@rubytech/create-maxy-code 0.1.492 → 0.1.494

package/payload/platform/plugins/admin/hooks/__tests__/preference-consult-gate.test.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+set -uo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HOOK="$DIR/../preference-consult-gate.sh"
+PASS=0; FAIL=0; FAILED=()
+run() { printf '%s' "$1" | bash "$HOOK" >/dev/null 2>&1; echo $?; }
+assert_exit() { local got; got=$(run "$2"); if [ "$got" = "$1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: want exit $1 got $got"); fi; }
+
+TMP="$(mktemp -d)"
+# Transcript WITH a profile-read this turn. The profile-read's RESULT is recorded
+# as a user entry whose content is only tool_result blocks (the real Claude Code
+# shape); that entry must NOT be treated as the human turn boundary, or the gate
+# false-blocks every compliant send.
+CONSULTED="$TMP/consulted.jsonl"
+{
+  printf '%s\n' '{"type":"user","message":{"role":"user","content":"make the quote"}}'
+  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"mcp__plugin_memory_memory__profile-read","input":{}}]}}'
+  printf '%s\n' '{"type":"user","message":{"role":"user","content":[{"type":"tool_result","content":"prefs..."}]}}'
+  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"text","text":"saving the pdf now"}]}}'
+} > "$CONSULTED"
+# Genuine human turn recorded as a content LIST (image + text), not a string, must
+# still count as the boundary.
+CONSULTED_LIST="$TMP/consulted_list.jsonl"
+{
+  printf '%s\n' '{"type":"user","message":{"role":"user","content":[{"type":"text","text":"make the quote"}]}}'
+  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"mcp__plugin_memory_memory__profile-read","input":{}}]}}'
+  printf '%s\n' '{"type":"user","message":{"role":"user","content":[{"type":"tool_result","content":"prefs..."}]}}'
+} > "$CONSULTED_LIST"
+# Transcript with NO profile-read this turn (one appears BEFORE the last user msg only).
+UNCONSULTED="$TMP/unconsulted.jsonl"
+{
+  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"mcp__plugin_memory_memory__profile-read","input":{}}]}}'
+  printf '%s\n' '{"type":"user","message":{"role":"user","content":"send it"}}'
+  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"text","text":"ok"}]}}'
+} > "$UNCONSULTED"
+
+pdf_env() { printf '{"tool_name":"mcp__plugin_browser_browser__browser-pdf-save","tool_input":{"path":"memory/users/+447700900000/documents/quote.pdf"},"transcript_path":"%s"}' "$1"; }
+email_att_env() { printf '{"tool_name":"mcp__plugin_email_email__email-send","tool_input":{"attachments":["memory/users/+44/documents/x.pdf"]},"transcript_path":"%s"}' "$1"; }
+
+# Gated tool + consulted (with a tool_result user entry after profile-read) -> allow.
+assert_exit 0 "$(pdf_env "$CONSULTED")" "pdf consulted allows despite tool_result user entry"
+# Genuine user turn as a content list -> boundary still detected, consulted -> allow.
+assert_exit 0 "$(pdf_env "$CONSULTED_LIST")" "pdf consulted (list user turn) allows"
+# Gated tool + not consulted -> block.
+assert_exit 2 "$(pdf_env "$UNCONSULTED")" "pdf unconsulted blocks"
+# Email with attachment + not consulted -> block.
+assert_exit 2 "$(email_att_env "$UNCONSULTED")" "email+attach unconsulted blocks"
+# Email with NO attachment -> not a document deliverable -> allow.
+assert_exit 0 "$(printf '{"tool_name":"mcp__plugin_email_email__email-send","tool_input":{},"transcript_path":"%s"}' "$UNCONSULTED")" "email no-attach allows"
+# browser-pdf-save OUTSIDE customer documents scope -> allow.
+assert_exit 0 "$(printf '{"tool_name":"mcp__plugin_browser_browser__browser-pdf-save","tool_input":{"path":"output/report.pdf"},"transcript_path":"%s"}' "$UNCONSULTED")" "pdf outside scope allows"
+# Non-send tool -> allow.
+assert_exit 0 "$(printf '{"tool_name":"Read","tool_input":{"file_path":"x"},"transcript_path":"%s"}' "$UNCONSULTED")" "read allows"
+# Empty stdin -> fail open (allow).
+assert_exit 0 "" "empty stdin fails open"
+
+echo "----- $PASS passed, $FAIL failed -----"
+for f in "${FAILED[@]:-}"; do [ -n "$f" ] && echo "  $f"; done
+[ "$FAIL" -eq 0 ]

