@rubytech/create-maxy 1.0.875 → 1.0.877

package/dist/index.js

@@ -1231,15 +1231,16 @@ function setupDedicatedNeo4j() {
     const logDir = `/var/log/neo4j-${brandSuffix}`;
     const serviceName = `neo4j-${brandSuffix}`;
     const httpPort = NEO4J_PORT - 213; // Preserve standard 7687/7474 offset
-    // Conf creation is gated on first install; everything below the if/else
-    // (state remediation + start + verify) runs on every install — Task 787
-    // closes the recovery gap where a half-installed Pi (failed prior install
-    // hit start-limit-hit, dedicated unit in failed state) returned here without
-    // the fix being applied.
+    // Per-brand state (sed, mkdir, chown, unit-write) is idempotent and runs on
+    // every install. Only the base-config copy and initial-password rotation are
+    // gated to first install — Task 787 established that state remediation must
+    // run every install; Task 979 extended the same principle to the conf and
+    // unit emission so a half-installed host (broken unit missing NEO4J_HOME)
+    // recovers on retry without an out-of-band manual reset.
     const confExists = spawnSync("test", ["-f", `${confDir}/neo4j.conf`], { stdio: "pipe" }).status === 0;
     if (confExists) {
-        console.log(`  Dedicated Neo4j instance for ${BRAND.productName} already configured at ${confDir}`);
-        logFile(`  Neo4j dedicated: existing config at ${confDir}, skipping conf creation`);
+        console.log(`  Dedicated Neo4j instance for ${BRAND.productName} already configured at ${confDir} — re-applying per-brand state`);
+        logFile(`  Neo4j dedicated: existing config at ${confDir}, re-applying sed/mkdir/chown/unit on every install`);
     }
     else {
         console.log(`  Setting up dedicated Neo4j instance for ${BRAND.productName} on bolt://localhost:${NEO4J_PORT}...`);
@@ -1252,31 +1253,41 @@ function setupDedicatedNeo4j() {
         if (!existsSync("/etc/neo4j/neo4j.conf")) {
             throw new Error("/etc/neo4j/neo4j.conf not found. Cannot create dedicated instance without base config.");
         }
-        // 1. Copy base config
+        // Copy base config (first install only — sed runs unconditionally below)
         console.log("  [privileged] cp -r");
         shell("cp", ["-r", "/etc/neo4j", confDir], { sudo: true });
-        // 2. Modify config for this instance: bolt port, HTTP port, data/log directories
-        console.log("  [privileged] sed -i");
-        shell("sed", ["-i", `s/^#\\?server\\.bolt\\.listen_address=.*/server.bolt.listen_address=:${NEO4J_PORT}/`, `${confDir}/neo4j.conf`], { sudo: true });
-        console.log("  [privileged] sed -i");
-        shell("sed", ["-i", `s/^#\\?server\\.http\\.listen_address=.*/server.http.listen_address=:${httpPort}/`, `${confDir}/neo4j.conf`], { sudo: true });
-        console.log("  [privileged] sed -i");
-        shell("sed", ["-i", `s|^#\\?server\\.directories\\.data=.*|server.directories.data=${dataDir}/data|`, `${confDir}/neo4j.conf`], { sudo: true });
-        console.log("  [privileged] sed -i");
-        shell("sed", ["-i", `s|^#\\?server\\.directories\\.logs=.*|server.directories.logs=${logDir}|`, `${confDir}/neo4j.conf`], { sudo: true });
-        // Verify config was updated — sed silently no-ops if the key format changed
-        const confContent = spawnSync("grep", [`server.bolt.listen_address=:${NEO4J_PORT}`, `${confDir}/neo4j.conf`], { stdio: "pipe" });
-        if (confContent.status !== 0) {
-            console.error(`  WARNING: neo4j.conf may not have been updated correctly — bolt port ${NEO4J_PORT} not found in config`);
-            logFile(`  WARNING: sed verification failed — bolt port ${NEO4J_PORT} not found in ${confDir}/neo4j.conf`);
-        }
-        // 3. Create data and log directories
-        console.log("  [privileged] mkdir -p");
-        shell("mkdir", ["-p", `${dataDir}/data`, logDir], { sudo: true });
-        console.log("  [privileged] chown -R");
-        shell("chown", ["-R", "neo4j:neo4j", dataDir, logDir, confDir], { sudo: true });
-        // 4. Create systemd service
-        const serviceContent = `[Unit]
+    }
+    // Idempotent per-brand state — runs on every install (Task 979).
+    // sed `s|^#?key=.*|key=value|` no-ops when the file already has the target
+    // value; mkdir -p, chown -R, and unit-write are idempotent by definition.
+    // NEO4J_HOME=${dataDir} makes server.directories.run resolve per-brand to
+    // ${dataDir}/run, so the launcher's pre-flight does not collide with the
+    // system unit's /var/lib/neo4j/run/neo4j.pid (Task 979 root cause). Plugins
+    // and import are sed-overridden because the apt base conf pins them to
+    // absolute /var/lib/neo4j/plugins and /var/lib/neo4j/import (shared).
+    console.log("  [privileged] sed -i");
+    shell("sed", ["-i", `s/^#\\?server\\.bolt\\.listen_address=.*/server.bolt.listen_address=:${NEO4J_PORT}/`, `${confDir}/neo4j.conf`], { sudo: true });
+    console.log("  [privileged] sed -i");
+    shell("sed", ["-i", `s/^#\\?server\\.http\\.listen_address=.*/server.http.listen_address=:${httpPort}/`, `${confDir}/neo4j.conf`], { sudo: true });
+    console.log("  [privileged] sed -i");
+    shell("sed", ["-i", `s|^#\\?server\\.directories\\.data=.*|server.directories.data=${dataDir}/data|`, `${confDir}/neo4j.conf`], { sudo: true });
+    console.log("  [privileged] sed -i");
+    shell("sed", ["-i", `s|^#\\?server\\.directories\\.logs=.*|server.directories.logs=${logDir}|`, `${confDir}/neo4j.conf`], { sudo: true });
+    console.log("  [privileged] sed -i");
+    shell("sed", ["-i", `s|^#\\?server\\.directories\\.plugins=.*|server.directories.plugins=${dataDir}/plugins|`, `${confDir}/neo4j.conf`], { sudo: true });
+    console.log("  [privileged] sed -i");
+    shell("sed", ["-i", `s|^#\\?server\\.directories\\.import=.*|server.directories.import=${dataDir}/import|`, `${confDir}/neo4j.conf`], { sudo: true });
+    // Verify config was updated — sed silently no-ops if the key format changed
+    const confContent = spawnSync("grep", [`server.bolt.listen_address=:${NEO4J_PORT}`, `${confDir}/neo4j.conf`], { stdio: "pipe" });
+    if (confContent.status !== 0) {
+        console.error(`  WARNING: neo4j.conf may not have been updated correctly — bolt port ${NEO4J_PORT} not found in config`);
+        logFile(`  WARNING: sed verification failed — bolt port ${NEO4J_PORT} not found in ${confDir}/neo4j.conf`);
+    }
+    console.log("  [privileged] mkdir -p");
+    shell("mkdir", ["-p", `${dataDir}/data`, `${dataDir}/plugins`, `${dataDir}/import`, logDir], { sudo: true });
+    console.log("  [privileged] chown -R");
+    shell("chown", ["-R", "neo4j:neo4j", dataDir, logDir, confDir], { sudo: true });
+    const serviceContent = `[Unit]
 Description=Neo4j Graph Database (${BRAND.productName})
 After=network-online.target
 Wants=network-online.target
@@ -1286,18 +1297,21 @@ ExecStart=/usr/bin/neo4j console
 Restart=on-failure
 User=neo4j
 Group=neo4j
-Environment=NEO4J_CONF=${confDir}
+Environment="NEO4J_CONF=${confDir}" "NEO4J_HOME=${dataDir}"
 LimitNOFILE=60000
 
