@cohortapp/agent-sdk 2.3.0

package/lib/hooks/bus.test.mjs

@@ -0,0 +1,387 @@
+/**
+ * Tests for lib/hooks/bus.mjs — the typed lifecycle hook bus.
+ *
+ * Covers the contract the audit (gaps-product-quality P1-8) specifies:
+ *   - ordered priority dispatch (higher priority first, FIFO within a band)
+ *   - a beforeSend subscriber can cancel the chain with a reason
+ *   - a throwing subscriber is isolated (others still run; chain completes)
+ *   - async subscribers are awaited in order
+ *   - an unknown event type is rejected at subscribe AND emit
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  HookBus,
+  createHookBus,
+  getHookBus,
+  resetHookBus,
+  HOOK_EVENT_NAMES,
+  HOOK_EVENTS,
+  isHookEvent,
+  isCancellableEvent,
+} from "./bus.mjs";
+
+/** A bus with an in-memory logger so error reporting is observable + silent. */
+function busWithLog() {
+  const logged = [];
+  const bus = createHookBus({ logger: (e) => logged.push(e) });
+  return { bus, logged };
+}
+
+describe("HookBus — closed event set", () => {
+  it("exposes exactly the eight specified lifecycle events", () => {
+    assert.deepEqual(
+      [...HOOK_EVENT_NAMES].sort(),
+      [
+        "afterSend",
+        "beforeSend",
+        "onClassify",
+        "onDispatch",
+        "onError",
+        "onGuardFail",
+        "onSessionClose",
+        "onSkillAuthored",
+      ]
+    );
+  });
+
+  it("marks only beforeSend as cancellable", () => {
+    assert.equal(isCancellableEvent("beforeSend"), true);
+    for (const e of HOOK_EVENT_NAMES) {
+      if (e === "beforeSend") continue;
+      assert.equal(isCancellableEvent(e), false, `${e} must not be cancellable`);
+    }
+  });
+
+  it("isHookEvent recognises known names and rejects others", () => {
+    assert.equal(isHookEvent("beforeSend"), true);
+    assert.equal(isHookEvent("nope"), false);
+  });
+});
+
+describe("HookBus — ordered priority dispatch", () => {
+  it("runs subscribers in descending priority order", async () => {
+    const { bus } = busWithLog();
+    const order = [];
+    bus.subscribe("onClassify", () => order.push("low"), { priority: 1 });
+    bus.subscribe("onClassify", () => order.push("high"), { priority: 10 });
+    bus.subscribe("onClassify", () => order.push("mid"), { priority: 5 });
+    await bus.emit("onClassify", {});
+    assert.deepEqual(order, ["high", "mid", "low"]);
+  });
+
+  it("breaks priority ties by registration order (FIFO)", async () => {
+    const { bus } = busWithLog();
+    const order = [];
+    bus.subscribe("onDispatch", () => order.push("a"), { priority: 5 });
+    bus.subscribe("onDispatch", () => order.push("b"), { priority: 5 });
+    bus.subscribe("onDispatch", () => order.push("c"), { priority: 5 });
+    await bus.emit("onDispatch", {});
+    assert.deepEqual(order, ["a", "b", "c"]);
+  });
+
+  it("passes the same ctx object to every subscriber", async () => {
+    const { bus } = busWithLog();
+    const ctx = { tool: "slack_send", text: "hi" };
+    const seen = [];
+    bus.subscribe("afterSend", (c) => seen.push(c));
+    bus.subscribe("afterSend", (c) => seen.push(c));
+    await bus.emit("afterSend", ctx);
+    assert.equal(seen.length, 2);
+    assert.equal(seen[0], ctx);
+    assert.equal(seen[1], ctx);
+  });
+
+  it("returns a not-cancelled decision for observe-only events", async () => {
+    const { bus } = busWithLog();
+    bus.subscribe("onGuardFail", () => ({ cancel: true, reason: "ignored" }));
+    const res = await bus.emit("onGuardFail", {});
+    // cancel returns are ignored for non-cancellable events.
