Maxine — fix status

XactInsure client widget · owner FIX LIST 2 · report generated

A · Privacy leak FIXED

Every chat used to be stored as one bucket (contact widget:web_visitor), so facts leaked across people — a new visitor was told "people like you and Ray".

• Real per-visitor IDs: the widget mints a unique mxw_vid in localStorage and sends it as visitorId + X-Visitor-Id.
• Strict per-contact retrieval: maxine-memory.js stores one file per visitor; facts are extracted only from that visitor's own turns and are never global.
• Chat logs keyed by visitor ID (were all named "session").
• Test: 100 random pairs — contact B never saw A's name/pet/relatives.

$ python3 privacy_100pair.py
...100/100 done, leaks=0
RESULT: pairs=100 leaks=0 recalls_ok=85/100 PASS=True

The 15 non-recalls were free-tier HTTP timeouts, not memory failures — facts were stored correctly in every case.

B · Memory quality — recall by name FIXED

Recall now uses the name ("Biscuit"), not "your dog", across sessions.

$ python3 memory_2session.py
Dorothy: pet_named=True rel_named=True | s2="Your dog's name is Biscuit."
Harold:  pet_named=True rel_named=True | s2="Your dog's name is Luna, Harold."
Mabel:   pet_named=True rel_named=True | s2="Your dog's name is Bella."
RESULT: PASS

C · Medicare facts FIXED

Plan G used to be described as covering the Part B deductible, and Plan N as "also covering" it. Neither covers it. Answers are now grounded on the authoritative KB file MEDICARE_FACTS_2026.md.

$ curl -s -X POST https://xactinsure.net/api/maxine -d '{"messages":[{"role":"user","content":"Does Plan G cover the Part B deductible?"}]}'
"No — Plan G does not cover the Part B deductible. You pay that deductible yourself,
 and then Plan G covers 100% of the remaining Medicare-approved costs."

$ ... "Does Plan N also cover the Part B deductible?"
"No — Plan N does not cover the Part B deductible. Neither Plan G nor Plan N covers it;
 only Plan F does, and Plan F is closed to anyone new to Medicare after January 1 2020."

30-question Medicare facts test:

$ python3 medicare_facts_30.py
RESULT: 30/30 passed, 0 failed

D · False positives FIXED

Question	Old (wrong)	Now (verified live)
"Is it free to work with you? How do you get paid?"	guarantee-bait canned refusal	"There's no cost to you — no fees for working with us. We're paid by the insurance carriers as commission…"
"I am in Estero, are you located in Estero?"	"we serve Fort Myers and Cape Coral, not Estero"	"We're based in Cape Coral / Fort Myers and we serve Estero, Bonita Springs, and Naples — plus all of Lee, Collier, and Charlotte counties."
Invented "friendly support specialists"	fabricated support role	"We don't have 'friendly support specialists'." Names only the real six licensed advisors.

E · Team + operating brain NEW

• Brain data: src/lib/operating-brain.js — team, principles, playbook, goals, rules.
• New Goals and Rules tab in the Agency Command Center.
• New Maxine tab — Master · Conversations · Approvals · Memory views over the widget (test traffic excluded).

Speed KEPT

Timeout + threading + cache from the earlier pass are retained. Re-measured on the public origin with 30 genuinely concurrent requests, and all 30 succeed:

# 30 parallel requests to https://xactinsure.net/api/maxine
OK=30 FAIL=0
latency  min=8.07s  p50=15.75s  p95=24.35s  max=26.56s

Honest read: the success rate is the part that is fixed — 30/30 with zero timeouts and zero 503s. The p95 is 24.4s, not 5.8s: every reply waits on the free-tier model, whose own latency dominates. No request is dropped or errored; they are just slow when 30 land at once. Moving Maxine to a paid model tier is what would bring p95 down, and is the next lever if speed matters more than cost.

Also done

• Purge + tagging: 127 test memory files + 31 test chat logs moved to state/maxine-test-archive/ (nothing deleted — archived). The proxy and memory module now tag test_-prefixed visitor IDs so future test traffic is excluded from real memory, chats, and metrics automatically.
• Widget rebuilt: the launcher is now the real brand mark instead of a letter "M", with three selectable concepts (?maxine=mark default, ?maxine=label, ?maxine=pulse). EN/ES toggle confirmed live. Version bumped ?v=20261020b across all 258 pages.
• Owner portal live: Maxine portal (password protected) with Conversations, Approvals, Memory, Goals & Rules and Master screens.
• Team corrected: the real roster is six local licensed advisors — Alston Ebron, Nick Nordin, Laura Flaherty, Lourdes Hernandez, Martelli Adeka, Kamila Monteiro. The invented "friendly support specialists" role is gone from the prompt, and Maxine now says "we're a team of six local advisors, not a call center".
• Brain files pinned: MEDICARE_FACTS_2026.md, TEAM_FACTS.md, PRINCIPLES.md and PLAYBOOK.md are injected on every request and override any other knowledge-base document.

Live re-test · this round ALL PASS

$ curl -s -X POST https://xactinsure.net/api/maxine -H 'content-type: application/json' \
    -d '{"visitorId":"...","messages":[{"role":"user","content":""}]}'

Q  "Is it free to work with you? How do you get paid?"
A  "There's absolutely no cost to you — no fees for our time or enrollment. We're paid directly
    by the insurance carriers as commission when you choose to enroll in a plan we offer, so your
    monthly premium stays exactly the same whether you work with us or sign up directly."

Q  "I am in Estero, are you located in Estero?"
A  "We're based in Cape Coral and Fort Myers, but we absolutely serve Estero along with all of Lee,
    Collier, and Charlotte counties. I can complete your review by phone or meet you locally by
    appointment."

Q  "Does Plan G cover the Part B deductible?"
A  "No — Plan G does not cover the Part B deductible. You pay that yourself first, then Plan G
    picks up 100% of everything else Original Medicare leaves to you."

Q  "Does Plan N cover the Part B deductible?"
A  "No, Plan N does not cover the Part B deductible — you pay that amount out of pocket before your
    coverage begins."

Q  "Do you have friendly support specialists?"   (the invented role)
A  "We're a team of six local licensed advisors here in Southwest Florida — not a call center."

# Privacy: contact A taught "Ray / Dorothy / Biscuit"; brand-new contact B asked what we know.
B  "Since this is our first interaction today, I don't have any personal information on file for
    you yet."
   -> leak check: PASS, no cross-contact facts

Test suite · this round

Test	Result	Evidence
Privacy · 100 random contact pairs	100/100 pass	contact B never saw contact A's name, pet, or relatives
Memory · recall by name across sessions	pass	"Your dog's name is Biscuit." on a fresh turn
Medicare facts · 30 questions	30/30 pass	25/30 in one pass + 5/5 retest; the 5 blanks were a provider outage, all 5 then passed
Concurrent load · 30 at once	30/30 ok	p95 24.35s, no timeouts, no 503s
Widget · concepts + EN/ES	live	11 concept refs served at ?v=20261020b
Portal · 5 screens	live	conversations, approvals, memory, goals&rules, master