@kontourai/flow-agents 2.3.0 → 3.0.0

package/evals/integration/test_usage_feedback_global.sh

@@ -20,16 +20,16 @@ echo ""
 global="$TMPDIR_EVAL/global"
 repo_a="$TMPDIR_EVAL/repo-a"
 repo_b="$TMPDIR_EVAL/repo-b"
-mkdir -p "$repo_a/.flow-agents/alpha" "$repo_b/.flow-agents/beta"
+mkdir -p "$repo_a/.kontourai/flow-agents/alpha" "$repo_b/.kontourai/flow-agents/beta"
 
-cat > "$repo_a/.flow-agents/alpha/alpha--deliver.md" <<'MARKDOWN'
+cat > "$repo_a/.kontourai/flow-agents/alpha/alpha--deliver.md" <<'MARKDOWN'
 # Deliver Alpha
 
 status: delivered
 type: deliver
 MARKDOWN
 
-cat > "$repo_b/.flow-agents/beta/beta--verify.md" <<'MARKDOWN'
+cat > "$repo_b/.kontourai/flow-agents/beta/beta--verify.md" <<'MARKDOWN'
 # Verify Beta
 
 status: failed
@@ -94,8 +94,8 @@ fi
 
 discover_root="$TMPDIR_EVAL/discover-root"
 repo_c="$discover_root/gamma"
-mkdir -p "$repo_c/.flow-agents/gamma"
-cat > "$repo_c/.flow-agents/gamma/gamma--deliver.md" <<'MARKDOWN'
+mkdir -p "$repo_c/.kontourai/flow-agents/gamma"
+cat > "$repo_c/.kontourai/flow-agents/gamma/gamma--deliver.md" <<'MARKDOWN'
 # Deliver Gamma
 
 status: delivered

package/evals/integration/test_validate_artifacts_portability.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# test_validate_artifacts_portability.sh — flow-agents-validate-artifacts must resolve its
+# JSON Schemas relative to its own installed package, so it runs from any cwd that has no
+# local schemas/ directory (the bug reproduced during planning was an uncaught ENOENT).
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+source "$ROOT/evals/lib/node.sh"
+
+errors=0
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+pass() { echo "  ✓ $1"; }
+fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
+
+flow_agents_build_ts || { echo "  ✗ build failed (prerequisite)"; exit 1; }
+SIDECAR="$ROOT/build/src/cli/workflow-sidecar.js"
+VALIDATE="$ROOT/build/src/cli/validate-workflow-artifacts.js"
+
+echo "=== validate-workflow-artifacts portability (foreign cwd, no local schemas/) ==="
+
+FOREIGN="$TMP_DIR/foreign"
+mkdir -p "$FOREIGN"
+
+# Create a minimal valid sidecar set from the foreign cwd (no package.json/kits/schemas here).
+( cd "$FOREIGN" && node "$SIDECAR" ensure-session --source-request "portability smoke" --summary "smoke" --criterion "c1" --task-slug port-smoke ) >"$TMP_DIR/ensure.out" 2>&1
+if [[ -f "$FOREIGN/.kontourai/flow-agents/port-smoke/state.json" ]]; then
+  pass "sidecar writer created a sidecar set from a foreign cwd"
+else
+  fail "ensure-session did not create sidecars in foreign cwd"
+  sed -n '1,80p' "$TMP_DIR/ensure.out"
+fi
+
+if [[ ! -d "$FOREIGN/schemas" ]]; then
+  pass "foreign cwd has no local schemas/ directory (faithful to the bug repro)"
+else
+  fail "foreign cwd unexpectedly has a schemas/ directory"
+fi
+
+# Run validate-artifacts from the foreign cwd; the schema load must resolve package-relative.
+if ( cd "$FOREIGN" && node "$VALIDATE" .kontourai/flow-agents/port-smoke ) >"$TMP_DIR/validate.out" 2>&1; then
+  if rg -q "Validated" "$TMP_DIR/validate.out"; then
+    pass "validate-workflow-artifacts runs from a foreign cwd (schemas resolved package-relative)"
+  else
+    fail "validate-artifacts exited 0 but printed no validation summary"
+    sed -n '1,80p' "$TMP_DIR/validate.out"
+  fi
+else
+  fail "validate-artifacts crashed from a foreign cwd (schema-path ENOENT regression?)"
+  sed -n '1,80p' "$TMP_DIR/validate.out"
+fi
+
+echo ""
+if [[ "$errors" -eq 0 ]]; then
+  echo "validate-artifacts portability checks passed."
+  exit 0
+fi
+echo "validate-artifacts portability checks failed: $errors issue(s)."
+exit 1

