@rubytech/create-maxy-code 0.1.83 → 0.1.85

package/payload/platform/plugins/admin/hooks/__tests__/turn-completed-graph-write.test.sh

@@ -1,7 +1,15 @@
 #!/usr/bin/env bash
-# Task 129/131/165/175/177/195 regression test for the Stop hook.
+# Task 129/131/165/175/177/195/214/216 regression test for the Stop hook.
 #
-# Contract (post-195):
+# Dormant since Task 214 — the Stop-hook registration was removed from
+# account `settings.json`; the script + this test remain as preserved
+# infrastructure (see PLUGIN.md). When the script does run (e.g. via this
+# test invoking it directly), the post-Task-214 `database-operator.md`
+# template carries no `{schema}` / `{conversation}` / `{accountId}`
+# placeholders, so the substitution layer is a no-op pass-through and
+# `initialMessage` is the literal post-frontmatter body of the agent file.
+#
+# Contract (post-214):
 #   - Every log emission goes through `POST /api/admin/log-ingest`. Hook
 #     stderr is silent on every path.
 #   - Every gated-off path emits one `trigger-skipped` line carrying a
@@ -11,18 +19,15 @@
 #     `conversationBytes=<n>` and exactly ONE POST to
 #     `/api/admin/claude-sessions`. The body carries the operator
 #     session id as `adminSessionId` and an `initialMessage` whose value
-#     is the FILLED database-operator paragraph — the four-sentence
-#     template with `{schema}` replaced by `schema-base.md` (plus the
-#     brand-declared vertical when set) and `{conversation}` replaced by
-#     a flat `role: text` rendering of the envelope's `turns` array.
-#     Task 213 strips the prior `[tool: name(args)]` markers — they
-#     taught the recorder to copy the shape into prose. The initialMessage
-#     is a plain string, not a JSON-stringified envelope; no instruction
-#     prose, no leading JSON.
-#   - The hook emits exactly one `[turn-recorder] envelope ...` line and
-#     one `[turn-recorder] substitution ...` line before `spawn-request`.
-#     The substitution line carries `schemaBytes`, `conversationBytes`,
-#     and `bodyBytes` so the per-spawn substitution is auditable.
+#     is the literal database-operator agent body (post-frontmatter).
+#     No placeholders are substituted because the post-Task-214 template
+#     has none. The walker still parses the JSONL, still emits the
+#     `envelope … turnsCount=N userTurns=U assistantTurns=A toolCallTurns=T`
+#     log line, and the schema file is still read and reported in the
+#     `substitution … schemaBytes=N` line — but neither the transcript
+#     nor the schema content reaches `initialMessage`.
+#   - The hook emits exactly one envelope line and one substitution line
+#     before `spawn-request`.
 #   - The hook never writes the legacy `spawn-with-input` / `fired` stderr
 #     lines.
 #
@@ -223,12 +228,14 @@ else
   fail "case-5b expected exactly 1 recorder-spawn POST, got $RECORDER_LINES"
 fi
 
