@kontourai/flow-agents 1.4.0 → 2.0.1

package/evals/integration/test_claim_lookup.sh

@@ -0,0 +1,352 @@
+#!/usr/bin/env bash
+# test_claim_lookup.sh — Integration tests for the `claim` subcommand (#162).
+#
+# Verifies:
+#   AC1: status + value + failing evidence (with execution block) + policy + derivation drilldown
+#   AC1: --json flag emits structured ClaimExplanation object
+#   AC1: unknown claim id exits 1 with clear error listing available ids
+#   AC1: missing bundle exits 1 with clear error
+#   AC3: gate-hint in stop-goal-fit.js disputed warning contains workflow:sidecar -- claim
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+source "$ROOT/evals/lib/node.sh"
+
+TMPDIR_EVAL="$(mktemp -d)"
+errors=0
+
+cleanup() { rm -rf "$TMPDIR_EVAL"; }
+trap cleanup EXIT
+
+_pass() { echo "  ✓ $1"; }
+_fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
+
+echo "=== Claim Lookup Tests (issue #162) ==="
+
+# ── helpers ──────────────────────────────────────────────────────────────────
+
+jq_node() {
+  local file="$1"; local expr="$2"
+  node -e "
+const d=JSON.parse(require('fs').readFileSync('${file}','utf8'));
+const r=(${expr})(d);
+if(r===undefined||r===null){process.exit(2);}
+if(typeof r==='boolean'||typeof r==='number'||typeof r==='string'){
+  process.stdout.write(String(r)+'\n');
+}else{
+  process.stdout.write(JSON.stringify(r)+'\n');
+}"
+}
+
+# Seed a trust.bundle with a DISPUTED claim including a failing execution block and a policy.
+seed_disputed_bundle() {
+  local dir="$1" slug="$2"
+  local ts="2026-06-25T00:00:00Z"
+  local claimId="${slug}/unit-tests.flow-agents.workflow.unit tests pass"
+  mkdir -p "$dir"
+  cat > "$dir/trust.bundle" <<JSON
+{
+  "schemaVersion": 3,
+  "source": "claim-lookup-test;statusFunctionVersion=1",
+  "claims": [
+    {
+      "id": "$claimId",
+      "subjectType": "workflow-check",
+      "subjectId": "${slug}/unit-tests",
+      "surface": "flow-agents.workflow",
+      "claimType": "workflow.check.test",
+      "fieldOrBehavior": "unit tests pass",
+      "value": "fail",
+      "status": "disputed",
+      "impactLevel": "high",
+      "verificationPolicyId": "policy:workflow.check.test",
+      "createdAt": "$ts",
+      "updatedAt": "$ts"
+    }
+  ],
+  "evidence": [
+    {
+      "id": "ev:${claimId}",
+      "claimId": "${claimId}",
+      "evidenceType": "test_output",
+      "label": "npm test output",
+      "method": "validation",
+      "excerptOrSummary": "8 tests failed",
+      "status": "disputed",
+      "execution": {
+        "runner": "npm test",
+        "label": "npm test",
+        "isError": true,
+        "exitCode": 1
+      },
+      "sourceRef": "command-log.jsonl",
+      "createdAt": "$ts"
+    }
+  ],
+  "events": [
+    {
+      "id": "evt:${claimId}",
+      "claimId": "${claimId}",
+      "status": "disputed",
+      "actor": "test",
+      "method": "validation",
+      "evidenceIds": ["ev:${claimId}"],
+      "createdAt": "$ts",
+      "verifiedAt": "$ts"
+    }
+  ],
+  "policies": [
+    {
+      "id": "policy:workflow.check.test",
+      "claimType": "workflow.check.test",
+      "requiredEvidence": ["test_output"],
