@kontourai/flow-agents 3.1.0 → 3.2.0

package/context/scripts/hooks/stop-goal-fit.js

@@ -25,6 +25,7 @@
 'use strict';
 
 const fs = require('fs');
+const os = require('os');
 const path = require('path');
 const { spawnSync } = require('child_process');
 const crypto = require('crypto');
@@ -42,7 +43,7 @@ const {
   flowAgentsArtifactRoot,
   flowAgentsArtifactRootsForRead,
 } = require('./lib/local-artifact-paths');
-const { resolveActor } = require('./lib/actor-identity.js');
+const { resolveActor, isUnresolvedActor, detectRuntime } = require('./lib/actor-identity.js');
 const { readCurrentPointer } = require('./lib/current-pointer.js');
 
 const MAX_STDIN = 1024 * 1024;
@@ -1671,7 +1672,7 @@ async function analyze(root, now = Date.now()) {
     artifacts = artifacts.filter(a => a && hasSidecarPresence(path.dirname(a.file)));
   }
 
-  if (artifacts.length === 0) return { warnings: [], blocking: false };
+  if (artifacts.length === 0) return { warnings: [], blocking: false, latestArtifactDir: null };
 
   const latest = artifacts[0];
   const latestArtifactDir = path.dirname(latest.file);
@@ -1745,7 +1746,7 @@ async function analyze(root, now = Date.now()) {
     if (/\[backstop in warn mode — not blocking\]/.test(w)) return false;
     return blockRe.test(w);
   });
-  return { warnings, blocking, preExecution, gatePrefix: gateLabel(activeFlowStep) };
+  return { warnings, blocking, preExecution, gatePrefix: gateLabel(activeFlowStep), latestArtifactDir };
 }
 
 /**
@@ -1844,12 +1845,266 @@ function remediationFor(warning) {
   return null;
 }
 