package/payload/platform/plugins/admin/hooks/__tests__/quote-render-pdf-conformance.test.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+# Regression test for quote-render-pdf-conformance.sh.
+#
+# PostToolUse hook on browser-pdf-save. For a gated client-quote PDF whose render
+# receipt names the source HTML, it blocks when the PDF dropped links (its /URI
+# count is below the HTML's absolute-link count) or when an embedded https link
+# is not live. Everything else passes; it fails open on anything uninspectable.
+#
+# Covers (all offline-deterministic — the one network case points at a closed
+# local port so the connection refusal is immediate and reproducible):
+#   A. non-quote PDF                                  → ALLOWED (not gated)
+#   B. quote PDF, no receipt                          → ALLOWED (PreToolUse owns that block)
+#   C. quote PDF, HTML has no absolute links          → ALLOWED (0 >= 0, no fetch)
+#   D. quote PDF, PDF /URI < HTML links               → BLOCKED (link-loss, no fetch)
+#   E. quote PDF, /URI ok but an https link is dead   → BLOCKED (link not live)
+#   F. quote PDF, /URI ok and the only link is 200    → not asserted (needs a live server)
+#   G. empty stdin                                    → ALLOWED (fail-open)
+#   H. non-browser tool                               → ALLOWED (matcher defence-in-depth)
+#   I. a block emits the op=bypass fault line
+
+set -u
+
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/quote-render-pdf-conformance.sh"
+if [[ ! -x "$HOOK" ]]; then
+  echo "FAIL: $HOOK not executable" >&2
+  exit 1
+fi
+
+ACCT=$(mktemp -d)
+cleanup() { rm -rf "$ACCT"; }
+trap cleanup EXIT
+
+DOCS="$ACCT/memory/users/44700900000/documents"
+mkdir -p "$DOCS"
+
+# Receipt + filed HTML for each scenario job. The receipt names the filed quote
+# HTML; the hook reads its absolute links and compares to the PDF's /URI count.
+mk_job() { # jobId, html_body, pdf_uri_repeat
+  local job="$1" body="$2" uris="$3"
+  mkdir -p "$ACCT/quoting/jobs/$job"
+  local html="$DOCS/quote-$job.html"
+  printf '%s' "$body" > "$html"
+  printf '{"jobId":"%s","filed":{"internal":"x","breakdown":"x","quote":"%s"}}' "$job" "$html" \
+    > "$ACCT/quoting/jobs/$job/render-receipt.json"
+  # A minimal PDF-ish file carrying `uris` copies of the /URI token.
+  { printf '%%PDF-1.4\n'; local i=0; while [[ $i -lt $uris ]]; do printf '/URI (x)\n'; i=$((i+1)); done; } \
+    > "$DOCS/quote-$job.pdf"
+}
+
+# C: no absolute links, PDF has none → allow.
+mk_job "clean" '<html><body><a href="#top">top</a><p>no links</p></body></html>' 0
+# D: two https links, PDF dropped them (0 /URI) → block on count.
+mk_job "dropped" '<html><body><a href="https://a.example/1">a</a><a href="https://b.example/2">b</a></body></html>' 0
+# E: one https link, PDF kept a /URI, but the link points at a closed local port → block on liveness.
+mk_job "dead" '<html><body><a href="https://127.0.0.1:1/never">sign</a></body></html>' 1
+
+PASS=0
+FAIL=0
+
+run_case() {
+  local name="$1" stdin="$2" expected_exit="$3" actual_exit
+  ( cd "$ACCT" && printf '%s' "$stdin" | bash "$HOOK" >/dev/null 2>/dev/null )
+  actual_exit=$?
+  if [[ "$actual_exit" -eq "$expected_exit" ]]; then
+    echo "PASS: $name (exit=$actual_exit)"; PASS=$((PASS + 1))
+  else
+    echo "FAIL: $name (expected exit=$expected_exit, got=$actual_exit)" >&2; FAIL=$((FAIL + 1))
+  fi
+}
+
+envelope() { printf '{"hook_event_name":"PostToolUse","tool_name":"%s","tool_input":{"path":"%s"}}' "$1" "$2"; }
+BROWSER="mcp__plugin_browser_browser__browser-pdf-save"
+
+run_case "A: non-quote PDF → ALLOWED" \
+  "$(envelope "$BROWSER" "$DOCS/brochure.pdf")" 0
+run_case "B: quote PDF, no receipt → ALLOWED (PreToolUse owns it)" \
+  "$(envelope "$BROWSER" "$DOCS/quote-nojob.pdf")" 0
+run_case "C: HTML has no absolute links → ALLOWED" \
+  "$(envelope "$BROWSER" "$DOCS/quote-clean.pdf")" 0
+run_case "D: PDF /URI below HTML link count → BLOCKED" \
+  "$(envelope "$BROWSER" "$DOCS/quote-dropped.pdf")" 2
+run_case "E: an embedded https link is not live → BLOCKED" \
+  "$(envelope "$BROWSER" "$DOCS/quote-dead.pdf")" 2
+run_case "G: empty stdin → ALLOWED (fail-open)" \
+  "" 0
+run_case "H: non-browser tool → ALLOWED" \
+  '{"hook_event_name":"PostToolUse","tool_name":"Write","tool_input":{"path":"'"$DOCS"'/quote-dropped.pdf"}}' 0
+
+# I: a block emits the op=bypass fault line on stderr.
+STDERR=$( cd "$ACCT" && printf '%s' "$(envelope "$BROWSER" "$DOCS/quote-dropped.pdf")" | bash "$HOOK" 2>&1 >/dev/null )
+if printf '%s' "$STDERR" | grep -q '\[quote-render\] op=bypass jobId=dropped reason=pdf-link-conformance'; then
+  echo "PASS: I: block emits op=bypass jobId=dropped"; PASS=$((PASS + 1))
+else
+  echo "FAIL: I: op=bypass line absent (got: $STDERR)" >&2; FAIL=$((FAIL + 1))
+fi
+
+echo "──────── quote-render-pdf-conformance test summary ────────"
+echo "PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -eq 0 ]]

