@rubytech/create-maxy-code 0.1.61 → 0.1.63

package/payload/premium-plugins/real-agent/plugins/preval/skills/property-preval/SKILL.md

@@ -26,7 +26,7 @@ Never substitute the agent's body or display fonts even if their `DESIGN.md` spe
   - Optional `beds`, `type`, `tenure`, `condition` (well / average / needs work).
   - `adjustments[]` — operator-curated array of `{label, delta_pct}` covering esoteric factors that shift the headline range (e.g. `{"label":"South-facing garden","delta_pct":3}`, `{"label":"Needs full reno","delta_pct":-8}`). Deltas sum linearly into the final range.
   - `narrative` — one short paragraph the operator writes about the property.
-  - **Floor area is auto-pulled from the EPC register** via `real-agent-epc` (`epc-lookup-by-address`) and surfaced as `sqft_m2` + derived `sqft`. If EPC has no record (pre-2008 property never sold or let; Scotland/NI; unmatched), operator pastes `subject.sqft` directly. Without a floor area the renderer prints "Estimate requires floor area" and shows only the £/sqft benchmark — never invents a number.
+  - **EPC certificate fields are pasted by the operator before invocation.** The three required fields are `subject.total_floor_area_m2`, `subject.current_energy_rating`, and `subject.lodgement_date` — copied verbatim from the EPC certificate. The renderer derives `sqft` from `total_floor_area_m2 × 10.7639`. There is no mid-run paste prompt and no benchmark-only render — a null in any of the three aborts the run with `reason=epc-certificate-not-supplied`.
 - **`agent_listings`** — the agent's recent sold / under-offer / live listings to feature on the closing page. Up to 6 entries of `{url, address, price, beds, type, image, status, slug}` where `status ∈ {"Sold","Under offer","For sale"}`. Operator picks the comps that make the strongest pitch; this is *not* the PropertyData sample.
 - **`market_summary`** — `headline` (one display-italic line), `paragraphs[]` (2–3 short paragraphs), `demand_gauge_position` (percentage string like `"62%"`), `price_growth_note`, `demand_note`. The operator drafts or accepts an LLM stub.
 
@@ -48,9 +48,7 @@ Parallel fan-out keyed on the derived postcode + the subject address:
 11. `property-data-flood-risk` — area flood risk (full postcode only).
 12. `property-data-council-tax` — band D + per-property bands (full postcode only).
 
-**EPC (1 call — free, rate-limited):**
-
-13. `epc-lookup-by-address(address, postcode)` — subject floor area + energy ratings + lodgement date.
+EPC certificate fields are operator paste-in — see `subject.total_floor_area_m2`, `subject.current_energy_rating`, `subject.lodgement_date` in the Inputs section. There is no EPC MCP fan-out.
 
 `address-match-uprn` and `planning-applications` are deliberately omitted (CRM hygiene and dev-precedent reports respectively).
 
@@ -67,7 +65,7 @@ Return the PDF path to the operator.
 ## Pages
 
 1. **Cover** — full-bleed `subject.cover_hero` with vertical gradient scrim; light logo top-left; eyebrow "`<brand.name>` · Pre-valuation"; address in display-italic; postcode chip; four-up meta strip (Report · Address · Postcode · Generated). Lifted from property-market-report's cover contract.
-2. **Subject valuation** — KPI strip (sqft, beds, EPC rating, type). Centre panel: headline range = `sqft × sold_psf_low–high` (Land Registry 70pc band) with `sqft × asking_psf` shown as a cross-check. Operator `adjustments[]` displayed as a stacked list (label · delta% · running £). Final range pill at the foot. If `sqft` missing the panel switches to the "requires floor area" mode (£/sqft benchmark only). One paragraph of `subject.narrative` under the panel.
+2. **Subject valuation** — KPI strip (sqft, beds, EPC rating, type). Centre panel: headline range = `sqft × sold_psf_low–high` (Land Registry 70pc band) with `sqft × asking_psf` shown as a cross-check. Operator `adjustments[]` displayed as a stacked list (label · delta% · running £). Final range pill at the foot. One paragraph of `subject.narrative` under the panel. `sqft` is required — a null value aborts the run, never renders a benchmark-only panel.
 3. **Market context** — KPI cube (avg asking, avg sold, £/sqft, YoY); pill + gauge for demand; 7y growth sparkline (£ solid + £/sqft dashed); summary paragraphs. Same patterns as property-market-report's page 2.
 4. **Comparables (full-width, stacked)** — Nearest sold table (top 6) full-width across the page; Live asking tile grid (top 4) full-width below. Vertically stacked, never side-by-side — corrects the cramped two-column layout in the v1 preval where the asking tiles got pushed to ~40mm columns of italic addresses.
 5. **Recently with `<brand.name>` + sources** — agent's own listings as a clickable tile grid (`<a>` per card, status badge: Sold / Under offer / For sale), then the sources / methodology / accuracy / investment block. Closes with `Real Agent · Generated <date> · <postcode>` in the footer.
@@ -75,11 +73,13 @@ Return the PDF path to the operator.
 ## How to execute
 
