@kontourai/flow-agents 2.2.0 → 2.4.0

package/evals/integration/test_flowdef_union_floor_regression.sh

@@ -0,0 +1,429 @@
+#!/usr/bin/env bash
+# test_flowdef_union_floor_regression.sh — Union-floor regression trip-wire for
+# the .kontourai/flow-agents/flowdef-driven-stop-gate posture.
+#
+# PR #215 replaced isSelectedClaim's pure if/else claim-selection predicate
+# with a permanent UNION:
+#
+#   ct.startsWith('workflow.') || (declaredClaimTypes != null && declaredClaimTypes.has(ct))
+#
+# ...plus a `gate misconfiguration:` HARD_BLOCK when an active FlowDefinition
+# resolves to an empty expects[] (see ADR 0016, ADR 0018, and the Prior Attempt
+# Post-Mortem in .kontourai/flow-agents/flowdef-driven-stop-gate/plan.md).
+#
+# Wave 1 of this plan extracted declaredClaimTypesFor() as a pure refactor of
+# stop-goal-fit.js — the union form itself was NOT touched. This eval locks
+# that posture in place so a future "refactor" cannot quietly narrow the union
+# back to an if/else (which would reopen the gate-bypass-chain exploit: an
+# empty declaredClaimTypes Set from a tampered/fake FlowDefinition would once
+# again select ZERO claims and bundleEnforcement would silently pass).
+#
+# Three checks:
+#   1. STATIC TRIP-WIRE — the union form is present on the live `return`
+#      statement inside isSelectedClaim's function body in
+#      scripts/hooks/stop-goal-fit.js (comment lines/trailing comments are
+#      stripped first so a decoy comment cannot satisfy the check).
+#   2. EMPTY-EXPECTS GUARD — cross-referenced to evals/integration/
+#      test_gate_bypass_chain.sh, which already asserts the empty-expects ->
+#      exit 2 `gate misconfiguration:` case end-to-end (see its "Test 2" /
+#      "Test 3" sections). Not duplicated here.
+#   3. UNION-IS-LIVE PROOF — two builder.build/verify sessions:
+#        3a. A bundle with a declared builder.verify.tests claim (clean,
+#            re-derives verified) alongside a workflow.check.command claim
+#            (stored "verified", evidence tampered -> re-derives disputed).
+#            workflow.check.command is NOT in builder.build's verify-gate
+#            expects[], so this proves the union's `startsWith('workflow.')`
+#            baseline is live code, not dead code, for FlowDefinition-driven
+#            sessions.
+#        3b. A SECOND bundle where the DECLARED builder.verify.tests claim
+#            itself is tampered (stored "verified", evidence re-derives
+#            disputed). builder.verify.tests does NOT start with "workflow.",
+#            so the ONLY way isSelectedClaim can select it is via the
+#            `declaredClaimTypes.has(ct)` branch of the union. Asserting
+#            exit 2 + a tamper warning naming builder.verify.tests here is
+#            direct, positive proof that declared-claim-type selection
+#            (not just the workflow.* baseline) is actually live — closing
+#            the "Check 3 can pass vacuously when build/ is absent" gap
+#            (3a alone never positively exercises the declared branch; a
+#            missing build/ would make declaredClaimTypes null everywhere
+#            and 3a's "not flagged" assertion would be trivially satisfied).
+#      Both sub-checks require flow-resolver.js (built under build/src/lib/) to exist —
+#      loadActiveFlowStep() fails open to null when build/ is absent, which
+#      would make the whole of Check 3 pass vacuously. This eval hard-fails
+#      loudly instead of silently passing in that case.
+#
+# Deterministic, no model spend, self-cleaning.
+# Usage: bash evals/integration/test_flowdef_union_floor_regression.sh
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+GATE="$ROOT/scripts/hooks/stop-goal-fit.js"
+GATE_SRC="$ROOT/scripts/hooks/stop-goal-fit.js"
+
+export FLOW_AGENTS_GOAL_FIT_MAX_BLOCKS=100000
+
+TMP="$(mktemp -d)"
+errors=0
+_pass() { echo "  ✓ $1"; }
+_fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
+
+cleanup() { [ -n "${TMP:-}" ] && rm -rf "$TMP"; }
+trap cleanup EXIT
+
+# --- helper: seed a minimal delivered workflow artifact --------------------
+seed_repo() { # $1=dir $2=slug
+  local p="$1" slug="$2"
+  mkdir -p "$p/.kontourai/flow-agents/$slug"
+  printf '# Repo\n' > "$p/AGENTS.md"
