@kontourai/flow-agents 3.1.0 → 3.3.0

package/evals/integration/test_takeover_protocol.sh

@@ -0,0 +1,340 @@
+#!/usr/bin/env bash
+# test_takeover_protocol.sh — takeover protocol integration eval (issue #294, ADR 0021 §5).
+#
+# Exercises `runTakeoverPreflight()`/`takeover-preflight` CLI subcommand and its companion
+# `ensure-session --supersede-stale` takeover-as-resumption path (src/cli/workflow-sidecar.ts),
+# reusing the SAME assignment ⋈ liveness join #290/#291 already built (computeEffectiveState/
+# readLocalAssignmentStatus/freshHolders) — no second computation is invented here.
+#
+# Follows evals/integration/test_verify_hold.sh's harness conventions VERBATIM (set -uo
+# pipefail / ROOT / node.sh / WRITER / TMPDIR_EVAL / trap / ARTIFACT_ROOT / pass|fail|errors /
+# json_query / flow_agents_node) and reuses its write_assignment_record / append_liveness_event
+# fixture-writer helpers verbatim — no new plumbing invented where an existing helper already
+# does the job.
+#
+# Sections (1-to-1 with the plan's acceptance criteria):
+#   1. AC1 — takeover offered + continues the incumbent's branch (the headline): a STALE record
+#      with a specific branch resolves `grace-then-supersede`/`reclaimable`; `--supersede-stale`
+#      as a different successor prints SupersedeTakeover with resumed_branch == the incumbent's
+#      branch (NOT a new branch) and records a `supersede` audit entry ("resuming from trust
+#      bundle").
+#   2. AC2a — revive during grace -> back off: a fresh incumbent liveness heartbeat flips the
+#      same fixture to `back-off`/`held`/ok:false; a follow-on `--supersede-stale` REFUSES.
+#   3. AC2b — a superseded incumbent is blocked at publish (compose with verify-hold, #293): the
+#      woken zombie incumbent's verify-hold on the AC1 subject exits non-zero.
+#   4. free / self / human quick cases: no record -> `claim`/free; self+fresh -> `proceed`.
+#   5. Injection discipline: hostile control bytes + >64 chars in actor_key/branch never leak raw
+#      into holder.actor / resume_branch, and are length-capped (<=64). Modeled on
+#      test_verify_hold.sh's AC7 / section-6 injection check.
+#
+# Deterministic, no model spend, self-cleaning, no network, no `gh` process anywhere.
+# Usage: bash evals/integration/test_takeover_protocol.sh
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+source "$ROOT/evals/lib/node.sh"
+
+CLI="$ROOT/build/src/cli.js"
+WRITER="workflow-sidecar"
+
+TMPDIR_EVAL="$(mktemp -d)"
+trap 'rm -rf "$TMPDIR_EVAL"' EXIT
+ARTIFACT_ROOT="$TMPDIR_EVAL/artifact-root"
+
+errors=0
+pass() { echo "  [PASS] $1"; }
+fail() { echo "  [FAIL] $1"; errors=$((errors + 1)); }
+
+json_query() {
+  node -e 'const fs=require("fs"); let cur=JSON.parse(fs.readFileSync(process.argv[1],"utf8")); for (const part of process.argv[2].split(".")) cur=part==="length" ? cur.length : (Array.isArray(cur) ? cur[Number(part)] : cur[part]); console.log(cur);' "$1" "$2"
+}
+
+# append_liveness_event <root> <subjectId> <actor> <at-iso> [ttlSeconds]
+# Reused verbatim from test_verify_hold.sh's own helper.
+append_liveness_event() {
+  local root="$1" subject="$2" actor="$3" at="$4" ttl="${5:-1800}"
+  mkdir -p "$root/liveness"
+  node -e '
+const fs = require("fs");
+const evt = { type: "claim", subjectId: process.argv[1], actor: process.argv[2], at: process.argv[3], ttlSeconds: Number(process.argv[4]) };
+fs.appendFileSync(process.argv[5], JSON.stringify(evt) + "\n");
+' "$subject" "$actor" "$at" "$ttl" "$root/liveness/events.jsonl"
+}
+
+# write_assignment_record <artifactRoot> <slug> <sessionId> <actorKey> [claimedAt]
+# Reused verbatim from test_verify_hold.sh's own helper. Writes a minimal, well-formed,
+# ALREADY-CLAIMED assignment record directly (branch:"main", claimed_at defaults to now). For a
+# staleness fixture with NO liveness event, computeEffectiveState classifies it reclaimable.
