npm - @rubytech/create-realagent - Versions diffs - 1.0.818 → 1.0.820 - Mend

@rubytech/create-realagent 1.0.818 → 1.0.820

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (58) hide show

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-realagent",
-  "version": "1.0.818",
+  "version": "1.0.820",
   "description": "Install Real Agent — Built for agents. By agents.",
   "bin": {
     "create-realagent": "./dist/index.js"

package/payload/platform/lib/graph-write/dist/__tests__/action-provenance-gate.test.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export {};
2	+ //# sourceMappingURL=action-provenance-gate.test.d.ts.map

package/payload/platform/lib/graph-write/dist/__tests__/action-provenance-gate.test.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"action-provenance-gate.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/action-provenance-gate.test.ts"],"names":[],"mappings":""}

package/payload/platform/lib/graph-write/dist/__tests__/action-provenance-gate.test.js ADDED Viewed

@@ -0,0 +1,168 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const index_js_1 = require("../index.js");
+function makeStubSession(opts) {
+    const calls = [];
+    const tx = {
+        async run(cypher, params = {}) {
+            calls.push({ cypher, params });
+            if (cypher.includes("RETURN elementId(t) AS id, labels(t) AS labels")) {
+                const ids = params.ids ?? [];
+                const records = ids
+                    .filter((id) => opts.preCheckLabelsByTarget.has(id))
+                    .map((id) => ({
+                    get(field) {
+                        if (field === "id")
+                            return id;
+                        if (field === "labels")
+                            return opts.preCheckLabelsByTarget.get(id) ?? [];
+                        throw new Error(`unknown field ${field}`);
+                    },
+                }));
+                return { records };
+            }
+            if (cypher.includes("CREATE (n:")) {
+                return {
+                    records: [
+                        {
+                            get(field) {
+                                if (field === "nodeId")
+                                    return "new-element-id";
+                                if (field === "nodeLabels")
+                                    return ["Person"];
+                                throw new Error(`unknown field ${field}`);
+                            },
+                        },
+                    ],
+                };
+            }
+            if (cypher.includes("CREATE (a)-[") || cypher.includes("CREATE (b)-[")) {
+                return {
+                    records: [],
+                    summary: {
+                        counters: {
+                            updates() {
+                                return { relationshipsCreated: opts.edgesCreatedPerCall ?? 1 };
+                            },
+                        },
+                    },
+                };
+            }
+            return { records: [] };
+        },
+    };
+    const session = {
+        async executeWrite(work) {
+            return await work(tx);
+        },
+    };
+    return { session, calls };
+}
+(0, node_test_1.default)("ACTION_PROVENANCE_LABELS includes the documented set", () => {
+    for (const label of [
+        "Person",
+        "UserProfile",
+        "AdminUser",
+        "Organization",
+        "LocalBusiness",
+        "CloudflareTunnel",
+        "CloudflareHostname",
+    ]) {
+        strict_1.default.ok(index_js_1.ACTION_PROVENANCE_LABELS.has(label), `${label} should be in ACTION_PROVENANCE_LABELS`);
+    }
+});
+(0, node_test_1.default)("writeNodeWithEdges rejects :Person write missing PRODUCED-from-Task edge", async () => {
+    const { session } = makeStubSession({
+        preCheckLabelsByTarget: new Map([["other-target", ["Conversation"]]]),
+    });
+    const relationships = [
+        { type: "PART_OF", direction: "outgoing", targetNodeId: "other-target" },
+    ];
+    await strict_1.default.rejects(() => (0, index_js_1.writeNodeWithEdges)({
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        session: session,
+        labels: ["Person"],
+        props: { accountId: "acct-123" },
+        relationships,
+        createdBy: { agent: "maxy-admin", session: "sess-1", tool: "memory-write" },
+    }), /missing-action-provenance|Process provenance/i);
+});
+(0, node_test_1.default)("writeNodeWithEdges accepts :Person write with PRODUCED-from-Task edge", async () => {
+    const { session } = makeStubSession({
+        preCheckLabelsByTarget: new Map([
+            ["task-id", ["Task"]],
+        ]),
+    });
+    const relationships = [
+        { type: "PRODUCED", direction: "incoming", targetNodeId: "task-id" },
+    ];
+    const res = await (0, index_js_1.writeNodeWithEdges)({
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        session: session,
+        labels: ["Person"],
+        props: { accountId: "acct-123" },
+        relationships,
+        createdBy: { agent: "maxy-admin", session: "sess-1", tool: "memory-write" },
+    });
+    strict_1.default.equal(res.edgesCreated, 1);
+});
+(0, node_test_1.default)("writeNodeWithEdges accepts :Person write with no Task edge when agent='system' (bootstrap exemption)", async () => {
+    const { session } = makeStubSession({
+        preCheckLabelsByTarget: new Map([["admin-user-id", ["AdminUser"]]]),
+    });
+    const relationships = [
+        { type: "OWNS", direction: "incoming", targetNodeId: "admin-user-id" },
+    ];
+    const res = await (0, index_js_1.writeNodeWithEdges)({
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        session: session,
+        labels: ["Person"],
+        props: { accountId: "acct-123" },
+        relationships,
+        createdBy: { agent: "system", source: "writeAdminUserAndPerson" },
+    });
+    strict_1.default.equal(res.edgesCreated, 1);
+});
+(0, node_test_1.default)("writeNodeWithEdges rejects :Person write whose 'PRODUCED-incoming' source is NOT a :Task", async () => {
+    const { session } = makeStubSession({
+        preCheckLabelsByTarget: new Map([
+            ["other-id", ["Conversation"]],
+        ]),
+    });
+    const relationships = [
+        // Inbound PRODUCED edge but the source is a Conversation, not a Task.
+        // Must reject — prevents bypass via spoofed PRODUCED edge from any node.
+        { type: "PRODUCED", direction: "incoming", targetNodeId: "other-id" },
+    ];
+    await strict_1.default.rejects(() => (0, index_js_1.writeNodeWithEdges)({
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        session: session,
+        labels: ["Person"],
+        props: { accountId: "acct-123" },
+        relationships,
+        createdBy: { agent: "maxy-admin", session: "sess-1", tool: "memory-write" },
+    }), /missing-action-provenance|Process provenance/i);
+});
+(0, node_test_1.default)("writeNodeWithEdges accepts non-action-provenance label writes without Task edge", async () => {
+    const { session } = makeStubSession({
+        preCheckLabelsByTarget: new Map([["doc-id", ["KnowledgeDocument"]]]),
+    });
+    const relationships = [
+        { type: "ABOUT", direction: "outgoing", targetNodeId: "doc-id" },
+    ];
+    const res = await (0, index_js_1.writeNodeWithEdges)({
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        session: session,
+        labels: ["Question"], // not in ACTION_PROVENANCE_LABELS
+        props: { accountId: "acct-123" },
+        relationships,
+        createdBy: { agent: "maxy-admin", session: "sess-1", tool: "memory-write" },
+    });
+    strict_1.default.equal(res.edgesCreated, 1);
+});
+//# sourceMappingURL=action-provenance-gate.test.js.map

