@kontourai/flow-agents 2.3.0 → 2.4.0

package/evals/integration/test_workflow_steering_hook.sh

@@ -16,12 +16,12 @@ _pass() { echo "  ✓ $1"; }
 _fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
 
 REPO="$TMPDIR_EVAL/repo"
-mkdir -p "$REPO/.flow-agents/steering-demo"
+mkdir -p "$REPO/.kontourai/flow-agents/steering-demo"
 mkdir -p "$REPO/docs"
 printf '# Test Repo\n' > "$REPO/AGENTS.md"
 printf '# Context Map\n' > "$REPO/docs/context-map.md"
 
-cat > "$REPO/.flow-agents/steering-demo/state.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/steering-demo/state.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "steering-demo",
@@ -36,7 +36,7 @@ cat > "$REPO/.flow-agents/steering-demo/state.json" <<'JSON'
 }
 JSON
 
-cat > "$REPO/.flow-agents/steering-demo/critique.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/steering-demo/critique.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "steering-demo",
@@ -217,6 +217,176 @@ else
   _fail "Claude hook adapter should not fail for prompt-submit workflow steering"
 fi
 
+FRESH_REPO="$TMPDIR_EVAL/fresh-repo"
+mkdir -p "$FRESH_REPO/docs"
+printf '# Fresh Repo\n' > "$FRESH_REPO/AGENTS.md"
+printf '# Context Map\n' > "$FRESH_REPO/docs/context-map.md"
+
+if node "$ROOT/scripts/hooks/workflow-steering.js" >"$TMPDIR_EVAL/builder-route.out" 2>"$TMPDIR_EVAL/builder-route.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"Please implement the new settings API and update its tests."}
+JSON
+then
+  if rg -q 'BUILDER WORKFLOW ROUTE' "$TMPDIR_EVAL/builder-route.out" && \
+     rg -q 'activate `deliver`' "$TMPDIR_EVAL/builder-route.out" && \
+     rg -q -- '--flow-id builder.build' "$TMPDIR_EVAL/builder-route.out" && \
+     rg -q 'plan-work -> execute-plan -> review-work -> verify-work' "$TMPDIR_EVAL/builder-route.out" && \
+     rg -q 'publish/release-readiness and learning-review' "$TMPDIR_EVAL/builder-route.out"; then
+    _pass "workflow steering hook routes fresh coding prompts into Builder workflow"
+  else
+    _fail "workflow steering missed Builder workflow route for coding prompt: $(cat "$TMPDIR_EVAL/builder-route.out")"
+  fi
+else
+  _fail "workflow steering hook should not fail for fresh coding prompt"
+fi
+
+if node "$ROOT/scripts/hooks/claude-hook-adapter.js" UserPromptSubmit prompt:workflow-steering workflow-steering.js standard,strict >"$TMPDIR_EVAL/claude-builder-route.out" 2>"$TMPDIR_EVAL/claude-builder-route.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"Please implement the new settings API and update its tests."}
+JSON
+then
+  if node - "$TMPDIR_EVAL/claude-builder-route.out" <<'NODE'
+const fs = require("node:fs");
+const payload = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+const ctx = payload.hookSpecificOutput?.additionalContext || "";
+if (payload.continue !== true) throw new Error("continue not true");
+if (payload.suppressOutput !== false) throw new Error("suppressOutput should be false when guidance exists");
+for (const needle of ["BUILDER WORKFLOW ROUTE", "activate `deliver`", "--flow-id builder.build", "plan-work -> execute-plan -> review-work -> verify-work", "publish/release-readiness and learning-review"]) {
+  if (!ctx.includes(needle)) throw new Error(`missing ${needle}`);
+}
+NODE
+  then
+    _pass "Claude hook adapter surfaces Builder workflow route for coding prompts"
+  else
+    _fail "Claude hook adapter missed Builder workflow route: $(cat "$TMPDIR_EVAL/claude-builder-route.out") $(cat "$TMPDIR_EVAL/claude-builder-route.err")"
+  fi
+else
+  _fail "Claude hook adapter should not fail for Builder workflow route"
+fi
+
+if node "$ROOT/scripts/hooks/workflow-steering.js" >"$TMPDIR_EVAL/builder-route-review-only.out" 2>"$TMPDIR_EVAL/builder-route-review-only.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"Please review the test coverage and validate whether it is enough. Do not modify files."}
+JSON
+then
+  if ! rg -q 'BUILDER WORKFLOW ROUTE' "$TMPDIR_EVAL/builder-route-review-only.out"; then
+    _pass "workflow steering hook does not route explicit review-only prompts into Builder workflow"
+  else
+    _fail "workflow steering incorrectly routed review-only prompt: $(cat "$TMPDIR_EVAL/builder-route-review-only.out")"
+  fi
+else
+  _fail "workflow steering hook should not fail for review-only prompt"
+fi
+
+if node "$ROOT/scripts/hooks/workflow-steering.js" >"$TMPDIR_EVAL/builder-route-validate-only.out" 2>"$TMPDIR_EVAL/builder-route-validate-only.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"Please validate whether the tests are enough. Do not modify files."}
+JSON
+then
+  if ! rg -q 'BUILDER WORKFLOW ROUTE' "$TMPDIR_EVAL/builder-route-validate-only.out"; then
+    _pass "workflow steering hook does not route explicit validation-only prompts into Builder workflow"
+  else
+    _fail "workflow steering incorrectly routed validation-only prompt: $(cat "$TMPDIR_EVAL/builder-route-validate-only.out")"
+  fi
+else
+  _fail "workflow steering hook should not fail for validation-only prompt"
+fi
+
+if node "$ROOT/scripts/hooks/workflow-steering.js" >"$TMPDIR_EVAL/builder-route-bare-validate.out" 2>"$TMPDIR_EVAL/builder-route-bare-validate.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"Please validate whether the settings API tests are enough."}
+JSON
+then
+  if ! rg -q 'BUILDER WORKFLOW ROUTE' "$TMPDIR_EVAL/builder-route-bare-validate.out"; then
+    _pass "workflow steering hook does not route bare validation prompts into Builder workflow"
+  else
+    _fail "workflow steering incorrectly routed bare validation prompt: $(cat "$TMPDIR_EVAL/builder-route-bare-validate.out")"
