@kontourai/flow-agents 3.0.0 → 3.2.0

package/kits/knowledge/providers/neo4j/sync.js

@@ -0,0 +1,235 @@
+/**
+ * Sync / materialize: import the file/work-item providers into Neo4j.
+ *
+ * The file stores remain the SOURCE OF TRUTH; the graph is a queryable
+ * materialized view. Sync reuses the #317 providers as READERS (no forked
+ * extractors) and MERGEs their combined graph into Neo4j with MERGE semantics,
+ * so a re-sync of unchanged data reports zero writes (AC1). A snapshot digest +
+ * timestamp is recorded on the graph so the second run can short-circuit and so
+ * the graph is point-in-time attributable.
+ *
+ * Marker tolerance (spike finding 3: 3/19 metadata markers failed JSON.parse in
+ * the wild): a provider that throws while reading MUST NOT kill the whole sync.
+ * Each provider is read behind a guard that falls back to an empty contribution
+ * and records the error; the work-item provider already falls back from a
+ * malformed metadata marker to prose refs, and this guard covers the rest.
+ *
+ * Pure planning (planSync/computeDigest) is separated from IO (syncToNeo4j) so
+ * idempotency is unit-testable with no driver and no Docker.
+ *
+ * @module providers/neo4j/sync
+ */
+
+import { createHash } from "node:crypto";
+import {
+  typeToLabel,
+  edgeTypeToRel,
+  nodeToProps,
+  edgeToProps,
+  SNAPSHOT_LABEL,
+  SNAPSHOT_ID,
+  READ_SNAPSHOT_CYPHER,
+} from "./cypher.js";
+
+/** Deterministic JSON (sorted keys) for hashing. */
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.keys(value)
+      .sort()
+      .map((k) => `${JSON.stringify(k)}:${canonical(value[k])}`)
+      .join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+/**
+ * The graph is a materialized view keyed on CONTENT, not on when it was read.
+ * Provenance carries volatile fields (retrieved_at, agent) that change every
+ * read — including them would defeat idempotency (a re-sync of unchanged stores
+ * would rewrite every element). Strip them for identity; the snapshot's
+ * synced_at records the point-in-time separately.
+ */
+function contentIdentity(el) {
+  const clone = JSON.parse(JSON.stringify(el));
+  if (clone.provenance) {
+    delete clone.provenance.retrieved_at;
+    delete clone.provenance.agent;
+  }
+  return clone;
+}
+
+/** Content hash of a single node/edge (drives the idempotent hash-guarded SET). */
+export function hashElement(el) {
+  return createHash("sha256").update(canonical(contentIdentity(el))).digest("hex").slice(0, 16);
+}
+
+/** Digest of the whole materialized graph (drives the zero-write short-circuit). */
+export function computeDigest(graph) {
+  const nodes = [...(graph.nodes || [])].map(contentIdentity).sort((a, b) => a.id.localeCompare(b.id));
+  const edges = [...(graph.edges || [])].map(contentIdentity).sort((a, b) => a.id.localeCompare(b.id));
+  return createHash("sha256").update(canonical({ nodes, edges })).digest("hex");
+}
+
+/** Read one provider's graph behind a guard; never let one provider kill sync. */
+async function safeReadGraph(provider, errors) {
+  try {
+    const g = await provider.readGraph();
+    return { nodes: g.nodes || [], edges: g.edges || [] };
+  } catch (err) {
+    errors.push({ provider: provider?.id || provider?.constructor?.name || "unknown", error: String(err && err.message || err) });
+    return { nodes: [], edges: [] };
+  }
+}
+
+/**
+ * Materialize the combined graph from the provider readers. Dedupes nodes and
+ * edges by id (last write wins on id collision across providers).
+ * @param {object[]} providers  #317 provider instances (vault, git-repo, work-item, …)
+ * @returns {Promise<{ nodes:object[], edges:object[], errors:object[] }>}
+ */
+export async function materializeGraph(providers) {
+  const errors = [];
+  const nodeById = new Map();
+  const edgeById = new Map();
+  for (const provider of providers) {
+    const { nodes, edges } = await safeReadGraph(provider, errors);
+    for (const n of nodes) nodeById.set(n.id, n);
+    for (const e of edges) edgeById.set(e.id, e);
+  }
+  return { nodes: [...nodeById.values()], edges: [...edgeById.values()], errors };
+}
+
+/**
+ * Pure sync plan. Given the materialized graph and the prior snapshot digest,
+ * decide whether anything changed and produce the parameterized MERGE
+ * statements. When the digest is unchanged, the plan is a no-op (AC1: second run
+ * reports zero writes) unless `force` is set.
+ *
+ * @param {{nodes:object[],edges:object[]}} graph
+ * @param {string|null} priorDigest
+ * @param {object} [options]
+ * @param {boolean} [options.force=false] emit statements even when unchanged
+ * @returns {{ digest:string, unchanged:boolean, statements:{cypher:string,params:object}[] }}
+ */
+export function planSync(graph, priorDigest, options = {}) {
+  const digest = computeDigest(graph);
+  const unchanged = digest === priorDigest;
+  if (unchanged && !options.force) {
+    return { digest, unchanged, statements: [] };
+  }
+
+  const statements = [];
+
+  // Nodes grouped by contract type -> one MERGE per Neo4j label. Hash-guarded
+  // SET so an unchanged node produces zero propertiesSet on re-run.
+  const nodesByLabel = new Map();
+  for (const n of graph.nodes || []) {