+// ─── #292 Wave 2: Stop-hook non-terminal release-with-handoff ────────────────
+//
+// When a session's Stop event fires and the session's state.json status is NOT
+// one of workflow-sidecar.ts's LIVENESS_TERMINAL statuses (delivered/accepted/
+// archived — the SAME set advance-state's terminal path already tests against,
+// imported here rather than re-declared, per AC8), the liveness claim and (for
+// the local-file assignment provider) the durable assignment claim would
+// otherwise sit held until TTL, even though the session has genuinely ended.
+// This closes that gap: always emit a provider-agnostic liveness release (AC1),
+// and for local-file additionally perform the real release inline (AC2), while
+// honestly disclosing (never executing) the equivalent GitHub-provider release
+// as a pending handoff.json intent (AC3). See the plan artifact
+// (.kontourai/flow-agents/kontourai-flow-agents-292/kontourai-flow-agents-292--plan-work.md,
+// "Wave 2") for the full design rationale and the render-don't-execute
+// constraint this deliberately does not cross.
+//
+// Fail-open (AC7): the ENTIRE body runs under one try/catch. Any failure —
+// missing build/, corrupt assignment record, unresolved actor, missing/
+// malformed provider settings — degrades to a single stderr diagnostic and
+// returns, never throwing, never affecting the Stop hook's own exit code or
+// goal-fit's warnings/blocking output (this function's return value is not
+// consumed by that contract at all — it is a pure side effect).
+
+/**
+ * require() the compiled workflow-sidecar.js the same hasBuild/fs.existsSync-guarded
+ * way loadActiveFlowStep() already requires flow-resolver.js. Returns null (never
+ * throws) when build/ is absent or the require fails — the caller treats null as
+ * "the LIVENESS_TERMINAL boundary is unknown; do not guess it" and skips the whole
+ * release (fail-open, never a re-derived duplicate Set — AC8).
+ */
+function loadWorkflowSidecarBuilt() {
+  const packageRoot = path.resolve(__dirname, '..', '..');
+  const builtSidecar = path.join(packageRoot, 'build', 'src', 'cli', 'workflow-sidecar.js');
+  if (!fs.existsSync(builtSidecar)) return null; // hasBuild guard
+  try {
+    const mod = require(builtSidecar);
+    if (!(mod.LIVENESS_TERMINAL instanceof Set)) return null;
+    return mod;
+  } catch {
+    return null; // require failed — fail-open
+  }
+}
+
+/** Same hasBuild-guarded require idiom, for build/src/cli/assignment-provider.js. */
+function loadAssignmentProviderBuilt() {
+  const packageRoot = path.resolve(__dirname, '..', '..');
+  const builtProvider = path.join(packageRoot, 'build', 'src', 'cli', 'assignment-provider.js');
+  if (!fs.existsSync(builtProvider)) return null;
+  try {
+    const mod = require(builtProvider);
+    if (typeof mod.performLocalRelease !== 'function') return null;
+    return mod;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve the effective assignment-provider kind for this repo ('local-file' | 'github'),
+ * or null when it cannot be determined. Prefers reading context/settings/
+ * assignment-provider-settings.json directly (project settings first, matching
+ * effective-assignment-provider-settings.ts's own lookup precedence) rather than shelling
+ * out to or refactoring that CLI-shaped file (see plan Unresolved Question 1) — this task's
+ * scope is the Stop hook, not that file. Returns null (never guesses) when no settings file
+ * is present/parseable or names no provider kind for a project entry.
+ *
+ * Deliberately reads ONLY the project settings file (context/settings/
+ * assignment-provider-settings.json relative to repo root) — the common case for this repo
+ * and the one confirmed present. The effective() merge/repo-matching logic in
+ * effective-assignment-provider-settings.ts is intentionally NOT reimplemented here (that
+ * would fork a second merge algorithm); a repo whose provider kind can only be resolved via
+ * global settings or multi-project merge degrades to "unknown, skip assignment-layer
+ * release" rather than guessing.
+ */
+function resolveAssignmentProviderKind(root) {
+  const settingsFile = path.join(root, 'context', 'settings', 'assignment-provider-settings.json');
+  const settings = readJsonFile(settingsFile);
+  if (!settings) return null;
+  const candidates = [];
+  if (settings.defaults && settings.defaults.provider) candidates.push(settings.defaults.provider);
+  if (Array.isArray(settings.projects)) {
+    for (const project of settings.projects) {
+      if (project && project.provider) candidates.push(project.provider);
+    }
+  }
+  const kind = candidates.map(p => p && p.kind).find(k => k === 'local-file' || k === 'github');
+  return kind || null;
+}
+
+/**
+ * Refresh handoff.json by merge (read+spread the existing file's JSON, overwrite only the
+ * fields this task owns), mirroring advanceState's own handoff-write shape
+ * (`{ ...loadJson(...), ...sidecarBase(slug), summary, current_state_ref: "state.json",
+ * next_steps, blockers: [], warnings: [] }`) and current-pointer.js's writePerActorCurrent
