@rubytech/create-maxy-code 0.1.561 → 0.1.562

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.561",
+  "version": "0.1.562",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/hooks/__tests__/datetime-inject.test.sh

@@ -114,6 +114,16 @@ else
 fi
 rm -rf "$FAKEBIN2"
 
+# Task 2424 — a public visitor's turn carries only its agent's authored
+# IDENTITY/SOUL/KNOWLEDGE. MAXY_PUBLIC_ALLOWED_TOOLS is stamped for role=public
+# spawns only, by both spawn paths.
+pub_out=$(printf '%s' '{"session_id":"x","prompt":"hi"}' | MAXY_PUBLIC_ALLOWED_TOOLS='mcp__channel__reply' bash "$HOOK" 2>/dev/null); pub_rc=$?
+if [[ "$pub_rc" -eq 0 && -z "$pub_out" ]]; then
+  echo "PASS: public turn exits 0 with no stdout"; PASS=$((PASS+1))
+else
+  echo "FAIL: public turn injected (exit=$pub_rc stdout=$pub_out)" >&2; FAIL=$((FAIL+1))
+fi
+
 echo "----"
 echo "PASS=$PASS FAIL=$FAIL"
 [[ "$FAIL" -eq 0 ]]

package/payload/platform/plugins/admin/hooks/__tests__/mailbox-inject.test.sh

@@ -493,13 +493,26 @@ else
 fi
 rm -rf "$A"
 
+# Task 2424 — a public visitor's turn must never carry the operator's mailbox
+# list. This hook's only role gate was "is ACCOUNT_DIR set", which held on the
+# pty-spawner path but not on the rc-spawn path, where buildRcChildEnv stamps it
+# unconditionally. MAXY_PUBLIC_ALLOWED_TOOLS is stamped for role=public only.
+PUB_A=$(mktemp -d)
+PUB_OUT=$(printf '%s' '{"session_id":"x","prompt":"hi"}' | ACCOUNT_DIR="$PUB_A" MAXY_PUBLIC_ALLOWED_TOOLS='mcp__channel__reply' bash "$HOOK" 2>/dev/null); PUB_RC=$?
+if [ "$PUB_RC" -eq 0 ] && [ -z "$PUB_OUT" ]; then
+  ok "public turn exits 0 with no stdout even with ACCOUNT_DIR set"
+else
+  bad "public turn injected (exit=$PUB_RC stdout=$PUB_OUT)"
+fi
+rm -rf "$PUB_A"
+
 echo "----"
 echo "PASS=$PASS FAIL=$FAIL"
 # The count is asserted, not just the failures: a case that stops running (a
 # broken helper, a guard, an early exit) otherwise leaves a green suite that
 # tested less than it claims, and .husky/pre-commit reads only the exit status.
-EXPECTED=28
-if [ "$(id -u)" -eq 0 ]; then EXPECTED=26; fi
+EXPECTED=29
+if [ "$(id -u)" -eq 0 ]; then EXPECTED=27; fi
 if [[ $((PASS+FAIL)) -ne "$EXPECTED" ]]; then
   echo "FAIL: expected $EXPECTED cases, ran $((PASS+FAIL))" >&2
   exit 1

package/payload/platform/plugins/admin/hooks/__tests__/preference-consult-directive.test.sh

