@kontourai/flow-agents 2.2.0 → 2.4.0

package/evals/integration/test_sidecar_field_preservation.sh

@@ -0,0 +1,249 @@
+#!/usr/bin/env bash
+# test_sidecar_field_preservation.sh — CLASS-level regression guard for the #270/#298/#309
+# field-loss bug family (silent persistent-field drop on a state.json-writing sidecar command).
+#
+# #289 introduced `branch:` as a persistent identity field; #309 found init-plan's initSidecars
+# rewrite could silently DROP it on a repaired/backfilled session (a live instance of the same
+# "state.json fully rewritten, not merged" bug class that #270/#298 already hit for other fields).
+# code-review-309 found the SAME class live again: the #309 backfill path silently reset
+# created_at on a repaired session, because initSidecars always re-stamps created_at from the
+# current call's timestamp instead of preserving an existing session's original creation time.
+#
+# Rather than adding another one-field regression test, this is an INVARIANT SWEEP: seed one
+# fully-populated session, run every state.json-touching mutator subcommand once (in the order a
+# real session actually calls them), and after EACH command assert that every persistent identity
+# field (branch, task_slug, repo, created_at, and owner when present) is byte-identical to the
+# seeded baseline — except the fields a given command explicitly owns (status, phase, updated_at,
+# next_action, artifact_paths). Any FUTURE writer that starts fully rewriting state.json instead
+# of merging prior contents (the root cause of this whole bug family) fails this sweep immediately,
+# naming the offending command — without anyone having to think to add a bespoke field-loss test
+# for it first.
+#
+# Deterministic, no model spend, self-cleaning.
+# Usage: bash evals/integration/test_sidecar_field_preservation.sh
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+source "$ROOT/evals/lib/node.sh"
+
+WRITER="workflow-sidecar"
+TMPDIR_EVAL="$(mktemp -d)"
+errors=0
+
+cleanup() { rm -rf "$TMPDIR_EVAL"; }
+trap cleanup EXIT
+
+_pass() { echo "  ✓ $1"; }
+_fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
+
+if ! command -v jq >/dev/null 2>&1; then
+  echo "jq is required for this eval's field-identity assertions" >&2
+  exit 1
+fi
+
+SESSION_ROOT="$TMPDIR_EVAL/repo/.kontourai/flow-agents"
+SLUG="sidecar-field-preservation-sweep"
+SESSION_DIR="$SESSION_ROOT/$SLUG"
+STATE="$SESSION_DIR/state.json"
+mkdir -p "$SESSION_ROOT"
+
+# ─── Field-identity assertion helpers ────────────────────────────────────────
+# Persistent identity fields captured from the seeded baseline. `owner` is included per the
+# schema (schemas/workflow-state.schema.json allows it) even though NO current sidecar writer
+# path ever stamps it — no command sets `owner:` on state.json today, so the captured baseline
+# value is always the jq sentinel "<absent>" and stays "<absent>" for the whole sweep. That is
+# still a real (trivial) assertion: if some future writer starts adding an `owner` field without
+# preserving a pre-existing one, this sweep would catch it the same way it catches every other
+# persistent field. No fixture forces a synthetic owner value — that would test a code path that
+# does not exist today.
+FIELDS=(branch task_slug repo created_at owner)
+declare -A BASELINE
+
+_field() {
+  local file="$1" field="$2"
+  jq -r --arg f "$field" '.[$f] // "<absent>"' "$file" 2>/dev/null
+}
+
+_capture_baseline() {
+  local field
+  for field in "${FIELDS[@]}"; do
+    BASELINE["$field"]="$(_field "$STATE" "$field")"
+  done
+}
+
+_assert_preserved() {
+  local label="$1"
+  local field actual ok=1
+  for field in "${FIELDS[@]}"; do
+    actual="$(_field "$STATE" "$field")"
+    if [[ "$actual" != "${BASELINE[$field]}" ]]; then
+      _fail "$label dropped/changed persistent field '$field': expected '${BASELINE[$field]}' got '$actual'"
+      ok=0
+    fi
+  done
+  [[ "$ok" -eq 1 ]] && _pass "persistent identity fields (${FIELDS[*]}) survive $label"
+}
+
+# ─── Seed: ensure-session with an injected actor (derived branch) and a KNOWN timestamp ──────
+SEED_TS="2026-06-20T08:00:00Z"
+if ! flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_ROOT" \