+ * write idiom (`fs.writeFileSync(file, JSON.stringify(payload, null, 2) + "\n")`). next_steps
+ * is appended to (not clobbered) when a provider-release next-step is due.
+ */
+function refreshHandoffAfterRelease(artifactDir, slug, state, providerReleasePending, providerReleaseNextCommand) {
+  const file = path.join(artifactDir, 'handoff.json');
+  const existing = readJsonFile(file) || {};
+  const status = state ? normalizedStatus(state.status || 'unknown') : 'unknown';
+  const phase = state ? normalizedStatus(state.phase || 'unknown') : 'unknown';
+  const summary = (state && state.next_action && state.next_action.summary)
+    ? String(state.next_action.summary)
+    : `session ended at status:${status} phase:${phase}`;
+  const existingNextSteps = Array.isArray(existing.next_steps) ? existing.next_steps.slice() : [];
+  const nextSteps = existingNextSteps.slice();
+  if (providerReleasePending && providerReleaseNextCommand && !nextSteps.includes(providerReleaseNextCommand)) {
+    nextSteps.push(providerReleaseNextCommand);
+  }
+  const payload = {
+    ...existing,
+    schema_version: existing.schema_version || '1.0',
+    task_slug: existing.task_slug || slug,
+    summary,
+    current_state_ref: 'state.json',
+    next_steps: nextSteps,
+    ...(providerReleasePending ? { provider_release_pending: true } : {}),
+    ...(providerReleaseNextCommand ? { provider_release_next_command: providerReleaseNextCommand } : {}),
+  };
+  fs.writeFileSync(file, `${JSON.stringify(payload, null, 2)}\n`);
+}
+
+/**
+ * #292 Wave 2: on a Stop event whose resolved session is at a NON-terminal status, release
+ * the session's liveness claim (always, provider-agnostic — AC1) and, for the local-file
+ * assignment provider, its durable assignment claim too (AC2), then refresh handoff.json
+ * (AC4). A terminal-status session (already released by advance-state) is a deliberate no-op
+ * (AC5). For the github provider, never calls render-release or gh — only records an
+ * honestly-labeled pending intent in handoff.json (AC3). Actor-scoped: only ever releases
+ * the CURRENT actor's own held claim (AC6, enforced inside performLocalRelease).
+ *
+ * Called once from run(), reusing analyze()'s already-resolved latestArtifactDir — this
+ * function does not re-derive "what is the active session" a second time.
+ *
+ * Fail-open (AC7): the entire body is wrapped in one try/catch. Any failure degrades to a
+ * single stderr diagnostic and returns, never throwing, never affecting the Stop hook's exit
+ * code or goal-fit's warnings/blocking contract (this function's return value is unused by
+ * that contract).
+ *
+ * @param {string} root - repo root (as resolved by findRepoRoot)
+ * @param {string|null} artifactDir - analyze()'s already-resolved latestArtifactDir
+ */
+function releaseOnNonTerminalStop(root, artifactDir) {
+  try {
+    if (!artifactDir) return; // no active session resolved — nothing to release.
+
+    const state = readJsonFile(path.join(artifactDir, 'state.json'));
+    if (!state) return; // AC5: no state.json — nothing to gate a release decision on.
+
+    const sidecar = loadWorkflowSidecarBuilt();
+    if (!sidecar) {
+      process.stderr.write('[Hook] Goal Fit: stop-hook release skipped — build/src/cli/workflow-sidecar.js not available (LIVENESS_TERMINAL boundary unknown).\n');
+      return;
+    }
+
+    const status = normalizedStatus(state.status || 'unknown');
+    if (sidecar.LIVENESS_TERMINAL.has(status)) return; // AC5: terminal — advance-state already released.
+
+    // Slug: artifact dir's basename, or state.json's own task_slug field — reuse whichever
+    // this file already has, never a new slug-derivation rule.
+    const slug = (state.task_slug && String(state.task_slug).trim()) || path.basename(artifactDir);
+
+    const { actor } = resolveActor(process.env);
+    if (isUnresolvedActor(actor)) {
+      process.stderr.write(`[Hook] Goal Fit: stop-hook release skipped for "${safeOneLine(slug, 80)}" — actor identity is unresolved; never releasing under a synthetic identity.\n`);
+      return;
+    }
+
+    const flowAgentsDir = path.dirname(artifactDir);
+    const nowIso = new Date().toISOString();
+
+    // AC1: ALWAYS emit the liveness release, regardless of provider kind — liveness is
+    // provider-agnostic and this is the ONE shared writer every other liveness emitter uses.
+    try {
+      require('./lib/liveness-write.js').appendLivenessEvent(flowAgentsDir, {
+        type: 'release',
+        subjectId: slug,
+        actor,
+        at: nowIso,
+        source: 'stop-hook',
+      });
+    } catch (err) {
+      process.stderr.write(`[Hook] Goal Fit: stop-hook liveness release failed for "${safeOneLine(slug, 80)}": ${safeOneLine(err && err.message || err, 160)}\n`);
+    }
+
+    // Resolve the effective assignment-provider kind — unknown means "do not guess",
+    // skip the assignment-layer release entirely (fail-open).
+    const providerKind = resolveAssignmentProviderKind(root);
+    if (!providerKind) {
