@rubytech/create-maxy-code 0.1.419 → 0.1.427

package/payload/platform/plugins/admin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "admin",
-  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform.",
+  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires a managing house admin (its userId) and refuses without one, recording it as the sub-account's managingAdminUserId; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId); account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add, admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/admin/PLUGIN.md

@@ -1,7 +1,7 @@
 ---
 name: admin
 surface: platform
-description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
+description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires a managing house admin (its userId) and refuses without one, recording it as the sub-account's managingAdminUserId; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId); account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add, admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
 tools:
   - name: system-status
     publicAllowlist: false
@@ -33,6 +33,9 @@ tools:
   - name: account_create
     publicAllowlist: false
     adminAllowlist: true
+  - name: account_reassign_admin
+    publicAllowlist: false
+    adminAllowlist: true
   - name: account_delete
     publicAllowlist: false
     adminAllowlist: true
@@ -175,6 +178,7 @@ Tools are available via the `admin` MCP server.
 - `hooks/post-tool-use-agent.sh` — **PostToolUse hook on `Agent`.** Drains any subagent hook-decision buffers under `~/.maxy-code/logs/hook-decisions/` modified since this parent's previous PostToolUse-Agent fire (cursor file keyed by parent session id), prints one `[hook-propagate]` line per record to stdout — Claude Code attaches the stdout as a `hook_success` attachment on the parent JSONL, making the records grep-queryable from the parent session alone. Rotates consumed buffers to `consumed/`. Emits one `[hook-propagate-census] parentSession=<…> subagentHooksObserved=<N> attachmentsEmitted=<M>` line per fire to stdout and server.log; `N != M` is the propagation regression signal. The companion emitter library `hooks/lib/hook-emit.sh` is sourced by `post-tool-use-agent.sh` and any other hook that records a block decision (4 KB stderr truncation, `truncated=true` set on the record).
 - `hooks/admin-authoring-observer.sh` — **PostToolUse hook on Write and Edit.** Observation only — never blocks; exits 0 on every path. Fires when the admin agent (not a specialist subagent — gated by `MAXY_SPECIALIST` env) writes or edits a file under `<accountDir>/output/`. Walks the session transcript from the latest real-user turn forward to detect any prior `Task` `tool_use` whose `subagent_type` starts with `specialists:`. Emits one stderr line `[admin-authoring] inline-write path=<rel> priorSpecialistSpawnInTurn=<true|false|unknown>`. A `false` value on a long-form prose file is the regression signal this hook was designed to make visible — the BioSymm proposal session (admin authored a customer-facing proposal inline despite content-producer being installed) is the failure mode this surfaces mechanically. Mechanical enforcement (refuse the write, force a re-spawn) is deferred per the task spec.
 - `hooks/prompt-optimiser-directive.sh` — **UserPromptSubmit hook.** Injects the standing prompt-optimiser restatement directive plus the per-turn three-tier routing ladder as `additionalContext`: **(1)** delegate to the specialist that owns the deliverable via the Agent tool — the brief states the outcome plus binding constraints, never lines/anchors/literal text; **(2)** only if none fits, load an admin-usable skill with `skill-load`; **(3)** only if neither fits, author inline — freestyle is the named last resort. Re-emits the full agent roster (`agents/admin/AGENTS.md`) and the full admin-usable skills list (`agents/admin/ADMIN-SKILLS.md`) every turn by reading the two generated files from the account dir (the hook fires with the account dir as cwd); it never walks the plugins tree per turn. Fail-open is **visible**: a missing list logs `[prompt-optimiser] missing=<AGENTS.md\|ADMIN-SKILLS.md> emitting-partial` to stderr and the ladder still injects. The trivial-turn skip (one-word confirmation, slash-command, direct continuation) is unchanged. **Staleness:** `ADMIN-SKILLS.md` is regenerated only by `setup-account.sh`; a plugin add/remove since the last setup leaves the list stale — compare `ADMIN-SKILLS.md` mtime against the newest `SKILL.md` mtime and re-run setup to refresh. The list generator is `platform/scripts/lib/admin-skills-bootstrap.sh`; it logs `[admin-skills] scanned=<N> admin-usable=<M> no-declaration=<K>` (failure signature: `admin-usable=0` while `scanned>0`, or any `missing-declaration` line). The directive also carries a standing CAPABILITY-QUESTIONS-ARE-OWNED-WORK clause (how-to / "do you have instructions for X" / config questions about platform features are answered from the owning specialist or plugin tool/reference, never from training memory), and the hook appends a durable `<ts> [prompt-optimiser-directive] injected len=<n> session=<id>` breadcrumb to `$LOG_DIR/prompt-optimiser-directive.log` so per-turn injection is greppable, not stderr-only. The directive is also **suppressed on native channel turns** — when the parsed `.prompt` starts with the `<channel source=` event marker, the hook logs `[prompt-optimiser-directive] skipped reason=channel-turn session=<id>` to stderr and exits without injecting, because the channel service already reframes the inbound into a select-and-dispatch turn (`composeAdminContent`, see `.docs/whatsapp-inbound-lifeline.md`). Marker-matched at start-of-prompt only, so an admin/Terminal prompt that merely mentions "channel" still gets the directive; fail-open injects if the prompt cannot be parsed.
