@kontourai/flow-agents 3.1.0 → 3.2.0

package/.github/workflows/ci.yml

@@ -157,6 +157,10 @@ jobs:
         continue-on-error: true
         run: bash evals/ci/run-baseline.sh --check assignment-provider-github-integration
 
+      - name: Stop hook release-with-handoff integration
+        continue-on-error: true
+        run: bash evals/ci/run-baseline.sh --check stop-hook-release-with-handoff-integration
+
       - name: Pull work assignment join integration
         continue-on-error: true
         run: bash evals/ci/run-baseline.sh --check pull-work-assignment-join-integration

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [3.2.0](https://github.com/kontourai/flow-agents/compare/v3.1.0...v3.2.0) (2026-07-04)
+
+
+### Features
+
+* **builder:** per-step model-routing hints + escalate-on-gate-failure ladder ([#376](https://github.com/kontourai/flow-agents/issues/376)) ([8182dc6](https://github.com/kontourai/flow-agents/commit/8182dc66da10f3bfd731aef93d7cbd38b63ddd06))
+* **knowledge:** inbound-reference integrity check, fail closed ([#340](https://github.com/kontourai/flow-agents/issues/340)) ([02932ab](https://github.com/kontourai/flow-agents/commit/02932abec98fcc43ae3755d2281697e21c7451a6))
+* **knowledge:** incremental append-mode consolidate (Closes [#343](https://github.com/kontourai/flow-agents/issues/343)) ([9b972f5](https://github.com/kontourai/flow-agents/commit/9b972f5bf9d7a41d1de4af23d5e27619db3b1635))
+* **knowledge:** incremental append-mode consolidate, regenerate snapshot from records ([#343](https://github.com/kontourai/flow-agents/issues/343)) ([32cc263](https://github.com/kontourai/flow-agents/commit/32cc263aedc4c3727b144ced24872bc102a13383))
+* **knowledge:** record-carried freshness + Hachure-aligned status semantics ([#341](https://github.com/kontourai/flow-agents/issues/341)) ([32ff45e](https://github.com/kontourai/flow-agents/commit/32ff45eb9244fa1879a0b32784e95e5e5c80de71))
+
+
+### Fixes
+
+* **delivery:** per-session delivery paths so concurrent deliveries stop contending ([#379](https://github.com/kontourai/flow-agents/issues/379)) ([fedf4db](https://github.com/kontourai/flow-agents/commit/fedf4db5c41c7e45dcf9db949176be076131a09e))
+* **delivery:** per-session delivery paths so concurrent deliveries stop contending ([#379](https://github.com/kontourai/flow-agents/issues/379)) ([a03026f](https://github.com/kontourai/flow-agents/commit/a03026fccf940da2129a3b82e979443c37b87456))
+
 ## [3.1.0](https://github.com/kontourai/flow-agents/compare/v3.0.0...v3.1.0) (2026-07-04)
 
 

package/build/src/cli/assignment-provider.d.ts

@@ -117,6 +117,51 @@ export declare function performLocalClaim(artifactRoot: string, subjectId: strin
     reason?: string;
     actorKey?: string;
 }): AssignmentClaimRecord;
+/**
+ * Wave 1 (#292) extraction: the durable-write body previously inlined inside releaseLocalFile's
+ * withSubjectLock() closure, now a parameter-driven pure function so the Stop hook's non-terminal
+ * release lifecycle (scripts/hooks/stop-goal-fit.js, #292 Wave 2) can reuse the EXACT same release
+ * logic — actor-ownership verification, audit-trail append, atomic write under withSubjectLock —
+ * rather than reimplementing a second, parallel release path. releaseLocalFile (CLI wrapper,
+ * below) is now a thin parse-args/print-envelope shell around this, mirroring the
+ * performLocalSupersede/supersedeLocalFile extraction shape exactly.
+ *
+ * Two behaviors are deliberately DIFFERENT from a naive inline release, both required for the
+ * Stop hook's idempotent, actor-scoped lifecycle release (never for the interactive CLI, which
+ * keeps `tolerateNoActiveClaim` unset/false and therefore 100% of its prior throw-on-error shape):
+ *
+ * - `opts.tolerateNoActiveClaim === true` and there is no existing record, or the existing
+ *   record's status is not `"claimed"`: return `null` (a tolerated no-op) instead of throwing
+ *   "no active claim to release". This is the one deliberate idempotency change vs today's
+ *   releaseLocalFile — a second release call (e.g. a double Stop event) must be a safe no-op.
+ * - `releasedBy` is provided and does not match the existing record's holder: never force-release
+ *   a claim held by a different actor — return `null` (if tolerateNoActiveClaim) or throw
+ *   (otherwise), same as the no-active-claim case. The comparison mirrors computeEffectiveState()'s
+ *   `record.actor_key || helper.serializeActor(record.actor)` canonical-key preference EXACTLY
+ *   (actor_key-first, falling back to serializeActor only when actor_key is absent) — the read
+ *   path (status/effective-state) and this write path (release) must use the identical
+ *   canonical-key comparison, or a claim written under an explicit-override actor (`actor_key`
+ *   bare, e.g. `"canonical-x"`, but `serializeActor(record.actor)` a DIFFERENT triple, e.g.
+ *   `"explicit-override:canonical-x:host"`) can be self-recognized by computeEffectiveState() yet
+ *   fail to release here because the releaser's canonical key was compared against the wrong
+ *   (re-derived, triple) form instead of the stored actor_key. Comparing two serializeActor()
+ *   calls unconditionally — as a prior version of this function did — is NOT correct for override
+ *   actors and reintroduces the exact #291 seam on the release path.
+ *
+ * Contract: when `releasedBy` is provided AND the existing record is `actor_key`-stamped,
+ * `opts.actorKey` is REQUIRED (the canonical `resolveActor(env).actor` string) — otherwise
+ * ownership cannot be verified. A caller that passes `releasedBy` without `opts.actorKey` against
+ * an `actor_key`-stamped record would have its ownership compared as
+ * `existing.actor_key` (bare canonical) vs `serializeActor(releasedBy)` (re-derived triple), which
+ * can NEVER match even for the legitimate holder — a silent-failure trap, not a real ownership
+ * check. This is refused loudly (see the guard at the top of the `releasedBy` branch below) rather
+ * than allowed to silently no-op or wrongly refuse.
+ */
+export declare function performLocalRelease(artifactRoot: string, subjectId: string, releasedBy: ActorStruct | null, opts?: {
+    reason?: string;
+    actorKey?: string;
+    tolerateNoActiveClaim?: boolean;
+}): AssignmentClaimRecord | null;
 /**
  * Wave 1 (#291) extraction: the durable-write body previously inlined inside supersedeLocalFile's
  * withSubjectLock() closure, now a parameter-driven pure function so ensure-session's

