@kontourai/flow-agents 2.3.0 → 3.0.0

package/evals/integration/test_workflow_steering_hook.sh

@@ -16,12 +16,12 @@ _pass() { echo "  ✓ $1"; }
 _fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
 
 REPO="$TMPDIR_EVAL/repo"
-mkdir -p "$REPO/.flow-agents/steering-demo"
+mkdir -p "$REPO/.kontourai/flow-agents/steering-demo"
 mkdir -p "$REPO/docs"
 printf '# Test Repo\n' > "$REPO/AGENTS.md"
 printf '# Context Map\n' > "$REPO/docs/context-map.md"
 
-cat > "$REPO/.flow-agents/steering-demo/state.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/steering-demo/state.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "steering-demo",
@@ -36,7 +36,7 @@ cat > "$REPO/.flow-agents/steering-demo/state.json" <<'JSON'
 }
 JSON
 
-cat > "$REPO/.flow-agents/steering-demo/critique.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/steering-demo/critique.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "steering-demo",
@@ -217,6 +217,176 @@ else
   _fail "Claude hook adapter should not fail for prompt-submit workflow steering"
 fi
 
+FRESH_REPO="$TMPDIR_EVAL/fresh-repo"
+mkdir -p "$FRESH_REPO/docs"
+printf '# Fresh Repo\n' > "$FRESH_REPO/AGENTS.md"
+printf '# Context Map\n' > "$FRESH_REPO/docs/context-map.md"
+
+if node "$ROOT/scripts/hooks/workflow-steering.js" >"$TMPDIR_EVAL/builder-route.out" 2>"$TMPDIR_EVAL/builder-route.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"Please implement the new settings API and update its tests."}
+JSON
+then
+  if rg -q 'BUILDER WORKFLOW ROUTE' "$TMPDIR_EVAL/builder-route.out" && \
+     rg -q 'activate `deliver`' "$TMPDIR_EVAL/builder-route.out" && \
+     rg -q -- '--flow-id builder.build' "$TMPDIR_EVAL/builder-route.out" && \
+     rg -q 'plan-work -> execute-plan -> review-work -> verify-work' "$TMPDIR_EVAL/builder-route.out" && \
+     rg -q 'publish/release-readiness and learning-review' "$TMPDIR_EVAL/builder-route.out"; then
+    _pass "workflow steering hook routes fresh coding prompts into Builder workflow"
+  else
+    _fail "workflow steering missed Builder workflow route for coding prompt: $(cat "$TMPDIR_EVAL/builder-route.out")"
+  fi
+else
+  _fail "workflow steering hook should not fail for fresh coding prompt"
+fi
+
+if node "$ROOT/scripts/hooks/claude-hook-adapter.js" UserPromptSubmit prompt:workflow-steering workflow-steering.js standard,strict >"$TMPDIR_EVAL/claude-builder-route.out" 2>"$TMPDIR_EVAL/claude-builder-route.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"Please implement the new settings API and update its tests."}
+JSON
+then
+  if node - "$TMPDIR_EVAL/claude-builder-route.out" <<'NODE'
+const fs = require("node:fs");
+const payload = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+const ctx = payload.hookSpecificOutput?.additionalContext || "";
+if (payload.continue !== true) throw new Error("continue not true");
+if (payload.suppressOutput !== false) throw new Error("suppressOutput should be false when guidance exists");
+for (const needle of ["BUILDER WORKFLOW ROUTE", "activate `deliver`", "--flow-id builder.build", "plan-work -> execute-plan -> review-work -> verify-work", "publish/release-readiness and learning-review"]) {
+  if (!ctx.includes(needle)) throw new Error(`missing ${needle}`);
+}
+NODE
+  then
+    _pass "Claude hook adapter surfaces Builder workflow route for coding prompts"
+  else
+    _fail "Claude hook adapter missed Builder workflow route: $(cat "$TMPDIR_EVAL/claude-builder-route.out") $(cat "$TMPDIR_EVAL/claude-builder-route.err")"
+  fi
+else
+  _fail "Claude hook adapter should not fail for Builder workflow route"
+fi
+
