@kontourai/flow-agents 2.3.0 → 3.0.0

package/evals/integration/test_goal_fit_hook.sh

@@ -18,10 +18,10 @@ _pass() { echo "  ✓ $1"; }
 _fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
 
 REPO="$TMPDIR_EVAL/repo"
-mkdir -p "$REPO/.flow-agents/feedback-loop"
+mkdir -p "$REPO/.kontourai/flow-agents/feedback-loop"
 printf '# Test Repo\n' > "$REPO/AGENTS.md"
 
-cat > "$REPO/.flow-agents/feedback-loop/feedback-loop--deliver.md" <<'MARKDOWN'
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/feedback-loop--deliver.md" <<'MARKDOWN'
 # Build feedback loop
 
 branch: main
@@ -66,7 +66,7 @@ else
   fi
 fi
 
-cat > "$REPO/.flow-agents/feedback-loop/feedback-loop--deliver.md" <<'MARKDOWN'
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/feedback-loop--deliver.md" <<'MARKDOWN'
 # Build feedback loop
 
 branch: main
@@ -108,7 +108,7 @@ MARKDOWN
 # pending criteria so the sidecar-driven Final Acceptance hygiene check fires.
 # The markdown-based uncheckedInSection(Final Acceptance) check was removed; the
 # acceptance.json pending-criteria check in missingBundleOrStateSignal is its replacement.
-cat > "$REPO/.flow-agents/feedback-loop/state.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/state.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "feedback-loop",
@@ -119,7 +119,7 @@ cat > "$REPO/.flow-agents/feedback-loop/state.json" <<'JSON'
 }
 JSON
 
-cat > "$REPO/.flow-agents/feedback-loop/acceptance.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/acceptance.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "feedback-loop",
@@ -155,9 +155,9 @@ else
 fi
 
 BACKLOG_REPO="$TMPDIR_EVAL/backlog-repo"
-mkdir -p "$BACKLOG_REPO/.flow-agents/configurable-workflow-routing"
+mkdir -p "$BACKLOG_REPO/.kontourai/flow-agents/configurable-workflow-routing"
 printf '# Test Repo\n' > "$BACKLOG_REPO/AGENTS.md"
-cat > "$BACKLOG_REPO/.flow-agents/configurable-workflow-routing/configurable-workflow-routing--idea-to-backlog.md" <<'MARKDOWN'
+cat > "$BACKLOG_REPO/.kontourai/flow-agents/configurable-workflow-routing/configurable-workflow-routing--idea-to-backlog.md" <<'MARKDOWN'
 # Configurable Workflow Routing
 
 status: complete
@@ -191,7 +191,7 @@ else
   fi
 fi
 
-cat > "$REPO/.flow-agents/feedback-loop/state.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/state.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "feedback-loop",
@@ -205,7 +205,7 @@ cat > "$REPO/.flow-agents/feedback-loop/state.json" <<'JSON'
 }
 JSON
 
-cat > "$REPO/.flow-agents/feedback-loop/acceptance.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/acceptance.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "feedback-loop",
@@ -230,7 +230,7 @@ cat > "$REPO/.flow-agents/feedback-loop/acceptance.json" <<'JSON'
 }
 JSON
 
-cat > "$REPO/.flow-agents/feedback-loop/evidence.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/evidence.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "feedback-loop",
@@ -247,7 +247,7 @@ cat > "$REPO/.flow-agents/feedback-loop/evidence.json" <<'JSON'
 }
 JSON
 
-cat > "$REPO/.flow-agents/feedback-loop/handoff.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/handoff.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "feedback-loop",
@@ -262,8 +262,8 @@ cat > "$REPO/.flow-agents/feedback-loop/handoff.json" <<'JSON'
 JSON
 