 1. Match the postcode out of the address (`/[A-Z]{1,2}[0-9][A-Z0-9]?\s?[0-9][A-Z]{2}/i`). Stop if no match.
-2. Run the 13 fan-out tools (12 PropertyData + 1 EPC) in parallel. Failure handling differs by source:
-   - **PropertyData `key-not-registered`** → abort with the `property-data-key-register` prompt. The pack cannot render without market data.
-   - **PropertyData `http-429`** → back off, retry only the throttled tool. Do not re-run the whole fan-out.
-   - **EPC failure of any kind** — `key-not-registered`, `http-404 (no record on file)`, `http-429`, `http-500`, network failure, or MCP not configured on the account — is treated as a single class: **prompt the operator** with the relevant cause (e.g. "EPC API key not registered — register with `epc-key-register`, or paste subject.sqft to continue"; "No EPC on file for this address — paste subject.sqft to continue"; "EPC API unavailable — paste subject.sqft to continue"). If the operator pastes `subject.sqft`, the pack renders normally with the EPC-derived KPI cells switching to "—" + "No EPC on file" / "EPC API unavailable" sub-labels. If the operator declines to paste, the valuation panel switches to the "Estimate requires floor area" benchmark-only mode and the pack still renders the other four pages.
+2. Run the 12 PropertyData fan-out tools in parallel. Every failure is fail-loud — no mid-run paste prompts, no benchmark-only render, no degraded pack on disk:
+   - **PropertyData `key-not-registered`** → abort `reason=property-data-key-not-registered` with the `property-data-key-register` remediation hint.
+   - **PropertyData `http-429`** → back off and retry the single throttled tool **once**. A second `http-429` aborts `reason=property-data-rate-limited`.
+   - **PropertyData `http-5xx` / network failure** → abort `reason=property-data-unavailable`.
+   - **Watchdog: any of the 12 PropertyData log lines missing** within 60 s of `[preval] start` → `render.py` aborts `reason=observability-missing tool=<name>` naming the silent tool. A silent tool drop must never proceed to render.
 3. Compute valuation range:
+   - `sqft = round(subject.total_floor_area_m2 × 10.7639)` (operator-pasted m² × the standard conversion factor).
    - `sold_psf_low` = `sold-prices-per-sqf` `70pc_range[0]`
    - `sold_psf_high` = `sold-prices-per-sqf` `70pc_range[1]`
    - `low = sqft × sold_psf_low`, `mid = sqft × sold_psf`, `high = sqft × sold_psf_high`
@@ -96,23 +96,81 @@ Deltas sum linearly (`-8 + 3 = -5%`, applied as `× 0.95`). Compound interpretat
 