 [Install]
 WantedBy=multi-user.target
 `;
-        const tmpServicePath = `/tmp/${serviceName}.service`;
-        writeFileSync(tmpServicePath, serviceContent);
-        console.log("  [privileged] cp");
-        shell("cp", [tmpServicePath, `/etc/systemd/system/${serviceName}.service`], { sudo: true });
-        spawnSync("rm", ["-f", tmpServicePath]);
-        // 5. Set initial password before first start
+    const tmpServicePath = `/tmp/${serviceName}.service`;
+    writeFileSync(tmpServicePath, serviceContent);
+    console.log("  [privileged] cp");
+    shell("cp", [tmpServicePath, `/etc/systemd/system/${serviceName}.service`], { sudo: true });
+    spawnSync("rm", ["-f", tmpServicePath]);
+    logFile(`  [neo4j] dedicated unit env: NEO4J_CONF=${confDir} NEO4J_HOME=${dataDir}`);
+    if (!confExists) {
+        // Set initial password before first start (first install only — rotation
+        // on retry would brick an existing DB whose password is already stored).
         const password = randomBytes(24).toString("base64url");
         const persistDir = resolve(process.env.HOME ?? "/root", BRAND.configDir);
         mkdirSync(persistDir, { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy",
-  "version": "1.0.875",
+  "version": "1.0.877",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy": "./dist/index.js"

package/payload/platform/lib/graph-search/src/__tests__/brochure-threshold.test.ts

