kairos-chain 3.73.0 → 3.74.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4344b2bf968bbb0b650c672522c8abdee9ae34daea4f06899e60cfaf815fa489
-  data.tar.gz: e2a99d727e1ca7d404ecdd0945c29e9964220b1ec8aaca8be44f46c55b9a5e77
+  metadata.gz: 730e325cdf2caf9ce68964d25d379511f5b1080aa86b86378c928a06156fc567
+  data.tar.gz: 3c7fd4cc597b1fefd8403bd976786eba4e3e02c6665c2097d35940e243d6a2dd
 SHA512:
-  metadata.gz: 9d47b320473eb188dcc9f57655f11cd152ce0cee6e160c714396ebcd508156a5696c0c0db8eeb7ace61956cfc5e61467507a051ce6d200552d95ebe3a7f9ebf1
-  data.tar.gz: e38d3d417efb9be7c9e0274d9aca36ba7c1fd062f7ef0ecfc204536f86c99a9bbbbf025a52ee31525caab67b94a3dba88c41fcd3ab9d49313d6a609b10a2e0f8
+  metadata.gz: a78cf0336f37b5107f0991ca1f0e88a3cfeb911f1a998d1ffb5763e071d1ba9ffa88fde11d92fc2eaca9eeb0ffc948718e3bfa1f65ed0f87fa1adf3f1c36d40a
+  data.tar.gz: da3b0b85ec1518e1e07f4bd4199761128006fe57db205059b36f3145db7cd5ef8f51b9d95f24faa82a05756507244700d6fbe3655d3672d11b80e9b7eb4a697d

data/CHANGELOG.md

@@ -4,6 +4,64 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.74.0] - 2026-08-18
+
+### Fixed
+
+- **Every guard in `project_manager` sat on the reading side, and a value JSON
+  cannot represent walked past all of them and wedged the store.** Generation ran
+  before `File.write`, so the file survived and `@data` did not: the bad value
+  stayed in memory and every later save in the process failed identically. The
+  store went on silently accepting nothing while each caller saw only its own
+  error, and the digest counted items that were never written. Measured on a
+  probe: a title carrying a lone surrogate raised, and so did the next perfectly
+  ordinary write; 0 items on disk against 2 in memory. `Store#save` now treats
+  generation, `mkdir`, write and rename as one unit, and any failure restores
+  `@committed` — the last state that reached disk, held in memory and advanced
+  only after a write completes — before re-raising. Restoring from memory rather
+  than by re-reading the file matters because a `store.json` that had itself
+  become unreadable would otherwise leave the rollback with nothing to restore.
+  What rollback discards is stated rather than glossed: everything in memory since
+  the last successful save, including an edit written straight into a record
+  handed out by `items` or `fetch_*`. Records returned by the store are for
+  reading; go through a mutator to keep a change.
+- **`pm.yml` is the one file an operator is invited to edit and `skillset upgrade`
+  never repairs it, so a bad edit was permanent — and it returned an error from
+  every pm tool at once.** `YAML.safe_load_file` is strict: 5 of 5 ordinary edits
+  raise (tab indent, unclosed quote, bare date, `&anchor`/`*alias`, `:symbol`),
+  and the raise landed one level above every guard the tools carry. The read now
+  falls back to the defaults — but falling back is only half a fix, because
+  defaults wearing the operator's settings are worse than the outage they replace.
+  The reason is kept in `pm_config_error`, `pm_digest` and `pm_record` carry it as
+  `config_error`, and the secretary is told to say it **before** the buckets and
+  to state that the report was built on defaults and is not comparable to a
+  configured one. A document that parses but is not a mapping is reported the same
+  way, `false` included; only `nil` means "no settings", which an empty file, a
+  newline-only file and a comment-only file all produce (3 of 3 measured).
+  `ToolHelpers#pm_digest` carried the same hole and had no caller, so it is
+  deleted rather than guarded.
+- **Two rounds of review, and the second round's fixes came from findings the
+  first round's fixes created.** Round 1 returned 1 APPROVE of 3 seats with six
+  blocking findings; all six were checked against the code before acting and all
+  six were real. Round 2 returned 2 of 3. One correction runs the other way: a
+  finding claimed an operator's shortened record ttl would be silently replaced,
+  but the shipped value and the built-in default are the same 100 years, so only
+  an operator who changed it is affected — the gap was real, the stated magnitude
+  was not. Two residuals are shipped open, both unreachable from any of the five
+  tool entry points and both recorded at the call site as well as in the store:
+  rollback detaches previously returned records (0 of 3 holders are harmed today),
+  and `JSON.parse(@committed)` is assumed to succeed (tool arguments arrive parsed
+  from JSON, so no object with its own `to_json` can enter).
+- **The mutant set grew from 8 to 14 and one of its own results was thrown out.**
+  Mutant 18-d first read as a survivor; the mutation was malformed, splitting the
+  `begin` block while leaving the original `rescue` attached to the second half,
+  so the mutant still rolled back and was equivalent rather than surviving.
+  Rewritten as a whole-method replacement it is killed. 14 of 14 killed, including
+  the two a reviewer predicted would survive. Suite: 78 runs, 259 assertions.
+  Still uncovered, and recorded as such: `secretary.md` is prose, so deleting the
+  paragraph it gained passes all 14 mutants — as would deleting any other rule in
+  that file, since nothing in this SkillSet inspects what the secretary produces.
+
 ## [3.73.0] - 2026-08-17
 