+- `hooks/datetime-inject.sh` — **UserPromptSubmit hook.** Injects a fresh `<datetime>` block as `additionalContext` on every turn (`refresh=per-turn`), so the agent always has the current instant — date, time, timezone, weekday, and the raw UTC ISO — without hand-computing it and without depending on Claude Code's spawn-time "Today's date" line going stale. The instant is computed fresh each turn; the timezone is **not** computed here — it is the operator's own zone, resolved from their `UserProfile.timezone` on the graph once per admin spawn and stamped into `MAXY_ACCOUNT_TZ` (see `platform/services/claude-session-manager/src/account-timezone.ts`). When `MAXY_ACCOUNT_TZ` is empty (a non-admin turn, an unset profile timezone, or a neo4j hiccup at spawn) the block falls back to the server's own zone and labels the source, so a reader can always tell which clock the agent saw. This is the current-time surface the `datetime` skill points at. **Fail-open** on every path (missing `python3` or `node`, any formatting error → exit 0, empty stdout — the turn is never blocked). The hook appends `<ts> [datetime-inject] injected tz=<zone> source=<graph|server-fallback> refresh=per-turn session=<id>` to `$LOG_DIR/datetime-inject.log` so "did the agent have the right time this turn, and from which clock?" is answerable from logs without reproduction.
 - `hooks/prompt-optimiser-compliance.sh` — **Stop hook.** After each admin turn, reads the just-finished turn from `transcript_path` and appends `<ts> [prompt-optimiser-compliance] directive-fired no-route-taken session=<id8> prompt="<clip>"` to `$LOG_DIR/prompt-optimiser-directive.log` (and stderr) when the routing directive fired, the prompt was non-trivial (not a slash-command, not a one-word confirmation), and the turn took **no route** — no `Agent` dispatch, no `Skill` load, no `ToolSearch`, no `mcp__*` tool call. This is the standing compliance signal that surfaces the session-`da0b12d4` failure class (agent answers a capability question from memory) as a visible event instead of a silent stale answer. Directive-fired is detected by the marker `PROMPT-OPTIMISER DIRECTIVE` in the turn slice, so it is robust to the CC-version difference in how `UserPromptSubmit` `additionalContext` is recorded (`attachment`/`hook_success` vs `hook_additional_context`). **Known limitation:** "direct continuation of the prior turn" is not detectable from the transcript, so a continuation turn that legitimately needs no route can be flagged; treat the log as a review signal, not a gate. **Fail-open:** no python3, no `transcript_path`, or an unreadable transcript → exit 0, no output. Lives in the same log as the directive breadcrumb, so a single `grep` interleaves "fired" and "no-route" into one per-session timeline; cross-check via `platform/scripts/logs-read.sh <sessionKey>`. This is a lightweight transcript read, not a per-turn spawn (contrast the turn recorder below).
 - **Turn recorder — removed entirely.** The `turn-completed-graph-write.sh` Stop hook, the `/api/admin/claude-sessions` loopback bypass it relied on, the `[turn-recorder]` emitters, the envelope walker, and the recorder-auto-archive subscriber are deleted. It had been dormant for a long time (never re-registered in settings.json); the admin now writes to the graph by delegating to `database-operator` via the Task tool inside the live session, and the on-demand `/insight` pass (`skills/insight/SKILL.md`, a registered admin skill) is the per-session review. There is no per-turn spawn.
 

package/payload/platform/plugins/admin/hooks/__tests__/datetime-inject.test.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# Regression test for datetime-inject.sh.
+#
+# The hook injects a fresh <datetime> block as UserPromptSubmit additionalContext
+# every turn, reporting "now" in $MAXY_ACCOUNT_TZ (the operator's graph timezone,
+# stamped at spawn) or the server zone when that env is empty.
+#
+# Covers:
+#   1. MAXY_ACCOUNT_TZ set          -> exit 0, valid JSON, additionalContext has
+#      the <datetime> block, the named zone, and a UTC: line; source=graph.
+#   2. MAXY_ACCOUNT_TZ empty        -> exit 0, block falls back to the server zone
+#      and labels source as server-timezone.
+#   3. Breadcrumb                   -> $LOG_DIR/datetime-inject.log gains a line
+#      with source= and refresh=per-turn.
