@kontourai/flow-agents 2.3.0 → 2.4.0

package/evals/integration/test_captured_fail_reconciliation.sh

@@ -42,11 +42,11 @@ trap cleanup EXIT
 # ─── Helper: seed a delivered (terminal) workflow artifact ────────────────────
 seed_delivered() { # $1=dir $2=slug
   local p="$1" slug="$2"
-  mkdir -p "$p/.flow-agents/$slug"
+  mkdir -p "$p/.kontourai/flow-agents/$slug"
   printf '# Repo\n' > "$p/AGENTS.md"
   printf '%s' "{\"schema_version\":\"1.0\",\"task_slug\":\"$slug\",\"status\":\"delivered\",\"phase\":\"done\",\"updated_at\":\"2026-06-27T00:00:00Z\",\"next_action\":{\"status\":\"done\",\"summary\":\"done\"}}" \
-    > "$p/.flow-agents/$slug/state.json"
-  cat > "$p/.flow-agents/$slug/$slug--deliver.md" << MD
+    > "$p/.kontourai/flow-agents/$slug/state.json"
+  cat > "$p/.kontourai/flow-agents/$slug/$slug--deliver.md" << MD
 # $slug
 
 branch: main
@@ -71,7 +71,7 @@ write_kit_pass_bundle() { # $1=bundle_path $2=slug $3=claim_value(opt)
 import json, sys
 bundle_path, slug, claim_val = sys.argv[1], sys.argv[2], sys.argv[3]
 bundle = {
-    "schemaVersion": 3, "source": "flow-agents/workflow-sidecar",
+    "schemaVersion": 5, "source": "flow-agents/workflow-sidecar",
     "claims": [{
         "id": "c1", "subjectId": slug + "/tests", "subjectType": "flow-step",
         "claimType": "builder.verify.tests",
@@ -131,10 +131,10 @@ T1="$TMP/t1-bypass"
 seed_delivered "$T1" "bypass-kit"
 
 # NO active_flow_id in current.json
-printf '%s' '{"artifact_dir":"bypass-kit"}' > "$T1/.flow-agents/current.json"
+printf '%s' '{"artifact_dir":"bypass-kit"}' > "$T1/.kontourai/flow-agents/current.json"
 
-write_kit_pass_bundle "$T1/.flow-agents/bypass-kit/trust.bundle" "bypass-kit"
-write_fail_log "$T1/.flow-agents/bypass-kit/command-log.jsonl"
+write_kit_pass_bundle "$T1/.kontourai/flow-agents/bypass-kit/trust.bundle" "bypass-kit"
+write_fail_log "$T1/.kontourai/flow-agents/bypass-kit/command-log.jsonl"
 
 echo ""
 echo "--- 1a. PRE-FIX simulation: show the gate was blind ---"
@@ -208,7 +208,7 @@ seed_delivered "$T2" "nondeclared"
 
 # current.json: active flow (builder.build/verify)
 printf '%s' '{"artifact_dir":"nondeclared","active_flow_id":"builder.build","active_step_id":"verify"}' \
-  > "$T2/.flow-agents/current.json"
+  > "$T2/.kontourai/flow-agents/current.json"
 
 # Fake flow defs dir (safe, not agent-writable)
 FLOW_DEFS_DIR="$TMP/flows"
@@ -238,11 +238,11 @@ cat > "$FLOW_DEFS_DIR/builder.build.flow.json" << 'FLOWJSON'
 FLOWJSON
 
 # Bundle: agent-chosen NON-declared claimType (e.g. "acme.custom.verify") claiming npm test passed
-python3 - "$T2/.flow-agents/nondeclared/trust.bundle" "nondeclared" << 'PY'
+python3 - "$T2/.kontourai/flow-agents/nondeclared/trust.bundle" "nondeclared" << 'PY'
 import json, sys
 bundle_path, slug = sys.argv[1], sys.argv[2]
 bundle = {
-    "schemaVersion": 3, "source": "flow-agents/workflow-sidecar",
+    "schemaVersion": 5, "source": "flow-agents/workflow-sidecar",
     "claims": [{
         "id": "c1", "subjectId": slug + "/tests", "subjectType": "custom",
         "claimType": "acme.custom.verify",   # neither workflow.* NOR declared by the flow
@@ -263,7 +263,7 @@ bundle = {
 }
 json.dump(bundle, open(bundle_path, 'w'))
 PY
-write_fail_log "$T2/.flow-agents/nondeclared/command-log.jsonl"
+write_fail_log "$T2/.kontourai/flow-agents/nondeclared/command-log.jsonl"
 
 set +e
 t2_out="$(FLOW_AGENTS_GOAL_FIT_MODE=block FLOW_AGENTS_GOAL_FIT_BACKSTOP=skip \
@@ -293,9 +293,9 @@ echo "=== 3. NO OVER-BLOCK (a): clean session, no captured fails ==="
 