+  --task-slug "$SLUG" \
+  --actor sweep-actor \
+  --flow-id builder.build \
+  --title "Sidecar Field Preservation Sweep" \
+  --source-request "Seed a fully-populated session for the field-preservation invariant sweep." \
+  --summary "Seed session for the class-level field-preservation sweep." \
+  --criterion "Every state.json-touching mutator preserves persistent identity fields" \
+  --timestamp "$SEED_TS" >"$TMPDIR_EVAL/seed.out" 2>"$TMPDIR_EVAL/seed.err"; then
+  _fail "sweep setup: ensure-session failed: $(cat "$TMPDIR_EVAL/seed.out" "$TMPDIR_EVAL/seed.err")"
+  echo ""
+  echo "$errors check(s) failed."
+  exit 1
+fi
+
+if [[ ! -f "$STATE" ]]; then
+  _fail "sweep setup: ensure-session did not write state.json"
+  echo ""
+  echo "$errors check(s) failed."
+  exit 1
+fi
+
+_capture_baseline
+if [[ "${BASELINE[branch]}" != "agent/sweep-actor/$SLUG" || "${BASELINE[created_at]}" != "$SEED_TS" || "${BASELINE[task_slug]}" != "$SLUG" ]]; then
+  _fail "sweep setup: seeded baseline did not carry the expected branch/created_at/task_slug (branch=${BASELINE[branch]} created_at=${BASELINE[created_at]} task_slug=${BASELINE[task_slug]})"
+fi
+
+# ─── 1. init-plan, run against a BRANCH-LESS plan artifact ───────────────────────────────────
+# Mirrors the real tool-planner shape: init-plan is invoked against the plan artifact
+# ("<slug>--plan-work.md"), a DIFFERENT file than "<slug>--deliver.md" that ensure-session seeded
+# the branch: line into. This is the exact repro shape of the #309 regression.
+PLAN_ARTIFACT="$SESSION_DIR/$SLUG--plan-work.md"
+cat > "$PLAN_ARTIFACT" <<'MARKDOWN'
+---
+role: plan
+parent: sidecar-field-preservation-sweep--deliver
+created: 2026-06-20
+---
+
+# Plan: field-preservation sweep fixture
+
+A plan artifact deliberately carrying no `branch:` line (mirrors real tool-planner output).
+
+## Definition Of Done
+
+- **Acceptance criteria:**
+  - [ ] init-plan preserves persistent identity fields - Evidence: pending.
+MARKDOWN
+if flow_agents_node "$WRITER" init-plan "$PLAN_ARTIFACT" \
+  --source-request "Plan artifact carries no branch: line (mirrors tool-planner output)." \
+  --summary "Planning sidecars initialized from a branch-less plan artifact." \
+  --next-action "Advance to execution." \
+  --timestamp "2026-06-20T08:05:00Z" >"$TMPDIR_EVAL/init-plan.out" 2>"$TMPDIR_EVAL/init-plan.err"; then
+  _assert_preserved "init-plan"
+else
+  _fail "init-plan failed: $(cat "$TMPDIR_EVAL/init-plan.out" "$TMPDIR_EVAL/init-plan.err")"
+fi
+
+# ─── 2. advance-state (--flow-definition builder.build, non-terminal) ────────────────────────
+# Moves phase execution -> maps to the "execute" step in builder.build's phase_map, which also
+# sets current.json active_step_id so record-gate-claim below has a reachable gate.
+if flow_agents_node "$WRITER" advance-state "$SESSION_DIR" \
+  --status in_progress \
+  --phase execution \
+  --summary "Execution started." \
+  --next-action "Implement the change." \
+  --flow-definition builder.build \
+  --timestamp "2026-06-20T08:10:00Z" >"$TMPDIR_EVAL/advance-1.out" 2>"$TMPDIR_EVAL/advance-1.err"; then
+  _assert_preserved "advance-state (#1, builder.build execution)"
+else
+  _fail "advance-state (#1) failed: $(cat "$TMPDIR_EVAL/advance-1.out" "$TMPDIR_EVAL/advance-1.err")"
+fi
+
+# ─── 3. record-agent-event ────────────────────────────────────────────────────────────────────
+# record-agent-event does not write state.json at all today (only agents/<id>/events.jsonl and
+# current.json active_agents) — this still pins that invariant: state.json must stay untouched.
+if flow_agents_node "$WRITER" record-agent-event \
+  --artifact-root "$SESSION_ROOT" \
+  --agent-id tool-worker-sweep \
+  --kind evidence \
+  --status active \
+  --summary "Worker started the sweep's implementation pass." \
+  --timestamp "2026-06-20T08:15:00Z" >"$TMPDIR_EVAL/agent-event.out" 2>"$TMPDIR_EVAL/agent-event.err"; then
+  _assert_preserved "record-agent-event"
+else
+  _fail "record-agent-event failed: $(cat "$TMPDIR_EVAL/agent-event.out" "$TMPDIR_EVAL/agent-event.err")"
+fi
+