package/payload/platform/lib/graph-write/dist/__tests__/action-provenance-gate.test.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"action-provenance-gate.test.js","sourceRoot":"","sources":["../../src/__tests__/action-provenance-gate.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,0CAIqB;AAUrB,SAAS,eAAe,CAAC,IAGxB;IACC,MAAM,KAAK,GAA0D,EAAE,CAAC;IACxE,MAAM,EAAE,GAAW;QACjB,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,SAAkC,EAAE;YAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,gDAAgD,CAAC,EAAE,CAAC;gBACtE,MAAM,GAAG,GAAI,MAAM,CAAC,GAAgB,IAAI,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAG,GAAG;qBAChB,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;qBACnD,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC,KAAa;wBACf,IAAI,KAAK,KAAK,IAAI;4BAAE,OAAO,EAAE,CAAC;wBAC9B,IAAI,KAAK,KAAK,QAAQ;4BAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;wBACzE,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;oBAC5C,CAAC;iBACF,CAAC,CAAC,CAAC;gBACN,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,GAAG,CAAC,KAAa;gCACf,IAAI,KAAK,KAAK,QAAQ;oCAAE,OAAO,gBAAgB,CAAC;gCAChD,IAAI,KAAK,KAAK,YAAY;oCAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gCAC9C,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;4BAC5C,CAAC;yBACF;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACvE,OAAO;oBACL,OAAO,EAAE,EAAE;oBACX,OAAO,EAAE;wBACP,QAAQ,EAAE;4BACR,OAAO;gCACL,OAAO,EAAE,oBAAoB,EAAE,IAAI,CAAC,mBAAmB,IAAI,CAAC,EAAE,CAAC;4BACjE,CAAC;yBACF;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACzB,CAAC;KACF,CAAC;IACF,MAAM,OAAO,GAAG;QACd,KAAK,CAAC,YAAY,CAAI,IAAgC;YACpD,OAAO,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,IAAA,mBAAI,EAAC,sDAAsD,EAAE,GAAG,EAAE;IAChE,KAAK,MAAM,KAAK,IAAI;QAClB,QAAQ;QACR,aAAa;QACb,WAAW;QACX,cAAc;QACd,eAAe;QACf,kBAAkB;QAClB,oBAAoB;KACrB,EAAE,CAAC;QACF,gBAAM,CAAC,EAAE,CACP,mCAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,EACnC,GAAG,KAAK,wCAAwC,CACjD,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC;QAClC,sBAAsB,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;KACtE,CAAC,CAAC;IACH,MAAM,aAAa,GAAwB;QACzC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE;KACzE,CAAC;IACF,MAAM,gBAAM,CAAC,OAAO,CAClB,GAAG,EAAE,CACH,IAAA,6BAAkB,EAAC;QACjB,8DAA8D;QAC9D,OAAO,EAAE,OAAc;QACvB,MAAM,EAAE,CAAC,QAAQ,CAAC;QAClB,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;QAChC,aAAa;QACb,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE;KAC5E,CAAC,EACJ,+CAA+C,CAChD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;IACvF,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC;QAClC,sBAAsB,EAAE,IAAI,GAAG,CAAC;YAC9B,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;SACtB,CAAC;KACH,CAAC,CAAC;IACH,MAAM,aAAa,GAAwB;QACzC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE;KACrE,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,IAAA,6BAAkB,EAAC;QACnC,8DAA8D;QAC9D,OAAO,EAAE,OAAc;QACvB,MAAM,EAAE,CAAC,QAAQ,CAAC;QAClB,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;QAChC,aAAa;QACb,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE;KAC5E,CAAC,CAAC;IACH,gBAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,sGAAsG,EAAE,KAAK,IAAI,EAAE;IACtH,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC;QAClC,sBAAsB,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;KACpE,CAAC,CAAC;IACH,MAAM,aAAa,GAAwB;QACzC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE;KACvE,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,IAAA,6BAAkB,EAAC;QACnC,8DAA8D;QAC9D,OAAO,EAAE,OAAc;QACvB,MAAM,EAAE,CAAC,QAAQ,CAAC;QAClB,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;QAChC,aAAa;QACb,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,EAAE;KAClE,CAAC,CAAC;IACH,gBAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;IAC1G,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC;QAClC,sBAAsB,EAAE,IAAI,GAAG,CAAC;YAC9B,CAAC,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC;SAC/B,CAAC;KACH,CAAC,CAAC;IACH,MAAM,aAAa,GAAwB;QACzC,sEAAsE;QACtE,yEAAyE;QACzE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE;KACtE,CAAC;IACF,MAAM,gBAAM,CAAC,OAAO,CAClB,GAAG,EAAE,CACH,IAAA,6BAAkB,EAAC;QACjB,8DAA8D;QAC9D,OAAO,EAAE,OAAc;QACvB,MAAM,EAAE,CAAC,QAAQ,CAAC;QAClB,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;QAChC,aAAa;QACb,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE;KAC5E,CAAC,EACJ,+CAA+C,CAChD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;IACjG,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC;QAClC,sBAAsB,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;KACrE,CAAC,CAAC;IACH,MAAM,aAAa,GAAwB;QACzC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE;KACjE,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,IAAA,6BAAkB,EAAC;QACnC,8DAA8D;QAC9D,OAAO,EAAE,OAAc;QACvB,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,kCAAkC;QACxD,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;QAChC,aAAa;QACb,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE;KAC5E,CAAC,CAAC;IACH,gBAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC"}