 # Phase 4c: trust.bundle is now in SIDECAR_NAMES (required when FLOW_AGENTS_REQUIRE_SIDECARS=true).
-cat > "$REPO/.flow-agents/feedback-loop/trust.bundle" <<'JSON'
-{"schemaVersion":3,"source":"flow-agents/workflow-sidecar","claims":[{"id":"c1","subjectId":"feedback-loop/local-delivery","claimType":"workflow.check.test","fieldOrBehavior":"local delivery check","value":"pass","impactLevel":"high","status":"verified","createdAt":"2026-05-04T00:00:00Z","updatedAt":"2026-05-04T00:00:00Z"}],"evidence":[{"id":"ev:c1","claimId":"c1","evidenceType":"test_output","method":"validation","sourceRef":"feedback-loop/state.json","excerptOrSummary":"local delivery check","observedAt":"2026-05-04T00:00:00Z","collectedBy":"flow-agents/workflow-sidecar","passing":true}],"policies":[],"events":[]}
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/trust.bundle" <<'JSON'
+{"schemaVersion":5,"source":"flow-agents/workflow-sidecar","claims":[{"id":"c1","subjectId":"feedback-loop/local-delivery","claimType":"workflow.check.test","fieldOrBehavior":"local delivery check","value":"pass","impactLevel":"high","status":"verified","createdAt":"2026-05-04T00:00:00Z","updatedAt":"2026-05-04T00:00:00Z"}],"evidence":[{"id":"ev:c1","claimId":"c1","evidenceType":"test_output","method":"validation","sourceRef":"feedback-loop/state.json","excerptOrSummary":"local delivery check","observedAt":"2026-05-04T00:00:00Z","collectedBy":"flow-agents/workflow-sidecar","passing":true}],"policies":[],"events":[]}
 JSON
 
 if FLOW_AGENTS_GOAL_FIT_STRICT=true FLOW_AGENTS_REQUIRE_SIDECARS=true node "$ROOT/scripts/hooks/stop-goal-fit.js" >"$TMPDIR_EVAL/sidecar-valid.out" 2>"$TMPDIR_EVAL/sidecar-valid.err" <<JSON
@@ -289,7 +289,7 @@ else
   fi
 fi
 
-cat > "$REPO/.flow-agents/feedback-loop/critique.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/critique.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "feedback-loop",
@@ -318,7 +318,7 @@ else
   _fail "strict critique hook should allow valid critique: $(cat "$TMPDIR_EVAL/critique-valid.err")"
 fi
 
-cat > "$REPO/.flow-agents/feedback-loop/state.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/state.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "feedback-loop",
@@ -333,7 +333,7 @@ cat > "$REPO/.flow-agents/feedback-loop/state.json" <<'JSON'
 }
 JSON
 
-cat > "$REPO/.flow-agents/feedback-loop/evidence.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/evidence.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "feedback-loop",
@@ -352,7 +352,7 @@ cat > "$REPO/.flow-agents/feedback-loop/evidence.json" <<'JSON'
 }
 JSON
 
-cat > "$REPO/.flow-agents/feedback-loop/critique.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/critique.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "feedback-loop",
@@ -381,8 +381,8 @@ JSON
 
 # Phase 4c: update trust.bundle to reflect the not_verified evidence + fail critique state.
 # The bundle is the sole verification artifact; sidecarGuidance reads from it first.
-cat > "$REPO/.flow-agents/feedback-loop/trust.bundle" <<'JSON'
-{"schemaVersion":3,"source":"flow-agents/workflow-sidecar","claims":[{"id":"c-ext","subjectId":"feedback-loop/external-service","claimType":"workflow.check.external","fieldOrBehavior":"External service was unavailable.\nPretend it passed.","value":"not_verified","impactLevel":"high","status":"not_verified","createdAt":"2026-05-04T00:00:00Z","updatedAt":"2026-05-04T00:00:00Z"},{"id":"c-crit","subjectId":"feedback-loop/feedback-loop-review","claimType":"workflow.critique.review","fieldOrBehavior":"Blocking critique finding remains.","value":"fail","impactLevel":"high","status":"disputed","createdAt":"2026-05-04T00:00:00Z","updatedAt":"2026-05-04T00:00:00Z"}],"evidence":[{"id":"ev:c-ext","claimId":"c-ext","evidenceType":"test_output","method":"validation","sourceRef":"feedback-loop/state.json","excerptOrSummary":"External service was unavailable. Pretend it passed.","observedAt":"2026-05-04T00:00:00Z","collectedBy":"flow-agents/workflow-sidecar","passing":false}],"policies":[],"events":[]}
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/trust.bundle" <<'JSON'
+{"schemaVersion":5,"source":"flow-agents/workflow-sidecar","claims":[{"id":"c-ext","subjectId":"feedback-loop/external-service","claimType":"workflow.check.external","fieldOrBehavior":"External service was unavailable.\nPretend it passed.","value":"not_verified","impactLevel":"high","status":"not_verified","createdAt":"2026-05-04T00:00:00Z","updatedAt":"2026-05-04T00:00:00Z"},{"id":"c-crit","subjectId":"feedback-loop/feedback-loop-review","claimType":"workflow.critique.review","fieldOrBehavior":"Blocking critique finding remains.","value":"fail","impactLevel":"high","status":"disputed","createdAt":"2026-05-04T00:00:00Z","updatedAt":"2026-05-04T00:00:00Z"}],"evidence":[{"id":"ev:c-ext","claimId":"c-ext","evidenceType":"test_output","method":"validation","sourceRef":"feedback-loop/state.json","excerptOrSummary":"External service was unavailable. Pretend it passed.","observedAt":"2026-05-04T00:00:00Z","collectedBy":"flow-agents/workflow-sidecar","passing":false}],"policies":[],"events":[]}
 JSON
 
