@kontourai/flow-agents 2.4.0 → 3.1.0

package/evals/integration/test_assignment_provider_local_file.sh

@@ -0,0 +1,222 @@
+#!/usr/bin/env bash
+# test_assignment_provider_local_file.sh — AssignmentProvider local-file round-trip (#290).
+#
+# Fully deterministic: exercises `assignment-provider claim|status|supersede|release|list
+# --provider local-file` against a temp artifact root and two fixed test-actor fixtures. No
+# network, no `gh` process, no live provider. Follows test_pull_work_provider.sh's
+# pass/fail/json_query idiom exactly.
+#
+# Supports AC5 (local-file round-trip), AC6 (list --actor), AC7 (concurrent claim never
+# silently overwrites), AC9 (no live gh process — none invoked here at all).
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+CLI="$ROOT/build/src/cli.js"
+FIXTURES="$ROOT/evals/fixtures/assignment-provider"
+ACTOR_A="$FIXTURES/actor-a.json"
+ACTOR_B="$FIXTURES/actor-b.json"
+SUBJECT_ID="kontourai/flow-agents#9001"
+BRANCH_A="agent/claude-code-eval-actor-a-session-eval-host/flow-agents-9001"
+ARTIFACT_DIR_A=".kontourai/flow-agents/flow-agents-9001"
+
+TMPDIR_EVAL="$(mktemp -d)"
+trap 'rm -rf "$TMPDIR_EVAL"' EXIT
+ARTIFACT_ROOT="$TMPDIR_EVAL/artifact-root"
+
+errors=0
+pass() { echo "  ✓ $1"; }
+fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
+
+json_query() {
+  node -e 'const fs=require("fs"); let cur=JSON.parse(fs.readFileSync(process.argv[1],"utf8")); for (const part of process.argv[2].split(".")) cur=part==="length" ? cur.length : (Array.isArray(cur) ? cur[Number(part)] : cur[part]); console.log(cur);' "$1" "$2"
+}
+
+if [[ ! -f "$CLI" ]]; then
+  echo "build/src/cli.js not found — run 'npm run build' first" >&2
+  exit 1
+fi
+
+echo "=== AssignmentProvider: local-file round-trip ==="
+
+# 1. claim writes the exact versioned record shape (Design Decision 2) for a fixed test actor.
+node "$CLI" assignment-provider claim \
+  --provider local-file --artifact-root "$ARTIFACT_ROOT" \
+  --subject-id "$SUBJECT_ID" \
+  --actor-json "$ACTOR_A" \
+  --branch "$BRANCH_A" \
+  --artifact-dir "$ARTIFACT_DIR_A" \
+  --ttl-seconds 1800 \
+  > "$TMPDIR_EVAL/claim-a.json"
+status=$?
+[[ "$status" -eq 0 ]] && pass "claim exits successfully" || fail "claim exits successfully"
+
+[[ "$(json_query "$TMPDIR_EVAL/claim-a.json" "record.schema_version")" == "1.0" ]] && pass "claim record schema_version is 1.0" || fail "claim record schema_version is 1.0"
+[[ "$(json_query "$TMPDIR_EVAL/claim-a.json" "record.role")" == "AssignmentClaimRecord" ]] && pass "claim record role is AssignmentClaimRecord" || fail "claim record role is AssignmentClaimRecord"
+[[ "$(json_query "$TMPDIR_EVAL/claim-a.json" "record.subject_id")" == "$SUBJECT_ID" ]] && pass "claim record subject_id matches" || fail "claim record subject_id matches"
+[[ "$(json_query "$TMPDIR_EVAL/claim-a.json" "record.actor.session_id")" == "eval-actor-a-session" ]] && pass "claim record actor matches fixed test actor A" || fail "claim record actor matches fixed test actor A"
+[[ "$(json_query "$TMPDIR_EVAL/claim-a.json" "record.ttl_seconds")" == "1800" ]] && pass "claim record ttl_seconds matches" || fail "claim record ttl_seconds matches"
+[[ "$(json_query "$TMPDIR_EVAL/claim-a.json" "record.branch")" == "$BRANCH_A" ]] && pass "claim record branch matches" || fail "claim record branch matches"
+[[ "$(json_query "$TMPDIR_EVAL/claim-a.json" "record.artifact_dir")" == "$ARTIFACT_DIR_A" ]] && pass "claim record artifact_dir matches" || fail "claim record artifact_dir matches"
+[[ "$(json_query "$TMPDIR_EVAL/claim-a.json" "record.status")" == "claimed" ]] && pass "claim record status is claimed" || fail "claim record status is claimed"
+[[ "$(json_query "$TMPDIR_EVAL/claim-a.json" "record.audit_trail.0.transition")" == "claim" ]] && pass "claim record audit_trail records the claim transition" || fail "claim record audit_trail records the claim transition"
+
+CLAIMED_AT="$(json_query "$TMPDIR_EVAL/claim-a.json" "record.claimed_at")"
+
+# 2. status returns actor/claimedAt matching what claim wrote.