+    const label = typeToLabel(n.type);
+    if (!nodesByLabel.has(label)) nodesByLabel.set(label, []);
+    nodesByLabel.get(label).push(nodeToProps(n, hashElement(n)));
+  }
+  for (const [label, rows] of nodesByLabel) {
+    statements.push({
+      cypher: `UNWIND $rows AS r MERGE (n:${label} {id:r.id}) WITH n, r WHERE coalesce(n._kg_hash,'') <> r._kg_hash SET n += r`,
+      params: { rows },
+    });
+  }
+
+  // Edges grouped by rel type. Endpoints matched by id regardless of label
+  // (spike: polyglot property bags "just work"); edges to a not-yet-synced node
+  // are skipped by the MATCH (external/dangling refs stay out of the view).
+  const edgesByRel = new Map();
+  for (const e of graph.edges || []) {
+    const rel = edgeTypeToRel(e.type);
+    if (!edgesByRel.has(rel)) edgesByRel.set(rel, []);
+    edgesByRel.get(rel).push(edgeToProps(e, hashElement(e)));
+  }
+  for (const [rel, rows] of edgesByRel) {
+    statements.push({
+      cypher: `UNWIND $rows AS r MATCH (a {id:r.from}) MATCH (b {id:r.to}) MERGE (a)-[x:${rel} {id:r.id}]->(b) WITH x, r WHERE coalesce(x._kg_hash,'') <> r._kg_hash SET x += r`,
+      params: { rows },
+    });
+  }
+
+  return { digest, unchanged, statements };
+}
+
+/** Read the prior snapshot digest from Neo4j (null if never synced). */
+async function readPriorDigest(session) {
+  const res = await session.run(READ_SNAPSHOT_CYPHER, { id: SNAPSHOT_ID });
+  const rec = res.records && res.records[0];
+  if (!rec) return null;
+  const props = rec.get("props");
+  return (props && props.digest) || null;
+}
+
+function sumWrites(counters) {
+  const u = typeof counters.updates === "function" ? counters.updates() : counters;
+  return (u.nodesCreated || 0) + (u.relationshipsCreated || 0) + (u.propertiesSet || 0);
+}
+
+/**
+ * Materialize the providers and MERGE them into Neo4j idempotently.
+ *
+ * @param {object} options
+ * @param {object} options.driver          neo4j driver (or the injected fake)
+ * @param {string} [options.database]
+ * @param {object[]} [options.providers]   #317 providers to read (or pass graph)
+ * @param {{nodes,edges}} [options.graph]  a pre-materialized graph (skips readers)
+ * @param {boolean} [options.force=false]  re-run MERGEs even if the digest matches
+ * @returns {Promise<{ writes:number, unchanged:boolean, digest:string, nodes:number, edges:number, snapshot:object, errors:object[] }>}
+ */
+export async function syncToNeo4j(options = {}) {
+  const { driver, database, force = false } = options;
+  let errors = [];
+  let graph = options.graph;
+  if (!graph) {
+    const mat = await materializeGraph(options.providers || []);
+    graph = { nodes: mat.nodes, edges: mat.edges };
+    errors = mat.errors;
+  }
+
+  const session = driver.session(database ? { database } : undefined);
+  try {
+    const priorDigest = await readPriorDigest(session);
+    const plan = planSync(graph, priorDigest, { force });
+
+    if (plan.unchanged && !force) {
+      return {
+        writes: 0,
+        unchanged: true,
+        digest: plan.digest,
+        nodes: graph.nodes.length,
+        edges: graph.edges.length,
+        snapshot: { digest: plan.digest },
+        errors,
+      };
+    }
+
+    let writes = 0;
+    for (const stmt of plan.statements) {
+      const res = await session.run(stmt.cypher, stmt.params);
+      writes += sumWrites(res.summary.counters);
+    }
+
+    const syncedAt = new Date().toISOString();
+    const snapRes = await session.run(
+      `MERGE (s:${SNAPSHOT_LABEL} {id:$id}) WITH s, $digest AS d WHERE coalesce(s.digest,'') <> d SET s.digest = d, s.synced_at = $syncedAt, s.node_count = $nc, s.edge_count = $ec`,
+      { id: SNAPSHOT_ID, digest: plan.digest, syncedAt, nc: graph.nodes.length, ec: graph.edges.length },
+    );
+    writes += sumWrites(snapRes.summary.counters);
+
+    return {
+      writes,
+      unchanged: plan.unchanged,
+      digest: plan.digest,
+      nodes: graph.nodes.length,
+      edges: graph.edges.length,
+      snapshot: { digest: plan.digest, synced_at: syncedAt },
+      errors,
+    };
+  } finally {
+    await session.close();
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontourai/flow-agents",
-  "version": "3.0.0",
+  "version": "3.2.0",
   "description": "Flow Agents — a Kontour product that applies Flow and Veritas discipline as a portable process layer inside the agent tools you already use: Claude Code, Codex, Kiro, opencode, pi, and GitHub Actions — with framework adapters (AWS Strands preview) on the same policy-engine contract.",
   "keywords": [
     "agents",
@@ -139,6 +139,7 @@
     "check:content-boundary": "node scripts/check-content-boundary.cjs",
     "check:decisions": "node scripts/check-decisions.cjs check",
     "gen:decisions-index": "node scripts/check-decisions.cjs gen-index",
+    "freeze:adrs": "node scripts/freeze-adrs.mjs",
     "prepack": "npm run build --silent && npm run validate:source --",
     "kit": "npm run build --silent && node build/src/cli.js kit"
   },
@@ -152,6 +153,7 @@
   },
   "optionalDependencies": {
     "@kontourai/surface": "^2.0.0",
-    "hachure": "^0.9.0"
+    "hachure": "^0.9.0",
+    "neo4j-driver": "^5.28.0"
   }
 }

