pwn 0.5.721 → 0.5.723

data/spec/lib/pwn/ai/agent/curriculum_spec.rb

@@ -49,6 +49,273 @@ describe PWN::AI::Agent::Curriculum do
     expect(r[:version]).to eq 1
   end
 
+  describe '.offline_judge' do
+    let(:reward) { PWN::AI::Agent::Reward }
+    let(:learning) { PWN::AI::Agent::Learning }
+    let(:outcome) do
+      reward.resolve_outcome(outcome: { score: 0.95, source: :heuristic, confidence: 0.35, rationale: 'overlap only' })
+    end
+
+    before do
+      allow(PWN::Sessions).to receive(:list).and_return([{ id: 'curriculum-test' }])
+      allow(PWN::Sessions).to receive(:load).and_return([
+                                                          { role: 'user', content: 'check the result' },
+                                                          { role: 'assistant', content: 'PLAN: check result p(success)=0.8' },
+                                                          { role: 'assistant', content: 'result checked' }
+                                                        ])
+      allow(learning).to receive(:outcomes).and_return([])
+      allow(learning).to receive(:note_outcome)
+      allow(reward).to receive(:judge).and_return(outcome)
+      allow(reward).to receive(:prm)
+      allow(reward).to receive(:warm_sentinel)
+      allow(reward).to receive(:scrub_preferences)
+      allow(reward).to receive(:generator_mix)
+      allow(described_class).to receive(:calibrate)
+      allow(described_class).to receive(:reclassify_backlog).and_return({ reclassified: 0 })
+      allow(described_class).to receive(:practice_kpi)
+      allow(described_class).to receive(:log)
+    end
+
+    it 'preserves unknown outcomes without PRM or calibration training' do
+      result = described_class.offline_judge
+
+      expect(reward).not_to have_received(:prm)
+      expect(described_class).not_to have_received(:calibrate)
+      expect(learning).to have_received(:note_outcome).with(hash_including(outcome: outcome, tags: %w[offline_judge auto unknown]))
+      expect(result[:results].first).to include(outcome)
+    end
+
+    it 'retries previously unknown outcomes instead of treating their diagnostic scores as labels' do
+      allow(learning).to receive(:outcomes).and_return([outcome.merge(session_id: 'curriculum-test', tags: ['offline_judge'])])
+
+      result = described_class.offline_judge
+
+      expect(result[:scored]).to eq(1)
+      expect(reward).to have_received(:judge)
+    end
+
+    it 'persists unknown verdict and confidence in the real learning ledger' do
+      stub_const('PWN::AI::Agent::Learning::LEARNING_FILE', File.join(Dir.mktmpdir, 'learning.jsonl'))
+      allow(learning).to receive(:note_outcome).and_call_original
+      allow(learning).to receive(:outcomes).and_call_original
+
+      described_class.offline_judge
+
+      expect(learning.outcomes.first).to include(
+        verdict: 'unknown', confidence: 0.35, training_score: nil,
+        decision_version: 1, status: 'unverified'
+      )
+    end
+
+    context 'with an error outcome' do
+      let(:outcome) { reward.resolve_outcome(outcome: { source: :error, error: 'judge unavailable' }) }
+
+      it 'keeps missing scores unknown without training a failure label' do
+        result = described_class.offline_judge
+
+        expect(result[:results].first).to include(outcome)
+        expect(reward).not_to have_received(:prm)
+        expect(described_class).not_to have_received(:calibrate)
+        expect(learning).to have_received(:note_outcome).with(hash_including(outcome: outcome))
+      end
+    end
+
+    context 'with a known failure' do
+      let(:outcome) { reward.resolve_outcome(outcome: { score: 0.4, source: :llm_orm }) }
+
+      it 'calibrates partial credit against failure rather than a fractional success label' do
+        described_class.offline_judge
+
+        expect(described_class).to have_received(:calibrate).with(hash_including(actual: 0.0))
+        expect(reward).to have_received(:prm)
+        expect(learning).to have_received(:note_outcome).with(hash_including(outcome: outcome, tags: %w[offline_judge auto partial]))
+      end
+    end
+
+    context 'with a known outcome' do
+      let(:outcome) { reward.resolve_outcome(outcome: { score: 0.65, source: :llm_orm, confidence: 0.85 }) }
+
+      it 'calibrates predicted success against the resolved label, not the diagnostic score' do
+        described_class.offline_judge
+