+      process.stderr.write(`[Hook] Goal Fit: stop-hook release — provider kind unknown for "${safeOneLine(slug, 80)}", skipping assignment-layer release (liveness release already emitted).\n`);
+      refreshHandoffAfterRelease(artifactDir, slug, state, false, null);
+      return;
+    }
+
+    let providerReleasePending = false;
+    let providerReleaseNextCommand = null;
+
+    if (providerKind === 'local-file') {
+      const provider = loadAssignmentProviderBuilt();
+      if (!provider) {
+        process.stderr.write('[Hook] Goal Fit: stop-hook local-file release skipped — build/src/cli/assignment-provider.js not available.\n');
+      } else {
+        try {
+          // Mirror assignment-provider.ts's loadActorStruct() exactly: runtime is derived via
+          // detectRuntime (not a literal 'unknown'), since serializeActor()'s comparison key
+          // includes runtime — a mismatched runtime segment here would make performLocalRelease's
+          // AC6 actor-match check wrongly treat this session's own claim as foreign.
+          //
+          // actorKey: opts.actorKey MUST be the same canonical `resolveActor(env).actor` string
+          // already resolved above (`actor`) — the identical bare-or-triple form
+          // computeEffectiveState()'s holderActorKey preference (`record.actor_key ||
+          // serializeActor(record.actor)`) and performLocalRelease's mirrored ownership check
+          // both key on. Without this, an explicit-override actor's release-side comparison
+          // would fall back to serializeActor(releasedBy) — a re-derived triple that never
+          // equals the stored bare actor_key — and this hook would wrongly treat its own claim
+          // as foreign (the #291 seam, relocated to the release path; see performLocalRelease's
+          // doc comment in src/cli/assignment-provider.ts).
+          const releasedBy = { runtime: detectRuntime(process.env), session_id: actor, host: os.hostname(), human: null };
+          const artifactRoot = flowAgentsArtifactRoot(root);
+          provider.performLocalRelease(artifactRoot, slug, releasedBy, {
+            reason: 'stop-hook non-terminal release',
+            tolerateNoActiveClaim: true,
+            actorKey: actor,
+          });
+        } catch (err) {
+          process.stderr.write(`[Hook] Goal Fit: stop-hook local-file release failed for "${safeOneLine(slug, 80)}": ${safeOneLine(err && err.message || err, 160)}\n`);
+        }
+      }
+    } else {
+      // AC3: github (or any non-local-file kind) — render-don't-execute. Never call
+      // render-release, never invoke gh. Disclose the pending intent honestly.
+      providerReleasePending = true;
+      providerReleaseNextCommand = `npm run workflow -- assignment-provider status --provider github --subject-id "${slug}" ...   # then: assignment-provider render-release --provider github --subject-id "${slug}" ... (emits the gh argv to run)`;
+    }
+
+    // AC4: refresh handoff.json — merge, never fully overwrite.
+    refreshHandoffAfterRelease(artifactDir, slug, state, providerReleasePending, providerReleaseNextCommand);
+  } catch (err) {
+    // Fail-open (AC7): any unexpected failure anywhere above (JSON parse error, fs error,
+    // etc.) must never crash the Stop hook or affect its exit code / goal-fit's output.
+    try {
+      process.stderr.write(`[Hook] Goal Fit: stop-hook release logic error (fail-open): ${safeOneLine(err && err.message || err, 160)}\n`);
+    } catch { /* best-effort diagnostic only */ }
+  }
+}
+
 async function run(rawInput) {
   const input = parseJson(rawInput);
   const root = findRepoRoot(input.cwd || process.cwd());
   const mode = resolveGoalFitMode();
   if (mode === 'off') return rawInput;
   const result = await analyze(root);
+  // #292 Wave 2: additive side effect only — never changes analyze()'s warnings/blocking
+  // contract or this function's return value. Reuses analyze()'s already-resolved
+  // latestArtifactDir rather than re-deriving a second "what is the active session" path.
+  // Runs regardless of whether goal-fit itself has any warnings this turn (AC1: the
+  // liveness release must always be attempted on a non-terminal Stop, independent of
+  // whether goal-fit found anything to warn about).
+  releaseOnNonTerminalStop(root, result.latestArtifactDir || null);
   if (result.warnings.length === 0) {
     clearBlockStreak(root);
     return rawInput;
@@ -1939,4 +2194,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { analyze, run, resolveGoalFitMode, uncheckedInSection, findRepoRoot, sidecarGuidance, safeOneLine, captureCrossReference, bundleEnforcement, loadActiveFlowStep, readCommandLog, resolveTrustedCommand, declaredManifestTarget, verifyCommandLogChain, CHAIN_GENESIS_VERIFY, hasLaunderingOperator };
+module.exports = { analyze, run, resolveGoalFitMode, uncheckedInSection, findRepoRoot, sidecarGuidance, safeOneLine, captureCrossReference, bundleEnforcement, loadActiveFlowStep, readCommandLog, resolveTrustedCommand, declaredManifestTarget, verifyCommandLogChain, CHAIN_GENESIS_VERIFY, hasLaunderingOperator, releaseOnNonTerminalStop };