+write_assignment_record() {
+  local root="$1" slug="$2" sessionId="$3" actorKey="$4" claimedAt="${5:-}"
+  mkdir -p "$root/assignment"
+  node -e '
+const fs = require("fs");
+const [dest, slug, sessionId, actorKey, claimedAtOverride] = process.argv.slice(1);
+const now = new Date().toISOString();
+const claimedAt = claimedAtOverride || now;
+const actor = { runtime: "claude-code", session_id: sessionId, host: "eval-host" };
+const rec = {
+  schema_version: "1.0", role: "AssignmentClaimRecord", subject_id: slug,
+  actor, actor_key: actorKey, claimed_at: claimedAt, ttl_seconds: 1800, branch: "main",
+  artifact_dir: slug, status: "claimed",
+  audit_trail: [{ at: now, transition: "claim", from_actor: null, to_actor: actor, reason: "claim" }],
+};
+fs.writeFileSync(dest, JSON.stringify(rec, null, 2));
+' "$root/assignment/$slug.json" "$slug" "$sessionId" "$actorKey" "$claimedAt"
+}
+
+# patch_record_branch <assignmentRecord.json> <branch> — read/modify/write the record's `branch`
+# field so takeover-preflight/SupersedeTakeover surface a SPECIFIC resume branch (write_assignment_record
+# always sets branch:"main"). This is the incumbent's branch the successor must CONTINUE (AC1).
+patch_record_branch() {
+  node -e '
+const fs = require("fs");
+const [file, branch] = process.argv.slice(1);
+const rec = JSON.parse(fs.readFileSync(file, "utf8"));
+rec.branch = branch;
+fs.writeFileSync(file, JSON.stringify(rec, null, 2));
+' "$1" "$2"
+}
+
+if [[ ! -f "$CLI" ]]; then
+  echo "build/src/cli.js not found — run 'npm run build' first" >&2
+  exit 1
+fi
+flow_agents_build_ts || { echo "build failed" >&2; exit 1; }
+
+echo "=== takeover protocol (#294) ==="
+
+# ─── 1. AC1 — takeover offered + continues the incumbent's branch (the headline) ───────────
+echo "--- 1. AC1: stale claim -> grace-then-supersede; --supersede-stale continues the incumbent's branch (not a new one) ---"
+
+AC1_SLUG="takeover-ac1-resume-branch"
+AC1_DIR="$ARTIFACT_ROOT/$AC1_SLUG"
+INCUMBENT_ACTOR="eval-actor-incumbent-a"
+SUCCESSOR_ACTOR="eval-actor-successor"
+AC1_BRANCH="agent/a/$AC1_SLUG"
+AC1_RECORD="$ARTIFACT_ROOT/assignment/$AC1_SLUG.json"
+
+# Seed a STALE reclaimable record: write_assignment_record (branch:"main", claimed_at=now) then
+# patch its branch to the incumbent's real branch. NO liveness event -> no fresh heartbeat, so
+# the join classifies it reclaimable (assignment_present_liveness_stale_or_absent).