+#   4. python3 absent               -> exit 0, empty stdout (fail-open).
+#   5. node absent                  -> exit 0, empty stdout (fail-open).
+
+set -u
+
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/datetime-inject.sh"
+if [[ ! -x "$HOOK" ]]; then
+  echo "FAIL: $HOOK not executable" >&2
+  exit 1
+fi
+
+PASS=0
+FAIL=0
+STDIN='{"hook_event_name":"UserPromptSubmit","prompt":"when is the meeting","session_id":"sess-abc123"}'
+
+# Case 1 — MAXY_ACCOUNT_TZ set: block reports that zone, source=graph.
+out=$(printf '%s' "$STDIN" | MAXY_ACCOUNT_TZ="Europe/London" LOG_DIR="" bash "$HOOK" 2>/dev/null); ex=$?
+if [[ "$ex" -eq 0 ]] && printf '%s' "$out" | python3 -c '
+import json, sys
+d = json.load(sys.stdin)
+h = d["hookSpecificOutput"]
+assert h["hookEventName"] == "UserPromptSubmit", "wrong hookEventName"
+ctx = h["additionalContext"]
+assert "<datetime>" in ctx and "</datetime>" in ctx, "no datetime block"
+assert "Europe/London" in ctx, "zone not named"
+assert "UTC:" in ctx, "no UTC line"
+assert "account-timezone" in ctx, "source label missing for graph tz"
+' 2>/dev/null; then
+  echo "PASS: MAXY_ACCOUNT_TZ set -> datetime block in named zone"; PASS=$((PASS+1))
+else
+  echo "FAIL: graph-tz injection (exit=$ex stdout=$out)" >&2; FAIL=$((FAIL+1))
+fi
+
+# Case 2 — MAXY_ACCOUNT_TZ empty: falls back to the server zone, labels it.
+out2=$(printf '%s' "$STDIN" | MAXY_ACCOUNT_TZ="" LOG_DIR="" bash "$HOOK" 2>/dev/null); ex2=$?
+if [[ "$ex2" -eq 0 ]] && printf '%s' "$out2" | python3 -c '
+import json, sys
+ctx = json.load(sys.stdin)["hookSpecificOutput"]["additionalContext"]
+assert "<datetime>" in ctx, "no datetime block"
+assert "server-timezone" in ctx, "server fallback not labelled"
+assert "UTC:" in ctx, "no UTC line"
+' 2>/dev/null; then
+  echo "PASS: empty MAXY_ACCOUNT_TZ -> server-zone fallback labelled"; PASS=$((PASS+1))
+else
+  echo "FAIL: server fallback (exit=$ex2 stdout=$out2)" >&2; FAIL=$((FAIL+1))
+fi
+
+# Case 2b — MAXY_ACCOUNT_TZ set but NOT a real IANA zone: the node validation
+# rejects it, falls back to the server zone, and labels the source neutrally as
+# "unavailable" (never falsely "unset" — the value was present, just unusable).
+out2b=$(printf '%s' "$STDIN" | MAXY_ACCOUNT_TZ="Not/AZone" LOG_DIR="" bash "$HOOK" 2>/dev/null); ex2b=$?
+if [[ "$ex2b" -eq 0 ]] && printf '%s' "$out2b" | python3 -c '
+import json, sys
+ctx = json.load(sys.stdin)["hookSpecificOutput"]["additionalContext"]
+assert "<datetime>" in ctx, "no datetime block"
+assert "server-timezone (account timezone unavailable)" in ctx, "invalid tz not labelled unavailable"
+assert "Not/AZone" not in ctx, "rejected zone leaked into the block"
+' 2>/dev/null; then
+  echo "PASS: set-but-invalid MAXY_ACCOUNT_TZ -> server fallback, labelled unavailable"; PASS=$((PASS+1))
+else
+  echo "FAIL: invalid-tz fallback (exit=$ex2b stdout=$out2b)" >&2; FAIL=$((FAIL+1))
+fi
+
+# Case 3 — breadcrumb carries source= and refresh=per-turn.
+LOGD=$(mktemp -d)
+printf '%s' "$STDIN" | MAXY_ACCOUNT_TZ="Europe/London" LOG_DIR="$LOGD" bash "$HOOK" >/dev/null 2>&1
+if [[ -f "$LOGD/datetime-inject.log" ]] \
+   && grep -q "\[datetime-inject\]" "$LOGD/datetime-inject.log" \
+   && grep -q "source=" "$LOGD/datetime-inject.log" \
+   && grep -q "refresh=per-turn" "$LOGD/datetime-inject.log"; then
+  echo "PASS: breadcrumb has source= and refresh=per-turn"; PASS=$((PASS+1))
+else
+  echo "FAIL: breadcrumb missing (log=$(cat "$LOGD/datetime-inject.log" 2>/dev/null))" >&2; FAIL=$((FAIL+1))
+fi
+rm -rf "$LOGD"
+
+# Case 4 — python3 absent -> fail-open (exit 0, empty stdout).