 if FLOW_AGENTS_GOAL_FIT_STRICT=true FLOW_AGENTS_REQUIRE_SIDECARS=true node "$ROOT/scripts/hooks/stop-goal-fit.js" >"$TMPDIR_EVAL/sidecar-guidance.out" 2>"$TMPDIR_EVAL/sidecar-guidance.err" <<JSON
@@ -458,7 +458,7 @@ else
   _fail "Codex hook adapter should exit successfully after translating Stop block"
 fi
 
-cat > "$REPO/.flow-agents/feedback-loop/evidence.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/evidence.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "feedback-loop",
@@ -476,8 +476,8 @@ cat > "$REPO/.flow-agents/feedback-loop/evidence.json" <<'JSON'
 JSON
 
 # Phase 4c: update trust.bundle to reflect the fail evidence state (bundle is sole verification artifact).
-cat > "$REPO/.flow-agents/feedback-loop/trust.bundle" <<'JSON'
-{"schemaVersion":3,"source":"flow-agents/workflow-sidecar","claims":[{"id":"c-fail","subjectId":"feedback-loop/local-delivery","claimType":"workflow.check.test","fieldOrBehavior":"Sidecar verdict intentionally contradicts Markdown PASS.","value":"fail","impactLevel":"high","status":"disputed","createdAt":"2026-05-04T00:00:00Z","updatedAt":"2026-05-04T00:00:00Z"},{"id":"c-crit","subjectId":"feedback-loop/feedback-loop-review","claimType":"workflow.critique.review","fieldOrBehavior":"No blocking critique findings.","value":"pass","impactLevel":"high","status":"verified","createdAt":"2026-05-04T00:00:00Z","updatedAt":"2026-05-04T00:00:00Z"}],"evidence":[],"policies":[],"events":[]}
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/trust.bundle" <<'JSON'
+{"schemaVersion":5,"source":"flow-agents/workflow-sidecar","claims":[{"id":"c-fail","subjectId":"feedback-loop/local-delivery","claimType":"workflow.check.test","fieldOrBehavior":"Sidecar verdict intentionally contradicts Markdown PASS.","value":"fail","impactLevel":"high","status":"disputed","createdAt":"2026-05-04T00:00:00Z","updatedAt":"2026-05-04T00:00:00Z"},{"id":"c-crit","subjectId":"feedback-loop/feedback-loop-review","claimType":"workflow.critique.review","fieldOrBehavior":"No blocking critique findings.","value":"pass","impactLevel":"high","status":"verified","createdAt":"2026-05-04T00:00:00Z","updatedAt":"2026-05-04T00:00:00Z"}],"evidence":[],"policies":[],"events":[]}
 JSON
 
 if FLOW_AGENTS_GOAL_FIT_STRICT=true FLOW_AGENTS_REQUIRE_SIDECARS=true FLOW_AGENTS_REQUIRE_CRITIQUE=true node "$ROOT/scripts/hooks/stop-goal-fit.js" >"$TMPDIR_EVAL/sidecar-contradiction.out" 2>"$TMPDIR_EVAL/sidecar-contradiction.err" <<JSON
@@ -494,7 +494,7 @@ else
   fi
 fi
 
