@rubytech/create-maxy-code 0.1.434 → 0.1.436

package/payload/platform/plugins/admin/hooks/__tests__/askuserquestion-channel-carrier-gate.test.sh

@@ -0,0 +1,175 @@
+#!/usr/bin/env bash
+# Regression test for askuserquestion-channel-carrier-gate.sh.
+#
+# The hook blocks AskUserQuestion when the session has a native channel
+# attached — signalled by a channel MCP config file for this session id in
+# tmpdir. A channel carries no elicitation card, so the turn would wedge; the
+# hook steers the agent to ask in prose via its channel reply tool instead.
+#
+# Covers (per .tasks/1552):
+#   1. Channel attached (webchat config file present) + AskUserQuestion  → BLOCK channel-attached
+#   2. No channel file + AskUserQuestion                                 → ALLOW no-channel
+#   3. Non-AskUserQuestion tool                                          → exit 0 silent (no [ask-channel] line)
+#   4. PostToolUse event on AskUserQuestion                             → exit 0 silent
+#   5. Missing session_id                                               → ALLOW fail-open-no-session
+#   6. No stdin envelope                                                → ALLOW fail-open-no-envelope
+#   7. Each of the 4 channel filename shapes present                    → BLOCK channel-attached
+#   8. Session id needing sanitization, sanitized file present          → BLOCK channel-attached
+#
+# All decisive cases assert exit code AND the decision-log signature on stderr.
+
+set -u
+
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/askuserquestion-channel-carrier-gate.sh"
+if [ ! -x "$HOOK" ]; then
+  echo "FAIL: $HOOK not executable" >&2
+  exit 1
+fi
+
+PASS=0
+FAIL=0
+
+# Run one case. Args:
+#   $1 = name
+#   $2 = stdin payload ("" for no-envelope: closed stdin)
+#   $3 = tmpdir the hook should scan (ASK_CHANNEL_TMPDIR override), "" for default
+#   $4 = expected exit code
+#   $5 = expected log signature regex (matched against stderr; "" = assert stderr is empty)
+run_case() {
+  local name="$1" stdin="$2" scan_dir="$3" expected_exit="$4" expected_log_re="$5"
+  local stderr_file actual_exit
+  stderr_file="$(mktemp)"
+  if [ -z "$stdin" ]; then
+    # No envelope: close stdin so the hook's `[ -t 0 ]` / empty-read path fires.
+    ASK_CHANNEL_TMPDIR="$scan_dir" bash "$HOOK" >/dev/null 2>"$stderr_file" </dev/null
+  else
+    printf '%s' "$stdin" | ASK_CHANNEL_TMPDIR="$scan_dir" bash "$HOOK" >/dev/null 2>"$stderr_file"
+  fi
+  actual_exit=$?
+  local stderr_content
+  stderr_content=$(cat "$stderr_file")
+  rm -f "$stderr_file"
+
+  local exit_ok=0 log_ok=0
+  if [ "$actual_exit" -eq "$expected_exit" ]; then exit_ok=1; fi
+  if [ -z "$expected_log_re" ]; then
+    # Empty regex means: assert the hook emitted NO [ask-channel] line.
+    if ! printf '%s' "$stderr_content" | grep -q '\[ask-channel\]'; then log_ok=1; fi
+  else
+    if printf '%s' "$stderr_content" | grep -Eq "$expected_log_re"; then log_ok=1; fi
+  fi
+
+  if [ $exit_ok -eq 1 ] && [ $log_ok -eq 1 ]; then
+    echo "PASS: $name (exit=$actual_exit)"
+    PASS=$((PASS + 1))
+  else
+    echo "FAIL: $name" >&2
+    [ $exit_ok -eq 0 ] && echo "  expected exit=$expected_exit, got=$actual_exit" >&2
+    [ $log_ok -eq 0 ]  && echo "  expected log regex: ${expected_log_re:-<none>}" >&2 && \
+                          echo "  actual stderr: $stderr_content" >&2
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+SID="1a085718-1111-2222-3333-444455556666"
+SID8="1a085718"
+
+# Stdin payloads.
+PRE_ASK="{\"hook_event_name\":\"PreToolUse\",\"tool_name\":\"AskUserQuestion\",\"session_id\":\"$SID\",\"tool_input\":{\"questions\":[]}}"
+PRE_OTHER="{\"hook_event_name\":\"PreToolUse\",\"tool_name\":\"Bash\",\"session_id\":\"$SID\",\"tool_input\":{\"command\":\"ls\"}}"
+POST_ASK="{\"hook_event_name\":\"PostToolUse\",\"tool_name\":\"AskUserQuestion\",\"session_id\":\"$SID\",\"tool_input\":{\"questions\":[]}}"
