@kontourai/flow-agents 2.3.0 → 3.0.0

package/evals/acceptance/test_kiro_harness.sh

@@ -113,7 +113,7 @@ MARKDOWN
 stop_output="$(cd "$TMP_WORK" && FLOW_AGENTS_GOAL_FIT_STRICT=true kiro-cli chat --agent dev --no-interactive "Reply with READY only." 2>&1 || true)"
 stop_clean="$(printf '%s' "$stop_output" | strip_ansi)"
 if echo "$stop_clean" | grep -q 'stop "node .*stop:goal-fit stop-goal-fit.js standard,strict" failed with exit code: 2' \
-  && echo "$stop_clean" | grep -q '\[Hook\] Goal Fit warning:' \
+  && echo "$stop_clean" | grep -q '\[stop-gate\] Goal Fit warning:' \
   && echo "$stop_clean" | grep -q 'live-stop--deliver.md is still status:executing'; then
   _pass "strict Goal Fit stop hook surfaces live Kiro stop gate"
 else

package/evals/ci/antigaming-suite.sh

@@ -25,12 +25,17 @@ TESTS=(
   "evals/integration/test_enforcer_expects_driven.sh"
   "evals/integration/test_goal_fit_rederive.sh"
   "evals/integration/test_flowdef_session_activation.sh"
+  "evals/integration/test_flowdef_union_floor_regression.sh"
   "evals/integration/test_trust_reconcile.sh"
   "evals/integration/test_trust_checkpoint.sh"
   "evals/integration/test_checkpoint_signing.sh"
   "evals/integration/test_mint_attestation.sh"
   "evals/integration/test_publish_delivery.sh"
   "evals/integration/test_phase_map_and_gate_claim.sh"
+  "evals/integration/test_trust_reconcile_manifest.sh"
+  "evals/integration/test_trust_reconcile_mixed_bundle.sh"
+  "evals/integration/test_trust_reconcile_negatives.sh"
+  "evals/integration/test_goal_fit_ghost_session.sh"
 )
 
 fail=0

package/evals/ci/run-baseline.sh

@@ -11,6 +11,7 @@ mkdir -p "$LOG_DIR"
 
 CHECKS=(
   "Content boundary|npm run check:content-boundary --"
+  "Decision registry|npm run check:decisions --"
   "Source tree validation|npm run validate:source --"
   "Context map drift|npm run context-map -- --check"
   "Static eval suite|bash evals/run.sh static"
@@ -19,6 +20,11 @@ CHECKS=(
   "Fixture retirement audit integration|bash evals/integration/test_fixture_retirement_audit.sh"
   "Publish-change helper integration|bash evals/integration/test_publish_change_helper.sh"
   "Workflow sidecar writer integration|bash evals/integration/test_workflow_sidecar_writer.sh"
+  "Sidecar field preservation integration|bash evals/integration/test_sidecar_field_preservation.sh"
+  "Actor identity resolver integration|bash evals/integration/test_actor_identity.sh"
+  "Assignment provider local-file integration|bash evals/integration/test_assignment_provider_local_file.sh"
+  "Assignment provider github integration|bash evals/integration/test_assignment_provider_github.sh"
+  "Pull work assignment join integration|bash evals/integration/test_pull_work_assignment_join.sh"
   "Goal Fit hook integration|bash evals/integration/test_goal_fit_hook.sh"
   "Hook category behavior integration|bash evals/integration/test_hook_category_behaviors.sh"
   "Workflow steering hook integration|bash evals/integration/test_workflow_steering_hook.sh"
@@ -36,10 +42,15 @@ CHECKS=(
   "Effective backlog settings integration|bash evals/integration/test_effective_backlog_settings.sh"
   "Flow agents statusline integration|bash evals/integration/test_flow_agents_statusline.sh"
   "Telemetry contract integration|bash evals/integration/test_telemetry.sh"
+  "Liveness heartbeat integration|bash evals/integration/test_liveness_heartbeat.sh"
+  "Pull work liveness preflight integration|bash evals/integration/test_pull_work_liveness_preflight.sh"
+  "Liveness verdict integration|bash evals/integration/test_liveness_verdict.sh"
+  "Liveness conflict injection integration|bash evals/integration/test_liveness_conflict_injection.sh"
   "Telemetry doctor integration|bash evals/integration/test_telemetry_doctor.sh"
   "Usage and cost integration|bash evals/integration/test_usage_cost.sh"
   "Utterance check integration|bash evals/integration/test_utterance_check.sh"
   "Pull work provider integration|bash evals/integration/test_pull_work_provider.sh"
+  "Veritas governance kit integration|bash evals/integration/test_veritas_governance_kit.sh"
   "Anti-gaming and trust suite|bash evals/ci/antigaming-suite.sh"
   "Usage feedback import integration|bash evals/integration/test_usage_feedback_import.sh"
   "Usage feedback outcomes integration|bash evals/integration/test_usage_feedback_outcomes.sh"
@@ -50,6 +61,7 @@ CHECKS=(
 