-# 5c. (Task 195) initialMessage is the FILLED four-sentence paragraph.
-#     The template's `{schema}` is replaced by schema-base.md content;
-#     `{conversation}` is replaced by `role: text` lines for every turn.
-#     The string is plain text, not a JSON envelope. The template's
-#     opening sentence and closing sentence are present verbatim; the
-#     four operator/assistant texts each appear on their own line.
+# 5c. (Task 216) initialMessage is the literal post-frontmatter body of
+#     `database-operator.md`. Task 214 stripped the `{schema}` /
+#     `{conversation}` / `{accountId}` placeholders from the template,
+#     so the substitution layer in the hook is now a no-op pass-through
+#     and the agent body lands in `initialMessage` verbatim. Assertions
+#     are property-based — they guard the regression class (substitution
+#     layer reintroduced, transcript leak, schema content leak, outer
+#     spawn-body drift) without coupling to the prompt's exact wording.
 RECORDER_BODY=$(grep -E '^/api/admin/claude-sessions	' "$REQ_LOG" | head -1 | cut -f2-)
 BODY_OK=$(printf '%s' "$RECORDER_BODY" | python3 -c '
 import sys, json
@@ -241,35 +248,43 @@ try:
     print("no:initialMessage-not-string:"+repr(type(msg).__name__))
     sys.exit(0)
   conds = []
+  # Template-header anchor — the post-Task-214 body opens with this
+  # sentence. A different opener means the agent file was renamed,
+  # rewritten, or its frontmatter parse drifted.
   conds.append(("starts-with-template",
                 msg.startswith("You are an expert Neo4J graph operator.")))
-  conds.append(("ends-with-template",
-                msg.rstrip().endswith("do not emit it.")))
+  # Placeholder-reintroduction guards. If any of these reappear, Task
+  # 214 was reverted without updating the template.
   conds.append(("no-placeholder-schema", "{schema}" not in msg))
   conds.append(("no-placeholder-conversation", "{conversation}" not in msg))
   conds.append(("no-placeholder-accountid", "{accountId}" not in msg))
-  # schema-base.md content is interpolated.
-  conds.append(("contains-schema-base-header", "Schema Reference" in msg))
-  # Task 199 — accountId clarifier sentence + literal value rendered.
-  conds.append(("has-accountid-clarifier",
-                "accountId" in msg and "automatically supplied" in msg))
-  conds.append(("has-accountid-value",
-                "The current accountId is `" + acct + "`." in msg))
-  # The conversation lines appear in role: text format.
-  conds.append(("has-user-1", "\nuser: New Real Agent session" in msg))
-  conds.append(("has-asst-1",
-                "\nassistant: Session noted. What would you like to work on?" in msg))
-  conds.append(("has-user-2", "\nuser: you tell me" in msg))
-  conds.append(("has-asst-2",
-                "\nassistant: One question to anchor the next move: what is your name?"
-                in msg))
+  # Transcript-leak guard. The walker still parses the JSONL, but its
+  # `turns` array no longer reaches `initialMessage`. Any `\nuser: ` or
+  # `\nassistant: ` line means substitution crept back in.
+  conds.append(("no-transcript-user", "\nuser: " not in msg))
+  conds.append(("no-transcript-asst", "\nassistant: " not in msg))
+  # Schema-leak guard. schema-base.md is still read (and its bytes are
+  # reported in the substitution log line), but its content is no
+  # longer substituted into the body. `Schema Reference` is the
+  # opening header of `platform/plugins/memory/references/schema-base.md`
+  # (`# Schema Reference — Base`); its appearance in the body means
+  # `{schema}` re-entered the template.
+  conds.append(("no-schema-content", "Schema Reference" not in msg))
+  # AccountId-value leak guard. If `{accountId}` is re-added in
+  # isolation (no `{schema}` / `{conversation}` reintroduction), the
+  # placeholder guards above pass (because substitution replaces the
+  # token cleanly), but the operator accountId still leaks into the
+  # prompt. The test fixture passes ACCOUNT_ID="$ACCT_ID" into the
+  # hook env, so the literal acct id must NOT appear anywhere in the
+  # body.
+  conds.append(("no-accountid-value-leak", acct not in msg))
+  # Pre-Task-177 envelope-shape guard. `initialMessage` is a plain
+  # string, never a JSON envelope.
   conds.append(("no-leading-json", not msg.lstrip().startswith("{")))
   conds.append(("no-operatorMessage", "operatorMessage" not in msg))
   conds.append(("no-assistantReply", "assistantReply" not in msg))
+  # Spawn-body outer-shape sanity (unchanged from Task 195/200).
   conds.append(("outer-specialist", outer.get("specialist") == "database-operator"))
-  # Task 200 — model field is omitted from the spawn body so the
-  # database-operator agent frontmatter (claude-sonnet-4-6) is the
-  # runtime model. The hard-coded haiku override has been removed.
   conds.append(("outer-no-model-key", "model" not in outer))
   conds.append(("outer-adminSessionId", outer.get("adminSessionId") == op))
   conds.append(("outer-channel", outer.get("channel") == "browser"))
@@ -279,9 +294,9 @@ except Exception as e:
   print("parse-fail:"+str(e))
 ' "$OP_ID" "$ACCT_ID" 2>/dev/null)
 if [[ "$BODY_OK" == "yes" ]]; then
-  pass "case-5c initialMessage is the filled paragraph; schema/accountId/conversation placeholders substituted; accountId value rendered; transcript as role: text lines"
+  pass "case-5c initialMessage is the literal template body (no placeholders, no transcript leak, no schema leak); outer spawn shape intact"
 else
-  fail "case-5c filled-prompt shape wrong ($BODY_OK)"
+  fail "case-5c literal-body shape wrong ($BODY_OK)"
 fi
 
 # 5h. (Task 195 + 199) exactly one `substitution` log-ingest line carrying
@@ -354,17 +369,27 @@ else
   pass "case-5g no legacy stderr emissions"
 fi
 