+if node "$ROOT/scripts/hooks/workflow-steering.js" >"$TMPDIR_EVAL/builder-route-review-only.out" 2>"$TMPDIR_EVAL/builder-route-review-only.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"Please review the test coverage and validate whether it is enough. Do not modify files."}
+JSON
+then
+  if ! rg -q 'BUILDER WORKFLOW ROUTE' "$TMPDIR_EVAL/builder-route-review-only.out"; then
+    _pass "workflow steering hook does not route explicit review-only prompts into Builder workflow"
+  else
+    _fail "workflow steering incorrectly routed review-only prompt: $(cat "$TMPDIR_EVAL/builder-route-review-only.out")"
+  fi
+else
+  _fail "workflow steering hook should not fail for review-only prompt"
+fi
+
+if node "$ROOT/scripts/hooks/workflow-steering.js" >"$TMPDIR_EVAL/builder-route-validate-only.out" 2>"$TMPDIR_EVAL/builder-route-validate-only.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"Please validate whether the tests are enough. Do not modify files."}
+JSON
+then
+  if ! rg -q 'BUILDER WORKFLOW ROUTE' "$TMPDIR_EVAL/builder-route-validate-only.out"; then
+    _pass "workflow steering hook does not route explicit validation-only prompts into Builder workflow"
+  else
+    _fail "workflow steering incorrectly routed validation-only prompt: $(cat "$TMPDIR_EVAL/builder-route-validate-only.out")"
+  fi
+else
+  _fail "workflow steering hook should not fail for validation-only prompt"
+fi
+
+if node "$ROOT/scripts/hooks/workflow-steering.js" >"$TMPDIR_EVAL/builder-route-bare-validate.out" 2>"$TMPDIR_EVAL/builder-route-bare-validate.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"Please validate whether the settings API tests are enough."}
+JSON
+then
+  if ! rg -q 'BUILDER WORKFLOW ROUTE' "$TMPDIR_EVAL/builder-route-bare-validate.out"; then
+    _pass "workflow steering hook does not route bare validation prompts into Builder workflow"
+  else
+    _fail "workflow steering incorrectly routed bare validation prompt: $(cat "$TMPDIR_EVAL/builder-route-bare-validate.out")"
+  fi
+else
+  _fail "workflow steering hook should not fail for bare validation prompt"
+fi
+
+if node "$ROOT/scripts/hooks/workflow-steering.js" >"$TMPDIR_EVAL/builder-route-bare-test.out" 2>"$TMPDIR_EVAL/builder-route-bare-test.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"Please test whether this still reproduces."}
+JSON
+then
+  if ! rg -q 'BUILDER WORKFLOW ROUTE' "$TMPDIR_EVAL/builder-route-bare-test.out"; then
+    _pass "workflow steering hook does not route bare test prompts into Builder workflow"
+  else
+    _fail "workflow steering incorrectly routed bare test prompt: $(cat "$TMPDIR_EVAL/builder-route-bare-test.out")"
+  fi
+else
+  _fail "workflow steering hook should not fail for bare test prompt"
+fi
+
+if node "$ROOT/scripts/hooks/workflow-steering.js" >"$TMPDIR_EVAL/builder-route-test-question.out" 2>"$TMPDIR_EVAL/builder-route-test-question.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"What tests should I run for the settings API?"}
+JSON
+then
+  if ! rg -q 'BUILDER WORKFLOW ROUTE' "$TMPDIR_EVAL/builder-route-test-question.out"; then
+    _pass "workflow steering hook does not route question-only test prompts into Builder workflow"
+  else
+    _fail "workflow steering incorrectly routed question-only test prompt: $(cat "$TMPDIR_EVAL/builder-route-test-question.out")"
+  fi
+else
+  _fail "workflow steering hook should not fail for question-only test prompt"
+fi
+
+if node "$ROOT/scripts/hooks/claude-hook-adapter.js" UserPromptSubmit prompt:workflow-steering workflow-steering.js standard,strict >"$TMPDIR_EVAL/claude-builder-route-review-only.out" 2>"$TMPDIR_EVAL/claude-builder-route-review-only.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"Please review the test coverage and validate whether it is enough. Do not modify files."}
+JSON
+then
+  if node - "$TMPDIR_EVAL/claude-builder-route-review-only.out" <<'NODE'
