@windyroad/risk-scorer 0.14.3 → 0.15.0

package/.claude-plugin/plugin.json

@@ -310,5 +310,5 @@
     }
   },
   "name": "wr-risk-scorer",
-  "version": "0.14.3"
+  "version": "0.15.0"
 }

package/hooks/risk-scorer-scaffold-nudge.sh

@@ -41,10 +41,23 @@ PROJECT_DIR="${CLAUDE_PROJECT_DIR:-.}"
 POLICY_FILE="$PROJECT_DIR/RISK-POLICY.md"
 REGISTER_DIR="$PROJECT_DIR/docs/risks"
 
-# Silent when the project does not have a risk policy. The policy file
-# presence is the user authorisation for the register to exist; without
-# it, the absence of docs/risks/ is not a governance gap.
-[ -f "$POLICY_FILE" ] || exit 0
+# Silent when the project dir itself does not exist — no adopter project
+# to nudge (e.g. a stale CLAUDE_PROJECT_DIR).
+[ -d "$PROJECT_DIR" ] || exit 0
+
+# Policy file absent entirely (P379, inverse predicate of the
+# register-missing arm below). Without a RISK-POLICY.md the risk-scorer
+# gates run at their default appetite (5 per ADR-086) silently, and the
+# capability sits dormant with no surfacing that a policy can be authored.
+# Nudge the adopter to author one via /wr-risk-scorer:update-policy. The
+# original guard treated bare policy-absence as a non-gap; the P379 review
+# (ADR-047 Amendment 2026-06-28) records the predicate reversal. Read-only
+# — the hook never writes; the policy authoring is gated behind the user
+# invoking the on-demand skill.
+if [ ! -f "$POLICY_FILE" ]; then
+  echo "[wr-risk-scorer] No RISK-POLICY.md in this project — run /wr-risk-scorer:update-policy to author one so the risk-scorer gates score against your appetite instead of the default."
+  exit 0
+fi
 
 # Register directory missing — nudge to scaffold it.
 if [ ! -d "$REGISTER_DIR" ]; then

package/hooks/test/risk-scorer-scaffold-nudge.bats

@@ -13,6 +13,11 @@
 # pending-review backlog self-surfaces (class-B) instead of rotting
 # silently once stubs exist (the audit's "one step short of the jtbd
 # pattern" gap).
+#
+# P379 (2026-06-28): inverse predicate of the register-missing arm — when
+# RISK-POLICY.md is ABSENT ENTIRELY the hook nudges the adopter to author
+# one via /wr-risk-scorer:update-policy (the gates otherwise run at the
+# default appetite silently). Same AFK-suppress envelope (ADR-068).
 # Behavioural — exercises the hook against fixture trees and asserts on stdout.
 
 setup() {
@@ -20,6 +25,11 @@ setup() {
   HOOK="$REPO_ROOT/packages/risk-scorer/hooks/risk-scorer-scaffold-nudge.sh"
   PLUGIN_ROOT="$REPO_ROOT/packages/risk-scorer"
   DIR="$(mktemp -d)"
+  # Hermeticity (P391): the AFK work-problems orchestrator exports
+  # WR_SUPPRESS_OVERSIGHT_NUDGE=1, which the hook self-suppresses on. Unset it so
+  # nudge-emitting tests assert real behaviour; guard-specific tests set it
+  # per-invocation via `run env WR_SUPPRESS_OVERSIGHT_NUDGE=...`.
+  unset WR_SUPPRESS_OVERSIGHT_NUDGE
 }
 
 teardown() {
@@ -81,16 +91,24 @@ teardown() {
   [ -z "$output" ]
 }
 
-@test "silent when RISK-POLICY.md is absent (no policy file = no register expectation)" {
+@test "emits a policy-authoring nudge when RISK-POLICY.md is absent (P379 inverse predicate)" {
   run env CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" bash "$HOOK"
   [ "$status" -eq 0 ]
-  [ -z "$output" ]
+  [[ "$output" == *"No RISK-POLICY.md"* ]]
+  [[ "$output" == *"/wr-risk-scorer:update-policy"* ]]
 }
 
-@test "silent when RISK-POLICY.md is absent even if docs/risks/ exists" {
+@test "policy-absent nudge fires even when docs/risks/ exists (policy-absence wins, P379)" {
   mkdir -p "$DIR/docs/risks"
   run env CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" bash "$HOOK"
   [ "$status" -eq 0 ]
+  [[ "$output" == *"No RISK-POLICY.md"* ]]
+  [[ "$output" == *"/wr-risk-scorer:update-policy"* ]]
+}
+
+@test "AFK guard suppresses the policy-absent nudge too (P379)" {
+  run env WR_SUPPRESS_OVERSIGHT_NUDGE=1 CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" bash "$HOOK"
+  [ "$status" -eq 0 ]
   [ -z "$output" ]
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.14.3",
+  "version": "0.15.0",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "bin": {
     "windyroad-risk-scorer": "./bin/install.mjs"
@@ -25,6 +25,7 @@
     "skills/",
     ".claude-plugin/",
     "lib/",
-    "scripts/"
+    "scripts/",
+    "!skills/*/eval/"
   ]
 }