package/payload/platform/lib/graph-write/dist/index.d.ts CHANGED Viewed

@@ -9,14 +9,24 @@ export * from "./audit.js";
  * maps, and flat props are queryable — `MATCH (n) WHERE n.createdBySession
  * = $id RETURN n` is the forensic entry point).
  *
+ * Process provenance doctrine (Task 885): writes targeting any label in
+ * `ACTION_PROVENANCE_LABELS` (Person, UserProfile, AdminUser, Organization,
+ * LocalBusiness, CloudflareTunnel, CloudflareHostname) must include exactly
+ * one inbound `:PRODUCED` edge whose source is a `:Task` node. This makes
+ * every durable LLM-tool-driven entity creation traversable from the Task
+ * node that produced it, and forward from Task→Conversation via
+ * `:RAISED_DURING`. Bootstrap writes (`createdBy.agent === 'system'`) are
+ * exempt — installer / migration / lazy-create paths run as system writers.
+ *
  * Rejection paths (every one emits a stderr log the admin server pipes to
  * server.log, so orphan pressure is visible per-write not just in the
  * hourly [graph-health] signal):
- *   - zero relationships      → `[graph-write] reject reason=zero-relationships`
- *   - unresolved target id    → `[graph-write] reject reason=unresolved-target`
- *   - removed-feature write   → `[graph-write] reject reason=removed-feature`
- *     (Task 884 — `:ReviewAlert` and `:Event {actionTool:"review-digest-compose"}`
- *     are deleted features; the gate catches doctrine-compliant writers
+ *   - zero relationships          → `[graph-write] reject reason=zero-relationships`
+ *   - unresolved target id        → `[graph-write] reject reason=unresolved-target`
+ *   - missing action provenance   → `[graph-write] reject reason=missing-action-provenance`
+ *   - removed-feature write       → `[graph-write] reject reason=removed-feature`
+ *     (`:ReviewAlert` and `:Event {actionTool:"review-digest-compose"}` are
+ *     deleted features; the gate catches doctrine-compliant writers
  *     re-introducing them. The vitest tombstone grep is the primary fence
  *     for raw `session.run("MERGE …")` callers that bypass this primitive.)
  *
@@ -26,6 +36,19 @@ export * from "./audit.js";
  * will write "unknown"; that's the signal something is wrong. Do not use
  * this field for access control — it is forensic, not a security boundary.
  */
+/**
+ * Labels that require an inbound `:PRODUCED` edge from a `:Task` (Task 885).
+ * Bootstrap writes with `createdBy.agent === 'system'` are exempt — that
+ * carve-out covers PIN-setup `writeAdminUserAndPerson`, schema migrations,
+ * and the lazy `loadUserProfile` MERGE path that bypasses this primitive
+ * entirely (raw Cypher in `platform/ui/app/lib/neo4j-store.ts`).
+ *
+ * The set is intentionally not exhaustive — labels added here become a
+ * blocking gate for every LLM-tool write of that label. Add a label only
+ * after every legitimate writer of it can either (a) carry a Task-PRODUCED
+ * edge, or (b) declare itself as `agent: 'system'`.
+ */
+export declare const ACTION_PROVENANCE_LABELS: ReadonlySet<string>;
 import type { Session } from "neo4j-driver";
 export interface GraphRelationship {
     type: string;