package/build/src/cli/assignment-provider.js

@@ -424,31 +424,116 @@ function claimLocalFile(argv) {
     console.log(JSON.stringify({ role: "AssignmentClaimResult", subject_id: subjectId, record }, null, 2));
     return 0;
 }
-function releaseLocalFile(argv) {
-    const args = parseArgs(argv);
-    const provider = flagString(args.flags, "provider", "local-file");
-    if (provider !== "local-file")
-        throw new Error(`release: --provider must be local-file (use render-release for github); got ${provider}`);
-    const artifactRoot = requireFlag(args, "artifact-root");
-    const subjectId = requireFlag(args, "subject-id");
-    const releasedBy = flagString(args.flags, "actor-json") ? loadActorStructFromFile(requireFlag(args, "actor-json")) : null;
-    const reason = flagString(args.flags, "reason") ?? "released";
+/**
+ * Wave 1 (#292) extraction: the durable-write body previously inlined inside releaseLocalFile's
+ * withSubjectLock() closure, now a parameter-driven pure function so the Stop hook's non-terminal
+ * release lifecycle (scripts/hooks/stop-goal-fit.js, #292 Wave 2) can reuse the EXACT same release
+ * logic — actor-ownership verification, audit-trail append, atomic write under withSubjectLock —
+ * rather than reimplementing a second, parallel release path. releaseLocalFile (CLI wrapper,
+ * below) is now a thin parse-args/print-envelope shell around this, mirroring the
+ * performLocalSupersede/supersedeLocalFile extraction shape exactly.
+ *
+ * Two behaviors are deliberately DIFFERENT from a naive inline release, both required for the
+ * Stop hook's idempotent, actor-scoped lifecycle release (never for the interactive CLI, which
+ * keeps `tolerateNoActiveClaim` unset/false and therefore 100% of its prior throw-on-error shape):
+ *
+ * - `opts.tolerateNoActiveClaim === true` and there is no existing record, or the existing
+ *   record's status is not `"claimed"`: return `null` (a tolerated no-op) instead of throwing
+ *   "no active claim to release". This is the one deliberate idempotency change vs today's
+ *   releaseLocalFile — a second release call (e.g. a double Stop event) must be a safe no-op.
+ * - `releasedBy` is provided and does not match the existing record's holder: never force-release
+ *   a claim held by a different actor — return `null` (if tolerateNoActiveClaim) or throw
+ *   (otherwise), same as the no-active-claim case. The comparison mirrors computeEffectiveState()'s
+ *   `record.actor_key || helper.serializeActor(record.actor)` canonical-key preference EXACTLY
+ *   (actor_key-first, falling back to serializeActor only when actor_key is absent) — the read
+ *   path (status/effective-state) and this write path (release) must use the identical
+ *   canonical-key comparison, or a claim written under an explicit-override actor (`actor_key`
+ *   bare, e.g. `"canonical-x"`, but `serializeActor(record.actor)` a DIFFERENT triple, e.g.
+ *   `"explicit-override:canonical-x:host"`) can be self-recognized by computeEffectiveState() yet
+ *   fail to release here because the releaser's canonical key was compared against the wrong
+ *   (re-derived, triple) form instead of the stored actor_key. Comparing two serializeActor()
+ *   calls unconditionally — as a prior version of this function did — is NOT correct for override
+ *   actors and reintroduces the exact #291 seam on the release path.
+ *
+ * Contract: when `releasedBy` is provided AND the existing record is `actor_key`-stamped,
+ * `opts.actorKey` is REQUIRED (the canonical `resolveActor(env).actor` string) — otherwise
+ * ownership cannot be verified. A caller that passes `releasedBy` without `opts.actorKey` against
+ * an `actor_key`-stamped record would have its ownership compared as
+ * `existing.actor_key` (bare canonical) vs `serializeActor(releasedBy)` (re-derived triple), which
+ * can NEVER match even for the legitimate holder — a silent-failure trap, not a real ownership
+ * check. This is refused loudly (see the guard at the top of the `releasedBy` branch below) rather
+ * than allowed to silently no-op or wrongly refuse.
+ */
+export function performLocalRelease(artifactRoot, subjectId, releasedBy, opts = {}) {
+    const helper = loadActorIdentityHelper();
+    const reason = opts.reason ?? "released";
+    const tolerateNoActiveClaim = opts.tolerateNoActiveClaim ?? false;
     // F1 fix (fix-plan iteration 1, CRITICAL): release mutates the same record file claim/supersede
     // do, under the same per-subject lock (see withSubjectLock()'s doc comment).
     return withSubjectLock(artifactRoot, subjectId, () => {
         const existing = readLocalRecord(artifactRoot, subjectId);
-        if (!existing || existing.status !== "claimed")