+PRE_ASK_NO_SID='{"hook_event_name":"PreToolUse","tool_name":"AskUserQuestion","tool_input":{"questions":[]}}'
+
+# ---------- Cases ----------
+
+# 1. Channel attached (webchat config present) → BLOCK.
+DIR_WEBCHAT=$(mktemp -d)
+: > "$DIR_WEBCHAT/maxy-webchat-channel-$SID.json"
+run_case "Webchat channel attached → BLOCK channel-attached" \
+  "$PRE_ASK" "$DIR_WEBCHAT" 2 \
+  "\[ask-channel\] decision=block sessionId=$SID8 channel=attached reason=channel-attached"
+rm -rf "$DIR_WEBCHAT"
+
+# 2. No channel file → ALLOW no-channel.
+DIR_EMPTY=$(mktemp -d)
+run_case "No channel file → ALLOW no-channel" \
+  "$PRE_ASK" "$DIR_EMPTY" 0 \
+  "\[ask-channel\] decision=allow sessionId=$SID8 channel=none reason=no-channel"
+rm -rf "$DIR_EMPTY"
+
+# 3. Non-AskUserQuestion tool → silent exit 0.
+DIR_WITH_FILE=$(mktemp -d)
+: > "$DIR_WITH_FILE/maxy-webchat-channel-$SID.json"
+run_case "Non-AskUserQuestion tool → exit 0 silent" \
+  "$PRE_OTHER" "$DIR_WITH_FILE" 0 ""
+rm -rf "$DIR_WITH_FILE"
+
+# 4. PostToolUse event → silent exit 0 (even with channel file present).
+DIR_POST=$(mktemp -d)
+: > "$DIR_POST/maxy-webchat-channel-$SID.json"
+run_case "PostToolUse on AskUserQuestion → exit 0 silent" \
+  "$POST_ASK" "$DIR_POST" 0 ""
+rm -rf "$DIR_POST"
+
+# 5. Missing session_id → ALLOW fail-open-no-session.
+DIR_NOSID=$(mktemp -d)
+run_case "Missing session_id → ALLOW fail-open-no-session" \
+  "$PRE_ASK_NO_SID" "$DIR_NOSID" 0 \
+  '\[ask-channel\] decision=allow sessionId=- channel=none reason=fail-open-no-session'
+rm -rf "$DIR_NOSID"
+
+# 6. No stdin envelope → ALLOW fail-open-no-envelope.
+run_case "No stdin envelope → ALLOW fail-open-no-envelope" \
+  "" "" 0 \
+  '\[ask-channel\] decision=allow sessionId=- channel=none reason=fail-open-no-envelope'
+
+# 7. Each of the 4 channel filename shapes present → BLOCK.
+for kind in channel webchat-channel wa-channel telegram-channel; do
+  DIR_KIND=$(mktemp -d)
+  : > "$DIR_KIND/maxy-$kind-$SID.json"
+  run_case "Channel file shape maxy-$kind-<sid>.json → BLOCK channel-attached" \
+    "$PRE_ASK" "$DIR_KIND" 2 \
+    "\[ask-channel\] decision=block sessionId=$SID8 channel=attached reason=channel-attached"
+  rm -rf "$DIR_KIND"
+done
+
+# 8. Session id needing sanitization: raw id has chars outside [A-Za-z0-9_-];
+#    the writer sanitizes to '_', so the on-disk file uses the sanitized id.
+RAW_SID="acc/one:sess"          # '/' and ':' are sanitized to '_'
+SAN_SID="acc_one_sess"
+DIR_SAN=$(mktemp -d)
+: > "$DIR_SAN/maxy-webchat-channel-$SAN_SID.json"
+PRE_ASK_RAW="{\"hook_event_name\":\"PreToolUse\",\"tool_name\":\"AskUserQuestion\",\"session_id\":\"$RAW_SID\",\"tool_input\":{\"questions\":[]}}"
+run_case "Sanitized session id resolves the file → BLOCK channel-attached" \
+  "$PRE_ASK_RAW" "$DIR_SAN" 2 \
+  '\[ask-channel\] decision=block sessionId=acc/one: channel=attached reason=channel-attached'
+rm -rf "$DIR_SAN"
+
+# 9. Real tmpdir resolution fallback: no ASK_CHANNEL_TMPDIR override, TMPDIR
+#    unset, TMP set → the hook must resolve TMP (mirroring Node's os.tmpdir())
+#    and find the config file there. Proves the production resolution order, not
+#    just the test override.
+DIR_TMP=$(mktemp -d)
+: > "$DIR_TMP/maxy-webchat-channel-$SID.json"
+tmp_stderr="$(mktemp)"
+printf '%s' "$PRE_ASK" | env -u TMPDIR -u ASK_CHANNEL_TMPDIR -u TEMP TMP="$DIR_TMP" \
+  bash "$HOOK" >/dev/null 2>"$tmp_stderr"
+tmp_exit=$?
+if [ "$tmp_exit" -eq 2 ] && grep -Eq "\[ask-channel\] decision=block sessionId=$SID8 channel=attached reason=channel-attached" "$tmp_stderr"; then
+  echo "PASS: TMP-fallback resolution finds the config file → BLOCK (exit=$tmp_exit)"
+  PASS=$((PASS + 1))
+else
+  echo "FAIL: TMP-fallback resolution" >&2
+  echo "  expected exit=2 got=$tmp_exit; stderr: $(cat "$tmp_stderr")" >&2
+  FAIL=$((FAIL + 1))
+fi
+rm -f "$tmp_stderr"
+rm -rf "$DIR_TMP"
+
+echo
+echo "──────── askuserquestion-channel-carrier-gate test summary ────────"
+echo "PASS: $PASS"
+echo "FAIL: $FAIL"
+
+[ "$FAIL" -gt 0 ] && exit 1
+exit 0