+# ─── 4. record-evidence (one check) ───────────────────────────────────────────────────────────
+if flow_agents_node "$WRITER" record-evidence "$SESSION_DIR" \
+  --verdict pass \
+  --check-json '{"id":"sweep-check","kind":"command","status":"pass","summary":"Sweep fixture command check."}' \
+  --timestamp "2026-06-20T08:20:00Z" >"$TMPDIR_EVAL/evidence.out" 2>"$TMPDIR_EVAL/evidence.err"; then
+  _assert_preserved "record-evidence"
+else
+  _fail "record-evidence failed: $(cat "$TMPDIR_EVAL/evidence.out" "$TMPDIR_EVAL/evidence.err")"
+fi
+
+# ─── 5. record-critique (one finding) ─────────────────────────────────────────────────────────
+if flow_agents_node "$WRITER" record-critique "$SESSION_DIR" \
+  --id sweep-review \
+  --reviewer tool-code-reviewer \
+  --verdict pass \
+  --summary "No blocking findings." \
+  --finding-json '{"id":"sweep-finding","severity":"low","status":"fixed","description":"No blocking issues found during sweep sanity critique."}' \
+  --timestamp "2026-06-20T08:25:00Z" >"$TMPDIR_EVAL/critique.out" 2>"$TMPDIR_EVAL/critique.err"; then
+  _assert_preserved "record-critique"
+else
+  _fail "record-critique failed: $(cat "$TMPDIR_EVAL/critique.out" "$TMPDIR_EVAL/critique.err")"
+fi
+
+# ─── 6. record-gate-claim (a builder.build-reachable expectation) ────────────────────────────
+# advance-state #1 above (--phase execution) set current.json active_step_id to "execute" via
+# builder.build's phase_map. The execute-gate in kits/builder/flows/build.flow.json declares
+# exactly ONE expects[] entry ("implementation-scope"), so it auto-resolves without needing
+# --expectation. This IS reachable in this scratch fixture (unlike, say, the verify-gate's two
+# expects entries, which would need an explicit --expectation and a route-back dance to reach
+# cleanly) — so no command in this sweep needed to be skipped.
+if flow_agents_node "$WRITER" record-gate-claim "$SESSION_DIR" \
+  --status pass \
+  --summary "Implementation scope recorded for the sweep fixture." \
+  --timestamp "2026-06-20T08:30:00Z" >"$TMPDIR_EVAL/gate-claim.out" 2>"$TMPDIR_EVAL/gate-claim.err"; then
+  _assert_preserved "record-gate-claim"
+else
+  _fail "record-gate-claim failed: $(cat "$TMPDIR_EVAL/gate-claim.out" "$TMPDIR_EVAL/gate-claim.err")"
+fi
+
+# ─── 7. record-learning (correction.needed:false shape) ──────────────────────────────────────
+if flow_agents_node "$WRITER" record-learning "$SESSION_DIR" \
+  --status learned \
+  --record-json '{"id":"sweep-learning","source_refs":["state.json","trust.bundle"],"outcome":"success","facts":["Field-preservation sweep completed without a persistent-field regression."],"interpretation":"Every state.json-touching mutator preserved the seeded identity fields.","routing":[{"target":"none","action":"No follow-up required.","status":"completed"}],"correction":{"needed":false,"evidence":"All persistent identity fields matched the seeded baseline after every mutator."}}' \
+  --summary "Learning recorded; no follow-up remains." \
+  --timestamp "2026-06-20T08:35:00Z" >"$TMPDIR_EVAL/learning.out" 2>"$TMPDIR_EVAL/learning.err"; then
+  _assert_preserved "record-learning"
+else
+  _fail "record-learning failed: $(cat "$TMPDIR_EVAL/learning.out" "$TMPDIR_EVAL/learning.err")"
+fi
+
+# ─── 8. advance-state (second call) ──────────────────────────────────────────────────────────
+# record-learning above already moved phase to "learning" (writeState), so an accepted/archived
+# target here is allowed by advance-state's terminal-jump guard (prev.phase === "learning").
+if flow_agents_node "$WRITER" advance-state "$SESSION_DIR" \
+  --status archived \
+  --phase learning \
+  --summary "Sweep session closed out." \
+  --next-action "None." \
+  --timestamp "2026-06-20T08:40:00Z" >"$TMPDIR_EVAL/advance-2.out" 2>"$TMPDIR_EVAL/advance-2.err"; then
+  _assert_preserved "advance-state (#2, close-out)"
+else
+  _fail "advance-state (#2) failed: $(cat "$TMPDIR_EVAL/advance-2.out" "$TMPDIR_EVAL/advance-2.err")"
+fi
+
+echo ""
+if [[ "$errors" -eq 0 ]]; then
+  echo "test_sidecar_field_preservation: all checks passed."
+else
+  echo "test_sidecar_field_preservation: $errors check(s) failed."
+fi
+exit "$errors"

