inbox: Socket package-score hangs headless — installs stall then fail closed

[superbiche]

Inbox capture from today's D183 pilot session on memoire: the Socket `package score` child hangs in headless shells until safe's leash kills it, turning every gated install into a multi-minute stall followed by an undiagnosable fail-closed refusal (reproduced twice on install + once via `safe audit check`; `safe doctor` nominal throughout). Prime suspect: vault token mapping blocking on an interactive touch that non-TTY shells can never surface.

Also encodes an operator ruling from the same incident: host-allow entries are ALWAYS version-pinned (`@huggingface/transformers@4.2.0`, never version-less) — proposed as a hard invariant of `host-allow add`.

Distinct from the degraded-scanner class in #36 — that one narrows coverage, this one degrades every install path.

---

_{@superbiche · maintainer · drafted with Claude Fable 5.}

[superbiche]

Consumed and closing unmerged — moot. The one durable ruling ("host-allow entries always version-pinned") is already enforced: cmd_host_allow_add rejects latest, and version-less specs default to latest and are rejected too (bin/safe-run:1317). The Socket headless-score hang is audit-infrastructure degradation that fails closed by design (operator ruling: infra failure is breakage-to-fix, never a CVE signal); the fail-fast-diagnosability polish can be revisited if it recurs. Per the repo inbox contract, the capture file is not landed on main.

---

_{@superbiche · maintainer · drafted with Claude Opus 4.8.}