+node "$CLI" assignment-provider status \
+  --provider local-file --artifact-root "$ARTIFACT_ROOT" --subject-id "$SUBJECT_ID" \
+  > "$TMPDIR_EVAL/status-a.json"
+[[ "$(json_query "$TMPDIR_EVAL/status-a.json" "assignment.assignee")" == "claude-code:eval-actor-a-session:eval-host" ]] && pass "status reports actor A as assignee" || fail "status reports actor A as assignee"
+[[ "$(json_query "$TMPDIR_EVAL/status-a.json" "assignment.record.claimed_at")" == "$CLAIMED_AT" ]] && pass "status claimed_at matches claim's claimed_at" || fail "status claimed_at matches claim's claimed_at"
+
+# 3. supersede A -> B updates the actor and records an audit trail entry.
+node "$CLI" assignment-provider supersede \
+  --provider local-file --artifact-root "$ARTIFACT_ROOT" --subject-id "$SUBJECT_ID" \
+  --from-actor-json "$ACTOR_A" --to-actor-json "$ACTOR_B" --reason "handoff-eval" \
+  > "$TMPDIR_EVAL/supersede.json"
+status=$?
+[[ "$status" -eq 0 ]] && pass "supersede exits successfully" || fail "supersede exits successfully"
+[[ "$(json_query "$TMPDIR_EVAL/supersede.json" "record.actor.session_id")" == "eval-actor-b-session" ]] && pass "supersede updates the record's actor to B" || fail "supersede updates the record's actor to B"
+[[ "$(json_query "$TMPDIR_EVAL/supersede.json" "record.audit_trail.length")" == "2" ]] && pass "supersede appends to the audit trail (claim + supersede)" || fail "supersede appends to the audit trail (claim + supersede)"
+[[ "$(json_query "$TMPDIR_EVAL/supersede.json" "record.audit_trail.1.transition")" == "supersede" ]] && pass "audit trail records the supersede transition" || fail "audit trail records the supersede transition"
+[[ "$(json_query "$TMPDIR_EVAL/supersede.json" "record.audit_trail.1.from_actor.session_id")" == "eval-actor-a-session" ]] && pass "audit trail supersede entry records from_actor A" || fail "audit trail supersede entry records from_actor A"
+[[ "$(json_query "$TMPDIR_EVAL/supersede.json" "record.audit_trail.1.to_actor.session_id")" == "eval-actor-b-session" ]] && pass "audit trail supersede entry records to_actor B" || fail "audit trail supersede entry records to_actor B"
+[[ "$(json_query "$TMPDIR_EVAL/supersede.json" "record.audit_trail.1.reason")" == "handoff-eval" ]] && pass "audit trail supersede entry records reason" || fail "audit trail supersede entry records reason"
+
+node "$CLI" assignment-provider status \
+  --provider local-file --artifact-root "$ARTIFACT_ROOT" --subject-id "$SUBJECT_ID" \
+  > "$TMPDIR_EVAL/status-b.json"
+[[ "$(json_query "$TMPDIR_EVAL/status-b.json" "assignment.assignee")" == "claude-code:eval-actor-b-session:eval-host" ]] && pass "status reports actor B after supersede" || fail "status reports actor B after supersede"
+
+# 4. release clears the claim; subsequent status reports free.