 ### Fixed

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.73.0"
+  VERSION = "3.74.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/project_manager/lib/project_manager/store.rb

@@ -35,6 +35,12 @@ module ProjectManager
     def initialize(path: nil)
       @path = path || default_path
       @data = load_data
+      # The last state known to be writable, kept as generated JSON. A rollback
+      # restores from this rather than re-reading the file, so it cannot fail the
+      # way the write it undoes did — a store.json that has meanwhile become
+      # unreadable would otherwise leave the rollback with nothing to restore and
+      # the offending value still in place.
+      @committed = JSON.generate(@data)
     end
 
     def default_path
@@ -315,11 +321,50 @@ module ProjectManager
       { 'version' => 1, 'projects' => {}, 'items' => {}, 'attention_days' => {} }
     end
 
+    # The whole write is one unit — generation, mkdir, write, rename. Any failure
+    # restores the last state that reached disk and re-raises, so a caller reports
+    # a refused write instead of losing one. Before this, a value JSON cannot
+    # represent stayed in @data and every later save failed identically, so the
+    # store silently accepted nothing while each caller saw only its own error.
+    #
+    # Rollback discards everything in memory since the last successful save.
+    # Store's own mutators each end in save, so that is normally just the
+    # offending write — but `items`, `projects` and the fetch_* methods hand out
+    # the live hashes, and an edit written straight into one of those is discarded
+    # too. Records returned by this class are for reading; go through a mutator to
+    # keep a change.
+    #
+    # The guard belongs here rather than in apply_item_attrs: every writer passes
+    # through save, and an attribute-level check would leave project names,
+    # provenance entries and attention records unguarded.
+    #
+    # Two residuals, both raised in review and both left open because no current
+    # caller can reach them. Read these before adding a caller that does.
+    #
+    # 1. Rollback rebuilds @data, so a record handed out earlier by items,
+    #    projects or fetch_* is detached from the store afterwards: reads from it
+    #    go stale and writes into it reach nothing. Of the three tools that hold
+    #    a returned record, only pm_record holds one across a save, and it uses
+    #    the id string alone. A caller that keeps a record and edits it after a
+    #    refused write would need this to restore in place instead.
+    # 2. JSON.parse(@committed) is assumed to succeed. It does, because
+    #    @committed is only ever assigned the output of a generate that already
+    #    round-tripped, and tool arguments arrive parsed from JSON so no object
+    #    with its own to_json can enter. A value reaching @data from Ruby rather
+    #    than from a tool could break that.
     def save
-      FileUtils.mkdir_p(File.dirname(@path))
-      tmp = "#{@path}.tmp"
-      File.write(tmp, JSON.pretty_generate(@data))
-      File.rename(tmp, @path)
+      json = nil
+      begin
+        json = JSON.pretty_generate(@data)
+        FileUtils.mkdir_p(File.dirname(@path))
+        tmp = "#{@path}.tmp"
+        File.write(tmp, json)
+        File.rename(tmp, @path)
+      rescue StandardError
+        @data = JSON.parse(@committed)
+        raise
+      end
+      @committed = json
     end
   end
 end

