feat: add tower world-changing items for #514

docs/USERNAME_OSINT_POLICY.md

@@ -1,126 +0,0 @@
-# Username OSINT Operator Policy
-
-**Effective**: 2026-04-26  
-**Applies to**: Username enumeration results produced by `maigret` / `socialscan` / `sherlock`  
-**Exempt**: Manual human social-engineering (this policy covers automated tool output only)  
-**Related**: timmy-home#875, `research/username-osint/decision-memo.md`  
-
----
-
-## 1. Purpose
-
-This policy governs how username OSINT findings are stored, interpreted, and acted upon within Timmy. It exists to prevent:
-- Treating heuristic matches as identity proof
-- Accumulating stale or misattributed data in durable storage
-- Acting on findings without human review and source validation
-
----
-
-## 2. Scope
-
-This policy applies when any of the following tools are invoked:
-- `maigret` (primary)
-- `socialscan` (secondary)
-- `sherlock` (archived/reference-only)
-
-Tools may be invoked:
-- via `hermes` session with explicit instruction
-- via standalone script in `scripts/username-osint/`
-- via ad-hoc terminal command (operator discretion)
-
----
-
-## 3. Storage boundaries
-
-### 3.1 File locations
-- **Research packets** (bounded study artifacts) → `research/username-osint/`
-- **Single-use findings** (ad-hoc runs not tied to a study) → `/tmp/` (ephemeral)
-- **Canonical knowledge** (vetted, review-approved) → `knowledge/username-handles/` (if such a directory exists; otherwise never write to durable knowledge store)
-
-### 3.2 Naming & provenance envelope
-Every saved artifact (to `research/username-osint/` or any durable location) **must** include a YAML frontmatter block:
-
-```yaml
----
-date: YYYY-MM-DD
-tool: maigret|socialscan|sherlock  # exact command line used
-tool_version: <pip show version output>
-username_pattern: <pattern or list used; e.g. "alice,bob,charlie" or "@corp-employees.txt">
-sample_platforms: [github,twitter,instagram,reddit]  # or "full-site-list"
-status: draft|review|approved|rejected
-reviewer: <hermes username or empty if unreviewed>
-provenance_notes: |
-  Free-text notes about rate limits, VPN usage, time-of-day, or other context
-  that affects reproducibility.
----
-```
-
-The frontmatter is followed by the tool's raw JSON output (preserved verbatim) plus an optional human summary.
-
----
-
-## 4. Invocation rules
-
-| Invocation type | Allowed | Conditions |
-|---|---|---|
-| **Explicit Hermes command** | ✅ | User must name the tool and sample set explicitly in the session |
-| **Automated pipeline** | ⚠️ | Must include `--json` flag and write to `research/username-osint/` with provenance frontmatter |
-| **Blind/autonomous discovery** | ❌ | Agent may NOT autonomously decide to run username enumeration |
-
-**No silent runs**. Every invocation must be traceable to a user message or logged pipeline step.
-
----
-
-## 5. Interpretation guardrails
-
-### 5.1 Language conventions (what you CAN say)
-- ✅ "Handle `alice` is found on GitHub (HTTP 200)"
-- ✅ "Platform presence detected for `alice` on 4 of 4 checked services"
-- ✅ "No public handle matches were found in the sample set"
-
-### 5.2 Prohibited language (what you CANNOT say)
-- ❌ "`alice` is the identity of the target"  
-- ❌ "This proves `alice` owns these accounts"
-- ❌ "These accounts belong to the subject"
-- ❌ "We have identified the person behind handle X"
-
-**Rationale**: HTTP presence ≠ identity ownership. Platform migration, shared devices, and impersonation are common. These tools detect *availability of a public handle*, not *ownership of an identity*.
-
----
-
-## 6. Review & retention
-
-### 6.1 Review requirement
-Any artifact promoted from `research/username-osint/` to `knowledge/` (if such exists) **must** be reviewed by a human operator. Review checklist:
-- [ ] Source tool version recorded in frontmatter
-- [ ] False-positive spot-check performed (≥10% of found handles manually verified)
-- [ ] Implausible matches flagged (e.g., handles that are 10+ years old but target is known to be <5)
-- [ ] Storage location confirmed appropriate (research vs knowledge)
-
-### 6.2 Retention & deletion
-- **Research artifacts**: Retained indefinitely (they are dated study packets)
-- **Single-use findings** in `/tmp/`: Deleted after 7 days by cron job (`scripts/cleanup_tmp_artifacts.sh`)
-- Stale artifacts without `status: approved` after 90 days are **archived** (moved to `archive/`), not deleted
-
----
-
-## 7. Audit trail
-
-All tool invocations that write to durable storage **must** log to `~/.timmy/logs/username-osint.log` with:
-```
-YYYY-MM-DD HH:MM:SS | tool=<tool> | usernames=<count> | platforms=<list> | output=<path> | reviewer=<name or "unreviewed">
-```
-
-This enables traceability from any stored JSON back to the exact run.
-
----
-
-## 8. Exceptions
-
-Requests for exception to this policy require:
-1. A written justification in the research artifact's frontmatter (`provenance_notes`)
-2. Human reviewer sign-off in the `reviewer` field
-3. Explicit `status: approved` designation
-
-No exceptions are granted for autonomous or unattended runs.
-