package/schemas/workflow-handoff.schema.json

@@ -47,6 +47,12 @@
       "items": {
         "type": "string"
       }
+    },
+    "provider_release_pending": {
+      "type": "boolean"
+    },
+    "provider_release_next_command": {
+      "type": "string"
     }
   }
 }

package/scripts/README.md

@@ -70,6 +70,7 @@ renamed, or changes category, update the table and the validator together.
 | `lib/actor-identity.js` | shared hook library | `evals/integration/test_actor_identity.sh` | Shared runtime-agnostic actor identity resolver (`resolveActor`) consumed by `workflow-steering.js` and `workflow-sidecar.js` to retire the shared `"local"` liveness-actor default (issue #287). |
 | `lib/audit-transport.sh` | shared hook library | `evals/integration/test_hook_category_behaviors.sh`, `evals/integration/test_telemetry.sh` | Shared audit event transport functions. |
 | `lib/config-protection-remedies.js` | shared hook library | `evals/integration/test_hook_category_behaviors.sh` | Sanctioned-remedy table for `config-protection.js` (WS8/ADR 0020 extraction). |
+| `lib/current-pointer.js` | shared hook library | `evals/integration/test_current_json_per_actor.sh` | Shared per-actor "current" pointer reader/writer (`readCurrentPointer`, `writePerActorCurrent`) — the compat-shim fallback (per-actor `current/<actor>.json` first, legacy global `current.json` fallback) every actor-aware consumer routes through (issue #291). |
 | `lib/hook-flags.js` | shared hook library | `evals/integration/test_hook_category_behaviors.sh` | Shared profile/disable flag parsing. |
 | `lib/liveness-heartbeat.js` | shared hook library | `evals/integration/test_liveness_heartbeat.sh` | Shared tool-activity liveness heartbeat (`maybeEmitHeartbeat`); rides `postToolUse` across all four telemetry hook wrappers, throttled and fail-open (issue #288). |
 | `lib/liveness-policy.js` | shared hook library | `evals/integration/test_workflow_sidecar_writer.sh`, `evals/integration/test_liveness_heartbeat.sh` | Shared liveness on/off predicate (`isLivenessEnabled`, default-on/opt-out) and TTL/heartbeat-throttle default resolution (issue #288). |