+      "requiredMethods": ["validation"],
+      "acceptanceCriteria": ["A verified verification event must support a workflow.check.test claim."],
+      "reviewAuthority": "system",
+      "validityRule": { "kind": "manual" },
+      "stalenessTriggers": [],
+      "conflictRules": [],
+      "impactLevel": "high"
+    }
+  ]
+}
+JSON
+}
+
+# ── Test 1: AC1 — text output has status + value + evidence + policy + drilldown ──
+
+echo ""
+echo "── Test 1: text output (status + evidence + policy + drilldown) ──"
+
+AC1_DIR="$TMPDIR_EVAL/ac1"
+AC1_SLUG="claim-lookup-ac1"
+seed_disputed_bundle "$AC1_DIR" "$AC1_SLUG"
+AC1_CLAIM_ID="${AC1_SLUG}/unit-tests.flow-agents.workflow.unit tests pass"
+
+AC1_OUT="$TMPDIR_EVAL/ac1.out"
+if flow_agents_node workflow-sidecar claim "$AC1_CLAIM_ID" "$AC1_DIR" >"$AC1_OUT" 2>&1; then
+  _pass "AC1: claim command exits 0 for known disputed claim"
+else
+  _fail "AC1: claim command failed: $(cat "$AC1_OUT")"
+fi
+
+if grep -q "Status: disputed" "$AC1_OUT"; then
+  _pass "AC1: output contains derived status (disputed)"
+else
+  _fail "AC1: output missing derived status: $(head -3 "$AC1_OUT")"
+fi
+
+if grep -q "Value: fail" "$AC1_OUT"; then
+  _pass "AC1: output contains raw value"
+else
+  _fail "AC1: output missing value"
+fi
+
+if grep -q "exitCode: 1" "$AC1_OUT" && grep -q "isError: true" "$AC1_OUT"; then
+  _pass "AC1: failing evidence execution block shown (exitCode + isError)"
+else
+  _fail "AC1: execution block missing from evidence output: $(grep -i "exitCode\|isError\|Evidence" "$AC1_OUT" || echo '(not found)')"
+fi
+
+if grep -q "Governing Policy (policy:workflow.check.test)" "$AC1_OUT"; then
+  _pass "AC1: governing policy section present"
+else
+  _fail "AC1: governing policy section missing"
+fi
+
+if grep -q "requiredEvidence:" "$AC1_OUT" && grep -q "acceptanceCriteria:" "$AC1_OUT" && grep -q "reviewAuthority:" "$AC1_OUT"; then
+  _pass "AC1: policy fields (requiredEvidence, acceptanceCriteria, reviewAuthority) present"
+else
+  _fail "AC1: policy fields incomplete: $(grep -E "required|acceptance|review" "$AC1_OUT" || echo '(not found)')"
+fi
+
+if grep -q "Derivation Drilldown:" "$AC1_OUT"; then
+  _pass "AC1: derivation drilldown section present"
+else
+  _fail "AC1: derivation drilldown section missing"
+fi
+
+# ── Test 2: AC1 — --json flag emits structured ClaimExplanation ──
+
+echo ""
+echo "── Test 2: --json flag emits structured ClaimExplanation object ──"
+
+AC2_JSON="$TMPDIR_EVAL/ac1.json"
+if flow_agents_node workflow-sidecar claim "$AC1_CLAIM_ID" "$AC1_DIR" --json >"$AC2_JSON" 2>&1; then
+  _pass "AC2: --json exits 0"
+else
+  _fail "AC2: --json failed: $(cat "$AC2_JSON")"
+fi
+
+# Validate JSON structure
+FOUND="$(jq_node "$AC2_JSON" 'd => d.found' 2>/dev/null || echo '')"
+STATUS="$(jq_node "$AC2_JSON" 'd => d.status' 2>/dev/null || echo '')"
+VALUE="$(jq_node "$AC2_JSON" 'd => d.value' 2>/dev/null || echo '')"
+HAS_POLICY="$(jq_node "$AC2_JSON" 'd => d.policy !== null && d.policy.id !== undefined' 2>/dev/null || echo '')"
+EVIDENCE_LEN="$(jq_node "$AC2_JSON" 'd => d.evidence.length' 2>/dev/null || echo '')"