 LANE_SOURCE_AND_STATIC=(
   "Content boundary"
+  "Decision registry"
   "Source tree validation"
   "Context map drift"
   "Static eval suite"
@@ -61,6 +73,11 @@ LANE_WORKFLOW_CONTRACTS=(
   "Fixture retirement audit integration"
   "Publish-change helper integration"
   "Workflow sidecar writer integration"
+  "Sidecar field preservation integration"
+  "Actor identity resolver integration"
+  "Assignment provider local-file integration"
+  "Assignment provider github integration"
+  "Pull work assignment join integration"
 )
 
 LANE_RUNTIME_AND_KIT=(
@@ -81,10 +98,15 @@ LANE_RUNTIME_AND_KIT=(
   "Effective backlog settings integration"
   "Flow agents statusline integration"
   "Telemetry contract integration"
+  "Liveness heartbeat integration"
+  "Pull work liveness preflight integration"
+  "Liveness verdict integration"
+  "Liveness conflict injection integration"
   "Telemetry doctor integration"
   "Usage and cost integration"
   "Utterance check integration"
   "Pull work provider integration"
+  "Veritas governance kit integration"
   "Anti-gaming and trust suite"
 )
 
@@ -100,6 +122,51 @@ slugify() {
   printf '%s' "$1" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9]+/-/g; s/^-//; s/-$//'
 }
 
+# WS8 (ADR 0020): the reconcile manifest is THIS registry, not a new file. Every entry
+# EMITTED below is a member of a REQUIRED LANE_* array (source-and-static, workflow-contracts,
+# runtime-and-kit), each of which gates a merge — so a manifest command is, by construction, a
+# required-lane command. The advisory LANE_USAGE_FEEDBACK lane (continue-on-error, non-blocking)
+# is EXCLUDED from the emit so a test_output claim can never reconcile against a non-gating
+# command. scripts/ci/trust-reconcile.js consumes this emit to resolve the manifest.
+_json_str() {
+  local s="$1"
+  s="${s//\\/\\\\}"
+  s="${s//\"/\\\"}"
+  printf '"%s"' "$s"
+}
+
+_lanes_for_label() {
+  # WS8 (ADR 0020, iteration 2): LANE_USAGE_FEEDBACK is deliberately NOT considered here.
+  # The reconcile manifest must contain only commands that gate a merge in a required lane.
+  # The usage-feedback lane is advisory (its steps run continue-on-error and its failures do
+  # not block), so a usage-feedback check is NOT a required-lane command and must not be a
+  # manifest entry a test_output claim can reconcile against. Entries whose ONLY lane is
+  # usage-feedback therefore resolve to empty lanes and are skipped by emit_manifest_json.
+  local label="$1" out="" x
+  for x in "${LANE_SOURCE_AND_STATIC[@]}"; do [[ "$x" == "$label" ]] && { out="${out}\"source-and-static\","; break; }; done
+  for x in "${LANE_WORKFLOW_CONTRACTS[@]}"; do [[ "$x" == "$label" ]] && { out="${out}\"workflow-contracts\","; break; }; done
+  for x in "${LANE_RUNTIME_AND_KIT[@]}"; do [[ "$x" == "$label" ]] && { out="${out}\"runtime-and-kit\","; break; }; done
+  printf '%s' "${out%,}"
+}
+
+emit_manifest_json() {
+  # Machine-readable manifest: every lane-covered check as {id, command, lanes[]}.
+  # Only checks present in at least one LANE_* array are emitted (anti-gaming: a manifest
+  # command must run in a required lane by construction).
+  local entry label command id lanes first=1
+  printf '['
+  for entry in "${CHECKS[@]}"; do
+    label="${entry%%|*}"
+    command="${entry#*|}"
+    id="$(slugify "$label")"
+    lanes="$(_lanes_for_label "$label")"
+    [[ -z "$lanes" ]] && continue
+    if [[ $first -eq 1 ]]; then first=0; else printf ','; fi
+    printf '{"id":%s,"command":%s,"lanes":[%s]}' "$(_json_str "$id")" "$(_json_str "$command")" "$lanes"
+  done
+  printf ']\n'
+}
+
 active_lane() {
   printf '%s' "${FLOW_AGENTS_CI_LANE:-all}"
 }
@@ -306,6 +373,9 @@ case "${1:-}" in
   --finalize)
     finalize_results
     ;;
+  --manifest-json)
+    emit_manifest_json
+    ;;
   "")
     validate_active_lane || exit 2
     init_results
@@ -328,7 +398,7 @@ case "${1:-}" in
     finalize_results
     ;;
   *)
-    echo "Usage: $0 [--init|--check <check-id-or-label>|--finalize|--lane <lane>]" >&2
+    echo "Usage: $0 [--init|--check <check-id-or-label>|--finalize|--lane <lane>|--manifest-json]" >&2
     exit 2
     ;;
 esac