 T3="$TMP/t3-clean"
 seed_delivered "$T3" "clean-sess"
-printf '%s' '{"artifact_dir":"clean-sess"}' > "$T3/.flow-agents/current.json"
-write_kit_pass_bundle "$T3/.flow-agents/clean-sess/trust.bundle" "clean-sess"
-write_pass_log "$T3/.flow-agents/clean-sess/command-log.jsonl"
+printf '%s' '{"artifact_dir":"clean-sess"}' > "$T3/.kontourai/flow-agents/current.json"
+write_kit_pass_bundle "$T3/.kontourai/flow-agents/clean-sess/trust.bundle" "clean-sess"
+write_pass_log "$T3/.kontourai/flow-agents/clean-sess/command-log.jsonl"
 
 set +e
 t3_out="$(run_gate "$T3")"
@@ -319,13 +319,13 @@ echo "=== 4. NO OVER-BLOCK (b): fail-then-re-run-to-pass (latest capture PASS) =
 
 T4="$TMP/t4-rerun"
 seed_delivered "$T4" "rerun-pass"
-printf '%s' '{"artifact_dir":"rerun-pass"}' > "$T4/.flow-agents/current.json"
-write_kit_pass_bundle "$T4/.flow-agents/rerun-pass/trust.bundle" "rerun-pass"
+printf '%s' '{"artifact_dir":"rerun-pass"}' > "$T4/.kontourai/flow-agents/current.json"
+write_kit_pass_bundle "$T4/.kontourai/flow-agents/rerun-pass/trust.bundle" "rerun-pass"
 # FAIL first, then PASS (re-run fixed it — latest is PASS)
 {
   printf '%s\n' '{"command":"npm test","observedResult":"fail","exitCode":1,"capturedAt":"2026-06-27T00:00:00Z","source":"test"}'
   printf '%s\n' '{"command":"npm test","observedResult":"pass","exitCode":0,"capturedAt":"2026-06-27T00:00:01Z","source":"test"}'
-} > "$T4/.flow-agents/rerun-pass/command-log.jsonl"
+} > "$T4/.kontourai/flow-agents/rerun-pass/command-log.jsonl"
 
 set +e
 t4_out="$(run_gate "$T4")"
@@ -349,14 +349,14 @@ echo "=== 5. NO OVER-BLOCK (c): acknowledged failure (evidence marks command dis
 
 T5="$TMP/t5-ack"
 seed_delivered "$T5" "ack-fail"
-printf '%s' '{"artifact_dir":"ack-fail"}' > "$T5/.flow-agents/current.json"
+printf '%s' '{"artifact_dir":"ack-fail"}' > "$T5/.kontourai/flow-agents/current.json"
 
 # Bundle: claim acknowledges failure (status=disputed, value=fail)
-python3 - "$T5/.flow-agents/ack-fail/trust.bundle" "ack-fail" << 'PY'
+python3 - "$T5/.kontourai/flow-agents/ack-fail/trust.bundle" "ack-fail" << 'PY'
 import json, sys
 bundle_path, slug = sys.argv[1], sys.argv[2]
 bundle = {
-    "schemaVersion": 3, "source": "flow-agents/workflow-sidecar",
+    "schemaVersion": 5, "source": "flow-agents/workflow-sidecar",
     "claims": [{
         "id": "c1", "subjectId": slug + "/tests", "subjectType": "flow-step",
         "claimType": "builder.verify.tests",
@@ -379,7 +379,7 @@ bundle = {
 }
 json.dump(bundle, open(bundle_path, 'w'))
 PY
-write_fail_log "$T5/.flow-agents/ack-fail/command-log.jsonl"
+write_fail_log "$T5/.kontourai/flow-agents/ack-fail/command-log.jsonl"
 
 set +e
 t5_out="$(run_gate "$T5")"
@@ -403,12 +403,12 @@ echo "=== 6. NO OVER-BLOCK (d): no-command doc/policy session (verified, no exec
 echo "    (#216 fix: missing-log check must NOT fire when no command was expected)"
 