package/docs/adr/0022-fail-closed-delivery-reconciliation-with-governed-exemptions.md

@@ -463,3 +463,114 @@ the workflow to fake the post-merge no-op path; this is closed by required code-
 review on `.github/workflows/trust-reconcile.yml` (#225, not yet server-side enforced),
 the same residual class as every other self-asserted CI input this ADR already carries.
 Step 1 (fresh verify) is unaffected by event scoping either way and always runs.
+
+## Addendum (2026-07-04, part 5): per-session delivery paths — concurrent deliveries stop contending (#379)
+
+Owner-approved follow-up closing a structural defect the fail-closed gate's first real
+deliveries surfaced repeatedly: the delivery transport used a SINGLE shared path
+(`delivery/trust.bundle` + `delivery/trust.checkpoint.json`), so every sealed delivery
+force-committed to the SAME two files. Any two concurrent deliveries therefore
+merge-conflict by construction — three seal collisions inside 24h (#330, #358, #378) each
+needed manual conflict resolution. Worse than the conflict itself: **GitHub schedules NO
+`pull_request` workflows for a conflicting (DIRTY) PR** — zero checks, no error — so the
+required Trust Reconcile check silently never re-runs. The symptom reads as "CI vanished,"
+not "conflict." This collision class scales with delivery frequency; ADR 0021's own "work
+area" vocabulary predicted it, and #335 named the `resolveDeliveryCandidates()` seam as the
+fix site.
+
+**Decision (structural): per-session delivery paths.** `publishDelivery()`
+(`src/cli/workflow-sidecar.ts`) writes to `delivery/<slug>/trust.bundle` (+ checkpoint
+companions), where `<slug>` is the session artifact dir's basename, instead of the shared
+flat path. Concurrent deliveries write to DISTINCT files and cannot contend: two deliveries
+add different `delivery/<slug>/` dirs (add/add of different paths — not a conflict), and both
+deleting the same inherited flat/legacy file is a delete/delete (auto-merges — not a
+conflict). The per-session dir NAME is only a collision-avoidance handle; it carries no
+trust weight.
+
+**Reconciler side: ownership-aware discovery, prefer-newest, not first-match.**
+`resolveDeliveryCandidates()` now returns the flat path (FIRST, for full back-compat)
+followed by every `delivery/<slug>/<filename>` (sorted). `discoverBundle()` no longer returns
+the first-existing candidate; it collects every candidate that attests THIS change
+(ancestor-or-equal, the SAME `bundleAttestsThisChange()` binding Addendum part 2 defined) and
+selects the one attesting the **NEWEST** (descendant-most) commit. This prefer-newest rule is
+load-bearing in a **merge-commit** repo (this repo's own history has merge commits, e.g.
+release-please merges): an inherited FLAT bundle's `commit_sha` can be a REAL ancestor of HEAD
+— it was committed on the trunk's linear history before this branch point — so it legitimately
+"owns" the change too, and a naive first-fresh-wins would select that STALE inherited bundle
+purely because it sorts first, reconciling the PREVIOUS delivery's claims against THIS change's
+CI. Prefer-newest makes the fresh per-session bundle win on recency, not on being deleted
+first — which in turn is what lets the cleanup policy leave the flat path in place (below)
+without corrupting selection. (Addendum parts 2/4's squash-merge reasoning still holds for
+squash repos; prefer-newest is the strict generalization that also covers merge-commit repos,
+where "inherited ⇒ non-ancestor" is NOT guaranteed.) `extractBundleCommitSha()` now resolves a
+bundle's sibling checkpoint from the bundle's OWN directory (`path.dirname(bundlePath)`), not a
+global scan — a global scan would pair a per-session bundle with the wrong session's (or the
+flat) checkpoint and read the wrong commit binding. For the flat layout this is byte-identical
+to the prior behavior; for per-session it is the only correct pairing.
+
+**Back-compat (retained, deprecation-noted).** The flat `delivery/trust.bundle` path stays
+fully supported on the READ side: an already-committed flat bundle from before this change,
+or an external adopter that has not migrated, still resolves and reconciles exactly as
+before (regression-locked by the negatives suite's flat-owner-coexist case and the
+unchanged `test_publish_delivery.sh` TEST 3/4 flat-fixture cases). Only the WRITE side moved
+to per-session — writing to both flat and per-session would re-introduce the very contention
+this closes, so the flat path is write-deprecated, read-supported.
+
+**Cleanup policy: supersede-on-publish, per-session dirs only (delivery/ stays bounded).** A
+publishing session prunes every inherited **per-session** seal dir except its own, then
+commits only `delivery/<slug>/`. Per-session dirs are the growth vector (one per delivery) and
+are UNIQUELY named, so pruning one can never conflict with a concurrent PR: two branches
+deleting the same inherited dir is a delete/delete (auto-merges), and each delivery adds its
+own distinct dir. Leaving an inherited per-session dir would be harmless anyway (prefer-newest
+ignores it) — pruning is purely to stop unbounded accumulation. The alternative,
+retain-as-history, was rejected as unbounded growth of permanently-superseded dirs with no
+reader. Pruning is best-effort: a prune failure is logged, never fatal to the delivery.
+
+**The shared flat path is deliberately NOT pruned per-delivery.** An earlier iteration of this
+addendum also pruned the flat `delivery/trust.bundle` legacy seals on every publish (to
+"migrate off" the shared path). That was reverted: during the migration window a concurrent PR
+may still seal to the flat path (this was written while PR #370 had an open flat-path seal),
+and a per-delivery deletion of that file is a **modify/delete conflict** against such a PR → a
+DIRTY PR → precisely the no-CI failure mode this whole change exists to remove. Because the
+flat path is a single fixed location (not a growth vector) and prefer-newest selection makes a
+lingering flat bundle harmless, retaining it costs nothing. Removing the flat legacy seals is a
+one-time cleanup for a **dedicated** PR once no open PR still seals to the flat path — not
+something safely bundled into every delivery.
+
+**The SILENT failure mode (documented, not "solved").** No repo-side code can make GitHub
+run `pull_request` workflows on a conflicted PR — that is platform behavior. Per-session
+paths remove the STRUCTURAL cause (the shared-path conflict) for agent-vs-agent delivery
+contention, which is the overwhelming majority of the incidents. The residual — a PR that
+goes DIRTY for some OTHER reason (a genuine same-file edit conflict with `main`) still gets
+no CI silently — is addressed by making the failure mode LOUD where we can: the deliver
+skill now documents the DIRTY→no-CI symptom and its diagnosis (`gh pr view --json
+mergeStateStatus`), and `discoverBundle()` emits a grep-stable `#379: examined N delivery
+candidate(s) … none attests this change …` concurrency hint so the next agent can tell a
+per-session collision apart from a plain stale/absent bundle. #335's detectability half
+(treating `mergeStateStatus=DIRTY` as a first-class steering/doctor input) remains open and
+is explicitly NOT claimed closed here.
+
+**Security: the forgery surface moved with the write path.** `scripts/hooks/config-protection.js`
+(and its `context/` mirror) protected only the flat `delivery/trust.bundle` /
+`delivery/trust.checkpoint.json` from direct agent Write/Edit/cp/redirect. Its three
+delivery regexes now carry an optional `(?:[^/]+\/)?` segment so `delivery/<slug>/trust.*`
+is equally blocked — otherwise moving the write path would have opened a hand-forgery hole
+one directory down. Regression-locked by `test_gate_lockdown.sh` AC1.26b/c/d. The
+`delivery/*` gitignore already covers per-session dirs (they are force-added deliberately per
+delivery exactly like the flat path).
+
+**Residuals (honest):** (1) the DIRTY→no-CI platform behavior for non-per-session conflicts
+is documented, not eliminated (above). (2) The per-session dir name is derived from the
+local session slug; a colliding slug across two sessions would re-share a path — acceptable
+because ownership is still decided by commit ancestry (a stale same-named sibling is ignored,
+not trusted), and slugs are session-unique in practice. (3) Selection correctness does NOT
+depend on merge strategy: prefer-newest resolves the owning candidate for both squash-merge
+(inherited seals are non-ancestors, trivially not-owning) and merge-commit (inherited seals
+can be ancestors, but attest an OLDER commit than this session's, so they lose on recency)
+histories — the merge-commit case was the concrete defect that forced prefer-newest and is
+regression-locked by `test_trust_reconcile_negatives.sh` §8d against a real git repo. (4) The
+flat legacy seals still on `main` are retained by design (see cleanup policy above) and remain
+until a dedicated one-time cleanup PR; they are harmless (prefer-newest) but do accumulate as a
+single fixed path, not a growth vector. This addendum changes WHERE seals live and HOW the
+owning one is chosen; it does not touch Step 1 (fresh verify), the DECLARED exemption path, or
+any fail-closed verdict — all of which are regression-locked unchanged.