package/scripts/ci/mint-attestation.js

@@ -104,23 +104,50 @@ function loadCiResults(repoRoot) {
   };
 }
 
+/**
+ * Discover the delivery trust.bundle across the flat and per-session (#379) layouts.
+ * Prefers the flat `delivery/trust.bundle` (back-compat), then `delivery/<slug>/trust.bundle`
+ * for each immediate subdirectory (sorted). Returns the first existing path, or null.
+ * This mirrors scripts/ci/trust-reconcile.js resolveDeliveryCandidates() precedence so the
+ * attestation subject binds to the same bundle the reconciler read. best-effort — a missing
+ * or unreadable delivery/ yields null.
+ */
+function discoverDeliveryBundle(repoRoot) {
+  const deliveryRoot = path.join(repoRoot, 'delivery');
+  const flat = path.join(deliveryRoot, 'trust.bundle');
+  if (fs.existsSync(flat)) return flat;
+  let entries = [];
+  try {
+    entries = fs.readdirSync(deliveryRoot, { withFileTypes: true });
+  } catch {
+    return null;
+  }
+  const subdirs = entries.filter((e) => e.isDirectory()).map((e) => e.name).sort();
+  for (const name of subdirs) {
+    const candidate = path.join(deliveryRoot, name, 'trust.bundle');
+    if (fs.existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+
 /**
  * Determine the subject artifact for the in-toto statement.
  *
- * If delivery/trust.bundle is present, use it as the subject (sha256 of its bytes).
- * Otherwise synthesize a results artifact from the predicate and use that.
+ * If a delivery trust.bundle is present (flat or per-session, #379), use it as the subject
+ * (sha256 of its bytes). Otherwise synthesize a results artifact from the predicate.
  *
  * @param {object} predicate  — the predicate that will appear in the statement
  * @param {string} repoRoot
  * @returns {{ subjectName: string, subjectDigest: string, fromBundle: boolean }}
  */
 function resolveSubject(predicate, repoRoot) {
-  const bundlePath = path.join(repoRoot, 'delivery', 'trust.bundle');
-  if (fs.existsSync(bundlePath)) {
+  const bundlePath = discoverDeliveryBundle(repoRoot);
+  if (bundlePath) {
     const bundleBytes = fs.readFileSync(bundlePath);
     const digest = sha256hex(bundleBytes);
-    process.stdout.write(`[mint-attestation] subject: delivery/trust.bundle sha256=${digest.slice(0, 16)}...\n`);
-    return { subjectName: 'delivery/trust.bundle', subjectDigest: digest, fromBundle: true };
+    const rel = path.relative(repoRoot, bundlePath);
+    process.stdout.write(`[mint-attestation] subject: ${rel} sha256=${digest.slice(0, 16)}...\n`);
+    return { subjectName: rel, subjectDigest: digest, fromBundle: true };
   }
 
   // No bundle present: synthesize subject from predicate JSON (self-attesting the results).

package/scripts/ci/trust-reconcile.js

@@ -522,32 +522,139 @@ const DELIVERY_DIR = 'delivery';
 