package/evals/fixtures/assignment-provider/actor-a.json

@@ -0,0 +1,6 @@
+{
+  "runtime": "claude-code",
+  "session_id": "eval-actor-a-session",
+  "host": "eval-host",
+  "human": null
+}

package/evals/fixtures/assignment-provider/actor-b.json

@@ -0,0 +1,6 @@
+{
+  "runtime": "claude-code",
+  "session_id": "eval-actor-b-session",
+  "host": "eval-host",
+  "human": null
+}

package/evals/fixtures/assignment-provider/github-issue-claimed.json

@@ -0,0 +1,27 @@
+{
+  "number": 4242,
+  "state": "OPEN",
+  "assignees": [
+    {
+      "login": "flow-agents-fixture-bot"
+    }
+  ],
+  "labels": [
+    {
+      "name": "agent:claimed"
+    },
+    {
+      "name": "kind:enhancement"
+    }
+  ],
+  "comments": [
+    {
+      "id": 90001,
+      "body": "An unrelated human comment on this fixture issue."
+    },
+    {
+      "id": 90002,
+      "body": "<!-- flow-agents:assignment-claim -->\n**Assignment claim** — Claimed by an automated agent session (claude-code).\n\n- actor: `claude-code:fixture-actor-a-session:fixture-host`\n- claimed_at: 2026-06-01T12:00:00Z\n- ttl_seconds: 1800\n- branch: `agent/claude-code-fixture-actor-a-session-fixture-host/flow-agents-4242`\n\n```json\n{\n  \"schema_version\": \"1.0\",\n  \"role\": \"AssignmentClaimRecord\",\n  \"subject_id\": \"kontourai/flow-agents#4242\",\n  \"actor\": {\n    \"runtime\": \"claude-code\",\n    \"session_id\": \"fixture-actor-a-session\",\n    \"host\": \"fixture-host\",\n    \"human\": null\n  },\n  \"claimed_at\": \"2026-06-01T12:00:00Z\",\n  \"ttl_seconds\": 1800,\n  \"branch\": \"agent/claude-code-fixture-actor-a-session-fixture-host/flow-agents-4242\",\n  \"artifact_dir\": \".kontourai/flow-agents/flow-agents-4242\",\n  \"status\": \"claimed\"\n}\n```"
+    }
+  ]
+}

package/evals/fixtures/assignment-provider/github-issue-unassigned.json

@@ -0,0 +1,7 @@
+{
+  "number": 4243,
+  "state": "OPEN",
+  "assignees": [],
+  "labels": [{ "name": "kind:enhancement" }],
+  "comments": [{ "id": 90101, "body": "No assignment claim recorded yet." }]
+}

package/evals/fixtures/assignment-provider/liveness-fresh.json

@@ -0,0 +1,9 @@
+[
+  {
+    "type": "claim",
+    "subjectId": "kontourai/flow-agents#4242",
+    "actor": "claude-code:fixture-actor-a-session:fixture-host",
+    "at": "2026-06-01T12:15:00Z",
+    "ttlSeconds": 1800
+  }
+]

package/evals/fixtures/assignment-provider/liveness-stale.json

@@ -0,0 +1,9 @@
+[
+  {
+    "type": "claim",
+    "subjectId": "kontourai/flow-agents#4242",
+    "actor": "claude-code:fixture-actor-a-session:fixture-host",
+    "at": "2026-06-01T10:00:00Z",
+    "ttlSeconds": 1800
+  }
+]

package/evals/fixtures/flow-kit-repository/invalid-bad-dependency/flows/review.flow.json

@@ -0,0 +1,26 @@
+{
+  "id": "example.review",
+  "version": "1.0",
+  "steps": [
+    { "id": "review", "next": "done" },
+    { "id": "done", "next": null }
+  ],
+  "gates": {
+    "review-gate": {
+      "step": "review",
+      "expects": [
+        {
+          "id": "review-evidence",
+          "kind": "trust.bundle",
+          "required": true,
+          "description": "Review evidence has been recorded.",
+          "bundle_claim": {
+            "claimType": "example.review.evidence",
+            "subjectType": "artifact",
+            "accepted_statuses": ["trusted", "accepted"]
+          }
+        }
+      ]
+    }
+  }
+}

package/evals/fixtures/flow-kit-repository/invalid-bad-dependency/kit.json

@@ -0,0 +1,13 @@
+{
+  "schema_version": "1.0",
+  "id": "bad-dependency-kit",
+  "name": "Bad Dependency Kit",
+  "product_name": "Bad Dependency Kit",
+  "description": "A valid container whose dependencies entry is malformed (missing kit_id) — used to assert dependency shape validation rejects it.",
+  "flows": [
+    { "id": "example.review", "path": "flows/review.flow.json", "description": "Review a small change." }
+  ],
+  "dependencies": [
+    { "reason": "this entry is intentionally missing a kit_id" }
+  ]
+}

package/evals/fixtures/flow-kit-repository/valid-with-dependency/flows/review.flow.json