package/payload/platform/plugins/admin/hooks/preference-consult-directive.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# preference-consult-directive — UserPromptSubmit hook. Injects a standing line
+# naming the two-layer preference architecture and two adherence directives:
+# consult layer-2 preferences (profile-read) before any customer document, and
+# promote finished deliverables out of output/. Prompt-independent; fail-open.
+set -uo pipefail
+HOOK_INPUT=$(cat 2>/dev/null || true)
+command -v python3 >/dev/null 2>&1 || exit 0
+python3 - <<'PY' 2>/dev/null || exit 0
+import json
+ctx = (
+"<preference-adherence>\n"
+"Your preferences live in two layers. Layer 1 is the fixed block already in front of you every turn. "
+"Layer 2 is the account's own saved records, read with profile-read; it holds the signature policy, header, "
+"naming conventions and styling that layer 1 does not, and it grows over time. Before any customer-facing "
+"document deliverable (a PDF or file sent to the customer, or an email or Outlook message carrying an "
+"attachment), read the relevant layer-2 preferences with profile-read and apply them. "
+"Store finished deliverables under documents/ or the project folder. output/ is scratch of last resort, "
+"rebuilt on the next tool write, and never the home a graph reference points at.\n"
+"</preference-adherence>"
+)
+print(json.dumps({"hookSpecificOutput": {"hookEventName": "UserPromptSubmit", "additionalContext": ctx}}))
+PY
+echo "[pref-wrapper] op=inject" >&2
+exit 0

