@rubytech/create-maxy-code 0.1.63 → 0.1.64

package/payload/platform/plugins/preval/PLUGIN.md

@@ -1,55 +0,0 @@
----
-name: real-agent-preval
-description: "Single-address pre-valuation pitch pack. One full UK address in, 5-page A4 PDF out (cover · subject valuation · market context · comparables · recently with <brand>). Consumes the real-agent-property-data MCP — no MCP tools of its own. EPC certificate fields (total_floor_area_m2, current_energy_rating, lodgement_date) are pasted by the operator into inputs.json before invocation."
-skills:
-  - skills/property-preval/SKILL.md
-hooks:
-  PreToolUse:
-    - matcher: "Write|Edit|MultiEdit"
-      command: "${CLAUDE_PLUGIN_ROOT}/hooks/preval-prompt-required.sh"
-always: false
-metadata: {"platform":{"optional":true,"embed":["admin"]}}
----
-
-# Real Agent — Preval
-
-Consumer sub-plugin. No MCP server, no new tools — only a skill (`property-preval`) that takes one full UK address plus operator-supplied brand tokens, subject details, agent listings, and a market summary, and renders a **5-page A4 pre-valuation PDF** designed as a sales pitch for the listing.
-
-## What it produces
-
-A 5-page A4 PDF and the source HTML, written to `~/Documents/Maxy/preval/<postcode-compact>-<YYYY-MM-DD>/`:
-
-- **Page 1 — Cover.** Full-bleed subject hero photo with gradient scrim. Light brand wordmark top-left. Address in display-italic. Postcode chip. Four-up meta strip (Report · Address · Postcode · Generated). Lifted from the `property-market-report` cover contract.
-- **Page 2 — Subject valuation.** KPI strip (floor area, bedrooms, EPC rating, type). Valuation panel: headline range = `derived sqft × sold £/sqft 70pc band` (Land Registry), asking £/sqft cross-check, operator adjustments (`subject.adjustments[]`) shown as a stacked list with colour-coded percentages, final indicative range pill. Floor area is derived from `subject.total_floor_area_m2` (operator-pasted from the EPC certificate) — a null value aborts the run with `epc-certificate-not-supplied`.
-- **Page 3 — Market context.** Market summary headline + paragraphs with drop cap. KPI strip (avg asking £, avg sold £, £/sqft). Price-growth panel (YoY) + demand pill with gauge. 7-year sparkline of £ and £/sqft. Same patterns as `property-market-report`.
-- **Page 4 — Comparables.** Full-width Land Registry sold-transactions table (≤ 6 rows), stacked above a full-width live-asking-comparables tile grid (≤ 4 tiles). Never side-by-side — corrects the cramped two-column layout in v1 preval.
-- **Page 5 — Recently with `<brand>` + sources.** Operator-curated `agent_listings[]` rendered as a clickable tile grid with status badges (Sold / Under offer / For sale), then the sources & methodology block. The vendor reads this page and knows who to call.
-
-## Tool dependencies
-
-The skill fans out to **12** PropertyData MCP calls in parallel (postcode-keyed): `prices`, `prices-per-sqf`, `sold-prices`, `sold-prices-per-sqf`, `growth`, `growth-psf`, `demand`, `demand-rent`, `property-types`, `crime`, `flood-risk`, `council-tax`.
-
-`property-data-address-match-uprn` and `property-data-planning-applications` are deliberately not called (CRM hygiene and dev-precedent reports, respectively).
-
-The three EPC certificate fields the page-2 KPI strip needs — `total_floor_area_m2`, `current_energy_rating`, `lodgement_date` — are pasted by the operator into `subject` in `inputs.json` before invocation. There is no MCP fan-out for EPC; the PreToolUse hook and `render.py` both abort with `epc-certificate-not-supplied` if any of the three fields is null.
-
-## Failure handling
-
-Every failure is fail-loud. The skill emits `[preval] aborted reason=<cause> …` and exits 2; no partial `index.html` or PDF is left on disk.
-
-- **PropertyData `key-not-registered`** → abort `reason=property-data-key-not-registered` with the `property-data-key-register` remediation hint.
-- **PropertyData `http-429`** → back off and retry the single throttled tool once. A second `http-429` aborts `reason=property-data-rate-limited`.