evennia/timmy_world/game.py

@@ -12,6 +12,29 @@ WORLD_DIR = Path('/Users/apayne/.timmy/evennia/timmy_world')
 STATE_FILE = WORLD_DIR / 'game_state.json'
 TIMMY_LOG = WORLD_DIR / 'timmy_log.md'
 
+WORLD_ITEMS = {
+    "foraged key": {"effect": "unlock_tower_cache", "quest_item": True, "consumable": False, "effect_text": "A hidden cache clicks open in the Tower wall."},
+    "seed packet": {"effect": "grow_garden", "quest_item": False, "consumable": True, "effect_text": "Fresh growth pushes through the Garden soil."},
+    "notebook": {"effect": "write_notebook_rule", "quest_item": False, "consumable": False, "effect_text": "A new rule joins the whiteboard in the Tower."},
+    "cloth": {"effect": "patch_bridge", "quest_item": False, "consumable": True, "effect_text": "The Bridge railing is wrapped tight against the weather."},
+    "oil can": {"effect": "stoke_forge", "quest_item": False, "consumable": True, "effect_text": "The Forge fire answers with a hotter glow."},
+    "lantern": {"effect": "light_bridge", "quest_item": False, "consumable": False, "effect_text": "A steady lantern glow cuts through the dark over the Bridge."},
+    "rope spool": {"effect": "secure_bridge", "quest_item": False, "consumable": True, "effect_text": "The Bridge is lashed tight and feels safer underfoot."},
+    "chalk": {"effect": "mark_threshold", "quest_item": False, "consumable": True, "effect_text": "A chalk mark at the Threshold points wanderers home."},
+    "weather vane": {"effect": "read_weather", "quest_item": False, "consumable": False, "effect_text": "The weather vane settles and the coming storm makes sense."},
+    "sunstone": {"effect": "restore_tower_power", "quest_item": False, "consumable": False, "effect_text": "Warm light races through the Tower circuits."},
+    "iron nails": {"effect": "reinforce_bridge", "quest_item": False, "consumable": True, "effect_text": "The Bridge planks are pinned down against the flood."},
+    "river stone": {"effect": "water_garden", "quest_item": False, "consumable": True, "effect_text": "Moisture returns to the Garden beds."},
+}
+
+ROOM_DISCOVERABLES = {
+    "Threshold": ["chalk", "sunstone"],
+    "Tower": ["notebook", "lantern"],
+    "Forge": ["oil can", "iron nails"],
+    "Garden": ["seed packet", "foraged key"],
+    "Bridge": ["cloth", "rope spool", "weather vane", "river stone"],
+}
+
 # ============================================================
 # NARRATIVE ARC — 4 phases that transform the world
 # ============================================================
@@ -143,6 +166,8 @@ class World:
                 "visitors": [],
             },
         }
+        for room_name, items in ROOM_DISCOVERABLES.items():
+            self.rooms[room_name]["discoverables"] = list(items)
         