data/templates/skillsets/project_manager/lib/project_manager/tool_helpers.rb

@@ -8,15 +8,54 @@ module ProjectManager
       @_pm_store ||= Store.new
     end
 
+    # Named so a test can point the reader at a file it wrote, and still drive
+    # the real pm_config rather than a stand-in for it.
+    def pm_config_path
+      File.expand_path('../../config/pm.yml', __dir__)
+    end
+
+    # pm.yml is the one file an operator is invited to edit, and `skillset
+    # upgrade` deliberately never overwrites it, so a bad edit is permanent
+    # rather than transient. YAML.safe_load_file is strict — a tab indent, an
+    # unclosed quote, a bare date, an &anchor and a :symbol each raise, five of
+    # five measured — and the raise happened here, one level above every guard
+    # the tools carry. One stray character took every pm tool out at once.
+    #
+    # A document that parses but is not a mapping is the same failure in another
+    # shape: it breaks the first caller that subscripts it. It is coerced here
+    # rather than at each call site, because a call-site guard is re-acquired by
+    # the next caller and pm_record's was never written.
+    #
+    # Falling back is not the whole fix. Defaults wearing the operator's settings
+    # are worse than the outage they replace, so the reason is kept and
+    # pm_config_error hands it to any caller that reports to a human.
     def pm_config
-      @_pm_config ||= begin
-        path = File.expand_path('../../config/pm.yml', __dir__)
-        File.exist?(path) ? (YAML.safe_load_file(path) || {}) : {}
-      end
+      return @_pm_config if defined?(@_pm_config)
+
+      @_pm_config_error = nil
+      loaded = File.exist?(pm_config_path) ? YAML.safe_load_file(pm_config_path) : {}
+      @_pm_config =
+        if loaded.is_a?(Hash)
+          loaded
+        else
+          # An empty file — no bytes, blank lines, or comments only — parses to
+          # nil, and that is the operator saying "no settings". Every other
+          # non-mapping is a mistake and is named, `false` included: it is an
+          # affirmative value that happens not to be a Hash, so treating it as
+          # emptiness would hand back defaults with nothing said.
+          @_pm_config_error = "pm.yml is #{loaded.class}, expected a mapping" unless loaded.nil?
+          {}
+        end
+    rescue StandardError => e
+      @_pm_config_error = "#{e.class}: #{e.message.to_s.lines.first.to_s.strip}"
+      @_pm_config = {}
     end
 
-    def pm_digest
-      Digest.new(pm_store, pm_config['digest'])
+    # nil when pm.yml was usable, or absent — absence is the documented default,
+    # not a failure. Otherwise, why the file was ignored.
+    def pm_config_error
+      pm_config
+      @_pm_config_error
     end
   end
 end

data/templates/skillsets/project_manager/plugin/agents/secretary.md

@@ -51,6 +51,13 @@ thresholds cannot be compared with yesterday's. If the operator asks for a diffe
 use it, and say in the report which value you used and that this report is not comparable to the
 default one.
 