package/payload/platform/plugins/admin/hooks/askuserquestion-channel-carrier-gate.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# AskUserQuestion native-channel carrier gate.
+#
+# Blocks `AskUserQuestion` when the session has a native channel attached. The
+# Claude Code channel protocol carries exactly two interactive methods
+# (permission_request / permission); there is NO carrier for the AskUserQuestion
+# elicitation. On a native-channel (rc-spawn) webchat/WhatsApp/Telegram session
+# the harness blocks the turn awaiting a selection that can never arrive: the
+# reader renders only delivered replies, never an elicitation card, so the turn
+# wedges — the operator sees the last delivered reply and a live-looking but
+# dead composer (see .tasks/1552, live SiteDesk incident session 1a085718
+# 2026-07-11). This hook removes that wedge deterministically by steering the
+# agent to ask the same question as prose via its channel reply tool, which
+# rides the ordinary delivered-reply path that works on every surface.
+#
+# This is a SEPARATE concern from askuserquestion-investigate-gate.sh (which
+# blocks a fabricated menu raised before any investigation). Both are registered
+# as commands on the same PreToolUse AskUserQuestion matcher; either exit 2
+# blocks. This hook guards the "surface can't render this" condition; the other
+# guards the "no evidence yet" condition.
+#
+# Signal: the rc-spawn writes the channel MCP registration as a config file in
+# os.tmpdir() keyed by session id (channel-mcp.ts / webchat-channel-mcp.ts /
+# wa-channel-mcp.ts / telegram-channel-mcp.ts). Its presence at tool-call time
+# is the authoritative "channel attached to this session" marker: a Pi channel
+# process sees the file (block); a claude.ai/code process on another host never
+# sees the Pi tmpfile (fail-open, allow — that surface can answer the card).
+#
+# Contract:
+#   Input:  PreToolUse stdin JSON envelope from Claude Code
+#   Output: exit 0 (allow) or exit 2 (block) per hook protocol
+#   Logs:   one stderr line per decisive call, format
+#           [ask-channel] decision=<allow|block> sessionId=<id8>
+#                         channel=<attached|none>
+#                         reason=<channel-attached|no-channel|fail-open-no-envelope|fail-open-no-session>
+#
+# Fail-open philosophy: any missing/blank marker (no channel file, no session
+# id, no envelope) nudges the agent through, never bricks the UI. Block is
+# reserved for the deterministic case "AskUserQuestion fired while a channel
+# config file for this session exists in tmpdir".
+
+set -uo pipefail
+
+# ----- Read stdin, identify event ------------------------------------------
+if [ -t 0 ]; then
+  # No envelope — cannot enforce. Fail open per nudge-not-brick rule.
+  echo "[ask-channel] decision=allow sessionId=- channel=none reason=fail-open-no-envelope" >&2
+  exit 0
+fi
+INPUT=$(cat)
+
+if [ -z "$INPUT" ]; then
+  echo "[ask-channel] decision=allow sessionId=- channel=none reason=fail-open-no-envelope" >&2
+  exit 0
+fi
+
+HOOK_EVENT=$(printf '%s' "$INPUT" | python3 -c '
+import sys, json
+try:
+    d = json.load(sys.stdin)
+    print(d.get("hook_event_name", "") or "")
+except Exception:
+    print("")
+' 2>/dev/null)
+
+TOOL_NAME=$(printf '%s' "$INPUT" | python3 -c '
+import sys, json
+try:
+    d = json.load(sys.stdin)
+    print(d.get("tool_name", "") or "")
+except Exception:
+    print("")
+' 2>/dev/null)
+
+# Only applies to PreToolUse on AskUserQuestion. Anything else: silent exit.
+if [ "$HOOK_EVENT" != "PreToolUse" ] || [ "$TOOL_NAME" != "AskUserQuestion" ]; then
+  exit 0
+fi
+
+SESSION_ID=$(printf '%s' "$INPUT" | python3 -c '
+import sys, json
+try:
+    d = json.load(sys.stdin)
+    print(d.get("session_id", "") or "")
+except Exception:
+    print("")
+' 2>/dev/null)
+SESSION_ID8="${SESSION_ID:0:8}"
+if [ -z "$SESSION_ID8" ]; then SESSION_ID8="-"; fi
+
+if [ -z "$SESSION_ID" ]; then
+  echo "[ask-channel] decision=allow sessionId=- channel=none reason=fail-open-no-session" >&2
+  exit 0
+fi
+
+# ----- Resolve the tmpdir the writers used ---------------------------------
+# The channel MCP config path is join(os.tmpdir(), ...). Node's os.tmpdir() on
+# POSIX is `process.env.TMPDIR` with a trailing separator stripped, else '/tmp'.
+# Reproduce that exactly so the lookup lands on the same directory the rc-spawn
+# wrote to. `ASK_CHANNEL_TMPDIR` overrides it for tests only — never set in
+# production; the SDK-spawned child inherits the manager's TMPDIR.
+if [ -n "${ASK_CHANNEL_TMPDIR:-}" ]; then
+  TMP_DIR="$ASK_CHANNEL_TMPDIR"
+else
+  # Mirror Node's os.tmpdir() (libuv uv_os_tmpdir): TMPDIR, then TMP, then TEMP,
+  # then /tmp; a trailing slash is stripped. The lookup must land on the exact
+  # directory the rc-spawn writer used, so this resolution order matches the
+  # writer's byte for byte. On the Pi (systemd user service) and macOS (launchd)
+  # only TMPDIR is ever set, but honouring the full order removes a latent
+  # false-allow if TMP/TEMP alone are present.
+  TMP_DIR="${TMPDIR:-${TMP:-${TEMP:-/tmp}}}"
+  TMP_DIR="${TMP_DIR%/}"
+fi
+
+# Sanitize the session id the same way the writers do:
+# `sessionId.replace(/[^A-Za-z0-9_-]/g, '_')`.
+SID_SAN=$(printf '%s' "$SESSION_ID" | sed 's/[^A-Za-z0-9_-]/_/g')
+
+# ----- Channel attached? ---------------------------------------------------
+# Any of the four channel MCP config filename shapes present in tmpdir for this
+# session means a channel is bound (unified, webchat, whatsapp, or telegram).
+CHANNEL_ATTACHED=0
+for kind in channel webchat-channel wa-channel telegram-channel; do
+  if [ -e "$TMP_DIR/maxy-${kind}-${SID_SAN}.json" ]; then
+    CHANNEL_ATTACHED=1
+    break
+  fi
+done
+
+if [ "$CHANNEL_ATTACHED" -eq 1 ]; then
+  echo "[ask-channel] decision=block sessionId=${SESSION_ID8} channel=attached reason=channel-attached" >&2
+  echo "Blocked: this is a native-channel session and AskUserQuestion cannot be delivered over a channel (the channel protocol carries no elicitation card, so the turn would wedge). Ask the same question as prose in your channel reply tool and wait for the operator's next message." >&2
+  exit 2
+fi
+
+echo "[ask-channel] decision=allow sessionId=${SESSION_ID8} channel=none reason=no-channel" >&2
+exit 0