package/payload/platform/plugins/admin/hooks/preference-consult-gate.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# preference-consult-gate — PreToolUse gate on customer-facing document deliverables.
+#
+# A customer document (a PDF/file to the customer documents scope, or an email/
+# Outlook send carrying an attachment) must not go out until the account's saved
+# layer-2 preferences were consulted this turn, proven by a profile-read tool
+# call after the last user message in the session transcript. Layer-2 records
+# hold the signature policy, header, naming and styling rules the fixed layer-1
+# block does not; a send with no profile-read this turn is the miss that dropped
+# a customer signature.
+#
+# Scope (document-deliverable shape only; every other tool/shape exits 0):
+#   *browser-pdf-save  path under memory/users/<phone>/documents/
+#   SendUserFile       path under memory/users/<phone>/documents/ or .pdf/.html/.docx
+#   *email-send|reply|draft-send / *outlook-mail-send|reply|draft-send  non-empty attachments
+#
+# Exit: 0 allow, 2 block. Fail OPEN on tty/empty stdin/no python3/transcript
+# unreadable. Block log: [preference-gate] op=bypass tool=<name> detail=no profile-read this turn
+set -uo pipefail
+
+if [ -t 0 ]; then exit 0; fi
+INPUT=$(cat)
+[ -z "$INPUT" ] && exit 0
+command -v python3 >/dev/null 2>&1 || exit 0
+
+DECISION=$(INPUT="$INPUT" python3 - <<'PY' 2>/dev/null || true
+import os, json, re, sys
+try:
+    d = json.loads(os.environ["INPUT"])
+except Exception:
+    sys.exit(0)
+tool = d.get("tool_name", "") or ""
+ti = d.get("tool_input", {}) or {}
+
+def under_customer_docs(p):
+    return bool(re.search(r'(^|/)memory/users/[^/]+/documents/', os.path.normpath(p or "")))
+
+gated = False
+if tool.endswith("browser-pdf-save"):
+    gated = under_customer_docs(ti.get("path", ""))
+elif tool == "SendUserFile" or tool.endswith("__SendUserFile"):
+    p = ti.get("path", "") or ti.get("file_path", "")
+    gated = under_customer_docs(p) or p.lower().endswith((".pdf", ".html", ".docx"))
+elif re.search(r'(email-send|email-reply|email-draft-send|outlook-mail-send|outlook-mail-reply|outlook-draft-send)$', tool):
+    atts = ti.get("attachments")
+    gated = isinstance(atts, list) and len(atts) > 0
+
+if not gated:
+    print("")  # not a document deliverable
+    sys.exit(0)
+
+transcript = d.get("transcript_path", "") or ""
+if not transcript or not os.access(transcript, os.R_OK):
+    print("")  # cannot inspect consultation -> fail open
+    sys.exit(0)
+
+try:
+    with open(transcript) as f:
+        lines = f.readlines()
+except Exception:
+    print("")
+    sys.exit(0)
+
+def is_genuine_user_turn(e):
+    is_user = (e.get("type") == "user") or (e.get("role") == "user") or (isinstance(e.get("message"), dict) and e["message"].get("role") == "user")
+    if not is_user:
+        return False
+    msg = e.get("message", e)
+    content = msg.get("content") if isinstance(msg, dict) else None
+    if isinstance(content, str):
+        return True
+    if isinstance(content, list):
+        # A tool_result delivery is recorded as a user entry whose content is
+        # composed only of tool_result blocks. It is not a human turn; counting
+        # it would push the boundary past the profile-read that ran this turn and
+        # false-block a compliant send. A genuine human turn carries at least one
+        # non-tool_result block (text/image).
+        return any(not (isinstance(b, dict) and b.get("type") == "tool_result") for b in content)
+    # Unknown shape: do not advance the boundary, biasing toward a wider consulted
+    # window (toward allow) — fail-open is the correct direction here.
+    return False
+
+last_user = -1
+for i, ln in enumerate(lines):
+    try:
+        e = json.loads(ln)
+    except Exception:
+        continue
+    if is_genuine_user_turn(e):
+        last_user = i
+
+consulted = False
+for ln in (lines[last_user + 1:] if last_user >= 0 else lines):
+    try:
+        e = json.loads(ln)
+    except Exception:
+        continue
+    msg = e.get("message", e)
+    content = msg.get("content") if isinstance(msg, dict) else None
+    if isinstance(content, list):
+        for block in content:
+            if isinstance(block, dict) and block.get("type") == "tool_use" and (block.get("name", "") or "").endswith("profile-read"):
+                consulted = True
+
+print("%s|%s" % (tool, "yes" if consulted else "no"))
+PY
+)
+
+[ -z "$DECISION" ] && exit 0
+TOOL="${DECISION%%|*}"
+CONSULTED="${DECISION##*|}"
+
+if [ "$CONSULTED" = "yes" ]; then
+  echo "[preference-gate] op=allow tool=$TOOL consulted=true" >&2
+  exit 0
+fi
+
+echo "[preference-gate] op=bypass tool=$TOOL detail=no profile-read this turn" >&2
+echo "Blocked: this customer document is about to go out without the account's saved preferences being checked this turn. Those records hold the signature, header, naming and styling rules. Run profile-read for this account, apply anything relevant, then send again." >&2
+exit 2