@@ -10,6 +10,12 @@ check 'printf "%s" "$OUT" | grep -q "hookSpecificOutput"' "emits envelope"
 check 'printf "%s" "$OUT" | grep -q "profile-read"' "names profile-read"
 check 'printf "%s" "$OUT" | grep -q "output/"' "names output scratch rule"
 check '! printf "%s" "$OUT" | grep -q "—"' "no em-dash"
+# Task 2424 — a public visitor's turn carries only its agent's authored
+# IDENTITY/SOUL/KNOWLEDGE. MAXY_PUBLIC_ALLOWED_TOOLS is stamped for role=public
+# spawns only, by both spawn paths.
+OUT_PUB=$(printf '{"session_id":"x","prompt":"hi"}' | MAXY_PUBLIC_ALLOWED_TOOLS='mcp__channel__reply' bash "$HOOK" 2>/dev/null); RC_PUB=$?
+check '[ "$RC_PUB" = "0" ]' "public turn exits 0"
+check '[ -z "$OUT_PUB" ]' "public turn emits nothing on stdout"
 echo "----- $PASS passed, $FAIL failed -----"
 for f in "${FAILED[@]:-}"; do [ -n "$f" ] && echo "  $f"; done
 [ "$FAIL" -eq 0 ]

package/payload/platform/plugins/admin/hooks/__tests__/prompt-optimiser-directive.test.sh

@@ -195,6 +195,16 @@ else
   echo "FAIL: false-suppression on a normal prompt (exit=$norm_exit stdout=$norm_out)" >&2; FAIL=$((FAIL+1))
 fi
 
+# Task 2424 — a public visitor's turn carries only its agent's authored
+# IDENTITY/SOUL/KNOWLEDGE. MAXY_PUBLIC_ALLOWED_TOOLS is stamped for role=public
+# spawns only, by both spawn paths.
+pub_out=$(printf '%s' '{"session_id":"x","prompt":"hi"}' | MAXY_PUBLIC_ALLOWED_TOOLS='mcp__channel__reply' bash "$HOOK" 2>/dev/null); pub_rc=$?
+if [[ "$pub_rc" -eq 0 && -z "$pub_out" ]]; then
+  echo "PASS: public turn exits 0 with no stdout"; PASS=$((PASS+1))
+else
+  echo "FAIL: public turn injected (exit=$pub_rc stdout=$pub_out)" >&2; FAIL=$((FAIL+1))
+fi
+
 echo "----"
 echo "PASS=$PASS FAIL=$FAIL"
 [[ "$FAIL" -eq 0 ]]

package/payload/platform/plugins/admin/hooks/datetime-inject.sh

@@ -34,6 +34,16 @@ set -uo pipefail
 # session_id is used here (for the breadcrumb); the block is prompt-independent.
 HOOK_INPUT=$(cat 2>/dev/null || true)
 
+# Task 2424 — a public visitor's turn carries only its agent's authored
+# IDENTITY/SOUL/KNOWLEDGE. MAXY_PUBLIC_ALLOWED_TOOLS is stamped for role=public
+# spawns only, by both spawn paths, and is the signal public-tool-surface.sh
+# already keys on. Placed after the stdin drain so the parent never sees EPIPE.
+if [ -n "${MAXY_PUBLIC_ALLOWED_TOOLS:-}" ]; then
+  echo "[public-prompt-gate] op=gate hook=datetime-inject.sh public=1" >&2
+  exit 0
+fi
+echo "[public-prompt-gate] op=gate hook=datetime-inject.sh public=0" >&2
+
 # Fail-open if either encoder is unavailable: python3 wraps the JSON envelope,
 # node formats the instant in the target zone (Intl has the full IANA database).
 command -v python3 >/dev/null 2>&1 || exit 0

package/payload/platform/plugins/admin/hooks/mailbox-inject.sh

@@ -32,6 +32,20 @@ set -uo pipefail
 # hit with EPIPE. Same reason the two sibling hooks drain first.
 HOOK_INPUT=$(cat 2>/dev/null || true)
 