+  fi
+else
+  _fail "workflow steering hook should not fail for bare validation prompt"
+fi
+
+if node "$ROOT/scripts/hooks/workflow-steering.js" >"$TMPDIR_EVAL/builder-route-bare-test.out" 2>"$TMPDIR_EVAL/builder-route-bare-test.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"Please test whether this still reproduces."}
+JSON
+then
+  if ! rg -q 'BUILDER WORKFLOW ROUTE' "$TMPDIR_EVAL/builder-route-bare-test.out"; then
+    _pass "workflow steering hook does not route bare test prompts into Builder workflow"
+  else
+    _fail "workflow steering incorrectly routed bare test prompt: $(cat "$TMPDIR_EVAL/builder-route-bare-test.out")"
+  fi
+else
+  _fail "workflow steering hook should not fail for bare test prompt"
+fi
+
+if node "$ROOT/scripts/hooks/workflow-steering.js" >"$TMPDIR_EVAL/builder-route-test-question.out" 2>"$TMPDIR_EVAL/builder-route-test-question.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"What tests should I run for the settings API?"}
+JSON
+then
+  if ! rg -q 'BUILDER WORKFLOW ROUTE' "$TMPDIR_EVAL/builder-route-test-question.out"; then
+    _pass "workflow steering hook does not route question-only test prompts into Builder workflow"
+  else
+    _fail "workflow steering incorrectly routed question-only test prompt: $(cat "$TMPDIR_EVAL/builder-route-test-question.out")"
+  fi
+else
+  _fail "workflow steering hook should not fail for question-only test prompt"
+fi
+
+if node "$ROOT/scripts/hooks/claude-hook-adapter.js" UserPromptSubmit prompt:workflow-steering workflow-steering.js standard,strict >"$TMPDIR_EVAL/claude-builder-route-review-only.out" 2>"$TMPDIR_EVAL/claude-builder-route-review-only.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"Please review the test coverage and validate whether it is enough. Do not modify files."}
+JSON
+then
+  if node - "$TMPDIR_EVAL/claude-builder-route-review-only.out" <<'NODE'
+const fs = require("node:fs");
+const payload = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+const ctx = payload.hookSpecificOutput?.additionalContext || "";
+if (payload.continue !== true) throw new Error("continue not true");
+if (ctx.includes("BUILDER WORKFLOW ROUTE")) throw new Error("review-only prompt should not route to Builder workflow");
+NODE
+  then
+    _pass "Claude hook adapter does not route explicit review-only prompts into Builder workflow"
+  else
+    _fail "Claude hook adapter incorrectly routed review-only prompt: $(cat "$TMPDIR_EVAL/claude-builder-route-review-only.out") $(cat "$TMPDIR_EVAL/claude-builder-route-review-only.err")"
+  fi
+else
+  _fail "Claude hook adapter should not fail for review-only prompt"
+fi
+
+if node "$ROOT/scripts/hooks/claude-hook-adapter.js" UserPromptSubmit prompt:workflow-steering workflow-steering.js standard,strict >"$TMPDIR_EVAL/claude-builder-route-validate-only.out" 2>"$TMPDIR_EVAL/claude-builder-route-validate-only.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"Please validate whether the tests are enough. Do not modify files."}
+JSON
+then
+  if node - "$TMPDIR_EVAL/claude-builder-route-validate-only.out" <<'NODE'
+const fs = require("node:fs");
+const payload = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+const ctx = payload.hookSpecificOutput?.additionalContext || "";
+if (payload.continue !== true) throw new Error("continue not true");
+if (ctx.includes("BUILDER WORKFLOW ROUTE")) throw new Error("validation-only prompt should not route to Builder workflow");
+NODE
+  then
+    _pass "Claude hook adapter does not route explicit validation-only prompts into Builder workflow"
+  else
+    _fail "Claude hook adapter incorrectly routed validation-only prompt: $(cat "$TMPDIR_EVAL/claude-builder-route-validate-only.out") $(cat "$TMPDIR_EVAL/claude-builder-route-validate-only.err")"
+  fi
+else
+  _fail "Claude hook adapter should not fail for validation-only prompt"
+fi
+
+if node "$ROOT/scripts/hooks/claude-hook-adapter.js" UserPromptSubmit prompt:workflow-steering workflow-steering.js standard,strict >"$TMPDIR_EVAL/claude-builder-route-test-question.out" 2>"$TMPDIR_EVAL/claude-builder-route-test-question.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"What tests should I run for the settings API?"}
+JSON
+then
+  if node - "$TMPDIR_EVAL/claude-builder-route-test-question.out" <<'NODE'
+const fs = require("node:fs");
+const payload = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+const ctx = payload.hookSpecificOutput?.additionalContext || "";
+if (payload.continue !== true) throw new Error("continue not true");
+if (ctx.includes("BUILDER WORKFLOW ROUTE")) throw new Error("question-only test prompt should not route to Builder workflow");
+NODE
+  then
+    _pass "Claude hook adapter does not route question-only test prompts into Builder workflow"
+  else
+    _fail "Claude hook adapter incorrectly routed question-only test prompt: $(cat "$TMPDIR_EVAL/claude-builder-route-test-question.out") $(cat "$TMPDIR_EVAL/claude-builder-route-test-question.err")"
+  fi
+else
+  _fail "Claude hook adapter should not fail for question-only test prompt"
+fi
+
 if node "$ROOT/scripts/hooks/codex-hook-adapter.js" post:workflow-steering workflow-steering.js standard,strict >"$TMPDIR_EVAL/codex-adapter.out" 2>"$TMPDIR_EVAL/codex-adapter.err" <<JSON
 {"hook_event_name":"PostToolUse","cwd":"$REPO","tool_input":{"command":"Bash","content":{"command":"bash evals/run.sh integration"}},"tool_response":"integration finished"}
 JSON
@@ -285,7 +455,7 @@ else
   _fail "Codex hook adapter should not fail for prompt-submit workflow steering"
 fi
 