+write_assignment_record "$ARTIFACT_ROOT" "$AC1_SLUG" "incumbent-a-session" "$INCUMBENT_ACTOR"
+patch_record_branch "$AC1_RECORD" "$AC1_BRANCH"
+mkdir -p "$AC1_DIR"
+
+if flow_agents_node "$WRITER" takeover-preflight "$AC1_DIR" --actor "$SUCCESSOR_ACTOR" \
+  >"$TMPDIR_EVAL/tp-ac1.out" 2>"$TMPDIR_EVAL/tp-ac1.err"; then
+  pass "takeover-preflight on a reclaimable subject exits 0 (ok:true — a takeover is offered) (AC1)"
+else
+  fail "takeover-preflight on a reclaimable subject should have exited 0: $(cat "$TMPDIR_EVAL/tp-ac1.out" "$TMPDIR_EVAL/tp-ac1.err")"
+fi
+[[ "$(json_query "$TMPDIR_EVAL/tp-ac1.out" "role")" == "TakeoverPreflight" ]] && pass "takeover-preflight JSON role is TakeoverPreflight (AC1)" || fail "takeover-preflight JSON role was not TakeoverPreflight: $(cat "$TMPDIR_EVAL/tp-ac1.out")"
+[[ "$(json_query "$TMPDIR_EVAL/tp-ac1.out" "action")" == "grace-then-supersede" ]] && pass "takeover-preflight action is grace-then-supersede for a reclaimable subject (AC1)" || fail "takeover-preflight action was not grace-then-supersede: $(cat "$TMPDIR_EVAL/tp-ac1.out")"
+[[ "$(json_query "$TMPDIR_EVAL/tp-ac1.out" "effective_state")" == "reclaimable" ]] && pass "takeover-preflight effective_state is reclaimable (AC1)" || fail "takeover-preflight effective_state was not reclaimable: $(cat "$TMPDIR_EVAL/tp-ac1.out")"
+[[ "$(json_query "$TMPDIR_EVAL/tp-ac1.out" "resume_branch")" == "$AC1_BRANCH" ]] && pass "takeover-preflight resume_branch is the incumbent's branch ($AC1_BRANCH), never a new one (AC1 headline)" || fail "takeover-preflight resume_branch was not the incumbent's branch: $(cat "$TMPDIR_EVAL/tp-ac1.out")"
+AC1_GRACE="$(json_query "$TMPDIR_EVAL/tp-ac1.out" "grace_seconds")"
+if [[ "$AC1_GRACE" =~ ^[0-9]+$ && "$AC1_GRACE" -gt 0 ]]; then
+  pass "takeover-preflight grace_seconds is a positive number ($AC1_GRACE) (AC1)"
+else
+  fail "takeover-preflight grace_seconds was not a positive number: '$AC1_GRACE'"
+fi
+[[ "$(json_query "$TMPDIR_EVAL/tp-ac1.out" "holder.actor")" == "$INCUMBENT_ACTOR" ]] && pass "takeover-preflight holder.actor names the incumbent ($INCUMBENT_ACTOR) (AC1)" || fail "takeover-preflight holder.actor did not name the incumbent: $(cat "$TMPDIR_EVAL/tp-ac1.out")"
+
+# Now the successor takes over via ensure-session --supersede-stale — takeover-as-resumption:
+# resumed_branch must be the incumbent's branch (NOT a fresh branch), and a `supersede` audit
+# entry naming the incumbent + "resuming from trust bundle" must be recorded.
+flow_agents_node "$WRITER" ensure-session \
+  --flow-id builder.build \
+  --task-slug "$AC1_SLUG" \
+  --work-item "kontourai/flow-agents#294" \
+  --title "Takeover AC1" \
+  --artifact-root "$ARTIFACT_ROOT" \
+  --supersede-stale \
+  --actor "$SUCCESSOR_ACTOR" \
+  >"$TMPDIR_EVAL/tp-ac1-supersede.out" 2>"$TMPDIR_EVAL/tp-ac1-supersede.err"
+AC1_SUPERSEDE_EXIT=$?
+[[ $AC1_SUPERSEDE_EXIT -eq 0 ]] && pass "ensure-session --supersede-stale as the successor exits 0 (AC1)" || fail "ensure-session --supersede-stale unexpectedly failed: $(cat "$TMPDIR_EVAL/tp-ac1-supersede.out" "$TMPDIR_EVAL/tp-ac1-supersede.err")"
+# ensure-session's stdout carries the single-line SupersedeTakeover JSON AND a trailing
+# `console.log(dir)` line — isolate the JSON object line (printJson emits it single-line) before
+# json_query'ing it.