+# Task 2424 — a public visitor's turn carries only its agent's authored
+# IDENTITY/SOUL/KNOWLEDGE. The ACCOUNT_DIR test below is NOT a role gate on the
+# rc-spawn path: buildRcChildEnv stamps that variable unconditionally
+# (rc-daemon.ts), so Task 2271's reasoning held only for pty-spawner, and after
+# Task 2423 routed public Telegram through /rc-spawn the operator's mailbox list
+# reached visitors. MAXY_PUBLIC_ALLOWED_TOOLS is stamped for role=public spawns
+# only, by both paths. Placed after the stdin drain so the parent never sees
+# EPIPE.
+if [ -n "${MAXY_PUBLIC_ALLOWED_TOOLS:-}" ]; then
+  echo "[public-prompt-gate] op=gate hook=mailbox-inject.sh public=1" >&2
+  exit 0
+fi
+echo "[public-prompt-gate] op=gate hook=mailbox-inject.sh public=0" >&2
+
 command -v python3 >/dev/null 2>&1 || exit 0
 command -v node >/dev/null 2>&1 || exit 0
 

package/payload/platform/plugins/admin/hooks/preference-consult-directive.sh

@@ -5,6 +5,15 @@
 # promote finished deliverables out of output/. Prompt-independent; fail-open.
 set -uo pipefail
 HOOK_INPUT=$(cat 2>/dev/null || true)
+# Task 2424 — a public visitor's turn carries only its agent's authored
+# IDENTITY/SOUL/KNOWLEDGE. MAXY_PUBLIC_ALLOWED_TOOLS is stamped for role=public
+# spawns only, by both spawn paths, and is the signal public-tool-surface.sh
+# already keys on. Placed after the stdin drain so the parent never sees EPIPE.
+if [ -n "${MAXY_PUBLIC_ALLOWED_TOOLS:-}" ]; then
+  echo "[public-prompt-gate] op=gate hook=preference-consult-directive.sh public=1" >&2
+  exit 0
+fi
+echo "[public-prompt-gate] op=gate hook=preference-consult-directive.sh public=0" >&2
 command -v python3 >/dev/null 2>&1 || exit 0
 python3 - <<'PY' 2>/dev/null || exit 0
 import json

package/payload/platform/plugins/admin/hooks/prompt-optimiser-directive.sh

@@ -38,6 +38,16 @@ set -uo pipefail
 # UserPromptSubmit payload carries session_id, used for the durable breadcrumb.
 HOOK_INPUT=$(cat 2>/dev/null || true)
 
+# Task 2424 — a public visitor's turn carries only its agent's authored
+# IDENTITY/SOUL/KNOWLEDGE. MAXY_PUBLIC_ALLOWED_TOOLS is stamped for role=public
+# spawns only, by both spawn paths, and is the signal public-tool-surface.sh
+# already keys on. Placed after the stdin drain so the parent never sees EPIPE.
+if [ -n "${MAXY_PUBLIC_ALLOWED_TOOLS:-}" ]; then
+  echo "[public-prompt-gate] op=gate hook=prompt-optimiser-directive.sh public=1" >&2
+  exit 0
+fi
+echo "[public-prompt-gate] op=gate hook=prompt-optimiser-directive.sh public=0" >&2
+
 # Fail-open if the JSON encoder is unavailable.
 command -v python3 >/dev/null 2>&1 || exit 0
 

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:0a9fdc97ea6caba4625dfee58ef5c504befcd1adfef8c892330bf95b3c17c3ee
+content-hash: sha256:2a6a3a040c8d55a472cfc2eda9180b15e5a0ebd8e5ce49a997c4348570ffd37b
 brand: maxy-code
 product-name: Maxy
 ---
@@ -5557,6 +5557,8 @@ There is exactly one place each datum is read from, and every subsystem reads it
 - **Default agent + account id** come from the canonical account config `data/accounts/<id>/account.json`, resolved via `resolveAccount` / `resolveDefaultAgentSlug` / `getDefaultAccountId` (`app/lib/claude-agent/account.ts`). The UI server's bare-root handler and branding loader read it through these helpers — never from `~/.<brand>/account.json`, which nothing writes. A `null` default means a genuinely unset `defaultAgent`; the root logs `[public-root] op=serve-default slug=<s>` on success and `op=no-default` only when the canonical default is truly empty.
 - **Identity files** (IDENTITY.md, SOUL.md, KNOWLEDGE.md) come from `agents/<slug>/` — keyed on the agent's slug, never the literal role. A public agent renamed to a slug `≠ "public"` (e.g. `maxy-info`) spawns from `agents/maxy-info/`. Admin reads `agents/admin/`. The spawn composer and the standing reachability audit resolve this directory through one shared function, `resolveAgentIdentityDir(accountDir, role, slug)` (`claude-session-manager/src/agent-identity-locator.ts`), so the path the audit vouches for is byte-identical to the path the spawn reads — the audit's `reachable=true` implies the spawn will find the files, and a slug whose files are misplaced is reported `reachable=false reason=files-missing file=<path>` without a visitor request.
 