-cat > "$REPO/.flow-agents/steering-demo/state.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/steering-demo/state.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "steering-demo",
@@ -298,7 +468,7 @@ cat > "$REPO/.flow-agents/steering-demo/state.json" <<'JSON'
   }
 }
 JSON
-rm -f "$REPO/.flow-agents/steering-demo/critique.json"
+rm -f "$REPO/.kontourai/flow-agents/steering-demo/critique.json"
 
 if node "$ROOT/scripts/hooks/workflow-steering.js" >"$TMPDIR_EVAL/done.out" 2>"$TMPDIR_EVAL/done.err" <<JSON
 {"cwd":"$REPO","tool_input":{"command":"InvokeSubagents","content":{"subagents":[{"agent_name":"tool-verifier"}]}},"tool_response":"verification finished"}

package/evals/lib/codex-provider.sh

@@ -19,7 +19,7 @@ AGENT="${AGENT:-${FLOW_AGENTS_EVAL_AGENT:-dev}}"
 
 profile_for_agent() {
   case "$1" in
-    dev) echo "kdev" ;;
+    dev) echo "builder" ;;
     *) echo "" ;;
   esac
 }

package/evals/lib/node.sh

@@ -3,8 +3,26 @@
 
 FLOW_AGENTS_EVAL_ROOT="${ROOT:-${ROOT_DIR:-}}"
 