+  STATE_FILE="$p/.kontourai/flow-agents/$slug/state.json"
+  printf '%s' "{\"schema_version\":\"1.0\",\"task_slug\":\"$slug\",\"status\":\"delivered\",\"phase\":\"done\",\"updated_at\":\"2026-06-30T00:00:00Z\",\"next_action\":{\"status\":\"done\",\"summary\":\"done\"}}" \
+    > "$STATE_FILE"
+  cat > "$p/.kontourai/flow-agents/$slug/$slug--deliver.md" << MD
+# $slug
+
+branch: main
+status: delivered
+type: deliver
+
+## Definition Of Done
+- [x] tests pass
+
+## Goal Fit Gate
+- [x] acceptance verified
+
+### Verdict: PASS
+MD
+}
+
+# --- Check 1: STATIC TRIP-WIRE - union form present inside isSelectedClaim -
+echo "Check 1: static trip-wire - union form present inside isSelectedClaim() in stop-goal-fit.js"
+
+# Isolate the isSelectedClaim function body (from its declaration to its
+# closing brace) rather than grepping the whole file, so this trip-wire fails
+# loudly if the union is removed from the function even if the literal string
+# "startsWith('workflow.')" survives elsewhere (e.g. in a comment or a
+# different, narrower predicate).
+isSelectedClaim_body="$(awk '/const isSelectedClaim = \(claim\)/{flag=1} flag{print} flag && /^  \};/{exit}' "$GATE_SRC")"
+
+# Strip comments (full-line comments AND trailing "// ..." comments) from the
+# isolated body before inspecting it, then anchor the check to the live
+# `return` statement specifically. Without this, a decoy comment anywhere in
+# the function body (e.g. `// ct.startsWith('workflow.') || ...` left behind
+# after narrowing the real predicate to an if/else) would still satisfy a
+# plain `grep -q "startsWith('workflow.')"` against the whole body and let
+# this trip-wire pass vacuously.
+isSelectedClaim_body_nocomments="$(echo "$isSelectedClaim_body" | sed 's|//.*$||')"
+isSelectedClaim_return_line="$(echo "$isSelectedClaim_body_nocomments" | grep -E '^[[:space:]]*return\b')"
+
+if [ -z "$isSelectedClaim_body" ]; then
+  _fail "could not locate isSelectedClaim() in scripts/hooks/stop-goal-fit.js -- function renamed or removed"
+  echo "    This regresses PR #215 / ADR 0016 / ADR 0018. See the Prior Attempt Post-Mortem in"
+  echo "    .kontourai/flow-agents/flowdef-driven-stop-gate/plan.md: the union claim-selection"
+  echo "    predicate must remain a permanent, named, testable function."
+elif [ -n "$isSelectedClaim_return_line" ] \
+    && echo "$isSelectedClaim_return_line" | grep -q "startsWith('workflow.')" \
+    && echo "$isSelectedClaim_return_line" | grep -q "declaredClaimTypes"; then
+  _pass "isSelectedClaim()'s return statement contains the workflow.* union baseline (startsWith('workflow.') + declaredClaimTypes, comment-stripped)"
+else
+  _fail "isSelectedClaim()'s return statement no longer contains the union baseline -- union narrowed back toward if/else (or moved into a comment)"
+  echo "    This regresses PR #215 / ADR 0016 / ADR 0018. Per the Prior Attempt Post-Mortem in"
+  echo "    .kontourai/flow-agents/flowdef-driven-stop-gate/plan.md: isSelectedClaim MUST stay a"
+  echo "    UNION -- \`ct.startsWith('workflow.') || (declaredClaimTypes != null && declaredClaimTypes.has(ct))\`"
+  echo "    -- never a pure if/else. An if/else lets an empty (non-null) declaredClaimTypes Set"
+  echo "    (e.g. from a tampered/fake FlowDefinition with expects:[]) select ZERO claims and"
+  echo "    silently bypass bundleEnforcement (the original gate-bypass-chain exploit)."
+  echo "    isSelectedClaim() body found:"
+  echo "$isSelectedClaim_body" | sed 's/^/      /'
+  echo "    comment-stripped return statement found:"
+  echo "${isSelectedClaim_return_line:-<none>}" | sed 's/^/      /'
+fi
+
+# --- Check 2: EMPTY-EXPECTS GUARD - cross-referenced, not duplicated -------
+# evals/integration/test_gate_bypass_chain.sh already seeds an active
+# builder.build/verify session whose active FlowDefinition resolves to an
+# empty expects[] (via FLOW_AGENTS_FLOW_DEFS_DIR override to a fake flow) and
+# asserts BOTH exit code 2 AND a `gate misconfiguration:` warning in its
+# "=== 2. Layer 2 -- Empty-Set defense ===" section (test 2b), and again
+# end-to-end in its "=== 3. Full exploit chain ===" section. See AC3 Part 2 in
+# stop-goal-fit.js's bundleEnforcement comment block. Not duplicated here to