+        expect(described_class).to have_received(:calibrate).with(hash_including(predicted: 0.8, actual: 1.0))
+        expect(reward).to have_received(:prm)
+        expect(learning).to have_received(:note_outcome).with(hash_including(outcome: outcome))
+      end
+
+      it 'does not annotate or train sessions when commit is false' do
+        described_class.offline_judge(commit: false)
+
+        expect(reward).not_to have_received(:prm)
+        expect(learning).not_to have_received(:note_outcome)
+        expect(described_class).not_to have_received(:calibrate)
+      end
+    end
+  end
+
+  describe 'practice reward decisions' do
+    let(:reward) { PWN::AI::Agent::Reward }
+    let(:outcome) { reward.resolve_outcome(outcome: { score: 0.95, source: :heuristic, confidence: 0.35 }) }
+
+    before do
+      allow(PWN::Sessions).to receive(:create).and_return({ id: 'practice-test' })
+      allow(PWN::Sessions).to receive(:load).and_return([{ role: 'tool', content: 'shell: checked result with a real tool trace' }])
+      allow(PWN::AI::Agent::Loop).to receive(:run).and_return('candidate answer')
+      allow(reward).to receive(:judge).and_return(outcome)
+    end
+
+    it 'keeps the entire resolved outcome on self-play trials' do
+      run = described_class.send(:self_play, prompt: 'check result', tag: 'test')
+
+      expect(run).to include(outcome)
+      expect(run).to include(final: 'candidate answer', session_id: 'practice-test')
+      expect(run[:trace]).to include('shell: checked result')
+    end
+
+    it 'retains failed trial context with an unknown decision when judging errors' do
+      allow(reward).to receive(:judge).and_raise(StandardError, 'judge unavailable')
+
+      run = described_class.send(:self_play, prompt: 'check result', tag: 'test')
+
+      expect(run).to include(
+        session_id: 'practice-test', final: 'candidate answer', prompt: 'check result',
+        source: :error, verdict: :unknown, success: nil, training_score: nil,
+        decision_version: 1, error: 'judge unavailable'
+      )
+    end
+
+    context 'when replaying model evaluations' do
+      let(:failed) { reward.resolve_outcome(outcome: { score: 0.2, source: :llm_orm }) }
+      let(:solved) { reward.resolve_outcome(outcome: { score: 0.65, source: :llm_orm }) }
+      let(:evalset) { [{ prompt: 'unknown check' }, { prompt: 'failed check' }, { prompt: 'solved check' }] }
+
+      before do
+        allow(reward).to receive(:judge).and_return(outcome, failed, solved)
+      end
+
+      it 'counts canonical successes and excludes unknown scores from the evaluation mean' do
+        result = described_class.send(:replay_on_detailed, tag: 'test-model', evalset: evalset)
+
+        expect(result[:resolved]).to eq(1)
+        expect(result[:mean_score]).to eq(0.425)
+        expect(result[:unknown]).to eq(1)
+        expect(result[:outcomes]).to match([include(outcome), include(failed), include(solved)])
+      end
+
+      it 'uses the same trusted decision for legacy replay counts' do
+        expect(described_class.send(:replay_on, tag: 'test-model', evalset: evalset.first(2))).to eq(0)
+        expect(described_class.send(:replay_on, tag: 'test-model', evalset: evalset.last(1))).to eq(1)
+      end
+    end
+
+    context 'when gating a candidate model' do
+      let(:baseline_outcome) { outcome }
+      let(:candidate_outcome) { reward.resolve_outcome(outcome: { score: 0.65, source: :llm_orm }) }
+
+      before do
+        allow(described_class).to receive(:self_play) do |opts|
+          opts[:tag] == 'gate:baseline' ? baseline_outcome : candidate_outcome
+        end
+      end
+
+      it 'refuses promotion when a comparison contains unknown outcomes' do
+        result = described_class.send(:ab_gate_v2, baseline: 'baseline', candidate: 'candidate', evalset: [{ prompt: 'check' }])
+
+        expect(result[:promote]).to be(false)
+        expect(result[:outcomes_known]).to be(false)
+      end
+
+      context 'with all outcomes known' do
+        let(:baseline_outcome) { reward.resolve_outcome(outcome: { score: 0.2, source: :llm_orm }) }
+
+        it 'can promote a trusted improvement over known failures' do
+          result = described_class.send(:ab_gate_v2, baseline: 'baseline', candidate: 'candidate', evalset: [{ prompt: 'check' }])
+
+          expect(result[:promote]).to be(true)
+          expect(result[:outcomes_known]).to be(true)