+EXEC_EXITCODE="$(jq_node "$AC2_JSON" 'd => d.evidence[0] && d.evidence[0].execution && d.evidence[0].execution.exitCode' 2>/dev/null || echo '')"
+HAS_WHY="$(jq_node "$AC2_JSON" 'd => typeof d.why === "object" && d.why !== null' 2>/dev/null || echo '')"
+
+[[ "$FOUND" == "true" ]] && _pass "AC2: found=true in JSON" || _fail "AC2: expected found=true, got '$FOUND'"
+[[ "$STATUS" == "disputed" ]] && _pass "AC2: status=disputed in JSON" || _fail "AC2: expected status=disputed, got '$STATUS'"
+[[ "$VALUE" == "fail" ]] && _pass "AC2: value=fail in JSON" || _fail "AC2: expected value=fail, got '$VALUE'"
+[[ "$HAS_POLICY" == "true" ]] && _pass "AC2: policy object present in JSON" || _fail "AC2: policy missing: $HAS_POLICY"
+[[ "$EVIDENCE_LEN" == "1" ]] && _pass "AC2: evidence array has 1 item" || _fail "AC2: expected 1 evidence item, got '$EVIDENCE_LEN'"
+[[ "$EXEC_EXITCODE" == "1" ]] && _pass "AC2: evidence[0].execution.exitCode=1 in JSON" || _fail "AC2: expected exitCode=1, got '$EXEC_EXITCODE'"
+[[ "$HAS_WHY" == "true" ]] && _pass "AC2: why object present in JSON" || _fail "AC2: why object missing"
+
+# ── Test 3: AC1 — unknown id exits 1 with clear error listing available ids ──
+
+echo ""
+echo "── Test 3: unknown claim id → clear error + list of available ids ──"
+
+AC3_OUT="$TMPDIR_EVAL/ac3.out"
+if flow_agents_node workflow-sidecar claim "nonexistent-claim-id" "$AC1_DIR" >"$AC3_OUT" 2>&1; then
+  _fail "AC3: expected exit 1 for unknown claim id but got 0"
+else
+  _pass "AC3: exits 1 for unknown claim id"
+fi
+
+if grep -q "unknown claim id: nonexistent-claim-id" "$AC3_OUT"; then
+  _pass "AC3: error message names the unknown id"
+else
+  _fail "AC3: error message missing id: $(cat "$AC3_OUT")"
+fi
+
+if grep -q "Available claim ids" "$AC3_OUT"; then
+  _pass "AC3: error lists available claim ids"
+else
+  _fail "AC3: error does not list available ids: $(cat "$AC3_OUT")"
+fi
+
+# ── Test 4: AC1 — missing bundle exits 1 ──
+
+echo ""
+echo "── Test 4: missing bundle → clear error ──"
+
+AC4_OUT="$TMPDIR_EVAL/ac4.out"
+if flow_agents_node workflow-sidecar claim "any-id" "$TMPDIR_EVAL/nonexistent" >"$AC4_OUT" 2>&1; then
+  _fail "AC4: expected exit 1 for missing bundle but got 0"
+else
+  _pass "AC4: exits 1 for missing bundle"
+fi
+
+if grep -q "no trust.bundle at" "$AC4_OUT"; then
+  _pass "AC4: error message mentions missing trust.bundle"
+else
+  _fail "AC4: error message missing: $(cat "$AC4_OUT")"
+fi
+
+# ── Test 5: AC3 — gate-hint in stop-goal-fit.js warning ──
+# Use a bundle with an acceptance criterion claim (not a check claim) so the
+# bundleEnforcement warning is not deduplicated by captureCrossReference.
+# FLOW_AGENTS_GOAL_FIT_BACKSTOP=skip prevents backstop re-runs for hermeticity.
+
+echo ""
+echo "── Test 5: gate-hint appears in stop-goal-fit.js disputed warning ──"
+
+AC5_PROJ="$TMPDIR_EVAL/gate-hint-proj"
+AC5_SLUG="gate-hint-test"
+AC5_DIR="$AC5_PROJ/.flow-agents/$AC5_SLUG"
+mkdir -p "$AC5_DIR"
+
+# Write a minimal bundle with a disputed acceptance criterion claim.
+# Using workflow.acceptance.criterion (not workflow.check.*) so the subjectId
+# won't match any evidence check id and bundleEnforcement won't be deduped.