+**What a public block contains.** A `role='public'` compose emits `<identity>`, `<soul>`, `<platform-boundary>`, `<data-stewardship>` and `<knowledge>`, and nothing else. The `<host>` section every other role gets is omitted: hostname, LAN IPv4, admin URL and tunnel URL are facts about the operator's machine, and a visitor's agent holds only what its author wrote. The two standing directives stay because they constrain behaviour rather than stating extractable facts. `op=public-persona-composed … hostBytes=0` is the per-spawn proof; non-zero on a public spawn is the regression signal, readable without reproducing a visitor turn.
+
 Which account is `<id>`? The slug is the address, and the address names the account. `resolvePublicAddressFromDisk` (`platform/ui/app/lib/claude-agent/public-address.ts`) walks every valid account for an active agent at the requested slug: exactly one claimant serves; the house serves when it is among several claimants and the others are refused by name; two or more non-house claimants serve nobody. The bare root `/` carries no slug and stays the house's door with the house's `defaultAgent`. The four public surfaces — the `/{slug}` page, `POST /api/chat`, `POST /api/session` and the visitor transcript reader — share that one resolver, and the resolved account rides `agentAccountId` to `/public-spawn`, which re-scopes the spawn onto it. A visitor's uploads follow the same account, and the reader locates them from the session's own sidecar `accountId` rather than re-deriving them from the slug, because a slug's owner can change after the session ran. Slugs are not unique across accounts, so a collision is reported on every refusal (`[webchat] op=address-collision`) and counted on every run of the `webchat-address-audit` loop.
 
 ### Observability

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,11 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-08-05 (0.1.562)
+
+- A public agent no longer sees anything about you or your machine. A stranger messaging a public bot was having your connected mailbox list, this machine's name and network addresses, its admin and tunnel web addresses, today's date and your working preferences added to every turn, alongside the persona you wrote. A public turn now carries only what the agent's author wrote plus its single reply tool.
+- Two standing checks back that up: one records, for every account, exactly what gets added to a turn, and the other refuses to start if that picture drifts from what is expected. Each spawn also reports how much was added, so a public one showing anything other than nothing is visible immediately.
+
 ## 2026-08-04 (0.1.561)
 
 - A public Telegram bot now answers. Messages were arriving and the conversation staying alive, but nothing the visitor sent ever became a turn, so a public bot received everything and replied to nothing. Public bots now open through the same locked-down path the platform already uses elsewhere: the ordinary setup with only the reply tool available.