@@ -0,0 +1,136 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { hybrid, clearIndexCache } from "../index.js";
+
+/**
+ * Task 978 — brochure-class calibration fixture.
+ *
+ * Pre-Task-978 the route's `DEFAULT_VECTOR_THRESHOLD` was 0.72, calibrated
+ * against the `savage` query (every score < 0.70, only the relevant row
+ * passes the BM25 carve-out). `brochure` is a different shape: keepers
+ * cluster in [0.8473, 0.8623], noise in [0.7159, 0.8143]. At 0.72 the
+ * floor caught only the lone outlier below 0.72; all 11 in-cluster rows
+ * rendered. Task 978 raised the default to 0.82, the midpoint of the
+ * 0.033-wide gap between brochure-keepers and brochure-noise.
+ *
+ * This fixture pins both ends of that calibration so a future drop back
+ * toward 0.72 (or a push past 0.85 that would clip the lowest keeper)
+ * fails the test instead of silently regressing /graph search quality.
+ */
+
+interface StubRun {
+  match: (query: string) => boolean;
+  records: Array<Record<string, unknown>>;
+}
+
+function record(fields: Record<string, unknown>) {
+  return { get: (k: string) => fields[k] };
+}
+
+function makeStubSession(scripted: StubRun[]) {
+  return {
+    run(query: string) {
+      const hit = scripted.find((s) => s.match(query));
+      if (!hit) return Promise.resolve({ records: [] });
+      return Promise.resolve({ records: hit.records.map(record) });
+    },
+  } as unknown as import("neo4j-driver").Session;
+}
+
+// Real Agent laptop 2026-05-12 snapshot, `brochure` against
+// project_embedding for account b3b638d9. BM25 = 0 on every row.
+const BROCHURE_VECTOR_ROWS = [
+  { nodeId: "k1", name: "Brochure Production — Alex Pelosi Buchanan", score: 0.8623 },
+  { nodeId: "k2", name: "Brochure Production — Ross Margetts", score: 0.8523 },
+  { nodeId: "k3", name: "Brochure Production — Donna Vincent", score: 0.8521 },
+  { nodeId: "k4", name: "Brochure Production — Paul Leslie", score: 0.8509 },
+  { nodeId: "k5", name: "Brochure Production — John Savage", score: 0.8474 },
+  { nodeId: "k6", name: "Brochure Production — Muvin", score: 0.8473 },
+  { nodeId: "n1", name: "Real Agent Product Development", score: 0.8143 },
+  { nodeId: "n2", name: "Dan McLeod Partnership", score: 0.7498 },
+  { nodeId: "n3", name: "Real Agent Lettings — New Vertical", score: 0.7498 },
+  { nodeId: "n4", name: "Real Agent Lettings", score: 0.7487 },
+  { nodeId: "n5", name: "Fundraising & Finance", score: 0.7323 },
+  { nodeId: "n6", name: "Muvin Pilot", score: 0.7240 },
+  { nodeId: "n7", name: "Go-to-Market & Events", score: 0.7159 },
+];
+
+function makeBrochureSession() {
+  return makeStubSession([
+    {
+      match: (q) => q.includes("SHOW INDEXES"),
+      records: [{ name: "project_embedding", labelsOrTypes: ["Project"] }],
+    },
+    {
+      match: (q) => q.includes("db.index.vector.queryNodes"),
+      records: BROCHURE_VECTOR_ROWS.map((r) => ({
+        nodeId: r.nodeId,
+        nodeLabels: ["Project"],
+        node: { properties: { name: r.name } },
+        score: r.score,
+      })),
+    },
+    // BM25 returns nothing — no `brochure` token literal in any name.
+    { match: (q) => q.includes("db.index.fulltext.queryNodes"), records: [] },
+  ]);
+}
+
+beforeEach(() => {
+  clearIndexCache();
+});
+
+describe("brochure-class threshold calibration (Task 978)", () => {
+  it("at threshold 0.72 (pre-fix) renders 12 rows — the bug shape", async () => {
+    const res = await hybrid(makeBrochureSession(), async () => [0.1], {
+      query: "brochure",
+      accountId: "acc-1",
+      limit: 100,
+      labels: ["Project"],
+      expandHops: 0,
+      vectorThreshold: 0.72,
+    });
+    // 13 rows merged, lowest (0.7159) below 0.72, 12 rendered.
+    expect(res.rawMerged).toBe(13);
+    expect(res.results).toHaveLength(12);
+    expect(res.suppressed).toBe(1);
+    expect(res.bm25Bypass).toBe(0);
+  });
+
+  it("at threshold 0.82 (post-fix) renders the 6 keepers exactly", async () => {
+    const res = await hybrid(makeBrochureSession(), async () => [0.1], {
+      query: "brochure",
+      accountId: "acc-1",
+      limit: 100,
+      labels: ["Project"],
+      expandHops: 0,
+      vectorThreshold: 0.82,
+    });
+    expect(res.rawMerged).toBe(13);
+    expect(res.results).toHaveLength(6);
+    expect(res.suppressed).toBe(7);
+    expect(res.bm25Bypass).toBe(0);
+    expect(res.results.map((r) => r.properties.name as string).sort()).toEqual([
+      "Brochure Production — Alex Pelosi Buchanan",
+      "Brochure Production — Donna Vincent",
+      "Brochure Production — John Savage",
+      "Brochure Production — Muvin",
+      "Brochure Production — Paul Leslie",
+      "Brochure Production — Ross Margetts",
+    ]);
+  });
+
+  it("at threshold 0.85 (too tight) starts clipping keepers — regression guard", async () => {
+    const res = await hybrid(makeBrochureSession(), async () => [0.1], {
+      query: "brochure",
+      accountId: "acc-1",
+      limit: 100,
+      labels: ["Project"],
+      expandHops: 0,
+      vectorThreshold: 0.85,
+    });
+    // Two keepers (0.8473, 0.8474) fall below 0.85 — proves 0.82 sits in
+    // the gap on purpose, not by accident. Don't move the default this
+    // high without rechecking.
+    expect(res.results).toHaveLength(4);
+    expect(res.suppressed).toBe(9);
+  });
+});