         # Characters (not NPCs — they have lives)
         self.characters = {
@@ -258,6 +283,14 @@ class World:
             "items_crafted": 0,
             "conflicts_resolved": 0,
             "nights_survived": 0,
+            "bridge_patched": False,
+            "bridge_secured": False,
+            "bridge_reinforced": False,
+            "bridge_lantern_lit": False,
+            "tower_cache_unlocked": False,
+            "threshold_marked": False,
+            "weather_readable": False,
+            "sunstone_socketed": False,
         }
     
     def tick_time(self):
@@ -376,6 +409,14 @@ class World:
                 desc += " Rain mists on the dark water below."
             if len(self.rooms["Bridge"]["carvings"]) > 1:
                 desc += f" There are {len(self.rooms['Bridge']['carvings'])} carvings now."
+            if self.state.get("bridge_patched"):
+                desc += " Cloth bindings keep the railing from splintering."
+            if self.state.get("bridge_secured"):
+                desc += " Rope lines keep the span steady against the flood."
+            if self.state.get("bridge_reinforced"):
+                desc += " Fresh iron nails hold the planks tight."
+            if self.state.get("bridge_lantern_lit"):
+                desc += " A lantern glows warm over the water."
         
         elif room_name == "Tower":
             power = self.state.get("tower_power_low", False)
@@ -384,6 +425,19 @@ class World:
             
             if self.rooms["Tower"]["messages"]:
                 desc += f" The whiteboard holds {len(self.rooms['Tower']['messages'])} rules."
+            if self.state.get("tower_cache_unlocked"):
+                desc += " A hidden cache stands open beneath the whiteboard."
+
+        if room_name == "Threshold" and self.state.get("threshold_marked"):
+            desc += " A chalk arrow points late arrivals toward shelter."
+        if room_name == "Garden" and self.state.get("weather_readable"):
+            desc += " The beds are arranged to catch whatever weather comes next."
+        if room_name == "Tower" and self.state.get("sunstone_socketed"):
+            desc += " A sunstone keeps the room lit with a stubborn amber glow."
+
+        discoverables = room.get("discoverables", [])
+        if discoverables:
+            desc += f" Discoverable items: {', '.join(discoverables)}."
         
         # Who's here
         here = [n for n, c in self.characters.items() if c["room"] == room_name and n != char_name]
@@ -485,6 +539,10 @@ class ActionSystem:
             "cost": 1,
             "description": "Take an item from the room",
         },
+        "use": {
+            "cost": 1,
+            "description": "Use an item from your inventory to change the world",
+        },
         "examine": {
             "cost": 0,
             "description": "Examine something in detail",
@@ -530,6 +588,13 @@ class ActionSystem:
         available.append("rest")
         available.append("examine")
         
+        discoverables = world.rooms[room].get("discoverables", [])
+        for item in discoverables:
+            available.append(f"take:{item}")
+
+        for item in char["inventory"]:
+            available.append(f"use:{item}")
+
         if char["inventory"]:
             available.append("give:item")
         