package/payload/platform/plugins/admin/hooks/quote-render-pdf-conformance.sh

@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+# quote-render-pdf-conformance — PostToolUse gate on browser-pdf-save.
+#
+# The companion to the PreToolUse quote-render-gate: that gate checks the
+# rendered HTML on the deterministic path (via the render receipt) before the
+# PDF is printed; the HTML the tool gated cannot yet be a PDF at PreToolUse, so
+# the two PDF-only conformance checks run here, once the PDF exists.
+#
+# For a gated client-quote PDF (memory/users/<phone>/documents/quote-<jobId>.pdf
+# or ...-breakdown.pdf) whose render receipt names the source HTML, it asserts:
+#   1. the PDF's /URI annotation count >= the source HTML's absolute-link count
+#      (a print that dropped links — a rasterised or flattened copy — carries
+#      fewer /URI than the HTML had anchors);
+#   2. every embedded https:// anchor in the source HTML answers 200 (a pending
+#      redeploy that would 404 the Sign-Online link is caught before the PDF is
+#      sent).
+# The /URI-count check is offline and runs first; the network fetch runs only
+# when the count check passes, so a link-loss regression never depends on the
+# network being up.
+#
+# Exit codes: 0 = allow, 2 = block (stderr shown to the agent). Fail OPEN on any
+# uninspectable call (tty / empty stdin / no python3 / no receipt / PDF not
+# written): the no-receipt case is already the PreToolUse gate's to block, and
+# browser-pdf-save is general-purpose, so failing open here bricks no unrelated
+# PDF. No task numbers or internal refs in any operator-visible string.
+
+set -uo pipefail
+
+if [ -t 0 ]; then exit 0; fi
+INPUT=$(cat)
+[ -z "$INPUT" ] && exit 0
+
+RESULT=$(INPUT="$INPUT" BASE="$PWD" python3 - <<'PY' 2>/dev/null || true
+import os, json, re, sys, urllib.request
+
+try:
+    d = json.loads(os.environ["INPUT"])
+except Exception:
+    sys.exit(0)  # uninspectable envelope -> fail open
+
+tool = d.get("tool_name", "") or ""
+if not tool.endswith("browser-pdf-save"):
+    sys.exit(0)
+path = (d.get("tool_input", {}) or {}).get("path", "") or ""
+if not path:
+    sys.exit(0)
+norm = os.path.normpath(path)
+m = re.search(r'(?:^|/)memory/users/[^/]+/documents/quote-(.+?)(-breakdown)?\.pdf$', norm)
+if not m:
+    sys.exit(0)  # not a gated client-quote artefact
+jobid = m.group(1)
+if "/" in jobid or ".." in jobid:
+    sys.exit(0)  # the PreToolUse gate owns bad-jobid; here fail open
+variant = m.group(2)  # "-breakdown" or None
+
+base = os.environ["BASE"]
+receipt_path = os.path.join(base, "quoting", "jobs", jobid, "render-receipt.json")
+try:
+    receipt = json.load(open(receipt_path))
+except Exception:
+    sys.exit(0)  # no receipt -> PreToolUse gate already blocks; fail open
+
+filed = receipt.get("filed", {}) or {}
+html_path = filed.get("breakdown" if variant else "quote", "")
+if not html_path or not os.path.isfile(html_path) or not os.path.isfile(path):
+    sys.exit(0)  # nothing to compare against -> fail open
+
+html = open(html_path, encoding="utf-8", errors="replace").read()
+# Anchors that become a /URI annotation in the printed PDF: absolute http(s) or
+# mailto hrefs. Fragment and relative anchors do not, so they are not counted.
+uri_anchors = re.findall(r'href="((?:https?|mailto):[^"]*)"', html, re.I)
+https_anchors = [u for u in uri_anchors if u.lower().startswith("https:")]
+
+# /URI occurrences in the printed PDF. This is the same primitive the e-sign
+# stamp gate uses (grep -a -c '/URI'); on real browser-pdf-save output it was
+# measured to carry one greppable /URI per surviving link (base PDFs counted 4
+# to 6, one per anchor), so the count is a faithful per-link tally, not stream-
+# compressed away. A rasterised or flattened reprint drops to a lower count.
+uri_count = open(path, "rb").read().count(b"/URI")
+if uri_count < len(uri_anchors):
+    print("BLOCK|%s|uri-count pdf=%d html_links=%d" % (jobid, uri_count, len(uri_anchors)))
+    sys.exit(0)
+
+for u in https_anchors:
+    try:
+        with urllib.request.urlopen(u, timeout=6) as r:
+            code = r.status
+    except Exception as e:
+        code = getattr(e, "code", 0) or 0
+    if code != 200:
+        print("BLOCK|%s|link %s -> %s" % (jobid, u, code))
+        sys.exit(0)
+
+sys.exit(0)
+PY
+)
+
+case "$RESULT" in
+  BLOCK\|*)
+    rest=${RESULT#BLOCK|}
+    jobid=${rest%%|*}
+    detail=${rest#*|}
+    echo "[quote-render] op=bypass jobId=$jobid reason=pdf-link-conformance detail=$detail" >&2
+    echo "Blocked: the printed quote PDF is missing links the document declared, or an embedded link is not live ($detail). Do not send it. If a Sign-Online link is not live yet, deploy the signing page first; then re-render and re-print so the PDF carries every link the document declares." >&2
+    exit 2
+    ;;
+esac
+exit 0