+    assert.deepEqual(res, { cancelled: false, reason: null, by: null, errors: 0 });
+  });
+});
+
+describe("HookBus — cancellable beforeSend chain", () => {
+  it("a subscriber cancels the chain with a reason and short-circuits", async () => {
+    const { bus } = busWithLog();
+    const ran = [];
+    bus.subscribe("beforeSend", () => { ran.push("gate-a"); }, { priority: 10 });
+    bus.subscribe("beforeSend", () => {
+      ran.push("send-gate");
+      return { cancel: true, reason: "banned-phrase" };
+    }, { priority: 5 });
+    bus.subscribe("beforeSend", () => { ran.push("should-not-run"); }, { priority: 1 });
+
+    const res = await bus.emit("beforeSend", { text: "Absolutely!" });
+    assert.equal(res.cancelled, true);
+    assert.equal(res.reason, "banned-phrase");
+    assert.equal(res.by, 1); // index of the canceller in priority order
+    assert.deepEqual(ran, ["gate-a", "send-gate"]); // third never ran
+  });
+
+  it("an async subscriber can cancel the chain", async () => {
+    const { bus } = busWithLog();
+    const res = await (async () => {
+      bus.subscribe("beforeSend", async () => {
+        await Promise.resolve();
+        return { cancel: true, reason: "ownership-backstop" };
+      });
+      return bus.emit("beforeSend", {});
+    })();
+    assert.equal(res.cancelled, true);
+    assert.equal(res.reason, "ownership-backstop");
+  });
+
+  it("defaults the reason when a canceller omits one", async () => {
+    const { bus } = busWithLog();
+    bus.subscribe("beforeSend", () => ({ cancel: true }));
+    const res = await bus.emit("beforeSend", {});
+    assert.equal(res.cancelled, true);
+    assert.equal(res.reason, "cancelled");
+  });
+
+  it("does NOT cancel when no subscriber vetoes", async () => {
+    const { bus } = busWithLog();
+    bus.subscribe("beforeSend", () => undefined);
+    bus.subscribe("beforeSend", () => ({ cancel: false }));
+    bus.subscribe("beforeSend", () => "non-object-return");
+    const res = await bus.emit("beforeSend", {});
+    assert.equal(res.cancelled, false);
+    assert.equal(res.reason, null);
+  });
+});
+
+describe("HookBus — error isolation (fail-open)", () => {
+  it("isolates a throwing subscriber; later subscribers still run", async () => {
+    const { bus, logged } = busWithLog();
+    const ran = [];
+    bus.subscribe("onClassify", () => ran.push("first"), { priority: 10 });
+    bus.subscribe("onClassify", () => { throw new Error("boom"); }, { priority: 5 });
+    bus.subscribe("onClassify", () => ran.push("third"), { priority: 1 });
+
+    const res = await bus.emit("onClassify", {});
+    assert.deepEqual(ran, ["first", "third"]);
+    assert.equal(res.errors, 1);
+    assert.equal(res.cancelled, false);
+    // the error was reported to the logger
+    const errRows = logged.filter((e) => e.stage === "hook_subscriber_error");
+    assert.equal(errRows.length, 1);
+    assert.equal(errRows[0].event, "onClassify");
+    assert.match(errRows[0].error, /boom/);
+  });
+
+  it("isolates a rejecting async subscriber", async () => {
+    const { bus, logged } = busWithLog();
+    const ran = [];
+    bus.subscribe("onDispatch", async () => { throw new Error("async-boom"); });
+    bus.subscribe("onDispatch", () => ran.push("after"));
+    const res = await bus.emit("onDispatch", {});
+    assert.deepEqual(ran, ["after"]);
+    assert.equal(res.errors, 1);
+    assert.equal(logged.filter((e) => e.stage === "hook_subscriber_error").length, 1);
+  });
+
+  it("a throwing subscriber in a cancellable chain does NOT cancel the send", async () => {
+    const { bus } = busWithLog();
+    const ran = [];
+    bus.subscribe("beforeSend", () => { throw new Error("gate crashed"); }, { priority: 10 });
+    bus.subscribe("beforeSend", () => ran.push("downstream"), { priority: 1 });
+    const res = await bus.emit("beforeSend", {});
+    // fail-open: a buggy gate must not silently drop traffic
+    assert.equal(res.cancelled, false);
+    assert.equal(res.errors, 1);
+    assert.deepEqual(ran, ["downstream"]);
+  });
+
+  it("a throwing subscriber re-emits onError without recursing forever", async () => {
+    const { bus, logged } = busWithLog();
+    const onErrorSeen = [];
+    bus.subscribe("onError", (ctx) => { onErrorSeen.push(ctx); });
+    bus.subscribe("onSessionClose", () => { throw new Error("close-boom"); });
+    await bus.emit("onSessionClose", {});
+    // let the fire-and-forget onError re-emit settle
+    await new Promise((r) => setTimeout(r, 0));
+    assert.equal(onErrorSeen.length, 1);
+    assert.equal(onErrorSeen[0].sourceEvent, "onSessionClose");
+    assert.match(onErrorSeen[0].error, /close-boom/);
+    // exactly one subscriber-error row (the original) — onError did not recurse
+    assert.equal(logged.filter((e) => e.stage === "hook_subscriber_error").length, 1);
+  });
+
+  it("a throwing onError subscriber is logged but does not loop", async () => {
+    const { bus, logged } = busWithLog();
+    bus.subscribe("onError", () => { throw new Error("handler-boom"); });
+    bus.subscribe("onClassify", () => { throw new Error("orig"); });
+    await bus.emit("onClassify", {});
+    await new Promise((r) => setTimeout(r, 0));
+    // original error + the onError handler's own throw == 2 rows, then it stops.