+The digest reads those defaults from `pm.yml`, and that file can be unreadable — a stray tab, an
+unclosed quote, a bare date. When it is, the digest still answers, on built-in defaults rather than
+the operator's settings, and returns a `config_error` field saying why. **If that field is present,
+say so first, before the buckets**, and name the reason verbatim: this report was built on defaults,
+so it is not comparable to one built on the configured thresholds, and the settings file needs
+repair. Reporting the buckets without it presents defaults as though the operator had chosen them.
+
 The digest computes its buckets independently, so one item can appear in several of them. Report
 each item exactly once, in the first bucket that claims it, in this fixed order:
 

data/templates/skillsets/project_manager/skillset.json

@@ -1,6 +1,6 @@
 {
     "name": "project_manager",
-    "version": "0.6.0",
+    "version": "0.7.0",
     "description": "Project and work-item management: register projects and items, query them, produce a session-start digest with derived dormancy, and record irreversible project actions on the attestation chain. Ships a secretary-persona sub-agent (plugin/agents) so the secretarial disposition runs in its own context under any instruction mode, and a read-only scan (scripts/l2_scan.py) that reports, per item, what has recently been written near it in the L2 context store. The scan claims no attribution: tags name subjects and items name work that remains, so its output is evidence for the operator to judge. scripts/pm_l2_report.py renders the same comparison as one HTML page under <data dir>/log/ and is declared as a SessionStart hook in plugin/hooks.json, so a projected instance sees the memo-versus-L2 drift once per session. It takes no output path, which is how it is read-only: nothing can aim a write at the memo, the mapping, or an L2 context. When the authored mapping has nothing for an item, its search terms are inferred from the item's own title and notes, so L2 is never asked to be relabelled; inference accepts only a document name or an underscored identifier, caps both the reach of each term and the size of the row's whole result, and refuses rather than truncates when the row would be too broad. A row without a comparison names which of five things is missing, distinguishing an unreadable L2 date from an unreadable memo marker, because they blame different files. Holds an attention record: per closed judgment it stores what the operator was asked for, how long the shown text was, and the operators own answer to whether it was understood in one pass, plus a daily declaration of how many judgments the day has room for. The self-report is the calibrating measurement and may never be filled in by the agent that produced the output. Designs: docs/drafts/project_manager_plugin_projection_draft_v0.7_FROZEN.md and docs/drafts/project_manager_l2_derivation_draft_v0.12.md.",
     "author": "Masaomi Hatakeyama",
     "layer": "L1",