+# avoid two evals asserting the same fixture drifting out of sync.
+echo ""
+echo "Check 2: empty-expects guard -- cross-referenced to evals/integration/test_gate_bypass_chain.sh (not duplicated)"
+_pass "empty-expects -> exit 2 'gate misconfiguration:' already covered by test_gate_bypass_chain.sh (Test 2 / Test 3)"
+
+# --- Check 3: UNION-IS-LIVE PROOF -------------------------------------------
+echo ""
+echo "Check 3: union-is-live proof -- FlowDefinition-driven claim selection actually runs (not fail-open null)"
+
+# Prerequisite: loadActiveFlowStep() in stop-goal-fit.js fails open to null
+# when flow-resolver.js (built under build/src/lib/) is absent (hasBuild guard). If build/
+# is missing, declaredClaimTypes is null for every session below, the
+# declared builder.verify.tests branch of the union is never exercised, and
+# this whole check would pass vacuously (the "not flagged" assertions in 3a
+# are satisfied trivially when nothing can ever be selected via the declared
+# branch). Fail loudly instead of silently passing.
+BUILT_RESOLVER="$ROOT/build/src/li""b/flow-resolver.js"
+if [ ! -f "$BUILT_RESOLVER" ]; then
+  echo "  ✗ FATAL: build/src/li""b/flow-resolver.js is missing -- this eval requires npm run build; refusing to vacuously pass." >&2
+  echo "      Without build/, loadActiveFlowStep() fails open to null, declaredClaimTypes is null" >&2
+  echo "      everywhere, the declared builder.verify.tests claim is never selected via the union's" >&2
+  echo "      declared-type branch, and Check 3 would pass without ever exercising" >&2
+  echo "      FlowDefinition-driven claim selection. Run: npm run build" >&2
+  exit 1
+fi
+_pass "prerequisite: build/src/li""b/flow-resolver.js is present -- FlowDefinition resolution is live for this run"
+
+# --- Check 3a: undeclared workflow.* claim still blocks a builder.build ----
+# session even though workflow.check.command is NOT declared by builder.build's
+# verify-gate expects[] (which only declares builder.verify.tests and
+# builder.verify.policy-compliance -- see kits/builder/flows/build.flow.json).
+echo ""
+echo "Check 3a: undeclared workflow.check.command claim still blocks a builder.build/verify session"
+
+T3_DIR="$TMP/t3-union-live"
+seed_repo "$T3_DIR" "union-live-test"
+
+CURRENT_FILE="$T3_DIR/.kontourai/flow-agents/current.json"
+printf '%s' '{"artifact_dir":"union-live-test","active_flow_id":"builder.build","active_step_id":"verify"}' \
+  > "$CURRENT_FILE"
+
+python3 - "$T3_DIR/.kontourai/flow-agents/union-live-test/trust.bundle" << 'PY'
+import json, sys
+bundle = {
+    "schemaVersion": 3,
+    "source": "flow-agents/workflow-sidecar",
+    "claims": [
+        {
+            # Declared by builder.build's verify-gate expects[] -- clean, must NOT block.
+            "id": "c-declared",
+            "subjectId": "union-live-test/tests",
+            "subjectType": "flow-step",
+            "claimType": "builder.verify.tests",
+            "fieldOrBehavior": "build/verify tests",
+            "value": "pass",
+            "impactLevel": "high",
+            "status": "verified",
+            "createdAt": "2026-06-30T00:00:00Z",
+            "updatedAt": "2026-06-30T00:00:00Z"
+        },
+        {
+            # NOT declared by builder.build's verify-gate expects[] -- only reachable via
+            # the union's workflow.* baseline. Stored "verified" but tampered: evidence
+            # re-derives to disputed. Must BLOCK if (and only if) the union is live.
+            "id": "c-undeclared-workflow",
+            "subjectId": "union-live-test/unit-tests",
+            "subjectType": "workflow-check",
+            "claimType": "workflow.check.command",
+            "fieldOrBehavior": "unit tests",
+            "value": "pass",
+            "impactLevel": "high",
+            "status": "verified",   # tampered: edited from "disputed" -> "verified"
+            "createdAt": "2026-06-30T00:00:00Z",
+            "updatedAt": "2026-06-30T00:00:00Z"
+        }
+    ],
+    "evidence": [
+        {
+            "id": "ev-declared",
+            "claimId": "c-declared",
+            "evidenceType": "test_output",
+            "method": "validation",
+            "sourceRef": "command-log.jsonl",
+            "excerptOrSummary": "npm test passed",