+        if (!existing || existing.status !== "claimed") {
+            if (tolerateNoActiveClaim)
+                return null;
             throw new Error(`no active claim to release for subject: ${subjectId}`);
+        }
+        if (releasedBy) {
+            // Contract guard (hardening fix, #292 review): a caller that supplies `releasedBy` but NOT
+            // `opts.actorKey` against a record that already carries `actor_key` cannot reliably prove
+            // ownership — see this function's doc comment. This is the ONLY combination that fires: it
+            // does NOT fire when `existing.actor_key` is absent (the CLI/fixture path, where both sides
+            // fall back to serializeActor() and legitimately compare equal). Fail loudly rather than
+            // silently no-op (tolerant callers) or wrongly refuse (throwing callers) — never silent.
+            if (!opts.actorKey && existing.actor_key) {
+                if (tolerateNoActiveClaim) {
+                    console.error(`[performLocalRelease] cannot verify ownership of an actor_key-stamped record without opts.actorKey; skipping release for ${subjectId}`);
+                    return null;
+                }
+                throw new Error("performLocalRelease: pass opts.actorKey (the canonical resolveActor().actor string) when releasedBy is set and the record carries actor_key — serializeActor(releasedBy) is not a valid ownership key for actor_key-stamped records");
+            }
+            // AC6: never force-release a claim held by a different actor. Mirrors
+            // computeEffectiveState()'s canonical self-recognition comparison EXACTLY —
+            // `holderActorKey` prefers the stored `actor_key` (the canonical resolveActor(env).actor
+            // string, present on records written by the fixed performLocalClaim/performLocalSupersede
+            // paths) and only falls back to `serializeActor(existing.actor)` when `actor_key` is
+            // absent (every pre-fix record, every #290 eval fixture). The releaser's side must use the
+            // SAME canonical form: `opts.actorKey` (the caller's resolveActor(env).actor string, e.g.
+            // scripts/hooks/stop-goal-fit.js's Stop hook) when provided, else re-derived via
+            // serializeActor(releasedBy) — never serializeActor() unconditionally on both sides, which
+            // would compare the bare actor_key form against a re-derived triple form for an
+            // explicit-override actor and spuriously reject a legitimate same-actor release (the #291
+            // seam, relocated to this write path).
+            const holderActorKey = existing.actor_key || helper.serializeActor(existing.actor);
+            const releasedByActorKey = opts.actorKey || helper.serializeActor(releasedBy);
+            if (holderActorKey !== releasedByActorKey) {
+                if (tolerateNoActiveClaim)
+                    return null;
+                throw new Error(`--actor-json does not match the current holder (${holderActorKey}); refusing to release a claim held by someone else`);
+            }
+        }
         const record = {
             ...existing,
+            ...(opts.actorKey ? { actor_key: opts.actorKey } : {}),
             status: "released",
             audit_trail: [...(existing.audit_trail ?? []), { at: isoNow(), transition: "release", from_actor: existing.actor, to_actor: releasedBy, reason }],
         };
         writeLocalRecord(artifactRoot, subjectId, record);
-        console.log(JSON.stringify({ role: "AssignmentReleaseResult", subject_id: subjectId, record }, null, 2));
-        return 0;
+        return record;
     });
 }
+function releaseLocalFile(argv) {
+    const args = parseArgs(argv);
+    const provider = flagString(args.flags, "provider", "local-file");
+    if (provider !== "local-file")
+        throw new Error(`release: --provider must be local-file (use render-release for github); got ${provider}`);
+    const artifactRoot = requireFlag(args, "artifact-root");
+    const subjectId = requireFlag(args, "subject-id");
+    const releasedBy = flagString(args.flags, "actor-json") ? loadActorStructFromFile(requireFlag(args, "actor-json")) : null;
+    const reason = flagString(args.flags, "reason") ?? "released";
+    const record = performLocalRelease(artifactRoot, subjectId, releasedBy, { reason, tolerateNoActiveClaim: false });
+    console.log(JSON.stringify({ role: "AssignmentReleaseResult", subject_id: subjectId, record }, null, 2));
+    return 0;
+}
 /**
  * Wave 1 (#291) extraction: the durable-write body previously inlined inside supersedeLocalFile's
  * withSubjectLock() closure, now a parameter-driven pure function so ensure-session's