data/templates/skillsets/project_manager/test/test_project_manager.rb

@@ -795,3 +795,335 @@ class TestProjectManagerAttention < Minitest::Test
     assert_match(/invalid attention kind/, out['error'])
   end
 end
+
+# The write side (2026-08-18). Every guard in this SkillSet used to sit on the
+# reading side — parse_time, whole_number, the config containers — and a value
+# that cannot be turned into JSON walked straight past all of them. Generation
+# failed before File.write, so the file survived and @data did not: the bad value
+# stayed in memory and every later save failed identically, which read to the
+# caller as one error and to the store as a permanent refusal to record anything.
+class TestProjectManagerStoreWriteGuard < Minitest::Test
+  # Valid Ruby strings and numbers that JSON cannot represent. Both arrive
+  # through ordinary tool arguments; neither is caught by the status/salience
+  # enum checks, which are the only write-side validation that existed.
+  LONE_SURROGATE = "bad\xED\xA0\x80title".dup.force_encoding('UTF-8')
+
+  def setup
+    @dir = Dir.mktmpdir
+    @path = File.join(@dir, 'store.json')
+    @store = ProjectManager::Store.new(path: @path)
+    @now = Time.utc(2026, 8, 18, 12, 0, 0)
+    @prj = @store.register_project(name: 'p', now: @now)
+    @kept = @store.add_item(project_id: @prj['id'], title: 'kept', now: @now)
+  end
+
+  def teardown
+    FileUtils.remove_entry(@dir)
+  end
+
+  def on_disk
+    JSON.parse(File.read(@path))
+  end
+
+  def test_an_unwritable_title_is_refused_rather_than_written
+    assert_raises(JSON::GeneratorError) do
+      @store.add_item(project_id: @prj['id'], title: LONE_SURROGATE, now: @now)
+    end
+  end
+
+  # The defect proper: not that the bad write failed, but that every good write
+  # after it failed too, on disk and in memory, without anything saying so.
+  def test_the_store_still_accepts_writes_after_a_refused_one
+    begin
+      @store.add_item(project_id: @prj['id'], title: LONE_SURROGATE, now: @now)
+    rescue JSON::GeneratorError
+      nil
+    end
+
+    later = @store.add_item(project_id: @prj['id'], title: 'written after', now: @now)
+    assert_equal 'written after', @store.fetch_item(later['id'])['title']
+    assert_equal 2, on_disk['items'].size, 'the good writes reached disk'
+    assert_equal %w[kept written\ after].sort,
+                 on_disk['items'].values.map { |i| i['title'] }.sort
+  end
+
+  # A refused write must not survive in memory either, or a reader counts items
+  # that were never recorded — which is how the digest reported phantom work.
+  def test_a_refused_write_leaves_nothing_behind_in_memory
+    begin
+      @store.add_item(project_id: @prj['id'], title: LONE_SURROGATE, now: @now)
+    rescue JSON::GeneratorError
+      nil
+    end
+
+    assert_equal 1, @store.items.size
+    assert_equal 'kept', @store.items.first['title']
+    refute_includes @store.items.map { |i| i['title'] }, LONE_SURROGATE
+  end
+
+  # Infinity reaches JSON through any numeric field and fails generation the same
+  # way. Different value, same path, so it must be refused by the same guard
+  # rather than by a check written for strings.
+  def test_an_unrepresentable_number_is_refused_the_same_way
+    assert_raises(JSON::GeneratorError) do
+      @store.update_item(@kept['id'], { 'notes' => Float::INFINITY }, now: @now)
+    end
+    assert_equal 1, @store.items.size
+    @store.update_item(@kept['id'], { 'notes' => 'fine' }, now: @now)
+    assert_equal 'fine', on_disk['items'][@kept['id']]['notes']
+  end
+
+  # Rolling back restores @committed, which advances only after a write finishes.
+  # An earlier write that had been accepted must therefore survive the rollback of
+  # a later refused one.
+  def test_rollback_does_not_discard_an_earlier_accepted_write
+    @store.update_item(@kept['id'], { 'salience' => 'high' }, now: @now)
+    begin
+      @store.add_item(project_id: @prj['id'], title: LONE_SURROGATE, now: @now)
+    rescue JSON::GeneratorError
+      nil
+    end
+    assert_equal 'high', @store.fetch_item(@kept['id'])['salience']
+    assert_equal 'high', on_disk['items'][@kept['id']]['salience']
+  end
+
+  # A failure after generation — no space, a read-only directory, a rename that
+  # cannot complete — leaves the same poisoned @data as a generation failure did.
+  # Guarding only generation would let a write reported as failed reappear in the
+  # next successful save.
+  def test_a_failure_after_generation_rolls_back_too
+    File.chmod(0o500, @dir)
+    begin
+      assert_raises(SystemCallError) do
+        @store.add_item(project_id: @prj['id'], title: 'never written', now: @now)
+      end
+    ensure
+      File.chmod(0o700, @dir)
+    end
+
+    assert_equal 1, @store.items.size, 'the refused write stayed in memory'
+    refute_includes @store.items.map { |i| i['title'] }, 'never written'