package/payload/platform/plugins/admin/skills/agent-builder/references/agent-pattern.md

@@ -110,12 +110,24 @@ Two further clauses bind the Output contract itself. **Recency**, universal: a t
 claim carries the date it was observed, and a date the agent cannot see is one it flags, never
 one it infers. **Corroboration**, for agents whose deliverable is a pattern, a theme, a trend, a
 signal: the agent names the independent sources behind it and does not report one as established
-on a single occurrence. Corroboration is authoring guidance enforced by review, not by the gate,
-because the subset it applies to cannot be detected statically.
-
-`agent-grounding-drift.test.ts` fails if any shipped prompt carries either sentence anything
-other than exactly once, and fails if the number of prompts it inspected is not the number it
-expects. A new agent that skips them does not ship.
+on a single occurrence.
+
+Corroboration binds only that subset, and the subset cannot be read out of a prompt's text, so
+every prompt declares it. The flat specialists carry `pattern_deliverable: true` or
+`pattern_deliverable: false` as a frontmatter key; the role `IDENTITY.md` files, which have no
+frontmatter and are injected raw, carry the same marker as a trailing HTML comment
+`<!-- pattern_deliverable: true -->`. Absent is a gate failure, not a default. A prompt declaring
+true carries this sentence, character for character, as a third paragraph of its `## Grounding`
+section; a prompt declaring false does not carry it at all:
+
+> Where what you report is a pattern, a theme, a trend, or a signal, name the independent occurrences behind it; one occurrence is a single observation you report as such, never a pattern you assert.
+
+`agent-grounding-drift.test.ts` fails if any shipped prompt carries the provenance or
+person-attribute sentence anything other than exactly once, if a prompt does not declare
+`pattern_deliverable` exactly once, if a true-declaring prompt carries the corroboration sentence
+anything other than exactly once, if a false-declaring prompt carries it at all, and if the
+number of prompts it inspected is not the number it expects. The marker and the sentence cannot
+drift apart, and a new agent that skips any of the three does not ship.
 
 ## Skills owned
 

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:643a947eb8968517ad598f7f8b4e433d8545877d7c21f857d4867ac914e34cc9
+content-hash: sha256:59873e611d7a40e6aa9c3f41bc766d8a4e0632934f7542470aa309fb59dc5db7
 brand: maxy-code
 product-name: Maxy
 ---
@@ -4227,6 +4227,8 @@ Standing rules the operator gives over a channel are `Preference` nodes. Two mec
 
 **Observability.** `[preference-write] op=reconcile … mode=<reinforce|update|contradict|new> similarity=…` — a stream of `mode=new` for subjects that already exist is the duplicate-minting signature. `[preference-inject] op=inject channel=<wa|tg|web> injected=<N> owner=<8> source=<owner|no-owner|owner-error|fetch-error>` — injection selects only the account owner's admin preferences, so `source=owner injected=0` is a genuinely empty owner, `source=no-owner` is an account with no seeded owner (injects nothing, a missed owner seeding), and `injected=0 source=owner` on an account whose owner holds rules is the write-only regression re-appearing. `[preference-audit] op=drift accountId=… storedActive=… injectedActive=… duplicateClusters=…` — the standing reconciliation audit (claude-session-manager, 5-minute tick) flags any account whose store holds more active rows than injection would surface, the no-event detector for drift.
 