@@ -0,0 +1,26 @@
+{
+  "id": "example.review",
+  "version": "1.0",
+  "steps": [
+    { "id": "review", "next": "done" },
+    { "id": "done", "next": null }
+  ],
+  "gates": {
+    "review-gate": {
+      "step": "review",
+      "expects": [
+        {
+          "id": "review-evidence",
+          "kind": "trust.bundle",
+          "required": true,
+          "description": "Review evidence has been recorded.",
+          "bundle_claim": {
+            "claimType": "example.review.evidence",
+            "subjectType": "artifact",
+            "accepted_statuses": ["trusted", "accepted"]
+          }
+        }
+      ]
+    }
+  }
+}

package/evals/fixtures/flow-kit-repository/valid-with-dependency/kit.json

@@ -0,0 +1,13 @@
+{
+  "schema_version": "1.0",
+  "id": "with-dependency-kit",
+  "name": "With Dependency Kit",
+  "product_name": "With Dependency Kit",
+  "description": "A valid Flow Kit that declares a well-formed cross-kit dependency on a kit that is deliberately never installed.",
+  "flows": [
+    { "id": "example.review", "path": "flows/review.flow.json", "description": "Review a small change." }
+  ],
+  "dependencies": [
+    { "kit_id": "nonexistent-dep-kit", "reason": "declared dependency deliberately absent from any registry or catalog" }
+  ]
+}

package/evals/fixtures/hook-influence/cases.json

@@ -140,6 +140,38 @@
         "status": "always-run-in-integration"
       }
     },
+    {
+      "id": "dev-builder-route-fresh-coding-prompt",
+      "description": "A fresh coding/build prompt with no active sidecar should still steer into Builder Kit delivery workflow before source edits. Claude Code must receive this as prompt-submit additional context through the hook adapter.",
+      "runtime_scope": ["claude-code", "codex", "kiro-cli"],
+      "hook": "workflow-steering",
+      "event": "UserPromptSubmit",
+      "fixture_state": {
+        "task_slug": "fresh-coding-prompt",
+        "status": "new",
+        "phase": "intake",
+        "active_flow_id": null,
+        "prompt": "Please implement the new settings API and update its tests."
+      },
+      "guidance_must_include": [
+        "BUILDER WORKFLOW ROUTE",
+        "activate `deliver`",
+        "--flow-id builder.build",
+        "plan-work -> execute-plan -> review-work -> verify-work",
+        "publish/release-readiness and learning-review"
+      ],
+      "agent_must_do": [
+        "activate Builder Kit delivery workflow before source edits or implementation commands",
+        "use deliver by default for coding/build work unless the user explicitly requested TDD",
+        "keep the session on builder.build and do not bypass plan-work -> execute-plan -> review-work -> verify-work",
+        "continue from local verification into publish, release readiness, and learning feedback"
+      ],
+      "evidence": {
+        "tier": "adapter",
+        "command": "bash evals/integration/test_workflow_steering_hook.sh",
+        "status": "always-run-in-integration"
+      }
+    },
     {
       "id": "codex-live-context-gap",
       "runtime_scope": ["codex"],

