": "0.1.0",
+  "private": true,
+  "type": "commonjs",
+  "main": "dist/index.js"
+}

package/payload/platform/lib/active-rules/src/index.test.ts

@@ -0,0 +1,89 @@
+import { describe, it, expect } from "vitest";
+import {
+  cosine,
+  deconflictBySubject,
+  formatStandingRulesBlock,
+  INJECTION_RULE_CAP,
+  type RuleCandidate,
+} from "./index.js";
+
+const vec = (n: number, fill: number): number[] => Array(n).fill(fill);
+
+function cand(over: Partial<RuleCandidate>): RuleCandidate {
+  return {
+    preferenceId: "p",
+    category: "communication",
+    key: "k",
+    value: "v",
+    confidence: 0.5,
+    observedAt: "2026-07-01T00:00:00Z",
+    embedding: vec(4, 1),
+    ...over,
+  };
+}
+
+describe("cosine", () => {
+  it("is 1 for identical vectors and 0 for an empty one", () => {
+    expect(cosine([1, 0, 0], [1, 0, 0])).toBeCloseTo(1, 6);
+    expect(cosine([], [1, 2, 3])).toBe(0);
+  });
+});
+
+describe("deconflictBySubject", () => {
+  it("folds a near-duplicate into the higher-confidence winner", () => {
+    const a = cand({
+      preferenceId: "a",
+      key: "header_rule",
+      value: "use header A",
+      confidence: 0.8,
+      embedding: [1, 0, 0, 0],
+    });
+    const b = cand({
+      preferenceId: "b",
+      key: "doc_header",
+      value: "use header A restated",
+      confidence: 0.5,
+      embedding: [0.99, 0.01, 0, 0],
+    });
+    const out = deconflictBySubject([a, b], 0.85);
+    expect(out.map((r) => r.preferenceId)).toEqual(["a"]);
+  });
+
+  it("keeps genuinely different subjects", () => {
+    const a = cand({ preferenceId: "a", embedding: [1, 0, 0, 0] });
+    const b = cand({ preferenceId: "b", embedding: [0, 1, 0, 0] });
+    expect(deconflictBySubject([a, b], 0.85).map((r) => r.preferenceId)).toEqual([
+      "a",
+      "b",
+    ]);
+  });
+
+  it("never folds a candidate with no embedding", () => {
+    const a = cand({ preferenceId: "a", embedding: [1, 0, 0, 0] });
+    const b = cand({ preferenceId: "b", embedding: null });
+    expect(deconflictBySubject([a, b], 0.85).map((r) => r.preferenceId)).toEqual([
+      "a",
+      "b",
+    ]);
+  });
+});
+
+describe("formatStandingRulesBlock", () => {
+  it("returns empty string for no rules", () => {
+    expect(formatStandingRulesBlock([], INJECTION_RULE_CAP)).toBe("");
+  });
+
+  it("caps the number of rendered rules", () => {
+    const rules = Array.from({ length: 20 }, (_, i) => ({
+      preferenceId: `p${i}`,
+      category: "communication",
+      key: `k${i}`,
+      value: `rule ${i}`,
+      confidence: 1 - i * 0.01,
+      observedAt: "2026-07-01T00:00:00Z",
+    }));
+    const block = formatStandingRulesBlock(rules, 12);
+    expect(block).toContain("## Standing rules");
+    expect((block.match(/^- /gm) ?? []).length).toBe(12);
+  });
+});