 T6="$TMP/t6-nocommand"
-mkdir -p "$T6/.flow-agents/nocommand"
+mkdir -p "$T6/.kontourai/flow-agents/nocommand"
 printf '# Repo\n' > "$T6/AGENTS.md"
 # State is verified (completing) but no commands were run
 printf '%s' '{"schema_version":"1.0","task_slug":"nocommand","status":"verified","phase":"verification","updated_at":"2026-06-27T00:00:00Z","next_action":{"status":"done","summary":"done"}}' \
-  > "$T6/.flow-agents/nocommand/state.json"
-cat > "$T6/.flow-agents/nocommand/nocommand--deliver.md" << 'MD'
+  > "$T6/.kontourai/flow-agents/nocommand/state.json"
+cat > "$T6/.kontourai/flow-agents/nocommand/nocommand--deliver.md" << 'MD'
 # nocommand
 
 branch: main
@@ -423,13 +423,13 @@ type: deliver
 
 ### Verdict: PASS
 MD
-printf '%s' '{"artifact_dir":"nocommand"}' > "$T6/.flow-agents/current.json"
+printf '%s' '{"artifact_dir":"nocommand"}' > "$T6/.kontourai/flow-agents/current.json"
 
 # Bundle with NO execution.label (doc/policy session — no commands run)
-python3 - "$T6/.flow-agents/nocommand/trust.bundle" << 'PY'
+python3 - "$T6/.kontourai/flow-agents/nocommand/trust.bundle" << 'PY'
 import json, sys
 bundle = {
-    "schemaVersion": 3, "source": "flow-agents/workflow-sidecar",
+    "schemaVersion": 5, "source": "flow-agents/workflow-sidecar",
     "claims": [{
         "id": "c1", "subjectId": "nocommand/review", "subjectType": "workflow-check",
         "claimType": "workflow.check.review", "fieldOrBehavior": "policy doc reviewed",
@@ -476,11 +476,11 @@ echo "    (Two-part dependency: union form ALWAYS enforces workflow.* + empty-ex
 echo "     emits gate-misconfiguration HARD_BLOCK for empty expects[])"
 
 T7="$TMP/t7-empty-expects"
-mkdir -p "$T7/.flow-agents/empty-expects"
+mkdir -p "$T7/.kontourai/flow-agents/empty-expects"
 printf '# Repo\n' > "$T7/AGENTS.md"
 printf '%s' '{"schema_version":"1.0","task_slug":"empty-expects","status":"in_progress","phase":"execution","updated_at":"2026-06-27T00:00:00Z","next_action":{"status":"in_progress","summary":"Testing"}}' \
-  > "$T7/.flow-agents/empty-expects/state.json"
-cat > "$T7/.flow-agents/empty-expects/empty-expects--deliver.md" << 'MD'
+  > "$T7/.kontourai/flow-agents/empty-expects/state.json"
+cat > "$T7/.kontourai/flow-agents/empty-expects/empty-expects--deliver.md" << 'MD'
 # empty-expects
 
 branch: main
@@ -491,14 +491,14 @@ type: deliver
 - [ ] tests pass
 MD
 printf '%s' '{"artifact_dir":"empty-expects","active_flow_id":"builder.build","active_step_id":"verify"}' \
-  > "$T7/.flow-agents/current.json"
+  > "$T7/.kontourai/flow-agents/current.json"
 
 # Bundle with ONLY kit-typed claims (no workflow.*)
-python3 - "$T7/.flow-agents/empty-expects/trust.bundle" "empty-expects" << 'PY'
+python3 - "$T7/.kontourai/flow-agents/empty-expects/trust.bundle" "empty-expects" << 'PY'
 import json, sys
 bundle_path, slug = sys.argv[1], sys.argv[2]
 bundle = {
-    "schemaVersion": 3, "source": "flow-agents/workflow-sidecar",
+    "schemaVersion": 5, "source": "flow-agents/workflow-sidecar",
     "claims": [{
         "id": "c1", "subjectId": slug + "/tests", "subjectType": "flow-step",
         "claimType": "builder.verify.tests",
@@ -510,7 +510,7 @@ bundle = {
 }
 json.dump(bundle, open(bundle_path, 'w'))
 PY
-printf '' > "$T7/.flow-agents/empty-expects/command-log.jsonl"
+printf '' > "$T7/.kontourai/flow-agents/empty-expects/command-log.jsonl"
 
 # Fake flow with expects:[] (safe dir, not agent-writable)
 FAKE_FLOWS="$TMP/fake-flows-ac3"
@@ -566,12 +566,12 @@ echo "    PRE-FIX: completing guard skipped reconciliation for non-terminal stat
 echo "    POST-FIX: guard removed → check runs on every stop (status-independent)"
 