-# --- Case 6 (Task 195): multi-block assistant collapse ----------------
-# Two assistant records sharing `message.id`: thinking-only then text.
-# The walker collapses both into ONE assistant turn whose text is the
-# text-record's text. The filled prompt's conversation portion has
-# exactly two transcript lines: `user: think then answer` and
-# `assistant: answer is 42`.
+# --- Case 6: multi-block assistant collapse (walker coverage) ---------
+# Two assistant records sharing `message.id`, BOTH carrying text. The
+# walker's collapse branch (turn-completed-graph-write.sh, the
+# `msg_id in msg_id_to_turn_index` branch in the assistant arm) merges
+# them into ONE assistant turn whose text is the concatenation. Without
+# the collapse the walker would emit two assistant turns. Pre-Task-214
+# this was visible in `initialMessage` via a single `\nassistant: ...`
+# line carrying both fragments; post-Task-214 the transcript no longer
+# reaches the body, so coverage moves to the envelope log line —
+# `turnsCount=2 userTurns=1 assistantTurns=1 toolCallTurns=0` proves
+# the two assistant records collapsed to one (otherwise the line would
+# read assistantTurns=2). Fixture must use TEXT-bearing records on both
+# sides; a thinking-only first record would be skipped at line 202 of
+# the walker before the collapse branch ever runs, so the test would
+# only prove the skip path (already covered by case 9) instead of the
+# collapse path.
 MULTI_TRANSCRIPT=$(mktemp); TMPFILES+=("$MULTI_TRANSCRIPT")
 {
-  printf '{"type":"user","timestamp":"2026-05-19T21:30:00.000Z","message":{"role":"user","content":"think then answer"}}\n'
-  printf '{"type":"assistant","timestamp":"2026-05-19T21:30:01.000Z","message":{"id":"msg_multi","role":"assistant","content":[{"type":"thinking","thinking":"considering..."}]}}\n'
-  printf '{"type":"assistant","timestamp":"2026-05-19T21:30:02.000Z","message":{"id":"msg_multi","role":"assistant","content":[{"type":"text","text":"answer is 42"}]}}\n'
+  printf '{"type":"user","timestamp":"2026-05-19T21:30:00.000Z","message":{"role":"user","content":"split your answer"}}\n'
+  printf '{"type":"assistant","timestamp":"2026-05-19T21:30:01.000Z","message":{"id":"msg_multi","role":"assistant","content":[{"type":"text","text":"part one"}]}}\n'
+  printf '{"type":"assistant","timestamp":"2026-05-19T21:30:02.000Z","message":{"id":"msg_multi","role":"assistant","content":[{"type":"text","text":" and part two"}]}}\n'
 } > "$MULTI_TRANSCRIPT"
 MULTI_ENVELOPE=$(python3 -c '
 import json, sys
@@ -373,46 +398,24 @@ print(json.dumps({"session_id": sys.argv[1], "transcript_path": sys.argv[2]}))
 : > "$REQ_LOG"
 run_hook "admin" "" "$MULTI_ENVELOPE"
 [[ "$HOOK_RC" -eq 0 ]] || fail "case-6 rc=$HOOK_RC stderr=$HOOK_STDERR"
-MULTI_BODY=$(grep -E '^/api/admin/claude-sessions	' "$REQ_LOG" | head -1 | cut -f2-)
-MULTI_OK=$(printf '%s' "$MULTI_BODY" | python3 -c '
-import sys, json
-try:
-  outer = json.load(sys.stdin)
-  msg = outer.get("initialMessage")
-  if not isinstance(msg, str):
-    print("no:initialMessage-not-string")
-    sys.exit(0)
-  conds = []
-  # Filled-prompt sanity.
-  conds.append(("starts-template", msg.startswith("You are an expert Neo4J graph operator.")))
-  conds.append(("no-placeholder-conv", "{conversation}" not in msg))
-  # Conversation lines.
-  conds.append(("has-user", "\nuser: think then answer" in msg))
-  conds.append(("has-asst", "\nassistant: answer is 42" in msg))
-  # Thinking content does NOT bleed in.
-  conds.append(("no-thinking-text", "considering..." not in msg))
-  # Exactly two transcript lines (one per turn) — no duplicate assistant.
-  user_lines = msg.count("\nuser: ")
-  asst_lines = msg.count("\nassistant: ")
-  conds.append(("one-user-line", user_lines == 1))
-  conds.append(("one-asst-line", asst_lines == 1))
-  failed = [name for name, ok in conds if not ok]
-  print("yes" if not failed else "no:"+repr(failed))
-except Exception as e:
-  print("parse-fail:"+str(e))
-' 2>/dev/null)
-if [[ "$MULTI_OK" == "yes" ]]; then
-  pass "case-6 multi-block assistant collapses to one transcript line; thinking content does not bleed in"
+echo "case-6 SKIPPED — dormant since Task 214; transcript no longer substituted into initialMessage. Walker collapse now asserted via envelope log line below."
+ENV_LINE_6=$(ingest_lines | grep -cE "^envelope sessionId=${OP_ID} turnsCount=2 userTurns=1 assistantTurns=1 toolCallTurns=0$" || true)
+if [[ "$ENV_LINE_6" -eq 1 ]]; then
+  pass "case-6 envelope log line counts multi-block collapse: turnsCount=2 userTurns=1 assistantTurns=1 toolCallTurns=0"
 else
-  fail "case-6 multi-block collapse wrong ($MULTI_OK): $MULTI_BODY"
+  fail "case-6 expected 1 envelope line w/ turnsCount=2 userTurns=1 assistantTurns=1 toolCallTurns=0, got $ENV_LINE_6 (lines: $(ingest_lines))"
 fi
 