 - `[preval] start address="<addr>" postcode=<pc>` at run start.
 - `[preval] done pdf=<path> pages=<n> ms=<n>` at run end.
-- Each fan-out call emits its own `[property-data] tool=<name>` or `[epc] tool=<name>` line in `server.log` (inherited contracts; no new instrumentation here).
+- `[preval] aborted reason=<cause> address="<addr>" postcode=<pc> ms=<n>` on any abort (one line, then exit 2; no `done`).
+- Each fan-out call emits its own `[property-data] tool=<name>` line in `server.log` (inherited contract; no new instrumentation here). `render.py`'s observability watchdog tails these lines and aborts with `observability-missing tool=<name>` if any of the 12 expected names is absent 60 s after `[preval] start`.
+
+## Hard breakpoints
+
+Each row aborts the run with the named cause. No PDF or `index.html` is left on disk. Operator sees a single-line cause + one-line remediation hint, nothing else.
+
+| Forbidden state | `reason=` cause |
+|---|---|
+| `subject.total_floor_area_m2` / `current_energy_rating` / `lodgement_date` null or missing | `epc-certificate-not-supplied` (operator pastes the three fields from the EPC certificate before re-invoking) |
+| `subject.cover_hero` missing, unreachable, below 1200×800, or symlinked into another property's folder | `subject-cover-hero-missing` / `subject-cover-hero-unreadable` / `subject-cover-hero-too-small` / `subject-cover-hero-symlinked-foreign` |
+| `brand` not resolved from an on-disk `DESIGN.md` (required token missing) | `brand-unresolved` |
+| `agent_listings` empty | `agent-listings-empty` |
+| `market_summary.paragraphs` < 2 entries | `market-summary-too-thin` |
+| PropertyData any-call `http-429` after 1 retry | `property-data-rate-limited` |
+| PropertyData any-call `key-not-registered` | `property-data-key-not-registered` (operator runs `property-data-key-register`) |
+| Any of the 12 PropertyData log lines missing 60 s after `[preval] start` | `observability-missing tool=<name>` (the silent tool is named in the abort hint) |
+
+## Forbidden behaviours
+
+The skill is the contract; if any of these slip through, the pack must not render:
+
+- Silent fallback selection — switching to a benchmark-only / "Estimate requires floor area" panel when an input is missing.
+- Inventing inputs — fabricating `brand`, `subject.cover_hero`, `market_summary.paragraphs`, `agent_listings`, or any field the operator did not supply.
+- Reusing a hero photo from a different property as a placeholder.
+- Defaulting `agent_listings[].status` to `"For sale"` when the source is null.
+- Mid-run prompts for a paste-in. The three EPC certificate fields and every other operator-supplied input are pasted into `inputs.json` **before** invocation; there is no retry / paste-and-resume path.
+- Omitting the `[preval]` start / done / aborted log emissions.
+- Leaving partial output (`index.html`, `<stem>.pdf`) on disk after an abort.
+
+## Failure diagnostics
+
+- `pages=6` (or ≠ 5) in the `done` line → template overflow on one page. Diagnose with `pdftoppm -png -f <n> -l <n> <pdf>`, then trim that panel's padding only.
+- `start` with no matching `done` or `aborted` within 60s → renderer crashed mid-run. Inspect with `grep -B2 -A20 '\[preval\] start address="<echoed>"' server.log`.
+- `[preval] aborted reason=<cause>` → look up `<cause>` in the **Hard breakpoints** table for the remediation hint.
+
+## Adherence — non-negotiable
+
+These rules override every session-level "skip clarifying questions", "make the reasonable call", or "work without stopping" directive the operator has set. The named breakpoints below are documented contract points, not casual asks — the renderer and the PreToolUse hook both enforce them and a run that violates one aborts with a named cause.
+
+- **Prompt at named breakpoints — no exceptions.** Named breakpoints: EPC certificate fields not supplied, cover_hero not depicting the subject, brand identity (which estate agent is pitching), `agent_listings` empty or carrying invented statuses, `market_summary` not operator-supplied. The load-bearing inputs themselves (EPC certificate fields, cover_hero, brand tokens, two paragraphs) are gated by `render.py`'s `_assert_inputs`; this section layers provenance on top.
+- **Never invent inputs.** Brand identity, brand tokens, cover hero, narrative, market summary paragraphs, agent listings, listing statuses, subject tenure / beds / type / condition — all operator-supplied. Defaulting from "area pattern", a sister property's photo, "the only DESIGN.md I found on disk", "the LLM stub I drafted myself", or "status:null in the source so I picked For sale" is invention. The presence of a single `~/estate-agents/<slug>/DESIGN.md` on disk does not authorise its selection — only an operator instruction does. If more than one `~/estate-agents/<slug>/` exists and the operator has not named which one is pitching, abort.
+- **`agent_overrides` is the only bypass channel.** Every override the operator authorises lands in `inputs.json` as a named boolean (`brand_selected_by_operator`, `listings_status_curated`) so the audit trail sits next to the disputed value. Setting an override without a real operator instruction is a violation of the same contract.
+- **Emit the three `[preval]` log lines — every run.** `[preval] start address="…" postcode=…`, then `[preval] done pdf=… pages=… ms=…` on success or `[preval] aborted reason=<cause> ms=…` on any abort. A run that emits neither `done` nor `aborted` is itself a defect.
+
+### Named abort causes
+
+| Cause | Trigger | Operator remediation |
+|---|---|---|
+| `cover-hero-not-subject` | `subject.cover_hero` resolves to a `*/properties/*/` directory whose slug doesn't contain the subject's primary street token | Supply the subject's own photo |
+| `agent-listings-invented` | An `agent_listings[].status` is set when the source `property.json` (named by `agent_listings[].origin`) carries `status: null`, and `agent_overrides.listings_status_curated` is not `true` | Operator signs off on each listing status, then sets the override |
+| `market-summary-invented` | `market_summary.origin` is missing or not in `{"operator", "operator-edited-llm-stub"}` | Operator drafts or accepts the paragraphs; set `origin` accordingly |
+| `brand-invented` | `brand.name` is set without `agent_overrides.brand_selected_by_operator: true` | Operator names which estate agent is pitching; set the override |
+| `epc-certificate-not-supplied` | Any of `subject.total_floor_area_m2`, `subject.current_energy_rating`, or `subject.lodgement_date` is null or missing | Operator copies the three fields verbatim from the EPC certificate into `subject` in `inputs.json` before re-invoking |
+| `observability-missing tool=<name>` | One of the 12 expected `[property-data] tool=<name>` log lines did not appear within 60 s of `[preval] start` | Re-invoke and confirm every PropertyData tool returns; if a tool is genuinely down, surface a `property-data-*` cause first |
+| `log-destination-unavailable` | Neither `~/.maxy/logs/server.log` nor `<out_dir>/preval.log` is writable | Fix filesystem permissions before re-running |
+
+## Self-check before declaring done
 