 T8="$TMP/t8-status-dodge"
-mkdir -p "$T8/.flow-agents/status-dodge"
+mkdir -p "$T8/.kontourai/flow-agents/status-dodge"
 printf '# Repo\n' > "$T8/AGENTS.md"
 # CRITICAL: status = 'blocked' (non-terminal — pre-fix would have returned [] here)
 printf '%s' '{"schema_version":"1.0","task_slug":"status-dodge","status":"blocked","phase":"executing","updated_at":"2026-06-27T00:00:00Z","next_action":{"status":"in_progress","summary":"running"}}' \
-  > "$T8/.flow-agents/status-dodge/state.json"
-cat > "$T8/.flow-agents/status-dodge/status-dodge--deliver.md" << 'MD'
+  > "$T8/.kontourai/flow-agents/status-dodge/state.json"
+cat > "$T8/.kontourai/flow-agents/status-dodge/status-dodge--deliver.md" << 'MD'
 # status-dodge
 
 branch: main
@@ -588,11 +588,11 @@ type: deliver
 MD
 
 # Bundle: kit-typed claim asserting pass for "npm test"
-python3 - "$T8/.flow-agents/status-dodge/trust.bundle" "status-dodge" << 'PY'
+python3 - "$T8/.kontourai/flow-agents/status-dodge/trust.bundle" "status-dodge" << 'PY'
 import json, sys
 bundle_path, slug = sys.argv[1], sys.argv[2]
 bundle = {
-    "schemaVersion": 3, "source": "flow-agents/workflow-sidecar",
+    "schemaVersion": 5, "source": "flow-agents/workflow-sidecar",
     "claims": [{
         "id": "c1", "subjectId": slug + "/tests", "subjectType": "flow-step",
         "claimType": "builder.verify.tests",
@@ -614,7 +614,7 @@ bundle = {
 json.dump(bundle, open(bundle_path, 'w'))
 PY
 # command-log: "npm test" FAIL (latest capture is FAIL — the agent lied)
-write_fail_log "$T8/.flow-agents/status-dodge/command-log.jsonl"
+write_fail_log "$T8/.kontourai/flow-agents/status-dodge/command-log.jsonl"
 
 echo ""
 echo "--- 8a. PRE-FIX simulation (completing guard) ---"
@@ -663,14 +663,14 @@ echo "    POST-FIX: Case B removed → incidental fails with no claim NOT blocke
 
 T9="$TMP/t9-overblock"
 seed_delivered "$T9" "overblock-sess"
-printf '%s' '{"artifact_dir":"overblock-sess"}' > "$T9/.flow-agents/current.json"
+printf '%s' '{"artifact_dir":"overblock-sess"}' > "$T9/.kontourai/flow-agents/current.json"
 # Bundle: only "npm test" claim asserting pass (no claim about the grep incidental fail)
-write_kit_pass_bundle "$T9/.flow-agents/overblock-sess/trust.bundle" "overblock-sess"
+write_kit_pass_bundle "$T9/.kontourai/flow-agents/overblock-sess/trust.bundle" "overblock-sess"
 # Log: "npm test" PASS + incidental "grep --quiet somepattern AGENTS.md" FAIL (exit 1)
 printf '%s\n%s\n' \
   '{"command":"npm test","observedResult":"pass","exitCode":0,"capturedAt":"2026-06-27T00:00:00Z","source":"postToolUse-capture"}' \
   '{"command":"grep --quiet somepattern AGENTS.md","observedResult":"fail","exitCode":1,"capturedAt":"2026-06-27T00:00:01Z","source":"postToolUse-capture"}' \
-  > "$T9/.flow-agents/overblock-sess/command-log.jsonl"
+  > "$T9/.kontourai/flow-agents/overblock-sess/command-log.jsonl"
 
 set +e
 t9_out="$(run_gate "$T9")"
@@ -708,13 +708,13 @@ echo "    POST-FIX: latest-wins → re-run to PASS clears the block"
 
 T10="$TMP/t10-fixpass"
 seed_delivered "$T10" "fixpass-sess"
-printf '%s' '{"artifact_dir":"fixpass-sess"}' > "$T10/.flow-agents/current.json"
-write_kit_pass_bundle "$T10/.flow-agents/fixpass-sess/trust.bundle" "fixpass-sess"
+printf '%s' '{"artifact_dir":"fixpass-sess"}' > "$T10/.kontourai/flow-agents/current.json"
+write_kit_pass_bundle "$T10/.kontourai/flow-agents/fixpass-sess/trust.bundle" "fixpass-sess"
 # Log: FAIL first, then PASS (genuine fix-then-re-run)
 printf '%s\n%s\n' \
   '{"command":"npm test","observedResult":"fail","exitCode":1,"capturedAt":"2026-06-27T00:00:00Z","source":"postToolUse-capture"}' \
   '{"command":"npm test","observedResult":"pass","exitCode":0,"capturedAt":"2026-06-27T00:00:01Z","source":"postToolUse-capture"}' \
-  > "$T10/.flow-agents/fixpass-sess/command-log.jsonl"
+  > "$T10/.kontourai/flow-agents/fixpass-sess/command-log.jsonl"
 
 set +e
 t10_out="$(run_gate "$T10")"
@@ -747,13 +747,13 @@ echo "    POST-FIX: hasLaunderingOperator detects || true → 'exit-code-launder
 
