@inetafrica/open-claudia 3.0.35 → 3.0.40

package/test-pack-search.js

@@ -0,0 +1,79 @@
+// WS1: extractive per-line search (packs.searchLines). Unlike matchPacks,
+// which routes whole packs, searchLines returns the individual lines that
+// best match a query, tagged by section — the substrate the extractive
+// injector uses to surface a verbatim fact from anywhere in a pack, not just
+// Stance. Covers: cross-section retrieval, section tagging, verbatim text,
+// distinct-term scoring, dir scoping, k cap, stopword/empty guards, archived
+// exclusion.
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "pack-search-"));
+process.env.PACKS_DIR = path.join(tmp, "packs");
+
+const packs = require("./core/packs");
+
+packs.createPack({
+  dir: "deploy-notes",
+  name: "Deploy Notes",
+  description: "how we ship",
+  stance: "Prefer GitOps for what runs in the cluster.",
+  procedure: "Run the smoke test before every deploy.\nTag the release then push via git-release.",
+  state: "The ArgoCD sync for payments is currently paused.",
+  journal: "2026-07-01 deployed v3 to the cluster without incident.",
+});
+packs.createPack({
+  dir: "billing",
+  name: "Billing",
+  description: "invoices and refunds",
+  stance: "Refunds always require a manager approval.",
+  procedure: "Generate the invoice, then email it to the customer.",
+});
+
+// ── cross-section: a fact in Procedure/State/Journal is retrievable, proving
+//    searchLines reaches beyond Stance (the felt-regression fix). ──
+const argo = packs.searchLines("argocd sync payments");
+assert.ok(argo.length > 0, "finds a matching line");
+assert.strictEqual(argo[0].dir, "deploy-notes", "matched the right pack");
+assert.strictEqual(argo[0].section, "State", "line is tagged with its section (State, not Stance)");
+assert.ok(/ArgoCD sync for payments/.test(argo[0].text), "returns the verbatim source line");
+assert.ok(argo[0].lineno >= 1, "reports a 1-based line number");
+assert.ok(argo[0].score > 0, "reports a positive score");
+
+// ── verbatim: returned text is the source line trimmed, never paraphrased ──
+const smoke = packs.searchLines("smoke test deploy", { dir: "deploy-notes" });
+assert.ok(smoke.some((h) => h.text === "Run the smoke test before every deploy." && h.section === "Procedure"),
+  "verbatim line preserved exactly, correct section");
+
+// ── scoring: a line covering more distinct query terms outranks one covering
+//    fewer, so the injector's top hit is the densest match. ──
+const rank = packs.searchLines("release git-release push tag");
+assert.strictEqual(rank[0].section, "Procedure", "the line with the most distinct query terms ranks first");
+assert.ok(/git-release/.test(rank[0].text), "top hit is the multi-term line");
+
+// ── dir scoping: --pack restricts the search to one pack ──
+const scoped = packs.searchLines("approval invoice refund", { dir: "billing" });
+assert.ok(scoped.length > 0, "dir-scoped search returns billing lines");
+assert.ok(scoped.every((h) => h.dir === "billing"), "dir scoping excludes other packs");
+
+// ── k cap: never returns more than k hits ──
+const capped = packs.searchLines("the", { k: 2 }); // 'the' is a stopword → no terms
+assert.strictEqual(capped.length, 0, "a stopword-only query yields no terms and no hits");
+const capped2 = packs.searchLines("deploy invoice refund approval release", { k: 2 });
+assert.ok(capped2.length <= 2, "k caps the number of hits");
+
+// ── guards: empty query → [] ──
+assert.deepStrictEqual(packs.searchLines(""), [], "empty query returns nothing");
+assert.deepStrictEqual(packs.searchLines("   "), [], "whitespace query returns nothing");
+
+// ── no match → [] ──
+assert.deepStrictEqual(packs.searchLines("kubernetes helm quantum"), [], "no matching lines returns []");
+
+// ── archived packs are excluded from a corpus-wide search ──
+packs.archivePack("billing");
+const afterArchive = packs.searchLines("approval invoice refund");
+assert.ok(afterArchive.every((h) => h.dir !== "billing"), "archived pack lines are not surfaced");
+
+console.log("pack search OK");