-- **PropertyData `http-5xx` / network failure** → abort `reason=property-data-unavailable`.
-- **Any of the 12 PropertyData log lines missing** within 60s of `[preval] start` → abort `reason=observability-missing tool=<name>`. A silent tool drop must never proceed to render.
-- **Subject EPC certificate field missing** — any of `subject.total_floor_area_m2`, `subject.current_energy_rating`, `subject.lodgement_date` is null → abort `reason=epc-certificate-not-supplied`. The operator pastes all three from the EPC certificate into `inputs.json` before re-invoking. There is no mid-run prompt and no MCP fallback.
-- See `skills/property-preval/SKILL.md` § Hard breakpoints for the full table of abort causes.
-
-## External dependencies
-
-- Requires `real-agent-property-data` enabled on the account with a registered PropertyData API key (`property-data-key-register`).
-- Requires the operator to paste the three EPC certificate fields (`total_floor_area_m2`, `current_energy_rating`, `lodgement_date`) into `subject` in `inputs.json` before invocation. There is no automated EPC lookup.
-- Requires Google Chrome at `/Applications/Google Chrome.app/Contents/MacOS/Google Chrome` for headless `--print-to-pdf`. Same Chrome dependency as `property-market-report`.
-
-## Hooks
-
-- `hooks/preval-prompt-required.sh` — PreToolUse gate on `Write|Edit|MultiEdit` of `**/preval/**/inputs.json`. Blocks (exit 2) before the file lands on disk if any of `epc-certificate-not-supplied`, `agent-listings-invented`, `market-summary-invented`, or `brand-invented` applies. The same five causes (plus `cover-hero-not-subject`) are re-checked by `render.py`'s `_assert_inputs` gate — defence in depth against silent fallback completions. Paths outside `preval/inputs.json` pass through.

package/payload/platform/plugins/preval/hooks/preval-prompt-required.sh

@@ -1,140 +0,0 @@
-#!/usr/bin/env bash
-# PreToolUse hook — defence-in-depth gate for property-preval's inputs.json.
-#
-# Fires on Write/Edit when the target path ends in `/preval/.../inputs.json`.
-# Blocks (exit 2) before the payload reaches disk if any of the five named
-# adherence violations is present. The render.py validator catches the same
-# violations downstream — this hook stops the bad payload one step earlier,
-# while the agent still has the opportunity to prompt the operator.
-#
-# Aborts named here mirror the AdherenceError causes raised by render.py:
-#   - epc-certificate-not-supplied
-#   - agent-listings-invented
-#   - market-summary-invented
-#   - brand-invented
-#
-# (cover-hero-not-subject is checked by render.py only — the slug heuristic
-# needs the on-disk path to be inspectable, which isn't reliable from the
-# tool args alone.)
-#
-# Error philosophy: fail closed on the four named contract violations; fail
-# open on anything else (missing python3, malformed stdin, file not under
-# preval/). Failing open lets unrelated tool calls proceed; the named
-# violations are the only ones the hook owns.