+FAKEBIN=$(mktemp -d)
+for util in cat printf env bash node date; do
+  src=$(command -v "$util" 2>/dev/null) && ln -sf "$src" "$FAKEBIN/$util" 2>/dev/null
+done
+nopy_out=$(printf '%s' "$STDIN" | PATH="$FAKEBIN" MAXY_ACCOUNT_TZ="Europe/London" bash "$HOOK" 2>/dev/null); nopy_exit=$?
+if [[ "$nopy_exit" -eq 0 && -z "$nopy_out" ]]; then
+  echo "PASS: python3 absent -> exit 0, empty stdout (fail-open)"; PASS=$((PASS+1))
+else
+  echo "FAIL: python3 absent (exit=$nopy_exit stdout=$nopy_out)" >&2; FAIL=$((FAIL+1))
+fi
+rm -rf "$FAKEBIN"
+
+# Case 5 — node absent -> fail-open (exit 0, empty stdout).
+FAKEBIN2=$(mktemp -d)
+for util in cat printf env bash python3 date; do
+  src=$(command -v "$util" 2>/dev/null) && ln -sf "$src" "$FAKEBIN2/$util" 2>/dev/null
+done
+nonode_out=$(printf '%s' "$STDIN" | PATH="$FAKEBIN2" MAXY_ACCOUNT_TZ="Europe/London" bash "$HOOK" 2>/dev/null); nonode_exit=$?
+if [[ "$nonode_exit" -eq 0 && -z "$nonode_out" ]]; then
+  echo "PASS: node absent -> exit 0, empty stdout (fail-open)"; PASS=$((PASS+1))
+else
+  echo "FAIL: node absent (exit=$nonode_exit stdout=$nonode_out)" >&2; FAIL=$((FAIL+1))
+fi
+rm -rf "$FAKEBIN2"
+
+echo "----"
+echo "PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -eq 0 ]]

package/payload/platform/plugins/admin/hooks/__tests__/prompt-optimiser-compliance.test.sh

@@ -60,6 +60,16 @@ CHANNEL_REFRAME_TRIVIAL='{"type":"user","isMeta":true,"message":{"role":"user","
 # registration key `channel`, and the server embeds an inner source tag, so the
 # reframe arrives DOUBLE-wrapped. The strip must iterate to reach ## Context.
 CHANNEL_REFRAME_MULTI='{"type":"user","isMeta":true,"message":{"role":"user","content":"<channel source=\"channel\">\n<channel source=\"whatsapp\">\n## Context\nplease draft the works order PDF for order 926\n\n## Instruction\nChoose the installed specialist that owns this request and dispatch it with the Agent tool.\n</channel>\n</channel>"}}'
+# Task 1505 — the same reframe carrying the account's active standing-rules block
+# (Task 1486 prepends `## Standing rules\n- …\n\n` above ## Context on admin
+# channel turns). The reframe detection must strip that optional prefix, mirroring
+# the reader anchor, so a rules-present turn is evaluated identically to a
+# rules-absent one; without the strip the turn no longer starts with ## Context
+# and the hook silently stops flagging on exactly the rule-carrying turns.
+CHANNEL_REFRAME_RULES='{"type":"user","isMeta":true,"message":{"role":"user","content":"<channel source=\"whatsapp-channel\">## Standing rules\n- Always greet the client by name\n- Use British spelling\n\n## Context\nplease draft the works order PDF for order 926\n\n## Instruction\nChoose the installed specialist that owns this request and dispatch it with the Agent tool.</channel>"}}'
+# Same rules-prefixed shape, one-word Context payload — after the prefix strip the
+# trivial filter must still read just the payload (`yes`), not the rules block.
+CHANNEL_REFRAME_RULES_TRIVIAL='{"type":"user","isMeta":true,"message":{"role":"user","content":"<channel source=\"whatsapp-channel\">## Standing rules\n- Always greet the client by name\n- Use British spelling\n\n## Context\nyes\n\n## Instruction\nChoose the installed specialist that owns this request and dispatch it with the Agent tool.</channel>"}}'
 
 assert_flagged() {
   local name="$1" t="$2" out
@@ -181,6 +191,18 @@ assert_flagged "multi-target double-wrapped reframe + inline authoring -> flagge
 # 18c. Same double-wrapped reframe with an Agent dispatch -> not flagged.
 assert_not_flagged "multi-target double-wrapped reframe + Agent dispatch -> not flagged" \
   "$(mk_transcript "$CHANNEL_REFRAME_MULTI" "$ASSISTANT_REPLY" "$ASSISTANT_AGENT")"
+# 18d. Task 1505 — rules-prefixed reframe, inline authoring, no marker -> flagged.