package/test-provider-language.js

@@ -32,15 +32,34 @@ assert.doesNotMatch(setup, /Your Claude Code bot is connected|Description=Claude
 
 const pkg = JSON.parse(read("package.json"));
 assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
-// 3.0.35 approved by Sumeet 2026-07-17 ("yes will this also ship the issue of
-// new lines not showing properly?"): Spaces comments become real ProseMirror
-// docs. buildCommentContent used to post the whole reply as ONE text node in
-// ONE paragraph, so TipTap collapsed every newline and printed markdown
-// asterisks literally — the unreadable-wall screenshot from the euvy bot
-// thread. Now markdown converts to paragraphs/hardBreaks, bold/italic/code
-// marks, bullet/ordered lists, headings, code blocks and dividers — all node
-// types verified present in the Spaces editor schema.
-assert.strictEqual(pkg.version, "3.0.35", "release version must remain unchanged without explicit approval");
+// 3.0.36 approved by Sumeet 2026-07-17 ("One bug is when you change model to a
+// Claude it asks you to sign in again" → "Go ahead"): picking a Claude model no
+// longer forces a re-login. The model-button handler and the /login picker
+// judged "connected?" from a shallow token probe (getClaudeOAuthToken) that
+// only sees .env/process-env/vault tokens, so a Claude CLI-store login read as
+// disconnected and every tap restarted login — a loop, since that login stores
+// no bot token. Both now use claudeProviderAuthStatus() (honours a bot token
+// AND a `claude auth status` CLI-store login), matching the Codex branch.
+// 3.0.37 approved by Sumeet 2026-07-17 ("when done please push out the new
+// version"): adds silent background watches (a cron carrying a shell `check`
+// that only wakes the agent on exit 0, owner-gated via /watch) and
+// provider-agnostic loose-credential capture (a pasted secret is stored
+// out-of-band and the turn stopped before the model — Codex refuses secrets in
+// its prompt, so the harness intercepts the paste itself).
+// 3.0.40 approved by Sumeet 2026-07-18 ("please go ahead and work through end
+// to end till it's fully built and deploy out a new version for me ... I want
+// you to fully complete the plan then let me know to upgrade and test"): the
+// Pass-4 recall overhaul. Third cut — v3.0.38 bumped the version but forgot to
+// move THIS pin (pretest caught it); v3.0.39 fixed the pin but a new test
+// (test-cokept-warming.js) asserted a sqlite-graph write that no-ops on CI's
+// node:20 (no node:sqlite), so it now skips that path like test-recall-graph.js.
+// Payload unchanged: extractive on-open injection (Stance verbatim + fuzzy-
+// matched, section-tagged lines) surfaces the actual matched facts instead of a
+// headline; a walker score-gate drops weakly-relevant nodes below the relevance
+// floor and tightens the cascade so sticky auto-keeps route back to the judge; a
+// KPI ruler stamps per-version relevance/gate/warm columns. Co-kept Hebbian
+// warming ships dark (default OFF).
+assert.strictEqual(pkg.version, "3.0.40", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-scheduler.js

@@ -10,6 +10,14 @@ const path = require("path");
 const root = __dirname;
 const fixturesRoot = path.join(root, "test-fixtures", "migrations");
 
+// Keep watch state off the real ~/.open-claudia during the run. scheduler.js
+// reads these paths from env at require time, so they must be set before main()
+// pulls in ./core/scheduler.
+const watchTmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "oc-watch-test-"));
+process.env.OPEN_CLAUDIA_WATCH_LOG_FILE = path.join(watchTmpDir, "watch.log");
+process.env.OPEN_CLAUDIA_WATCHES_ENABLED_FILE = path.join(watchTmpDir, "watches-enabled");
+const watchesEnabledFile = process.env.OPEN_CLAUDIA_WATCHES_ENABLED_FILE;
+
 function readFixture(name, file = "jobs.json") {
   return JSON.parse(fs.readFileSync(path.join(fixturesRoot, name, file), "utf8"));
 }
@@ -423,6 +431,7 @@ function schedulerHarness(createSchedulerService, seed, options = {}) {
     retryDelayMs: 1000,
     busyDelayMs: 250,
     missedGraceMs: 60 * 60 * 1000,
+    ...(options.runWatchCheck ? { runWatchCheck: options.runWatchCheck } : {}),
   });
   return { service, jobsStore, scheduled, admissions, runCalls, sends, state };
 }
@@ -727,6 +736,78 @@ function loopbackMetadataProbe(runner, loopbackClient) {
   }
 }
 