-## Failure signatures
+Answer all seven inline at the end of every run, with line references from `server.log` or `<out_dir>/preval.log` — not paraphrase:
 
-- `pages=6` (or ≠ 5) in the `done` line → template overflow on one page. Diagnose with `pdftoppm -png -f <n> -l <n> <pdf>` to see which page bled, then trim that panel's padding only.
-- `start` with no matching `done` within 60s → renderer crashed. Inspect with `grep -B2 -A20 '\[preval\] start address="<echoed>"' server.log`.
-- `[epc] … status=http-404` → property has no EPC; prompt "no EPC on file for this address — paste subject.sqft to continue".
-- `[epc] … status=key-not-registered` → prompt "EPC API key not registered — run `epc-key-register`, or paste subject.sqft to continue".
-- `[epc] … status=http-429` | `http-5xx` | `bad-response` | `network-error` → prompt "EPC API unavailable — paste subject.sqft to continue". The MCP-not-installed case (no `[epc] …` line at all and the tool call surfaces as "tool not found") is the same prompt with cause "EPC MCP not configured on this account".
-- `[property-data] … status=http-429` → 4-calls-in-10-seconds throttle. Retry only the throttled tool after the back-off; do not re-run the whole fan-out.
+1. `[preval] start` emitted? (cite the log line)
+2. All 12 expected `[property-data] tool=<name>` log lines present, or `[preval] aborted` emitted with a named cause? (cite the lines)
+3. EPC certificate fields (`subject.total_floor_area_m2`, `subject.current_energy_rating`, `subject.lodgement_date`) all populated from the operator paste? (cite the `inputs.json` excerpt)
+4. Every input field traceable to a real source — operator paste (including the EPC certificate), on-disk `DESIGN.md`, MCP response? Anything sourced from "area pattern", a sister property file, or LLM imagination is a defect.
+5. `[preval] done pages=5` emitted? (cite the log line)
+6. PDF page count = 5 asserted? (cite the assertion result)
+7. No fields invented from area pattern, sister-property files, or LLM imagination? List the three most fabrication-prone fields (`brand.name`, `market_summary.paragraphs`, `agent_listings[].status`) and the source for each in this run.
 