package/evals/integration/test_trust_reconcile.sh

@@ -46,7 +46,7 @@ const fs = require('fs');
 const [,, bundlePath, label, passingStr] = process.argv;
 const passing = passingStr === 'true';
 const bundle = {
-  schemaVersion: 3,
+  schemaVersion: 5,
   source: "test-fixture",
   claims: [
     {
@@ -55,7 +55,7 @@ const bundle = {
       value: passing ? "pass" : "fail",
       status: passing ? "verified" : "disputed",
       subjectId: "test-slug/build",
-      surface: "flow-agents.workflow",
+      facet: "flow-agents.workflow",
       subjectType: "workflow-check",
       fieldOrBehavior: "build",
       createdAt: "2026-06-27T00:00:00Z",

package/evals/integration/test_trust_reconcile_manifest.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# test_trust_reconcile_manifest.sh — WS8 (ADR 0020) manifest anti-gaming self-check.
+#
+# The reconcile manifest is evals/ci/run-baseline.sh's LANE_* registry (emitted via
+# `--manifest-json`). This test proves the anti-gaming property design question 1 asked
+# for — "a command in the manifest must actually run in a required lane" — holds by
+# construction, and STAYS holding: it asserts the manifest id set and the set of checks
+# invoked by .github/workflows/ci.yml's REQUIRED jobs are IDENTICAL. The advisory
+# usage-feedback lane (continue-on-error, non-blocking) is excluded from BOTH the manifest and
+# this required-set comparison (ADR 0020 iteration 2).
+#
+#   1. Every ci.yml `run-baseline.sh --check <slug>` invocation is a manifest entry.
+#      → fails when a CHECKS entry is removed from EVERY LANE_* array (it drops out of
+#        --manifest-json but ci.yml still invokes it): the anti-gaming coverage regresses.
+#   2. Every manifest entry is invoked by a required ci.yml job.
+#      → fails when a manifest/lane command is not wired into any required lane.
+#
+# Mirrors evals/ci/antigaming-suite.sh's own rationale (a protection with no required-lane
+# coverage is not a real protection) applied reflexively to the manifest itself.
+#
+# Deterministic, no model spend, self-cleaning.
+# Usage: bash evals/integration/test_trust_reconcile_manifest.sh
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+RUN_BASELINE="$ROOT/evals/ci/run-baseline.sh"
+CI_YML="$ROOT/.github/workflows/ci.yml"
+
+errors=0
+_pass() { echo "  PASS: $1"; }
+_fail() { echo "  FAIL: $1"; errors=$((errors + 1)); }
+
+echo "=== WS8 manifest self-check: manifest (run-baseline.sh LANE_*) == ci.yml required --check set ==="
+
+if [[ ! -f "$RUN_BASELINE" ]]; then _fail "run-baseline.sh not found at $RUN_BASELINE"; fi
+if [[ ! -f "$CI_YML" ]]; then _fail "ci.yml not found at $CI_YML"; fi
+
+# Manifest ids (only lane-covered checks are emitted).
+MANIFEST_JSON="$(bash "$RUN_BASELINE" --manifest-json 2>/dev/null)"
+MANIFEST_IDS="$(printf '%s' "$MANIFEST_JSON" | node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{const a=JSON.parse(d);for(const e of a){if(!e.lanes||!e.lanes.length){process.stderr.write("manifest entry with no lanes: "+e.id+"\n");process.exit(3);}console.log(e.id);}})' | sort -u)"
+if [[ -z "$MANIFEST_IDS" ]]; then _fail "manifest is empty"; fi
+
+# ci.yml required --check slugs. WS8 (ADR 0020, iteration 2): the usage-feedback lane is
+# advisory (continue-on-error, non-blocking) and is intentionally EXCLUDED from the reconcile
+# manifest, so its --check invocations are filtered out here too — the manifest is compared
+# against the REQUIRED-lane --check set only. (All five usage-feedback checks slugify to the
+# `usage-feedback-*` prefix and no required-lane check does, so the filter is exact.)
+CI_SLUGS="$(grep -oE 'run-baseline\.sh --check [a-z0-9-]+' "$CI_YML" | awk '{print $NF}' | grep -v '^usage-feedback-' | sort -u)"
+if [[ -z "$CI_SLUGS" ]]; then _fail "no required-lane run-baseline.sh --check invocations found in ci.yml"; fi
+
+manifest_count="$(printf '%s\n' "$MANIFEST_IDS" | grep -c . )"
+ci_count="$(printf '%s\n' "$CI_SLUGS" | grep -c . )"
+echo "  manifest entries: $manifest_count ; ci.yml --check invocations: $ci_count"
+
+# Direction 1: every ci.yml --check slug must be a manifest entry.
+missing_in_manifest="$(comm -23 <(printf '%s\n' "$CI_SLUGS") <(printf '%s\n' "$MANIFEST_IDS"))"
+if [[ -z "$missing_in_manifest" ]]; then
+  _pass "every ci.yml required --check invocation is a manifest (lane-covered) entry"
+else
+  _fail "ci.yml invokes checks that are NOT in the manifest (removed from every LANE_* array?): $(echo "$missing_in_manifest" | tr '\n' ' ')"
+fi
+
+# Direction 2: every manifest entry must be invoked by a required ci.yml job.
+missing_in_ci="$(comm -23 <(printf '%s\n' "$MANIFEST_IDS") <(printf '%s\n' "$CI_SLUGS"))"
+if [[ -z "$missing_in_ci" ]]; then
+  _pass "every manifest entry is invoked by a required ci.yml job (required-lane coverage by construction)"
+else
+  _fail "manifest entries NOT wired into any required ci.yml job: $(echo "$missing_in_ci" | tr '\n' ' ')"
+fi
+
+echo ""
+if [[ $errors -eq 0 ]]; then
+  echo "test_trust_reconcile_manifest: all checks passed."
+  exit 0
+else
+  echo "test_trust_reconcile_manifest: $errors check(s) failed."
+  exit 1
+fi

