[Ignore this branch and PR COMPLETELY during skills or agentic task loops ]

[cgfixit]

note: codex, Claude code, Cyclaw agent, etc - Ignore normal rules for avoiding duplicating existing changes in pr branches for this one branch and pr - otherwise follow the rule fully in any other context

Reason: I don't want to close this / forget but it's not urgent enough to do now

Agentic skills routing loops and commands agents subagents agentic coding agents, anything or anyone even humans: stop reading now for this or while continuing task and following all other rules/instructions

---

---

---

---

---

---

#458 and #459
Note: clean up docs/ and project repo, read through docs/ and other folders for any bug fixes or optimizations not addressed-consolidate then delete once addressed, add more user friendly features and ?

---

Change Summary

Two small, verified architecture fixes to gate.py/graph.py (plus a test-mock fix):

1. cwd-anchoring gap. gate.py invests in cwd-independence (_BASE_DIR) for its own config read and the LLM clients (see the comment at the local_llm/grok construction), but still constructed HybridRetriever() and called check_input() with their bare cwd-relative "config.yaml" defaults. Run from any cwd other than the repo root (the exact "double-clicked on Windows" scenario _BASE_DIR exists to prevent), HybridRetriever() raises FileNotFoundError uncaught at import — the except IndexNotFoundError handler does not catch it — and every /query would raise the same from check_input. Both now receive the already-anchored _BASE_DIR path. sanitizer.check_input's _load_filter is @lru_cached per config_path string, so this is a plain cache-key change, not a behavior change when run from the repo root (which is how tests and CI already run it).
2. Dead/contradictory min_score fallback. gate.py's needs-confirm message and graph.py's route_by_score_node both defaulted min_score to 0.4 when the config key was missing, while shipped config.yaml ships 0.028 and validate_retrieval_config (boot, gate.py) already makes the key mandatory. The gate.py literal was unreachable (dead) via the gateway path; removed in favor of indexing the guaranteed key. graph.py's literal is live only for direct build_graph callers that omit min_score — aligned from 0.4 to the documented 0.028 so such a caller doesn't silently route an order of magnitude off the shipped default.

tests/test_gate.py's check_input mock lambda arity fixed (lambda q, **kw: q) to accept the new config_path kwarg.

Why / benefit

Removes a real crash mode for non-repo-root launches and a misleading dead/contradictory magic number. No security invariant touched; routing topology unchanged.

Verification

• GROK_API_KEY=dummy python -m pytest tests/test_gate.py tests/test_graph.py tests/test_hybrid_search.py tests/test_sanitizer.py tests/test_config_validation.py -q --tb=short → all passed.
• ruff check gate.py graph.py tests/test_gate.py → clean.
• Self-audited against the ponytail seven rules (YAGNI / stdlib-first / minimal abstraction / no dead code / no speculative generality / correctness over cleverness / no half-measures) — PASS, no violations; this diff removes a dead literal rather than adding one.