package/evals/fixtures/pull-work-provider/github-issues.json

@@ -3,7 +3,7 @@
     "number": 22,
     "title": "Define and validate Flow Kit repositories",
     "state": "OPEN",
-    "body": "## Problem\nExternal kit repositories need a validated contract.\n\n## Scope\n- Add contract docs.\n- Validate local kit folders.\n\n## Acceptance criteria\n- Valid fixture passes.\n- Invalid fixtures fail.\n\n## Dependencies\nRequires kontourai/flow#2.\n\n## Source artifact\n`.flow-agents/flow-agents-kit-platform-backlog/flow-agents-kit-platform-backlog--idea-to-backlog.md`",
+    "body": "## Problem\nExternal kit repositories need a validated contract.\n\n## Scope\n- Add contract docs.\n- Validate local kit folders.\n\n## Acceptance criteria\n- Valid fixture passes.\n- Invalid fixtures fail.\n\n## Dependencies\nRequires kontourai/flow#2.\n\n## Source artifact\n`.kontourai/flow-agents/flow-agents-kit-platform-backlog/flow-agents-kit-platform-backlog--idea-to-backlog.md`",
     "labels": [],
     "assignees": [],
     "milestone": null,
@@ -73,7 +73,7 @@
     "number": 97,
     "title": "Emit source revision metadata and structured blockers",
     "state": "OPEN",
-    "body": "## Problem\nDownstream pickup needs durable source revision and blocker metadata.\n\n## Scope\n- Emit provider-neutral work-item metadata.\n- Preserve human-readable blocker prose.\n\n## Acceptance criteria\n- Source revision fields normalize.\n- Structured blockers preserve provider refs and text blockers.\n\n## Dependencies / Blockers\nRequires kontourai/flow#2.\nBlocked by product decision on rollout scope.\n\n## Source artifact\n`.flow-agents/idea-to-backlog-source-revision-structured-blockers/idea-to-backlog-source-revision-structured-blockers--plan.md`\n\n<!-- flow-agents:work-item-metadata\n{\n  \"schema_version\": \"1.0\",\n  \"source_revisions\": [\n    {\n      \"repo\": \"kontourai/flow-agents\",\n      \"planned_base_ref\": \"main\",\n      \"planned_base_sha\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n      \"planned_at\": \"2026-06-03T03:23:14Z\",\n      \"planning_artifact_ref\": \".flow-agents/idea-to-backlog-source-revision-structured-blockers/idea-to-backlog-source-revision-structured-blockers--plan.md\",\n      \"planning_scope_refs\": [\n        \"kits/builder/skills/idea-to-backlog/SKILL.md\",\n        \"context/contracts/work-item-contract.md\"\n      ]\n    },\n    {\n      \"repo\": \"kontourai/flow\",\n      \"planned_base_ref\": \"main\",\n      \"planned_base_sha\": \"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\n      \"planned_at\": \"2026-06-03T03:23:14Z\",\n      \"planning_artifact_ref\": \".flow-agents/idea-to-backlog-source-revision-structured-blockers/idea-to-backlog-source-revision-structured-blockers--plan.md\",\n      \"planning_scope_refs\": [\"context/contracts/work-item-contract.md\"]\n    }\n  ],\n  \"blockers\": [\n    {\n      \"type\": \"work_item\",\n      \"ref\": \"kontourai/flow#2\",\n      \"status\": \"blocked\",\n      \"summary\": \"Requires Flow contract issue first.\"\n    },\n    {\n      \"type\": \"text\",\n      \"status\": \"blocked\",\n      \"summary\": \"Product decision on rollout scope.\"\n    }\n  ]\n}\n-->",
+    "body": "## Problem\nDownstream pickup needs durable source revision and blocker metadata.\n\n## Scope\n- Emit provider-neutral work-item metadata.\n- Preserve human-readable blocker prose.\n\n## Acceptance criteria\n- Source revision fields normalize.\n- Structured blockers preserve provider refs and text blockers.\n\n## Dependencies / Blockers\nRequires kontourai/flow#2.\nBlocked by product decision on rollout scope.\n\n## Source artifact\n`.kontourai/flow-agents/idea-to-backlog-source-revision-structured-blockers/idea-to-backlog-source-revision-structured-blockers--plan.md`\n\n<!-- flow-agents:work-item-metadata\n{\n  \"schema_version\": \"1.0\",\n  \"source_revisions\": [\n    {\n      \"repo\": \"kontourai/flow-agents\",\n      \"planned_base_ref\": \"main\",\n      \"planned_base_sha\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n      \"planned_at\": \"2026-06-03T03:23:14Z\",\n      \"planning_artifact_ref\": \".kontourai/flow-agents/idea-to-backlog-source-revision-structured-blockers/idea-to-backlog-source-revision-structured-blockers--plan.md\",\n      \"planning_scope_refs\": [\n        \"kits/builder/skills/idea-to-backlog/SKILL.md\",\n        \"context/contracts/work-item-contract.md\"\n      ]\n    },\n    {\n      \"repo\": \"kontourai/flow\",\n      \"planned_base_ref\": \"main\",\n      \"planned_base_sha\": \"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\n      \"planned_at\": \"2026-06-03T03:23:14Z\",\n      \"planning_artifact_ref\": \".kontourai/flow-agents/idea-to-backlog-source-revision-structured-blockers/idea-to-backlog-source-revision-structured-blockers--plan.md\",\n      \"planning_scope_refs\": [\"context/contracts/work-item-contract.md\"]\n    }\n  ],\n  \"blockers\": [\n    {\n      \"type\": \"work_item\",\n      \"ref\": \"kontourai/flow#2\",\n      \"status\": \"blocked\",\n      \"summary\": \"Requires Flow contract issue first.\"\n    },\n    {\n      \"type\": \"text\",\n      \"status\": \"blocked\",\n      \"summary\": \"Product decision on rollout scope.\"\n    }\n  ]\n}\n-->",