+    const rows = logged.filter((e) => e.stage === "hook_subscriber_error");
+    assert.equal(rows.length, 2);
+    assert.deepEqual(rows.map((r) => r.event).sort(), ["onClassify", "onError"]);
+  });
+
+  it("a broken logger never breaks the bus", async () => {
+    const bus = createHookBus({ logger: () => { throw new Error("logger down"); } });
+    const ran = [];
+    bus.subscribe("onClassify", () => { throw new Error("x"); });
+    bus.subscribe("onClassify", () => ran.push("survived"));
+    const res = await bus.emit("onClassify", {});
+    assert.deepEqual(ran, ["survived"]);
+    assert.equal(res.errors, 1);
+  });
+});
+
+describe("HookBus — async ordering", () => {
+  it("awaits async subscribers in priority order before the next runs", async () => {
+    const { bus } = busWithLog();
+    const order = [];
+    const delay = (ms) => new Promise((r) => setTimeout(r, ms));
+    // higher priority deliberately SLOWER — must still complete before the
+    // lower-priority one starts, proving emit awaits in order.
+    bus.subscribe("onDispatch", async () => {
+      order.push("high-start");
+      await delay(20);
+      order.push("high-end");
+    }, { priority: 10 });
+    bus.subscribe("onDispatch", async () => {
+      order.push("low-start");
+      await delay(1);
+      order.push("low-end");
+    }, { priority: 1 });
+    await bus.emit("onDispatch", {});
+    assert.deepEqual(order, ["high-start", "high-end", "low-start", "low-end"]);
+  });
+
+  it("mixes sync and async subscribers, preserving order", async () => {
+    const { bus } = busWithLog();
+    const order = [];
+    bus.subscribe("afterSend", () => order.push("sync-1"), { priority: 3 });
+    bus.subscribe("afterSend", async () => {
+      await Promise.resolve();
+      order.push("async-2");
+    }, { priority: 2 });
+    bus.subscribe("afterSend", () => order.push("sync-3"), { priority: 1 });
+    await bus.emit("afterSend", {});
+    assert.deepEqual(order, ["sync-1", "async-2", "sync-3"]);
+  });
+
+  it("a cancel in an async chain short-circuits subsequent subscribers", async () => {
+    const { bus } = busWithLog();
+    const ran = [];
+    bus.subscribe("beforeSend", async () => {
+      await Promise.resolve();
+      ran.push("first");
+      return { cancel: true, reason: "stop" };
+    }, { priority: 10 });
+    bus.subscribe("beforeSend", () => ran.push("second"), { priority: 1 });
+    const res = await bus.emit("beforeSend", {});
+    assert.equal(res.cancelled, true);
+    assert.deepEqual(ran, ["first"]);
+  });
+});
+
+describe("HookBus — unknown event rejection", () => {
+  it("rejects subscribe to an unknown event", () => {
+    const { bus } = busWithLog();
+    assert.throws(() => bus.subscribe("notAnEvent", () => {}), /unknown event "notAnEvent"/);
+  });
+
+  it("rejects emit of an unknown event", async () => {
+    const { bus } = busWithLog();
+    await assert.rejects(() => bus.emit("notAnEvent", {}), /unknown event "notAnEvent"/);
+  });
+
+  it("rejects unsubscribe/count/clear of an unknown event", () => {
+    const { bus } = busWithLog();
+    assert.throws(() => bus.unsubscribe("nope", () => {}), /unknown event/);
+    assert.throws(() => bus.count("nope"), /unknown event/);
+    assert.throws(() => bus.clear("nope"), /unknown event/);
+  });
+
+  it("rejects a non-function handler", () => {
+    const { bus } = busWithLog();
+    assert.throws(() => bus.subscribe("beforeSend", 42), /must be a function/);
+  });
+});
+