 ## Out of scope
 
 - Multi-address batch preval (CSV in → many PDFs out).
 - Loop CRM auto-publish of the PDF onto a contact's record.
 - Pulling `agent_listings` from Loop CRM automatically — operator paste-in for now; CRM wire-up is a separate task.
-- Caching of MCP responses (13 credits per pack is acceptable).
+- Caching of MCP responses (12 credits per pack is acceptable).
 - A separate cover letter / pitch letter — the cover page *is* the pitch.
 - Compound adjustments (linear sum is the contract; see above).
-- Subject sqft from sources other than EPC and the operator paste-in fallback (e.g. Loop CRM floor plans, Rightmove sqft scrape) — separate task if pursued.
+- Subject EPC fields from sources other than the operator paste-in (e.g. Loop CRM floor plans, Rightmove sqft scrape, restored EPC API) — separate task if pursued.

package/payload/premium-plugins/real-agent/plugins/preval/skills/property-preval/references/__tests__/adherence.test.py

@@ -0,0 +1,373 @@
+"""Adherence-gate tests for property-preval (Tasks 157 + 163).
+
+Covers:
+
+  Task 157 provenance causes (agent didn't invent the input):
+    - cover-hero-not-subject     (slug heuristic; complements 156's symlink check)
+    - agent-listings-invented    (status set when source property.json had null)
+    - market-summary-invented    (origin missing or "agent-invented")
+    - brand-invented             (brand.name without operator override)
+    - log-destination-unavailable (observability emit-or-abort)
+
+  Task 163 causes (replaces 156's sqft gates after EPC removal):
+    - epc-certificate-not-supplied  (any of the three operator-paste EPC
+                                     fields missing — render.py + hook)
+    - observability-missing tool=<name>  (one of the 12 expected
+                                          [property-data] tool=<name> log
+                                          lines absent within the budget)
+
+Plus the PreToolUse hook red-team (blocks the same causes before
+inputs.json reaches disk).
+
+Run with:  python3 references/__tests__/adherence.test.py
+"""
+from __future__ import annotations
+import json, os, struct, subprocess, sys, tempfile, unittest, zlib
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+REFERENCES = HERE.parent
+PLUGIN_ROOT = REFERENCES.parent.parent.parent
+HOOK = PLUGIN_ROOT / "hooks" / "preval-prompt-required.sh"
+
+sys.path.insert(0, str(REFERENCES))
+from render import (  # noqa: E402
+    _assert_inputs,
+    _assert_observability_logs,
+    EXPECTED_PROPERTY_DATA_TOOLS,
+    PrevalAbort,
+)
+
+
+def _write_png(path: Path, w: int = 1600, h: int = 1200) -> None:
+    """Minimal valid PNG large enough to clear Task 156's 1200x800 gate."""
+    def chunk(tag: bytes, data: bytes) -> bytes:
+        return struct.pack(">I", len(data)) + tag + data + struct.pack(">I", zlib.crc32(tag + data) & 0xffffffff)
+    sig = b"\x89PNG\r\n\x1a\n"
+    ihdr = struct.pack(">IIBBBBB", w, h, 8, 2, 0, 0, 0)
+    raw = b"".join(b"\x00" + b"\x00\x00\x00" * w for _ in range(h))
+    idat = zlib.compress(raw)
+    path.write_bytes(sig + chunk(b"IHDR", ihdr) + chunk(b"IDAT", idat) + chunk(b"IEND", b""))
+
+
+def _complete_inputs(tmp: Path) -> dict:
+    """An inputs.json that PASSES every 156 + 157 gate."""
+    hero = tmp / "hero.png"
+    _write_png(hero)
+    return {
+        "out_dir": str(tmp),
+        "filename_stem": "subject",
+        "address": "9 Phoenix Drive, Bishop's Stortford, CM23 2UJ",
+        "postcode": "CM23 2UJ",
+        "generated": "19 May 2026",
+        "brand": {
+            "name": "Muvin",
+            "tagline": "Estate Agents",
+            "primary": "#000", "primary_dark": "#000", "accent": "#000",
+            "paper": "#fff", "paper_banded": "#fff", "rule": "#000",
+        },
+        "subject": {
+            "cover_hero": str(hero),
+            "total_floor_area_m2": 93.2,
+            "current_energy_rating": "C",
+            "lodgement_date": "2018-04-21",
+        },
+        "valuation": {