package/evals/integration/test_verify_cli.sh

@@ -50,7 +50,7 @@ const fs = require('fs');
 const [,, outPath, label, passingStr] = process.argv;
 const passing = passingStr === 'true';
 const bundle = {
-  schemaVersion: 3,
+  schemaVersion: 5,
   source: "test-fixture",
   claims: [
     {
@@ -59,7 +59,7 @@ const bundle = {
       value: passing ? "pass" : "fail",
       status: passing ? "verified" : "disputed",
       subjectId: "test/build",
-      surface: "flow-agents.workflow",
+      facet: "flow-agents.workflow",
       subjectType: "workflow-check",
       fieldOrBehavior: "build",
       createdAt: "2026-06-27T00:00:00Z",

package/evals/integration/test_veritas_governance_kit.sh

@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+# test_veritas_governance_kit.sh — Veritas Governance Kit slice 1 gate demo (agentless).
+#
+# Proves the kit's readiness-check flow gates a REAL `veritas readiness` verdict, projected
+# into a Hachure trust.bundle by the kit adapter (kits/veritas-governance/adapter/
+# readiness-to-trust-bundle.mjs):
+#   POSITIVE: a ready readiness report -> verified software-readiness-verdict claim ->
+#             flow evaluate exits 0 (gate passes).
+#   NEGATIVE: a not-ready readiness report (injected Repo Standards violation) -> disputed
+#             claim -> flow evaluate --exit-code exits 1 (gate BLOCKS, not silently passed).
+#
+# The two committed fixtures under kits/veritas-governance/fixtures/readiness/ are REAL,
+# captured `veritas readiness --check evidence --working-tree` evidence reports (ready = a
+# clean checkout of kontourai/veritas; not-ready = the same tree with a required CLI artifact
+# deleted, a Require-enforcement violation). When a Veritas binary is resolvable (VERITAS_BIN,
+# or `veritas` on PATH) AND VERITAS_GOVERNED_REPO points at a Veritas-governed repo, the eval
+# ALSO runs Veritas live and re-derives both paths; otherwise it prints SKIP for the live leg
+# and relies on the captured real-output fixtures (deterministic in CI).
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+source "$ROOT/evals/lib/node.sh"
+
+errors=0
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+pass() { echo "  ✓ $1"; }
+fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
+
+KIT="$ROOT/kits/veritas-governance"
+ADAPTER="$KIT/adapter/readiness-to-trust-bundle.mjs"
+FLOWDEF="$KIT/flows/readiness-check.flow.json"
+FLOW_CLI="$ROOT/node_modules/@kontourai/flow/dist/cli.js"
+
+echo "=== Veritas Governance Kit — slice 1 gate demo ==="
+
+# --- Kit container is K0-valid --------------------------------------------------
+if node "$FLOW_CLI" kit validate "$KIT" >"$TMP_DIR/kitval.out" 2>&1; then
+  pass "kit container validates (flow kit validate)"
+else
+  fail "kit container failed validation"; sed -n '1,40p' "$TMP_DIR/kitval.out"
+fi
+
+# --- No-fork: kit does not vendor/reimplement Veritas rule/claim evaluation ------
+# Scope to kit SOURCE (adapter + flows), not fixtures/ — the fixtures are real Veritas
+# OUTPUT and legitimately embed Veritas rule ids and check labels.
+if rg -q -i 'evaluateRepoStandards|evidence-check-runner\.mjs|class +[A-Za-z]*RuleEngine|repo-standards/default\.repo-standards\.json' "$KIT/adapter" "$KIT/flows" 2>/dev/null; then
+  fail "kit source appears to vendor/reimplement Veritas evaluation logic (no-fork violated)"
+else
+  pass "no-fork: kit source references Veritas recorded output only (no vendored rule/claim engine)"
+fi
+
+# --- Gate one readiness fixture; assert the expected evaluate exit code ----------