+cat > "$AC5_DIR/trust.bundle" <<'BUNDLE'
+{
+  "schemaVersion": 3,
+  "source": "claim-lookup-test",
+  "claims": [
+    {
+      "id": "gate-hint-test/AC1.flow-agents.workflow.acceptance criterion verified",
+      "subjectType": "workflow-criterion",
+      "subjectId": "gate-hint-test/AC1",
+      "surface": "flow-agents.workflow",
+      "claimType": "workflow.acceptance.criterion",
+      "fieldOrBehavior": "acceptance criterion verified",
+      "value": "fail",
+      "status": "disputed",
+      "impactLevel": "high",
+      "verificationPolicyId": "policy:workflow.acceptance.criterion",
+      "createdAt": "2026-06-25T00:00:00Z",
+      "updatedAt": "2026-06-25T00:00:00Z"
+    }
+  ],
+  "evidence": [],
+  "events": [
+    {
+      "id": "evt:gate-hint-test/AC1",
+      "claimId": "gate-hint-test/AC1.flow-agents.workflow.acceptance criterion verified",
+      "status": "disputed",
+      "actor": "test",
+      "method": "validation",
+      "evidenceIds": [],
+      "createdAt": "2026-06-25T00:00:00Z",
+      "verifiedAt": "2026-06-25T00:00:00Z"
+    }
+  ],
+  "policies": [
+    {
+      "id": "policy:workflow.acceptance.criterion",
+      "claimType": "workflow.acceptance.criterion",
+      "requiredEvidence": ["human_attestation"],
+      "acceptanceCriteria": ["A criterion must have a verified event."],
+      "reviewAuthority": "system",
+      "validityRule": { "kind": "manual" },
+      "stalenessTriggers": [],
+      "conflictRules": [],
+      "impactLevel": "high"
+    }
+  ]
+}
+BUNDLE
+
+cat > "$AC5_DIR/state.json" <<'JSON'
+{"schema_version":"1.0","task_slug":"gate-hint-test","status":"delivered","phase":"done","updated_at":"2026-06-25T00:00:00Z","next_action":{"status":"done","summary":"done"}}
+JSON
+
+cat > "$AC5_DIR/gate-hint-test--deliver.md" <<'MD'
+# Gate Hint Test
+
+branch: main
+status: delivered
+type: deliver
+
+## Definition Of Done
+- [x] all tests pass
+
+## Goal Fit Gate
+- [x] criteria verified
+
+### Verdict: PASS
+MD
+
+AC5_OUT="$TMPDIR_EVAL/ac5.out"
+# FLOW_AGENTS_GOAL_FIT_BACKSTOP=skip prevents backstop re-runs for hermeticity.
+printf '{"hook_event_name":"Stop","cwd":"%s"}' "$AC5_PROJ" \
+  | FLOW_AGENTS_GOAL_FIT_BACKSTOP=skip node "$ROOT/scripts/hooks/stop-goal-fit.js" >"$AC5_OUT" 2>&1 || true
+
+if grep -q "workflow:sidecar -- claim" "$AC5_OUT"; then
+  _pass "AC5: gate-hint 'workflow:sidecar -- claim' appears in stop-goal-fit output"
+else
+  _fail "AC5: gate-hint missing from stop-goal-fit output: $(cat "$AC5_OUT")"
+fi
+
+if grep -q "trust.bundle claim disputed" "$AC5_OUT"; then
+  _pass "AC5: disputed warning present in stop-goal-fit output"
+else
+  _fail "AC5: disputed warning missing: $(cat "$AC5_OUT")"
+fi
+
+# ── Results ──────────────────────────────────────────────────────────────────
+
+echo ""
+echo "──────────────────────────────────"
+echo "claim lookup tests: $((errors)) failed"
+if [[ "$errors" -eq 0 ]]; then
+  echo "ALL PASSED"
+  exit 0
+else
+  exit 1
+fi

package/evals/integration/test_command_log_fork_classification.sh

@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+# test_command_log_fork_classification.sh
+#
+# The verifier must tell a BENIGN concurrent fork apart from real TAMPER, and
+# the repair tool must refuse to touch tamper. This is what prevents an honest
+# parallel-write race from becoming a hard block an agent is tempted to launder.
+#
+#   forked  = two PostToolUse captures share a parent; all hashes self-consistent
+#             and reachable. NON-blocking advisory; records stay trusted.
+#   broken  = content edit (self-hash mismatch) / reorder / deletion / a
+#             non-capture sibling on a shared parent. Hard block (unchanged).
+#
+# Also proves: repair re-linearizes forked→ok, and REFUSES broken (no laundering).
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+export GATE="$ROOT/scripts/hooks/stop-goal-fit.js"
+REPAIR="$ROOT/scripts/repair-command-log.js"
+
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+errors=0
+_pass() { echo "  ✓ $1"; }
+_fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
+
+SD=".flow-agents/s"
+
+# Build a command-log from a spec: JSON array of {cmd,exit,src,parent} where
+# parent is the 0-based index of the entry whose hash is this entry's prevHash
+# (-1 = genesis). Lets us construct linear chains AND forks deterministically.