+            "avg_asking": 500000, "asking_psf": 450, "avg_sold": 480000,
+            "sold_psf": 440, "sold_psf_low": 400, "sold_psf_high": 480,
+            "sold_comps": [], "asking_comps": [],
+        },
+        "area": {
+            "crime_rating": "Low", "flood_risk": "Low", "council_tax_band_d": 2000,
+            "population": 1000, "crime_breakdown": [], "council_tax_bands": [],
+            "headline": "",
+        },
+        "demand_trend": {
+            "demand_rating": "High", "dom": 30, "turnover_pct": 5, "for_sale": 10,
+            "growth_series": [], "growth_psf_series": [],
+            "rental": {"demand_rating": "High", "dom": 20, "turnover_pct": 4, "for_rent": 5},
+            "type_dist": [],
+        },
+        "market_summary": {
+            "headline": "Bishop's Stortford is selling.",
+            "paragraphs": ["The market is active.", "Prices held flat YoY."],
+            "demand_gauge_position": "62%",
+            "price_growth_note": "Up 3% YoY.",
+            "demand_note": "High demand.",
+            "origin": "operator",
+        },
+        "agent_listings": [
+            {
+                "address": "1 Some Road, CM23",
+                "price": 600000,
+                "status": "Sold",
+                "slug": "1-some-road",
+                "origin": "operator",
+            }
+        ],
+        "agent_overrides": {
+            "brand_selected_by_operator": True,
+            "listings_status_curated": False,
+        },
+    }
+
+
+class TestAdherenceGate(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.tmp = Path(self._tmp.name)
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def _assert_aborts(self, inputs: dict, cause: str):
+        with self.assertRaises(PrevalAbort) as ctx:
+            _assert_inputs(inputs)
+        self.assertEqual(ctx.exception.cause, cause)
+        self.assertFalse(any(self.tmp.glob("*.pdf")))
+
+    def test_clean_run_passes(self):
+        _assert_inputs(_complete_inputs(self.tmp))
+
+    def test_cover_hero_not_subject(self):
+        # Plant the hero PNG in a sister property's folder to trigger the
+        # 157 slug heuristic. 156's symlink check passes (real file, not
+        # a symlink); only the 157 cause should fire.
+        sister = self.tmp / "estate-agents" / "muvin" / "properties" / "07-the-old-orchard-rye-street-cm23"
+        sister.mkdir(parents=True)
+        bad_hero = sister / "hero.png"
+        _write_png(bad_hero)
+        inputs = _complete_inputs(self.tmp)
+        inputs["subject"]["cover_hero"] = str(bad_hero)
+        self._assert_aborts(inputs, "cover-hero-not-subject")
+
+    def test_cover_hero_subject_match_passes(self):
+        subject_dir = self.tmp / "estate-agents" / "muvin" / "properties" / "9-phoenix-drive-cm23-2uj"
+        subject_dir.mkdir(parents=True)
+        good_hero = subject_dir / "hero.png"
+        _write_png(good_hero)
+        inputs = _complete_inputs(self.tmp)
+        inputs["subject"]["cover_hero"] = str(good_hero)
+        _assert_inputs(inputs)
+
+    def test_agent_listings_invented_status(self):
+        source = self.tmp / "source.json"
+        source.write_text(json.dumps({"status": None, "address": "1 Some Road"}))
+        inputs = _complete_inputs(self.tmp)
+        inputs["agent_listings"][0]["origin"] = str(source)
+        inputs["agent_overrides"]["listings_status_curated"] = False
+        self._assert_aborts(inputs, "agent-listings-invented")
+
+    def test_agent_listings_curated_override_passes(self):
+        source = self.tmp / "source.json"
+        source.write_text(json.dumps({"status": None, "address": "1 Some Road"}))
+        inputs = _complete_inputs(self.tmp)
+        inputs["agent_listings"][0]["origin"] = str(source)
+        inputs["agent_overrides"]["listings_status_curated"] = True
+        _assert_inputs(inputs)
+
+    def test_market_summary_invented_missing_origin(self):
+        inputs = _complete_inputs(self.tmp)
+        inputs["market_summary"].pop("origin")