+async function watchGateProbe(createSchedulerService) {
+  const successOutcome = () => ({
+    ok: true,
+    status: "succeeded",
+    persistence: { transcript: { ok: true }, usage: { ok: true }, session: { ok: true } },
+    delivery: { ok: true },
+  });
+  const watchJob = (overrides = {}) => baseJob({
+    id: "watch-1",
+    kind: "cron",
+    schedule: "* * * * *",
+    fireAt: undefined,
+    occurrenceId: "watch-occurrence",
+    check: "true",
+    repeat: false,
+    label: "disk watch",
+    ...overrides,
+  });
+
+  // Failing check → idle skip: agent never wakes, nothing hits chat, job stays pending.
+  const idle = schedulerHarness(createSchedulerService, [watchJob({ id: "watch-idle" })], {
+    runWatchCheck: async () => ({ code: 1, timedOut: false }),
+    outcomes: [successOutcome()],
+  });
+  const idleResult = await idle.service.fireJob("watch-idle");
+  assert.strictEqual(idleResult.status, "watch-idle");
+  assert.strictEqual(idleResult.skipped, true);
+  assert.strictEqual(idle.runCalls.length, 0, "failed check must not wake the agent");
+  assert.strictEqual(idle.sends.length, 0, "idle poll never touches chat");
+  const idleJob = idle.jobsStore.get("watch-idle");
+  assert.ok(idleJob, "idle watch is left in the store");
+  assert.strictEqual(idleJob.status, "pending", "idle watch stays pending for the next tick");
+
+  // Passing check → wakes agent once with the Watch header; one-shot watch is removed after firing.
+  const fired = schedulerHarness(createSchedulerService, [watchJob({ id: "watch-fire" })], {
+    runWatchCheck: async () => ({ code: 0, timedOut: false }),
+    outcomes: [successOutcome()],
+  });
+  const firedResult = await fired.service.fireJob("watch-fire");
+  assert.strictEqual(firedResult.ok, true);
+  assert.strictEqual(firedResult.status, "succeeded");
+  assert.strictEqual(fired.runCalls.length, 1, "passing check wakes the agent exactly once");
+  assert.match(fired.runCalls[0].prompt, /Watch triggered/, "watch fire carries the Watch triggered header");
+  assert.strictEqual(fired.jobsStore.get("watch-fire"), null, "one-shot watch is removed after firing");
+
+  // Repeat watch → fires but survives with a fresh occurrence so the next tick polls again.
+  const repeating = schedulerHarness(createSchedulerService, [watchJob({ id: "watch-repeat", repeat: true })], {
+    runWatchCheck: async () => ({ code: 0, timedOut: false }),
+    outcomes: [successOutcome()],
+  });
+  await repeating.service.fireJob("watch-repeat");
+  assert.strictEqual(repeating.runCalls.length, 1);
+  const repeatJob = repeating.jobsStore.get("watch-repeat");
+  assert.ok(repeatJob, "repeat watch survives firing");
+  assert.strictEqual(repeatJob.status, "pending");
+  assert.strictEqual(repeatJob.occurrenceId, "next-occ-1", "repeat watch advances to a new occurrence");
+
+  // Global master switch OFF → skip before the check even runs.
+  fs.writeFileSync(watchesEnabledFile, "off");
+  let checkRan = false;
+  const disabled = schedulerHarness(createSchedulerService, [watchJob({ id: "watch-off" })], {
+    runWatchCheck: async () => { checkRan = true; return { code: 0, timedOut: false }; },
+    outcomes: [successOutcome()],
+  });
+  const disabledResult = await disabled.service.fireJob("watch-off");
+  assert.strictEqual(disabledResult.status, "watch-disabled");
+  assert.strictEqual(disabledResult.skipped, true);
+  assert.strictEqual(checkRan, false, "disabled watches never run their check");
+  assert.strictEqual(disabled.runCalls.length, 0);
+  fs.rmSync(watchesEnabledFile, { force: true });
+}
+
 function staticSchedulingProbe() {
   const files = [
     "core/jobs.js",
@@ -742,6 +823,13 @@ function staticSchedulingProbe() {
     assert.ok(!/\bsessionKey\b/.test(source[file]), `${file} must not use the removed sessionKey scheduling field`);
   }
   assert.match(source["bin/cli.js"], /selected provider session/i);
+
+  // Watch feature must be wired end to end: gate → loopback → CLI surfaces.
+  assert.match(source["core/scheduler.js"], /job\.check/, "scheduler must gate firing on a watch check");
+  assert.match(source["core/scheduler.js"], /watchesEnabled/, "scheduler must consult the global watch switch");
+  assert.match(source["core/loopback.js"], /watch-add/, "loopback must route watch-add");
+  assert.match(source["bin/schedule.js"], /runWatchAdd/, "schedule CLI must expose watch-add");
+  assert.match(source["bin/cli.js"], /watch-add/, "cli must dispatch watch-add");
 }
 