     "labels": [],
     "assignees": [],
     "milestone": null,
@@ -101,7 +101,7 @@
     "number": 110,
     "title": "Fresh planned item",
     "state": "OPEN",
-    "body": "## Scope\nUse fresh source revision metadata.\n\n## Acceptance criteria\nFreshness is verified.\n\n<!-- flow-agents:work-item-metadata\n{\n  \"schema_version\": \"1.0\",\n  \"planned_base_ref\": \"main\",\n  \"planned_base_sha\": \"cccccccccccccccccccccccccccccccccccccccc\",\n  \"planned_at\": \"2026-06-02T00:00:00Z\",\n  \"planning_artifact_ref\": \".flow-agents/fresh/fresh--plan.md\",\n  \"planning_scope_refs\": [\"kits/builder/skills/pull-work/SKILL.md\"]\n}\n-->",
+    "body": "## Scope\nUse fresh source revision metadata.\n\n## Acceptance criteria\nFreshness is verified.\n\n<!-- flow-agents:work-item-metadata\n{\n  \"schema_version\": \"1.0\",\n  \"planned_base_ref\": \"main\",\n  \"planned_base_sha\": \"cccccccccccccccccccccccccccccccccccccccc\",\n  \"planned_at\": \"2026-06-02T00:00:00Z\",\n  \"planning_artifact_ref\": \".kontourai/flow-agents/fresh/fresh--plan.md\",\n  \"planning_scope_refs\": [\"kits/builder/skills/pull-work/SKILL.md\"]\n}\n-->",
     "labels": [],
     "assignees": [],
     "milestone": null,
@@ -115,7 +115,7 @@
     "number": 111,
     "title": "Drifted planned item",
     "state": "OPEN",
-    "body": "## Scope\nUse drifted source revision metadata.\n\n## Acceptance criteria\nFreshness reports benign drift.\n\n<!-- flow-agents:work-item-metadata\n{\n  \"schema_version\": \"1.0\",\n  \"planned_base_ref\": \"main\",\n  \"planned_base_sha\": \"dddddddddddddddddddddddddddddddddddddddd\",\n  \"planned_at\": \"2026-06-01T00:00:00Z\",\n  \"planning_artifact_ref\": \".flow-agents/drifted/drifted--plan.md\",\n  \"planning_scope_refs\": [\"kits/builder/skills/pickup-probe/SKILL.md\"]\n}\n-->",
+    "body": "## Scope\nUse drifted source revision metadata.\n\n## Acceptance criteria\nFreshness reports benign drift.\n\n<!-- flow-agents:work-item-metadata\n{\n  \"schema_version\": \"1.0\",\n  \"planned_base_ref\": \"main\",\n  \"planned_base_sha\": \"dddddddddddddddddddddddddddddddddddddddd\",\n  \"planned_at\": \"2026-06-01T00:00:00Z\",\n  \"planning_artifact_ref\": \".kontourai/flow-agents/drifted/drifted--plan.md\",\n  \"planning_scope_refs\": [\"kits/builder/skills/pickup-probe/SKILL.md\"]\n}\n-->",
     "labels": [],
     "assignees": [],
     "milestone": null,
@@ -129,7 +129,7 @@
     "number": 112,
     "title": "Stale planned item",
     "state": "OPEN",
-    "body": "## Scope\nUse stale source revision metadata.\n\n## Acceptance criteria\nFreshness routes stale work.\n\n<!-- flow-agents:work-item-metadata\n{\n  \"schema_version\": \"1.0\",\n  \"planned_base_ref\": \"main\",\n  \"planned_base_sha\": \"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\",\n  \"planned_at\": \"2026-04-01T00:00:00Z\",\n  \"planning_artifact_ref\": \".flow-agents/stale/stale--plan.md\",\n  \"planning_scope_refs\": [\"context/contracts/work-item-contract.md\", \"kits/builder/skills/pull-work/SKILL.md\"]\n}\n-->",
+    "body": "## Scope\nUse stale source revision metadata.\n\n## Acceptance criteria\nFreshness routes stale work.\n\n<!-- flow-agents:work-item-metadata\n{\n  \"schema_version\": \"1.0\",\n  \"planned_base_ref\": \"main\",\n  \"planned_base_sha\": \"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\",\n  \"planned_at\": \"2026-04-01T00:00:00Z\",\n  \"planning_artifact_ref\": \".kontourai/flow-agents/stale/stale--plan.md\",\n  \"planning_scope_refs\": [\"context/contracts/work-item-contract.md\", \"kits/builder/skills/pull-work/SKILL.md\"]\n}\n-->",
     "labels": [],
     "assignees": [],
     "milestone": null,
@@ -143,7 +143,7 @@
     "number": 113,
     "title": "Legacy item missing planned base",
     "state": "OPEN",
-    "body": "## Scope\nPreserve legacy gap for missing planned_base_sha.\n\n## Acceptance criteria\nFreshness is not verified.\n\n<!-- flow-agents:work-item-metadata\n{\n  \"schema_version\": \"1.0\",\n  \"planned_base_ref\": \"main\",\n  \"planned_at\": \"2026-06-01T00:00:00Z\",\n  \"planning_artifact_ref\": \".flow-agents/legacy/legacy--plan.md\",\n  \"planning_scope_refs\": [\"kits/builder/skills/pull-work/SKILL.md\"]\n}\n-->",
+    "body": "## Scope\nPreserve legacy gap for missing planned_base_sha.\n\n## Acceptance criteria\nFreshness is not verified.\n\n<!-- flow-agents:work-item-metadata\n{\n  \"schema_version\": \"1.0\",\n  \"planned_base_ref\": \"main\",\n  \"planned_at\": \"2026-06-01T00:00:00Z\",\n  \"planning_artifact_ref\": \".kontourai/flow-agents/legacy/legacy--plan.md\",\n  \"planning_scope_refs\": [\"kits/builder/skills/pull-work/SKILL.md\"]\n}\n-->",
     "labels": [],
     "assignees": [],
     "milestone": null,