+grep -F '"role": "SupersedeTakeover"' "$TMPDIR_EVAL/tp-ac1-supersede.out" > "$TMPDIR_EVAL/tp-ac1-supersede.json" || true
+[[ "$(json_query "$TMPDIR_EVAL/tp-ac1-supersede.json" "role")" == "SupersedeTakeover" ]] && pass "supersede stdout JSON role is SupersedeTakeover (AC1)" || fail "supersede stdout JSON role was not SupersedeTakeover: $(cat "$TMPDIR_EVAL/tp-ac1-supersede.out")"
+[[ "$(json_query "$TMPDIR_EVAL/tp-ac1-supersede.json" "resumed_branch")" == "$AC1_BRANCH" ]] && pass "supersede resumed_branch is the incumbent's branch ($AC1_BRANCH), NOT a new branch (AC1 headline)" || fail "supersede resumed_branch was not the incumbent's branch: $(cat "$TMPDIR_EVAL/tp-ac1-supersede.out")"
+[[ "$(json_query "$TMPDIR_EVAL/tp-ac1-supersede.json" "superseded_actor")" == "$INCUMBENT_ACTOR" ]] && pass "supersede superseded_actor names the incumbent ($INCUMBENT_ACTOR) (AC1)" || fail "supersede superseded_actor did not name the incumbent: $(cat "$TMPDIR_EVAL/tp-ac1-supersede.out")"
+
+# The record now carries a `supersede` audit_trail entry whose reason resumes from the trust
+# bundle and names the superseded incumbent.
+AC1_SUPERSEDE_REASON="$(node -e '
+const fs = require("fs");
+const rec = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+const trail = Array.isArray(rec.audit_trail) ? rec.audit_trail : [];
+const entry = trail.find((e) => e && e.transition === "supersede");
+process.stdout.write(entry && typeof entry.reason === "string" ? entry.reason : "");
+' "$AC1_RECORD")"
+[[ -n "$AC1_SUPERSEDE_REASON" ]] && pass "the assignment record now contains a supersede audit_trail entry (AC1)" || fail "no supersede audit_trail entry found on the record: $(cat "$AC1_RECORD")"
+[[ "$AC1_SUPERSEDE_REASON" == *"resuming from trust bundle"* ]] && pass "the supersede audit reason contains 'resuming from trust bundle' (AC1)" || fail "supersede audit reason did not contain 'resuming from trust bundle': '$AC1_SUPERSEDE_REASON'"
+[[ "$AC1_SUPERSEDE_REASON" == *"$INCUMBENT_ACTOR"* ]] && pass "the supersede audit reason names the superseded incumbent ($INCUMBENT_ACTOR) (AC1)" || fail "supersede audit reason did not name the superseded incumbent: '$AC1_SUPERSEDE_REASON'"
+
+# ─── 2. AC2a — revive during grace -> back off; --supersede-stale then REFUSES ─────────────
+echo "--- 2. AC2a: a fresh incumbent liveness heartbeat flips reclaimable -> back-off/held; --supersede-stale then refuses ---"
+
+AC2A_SLUG="takeover-ac2a-revive"
+AC2A_DIR="$ARTIFACT_ROOT/$AC2A_SLUG"
+AC2A_INCUMBENT="eval-actor-incumbent-revived"
+write_assignment_record "$ARTIFACT_ROOT" "$AC2A_SLUG" "incumbent-revived-session" "$AC2A_INCUMBENT"
+mkdir -p "$AC2A_DIR"
+
+# A FRESH liveness heartbeat for the INCUMBENT — the incumbent revived during the grace window,
+# so the join now classifies the subject held(holder=incumbent), not reclaimable.