+describe("HookBus — unsubscribe", () => {
+  it("the handle returned by subscribe removes the subscriber", async () => {
+    const { bus } = busWithLog();
+    const ran = [];
+    const off = bus.subscribe("onClassify", () => ran.push("x"));
+    assert.equal(bus.count("onClassify"), 1);
+    off();
+    assert.equal(bus.count("onClassify"), 0);
+    await bus.emit("onClassify", {});
+    assert.deepEqual(ran, []);
+  });
+
+  it("the unsubscribe handle is idempotent", () => {
+    const { bus } = busWithLog();
+    const fn = () => {};
+    const off = bus.subscribe("onClassify", fn);
+    // re-register the same fn so we can prove the handle removes only its own.
+    bus.subscribe("onClassify", fn);
+    off();
+    off(); // second call is a no-op
+    assert.equal(bus.count("onClassify"), 1);
+  });
+
+  it("unsubscribe(event, fn) removes the first matching registration", () => {
+    const { bus } = busWithLog();
+    const fn = () => {};
+    bus.subscribe("onClassify", fn);
+    assert.equal(bus.unsubscribe("onClassify", fn), true);
+    assert.equal(bus.unsubscribe("onClassify", fn), false);
+  });
+
+  it("unsubscribing during emit does not perturb the in-flight chain", async () => {
+    const { bus } = busWithLog();
+    const ran = [];
+    let off3;
+    bus.subscribe("onClassify", () => { ran.push("1"); off3(); }, { priority: 3 });
+    bus.subscribe("onClassify", () => ran.push("2"), { priority: 2 });
+    off3 = bus.subscribe("onClassify", () => ran.push("3"), { priority: 1 });
+    await bus.emit("onClassify", {});
+    // 3 was removed mid-emit but the snapshot still ran it this round.
+    assert.deepEqual(ran, ["1", "2", "3"]);
+    // next emit reflects the removal.
+    ran.length = 0;
+    await bus.emit("onClassify", {});
+    assert.deepEqual(ran, ["1", "2"]);
+  });
+});
+
+describe("HookBus — factory + singleton", () => {
+  it("createHookBus returns isolated instances", async () => {
+    const a = createHookBus({ logger: () => {} });
+    const b = createHookBus({ logger: () => {} });
+    assert.notEqual(a, b);
+    const ranA = [];
+    a.subscribe("onClassify", () => ranA.push("a"));
+    await b.emit("onClassify", {});
+    assert.deepEqual(ranA, []); // b's emit never touched a's subscribers
+  });
+
+  it("getHookBus returns the same instance across calls", () => {
+    resetHookBus();
+    const first = getHookBus({ logger: () => {} });
+    const second = getHookBus();
+    assert.equal(first, second);
+    resetHookBus();
+    const third = getHookBus({ logger: () => {} });
+    assert.notEqual(first, third);
+    resetHookBus();
+  });
+
+  it("is an instance of HookBus", () => {
+    assert.ok(createHookBus() instanceof HookBus);
+  });
+
+  it("HOOK_EVENTS is frozen (closed set is immutable)", () => {
+    assert.ok(Object.isFrozen(HOOK_EVENTS));
+    assert.ok(Object.isFrozen(HOOK_EVENT_NAMES));
+  });
+});

package/lib/index.js

@@ -0,0 +1,16 @@
+/**
+ * @cohortapp/agent-sdk — Main entry point
+ *
+ * Re-exports all public modules for convenient consumption:
+ *   import { getToolsForAccessLevel, executeAction } from "@cohortapp/agent-sdk";
+ */
+
+export {
+  getToolsForAccessLevel,
+  getToolNamesForAccessLevel,
+  getAllToolsByCategory,
+} from "./tool-definitions.js";
+
+export { executeAction } from "./action-executor.js";
+
+export { acquireLock, releaseLock, checkLock } from "./singleton.js";

package/lib/learning/config.mjs

@@ -0,0 +1,106 @@
+/**
+ * lib/learning/config.mjs — config loader for the self-learning loop (WS3).