package/payload/platform/lib/graph-write/dist/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,YAAY,CAAC;AAE3B~~;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG~~;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,4EAA4E;IAC5E,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,EAAE,SAAS,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzB;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,eAAe,CAAC,~~CAkI1B~~"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,YAAY,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAQvD,CAAC;AAiBH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,4EAA4E;IAC5E,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,EAAE,SAAS,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzB;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAoK1B"}

package/payload/platform/lib/graph-write/dist/index.js CHANGED Viewed

@@ -14,12 +14,81 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACTION_PROVENANCE_LABELS = void 0;
 exports.stampCreatedBy = stampCreatedBy;
 exports.writeNodeWithEdges = writeNodeWithEdges;
 // Task 796: re-export the post-write audit so consumers (graph-mcp shim)
 // import from the same package as `writeNodeWithEdges`. Keeps the
 // `[graph-*]` log family colocated.
 __exportStar(require("./audit.js"), exports);
+/**
+ * Write doctrine (Task 673): a node without at least one adjacency is noise,
+ * not knowledge. `writeNodeWithEdges` is the single primitive every graph
+ * writer should call; it rejects zero-relationship writes, verifies every
+ * relationship target resolves before the node is created, and commits the
+ * node + all edges in one managed transaction. Provenance is stamped on the
+ * node as flattened `createdBy*` properties (Neo4j does not persist nested
+ * maps, and flat props are queryable — `MATCH (n) WHERE n.createdBySession
+ * = $id RETURN n` is the forensic entry point).
+ *
+ * Process provenance doctrine (Task 885): writes targeting any label in
+ * `ACTION_PROVENANCE_LABELS` (Person, UserProfile, AdminUser, Organization,
+ * LocalBusiness, CloudflareTunnel, CloudflareHostname) must include exactly
+ * one inbound `:PRODUCED` edge whose source is a `:Task` node. This makes
+ * every durable LLM-tool-driven entity creation traversable from the Task
+ * node that produced it, and forward from Task→Conversation via
+ * `:RAISED_DURING`. Bootstrap writes (`createdBy.agent === 'system'`) are
+ * exempt — installer / migration / lazy-create paths run as system writers.
+ *
+ * Rejection paths (every one emits a stderr log the admin server pipes to
+ * server.log, so orphan pressure is visible per-write not just in the
+ * hourly [graph-health] signal):
+ *   - zero relationships          → `[graph-write] reject reason=zero-relationships`
+ *   - unresolved target id        → `[graph-write] reject reason=unresolved-target`
+ *   - missing action provenance   → `[graph-write] reject reason=missing-action-provenance`
+ *   - removed-feature write       → `[graph-write] reject reason=removed-feature`
+ *     (`:ReviewAlert` and `:Event {actionTool:"review-digest-compose"}` are
+ *     deleted features; the gate catches doctrine-compliant writers
+ *     re-introducing them. The vitest tombstone grep is the primary fence
+ *     for raw `session.run("MERGE …")` callers that bypass this primitive.)
+ *
+ * The `createdBy.agent` field is advisory, not authoritative — it is sourced
+ * from the MCP server's AGENT_SLUG env var, which is set by the trusted
+ * spawning code (admin server / workflow runner). A misconfigured spawner
+ * will write "unknown"; that's the signal something is wrong. Do not use
+ * this field for access control — it is forensic, not a security boundary.
+ */
+/**
+ * Labels that require an inbound `:PRODUCED` edge from a `:Task` (Task 885).
+ * Bootstrap writes with `createdBy.agent === 'system'` are exempt — that
+ * carve-out covers PIN-setup `writeAdminUserAndPerson`, schema migrations,
+ * and the lazy `loadUserProfile` MERGE path that bypasses this primitive
+ * entirely (raw Cypher in `platform/ui/app/lib/neo4j-store.ts`).
+ *
+ * The set is intentionally not exhaustive — labels added here become a
+ * blocking gate for every LLM-tool write of that label. Add a label only
+ * after every legitimate writer of it can either (a) carry a Task-PRODUCED
+ * edge, or (b) declare itself as `agent: 'system'`.
+ */
+exports.ACTION_PROVENANCE_LABELS = new Set([
+    "Person",