package/build/src/cli/workflow-sidecar.d.ts

@@ -204,19 +204,28 @@ export declare function sealTrustCheckpoint(dir: string, slug: string, sealedAt:
 /**
  * Publish the session's trust artifacts to the committed delivery/ path.
  *
+ * #379: writes to a PER-SESSION path `<repoRoot>/delivery/<slug>/` (slug = the session
+ * artifact dir's basename) rather than the shared flat `delivery/`. A shared path guarantees
+ * a git conflict between ANY two concurrent deliveries, and a conflicting (DIRTY) PR gets NO
+ * pull_request workflows — the required Trust Reconcile check silently never runs (field
+ * incidents #330/#358/#378). Per-session paths make concurrent deliveries write DISTINCT
+ * files that never contend. trust-reconcile.js reads both the flat (back-compat) and
+ * per-session layouts via resolveDeliveryCandidates() and selects the owning candidate by
+ * commit ancestry.
+ *
  * Copies trust.bundle, trust.checkpoint.json, and (if present)
- * trust.checkpoint.intoto.json / trust.checkpoint.sig.json from the
- * session artifact dir to <repoRoot>/delivery/.
+ * trust.checkpoint.intoto.json / trust.checkpoint.sig.json / trust.checkpoint.attestation.json
+ * from the session artifact dir to <repoRoot>/delivery/<slug>/.
  *
  * Fail-soft on a missing bundle: if trust.bundle is absent, returns without throwing.
  * Fail-CLOSED on repo-root resolution: repoRoot must be a real, resolved kits/ ancestor
  * (see findRepoRootFromDirStrict) — null (no ancestor found) skips the publish with a
  * visible warning instead of writing to whatever process.cwd() happens to be. This
  * prevents a scratch/test session dir (no kits/ ancestor) from silently clobbering an
- * unrelated real repo's delivery/trust.bundle when invoked with that repo as cwd (see
+ * unrelated real repo's delivery/ seal when invoked with that repo as cwd (see
  * evals/integration/test_checkpoint_signing.sh TEST 2 and the WS5 session findings at
  * .kontourai/flow-agents/ws5-governance-kit-slice1 for the root cause this fixes).
- * Idempotent: overwrites on re-delivery.
+ * Idempotent: overwrites on re-delivery to the same slug.
  */
 export declare function publishDelivery(dir: string, repoRoot: string | null): Promise<void>;
 export declare function validateLearningCorrection(record: AnyObj): void;
@@ -301,5 +310,6 @@ export declare function gateAdvisoryFix(calibration: GateCalibration, claimId: s
  * @param now                 Optional timestamp override for deterministic tests
  */
 export declare function buildGateInquiryRecords(bundle: BundleFile, blockSignal: GateBlockSignal, slug: string, expectedCriterionIds: string[], surface: SurfaceModule, now?: Date): AnyObj[];
+export declare const LIVENESS_TERMINAL: Set<string>;
 export { buildClaimExplanation } from "./sidecar-claim-explain.js";
 export type { ClaimEvidenceItem, ClaimExplanation } from "./sidecar-claim-explain.js";