-# --- Case 7 (Task 177 + Task 213): tool-call pairing kept in envelope, -
-# stripped from the transcript. Assistant tool_use + user tool_result still
-# fold into one `toolCalls` entry on the assistant turn (envelope-level
-# observability via `[turn-recorder] envelope … toolCallTurns=N`). The
-# rendered transcript carries NO `[tool: …]` markers — pre-213 they taught
-# the recorder to emit `<tool_call>` as text.
+# --- Case 7: tool-call pairing (walker coverage) ----------------------
+# Assistant tool_use + user tool_result fold into one `toolCalls` entry
+# on the assistant turn; the user-record carrying only the tool_result
+# never creates its own user turn. Pre-Task-214 this was visible in
+# `initialMessage` as "exactly one user line, two assistant lines (one
+# empty-bodied)". Post-Task-214 the transcript no longer reaches the
+# body, so the pairing is now only observable through the envelope log
+# line — `turnsCount=3 userTurns=1 assistantTurns=2 toolCallTurns=1`
+# proves the tool_result was absorbed (no extra user turn) and the
+# tool_use was paired on the owning assistant turn (toolCallTurns=1).
 TOOL_TRANSCRIPT=$(mktemp); TMPFILES+=("$TOOL_TRANSCRIPT")
 python3 - "$TOOL_TRANSCRIPT" <<'PY'
 import json, sys
@@ -439,54 +442,24 @@ print(json.dumps({"session_id": sys.argv[1], "transcript_path": sys.argv[2]}))
 : > "$REQ_LOG"
 run_hook "admin" "" "$TOOL_ENVELOPE"
 [[ "$HOOK_RC" -eq 0 ]] || fail "case-7 rc=$HOOK_RC stderr=$HOOK_STDERR"
-TOOL_BODY=$(grep -E '^/api/admin/claude-sessions	' "$REQ_LOG" | head -1 | cut -f2-)
-TOOL_OK=$(printf '%s' "$TOOL_BODY" | python3 -c '
-import sys, json
-try:
-  outer = json.load(sys.stdin)
-  msg = outer.get("initialMessage")
-  if not isinstance(msg, str):
-    print("no:initialMessage-not-string")
-    sys.exit(0)
-  conds = []
-  # The user turn carrying only a tool_result becomes no transcript line;
-  # so the filled prompt should have exactly ONE `user:` line.
-  conds.append(("one-user-line", msg.count("\nuser: ") == 1))
-  conds.append(("has-user-prompt", "\nuser: please write a node" in msg))
-  # Two assistant lines: one carrying the tool_use marker (with empty
-  # text body), one carrying "done".
-  conds.append(("two-asst-lines", msg.count("\nassistant: ") == 2))
-  conds.append(("has-asst-done", "\nassistant: done" in msg))
-  # Task 213 — no `[tool: …]` markup in the rendered transcript.
-  conds.append(("no-tool-marker", "[tool:" not in msg))
-  conds.append(("no-tool-input-leak", "Smalleys" not in msg))
-  # The owning assistant turn lands as an empty-bodied line: the tool_use
-  # block contributed no text, and the marker that used to fill it is gone.
-  conds.append(("has-empty-asst-line", "\nassistant: \n" in msg))
-  # The tool_result content does not bleed in either.
-  conds.append(("no-output-leakage", "ok: wrote LocalBusiness" not in msg))
-  failed = [name for name, ok in conds if not ok]
-  print("yes" if not failed else "no:"+repr(failed))
-except Exception as e:
-  print("parse-fail:"+str(e))
-' 2>/dev/null)
-if [[ "$TOOL_OK" == "yes" ]]; then
-  pass "case-7 assistant tool_use leaves no [tool: …] markup in transcript; tool_result does not create a separate user line; toolCallTurns count survives via envelope log"
-else
-  fail "case-7 tool pairing wrong ($TOOL_OK): $TOOL_BODY"
-fi
+echo "case-7 SKIPPED — dormant since Task 214; transcript no longer substituted into initialMessage. Tool-call pairing now asserted via envelope log line below."
 