+    "UserProfile",
+    "AdminUser",
+    "Organization",
+    "LocalBusiness",
+    "CloudflareTunnel",
+    "CloudflareHostname",
+]);
+function requiresActionProvenance(labels) {
+    for (const label of labels) {
+        if (exports.ACTION_PROVENANCE_LABELS.has(label))
+            return true;
+    }
+    return false;
+}
+function findProducedFromTaskCandidates(relationships) {
+    return relationships.filter((r) => r.type === "PRODUCED" && r.direction === "incoming");
+}
 /** Stamp flattened provenance into node properties. */
 function stampCreatedBy(props, createdBy) {
     return {
@@ -62,13 +131,38 @@ async function writeNodeWithEdges(params) {
     const nodeProps = stampCreatedBy(props, createdBy);
     return await session.executeWrite(async (tx) => {
         const targetIds = relationships.map((r) => r.targetNodeId);
-        const check = await tx.run(`UNWIND $ids AS id MATCH (t) WHERE elementId(t) = id RETURN count(DISTINCT t) AS found`, { ids: targetIds });
-        const found = check.records[0].get("found").toNumber();
+        const check = await tx.run(`UNWIND $ids AS id MATCH (t) WHERE elementId(t) = id RETURN elementId(t) AS id, labels(t) AS labels`, { ids: targetIds });
+        const labelsByTarget = new Map();
+        for (const rec of check.records) {
+            labelsByTarget.set(rec.get("id"), rec.get("labels"));
+        }
+        const found = labelsByTarget.size;
         const uniqueRequested = new Set(targetIds).size;
         if (found !== uniqueRequested) {
             process.stderr.write(`[graph-write] reject reason=unresolved-target labels=${labelCsv} agent=${agentLabel} requested=${uniqueRequested} found=${found}\n`);
             throw new Error(`Write doctrine violated: ${uniqueRequested - found} of ${uniqueRequested} relationship target(s) did not resolve (elementId mismatch). No node created.`);
         }
+        // Process provenance gate (Task 885). Labels in
+        // ACTION_PROVENANCE_LABELS require a `:Task` source on at least one
+        // inbound :PRODUCED edge so every durable LLM-tool entity write is
+        // traversable from the Task that produced it. Bootstrap writes
+        // (createdBy.agent === 'system') are exempt — installer + migration
+        // paths predate any Task. The check runs INSIDE the transaction so
+        // the labels-by-target map is consistent with target resolution.
+        let producedByTaskId = null;
+        if (requiresActionProvenance(labels) &&
+            (createdBy.agent ?? "") !== "system") {
+            const candidates = findProducedFromTaskCandidates(relationships);
+            const taskCandidates = candidates.filter((r) => {
+                const lbls = labelsByTarget.get(r.targetNodeId);
+                return Array.isArray(lbls) && lbls.includes("Task");
+            });
+            if (taskCandidates.length === 0) {
+                process.stderr.write(`[graph-write] reject reason=missing-action-provenance labels=${labelCsv} agent=${agentLabel}\n`);
+                throw new Error(`Process provenance doctrine violated: write to ${labelCsv} requires an inbound :PRODUCED edge from a :Task (createdBy.agent='${agentLabel}'). See .docs/neo4j.md (Process provenance doctrine).`);
+            }
+            producedByTaskId = taskCandidates[0].targetNodeId;
+        }
         let nodeRes;
         try {
             nodeRes = await tx.run(`CREATE (n:${labelStr} $props) RETURN elementId(n) AS nodeId, labels(n) AS nodeLabels`, { props: nodeProps });
@@ -122,7 +216,7 @@ async function writeNodeWithEdges(params) {
             process.stderr.write(`[graph-write] reject reason=edge-count-mismatch labels=${labelCsv} agent=${agentLabel} requested=${relationships.length} created=${edgesCreated}\n`);
             throw new Error(`Write doctrine violated: expected ${relationships.length} edges, created ${edgesCreated}. Transaction rolled back.`);
         }
-        process.stderr.write(`[graph-write] accepted labels=${labelCsv} edges=${edgesCreated} createdByAgent=${createdBy.agent ?? "unknown"} createdByTool=${createdBy.tool ?? createdBy.source ?? "unknown"}\n`);
+        process.stderr.write(`[graph-write] accepted labels=${labelCsv} edges=${edgesCreated} createdByAgent=${createdBy.agent ?? "unknown"} createdByTool=${createdBy.tool ?? createdBy.source ?? "unknown"} producedByTask=${producedByTaskId ?? "none"}\n`);
         return { nodeId, labels: nodeLabels, edgesCreated };
     });
 }