+node "$CLI" assignment-provider release \
+  --provider local-file --artifact-root "$ARTIFACT_ROOT" --subject-id "$SUBJECT_ID" \
+  --actor-json "$ACTOR_B" \
+  > "$TMPDIR_EVAL/release.json"
+status=$?
+[[ "$status" -eq 0 ]] && pass "release exits successfully" || fail "release exits successfully"
+[[ "$(json_query "$TMPDIR_EVAL/release.json" "record.status")" == "released" ]] && pass "release sets record status to released" || fail "release sets record status to released"
+
+node "$CLI" assignment-provider status \
+  --provider local-file --artifact-root "$ARTIFACT_ROOT" --subject-id "$SUBJECT_ID" \
+  --liveness-events-json <(echo '[]') \
+  > "$TMPDIR_EVAL/status-free.json"
+[[ "$(json_query "$TMPDIR_EVAL/status-free.json" "assignment.assignee")" == "null" ]] && pass "status reports no assignee after release" || fail "status reports no assignee after release"
+[[ "$(json_query "$TMPDIR_EVAL/status-free.json" "effective.effective_state")" == "free" ]] && pass "status reports effective_state free after release" || fail "status reports effective_state free after release"
+
+# 5. list --actor returns exactly that actor's claimed subject ids (claim a second subject
+#    under actor A, then verify list --actor A returns exactly that one subject).
+SUBJECT_ID_2="kontourai/flow-agents#9002"
+node "$CLI" assignment-provider claim \
+  --provider local-file --artifact-root "$ARTIFACT_ROOT" \
+  --subject-id "$SUBJECT_ID_2" \
+  --actor-json "$ACTOR_A" \
+  --branch "agent/claude-code-eval-actor-a-session-eval-host/flow-agents-9002" \
+  --artifact-dir ".kontourai/flow-agents/flow-agents-9002" \
+  > /dev/null
+node "$CLI" assignment-provider list \
+  --provider local-file --artifact-root "$ARTIFACT_ROOT" --actor-json "$ACTOR_A" \
+  > "$TMPDIR_EVAL/list-a.json"
+[[ "$(json_query "$TMPDIR_EVAL/list-a.json" "subject_ids.length")" == "1" ]] && pass "list --actor A returns exactly one subject id" || fail "list --actor A returns exactly one subject id"
+[[ "$(json_query "$TMPDIR_EVAL/list-a.json" "subject_ids.0")" == "$SUBJECT_ID_2" ]] && pass "list --actor A returns actor A's currently-claimed subject (released subject excluded)" || fail "list --actor A returns actor A's currently-claimed subject (released subject excluded)"
+
+node "$CLI" assignment-provider list \
+  --provider local-file --artifact-root "$ARTIFACT_ROOT" --actor-json "$ACTOR_B" \
+  > "$TMPDIR_EVAL/list-b.json"
+[[ "$(json_query "$TMPDIR_EVAL/list-b.json" "subject_ids.length")" == "0" ]] && pass "list --actor B returns no subject ids (its only claim was released)" || fail "list --actor B returns no subject ids (its only claim was released)"
+
+# 6. Two concurrent claims on the same subject from different actors: the second call must
+#    fail loud (non-zero exit + holder-identifying error), never silently overwrite the first
+#    (AC7; artifact-contract.md's "fail loud, never fail-open" persistence rule).
+node "$CLI" assignment-provider claim \
+  --provider local-file --artifact-root "$ARTIFACT_ROOT" \
+  --subject-id "$SUBJECT_ID_2" \
+  --actor-json "$ACTOR_B" \
+  --branch "agent/claude-code-eval-actor-b-session-eval-host/flow-agents-9002" \
+  --artifact-dir ".kontourai/flow-agents/flow-agents-9002" \
+  > "$TMPDIR_EVAL/concurrent-claim.json" 2> "$TMPDIR_EVAL/concurrent-claim.err"
+concurrent_status=$?