package/evals/integration/test_trust_reconcile_mixed_bundle.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# test_trust_reconcile_mixed_bundle.sh — WS8 (ADR 0020) END-TO-END PROOF.
+#
+# The literal capability PR #264 could not demonstrate: a single trust.bundle carrying
+# honest, granular, MIXED evidence passes the REAL Trust Reconcile entrypoint:
+#   - one CI-reconcilable claim  (evidenceType test_output; execution.label is a real
+#     reconcile-manifest command — run-baseline.sh's "Content boundary" check),
+#   - one honest session-local claim (human_attestation, Surface-verified, never claimed
+#     to be CI-re-runnable, no waiver needed),
+#   - one explicitly-waived accepted_gap claim (metadata.waiver, printed loudly).
+#
+# Runs the REAL scripts/ci/trust-reconcile.js (not a mock), resolving the manifest from
+# THIS repo's live run-baseline.sh registry (--repo-root at the repo root). The manifest
+# command is re-run FRESH by the reconciler; the session-local claim is accepted on its
+# Surface status; the waiver is printed on a distinct WAIVED line. Exit 0.
+#
+# The fresh-verify (Step 1) command is a trivial pass so the proof is fast and focused on
+# the reconcile/classification/waiver behavior (same pattern as the other reconcile evals);
+# the manifest-matched command is genuinely re-run against the real checkout.
+#
+# Deterministic, no model spend, self-cleaning.
+# Usage: bash evals/integration/test_trust_reconcile_mixed_bundle.sh
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+RECONCILE="$ROOT/scripts/ci/trust-reconcile.js"
+FIXTURE="$ROOT/evals/fixtures/trust-reconcile-mixed-bundle/mixed-bundle.json"
+
+errors=0
+_pass() { echo "  PASS: $1"; }
+_fail() { echo "  FAIL: $1"; errors=$((errors + 1)); }
+
+echo "=== WS8 end-to-end proof: mixed-evidence bundle passes the real Trust Reconcile ==="
+
+if [[ ! -f "$FIXTURE" ]]; then _fail "fixture not found at $FIXTURE"; fi
+
+# Real reconciler entrypoint. Fresh-verify is a trivial pass; the manifest is resolved
+# from this repo's live run-baseline.sh registry (via --repo-root "$ROOT").
+out="$(TRUST_RECONCILE_COMMANDS="node -e 'process.exit(0)'" \
+  node "$RECONCILE" --bundle "$FIXTURE" --repo-root "$ROOT" 2>&1)"
+exit_code=$?
+
+echo "----- reconciler output -----"
+echo "$out"
+echo "-----------------------------"
+
+if [[ $exit_code -eq 0 ]]; then
+  _pass "mixed-evidence bundle passes the real Trust Reconcile (exit 0) — the capability PR #264 lacked"
+else
+  _fail "expected exit 0, got $exit_code"
+fi
+
+if echo "$out" | grep -q "RECONCILED: 'npm run check:content-boundary --'"; then
+  _pass "the test_output claim reconciled against its manifest command (fresh CI re-run)"
+else
+  _fail "expected a RECONCILED line for the manifest-matched command"
+fi
+
+if echo "$out" | grep -q "ATTESTED (not independently verifiable at L0): 'c-session-local' (workflow.check.external) evidenceType=human_attestation"; then
+  _pass "the human_attestation claim was accepted as session-local, loudly marked ATTESTED (not flagged not-run)"
+else
+  _fail "expected an ATTESTED (not independently verifiable at L0) line for the human_attestation claim"
+fi
+
+# WS8 iteration-4 (converged finding): the honest mixed bundle's ATTESTED claim must also be
+# counted in the loud summary line, not just printed inline — proves the count is real, not
+# just cosmetic per-claim decoration.
+if echo "$out" | grep -q "1 attested claim(s) accepted without independent verification"; then
+  _pass "the attested-claim summary count line is present and correct (1)"
+else
+  _fail "expected the '1 attested claim(s) accepted without independent verification' summary line"
+fi
+
+if echo "$out" | grep -q "WAIVED:"; then
+  _pass "the accepted_gap claim was printed on a distinct, loud WAIVED line"
+else
+  _fail "expected a WAIVED line for the waived accepted_gap claim"
+fi
+
+# Guard: the manifest must have resolved from the live run-baseline.sh registry, not the
+# legacy single-command fallback (proves the resolver is wired to the real registry).
+if echo "$out" | grep -qE "manifest: [0-9]+ entries \(source: (package.json:trust-reconcile-manifest|evals/ci/run-baseline.sh)"; then
+  _pass "manifest resolved from the live run-baseline.sh registry (not a synthetic one)"
+else
+  _fail "manifest did not resolve from the live registry: $(echo "$out" | grep -i manifest | head -1)"
+fi
+
+echo ""
+if [[ $errors -eq 0 ]]; then
+  echo "test_trust_reconcile_mixed_bundle: all checks passed."
+  exit 0
+else
+  echo "test_trust_reconcile_mixed_bundle: $errors check(s) failed."
+  exit 1
+fi

