Implement PMEM-WP-0016 ops-warden cross-runtime memory contracts.

Add ops-warden coordination profile, session event schemas, activation helpers,
adapter pack, evaluation scenarios, and contract documentation for shared memory
across worker, agent session, and operator CLI surfaces.

tests/test_ops_warden_memory.py

@@ -0,0 +1,150 @@
+import json
+from pathlib import Path
+
+from phase_memory.ops_warden import (
+    OPS_WARDEN_ACTIVATION_SCHEMA,
+    OPS_WARDEN_MEMORY_STATUS_SCHEMA,
+    OPS_WARDEN_PROFILE_ID,
+    OPS_WARDEN_RUNTIME_SCHEMA,
+    OPS_WARDEN_SESSION_EVENT_SCHEMA,
+    activate_ops_warden_memory,
+    build_session_event,
+    memory_enabled,
+    ops_warden_adapter_pack,
+    ops_warden_coordination_profile,
+    ops_warden_evaluation_metrics,
+    record_session_event,
+    resolve_session_kind,
+    session_kind_for_agent,
+    stabilized_route_match,
+    validate_memory_write,
+    validate_ops_warden_profile,
+)
+from phase_memory.external_adapters import validate_adapter_pack_manifest
+
+FIXTURES = Path(__file__).parent / "fixtures"
+
+
+def test_ops_warden_profile_validates_with_activation_budget() -> None:
+    profile = ops_warden_coordination_profile(FIXTURES / "ops-warden-coordination-profile.json")
+    validation = validate_ops_warden_profile(profile)
+
+    assert profile["id"] == OPS_WARDEN_PROFILE_ID
+    assert profile["policy"]["secrets_allowed"] is False
+    assert validation["valid"] is True
+
+
+def test_validate_memory_write_rejects_secret_like_payload() -> None:
+    ok, diagnostics = validate_memory_write(
+        {
+            "command": "access",
+            "outcome": "resolved",
+            "metadata": {"token": "super-secret-token"},
+        }
+    )
+
+    assert ok is False
+    assert diagnostics[0].code == "ops_warden_memory_secret_field_rejected"
+
+
+def test_session_kind_supports_known_and_future_agents() -> None:
+    assert session_kind_for_agent("grok") == "warden.agent.grok"
+    assert session_kind_for_agent(None) == "warden.operator"
+    assert resolve_session_kind({"WARDEN_AGENT_ID": "claude"}) == "warden.agent.claude"
+    assert resolve_session_kind({"WARDEN_SESSION_KIND": "warden.worker"}) == "warden.worker"
+
+
+def test_record_and_activate_ops_warden_memory_round_trip(tmp_path) -> None:
+    store = tmp_path / "memory"
+    record_session_event(
+        store,
+        build_session_event(
+            command="route find",
+            session_kind="warden.agent.grok",
+            outcome="resolved",
+            need="openrouter api key",
+            route_id="openrouter-llm-connect",
+            agent_id="grok",
+            session_id="sess-1",
+        ),
+    )
+    record_session_event(
+        store,
+        build_session_event(
+            command="route find",
+            session_kind="warden.agent.grok",
+            outcome="resolved",
+            need="openrouter api key",
+            route_id="openrouter-llm-connect",
+            agent_id="grok",
+            session_id="sess-1",
+        ),
+    )
+
+    activation = activate_ops_warden_memory(
+        store,
+        session_kind="warden.worker",
+        need="openrouter api key",
+        session_id="worker-1",
+    )
+
+    assert activation["schema_version"] == OPS_WARDEN_ACTIVATION_SCHEMA
+    assert activation["stabilized_route"]["route_id"] == "openrouter-llm-connect"
+    assert activation["llm_calls_avoided"] is True
+
+
+def test_cross_runtime_continuity_is_visible_to_worker_activation(tmp_path) -> None:
+    store = tmp_path / "memory"
+    record_session_event(
+        store,
+        build_session_event(
+            command="route find",
+            session_kind="warden.agent.codex",
+            outcome="resolved",
+            need="npm token",
+            route_id="openbao-api-key",
+            agent_id="codex",
+        ),
+    )
+    activation = activate_ops_warden_memory(store, session_kind="warden.worker", need="npm token")
+
+    kinds = {item.get("session_kind") for item in activation["selected_episodes"] if item.get("kind") == "episode"}
+    assert "warden.agent.codex" in kinds
+
+
+def test_ops_warden_evaluation_metrics_and_adapter_pack() -> None:
+    scenarios = json.loads((FIXTURES / "ops-warden-evaluation-scenarios.json").read_text(encoding="utf-8"))
+    events = scenarios["scenarios"][0]["events"]
+    metrics = ops_warden_evaluation_metrics(events)
+    pack = ops_warden_adapter_pack()
+    diagnostics = validate_adapter_pack_manifest(pack)
+
+    assert metrics["cross_runtime_continuity"] == 1.0
+    assert metrics["routing_repeat_accuracy"] > 0
+    assert not any(item.severity == "error" for item in diagnostics)
+    assert pack.name == "ops-warden-coordination"
+
+
+def test_stabilized_route_match_requires_confirmations() -> None:
+    events = [
+        {"need_fingerprint": "abc", "route_id": "openbao-api-key", "outcome": "resolved"},
+        {"need_fingerprint": "abc", "route_id": "openbao-api-key", "outcome": "resolved"},
+    ]
+
+    assert stabilized_route_match(events, need_fingerprint_value="abc")["route_id"] == "openbao-api-key"
+    assert stabilized_route_match(events[:1], need_fingerprint_value="abc") is None
+
+
+def test_memory_enabled_honors_opt_out() -> None:
+    assert memory_enabled({"WARDEN_MEMORY": "1"}) is True
+    assert memory_enabled({"WARDEN_MEMORY": "0"}) is False
+
+
+def test_ops_warden_evaluation_report_passes_fixture_scenarios() -> None:
+    from phase_memory.ops_warden import ops_warden_evaluation_report
+
+    scenarios = json.loads((FIXTURES / "ops-warden-evaluation-scenarios.json").read_text(encoding="utf-8"))
+    report = ops_warden_evaluation_report(scenarios)
+
+    assert report["valid"] is True
+    assert report["metrics"]["scenario_count"] == 3