package/payload/platform/neo4j/edge-annotations.json

@@ -81,8 +81,8 @@
       "note": "Flat document-to-chunk (alternative to HAS_SECTION then HAS_CHUNK)."
     },
     "REFERENCES": {
-      "direction": "(Message|KnowledgeDocument)-[:REFERENCES]->(*)",
-      "note": "Soft reference link."
+      "direction": "(Message|KnowledgeDocument|Task)-[:REFERENCES]->(*)",
+      "note": "Soft reference link. Task 892 added `Task` as a source: derived-insight tasks created from a `:Section:Conversation` chunk record their provenance via (:Task)-[:REFERENCES]->(:Section:Conversation) with a `contentHash` merge-key for idempotent re-runs."
     },
     "ABOUT": {
       "direction": "(Review|Message)-[:ABOUT]->(*)",
@@ -102,7 +102,15 @@
     },
     "OBSERVED_IN": {
       "direction": "(*)-[:OBSERVED_IN]->(Conversation)",
-      "note": "Observation provenance."
+      "note": "Observation provenance. Task 892: `:Section:Conversation` chunks (which carry the Conversation label) are valid OBSERVED_IN targets, so (:Preference)-[:OBSERVED_IN]->(:Section:Conversation) pattern-matches this annotation."
+    },
+    "MENTIONS": {
+      "direction": "(Section|Message|KnowledgeDocument)-[:MENTIONS]->(Person|Organization)",
+      "note": "Named entity reference. Task 892 added `Section` (typically Section:Conversation) as a source so chunk-anchored insight derivation can record who a transcript chunk mentions. KnowledgeDocument-source MENTIONS is the document-ingest path; Message-source MENTIONS is reserved for future per-message extraction."
+    },
+    "RELATED_TO": {
+      "direction": "(Person|Organization)-[:RELATED_TO]->(Person|Organization)",
+      "note": "Operator-confirmed relationship between two named entities derived from a transcript chunk (Task 892). Carries `operatorConfirmed: true` plus `relationshipType` naming the specific bond (`broker`, `colleague`, `referrer`, …). Distinct from typed edges like AUTHORED_BY or PARTICIPANT — RELATED_TO is the generic surface for relationships the operator confirmed at enrich time."
     },
     "HAS_IDENTITY": {
       "direction": "(Agent)-[:HAS_IDENTITY]->(KnowledgeDocument)",