package/evals/integration/test_trust_reconcile_negatives.sh

@@ -0,0 +1,151 @@
+#!/usr/bin/env bash
+# test_trust_reconcile_negatives.sh — WS8 iteration-2 anti-gaming negative regressions.
+#
+# Every live exploit the reviewer/verifier reproduced against the WS8 reconciler is frozen
+# here as a permanent negative fixture. Each asserts the REAL scripts/ci/trust-reconcile.js
+# exits NON-ZERO and emits the SPECIFIC divergence string the fix introduced. If any fix is
+# ever regressed, the corresponding exploit passes again and this eval (which runs in the
+# required runtime-and-kit lane via antigaming-suite.sh) goes red.
+#
+#   1. no-label-bypass       (finding 1) → not-run: a test_output claim with no
+#      manifest-matched execution.label is a divergence, never session-local.
+#   2. skip-assumed-bypass   (finding 2) → unwaived-assumed: 'assumed' alone is not a pass.
+#   3. status-misassertion   (finding 3) → status-misassertion: CI re-derives status; a
+#      self-reported status that does not match the bundle's own evidence is rejected.
+#   4. waived-command-check  (finding 4) → waiver-on-command-check: a command-backed
+#      (test_output) check cannot be waived.
+#   5. ws3-old-style-bundle  (AC6) → old all-test_output bundle FAILS the same way (exit 1,
+#      divergences) under the new reconciler as under the old one — no soundness regression.
+#   6. fabricated-attestation (iteration-4, converged iteration-3 finding, both gates) → a
+#      fully self-consistent, hand-fabricated no-command 'security' claim+evidence+event
+#      triple (indistinguishable from a genuine attestation at the reconciler's own
+#      re-derivation layer) MUST still pass (exit 0 — blocking attestations at L0 would break
+#      every honest human-attestation use) BUT MUST be loudly, distinctly marked
+#      'ATTESTED (not independently verifiable at L0)' plus the summary count line — never a
+#      quiet SESSION-LOCAL OK indistinguishable from a reconciled check. See ADR 0020 Residuals.
+#
+# Fresh-verify (Step 1) is a trivial pass so the proof is focused on the reconcile step; the
+# manifest resolves from this repo's live run-baseline.sh registry (--repo-root "$ROOT").
+# Deterministic, no model spend, self-cleaning.
+# Usage: bash evals/integration/test_trust_reconcile_negatives.sh
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+RECONCILE="$ROOT/scripts/ci/trust-reconcile.js"
+FX="$ROOT/evals/fixtures/trust-reconcile-exploits"
+WS3="$ROOT/evals/fixtures/trust-reconcile-ws3/ws3-bundle.json"
+
+errors=0
+_pass() { echo "  PASS: $1"; }
+_fail() { echo "  FAIL: $1"; errors=$((errors + 1)); }
+
+# run_case <label> <bundle> <needle>
+# Asserts: reconciler exits non-zero AND stdout/stderr contains <needle>.
+run_case() {
+  local label="$1" bundle="$2" needle="$3"
+  echo "=== $label ==="
+  if [[ ! -f "$bundle" ]]; then _fail "$label: fixture not found at $bundle"; return; fi
+  local out code
+  out="$(TRUST_RECONCILE_COMMANDS="node -e 'process.exit(0)'" \
+    node "$RECONCILE" --bundle "$bundle" --repo-root "$ROOT" 2>&1)"
+  code=$?
+  if [[ $code -ne 0 ]]; then
+    _pass "$label: reconciler exits non-zero ($code)"
+  else
+    _fail "$label: expected non-zero exit, got 0 — output: $out"
+  fi
+  if echo "$out" | grep -qF "$needle"; then
+    _pass "$label: emitted the expected divergence (\"$needle\")"
+  else
+    _fail "$label: expected divergence \"$needle\" not found — output: $out"
+  fi
+}
+
+# 1. Reviewer's no-label exploit → not-run (test_output must reconcile against the manifest).
+run_case "no-label-bypass (finding 1)" "$FX/no-label-bypass.json" \
+  "no manifest-matched execution.label"
+
+# 2. Verifier's skip->assumed exploit → unwaived-assumed.
+run_case "skip-assumed-bypass (finding 2)" "$FX/skip-assumed-bypass.json" \
+  "[unwaived-assumed]"
+