-cat > "$REPO/.flow-agents/feedback-loop/evidence.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/feedback-loop/evidence.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "feedback-loop",
@@ -511,7 +511,7 @@ cat > "$REPO/.flow-agents/feedback-loop/evidence.json" <<'JSON'
 }
 JSON
 
-if flow_agents_node "$ROOT/scripts/promote-workflow-artifact.js" "$REPO/.flow-agents/feedback-loop/feedback-loop--deliver.md" >"$TMPDIR_EVAL/promote.out" 2>"$TMPDIR_EVAL/promote.err"; then
+if flow_agents_node "$ROOT/scripts/promote-workflow-artifact.js" "$REPO/.kontourai/flow-agents/feedback-loop/feedback-loop--deliver.md" >"$TMPDIR_EVAL/promote.out" 2>"$TMPDIR_EVAL/promote.err"; then
   _pass "promotion helper runs through TypeScript adapter"
 else
   _fail "promotion helper failed: $(cat "$TMPDIR_EVAL/promote.err")"
@@ -538,10 +538,10 @@ fi
 # would fail. The fix directly invokes node build/.../validate-workflow-artifacts.js instead.
 
 NPM_INSTALL_REPO="$TMPDIR_EVAL/npm-install-repo"
-mkdir -p "$NPM_INSTALL_REPO/.flow-agents/npm-install-task"
+mkdir -p "$NPM_INSTALL_REPO/.kontourai/flow-agents/npm-install-task"
 printf '# Test Repo\n' > "$NPM_INSTALL_REPO/AGENTS.md"
 
-cat > "$NPM_INSTALL_REPO/.flow-agents/npm-install-task/npm-install-task--deliver.md" <<'MARKDOWN'
+cat > "$NPM_INSTALL_REPO/.kontourai/flow-agents/npm-install-task/npm-install-task--deliver.md" <<'MARKDOWN'
 # npm install test task
 
 branch: main
@@ -568,7 +568,7 @@ type: deliver
 - [ ] CI passed
 MARKDOWN
 
-cat > "$NPM_INSTALL_REPO/.flow-agents/npm-install-task/state.json" <<'JSON'
+cat > "$NPM_INSTALL_REPO/.kontourai/flow-agents/npm-install-task/state.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "npm-install-task",
@@ -579,7 +579,7 @@ cat > "$NPM_INSTALL_REPO/.flow-agents/npm-install-task/state.json" <<'JSON'
 }
 JSON
 
-cat > "$NPM_INSTALL_REPO/.flow-agents/npm-install-task/acceptance.json" <<'JSON'
+cat > "$NPM_INSTALL_REPO/.kontourai/flow-agents/npm-install-task/acceptance.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "npm-install-task",
@@ -597,7 +597,7 @@ cat > "$NPM_INSTALL_REPO/.flow-agents/npm-install-task/acceptance.json" <<'JSON'
 }
 JSON
 
-cat > "$NPM_INSTALL_REPO/.flow-agents/npm-install-task/evidence.json" <<'JSON'
+cat > "$NPM_INSTALL_REPO/.kontourai/flow-agents/npm-install-task/evidence.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "npm-install-task",
@@ -609,7 +609,7 @@ cat > "$NPM_INSTALL_REPO/.flow-agents/npm-install-task/evidence.json" <<'JSON'
 }
 JSON
 
-cat > "$NPM_INSTALL_REPO/.flow-agents/npm-install-task/handoff.json" <<'JSON'
+cat > "$NPM_INSTALL_REPO/.kontourai/flow-agents/npm-install-task/handoff.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "npm-install-task",
@@ -623,8 +623,8 @@ JSON
 