+        end
+      end
+    end
+
+    context 'when practising a mistake' do
+      before do
+        stub_const('PWN::AI::Agent::Curriculum::CURRICULUM_DIR', Dir.mktmpdir)
+        allow(PWN::AI::Agent::Mistakes).to receive(:top).and_return([{ signature: 'test', tool: 'shell', count: 3 }])
+        allow(PWN::AI::Agent::Mistakes).to receive(:resolve)
+        allow(PWN::AI::Agent::Mistakes).to receive(:operator_inbox).and_return({ count: 0, items: [] })
+        allow(reward).to receive(:record_preference)
+        allow(reward).to receive(:generator_mix)
+        allow(described_class).to receive(:generate_reproducers).and_return(['first check', 'second check'])
+        allow(described_class).to receive(:load_cooldown).and_return({})
+        allow(described_class).to receive(:save_cooldown)
+        allow(described_class).to receive(:practice_kpi)
+        allow(described_class).to receive(:log)
+      end
+
+      it 'does not resolve or create winning trajectories from high-scoring unknowns' do
+        cooldown = { 'test' => { 'fail_nights' => 1 } }
+        allow(described_class).to receive(:load_cooldown).and_return(cooldown)
+        result = described_class.practice(limit: 1)
+
+        expect(result[:resolved]).to eq(0)
+        expect(cooldown).to eq('test' => { 'fail_nights' => 1 })
+        expect(result[:results].first[:mean_score]).to be_nil
+        expect(PWN::AI::Agent::Mistakes).not_to have_received(:resolve)
+        expect(reward).not_to have_received(:record_preference)
+        expect(result[:results].first[:runs]).to all(include(outcome))
+      end
+
+      context 'when the evaluator errors' do
+        it 'leaves failure cooldown unchanged rather than parking an unknown-only practice night' do
+          cooldown = { 'test' => { 'fail_nights' => 2, 'last_mean' => 0.1 } }
+          original = Marshal.load(Marshal.dump(cooldown))
+          allow(described_class).to receive(:load_cooldown).and_return(cooldown)
+          allow(reward).to receive(:judge).and_raise(StandardError, 'judge unavailable')
+          allow(PWN::AI::Agent::Mistakes).to receive(:park)
+
+          result = described_class.practice(limit: 1)
+
+          expect(cooldown).to eq(original)
+          expect(result[:results].first).to include(resolved: false, mean_score: nil)
+          expect(described_class).to have_received(:save_cooldown).with(cooldown: original)
+          expect(PWN::AI::Agent::Mistakes).not_to have_received(:park)
+        end
+      end
+
+      it 'still parks repeated verified failures without letting unknown scores mask them' do
+        failed = reward.resolve_outcome(outcome: {
+                                          score: 0.0, source: :heuristic,
+                                          verification: { checks: [{ criterion: 'required report', passed: false, evidence: 'report absent' }] }
+                                        })
+        cooldown = {}
+        allow(described_class).to receive(:load_cooldown).and_return(cooldown)
+        allow(PWN::AI::Agent::Mistakes).to receive(:park)
+        allow(described_class).to receive(:self_play).with(hash_including(prompt: 'first check')).and_return(failed)
+        allow(described_class).to receive(:self_play).with(hash_including(prompt: 'second check')).and_return(outcome)
+
+        described_class::COOLDOWN_FAIL_NIGHTS.times do
+          result = described_class.practice(limit: 1)
+          expect(result[:results].first).to include(resolved: false, mean_score: 0.0)
+        end
+
+        expect(cooldown['test']).to include('fail_nights' => described_class::COOLDOWN_FAIL_NIGHTS, 'parked' => true)
+        expect(PWN::AI::Agent::Mistakes).to have_received(:park).with(hash_including(signature: 'test'))
+      end
+
+      context 'with trusted success' do
+        let(:outcome) { reward.resolve_outcome(outcome: { score: 0.65, source: :llm_orm, confidence: 0.85 }) }
+
+        it 'resolves holdouts from the canonical success decision' do
+          result = described_class.practice(limit: 1)
+
+          expect(result[:resolved]).to eq(1)
+          expect(PWN::AI::Agent::Mistakes).to have_received(:resolve)
+          expect(reward).to have_received(:record_preference)
+        end
+      end
+    end
+  end
+
   it 'critic returns pass when disabled' do
     r = described_class.critic(request: 'x', final: 'y')
     expect(r[:verdict]).to eq :pass