package/evals/ci/run-baseline.sh

@@ -24,6 +24,7 @@ CHECKS=(
   "Actor identity resolver integration|bash evals/integration/test_actor_identity.sh"
   "Assignment provider local-file integration|bash evals/integration/test_assignment_provider_local_file.sh"
   "Assignment provider github integration|bash evals/integration/test_assignment_provider_github.sh"
+  "Stop hook release-with-handoff integration|bash evals/integration/test_stop_hook_release.sh"
   "Pull work assignment join integration|bash evals/integration/test_pull_work_assignment_join.sh"
   "Ensure-session ownership guard integration|bash evals/integration/test_ensure_session_ownership_guard.sh"
   "Current.json per-actor integration|bash evals/integration/test_current_json_per_actor.sh"
@@ -79,6 +80,7 @@ LANE_WORKFLOW_CONTRACTS=(
   "Actor identity resolver integration"
   "Assignment provider local-file integration"
   "Assignment provider github integration"
+  "Stop hook release-with-handoff integration"
   "Pull work assignment join integration"
   "Ensure-session ownership guard integration"
   "Current.json per-actor integration"

package/evals/integration/test_checkpoint_signing.sh

@@ -298,10 +298,11 @@ else
   _fail "advance-state --status delivered exited $SEAL_EXIT (signing must not break the seal)"
 fi
 
-if [[ -f "$REPO_ROOT2/delivery/trust.bundle" ]]; then
-  _pass "publish-delivery published into the explicit scratch --repo-root ($REPO_ROOT2/delivery/trust.bundle), not process.cwd()"
+# #379: publishDelivery writes to the per-session path delivery/<slug>/trust.bundle.
+if [[ -f "$REPO_ROOT2/delivery/$SLUG2/trust.bundle" ]]; then
+  _pass "publish-delivery published into the explicit scratch --repo-root ($REPO_ROOT2/delivery/$SLUG2/trust.bundle, #379 per-session), not process.cwd()"
 else
-  _fail "publish-delivery did not write to the explicit scratch --repo-root ($REPO_ROOT2/delivery/trust.bundle) — check the --repo-root plumbing in advanceState"
+  _fail "publish-delivery did not write to the explicit scratch --repo-root ($REPO_ROOT2/delivery/$SLUG2/trust.bundle) — check the --repo-root plumbing in advanceState"
 fi
 
 if [[ -f "$SESSION_DIR2/trust.checkpoint.json" ]]; then

package/evals/integration/test_gate_lockdown.sh

@@ -706,6 +706,42 @@ else
   _fail "AC1.26: redirect > delivery/trust.bundle NOT blocked (exit=$prot_exit)"
 fi
 