+append_liveness_event "$ARTIFACT_ROOT" "$AC2A_SLUG" "$AC2A_INCUMBENT" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" 1800
+
+if flow_agents_node "$WRITER" takeover-preflight "$AC2A_DIR" --actor "$SUCCESSOR_ACTOR" \
+  >"$TMPDIR_EVAL/tp-ac2a.out" 2>"$TMPDIR_EVAL/tp-ac2a.err"; then
+  fail "takeover-preflight against a revived incumbent should have exited non-zero (back off) (AC2a)"
+else
+  pass "takeover-preflight against a revived incumbent exits non-zero — do NOT supersede a live holder (AC2a)"
+fi
+[[ "$(json_query "$TMPDIR_EVAL/tp-ac2a.out" "ok")" == "false" ]] && pass "takeover-preflight reports ok:false for the revived incumbent (AC2a)" || fail "takeover-preflight did not report ok:false: $(cat "$TMPDIR_EVAL/tp-ac2a.out")"
+[[ "$(json_query "$TMPDIR_EVAL/tp-ac2a.out" "action")" == "back-off" ]] && pass "takeover-preflight action is back-off for the revived incumbent (AC2a)" || fail "takeover-preflight action was not back-off: $(cat "$TMPDIR_EVAL/tp-ac2a.out")"
+[[ "$(json_query "$TMPDIR_EVAL/tp-ac2a.out" "effective_state")" == "held" ]] && pass "takeover-preflight effective_state is held (incumbent revived) (AC2a)" || fail "takeover-preflight effective_state was not held: $(cat "$TMPDIR_EVAL/tp-ac2a.out")"
+
+# The successor's --supersede-stale must now REFUSE (the state is held, not reclaimable) and never
+# write a supersede audit entry.
+flow_agents_node "$WRITER" ensure-session \
+  --flow-id builder.build \
+  --task-slug "$AC2A_SLUG" \
+  --work-item "kontourai/flow-agents#294" \
+  --title "Takeover AC2a" \
+  --artifact-root "$ARTIFACT_ROOT" \
+  --supersede-stale \
+  --actor "$SUCCESSOR_ACTOR" \
+  >"$TMPDIR_EVAL/tp-ac2a-supersede.out" 2>"$TMPDIR_EVAL/tp-ac2a-supersede.err"
+AC2A_SUPERSEDE_EXIT=$?
+[[ $AC2A_SUPERSEDE_EXIT -ne 0 ]] && pass "ensure-session --supersede-stale as the successor REFUSES (exits non-zero) because the incumbent revived (AC2a)" || fail "ensure-session --supersede-stale should have refused against a revived incumbent: $(cat "$TMPDIR_EVAL/tp-ac2a-supersede.out" "$TMPDIR_EVAL/tp-ac2a-supersede.err")"
+AC2A_HAS_SUPERSEDE="$(node -e '
+const fs = require("fs");
+const rec = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+const trail = Array.isArray(rec.audit_trail) ? rec.audit_trail : [];
+process.stdout.write(trail.some((e) => e && e.transition === "supersede") ? "yes" : "no");
+' "$ARTIFACT_ROOT/assignment/$AC2A_SLUG.json")"
+[[ "$AC2A_HAS_SUPERSEDE" == "no" ]] && pass "no supersede audit entry was written for the refused takeover — the live incumbent's record is untouched (AC2a)" || fail "a supersede audit entry was written despite the refusal (AC2a)"
+
+# ─── 3. AC2b — a superseded incumbent is blocked at publish (compose with verify-hold, #293) ─
+echo "--- 3. AC2b: the woken zombie incumbent is blocked by verify-hold on the AC1 subject (takeover + #293 gate compose) ---"
+
+# After AC1's takeover the AC1 record is held by the successor (successor's actor_key). The
+# original incumbent, if it wakes, is no longer the holder — verify-hold (#293) must block it.
+if flow_agents_node "$WRITER" verify-hold "$AC1_DIR" --actor "$INCUMBENT_ACTOR" \
+  >"$TMPDIR_EVAL/tp-ac2b.out" 2>"$TMPDIR_EVAL/tp-ac2b.err"; then
+  fail "verify-hold for the superseded (zombie) incumbent should have exited non-zero — it no longer holds the subject (AC2b)"
+else
+  pass "verify-hold blocks the woken zombie incumbent (exit non-zero) — takeover + the #293 gate compose (AC2b)"
+fi
+[[ "$(json_query "$TMPDIR_EVAL/tp-ac2b.out" "ok")" == "false" ]] && pass "verify-hold reports ok:false for the superseded incumbent (AC2b)" || fail "verify-hold did not report ok:false for the superseded incumbent: $(cat "$TMPDIR_EVAL/tp-ac2b.out")"
+
+# ─── 4. free / self quick cases ────────────────────────────────────────────────────────────
+echo "--- 4. free (no record) -> claim; self+fresh -> proceed ---"
+
+# free: no assignment record at all for this fresh slug.