+# Memoized per-process: flow_agents_node is called dozens of times per eval script
+# (often inside a `run_bounded N ...` hang-guard around a single fail-fast assertion).
+# Re-running `npm run build --silent` (npm startup + tsc incremental stat-check) on EVERY
+# call repeatedly re-pays that overhead inside those bounds. On a slow/loaded CI runner a
+# single one of those ~100+ redundant build invocations can occasionally take long enough
+# to blow a tight hang-guard bound before the actual (near-instant) validation ever runs,
+# producing a spurious assertion failure that has nothing to do with the behavior under
+# test (see PR #306 CI trust-reconcile divergence investigation). Source under src/ never
+# changes mid-script for any eval, so building once per process is safe and correct.
+_FLOW_AGENTS_BUILD_DONE=""
+
 flow_agents_build_ts() {
-  (cd "$FLOW_AGENTS_EVAL_ROOT" && npm run build --silent >/dev/null)
+  if [[ "$_FLOW_AGENTS_BUILD_DONE" == "1" ]]; then
+    return 0
+  fi
+  if (cd "$FLOW_AGENTS_EVAL_ROOT" && npm run build --silent >/dev/null); then
+    _FLOW_AGENTS_BUILD_DONE="1"
+    return 0
+  fi
+  return 1
 }
 
 flow_agents_node() {

package/evals/run.sh

@@ -135,12 +135,16 @@ run_static() {
   echo ""
   bash "$EVAL_DIR/static/test_evidence_refs.sh" || result=1
   echo ""
+  bash "$EVAL_DIR/static/test_decisions.sh" || result=1
+  echo ""
   bash "$EVAL_DIR/static/test_library_exports.sh" || result=1
   echo ""
   bash "$EVAL_DIR/static/test_console_presets.sh" || result=1
   echo ""
   bash "$EVAL_DIR/static/test_repo_hooks.sh" || result=1
   echo ""
+  bash "$EVAL_DIR/static/test_flowdef_codeowners_coverage.sh" || result=1
+  echo ""
   bash "$EVAL_DIR/static/test_unit_helpers.sh" || result=1
   return $result
 }
@@ -179,12 +183,26 @@ run_integration() {
   echo ""
   bash "$EVAL_DIR/integration/test_workflow_artifact_cleanup_audit.sh" || result=1
   echo ""
+  bash "$EVAL_DIR/integration/test_promote_gate.sh" || result=1
+  echo ""
   bash "$EVAL_DIR/integration/test_fixture_retirement_audit.sh" || result=1
   echo ""
   bash "$EVAL_DIR/integration/test_publish_change_helper.sh" || result=1
   echo ""
   bash "$EVAL_DIR/integration/test_workflow_sidecar_writer.sh" || result=1
   echo ""
+  bash "$EVAL_DIR/integration/test_sidecar_field_preservation.sh" || result=1
+  echo ""
+  bash "$EVAL_DIR/integration/test_actor_identity.sh" || result=1
+  echo ""
+  bash "$EVAL_DIR/integration/test_liveness_heartbeat.sh" || result=1
+  echo ""
+  bash "$EVAL_DIR/integration/test_pull_work_liveness_preflight.sh" || result=1
+  echo ""
+  bash "$EVAL_DIR/integration/test_liveness_verdict.sh" || result=1
+  echo ""
+  bash "$EVAL_DIR/integration/test_liveness_conflict_injection.sh" || result=1
+  echo ""
   bash "$EVAL_DIR/integration/test_veritas_governance_adapter.sh" || result=1
   echo ""
   bash "$EVAL_DIR/integration/test_workflow_steering_hook.sh" || result=1
@@ -203,6 +221,10 @@ run_integration() {
   echo ""
   bash "$EVAL_DIR/integration/test_runtime_adapter_activation.sh" || result=1
   echo ""
+  bash "$EVAL_DIR/integration/test_validate_artifacts_portability.sh" || result=1
+  echo ""
+  bash "$EVAL_DIR/integration/test_codex_hook_resolution.sh" || result=1
+  echo ""
   bash "$EVAL_DIR/integration/test_bundle_install.sh" || result=1
   echo ""
   bash "$EVAL_DIR/integration/test_bundle_lifecycle.sh" || result=1