+**Consult-before-send gate.** Injection (above) puts the owner's active rules in front of every channel turn, but the growing layer-2 `Preference` set is read on demand with `profile-read`, a per-turn judgement the agent can skip, the miss that dropped a customer signature on a delivered document. `hooks/preference-consult-gate.sh` (admin plugin) is the deliverable-boundary enforcement: a PreToolUse gate on customer-facing document deliverables (`browser-pdf-save`/`SendUserFile` to `memory/users/<phone>/documents/`, and email/Outlook sends carrying attachments) that blocks (exit 2) when no `profile-read` ran after the last user message in the transcript. It fires on documents only, never on casual replies. **Observability:** `[preference-gate] op=allow tool=<name> consulted=true` on an allowed document deliverable, `op=bypass tool=<name> detail=no profile-read this turn` on a block; a stream of `op=bypass` is the un-consulted-send signature. The advisory companion `hooks/preference-consult-directive.sh` injects the two-layer architecture reminder every turn (`[pref-wrapper] op=inject`). The placement half, promoting finished deliverables out of `output/` scratch, is counted by the `data-manager` reconcile audit (`scratch-refs`, `stranded`); making that audit run on a standing periodic cadence is a filed follow-up.
+
 ---
 
 ## Output Formatting and Budget

package/payload/platform/plugins/business-assistant/skills/e-sign/SKILL.md

@@ -477,7 +477,15 @@ Dispatch runs **only** inside a live operator session on the account's own devic
 
 2. **For each unswept row, in order — stamp, send, then mark that one row swept:**
 
-   - **Stamp a per-signer copy from the persisted base — no browser, no network.** Dispatch must **never fetch the deployed page**: it may sit behind **Cloudflare Access**, so a headless fetch hits the Access login screen, not the document, and the PDF is garbage. The render-once base (§ 5) is what removes that dependency. Load `${ACCOUNT_DIR}/e-sign/<DOC_REF>/base.pdf`, append an **Electronic Acceptance Certificate** page, and write a per-signer copy alongside it — all with a pure PDF library (**`pdf-lib`**, run as a small Node script; pick another pure library if the account standardises on one, but it must add no browser and no network call):
+   - **Stamp a per-signer copy from the persisted base — no browser, no network.** Dispatch must **never fetch the deployed page**: it may sit behind **Cloudflare Access**, so a headless fetch hits the Access login screen, not the document, and the PDF is garbage. The render-once base (§ 5) is what removes that dependency. Load `${ACCOUNT_DIR}/e-sign/<DOC_REF>/base.pdf`, append an **Electronic Acceptance Certificate** page, and write a per-signer copy alongside it, all with a PDF library that loads the base and copies its pages through intact (**`pdf-lib`**, run as a small Node script). The stamp copies existing pages; it never renders them to an image. Rasterising the base (ghostscript to PNG, or any image-then-redraw rebuild) discards every link annotation and all selectable text, so the signer receives a flattened copy with dead links; it is prohibited whatever is or is not installed. A substitute for pdf-lib is allowed only if it imports existing PDF pages: pypdf, qpdf, or pdftk. A canvas-only generator such as reportlab cannot import a base and is not a substitute. Whatever the library, it adds no browser and no network call.
+
+     **Pre-flight: the page-copying library must resolve before any stamp runs.** A stamp attempted without it is the exact history this guards against, where a prior session met the missing library by rasterising instead of installing one:
+
+     ```bash
+     node -e 'import("pdf-lib").then(()=>console.log("ok"),e=>{console.error("pdf-lib missing: npm i pdf-lib at the account directory root");process.exit(1)})'
+     ```
+
+     On failure the one remediation is that install; a fallback that renders pages to images is never one. The stamp script itself:
 
      ```js
      // stamp.mjs — node, offline. Reads the persisted base, appends a certificate page,
@@ -509,6 +517,8 @@ Dispatch runs **only** inside a live operator session on the account's own devic
 
      The certificate fields come **from the D1 row**, not a re-fetch: `name`, `title` (an operator-defined field if present), `token`, `doc_ref`, `accepted_at`, the signing `method`, and the **verbatim intent/consent assertion** the signer ticked (§ 2). That makes the artifact self-contained evidence of who accepted, when, and on what stated basis.
 