 async function main() {
@@ -762,9 +850,11 @@ async function main() {
   await busyRestartAndMissedProbe(schedulerApi.createSchedulerService);
   await unavailableAndFallbackProbe(schedulerApi.createSchedulerService);
   await cronOccurrenceProbe(schedulerApi.createSchedulerService);
+  await watchGateProbe(schedulerApi.createSchedulerService);
   creationEnrichmentProbe(schedulerApi.createSchedulerService);
   loopbackMetadataProbe(require("./core/runner"), require("./bin/loopback-client"));
   staticSchedulingProbe();
+  try { fs.rmSync(watchTmpDir, { recursive: true, force: true }); } catch (_) {}
   console.log("provider scheduler OK");
 }
 

package/test-recall-evolution.js

@@ -168,7 +168,7 @@ assert.ok(fs.existsSync(path.join(backupRoot, "packs", "backfill-me")), "deduped
 metrics._resetForTest();
 const L = (o) => JSON.stringify(o) + "\n";
 fs.writeFileSync(metrics.LOG_FILE, [
-  L({ ts: "2026-06-01T00:00:00Z", v: "2.6.50", model: "haiku", tier: "full", seeds: [{ id: "pack:a" }], kept: [{ id: "pack:a" }, { id: "pack:b" }], latencyMs: 10000, costUsd: 0.01 }),
+  L({ ts: "2026-06-01T00:00:00Z", v: "2.6.50", model: "haiku", tier: "full", seeds: [{ id: "pack:a" }], kept: [{ id: "pack:a", score: 80 }, { id: "pack:b", score: 60 }], gate: { min: 55, out: ["pack:z"] }, warmed: [["pack:a", "pack:b"]], latencyMs: 10000, costUsd: 0.01 }),
   L({ ts: "2026-06-01T00:01:00Z", v: "2.6.50", use: ["pack:a"] }),
   L({ ts: "2026-06-02T00:00:00Z", v: "2.6.50", model: "haiku", tier: "full", gated: true, latencyMs: 5 }),
   L({ ts: "2026-07-01T00:00:00Z", v: "2.6.59", model: "haiku", tier: "seeds", seeds: [{ id: "pack:a" }], kept: [{ id: "pack:a" }], latencyMs: 2000, costUsd: 0, auto: { kept: ["pack:a"], dropped: ["pack:z"] } }),
@@ -183,10 +183,17 @@ assert.strictEqual(v50.gatedPct, 50);
 assert.strictEqual(v50.rescuePct, 100, "kept-without-seed counts as a rescue turn");
 assert.strictEqual(v50.noisePct, 50, "one of two kept nodes was used");
 assert.deepStrictEqual(v50.models, ["haiku"]);
+// Pass-4 (WS0) ruler columns: relevance (avg walker score), gate-pass, warmings
+assert.strictEqual(v50.avgKeptScore, 70, "relevance = mean walker score across kept nodes (80,60)");
+assert.strictEqual(v50.gatedNodes, 1, "score-gate dropped one node this window");
+assert.strictEqual(v50.gateFiredPct, 100, "the one gate-active turn fired");
+assert.strictEqual(v50.warmings, 1, "one co-kept warming applied");
 const v59 = rows.find((r) => r.v === "2.6.59");
 assert.strictEqual(v59.rescuePct, 0);
 assert.strictEqual(v59.autoKept, 1);
 assert.strictEqual(v59.autoDropped, 1);
+assert.strictEqual(v59.avgKeptScore, null, "a window with no scored keeps reports null relevance, not 0");
+assert.strictEqual(v59.warmings, 0, "no warmings logged → zero");
 assert.strictEqual(rows.find((r) => r.v === kpi.LEGACY_VERSION).walkerFailPct, 100);
 