 # Envelope log line for case-7: turnsCount=3, userTurns=1, assistantTurns=2, toolCallTurns=1
 ENV_LINE_7=$(ingest_lines | grep -cE "^envelope sessionId=${OP_ID} turnsCount=3 userTurns=1 assistantTurns=2 toolCallTurns=1$" || true)
 if [[ "$ENV_LINE_7" -eq 1 ]]; then
-  pass "case-7 envelope log line counts tool-call turn correctly"
+  pass "case-7 envelope log line counts tool-call turn correctly: turnsCount=3 userTurns=1 assistantTurns=2 toolCallTurns=1"
 else
   fail "case-7 expected envelope line w/ turnsCount=3 userTurns=1 assistantTurns=2 toolCallTurns=1, got $ENV_LINE_7 (lines: $(ingest_lines))"
 fi
 
-# --- Case 8 (Task 177): long-conversation 100 turns ------------------
-# Transcript with 100 turns (50 user + 50 assistant, interleaved) →
-# turns.length === 100. No drop, no truncation, no env-knob override.
+# --- Case 8: long-conversation 100 turns (walker coverage) -----------
+# Transcript with 100 turns (50 user + 50 assistant, interleaved).
+# Pre-Task-214 the body had to contain all 100 transcript lines and
+# exceed 5_000 bytes. Post-Task-214 the transcript no longer reaches
+# the body, so the "no windowing" invariant is asserted via the
+# envelope log line: `turnsCount=100 userTurns=50 assistantTurns=50
+# toolCallTurns=0`. A flat or shrinking turnsCount means windowing or
+# truncation crept back into the walker.
 LONG_TRANSCRIPT=$(mktemp); TMPFILES+=("$LONG_TRANSCRIPT")
 python3 - "$LONG_TRANSCRIPT" <<'PY'
 import json, sys
@@ -505,36 +478,12 @@ print(json.dumps({"session_id": sys.argv[1], "transcript_path": sys.argv[2]}))
 : > "$REQ_LOG"
 run_hook "admin" "" "$LONG_ENVELOPE"
 [[ "$HOOK_RC" -eq 0 ]] || fail "case-8 rc=$HOOK_RC stderr=$HOOK_STDERR"
-LONG_BODY=$(grep -E '^/api/admin/claude-sessions	' "$REQ_LOG" | head -1 | cut -f2-)
-LONG_OK=$(printf '%s' "$LONG_BODY" | python3 -c '
-import sys, json
-try:
-  outer = json.load(sys.stdin)
-  msg = outer.get("initialMessage")
-  if not isinstance(msg, str):
-    print("no:initialMessage-not-string")
-    sys.exit(0)
-  user_lines = msg.count("\nuser: ")
-  asst_lines = msg.count("\nassistant: ")
-  conds = []
-  # No windowing — every one of the 100 turns appears as a transcript line.
-  conds.append(("100-user", user_lines == 50))
-  conds.append(("100-asst", asst_lines == 50))
-  conds.append(("first-user-0", "\nuser: user msg 0" in msg))
-  conds.append(("last-user-49", "\nuser: user msg 49" in msg))
-  conds.append(("last-asst-49", "\nassistant: asst reply 49" in msg))
-  # The filled prompt is large — schema + 100 transcript lines easily
-  # exceeds 5_000 bytes even with a tiny schema.
-  conds.append(("body-large", len(msg.encode("utf-8")) > 5000))
-  failed = [name for name, ok in conds if not ok]
-  print("yes" if not failed else "no:"+repr(failed)+"|users="+str(user_lines)+"|assts="+str(asst_lines))
-except Exception as e:
-  print("parse-fail:"+str(e))
-' 2>/dev/null)
-if [[ "$LONG_OK" == "yes" ]]; then
-  pass "case-8 100-turn transcript → 50 user lines + 50 assistant lines in filled prompt; no truncation"
+echo "case-8 SKIPPED — dormant since Task 214; transcript no longer substituted into initialMessage. No-windowing invariant now asserted via envelope log line below."
+ENV_LINE_8=$(ingest_lines | grep -cE "^envelope sessionId=${OP_ID} turnsCount=100 userTurns=50 assistantTurns=50 toolCallTurns=0$" || true)
+if [[ "$ENV_LINE_8" -eq 1 ]]; then
+  pass "case-8 envelope log line counts 100-turn transcript: turnsCount=100 userTurns=50 assistantTurns=50 toolCallTurns=0 (no windowing)"
 else
-  fail "case-8 long-conversation wrong ($LONG_OK)"
+  fail "case-8 expected 1 envelope line w/ turnsCount=100 userTurns=50 assistantTurns=50 toolCallTurns=0, got $ENV_LINE_8 (lines: $(ingest_lines))"
 fi
 