package/payload/platform/lib/active-rules/src/index.ts

@@ -0,0 +1,133 @@
+// The one definition of "this account's active, de-conflicted, bounded
+// rule-set" (Task 1486). Consumed by the memory plugin's profile-read
+// (agent-callable) and by the three inbound gateways (per-turn injection). Kept
+// free of neo4j-driver types so both an MCP process and the UI can import the
+// built dist.
+
+export const SAME_SUBJECT_COSINE = 0.85;
+export const INJECTION_RULE_CAP = 12;
+export const ACTIVE_CANDIDATE_FLOOR = 0.4;
+export const ACTIVE_CANDIDATE_LIMIT = 30;
+
+export interface RuleCandidate {
+  preferenceId: string;
+  category: string;
+  key: string;
+  value: string;
+  confidence: number;
+  observedAt: string;
+  embedding: number[] | null;
+}
+
+export interface ActiveRule {
+  preferenceId: string;
+  category: string;
+  key: string;
+  value: string;
+  confidence: number;
+  observedAt: string;
+}
+
+export function cosine(a: number[], b: number[]): number {
+  if (!a.length || !b.length || a.length !== b.length) return 0;
+  let dot = 0;
+  let na = 0;
+  let nb = 0;
+  for (let i = 0; i < a.length; i++) {
+    dot += a[i] * b[i];
+    na += a[i] * a[i];
+    nb += b[i] * b[i];
+  }
+  if (na === 0 || nb === 0) return 0;
+  return dot / (Math.sqrt(na) * Math.sqrt(nb));
+}
+
+// records MUST be confidence-desc on entry. Greedy: the first record of a
+// cluster is the winner; any later record within cosineThreshold of an
+// already-kept winner is a rephrasing and is dropped. A record with no usable
+// embedding is never folded — it is kept as its own subject (we cannot prove it
+// is a duplicate).
+export function deconflictBySubject(
+  records: RuleCandidate[],
+  cosineThreshold: number = SAME_SUBJECT_COSINE,
+): ActiveRule[] {
+  const winners: RuleCandidate[] = [];
+  for (const r of records) {
+    const emb = r.embedding;
+    const isDup =
+      Array.isArray(emb) &&
+      emb.length > 0 &&
+      winners.some(
+        (w) =>
+          Array.isArray(w.embedding) &&
+          w.embedding.length > 0 &&
+          cosine(emb, w.embedding) >= cosineThreshold,
+      );
+    if (!isDup) winners.push(r);
+  }
+  return winners.map(({ embedding: _embedding, ...rest }) => rest);
+}
+
+export function formatStandingRulesBlock(
+  rules: ActiveRule[],
+  cap: number = INJECTION_RULE_CAP,
+): string {
+  if (rules.length === 0) return "";
+  const lines = rules.slice(0, cap).map((r) => `- ${r.value}`);
+  return `## Standing rules\n${lines.join("\n")}`;
+}
+
+interface MinimalSession {
+  run: (
+    q: string,
+    p: Record<string, unknown>,
+  ) => Promise<{ records: Array<{ get(k: string): unknown }> }>;
+}
+
+// The candidate query: this account's admin-scope preferences, not trashed, not
+// a "does not apply" declination, above the injection floor, ordered so the
+// highest-confidence / most-recent wins de-confliction. Returns `embedding` for
+// the clustering step. The trashed predicate mirrors graph-trash's
+// `notTrashed()` exactly (label + deletedAt) so this lib stays dependency-free.
+export async function queryActiveRuleCandidates(
+  session: MinimalSession,
+  accountId: string,
+): Promise<RuleCandidate[]> {
+  // ACTIVE_CANDIDATE_LIMIT is inlined as a Cypher literal rather than bound as a
+  // param: a plain JS number bound to `LIMIT $p` serializes as a FLOAT and Neo4j
+  // rejects it ("not a valid value. Must be a non-negative integer"). This lib
+  // is dependency-free (no neo4j-driver), so it cannot call `neo4j.int()`; the
+  // constant is a hardcoded integer, so inlining it is safe and gate-clean.
+  const result = await session.run(
+    `
+    MATCH (pref:Preference {accountId: $accountId, scope: 'admin'})
+    WHERE NOT pref:Trashed AND pref.deletedAt IS NULL
+      AND coalesce(pref.notApplicable, false) = false
+      AND pref.confidence >= $floor
+    RETURN pref.preferenceId AS preferenceId, pref.category AS category,
+           pref.key AS key, pref.value AS value, pref.confidence AS confidence,
+           pref.observedAt AS observedAt, pref.embedding AS embedding
+    ORDER BY pref.confidence DESC, pref.observedAt DESC
+    LIMIT ${ACTIVE_CANDIDATE_LIMIT}
+    `,
+    { accountId, floor: ACTIVE_CANDIDATE_FLOOR },
+  );
+  return result.records.map((r) => ({
+    preferenceId: r.get("preferenceId") as string,
+    category: r.get("category") as string,
+    key: r.get("key") as string,
+    value: r.get("value") as string,
+    confidence: r.get("confidence") as number,
+    observedAt: (r.get("observedAt") as string) ?? "",
+    embedding: (r.get("embedding") as number[] | null) ?? null,
+  }));
+}
+
+export async function activeRuleSet(
+  session: MinimalSession,
+  accountId: string,
+  cap: number = INJECTION_RULE_CAP,
+): Promise<ActiveRule[]> {
+  const candidates = await queryActiveRuleCandidates(session, accountId);
+  return deconflictBySubject(candidates).slice(0, cap);
+}

package/payload/platform/lib/active-rules/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"],
+  "exclude": ["src/**/*.test.ts"]
+}