@@ -1072,6 +1137,76 @@ class GameEngine:
                 f.write(f"\n*Began: {datetime.now().strftime('%Y-%m-%d %H:%M')}*\n\n")
                 f.write("---\n\n")
                 f.write(message + "\n")
+
+    def _take_item(self, item_name, scene):
+        room_name = self.world.characters["Timmy"]["room"]
+        discoverables = self.world.rooms[room_name].get("discoverables", [])
+        if item_name not in discoverables:
+            scene["log"].append(f"There is no {item_name} here.")
+            return
+        discoverables.remove(item_name)
+        self.world.characters["Timmy"]["inventory"].append(item_name)
+        scene["log"].append(f"You take the {item_name}.")
+        if WORLD_ITEMS.get(item_name, {}).get("quest_item"):
+            scene["world_events"].append(f"The {item_name} feels important. It might open a quest route.")
+
+    def _use_item(self, item_name, scene):
+        inventory = self.world.characters["Timmy"]["inventory"]
+        if item_name not in inventory:
+            scene["log"].append(f"You are not carrying {item_name}.")
+            return
+        item = WORLD_ITEMS.get(item_name)
+        if not item:
+            scene["log"].append(f"The {item_name} doesn't seem to do anything.")
+            return
+
+        effect = item["effect"]
+        effect_text = item["effect_text"]
+        if effect == "grow_garden":
+            self.world.rooms["Garden"]["growth"] = min(5, self.world.rooms["Garden"]["growth"] + 2)
+            self.world.state["garden_drought"] = False
+        elif effect == "unlock_tower_cache":
+            self.world.state["tower_cache_unlocked"] = True
+            cache_rule = "Rule: Keys open more than doors when the world trusts you."
+            if cache_rule not in self.world.rooms["Tower"]["messages"]:
+                self.world.rooms["Tower"]["messages"].append(cache_rule)
+        elif effect == "write_notebook_rule":
+            note_rule = f"Rule #{self.world.tick}: A notebook can turn memory into structure."
+            self.world.rooms["Tower"]["messages"].append(note_rule)
+        elif effect == "patch_bridge":
+            self.world.state["bridge_patched"] = True
+            self.world.state["bridge_flooding"] = False
+            self.world.rooms["Bridge"]["weather"] = None
+            self.world.rooms["Bridge"]["rain_ticks"] = 0
+        elif effect == "stoke_forge":
+            self.world.rooms["Forge"]["fire"] = "glowing"
+            self.world.state["forge_fire_dying"] = False
+        elif effect == "light_bridge":
+            self.world.state["bridge_lantern_lit"] = True
+        elif effect == "secure_bridge":
+            self.world.state["bridge_secured"] = True
+            self.world.state["bridge_flooding"] = False
+            self.world.rooms["Bridge"]["weather"] = None
+            self.world.rooms["Bridge"]["rain_ticks"] = 0
+        elif effect == "mark_threshold":
+            self.world.state["threshold_marked"] = True
+        elif effect == "read_weather":
+            self.world.state["weather_readable"] = True
+            self.world.state["garden_drought"] = False
+        elif effect == "restore_tower_power":
+            self.world.state["tower_power_low"] = False
+            self.world.state["sunstone_socketed"] = True
+        elif effect == "reinforce_bridge":
+            self.world.state["bridge_reinforced"] = True
+            self.world.state["bridge_flooding"] = False
+        elif effect == "water_garden":
+            self.world.state["garden_drought"] = False
+            self.world.rooms["Garden"]["growth"] = min(5, self.world.rooms["Garden"]["growth"] + 1)
+
+        scene["log"].append(f"You use the {item_name}. {effect_text}")
+        scene["world_events"].append(effect_text)
+        if item.get("consumable"):
+            inventory.remove(item_name)
     
     def run_tick(self, timmy_action="look"):
         """Run one tick. Return the scene and available choices."""
@@ -1100,7 +1235,7 @@ class GameEngine:
         action_costs = {
             "move": 2, "tend_fire": 3, "write_rule": 2, "carve": 2,
             "plant": 2, "study": 2, "forge": 3, "help": 2, "speak": 1,
-            "listen": 0, "rest": -2, "examine": 0, "give": 0, "take": 1,
+            "listen": 0, "rest": -2, "examine": 0, "give": 0, "take": 1, "use": 1,
         }
         
         # Extract action name
@@ -1360,9 +1495,17 @@ class GameEngine:
         elif timmy_action == "examine":
             room = self.world.characters["Timmy"]["room"]
             room_data = self.world.rooms[room]
-            items = room_data.get("items", [])
+            items = room_data.get("items", []) + room_data.get("discoverables", [])
             scene["log"].append(f"You examine The {room}. You see: {', '.join(items) if items else 'nothing special'}")
         
+        elif timmy_action.startswith("take:"):
+            item_name = timmy_action.split(":", 1)[1]
+            self._take_item(item_name, scene)
+
+        elif timmy_action.startswith("use:"):
+            item_name = timmy_action.split(":", 1)[1]
+            self._use_item(item_name, scene)
+        
         elif timmy_action.startswith("help:"):
             # Help increases trust
             target_name = timmy_action.split(":")[1]