+# The regression guard: with the standing-rules block above ## Context the pre-fix
+# hook read is_reframe=False and silently stopped flagging this class.
+assert_flagged "rules-prefixed reframe + inline authoring, no marker -> flagged" \
+  "$(mk_transcript "$CHANNEL_REFRAME_RULES" "$ASSISTANT_REPLY" "$ASSISTANT_BASH" "$ASSISTANT_WRITE")"
+# 18e. Same rules-prefixed reframe with an Agent dispatch -> not flagged.
+assert_not_flagged "rules-prefixed reframe + Agent dispatch -> not flagged" \
+  "$(mk_transcript "$CHANNEL_REFRAME_RULES" "$ASSISTANT_REPLY" "$ASSISTANT_AGENT")"
+# 18f. Rules-prefixed reframe whose Context payload is one word -> trivial, not
+# flagged (the prefix strip must leave just the payload for the trivial filter).
+assert_not_flagged "rules-prefixed reframe with one-word Context payload -> not flagged (trivial)" \
+  "$(mk_transcript "$CHANNEL_REFRAME_RULES_TRIVIAL" "$ASSISTANT_TEXT")"
 # 19. Channel-wrapped NON-reframe turn (no ## Instruction section — webchat
 # today, Task 776) with no marker -> not directive-equivalent, not flagged.
 assert_not_flagged "channel-wrapped non-reframe turn, no marker -> not flagged" \

package/payload/platform/plugins/admin/hooks/datetime-inject.sh

@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+# Task 1515 — UserPromptSubmit hook: inject a fresh <datetime> block as
+# additionalContext on every turn, so the agent always has the current instant
+# (date, time, timezone, weekday, and the raw UTC ISO) without hand-computing it
+# and without depending on Claude Code's spawn-time "Today's date" line going
+# stale. This is the per-turn current-time surface the datetime skill points at.
+#
+# The instant is computed fresh here every turn (refresh=per-turn). The timezone
+# is NOT computed here — it is the operator's own zone, resolved from their
+# UserProfile on the graph once per admin spawn and stamped into MAXY_ACCOUNT_TZ.
+# When MAXY_ACCOUNT_TZ is empty (a non-admin turn, an unset profile timezone, or
+# a neo4j hiccup at spawn) the block falls back to the server's own zone and
+# labels the source, so a reader can always tell which clock the agent saw.
+#
+# Mirrors prompt-optimiser-directive.sh: emit hookSpecificOutput.additionalContext
+# via python3, fail-open with exit 0 on every path. UserPromptSubmit output is
+# ADDED to the prompt, never substituted — the raw prompt always still reaches
+# the model.
+#
+# Input  (stdin, UserPromptSubmit contract): { "session_id": "...", ... } —
+#         session_id is used only for the breadcrumb; the prompt text is ignored
+#         (the block is standing and prompt-independent).
+# Output (stdout JSON):
+#   { "hookSpecificOutput": { "hookEventName": "UserPromptSubmit",
+#                             "additionalContext": "<datetime>...</datetime>" } }
+
+set -uo pipefail
+
+# Drain stdin FIRST, before any exit path. Claude Code writes the full
+# UserPromptSubmit payload (which carries the prompt text) to our stdin; if we
+# exit before reading it, a payload larger than the pipe buffer leaves the parent
+# blocked on write and then hit with EPIPE/SIGPIPE. The sibling
+# prompt-optimiser-directive.sh drains first for this exact reason. Only
+# session_id is used here (for the breadcrumb); the block is prompt-independent.
+HOOK_INPUT=$(cat 2>/dev/null || true)
+
+# Fail-open if either encoder is unavailable: python3 wraps the JSON envelope,
+# node formats the instant in the target zone (Intl has the full IANA database).
+command -v python3 >/dev/null 2>&1 || exit 0
+command -v node >/dev/null 2>&1 || exit 0
+
+# The operator's zone, stamped at spawn from the graph. Empty -> server zone.
+ACCOUNT_TZ="${MAXY_ACCOUNT_TZ:-}"
+
+# Format the current instant. node prints two tab-separated fields:
+#   1. the resolved IANA zone actually used (so the server-fallback names a real
+#      zone, not the string "server")
+#   2. the assembled block body
+# TZ_IN is passed as argv[1]; empty means "use the runtime's own zone".
+BLOCK=$(TZ_IN="$ACCOUNT_TZ" node -e '
+const tzIn = process.env.TZ_IN && process.env.TZ_IN.trim().length ? process.env.TZ_IN.trim() : null;
+const now = new Date();
+// Resolve the zone actually used. A supplied zone that Intl rejects falls back
+// to the runtime zone, so a bad stamp can never break the turn.