+FREE_SLUG="takeover-free-subject"
+FREE_DIR="$ARTIFACT_ROOT/$FREE_SLUG"
+mkdir -p "$FREE_DIR"
+if flow_agents_node "$WRITER" takeover-preflight "$FREE_DIR" --actor "$SUCCESSOR_ACTOR" \
+  >"$TMPDIR_EVAL/tp-free.out" 2>"$TMPDIR_EVAL/tp-free.err"; then
+  pass "takeover-preflight on a free subject (no record) exits 0 (AC free)"
+else
+  fail "takeover-preflight on a free subject unexpectedly refused: $(cat "$TMPDIR_EVAL/tp-free.out" "$TMPDIR_EVAL/tp-free.err")"
+fi
+[[ "$(json_query "$TMPDIR_EVAL/tp-free.out" "action")" == "claim" ]] && pass "takeover-preflight action is claim for a free subject (AC free)" || fail "takeover-preflight action was not claim: $(cat "$TMPDIR_EVAL/tp-free.out")"
+[[ "$(json_query "$TMPDIR_EVAL/tp-free.out" "effective_state")" == "free" ]] && pass "takeover-preflight effective_state is free for a free subject (AC free)" || fail "takeover-preflight effective_state was not free: $(cat "$TMPDIR_EVAL/tp-free.out")"
+
+# self_is_holder: a fresh record + fresh liveness for the SAME actor passed as --actor.
+SELF_SLUG="takeover-self-holder"
+SELF_DIR="$ARTIFACT_ROOT/$SELF_SLUG"
+SELF_ACTOR="eval-actor-self-holder"
+write_assignment_record "$ARTIFACT_ROOT" "$SELF_SLUG" "self-holder-session" "$SELF_ACTOR"
+append_liveness_event "$ARTIFACT_ROOT" "$SELF_SLUG" "$SELF_ACTOR" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" 1800
+mkdir -p "$SELF_DIR"
+if flow_agents_node "$WRITER" takeover-preflight "$SELF_DIR" --actor "$SELF_ACTOR" \
+  >"$TMPDIR_EVAL/tp-self.out" 2>"$TMPDIR_EVAL/tp-self.err"; then
+  pass "takeover-preflight when the current actor IS the fresh holder exits 0 (AC self)"
+else
+  fail "takeover-preflight for the self holder unexpectedly refused: $(cat "$TMPDIR_EVAL/tp-self.out" "$TMPDIR_EVAL/tp-self.err")"
+fi
+[[ "$(json_query "$TMPDIR_EVAL/tp-self.out" "action")" == "proceed" ]] && pass "takeover-preflight action is proceed when self is the holder (AC self)" || fail "takeover-preflight action was not proceed: $(cat "$TMPDIR_EVAL/tp-self.out")"
+
+# ─── 5. Injection discipline — hostile control bytes + >64 chars are stripped AND capped ─────
+echo "--- 5. injection: hostile actor_key/branch never leak raw control/ANSI bytes; holder.actor & resume_branch are length-capped (<=64) ---"
+
+HOSTILE_SLUG="takeover-hostile-injection"
+HOSTILE_DIR="$ARTIFACT_ROOT/$HOSTILE_SLUG"
+HOSTILE_RECORD="$ARTIFACT_ROOT/assignment/$HOSTILE_SLUG.json"
+# actor_key and branch: embed raw ESC (\x1b) + BEL (\x07) control bytes AND >64 chars each.