+const fs = require("node:fs");
+const payload = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+const ctx = payload.hookSpecificOutput?.additionalContext || "";
+if (payload.continue !== true) throw new Error("continue not true");
+if (ctx.includes("BUILDER WORKFLOW ROUTE")) throw new Error("review-only prompt should not route to Builder workflow");
+NODE
+  then
+    _pass "Claude hook adapter does not route explicit review-only prompts into Builder workflow"
+  else
+    _fail "Claude hook adapter incorrectly routed review-only prompt: $(cat "$TMPDIR_EVAL/claude-builder-route-review-only.out") $(cat "$TMPDIR_EVAL/claude-builder-route-review-only.err")"
+  fi
+else
+  _fail "Claude hook adapter should not fail for review-only prompt"
+fi
+
+if node "$ROOT/scripts/hooks/claude-hook-adapter.js" UserPromptSubmit prompt:workflow-steering workflow-steering.js standard,strict >"$TMPDIR_EVAL/claude-builder-route-validate-only.out" 2>"$TMPDIR_EVAL/claude-builder-route-validate-only.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"Please validate whether the tests are enough. Do not modify files."}
+JSON
+then
+  if node - "$TMPDIR_EVAL/claude-builder-route-validate-only.out" <<'NODE'
+const fs = require("node:fs");
+const payload = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+const ctx = payload.hookSpecificOutput?.additionalContext || "";
+if (payload.continue !== true) throw new Error("continue not true");
+if (ctx.includes("BUILDER WORKFLOW ROUTE")) throw new Error("validation-only prompt should not route to Builder workflow");
+NODE
+  then
+    _pass "Claude hook adapter does not route explicit validation-only prompts into Builder workflow"
+  else
+    _fail "Claude hook adapter incorrectly routed validation-only prompt: $(cat "$TMPDIR_EVAL/claude-builder-route-validate-only.out") $(cat "$TMPDIR_EVAL/claude-builder-route-validate-only.err")"
+  fi
+else
+  _fail "Claude hook adapter should not fail for validation-only prompt"
+fi
+
+if node "$ROOT/scripts/hooks/claude-hook-adapter.js" UserPromptSubmit prompt:workflow-steering workflow-steering.js standard,strict >"$TMPDIR_EVAL/claude-builder-route-test-question.out" 2>"$TMPDIR_EVAL/claude-builder-route-test-question.err" <<JSON
+{"hook_event_name":"UserPromptSubmit","cwd":"$FRESH_REPO","prompt":"What tests should I run for the settings API?"}
+JSON
+then
+  if node - "$TMPDIR_EVAL/claude-builder-route-test-question.out" <<'NODE'
+const fs = require("node:fs");
+const payload = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+const ctx = payload.hookSpecificOutput?.additionalContext || "";
+if (payload.continue !== true) throw new Error("continue not true");
+if (ctx.includes("BUILDER WORKFLOW ROUTE")) throw new Error("question-only test prompt should not route to Builder workflow");
+NODE
+  then
+    _pass "Claude hook adapter does not route question-only test prompts into Builder workflow"
+  else
+    _fail "Claude hook adapter incorrectly routed question-only test prompt: $(cat "$TMPDIR_EVAL/claude-builder-route-test-question.out") $(cat "$TMPDIR_EVAL/claude-builder-route-test-question.err")"
+  fi
+else
+  _fail "Claude hook adapter should not fail for question-only test prompt"
+fi
+
 if node "$ROOT/scripts/hooks/codex-hook-adapter.js" post:workflow-steering workflow-steering.js standard,strict >"$TMPDIR_EVAL/codex-adapter.out" 2>"$TMPDIR_EVAL/codex-adapter.err" <<JSON
 {"hook_event_name":"PostToolUse","cwd":"$REPO","tool_input":{"command":"Bash","content":{"command":"bash evals/run.sh integration"}},"tool_response":"integration finished"}
 JSON
@@ -285,7 +455,7 @@ else
   _fail "Codex hook adapter should not fail for prompt-submit workflow steering"
 fi
 