+ *
+ * Mirrors lib/collective/config.mjs: pure, dependency-light, js-yaml loaded
+ * lazily, FAIL-OPEN (these run inside global hooks on every session machine-
+ * wide, so a throw here would break unrelated sessions — we return defaults).
+ *
+ * config/learning.yaml only needs the keys you want to override; everything
+ * below is the built-in default. The repo denylist is INHERITED from the
+ * collective config (the same ring-fenced repos must not feed the learning loop
+ * either) and may be extended here.
+ *
+ * @module lib/learning/config
+ */
+
+"use strict";
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** Built-in defaults. Mirrors scaffold/config/learning.yaml. */
+export const DEFAULTS = Object.freeze({
+  enabled: true,
+  minTurns: 4,                 // Pass B gate: skip sessions shorter than this
+  reviewModel: "sonnet",       // self-improvement reviewer model (never the main model)
+  nudgeToolUses: 40,           // raise the skill prior past this many tool-uses
+  nudgeSessions: 8,            // raise the skill prior past this many sessions
+  staleDays: 30,               // active → stale after this many days idle
+  archiveDays: 90,             // → archived after this many days idle
+  repoDenylist: [],            // extends the inherited collective denylist
+  // Phase-2 curator: periodically merge narrowly-overlapping agent-authored
+  // skills into class-level umbrellas via one bounded LLM call, run as a
+  // DETACHED worker from the skill-curator cadence. Fail-open defaults.
+  consolidation: Object.freeze({
+    enabled: true,             // turn the umbrella-consolidation pass on/off
+    minSkills: 5,              // don't spawn the LLM below this many agent-authored active skills
+    intervalDays: 14,          // minimum days between consolidation passes
+    model: "sonnet",           // reviewer model for the clustering call
+  }),
+});
+
+const CONFIG_REL = "config/learning.yaml";
+
+function clone(v) { return JSON.parse(JSON.stringify(v)); }
+
+/** Last-wins shallow-ish merge (objects deep-merge, arrays/scalars replace). */
+function merge(base, override) {
+  if (override == null) return clone(base);
+  if (Array.isArray(base) || Array.isArray(override)) return clone(override);
+  if (typeof base !== "object" || typeof override !== "object") return clone(override);
+  const out = clone(base);
+  for (const k of Object.keys(override)) {
+    const b = out[k], o = override[k];
+    if (b && o && typeof b === "object" && typeof o === "object" && !Array.isArray(b) && !Array.isArray(o)) out[k] = merge(b, o);
+    else if (o !== undefined) out[k] = clone(o);
+  }
+  return out;
+}
+
+let _yaml = null;
+async function getYaml() {
+  if (_yaml) return _yaml;
+  const mod = await import("js-yaml");
+  _yaml = mod.default || mod;
+  return _yaml;
+}
+
+/**
+ * Load the learning config for an agent root, merged over DEFAULTS. Optionally
+ * inherits `repoDenylist` from an already-loaded collective config. Returns a
+ * fresh DEFAULTS clone when the root is unknown or the file is missing/bad.
+ *
+ * @param {string|null} agentRoot
+ * @param {object} [collectiveCfg]  already-loaded collective config (for denylist inheritance)
+ * @returns {Promise<object>}
+ */
+export async function loadLearningConfig(agentRoot, collectiveCfg) {
+  const base = clone(DEFAULTS);
+  // Inherit the collective denylist as the floor.
+  if (collectiveCfg && Array.isArray(collectiveCfg.repoDenylist)) {
+    base.repoDenylist = clone(collectiveCfg.repoDenylist);
+  }
+  if (!agentRoot) return base;
+  const p = join(agentRoot, CONFIG_REL);
+  if (!existsSync(p)) return base;
+  try {
+    const yaml = await getYaml();
+    const raw = yaml.load(readFileSync(p, "utf8"));
+    if (!raw || typeof raw !== "object") return base;
+    const merged = merge(base, raw);
+    // Union the inherited + file denylists so the file extends, never shrinks, the floor.