package/payload/platform/plugins/docs/references/internals.md

@@ -238,6 +238,8 @@ There is exactly one place each datum is read from, and every subsystem reads it
 - **Default agent + account id** come from the canonical account config `data/accounts/<id>/account.json`, resolved via `resolveAccount` / `resolveDefaultAgentSlug` / `getDefaultAccountId` (`app/lib/claude-agent/account.ts`). The UI server's bare-root handler and branding loader read it through these helpers — never from `~/.<brand>/account.json`, which nothing writes. A `null` default means a genuinely unset `defaultAgent`; the root logs `[public-root] op=serve-default slug=<s>` on success and `op=no-default` only when the canonical default is truly empty.
 - **Identity files** (IDENTITY.md, SOUL.md, KNOWLEDGE.md) come from `agents/<slug>/` — keyed on the agent's slug, never the literal role. A public agent renamed to a slug `≠ "public"` (e.g. `maxy-info`) spawns from `agents/maxy-info/`. Admin reads `agents/admin/`. The spawn composer and the standing reachability audit resolve this directory through one shared function, `resolveAgentIdentityDir(accountDir, role, slug)` (`claude-session-manager/src/agent-identity-locator.ts`), so the path the audit vouches for is byte-identical to the path the spawn reads — the audit's `reachable=true` implies the spawn will find the files, and a slug whose files are misplaced is reported `reachable=false reason=files-missing file=<path>` without a visitor request.
 
+**What a public block contains.** A `role='public'` compose emits `<identity>`, `<soul>`, `<platform-boundary>`, `<data-stewardship>` and `<knowledge>`, and nothing else. The `<host>` section every other role gets is omitted: hostname, LAN IPv4, admin URL and tunnel URL are facts about the operator's machine, and a visitor's agent holds only what its author wrote. The two standing directives stay because they constrain behaviour rather than stating extractable facts. `op=public-persona-composed … hostBytes=0` is the per-spawn proof; non-zero on a public spawn is the regression signal, readable without reproducing a visitor turn.
+
 Which account is `<id>`? The slug is the address, and the address names the account. `resolvePublicAddressFromDisk` (`platform/ui/app/lib/claude-agent/public-address.ts`) walks every valid account for an active agent at the requested slug: exactly one claimant serves; the house serves when it is among several claimants and the others are refused by name; two or more non-house claimants serve nobody. The bare root `/` carries no slug and stays the house's door with the house's `defaultAgent`. The four public surfaces — the `/{slug}` page, `POST /api/chat`, `POST /api/session` and the visitor transcript reader — share that one resolver, and the resolved account rides `agentAccountId` to `/public-spawn`, which re-scopes the spawn onto it. A visitor's uploads follow the same account, and the reader locates them from the session's own sidecar `accountId` rather than re-deriving them from the slug, because a slug's owner can change after the session ran. Slugs are not unique across accounts, so a collision is reported on every refusal (`[webchat] op=address-collision`) and counted on every run of the `webchat-address-audit` loop.
 