-cat > "$REPO/.flow-agents/steering-demo/state.json" <<'JSON'
+cat > "$REPO/.kontourai/flow-agents/steering-demo/state.json" <<'JSON'
 {
   "schema_version": "1.0",
   "task_slug": "steering-demo",
@@ -298,7 +468,7 @@ cat > "$REPO/.flow-agents/steering-demo/state.json" <<'JSON'
   }
 }
 JSON
-rm -f "$REPO/.flow-agents/steering-demo/critique.json"
+rm -f "$REPO/.kontourai/flow-agents/steering-demo/critique.json"
 
 if node "$ROOT/scripts/hooks/workflow-steering.js" >"$TMPDIR_EVAL/done.out" 2>"$TMPDIR_EVAL/done.err" <<JSON
 {"cwd":"$REPO","tool_input":{"command":"InvokeSubagents","content":{"subagents":[{"agent_name":"tool-verifier"}]}},"tool_response":"verification finished"}

package/evals/lib/codex-provider.sh

@@ -19,7 +19,7 @@ AGENT="${AGENT:-${FLOW_AGENTS_EVAL_AGENT:-dev}}"
 
 profile_for_agent() {
   case "$1" in
-    dev) echo "kdev" ;;
+    dev) echo "builder" ;;
     *) echo "" ;;
   esac
 }

package/evals/lib/node.sh

@@ -3,8 +3,26 @@
 
 FLOW_AGENTS_EVAL_ROOT="${ROOT:-${ROOT_DIR:-}}"
 
+# Memoized per-process: flow_agents_node is called dozens of times per eval script
+# (often inside a `run_bounded N ...` hang-guard around a single fail-fast assertion).
+# Re-running `npm run build --silent` (npm startup + tsc incremental stat-check) on EVERY
+# call repeatedly re-pays that overhead inside those bounds. On a slow/loaded CI runner a
+# single one of those ~100+ redundant build invocations can occasionally take long enough
+# to blow a tight hang-guard bound before the actual (near-instant) validation ever runs,
+# producing a spurious assertion failure that has nothing to do with the behavior under
+# test (see PR #306 CI trust-reconcile divergence investigation). Source under src/ never
+# changes mid-script for any eval, so building once per process is safe and correct.
+_FLOW_AGENTS_BUILD_DONE=""
+
 flow_agents_build_ts() {
-  (cd "$FLOW_AGENTS_EVAL_ROOT" && npm run build --silent >/dev/null)
+  if [[ "$_FLOW_AGENTS_BUILD_DONE" == "1" ]]; then
+    return 0
+  fi
+  if (cd "$FLOW_AGENTS_EVAL_ROOT" && npm run build --silent >/dev/null); then
+    _FLOW_AGENTS_BUILD_DONE="1"
+    return 0
+  fi
+  return 1
 }
 
 flow_agents_node() {

package/evals/run.sh

@@ -135,13 +135,19 @@ run_static() {
   echo ""
   bash "$EVAL_DIR/static/test_evidence_refs.sh" || result=1
   echo ""
+  bash "$EVAL_DIR/static/test_decisions.sh" || result=1
+  echo ""
   bash "$EVAL_DIR/static/test_library_exports.sh" || result=1
   echo ""
   bash "$EVAL_DIR/static/test_console_presets.sh" || result=1
   echo ""
   bash "$EVAL_DIR/static/test_repo_hooks.sh" || result=1
   echo ""
+  bash "$EVAL_DIR/static/test_flowdef_codeowners_coverage.sh" || result=1
+  echo ""
   bash "$EVAL_DIR/static/test_unit_helpers.sh" || result=1
+  echo ""
+  bash "$EVAL_DIR/static/test_knowledge_providers.sh" || result=1
   return $result
 }
 