+let zone = tzIn;
+try { if (zone) new Intl.DateTimeFormat("en-GB", { timeZone: zone }); }
+catch { zone = null; }
+if (!zone) zone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+// zone === tzIn only when a non-empty, valid graph timezone was stamped; every
+// other case (env empty on a non-admin turn, or a stamped value Intl rejected)
+// falls back to the runtime zone. Label that neutrally as "unavailable" rather
+// than asserting "unset" — the [datetime-tz] spawn log distinguishes unset from
+// invalid from unavailable; here all the hook knows is the zone is not the graph one.
+const source = tzIn && zone === tzIn ? "account-timezone (graph)" : "server-timezone (account timezone unavailable)";
+const local = new Intl.DateTimeFormat("en-GB", {
+  weekday: "long", day: "numeric", month: "long", year: "numeric",
+  hour: "2-digit", minute: "2-digit", timeZone: zone, timeZoneName: "longOffset",
+}).format(now);
+const body = [
+  "Current date and time, read this rather than computing it by hand:",
+  "Now: " + local + " (" + zone + ")",
+  "UTC: " + now.toISOString(),
+  "Source: " + source,
+].join("\n");
+process.stdout.write(zone + "\t" + body);
+' 2>/dev/null) || exit 0
+
+[ -n "$BLOCK" ] || exit 0
+ZONE_USED="${BLOCK%%$'\t'*}"
+BODY="${BLOCK#*$'\t'}"
+CONTEXT="<datetime>
+$BODY
+</datetime>"
+
+OUT=$(printf '%s' "$CONTEXT" | python3 -c '
+import json, sys
+ctx = sys.stdin.read()
+print(json.dumps({
+    "hookSpecificOutput": {
+        "hookEventName": "UserPromptSubmit",
+        "additionalContext": ctx,
+    }
+}))
+' 2>/dev/null) || exit 0
+
+[ -n "$OUT" ] || exit 0
+printf '%s\n' "$OUT"
+
+# Breadcrumb: source (graph vs server-fallback) + refresh=per-turn so a future
+# staleness report can tell which clock was live each turn without reproduction.
+# Fail-open: a missing/unwritable LOG_DIR just skips the write.
+SID=$(printf '%s' "$HOOK_INPUT" | python3 -c 'import json,sys
+try:
+    print(json.load(sys.stdin).get("session_id","") or "?")
+except Exception:
+    print("?")' 2>/dev/null)
+SID=${SID:-?}
+if [ -n "$ACCOUNT_TZ" ] && [ "$ZONE_USED" = "$ACCOUNT_TZ" ]; then SRC=graph; else SRC=server-fallback; fi
+NOW_ISO=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo "?")
+LINE="$NOW_ISO [datetime-inject] injected tz=$ZONE_USED source=$SRC refresh=per-turn session=$SID"
+if [ -n "${LOG_DIR:-}" ] && [ -d "$LOG_DIR" ]; then
+  printf '%s\n' "$LINE" >> "$LOG_DIR/datetime-inject.log" 2>/dev/null || true
+fi
+echo "$LINE" >&2 || true
+exit 0

package/payload/platform/plugins/admin/hooks/prompt-optimiser-compliance.sh

@@ -42,7 +42,7 @@ INPUT=$(cat 2>/dev/null || true)
 command -v python3 >/dev/null 2>&1 || exit 0
 
 RESULT=$(printf '%s' "$INPUT" | python3 -c '
-import json, sys, os, datetime
+import json, sys, os, datetime, re
 
 def fail_open():
     sys.exit(0)
@@ -144,6 +144,19 @@ while inner.startswith("<channel"):
     inner = inner[end + 1:close].strip()
     is_channel = True
 
+# Task 1505 — mirror the reader anchor (parse-transcript.ts COMPOSED_ADMIN_FRAME).
+# For admin channel turns Task 1486 prepends the account active standing-rules block
+# (`## Standing rules\n- …\n\n`) above `## Context`, so a rules-present channel turn
+# no longer begins with `## Context` and both the reframe detection and the trivial
+# strip below silently stopped firing on exactly those turns. Strip an optional
+# leading standing-rules block — anchored to the `## Standing rules` header (not any
+# prefix), non-greedy up to the `\n\n` immediately before `## Context` — so both see
+# the `## Context` payload as before rules injection. Channel-only and match-gated on
+# a following `## Context`, so a rules-absent channel turn is byte-identical to before
+# and a typed (non-channel) prompt is untouched.