 ### Observability

package/payload/platform/scripts/__tests__/public-prompt-gate-registered.test.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# Task 2424 — every UserPromptSubmit hook must either carry the public gate or
+# be on the inert list. A fifth injecting hook added without a gate emits no
+# event and does not reproduce on demand: the only symptom is a stranger being
+# told something about the operator.
+#
+# Both writers are scanned. provision-account-dir.sh writes the array at account
+# creation; the account-settings-*.sh libs patch it onto accounts that already
+# exist, which is the only path that reaches client sub-accounts. Of the four
+# libs only mailbox-inject and public-surface touch this event — askgate patches
+# PreToolUse and pdf-conformance patches PostToolUse, so the filter skipping
+# them is correct rather than a broken parser.
+#
+# The guard is matched as a fixed string, never as a mention of the variable: a
+# hook that merely READS MAXY_PUBLIC_ALLOWED_TOOLS is not gated by it, and
+# counting it as gated is exactly the false green this test exists to avoid.
+set -uo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROV="$DIR/../lib/provision-account-dir.sh"
+HOOKS_DIR="$DIR/../../plugins/admin/hooks"
+GUARD='[ -n "${MAXY_PUBLIC_ALLOWED_TOOLS:-}" ]'
+INERT="archive-ingest-surface-gate.sh public-tool-surface.sh"
+PASS=0; FAIL=0
+
+ok()  { echo "PASS: $1"; PASS=$((PASS+1)); }
+bad() { echo "FAIL: $1" >&2; FAIL=$((FAIL+1)); }
+
+# Every hook script named inside the provision heredoc's UserPromptSubmit array.
+# The script name is taken from the END of each `"command"` string, not from a
+# `hooks/` prefix: provision writes `bash $HOOKS_PATH/<name>.sh`, so the literal
+# directory never appears there and a prefix anchor silently matches nothing.
+PROV_HOOKS=$(python3 - "$PROV" <<'PY'
+import re, sys
+src = open(sys.argv[1], encoding="utf-8").read()
+m = re.search(r'"UserPromptSubmit"\s*:\s*\[(.*?)\n    \]', src, re.S)
+if not m:
+    print("")
+    sys.exit(0)
+cmds = re.findall(r'"command"\s*:\s*"([^"]*)"', m.group(1))
+names = [n.group(1) for n in (re.search(r'([A-Za-z0-9_.-]+\.sh)\s*$', c.strip()) for c in cmds) if n]
+print("\n".join(sorted(set(names))))
+PY
+)
+
+# Every hook script named by a backfill lib that patches the same array. Read
+# only from the `_<NAME>_CMD=` constant each lib registers, not from every `.sh`
+# in the file: these libs name their siblings in prose, and a bare `.sh` sweep
+# turns those comments into phantom registrations.
+BACKFILL_HOOKS=""
+for lib in "$DIR"/../lib/account-settings-*.sh; do
+  grep -q 'hooks\.UserPromptSubmit' "$lib" || continue
+  cmd_names=$(grep -oE "^_[A-Z0-9_]+_CMD='[^']*'" "$lib" | grep -oE "[A-Za-z0-9_.-]+\.sh'$" | tr -d "'")
+  if [ -z "$cmd_names" ]; then
+    bad "$(basename "$lib") patches UserPromptSubmit but names no _<NAME>_CMD script — the parser cannot see what it registers"
+  fi
+  BACKFILL_HOOKS="$BACKFILL_HOOKS
+$cmd_names"
+done
+
+ALL=$(printf '%s\n%s\n' "$PROV_HOOKS" "$BACKFILL_HOOKS" | grep -v '^$' | sort -u)
+
+if [ -z "$ALL" ]; then
+  bad "no UserPromptSubmit hooks found in either writer — the parser is broken, not the tree"
+else
+  ok "found $(printf '%s\n' "$ALL" | wc -l | tr -d ' ') registered UserPromptSubmit hooks across both writers"
+fi
+
+for h in $ALL; do
+  case " $INERT " in
+    *" $h "*) ok "$h is on the inert list"; continue ;;
+  esac
+  if [ ! -f "$HOOKS_DIR/$h" ]; then
+    bad "$h is registered but has no script at $HOOKS_DIR/$h"
+  elif grep -qF "$GUARD" "$HOOKS_DIR/$h"; then
+    ok "$h carries the public gate"
+  else
+    bad "$h is registered on UserPromptSubmit with no public gate and is not inert"
+  fi
+done
+
+# The guard and the inert list each exist twice: here, and as exported constants
+# in public-prompt-surface.ts, which the standing census matches against. Two
+# hand-maintained copies of one literal is the drift class that bites silently,
+# so assert them equal. Divergence is not silent here — the census would FATAL
+# every hook on every account and fail every install smoke run — but it would be
+# a false alarm, and the cause would not be obvious from that output.
+CENSUS_TS="$DIR/../../services/claude-session-manager/src/public-prompt-surface.ts"
+if [ ! -f "$CENSUS_TS" ]; then
+  bad "the census module is not at $CENSUS_TS — this test can no longer check the shared literals"
+else
+  if grep -qF "export const PUBLIC_GATE_GUARD = '$GUARD'" "$CENSUS_TS"; then
+    ok "the census module's PUBLIC_GATE_GUARD matches the guard this test greps for"
+  else
+    bad "PUBLIC_GATE_GUARD in $CENSUS_TS differs from this test's GUARD — the two would disagree about what 'gated' means"
+  fi
+  for h in $INERT; do
+    if grep -qF "'$h'," "$CENSUS_TS" || grep -qF "'$h'" "$CENSUS_TS"; then
+      ok "the census module lists $h as inert too"
+    else
+      bad "$h is inert here but not in $CENSUS_TS — the census would FATAL on it"
+    fi
+  done
+fi
+
+# The path the standing census reads must stay the path provision writes.
+if grep -qF 'ACCOUNT_SETTINGS="$ACCOUNT_DIR/.claude/settings.json"' "$PROV"; then
+  ok "the settings path the census reads is still the path provision writes"
+else
+  bad "provision no longer writes .claude/settings.json — the census path is stale"
+fi
+
+echo "----"
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