+            "observedAt": "2026-06-30T00:00:00Z",
+            "collectedBy": "harness",
+            "passing": True,
+            "blocking": False
+        },
+        {
+            "id": "ev-undeclared-workflow",
+            "claimId": "c-undeclared-workflow",
+            "evidenceType": "test_output",
+            "method": "validation",
+            "sourceRef": "command-log.jsonl",
+            "excerptOrSummary": "npm test failed with exit 1",
+            "observedAt": "2026-06-30T00:00:00Z",
+            "collectedBy": "harness",
+            "passing": False,
+            "blocking": True
+        }
+    ],
+    "policies": [],
+    "events": [
+        {
+            "id": "evt-declared",
+            "claimId": "c-declared",
+            "status": "verified",
+            "actor": "agent",
+            "method": "workflow-check",
+            "evidenceIds": ["ev-declared"],
+            "createdAt": "2026-06-30T00:00:00Z"
+        },
+        {
+            "id": "evt-undeclared-workflow",
+            "claimId": "c-undeclared-workflow",
+            "status": "verified",
+            "actor": "agent",
+            "method": "workflow-check",
+            "evidenceIds": ["ev-undeclared-workflow"],
+            "createdAt": "2026-06-30T00:00:00Z"
+        }
+    ]
+}
+json.dump(bundle, open(sys.argv[1], 'w'))
+PY
+
+set +e
+t3_out="$(FLOW_AGENTS_GOAL_FIT_MODE=block FLOW_AGENTS_GOAL_FIT_BACKSTOP=skip \
+    node "$GATE" 2>&1 <<< "{\"hook_event_name\":\"Stop\",\"cwd\":\"$T3_DIR\"}")"
+t3_exit="$?"
+set -e
+
+if [ "$t3_exit" -eq 2 ]; then
+  _pass "builder.build/verify session with tampered undeclared workflow.check.command claim BLOCKS (exit 2)"
+else
+  _fail "builder.build/verify session did NOT block on the undeclared workflow.* claim: exit=$t3_exit output=$t3_out"
+fi
+
+if echo "$t3_out" | grep -q "caught false-completion"; then
+  _pass "union-is-live: emits caught false-completion"
+else
+  _fail "union-is-live: missing caught false-completion: $t3_out"
+fi
+
+if echo "$t3_out" | grep -q "workflow.check.command"; then
+  _pass "union-is-live: warning names the undeclared claimType workflow.check.command"
+else
+  _fail "union-is-live: warning does not mention workflow.check.command: $t3_out"
+fi
+
+if echo "$t3_out" | grep -q "builder.verify.tests"; then
+  _fail "union-is-live: the clean declared builder.verify.tests claim was incorrectly flagged too: $t3_out"
+else
+  _pass "union-is-live: the clean declared builder.verify.tests claim is not flagged (only the undeclared workflow.* claim blocks)"
+fi
+
+# Additive (iteration 5 fix pass, MEDIUM/reviewer): gateLabel()'s FlowDefinition-active
+# branch ("[<flowId>/<gateId>]") had zero eval coverage. This session's current.json
+# names active_flow_id=builder.build / active_step_id=verify (set above), so the Stop
+# hook's stderr must be prefixed with the resolved gate identity instead of the generic
+# "[stop-gate]" fallback -- and since this scenario also produces a claimed-pass-never-
+# captured warning (FLOW_AGENTS_GOAL_FIT_BACKSTOP=skip), the per-gap remediation guidance
+# line is asserted too (cheap, same output, message-assembly only -- no new fixture).
+if echo "$t3_out" | grep -q "\[builder.build/verify-gate\]"; then
+  _pass "union-is-live: Stop hook stderr is prefixed with the resolved gate identity [builder.build/verify-gate]"
+else
+  _fail "union-is-live: missing the gate-named prefix [builder.build/verify-gate]: $t3_out"
+fi
+
+if echo "$t3_out" | grep -q '  → run the command in this session'; then
+  _pass "union-is-live: per-gap remediation guidance line is present for the claimed-pass-never-captured warning"
+else
+  _fail "union-is-live: missing the per-gap remediation guidance line: $t3_out"
+fi
+
+# --- Check 3b: tampered DECLARED claim proves declaredClaimTypes selection --
+# is actually live (positive proof, not just "not flagged" by omission). This
+# closes the vacuous-pass gap: 3a alone never forces the declared branch of
+# the union (`declaredClaimTypes.has(ct)`) to fire and block anything, so a
+# broken/dead declared-type selector (or a null declaredClaimTypes from a
+# missing build/) could still make 3a's assertions pass. builder.verify.tests