+# $1 fixture path, $2 label, $3 expected exit (0=pass, 1=block)
+gate_case() {
+  local fixture="$1" label="$2" expect="$3"
+  local work="$TMP_DIR/$label"; mkdir -p "$work"; ( cd "$work" && node "$FLOW_CLI" init >/dev/null 2>&1 )
+  local bundle="$work/readiness.bundle"
+  if ! node "$ADAPTER" --report "$fixture" --out "$bundle" >"$work/adapter.out" 2>&1; then
+    fail "[$label] adapter failed to project readiness report"; sed -n '1,20p' "$work/adapter.out"; return
+  fi
+  ( cd "$work" && node "$FLOW_CLI" start "$FLOWDEF" --run-id "$label" >/dev/null 2>&1 )
+  ( cd "$work" && node "$FLOW_CLI" attach-evidence "$label" --gate gate-check-gate --file "$bundle" --bundle >"$work/attach.out" 2>&1 )
+  if ! rg -q 'kind: trust.bundle' "$work/attach.out"; then
+    fail "[$label] evidence did not attach as kind: trust.bundle"; sed -n '1,20p' "$work/attach.out"; return
+  fi
+  ( cd "$work" && node "$FLOW_CLI" evaluate "$label" --gate gate-check-gate --exit-code >"$work/eval.out" 2>&1 )
+  local got=$?
+  if [[ "$got" == "$expect" ]]; then
+    pass "[$label] gate evaluate exit $got as expected ($(rg -o '^(pass|block|route-back) gate-check-gate.*' "$work/eval.out" | head -1))"
+  else
+    fail "[$label] gate evaluate exit $got, expected $expect"; sed -n '1,20p' "$work/eval.out"
+  fi
+}
+
+echo "--- captured real-veritas-output fixtures ---"
+gate_case "$KIT/fixtures/readiness/ready.readiness-report.json"     "positive" 0
+gate_case "$KIT/fixtures/readiness/not-ready.readiness-report.json" "negative" 1
+
+# --- Optional live Veritas leg --------------------------------------------------
+VBIN="${VERITAS_BIN:-veritas}"
+if command -v "$VBIN" >/dev/null 2>&1 && [[ -n "${VERITAS_GOVERNED_REPO:-}" && -d "${VERITAS_GOVERNED_REPO:-}/.veritas" ]]; then
+  echo "--- live Veritas leg (VERITAS_GOVERNED_REPO=$VERITAS_GOVERNED_REPO) ---"
+  live="$TMP_DIR/live"; mkdir -p "$live"
+  rsync -a --exclude .git --exclude node_modules --exclude .kontourai "$VERITAS_GOVERNED_REPO/" "$live/repo/" >/dev/null 2>&1
+  ln -s "$VERITAS_GOVERNED_REPO/node_modules" "$live/repo/node_modules" 2>/dev/null || true
+  # `veritas readiness --working-tree` diffs against git; the copy needs its own git repo.
+  ( cd "$live/repo" && git init -q && git add -A && git -c user.email=eval@local -c user.name=eval commit -qm baseline ) >/dev/null 2>&1
+  # live-positive: clean tree
+  ( cd "$live/repo" && "$VBIN" readiness --check evidence --working-tree >/dev/null 2>&1 )
+  live_rep="$(ls -t "$live/repo/.kontourai/veritas/evidence/"*.json 2>/dev/null | head -1)"
+  if [[ -n "$live_rep" ]]; then
+    gate_case "$live_rep" "live-positive" 0
+  else
+    fail "live Veritas clean run produced no evidence report"
+  fi
+  # live-negative: inject a Require-enforcement violation (delete a required CLI artifact)
+  rm -f "$live/repo/bin/veritas-report.mjs"
+  ( cd "$live/repo" && "$VBIN" readiness --check evidence --working-tree >/dev/null 2>&1 )
+  live_neg="$(ls -t "$live/repo/.kontourai/veritas/evidence/"*.json 2>/dev/null | head -1)"
+  if [[ -n "$live_neg" && "$live_neg" != "$live_rep" ]]; then
+    gate_case "$live_neg" "live-negative" 1
+  else
+    fail "live Veritas injected-violation run produced no fresh evidence report"
+  fi
+else
+  echo "  - SKIP live Veritas leg (set VERITAS_BIN + VERITAS_GOVERNED_REPO to enable); fixtures are captured real output"
+fi
+
+echo ""
+if [[ "$errors" -eq 0 ]]; then
+  echo "PASS: veritas-governance kit gate demo (positive passes, negative blocks)"
+  exit 0
+else
+  echo "FAIL: $errors check(s) failed"
+  exit 1
+fi