+HOSTILE_ACTOR=$'hostile-actor\x1b[31;1mFAKE\x07-admin-'"$(printf 'A%.0s' {1..300})"
+HOSTILE_BRANCH=$'agent/hostile\x1b[31;1mFAKE\x07-branch-'"$(printf 'B%.0s' {1..300})"
+write_assignment_record "$ARTIFACT_ROOT" "$HOSTILE_SLUG" "hostile-session" "$HOSTILE_ACTOR"
+patch_record_branch "$HOSTILE_RECORD" "$HOSTILE_BRANCH"
+mkdir -p "$HOSTILE_DIR"
+
+# No liveness event -> reclaimable, so both holder.actor (from the record's actor_key) and
+# resume_branch (from the record's branch) are populated and pass through sanitize().
+flow_agents_node "$WRITER" takeover-preflight "$HOSTILE_DIR" --actor eval-actor-hostile-reader \
+  >"$TMPDIR_EVAL/tp-hostile.out" 2>"$TMPDIR_EVAL/tp-hostile.err"
+
+if grep -qF $'\x1b[31;1m' "$TMPDIR_EVAL/tp-hostile.out" "$TMPDIR_EVAL/tp-hostile.err" || grep -qF $'\x07' "$TMPDIR_EVAL/tp-hostile.out" "$TMPDIR_EVAL/tp-hostile.err"; then
+  fail "hostile actor_key/branch's raw ANSI/control bytes leaked into takeover-preflight's output (stdout+stderr) (injection AC)"
+else
+  pass "hostile actor_key/branch's raw ANSI/control bytes never leak into takeover-preflight's output (injection AC)"
+fi
+
+HOSTILE_HOLDER_ACTOR="$(json_query "$TMPDIR_EVAL/tp-hostile.out" "holder.actor")"
+if [[ "$HOSTILE_HOLDER_ACTOR" == *$'\x1b'* || "$HOSTILE_HOLDER_ACTOR" == *$'\x07'* ]]; then
+  fail "holder.actor leaked raw control/ANSI bytes (injection AC): $HOSTILE_HOLDER_ACTOR"
+else
+  pass "holder.actor is control-char-stripped (injection AC)"
+fi
+HOSTILE_HOLDER_ACTOR_LEN="${#HOSTILE_HOLDER_ACTOR}"
+[[ "$HOSTILE_HOLDER_ACTOR_LEN" -le 64 ]] && pass "holder.actor is length-capped at <=64 chars despite a 300+ char source (len=$HOSTILE_HOLDER_ACTOR_LEN) (injection AC)" || fail "holder.actor exceeded the 64-char cap (len=$HOSTILE_HOLDER_ACTOR_LEN): $HOSTILE_HOLDER_ACTOR"
+
+HOSTILE_RESUME_BRANCH="$(json_query "$TMPDIR_EVAL/tp-hostile.out" "resume_branch")"
+if [[ "$HOSTILE_RESUME_BRANCH" == *$'\x1b'* || "$HOSTILE_RESUME_BRANCH" == *$'\x07'* ]]; then
+  fail "resume_branch leaked raw control/ANSI bytes (injection AC): $HOSTILE_RESUME_BRANCH"
+else
+  pass "resume_branch is control-char-stripped (injection AC)"
+fi
+HOSTILE_RESUME_BRANCH_LEN="${#HOSTILE_RESUME_BRANCH}"
+# Branch uses the 240-char FREE-TEXT tier (not the 64-char id tier holder.actor uses): a realistic
+# `agent/<actor>/<slug>` branch legitimately exceeds 64 chars, so capping the branch at 64 would
+# truncate a VALID branch into a non-existent `git checkout` target (review finding #2). It is still
+# capped (bounded at 240) and control-stripped (asserted above).