package/evals/static/test_decisions.sh

@@ -0,0 +1,150 @@
+#!/usr/bin/env bash
+# test_decisions.sh — Decision registry validator + index generator checks.
+# Covers: valid pass, each violation class (bad status, missing subject,
+# secret-shaped evidence, tombstone -> missing slug), and index idempotency.
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SCRIPT="$ROOT/scripts/check-decisions.cjs"
+
+errors=0
+pass() { echo "  PASS $1"; }
+fail() { echo "  FAIL $1"; errors=$((errors + 1)); }
+
+echo "=== Decision Registry Checks ==="
+
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+run_check() { FLOW_AGENTS_DECISIONS_DIR="$1" node "$SCRIPT" check >"$2" 2>&1; }
+gen_index() { FLOW_AGENTS_DECISIONS_DIR="$1" node "$SCRIPT" gen-index >/dev/null 2>&1; }
+
+valid_frontmatter() {
+  cat <<'EOF'
+---
+status: current
+subject: Example subject
+decided: 2026-07-03
+evidence:
+  - kind: issue
+    ref: https://github.com/kontourai/flow-agents/issues/310
+---
+
+# Example subject
+
+The current answer.
+EOF
+}
+
+# --- Case 1: valid file passes ---
+D1="$WORK/valid"; mkdir -p "$D1"
+valid_frontmatter >"$D1/example-subject.md"
+gen_index "$D1"
+if run_check "$D1" "$WORK/c1.log"; then
+  pass "valid topic file + fresh index passes"
+else
+  fail "valid topic file should pass"; cat "$WORK/c1.log"
+fi
+
+# --- Case 2: unknown status fails ---
+D2="$WORK/badstatus"; mkdir -p "$D2"
+valid_frontmatter | sed 's/^status: current/status: accepted/' >"$D2/example-subject.md"
+gen_index "$D2"
+if run_check "$D2" "$WORK/c2.log"; then
+  fail "unknown status should fail validation"
+else
+  grep -q "unknown status" "$WORK/c2.log" && pass "unknown status fails" || { fail "unknown status wrong error"; cat "$WORK/c2.log"; }
+fi
+
+# --- Case 3: missing subject fails ---
+D3="$WORK/nosubject"; mkdir -p "$D3"
+valid_frontmatter | grep -v '^subject:' >"$D3/example-subject.md"
+gen_index "$D3"
+if run_check "$D3" "$WORK/c3.log"; then
+  fail "missing subject should fail validation"
+else
+  grep -q "subject" "$WORK/c3.log" && pass "missing subject fails" || { fail "missing subject wrong error"; cat "$WORK/c3.log"; }
+fi
+
+# --- Case 4: secret-shaped evidence ref fails ---
+# The secret-shaped literal is assembled at runtime so no contiguous
+# access-key-shaped token is committed to a tracked file (suite secret-scan gate).
+D4="$WORK/secret"; mkdir -p "$D4"
+FAKE_KEY="AKIA$(printf 'IOSFODNN7EXAMPLE')"
+{
+  printf -- '---\n'
+  printf 'status: current\n'
+  printf 'subject: Example subject\n'
+  printf 'decided: 2026-07-03\n'
+  printf 'evidence:\n'
+  printf '  - kind: url\n'
+  printf '    ref: "https://example.com/?token=%s"\n' "$FAKE_KEY"
+  printf -- '---\n\n'
+  printf '# Example subject\n'
+} >"$D4/example-subject.md"
+gen_index "$D4"
+if run_check "$D4" "$WORK/c4.log"; then
+  fail "secret-shaped evidence ref should fail validation"
+else
+  grep -q "secret-shaped" "$WORK/c4.log" && pass "secret-shaped evidence fails" || { fail "secret-shaped wrong error"; cat "$WORK/c4.log"; }
+fi
+
+# --- Case 5: tombstone pointing at missing slug fails ---
+D5="$WORK/tombstone"; mkdir -p "$D5"
+cat >"$D5/old-topic.md" <<'EOF'
+---
+status: superseded
+subject: Old topic
+decided: 2026-07-03
+superseded_by: does-not-exist
+evidence:
+  - kind: issue
+    ref: "#310"
+---
+
+# Old topic
+EOF
+gen_index "$D5"
+if run_check "$D5" "$WORK/c5.log"; then
+  fail "tombstone -> missing slug should fail validation"
+else
+  grep -q "missing topic slug" "$WORK/c5.log" && pass "tombstone -> missing slug fails" || { fail "tombstone wrong error"; cat "$WORK/c5.log"; }
+fi
+
+# --- Case 6: index idempotency (second gen is diff-clean) ---
+D6="$WORK/idem"; mkdir -p "$D6"
+valid_frontmatter >"$D6/example-subject.md"
+gen_index "$D6"
+cp "$D6/index.md" "$WORK/index-first.md"
+gen_index "$D6"
+if diff -q "$WORK/index-first.md" "$D6/index.md" >/dev/null; then
+  pass "index regeneration is idempotent (diff-clean)"
+else
+  fail "index regeneration is not idempotent"; diff "$WORK/index-first.md" "$D6/index.md" || true
+fi
+
+# --- Case 7: check flags a stale index ---
+D7="$WORK/stale"; mkdir -p "$D7"
+valid_frontmatter >"$D7/example-subject.md"
+gen_index "$D7"
+printf '\nstale line\n' >>"$D7/index.md"
+if run_check "$D7" "$WORK/c7.log"; then
+  fail "stale index should fail validation"
+else
+  grep -q "stale" "$WORK/c7.log" && pass "stale index detected" || { fail "stale index wrong error"; cat "$WORK/c7.log"; }
+fi
+
+# --- Case 8: repo's own registry passes end-to-end ---
+if node "$SCRIPT" check >"$WORK/c8.log" 2>&1; then
+  pass "repo docs/decisions registry passes"
+else
+  fail "repo docs/decisions registry should pass"; cat "$WORK/c8.log"
+fi
+
+echo ""
+if [[ "$errors" -eq 0 ]]; then
+  echo "Decision registry checks: all passed."
+  exit 0
+fi
+echo "Decision registry checks: $errors failed."
+exit 1