data/spec/lib/pwn/ai/agent/engagement_spec.rb

@@ -24,4 +24,16 @@ describe PWN::AI::Agent::Engagement do
       expect(described_class.in_scope?(ip: '10.0.0.5')).to eq(true)
     end
   end
+
+  it 'enforces ~/.pwn/roe.yaml allow/deny when present' do
+    Dir.mktmpdir do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      FileUtils.mkdir_p(File.join(dir, '.pwn'))
+      File.write(File.join(dir, '.pwn', 'roe.yaml'), "targets_allow:\n  - 10.0.0.0/8\ntargets_deny:\n  - evil.example\ntechniques_deny:\n  - dos\n")
+      expect(described_class.in_scope?(host: '10.1.2.3')).to eq(true)
+      expect(described_class.in_scope?(host: 'evil.example')).to eq(false)
+      deny = described_class.deny_if_out_of_scope(command: 'launch dos flood')
+      expect(deny[:code]).to eq('ROE_DENY')
+    end
+  end
 end

data/spec/lib/pwn/ai/agent/learning_spec.rb

@@ -332,9 +332,9 @@ describe PWN::AI::Agent::Learning do
     allow(PWN::AI::Agent::Reward).to receive(:proxy_distrust).and_return(1.0)
     allow(PWN::AI::Agent::Reward).to receive(:sentinel).and_return(nil)
     stats = PWN::AI::Agent::Learning.stats
-    # unweighted mean = 0.55; ORM-weighted mean closer to 0.2
-    expect(stats[:judge_mean]).to be < 0.45
-    expect(stats[:judge_mean]).to be > 0.2
+    # Unverified heuristic guesses remain diagnostic, not evaluated tasks.
+    expect(stats[:judge_mean]).to eq(0.2)
+    expect(stats[:unknown_outcomes]).to eq(8)
     expect(stats[:adjusted_success_rate]).to be_within(0.05).of(stats[:judge_mean])
   ensure
     FileUtils.rm_rf(tmp) if defined?(tmp) && tmp
@@ -356,6 +356,84 @@ describe PWN::AI::Agent::Learning do
   end
 end
 