+[[ "$concurrent_status" -ne 0 ]] && pass "second claim from a different actor fails loud (non-zero exit)" || fail "second claim from a different actor fails loud (non-zero exit)"
+grep -q "already claimed by a different actor" "$TMPDIR_EVAL/concurrent-claim.err" && pass "second claim's error identifies the existing holder" || fail "second claim's error identifies the existing holder"
+
+node "$CLI" assignment-provider status \
+  --provider local-file --artifact-root "$ARTIFACT_ROOT" --subject-id "$SUBJECT_ID_2" \
+  > "$TMPDIR_EVAL/status-after-concurrent.json"
+[[ "$(json_query "$TMPDIR_EVAL/status-after-concurrent.json" "assignment.assignee")" == "claude-code:eval-actor-a-session:eval-host" ]] && pass "record still shows actor A as holder — no silent overwrite" || fail "record still shows actor A as holder — no silent overwrite"
+
+# Same-actor re-claim (refresh before TTL expiry) is allowed and idempotent — must not error.
+node "$CLI" assignment-provider claim \
+  --provider local-file --artifact-root "$ARTIFACT_ROOT" \
+  --subject-id "$SUBJECT_ID_2" \
+  --actor-json "$ACTOR_A" \
+  --branch "agent/claude-code-eval-actor-a-session-eval-host/flow-agents-9002" \
+  --artifact-dir ".kontourai/flow-agents/flow-agents-9002" \
+  > /dev/null 2>&1
+[[ $? -eq 0 ]] && pass "same-actor re-claim (refresh) succeeds without error" || fail "same-actor re-claim (refresh) succeeds without error"
+
+echo ""
+
+# 7. F1 fix-plan iteration 1 (CRITICAL): GENUINE OS-process concurrency — two REAL,
+#    concurrently-launched `claim` processes (background `&` + `wait`, not the sequential case in
+#    section 6 above which never actually races) targeting the SAME fresh subject from DIFFERENT
+#    actors. Before the withSubjectLock fix, both processes could read "no existing claim" before
+#    either wrote, and one write would silently clobber the other (reproduced 29/40 races against
+#    the built CLI pre-fix). Assert EXACTLY ONE process exits 0, and the on-disk record shows
+#    exactly one holder with an intact, single-entry audit trail (no lost write).
+SUBJECT_ID_RACE="kontourai/flow-agents#9003"
+BRANCH_RACE_A="agent/claude-code-eval-actor-a-session-eval-host/flow-agents-9003"
+BRANCH_RACE_B="agent/claude-code-eval-actor-b-session-eval-host/flow-agents-9003"
+ARTIFACT_DIR_RACE=".kontourai/flow-agents/flow-agents-9003"
+
+(
+  node "$CLI" assignment-provider claim \
+    --provider local-file --artifact-root "$ARTIFACT_ROOT" \
+    --subject-id "$SUBJECT_ID_RACE" \
+    --actor-json "$ACTOR_A" \
+    --branch "$BRANCH_RACE_A" \
+    --artifact-dir "$ARTIFACT_DIR_RACE" \
+    > "$TMPDIR_EVAL/race-a.out" 2> "$TMPDIR_EVAL/race-a.err"
+  echo $? > "$TMPDIR_EVAL/race-a.rc"
+) &
+PID_A=$!
+(
+  node "$CLI" assignment-provider claim \
+    --provider local-file --artifact-root "$ARTIFACT_ROOT" \
+    --subject-id "$SUBJECT_ID_RACE" \
+    --actor-json "$ACTOR_B" \
+    --branch "$BRANCH_RACE_B" \
+    --artifact-dir "$ARTIFACT_DIR_RACE" \
+    > "$TMPDIR_EVAL/race-b.out" 2> "$TMPDIR_EVAL/race-b.err"
+  echo $? > "$TMPDIR_EVAL/race-b.rc"
+) &
+PID_B=$!