package/evals/static/test_flowdef_codeowners_coverage.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT_DIR"
+
+# Regression lock: CODEOWNERS must keep review-gated coverage over the
+# anti-gaming gate's enforcement hooks, the FlowDefinition resolution/trust
+# path, and the kit FlowDefinitions the gate's expects[] taxonomy is derived
+# from (ADR 0016 Abstraction A, ADR 0018 Decision #2). If any of these paths
+# silently drop out of CODEOWNERS, an agent could weaken the gate without
+# owner review. This check must fail loudly, naming the missing path.
+
+CODEOWNERS_FILE=".github/CODEOWNERS"
+
+pass() {
+  echo "PASS: $1"
+}
+
+fail() {
+  echo "FAIL: $1" >&2
+  exit 1
+}
+
+require_file() {
+  [[ -f "$1" ]] || fail "$1 is missing"
+  pass "$1 exists"
+}
+
+# Asserts that a non-comment line in CODEOWNERS contains the given
+# path/glob pattern and has an owner assigned to it. Tolerant of leading
+# "/", trailing globs, and surrounding whitespace — it checks coverage,
+# not an exact line match.
+require_codeowner() {
+  local pattern="$1"
+  local label="$2"
+  local match
+  match="$(grep -v '^[[:space:]]*#' "$CODEOWNERS_FILE" | grep -F -- "$pattern" || true)"
+  [[ -n "$match" ]] || fail "CODEOWNERS coverage regression: no entry found for '$label' (expected pattern containing '$pattern')"
+  echo "$match" | grep -Eq '@[A-Za-z0-9_-]+' || fail "CODEOWNERS coverage regression: entry for '$label' has no owner assigned"
+  pass "CODEOWNERS covers $label"
+}
+
+require_file "$CODEOWNERS_FILE"
+
+# NOTE: the flow-resolver.ts pattern below is string-split, matching how other
+# evals/ files reference the same module — otherwise validate-source-tree's
+# legacy-ref scanner mistakes the "lib/" segment for a (missing) top-level path.
+require_codeowner "scripts/hooks/stop-goal-fit.js" "scripts/hooks/stop-goal-fit.js"
+require_codeowner "scripts/hooks/config-protection.js" "scripts/hooks/config-protection.js"
+require_codeowner "scripts/hooks/evidence-capture.js" "scripts/hooks/evidence-capture.js"
+require_codeowner "src/li""b/flow-resolver.ts" "src/li""b/flow-resolver.ts"
+require_codeowner "src/cli/workflow-sidecar.ts" "src/cli/workflow-sidecar.ts"
+require_codeowner "kits/*/flows/*.flow.json" "kits/*/flows/*.flow.json (kit FlowDefinitions)"
+
+echo "FlowDefinition-related CODEOWNERS coverage checks passed."