-
-set -u
-
-if [ -t 0 ]; then
-  exit 0
-fi
-
-if ! command -v python3 >/dev/null 2>&1; then
-  cat >/dev/null
-  echo "[preval-prompt-required] action=fail reason=python3-missing" >&2
-  exit 0
-fi
-
-INPUT=$(cat)
-
-INPUT="$INPUT" python3 <<'PY'
-import json, os, sys
-
-INPUT = os.environ.get("INPUT", "")
-
-def passthrough(reason):
-    print(f"[preval-prompt-required] action=passthrough reason={reason}", file=sys.stderr)
-    sys.exit(0)
-
-def block(cause, remediation):
-    print(f"[preval-prompt-required] action=block cause={cause}", file=sys.stderr)
-    print(f"[preval] {cause}: {remediation}", file=sys.stderr)
-    sys.exit(2)
-
-try:
-    payload = json.loads(INPUT) if INPUT else {}
-except Exception:
-    passthrough("malformed-stdin")
-
-tool_name = payload.get("tool_name") or ""
-if tool_name not in ("Write", "Edit", "MultiEdit"):
-    passthrough(f"tool={tool_name}")
-
-tool_input = payload.get("tool_input") or {}
-file_path = tool_input.get("file_path") or ""
-norm = file_path.replace("\\", "/").lower()
-if "/preval/" not in norm or not norm.endswith("/inputs.json"):
-    passthrough("path-not-preval-inputs")
-
-if tool_name == "Write":
-    content = tool_input.get("content") or ""
-elif tool_name == "Edit":
-    content = tool_input.get("new_string") or ""
-else:  # MultiEdit
-    edits = tool_input.get("edits") or []
-    content = edits[-1].get("new_string", "") if edits else ""
-
-try:
-    data = json.loads(content)
-except Exception:
-    passthrough("content-not-json")
-
-if not isinstance(data, dict):
-    passthrough("content-not-object")
-
-overrides = data.get("agent_overrides") or {}
-
-subject = data.get("subject") or {}
-missing_epc = [
-    f for f in ("total_floor_area_m2", "current_energy_rating", "lodgement_date")
-    if not subject.get(f)
-]
-if missing_epc:
-    block(
-        "epc-certificate-not-supplied",
-        f"subject is missing EPC certificate field(s) {missing_epc}. "
-        "Paste total_floor_area_m2, current_energy_rating, and lodgement_date "
-        "from the EPC certificate into subject before re-invoking. "
-        "No mid-run prompt — the operator supplies the certificate before invocation.",
-    )
-
-if not overrides.get("listings_status_curated"):
-    for listing in data.get("agent_listings") or []:
-        origin = (listing or {}).get("origin")
-        if not origin or origin == "operator":
-            continue
-        try:
-            src_path = os.path.expanduser(str(origin))
-            if not os.path.isfile(src_path):
-                continue
-            with open(src_path) as f:
-                source = json.load(f)
-        except Exception:
-            continue
-        if source.get("status") in (None, "") and listing.get("status"):
-            block(
-                "agent-listings-invented",
-                f"agent_listings entry {listing.get('slug')} has status "
-                f"'{listing['status']}' but source {src_path} carries status:null. "
-                "Prompt the operator and set agent_overrides.listings_status_curated: true.",
-            )
-
-ms = data.get("market_summary") or {}
-if ms.get("origin") not in ("operator", "operator-edited-llm-stub"):
-    block(
-        "market-summary-invented",
-        "market_summary.origin must be 'operator' or 'operator-edited-llm-stub'. "
-        "Have the operator draft or accept the paragraphs before writing inputs.json.",
-    )
-
-brand = data.get("brand") or {}
-if brand.get("name") and not overrides.get("brand_selected_by_operator"):
-    block(
-        "brand-invented",
-        f"brand.name ('{brand['name']}') was set without "
-        "agent_overrides.brand_selected_by_operator: true. Ask the operator which "
-        "estate agent is pitching; presence of a DESIGN.md on disk does not authorise selection.",
-    )
-
-print("[preval-prompt-required] action=allow", file=sys.stderr)
-sys.exit(0)
-PY

package/payload/platform/plugins/preval/skills/property-preval/SKILL.md

@@ -1,176 +0,0 @@
----
-name: property-preval
-description: Use when an operator wants a pre-valuation pack to pitch for a UK property listing — a 5-page A4 PDF that combines a market-data report for the postcode with the subject property's own valuation range, full-width sold + asking comparables, and the agent's recent successes as the sales close. Triggers include "preval <address>", "pre-valuation for <address>", "valuation pitch for <address>", "what's <address> worth and pitch us to list it", "pre-appraisal pack for <address>".
----
-
-# Property Preval
-
-A 5-page A4 PDF that pitches the agent for the listing: cover (full-bleed subject hero), subject valuation (sqft × £/sqft band with operator adjustments), market context, full-width comparables (sold + asking stacked), and the agent's recent successes + disclaimer. **Preval is a sales pitch, not just a data sheet** — every page either tells the vendor what the property is worth or what the agent has recently delivered nearby.
-
-## Typography is fixed; only colours and logos come from the agent
-
-Same typographic lock as `property-market-report`:
-
-- **Display** — Cormorant Garamond (italic for headlines, KPI values, prices, addresses)
-- **Body** — Lora
-- **Sans / labels** — Inter (eyebrows, KPI labels, chips, footer meta)
-
-Never substitute the agent's body or display fonts even if their `DESIGN.md` specifies different families. The pack reads as an editorial / luxury document across every brand. The agent's identity comes through the **palette and logo only**.