+        self._assert_aborts(inputs, "market-summary-invented")
+
+    def test_market_summary_invented_explicit(self):
+        inputs = _complete_inputs(self.tmp)
+        inputs["market_summary"]["origin"] = "agent-invented"
+        self._assert_aborts(inputs, "market-summary-invented")
+
+    def test_brand_invented(self):
+        inputs = _complete_inputs(self.tmp)
+        inputs["agent_overrides"]["brand_selected_by_operator"] = False
+        self._assert_aborts(inputs, "brand-invented")
+
+    def test_epc_certificate_not_supplied_missing_m2(self):
+        inputs = _complete_inputs(self.tmp)
+        del inputs["subject"]["total_floor_area_m2"]
+        self._assert_aborts(inputs, "epc-certificate-not-supplied")
+
+    def test_epc_certificate_not_supplied_missing_rating(self):
+        inputs = _complete_inputs(self.tmp)
+        inputs["subject"]["current_energy_rating"] = None
+        self._assert_aborts(inputs, "epc-certificate-not-supplied")
+
+    def test_epc_certificate_not_supplied_missing_lodgement(self):
+        inputs = _complete_inputs(self.tmp)
+        inputs["subject"]["lodgement_date"] = ""
+        self._assert_aborts(inputs, "epc-certificate-not-supplied")
+
+
+class TestPreToolUseHook(unittest.TestCase):
+    def _run_hook(self, tool_name: str, file_path: str, content_obj: dict) -> tuple[int, str]:
+        payload = json.dumps({
+            "tool_name": tool_name,
+            "tool_input": {"file_path": file_path, "content": json.dumps(content_obj)},
+        })
+        result = subprocess.run(
+            ["bash", str(HOOK)],
+            input=payload,
+            capture_output=True,
+            text=True,
+        )
+        return result.returncode, result.stderr
+
+    def test_hook_blocks_market_summary_invented(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            inputs = _complete_inputs(Path(tmp))
+            inputs["market_summary"]["origin"] = "agent-invented"
+            code, stderr = self._run_hook(
+                "Write",
+                f"{tmp}/preval/CM232UJ-2026-05-19/inputs.json",
+                inputs,
+            )
+            self.assertEqual(code, 2, msg=stderr)
+            self.assertIn("market-summary-invented", stderr)
+
+    def test_hook_blocks_brand_invented(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            inputs = _complete_inputs(Path(tmp))
+            inputs["agent_overrides"]["brand_selected_by_operator"] = False
+            code, stderr = self._run_hook(
+                "Write",
+                f"{tmp}/preval/CM232UJ-2026-05-19/inputs.json",
+                inputs,
+            )
+            self.assertEqual(code, 2, msg=stderr)
+            self.assertIn("brand-invented", stderr)
+
+    def test_hook_passthrough_unrelated_path(self):
+        code, _ = self._run_hook(
+            "Write",
+            "/tmp/some-other-file.json",
+            {"hello": "world"},
+        )
+        self.assertEqual(code, 0)
+
+    def test_hook_passthrough_unrelated_tool(self):
+        code, _ = self._run_hook(
+            "Bash",
+            "/whatever/preval/inputs.json",
+            {},
+        )
+        self.assertEqual(code, 0)
+
+    def test_hook_blocks_epc_certificate_not_supplied(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            inputs = _complete_inputs(Path(tmp))
+            inputs["subject"]["current_energy_rating"] = None
+            code, stderr = self._run_hook(
+                "Write",
+                f"{tmp}/preval/CM232UJ-2026-05-19/inputs.json",
+                inputs,
+            )
+            self.assertEqual(code, 2, msg=stderr)
+            self.assertIn("epc-certificate-not-supplied", stderr)
+            self.assertIn("current_energy_rating", stderr)
+
+
+class TestObservability(unittest.TestCase):
+    def test_log_destination_unavailable_aborts(self):
+        from render import _pick_log_path
+        ro = Path("/dev/null/cannot-write-here")
+        old_home = os.environ.get("HOME")