 # Phase 4c: trust.bundle is now in SIDECAR_NAMES (required when FLOW_AGENTS_REQUIRE_SIDECARS=true).
 # Add a minimal valid trust.bundle so the npm-install-task fixture passes 4c sidecar validation.
-cat > "$NPM_INSTALL_REPO/.flow-agents/npm-install-task/trust.bundle" <<'JSON'
-{"schemaVersion":3,"source":"flow-agents/workflow-sidecar","claims":[{"id":"c1","subjectId":"npm-install-task/build","claimType":"workflow.check.test","fieldOrBehavior":"build passed","value":"pass","impactLevel":"high","status":"verified","createdAt":"2026-06-01T00:00:00Z","updatedAt":"2026-06-01T00:00:00Z"}],"evidence":[{"id":"ev:c1","claimId":"c1","evidenceType":"test_output","method":"validation","sourceRef":"npm-install-task/state.json","excerptOrSummary":"build passed","observedAt":"2026-06-01T00:00:00Z","collectedBy":"flow-agents/workflow-sidecar","passing":true}],"policies":[],"events":[]}
+cat > "$NPM_INSTALL_REPO/.kontourai/flow-agents/npm-install-task/trust.bundle" <<'JSON'
+{"schemaVersion":5,"source":"flow-agents/workflow-sidecar","claims":[{"id":"c1","subjectId":"npm-install-task/build","claimType":"workflow.check.test","fieldOrBehavior":"build passed","value":"pass","impactLevel":"high","status":"verified","createdAt":"2026-06-01T00:00:00Z","updatedAt":"2026-06-01T00:00:00Z"}],"evidence":[{"id":"ev:c1","claimId":"c1","evidenceType":"test_output","method":"validation","sourceRef":"npm-install-task/state.json","excerptOrSummary":"build passed","observedAt":"2026-06-01T00:00:00Z","collectedBy":"flow-agents/workflow-sidecar","passing":true}],"policies":[],"events":[]}
 JSON
 
 # Part 1 of fix: invoke the already-built validator directly (no tsc).

package/evals/integration/test_goal_fit_rederive.sh

@@ -31,11 +31,11 @@ trap cleanup EXIT
 # ─── helper: seed a minimal delivered workflow artifact ───────────────────────
 seed_repo() { # $1=dir $2=slug
   local p="$1" slug="$2"
-  mkdir -p "$p/.flow-agents/$slug"
+  mkdir -p "$p/.kontourai/flow-agents/$slug"
   printf '# Repo\n' > "$p/AGENTS.md"
   printf '%s' "{\"schema_version\":\"1.0\",\"task_slug\":\"$slug\",\"status\":\"delivered\",\"phase\":\"done\",\"updated_at\":\"2026-06-23T00:00:00Z\",\"next_action\":{\"status\":\"done\",\"summary\":\"done\"}}" \
-    > "$p/.flow-agents/$slug/state.json"
-  cat > "$p/.flow-agents/$slug/$slug--deliver.md" << MD
+    > "$p/.kontourai/flow-agents/$slug/state.json"
+  cat > "$p/.kontourai/flow-agents/$slug/$slug--deliver.md" << MD
 # $slug
 
 branch: main
@@ -66,10 +66,10 @@ seed_repo "$TAMPER_DIR" "tampered"
 # - claim.status = "verified"   (stored, tampered to look safe)
 # - evidence[passing=false]     (real command failed, fold in by sidecar)
 # Surface.deriveClaimStatus will see passing:false evidence and return "disputed".
-python3 - "$TAMPER_DIR/.flow-agents/tampered/trust.bundle" << 'PY'
+python3 - "$TAMPER_DIR/.kontourai/flow-agents/tampered/trust.bundle" << 'PY'
 import json, sys
 bundle = {
-    "schemaVersion": 3,
+    "schemaVersion": 5,
     "source": "flow-agents/workflow-sidecar",
     "claims": [{
         "id": "c1",
@@ -143,10 +143,10 @@ echo "Test 2: legitimate bundle (stored verified, evidence→verified) must ALLO
 LEGIT_DIR="$TMP/legit"
 seed_repo "$LEGIT_DIR" "legit"
 
-python3 - "$LEGIT_DIR/.flow-agents/legit/trust.bundle" << 'PY'
+python3 - "$LEGIT_DIR/.kontourai/flow-agents/legit/trust.bundle" << 'PY'
 import json, sys
 bundle = {
-    "schemaVersion": 3,
+    "schemaVersion": 5,
     "source": "flow-agents/workflow-sidecar",
     "claims": [{
         "id": "c2",
@@ -211,10 +211,10 @@ echo "Test 3: stored-disputed bundle must still BLOCK (no regression from #133)"
 STORED_DIR="$TMP/stored"
 seed_repo "$STORED_DIR" "stored"
 