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:ceaeee9505453efdd80ee573d7574cb56a8301beca2152b8f70699d3688b2eba
+content-hash: sha256:bd08bc341313562b1dd2139010b1120b23d7aab130e1d32c3e800678ad559f7c
 brand: maxy-code
 product-name: Maxy
 ---
@@ -3566,7 +3566,7 @@ If Ollama is unavailable at write time, the node is stored without an embedding
 
 The `memory-reindex` tool backfills missing embeddings by iterating nodes where `embedding IS NULL`. It uses the bounded representation (the `summary` for document/archive labels, never the raw body), embeds in batches with a per-node fallback on batch error, and **skips and continues** past a failing node — keeping skipped nodes out of the re-fetch via an exclude set — instead of aborting the whole run. `embed()`/`embedBatch()` cap oversized input (`EMBED_INPUT_MAX_CHARS`) before the Ollama POST, so a large body embeds truncated rather than throwing. Per-node `[reindex] op=embedded|skip-error` lines and a terminal `[reindex] op=done processed=N skipped=M`.
 
-`embedBatch()` also paces large batches. A document's summary plus every section body in one `/api/embed` POST pins ollama's `llama-server` across all cores for the whole batch with no idle gaps; on a passively-cooled Pi the SoC climbs past its soft-temp limit and the board thermally hard-resets. `embedBatch` splits an input array longer than the effective sub-batch size into sub-batches, waiting `EMBED_SUBBATCH_COOLDOWN_MS` (default 1000) between them so the SoC gets cooling gaps; vectors are concatenated in input order. The effective sub-batch size is the smaller of two ceilings: the thermal count ceiling `EMBED_SUBBATCH_SIZE` (default 32) and a throughput ceiling `floor(EMBED_REQUEST_TIMEOUT_MS * 0.8 / EMBED_MS_PER_INPUT)`. The throughput ceiling exists because on a CPU-only embedder a fixed 32-input POST can exceed `EMBED_REQUEST_TIMEOUT_MS` and abort the atomic ingest write, so `EMBED_MS_PER_INPUT` (the budgeted worst-case wall-time for one capped input, default 6000 ms, env-tunable) bounds each POST to 80 % of the request timeout. Every `/api/embed` POST also carries `keep_alive` (`EMBED_KEEP_ALIVE`, default `-1` = keep the model resident forever) so an interactive graph query-embed never cold-loads and blows its 5 s timeout. All knobs are env-overridable for on-device tuning. The load-bearing thermal protection is the installer's `CPUQuota` cap on `ollama.service` (every embed caller is bounded there regardless of batch shape); this pacing is defence-in-depth. The UI's file-index path uses its own single-input embed client in `platform/ui/app/lib/neo4j-store.ts` (one embed per file, not a batch), so it is covered by the CPU cap, not by `embedBatch` pacing.
+`embedBatch()` also paces large batches. A document's summary plus every section body in one `/api/embed` POST pins ollama's `llama-server` across all cores for the whole batch with no idle gaps; on a passively-cooled Pi the SoC climbs past its soft-temp limit and the board thermally hard-resets. `embedBatch` splits a multi-input array into sub-batches, waiting `EMBED_SUBBATCH_COOLDOWN_MS` (default 1000) between them so the SoC gets cooling gaps; vectors are concatenated in input order. Each POST is sized from the device's *measured* throughput, not a fixed constant: the first POST of a multi-input batch is a single-input probe (the only size provably safe without a measurement), and every POST's observed per-character wall-time folds into a running maximum. Subsequent POSTs are packed with as many inputs as fit a character budget `floor(EMBED_REQUEST_TIMEOUT_MS * 0.8 / observedMsPerChar)`, capped by the `EMBED_SUBBATCH_SIZE` count ceiling. Sizing by characters rather than input count matters because an embed's wall-time scales with its characters — a POST sized by count from a short probe (a document summary) would over-provision when the later inputs are near-cap sections and abort. So a CPU-only device slower than the old budget gets character-bounded POSTs that complete inside `EMBED_REQUEST_TIMEOUT_MS`, instead of a fixed 16/32-input POST that exceeds it and aborts the atomic ingest write; the running maximum is monotonic, so a mid-batch slowdown shrinks the remainder and never re-expands into a timeout. `EMBED_SUBBATCH_SIZE` (default 4) is the thermal count ceiling and the hard cap on any POST — kept low because the character budget is derived from the probe's observed rate, so a probe taken while the machine is briefly quiet would otherwise let the next POST grow to the ceiling and then blow `EMBED_REQUEST_TIMEOUT_MS` if desktop contention spikes mid-batch; a ceiling of 4 bounds that worst case (~4 near-cap cold-CPU embeds) under the timeout on a contended shared desktop, while a quiet appliance is governed by the character budget instead. `EMBED_MS_PER_INPUT` (default 6000 ms, env-tunable) no longer sizes the POST; it is the reconciliation baseline — after each POST an `[embed] op=drift` line warns when the observed per-input time exceeds the budget by more than 1.5×, so a device slower than budget is surfaced by a standing check rather than by a later ingest failure. Every `/api/embed` POST also carries `keep_alive` (`EMBED_KEEP_ALIVE`, default `-1` = keep the model resident forever) so an interactive graph query-embed never cold-loads and blows its 5 s timeout. All knobs are env-overridable for on-device tuning. The load-bearing thermal protection is the installer's `CPUQuota` cap on `ollama.service` (every embed caller is bounded there regardless of batch shape); this pacing is defence-in-depth. The UI's file-index path uses its own single-input embed client in `platform/ui/app/lib/neo4j-store.ts` (one embed per file, not a batch), so it is covered by the CPU cap, not by `embedBatch` pacing.
 
 ---
 

package/payload/platform/plugins/docs/references/internals.md

@@ -95,7 +95,7 @@ If Ollama is unavailable at write time, the node is stored without an embedding
 
 The `memory-reindex` tool backfills missing embeddings by iterating nodes where `embedding IS NULL`. It uses the bounded representation (the `summary` for document/archive labels, never the raw body), embeds in batches with a per-node fallback on batch error, and **skips and continues** past a failing node — keeping skipped nodes out of the re-fetch via an exclude set — instead of aborting the whole run. `embed()`/`embedBatch()` cap oversized input (`EMBED_INPUT_MAX_CHARS`) before the Ollama POST, so a large body embeds truncated rather than throwing. Per-node `[reindex] op=embedded|skip-error` lines and a terminal `[reindex] op=done processed=N skipped=M`.
 