+    @store.add_item(project_id: @prj['id'], title: 'after', now: @now)
+    assert_equal %w[after kept], on_disk['items'].values.map { |i| i['title'] }.sort
+  end
+
+  # Rollback restores from an in-memory copy of the last written state, not from
+  # the file. Re-reading would fail exactly when it is needed most — a store.json
+  # that has become unreadable would leave the bad value in place and wedge the
+  # process, which is the defect this guard exists to remove.
+  def test_rollback_survives_an_unreadable_file_on_disk
+    File.write(@path, 'not json at all')
+    begin
+      @store.add_item(project_id: @prj['id'], title: LONE_SURROGATE, now: @now)
+    rescue JSON::GeneratorError
+      nil
+    end
+    assert_equal 1, @store.items.size
+    assert_equal 'kept', @store.items.first['title']
+  end
+
+  # Honest boundary, pinned so it cannot be quietly claimed otherwise: rollback
+  # drops everything in memory since the last successful save, and the fetch_*
+  # methods hand out the live hash, so an edit written straight into one is
+  # dropped as well. Go through a mutator to keep a change.
+  def test_an_edit_written_straight_into_a_returned_record_is_discarded
+    @store.fetch_item(@kept['id'])['assignee'] = 'written behind the mutators'
+    begin
+      @store.add_item(project_id: @prj['id'], title: LONE_SURROGATE, now: @now)
+    rescue JSON::GeneratorError
+      nil
+    end
+    refute @store.fetch_item(@kept['id']).key?('assignee'),
+           'the direct edit survived a rollback the comment says discards it'
+  end
+
+  # The guard sits in save, not in the item attribute path, so writes that never
+  # touch an item attribute are covered too.
+  def test_a_project_name_is_covered_by_the_same_guard
+    assert_raises(JSON::GeneratorError) do
+      @store.update_project(@prj['id'], { 'name' => LONE_SURROGATE }, now: @now)
+    end
+    assert_equal 'p', @store.fetch_project(@prj['id'])['name']
+    @store.update_project(@prj['id'], { 'name' => 'renamed' }, now: @now)
+    assert_equal 'renamed', on_disk['projects'][@prj['id']]['name']
+  end
+end
+
+load File.expand_path('../tools/pm_record.rb', __dir__)
+
+# pm.yml is the only file an operator is invited to edit and `skillset upgrade`
+# never repairs it, so a bad edit is permanent. safe_load_file is strict and the
+# raise landed above every guard the tools carry, so one stray tab returned an
+# error from every pm tool at once.
+class TestPmConfigReadGuard < Minitest::Test
+  # Ordinary edits, each measured to raise a different Psych error.
+  BAD_YAML = {
+    'tab indent' => "digest:\n\tapproaching_days: 7\n",
+    'unclosed quote' => "digest:\n  approaching_days: 'oops\n",
+    'bare date' => "when: 2026-08-18\n",
+    'anchor and alias' => "a: &x 1\nb: *x\n",
+    'symbol' => "k: :sym\n"
+  }.freeze
+
+  def setup
+    @dir = Dir.mktmpdir
+    @path = File.join(@dir, 'pm.yml')
+  end
+
+  def teardown
+    FileUtils.remove_entry(@dir)
+  end
+
+  # A fresh host each time: pm_config memoises, which is the point of it.
+  def host(write: nil)
+    File.write(@path, write) unless write.nil?
+    path = @path
+    obj = Object.new
+    obj.extend(ProjectManager::ToolHelpers)
+    obj.define_singleton_method(:pm_config_path) { path }
+    obj
+  end
+
+  def test_an_unreadable_file_falls_back_to_defaults_instead_of_raising
+    BAD_YAML.each do |label, body|
+      h = host(write: body)
+      assert_equal({}, h.pm_config, "#{label} did not fall back")
+      refute_nil h.pm_config_error, "#{label} fell back without saying why"
+    end
+  end
+
+  # Falling back silently would hand the operator thresholds nobody chose and
+  # call them settings. The reason has to name the failure, not just exist.
+  def test_the_reason_names_the_failure
+    assert_match(/Psych::SyntaxError/, host(write: BAD_YAML['tab indent']).pm_config_error)
+    assert_match(/Psych::DisallowedClass/, host(write: BAD_YAML['bare date']).pm_config_error)
+  end
+
+  # A document that parses but is not a mapping breaks the first caller that
+  # subscripts it — pm_record has no guard of its own.
+  def test_a_non_mapping_document_is_coerced_and_reported
+    ['just a string', "- 1\n- 2\n", '42'].each do |body|
+      h = host(write: body)
+      assert_equal({}, h.pm_config, "#{body.inspect} was not coerced")
+      refute_nil h.pm_config_error, "#{body.inspect} was coerced silently"
+    end
+  end
+
+  def test_an_absent_or_empty_file_is_not_a_failure
+    assert_equal({}, host.pm_config)
+    assert_nil host.pm_config_error, 'an absent file is the documented default'
+
+    # All three parse to nil, so emptiness is recognised by the parse result and
+    # nothing else has to be exempted from the non-mapping report.
+    ['', "\n", "# only a comment\n"].each do |body|
+      h = host(write: body)
+      assert_equal({}, h.pm_config)
+      assert_nil h.pm_config_error, "#{body.inspect} is the operator saying \"no settings\""