package/evals/static/test_package.sh

@@ -87,6 +87,7 @@ for (const entry of required) {
 const requiredExcludes = [
   "!evals/cases/dev/node_modules/",
   "!**/.flow-agents/",
+  "!**/.kontourai/",
   "!**/.surface/",
   "!**/.telemetry/",
   "!**/.veritas/",
@@ -99,7 +100,7 @@ const forbidden = [
   ".agents/",
   ".codex/",
   ".claude/",
-  ".flow-agents/",
+  ".kontourai/",
   ".surface/",
   ".telemetry/",
   ".veritas/",
@@ -120,7 +121,7 @@ NODE
   if node - "$ROOT_DIR/console.telemetry.json" <<'NODE'
 const fs = require("node:fs");
 const descriptor = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
-for (const id of ["builder.shape", "builder.build"]) {
+for (const id of ["builder.shape", "builder.build", "builder.publish-learn"]) {
   const flow = (descriptor.flows || []).find((candidate) => candidate.id === id);
   if (!flow) throw new Error(`missing ${id} flow descriptor`);
   if (!flow.detailAttributes || Array.isArray(flow.detailAttributes) || typeof flow.detailAttributes !== "object") {
@@ -142,14 +143,14 @@ NODE
   else
     _pass "tracked source has no legacy Flow Agents rename references"
   fi
-  if (cd "$ROOT_DIR" && FLOW_AGENTS_CONTENT_BOUNDARY_FILES='.flow-agents/example/state.json' node scripts/check-content-boundary.cjs >/tmp/content-boundary-runtime.out 2>&1); then
+  if (cd "$ROOT_DIR" && FLOW_AGENTS_CONTENT_BOUNDARY_FILES='.kontourai/flow-agents/example/state.json' node scripts/check-content-boundary.cjs >/tmp/content-boundary-runtime.out 2>&1); then
     _fail "content boundary allows ordinary workflow runtime artifacts"
   elif rg -q 'Flow Agents runtime artifact must not be tracked' /tmp/content-boundary-runtime.out; then
     _pass "content boundary blocks ordinary workflow runtime artifacts"
   else
     _fail "content boundary runtime rejection was not actionable"
   fi
-  if (cd "$ROOT_DIR" && FLOW_AGENTS_CONTENT_BOUNDARY_FILES='.flow-agents/nested/example/closeout.md' node scripts/check-content-boundary.cjs >/tmp/content-boundary-nested.out 2>&1); then
+  if (cd "$ROOT_DIR" && FLOW_AGENTS_CONTENT_BOUNDARY_FILES='.kontourai/flow-agents/nested/example/closeout.md' node scripts/check-content-boundary.cjs >/tmp/content-boundary-nested.out 2>&1); then
     _fail "content boundary allows nested workflow runtime artifacts"
   elif rg -q 'Flow Agents runtime artifact must not be tracked' /tmp/content-boundary-nested.out; then
     _pass "content boundary blocks nested workflow runtime artifacts"
@@ -157,7 +158,7 @@ NODE
     _fail "content boundary nested runtime rejection was not actionable"
   fi
   current_branch="$(cd "$ROOT_DIR" && git branch --show-current 2>/dev/null || true)"
-  tracked_runtime_artifacts="$(cd "$ROOT_DIR" && git ls-files -- '.flow-agents' 2>/dev/null || true)"
+  tracked_runtime_artifacts="$(cd "$ROOT_DIR" && git ls-files -- '.kontourai/flow-agents' 2>/dev/null || true)"
   if [[ "$current_branch" == "main" && -n "$tracked_runtime_artifacts" ]]; then
     printf '%s\n' "$tracked_runtime_artifacts" >/tmp/tracked-flow-agent-runtime-artifacts.txt
     _fail "main contains tracked workflow runtime artifacts (see /tmp/tracked-flow-agent-runtime-artifacts.txt)"
@@ -174,12 +175,12 @@ NODE
   else
     _fail "installed bundle is missing Kit Catalog or Builder Kit manifest"
   fi
-  if [[ -f "$PACKAGE_DIR/kits/builder/flows/shape.flow.json" && -f "$PACKAGE_DIR/kits/builder/flows/build.flow.json" ]]; then