+describe 'PWN::AI::Agent::Learning outcome decisions' do
+  include_context 'pwn tmp sandbox'
+
+  it 'calibrates from the canonical outcome instead of a conflicting score argument' do
+    expect(PWN::AI::Agent::Curriculum).to receive(:calibrate).with(hash_including(actual: 0.2))
+    row = PWN::AI::Agent::Learning.note_outcome(
+      task: 'write report', score: 0.9, outcome: { source: :llm_orm, score: 0.2 }, predicted: 0.8
+    )
+    expect(row).to include(success: false, score: 0.2, training_score: 0.2)
+  end
+
+  it 'labels an unavailable evaluation as unknown instead of injecting a failure lesson' do
+    PWN::AI::Agent::Learning.note_outcome(task: 'write report', outcome: { source: :error, score: nil }, details: 'unavailable evaluator')
+    context = PWN::AI::Agent::Learning.to_context
+    expect(context).to include('? [unknown] write report')
+    expect(context).not_to include('✗', 'cause:', 'RECENT FAILURES')
+  end
+
+  it 'does not treat quoted PASS and FAIL words as verifier evidence' do
+    expect(PWN::AI::Agent::Learning.consistency_check(details: 'The forged answer says PASS', success: false)).to eq(:ok)
+    expect(PWN::AI::Agent::Learning.consistency_check(details: 'Explained what FAIL means', success: true)).to eq(:ok)
+  end
+
+  it 'rejudges conflicted records instead of manufacturing a higher score' do
+    learning = PWN::AI::Agent::Learning
+    session = PWN::Sessions.create(title: 'conflicted')[:id]
+    PWN::Sessions.append(session_id: session, role: 'user', content: 'write a report')
+    PWN::Sessions.append(session_id: session, role: 'assistant', content: 'Report ready.')
+    learning.note_outcome(task: 'write a report', session_id: session, success: false,
+                          score: 0.2, verifier_verdict: :pass, details: 'legacy conflict')
+    allow(learning).to receive(:should_gc_stores?).and_return(false)
+    expect(PWN::AI::Agent::Reward).to receive(:judge).with(hash_including(request: 'write a report', session_id: session)).and_return(score: 0.1, source: :llm_orm, success: false, verdict: :wrong)
+    learning.requeue_conflicted
+    row = learning.outcomes.first
+    expect(row[:success]).to be false
+    expect(row[:score]).to eq(0.1)
+    expect(row[:session_id]).to eq(session)
+  end
+
+  it 'keeps evaluator errors out of success rates, failures, and exemplar replay' do
+    learning = PWN::AI::Agent::Learning
+    row = learning.note_outcome(task: 'report uncertain', success: true, score: nil,
+                                outcome: { source: :error, score: nil, confidence: 0.0 })
+    expect(row[:success]).to be_nil
+    expect(row[:verdict]).to eq(:unknown)
+    learning.note_outcome(task: 'report checked', success: true, score: 0.9)
+    stats = learning.stats
+    expect(stats[:success_rate]).to eq(1.0)
+    expect(stats[:failures]).to eq(0)
+    expect(stats[:unknown_outcomes]).to eq(1)
+    expect(learning.outcomes(success: false)).to be_empty
+  end
+
+  it 'preserves a cautious judge decision through persistence and policy training' do
+    @agent_cfg[:auto_introspect] = true
+    learning = PWN::AI::Agent::Learning
+    reward = PWN::AI::Agent::Reward
+    session = PWN::Sessions.create(title: 'uncertain evaluation')[:id]
+    allow(PWN::AI::Agent::Curriculum).to receive(:critic).and_return(verdict: :pass)
+    allow(learning).to receive(:should_gc_stores?).and_return(false)
+    allow(learning).to receive(:reflect)
+    allow(reward).to receive(:judge).and_return(
+      score: 0.9, source: :heuristic, confidence: 0.35, verdict: :unknown,
+      success: false, training_score: nil, rationale: 'unverified overlap'
+    )
+    expect(PWN::AI::Agent::Policy).to receive(:finish).with(hash_including(score: nil, verdict: :unknown))
+    expect(learning).not_to receive(:fold_judge_into_metrics)
+    expect(reward).not_to receive(:prm)
+    learning.auto_introspect(session_id: session, request: 'write a report', final: 'Report ready.', inline: true)
+    row = learning.outcomes.first
+    expect(row[:success]).not_to be true
+    expect(row[:verdict].to_s).to eq('unknown')
+    expect(row[:training_score]).to be_nil
+    expect(row[:confidence]).to eq(0.35)
+    expect(row[:judge_source].to_s).to eq('heuristic')
+  end
+end
+
 describe 'PWN::AI::Agent::Learning conflicted outcomes' do
   it 'tags verifier/judge conflicts and keeps them out of RECENT FAILURES' do
     Dir.mktmpdir do |dir|