 /**
  * Single seam: every delivery/ path resolution in this file routes through here.
- * #335 (per-session delivery paths, e.g. delivery/<session-slug>/<filename> instead of
- * one shared path) is expected to change ONLY this function's body — e.g. glob
- * delivery/<slug-glob>/<filename> and return every match in a defined precedence order,
- * or
- * resolve the current PR's session slug and return its single subpath. discoverBundle()
- * and discoverDeclaredMarker() both iterate whatever candidates this returns and pick the
- * first existing one, so a future per-session layout composes with zero call-site changes.
+ *
+ * #335/#379 (per-session delivery paths) is IMPLEMENTED here now, not deferred: a shared
+ * `delivery/<filename>` guarantees a git merge conflict between ANY two concurrent
+ * deliveries — and a conflicting (DIRTY) PR gets NO `pull_request` workflows scheduled, so
+ * the required Trust Reconcile check silently never runs (field incidents #330/#358/#378).
+ * The fix is per-session paths so concurrent deliveries write to DISTINCT files and never
+ * contend.
+ *
+ * Returned candidate order (precedence, first is highest):
+ *   1. the flat `delivery/<filename>` — kept FIRST for full back-compat. A repo that never
+ *      adopts per-session layout sees byte-identical behavior; an already-committed flat
+ *      bundle from before this change still resolves.
+ *   2. `delivery/<slug>/<filename>` for every immediate subdirectory of `delivery/`, sorted
+ *      by name for determinism.
+ *
+ * Ordering here is ONLY the tie-break / fallback. Which candidate actually reconciles is
+ * decided by COMMIT-OWNERSHIP (discoverBundle() + bundleAttestsThisChange()), not directory
+ * order: among the candidates, the one whose checkpoint attests an ancestor-or-equal commit
+ * of THIS change wins, and stale siblings from other concurrent sessions are ignored.
+ * discoverBundle() and discoverDeclaredMarker() both iterate whatever this returns, so the
+ * per-session layout composes with zero call-site changes.
  */
 function resolveDeliveryCandidates(repoRoot, filename) {
-  return [path.join(repoRoot, DELIVERY_DIR, filename)];
+  const deliveryRoot = path.join(repoRoot, DELIVERY_DIR);
+  const candidates = [path.join(deliveryRoot, filename)];
+  // #379: append delivery/<slug>/<filename> for each immediate subdirectory of delivery/.
+  // readdirSync is best-effort — a missing delivery/ (or an unreadable one) yields just the
+  // flat candidate, never throws.
+  let entries = [];
+  try {
+    entries = fs.readdirSync(deliveryRoot, { withFileTypes: true });
+  } catch {
+    entries = [];
+  }
+  const subdirs = entries
+    .filter((e) => e.isDirectory())
+    .map((e) => e.name)
+    .sort();
+  for (const name of subdirs) {
+    candidates.push(path.join(deliveryRoot, name, filename));
+  }
+  return candidates;
 }
 