package/evals/integration/test_workflow_artifact_cleanup_audit.sh

@@ -13,7 +13,11 @@ errors=0
 pass() { echo "  ✓ $1"; }
 fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
 
-mkdir -p "$ARTIFACT_ROOT"/{active-wip,terminal-done,stale-verified,learning-followup,delivered-learning-followup,invalid-learning-route,invalid-sidecar,symlink-state,large-learning,missing-state-next-action,missing-learning-records,non-array-learning-records,changes,archive,.hidden}
+mkdir -p "$ARTIFACT_ROOT"/{active-wip,terminal-done,stale-verified,learning-followup,delivered-learning-followup,invalid-learning-route,invalid-sidecar,symlink-state,large-learning,missing-state-next-action,missing-learning-records,non-array-learning-records,changes,archive,liveness,.hidden}
+
+cat > "$ARTIFACT_ROOT/liveness/events.jsonl" <<'JSONL'
+{"type":"claim","subjectId":"active-wip","actor":"agent-1","at":"2026-06-01T00:00:00Z"}
+JSONL
 
 cat > "$ARTIFACT_ROOT/active-wip/state.json" <<'JSON'
 {
@@ -37,6 +41,14 @@ cat > "$ARTIFACT_ROOT/terminal-done/state.json" <<'JSON'
 }
 JSON
 
+# Promote-then-archive gate (issue #312): a delivered/accepted session stays terminal_done
+# ONLY when its trust.bundle carries a promotion claim (claim.metadata.promotion). Without
+# this, terminal-done would (correctly) reclassify as a cleanup_candidate. See the dedicated
+# WITHOUT-claim coverage in test_promote_gate.sh.
+cat > "$ARTIFACT_ROOT/terminal-done/trust.bundle" <<'JSON'
+{ "schemaVersion": 5, "claims": [ { "id": "smoke-promotion.flow-agents-workflow.promoted", "claimType": "workflow.check.policy", "status": "verified", "metadata": { "promotion": { "schema_version": "1.0", "none": false, "targets": ["docs/decisions/promotion-gate.md"], "promoted_at": "2026-06-01T00:00:00Z" } } } ], "evidence": [], "policies": [], "events": [] }
+JSON
+
 cat > "$ARTIFACT_ROOT/stale-verified/state.json" <<'JSON'
 {
   "schema_version": "1.0",
@@ -241,6 +253,7 @@ json_query() {
 