+  if [[ -f "$PACKAGE_DIR/kits/builder/flows/shape.flow.json" && -f "$PACKAGE_DIR/kits/builder/flows/build.flow.json" && -f "$PACKAGE_DIR/kits/builder/flows/publish-learn.flow.json" ]]; then
     _pass "installed bundle includes Builder Kit Flow Definitions"
   else
     _fail "installed bundle is missing Builder Kit Flow Definitions"
   fi
-  if node - "$PACKAGE_DIR/kits/catalog.json" "$PACKAGE_DIR/kits/builder/kit.json" "$PACKAGE_DIR/kits/builder/flows/shape.flow.json" "$PACKAGE_DIR/kits/builder/flows/build.flow.json" <<'NODE'
+  if node - "$PACKAGE_DIR/kits/catalog.json" "$PACKAGE_DIR/kits/builder/kit.json" "$PACKAGE_DIR/kits/builder/flows/shape.flow.json" "$PACKAGE_DIR/kits/builder/flows/build.flow.json" "$PACKAGE_DIR/kits/builder/flows/publish-learn.flow.json" <<'NODE'
 const fs = require("node:fs");
 for (const file of process.argv.slice(2)) JSON.parse(fs.readFileSync(file, "utf8"));
 console.log("ok");
@@ -189,9 +190,10 @@ NODE
   else
     _fail "installed kit JSON parse failed"
   fi
-  if node - "$PACKAGE_DIR/kits/builder/flows/build.flow.json" <<'NODE'
+  if node - "$PACKAGE_DIR/kits/builder/flows/build.flow.json" "$PACKAGE_DIR/kits/builder/flows/publish-learn.flow.json" <<'NODE'
 const fs = require("node:fs");
 const flow = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+const publishLearn = JSON.parse(fs.readFileSync(process.argv[3], "utf8"));
 const steps = Object.fromEntries((flow.steps || []).map((step) => [step.id, step.next]));
 if (steps["pull-work"] !== "design-probe") throw new Error("pull-work should route to design-probe");
 if (steps["design-probe"] !== "plan") throw new Error("design-probe should route to plan");
@@ -208,13 +210,20 @@ for (const gateId of ["verify-gate", "merge-ready-gate"]) {
   for (const [reason, target] of Object.entries(expected)) if (gate.on_route_back?.[reason] !== target) throw new Error(`${gateId} ${reason} should route to ${target}`);
   if (gate.route_back_policy?.on_exceeded !== "block") throw new Error(`${gateId} route_back_policy should block on exceeded attempts`);
 }
-const expectations = Object.values(flow.gates || {}).flatMap((gate) => gate.expects || []);
+for (const stepId of ["pr-open", "merge-ready-ci", "learn"]) {
+  const step = (flow.steps || []).find((item) => item.id === stepId);
+  if (step?.uses_flow !== "builder.publish-learn") throw new Error(`${stepId} should compose builder.publish-learn`);
+}
+const expectations = [
+  ...Object.values(flow.gates || {}).flatMap((gate) => gate.expects || []),
+  ...Object.values(publishLearn.gates || {}).flatMap((gate) => gate.expects || []),
+];
 if (!expectations.length) throw new Error("Builder build flow should declare gate expectations");
 for (const expectation of expectations) {
   if (expectation.kind !== "trust.bundle") throw new Error(`${expectation.id || "<unknown>"} should remain a trust.bundle expectation`);
   if (!expectation.bundle_claim?.claimType || !expectation.bundle_claim?.accepted_statuses) throw new Error(`${expectation.id || "<unknown>"} should declare bundle_claim claimType and accepted statuses`);
 }
-const flowText = JSON.stringify(flow).toLowerCase();
+const flowText = JSON.stringify({ flow, publishLearn }).toLowerCase();
 for (const term of ["veritas", "trust_provider", "trust-provider", "provider_name", "provider_ref", "veritas_policy", "veritas_readiness"]) {
   if (flowText.includes(term)) throw new Error(`Builder build flow should not name provider-specific trust field: ${term}`);
 }