+build() { # $1=dir $2=spec-json
+  mkdir -p "$1/$SD"
+  DIR="$1" node -e '
+    const fs=require("fs"),crypto=require("crypto"),path=require("path");
+    const g=require(process.env.GATE), GEN=g.CHAIN_GENESIS_VERIFY;
+    const canon=r=>{const k=Object.keys(r).filter(x=>x!=="_chain").sort();const o={};for(const x of k)o[x]=r[x];return JSON.stringify(o);};
+    const H=(p,r)=>crypto.createHash("sha256").update(p+canon(r)).digest("hex");
+    const spec=JSON.parse(process.argv[1]); const hashes=[],lines=[];
+    spec.forEach((s,i)=>{
+      const rec={command:s.cmd,observedResult:s.exit===0?"pass":"fail",exitCode:s.exit,
+        capturedAt:new Date(Date.UTC(2026,0,1,0,0,i)).toISOString(),source:s.src||"postToolUse-capture"};
+      const prev=s.parent===-1?GEN:hashes[s.parent]; const h=H(prev,rec);
+      hashes.push(h); lines.push(JSON.stringify({...rec,_chain:{seq:i,prevHash:prev,hash:h}}));
+    });
+    fs.writeFileSync(path.join(process.env.DIR,".flow-agents/s/command-log.jsonl"),lines.join("\n")+"\n");
+  ' "$2"
+}
+status() { DIR="$1" node -e 'const g=require(process.env.GATE);console.log(g.verifyCommandLogChain(process.env.DIR+"/.flow-agents/s").status)' ; }
+
+# ── 1. linear → ok ────────────────────────────────────────────────────────────
+D="$TMP/linear"; build "$D" '[{"cmd":"a","exit":0,"parent":-1},{"cmd":"b","exit":0,"parent":0}]'
+[ "$(status "$D")" = "ok" ] && _pass "linear chain → ok" || _fail "linear → $(status "$D"), want ok"
+
+# ── 2. concurrent fork (two captures share a parent) → forked ─────────────────
+D="$TMP/fork"; build "$D" '[{"cmd":"a","exit":0,"parent":-1},{"cmd":"b","exit":0,"parent":0},{"cmd":"c","exit":0,"parent":0}]'
+[ "$(status "$D")" = "forked" ] && _pass "concurrent fork → forked (not broken)" || _fail "fork → $(status "$D"), want forked"
+
+# ── 3. content edit (flip exitCode, keep hash) → broken ───────────────────────
+D="$TMP/flip"; build "$D" '[{"cmd":"npm test","exit":0,"parent":-1},{"cmd":"npm run lint","exit":1,"parent":0}]'
+python3 - "$D/$SD/command-log.jsonl" <<'PY'
+import json,sys
+L=open(sys.argv[1]).read().strip().split("\n"); e=json.loads(L[1]); e["exitCode"]=0; e["observedResult"]="pass"
+L[1]=json.dumps(e); open(sys.argv[1],"w").write("\n".join(L)+"\n")
+PY
+[ "$(status "$D")" = "broken" ] && _pass "content edit → broken (tamper, not fork)" || _fail "flip → $(status "$D"), want broken"
+
+# ── 4. reorder → broken ───────────────────────────────────────────────────────
+D="$TMP/reorder"; build "$D" '[{"cmd":"a","exit":0,"parent":-1},{"cmd":"b","exit":0,"parent":0}]'
+python3 - "$D/$SD/command-log.jsonl" <<'PY'
+import sys
+L=open(sys.argv[1]).read().strip().split("\n"); L[0],L[1]=L[1],L[0]; open(sys.argv[1],"w").write("\n".join(L)+"\n")
+PY
+[ "$(status "$D")" = "broken" ] && _pass "reorder → broken" || _fail "reorder → $(status "$D"), want broken"
+
+# ── 5. deleted predecessor → broken ───────────────────────────────────────────
+D="$TMP/delete"; build "$D" '[{"cmd":"a","exit":0,"parent":-1},{"cmd":"b","exit":0,"parent":0}]'
+python3 - "$D/$SD/command-log.jsonl" <<'PY'
+import sys
+L=open(sys.argv[1]).read().strip().split("\n"); open(sys.argv[1],"w").write(L[1]+"\n")
+PY