+if is_channel:
+    inner = re.sub(r"^## Standing rules\n[\s\S]*?\n\n(?=## Context\n)", "", inner, count=1)
+
 # Task 805 — a channel-wrapped reframe turn (the ## Context / ## Instruction
 # sections of composeAdminContent) is directive-equivalent: the directive hook suppresses
 # itself on channel turns (Task 753), so the reframe is the only routing

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -27,7 +27,7 @@ import { publishSite } from "./tools/publish-site.js";
 import { resolveCapabilitiesHere } from "./tools/capabilities-here.js";
 import { runCatalogueCensus } from "./lib/catalogue-census.js";
 import { lifelineTool } from "../../../../lib/mcp-lifeline/dist/index.js";
-import { listAccountsFromDir, isHouseAccount, archiveAccountDir, provisionClientAccount, findHouseAccount, getChannelRoutingAccountId, setChannelRoutingAccountId, seedAccountGraphRoot, ACCOUNT_NODE_COUNT_CYPHER, ACCOUNT_PURGE_CYPHER, } from "./tools/account-lifecycle.js";
+import { listAccountsFromDir, isHouseAccount, archiveAccountDir, provisionClientAccount, findHouseAccount, getChannelRoutingAccountId, setChannelRoutingAccountId, seedAccountGraphRoot, readHouseAdminUserIds, setManagingAdmin, findClientAccountsManagedBy, reassignManagingAdmin, ACCOUNT_NODE_COUNT_CYPHER, ACCOUNT_PURGE_CYPHER, } from "./tools/account-lifecycle.js";
 function refusalGuidance(kind) {
     switch (kind) {
         case "unsafe-slug":
@@ -1085,6 +1085,17 @@ eagerTool(server, "admin-remove", "Remove an admin from this account. Removes th
     if (admins.length <= 1) {
         return { content: [{ type: "text", text: `${TAG} Cannot remove the last admin. At least one admin must remain on the account.` }], isError: true };
     }
+    // Task 1501 — never orphan a managed sub-account. A managing admin is always a
+    // house admin, so this bites only when removing from the house account: if
+    // `userId` is the managing admin of any client sub-account, refuse and name
+    // them so the operator reassigns each (account_reassign_admin) before retrying.
+    if (isHouseAccount(ACCOUNTS_ROOT, ACCOUNT_ID)) {
+        const managed = findClientAccountsManagedBy(ACCOUNTS_ROOT, userId);
+        if (managed.length > 0) {
+            process.stderr.write(`[account-lifecycle] op=admin-remove-reconcile userId=${userId.slice(0, 8)} managedAccounts=${managed.length} action=blocked\n`);
+            return { content: [{ type: "text", text: `${TAG} Cannot remove ${userId}: they are the managing admin of ${managed.length} client sub-account(s): ${managed.join(", ")}. Reassign each to another house admin with account_reassign_admin, then retry.` }], isError: true };
+        }
+    }
     // Resolve the admin's name from Neo4j (canonical) for the confirmation
     // message. Best-effort — fall back to userId if the graph is unreachable.
     let removedName = userId;
@@ -3256,9 +3267,23 @@ eagerTool(server, "account_list", "List every sub-account on this install (one h
         content: [{ type: "text", text: accounts.length ? lines.join("\n") : "No accounts found." }],
     };
 });
-eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this install (managed service). Mints a UUID, scaffolds the account directory (agents, specialists, settings, account.json with role:\"client\"), seeds default plugins, and seeds the account's graph root (a :LocalBusiness plus its owner :AdminUser) so you can populate it immediately. Returns the new accountId. Operator-only; never creates the house sub-account (that is the install itself).", {}, async () => {
+eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this install (managed service). REQUIRES a managing admin: pass `adminUserId`, the userId of the house team member who will manage this client (get the choices from admin-list; ask the operator which one before creating). Mints a UUID, scaffolds the account directory (agents, specialists, settings, account.json with role:\"client\" and managingAdminUserId), seeds default plugins, and seeds the account's graph root (a :LocalBusiness plus its owner :AdminUser) so you can populate it immediately. Refuses if no adminUserId is given or if it is not a current house admin. Returns the new accountId. Operator-only; never creates the house sub-account (that is the install itself).", {
+    adminUserId: z.string().describe("The userId of the house admin who will manage this client sub-account. Must be a current house admin (see admin-list). Required — creation is refused without it."),
+}, async ({ adminUserId }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("account_create");
+    // Task 1500 — every client sub-account must carry a responsible house admin.
+    // Refuse (tool error, never a silent default) when none is named, or when
+    // the named userId is not a current house admin.