+    if (collectiveCfg && Array.isArray(collectiveCfg.repoDenylist)) {
+      merged.repoDenylist = Array.from(new Set([...(collectiveCfg.repoDenylist || []), ...(merged.repoDenylist || [])]));
+    }
+    return merged;
+  } catch {
+    return base;
+  }
+}
+
+/** Is the learning loop enabled for this config? */
+export function isLearningEnabled(cfg) {
+  return !!cfg && cfg.enabled !== false;
+}
+
+export default { DEFAULTS, loadLearningConfig, isLearningEnabled };

package/lib/learning/config.test.mjs

@@ -0,0 +1,75 @@
+/**
+ * config.test.mjs — learning config loader tests.
+ * Run: node --test lib/learning/config.test.mjs
+ */
+"use strict";
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { loadLearningConfig, isLearningEnabled, DEFAULTS } from "./config.mjs";
+
+function tmpRoot() {
+  const root = mkdtempSync(join(tmpdir(), "maestro-learncfg-"));
+  mkdirSync(join(root, "config"), { recursive: true });
+  return root;
+}
+
+test("loadLearningConfig: defaults when no file / no root", async () => {
+  assert.deepEqual(await loadLearningConfig(null), DEFAULTS);
+  const root = tmpRoot();
+  const cfg = await loadLearningConfig(root);
+  assert.equal(cfg.minTurns, 4);
+  assert.equal(cfg.reviewModel, "sonnet");
+});
+
+test("loadLearningConfig: file overrides merge over defaults", async () => {
+  const root = tmpRoot();
+  writeFileSync(join(root, "config", "learning.yaml"), "minTurns: 6\nreviewModel: sonnet\nenabled: false\n");
+  const cfg = await loadLearningConfig(root);
+  assert.equal(cfg.minTurns, 6);
+  assert.equal(cfg.enabled, false);
+  assert.equal(isLearningEnabled(cfg), false);
+  // Untouched keys keep their defaults.
+  assert.equal(cfg.archiveDays, 90);
+});
+
+test("loadLearningConfig: inherits + unions the collective denylist", async () => {
+  const root = tmpRoot();
+  writeFileSync(join(root, "config", "learning.yaml"), "repoDenylist: [extra-repo]\n");
+  const cfg = await loadLearningConfig(root, { repoDenylist: ["client-work", "secrets"] });
+  assert.ok(cfg.repoDenylist.includes("client-work"));
+  assert.ok(cfg.repoDenylist.includes("secrets"));
+  assert.ok(cfg.repoDenylist.includes("extra-repo"), "file extends the inherited floor");
+});
+
+test("loadLearningConfig: consolidation defaults present (enabled / 5 / 14 / sonnet)", async () => {
+  const root = tmpRoot();
+  const cfg = await loadLearningConfig(root);
+  assert.equal(cfg.consolidation.enabled, true);
+  assert.equal(cfg.consolidation.minSkills, 5);
+  assert.equal(cfg.consolidation.intervalDays, 14);
+  assert.equal(cfg.consolidation.model, "sonnet");
+});
+
+test("loadLearningConfig: consolidation overrides deep-merge (keep untouched sub-keys)", async () => {
+  const root = tmpRoot();
+  writeFileSync(join(root, "config", "learning.yaml"), "consolidation:\n  enabled: false\n  minSkills: 3\n");
+  const cfg = await loadLearningConfig(root);
+  assert.equal(cfg.consolidation.enabled, false);
+  assert.equal(cfg.consolidation.minSkills, 3);
+  // intervalDays / model untouched → defaults.
+  assert.equal(cfg.consolidation.intervalDays, 14);
+  assert.equal(cfg.consolidation.model, "sonnet");
+});
+
+test("loadLearningConfig: corrupt yaml fails open to defaults+inheritance", async () => {
+  const root = tmpRoot();
+  writeFileSync(join(root, "config", "learning.yaml"), "minTurns: [unterminated");
+  const cfg = await loadLearningConfig(root, { repoDenylist: ["ring-fenced"] });
+  assert.equal(cfg.minTurns, 4);
+  assert.deepEqual(cfg.repoDenylist, ["ring-fenced"]);
+});