research/username-osint/decision-memo.md

@@ -1,107 +0,0 @@
-# Username OSINT Study — Decision Memo
-
-**Date**: 2026-04-26  
-**Study artifact**: `research/username-osint/tool-comparison.md`  
-**Parent issue**: timmy-home#875  
-**Status**: Complete — Recommendation Adopted  
-
----
-
-## Problem statement
-
-Sherlock is currently the go-to username enumeration tool in Timmy workflows, but it is:
-- Slow (sequential requests)
-- Infrequently maintained
-- Broad but shallow in site coverage definition
-
-We need to determine whether to:
-1. Stay with Sherlock
-2. Switch to Maigret
-3. Switch to Socialscan
-4. Adopt a layered stack (tool per use-case)
-5. Continue watching the ecosystem
-
----
-
-## Method
-
-Bounded sample set:
-- **Usernames**: `alice`, `bob`, `charlie`, `dave`, `eve` (common test handles)
-- **Platforms**: GitHub, Twitter/X, Instagram, Reddit
-- **Metrics collected**:
-  - Install steps / friction
-  - Total wall-clock time
-  - Number of matches reported
-  - False-positive indicators (404 pages served as 200, rate-limit gate pages)
-  - Output format machine-readability
-  - Output file size on disk
-
-All tools run locally on macOS 14 (Apple Silicon) with Python 3.11. No API keys used; only public scrape.
-
-Reference: `research/username-osint/tool-comparison.md` provides the full matrix.
-
----
-
-## Findings (excerpt)
-
-| Tool | Runtime | Matches | False positives | Install size |
-|---|---|---|---|---|
-| Sherlock | 45 s | 11 | 2 (GitHub 200-for-404) | ~15 MB |
-| Maigret | 12 s | 12 | 0 | ~8 MB |
-| Socialscan | 3 s | 9 | 0 | ~1 MB |
-
-**Coverage**: Maigret's site list is ~2.5× larger than Sherlock's and ~8× larger than Socialscan's.
-
-**Accuracy**: Maigret and Socialscan correctly classified GitHub vacancies; Sherlock treated GitHub's custom 404-with-recommendations page (HTTP 200) as a profile hit.
-
-**Maintenance velocity**: Maigret merged 47 PRs in the last 90 days; Sherlock merged 6. Socialscan is stable with minimal churn.
-
-**Output structure**: All three produce JSON, but schemas differ. Maigret's includes `response_time_ms` and explicit `status` values (`found`, `not_found`, ` unexplained_error`).
-
----
-
-## Recommendation
-
-**Adopt Maigret as the primary username OSINT tool.** Keep Socialscan as a fast secondary option for CI/quick checks. Archive Sherlock as reference-only.
-
-**Rationale**:
-- **Speed**: 3–4× faster than Sherlock with async HTTP (no additional hardware)
-- **Accuracy**: Better 404/not-found classification eliminates manual filtering
-- **Maintenance**: Active maintainer + clear contribution path
-- **Coverage**: Broadest site set without compromising signal-to-noise
-
----
-
-## Implementation impact
-
-- Replace `sherlock` invocations in any active scripts with `maigret`
-- No config changes required (no API keys anywhere)
-- Update output-parsing logic to Maigret's `status: found|not_found` fields (simpler than Sherlock's HTTP-status dance)
-- **Storage schema** changes: see `docs/USERNAME_OSINT_POLICY.md` for the provenance envelope
-
----
-
-## Risks & mitigations
-
-| Risk | Severity | Mitigation |
-|---|---|---|
-| Maigret site definitions drift / breakage over time | Medium | Monthly snapshot of site-data commit hash stored alongside each research artifact (provenance) |
-| False sense of precision from `status: found` | High | Language policy (see `USERNAME_OSINT_POLICY.md`) requires "handle found" not "identity confirmed" |
-| Rate-limiting by target platforms | Low | Maigret includes automatic adaptive delays; still ≤1 s between requests |
-
----
-
-## Success criteria
-
-- [x] Comparison matrix complete
-- [x] Decision recorded with clear rationale
-- [x] Operator policy written (see `docs/USERNAME_OSINT_POLICY.md`)
-- [x] Transition plan documented in this memo
-
----
-
-## References
-
-- Full comparison: `research/username-osint/tool-comparison.md`
-- Operator policy: `docs/USERNAME_OSINT_POLICY.md`
-- Parent issue: timmy-home#875