 /**
  * Auto-discover the delivery bundle when no explicit path is provided.
- * Checks delivery/trust.bundle, then delivery/trust.checkpoint.json under repo root
- * (via resolveDeliveryCandidates()). Returns null if neither is present — the caller
- * then falls through to delivery/DECLARED marker resolution (ADR 0022 §1); bundle
- * absence is no longer fail-open on its own.
+ *
+ * Gathers every existing candidate — flat `delivery/trust.bundle`, flat
+ * `delivery/trust.checkpoint.json`, and their `delivery/<slug>/…` per-session siblings (via
+ * resolveDeliveryCandidates()) — with trust.bundle preferred over trust.checkpoint.json.
+ *
+ * #379 (per-session, ownership-aware selection): when `changeSha` is known, the candidate
+ * whose checkpoint attests an ancestor-or-equal commit of THIS change wins (same
+ * bundleAttestsThisChange() semantics the flat staleness gate already uses). Stale/older
+ * siblings from OTHER concurrent sessions are ignored.
+ *
+ * PREFER-NEWEST among owning candidates. More than one candidate can legitimately "own" the
+ * change at once: an inherited FLAT bundle's commit_sha can be a real ancestor of HEAD in a
+ * merge-commit repo (it was committed on the trunk's linear history before this branch
+ * point), AND this session's fresh per-session bundle attests a NEWER ancestor (the delivery
+ * commit right before HEAD). "First-fresh-wins" would then select the STALE inherited flat
+ * bundle purely because it sorts first — reconciling last delivery's claims against this
+ * change's CI. So among all owning candidates we pick the one attesting the NEWEST commit
+ * (the descendant-most: the owning candidate whose commit_sha every other owning candidate's
+ * commit_sha is an ancestor of), via the same `git merge-base --is-ancestor` primitive. This
+ * makes an inherited/older owning bundle HARMLESS whether or not it was ever pruned — the
+ * fresh per-session bundle wins on recency, not on being deleted first.
+ *
+ * When no candidate owns this change (or `changeSha` is unknown, e.g. a local run with no
+ * TRUST_RECONCILE_SHA), the first existing candidate is returned so the caller's staleness
+ * gate below handles it exactly as before: a stale bundle is treated as absent, a malformed
+ * one still raises the Step 2 read error.
+ *
+ * Returns null if no candidate exists at all — the caller then falls through to
+ * delivery/DECLARED marker resolution (ADR 0022 §1); bundle absence is not fail-open.
  */
-function discoverBundle(repoRoot) {
+function discoverBundle(repoRoot, changeSha) {
+  const candidates = [];
   for (const filename of ['trust.bundle', 'trust.checkpoint.json']) {
     for (const candidate of resolveDeliveryCandidates(repoRoot, filename)) {
-      if (fs.existsSync(candidate)) return candidate;
+      if (fs.existsSync(candidate)) candidates.push(candidate);
     }
   }
-  return null;
+  if (candidates.length === 0) return null;
+
+  const deliveryRoot = path.join(repoRoot, DELIVERY_DIR);
+  const hasPerSession = candidates.some((c) => path.dirname(c) !== deliveryRoot);
+
+  // Ownership-aware selection (#379). Only meaningful when we know this change's sha; a
+  // candidate that fails to parse is skipped here (never treated as owning) — if it turns
+  // out to be the only candidate, it is still returned below so Step 2's "failed to read
+  // bundle" diagnostic fires unchanged.
+  if (changeSha) {
+    const owning = []; // { candidate, bundleSha } — every candidate that attests this change
+    for (const candidate of candidates) {
+      let json = null;
+      try {
+        json = JSON.parse(fs.readFileSync(candidate, 'utf8'));
+      } catch {
+        json = null;
+      }
+      if (!json) continue;
+      const { fresh, bundleSha } = bundleAttestsThisChange(repoRoot, candidate, json, changeSha);
+      if (fresh) owning.push({ candidate, bundleSha });
+    }
+    if (owning.length > 0) {
+      // Prefer the owning candidate attesting the NEWEST (descendant-most) commit. `best` is
+      // upgraded to a candidate whose commit is a strict descendant of the current best's —
+      // i.e. best.sha is an ancestor of cand.sha. Every owning entry has a non-null bundleSha
+      // (bundleAttestsThisChange returns fresh=false otherwise). Ties / incomparable siblings
+      // keep the earlier (candidate-order) entry, so the flat path still wins a genuine tie.
+      let best = owning[0];
+      for (let i = 1; i < owning.length; i++) {
+        const cand = owning[i];
+        if (cand.bundleSha !== best.bundleSha && isAncestorCommit(repoRoot, best.bundleSha, cand.bundleSha)) {
+          best = cand;
+        }
+      }
+      if (hasPerSession) {
+        process.stdout.write(`[trust-reconcile] #379: selected delivery candidate ${path.relative(repoRoot, best.candidate)} — attests this change ${changeSha} (${candidates.length} candidate(s) present across flat + per-session delivery/<slug>/; ${owning.length} owning, newest wins; older/stale ignored)\n`);
+      }
+      return best.candidate;
+    }
+    // No candidate attests this change. When per-session candidates were in play, emit a
+    // loud, grep-stable concurrency hint (#379) so the next agent can tell a concurrent
+    // per-session collision apart from a plain stale/absent bundle — the per-candidate
+    // stale line still prints in runTrustReconcile's staleness gate for the returned one.
+    if (hasPerSession) {
+      const rels = candidates.map((c) => path.relative(repoRoot, c)).join(', ');
+      process.stdout.write(`[trust-reconcile] #379: examined ${candidates.length} delivery candidate(s) (flat + per-session delivery/<slug>/); none attests this change ${changeSha}. If this is a concurrent-delivery collision, the OWNING session's bundle is not on this ref — re-publish this session's delivery, or check whether main moved under the PR. Candidates: ${rels}\n`);
+    }
+  }
+  return candidates[0];
 }
 