 T11="$TMP/t11-laundering"
 seed_delivered "$T11" "laundering-sess"
-printf '%s' '{"artifact_dir":"laundering-sess"}' > "$T11/.flow-agents/current.json"
+printf '%s' '{"artifact_dir":"laundering-sess"}' > "$T11/.kontourai/flow-agents/current.json"
 # Bundle: claim asserting pass for "npm test || true" — command string has laundering operator
-python3 - "$T11/.flow-agents/laundering-sess/trust.bundle" "laundering-sess" << 'PY'
+python3 - "$T11/.kontourai/flow-agents/laundering-sess/trust.bundle" "laundering-sess" << 'PY'
 import json, sys
 bundle_path, slug = sys.argv[1], sys.argv[2]
 bundle = {
-    "schemaVersion": 3, "source": "flow-agents/workflow-sidecar",
+    "schemaVersion": 5, "source": "flow-agents/workflow-sidecar",
     "claims": [{
         "id": "c1", "subjectId": slug + "/tests", "subjectType": "flow-step",
         "claimType": "builder.verify.tests",
@@ -777,7 +777,7 @@ PY
 # Log: "npm test || true" captured as PASS (exit 0) — the laundering worked
 printf '%s\n' \
   '{"command":"npm test || true","observedResult":"pass","exitCode":0,"capturedAt":"2026-06-27T00:00:00Z","source":"postToolUse-capture"}' \
-  > "$T11/.flow-agents/laundering-sess/command-log.jsonl"
+  > "$T11/.kontourai/flow-agents/laundering-sess/command-log.jsonl"
 
 set +e
 t11_out="$(run_gate "$T11")"

package/evals/integration/test_checkpoint_signing.sh

@@ -15,6 +15,10 @@
 #      This proves the signing PATH is structurally correct without needing real OIDC.
 #   4. ADDITIVE: all existing gating tests still pass (record-release, advance-state-delivered,
 #      seal-checkpoint, record-evidence, record-critique all unaffected).
+#   5. NO-CLOBBER (WS5 iteration-2 part 2 regression guard): this eval's scratch sessions
+#      (mktemp -d, no kits/ ancestor) never publish into this real repo's delivery/trust.bundle,
+#      even when the eval is run from a checkout of this repo — publish-delivery's repo-root
+#      resolution is fail-closed and TEST 2 passes an explicit scratch --repo-root.
 #
 # Deterministic, no model spend, no network, self-cleaning.
 # Usage: bash evals/integration/test_checkpoint_signing.sh
@@ -34,6 +38,19 @@ _fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
 cleanup() { rm -rf "$TMP"; }
 trap cleanup EXIT
 
+# REGRESSION GUARD (WS5 iteration-2 part 2): this eval's scratch sessions live under a
+# mktemp -d tree with no kits/ ancestor. Before the fail-closed fix to
+# findRepoRootFromDir/publishDelivery in src/cli/workflow-sidecar.ts, a scratch session's
+# record-release / advance-state --status delivered call would silently fall back to
+# process.cwd() for its delivery/ repo-root — and when this eval runs from a checkout of
+# THIS repo (as it does under npm run eval:static / the integration suite), that clobbered
+# the real repo's own delivery/trust.bundle with scratch fixture content. Capture this real
+# repo's delivery/trust.bundle content hash now (before any scratch session in this eval
+# runs) and re-check it is byte-identical after every test below.
+REAL_DELIVERY_BUNDLE="$ROOT/delivery/trust.bundle"
+_bundle_hash() { if [[ -f "$1" ]]; then shasum -a 256 "$1" | awk '{print $1}'; else echo "absent"; fi; }
+REAL_DELIVERY_HASH_BEFORE="$(_bundle_hash "$REAL_DELIVERY_BUNDLE")"
+
 # ─────────────────────────────────────────────────────────────────────────────
 echo ""
 echo "=== TEST 1: Statement produced with correct subject (sha256 of checkpoint) ==="
@@ -242,6 +259,14 @@ SLUG2="sign-test-failopen"
 SESSION_DIR2="$AROOT2/$SLUG2"
 mkdir -p "$AROOT2"
 
+# REGRESSION FIX (WS5 iteration-2 part 2): this session dir has no kits/ ancestor of its
+# own (it lives under $TMP). Pass an explicit --repo-root pointing at a scratch repo-root
+# under $TMP so advance-state --status delivered's auto-publish never has to fall back to
+# (or, pre-fix, silently trust) process.cwd() — matching test_publish_delivery.sh's pattern
+# of always giving its scratch sessions an explicit repo-root.
+REPO_ROOT2="$TMP/test2/scratch-repo"
+mkdir -p "$REPO_ROOT2"
+
 flow_agents_node "$WRITER" ensure-session \
   --artifact-root "$AROOT2" \
   --task-slug "$SLUG2" \
@@ -264,6 +289,7 @@ flow_agents_node "$WRITER" advance-state "$SESSION_DIR2" \
   --status delivered \
   --phase release \
   --summary "Delivered." \
+  --repo-root "$REPO_ROOT2" \
   --timestamp "2026-06-26T11:03:00Z" >/dev/null 2>&1 || SEAL_EXIT=$?
 