package/payload/platform/scripts/smoke-boot-services.sh

@@ -284,6 +284,20 @@ run_one() {
     fi
   done
 
+  # Task 2424 — a public-prompt-surface drift line means some account has a
+  # per-turn hook that will inject operator context into a visitor's turn. The
+  # census fires once at boot, inside this window. Scoped to this one tag rather
+  # than widening the generic `fatal ` regex above, which would newly fail this
+  # gate on unrelated subsystems' pre-existing drift lines.
+  local drift_line
+  drift_line="$(grep -m1 -F '[public-prompt-surface] op=drift FATAL' "$log_file" || true)"
+  if [ -n "$drift_line" ]; then
+    echo "[smoke] service=$name reason=public-prompt-surface-drift matched=$drift_line" >&2
+    echo "--- log ($log_file) ---" >&2
+    cat "$log_file" >&2
+    return 1
+  fi
+
   echo "[smoke-boot] service=$name specialist-tool-drift=ok system-prompt-sentinels=ok identity-drift=ok boot=ok elapsed-ms=$elapsed_ms"
   return 0
 }

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAoB3B,OAAO,KAAK,EAAU,SAAS,EAAW,MAAM,YAAY,CAAA;AAK5D,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAqBzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAoBlD,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAQlE;;;;;;;;;;;mFAWmF;AACnF,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACvB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,IAAI,CAE/C;AAED;;;;;;;;;;2EAU2E;AAC3E,wBAAgB,cAAc,CAC5B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG,IAAI,CAOlD;AAsFD,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB;;oEAEgE;IAChE,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;sBAEkB;IAClB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;4EAGwE;IACxE,YAAY,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAA;CAC9C;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CASvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CA4BN;AAkED;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA2mHpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAoB3B,OAAO,KAAK,EAAU,SAAS,EAAW,MAAM,YAAY,CAAA;AAK5D,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAqBzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAoBlD,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAQlE;;;;;;;;;;;mFAWmF;AACnF,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACvB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,IAAI,CAE/C;AAED;;;;;;;;;;2EAU2E;AAC3E,wBAAgB,cAAc,CAC5B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG,IAAI,CAOlD;AAsFD,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB;;oEAEgE;IAChE,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;sBAEkB;IAClB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;4EAGwE;IACxE,YAAY,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAA;CAC9C;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CASvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CA4BN;AAkED;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA2nHpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -3502,7 +3502,13 @@ export function buildHttpApp(deps) {
                 return c.json({ error: 'spawn-failed', reason: composed.reason }, 503);
             }
             appendSegments.push(composed.block);
-            deps.logger(`[rc-spawn] op=public-persona-composed slug=${rcAgentSlug} identityBytes=${composed.identityBytes} soulBytes=${composed.soulBytes} knowledgeBytes=${composed.knowledgeBytes}`);
+            // Task 2424 — `hostBytes=0` is the healthy value here and the per-spawn
+            // proof that a visitor's block carries no host addresses; non-zero is the
+            // composer regressing, readable without reproducing a visitor turn.
+            // `blockBytes` bounds the whole composed surface, so an unexpected growth