+echo ""
+echo "--- AC1.26b: #379 per-session Write to delivery/<slug>/trust.bundle BLOCKED ---"
+set +e
+prot_out=$(echo '{"tool_name":"Write","tool_input":{"path":"/repo/delivery/i379-delivery-paths/trust.bundle"}}' | node "$PROT" 2>&1)
+prot_exit=$?
+set -e
+if [ "$prot_exit" -eq 2 ] && echo "$prot_out" | grep -q "BLOCKED"; then
+  _pass "AC1.26b: Write to delivery/<slug>/trust.bundle blocked (exit 2) — #379 forgery surface moved with the write path"
+else
+  _fail "AC1.26b: Write to delivery/<slug>/trust.bundle NOT blocked (exit=$prot_exit, out=$prot_out)"
+fi
+
+echo ""
+echo "--- AC1.26c: #379 per-session cp to delivery/<slug>/trust.checkpoint.json BLOCKED ---"
+set +e
+prot_out=$(echo '{"tool_name":"Bash","tool_input":{"command":"cp forged.json delivery/some-session/trust.checkpoint.json"}}' | node "$PROT" 2>&1)
+prot_exit=$?
+set -e
+if [ "$prot_exit" -eq 2 ] && echo "$prot_out" | grep -q "BLOCKED"; then
+  _pass "AC1.26c: cp to delivery/<slug>/trust.checkpoint.json blocked (exit 2)"
+else
+  _fail "AC1.26c: cp to delivery/<slug>/trust.checkpoint.json NOT blocked (exit=$prot_exit, out=$prot_out)"
+fi
+
+echo ""
+echo "--- AC1.26d: #379 per-session redirect > delivery/<slug>/trust.bundle BLOCKED ---"
+set +e
+prot_out=$(echo '{"tool_name":"Bash","tool_input":{"command":"echo {} > delivery/some-session/trust.bundle"}}' | node "$PROT" 2>&1)
+prot_exit=$?
+set -e
+if [ "$prot_exit" -eq 2 ] && echo "$prot_out" | grep -q "BLOCKED"; then
+  _pass "AC1.26d: redirect > delivery/<slug>/trust.bundle blocked (exit 2)"
+else
+  _fail "AC1.26d: redirect > delivery/<slug>/trust.bundle NOT blocked (exit=$prot_exit)"
+fi
+
 echo ""
 echo "--- AC1.27: cp x src/foo.ts ALLOWED (no over-block on normal copy) ---"
 set +e