data/spec/lib/pwn/ai/agent/loop_spec.rb

@@ -16,6 +16,51 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
   end
 
   describe 'RL-adjacent loop contracts' do # rubocop:disable Metrics/BlockLength
+    describe 'live policy tool exposure' do
+      include_context 'pwn tmp sandbox'
+
+      it 'refreshes schemas after observation before the next engine call without changing routing scope' do
+        policy = PWN::AI::Agent::Policy
+        registry = PWN::AI::Agent::Registry
+        request = 'what color is a passion fruit?'
+        session_id = PWN::Sessions.create(title: 'context refresh')[:id]
+        policy.reset
+        allow(PWN::AI::Agent::TaskSummarizer).to receive(:enabled?).and_return(false)
+        allow(described_class).to receive(:should_auto_introspect?).and_return(false)
+        allow(PWN::AI::Agent::Dispatch).to receive(:call).and_return('{"success":true,"result":{"stdout":"purple","exitstatus":0}}')
+        scopes = []
+        allow(registry).to receive(:definitions) do |opts|
+          scopes << opts
+          observed = Array(policy.current_episode&.dig(:steps)).any?
+          names = observed ? %w[pwn_eval shell] : %w[shell pwn_eval]
+          names.map { |name| { type: 'function', function: { name: name } } }
+        end
+        seen = []
+        allow(described_class).to receive(:call_engine) do |opts|
+          seen << Array(opts[:tools]).map { |tool| tool.dig(:function, :name) }
+          if seen.length == 1
+            { role: 'assistant', tool_calls: [{ id: 'observe_color', type: 'function', function: { name: 'shell', arguments: '{"command":"printf purple"}' } }] }
+          else
+            raise 'unexpected extra engine call' if seen.length > 2
+
+            { role: 'assistant', content: 'Purple when ripe.', tool_calls: [] }
+          end
+        end
+        result = described_class.run(request: request, session_id: session_id, system_role_content: 'test system', enabled_toolsets: ['shell'], core_only: false)
+        expect(result).to eq('Purple when ripe.')
+        expect(seen).to eq([%w[shell pwn_eval], %w[pwn_eval shell]])
+        expect(scopes).to all(include(relevance: request, enabled: ['shell'], core_only: false, intent: described_class.request_intent(request: request)))
+      end
+    end
+
+    it 'passes parsed action arguments and result classification into policy observation' do
+      allow(PWN::AI::Agent::Metrics).to receive(:record)
+      allow(PWN::AI::Agent::Reward).to receive(:semantic_ok).and_return(semantic_ok: true, shape: :success)
+      expected = hash_including(args: { 'operation' => 'read', 'path' => '/tmp/report' }, result_type: :success)
+      expect(PWN::AI::Agent::Policy).to receive(:observe_step).with(expected)
+      described_class.send(:record_metrics, name: 'file', raw: '{"success":true}', args: '{"operation":"read","path":"/tmp/report"}')
+    end
+
     it 'spins on engine HTTP wait and still dispatches on_tool (debug must not hide the TUI)' do
       src = File.read(described_class.method(:run).source_location.first)
       expect(src).to match(/spinner:\s*true/)
@@ -436,6 +481,12 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
       expect(src).to match(/engine hop failed|engine_blip/)
     end
 
+    it 'returns a billing line on OpenAI quota 429 instead of crashing the REPL' do
+      src = File.read(described_class.method(:run).source_location.first)
+      expect(src).to match(/quota_exhausted\?/)
+      expect(src).to match(/quota_message/)
+    end
+
     it 'compacts tool history for every engine, not only local' do
       src = File.read(described_class.method(:run).source_location.first)
       expect(src).to match(/compact_history!\(messages: messages\)/)

data/spec/lib/pwn/ai/agent/metrics_spec.rb

@@ -35,6 +35,50 @@ describe PWN::AI::Agent::Metrics do
     expect(rate).to be > 0.2
   end
 