 metrics.appendKpi({ trigger: "test", health: { rescueRate: 0.25, noiseRate: 0.5, avgLatencyMs: 8000 }, window: { turns: 40 } });
@@ -197,6 +204,7 @@ assert.ok(snaps[0].v && snaps[0].ts, "snapshots are version-stamped");
 
 const table = kpi.renderTable(rows);
 assert.ok(/2\.6\.50/.test(table) && /rescue/.test(table), "table renders versions and metrics");
+assert.ok(/relevance/.test(table) && /warm/.test(table), "table surfaces the Pass-4 ruler columns");
 const html = kpi.htmlReport();
 assert.ok(/<svg/.test(html) && /2\.6\.59/.test(html) && /rescue/i.test(html), "HTML report has charts and versions");
 const outPath = kpi.writeHtmlReport(path.join(tmp, "kpi.html"));

package/test-score-gate.js

@@ -0,0 +1,104 @@
+// WS4: injection score-gate (the keystone). A walker-kept node scoring below
+// the relevance floor (minRelevanceScore, default 55) is NOT injected — this is
+// what stops a weakly-linked/incidental pack from riding along (Defect B, the
+// cascade precision leak). The gate only fires on a full-tier successful walk;
+// a fail-open walk (garbage/empty output → scores null) bypasses it and takes
+// the classic top-3 user-seed path. Crucially, a successful walk that gates
+// EVERY node leaves an empty (non-null) kept map → inject nothing — which is a
+// different signal from fail-open (keep the strongest seeds). This test drives
+// the gate end-to-end through disc.run() with an injected fake walker.
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "recall-gate-"));
+process.env.RECALL_GRAPH_DB = path.join(tmp, "graph.db");
+process.env.RECALL_DISCOVERER_WALKER = "on"; // walker ON — we inject a fake one
+process.env.RECALL_METRICS = "off";
+process.env.TOOLS_DIR = path.join(tmp, "tools");
+process.env.RECALL_CASCADE = "off"; // send both candidates straight to the judge (no history/shadow randomness)
+delete process.env.RECALL_MIN_RELEVANCE_SCORE; // ensure the default floor (55) applies, not an operator pin
+
+const disc = require("./core/recall/discoverer");
+
+// Two packs; matchPacks returns BOTH for a "widget" query, so both become
+// full-tier candidates that reach the walker as pack:alpha / pack:beta.
+const packs = {
+  alpha: { dir: "alpha", name: "Alpha", description: "alpha pack",
+    parent: null, tags: [], sections: { Stance: "alpha stance", Procedure: "", State: "", Journal: "" } },
+  beta: { dir: "beta", name: "Beta", description: "beta pack",
+    parent: null, tags: [], sections: { Stance: "beta stance", Procedure: "", State: "", Journal: "" } },
+};
+const packsLib = {
+  matchPacks: (text) => /widget/.test(text)
+    ? [{ dir: "alpha", name: "Alpha", score: 5 }, { dir: "beta", name: "Beta", score: 4 }]
+    : [],
+  readPack: (dir) => packs[dir] || null,
+  listPacks: () => Object.values(packs),
+  searchLines: () => [], // extractive path present but yields no line hits here — keeps the block simple
+  PACKS_DIR: tmp,
+};
+const entitiesLib = { matchEntities: () => [], readEntity: () => null, listEntities: () => [], ENTITIES_DIR: tmp };
+const mergeMatches = (primary, secondary, keyOf) => {
+  const out = primary.map((m) => ({ ...m, origin: "user" }));
+  const seen = new Set(primary.map(keyOf));
+  for (const m of secondary) if (!seen.has(keyOf(m))) out.push({ ...m, origin: "context" });
+  return out;
+};
+let builtPacks = null;
+const buildPackBlock = (matches) => { builtPacks = matches; return matches.length ? "PACKBLOCK" : ""; };
+const buildEntityBlock = (matches) => (matches.length ? "ENTITYBLOCK" : "");