+wait "$PID_A" "$PID_B"
+
+RACE_RC_A="$(cat "$TMPDIR_EVAL/race-a.rc")"
+RACE_RC_B="$(cat "$TMPDIR_EVAL/race-b.rc")"
+
+if { [[ "$RACE_RC_A" -eq 0 && "$RACE_RC_B" -ne 0 ]] || [[ "$RACE_RC_A" -ne 0 && "$RACE_RC_B" -eq 0 ]]; }; then
+  pass "genuine concurrent claim race: exactly one process wins (rc_a=$RACE_RC_A rc_b=$RACE_RC_B)"
+else
+  fail "genuine concurrent claim race: exactly one process wins (rc_a=$RACE_RC_A rc_b=$RACE_RC_B)"
+fi
+
+node "$CLI" assignment-provider status \
+  --provider local-file --artifact-root "$ARTIFACT_ROOT" --subject-id "$SUBJECT_ID_RACE" \
+  > "$TMPDIR_EVAL/status-race.json"
+[[ "$(json_query "$TMPDIR_EVAL/status-race.json" "assignment.record.audit_trail.length")" == "1" ]] && pass "race winner's on-disk record has exactly one audit_trail entry (no lost/merged write)" || fail "race winner's on-disk record has exactly one audit_trail entry (no lost/merged write)"
+
+if [[ "$RACE_RC_A" -eq 0 ]]; then
+  EXPECTED_RACE_HOLDER="claude-code:eval-actor-a-session:eval-host"
+else
+  EXPECTED_RACE_HOLDER="claude-code:eval-actor-b-session:eval-host"
+fi
+[[ "$(json_query "$TMPDIR_EVAL/status-race.json" "assignment.assignee")" == "$EXPECTED_RACE_HOLDER" ]] && pass "on-disk record holder matches the process that actually exited 0 (no silent overwrite by the loser)" || fail "on-disk record holder matches the process that actually exited 0 (no silent overwrite by the loser)"
+
+echo ""
+if [[ "$errors" -eq 0 ]]; then
+  echo "test_assignment_provider_local_file: all checks passed."
+else
+  echo "test_assignment_provider_local_file: $errors check(s) failed."
+fi
+exit "$errors"

package/evals/integration/test_critique_supersession_roundtrip.sh

@@ -0,0 +1,182 @@
+#!/usr/bin/env bash
+# test_critique_supersession_roundtrip.sh — Regression evals for the trust-ledger defects
+# fixed under #267 (critique supersession), #268 (lossless, type-stable check/critique
+# round-trip), and #282 (first-class superseded_by affordance).
+#
+# Proves:
+#   (a) record-critique twice for the same id (fail → pass, SAME reviewer) supersedes the fail:
+#       the effective/live state is the pass, the historical fail is retained (status=superseded,
+#       metadata.superseded_by) but excluded from evaluation, no duplicate claim ids, and CI
+#       trust-reconcile exits 0.
+#   (b) HEADLINE: a --flow-id (builder.build/verify) session — ensure-session → record-evidence
+#       (mixed session-local kinds) → record-critique → trust-reconcile — exits 0. This exact flow
+#       could never converge before (critique claims were re-absorbed as command-less test_output
+#       checks → permanent [not-run] divergence; check kinds collapsed to the declared claimType).
+#   (c) record-evidence AFTER a critique preserves the critique history (previously hardcoded []).
+#   (d) ANTI-GAMING: a DIFFERENT reviewer cannot supersede a reviewer's fail — the disputed
+#       critique stays live and trust-reconcile still exits 1 (worker cannot bury a reviewer finding).
+#   (e) VALIDATOR (#282): a top-level pass tolerates a superseded historical fail member, but a
+#       LIVE (non-superseded) fail still triggers "required critique must pass".
+#
+# Deterministic, no model spend, self-cleaning.