package/build/src/cli/workflow-sidecar.js

@@ -1623,7 +1623,30 @@ function recordAgentEvent(p) {
         requireArtifactDirUnderRoot(dir, root);
     const timestamp = opt(p, "timestamp", now());
     const agent = validateAgentId(opt(p, "agent-id"));
-    const event = { timestamp, agent_id: agent, kind: opt(p, "kind", "note"), status: opt(p, "status", "info"), summary: opt(p, "summary"), ...(opt(p, "ref") ? { ref: opt(p, "ref") } : {}) };
+    // #376 model routing: optionally stamp the delegate role/model resolved from
+    // .datum/config.json onto the event so a downstream economics record (#349)
+    // can price role assignments per delegation, and so an escalate-on-gate-failure
+    // re-dispatch records which tier it climbed FROM. Fully additive/optional: when
+    // no routing flag is passed the event shape is byte-identical to before.
+    // These live as TOP-LEVEL event fields (not nested) on purpose: appendJsonl's
+    // serializer (spacedLine) uses the top-level key list as a JSON.stringify array
+    // replacer, which is an allowlist applied at every nesting level — a nested
+    // routing object would have its inner keys stripped. Flat keeps the shape a
+    // simple per-event routing record a JSONL economics feed can read directly.
+    const role = opt(p, "role");
+    const model = opt(p, "model");
+    const escalatedFrom = opt(p, "escalated-from");
+    const event = {
+        timestamp,
+        agent_id: agent,
+        kind: opt(p, "kind", "note"),
+        status: opt(p, "status", "info"),
+        summary: opt(p, "summary"),
+        ...(opt(p, "ref") ? { ref: opt(p, "ref") } : {}),
+        ...(role ? { role } : {}),
+        ...(model ? { model } : {}),
+        ...(escalatedFrom ? { escalated_from: escalatedFrom } : {}),
+    };
     appendJsonl(path.join(dir, "agents", agent, "events.jsonl"), event);
     updateCurrentAgent(root, dir, agent, event.status, timestamp, actorKey);
     return 0;
@@ -2582,48 +2605,115 @@ async function sealCheckpoint(p) {
 // Idempotent: overwrites on re-delivery.
 // Called automatically from recordRelease and advanceState→delivered (best-effort).
 // Also exposed as the `publish-delivery <artifact-dir>` subcommand for explicit use.
+/**
+ * #379 supersede-on-publish cleanup: keep delivery/ bounded by pruning inherited PER-SESSION
+ * seal dirs (the growth vector), scoped to avoid any cross-PR conflict.
+ *
+ * An inherited per-session seal dir (`delivery/<other-slug>/`) is UNIQUELY named, so pruning
+ * it can never conflict with a concurrent PR: two branches deleting the same inherited dir is
+ * a delete/delete (auto-merges), and each new delivery adds its OWN distinct
+ * `delivery/<slug>/`. And it is HARMLESS to leave: trust-reconcile.js's prefer-newest
+ * ownership selection always picks THIS session's fresher bundle over an older inherited one.
+ * Pruning is therefore purely to stop unbounded accumulation of permanently-superseded dirs.
+ *
+ * The SHARED FLAT path (`delivery/trust.bundle` + checkpoints) is deliberately NOT pruned
+ * here. During the migration window other concurrent PRs may still seal to the flat path;
+ * deleting it would produce a modify/delete conflict → a DIRTY PR → the no-CI failure this
+ * whole change fixes. The flat path is a single fixed location (not a growth vector) and the
+ * reconciler treats a stale flat bundle as non-owning / older-owning, so leaving it is safe.
+ * Removing the flat legacy seals is a one-time cleanup for a dedicated PR once no open PR
+ * still seals to it — intentionally NOT bundled into every delivery.
+ *
+ * Best-effort: a prune failure is logged, never fatal to the delivery. Never touches
+ * README.md, DECLARED, the flat seal files, or any subdir that is not itself a seal dir.
+ */
+function pruneSupersededSeals(deliveryDir, keepSlug) {
+    let entries = [];
+    try {
+        entries = fs.readdirSync(deliveryDir, { withFileTypes: true });
+    }
+    catch {
+        entries = [];
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory() || entry.name === keepSlug)
+            continue;
+        const subdir = path.join(deliveryDir, entry.name);
+        // Only prune dirs that actually look like a seal dir (contain a trust.bundle or
+        // trust.checkpoint.json) — never an unrelated directory a human placed under delivery/.
+        const looksLikeSeal = fs.existsSync(path.join(subdir, "trust.bundle")) ||
+            fs.existsSync(path.join(subdir, "trust.checkpoint.json"));
+        if (!looksLikeSeal)
+            continue;
+        try {
+            fs.rmSync(subdir, { recursive: true, force: true });
+            process.stderr.write(`[publish-delivery] #379: pruned superseded per-session seal delivery/${entry.name}/ (older-owning/stale; the reconciler selects the newest bundle regardless)\n`);
+        }
+        catch (err) {
+            process.stderr.write(`[publish-delivery] #379: could not prune per-session seal delivery/${entry.name}/ (non-fatal): ${err instanceof Error ? err.message : String(err)}\n`);
+        }
+    }
+}
 /**
  * Publish the session's trust artifacts to the committed delivery/ path.
  *