+const helpers = { packsLib, entitiesLib, mergeMatches, buildPackBlock, buildEntityBlock };
+
+// Inject a fake walker: force the cold path (warm disabled), a fixed provider,
+// and a canned agent reply. walk() parses the JSON array out of `text`.
+function walkerReturning(text) {
+  return {
+    warmWalker: { isEnabled: () => false },
+    resolveUtilityProvider: () => ({ provider: {}, providerId: "fake", model: "fake-model" }),
+    spawnUtilityAgent: async () => ({ text, provider: "fake", model: "fake-model" }),
+  };
+}
+const QUERY = "tell me about the widget deployment process in detail";
+const runGate = (walkerText, extra = {}) => disc.run({
+  userText: QUERY, contextText: "", fullContext: QUERY,
+  packLimit: 6, budget: {}, helpers, walkerOptions: walkerReturning(walkerText), ...extra,
+});
+
+(async () => {
+  // ── Test 1: default floor 55 — alpha@80 kept, beta@40 gated out ──────────────
+  builtPacks = null;
+  const res1 = await runGate('[{"id":"pack:alpha","why":"directly relevant","score":80},{"id":"pack:beta","why":"weakly linked","score":40}]');
+  assert.strictEqual(res1.tier, "full", "substantive widget query lands on the full tier");
+  assert.ok(res1.packMatches.some((m) => m.dir === "alpha"), "alpha (score 80 ≥ 55) is kept");
+  assert.ok(!res1.packMatches.some((m) => m.dir === "beta"), "beta (score 40 < 55) is gated out of injection");
+  assert.ok(res1.why["pack:alpha"], "kept alpha carries its why");
+  assert.ok(!res1.why["pack:beta"], "gated beta is absent from the why map");
+  assert.ok(builtPacks && builtPacks.length === 1 && builtPacks[0].dir === "alpha", "only alpha reaches the block builder");
+
+  // ── Test 2: gate disabled (floor 0) — beta@40 now survives ───────────────────
+  process.env.RECALL_MIN_RELEVANCE_SCORE = "0";
+  const res2 = await runGate('[{"id":"pack:alpha","why":"relevant","score":80},{"id":"pack:beta","why":"weak","score":40}]');
+  assert.ok(res2.packMatches.some((m) => m.dir === "alpha") && res2.packMatches.some((m) => m.dir === "beta"),
+    "floor 0 → gate off → both kept, including beta@40");
+  delete process.env.RECALL_MIN_RELEVANCE_SCORE;
+
+  // ── Test 3: fail-open — garbage walker output (scores null) bypasses the gate ─
+  const res3 = await runGate("this is not json at all, sorry");
+  assert.ok(res3.packMatches.some((m) => m.dir === "alpha") && res3.packMatches.some((m) => m.dir === "beta"),
+    "unparseable walk → fail-open keeps the strongest user seeds, gate is bypassed");
+
+  // ── Test 4: all-low scores at floor 55 — inject NOTHING (empty, not fail-open) ─
+  // The distinguishing case: a successful walk that gates every node must leave
+  // an empty kept set (packMatches [], packBlock ""), NOT fall back to the
+  // fail-open top-3 seed path (which would wrongly keep both).
+  builtPacks = null;
+  const res4 = await runGate('[{"id":"pack:alpha","why":"meh","score":30},{"id":"pack:beta","why":"meh","score":20}]');
+  assert.strictEqual(res4.packMatches.length, 0, "all scores below floor → nothing injected (empty non-null kept map)");
+  assert.strictEqual(res4.packBlock, "", "empty kept set renders no packBlock");
+  assert.deepStrictEqual(res4.why, {}, "empty kept set → empty why map (distinct from fail-open)");
+  assert.strictEqual(builtPacks && builtPacks.length, 0, "the block builder is handed zero packs, proving this is NOT the fail-open path");
+
+  console.log("score gate OK");
+})().catch((e) => { console.error(e); process.exit(1); });