+# does NOT start with "workflow.", so this claim can ONLY be selected via the
+# declared branch -- if it blocks, the declared branch is demonstrably live.
+echo ""
+echo "Check 3b: tampered DECLARED builder.verify.tests claim blocks -- proves declaredClaimTypes selection is live"
+
+T3B_DIR="$TMP/t3b-declared-live"
+seed_repo "$T3B_DIR" "declared-live-test"
+
+CURRENT_FILE_3B="$T3B_DIR/.kontourai/flow-agents/current.json"
+printf '%s' '{"artifact_dir":"declared-live-test","active_flow_id":"builder.build","active_step_id":"verify"}' \
+  > "$CURRENT_FILE_3B"
+
+python3 - "$T3B_DIR/.kontourai/flow-agents/declared-live-test/trust.bundle" << 'PY'
+import json, sys
+bundle = {
+    "schemaVersion": 3,
+    "source": "flow-agents/workflow-sidecar",
+    "claims": [
+        {
+            # The ONLY claim in this bundle, and it does NOT start with "workflow.".
+            # Selecting it at all requires declaredClaimTypes != null && .has(ct) --
+            # i.e. requires a live, resolved active FlowDefinition. Stored "verified"
+            # but tampered: evidence re-derives to disputed. Must BLOCK if (and only
+            # if) the declared-type half of the union is live.
+            "id": "c-declared-tampered",
+            "subjectId": "declared-live-test/tests",
+            "subjectType": "flow-step",
+            "claimType": "builder.verify.tests",
+            "fieldOrBehavior": "build/verify tests",
+            "value": "pass",
+            "impactLevel": "high",
+            "status": "verified",   # tampered: edited from "disputed" -> "verified"
+            "createdAt": "2026-06-30T00:00:00Z",
+            "updatedAt": "2026-06-30T00:00:00Z"
+        }
+    ],
+    "evidence": [
+        {
+            "id": "ev-declared-tampered",
+            "claimId": "c-declared-tampered",
+            "evidenceType": "test_output",
+            "method": "validation",
+            "sourceRef": "command-log.jsonl",
+            "excerptOrSummary": "npm test failed with exit 1",
+            "observedAt": "2026-06-30T00:00:00Z",
+            "collectedBy": "harness",
+            "passing": False,
+            "blocking": True
+        }
+    ],
+    "policies": [],
+    "events": [
+        {
+            "id": "evt-declared-tampered",
+            "claimId": "c-declared-tampered",
+            "status": "verified",
+            "actor": "agent",
+            "method": "workflow-check",
+            "evidenceIds": ["ev-declared-tampered"],
+            "createdAt": "2026-06-30T00:00:00Z"
+        }
+    ]
+}
+json.dump(bundle, open(sys.argv[1], 'w'))
+PY
+
+set +e
+t3b_out="$(FLOW_AGENTS_GOAL_FIT_MODE=block FLOW_AGENTS_GOAL_FIT_BACKSTOP=skip \
+    node "$GATE" 2>&1 <<< "{\"hook_event_name\":\"Stop\",\"cwd\":\"$T3B_DIR\"}")"
+t3b_exit="$?"
+set -e
+
+if [ "$t3b_exit" -eq 2 ]; then
+  _pass "builder.build/verify session with tampered DECLARED builder.verify.tests claim BLOCKS (exit 2) -- declaredClaimTypes selection is live, not vacuous"
+else
+  _fail "builder.build/verify session did NOT block on the tampered DECLARED builder.verify.tests claim (declaredClaimTypes selection may be dead or null): exit=$t3b_exit output=$t3b_out"
+fi
+
+if echo "$t3b_out" | grep -q "builder.verify.tests"; then
+  _pass "declared-claim-live: warning names the declared claimType builder.verify.tests"
+else
+  _fail "declared-claim-live: warning does not mention builder.verify.tests: $t3b_out"
+fi
+
+if echo "$t3b_out" | grep -q "tampered" || echo "$t3b_out" | grep -q "caught false-completion"; then
+  _pass "declared-claim-live: emits tampered/caught false-completion signal for the declared claim"
+else
+  _fail "declared-claim-live: missing tampered/caught false-completion signal: $t3b_out"
+fi
+
+# --- Summary -----------------------------------------------------------------
+echo ""
+if [ "$errors" -eq 0 ]; then
+  echo "Union-floor regression trip-wire passed: PR #215 posture intact (union live, empty-expects guard cross-referenced, declared-claim selection positively proven live)."
+  exit 0
+fi
+echo "Union-floor regression trip-wire FAILED: $errors issue(s). This may indicate a regression of PR #215 / ADR 0016 / ADR 0018 -- see .kontourai/flow-agents/flowdef-driven-stop-gate/plan.md Prior Attempt Post-Mortem."
+exit 1