package/payload/platform/lib/graph-write/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"~~;;;;;;;;;;;;;;;;AAoEA~~,wCAWC;AAQD,~~gDAoIC~~;~~AA3ND~~,yEAAyE;AACzE,kEAAkE;AAClE,oCAAoC;AACpC,6CAA2B;~~AAgE3B~~,uDAAuD;AACvD,SAAgB,cAAc,CAC5B,KAA8B,EAC9B,SAAoB;IAEpB,OAAO;QACL,GAAG,KAAK;QACR,cAAc,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS;QAC5C,gBAAgB,EAAE,SAAS,CAAC,OAAO,IAAI,SAAS;QAChD,aAAa,EAAE,SAAS,CAAC,IAAI,IAAI,IAAI;QACrC,eAAe,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,MAAgC;IAEhC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAEpE,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElC,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,sBAAsB,GAC1B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,uBAAuB,CAAC;IACvF,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,sBAAsB,EAAE,CAAC;QAC7D,MAAM,eAAe,GAAG,sBAAsB;YAC5C,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,KAAK,CAAC;QACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sDAAsD,QAAQ,eAAe,eAAe,UAAU,UAAU,IAAI,CACrH,CAAC;QACF,MAAM,IAAI,KAAK,CACb,gKAAgK,CACjK,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yDAAyD,QAAQ,UAAU,UAAU,IAAI,CAC1F,CAAC;QACF,MAAM,IAAI,KAAK,CACb,sHAAsH,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAEnD,OAAO,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CACxB,~~uFAAuF~~,~~EACvF~~,EAAE,GAAG,EAAE,SAAS,EAAE,CACnB,CAAC;~~QACF~~,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,~~OAAO~~,CAAC,CAAC,QAAQ,~~EAAE~~,CAAC;~~QACvD~~,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;QAChD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wDAAwD,QAAQ,UAAU,UAAU,cAAc,eAAe,UAAU,KAAK,IAAI,CACrI,CAAC;YACF,MAAM,IAAI,KAAK,CACb,4BAA4B,eAAe,GAAG,KAAK,OAAO,eAAe,gFAAgF,CAC1J,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CACpB,aAAa,QAAQ,iEAAiE,EACtF,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,kEAAkE;YAClE,sEAAsE;YACtE,+DAA+D;YAC/D,sEAAsE;YACtE,iCAAiC;YACjC,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,IAAI,EAAE,CAAC;YAC3D,IAAI,IAAI,KAAK,mDAAmD,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACnG,MAAM,aAAa,GAAI,SAAqC,CAAC,SAAS,CAAC;gBACvE,MAAM,UAAU,GAAI,SAAqC,CAAC,MAAM,CAAC;gBACjE,MAAM,SAAS,GAAG,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC5F,MAAM,SAAS,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2EAA2E,SAAS,WAAW,SAAS,WAAW,UAAU,IAAI,CAClI,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAW,CAAC;QAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAa,CAAC;QAEpE,uEAAuE;QACvE,iEAAiE;QACjE,uEAAuE;QACvE,wEAAwE;QACxE,oEAAoE;QACpE,uEAAuE;QACvE,iEAAiE;QACjE,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACxC,MAAM,CAAC,GACL,GAAG,CAAC,SAAS,KAAK,UAAU;gBAC1B,CAAC,CAAC,mFAAmF,IAAI,UAAU;gBACnG,CAAC,CAAC,mFAAmF,IAAI,UAAU,CAAC;YACxG,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,oBAAoB,CAAC;YAClE,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kEAAkE,QAAQ,UAAU,UAAU,YAAY,GAAG,CAAC,IAAI,aAAa,GAAG,CAAC,YAAY,IAAI,CACpJ,CAAC;gBACF,MAAM,IAAI,KAAK,CACb,0DAA0D,GAAG,CAAC,YAAY,kGAAkG,CAC7K,CAAC;YACJ,CAAC;YACD,YAAY,IAAI,OAAO,CAAC;QAC1B,CAAC;QAED,IAAI,YAAY,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;YAC1C,mEAAmE;YACnE,+DAA+D;YAC/D,+CAA+C;YAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,QAAQ,UAAU,UAAU,cAAc,aAAa,CAAC,MAAM,YAAY,YAAY,IAAI,CACrJ,CAAC;YACF,MAAM,IAAI,KAAK,CACb,qCAAqC,aAAa,CAAC,MAAM,mBAAmB,YAAY,4BAA4B,CACrH,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,QAAQ,UAAU,YAAY,mBAAmB,SAAS,CAAC,KAAK,IAAI,SAAS,kBAAkB,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,IAAI,~~CACpL~~,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAmHA,wCAWC;AAQD,gDAsKC;AA5SD,yEAAyE;AACzE,kEAAkE;AAClE,oCAAoC;AACpC,6CAA2B;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;;;;;;;;;GAWG;AACU,QAAA,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IACnE,QAAQ;IACR,aAAa;IACb,WAAW;IACX,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,oBAAoB;CACrB,CAAC,CAAC;AAEH,SAAS,wBAAwB,CAAC,MAAyB;IACzD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,gCAAwB,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,8BAA8B,CACrC,aAA2C;IAE3C,OAAO,aAAa,CAAC,MAAM,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,SAAS,KAAK,UAAU,CAC3D,CAAC;AACJ,CAAC;AAoCD,uDAAuD;AACvD,SAAgB,cAAc,CAC5B,KAA8B,EAC9B,SAAoB;IAEpB,OAAO;QACL,GAAG,KAAK;QACR,cAAc,