-`embedBatch()` also paces large batches. A document's summary plus every section body in one `/api/embed` POST pins ollama's `llama-server` across all cores for the whole batch with no idle gaps; on a passively-cooled Pi the SoC climbs past its soft-temp limit and the board thermally hard-resets. `embedBatch` splits an input array longer than the effective sub-batch size into sub-batches, waiting `EMBED_SUBBATCH_COOLDOWN_MS` (default 1000) between them so the SoC gets cooling gaps; vectors are concatenated in input order. The effective sub-batch size is the smaller of two ceilings: the thermal count ceiling `EMBED_SUBBATCH_SIZE` (default 32) and a throughput ceiling `floor(EMBED_REQUEST_TIMEOUT_MS * 0.8 / EMBED_MS_PER_INPUT)`. The throughput ceiling exists because on a CPU-only embedder a fixed 32-input POST can exceed `EMBED_REQUEST_TIMEOUT_MS` and abort the atomic ingest write, so `EMBED_MS_PER_INPUT` (the budgeted worst-case wall-time for one capped input, default 6000 ms, env-tunable) bounds each POST to 80 % of the request timeout. Every `/api/embed` POST also carries `keep_alive` (`EMBED_KEEP_ALIVE`, default `-1` = keep the model resident forever) so an interactive graph query-embed never cold-loads and blows its 5 s timeout. All knobs are env-overridable for on-device tuning. The load-bearing thermal protection is the installer's `CPUQuota` cap on `ollama.service` (every embed caller is bounded there regardless of batch shape); this pacing is defence-in-depth. The UI's file-index path uses its own single-input embed client in `platform/ui/app/lib/neo4j-store.ts` (one embed per file, not a batch), so it is covered by the CPU cap, not by `embedBatch` pacing.
+`embedBatch()` also paces large batches. A document's summary plus every section body in one `/api/embed` POST pins ollama's `llama-server` across all cores for the whole batch with no idle gaps; on a passively-cooled Pi the SoC climbs past its soft-temp limit and the board thermally hard-resets. `embedBatch` splits a multi-input array into sub-batches, waiting `EMBED_SUBBATCH_COOLDOWN_MS` (default 1000) between them so the SoC gets cooling gaps; vectors are concatenated in input order. Each POST is sized from the device's *measured* throughput, not a fixed constant: the first POST of a multi-input batch is a single-input probe (the only size provably safe without a measurement), and every POST's observed per-character wall-time folds into a running maximum. Subsequent POSTs are packed with as many inputs as fit a character budget `floor(EMBED_REQUEST_TIMEOUT_MS * 0.8 / observedMsPerChar)`, capped by the `EMBED_SUBBATCH_SIZE` count ceiling. Sizing by characters rather than input count matters because an embed's wall-time scales with its characters — a POST sized by count from a short probe (a document summary) would over-provision when the later inputs are near-cap sections and abort. So a CPU-only device slower than the old budget gets character-bounded POSTs that complete inside `EMBED_REQUEST_TIMEOUT_MS`, instead of a fixed 16/32-input POST that exceeds it and aborts the atomic ingest write; the running maximum is monotonic, so a mid-batch slowdown shrinks the remainder and never re-expands into a timeout. `EMBED_SUBBATCH_SIZE` (default 4) is the thermal count ceiling and the hard cap on any POST — kept low because the character budget is derived from the probe's observed rate, so a probe taken while the machine is briefly quiet would otherwise let the next POST grow to the ceiling and then blow `EMBED_REQUEST_TIMEOUT_MS` if desktop contention spikes mid-batch; a ceiling of 4 bounds that worst case (~4 near-cap cold-CPU embeds) under the timeout on a contended shared desktop, while a quiet appliance is governed by the character budget instead. `EMBED_MS_PER_INPUT` (default 6000 ms, env-tunable) no longer sizes the POST; it is the reconciliation baseline — after each POST an `[embed] op=drift` line warns when the observed per-input time exceeds the budget by more than 1.5×, so a device slower than budget is surfaced by a standing check rather than by a later ingest failure. Every `/api/embed` POST also carries `keep_alive` (`EMBED_KEEP_ALIVE`, default `-1` = keep the model resident forever) so an interactive graph query-embed never cold-loads and blows its 5 s timeout. All knobs are env-overridable for on-device tuning. The load-bearing thermal protection is the installer's `CPUQuota` cap on `ollama.service` (every embed caller is bounded there regardless of batch shape); this pacing is defence-in-depth. The UI's file-index path uses its own single-input embed client in `platform/ui/app/lib/neo4j-store.ts` (one embed per file, not a batch), so it is covered by the CPU cap, not by `embedBatch` pacing.
 