 if [[ "$SEAL_EXIT" -eq 0 ]]; then
@@ -272,6 +298,12 @@ else
   _fail "advance-state --status delivered exited $SEAL_EXIT (signing must not break the seal)"
 fi
 
+if [[ -f "$REPO_ROOT2/delivery/trust.bundle" ]]; then
+  _pass "publish-delivery published into the explicit scratch --repo-root ($REPO_ROOT2/delivery/trust.bundle), not process.cwd()"
+else
+  _fail "publish-delivery did not write to the explicit scratch --repo-root ($REPO_ROOT2/delivery/trust.bundle) — check the --repo-root plumbing in advanceState"
+fi
+
 if [[ -f "$SESSION_DIR2/trust.checkpoint.json" ]]; then
   _pass "trust.checkpoint.json written even when signing is fail-open"
 else
@@ -477,6 +509,17 @@ else
   _fail "Increment A checkpoint envelope shape broken (regression)"
 fi
 
+# ─────────────────────────────────────────────────────────────────────────────
+echo ""
+echo "=== TEST 5: Regression — this eval's scratch sessions never touch the real repo's delivery/trust.bundle ==="
+
+REAL_DELIVERY_HASH_AFTER="$(_bundle_hash "$REAL_DELIVERY_BUNDLE")"
+if [[ "$REAL_DELIVERY_HASH_AFTER" == "$REAL_DELIVERY_HASH_BEFORE" ]]; then
+  _pass "real repo delivery/trust.bundle unchanged by this eval's scratch sessions (before=$REAL_DELIVERY_HASH_BEFORE after=$REAL_DELIVERY_HASH_AFTER)"
+else
+  _fail "real repo delivery/trust.bundle CHANGED during this eval (before=$REAL_DELIVERY_HASH_BEFORE after=$REAL_DELIVERY_HASH_AFTER) — a scratch session's publish-delivery clobbered $REAL_DELIVERY_BUNDLE"
+fi
+
 # ─────────────────────────────────────────────────────────────────────────────
 echo ""
 echo "────────────────────────────────────────────"

package/evals/integration/test_claim_lookup.sh

@@ -46,14 +46,14 @@ seed_disputed_bundle() {
   mkdir -p "$dir"
   cat > "$dir/trust.bundle" <<JSON
 {
-  "schemaVersion": 3,
+  "schemaVersion": 5,
   "source": "claim-lookup-test;statusFunctionVersion=1",
   "claims": [
     {
       "id": "$claimId",
       "subjectType": "workflow-check",
       "subjectId": "${slug}/unit-tests",
-      "surface": "flow-agents.workflow",
+      "facet": "flow-agents.workflow",
       "claimType": "workflow.check.test",
       "fieldOrBehavior": "unit tests pass",
       "value": "fail",
@@ -255,14 +255,14 @@ mkdir -p "$AC5_DIR"
 # won't match any evidence check id and bundleEnforcement won't be deduped.
 cat > "$AC5_DIR/trust.bundle" <<'BUNDLE'
 {
-  "schemaVersion": 3,
+  "schemaVersion": 5,
   "source": "claim-lookup-test",
   "claims": [
     {
       "id": "gate-hint-test/AC1.flow-agents.workflow.acceptance criterion verified",
       "subjectType": "workflow-criterion",
       "subjectId": "gate-hint-test/AC1",
-      "surface": "flow-agents.workflow",
+      "facet": "flow-agents.workflow",
       "claimType": "workflow.acceptance.criterion",
       "fieldOrBehavior": "acceptance criterion verified",
       "value": "fail",