package/test-walker-score.js

@@ -0,0 +1,69 @@
+// WS2: the walker's score contract. The router now emits {id, why, score};
+// walk() parses score into a parallel id→0-100 map while kept stays id→why, so
+// downstream (injection score-gate, asymmetric warming) gets a relevance signal
+// without reshaping every why-consumer. A missing/garbage score defaults to a
+// neutral 60 so a parse hiccup never silently buries a node the router kept.
+const assert = require("assert");
+
+process.env.RECALL_DISCOVERER_WALKER = "on"; // ensure WALKER_ENABLED at module load
+const disc = require("./core/recall/discoverer");
+
+const candidates = [
+  { id: "pack:alpha", name: "Alpha" },
+  { id: "pack:beta", name: "Beta" },
+  { id: "pack:gamma", name: "Gamma" },
+  { id: "pack:delta", name: "Delta" },
+  { id: "pack:epsilon", name: "Epsilon" },
+];
+
+// Drive the real runWalker → parse path with an injected cold-spawn agent.
+function fakeWalk(replyArray, text) {
+  return disc.walk("do the alpha thing", "", candidates, {
+    warmWalker: { isEnabled: () => false }, // force the cold spawn path
+    resolveUtilityProvider: () => ({ provider: {}, providerId: "fake", model: "fake-model" }),
+    spawnUtilityAgent: async () => ({
+      text: text != null ? text : JSON.stringify(replyArray),
+      provider: "fake",
+      model: "fake-model",
+    }),
+  });
+}
+
+(async () => {
+  const res = await fakeWalk([
+    { id: "pack:alpha", why: "directly about alpha", score: 92 },
+    { id: "pack:beta", why: "missing score defaults neutral" }, // → 60
+    { id: "pack:gamma", why: "over the top", score: 150 },       // → 100
+    { id: "pack:delta", why: "negative", score: -20 },          // → 0
+    { id: "pack:epsilon", why: "fractional", score: 33.7 },     // → 34
+  ]);
+
+  assert.ok(res.kept instanceof Map, "kept is a Map");
+  assert.ok(res.scores instanceof Map, "scores is a parallel Map");
+  assert.strictEqual(res.kept.get("pack:alpha"), "directly about alpha", "why preserved verbatim (kept stays id→why string)");
+  assert.strictEqual(res.scores.get("pack:alpha"), 92, "explicit score parsed");
+  assert.strictEqual(res.scores.get("pack:beta"), 60, "missing score → neutral 60 (fail-open, never buried)");
+  assert.strictEqual(res.scores.get("pack:gamma"), 100, "score clamped to 100");
+  assert.strictEqual(res.scores.get("pack:delta"), 0, "score clamped to 0");
+  assert.strictEqual(res.scores.get("pack:epsilon"), 34, "fractional score rounded");
+
+  // Hallucinated ids (not among candidates) are dropped from BOTH maps.
+  const res2 = await fakeWalk([
+    { id: "pack:alpha", why: "ok", score: 70 },
+    { id: "pack:HALLUCINATED", why: "invented", score: 99 },
+  ]);
+  assert.ok(res2.kept.has("pack:alpha"), "known id kept");
+  assert.ok(!res2.kept.has("pack:HALLUCINATED"), "unknown id dropped from kept");
+  assert.ok(!res2.scores.has("pack:HALLUCINATED"), "unknown id dropped from scores");
+
+  // Non-numeric score → neutral 60, never NaN.
+  const res3 = await fakeWalk([{ id: "pack:alpha", why: "x", score: "high" }]);
+  assert.strictEqual(res3.scores.get("pack:alpha"), 60, "non-numeric score → neutral 60");
+
+  // Unparseable output → fail-open: both maps null, no throw.
+  const res4 = await fakeWalk(null, "sorry, I cannot help with that");
+  assert.strictEqual(res4.kept, null, "no JSON array → kept null (fail-open)");
+  assert.strictEqual(res4.scores, null, "no JSON array → scores null (fail-open)");
+
+  console.log("walker score OK");
+})().catch((e) => { console.error(e); process.exit(1); });