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS;QAC5C,gBAAgB,EAAE,SAAS,CAAC,OAAO,IAAI,SAAS;QAChD,aAAa,EAAE,SAAS,CAAC,IAAI,IAAI,IAAI;QACrC,eAAe,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,MAAgC;IAEhC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAEpE,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElC,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,sBAAsB,GAC1B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,uBAAuB,CAAC;IACvF,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,sBAAsB,EAAE,CAAC;QAC7D,MAAM,eAAe,GAAG,sBAAsB;YAC5C,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,KAAK,CAAC;QACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sDAAsD,QAAQ,eAAe,eAAe,UAAU,UAAU,IAAI,CACrH,CAAC;QACF,MAAM,IAAI,KAAK,CACb,gKAAgK,CACjK,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yDAAyD,QAAQ,UAAU,UAAU,IAAI,CAC1F,CAAC;QACF,MAAM,IAAI,KAAK,CACb,sHAAsH,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAEnD,OAAO,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CACxB,oGAAoG,EACpG,EAAE,GAAG,EAAE,SAAS,EAAE,CACnB,CAAC;QAEF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoB,CAAC;QACnD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAChC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAW,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAa,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC;QAClC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;QAChD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wDAAwD,QAAQ,UAAU,UAAU,cAAc,eAAe,UAAU,KAAK,IAAI,CACrI,CAAC;YACF,MAAM,IAAI,KAAK,CACb,4BAA4B,eAAe,GAAG,KAAK,OAAO,eAAe,gFAAgF,CAC1J,CAAC;QACJ,CAAC;QAED,gDAAgD;QAChD,oEAAoE;QACpE,mEAAmE;QACnE,+DAA+D;QAC/D,oEAAoE;QACpE,mEAAmE;QACnE,iEAAiE;QACjE,IAAI,gBAAgB,GAAkB,IAAI,CAAC;QAC3C,IACE,wBAAwB,CAAC,MAAM,CAAC;YAChC,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,QAAQ,EACpC,CAAC;YACD,MAAM,UAAU,GAAG,8BAA8B,CAAC,aAAa,CAAC,CAAC;YACjE,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC7C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBAChD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;YACH,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gEAAgE,QAAQ,UAAU,UAAU,IAAI,CACjG,CAAC;gBACF,MAAM,IAAI,KAAK,CACb,kDAAkD,QAAQ,sEAAsE,UAAU,uDAAuD,CAClM,CAAC;YACJ,CAAC;YACD,gBAAgB,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QACpD,CAAC;QAED,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CACpB,aAAa,QAAQ,iEAAiE,EACtF,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,kEAAkE;YAClE,sEAAsE;YACtE,+DAA+D;YAC/D,sEAAsE;YACtE,iCAAiC;YACjC,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,IAAI,EAAE,CAAC;YAC3D,IAAI,IAAI,KAAK,mDAAmD,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACnG,MAAM,aAAa,GAAI,SAAqC,CAAC,SAAS,CAAC;gBACvE,MAAM,UAAU,GAAI,SAAqC,CAAC,MAAM,CAAC;gBACjE,MAAM,SAAS,GAAG,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC5F,MAAM,SAAS,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2EAA2E,SAAS,WAAW,SAAS,WAAW,UAAU,IAAI,CAClI,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAW,CAAC;QAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAa,CAAC;QAEpE,uEAAuE;QACvE,iEAAiE;QACjE,uEAAuE;QACvE,wEAAwE;QACxE,oEAAoE;QACpE,uEAAuE;QACvE,iEAAiE;QACjE,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACxC,MAAM,CAAC,GACL,GAAG,CAAC,SAAS,KAAK,UAAU;gBAC1B,CAAC,CAAC,mFAAmF,IAAI,UAAU;gBACnG,CAAC,CAAC,mFAAmF,IAAI,UAAU,CAAC;YACxG,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,oBAAoB,CAAC;YAClE,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kEAAkE,QAAQ,UAAU,UAAU,YAAY,GAAG,CAAC,IAAI,aAAa,GAAG,CAAC,YAAY,IAAI,CACpJ,CAAC;gBACF,MAAM,IAAI,KAAK,CACb,0DAA0D,GAAG,CAAC,YAAY,kGAAkG,CAC7K,CAAC;YACJ,CAAC;YACD,YAAY,IAAI,OAAO,CAAC;QAC1B,CAAC;QAED,IAAI,YAAY,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;YAC1C,mEAAmE;YACnE,+DAA+D;YAC/D,+CAA+C;YAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,QAAQ,UAAU,UAAU,cAAc,aAAa,CAAC,MAAM,YAAY,YAAY,IAAI,CACrJ,CAAC;YACF,MAAM,IAAI,KAAK,CACb,qCAAqC,aAAa,CAAC,MAAM,mBAAmB,YAAY,4BAA4B,CACrH,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,QAAQ,UAAU,YAAY,mBAAmB,SAAS,CAAC,KAAK,IAAI,SAAS,kBAAkB,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,mBAAmB,gBAAgB,IAAI,MAAM,IAAI,CACjO,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/payload/platform/lib/graph-write/src/__tests__/action-provenance-gate.test.ts ADDED Viewed