-
-## Inputs (never invented)
-
-- **`address`** — full UK address ending in a valid postcode (e.g. `9 Phoenix Drive, Bishop's Stortford, CM23 2UJ`). Skill derives the postcode by matching the UK postcode regex on the final token group; stops if no match.
-- **`brand`** — agent design tokens, same shape as property-market-report: `name`, `tagline`, hex tokens `primary` / `primary_dark` / `accent` / `paper` / `paper_banded` / `rule`. Optional `logo_light` / `logo_dark` filesystem paths. Resolved from the agent's `DESIGN.md` (e.g. `/estate-agents/muvin/DESIGN.md`); read the canonical hex values directly, never substitute "close" colours. Only colour tokens are consumed; typography/spacing/radius tokens in the agent's `DESIGN.md` are ignored by design.
-- **`subject`** — paste-in details about the property being valued:
-  - `cover_hero` (filesystem path or URL to a photo of the subject — required for the cover).
-  - Optional `beds`, `type`, `tenure`, `condition` (well / average / needs work).
-  - `adjustments[]` — operator-curated array of `{label, delta_pct}` covering esoteric factors that shift the headline range (e.g. `{"label":"South-facing garden","delta_pct":3}`, `{"label":"Needs full reno","delta_pct":-8}`). Deltas sum linearly into the final range.
-  - `narrative` — one short paragraph the operator writes about the property.
-  - **EPC certificate fields are pasted by the operator before invocation.** The three required fields are `subject.total_floor_area_m2`, `subject.current_energy_rating`, and `subject.lodgement_date` — copied verbatim from the EPC certificate. The renderer derives `sqft` from `total_floor_area_m2 × 10.7639`. There is no mid-run paste prompt and no benchmark-only render — a null in any of the three aborts the run with `reason=epc-certificate-not-supplied`.
-- **`agent_listings`** — the agent's recent sold / under-offer / live listings to feature on the closing page. Up to 6 entries of `{url, address, price, beds, type, image, status, slug}` where `status ∈ {"Sold","Under offer","For sale"}`. Operator picks the comps that make the strongest pitch; this is *not* the PropertyData sample.
-- **`market_summary`** — `headline` (one display-italic line), `paragraphs[]` (2–3 short paragraphs), `demand_gauge_position` (percentage string like `"62%"`), `price_growth_note`, `demand_note`. The operator drafts or accepts an LLM stub.
-
-## Tools the skill calls
-
-Parallel fan-out keyed on the derived postcode + the subject address:
-
-**PropertyData (12 calls — credit cost 12):**
-1. `property-data-prices` — asking £ distribution + raw asking comps.
-2. `property-data-prices-per-sqf` — asking £/sqft.
-3. `property-data-sold-prices` — Land Registry sold transactions + raw sold comps.
-4. `property-data-sold-prices-per-sqf` — achieved £/sqft (plus 70pc band used for the valuation range).
-5. `property-data-growth` — 7y price series.
-6. `property-data-growth-psf` — 7y £/sqft series.
-7. `property-data-demand` — for-sale, sales/mo, turnover, MoI, DoM, demand rating.
-8. `property-data-demand-rent` — rental-side demand pillar.
-9. `property-data-property-types` — mix (detached / semi / terraced / flat).
-10. `property-data-crime` — area crime rating + breakdown.
-11. `property-data-flood-risk` — area flood risk (full postcode only).
-12. `property-data-council-tax` — band D + per-property bands (full postcode only).
-
-EPC certificate fields are operator paste-in — see `subject.total_floor_area_m2`, `subject.current_energy_rating`, `subject.lodgement_date` in the Inputs section. There is no EPC MCP fan-out.
-
-`address-match-uprn` and `planning-applications` are deliberately omitted (CRM hygiene and dev-precedent reports respectively).
-
-## Output
-
-Directory under `~/Documents/Maxy/preval/<postcode-compact>-<YYYY-MM-DD>/` containing:
-
-- `index.html` — single self-contained file.
-- `img/` — copied logos and the subject hero image.