+    end
+  end
+
+  # `false` parses, is not a mapping, and is not emptiness. Exempting it would
+  # hand back defaults with nothing said — the failure this guard exists to stop.
+  def test_a_literal_false_is_reported_rather_than_read_as_emptiness
+    h = host(write: "false\n")
+    assert_equal({}, h.pm_config)
+    refute_nil h.pm_config_error, 'literal false was swallowed as "no settings"'
+    assert_match(/FalseClass/, h.pm_config_error)
+  end
+
+  # The guard must not eat a good file: the shipped pm.yml has to survive it.
+  def test_a_usable_file_is_read_and_reports_nothing
+    h = host(write: "digest:\n  dormancy_days: 30\nrecord_ttl_seconds: 99\n")
+    assert_equal 30, h.pm_config['digest']['dormancy_days']
+    assert_equal 99, h.pm_config['record_ttl_seconds']
+    assert_nil h.pm_config_error
+  end
+
+  def test_the_shipped_pm_yml_is_readable
+    shipped = File.expand_path('../config/pm.yml', __dir__)
+    h = host
+    h.define_singleton_method(:pm_config_path) { shipped }
+    assert_nil h.pm_config_error, 'the file this SkillSet ships must pass its own guard'
+    assert_equal 14, h.pm_config['digest']['dormancy_days']
+  end
+
+  # The tool is the path an agent actually takes. It must answer, and it must
+  # carry the reason rather than presenting defaults as the operator's settings.
+  def test_the_digest_tool_answers_and_carries_the_reason
+    dir = Dir.mktmpdir
+    store = ProjectManager::Store.new(path: File.join(dir, 'store.json'))
+    prj = store.register_project(name: 'p', now: Time.utc(2026, 8, 18))
+    store.add_item(project_id: prj['id'], title: 'ember',
+                   now: Time.utc(2026, 8, 18) - (40 * 86_400), salience: 'high')
+
+    File.write(@path, BAD_YAML['tab indent'])
+    path = @path
+    t = KairosMcp::SkillSets::ProjectManagerSkillSet::Tools::PmDigest.allocate
+    t.define_singleton_method(:pm_config_path) { path }
+    t.define_singleton_method(:pm_store) { store }
+
+    out = JSON.parse(t.call({}))
+    refute out.key?('error'), "an unreadable pm.yml still took the tool down: #{out['error'].inspect}"
+    assert_equal 1, out['dormant_neglected'].size, 'the defaults still produced a digest'
+    assert_match(/Psych::SyntaxError/, out['config_error'].to_s)
+  ensure
+    FileUtils.remove_entry(dir) if dir
+  end
+
+  def test_the_digest_tool_says_nothing_when_the_file_is_fine
+    dir = Dir.mktmpdir
+    store = ProjectManager::Store.new(path: File.join(dir, 'store.json'))
+    store.register_project(name: 'p', now: Time.utc(2026, 8, 18))
+
+    File.write(@path, "digest:\n  dormancy_days: 14\n")
+    path = @path
+    t = KairosMcp::SkillSets::ProjectManagerSkillSet::Tools::PmDigest.allocate
+    t.define_singleton_method(:pm_config_path) { path }
+    t.define_singleton_method(:pm_store) { store }
+
+    out = JSON.parse(t.call({}))
+    refute out.key?('config_error'), 'a healthy file must not be reported as ignored'
+  ensure
+    FileUtils.remove_entry(dir) if dir
+  end
+
+  # pm_record reads the record ttl from the same file, and its records are meant
+  # to be permanent. A silent default there would tell an operator who shortened
+  # the ttl that their value was applied when it was not.
+  def record_tool(store)
+    path = @path
+    t = KairosMcp::SkillSets::ProjectManagerSkillSet::Tools::PmRecord.allocate
+    t.define_singleton_method(:pm_config_path) { path }
+    t.define_singleton_method(:pm_store) { store }
+    t.define_singleton_method(:issue_attestation) { |_project, _args| { proof_id: 'proof_1' } }
+    t
+  end
+
+  def test_the_record_tool_carries_the_reason
+    dir = Dir.mktmpdir
+    store = ProjectManager::Store.new(path: File.join(dir, 'store.json'))
+    prj = store.register_project(name: 'p', now: Time.utc(2026, 8, 18))
+
+    File.write(@path, BAD_YAML['bare date'])
+    out = JSON.parse(record_tool(store).call({ 'project_id' => prj['id'],
+                                               'action' => 'shipped', 'summary' => 's' }))
+    refute out.key?('error'), "an unreadable pm.yml took pm_record down: #{out['error'].inspect}"
+    assert_equal true, out['recorded']
+    assert_match(/Psych::DisallowedClass/, out['config_error'].to_s)
+  ensure
+    FileUtils.remove_entry(dir) if dir
+  end
+
+  def test_the_record_tool_says_nothing_when_the_file_is_fine
+    dir = Dir.mktmpdir
+    store = ProjectManager::Store.new(path: File.join(dir, 'store.json'))
+    prj = store.register_project(name: 'p', now: Time.utc(2026, 8, 18))
+
+    File.write(@path, "record_ttl_seconds: 99\n")
+    out = JSON.parse(record_tool(store).call({ 'project_id' => prj['id'],
+                                               'action' => 'shipped', 'summary' => 's' }))
+    refute out.key?('config_error'), 'a healthy file must not be reported as ignored'
+  ensure
+    FileUtils.remove_entry(dir) if dir
+  end
+end