package/evals/fixtures/trust-reconcile-exploits/fabricated-attestation.json

@@ -0,0 +1,59 @@
+{
+  "schemaVersion": 5,
+  "source": "ws8-exploit-fixture:fabricated-attestation",
+  "note": "CONVERGED ITERATION-3 FINDING (both gates): a fully self-consistent, HAND-FABRICATED claim+evidence+event triple for a no-command, high-impact 'security' check. `record-evidence --check-json '{\"kind\":\"security\",\"status\":\"pass\",...}'` with no `command` field produces exactly this shape through the real producer CLI. `deriveClaimStatus` only proves bundle-internal self-consistency (claim references evidence, evidence references a verified event) — it cannot and does not prove the underlying attestation is true. This fixture is INDISTINGUISHABLE, at the reconciler's own re-derivation layer, from a genuinely reviewed security check. It MUST still pass (exit 0) — attestations are not blocked at L0, or every honest human-attestation use breaks — but it MUST be visibly, loudly marked as an unverified attestation (not a quiet SESSION-LOCAL OK indistinguishable from a reconciled check). See ADR 0020 Residuals.",
+  "claims": [
+    {
+      "id": "c-fabricated-security",
+      "claimType": "workflow.check.security",
+      "value": "pass",
+      "status": "verified",
+      "subjectId": "exploit/fabricated-security-review",
+      "facet": "flow-agents.workflow",
+      "subjectType": "workflow-check",
+      "fieldOrBehavior": "security review: no injection vectors found (fabricated, no command run)",
+      "createdAt": "2026-07-02T00:00:00Z",
+      "updatedAt": "2026-07-02T00:00:00Z",
+      "impactLevel": "high",
+      "verificationPolicyId": "policy:workflow.check.security:attestation"
+    }
+  ],
+  "evidence": [
+    {
+      "id": "ev-fabricated-security",
+      "claimId": "c-fabricated-security",
+      "evidenceType": "attestation",
+      "method": "corroboration",
+      "sourceRef": "exploit/evidence.json",
+      "excerptOrSummary": "Fabricated: reviewed for injection vectors, none found. No command was ever run to produce this text.",
+      "observedAt": "2026-07-02T00:00:00Z",
+      "collectedBy": "flow-agents/workflow-sidecar",
+      "passing": true
+    }
+  ],
+  "policies": [
+    {
+      "id": "policy:workflow.check.security:attestation",
+      "claimType": "workflow.check.security",
+      "requiredEvidence": ["attestation"],
+      "acceptanceCriteria": ["A verified verification event must support a workflow.check.security claim."],
+      "reviewAuthority": "system",
+      "validityRule": { "kind": "manual" },
+      "stalenessTriggers": [],
+      "conflictRules": [],
+      "impactLevel": "high"
+    }
+  ],
+  "events": [
+    {
+      "id": "evt-fabricated-security",
+      "claimId": "c-fabricated-security",
+      "status": "verified",
+      "actor": "flow-agents/workflow-sidecar",
+      "method": "corroboration",
+      "evidenceIds": ["ev-fabricated-security"],
+      "createdAt": "2026-07-02T00:00:00Z",
+      "verifiedAt": "2026-07-02T00:00:00Z"
+    }
+  ]
+}

package/evals/fixtures/trust-reconcile-exploits/no-label-bypass.json

@@ -0,0 +1,36 @@
+{
+  "schemaVersion": 5,
+  "source": "ws8-exploit-fixture:no-label-bypass",
+  "note": "REVIEWER EXPLOIT (finding 1): a fabricated kind:'test' claim produces test_output evidence with NO execution.label and no command. Pre-fix it slipped past both the reconcilable bucket (needs a label) and the not-run guard (which only checked the literal claimType workflow.check.command), passing as SESSION-LOCAL OK on self-reported status. It MUST now be a not-run divergence: a test_output claim reconciles against the manifest or it is a divergence, never session-local.",
+  "claims": [
+    {
+      "id": "c-fabricated-test",
+      "claimType": "workflow.check.test",
+      "value": "pass",
+      "status": "verified",
+      "subjectId": "exploit/unit-tests",
+      "facet": "flow-agents.workflow",
+      "subjectType": "workflow-check",
+      "fieldOrBehavior": "unit tests passed",
+      "createdAt": "2026-07-02T00:00:00Z",
+      "updatedAt": "2026-07-02T00:00:00Z",
+      "impactLevel": "high",
+      "verificationPolicyId": "policy:workflow.check.test"
+    }
+  ],
+  "evidence": [
+    {
+      "id": "ev-fabricated-test",
+      "claimId": "c-fabricated-test",
+      "evidenceType": "test_output",
+      "method": "validation",
+      "sourceRef": "exploit/evidence.json",
+      "excerptOrSummary": "unit tests passed",
+      "observedAt": "2026-07-02T00:00:00Z",
+      "collectedBy": "flow-agents/workflow-sidecar",
+      "passing": true
+    }
+  ],
+  "policies": [],
+  "events": []
+}

