@kontourai/flow-agents 2.4.0 → 3.0.0

package/.github/CODEOWNERS

@@ -13,6 +13,14 @@
 /evals/ci/                      @briananderson1222
 /scripts/ci/                    @briananderson1222
 
+# delivery/DECLARED (ADR 0022 §2) is the no-agent-delivery exemption marker
+# trust-reconcile.js reads to skip Step 2 when no bundle is delivered — a
+# self-asserted governance artifact naming approved_by, so it gets the same
+# owner-review protection as the other verify-config/anchor paths above. This
+# closes #301's file-level half; branch-protection enforcement of CODEOWNERS
+# review itself remains #225 (server-side, not code).
+/delivery/DECLARED               @briananderson1222
+
 # The verification config the CI anchor depends on — an agent must not redefine
 # trust-reconcile-verify to a fake/laundered command or rewire the lane runner
 # without owner review (convergence red-team finding).

package/.github/workflows/ci.yml

@@ -149,6 +149,18 @@ jobs:
         continue-on-error: true
         run: bash evals/ci/run-baseline.sh --check actor-identity-resolver-integration
 
+      - name: Assignment provider local-file integration
+        continue-on-error: true
+        run: bash evals/ci/run-baseline.sh --check assignment-provider-local-file-integration
+
+      - name: Assignment provider github integration
+        continue-on-error: true
+        run: bash evals/ci/run-baseline.sh --check assignment-provider-github-integration
+
+      - name: Pull work assignment join integration
+        continue-on-error: true
+        run: bash evals/ci/run-baseline.sh --check pull-work-assignment-join-integration
+
       - name: Finalize CI evidence
         if: always()
         run: bash evals/ci/run-baseline.sh --finalize

package/.github/workflows/trust-reconcile.yml

@@ -27,12 +27,41 @@
 # The agent cannot self-declare success here: it cannot modify the CI environment,
 # pre-disable this job, or post-forge results after the check runs.
 #
-# THIS JOB IS INTENDED TO BE A REQUIRED STATUS CHECK (branch protection).
-# Enabling it as required is a server-side GitHub branch-protection configuration
-# step — it is not wired here by code. Once required, no PR can merge past it.
+# THIS JOB IS ALREADY A REQUIRED, ADMIN-ENFORCED STATUS CHECK on main (verified via
+# `gh api repos/kontourai/flow-agents/branches/main/protection`: "Trust Reconcile" is in
+# required_status_checks.contexts, enforce_admins.enabled: true). No PR — including from
+# admins — can merge past a failing run. Disabling/relaxing this requires a server-side
+# branch-protection change (GitHub UI/API), not a code change in this repo.
 #
 # Additive — NOT a gate-hook change. Does not modify scripts/hooks/*, kits/knowledge,
 # or continue-work. Mirrors the structure of .github/workflows/ci.yml.
+#
+# CI-context contract for the bundle-ownership staleness check (ADR 0022 addendum, part
+# 2; scripts/ci/trust-reconcile.js bundleAttestsThisChange()): an auto-discovered bundle
+# is treated as owned only if its checkpoint's commit_sha is a git-ancestor of (or equal
+# to) this change's own commit sha, checked via `git merge-base --is-ancestor`. That
+# check requires TWO things this workflow provides deliberately, not by accident:
+#   1. Checkout step below uses `fetch-depth: 0` (full history) — the default
+#      fetch-depth: 1 (shallow clone) lacks the parent commit objects merge-base needs;
+#      an ancestor check against a shallow clone exits 128 (unresolvable), which
+#      correctly fails CLOSED (treated as stale) per trust-reconcile.js's own
+#      fail-closed-on-ambiguity contract, but would falsely stale EVERY legitimate
+#      fresh bundle on this required check without full history.
+#   2. Trust reconcile step below sets TRUST_RECONCILE_SHA to the PR's own HEAD commit
+#      (github.event.pull_request.head.sha), not github.sha — on a pull_request trigger,
+#      github.sha is GitHub's synthetic merge commit (refs/pull/N/merge), which is NOT
+#      the commit a locally-run seal-checkpoint ever stamps as commit_sha (checkpoints
+#      are always sealed against a real branch commit). Falling back to github.sha only
+#      applies on push/workflow_dispatch, where it IS the real commit. The checkout ref
+#      itself is unchanged — Step 1 (fresh verify) still runs against the same tree it
+#      always has; only the identity used for the OWNERSHIP COMPARISON changes.
+#   3. Trust reconcile step below also sets TRUST_RECONCILE_EVENT to github.event_name so
+#      trust-reconcile.js can event-scope bundle-required enforcement (ADR 0022 addendum,
+#      part 4): a push run on `main` (post-merge, after a squash-merge whose commit has no
+#      git ancestry back to the feature-branch commit a checkpoint was sealed against) is
+#      a loud no-op on Step 2 instead of a false failure — gating already happened on the
+#      PR run. This does NOT weaken PR-time gating: on pull_request, enforcement is
+#      unchanged.
 