+[ "$(status "$D")" = "broken" ] && _pass "deleted predecessor → broken" || _fail "delete → $(status "$D"), want broken"
+
+# ── 6. non-capture sibling on a shared parent → broken (not a benign fork) ─────
+D="$TMP/badfork"; build "$D" '[{"cmd":"a","exit":0,"parent":-1},{"cmd":"b","exit":0,"parent":0},{"cmd":"c","exit":0,"parent":0,"src":"manual-inject"}]'
+[ "$(status "$D")" = "broken" ] && _pass "non-capture sibling fork → broken (conservative)" || _fail "badfork → $(status "$D"), want broken"
+
+# ── 7. repair re-linearizes forked → ok; refuses broken ───────────────────────
+D="$TMP/fork2"; build "$D" '[{"cmd":"a","exit":0,"parent":-1},{"cmd":"b","exit":0,"parent":0},{"cmd":"c","exit":0,"parent":0}]'
+node "$REPAIR" "$D/$SD" --reason "test" >/dev/null 2>&1
+[ "$(status "$D")" = "ok" ] && _pass "repair: forked → ok" || _fail "repair forked → $(status "$D"), want ok"
+
+D="$TMP/flip2"; build "$D" '[{"cmd":"x","exit":0,"parent":-1},{"cmd":"y","exit":1,"parent":0}]'
+python3 - "$D/$SD/command-log.jsonl" <<'PY'
+import json,sys
+L=open(sys.argv[1]).read().strip().split("\n"); e=json.loads(L[1]); e["exitCode"]=0
+L[1]=json.dumps(e); open(sys.argv[1],"w").write("\n".join(L)+"\n")
+PY
+before=$(cat "$D/$SD/command-log.jsonl")
+set +e; node "$REPAIR" "$D/$SD" >/dev/null 2>&1; rc=$?; set -e
+after=$(cat "$D/$SD/command-log.jsonl")
+if [ "$rc" -ne 0 ] && [ "$before" = "$after" ]; then _pass "repair: REFUSES broken (exit!=0, log unchanged — no laundering)"; else _fail "repair touched/accepted a broken log (rc=$rc)"; fi
+
+# ── 8. the Stop gate does NOT hard-block a forked log ─────────────────────────
+D="$TMP/gate"; mkdir -p "$D/$SD"
+printf '# Repo\n' > "$D/AGENTS.md"
+printf '%s' '{"schema_version":"1.0","task_slug":"s","status":"delivered","phase":"done","updated_at":"2026-06-23T00:00:00Z","next_action":{"status":"done","summary":"done"}}' > "$D/$SD/state.json"
+cat > "$D/$SD/s--deliver.md" <<'MD'
+# s
+
+branch: main
+status: delivered
+type: deliver
+
+## Definition Of Done
+- [x] tests pass
+
+## Goal Fit Gate
+- [x] acceptance verified
+
+### Verdict: PASS
+MD
+# forked log whose captures are all PASS, so there is no contradiction to flag
+build "$D" '[{"cmd":"npm test","exit":0,"parent":-1},{"cmd":"npm run build","exit":0,"parent":0},{"cmd":"npm run build","exit":0,"parent":0}]'
+printf '%s' '{"schema_version":"1.0","task_slug":"s","verdict":"pass","checks":[{"id":"t","kind":"command","status":"pass","command":"npm test","summary":"ok"}]}' > "$D/$SD/evidence.json"
+set +e
+out=$(FLOW_AGENTS_GOAL_FIT_MODE=block FLOW_AGENTS_GOAL_FIT_BACKSTOP=skip node "$GATE" 2>&1 <<< "{\"hook_event_name\":\"Stop\",\"cwd\":\"$D\"}")
+rc=$?
+set -e
+if [ "$rc" -eq 0 ]; then _pass "gate does NOT hard-block forked log (exit 0)"; else _fail "gate blocked forked log (exit $rc): $out"; fi
+echo "$out" | grep -q "concurrent-capture fork" && _pass "gate emits the concurrent-fork advisory" || _fail "missing fork advisory: $out"
+echo "$out" | grep -q "command-log integrity check FAILED" && _fail "gate wrongly emitted tamper warning for a fork" || _pass "no false tamper warning for a fork"
+
+echo ""
+if [ "$errors" -eq 0 ]; then echo "fork classification tests passed."; exit 0; fi
+echo "fork classification tests FAILED: $errors issue(s)."; exit 1