package/evals/integration/test_gate_bypass_chain.sh

@@ -3,10 +3,10 @@
 # gate-bypass chain (adversarial review HIGH/A01/A04).
 #
 # Exploit chain (pre-fix):
-#   1. Traversal via active_flow_id: "builder.../../../.flow-agents/slug/fake-flow"
-#      splits into kitId="builder" / flowName="../../../.flow-agents/slug/fake-flow"
+#   1. Traversal via active_flow_id: "builder.../../../.kontourai/flow-agents/slug/fake-flow"
+#      splits into kitId="builder" / flowName="../../../.kontourai/flow-agents/slug/fake-flow"
 #      → path.join escapes kits/ → loads attacker-authored fake-flow.flow.json
-#      directly from .flow-agents/ (agent-writable location).
+#      directly from .kontourai/flow-agents/ (agent-writable location).
 #   2. Fake flow has gates:{g:{step:"verify",expects:[]}} → declaredClaimTypes=Set{}
 #      (empty, NOT null) → old if/else isSelectedClaim returns false for EVERY claim
 #      → bundleEnforcement emits ZERO warnings → tamper-detection bypassed → exit 0.
@@ -23,7 +23,7 @@
 #   1. Layer 1 — traversal closed: pre-fix path.join escapes kits/, post-fix returns null.
 #   2. Layer 2 — empty-Set closed: pre-fix 0 claims selected, post-fix exit 2.
 #   3. Full chain end-to-end: traversal current.json + fake empty-expects flow under
-#      .flow-agents/ + disputed workflow.* bundle → PRE-FIX exit 0, POST-FIX exit 2.
+#      .kontourai/flow-agents/ + disputed workflow.* bundle → PRE-FIX exit 0, POST-FIX exit 2.
 #   4. Legit session regression: builder.build/verify with real flow still works.
 #
 # Deterministic, no model spend, self-cleaning.
@@ -48,11 +48,11 @@ trap cleanup EXIT
 # ─── Helper: seed a minimal in-progress workflow artifact ─────────────────────
 seed_repo_inprogress() { # $1=dir $2=slug
   local p="$1" slug="$2"
-  mkdir -p "$p/.flow-agents/$slug"
+  mkdir -p "$p/.kontourai/flow-agents/$slug"
   printf '# Repo\n' > "$p/AGENTS.md"
   printf '%s' "{\"schema_version\":\"1.0\",\"task_slug\":\"$slug\",\"status\":\"in_progress\",\"phase\":\"execution\",\"updated_at\":\"2026-06-27T00:00:00Z\",\"next_action\":{\"status\":\"in_progress\",\"summary\":\"Testing\"}}" \
-    > "$p/.flow-agents/$slug/state.json"
-  cat > "$p/.flow-agents/$slug/$slug--deliver.md" << MD
+    > "$p/.kontourai/flow-agents/$slug/state.json"
+  cat > "$p/.kontourai/flow-agents/$slug/$slug--deliver.md" << MD
 # $slug
 
 branch: main
@@ -72,7 +72,7 @@ seed_disputed_bundle() { # $1=bundle_path $2=slug
 import json, sys
 bundle_path, slug = sys.argv[1], sys.argv[2]
 bundle = {
-    "schemaVersion": 3,
+    "schemaVersion": 5,
     "source": "flow-agents/workflow-sidecar",
     "claims": [{
         "id": "c-dispute",
@@ -109,10 +109,10 @@ const path = require('path');
 const repoRoot = '/repo';
 
 // Exact exploit string from the task description
-const malId = 'builder.../../../.flow-agents/slug/fake-flow';
+const malId = 'builder.../../../.kontourai/flow-agents/slug/fake-flow';
 const dot = malId.indexOf('.');  // 7
 const kitId = malId.slice(0, dot);      // 'builder'
-const flowName = malId.slice(dot + 1);  // '../../../.flow-agents/slug/fake-flow'
+const flowName = malId.slice(dot + 1);  // '../../../.kontourai/flow-agents/slug/fake-flow'
 
 console.log('  Traversal flowId: \"' + malId + '\"');
 console.log('  Parsed: kitId=\"' + kitId + '\" flowName=\"' + flowName + '\"');
@@ -121,7 +121,7 @@ console.log('  Parsed: kitId=\"' + kitId + '\" flowName=\"' + flowName + '\"');
 const preFix = path.join(repoRoot, 'kits', kitId, 'flows', flowName + '.flow.json');
 console.log('  PRE-FIX path.join: ' + preFix);
 const escaped = !preFix.startsWith(path.join(repoRoot, 'kits') + '/');
-console.log('  PRE-FIX escapes kits/: ' + escaped + ' → would load attacker file under .flow-agents/');
+console.log('  PRE-FIX escapes kits/: ' + escaped + ' → would load attacker file under .kontourai/flow-agents/');
 
 if (!escaped) {
   console.error('ERROR: expected traversal to escape kits/ with this flowId');
@@ -140,8 +140,8 @@ const repoRoot = '$ROOT';
 
 // Traversal IDs — all must return null (slug validation rejects '.', '/', etc.)
 const cases = [
-  ['builder.../../../.flow-agents/slug/fake-flow', 'verify'],  // exact exploit from task
-  ['builder../../../.flow-agents/x/fake', 'verify'],           // double-dot variant
+  ['builder.../../../.kontourai/flow-agents/slug/fake-flow', 'verify'],  // exact exploit from task
+  ['builder../../../.kontourai/flow-agents/x/fake', 'verify'],           // double-dot variant
   ['builder.../etc/passwd', 'verify'],                          // etc/passwd probe
   ['kit-id.flow/../../secret', 'step'],                         // different separator
   ['builder.build', '../../../etc'],                            // traversal in stepId
@@ -173,23 +173,35 @@ console.log('builder.build/verify: gateId=' + result.gateId + ' expects=' + resu
 " 2>&1 && _pass "Legit builder.build/verify resolves correctly (no over-rejection)" \
           || _fail "Legit builder.build/verify regression"
 