@@ -179,12 +185,32 @@ run_integration() {
   echo ""
   bash "$EVAL_DIR/integration/test_workflow_artifact_cleanup_audit.sh" || result=1
   echo ""
+  bash "$EVAL_DIR/integration/test_promote_gate.sh" || result=1
+  echo ""
   bash "$EVAL_DIR/integration/test_fixture_retirement_audit.sh" || result=1
   echo ""
   bash "$EVAL_DIR/integration/test_publish_change_helper.sh" || result=1
   echo ""
   bash "$EVAL_DIR/integration/test_workflow_sidecar_writer.sh" || result=1
   echo ""
+  bash "$EVAL_DIR/integration/test_sidecar_field_preservation.sh" || result=1
+  echo ""
+  bash "$EVAL_DIR/integration/test_actor_identity.sh" || result=1
+  echo ""
+  bash "$EVAL_DIR/integration/test_assignment_provider_local_file.sh" || result=1
+  echo ""
+  bash "$EVAL_DIR/integration/test_assignment_provider_github.sh" || result=1
+  echo ""
+  bash "$EVAL_DIR/integration/test_pull_work_assignment_join.sh" || result=1
+  echo ""
+  bash "$EVAL_DIR/integration/test_liveness_heartbeat.sh" || result=1
+  echo ""
+  bash "$EVAL_DIR/integration/test_pull_work_liveness_preflight.sh" || result=1
+  echo ""
+  bash "$EVAL_DIR/integration/test_liveness_verdict.sh" || result=1
+  echo ""
+  bash "$EVAL_DIR/integration/test_liveness_conflict_injection.sh" || result=1
+  echo ""
   bash "$EVAL_DIR/integration/test_veritas_governance_adapter.sh" || result=1
   echo ""
   bash "$EVAL_DIR/integration/test_workflow_steering_hook.sh" || result=1
@@ -203,6 +229,10 @@ run_integration() {
   echo ""
   bash "$EVAL_DIR/integration/test_runtime_adapter_activation.sh" || result=1
   echo ""
+  bash "$EVAL_DIR/integration/test_validate_artifacts_portability.sh" || result=1
+  echo ""
+  bash "$EVAL_DIR/integration/test_codex_hook_resolution.sh" || result=1
+  echo ""
   bash "$EVAL_DIR/integration/test_bundle_install.sh" || result=1
   echo ""
   bash "$EVAL_DIR/integration/test_bundle_lifecycle.sh" || result=1
@@ -219,6 +249,8 @@ run_integration() {
   echo ""
   bash "$EVAL_DIR/integration/test_flowdef_session_history_preservation.sh" || result=1
   echo ""
+  bash "$EVAL_DIR/integration/test_critique_supersession_roundtrip.sh" || result=1
+  echo ""
   bash "$EVAL_DIR/integration/test_flowdef_session_activation.sh" || result=1
   echo ""
   bash "$EVAL_DIR/integration/test_trust_checkpoint.sh" || result=1