+    if (!adminUserId || !adminUserId.trim()) {
+        process.stderr.write(`[account-lifecycle] op=create-refused reason=no-admin adminUserId=-\n`);
+        return { content: [{ type: "text", text: `account_create refused: name the managing house admin (adminUserId). Call admin-list to see the choices and ask the operator which one manages this client.` }], isError: true };
+    }
+    const houseAdminUserIds = readHouseAdminUserIds(ACCOUNTS_ROOT);
+    if (!houseAdminUserIds.includes(adminUserId)) {
+        process.stderr.write(`[account-lifecycle] op=create-refused reason=unknown-admin adminUserId=${adminUserId.slice(0, 8)}\n`);
+        return { content: [{ type: "text", text: `account_create refused: ${adminUserId} is not a current house admin. Call admin-list for the valid managing-admin choices.` }], isError: true };
+    }
     const newId = randomUUID();
     try {
         const accountDir = provisionClientAccount({
@@ -3302,11 +3327,26 @@ eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this
         finally {
             await seedSession.close();
         }
-        process.stderr.write(`[account-lifecycle] op=create accountId=${newId} dir-exists=${dirExists} root-seeded=${rootSeeded}\n`);
+        process.stderr.write(`[account-lifecycle] op=create accountId=${newId} dir-exists=${dirExists} root-seeded=${rootSeeded} managingAdmin=${adminUserId.slice(0, 8)}\n`);
         if (!rootSeeded) {
             return { content: [{ type: "text", text: `account_create FAILED: graph root not seeded for ${newId} (business+admin read-back failed). The account directory was scaffolded but is rootless — run account_delete ${newId} and retry.` }], isError: true };
         }
-        return { content: [{ type: "text", text: `Created client sub-account ${newId}. Switch to it from the sub-account picker to work in its data.` }] };
+        // Task 1500 — persist the validated managing admin on the new sub-account.
+        // Done after the root seed so a rootless failure never leaves a half-created
+        // account claiming a manager. Its own try: at this point the account is
+        // fully created and seeded, so a write failure must not be reported as a
+        // generic create failure (which would push the operator to retry and
+        // orphan a second account). Report the real state — created but unmanaged —
+        // with the recovery action.
+        try {
+            setManagingAdmin(ACCOUNTS_ROOT, newId, adminUserId);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`[account-lifecycle] op=create-admin-write-failed accountId=${newId} error=${msg}\n`);
+            return { content: [{ type: "text", text: `account_create: sub-account ${newId} was created and its graph root seeded, but recording the managing admin failed: ${msg}. The account exists with no managing admin — run account_delete ${newId} and retry.` }], isError: true };
+        }
+        return { content: [{ type: "text", text: `Created client sub-account ${newId}, managed by admin ${adminUserId}. Switch to it from the sub-account picker to work in its data.` }] };
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -3314,6 +3354,24 @@ eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this
         return { content: [{ type: "text", text: `account_create FAILED: ${msg}` }], isError: true };
     }
 });
+eagerTool(server, "account_reassign_admin", "Reassign a CLIENT sub-account's managing house admin. Pass `accountId` (the client sub-account) and `adminUserId` (the new managing admin's userId — must be a current house admin; get the choices from admin-list and ask the operator which team member takes it). Rewrites the sub-account's managingAdminUserId; the new admin is picked up on the next passive intake. Use it to repair a dangling managing admin (one whose house admin was removed) or to hand a client to a different team member. Refuses if the account is not a client sub-account, or if adminUserId is not a current house admin. Operator-only.", {
+    accountId: z.string().describe("The client sub-account (UUID) whose managing admin changes."),
+    adminUserId: z.string().describe("The userId of the house admin to become the managing admin. Must be a current house admin (see admin-list)."),
+}, async ({ accountId, adminUserId }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("account_reassign_admin");
+    const res = reassignManagingAdmin(ACCOUNTS_ROOT, accountId, adminUserId);
+    if (!res.ok) {
+        const msg = res.reason === "no-account"
+            ? `${accountId} is not a registered account on this install.`
+            : res.reason === "not-client"
+                ? `${accountId} is not a client sub-account (the house account has no managing admin).`
+                : `${adminUserId} is not a current house admin. Call admin-list for the valid managing-admin choices.`;
+        return { content: [{ type: "text", text: `account_reassign_admin refused: ${msg}` }], isError: true };
+    }
+    process.stderr.write(`[account-lifecycle] op=reassign accountId=${accountId} from=${res.previousAdminUserId ? res.previousAdminUserId.slice(0, 8) : "-"} to=${adminUserId.slice(0, 8)}\n`);
+    return { content: [{ type: "text", text: `Reassigned client sub-account ${accountId} to managing admin ${adminUserId}. It takes effect on the next passive intake.` }] };
+});
 eagerTool(server, "account_delete", "Archive a CLIENT sub-account: move its directory to data/accounts/.trash/ so it no longer appears in the sub-account list. Graph data is RETAINED — run account_purge with the typed confirmation to irreversibly delete it. Refuses to archive the house sub-account. Pass the accountId to archive.", {
     accountId: z.string().describe("The client accountId (UUID) to archive."),
 }, async ({ accountId }) => {