 # --- Case 9 (Task 177): empty-skip ------------------------------------
@@ -563,9 +512,15 @@ else
   pass "case-9 no recorder-spawn POST"
 fi
 
-# --- Case 10 (Task 177): escaping round-trip --------------------------
-# Quotes, backslashes, newlines, non-ASCII all round-trip cleanly through
-# the JSON envelope's `turns[*].text` field.
+# --- Case 10: escaping round-trip (walker coverage) -------------------
+# User and assistant text with quotes / backslashes / em-dash / emoji.
+# Pre-Task-214 these had to survive interpolation into the body and
+# appear verbatim. Post-Task-214 the transcript no longer reaches the
+# body, but the walker still parses the JSONL — the envelope log line
+# `turnsCount=2 userTurns=1 assistantTurns=1 toolCallTurns=0` proves
+# the walker did NOT crash on the special-character text. A parser
+# regression would either drop a turn (zero counts) or fail the hook
+# (non-zero rc).
 ESC_TRANSCRIPT=$(mktemp); TMPFILES+=("$ESC_TRANSCRIPT")
 python3 - "$ESC_TRANSCRIPT" <<'PY'
 import json, sys
@@ -586,37 +541,12 @@ print(json.dumps({"session_id": sys.argv[1], "transcript_path": sys.argv[2]}))
 : > "$REQ_LOG"
 run_hook "admin" "" "$ESC_ENVELOPE"
 [[ "$HOOK_RC" -eq 0 ]] || fail "case-10 rc=$HOOK_RC stderr=$HOOK_STDERR"
-ESC_BODY=$(grep -E '^/api/admin/claude-sessions	' "$REQ_LOG" | head -1 | cut -f2-)
-ESC_OK=$(printf '%s' "$ESC_BODY" | python3 -c '
-import sys, json
-# The user turn text contains literal quotes, a backslash-n (two chars),
-# a real newline, an em-dash, and a fox emoji. The assistant text has
-# two backslashes and a real newline.
-EXPECTED_OP_FRAG_1 = "hello \"world\""
-EXPECTED_OP_FRAG_2 = "last — café \U0001F98A"
-EXPECTED_ASST_FRAG = "reply with backslash \\\\ and newline"
-try:
-  outer = json.load(sys.stdin)
-  msg = outer.get("initialMessage")
-  if not isinstance(msg, str):
-    print("no:initialMessage-not-string")
-    sys.exit(0)
-  conds = []
-  conds.append(("op-quotes", EXPECTED_OP_FRAG_1 in msg))
-  conds.append(("op-emoji", EXPECTED_OP_FRAG_2 in msg))
-  conds.append(("asst-backslash", EXPECTED_ASST_FRAG in msg))
-  conds.append(("user-prefix", "\nuser: " in msg))
-  conds.append(("asst-prefix", "\nassistant: " in msg))
-  conds.append(("template-intact", "You are an expert Neo4J graph operator." in msg))
-  failed = [name for name, ok in conds if not ok]
-  print("yes" if not failed else "no:"+repr(failed))
-except Exception as e:
-  print("parse-fail:"+str(e))
-' 2>/dev/null)
-if [[ "$ESC_OK" == "yes" ]]; then
-  pass "case-10 escaping: quotes / backslashes / em-dash / emoji survive interpolation into the filled prompt"
+echo "case-10 SKIPPED — dormant since Task 214; transcript no longer substituted into initialMessage. Walker-survives-special-chars now asserted via envelope log line below."
+ENV_LINE_10=$(ingest_lines | grep -cE "^envelope sessionId=${OP_ID} turnsCount=2 userTurns=1 assistantTurns=1 toolCallTurns=0$" || true)
+if [[ "$ENV_LINE_10" -eq 1 ]]; then
+  pass "case-10 envelope log line counts special-character transcript: turnsCount=2 userTurns=1 assistantTurns=1 toolCallTurns=0 (walker survived quotes/backslashes/em-dash/emoji)"
 else
-  fail "case-10 escaping wrong ($ESC_OK): $ESC_BODY"
+  fail "case-10 expected 1 envelope line w/ turnsCount=2 userTurns=1 assistantTurns=1 toolCallTurns=0, got $ENV_LINE_10 (lines: $(ingest_lines))"
 fi
 