package/evals/static/test_decisions.sh

@@ -0,0 +1,150 @@
+#!/usr/bin/env bash
+# test_decisions.sh — Decision registry validator + index generator checks.
+# Covers: valid pass, each violation class (bad status, missing subject,
+# secret-shaped evidence, tombstone -> missing slug), and index idempotency.
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SCRIPT="$ROOT/scripts/check-decisions.cjs"
+
+errors=0
+pass() { echo "  PASS $1"; }
+fail() { echo "  FAIL $1"; errors=$((errors + 1)); }
+
+echo "=== Decision Registry Checks ==="
+
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+run_check() { FLOW_AGENTS_DECISIONS_DIR="$1" node "$SCRIPT" check >"$2" 2>&1; }
+gen_index() { FLOW_AGENTS_DECISIONS_DIR="$1" node "$SCRIPT" gen-index >/dev/null 2>&1; }
+
+valid_frontmatter() {
+  cat <<'EOF'
+---
+status: current
+subject: Example subject
+decided: 2026-07-03
+evidence:
+  - kind: issue
+    ref: https://github.com/kontourai/flow-agents/issues/310
+---
+
+# Example subject
+
+The current answer.
+EOF
+}
+
+# --- Case 1: valid file passes ---
+D1="$WORK/valid"; mkdir -p "$D1"
+valid_frontmatter >"$D1/example-subject.md"
+gen_index "$D1"
+if run_check "$D1" "$WORK/c1.log"; then
+  pass "valid topic file + fresh index passes"
+else
+  fail "valid topic file should pass"; cat "$WORK/c1.log"
+fi
+
+# --- Case 2: unknown status fails ---
+D2="$WORK/badstatus"; mkdir -p "$D2"
+valid_frontmatter | sed 's/^status: current/status: accepted/' >"$D2/example-subject.md"
+gen_index "$D2"
+if run_check "$D2" "$WORK/c2.log"; then
+  fail "unknown status should fail validation"
+else
+  grep -q "unknown status" "$WORK/c2.log" && pass "unknown status fails" || { fail "unknown status wrong error"; cat "$WORK/c2.log"; }
+fi
+
+# --- Case 3: missing subject fails ---
+D3="$WORK/nosubject"; mkdir -p "$D3"
+valid_frontmatter | grep -v '^subject:' >"$D3/example-subject.md"
+gen_index "$D3"
+if run_check "$D3" "$WORK/c3.log"; then
+  fail "missing subject should fail validation"
+else
+  grep -q "subject" "$WORK/c3.log" && pass "missing subject fails" || { fail "missing subject wrong error"; cat "$WORK/c3.log"; }
+fi
+
+# --- Case 4: secret-shaped evidence ref fails ---
+# The secret-shaped literal is assembled at runtime so no contiguous
+# access-key-shaped token is committed to a tracked file (suite secret-scan gate).
+D4="$WORK/secret"; mkdir -p "$D4"
+FAKE_KEY="AKIA$(printf 'IOSFODNN7EXAMPLE')"
+{
+  printf -- '---\n'
+  printf 'status: current\n'
+  printf 'subject: Example subject\n'
+  printf 'decided: 2026-07-03\n'
+  printf 'evidence:\n'
+  printf '  - kind: url\n'
+  printf '    ref: "https://example.com/?token=%s"\n' "$FAKE_KEY"
+  printf -- '---\n\n'
+  printf '# Example subject\n'
+} >"$D4/example-subject.md"
+gen_index "$D4"
+if run_check "$D4" "$WORK/c4.log"; then
+  fail "secret-shaped evidence ref should fail validation"
+else
+  grep -q "secret-shaped" "$WORK/c4.log" && pass "secret-shaped evidence fails" || { fail "secret-shaped wrong error"; cat "$WORK/c4.log"; }
+fi
+
+# --- Case 5: tombstone pointing at missing slug fails ---
+D5="$WORK/tombstone"; mkdir -p "$D5"
+cat >"$D5/old-topic.md" <<'EOF'
+---
+status: superseded
+subject: Old topic
+decided: 2026-07-03
+superseded_by: does-not-exist
+evidence:
+  - kind: issue
+    ref: "#310"
+---
+
+# Old topic
+EOF
+gen_index "$D5"
+if run_check "$D5" "$WORK/c5.log"; then
+  fail "tombstone -> missing slug should fail validation"
+else
+  grep -q "missing topic slug" "$WORK/c5.log" && pass "tombstone -> missing slug fails" || { fail "tombstone wrong error"; cat "$WORK/c5.log"; }
+fi
+
+# --- Case 6: index idempotency (second gen is diff-clean) ---
+D6="$WORK/idem"; mkdir -p "$D6"
+valid_frontmatter >"$D6/example-subject.md"
+gen_index "$D6"
+cp "$D6/index.md" "$WORK/index-first.md"
+gen_index "$D6"
+if diff -q "$WORK/index-first.md" "$D6/index.md" >/dev/null; then
+  pass "index regeneration is idempotent (diff-clean)"
+else
+  fail "index regeneration is not idempotent"; diff "$WORK/index-first.md" "$D6/index.md" || true
+fi
+
+# --- Case 7: check flags a stale index ---
+D7="$WORK/stale"; mkdir -p "$D7"
+valid_frontmatter >"$D7/example-subject.md"
+gen_index "$D7"
+printf '\nstale line\n' >>"$D7/index.md"
+if run_check "$D7" "$WORK/c7.log"; then
+  fail "stale index should fail validation"
+else
+  grep -q "stale" "$WORK/c7.log" && pass "stale index detected" || { fail "stale index wrong error"; cat "$WORK/c7.log"; }
+fi
+
+# --- Case 8: repo's own registry passes end-to-end ---
+if node "$SCRIPT" check >"$WORK/c8.log" 2>&1; then
+  pass "repo docs/decisions registry passes"
+else
+  fail "repo docs/decisions registry should pass"; cat "$WORK/c8.log"
+fi
+
+echo ""
+if [[ "$errors" -eq 0 ]]; then
+  echo "Decision registry checks: all passed."
+  exit 0
+fi
+echo "Decision registry checks: $errors failed."
+exit 1