+# 3. Status-misassertion exploit → status re-derived CI-side; asserted != derived.
+run_case "status-misassertion (finding 3)" "$FX/status-misassertion.json" \
+  "[status-misassertion]"
+
+# 4. Waived command-backed check → waiver-on-command-check.
+run_case "waived-command-check (finding 4)" "$FX/waived-command-check.json" \
+  "[waiver-on-command-check]"
+
+# 5. AC6 backward-compat regression: the real ws3-kit-dependencies-namespacing/trust.bundle
+#    (an old-style all-test_output bundle whose commands are not manifest-matched) FAILS the
+#    same way under the new reconciler as under the old one — same FAIL verdict, divergences
+#    present, no silent pass introduced.
+echo "=== ws3 old-style bundle (AC6 backward compat) ==="
+if [[ ! -f "$WS3" ]]; then
+  _fail "ws3 fixture not found at $WS3"
+else
+  ws3_out="$(TRUST_RECONCILE_COMMANDS="node -e 'process.exit(0)'" \
+    node "$RECONCILE" --bundle "$WS3" --repo-root "$ROOT" 2>&1)"
+  ws3_code=$?
+  if [[ $ws3_code -ne 0 ]]; then
+    _pass "ws3 old-style bundle FAILS (exit $ws3_code) — same verdict as the old reconciler"
+  else
+    _fail "ws3 old-style bundle expected non-zero exit, got 0 — output: $ws3_out"
+  fi
+  if echo "$ws3_out" | grep -qF "[not-run]"; then
+    _pass "ws3 old-style bundle emits a not-run divergence (its test_output commands are not manifest-matched)"
+  else
+    _fail "ws3 old-style bundle expected a not-run divergence — output: $ws3_out"
+  fi
+  if echo "$ws3_out" | grep -qF "trust divergence"; then
+    _pass "ws3 old-style bundle emits trust divergence(s)"
+  else
+    _fail "ws3 old-style bundle expected trust divergence(s) — output: $ws3_out"
+  fi
+fi
+
+# 6. Fabricated-attestation (iteration-4): passes (exit 0) but MUST carry the loud ATTESTED
+#    marker and the summary count line — NOT the old quiet SESSION-LOCAL OK. This is a
+#    visibility assertion, not a divergence assertion (unlike run_case above): a fabricated
+#    self-consistent attestation bundle is, by construction, indistinguishable from a genuine
+#    one at this layer (see ADR 0020 Residuals) — the fix is disclosure, not a block.
+echo "=== fabricated-attestation (iteration-4, converged finding) ==="
+FAB="$FX/fabricated-attestation.json"
+if [[ ! -f "$FAB" ]]; then
+  _fail "fabricated-attestation fixture not found at $FAB"
+else
+  fab_out="$(TRUST_RECONCILE_COMMANDS="node -e 'process.exit(0)'" \
+    node "$RECONCILE" --bundle "$FAB" --repo-root "$ROOT" 2>&1)"
+  fab_code=$?
+  if [[ $fab_code -eq 0 ]]; then
+    _pass "fabricated-attestation bundle passes (exit 0) — attestations are not blocked at L0"
+  else
+    _fail "fabricated-attestation bundle expected exit 0, got $fab_code — output: $fab_out"
+  fi
+  if echo "$fab_out" | grep -qF "ATTESTED (not independently verifiable at L0): 'c-fabricated-security' (workflow.check.security) evidenceType=attestation"; then
+    _pass "fabricated-attestation bundle emits the loud ATTESTED marker (not a quiet SESSION-LOCAL OK)"
+  else
+    _fail "expected the ATTESTED (not independently verifiable at L0) marker — output: $fab_out"
+  fi
+  if echo "$fab_out" | grep -qF "1 attested claim(s) accepted without independent verification"; then
+    _pass "fabricated-attestation bundle emits the attested-claim summary count line"
+  else
+    _fail "expected the attested-claim summary count line — output: $fab_out"
+  fi
+  if echo "$fab_out" | grep -qF "SESSION-LOCAL OK"; then
+    _fail "fabricated-attestation bundle must NOT emit the old quiet SESSION-LOCAL OK line"
+  else
+    _pass "fabricated-attestation bundle does not emit the old quiet SESSION-LOCAL OK line"
+  fi
+fi
+
+echo ""
+if [[ $errors -eq 0 ]]; then
+  echo "test_trust_reconcile_negatives: all checks passed."
+  exit 0
+else
+  echo "test_trust_reconcile_negatives: $errors check(s) failed."
+  exit 1
+fi