-# Validate FLOW_AGENTS_FLOW_DEFS_DIR under .flow-agents is rejected
+# Validate FLOW_AGENTS_FLOW_DEFS_DIR under .kontourai/flow-agents is rejected
 T1_DIR="$TMP/t1-override"
-mkdir -p "$T1_DIR/.flow-agents/fake-flows"
-cat > "$T1_DIR/.flow-agents/fake-flows/builder.build.flow.json" << 'JSON'
+mkdir -p "$T1_DIR/.kontourai/flow-agents/fake-flows"
+cat > "$T1_DIR/.kontourai/flow-agents/fake-flows/builder.build.flow.json" << 'JSON'
 {"id":"fake","version":"0.0","gates":{"g":{"step":"verify","expects":[]}}}
 JSON
 node -e "
 const r = require('$RESOLVER');
-// Override points INTO .flow-agents (agent-writable) — must fall back to kits/
-process.env.FLOW_AGENTS_FLOW_DEFS_DIR = '$T1_DIR/.flow-agents/fake-flows';
+// Override points INTO .kontourai/flow-agents (agent-writable) — must fall back to kits/
+process.env.FLOW_AGENTS_FLOW_DEFS_DIR = '$T1_DIR/.kontourai/flow-agents/fake-flows';
 const result = r.resolveFlowStep('builder.build', 'verify', '$T1_DIR');
 delete process.env.FLOW_AGENTS_FLOW_DEFS_DIR;
 // Falls back to repoRoot/kits/ which has no builder.build flow → null
 // This confirms the agent-writable FLOW_DEFS_DIR override was rejected
-console.log('FLOW_DEFS_DIR under .flow-agents: result =', result, '(null = override rejected)');
-" 2>&1 && _pass "FLOW_AGENTS_FLOW_DEFS_DIR under .flow-agents is ignored (agent-writable protection)" \
-          || _fail "FLOW_AGENTS_FLOW_DEFS_DIR .flow-agents bypass not blocked"
+console.log('FLOW_DEFS_DIR under .kontourai/flow-agents: result =', result, '(null = override rejected)');
+" 2>&1 && _pass "FLOW_AGENTS_FLOW_DEFS_DIR under .kontourai/flow-agents is ignored (agent-writable protection)" \
+          || _fail "FLOW_AGENTS_FLOW_DEFS_DIR .kontourai/flow-agents bypass not blocked"
+
+ln -s "$T1_DIR/.kontourai/flow-agents/fake-flows" "$TMP/safe-looking-flow-defs"
+node -e "
+const r = require('$RESOLVER');
+// Override LOOKS safe but resolves through a symlink into agent-writable runtime artifacts.
+process.env.FLOW_AGENTS_FLOW_DEFS_DIR = '$TMP/safe-looking-flow-defs';
+const result = r.resolveFlowStep('builder.build', 'verify', '$T1_DIR');
+delete process.env.FLOW_AGENTS_FLOW_DEFS_DIR;
+console.log('FLOW_DEFS_DIR symlink to .kontourai/flow-agents: result =', result, '(null = symlink override rejected)');
+if (result !== null) process.exit(1);
+" 2>&1 && _pass "FLOW_AGENTS_FLOW_DEFS_DIR symlink into .kontourai/flow-agents is ignored" \
+          || _fail "FLOW_AGENTS_FLOW_DEFS_DIR symlink into .kontourai/flow-agents bypass not blocked"
 
 
 # ─── Test 2: Empty-Set closed — Layer 2 union form ───────────────────────────
@@ -198,11 +210,11 @@ echo "=== 2. Layer 2 — Empty-Set defense: union isSelectedClaim + empty-expect
 
 T2_DIR="$TMP/t2-empty-set"
 seed_repo_inprogress "$T2_DIR" "empty-set-test"
-seed_disputed_bundle "$T2_DIR/.flow-agents/empty-set-test/trust.bundle" "empty-set-test"
+seed_disputed_bundle "$T2_DIR/.kontourai/flow-agents/empty-set-test/trust.bundle" "empty-set-test"
 printf '%s' '{"artifact_dir":"empty-set-test","active_flow_id":"builder.build","active_step_id":"verify"}' \
-  > "$T2_DIR/.flow-agents/current.json"
+  > "$T2_DIR/.kontourai/flow-agents/current.json"
 
-# Fake flow with empty expects[] (loaded via FLOW_DEFS_DIR — NOT under .flow-agents)
+# Fake flow with empty expects[] (loaded via FLOW_DEFS_DIR — NOT under .kontourai/flow-agents)
 mkdir -p "$TMP/fake-flows-safe"
 cat > "$TMP/fake-flows-safe/builder.build.flow.json" << 'JSON'
 {"id":"builder.build","version":"0.0","gates":{"fake-gate":{"step":"verify","expects":[]}}}
@@ -262,19 +274,19 @@ echo ""
 echo "=== 3. Full exploit chain: traversal current.json + fake empty-expects flow + disputed bundle ==="
 echo ""
 echo "Setup: T3_DIR has kits/ so findRepoRoot returns T3_DIR."
-echo "Traversal flowId 'builder.../../../.flow-agents/slug/fake-flow' with repoRoot=T3_DIR resolves to:"
-echo "  T3_DIR/.flow-agents/slug/fake-flow.flow.json (agent-writable — the fake flow)"
+echo "Traversal flowId 'builder.../../../.kontourai/flow-agents/slug/fake-flow' with repoRoot=T3_DIR resolves to:"
+echo "  T3_DIR/.kontourai/flow-agents/slug/fake-flow.flow.json (agent-writable — the fake flow)"
 