data/templates/skillsets/project_manager/tools/pm_digest.rb

@@ -59,7 +59,14 @@ module KairosMcp
             config['dormancy_days'] = arguments['dormancy_days'] if arguments['dormancy_days']
             config['approaching_days'] = arguments['approaching_days'] if arguments['approaching_days']
             digest = ::ProjectManager::Digest.new(pm_store, config)
-            text_content(JSON.pretty_generate(digest.compute))
+            out = digest.compute
+            # An unreadable pm.yml no longer takes this tool down, and that is
+            # only half a fix: defaults that look like the operator's settings
+            # are worse than the outage. The reason travels with the digest so
+            # the consumer says the file was ignored instead of reporting
+            # thresholds nobody chose.
+            out[:config_error] = pm_config_error if pm_config_error
+            text_content(JSON.pretty_generate(out))
           rescue StandardError => e
             text_content(JSON.pretty_generate({ error: e.message }))
           end

data/templates/skillsets/project_manager/tools/pm_record.rb

@@ -83,10 +83,14 @@ module KairosMcp
               pm_store.update_project(project['id'], { 'status' => arguments['apply_project_status'] })
             end
 
-            text_content(JSON.pretty_generate({
-              recorded: true, action: arguments['action'],
-              project_id: project['id'], attestation: attestation
-            }))
+            out = { recorded: true, action: arguments['action'],
+                    project_id: project['id'], attestation: attestation }
+            # The ttl above comes from pm.yml. When that file cannot be read the
+            # default stands in for it silently, so an operator who shortened the
+            # ttl would believe their value was applied to a record that is
+            # meant to be permanent. The reason travels with the receipt.
+            out[:config_error] = pm_config_error if pm_config_error
+            text_content(JSON.pretty_generate(out))
           rescue StandardError => e
             text_content(JSON.pretty_generate({ error: e.message }))
           end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kairos-chain
 version: !ruby/object:Gem::Version
-  version: 3.73.0
+  version: 3.74.0
 platform: ruby
 authors:
 - Masaomi Hatakeyama