package/evals/integration/test_usage_feedback_global.sh

@@ -20,16 +20,16 @@ echo ""
 global="$TMPDIR_EVAL/global"
 repo_a="$TMPDIR_EVAL/repo-a"
 repo_b="$TMPDIR_EVAL/repo-b"
-mkdir -p "$repo_a/.flow-agents/alpha" "$repo_b/.flow-agents/beta"
+mkdir -p "$repo_a/.kontourai/flow-agents/alpha" "$repo_b/.kontourai/flow-agents/beta"
 
-cat > "$repo_a/.flow-agents/alpha/alpha--deliver.md" <<'MARKDOWN'
+cat > "$repo_a/.kontourai/flow-agents/alpha/alpha--deliver.md" <<'MARKDOWN'
 # Deliver Alpha
 
 status: delivered
 type: deliver
 MARKDOWN
 
-cat > "$repo_b/.flow-agents/beta/beta--verify.md" <<'MARKDOWN'
+cat > "$repo_b/.kontourai/flow-agents/beta/beta--verify.md" <<'MARKDOWN'
 # Verify Beta
 
 status: failed
@@ -94,8 +94,8 @@ fi
 
 discover_root="$TMPDIR_EVAL/discover-root"
 repo_c="$discover_root/gamma"
-mkdir -p "$repo_c/.flow-agents/gamma"
-cat > "$repo_c/.flow-agents/gamma/gamma--deliver.md" <<'MARKDOWN'
+mkdir -p "$repo_c/.kontourai/flow-agents/gamma"
+cat > "$repo_c/.kontourai/flow-agents/gamma/gamma--deliver.md" <<'MARKDOWN'
 # Deliver Gamma
 
 status: delivered