 /**
@@ -813,22 +920,30 @@ function resolveDeclaredExemption(repoRoot, ctx) {
  * src/cli/workflow-sidecar.ts). trust.bundle itself carries NO commit/branch metadata
  * (schemaVersion 5: {schemaVersion, source, claims, evidence, policies, events} — confirmed
  * by inspection), so when the discovered bundle IS trust.bundle, this falls through to its
- * sibling delivery/trust.checkpoint.json (same resolveDeliveryCandidates() seam) for the
- * binding — publishDelivery() always copies both together.
+ * SIBLING trust.checkpoint.json for the binding — publishDelivery() always writes both
+ * together into the SAME directory.
+ *
+ * #379: the sibling is resolved from the bundle's OWN directory (path.dirname(bundlePath)),
+ * not from a global resolveDeliveryCandidates() scan. In the per-session layout each session
+ * gets its own delivery/<slug>/ dir, and a global scan would cross-contaminate — pairing a
+ * per-session trust.bundle with the FLAT (or a different session's) trust.checkpoint.json and
+ * reading the wrong commit binding. Same-directory resolution is identical to the prior
+ * behavior for the flat layout (delivery/trust.bundle ↔ delivery/trust.checkpoint.json) and
+ * correct for per-session.
  */
 function extractBundleCommitSha(repoRoot, bundlePath, bundleJson) {
   if (bundleJson && typeof bundleJson.commit_sha === 'string' && bundleJson.commit_sha.trim()) {
     return bundleJson.commit_sha.trim();
   }
-  for (const candidate of resolveDeliveryCandidates(repoRoot, 'trust.checkpoint.json')) {
-    if (candidate === bundlePath || !fs.existsSync(candidate)) continue;
+  const siblingCheckpoint = path.join(path.dirname(bundlePath), 'trust.checkpoint.json');
+  if (siblingCheckpoint !== bundlePath && fs.existsSync(siblingCheckpoint)) {
     try {
-      const checkpoint = JSON.parse(fs.readFileSync(candidate, 'utf8'));
+      const checkpoint = JSON.parse(fs.readFileSync(siblingCheckpoint, 'utf8'));
       if (checkpoint && typeof checkpoint.commit_sha === 'string' && checkpoint.commit_sha.trim()) {
         return checkpoint.commit_sha.trim();
       }
     } catch {
-      // Malformed sibling checkpoint — no usable binding from it; keep looking / fall through.
+      // Malformed sibling checkpoint — no usable binding from it; fall through to null.
     }
   }
   return null;
@@ -907,14 +1022,17 @@ function runTrustReconcile({ bundle = null, commands = [], repoRoot = null, mani
   // (.github/workflows/trust-reconcile.yml) never passes --bundle; it always relies on
   // auto-discovery, which is exactly the path PR #278's stale-bundle incident went through.
   const explicitBundlePath = bundle || process.env.TRUST_RECONCILE_BUNDLE || null;
-  let bundlePath = explicitBundlePath || discoverBundle(resolvedRepoRoot) || null;
-  const bundleWasAutoDiscovered = !explicitBundlePath && !!bundlePath;
 
-  // Scope-matching context (ref/actor/sha) — resolved once, reused by both the
-  // bundle-ownership staleness check below and the delivery/DECLARED exemption path
-  // further down (bundle-absent branch).
+  // Scope-matching context (ref/actor/sha) — resolved once, reused by ownership-aware
+  // auto-discovery (#379, immediately below), the bundle-ownership staleness check further
+  // down (ADR 0022 addendum §2), and the delivery/DECLARED exemption path (bundle-absent
+  // branch). Resolved BEFORE auto-discovery because discoverBundle() now uses scopeCtx.sha
+  // to pick, among per-session candidates, the one that attests THIS change.
   const scopeCtx = resolveScopeContext(resolvedRepoRoot);
 
+  let bundlePath = explicitBundlePath || discoverBundle(resolvedRepoRoot, scopeCtx.sha) || null;
+  const bundleWasAutoDiscovered = !explicitBundlePath && !!bundlePath;
+
   // Event-scoped enforcement (ADR 0022 addendum, part 4): bundle-required enforcement
   // (and the staleness-gate consequence of it, immediately below) applies ONLY when this
   // run is gating a proposed change. A push run on main happens AFTER the gating PR run