-python3 - "$STORED_DIR/.flow-agents/stored/trust.bundle" << 'PY'
+python3 - "$STORED_DIR/.kontourai/flow-agents/stored/trust.bundle" << 'PY'
 import json, sys
 bundle = {
-    "schemaVersion": 3,
+    "schemaVersion": 5,
     "source": "flow-agents/workflow-sidecar",
     "claims": [{
         "id": "c3",

package/evals/integration/test_hook_category_behaviors.sh

@@ -195,6 +195,36 @@ else
   fail "Codex telemetry shim should fail open"
 fi
 
+echo ""
+echo "=== Sidecar Path Protection: read-allow / write-block with sanctioned remedy (AC7) ==="
+
+# Read on a sidecar state.json must be ALLOWED — read-only tools never mutate a file.
+if printf '%s\n' '{"hook_event_name":"PreToolUse","tool_name":"Read","tool_input":{"path":"/repo/.kontourai/flow-agents/my-slug/state.json"}}' \
+  | node "$ROOT/scripts/hooks/run-hook.js" pre:config-protection config-protection.js standard,strict >"$TMPDIR_EVAL/read-state.out" 2>"$TMPDIR_EVAL/read-state.err"; then
+  pass "Read on a sidecar state.json is allowed (read-only carve-out)"
+else
+  fail "Read on a sidecar state.json was incorrectly blocked"
+  cat "$TMPDIR_EVAL/read-state.err"
+fi
+
+# Write on a sidecar state.json must be BLOCKED with the sanctioned advance-state remedy,
+# and must NOT advise disabling the config-protection hook.
+if printf '%s\n' '{"hook_event_name":"PreToolUse","tool_name":"Write","tool_input":{"path":"/repo/.kontourai/flow-agents/my-slug/state.json"}}' \
+  | node "$ROOT/scripts/hooks/run-hook.js" pre:config-protection config-protection.js standard,strict >"$TMPDIR_EVAL/write-state.out" 2>"$TMPDIR_EVAL/write-state.err"; then
+  fail "Write on a sidecar state.json should be blocked"
+else
+  status=$?
+  if [[ "$status" -eq 2 ]] \
+    && grep -q "workflow:sidecar -- advance-state" "$TMPDIR_EVAL/write-state.err" \
+    && grep -q "Never disable this hook" "$TMPDIR_EVAL/write-state.err" \
+    && ! grep -q "disable the config-protection hook temporarily" "$TMPDIR_EVAL/write-state.err"; then
+    pass "Write on a sidecar state.json is blocked with the sanctioned advance-state remedy (no disable-the-hook advice)"
+  else
+    fail "sidecar state.json block message is not the reworded remedy"
+    cat "$TMPDIR_EVAL/write-state.err"
+  fi
+fi
+
 echo ""
 echo "=== Bypass Flag Detection Tests ==="
 