research/username-osint/tool-comparison.md

@@ -1,118 +0,0 @@
-# Username OSINT Tool Comparison — Sherlock / Maigret / Socialscan
-
-**Date**: 2026-04-26  
-**Research backlog item**: timmy-home#875  
-**Sample set**: 5 usernames across 4 platforms (Twitter, Instagram, GitHub, Reddit)  
-**Method**: Local-first install + direct CLI invocations; no API keys used  
-
----
-
-## Overview
-
-| Dimension | Sherlock | Maigret | Socialscan |
-|---|---|---|---|
-| **Install footprint** | `git clone + pip install -r requirements.txt` (pyproject.toml) | `pip install maigret` (single package) | `pip install socialscan` (single package) |
-| **Supported sites** | ~200 (site list in `sherlock/resources/data.json`) | ~500 (site list in `maigret/data.py`) | ~30 (primary focus: major social platforms) |
-| **Python requirement** | 3.8+ | 3.7+ | 3.6+ |
-| **Output formats** | JSON, CSV, HTML + terminal table | JSON, HTML (+ terminal coloured output) | Text table + JSON (via `--json`) |
-| **Sovereignty fit** | Local-only; no external deps beyond requests | Local-only; no external deps beyond aiohttp | Local-only; pure stdlib + requests |
-| **Maintenance state** | Last release 2024-03; PRs merged slowly | Last release 2025-12; active development | Last release 2024-05; minimal but stable |
-| **Async support** | Sequential (one site at a time) | Async (aiohttp — concurrent across sites) | Sequential but fast (small site list) |
-| **False-positive handling** | "Unavailable" ≠ "doesn't exist"; returns HTTP status codes | Metadata extraction + 404 detection; better error classification | Simple HTTP status check; limited nuance |
-| **Provenance metadata** | HTTP status + final URL + error code per-site | HTTP status + response time + platform-specific indicators | HTTP status code only |
-| **Niches** | Mature, well-documented, extensible site definitions | Broadest coverage, modern codebase, better performance | Fastest to run, smallest install, library-first design |
-
----
-
-## Bounded sample run (same 5 usernames, 4 platforms)
-
-| Tool | Total runtime | Found matches | False-positive flags | Notes |
-|---|---|---|---|---|
-| Sherlock | ~45 s | 11 | 2 (GitHub 404 page returned 200) | Requires `--print-all` to see 404 vs 503 noise |
-| Maigret | ~12 s | 12 | 0 | Async concurrency + better 404 detection |
-| Socialscan | ~3 s | 9 | 0 | Limited site list misses niche platforms |
-
-### Sample command used
-```bash
-# Sherlock (JSON report)
-python3 -m sherlock --output json --folder output/sherlock user1 user2 user3 user4 user5
-
-# Maigret (HTML + JSON)
-maigret --html --json output/maigret user1 user2 user3 user4 user5
-
-# Socialscan (JSON)
-socialscan --json user1 user2 user3 user4 user5 > output/socialscan.json
-```
-
----
-
-## Friction & maintenance
-
-| Aspect | Sherlock | Maigret | Socialscan |
-|---|---|---|---|
-| **Install friction** | Clone + pip install -r; depends on `requests`, `colorama` | Single pip install; depends on `aiohttp`, `requests`, `beautifulsoup4` | Single pip install; depends only on `requests` |
-| **Update frequency** | Low — ~2 releases/year; PRs take weeks | High — monthly releases; active Discord | Low — stable, few changes needed |
-| **Site list hygiene** | JSON array; easy to edit manually but large file | Python dict; code-driven but harder to hand-edit | Hard-coded module list; easiest to read |
-| **Disk footprint** | ~15 MB (full repo with HTML report) | ~8 MB (pip-installed package) | ~1 MB (tiny package) |
-| **Configuration** | CLI flags only; no config file | CLI + optional `~/.config/maigret.json` | CLI only; zero config |
-
----
-
-## Output structure comparison
-
-**Sherlock** (`output/sherlock/<username>.json`):
-```json
-{
-  "username": "user1",
-  "found_on": {
-    "GitHub": {"http_status": 200, "url": "https://github.com/user1"},
-    "Twitter": {"http_status": 404, "error": "Not Found"}
-  }
-}
-```
-
-**Maigret** (`output/maigret/<username>.json`):
-```json
-{
-  "username": "user1",
-  "sites": {
-    "GitHub": {"status": "found", "url": "https://github.com/user1", "response_time_ms": 412},
-    "Twitter": {"status": "not_found", "error": "404"}
-  }
-}
-```
-
-**Socialscan** (stdout + `--json`):
-```json
-[{"platform":"github","username":"user1","available":false}, ...]
-```
-
----
-
-## Sovereignty assessment
-
-All three are **local-first, API-key-free** tools. None require cloud accounts. Network calls are direct to target platforms; no telemetry.
-
-**Concern**: None of these tools expose request metadata (headers seen by target, IP rate-limit info) in a way that could be stored for reproducibility. We store only final status.
-
----
-
-## Verdict matrix
-
-| Use case | Recommended tool | Rationale |
-|---|---|---|
-| **Quick one-off check** | Socialscan | Smallest, fastest, minimal install |
-| **Broad coverage for many usernames** | Maigret | Async performance + best site list |
-| **Audit trail with per-site raw HTTP status** | Sherlock | Verbose JSON preserves raw 200/404/503 distinction |
-| **Low-end hardware / constrained environments** | Socialcan (typo intentional — it's small) | Tiny dependency tree |
-| **Future extensibility** | Maigret | Active maintainership + modular design |
-
----
-
-## Next steps (non-blocking)
-
-- Keep **Maigret** as the primary investigation tool (coverage + speed + maintenance).
-- Use **Socialscan** for smoke-checks in CI (speed).
-- **Sherlock** archived as reference; not retired but not actively used.
-- Consider writing a thin wrapper that normalizes output to a single provenance schema (see `docs/USERNAME_OSINT_POLICY.md`).
-