+        with tempfile.TemporaryDirectory() as tmp:
+            holder = Path(tmp) / "not-a-dir"
+            holder.write_text("")
+            os.environ["HOME"] = str(holder)
+            try:
+                with self.assertRaises(PrevalAbort) as ctx:
+                    _pick_log_path(ro)
+                self.assertEqual(ctx.exception.cause, "log-destination-unavailable")
+            finally:
+                if old_home is not None:
+                    os.environ["HOME"] = old_home
+                else:
+                    del os.environ["HOME"]
+
+
+class TestObservabilityWatchdog(unittest.TestCase):
+    """Task 163 — 12-call PropertyData fan-out watchdog."""
+
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.tmp = Path(self._tmp.name)
+        self.log_path = self.tmp / "preval.log"
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def _write_log(self, present_tools: list[str]) -> None:
+        lines = [
+            f"[property-data] tool={name} account=local postcode=CM232UJ status=ok ms=42"
+            for name in present_tools
+        ]
+        self.log_path.write_text("\n".join(lines) + "\n")
+
+    def test_all_12_present_passes(self):
+        self._write_log(list(EXPECTED_PROPERTY_DATA_TOOLS))
+        _assert_observability_logs(self.log_path, deadline_s=0.0)
+
+    def test_missing_growth_psf_aborts(self):
+        present = [t for t in EXPECTED_PROPERTY_DATA_TOOLS if t != "property-data-growth-psf"]
+        self._write_log(present)
+        with self.assertRaises(PrevalAbort) as ctx:
+            _assert_observability_logs(self.log_path, deadline_s=0.0)
+        self.assertEqual(
+            ctx.exception.cause,
+            "observability-missing tool=property-data-growth-psf",
+        )
+        self.assertIn("property-data-growth-psf", ctx.exception.hint)
+
+    def test_missing_flood_risk_aborts(self):
+        present = [t for t in EXPECTED_PROPERTY_DATA_TOOLS if t != "property-data-flood-risk"]
+        self._write_log(present)
+        with self.assertRaises(PrevalAbort) as ctx:
+            _assert_observability_logs(self.log_path, deadline_s=0.0)
+        self.assertEqual(
+            ctx.exception.cause,
+            "observability-missing tool=property-data-flood-risk",
+        )
+
+    def test_polls_until_late_arriving_line_lands(self):
+        """The watchdog must keep polling within the budget; a late arrival
+        before the deadline is a pass, not an abort. Wall-clock waits are
+        replaced by injected _now/_sleep so the test stays fast."""
+        present = [t for t in EXPECTED_PROPERTY_DATA_TOOLS if t != "property-data-prices"]
+        self._write_log(present)
+        ticks = iter([0.0, 1.0, 2.0])  # never reaches deadline_s=10
+        appended = []
+
+        def fake_sleep(s):
+            appended.append(s)
+            with self.log_path.open("a") as f:
+                f.write(
+                    "[property-data] tool=property-data-prices account=local postcode=CM232UJ status=ok ms=99\n"
+                )
+
+        _assert_observability_logs(
+            self.log_path,
+            deadline_s=10.0,
+            poll_s=2.0,
+            _now=lambda: next(ticks),
+            _sleep=fake_sleep,
+        )
+        self.assertEqual(appended, [2.0])
+
+    def test_unreadable_log_aborts_at_deadline(self):
+        """A log path that can't be read is treated as missing tools — abort
+        once the budget elapses, name a missing tool. No silent skip."""
+        # Don't write the log file at all.
+        ticks = iter([0.0, 100.0])
+        with self.assertRaises(PrevalAbort) as ctx:
+            _assert_observability_logs(
+                self.log_path,
+                deadline_s=60.0,
+                poll_s=2.0,
+                _now=lambda: next(ticks),
+                _sleep=lambda s: None,
+            )
+        self.assertTrue(ctx.exception.cause.startswith("observability-missing tool="))
+
+
+if __name__ == "__main__":
+    unittest.main()