 name: Trust Reconcile
 
@@ -63,6 +92,13 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # Full history (not the default shallow fetch-depth: 1): the bundle-ownership
+          # staleness check (ADR 0022 addendum, part 2) resolves `git merge-base
+          # --is-ancestor` against the checked-out repo, which needs parent commit
+          # objects a shallow clone does not have. See the CI-context contract note
+          # above this job.
+          fetch-depth: 0
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -80,6 +116,23 @@ jobs:
       - name: Trust reconcile
         id: trust-reconcile
         run: node scripts/ci/trust-reconcile.js
+        env:
+          # The change identity the bundle-ownership staleness check compares the
+          # discovered checkpoint's commit_sha against (ADR 0022 addendum, part 2). On a
+          # pull_request trigger, github.sha is GitHub's synthetic merge commit, not a
+          # commit any real seal-checkpoint run ever stamps — so this MUST be the PR's
+          # own head sha. On push/workflow_dispatch there is no pull_request context, and
+          # github.sha already is the real commit, so the fallback is exact, not a guess.
+          # This does NOT change what gets checked out/verified (Step 1 fresh verify is
+          # untouched) — only the sha used for the Step-2-ownership comparison.
+          TRUST_RECONCILE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          # Event-scoped enforcement (ADR 0022 addendum, part 4): lets trust-reconcile.js
+          # tell a gating pull_request run apart from a post-merge push run on `main` — a
+          # push run's bundle is expected to be absent/stale (squash-merge commits have no
+          # ancestry back to the feature-branch sha a checkpoint was sealed against) and
+          # must be a no-op, not a failure. Unset/unrecognized values fail toward the
+          # STRICTER (pull_request-shaped) enforcement — see resolveEnforcementEvent().
+          TRUST_RECONCILE_EVENT: ${{ github.event_name }}
         # Canonical verify: auto-discovered from package.json scripts["trust-reconcile-verify"]
         #   = npm run build && npm run eval:static
 #   (integration + the anti-gaming regression suite run in ci.yml's required
@@ -88,7 +141,12 @@ jobs:
         # compile-only check. Override via TRUST_RECONCILE_COMMANDS or --commands if needed.
         # Bundle auto-discovery: if delivery/trust.bundle or delivery/trust.checkpoint.json
         # exists in the checkout, CI reconciles per-command claimed passes against fresh
-        # results automatically. When absent, only the fresh verify is enforced (fail-open).
+        # results automatically. When absent, a bundle is REQUIRED by default (ADR 0022 §1):
+        # the job fails closed unless a well-formed, in-scope delivery/DECLARED
+        # no-agent-delivery marker is present, which exempts Step 2 (reconcile) only —
+        # Step 1 (fresh verify) still always runs. An auto-discovered bundle/checkpoint
+        # that does not attest THIS change (see the CI-context contract note above this
+        # job) is treated the same as absent (ADR 0022 addendum, part 2).
         # Phase 2: on success, writes ci-trust-reconcile-results.json to RUNNER_TEMP
         # for mint-attestation.js to consume.
 

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [3.0.0](https://github.com/kontourai/flow-agents/compare/v2.4.0...v3.0.0) (2026-07-04)
+
+
+### ⚠ BREAKING CHANGES
+
+* **trust:** require origin/check_kind stamps — remove pre-supersession read fallback ([#355](https://github.com/kontourai/flow-agents/issues/355))
+
+### Features
+
+* **routing:** model-routing policy as datum roles — orchestrator resolves at delegation ([#365](https://github.com/kontourai/flow-agents/issues/365)) ([7acf663](https://github.com/kontourai/flow-agents/commit/7acf6635125623505097eb0f7d2b0da7026c1b00))
+* **trust-anchor:** fail-closed delivery reconciliation with governed exemptions (ADR 0022 §1) ([#358](https://github.com/kontourai/flow-agents/issues/358)) ([0631050](https://github.com/kontourai/flow-agents/commit/0631050c7d88f3dd38d7c90ee1af5adf63410334))
+
+
+### Fixes
+
+* **trust:** critique supersession + lossless check/critique round-trip (closes [#267](https://github.com/kontourai/flow-agents/issues/267), [#268](https://github.com/kontourai/flow-agents/issues/268), [#282](https://github.com/kontourai/flow-agents/issues/282)) ([#344](https://github.com/kontourai/flow-agents/issues/344)) ([c2c3fd5](https://github.com/kontourai/flow-agents/commit/c2c3fd5d322d2537847d67a6fefc6daae6893070))
+* **trust:** require origin/check_kind stamps — remove pre-supersession read fallback ([#355](https://github.com/kontourai/flow-agents/issues/355)) ([ab27f71](https://github.com/kontourai/flow-agents/commit/ab27f71ac1ee652b7125ce01336895d34162472b))
+
+
+### Documentation
+
+* **contracts:** standing owner directives — durable home for ratified policy ([#351](https://github.com/kontourai/flow-agents/issues/351)) ([e335d54](https://github.com/kontourai/flow-agents/commit/e335d540378ba7eaae5bb7162427d8db16f58e4b))
+
 ## [2.4.0](https://github.com/kontourai/flow-agents/compare/v2.3.0...v2.4.0) (2026-07-03)
 
 

package/CONTEXT.md

@@ -56,6 +56,16 @@ A configured implementation of a capability, such as GitHub for backlog, Obsidia
 
 The declared capabilities, defaults, conventions, and limits of a provider type. Provider contracts make integrations predictable and testable without requiring the live provider.
 