package/evals/integration/test_codex_hook_resolution.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# test_codex_hook_resolution.sh - exercises the literal hooks.json command
+# strings emitted by build-universal-bundles.ts against the CODEX_HOME
+# resolution edge cases that a live Codex session actually hits: CODEX_HOME
+# unset/stale, and cwd being an unrelated project rather than this repo.
+#
+# Coverage gap this closes: test_codex_harness.sh only runs when a `codex`
+# binary is on PATH (it skips-as-pass otherwise, and no CI workflow installs
+# one), and every other hook eval calls the underlying script directly
+# (e.g. `node scripts/hooks/stop-goal-fit.js`), bypassing the bash -lc
+# CODEX_HOME resolver in hooks.json entirely. Neither ever caught a resolver
+# bug, which is exactly what shipped: every hook exited 1 in real usage
+# whenever CODEX_HOME wasn't exported into the hook's process and the
+# project cwd didn't happen to vendor scripts/hooks itself.
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+source "$ROOT/evals/lib/node.sh"
+
+errors=0
+TMPDIR_EVAL="$(mktemp -d)"
+trap 'rm -rf "$TMPDIR_EVAL"' EXIT
+
+_pass() { echo "  ✓ $1"; }
+_fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
+
+echo "=== Codex Hook Resolution ==="
+echo ""
+
+if flow_agents_node scripts/build-universal-bundles.js >/dev/null; then
+  _pass "bundle build completed"
+else
+  _fail "bundle build failed"
+fi
+
+HOOKS_JSON="$ROOT/dist/codex/.codex/hooks.json"
+if [[ -f "$HOOKS_JSON" ]]; then
+  _pass "dist/codex/.codex/hooks.json exists"
+else
+  _fail "dist/codex/.codex/hooks.json missing"
+fi
+
+# Pull the exact SessionStart workflow-steering command string Codex would run.
+SESSION_START_CMD="$(node -e '
+const hooks = require(process.argv[1]).hooks.SessionStart;
+const entry = hooks.find(group => group.hooks[0].command.includes("codex-hook-adapter.js"));
+process.stdout.write(entry.hooks[0].command);
+' "$HOOKS_JSON")"
+
+if [[ "$SESSION_START_CMD" == *"codex-hook-adapter.js"* ]]; then
+  _pass "extracted SessionStart hook command"
+else
+  _fail "could not extract SessionStart hook command"
+fi
+
+# An unrelated project: a real git repo that does NOT vendor scripts/hooks,
+# which is what every real installation target looks like (this repo is the
+# one exception, since it dogfoods itself from its own repo root).
+PROJECT="$TMPDIR_EVAL/unrelated-project"
+mkdir -p "$PROJECT"
+git init -q "$PROJECT"
+
+HOME_WITH_INSTALL="$TMPDIR_EVAL/home-with-install"
+mkdir -p "$HOME_WITH_INSTALL"
+bash "$ROOT/dist/codex/install.sh" "$HOME_WITH_INSTALL/.codex" >/dev/null
+
+HOME_EMPTY="$TMPDIR_EVAL/home-empty"
+mkdir -p "$HOME_EMPTY"
+
+echo ""
+echo "--- CODEX_HOME set correctly (baseline) ---"
+OUT="$(cd "$PROJECT" && CODEX_HOME="$HOME_WITH_INSTALL/.codex" bash -lc "$SESSION_START_CMD" <<<'{"hook_event_name":"SessionStart"}' 2>"$TMPDIR_EVAL/stderr.baseline")"
+STATUS=$?
+if [[ $STATUS -eq 0 ]] && [[ "$OUT" == *'"continue":true'* ]]; then
+  _pass "hook succeeds when CODEX_HOME is set and correct"
+else
+  _fail "hook should succeed when CODEX_HOME is set and correct (exit $STATUS): $OUT"
+fi
+
+echo ""
+echo "--- CODEX_HOME unset, unrelated cwd, install lives under \$HOME/.codex ---"
+OUT="$(cd "$PROJECT" && unset CODEX_HOME && HOME="$HOME_WITH_INSTALL" bash -lc "$SESSION_START_CMD" <<<'{"hook_event_name":"SessionStart"}' 2>"$TMPDIR_EVAL/stderr.fallback")"
+STATUS=$?
+if [[ $STATUS -eq 0 ]] && [[ "$OUT" == *'"continue":true'* ]]; then
+  _pass "hook falls back to \$HOME/.codex and succeeds when CODEX_HOME is unset"
+else
+  _fail "hook should fall back to \$HOME/.codex when CODEX_HOME is unset (exit $STATUS): $OUT"
+fi
+
+echo ""
+echo "--- CODEX_HOME unset, unrelated cwd, no install anywhere (fail open) ---"
+set +e
+OUT="$(cd "$PROJECT" && unset CODEX_HOME && HOME="$HOME_EMPTY" bash -lc "$SESSION_START_CMD" <<<'{"hook_event_name":"SessionStart"}' 2>"$TMPDIR_EVAL/stderr.missing")"
+STATUS=$?
+set -e
+if [[ $STATUS -eq 0 ]]; then
+  _pass "hook exits 0 (fails open) instead of crashing when the script cannot be found anywhere"
+else
+  _fail "hook should fail open with exit 0 when unresolvable, got exit $STATUS"
+fi
+
+if grep -q "hook script not found" "$TMPDIR_EVAL/stderr.missing"; then
+  _pass "hook reports a clear diagnostic instead of a bare module-not-found crash"
+else
+  _fail "hook did not report a diagnostic when the script was unresolvable"
+fi
+
+echo ""
+if [[ $errors -gt 0 ]]; then
+  echo "FAILED: $errors error(s)"
+  exit 1
+fi
+echo "PASSED"
+exit 0