+ * #379: writes to a PER-SESSION path `<repoRoot>/delivery/<slug>/` (slug = the session
+ * artifact dir's basename) rather than the shared flat `delivery/`. A shared path guarantees
+ * a git conflict between ANY two concurrent deliveries, and a conflicting (DIRTY) PR gets NO
+ * pull_request workflows — the required Trust Reconcile check silently never runs (field
+ * incidents #330/#358/#378). Per-session paths make concurrent deliveries write DISTINCT
+ * files that never contend. trust-reconcile.js reads both the flat (back-compat) and
+ * per-session layouts via resolveDeliveryCandidates() and selects the owning candidate by
+ * commit ancestry.
+ *
  * Copies trust.bundle, trust.checkpoint.json, and (if present)
- * trust.checkpoint.intoto.json / trust.checkpoint.sig.json from the
- * session artifact dir to <repoRoot>/delivery/.
+ * trust.checkpoint.intoto.json / trust.checkpoint.sig.json / trust.checkpoint.attestation.json
+ * from the session artifact dir to <repoRoot>/delivery/<slug>/.
  *
  * Fail-soft on a missing bundle: if trust.bundle is absent, returns without throwing.
  * Fail-CLOSED on repo-root resolution: repoRoot must be a real, resolved kits/ ancestor
  * (see findRepoRootFromDirStrict) — null (no ancestor found) skips the publish with a
  * visible warning instead of writing to whatever process.cwd() happens to be. This
  * prevents a scratch/test session dir (no kits/ ancestor) from silently clobbering an
- * unrelated real repo's delivery/trust.bundle when invoked with that repo as cwd (see
+ * unrelated real repo's delivery/ seal when invoked with that repo as cwd (see
  * evals/integration/test_checkpoint_signing.sh TEST 2 and the WS5 session findings at
  * .kontourai/flow-agents/ws5-governance-kit-slice1 for the root cause this fixes).
- * Idempotent: overwrites on re-delivery.
+ * Idempotent: overwrites on re-delivery to the same slug.
  */
 export async function publishDelivery(dir, repoRoot) {
     const bundleSrc = path.join(dir, "trust.bundle");
     if (!fs.existsSync(bundleSrc))
         return; // no bundle — skip gracefully
     if (!repoRoot) {
-        process.stderr.write(`[publish-delivery] WARNING: no kits/ ancestor found from ${dir}; skipping publish. Refusing to fall back to process.cwd() to avoid clobbering an unrelated repo's delivery/trust.bundle. Pass --repo-root explicitly if this session dir is intentionally outside a repo checkout.\n`);
+        process.stderr.write(`[publish-delivery] WARNING: no kits/ ancestor found from ${dir}; skipping publish. Refusing to fall back to process.cwd() to avoid clobbering an unrelated repo's delivery/ seal. Pass --repo-root explicitly if this session dir is intentionally outside a repo checkout.\n`);
         return;
     }
     const deliveryDir = path.join(repoRoot, "delivery");
+    // #379: slug is the session artifact dir's basename — the same human-meaningful id used
+    // throughout the session (.kontourai/flow-agents/<slug>/). The per-session dir NAME is only
+    // a collision-avoidance handle; ownership is decided by commit ancestry, not by name.
+    const slug = path.basename(path.resolve(dir));
+    const sessionDeliveryDir = path.join(deliveryDir, slug);
     fs.mkdirSync(deliveryDir, { recursive: true });
+    // Supersede inherited/flat seals BEFORE writing this session's dir (keepSlug = our own).
+    pruneSupersededSeals(deliveryDir, slug);
+    fs.mkdirSync(sessionDeliveryDir, { recursive: true });
     // Required: trust.bundle (the CI anchor)
-    fs.copyFileSync(bundleSrc, path.join(deliveryDir, "trust.bundle"));
+    fs.copyFileSync(bundleSrc, path.join(sessionDeliveryDir, "trust.bundle"));
     // Optional companions: checkpoint + signing artifacts
     const companions = [
         "trust.checkpoint.json",
         "trust.checkpoint.intoto.json",
         "trust.checkpoint.sig.json",
+        "trust.checkpoint.attestation.json",
     ];
     for (const filename of companions) {
         const src = path.join(dir, filename);
         if (fs.existsSync(src)) {
-            fs.copyFileSync(src, path.join(deliveryDir, filename));
+            fs.copyFileSync(src, path.join(sessionDeliveryDir, filename));
         }
     }
-    process.stderr.write(`[publish-delivery] published trust.bundle and companions to ${deliveryDir}\n`);
+    process.stderr.write(`[publish-delivery] published trust.bundle and companions to ${sessionDeliveryDir} (per-session path, #379)\n`);
 }
 /**
  * publish-delivery <artifact-dir> [--repo-root <path>]
@@ -3369,7 +3459,7 @@ function loadLivenessReadHelper() {
 // init-plan claims the work-item; advance-state heartbeats (or releases on terminal),
 // so the workflow lifecycle itself maintains the liveness claim — no manual liveness calls.
 // Additive + fail-open: a liveness-emit failure never affects the workflow command.
-const LIVENESS_TERMINAL = new Set(["delivered", "accepted", "archived"]);
+export const LIVENESS_TERMINAL = new Set(["delivered", "accepted", "archived"]);
 /**
  * Delegate to the shared pure-CJS resolver (scripts/hooks/lib/actor-identity.js), mirroring the
  * createRequire pattern used by readLivenessEvents() above. Deliberately NO inline duplicate