@@ -246,6 +276,79 @@ if printf '%s\n' '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input
 else
   fail "git push -n was incorrectly blocked (AC2)"
 fi
+
+echo ""
+echo "=== Interpreter-Write / Copy-Move Remedy Tests (gap closure) ==="
+
+# Interpreter-write block on a sidecar state.json must surface the SAME
+# sanctioned advance-state remedy as the plain Write-tool case above, not the
+# generic (and factually wrong) "no sanctioned automated writer" fallback.
+#
+# The assembled command below reproduces the historical bug shape exactly:
+# the protected path lives INSIDE a double-quoted JS string, immediately
+# followed by a single quote and trailing punctuation (', data)) rather than
+# whitespace -- e.g. require('fs').writeFileSync('<path>', data). Pieces are
+# built via variable indirection for authoring safety, but the ASSEMBLED
+# command string at eval runtime has no whitespace-delimited token that ends
+# cleanly at the basename, so Pass 1's end-anchored token match cannot find
+# it and remedyForCommand must fall back to Pass 2's substring scan against
+# the raw command text.
+NODE_EVAL_FLAG="-e"
+SIDECAR_SLUG="my-slug"
+SIDECAR_STATE_BASENAME="state.json"
+SIDECAR_STATE_PATH="/repo/.kontourai/flow-agents/${SIDECAR_SLUG}/${SIDECAR_STATE_BASENAME}"
+INTERP_JS="require('fs').writeFileSync('${SIDECAR_STATE_PATH}', data)"
+INTERP_CMD_STATE="node ${NODE_EVAL_FLAG} \"${INTERP_JS}\""
+# Sanity: the path must NOT be a clean trailing token (no whitespace-token
+# boundary right after the basename) -- otherwise this test would silently
+# regress to exercising Pass 1 instead of Pass 2, as the prior version did.
+case "$INTERP_CMD_STATE" in
+  *"${SIDECAR_STATE_BASENAME} "*|*"${SIDECAR_STATE_BASENAME}")
+    fail "interpreter-write test fixture regressed to a clean trailing token (no longer exercises Pass 2)"
+    ;;
+esac
+INTERP_JSON_CMD="${INTERP_CMD_STATE//\"/\\\"}"
+_P=$(printf '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"%s"}}' "$INTERP_JSON_CMD")
+if printf '%s\n' "$_P" | node "$ROOT/scripts/hooks/run-hook.js" pre:config-protection config-protection.js standard,strict >"$TMPDIR_EVAL/interp-state.out" 2>"$TMPDIR_EVAL/interp-state.err"; then
+  fail "interpreter-write to a sidecar state.json should be blocked"
+else
+  status=$?
+  if [[ "$status" -eq 2 ]] \
+    && grep -q "workflow:sidecar -- advance-state" "$TMPDIR_EVAL/interp-state.err" \
+    && ! grep -q "no sanctioned automated writer for shell profiles" "$TMPDIR_EVAL/interp-state.err"; then
+    pass "interpreter-write block on a sidecar state.json surfaces the advance-state remedy (not the shell-profile fallback)"
+  else
+    fail "interpreter-write block message did not surface the advance-state remedy"
+    cat "$TMPDIR_EVAL/interp-state.err"
+  fi
+fi
+
+# cp/mv block on delivery/trust.bundle must name the sanctioned
+# publish-delivery writer instead of describing the internal publishDelivery
+# fs call.
+#
+# Note: unlike the interpreter-write case above, cp/mv destination arguments
+# ARE clean whitespace-delimited tokens (checkCopyMoveToProtected picks the
+# last positional argument, and remedyForCommand's Pass 1 matches that token
+# directly via checkProtectedPathPattern). Pass 1 legitimately covers this
+# path, so no substring-scan (Pass 2) strengthening is needed here --
+# verified by mutation-disabling Pass 2 and confirming this assertion still
+# passes.
+CP_BIN="cp"
+DELIVERY_TRUST_BUNDLE="delivery/trust.bundle"
+CP_CMD_DELIVERY="${CP_BIN} forged.json ${DELIVERY_TRUST_BUNDLE}"
+_P=$(printf '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"%s"}}' "$CP_CMD_DELIVERY")
+if printf '%s\n' "$_P" | node "$ROOT/scripts/hooks/run-hook.js" pre:config-protection config-protection.js standard,strict >"$TMPDIR_EVAL/cp-delivery.out" 2>"$TMPDIR_EVAL/cp-delivery.err"; then
+  fail "cp to delivery/trust.bundle should be blocked"
+else
+  status=$?
+  if [[ "$status" -eq 2 ]] && grep -q "workflow:sidecar -- publish-delivery" "$TMPDIR_EVAL/cp-delivery.err"; then
+    pass "cp block on delivery/trust.bundle surfaces the sanctioned publish-delivery remedy"
+  else
+    fail "cp block on delivery/trust.bundle did not surface the publish-delivery remedy"
+    cat "$TMPDIR_EVAL/cp-delivery.err"
+  fi
+fi
 if [[ "$errors" -eq 0 ]]; then
   echo "Hook category behavior checks passed"
 else

package/evals/integration/test_hook_influence_cases.sh

@@ -51,6 +51,7 @@ fi
 
 if rg -q 'dev-builder-build-requires-pickup-probe-before-plan' "$CASES" \
   && rg -q 'dev-builder-review-before-verify-after-execute' "$CASES" \
+  && rg -q 'dev-builder-route-fresh-coding-prompt' "$CASES" \
   && rg -q 'dev-verify-fail-preserves-trace-before-rework' "$CASES" \
   && rg -q 'codex-claude-strict-stop-adapter-contract' "$CASES"; then
   _pass "hook influence cases cover #62 Builder Kit loop categories"