package/evals/fixtures/trust-reconcile-exploits/skip-assumed-bypass.json

@@ -0,0 +1,59 @@
+{
+  "schemaVersion": 5,
+  "source": "ws8-exploit-fixture:skip-assumed-bypass",
+  "note": "VERIFIER EXPLOIT (finding 2): a check with status 'skip' resolves Surface status 'assumed' via the skip->assumed mapping. Pre-fix, WS8's `assertsPass || status==='assumed'` accepted it as a silent SESSION-LOCAL OK pass with no waiver, no reason, no approver. It MUST now be an unwaived-assumed divergence: 'assumed' alone is not a pass; it requires a documented waiver.",
+  "claims": [
+    {
+      "id": "c-skipped",
+      "claimType": "workflow.check.external",
+      "value": "skip",
+      "status": "assumed",
+      "subjectId": "exploit/load-test",
+      "facet": "flow-agents.workflow",
+      "subjectType": "workflow-check",
+      "fieldOrBehavior": "load test",
+      "createdAt": "2026-07-02T00:00:00Z",
+      "updatedAt": "2026-07-02T00:00:00Z",
+      "impactLevel": "high",
+      "verificationPolicyId": "policy:workflow.check.external:attestation"
+    }
+  ],
+  "evidence": [
+    {
+      "id": "ev-skipped",
+      "claimId": "c-skipped",
+      "evidenceType": "attestation",
+      "method": "attestation",
+      "sourceRef": "exploit/evidence.json",
+      "excerptOrSummary": "load test skipped",
+      "observedAt": "2026-07-02T00:00:00Z",
+      "collectedBy": "flow-agents/workflow-sidecar",
+      "passing": true
+    }
+  ],
+  "policies": [
+    {
+      "id": "policy:workflow.check.external:attestation",
+      "claimType": "workflow.check.external",
+      "requiredEvidence": ["attestation"],
+      "acceptanceCriteria": ["A verified verification event must support a workflow.check.external claim."],
+      "reviewAuthority": "system",
+      "validityRule": { "kind": "manual" },
+      "stalenessTriggers": [],
+      "conflictRules": [],
+      "impactLevel": "high"
+    }
+  ],
+  "events": [
+    {
+      "id": "evt-skipped",
+      "claimId": "c-skipped",
+      "status": "assumed",
+      "actor": "flow-agents/workflow-sidecar",
+      "method": "attestation",
+      "evidenceIds": ["ev-skipped"],
+      "createdAt": "2026-07-02T00:00:00Z",
+      "verifiedAt": "2026-07-02T00:00:00Z"
+    }
+  ]
+}

package/evals/fixtures/trust-reconcile-exploits/status-misassertion.json

@@ -0,0 +1,48 @@
+{
+  "schemaVersion": 5,
+  "source": "ws8-exploit-fixture:status-misassertion",
+  "note": "EXPLOIT (finding 3): a session-local claim hand-asserts status 'verified' while the bundle's OWN evidence/events do not derive verified (no verified event → Surface derives 'proposed'). The reconciler must re-derive CI-side and NEVER trust claim.status verbatim; the asserted/derived mismatch is a status-misassertion divergence.",
+  "claims": [
+    {
+      "id": "c-lied-status",
+      "claimType": "workflow.check.external",
+      "value": "pass",
+      "status": "verified",
+      "subjectId": "exploit/manual-review",
+      "facet": "flow-agents.workflow",
+      "subjectType": "workflow-check",
+      "fieldOrBehavior": "manual review claimed verified without a verified event",
+      "createdAt": "2026-07-02T00:00:00Z",
+      "updatedAt": "2026-07-02T00:00:00Z",
+      "impactLevel": "high",
+      "verificationPolicyId": "policy:workflow.check.external:human_attestation"
+    }
+  ],
+  "evidence": [
+    {
+      "id": "ev-lied-status",
+      "claimId": "c-lied-status",
+      "evidenceType": "human_attestation",
+      "method": "attestation",
+      "sourceRef": "exploit/evidence.json",
+      "excerptOrSummary": "reviewer note",
+      "observedAt": "2026-07-02T00:00:00Z",
+      "collectedBy": "flow-agents/workflow-sidecar",
+      "passing": true
+    }
+  ],
+  "policies": [
+    {
+      "id": "policy:workflow.check.external:human_attestation",
+      "claimType": "workflow.check.external",
+      "requiredEvidence": ["human_attestation"],
+      "acceptanceCriteria": ["A verified verification event must support a workflow.check.external claim."],
+      "reviewAuthority": "system",
+      "validityRule": { "kind": "manual" },
+      "stalenessTriggers": [],
+      "conflictRules": [],
+      "impactLevel": "high"
+    }
+  ],
+  "events": []
+}