 ---
 

package/payload/platform/plugins/memory/PLUGIN.md

@@ -222,6 +222,8 @@ Read-only window into the extractive graph writes produced under this account. R
 
 The owner's profile and preferences accumulate organically from conversation — never from questionnaires. Run `skill-load skillName=conversational-memory` for full guidance on when to observe preferences, how to handle remember/forget requests, and how to answer "what do you know about me?" transparently with confidence scores and evidence trail.
 
+When a house operator operates a client's sub-account, the session is scoped into that account (`ACCOUNT_ID` is the sub-account, `USER_ID` is the operator, no `HOUSE_ADMIN_SCOPE`). In that session `profile-read`/`profile-update`/`profile-delete` resolve to the account's **owner** `AdminUser`, not the operator: the operator has no `AdminUser` node in the sub-account subgraph, so `resolveProfileIdentity` sees the caller is not an admin of the account it is scoped to and attributes to the seeded owner — the same owner identity the cross-account `targetAccountId` path resolves (above), reached without `targetAccountId` because the re-scoped session cannot set it. An account with no seeded owner rejects the write loudly (`… has no owner AdminUser …`) rather than attributing it to the operator, and emits `[xacct] op=identity tool=profile-* mode=operator-on-behalf target=<sub8> caller=<op8> resolved-userId=<owner8>` on the owner-attributed path. The operator's own preferences live on their own (house) session.
+
 ## UserProfile + Person Field Management
 
 `profile-update` serves three purposes: managing Preference nodes (category/key/value), setting top-level UserProfile node properties via `profileFields`, and setting Person properties on the operator's personal-profile Person via `personFields`.