package/payload/platform/plugins/admin/hooks/archive-ingest-surface-gate.sh

@@ -1,15 +1,21 @@
 #!/usr/bin/env bash
-# Archive-ingest surface gate (Task 855, updated by Task 891).
+# Archive-ingest surface gate (Task 855, updated by Task 891, Task 892).
 #
 # Five enforcements, one script — phase decided by `hook_event_name` on stdin.
 # Task 855 narrows the database-operator subagent's effective surface during
 # WhatsApp archive ingestion to exactly one Bash entry
 # (`memory/bin/conversation-archive-ingest.sh`) plus read-only neighbours, by
 # blocking the legacy MCP deviation tools mechanically. Task 891 retired the
-# `whatsapp-export-insight-pass` tool entirely (Phase 2 enrichment moved to a
-# separate follow-up task that will operate on :Section:Conversation chunks);
-# the tool name is added to the BLOCK list so any agent that still references
-# it from a stale skill or runbook gets a loud denial instead of MCP-not-found.
+# `whatsapp-export-insight-pass` tool; Task 892 reintroduces Phase 2 as
+# `mcp__memory__conversation-archive-derive-insights` — a read-only tool that
+# walks :Section:Conversation chunks of one named :ConversationArchive in
+# pages and emits per-row proposals. The new tool is NOT in any BLOCK list
+# (the gate is allow-by-default for unrecognised tools) — its writes go
+# through the existing graph-cypher-write surface, gated by the operator per
+# row in the conversation-archive-enrich skill. Stale references to the
+# retired Phase 2 name (`whatsapp-export-insight-pass`) remain in the BLOCK
+# list as a loud-denial breadcrumb for any operator-edited skill that still
+# names them.
 #
 # 1. PreToolUse on the four legacy WhatsApp MCP tools — BLOCK unconditionally.
 #    The single deterministic Bash entry is the only supported path for

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -536,6 +536,13 @@ server.tool("onboarding-plugin-options", "Return the fully-assembled multi-selec
             const meta = PLUGIN_DISPLAY[name] ?? { value: name, label: name, description: "" };
             options.push({ ...meta, group: "Maxy" });
         }
+        // Task 976: signal that the onboarding skill will append three Anthropic
+        // vertical entries from the claude-for-financial-services and
+        // knowledge-work-plugins marketplaces. The count is fixed because the
+        // skill prose always appends the same three (kyc-screener,
+        // meeting-prep-agent, pdf-viewer). Absence of this line post-install
+        // = the group was not surfaced (release blocker per task spec).
+        console.error(`[plugin-onboarding] group=anthropic-verticals presented=3`);
         return { content: [{ type: "text", text: JSON.stringify(options, null, 2) }] };
     }
     catch (err) {
@@ -2237,11 +2244,21 @@ server.tool("onboarding-get", "Read the current onboarding state from the graph.
 });
 server.tool("onboarding-complete-step", "Mark an onboarding step as completed. Sets a completion timestamp on the step " +
     "and updates currentStep to the highest completed step. Idempotent — completing " +
-    "an already-completed step preserves its original timestamp. Step must be 1–9.", {
+    "an already-completed step preserves its original timestamp. Step must be 1–9. " +
+    "When step is 1, optionally pass acceptedAnthropicVerticals + declinedAnthropicVerticals " +
+    "(both required together) to emit the paired counter for the [plugin-onboarding] " +
+    "group=anthropic-verticals prefix; the skill derives both arrays from the closed set " +
+    "{kyc-screener, meeting-prep-agent, pdf-viewer} and the user's submission.", {
     step: z.number().int().min(1).max(9).describe("The onboarding step number (1–9) to mark as completed"),
-}, async ({ step }) => {
+    acceptedAnthropicVerticals: z.array(z.string()).optional().describe("Step 1 only: plugin slugs the user accepted from the Anthropic verticals group. Pass together with declinedAnthropicVerticals."),
+    declinedAnthropicVerticals: z.array(z.string()).optional().describe("Step 1 only: plugin slugs the user declined from the Anthropic verticals group. Pass together with acceptedAnthropicVerticals."),
+}, async ({ step, acceptedAnthropicVerticals, declinedAnthropicVerticals }) => {
     try {
         const state = await completeOnboardingStep(getSession, ACCOUNT_ID, step);
+        // Task 977: closed set lives in skill prose, not server validation — a fourth vertical updates the skill.
+        if (step === 1 && acceptedAnthropicVerticals !== undefined && declinedAnthropicVerticals !== undefined) {
+            console.error(`[plugin-onboarding] group=anthropic-verticals accepted=${acceptedAnthropicVerticals.length} declined=${declinedAnthropicVerticals.length}`);
+        }
         return {
             content: [{
                     type: "text",