+# Usage: bash evals/integration/test_critique_supersession_roundtrip.sh
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+source "$ROOT/evals/lib/node.sh"
+RECON="$ROOT/scripts/ci/trust-reconcile.js"
+WRITER="workflow-sidecar"
+
+TMP="$(mktemp -d)"
+errors=0
+_pass() { echo "  PASS: $1"; }
+_fail() { echo "  FAIL: $1"; errors=$((errors + 1)); }
+cleanup() { rm -rf "$TMP"; }
+trap cleanup EXIT
+
+# seed <aroot> <slug> [flow-args...] — ensure-session + init-plan
+seed() {
+  local aroot="$1"; local slug="$2"; shift 2
+  mkdir -p "$aroot"
+  flow_agents_node "$WRITER" ensure-session --artifact-root "$aroot" --task-slug "$slug" \
+    --title "T" --summary "S" --timestamp "2026-07-01T00:00:00Z" "$@" >/dev/null 2>&1
+  flow_agents_node "$WRITER" init-plan "$aroot/$slug/$slug--deliver.md" \
+    --source-request "R" --summary "S" --timestamp "2026-07-01T00:00:00Z" >/dev/null 2>&1
+}
+
+# ─── (a) same-reviewer supersession: fail → pass ──────────────────────────────
+echo ""
+echo "=== (a) record-critique fail→pass (same reviewer) supersedes, history intact, reconcile 0 ==="
+A_AROOT="$TMP/a/aroot"; A_SLUG="supersede-same"; A_DIR="$A_AROOT/$A_SLUG"
+seed "$A_AROOT" "$A_SLUG"
+flow_agents_node "$WRITER" record-evidence "$A_DIR" --verdict pass \
+  --check-json '{"id":"c1","kind":"diff","status":"pass","summary":"diff check"}' \
+  --timestamp "2026-07-01T00:01:00Z" >/dev/null 2>&1
+flow_agents_node "$WRITER" record-critique "$A_DIR" --id rv --reviewer alice --verdict fail \
+  --summary "found a bug" --timestamp "2026-07-01T00:02:00Z" >/dev/null 2>&1
+flow_agents_node "$WRITER" record-critique "$A_DIR" --id rv --reviewer alice --verdict pass \
+  --summary "bug fixed" --timestamp "2026-07-01T00:03:00Z" >/dev/null 2>&1
+
+node - "$A_DIR/trust.bundle" << 'NODE'
+const fs = require('fs');
+const b = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+const crit = (b.claims||[]).filter(c => c.metadata && c.metadata.origin === 'critique');
+const live = crit.filter(c => !c.metadata.superseded_by);
+const hist = crit.filter(c => c.metadata.superseded_by);
+if (crit.length !== 2) throw new Error('expected 2 critique claims (1 live + 1 history), got ' + crit.length);
+if (live.length !== 1 || live[0].value !== 'pass') throw new Error('expected exactly 1 LIVE critique with value=pass, got ' + JSON.stringify(live.map(c=>c.value)));
+if (hist.length !== 1 || hist[0].value !== 'fail' || hist[0].status !== 'superseded') throw new Error('expected historical fail with status=superseded');
+if (!hist[0].metadata.superseded_by) throw new Error('history missing first-class metadata.superseded_by');
+const ids = (b.claims||[]).map(c=>c.id); const dup = ids.filter((x,i)=>ids.indexOf(x)!==i);
+if (dup.length) throw new Error('duplicate claim ids in bundle: ' + dup.join(','));
+console.log('live=pass, history=fail(superseded), no duplicate ids');
+NODE
+if [[ $? -eq 0 ]]; then _pass "(a) effective state=pass, historical fail retained+superseded, no dup ids"; else _fail "(a) supersession/history assertion failed"; fi
+
+TRUST_RECONCILE_COMMANDS="true" node "$RECON" --bundle "$A_DIR/trust.bundle" --repo-root "$TMP/a" >"$TMP/a-recon.log" 2>&1
+if [[ $? -eq 0 ]]; then _pass "(a) trust-reconcile exits 0 (resolved session converges)"; else _fail "(a) trust-reconcile did NOT converge: $(cat "$TMP/a-recon.log")"; fi
+
+# ─── (b) HEADLINE: --flow-id session converges ────────────────────────────────
+echo ""