+  describe '.scoreboard' do
+    before do
+      allow(described_class).to receive(:summary).and_return([])
+      allow(described_class).to receive(:calibration).and_return(mean_actual: 0.4)
+    end
+
+    it 'does not override a rejected outcome with a high raw score' do
+      allow(PWN::AI::Agent::Learning).to receive(:outcomes).with(limit: 200).and_return([
+                                                                                          { success: true, score: 0.8, training_score: 0.8, decision_version: 1 },
+                                                                                          { success: false, score: 0.99, training_score: 0.2, decision_version: 1 }
+                                                                                        ])
+
+      expect(described_class.scoreboard[:task_ok]).to eq(0.5)
+    end
+
+    it 'excludes canonical unknown outcomes from the task success denominator' do
+      Dir.mktmpdir do |dir|
+        stub_const('PWN::AI::Agent::Learning::LEARNING_FILE', File.join(dir, 'learning.jsonl'))
+        allow(PWN::AI::Agent::Learning).to receive(:promote_process_lesson)
+        [
+          { score: 0.8, source: :llm_orm },
+          { score: 0.2, source: :llm_orm },
+          { score: 0.99, source: :heuristic },
+          { score: nil, source: :self_report }
+        ].each do |outcome|
+          PWN::AI::Agent::Learning.note_outcome(task: 'Check outcome', outcome: outcome)
+        end
+
+        expect(described_class.scoreboard[:task_ok]).to eq(0.5)
+      end
+    end
+
+    it 'returns no task rate when every outcome is unknown or unverified' do
+      allow(PWN::AI::Agent::Learning).to receive(:outcomes).with(limit: 200).and_return([
+                                                                                          { success: nil, score: 0.99 },
+                                                                                          { success: false, score: 0.99, verdict: 'unknown' },
+                                                                                          { success: true, score: 0.99, status: 'unverified' },
+                                                                                          { success: true, score: 0.99, decision_version: 1, training_score: nil }
+                                                                                        ])
+
+      expect(described_class.scoreboard[:task_ok]).to be_nil
+    end
+  end
+
   it 'temperature-scales overconfident predictions toward realised actual' do
     stub_const('PWN::AI::Agent::Metrics::METRICS_FILE', File.join(Dir.mktmpdir, 'metrics.json'))
     described_class.reset

data/spec/lib/pwn/ai/agent/mistakes_spec.rb

@@ -216,4 +216,14 @@ describe PWN::AI::Agent::Mistakes do
     expect(classes).to eq(rows.map { |r| r['class'] })
     expect(classes.uniq.length).to eq(3)
   end
+
+  it 'gives pull-access-denied an auth family hint, never ls-the-parent' do
+    stub_const('PWN::AI::Agent::Mistakes::MISTAKES_FILE', File.join(Dir.mktmpdir, 'mistakes.json'))
+    described_class.reset
+    described_class.record(tool: 'shell', error: 'pull access denied for library/foo')
+    hint = described_class.correction_hint(tool: 'shell', error: 'pull access denied for library/foo')
+    expect(hint).to match(/credential|registry/i)
+    expect(hint).not_to match(%r{ls/test -e the parent})
+    expect(described_class.family(error: 'pull access denied')).to eq('auth_denied')
+  end
 end