+     **Post-stamp gate: prove fidelity before any send.** For both `base.pdf` and the stamped copy, count link annotations with `grep -a -c '/URI'` and measure page-1 text extent with ghostscript text extraction (`gs -q -dNOPAUSE -dBATCH -sDEVICE=txtwrite -dFirstPage=1 -dLastPage=1 -o - <file> | wc -c`). The stamped copy passes only when its `/URI` count and its page-1 text extent are each at least the base's. On either regression the stamp rasterised or otherwise flattened the base, so delete the stamped copy, skip both sends, and leave the row `swept = 0` so the next sweep re-surfaces it. This gate converts a link-stripped copy from a no-event failure (nothing logs until a signer clicks a dead link) into a rejection at stamp time. Record the base and stamped `/URI` counts alongside every dispatch, pass or fail, so a fidelity regression is a number rather than a complaint.
+
    - **Send twice via `email-send`**, each carrying `doc_ref`, `name`, `token`, `accepted_at`, and the **stamped** PDF (`signed-<token>.pdf`) as an attachment:
      - once to the **business owner's configured address** (read from configured business identity — never hard-code a recipient in this workflow);
      - once to the **signer's captured `email`** — this copy is the **statutory record provided to the signer**, the evidentiary copy the legal basis (intro) relies on.

package/payload/platform/plugins/cloudflare/bin/__tests__/portal-brand-css.test.sh

@@ -18,7 +18,7 @@ set -u
 
 BIN_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 SCRIPT="$BIN_DIR/portal-brand-css.mjs"
-TEMPLATE="$BIN_DIR/../skills/data-portal/template/public/portal.css"
+TEMPLATE="$BIN_DIR/../skills/data-portal/template/portal.css"
 [ -f "$SCRIPT" ] || { echo "FAIL: $SCRIPT not found" >&2; exit 1; }
 [ -f "$TEMPLATE" ] || { echo "FAIL: $TEMPLATE not found" >&2; exit 1; }
 # Case 2 strips the :root block with perl and diffs what is left. Without perl

package/payload/platform/plugins/cloudflare/bin/portal-index-push.mjs

@@ -198,6 +198,28 @@ export async function pushAccount(opts) {
   const current = Number(state[0]?.currentGeneration ?? 0)
   const next = current + 1
 
+  // Crash safety (Task 1923). A stage that died mid-batch — a D1 500 on one
+  // INSERT — leaves rows at `next` while the pointer stays at `current`. Every
+  // later run recomputes the same `next`, and its first colliding INSERT then
+  // hits UNIQUE(accountId, relPath, generation), so the index freezes at the
+  // stale generation until an operator hand-clears the orphans. Clearing `next`
+  // before staging lets a partial stage self-heal on the next cycle. Guarded on
+  // a non-zero count so the DELETE never precedes the flip on a clean cycle and
+  // the log line always means a recovered wedge. The count comes from a SELECT
+  // because the D1 client returns rows, not the affected-row meta.
+  const orphan = await client.query(
+    'SELECT COUNT(*) AS n FROM directory WHERE accountId = ? AND generation = ?',
+    [accountId, next],
+  )
+  const orphanCount = Number(orphan[0]?.n ?? 0)
+  if (orphanCount > 0) {
+    await client.query('DELETE FROM directory WHERE accountId = ? AND generation = ?', [
+      accountId,
+      next,
+    ])
+    log(`${TAG} op=stage-clear account=${accountId} generation=${next} cleared=${orphanCount}`)
+  }
+
   for (const row of rows) {
     await client.query(
       'INSERT INTO directory (accountId, relPath, sizeBytes, modifiedAt, indexedAt, isDir, generation) ' +