package/evals/integration/test_model_routing_escalation.sh

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# test_model_routing_escalation.sh — #376
+# Deliver-loop eval: a cheap-tier delegate's output FAILS a gate, the fix is
+# re-dispatched one tier HIGHER (escalation), and the escalation + every
+# per-delegation role/model decision are recorded on the session artifact in a
+# shape a downstream economics record (#349) can consume.
+#
+#   R2/AC2: fail -> escalate -> pass, escalation recorded with the tier it climbed FROM.
+#   R3/AC3: a verify/review delegation's role tier is >= the worker tier it checks.
+#   R4/AC4: per-delegation role/model land on agents/<id>/events.jsonl, additive.
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+source "$ROOT/evals/lib/node.sh"
+
+WRITER="workflow-sidecar"
+VALIDATOR="validate-workflow-artifacts"
+TMPDIR_EVAL="$(mktemp -d)"
+errors=0
+cleanup() { rm -rf "$TMPDIR_EVAL"; }
+trap cleanup EXIT
+
+_pass() { echo "  ✓ $1"; }
+_fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
+
+AR="$TMPDIR_EVAL/repo/.kontourai/flow-agents"
+SLUG="routing-escalation"
+SDIR="$AR/$SLUG"
+mkdir -p "$AR"
+
+ev() { flow_agents_node "$WRITER" record-agent-event --artifact-root "$AR" "$@"; }
+
+# ── session ───────────────────────────────────────────────────────────────────
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$AR" --task-slug "$SLUG" \
+  --title "Routing escalation" \
+  --summary "Cheap tier fails a gate; fix escalates one tier higher." \
+  --criterion "Escalation recorded" \
+  --timestamp "2026-07-04T00:00:00Z" >"$TMPDIR_EVAL/ensure.out" 2>&1; then
+  _pass "ensure-session created the deliver-loop session"
+else
+  _fail "ensure-session failed: $(cat "$TMPDIR_EVAL/ensure.out")"
+fi
+
+# ── deliver loop: delegate cheap -> gate FAIL -> escalate one tier up -> PASS ──
+# 1. Dispatch a fully-specified mechanical slice at the cheap tier (R4 record).
+ev --agent-id tool-worker-1 --kind delegation --status active \
+  --role delegate-mechanical --model "claude-haiku-4-5@anthropic" \
+  --summary "mechanical slice: routine config edit" \
+  --timestamp "2026-07-04T00:00:01Z" >/dev/null 2>&1 \
+  && _pass "recorded mechanical delegation (delegate-mechanical)" \
+  || _fail "failed to record mechanical delegation"
+
+# 2. Verify gate FAILS on that cheap delegate's output.
+ev --agent-id tool-verifier --kind evidence --status fail \
+  --role delegate-implementation --model "claude-sonnet-5@anthropic" \
+  --summary "verify gate FAILED on tool-worker-1 output" \
+  --timestamp "2026-07-04T00:00:02Z" >/dev/null 2>&1 \
+  && _pass "recorded verify gate FAILURE on cheap-tier output" \
+  || _fail "failed to record gate failure"
+
+# 3. Escalate: re-dispatch the FIX one tier higher, recording the tier climbed FROM.
+ev --agent-id tool-worker-2 --kind escalation --status active \
+  --role delegate-implementation --model "claude-sonnet-5@anthropic" \
+  --escalated-from delegate-mechanical \
+  --summary "fix re-dispatched one tier higher after gate failure" \
+  --timestamp "2026-07-04T00:00:03Z" >/dev/null 2>&1 \
+  && _pass "recorded escalation (delegate-mechanical -> delegate-implementation)" \
+  || _fail "failed to record escalation"
+
+# 4. Re-verify PASSES on the escalated fix. Goodhart guard: the verifier tier
+#    (delegate-implementation) is >= the worker tier it checks (delegate-implementation).
+ev --agent-id tool-verifier --kind evidence --status pass \
+  --role delegate-implementation --model "claude-sonnet-5@anthropic" \
+  --summary "verify gate PASSED on escalated fix" \
+  --timestamp "2026-07-04T00:00:04Z" >/dev/null 2>&1 \
+  && _pass "recorded verify PASS after escalation" \
+  || _fail "failed to record verify pass"
+
+# ── assertions over the recorded session artifact ─────────────────────────────
+node - "$SDIR" <<'NODE'
+const fs = require("fs");
+const path = require("path");
+const sdir = process.argv[2];
+const TIER = { "delegate-mechanical": 1, "delegate-implementation": 2, "delegate-design": 3, "orchestrator": 4 };
+
+function readEvents(agent) {
+  const f = path.join(sdir, "agents", agent, "events.jsonl");
+  if (!fs.existsSync(f)) return [];
+  return fs.readFileSync(f, "utf8").trim().split("\n").filter(Boolean).map((l) => JSON.parse(l));
+}
+
+let bad = 0;
+const say = (ok, msg) => { console.log(`  ${ok ? "✓" : "✗"} ${msg}`); if (!ok) bad++; };
+
+// R4/AC4: every delegation/escalation event carries a consumable role + model.
+const w1 = readEvents("tool-worker-1");
+const del = w1.find((e) => e.kind === "delegation");
+say(del && del.role === "delegate-mechanical" && del.model === "claude-haiku-4-5@anthropic",
+  "R4: mechanical delegation event carries role + model (economics-consumable)");
+
+// R4 additive/back-compat: a plain event carries no routing keys.
+const plainRoot = path.join(sdir, "state.json");
+say(fs.existsSync(plainRoot), "session state.json exists (additive change did not break session shape)");
+
+// R2/AC2: escalation event recorded, one tier higher, with the tier climbed FROM.
+const esc = readEvents("tool-worker-2").find((e) => e.kind === "escalation");
+say(!!esc, "R2: escalation event recorded");
+say(esc && esc.escalated_from === "delegate-mechanical", "R2: escalation records escalated_from = delegate-mechanical");
+say(esc && TIER[esc.role] === TIER[esc.escalated_from] + 1,
+  "R2: escalation climbed exactly one tier up the ladder (mechanical -> implementation)");
+
+// R3/AC3: the verifier tier is >= the worker tier it checks (Goodhart guard).
+const verifs = readEvents("tool-verifier").filter((e) => e.role);
+const workerTier = TIER["delegate-implementation"]; // tier of the escalated fix under verification
+const allGuarded = verifs.every((v) => TIER[v.role] >= workerTier);
+say(verifs.length >= 1 && allGuarded, "R3: verify role tier >= worker tier (never a cheaper checker)");
+
+// AC4: demonstrate the #349-consumable reduction — price per role across the run.
+const allEvents = [];
+for (const agent of fs.readdirSync(path.join(sdir, "agents"))) {
+  allEvents.push(...readEvents(agent));
+}
+const byRole = {};
+for (const e of allEvents) if (e.role) byRole[e.role] = (byRole[e.role] || 0) + 1;
+say(Object.keys(byRole).length >= 2 && byRole["delegate-mechanical"] >= 1 && byRole["delegate-implementation"] >= 1,
+  `AC4: routing records reduce to a per-role economics shape: ${JSON.stringify(byRole)}`);
+
+process.exit(bad === 0 ? 0 : 1);
+NODE
+if [[ $? -eq 0 ]]; then _pass "session artifact routing/escalation/Goodhart assertions passed"; else _fail "session artifact assertions failed"; fi
+
+# ── additive shape must still validate ────────────────────────────────────────
+if flow_agents_node "$VALIDATOR" "$SDIR" >"$TMPDIR_EVAL/validate.out" 2>&1; then
+  _pass "validate-workflow-artifacts accepts the additive routing fields"
+else
+  _fail "validate-workflow-artifacts rejected routing fields: $(cat "$TMPDIR_EVAL/validate.out")"
+fi
+
+if [[ "$errors" -eq 0 ]]; then
+  echo "Model routing escalation (deliver-loop) integration passed."
+  exit 0
+fi
+echo "Model routing escalation integration failed: $errors issue(s)."
+exit 1