package/context/contracts/assignment-provider-contract.md

@@ -94,7 +94,7 @@ delivers all four:
 | --- | --- | --- | --- |
 | `claim` | the claiming session | at selection | **#290 (this issue)** |
 | `claim` / `supersede` | `ensure-session`'s pre-entry ownership guard (a SECOND mutator, alongside `assignment-provider claim`) | on session entry, before any session directory is created — `free` establishes a claim, `reclaimable` requires explicit `--supersede-stale` | **#291** |
-| `clean_release` | the incumbent (Stop hook / terminal `advance-state`) | session end — unassign + handoff comment | #292 |
+| `clean_release` | the incumbent (Stop hook / terminal `advance-state`) | session end — unassign + handoff comment | **#292** — the Stop hook (`scripts/hooks/stop-goal-fit.js`) on clean non-terminal session end: liveness release + local-file assignment release (`performLocalRelease`) run inline; for the github provider the hook cannot run `gh`, so it honestly defers via a `provider_release_pending` handoff intent rather than pretending to complete the release |
 | `supersede` | the successor, inside the takeover protocol | after the grace beat | #294 |
 | `crash_no_successor` | nobody, initially; corrected by the next actor to want the subject, or the janitor | lazily, or on a janitor sweep | out of scope — the Console relay's first cross-machine duty (ADR 0021 §4/§7) |
 

package/context/contracts/execution-contract.md

@@ -67,6 +67,84 @@ model backs which delegate role. This contract only says where to read it.
   fallback in the session/task artifact — do not block delegation on datum
   being present.
 
+### Tier ladder
+
+The delegate roles form a cost/capability ladder that both escalation and the
+Goodhart guard below reference. Lowest to highest:
+
+```
+delegate-mechanical  <  delegate-implementation  <  delegate-design
+```
+
+`orchestrator` is off-ladder — it is the session's own model (planning, gates,
+adversarial verification), typically inherited rather than overridden, and sits
+above `delegate-design` for escalation purposes. `extraction-default` is a
+non-delegate role (bulk extraction) and is not part of this ladder.
+
+### Escalation on gate failure
+
+Delegate at the step's hinted tier, then let the gates enforce cost safety:
+
+- Dispatch the delegate at the tier its skill hint names (a cheap tier for
+  mechanical/fully-specified work).
+- On a review or verify **gate FAILURE of that delegate's output**, re-dispatch
+  the **fix** one tier higher on the ladder — `delegate-mechanical` failures
+  escalate to `delegate-implementation`, `delegate-implementation` failures to
+  `delegate-design`, and a `delegate-design` failure escalates to the
+  `orchestrator` / a human decision. Do not re-dispatch the fix at the same
+  tier that already failed its gate.
+- Record every escalation in the session artifact (see *Routing decisions in
+  the run artifact* below) with the tier it climbed **from**, so the run shows
+  why a more expensive model was used.
+- This is the fail-closed cost story: cheap tiers are safe **because** the gates
+  catch their misses and escalate. Routing cheap-by-default never weakens
+  verification — an ungated cheap delegate is what this ladder exists to prevent.
+
+### Goodhart guard (review/verify never cheaper than the work)
+
+Review and verify roles resolve at a tier **greater than or equal to** the tier
+of the work they check; they never auto-downgrade below it.
+
+- If the checked work was produced at `delegate-design`, its reviewer/verifier
+  resolves `delegate-design` (or `orchestrator`) — never `delegate-implementation`
+  or `delegate-mechanical`.
+- If the checked work was produced at `delegate-implementation`, its
+  reviewer/verifier resolves at `delegate-implementation` or higher.
+- Rationale: a cheaper checker rubber-stamping a more capable worker's output
+  defeats the gate and turns the routing table into a Goodhart target (optimize
+  the cost metric, lose the thing the metric was a proxy for). The gate must be
+  at least as capable as the work, or the fail-closed escalation story above is
+  hollow.
+
+### Routing decisions in the run artifact
+
+Record each delegation's resolved role and model on the session artifact so a
+downstream economics record (`flow-agents#349`) can price role assignments and a
+baseline harness (`flow-agents#350`) can A/B tiers. Use the sidecar writer's
+`record-agent-event` (additive `--role` / `--model` / `--escalated-from` flags):
+
+```bash
+# per-delegation routing decision
+npm run workflow:sidecar -- record-agent-event \
+  --agent-id <delegate-id> --kind delegation --status active \
+  --role <resolved-role> --model "<resolved-model@provider>" \
+  --summary "<what was delegated>"
+
+# an escalate-on-gate-failure re-dispatch
+npm run workflow:sidecar -- record-agent-event \
+  --agent-id <delegate-id> --kind escalation --status active \
+  --role <higher-tier-role> --model "<resolved-model@provider>" \
+  --escalated-from <lower-tier-role> \
+  --summary "<gate that failed> failed at <lower-tier-role>; fix re-dispatched one tier higher"
+```
+
+These land as top-level `role`, `model`, and (for escalations) `escalated_from`
+fields on the JSONL event under `agents/<agent-id>/events.jsonl`. The shape is
+additive: events without a routing decision are byte-identical to before, so no
+existing consumer breaks. An economics consumer reads events where `role` is
+present as one priced delegation each; `escalated_from` marks the entries that
+cost more because a gate caught a cheaper tier.
+
 ## Completion Rules
 