+### Knowledge Graph
+
+The Knowledge Kit's storage-independent model: typed nodes (recommended core: note, decision, issue, session, person — extensible) and typed edges (supersedes, merged-into, blocks, evidence-of, mentions, relates — a closed vocabulary), each carrying provenance so every assertion is traceable to the store it came from. Storage and synchronisation are provider concerns; the same ingest, link, and health verbs run over every provider.
+_Avoid_: Graph database as the generic term (the model is provider-independent; a graph-database provider is a separate spike)
+
+### Knowledge Store Provider
+
+A configured implementation of the knowledge-store capability behind the Knowledge Graph model. Providers expose a read interface (nodes, edges, query-by-type) and a proposals-only write interface (proposeWrite returns a proposal, never mutating a human-curated store). The reference providers are markdown-vault (the Obsidian-shaped vault), git-repo (decision registry, CONTEXT.md vocabulary, learnings), and work-item (GitHub issues as a source/sink adapter). See context/contracts/knowledge-store-contract.md.
+_Avoid_: Knowledge adapter when contrasting the provider interface with a single store adapter
+
 ### Kontour Resource Contract
 
 A versioned Kontour record shape for durable machine-readable configuration, scope, run state, evidence, provider output, and cross-product interchange. Kontour Resource Contracts are the default for new pre-public durable contracts unless a product records why a native shape is clearer.
@@ -265,6 +275,11 @@ _Avoid_: Numbered ADR as the format for new decisions
 
 The system of Decision Records plus the generated index at [docs/decisions/index.md](docs/decisions/index.md) (slug + one-line summary). The contract is [context/contracts/decision-registry-contract.md](context/contracts/decision-registry-contract.md); the frontmatter schema is `schemas/decision-record.schema.json`; `npm run check:decisions` validates it. Consult the index at write time to decide revise-vs-create.
 
+### Standing Directives
+
+A short, numbered, quotable list of ratified owner directives, each with a one-line rationale and date, kept at [context/contracts/standing-directives.md](context/contracts/standing-directives.md) and pointed to from the header of every other contract file in `context/contracts/`. Standing Directives override default engineering conservatism (such as keeping a compatibility path "just in case") wherever they apply; they exist so a ratified correction has a durable home instead of living only in the ephemeral context of the orchestrator session that ratified it.
+_Avoid_: Operating discipline as the generic term for owner-ratified policy, restating a directive from memory instead of citing the file
+
 ### Promotion Gate
 
 The gated sequence — final acceptance -> promote -> archive — that makes durable-residue extraction the archival act: a delivered session's decisions, vocabulary, learnings, and doc updates must be promoted into durable living docs before the session is archived. The `promote` step records what was promoted where and writes a session-local **promotion claim** into the session `trust.bundle` (evidence refs = the durable doc paths written, or an explicit `--none` no-residue reason). `workflow-artifact-cleanup-audit` classifies a delivered/accepted session with no promotion claim as a cleanup candidate (archive blocked), not terminal. See [docs/decisions/promotion-gate.md](docs/decisions/promotion-gate.md) and [docs/workflow-artifact-lifecycle.md](docs/workflow-artifact-lifecycle.md).
@@ -312,3 +327,9 @@ The Console overview for global setup, registered projects, cross-project usage,
 ### Control API
 
 The shared tool layer used by the Console, CLI, AI agents, and automation. The Control API owns operations such as reading effective settings, explaining provider resolution, testing provider health, previewing config changes, writing config, inspecting workflow state, and reporting usage or eval outcomes.
+
+### Model Routing
+
+The policy that maps a delegate role name (such as `delegate-mechanical`, `delegate-implementation`, `delegate-design`, `orchestrator`, `extraction-default`) to a specific `model@provider` ref. Model Routing is data, not code: it lives in `.datum/config.json` (read by the `@kontourai/datum` registry, schema `datum.schema.json`) and never in generated files or per-agent frontmatter. The orchestrator resolves the role at delegation time (`datum resolve <role> --json`) and passes the resolved model explicitly when spawning each delegate. See [context/contracts/execution-contract.md](context/contracts/execution-contract.md) § Delegation: Model Routing and [docs/decisions/model-routing.md](docs/decisions/model-routing.md).
+_Avoid_: Generated per-agent model frontmatter, environment-variable-only model selection
+

package/build/src/cli/assignment-provider.d.ts

@@ -0,0 +1 @@
+export declare function main(argv?: string[]): number;