 # --- Case 11 (Task 199): missing accountId → accountIdPresent=no, no crash ---
@@ -650,35 +580,18 @@ else
 fi
 
 # 11b. recorder spawn still fires — the hook does NOT loud-fail on absent
-#      accountId. The filled body still substitutes; the placeholder
-#      collapses to empty backticks.
-NO_ACCT_BODY=$(grep -E '^/api/admin/claude-sessions	' "$REQ_LOG" | head -1 | cut -f2-)
-NO_ACCT_OK=$(printf '%s' "$NO_ACCT_BODY" | python3 -c '
-import sys, json
-try:
-  outer = json.load(sys.stdin)
-  msg = outer.get("initialMessage")
-  if not isinstance(msg, str):
-    print("no:initialMessage-not-string")
-    sys.exit(0)
-  conds = []
-  conds.append(("starts-template", msg.startswith("You are an expert Neo4J graph operator.")))
-  conds.append(("no-placeholder-accountid", "{accountId}" not in msg))
-  # Placeholder collapses to empty backticks.
-  conds.append(("empty-accountid-rendered", "The current accountId is ``." in msg))
-  conds.append(("clarifier-still-present",
-                "never refuse a write because accountId" in msg))
-  # Transcript still rendered.
-  conds.append(("has-user-line", "\nuser: " in msg))
-  failed = [name for name, ok in conds if not ok]
-  print("yes" if not failed else "no:"+repr(failed))
-except Exception as e:
-  print("parse-fail:"+str(e))
-' 2>/dev/null)
-if [[ "$NO_ACCT_OK" == "yes" ]]; then
-  pass "case-11b empty ACCOUNT_ID → filled body still substitutes; {accountId} → empty backticks; clarifier sentence intact"
+#      accountId. Pre-Task-214 the {accountId} placeholder collapsed to
+#      empty backticks in the body. Post-Task-214 the template has no
+#      {accountId} placeholder, so the body is the literal template
+#      regardless of ACCOUNT_ID — the regression surface for "hook
+#      survives empty ACCOUNT_ID" is now 11a (substitution log line
+#      carries accountIdPresent=no) plus the spawn POST landing at all.
+echo "case-11b SKIPPED — dormant since Task 214; {accountId} placeholder removed from template, body is literal regardless of ACCOUNT_ID. Survival on empty accountId is now asserted by 11a (substitution log line) + spawn-POST presence below."
+NO_ACCT_POST=$(grep -cE '^/api/admin/claude-sessions	' "$REQ_LOG" || true)
+if [[ "$NO_ACCT_POST" -eq 1 ]]; then
+  pass "case-11b spawn POST fires on empty ACCOUNT_ID (hook does not loud-fail)"
 else
-  fail "case-11b filled-body shape wrong on empty accountId ($NO_ACCT_OK): $NO_ACCT_BODY"
+  fail "case-11b expected 1 spawn POST on empty ACCOUNT_ID, got $NO_ACCT_POST"
 fi
 
 # --- Summary ------------------------------------------------------------

package/payload/platform/plugins/admin/hooks/pre-tool-use.sh

@@ -21,24 +21,89 @@ TOOL_NAME=$(echo "$INPUT" | grep -o '"tool_name":"[^"]*"' | head -1 | cut -d'"'
 # ---------------------------------------------------------------------------
 if [ "$AGENT_TYPE" = "admin" ]; then
 