+            // (a section reaching this path that should not) is visible as a number
+            // rather than needing the block itself.
+            deps.logger(`[rc-spawn] op=public-persona-composed slug=${rcAgentSlug} identityBytes=${composed.identityBytes} soulBytes=${composed.soulBytes} knowledgeBytes=${composed.knowledgeBytes} hostBytes=${composed.hostBytes} blockBytes=${Buffer.byteLength(composed.block, 'utf8')}`);
         }
         if (appendSegments.length > 0) {
             argv.push('--append-system-prompt', appendSegments.join('\n\n'));
@@ -3678,6 +3684,20 @@ export function buildHttpApp(deps) {
         // match to false — grep-able (`op=cwd-check` + `match=false`) with no
         // live repro needed.
         deps.logger(`[rc-spawn] op=cwd-check unitToken=${unitToken} resolved=${env.ACCOUNT_DIR} actual=${effectiveAccountDir} match=${env.ACCOUNT_DIR === effectiveAccountDir}`);
+        // Task 2339 — the realised-surface hook's only input. `tool-allowlist` below
+        // records the surface this spawn was GIVEN; nothing recorded the surface it
+        // REALISES, so five tools ran under a one-tool allowlist and produced no
+        // line. Stamped here rather than inside buildRcChildEnv so it lands after
+        // the last argv push and the value is this spawn's final `--allowed-tools`
+        // set. Public spawns only; its presence is the signal the hook keys on.
+        //
+        // Task 2424 — moved ABOVE the `tool-allowlist` line, which now reports this
+        // value. It used to be stamped after, so the line could not see it. The four
+        // per-turn hook gates also key on this variable, so its absence on a public
+        // spawn is what `publicToolsEnv=0` names.
+        if (publicLockdown) {
+            env[PUBLIC_ALLOWED_TOOLS_ENV] = allowedToolsFromArgv(argv).join(',');
+        }
         // Task 2260 — the realised tool surface, on EVERY rc-spawn. /rc-spawn emitted
         // no such line, which is why the incident session was invisible to every
         // tool-surface audit. An admin spawn reports count=0 strictMcp=n, which is
@@ -3688,16 +3708,12 @@ export function buildHttpApp(deps) {
             count: publicLockdown ? publicLockdown.allowedTools.length : 0,
             strictMcp: publicLockdown !== null,
             mode: effectiveRcPermissionMode,
+            // Task 2424 — read back from the env actually stamped, not from the
+            // allowlist computed above, so the line reports what reached the child.
+            publicToolsEnv: (env[PUBLIC_ALLOWED_TOOLS_ENV] ?? '')
+                .split(',')
+                .filter((t) => t.length > 0).length,
         }));
-        // Task 2339 — the realised-surface hook's only input. `tool-allowlist` above
-        // records the surface this spawn was GIVEN; nothing recorded the surface it
-        // REALISES, so five tools ran under a one-tool allowlist and produced no
-        // line. Stamped here rather than inside buildRcChildEnv so it lands after
-        // the last argv push and the value is this spawn's final `--allowed-tools`
-        // set. Public spawns only; its presence is the signal the hook keys on.
-        if (publicLockdown) {
-            env[PUBLIC_ALLOWED_TOOLS_ENV] = allowedToolsFromArgv(argv).join(',');
-        }
         deps.logger(`[rc-spawn] op=argv unitToken=${unitToken} cwd=${effectiveAccountDir} permissionMode=${effectiveRcPermissionMode} model=${effectiveRcModel ?? 'unset'} effort=${effectiveRcEffort ?? 'unset'} positionalBytes=${positionalBytes} voiceBytes=${voiceBytes} argv=${JSON.stringify([deps.claudeBin, ...argv])}`);
         emitRcLife(deps.logger, 'argv', 'rc-spawn', 'node-pty', rcLifeMode, unitToken, {
             cwd: effectiveAccountDir,