-- `<slug>-<date>.pdf` — exactly **5** A4 pages. Renderer asserts via `pdfinfo` and raises if ≠ 5.
-
-Return the PDF path to the operator.
-
-## Pages
-
-1. **Cover** — full-bleed `subject.cover_hero` with vertical gradient scrim; light logo top-left; eyebrow "`<brand.name>` · Pre-valuation"; address in display-italic; postcode chip; four-up meta strip (Report · Address · Postcode · Generated). Lifted from property-market-report's cover contract.
-2. **Subject valuation** — KPI strip (sqft, beds, EPC rating, type). Centre panel: headline range = `sqft × sold_psf_low–high` (Land Registry 70pc band) with `sqft × asking_psf` shown as a cross-check. Operator `adjustments[]` displayed as a stacked list (label · delta% · running £). Final range pill at the foot. One paragraph of `subject.narrative` under the panel. `sqft` is required — a null value aborts the run, never renders a benchmark-only panel.
-3. **Market context** — KPI cube (avg asking, avg sold, £/sqft, YoY); pill + gauge for demand; 7y growth sparkline (£ solid + £/sqft dashed); summary paragraphs. Same patterns as property-market-report's page 2.
-4. **Comparables (full-width, stacked)** — Nearest sold table (top 6) full-width across the page; Live asking tile grid (top 4) full-width below. Vertically stacked, never side-by-side — corrects the cramped two-column layout in the v1 preval where the asking tiles got pushed to ~40mm columns of italic addresses.
-5. **Recently with `<brand.name>` + sources** — agent's own listings as a clickable tile grid (`<a>` per card, status badge: Sold / Under offer / For sale), then the sources / methodology / accuracy / investment block. Closes with `Real Agent · Generated <date> · <postcode>` in the footer.
-
-## How to execute
-
-1. Match the postcode out of the address (`/[A-Z]{1,2}[0-9][A-Z0-9]?\s?[0-9][A-Z]{2}/i`). Stop if no match.
-2. Run the 12 PropertyData fan-out tools in parallel. Every failure is fail-loud — no mid-run paste prompts, no benchmark-only render, no degraded pack on disk:
-   - **PropertyData `key-not-registered`** → abort `reason=property-data-key-not-registered` with the `property-data-key-register` remediation hint.
-   - **PropertyData `http-429`** → back off and retry the single throttled tool **once**. A second `http-429` aborts `reason=property-data-rate-limited`.
-   - **PropertyData `http-5xx` / network failure** → abort `reason=property-data-unavailable`.
-   - **Watchdog: any of the 12 PropertyData log lines missing** within 60 s of `[preval] start` → `render.py` aborts `reason=observability-missing tool=<name>` naming the silent tool. A silent tool drop must never proceed to render.
-3. Compute valuation range:
-   - `sqft = round(subject.total_floor_area_m2 × 10.7639)` (operator-pasted m² × the standard conversion factor).
-   - `sold_psf_low` = `sold-prices-per-sqf` `70pc_range[0]`
-   - `sold_psf_high` = `sold-prices-per-sqf` `70pc_range[1]`
-   - `low = sqft × sold_psf_low`, `mid = sqft × sold_psf`, `high = sqft × sold_psf_high`
-   - Apply `adjustments` linearly: `factor = 1 + Σ delta_pct / 100`. Final range = `[low × factor, high × factor]`, midpoint = `mid × factor`.
-4. Assemble the `inputs.json` shape per `references/template-inputs.schema.json`.
-5. `python3 references/render.py inputs.json`. Renderer fills the template, copies logos + hero into `img/`, drives Chrome `--print-to-pdf`, asserts page count == 5.
-6. Return the PDF path.
-
-## Adjustments — linear vs compound
-
-Deltas sum linearly (`-8 + 3 = -5%`, applied as `× 0.95`). Compound interpretation (`× 0.92 × 1.03`) would give a slightly different number (-5.24%) but the operator presents the figures verbally as a sum, so the displayed maths must match the verbal claim. If a future operator wants compound adjustments, this is a deliberate skill-level rewrite, not a config switch.
-
-## Observability
-
-- `[preval] start address="<addr>" postcode=<pc>` at run start.