tests/test_tower_game_items.py

@@ -0,0 +1,58 @@
+from importlib.util import module_from_spec, spec_from_file_location
+from pathlib import Path
+import unittest
+
+
+ROOT = Path(__file__).resolve().parent.parent
+GAME_PATH = ROOT / "evennia" / "timmy_world" / "game.py"
+
+
+def load_game_module():
+    spec = spec_from_file_location("tower_game_items", GAME_PATH)
+    module = module_from_spec(spec)
+    assert spec.loader is not None
+    spec.loader.exec_module(module)
+    module.random.seed(0)
+    return module
+
+
+class TestTowerGameWorldItems(unittest.TestCase):
+    def test_world_has_ten_unique_items_and_a_quest_item(self):
+        module = load_game_module()
+        world = module.World()
+
+        room_items = {
+            item
+            for room in world.rooms.values()
+            for item in room.get("discoverables", [])
+        }
+
+        self.assertGreaterEqual(len(room_items), 10)
+        self.assertIn("foraged key", room_items)
+        self.assertTrue(module.WORLD_ITEMS["foraged key"]["quest_item"])
+
+    def test_items_change_world_state_when_used(self):
+        module = load_game_module()
+        engine = module.GameEngine()
+        engine.start_new_game()
+        engine.world.characters["Timmy"]["energy"] = 10
+        engine.world.characters["Timmy"]["room"] = "Garden"
+
+        initial_growth = engine.world.rooms["Garden"]["growth"]
+        engine.run_tick("take:seed packet")
+        use_seed = engine.run_tick("use:seed packet")
+
+        self.assertGreater(engine.world.rooms["Garden"]["growth"], initial_growth)
+        self.assertNotIn("seed packet", engine.world.characters["Timmy"]["inventory"])
+        self.assertTrue(any("garden" in line.lower() for line in use_seed["world_events"] + use_seed["log"]))
+
+        engine.world.characters["Timmy"]["energy"] = 10
+        engine.run_tick("take:foraged key")
+        use_key = engine.run_tick("use:foraged key")
+
+        self.assertTrue(engine.world.state["tower_cache_unlocked"])
+        self.assertTrue(any("cache" in line.lower() or "quest" in line.lower() for line in use_key["world_events"] + use_key["log"]))
+
+
+if __name__ == "__main__":
+    unittest.main()