+echo "=== (b) HEADLINE --flow-id builder.build/verify: mixed evidence + critique → reconcile 0 ==="
+B_AROOT="$TMP/b/aroot"; B_SLUG="flowid-converge"; B_DIR="$B_AROOT/$B_SLUG"
+seed "$B_AROOT" "$B_SLUG" --flow-id builder.build --step-id verify
+flow_agents_node "$WRITER" record-evidence "$B_DIR" --verdict pass \
+  --check-json '{"id":"k-diff","kind":"diff","status":"pass","summary":"diff excerpt"}' \
+  --check-json '{"id":"k-policy","kind":"policy","status":"pass","summary":"policy rule"}' \
+  --check-json '{"id":"k-ext","kind":"external","status":"pass","summary":"attested"}' \
+  --timestamp "2026-07-01T00:01:00Z" >/dev/null 2>&1
+flow_agents_node "$WRITER" record-critique "$B_DIR" --id code-review --reviewer alice --verdict pass \
+  --summary "looks good" --timestamp "2026-07-01T00:02:00Z" >/dev/null 2>&1
+
+node - "$B_DIR/trust.bundle" << 'NODE'
+const fs = require('fs');
+const b = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+// Type stability: no critique claim may be re-absorbed as a check, and check kinds/evidenceTypes
+// must survive the round-trip (a session-local kind must NOT flip to test_output).
+const checks = (b.claims||[]).filter(c => c.metadata && c.metadata.origin === 'check');
+const crit = (b.claims||[]).filter(c => c.metadata && c.metadata.origin === 'critique');
+if (crit.length !== 1) throw new Error('expected exactly 1 critique claim (no re-absorption/duplication), got ' + crit.length);
+const evByClaim = {}; for (const e of (b.evidence||[])) (evByClaim[e.claimId] ||= []).push(e);
+for (const c of checks) {
+  const ets = (evByClaim[c.id]||[]).map(e=>e.evidenceType);
+  if (ets.includes('test_output')) throw new Error('session-local check ' + c.id + ' flipped to test_output evidence (round-trip kind instability)');
+}
+console.log(checks.length + ' check claims, ' + crit.length + ' critique claim; no test_output flip');
+NODE
+if [[ $? -eq 0 ]]; then _pass "(b) round-trip type-stable under --flow-id (no critique→check absorption, no evidenceType flip)"; else _fail "(b) round-trip type instability under --flow-id"; fi
+
+TRUST_RECONCILE_COMMANDS="true" node "$RECON" --bundle "$B_DIR/trust.bundle" --repo-root "$TMP/b" >"$TMP/b-recon.log" 2>&1
+if [[ $? -eq 0 ]]; then _pass "(b) HEADLINE: --flow-id session trust-reconcile exits 0 (converges)"; else _fail "(b) HEADLINE --flow-id session did NOT converge: $(cat "$TMP/b-recon.log")"; fi
+
+# ─── (c) record-evidence after critiques preserves history ────────────────────
+echo ""
+echo "=== (c) record-evidence AFTER a critique preserves critique history (#268) ==="
+flow_agents_node "$WRITER" record-evidence "$B_DIR" --verdict pass \
+  --check-json '{"id":"k-diff2","kind":"diff","status":"pass","summary":"another diff"}' \
+  --timestamp "2026-07-01T00:04:00Z" >/dev/null 2>&1
+node - "$B_DIR/trust.bundle" << 'NODE'
+const fs = require('fs');
+const b = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+const crit = (b.claims||[]).filter(c => c.metadata && c.metadata.origin === 'critique');
+if (crit.length !== 1) throw new Error('critique history dropped by record-evidence — expected 1, got ' + crit.length);
+if (crit[0].value !== 'pass') throw new Error('critique value changed');
+console.log('critique survived record-evidence');
+NODE
+if [[ $? -eq 0 ]]; then _pass "(c) critique history survives a later record-evidence call"; else _fail "(c) record-evidence dropped critique history"; fi
+
+# ─── (d) ANTI-GAMING: cross-reviewer cannot supersede a reviewer fail ─────────