-- `[preval] done pdf=<path> pages=<n> ms=<n>` at run end.
-- `[preval] aborted reason=<cause> address="<addr>" postcode=<pc> ms=<n>` on any abort (one line, then exit 2; no `done`).
-- Each fan-out call emits its own `[property-data] tool=<name>` line in `server.log` (inherited contract; no new instrumentation here). `render.py`'s observability watchdog tails these lines and aborts with `observability-missing tool=<name>` if any of the 12 expected names is absent 60 s after `[preval] start`.
-
-## Hard breakpoints
-
-Each row aborts the run with the named cause. No PDF or `index.html` is left on disk. Operator sees a single-line cause + one-line remediation hint, nothing else.
-
-| Forbidden state | `reason=` cause |
-|---|---|
-| `subject.total_floor_area_m2` / `current_energy_rating` / `lodgement_date` null or missing | `epc-certificate-not-supplied` (operator pastes the three fields from the EPC certificate before re-invoking) |
-| `subject.cover_hero` missing, unreachable, below 1200×800, or symlinked into another property's folder | `subject-cover-hero-missing` / `subject-cover-hero-unreadable` / `subject-cover-hero-too-small` / `subject-cover-hero-symlinked-foreign` |
-| `brand` not resolved from an on-disk `DESIGN.md` (required token missing) | `brand-unresolved` |
-| `agent_listings` empty | `agent-listings-empty` |
-| `market_summary.paragraphs` < 2 entries | `market-summary-too-thin` |
-| PropertyData any-call `http-429` after 1 retry | `property-data-rate-limited` |
-| PropertyData any-call `key-not-registered` | `property-data-key-not-registered` (operator runs `property-data-key-register`) |
-| Any of the 12 PropertyData log lines missing 60 s after `[preval] start` | `observability-missing tool=<name>` (the silent tool is named in the abort hint) |
-
-## Forbidden behaviours
-
-The skill is the contract; if any of these slip through, the pack must not render:
-
-- Silent fallback selection — switching to a benchmark-only / "Estimate requires floor area" panel when an input is missing.
-- Inventing inputs — fabricating `brand`, `subject.cover_hero`, `market_summary.paragraphs`, `agent_listings`, or any field the operator did not supply.
-- Reusing a hero photo from a different property as a placeholder.
-- Defaulting `agent_listings[].status` to `"For sale"` when the source is null.
-- Mid-run prompts for a paste-in. The three EPC certificate fields and every other operator-supplied input are pasted into `inputs.json` **before** invocation; there is no retry / paste-and-resume path.
-- Omitting the `[preval]` start / done / aborted log emissions.
-- Leaving partial output (`index.html`, `<stem>.pdf`) on disk after an abort.
-
-## Failure diagnostics
-
-- `pages=6` (or ≠ 5) in the `done` line → template overflow on one page. Diagnose with `pdftoppm -png -f <n> -l <n> <pdf>`, then trim that panel's padding only.
-- `start` with no matching `done` or `aborted` within 60s → renderer crashed mid-run. Inspect with `grep -B2 -A20 '\[preval\] start address="<echoed>"' server.log`.
-- `[preval] aborted reason=<cause>` → look up `<cause>` in the **Hard breakpoints** table for the remediation hint.
-
-## Adherence — non-negotiable
-
-These rules override every session-level "skip clarifying questions", "make the reasonable call", or "work without stopping" directive the operator has set. The named breakpoints below are documented contract points, not casual asks — the renderer and the PreToolUse hook both enforce them and a run that violates one aborts with a named cause.
-
-- **Prompt at named breakpoints — no exceptions.** Named breakpoints: EPC certificate fields not supplied, cover_hero not depicting the subject, brand identity (which estate agent is pitching), `agent_listings` empty or carrying invented statuses, `market_summary` not operator-supplied. The load-bearing inputs themselves (EPC certificate fields, cover_hero, brand tokens, two paragraphs) are gated by `render.py`'s `_assert_inputs`; this section layers provenance on top.