 [[ "$(json_query "$TMPDIR_EVAL/audit.json" "buckets.active_wip.0.slug")" == "active-wip" ]] && pass "json classifies active fixture" || fail "json classifies active fixture"
 [[ "$(json_query "$TMPDIR_EVAL/audit.json" "buckets.terminal_done.0.slug")" == "terminal-done" ]] && pass "json classifies terminal fixture" || fail "json classifies terminal fixture"
+grep -q "Cleanup candidates: 1" "$TMPDIR_EVAL/audit.txt" && pass "promoted terminal fixture is not a cleanup candidate" || fail "promoted terminal fixture is not a cleanup candidate"
 [[ "$(json_query "$TMPDIR_EVAL/audit.json" "buckets.cleanup_candidate.0.slug")" == "stale-verified" ]] && pass "json classifies stale verified cleanup fixture" || fail "json classifies stale verified cleanup fixture"
 [[ "$(json_query "$TMPDIR_EVAL/audit.json" "buckets.active_learning_followup.0.slug")" == "delivered-learning-followup" ]] && pass "json keeps delivered done open learning active" || fail "json keeps delivered done open learning active"
 [[ "$(json_query "$TMPDIR_EVAL/audit.json" "buckets.active_learning_followup.1.slug")" == "learning-followup" ]] && pass "json keeps open learning routing active" || fail "json keeps open learning routing active"
@@ -258,6 +271,18 @@ json_query() {
 [[ "$(json_query "$TMPDIR_EVAL/audit.json" "buckets.invalid.6.reasons.0")" == "state.json must not be a symlink" ]] && pass "json reports symlink rejection without reading target" || fail "json reports symlink rejection without reading target"
 [[ "$(json_query "$TMPDIR_EVAL/audit.json" "buckets.cleanup_candidate.0.classification")" == "cleanup_candidate" ]] && pass "json includes stable classification field" || fail "json includes stable classification field"
 
+node -e '
+const fs = require("fs");
+const data = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+const found = Object.values(data.buckets).some((arr) => Array.isArray(arr) && arr.some((entry) => entry.slug === "liveness"));
+process.exit(found ? 1 : 0);
+' "$TMPDIR_EVAL/audit.json"
+if [[ $? -eq 0 ]]; then
+  pass "liveness directory never appears in any bucket"
+else
+  fail "liveness directory never appears in any bucket"
+fi
+
 if flow_agents_node "$SCRIPT" --artifact-root "$TMPDIR_EVAL/missing-root" > "$TMPDIR_EVAL/missing-root.out" 2> "$TMPDIR_EVAL/missing-root.err"; then
   fail "missing artifact root exits nonzero"
 else

package/evals/integration/test_workflow_artifacts.sh

@@ -422,6 +422,39 @@ else
   _fail "valid artifact chain failed: $(cat "$TMPDIR_EVAL/valid.out" "$TMPDIR_EVAL/valid.err")"
 fi
 
+if rg -q 'WARN .*state\.json: state\.json has no branch field' "$TMPDIR_EVAL/valid.err"; then
+  _pass "legacy state.json without branch warns (not fails) on stderr, exit 0"
+else
+  _fail "legacy state.json without branch did not warn on stderr: $(cat "$TMPDIR_EVAL/valid.err")"
+fi
+
+BRANCH_PRESENT="$TMPDIR_EVAL/branch-present"
+mkdir -p "$BRANCH_PRESENT"
+cat > "$BRANCH_PRESENT/state.json" <<'JSON'
+{
+  "schema_version": "1.0",
+  "task_slug": "branch-present",
+  "status": "planned",
+  "phase": "planning",
+  "branch": "agent/test-actor/branch-present",
+  "updated_at": "2026-05-06T00:00:00Z",
+  "next_action": {
+    "status": "continue",
+    "summary": "Continue."
+  }
+}
+JSON
+
+if flow_agents_node "$VALIDATOR" "$BRANCH_PRESENT" >"$TMPDIR_EVAL/branch-present.out" 2>"$TMPDIR_EVAL/branch-present.err"; then
+  if rg -q 'WARN' "$TMPDIR_EVAL/branch-present.err"; then
+    _fail "state.json with a branch field should not warn: $(cat "$TMPDIR_EVAL/branch-present.err")"
+  else
+    _pass "state.json with a branch field passes with no warning"
+  fi
+else
+  _fail "state.json with a branch field should pass: $(cat "$TMPDIR_EVAL/branch-present.out" "$TMPDIR_EVAL/branch-present.err")"
+fi
+
 BAD="$TMPDIR_EVAL/bad"
 mkdir -p "$BAD"