package/evals/integration/test_command_log_concurrency.sh

@@ -30,15 +30,15 @@ trap cleanup EXIT
 
 REPO="$TMP/repo"
 SLUG="conc"
-mkdir -p "$REPO/.flow-agents/$SLUG"
+mkdir -p "$REPO/.kontourai/flow-agents/$SLUG"
 printf '# Repo\n' > "$REPO/AGENTS.md"
 # Anchor the capture log to this slug. evidence-capture.js resolves the artifact
-# dir via .flow-agents/current.json (active_slug) or the newest state.json; seed
-# both so resolveArtifactDir() points at .flow-agents/<slug>/.
-printf '{"active_slug":"%s","artifact_dir":".flow-agents/%s"}' "$SLUG" "$SLUG" \
-  > "$REPO/.flow-agents/current.json"
+# dir via .kontourai/flow-agents/current.json (active_slug) or the newest state.json; seed
+# both so resolveArtifactDir() points at .kontourai/flow-agents/<slug>/.
+printf '{"active_slug":"%s","artifact_dir":".kontourai/flow-agents/%s"}' "$SLUG" "$SLUG" \
+  > "$REPO/.kontourai/flow-agents/current.json"
 printf '%s' "{\"schema_version\":\"1.0\",\"task_slug\":\"$SLUG\",\"status\":\"in_progress\",\"phase\":\"build\",\"updated_at\":\"2026-06-23T00:00:00Z\",\"next_action\":{\"status\":\"in_progress\",\"summary\":\"work\"}}" \
-  > "$REPO/.flow-agents/$SLUG/state.json"
+  > "$REPO/.kontourai/flow-agents/$SLUG/state.json"
 
 N=24
 echo "Test: $N concurrent captures into one command-log must not fork the chain"
@@ -51,7 +51,7 @@ for i in $(seq 1 "$N"); do
 done
 wait
 
-LOG="$REPO/.flow-agents/$SLUG/command-log.jsonl"
+LOG="$REPO/.kontourai/flow-agents/$SLUG/command-log.jsonl"
 
 # 1. All N records present.
 count=$(grep -c '' "$LOG" 2>/dev/null || echo 0)
@@ -91,7 +91,7 @@ else
 fi
 
 # 3. The verifier confirms an intact chain.
-chain_status=$(node -e "const g = require('$GATE'); console.log(g.verifyCommandLogChain('$REPO/.flow-agents/$SLUG').status);")
+chain_status=$(node -e "const g = require('$GATE'); console.log(g.verifyCommandLogChain('$REPO/.kontourai/flow-agents/$SLUG').status);")
 if [[ "$chain_status" == "ok" ]]; then
   _pass "verifyCommandLogChain → ok under concurrency"
 else

package/evals/integration/test_command_log_fork_classification.sh

@@ -22,7 +22,7 @@ errors=0
 _pass() { echo "  ✓ $1"; }
 _fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
 
-SD=".flow-agents/s"
+SD=".kontourai/flow-agents/s"
 
 # Build a command-log from a spec: JSON array of {cmd,exit,src,parent} where
 # parent is the 0-based index of the entry whose hash is this entry's prevHash
@@ -41,10 +41,10 @@ build() { # $1=dir $2=spec-json
       const prev=s.parent===-1?GEN:hashes[s.parent]; const h=H(prev,rec);
       hashes.push(h); lines.push(JSON.stringify({...rec,_chain:{seq:i,prevHash:prev,hash:h}}));
     });
-    fs.writeFileSync(path.join(process.env.DIR,".flow-agents/s/command-log.jsonl"),lines.join("\n")+"\n");
+    fs.writeFileSync(path.join(process.env.DIR,".kontourai/flow-agents/s/command-log.jsonl"),lines.join("\n")+"\n");
   ' "$2"
 }
-status() { DIR="$1" node -e 'const g=require(process.env.GATE);console.log(g.verifyCommandLogChain(process.env.DIR+"/.flow-agents/s").status)' ; }
+status() { DIR="$1" node -e 'const g=require(process.env.GATE);console.log(g.verifyCommandLogChain(process.env.DIR+"/.kontourai/flow-agents/s").status)' ; }
 
 # ── 1. linear → ok ────────────────────────────────────────────────────────────
 D="$TMP/linear"; build "$D" '[{"cmd":"a","exit":0,"parent":-1},{"cmd":"b","exit":0,"parent":0}]'