-  # ── Task 213: memory-write/memory-update revocation ──────────────────────
-  # The admin agent does not write to the graph; the Stop-hook recorder
-  # (database-operator specialist) owns these tools. Session d2aaa85e
-  # 2026-05-21 showed admin emitting `tool_use: memory-update`, filling in
-  # when the recorder produced no tool_use. `pty-spawner.ts` already passes
-  # `--disallowed-tools` on the spawn argv; this hook is the observability
-  # surface — every relapse lands in server.log as `[admin-tool-revoke]`,
-  # which the `--disallowed-tools` path itself does not produce.
+  # ── Task 213 (rev. Task 222): memory-write/memory-update gate ────────────
+  # Admin does not write to the graph directly. The contract (Task 214 +
+  # admin IDENTITY.md) is that admin delegates a write to `database-operator`
+  # via the Task tool; database-operator holds the writers in its agent
+  # frontmatter and executes the write inside its own in-window subagent
+  # turn.
+  #
+  # The PreToolUse payload includes `transcript_path`, the JSONL the
+  # invoking session writes turns to. Claude Code stores a subagent's
+  # turns in a separate file at
+  #   <project-key>/<sessionId>/subagents/agent-<agentId>.jsonl
+  # so the path pattern is the deterministic discriminator between admin
+  # direct calls (parent JSONL) and Task subagent calls (subagent JSONL).
+  #
+  # The hook gates the two memory writers per-tool-use:
+  #   * Task-subagent caller (path matches subagent pattern)
+  #       → allow, emit caller=subagent:<subagent_type> source=hook-passthrough result=allowed
+  #   * admin direct caller (any other path)
+  #       → block exit 2, emit caller=admin source=hook result=rejected
+  #   * unparseable payload (no JSON, no transcript_path)
+  #       → fail-closed: block exit 2, emit caller=unknown source=hook result=rejected
+  # The subagent_type enrichment is best-effort: the subagent's own JSONL
+  # does not encode its agent name, so the hook reads the parent transcript
+  # (sibling `<sessionId>.jsonl` to the subagent dir) and extracts the
+  # `subagent_type` from the most recent `Task` tool_use. If that read
+  # fails for any reason the caller is logged as bare `subagent` and the
+  # call is still allowed.
   case "$TOOL_NAME" in
     mcp__plugin_memory_memory__memory-write|mcp__plugin_memory_memory__memory-update)
-      SESSION_ID=$(printf '%s' "$INPUT" | python3 -c '
-import sys, json
+      VERDICT=$(printf '%s' "$INPUT" | python3 -c '
+import sys, json, os, re
+tool_name = sys.argv[1]
 try:
-  d = json.load(sys.stdin)
-  print(d.get("session_id", "") or "unknown")
+    d = json.load(sys.stdin)
 except Exception:
-  print("unknown")
-' 2>/dev/null || echo "unknown")
+    print("block|unknown|unknown|" + tool_name)
+    sys.exit(0)
+sid = d.get("session_id") or "unknown"
+tp = d.get("transcript_path") or ""
+m = re.search(r"/subagents/agent-[A-Za-z0-9_-]+\.jsonl$", tp)
+if not m:
+    caller = "admin" if tp else "unknown"
+    print("block|" + sid + "|" + caller + "|" + tool_name)
+    sys.exit(0)
+parent = tp[: m.start()] + ".jsonl"
+subagent_type = None
+if os.path.isfile(parent):
+    try:
+        with open(parent, "r", encoding="utf-8") as f:
+            for ln in f:
+                ln = ln.strip()
+                if not ln:
+                    continue
+                try:
+                    r = json.loads(ln)
+                except Exception:
+                    continue
+                if r.get("type") != "assistant":
+                    continue
+                msg = r.get("message") or {}
+                content = msg.get("content")
+                if not isinstance(content, list):
+                    continue
+                for b in content:
+                    if (isinstance(b, dict) and b.get("type") == "tool_use"
+                            and b.get("name") == "Task"):
+                        st = (b.get("input") or {}).get("subagent_type")
+                        if isinstance(st, str) and st:
+                            subagent_type = st
+    except Exception:
+        subagent_type = None
+caller = "subagent:" + subagent_type if subagent_type else "subagent"
+print("allow|" + sid + "|" + caller + "|" + tool_name)
+' "$TOOL_NAME" 2>/dev/null)
+      [ -z "$VERDICT" ] && VERDICT="block|unknown|unknown|${TOOL_NAME}"
+      DECISION=$(printf '%s' "$VERDICT" | cut -d'|' -f1)
+      SESSION_ID=$(printf '%s' "$VERDICT" | cut -d'|' -f2)
+      CALLER=$(printf '%s' "$VERDICT" | cut -d'|' -f3)
+      if [ "$DECISION" = "allow" ]; then
+        LINE_BODY="role=admin sessionId=${SESSION_ID} tool=${TOOL_NAME} caller=${CALLER} source=hook-passthrough result=allowed"
+      else
+        LINE_BODY="role=admin sessionId=${SESSION_ID} tool=${TOOL_NAME} caller=${CALLER} source=hook result=rejected"
+      fi
       UI_PORT="${MAXY_UI_INTERNAL_PORT:-}"
       if [ -n "$UI_PORT" ]; then
         curl -sS -o /dev/null -X POST \
@@ -46,11 +111,14 @@ except Exception:
           --max-time 2 \
           --data "$(python3 -c '
 import sys, json
-print(json.dumps({"tag":"admin-tool-revoke","level":"info","line":f"role=admin sessionId={sys.argv[1]} tool={sys.argv[2]} result=rejected source=permission-hook"}))
-' "$SESSION_ID" "$TOOL_NAME")" \
+print(json.dumps({"tag":"admin-tool-revoke","level":"info","line":sys.argv[1]}))
+' "$LINE_BODY")" \
           "http://127.0.0.1:${UI_PORT}/api/admin/log-ingest" 2>/dev/null || true
       fi
-      echo "Blocked: admin agent does not write to the graph. The Stop-hook database-operator recorder owns memory-write and memory-update." >&2
+      if [ "$DECISION" = "allow" ]; then
+        exit 0
+      fi
+      echo "Blocked: admin agent does not write to the graph directly. Delegate the write to database-operator via the Task tool; database-operator holds the memory-write and memory-update tools and will execute the write on admin's behalf." >&2
       exit 2
       ;;
   esac