 Execution is complete only when:

package/context/scripts/hooks/config-protection.js

@@ -180,7 +180,9 @@ function checkProtectedPathPattern(filePath) {
   // copy a forged bundle here to corrupt the CI trust check.
   // SAFE: publishDelivery writes via fs.copyFileSync (not Write/Edit tool).
   // RESIDUAL: runtime-constructed paths and fs writes are unaffected.
-  if (/(?:^|\/)delivery\/trust\.bundle$/.test(norm)) {
+  // #379: the optional (?:[^/]+\/)? segment also covers the per-session path
+  // delivery/<slug>/trust.bundle — the forgery surface moved with the write path.
+  if (/(?:^|\/)delivery\/(?:[^/]+\/)?trust\.bundle$/.test(norm)) {
     return {
       name: "delivery/trust.bundle",
       reason: "an agent could write a forged bundle to corrupt the CI trust-reconcile anchor",
@@ -189,7 +191,8 @@ function checkProtectedPathPattern(filePath) {
 
   // delivery/trust.checkpoint.json -- the signed checkpoint companion.
   // SAFE: publishDelivery writes via fs.copyFileSync, NOT via Write/Edit tool.
-  if (/(?:^|\/)delivery\/trust\.checkpoint\.json$/.test(norm)) {
+  // #379: optional (?:[^/]+\/)? segment also covers delivery/<slug>/trust.checkpoint.json.
+  if (/(?:^|\/)delivery\/(?:[^/]+\/)?trust\.checkpoint\.json$/.test(norm)) {
     return {
       name: "delivery/trust.checkpoint.json",
       reason: "an agent could forge a signed delivery by writing a tampered checkpoint",
@@ -421,7 +424,9 @@ function checkCommandForBypass(command) {
  * .kontourai/flow-agents/<slug>/trust.bundle, and deprecated runtime-shaped
  * .flow-agents equivalents.
  */
-const REDIRECT_PROTECTED_RE = /(?:^|\/|~\/)(\.bash_profile|\.bashrc|\.profile|\.zprofile|\.zshrc)$|(?:^|\/)\.claude\/settings(?:\.local)?\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/current\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/current\/[^/]+\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/\.goal-fit-block-streak\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/[^/]+\/state\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/[^/]+\/trust\.bundle$|(?:^|\/)delivery\/trust\.bundle$|(?:^|\/)delivery\/trust\.checkpoint\.json$/;
+// #379: the delivery/ arms carry an optional (?:[^/]+\/)? segment so redirects/tee to the
+// per-session path delivery/<slug>/trust.bundle (+ checkpoint) are caught, not just the flat path.
+const REDIRECT_PROTECTED_RE = /(?:^|\/|~\/)(\.bash_profile|\.bashrc|\.profile|\.zprofile|\.zshrc)$|(?:^|\/)\.claude\/settings(?:\.local)?\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/current\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/current\/[^/]+\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/\.goal-fit-block-streak\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/[^/]+\/state\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/[^/]+\/trust\.bundle$|(?:^|\/)delivery\/(?:[^/]+\/)?trust\.bundle$|(?:^|\/)delivery\/(?:[^/]+\/)?trust\.checkpoint\.json$/;
 
 /**
  * Return true when a token (an unquoted redirect target or tee argument) matches
@@ -569,8 +574,10 @@ function checkInterpreterWriteToProtected(command) {
  * Delivery-protected path regex: delivery/trust.bundle and delivery/trust.checkpoint.json.
  * These are the CI anchor files whose contents must not be agent-forged.
  * Used by checkCopyMoveToProtected to catch `cp x delivery/trust.bundle`.
+ * #379: the optional (?:[^/]+\/)? segment also catches the per-session path
+ * `cp forged.json delivery/<slug>/trust.bundle`.
  */
-const DELIVERY_COPY_PROTECTED_RE = /(?:^|\/)delivery\/trust\.bundle$|(?:^|\/)delivery\/trust\.checkpoint\.json$/;
+const DELIVERY_COPY_PROTECTED_RE = /(?:^|\/)delivery\/(?:[^/]+\/)?trust\.bundle$|(?:^|\/)delivery\/(?:[^/]+\/)?trust\.checkpoint\.json$/;
 
 /**
  * Return true when a normalized token matches a delivery-protected path.