+echo ""
+echo "=== (d) ANTI-GAMING: a different reviewer cannot supersede a reviewer's fail ==="
+D_AROOT="$TMP/d/aroot"; D_SLUG="supersede-cross"; D_DIR="$D_AROOT/$D_SLUG"
+seed "$D_AROOT" "$D_SLUG"
+flow_agents_node "$WRITER" record-evidence "$D_DIR" --verdict pass \
+  --check-json '{"id":"c1","kind":"diff","status":"pass","summary":"diff check"}' \
+  --timestamp "2026-07-01T00:01:00Z" >/dev/null 2>&1
+flow_agents_node "$WRITER" record-critique "$D_DIR" --id rv --reviewer reviewer-bob --verdict fail \
+  --summary "reviewer found a real bug" --timestamp "2026-07-01T00:02:00Z" >/dev/null 2>&1
+flow_agents_node "$WRITER" record-critique "$D_DIR" --id rv --reviewer worker-mallory --verdict pass \
+  --summary "worker claims fixed" --timestamp "2026-07-01T00:03:00Z" >/dev/null 2>&1
+node - "$D_DIR/trust.bundle" << 'NODE'
+const fs = require('fs');
+const b = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+const crit = (b.claims||[]).filter(c => c.metadata && c.metadata.origin === 'critique');
+const live = crit.filter(c => !c.metadata.superseded_by);
+const liveFail = live.filter(c => c.value === 'fail' || c.status === 'disputed');
+if (!liveFail.length) throw new Error('ANTI-GAMING VIOLATION: reviewer fail was superseded by a different reviewer');
+if (crit.some(c => c.metadata.superseded_by)) throw new Error('unexpected supersession across reviewers');
+console.log('reviewer fail stays LIVE (' + liveFail.length + '); cross-reviewer supersession refused');
+NODE
+if [[ $? -eq 0 ]]; then _pass "(d) reviewer's fail is NOT superseded by a different reviewer (stays live)"; else _fail "(d) ANTI-GAMING regression: cross-reviewer supersession occurred"; fi
+TRUST_RECONCILE_COMMANDS="true" node "$RECON" --bundle "$D_DIR/trust.bundle" --repo-root "$TMP/d" >"$TMP/d-recon.log" 2>&1
+if [[ $? -ne 0 ]] && grep -q "session-local-failed" "$TMP/d-recon.log"; then _pass "(d) trust-reconcile still exits 1 (live disputed critique blocks)"; else _fail "(d) reconcile should have blocked on the live reviewer fail"; fi
+
+# ─── (e) VALIDATOR (#282): superseded fail tolerated, live fail blocks ────────
+echo ""
+echo "=== (e) VALIDATOR: superseded historical fail tolerated; live fail blocks (#282) ==="
+# Reuse (a)'s superseded bundle: pass top-level with a superseded fail member.
+va_out="$(flow_agents_node validate-workflow-artifacts "$A_AROOT" --require-sidecars --require-critique 2>&1)"
+if echo "$va_out" | grep -q "required critique must pass"; then
+  _fail "(e) validator wrongly rejected a superseded historical fail"
+else
+  _pass "(e) validator tolerates a superseded historical fail member (no 'required critique must pass')"
+fi
+# Live fail (d's cross-reviewer bundle has a live disputed critique) must still be rejected.
+vd_out="$(flow_agents_node validate-workflow-artifacts "$D_AROOT" --require-sidecars --require-critique 2>&1)"
+if echo "$vd_out" | grep -q "required critique must pass"; then
+  _pass "(e) validator still rejects a LIVE (non-superseded) fail critique"
+else
+  _fail "(e) validator failed to reject a live fail critique"
+fi
+
+# ─── Summary ──────────────────────────────────────────────────────────────────
+echo ""
+echo "────────────────────────────────────────────"
+if [[ $errors -eq 0 ]]; then
+  echo "test_critique_supersession_roundtrip: all checks passed."
+  exit 0
+else
+  echo "test_critique_supersession_roundtrip: $errors check(s) failed."
+  exit 1
+fi