@@ -0,0 +1,191 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  ACTION_PROVENANCE_LABELS,
+  writeNodeWithEdges,
+  type GraphRelationship,
+} from "../index.js";
+// Stub session/tx — captures Cypher calls and returns canned results.
+interface StubTx {
+  run(cypher: string, params?: Record<string, unknown>): Promise<{
+    records: { get(field: string): unknown }[];
+    summary?: { counters: { updates(): { relationshipsCreated: number } } };
+  }>;
+}
+function makeStubSession(opts: {
+  preCheckLabelsByTarget: Map<string, string[]>;
+  edgesCreatedPerCall?: number;
+}) {
+  const calls: { cypher: string; params: Record<string, unknown> }[] = [];
+  const tx: StubTx = {
+    async run(cypher: string, params: Record<string, unknown> = {}) {
+      calls.push({ cypher, params });
+      if (cypher.includes("RETURN elementId(t) AS id, labels(t) AS labels")) {
+        const ids = (params.ids as string[]) ?? [];
+        const records = ids
+          .filter((id) => opts.preCheckLabelsByTarget.has(id))
+          .map((id) => ({
+            get(field: string) {
+              if (field === "id") return id;
+              if (field === "labels") return opts.preCheckLabelsByTarget.get(id) ?? [];
+              throw new Error(`unknown field ${field}`);
+            },
+          }));
+        return { records };
+      }
+      if (cypher.includes("CREATE (n:")) {
+        return {
+          records: [
+            {
+              get(field: string) {
+                if (field === "nodeId") return "new-element-id";
+                if (field === "nodeLabels") return ["Person"];
+                throw new Error(`unknown field ${field}`);
+              },
+            },
+          ],
+        };
+      }
+      if (cypher.includes("CREATE (a)-[") || cypher.includes("CREATE (b)-[")) {
+        return {
+          records: [],
+          summary: {
+            counters: {
+              updates() {
+                return { relationshipsCreated: opts.edgesCreatedPerCall ?? 1 };
+              },
+            },
+          },
+        };
+      }
+      return { records: [] };
+    },
+  };
+  const session = {
+    async executeWrite<T>(work: (tx: StubTx) => Promise<T>): Promise<T> {
+      return await work(tx);
+    },
+  };
+  return { session, calls };
+}
+test("ACTION_PROVENANCE_LABELS includes the documented set", () => {
+  for (const label of [
+    "Person",
+    "UserProfile",
+    "AdminUser",
+    "Organization",
+    "LocalBusiness",
+    "CloudflareTunnel",
+    "CloudflareHostname",
+  ]) {
+    assert.ok(
+      ACTION_PROVENANCE_LABELS.has(label),
+      `${label} should be in ACTION_PROVENANCE_LABELS`,
+    );
+  }
+});
+test("writeNodeWithEdges rejects :Person write missing PRODUCED-from-Task edge", async () => {
+  const { session } = makeStubSession({
+    preCheckLabelsByTarget: new Map([["other-target", ["Conversation"]]]),
+  });
+  const relationships: GraphRelationship[] = [
+    { type: "PART_OF", direction: "outgoing", targetNodeId: "other-target" },
+  ];
+  await assert.rejects(
+    () =>
+      writeNodeWithEdges({
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        session: session as any,
+        labels: ["Person"],
+        props: { accountId: "acct-123" },
+        relationships,
+        createdBy: { agent: "maxy-admin", session: "sess-1", tool: "memory-write" },
+      }),
+    /missing-action-provenance|Process provenance/i,
+  );
+});
+test("writeNodeWithEdges accepts :Person write with PRODUCED-from-Task edge", async () => {
+  const { session } = makeStubSession({
+    preCheckLabelsByTarget: new Map([
+      ["task-id", ["Task"]],
+    ]),
+  });
+  const relationships: GraphRelationship[] = [
+    { type: "PRODUCED", direction: "incoming", targetNodeId: "task-id" },
+  ];
+  const res = await writeNodeWithEdges({
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    session: session as any,
+    labels: ["Person"],
+    props: { accountId: "acct-123" },
+    relationships,
+    createdBy: { agent: "maxy-admin", session: "sess-1", tool: "memory-write" },
+  });
+  assert.equal(res.edgesCreated, 1);
+});
+test("writeNodeWithEdges accepts :Person write with no Task edge when agent='system' (bootstrap exemption)", async () => {
+  const { session } = makeStubSession({
+    preCheckLabelsByTarget: new Map([["admin-user-id", ["AdminUser"]]]),
+  });
+  const relationships: GraphRelationship[] = [
+    { type: "OWNS", direction: "incoming", targetNodeId: "admin-user-id" },
+  ];
+  const res = await writeNodeWithEdges({
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    session: session as any,
+    labels: ["Person"],
+    props: { accountId: "acct-123" },
+    relationships,
+    createdBy: { agent: "system", source: "writeAdminUserAndPerson" },
+  });
+  assert.equal(res.edgesCreated, 1);
+});
+test("writeNodeWithEdges rejects :Person write whose 'PRODUCED-incoming' source is NOT a :Task", async () => {
+  const { session } = makeStubSession({
+    preCheckLabelsByTarget: new Map([
+      ["other-id", ["Conversation"]],
+    ]),
+  });
+  const relationships: GraphRelationship[] = [
+    // Inbound PRODUCED edge but the source is a Conversation, not a Task.
+    // Must reject — prevents bypass via spoofed PRODUCED edge from any node.
+    { type: "PRODUCED", direction: "incoming", targetNodeId: "other-id" },
+  ];
+  await assert.rejects(
+    () =>
+      writeNodeWithEdges({
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        session: session as any,
+        labels: ["Person"],
+        props: { accountId: "acct-123" },
+        relationships,
+        createdBy: { agent: "maxy-admin", session: "sess-1", tool: "memory-write" },
+      }),
+    /missing-action-provenance|Process provenance/i,
+  );
+});
+test("writeNodeWithEdges accepts non-action-provenance label writes without Task edge", async () => {
+  const { session } = makeStubSession({
+    preCheckLabelsByTarget: new Map([["doc-id", ["KnowledgeDocument"]]]),
+  });
+  const relationships: GraphRelationship[] = [
+    { type: "ABOUT", direction: "outgoing", targetNodeId: "doc-id" },
+  ];
+  const res = await writeNodeWithEdges({
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    session: session as any,
+    labels: ["Question"], // not in ACTION_PROVENANCE_LABELS
+    props: { accountId: "acct-123" },
+    relationships,
+    createdBy: { agent: "maxy-admin", session: "sess-1", tool: "memory-write" },
+  });
+  assert.equal(res.edgesCreated, 1);
+});