-- **Never invent inputs.** Brand identity, brand tokens, cover hero, narrative, market summary paragraphs, agent listings, listing statuses, subject tenure / beds / type / condition — all operator-supplied. Defaulting from "area pattern", a sister property's photo, "the only DESIGN.md I found on disk", "the LLM stub I drafted myself", or "status:null in the source so I picked For sale" is invention. The presence of a single `~/estate-agents/<slug>/DESIGN.md` on disk does not authorise its selection — only an operator instruction does. If more than one `~/estate-agents/<slug>/` exists and the operator has not named which one is pitching, abort.
-- **`agent_overrides` is the only bypass channel.** Every override the operator authorises lands in `inputs.json` as a named boolean (`brand_selected_by_operator`, `listings_status_curated`) so the audit trail sits next to the disputed value. Setting an override without a real operator instruction is a violation of the same contract.
-- **Emit the three `[preval]` log lines — every run.** `[preval] start address="…" postcode=…`, then `[preval] done pdf=… pages=… ms=…` on success or `[preval] aborted reason=<cause> ms=…` on any abort. A run that emits neither `done` nor `aborted` is itself a defect.
-
-### Named abort causes
-
-| Cause | Trigger | Operator remediation |
-|---|---|---|
-| `cover-hero-not-subject` | `subject.cover_hero` resolves to a `*/properties/*/` directory whose slug doesn't contain the subject's primary street token | Supply the subject's own photo |
-| `agent-listings-invented` | An `agent_listings[].status` is set when the source `property.json` (named by `agent_listings[].origin`) carries `status: null`, and `agent_overrides.listings_status_curated` is not `true` | Operator signs off on each listing status, then sets the override |
-| `market-summary-invented` | `market_summary.origin` is missing or not in `{"operator", "operator-edited-llm-stub"}` | Operator drafts or accepts the paragraphs; set `origin` accordingly |
-| `brand-invented` | `brand.name` is set without `agent_overrides.brand_selected_by_operator: true` | Operator names which estate agent is pitching; set the override |
-| `epc-certificate-not-supplied` | Any of `subject.total_floor_area_m2`, `subject.current_energy_rating`, or `subject.lodgement_date` is null or missing | Operator copies the three fields verbatim from the EPC certificate into `subject` in `inputs.json` before re-invoking |
-| `observability-missing tool=<name>` | One of the 12 expected `[property-data] tool=<name>` log lines did not appear within 60 s of `[preval] start` | Re-invoke and confirm every PropertyData tool returns; if a tool is genuinely down, surface a `property-data-*` cause first |
-| `log-destination-unavailable` | Neither `~/.maxy/logs/server.log` nor `<out_dir>/preval.log` is writable | Fix filesystem permissions before re-running |
-
-## Self-check before declaring done
-
-Answer all seven inline at the end of every run, with line references from `server.log` or `<out_dir>/preval.log` — not paraphrase:
-
-1. `[preval] start` emitted? (cite the log line)
-2. All 12 expected `[property-data] tool=<name>` log lines present, or `[preval] aborted` emitted with a named cause? (cite the lines)
-3. EPC certificate fields (`subject.total_floor_area_m2`, `subject.current_energy_rating`, `subject.lodgement_date`) all populated from the operator paste? (cite the `inputs.json` excerpt)
-4. Every input field traceable to a real source — operator paste (including the EPC certificate), on-disk `DESIGN.md`, MCP response? Anything sourced from "area pattern", a sister property file, or LLM imagination is a defect.
-5. `[preval] done pages=5` emitted? (cite the log line)
-6. PDF page count = 5 asserted? (cite the assertion result)
-7. No fields invented from area pattern, sister-property files, or LLM imagination? List the three most fabrication-prone fields (`brand.name`, `market_summary.paragraphs`, `agent_listings[].status`) and the source for each in this run.
-
-## Out of scope
-
-- Multi-address batch preval (CSV in → many PDFs out).
-- Loop CRM auto-publish of the PDF onto a contact's record.
-- Pulling `agent_listings` from Loop CRM automatically — operator paste-in for now; CRM wire-up is a separate task.
-- Caching of MCP responses (12 credits per pack is acceptable).
-- A separate cover letter / pitch letter — the cover page *is* the pitch.
-- Compound adjustments (linear sum is the contract; see above).
-- Subject EPC fields from sources other than the operator paste-in (e.g. Loop CRM floor plans, Rightmove sqft scrape, restored EPC API) — separate task if pursued.