package/payload/platform/plugins/memory/mcp/dist/index.js

@@ -12,6 +12,7 @@ import { buildLiveSchemaSource, defaultSchemaCypherPath, } from "./lib/live-sche
 import { memoryReindex } from "./tools/memory-reindex.js";
 import { memoryIngestExtract } from "./tools/memory-ingest-extract.js";
 import { memoryIngest } from "./tools/memory-ingest.js";
+import { makeEmbedProgressReporter } from "./lib/embed-progress-reporter.js";
 import { CONVERSATION_SOURCES } from "./lib/conversation-normalisers/types.js";
 import { kdClassify } from "./tools/kd-classify.js";
 import { memoryArchiveWrite } from "./tools/memory-archive-write.js";
@@ -42,6 +43,8 @@ import { memoryBrainCaptureRecent } from "./tools/memory-brain-capture-recent.js
 import { profileUpdate } from "./tools/profile-update.js";
 import { profileDelete } from "./tools/profile-delete.js";
 import { resolveOwnerUserId } from "./lib/resolve-owner-userid.js";
+import { resolveAdminHomeAccount } from "./lib/resolve-admin-home-account.js";
+import { classifyProfileIdentity } from "./lib/profile-identity.js";
 import { graphPruneDenylistAdd } from "./tools/graph-prune-denylist-add.js";
 import { graphPruneDenylistList } from "./tools/graph-prune-denylist-list.js";
 import { graphPruneDenylistRemove } from "./tools/graph-prune-denylist-remove.js";
@@ -113,31 +116,42 @@ const XACCT_DESC = "House-scoped admin only: operate on the named sub-account su
 // call (the resolver only returns a target for a house-authorised session).
 const BOOT_ACCOUNT_ID = accountId;
 async function resolveProfileIdentity(toolName, crossAccount, resolvedAccountId, callerUserId) {
-    if (crossAccount) {
-        const owner = await resolveOwnerUserId(resolvedAccountId);
-        if (!owner) {
-            return {
-                reject: {
-                    content: [{
-                            type: "text",
-                            text: `${toolName} failed: target account ${resolvedAccountId.slice(0, 8)}… has no owner AdminUser to attribute the profile to — its graph root is unprovisioned (see Task 1359 seedAccountGraphRoot).`,
-                        }],
-                    isError: true,
-                },
-            };
-        }
-        process.stderr.write(`[xacct] op=identity tool=${toolName} target=${resolvedAccountId.slice(0, 8)} resolved-userId=${owner.slice(0, 8)}\n`);
-        return { userId: owner };
-    }
-    if (!callerUserId) {
+    // Resolve the facts the pure classifier needs. On the own-account path the
+    // account's owner is resolved only when the caller is NOT operating their
+    // home account (a foreign house operator inside a client's sub-account), so
+    // the common owner-is-speaker path costs one AdminUser lookup, not two.
+    const callerHomeAccountId = !crossAccount && callerUserId ? await resolveAdminHomeAccount(callerUserId) : null;
+    const needOwner = crossAccount || (!!callerUserId && callerHomeAccountId !== resolvedAccountId);
+    const ownerUserId = needOwner ? await resolveOwnerUserId(resolvedAccountId) : null;
+    const decision = classifyProfileIdentity({
+        crossAccount,
+        resolvedAccountId,
+        callerUserId,
+        callerHomeAccountId,
+        ownerUserId,
+    });
+    if (decision.kind === "reject") {
+        const text = decision.reason === "no-owner"
+            ? `${toolName} failed: account ${resolvedAccountId.slice(0, 8)}… has no owner AdminUser to attribute the profile to — its graph root is unprovisioned (see Task 1359 seedAccountGraphRoot).`
+            : `${toolName} requires an authenticated admin session with userId`;
         return {
             reject: {
-                content: [{ type: "text", text: `${toolName} requires an authenticated admin session with userId` }],
+                content: [{ type: "text", text }],