package/evals/static/test_flowdef_codeowners_coverage.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT_DIR"
+
+# Regression lock: CODEOWNERS must keep review-gated coverage over the
+# anti-gaming gate's enforcement hooks, the FlowDefinition resolution/trust
+# path, and the kit FlowDefinitions the gate's expects[] taxonomy is derived
+# from (ADR 0016 Abstraction A, ADR 0018 Decision #2). If any of these paths
+# silently drop out of CODEOWNERS, an agent could weaken the gate without
+# owner review. This check must fail loudly, naming the missing path.
+
+CODEOWNERS_FILE=".github/CODEOWNERS"
+
+pass() {
+  echo "PASS: $1"
+}
+
+fail() {
+  echo "FAIL: $1" >&2
+  exit 1
+}
+
+require_file() {
+  [[ -f "$1" ]] || fail "$1 is missing"
+  pass "$1 exists"
+}
+
+# Asserts that a non-comment line in CODEOWNERS contains the given
+# path/glob pattern and has an owner assigned to it. Tolerant of leading
+# "/", trailing globs, and surrounding whitespace — it checks coverage,
+# not an exact line match.
+require_codeowner() {
+  local pattern="$1"
+  local label="$2"
+  local match
+  match="$(grep -v '^[[:space:]]*#' "$CODEOWNERS_FILE" | grep -F -- "$pattern" || true)"
+  [[ -n "$match" ]] || fail "CODEOWNERS coverage regression: no entry found for '$label' (expected pattern containing '$pattern')"
+  echo "$match" | grep -Eq '@[A-Za-z0-9_-]+' || fail "CODEOWNERS coverage regression: entry for '$label' has no owner assigned"
+  pass "CODEOWNERS covers $label"
+}
+
+require_file "$CODEOWNERS_FILE"
+
+# NOTE: the flow-resolver.ts pattern below is string-split, matching how other
+# evals/ files reference the same module — otherwise validate-source-tree's
+# legacy-ref scanner mistakes the "lib/" segment for a (missing) top-level path.
+require_codeowner "scripts/hooks/stop-goal-fit.js" "scripts/hooks/stop-goal-fit.js"
+require_codeowner "scripts/hooks/config-protection.js" "scripts/hooks/config-protection.js"
+require_codeowner "scripts/hooks/evidence-capture.js" "scripts/hooks/evidence-capture.js"
+require_codeowner "src/li""b/flow-resolver.ts" "src/li""b/flow-resolver.ts"
+require_codeowner "src/cli/workflow-sidecar.ts" "src/cli/workflow-sidecar.ts"
+require_codeowner "kits/*/flows/*.flow.json" "kits/*/flows/*.flow.json (kit FlowDefinitions)"
+
+# ADR 0022 §2: delivery/DECLARED is the no-agent-delivery exemption marker
+# scripts/ci/trust-reconcile.js reads — a self-asserted governance artifact (names
+# approved_by) that must stay owner-review-gated the same as the other verify-config/
+# anchor paths above (#301's file-level half; server-side review enforcement is #225).
+require_codeowner "delivery/DECLARED" "delivery/DECLARED (ADR 0022 §2 no-agent-delivery marker)"
+
+echo "FlowDefinition-related CODEOWNERS coverage checks passed."

package/evals/static/test_knowledge_providers.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# test_knowledge_providers.sh — Layer 1: Knowledge Store Provider contract
+# conformance + provider-agnostic health verbs (issue #317).
+#
+# Runs the node:test suites that back AC1–AC3:
+#   - providers/conformance/suite.test.js       (AC3: all three providers conform)
+#   - providers/health/health-pass.test.js      (AC1: vault+git-repo reports;
+#                                                 AC2: work-item seeded dupe + broken blocker)
+# Deterministic, dependency-free, fixture-driven — never touches a real board.
+set -uo pipefail
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT_DIR"
+
+echo "── Knowledge store provider conformance + health (node --test) ──"
+
+if node --test \
+  kits/knowledge/providers/conformance/suite.test.js \
+  kits/knowledge/providers/health/health-pass.test.js; then
+  echo "  PASS: knowledge store provider conformance + health verbs"
+else
+  echo "  FAIL: knowledge store provider conformance + health verbs"
+  exit 1
+fi