 T3_DIR="$TMP/t3-full-chain"
 mkdir -p "$T3_DIR/kits"  # ensures findRepoRoot returns T3_DIR
 seed_repo_inprogress "$T3_DIR" "exploit-test"
-seed_disputed_bundle "$T3_DIR/.flow-agents/exploit-test/trust.bundle" "exploit-test"
+seed_disputed_bundle "$T3_DIR/.kontourai/flow-agents/exploit-test/trust.bundle" "exploit-test"
 
 # Place the fake flow exactly where the traversal would resolve it:
-# path.join(T3_DIR, "kits", "builder", "flows", "../../../.flow-agents/slug/fake-flow.flow.json")
-# = T3_DIR/.flow-agents/slug/fake-flow.flow.json
-mkdir -p "$T3_DIR/.flow-agents/slug"
-cat > "$T3_DIR/.flow-agents/slug/fake-flow.flow.json" << 'JSON'
+# path.join(T3_DIR, "kits", "builder", "flows", "../../../.kontourai/flow-agents/slug/fake-flow.flow.json")
+# = T3_DIR/.kontourai/flow-agents/slug/fake-flow.flow.json
+mkdir -p "$T3_DIR/.kontourai/flow-agents/slug"
+cat > "$T3_DIR/.kontourai/flow-agents/slug/fake-flow.flow.json" << 'JSON'
 {
   "id": "fake-bypass",
   "version": "0.0",
@@ -288,15 +300,15 @@ cat > "$T3_DIR/.flow-agents/slug/fake-flow.flow.json" << 'JSON'
 JSON
 
 # current.json: traversal active_flow_id pointing to the fake flow
-printf '%s' '{"artifact_dir":"exploit-test","active_flow_id":"builder.../../../.flow-agents/slug/fake-flow","active_step_id":"verify"}' \
-  > "$T3_DIR/.flow-agents/current.json"
+printf '%s' '{"artifact_dir":"exploit-test","active_flow_id":"builder.../../../.kontourai/flow-agents/slug/fake-flow","active_step_id":"verify"}' \
+  > "$T3_DIR/.kontourai/flow-agents/current.json"
 
 echo ""
 echo "--- 3a. PRE-FIX: demonstrate traversal would load the fake flow ---"
 node -e "
 const path = require('path');
 const repoRoot = '$T3_DIR';
-const flowId = 'builder.../../../.flow-agents/slug/fake-flow';
+const flowId = 'builder.../../../.kontourai/flow-agents/slug/fake-flow';
 const dot = flowId.indexOf('.');
 const kitId = flowId.slice(0, dot);
 const flowName = flowId.slice(dot + 1);
@@ -353,13 +365,13 @@ echo ""
 echo "=== 4. Regression: legit builder.build/verify session passes (no false-block) ==="
 
 T4_DIR="$TMP/t4-legit"
-mkdir -p "$T4_DIR/.flow-agents/legit-test"
+mkdir -p "$T4_DIR/.kontourai/flow-agents/legit-test"
 printf '# Repo\n' > "$T4_DIR/AGENTS.md"
 printf '%s' '{"artifact_dir":"legit-test","active_flow_id":"builder.build","active_step_id":"verify"}' \
-  > "$T4_DIR/.flow-agents/current.json"
+  > "$T4_DIR/.kontourai/flow-agents/current.json"
 printf '%s' '{"schema_version":"1.0","task_slug":"legit-test","status":"delivered","phase":"done","updated_at":"2026-06-27T00:00:00Z","next_action":{"status":"done","summary":"done"}}' \
-  > "$T4_DIR/.flow-agents/legit-test/state.json"
-cat > "$T4_DIR/.flow-agents/legit-test/legit-test--deliver.md" << 'MD'
+  > "$T4_DIR/.kontourai/flow-agents/legit-test/state.json"
+cat > "$T4_DIR/.kontourai/flow-agents/legit-test/legit-test--deliver.md" << 'MD'
 # legit-test
 
 branch: main
@@ -376,10 +388,10 @@ type: deliver
 MD
 
 # Write a CLEAN trust.bundle for builder.verify.tests (status=verified, passing evidence)
-python3 - "$T4_DIR/.flow-agents/legit-test/trust.bundle" << 'PY'
+python3 - "$T4_DIR/.kontourai/flow-agents/legit-test/trust.bundle" << 'PY'
 import json, sys
 bundle = {
-    "schemaVersion": 3,
+    "schemaVersion": 5,
     "source": "flow-agents/workflow-sidecar",
     "claims": [{
         "id": "c-legit",