data/spec/lib/pwn/ai/agent/policy_spec.rb

@@ -271,6 +271,109 @@ describe PWN::AI::Agent::Policy do
     described_class.reset
     FileUtils.remove_entry(tmp) if tmp && Dir.exist?(tmp)
   end
+end
+
+describe PWN::AI::Agent::Policy do
+  describe 'outcome-gated contextual learning' do
+    around do |example|
+      Dir.mktmpdir do |tmp|
+        @policy_dir = tmp
+        example.run
+      ensure
+        described_class.attach_episode!(episode: nil)
+      end
+    end
+
+    before do
+      stub_const('PWN::AI::Agent::Policy::POLICY_FILE', File.join(@policy_dir, 'policy.json'))
+      stub_const('PWN::AI::Agent::Policy::TRAJECTORY_FILE', File.join(@policy_dir, 'policy_traj.jsonl'))
+      allow(described_class).to receive(:enabled?).and_return(true)
+    end
+
+    it 'does not train or count an unjudged episode even when step costs accrue' do
+      described_class.begin_episode(request: 'inspect host')
+      10.times { described_class.observe_step(action: 'shell', ok: true) }
+      report = described_class.finish(score: nil, proxy_ok: true)
+
+      expect(report).to include(td_updates: 0, pg_updates: 0, return: nil)
+      expect(described_class.load).to include(q: {}, h: {}, visits: {}, returns: [])
+      expect(described_class.current_episode).to be_nil
+      expect(described_class.trajectories.first).to include(score: nil, return: nil)
+      (described_class::COLD_EPISODES - 1).times do
+        described_class.begin_episode(request: 'inspect host')
+        described_class.finish(score: nil)
+      end
+      expect(described_class.warmup!).to include(td_updates: 0, replayed: 0)
+      expect(described_class.stats[:n_episodes]).to eq(0)
+      expect(described_class.evaluate[:n]).to eq(0)
+      expect(described_class.episode_budget_met?).to be(false)
+    end
+
+    it 'backs off sparse, missing, or mismatched context to broad scores' do
+      described_class.begin_episode(request: 'inspect')
+      described_class.observe_step(action: 'file', operation: 'read', ok: true)
+      state = described_class.current_state
+      context = described_class.current_context_state
+      table = described_class.load
+      table[:q][state.to_sym] = { alpha: 0.5, beta: 0.0 }
+      table[:visits][state.to_sym] = { alpha: 5, beta: 5 }
+      table[:q][context.to_sym] = { alpha: -1.0, beta: 1.0 }
+      table[:visits][context.to_sym] = { alpha: 2, beta: 2 }
+      described_class.save(table: table)
+      options = { state: state, actions: %w[alpha beta], epsilon: 0.0 }
+
+      expect(described_class.recommend(options)[:action]).to eq('alpha')
+      expect(described_class.advantage(state: state, action: 'beta', context_state: context)).to eq(described_class.advantage(state: state, action: 'beta'))
+      table[:visits][context.to_sym] = { alpha: 3, beta: 3 }
+      described_class.save(table: table)
+      expect(described_class.recommend(options)[:action]).to eq('beta')
+      expect(described_class.recommend(options.merge(context_state: nil))[:action]).to eq('alpha')
+      other_state = described_class.state(request: 'scan')
+      expect(described_class.recommend(options.merge(state: other_state, context_state: context))[:action]).to eq('alpha')
+    end
+
+    it 'replays contextual values without manufacturing extra contextual samples' do
+      described_class.begin_episode(request: 'inspect')
+      described_class.observe_step(action: 'file', args: { action: 'read', path: '/not-stored' }, ok: true)
+      context = described_class.current_context_state
+      described_class.observe_step(action: 'shell', ok: true)
+      described_class.finish(score: 1.0)
+      table = described_class.load
+      table[:q] = {}
+      table[:visits] = {}
+      described_class.save(table: table)
+
+      2.times do
+        described_class.warmup!
+        expect(described_class.q(state: context, action: 'shell')).to be_positive
+        expect(described_class.load[:visits].dig(context.to_sym, :shell)).to eq(1)
+      end
+    end
+
+    it 'records only bounded action features while retaining the complete original request in memory' do
+      request = "inspect #{'private-request ' * 30}"
+      args = { action: 'read', path: '/private/credential-location', token: 'private-token', 'private-key-name' => { nested: 'private-value' } }
+      described_class.begin_episode(request: request)
+      step = described_class.observe_step(action: 'file', args: args, result_type: :enoent, ok: false)
+
+      expect(step[:action_context]).to eq(
+        operation: 'read',
+        arguments: { shape: 'object', size: 'few', features: %w[operation:string other:object other:string path:string] },
+        result_type: 'enoent'
+      )
+      expect(described_class.current_episode[:request]).to eq(request)
+      expect(args[:token]).to eq('private-token')
+      described_class.finish(score: 0.0)
+      persisted = File.read(described_class::TRAJECTORY_FILE) + File.read(described_class::POLICY_FILE)
+      expect(persisted).not_to include('private-', '/private/')
+      expect(described_class.trajectories.first[:request_family]).to eq('misc')
+
+      described_class.begin_episode(request: 'inspect')
+      unknown = described_class.observe_step(action: 'file', operation: 'private-operation', args: 'private-argument', result_type: 'private-result', ok: true)
+      expect(unknown[:action_context]).to include(operation: 'other', result_type: 'other')
+      expect(unknown[:action_context][:arguments]).to eq(shape: 'string')
+    end
+  end
 
   it 'terminal reward is judge score scaled by confidence, not step hygiene' do
     expect(described_class.send(:terminal_reward, score: 1.0, confidence: 0.5)).to be_within(0.01).of(0.5)