                 isError: true,
             },
         };
     }
-    return { userId: callerUserId };
+    if (decision.kind === "owner") {
+        if (crossAccount) {
+            process.stderr.write(`[xacct] op=identity tool=${toolName} target=${resolvedAccountId.slice(0, 8)} resolved-userId=${decision.userId.slice(0, 8)}\n`);
+        }
+        else {
+            process.stderr.write(`[xacct] op=identity tool=${toolName} mode=operator-on-behalf target=${resolvedAccountId.slice(0, 8)} caller=${(callerUserId ?? "").slice(0, 8)} resolved-userId=${decision.userId.slice(0, 8)}\n`);
+        }
+        return { userId: decision.userId, bootstrap: true };
+    }
+    // decision.kind === "caller" — own-account owner-is-speaker / second admin.
+    return { userId: decision.userId, bootstrap: false };
 }
 // Load the markdown schema sidecar once at startup. Every memory-write call
 // reads its required-property and synonym maps. If loading fails we throw —
@@ -1336,11 +1350,16 @@ if (!readOnly) {
         forceRewrite: z.boolean().optional().describe("When inlineRewrite is true, bypass the 7-day per-entity cooldown on compiledTruthUpdatedAt. All threshold-qualifying entities are returned as inlineRewriteCandidates regardless of when their truth was last rewritten."),
         inlineRewriteThreshold: z.number().int().min(1).optional().describe("Minimum MENTIONS/REFERENCES edge count from this source to an entity for it to qualify as an inline-rewrite candidate. Default: 2."),
         targetAccountId: z.string().optional().describe(XACCT_DESC),
-    }, async ({ attachmentId, conversationIdentity, source, archiveSha256, archiveSourceFile, participantElementIds, lastIngestedMessageHash, lastIngestedMessageAt, archiveTitle, cleanupPriorChunks, sessionIndex, documentSummary, anchorNodeId, anchorLabel, sections, documentEdges, orphanCandidates, scope, sourceUrl, sourceType, documentKeywords, userKeywords, sessionId: sessionIdOverride, inlineRewrite, forceRewrite, inlineRewriteThreshold, targetAccountId }) => {
+    }, async ({ attachmentId, conversationIdentity, source, archiveSha256, archiveSourceFile, participantElementIds, lastIngestedMessageHash, lastIngestedMessageAt, archiveTitle, cleanupPriorChunks, sessionIndex, documentSummary, anchorNodeId, anchorLabel, sections, documentEdges, orphanCandidates, scope, sourceUrl, sourceType, documentKeywords, userKeywords, sessionId: sessionIdOverride, inlineRewrite, forceRewrite, inlineRewriteThreshold, targetAccountId }, extra) => {
         const scoped = resolveToolAccount("memory-ingest", targetAccountId);
         if ("reject" in scoped)
             return scoped.reject;
         const accountId = scoped.accountId;
+        // Task 1555 — stream a progress notification per embed sub-batch POST so
+        // a long embedding phase resets Claude Code's stdio idle timer and the
+        // ingest commits instead of aborting mid-write. No-ops when the client
+        // sent no progressToken.
+        const reportProgress = makeEmbedProgressReporter(extra);
         try {
             const result = await memoryIngest({
                 accountId,
@@ -1370,6 +1389,7 @@ if (!readOnly) {
                 inlineRewrite,
                 forceRewrite,
                 inlineRewriteThreshold,
+                reportProgress,
             });
             return {
                 content: [{
@@ -2228,8 +2248,8 @@ if (!readOnly) {
                 profileFields: profileFields,
                 personFields,
                 mergeSourceIds,
-                bootstrapProfile: crossAccount,
-                bootstrapPerson: crossAccount,
+                bootstrapProfile: ident.bootstrap,
+                bootstrapPerson: ident.bootstrap,
             });
             return {
                 content: [{