+[[ "$HOSTILE_RESUME_BRANCH_LEN" -le 240 ]] && pass "resume_branch is length-capped at <=240 (free-text tier) despite a 300+ char source (len=$HOSTILE_RESUME_BRANCH_LEN) (injection AC)" || fail "resume_branch exceeded the 240-char free-text cap (len=$HOSTILE_RESUME_BRANCH_LEN): $HOSTILE_RESUME_BRANCH"
+
+# ─── 6. A legitimate LONG branch (>64 chars, no control bytes) survives INTACT (review finding #2) ─
+echo "--- 6. a realistic >64-char branch is NOT truncated (resume path would otherwise checkout a bad target) ---"
+LONG_SLUG="takeover-long-branch"
+LONG_DIR="$ARTIFACT_ROOT/$LONG_SLUG"
+LONG_RECORD="$ARTIFACT_ROOT/assignment/$LONG_SLUG.json"
+# 78 chars, well over 64, entirely valid git-branch charset — the exact case that would break AC1 if
+# the branch were capped at 64.
+LONG_BRANCH="agent/claude-code-sess-abcdef0123456789-hostname/flow-agents-294-takeover-xyz"
+write_assignment_record "$ARTIFACT_ROOT" "$LONG_SLUG" "long-session" "long-actor-key"
+patch_record_branch "$LONG_RECORD" "$LONG_BRANCH"
+mkdir -p "$LONG_DIR"
+flow_agents_node "$WRITER" takeover-preflight "$LONG_DIR" --actor eval-actor-long-reader \
+  >"$TMPDIR_EVAL/tp-long.out" 2>"$TMPDIR_EVAL/tp-long.err"
+LONG_RESUME_BRANCH="$(json_query "$TMPDIR_EVAL/tp-long.out" "resume_branch")"
+[[ "$LONG_RESUME_BRANCH" == "$LONG_BRANCH" ]] && pass "a legitimate ${#LONG_BRANCH}-char branch survives INTACT in resume_branch (never truncated into a bad checkout target — AC1 / review finding #2)" || fail "a legitimate long branch was altered/truncated in resume_branch: got '$LONG_RESUME_BRANCH' expected '$LONG_BRANCH'"
+# And through the real supersede (resumed_branch) path.
+flow_agents_node "$WRITER" ensure-session --flow-id builder.build --task-slug "$LONG_SLUG" --work-item 294 --title t --artifact-root "$ARTIFACT_ROOT" --supersede-stale --actor eval-actor-long-reader \
+  >"$TMPDIR_EVAL/tp-long-supersede.out" 2>"$TMPDIR_EVAL/tp-long-supersede.err"
+grep -F '"role": "SupersedeTakeover"' "$TMPDIR_EVAL/tp-long-supersede.out" >"$TMPDIR_EVAL/tp-long-supersede.json"
+[[ "$(json_query "$TMPDIR_EVAL/tp-long-supersede.json" "resumed_branch")" == "$LONG_BRANCH" ]] && pass "supersede resumed_branch preserves the full ${#LONG_BRANCH}-char incumbent branch (review finding #2)" || fail "supersede resumed_branch truncated the long branch: $(cat "$TMPDIR_EVAL/tp-long-supersede.json")"
+
+echo ""
+if [[ "$errors" -eq 0 ]]; then
+  echo "test_takeover_protocol: all checks passed."
+else
+  echo "test_takeover_protocol: $errors check(s) failed."
+fi
+exit "$errors"

package/evals/integration/test_trust_reconcile_negatives.sh

@@ -40,6 +40,7 @@
 set -uo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+source "$ROOT/evals/lib/node.sh"
 RECONCILE="$ROOT/scripts/ci/trust-reconcile.js"
 FX="$ROOT/evals/fixtures/trust-reconcile-exploits"
 WS3="$ROOT/evals/fixtures/trust-reconcile-ws3/ws3-bundle.json"
@@ -749,6 +750,266 @@ else
   _fail "push-event-failing-verify: expected the push-event no-op line -- output: $out7v"
 fi
 
+# 8. #379 per-session delivery paths — concurrent-delivery collision resolution.
+#   resolveDeliveryCandidates() now discovers delivery/<slug>/trust.bundle per-session dirs
+#   in addition to the flat path; discoverBundle() selects the candidate whose checkpoint
+#   attests THIS change (ancestor-or-equal, same bundleAttestsThisChange() semantics the flat
+#   staleness gate uses), ignoring stale siblings from OTHER concurrent sessions. A shared
+#   flat path guaranteed a git conflict between any two concurrent deliveries → a DIRTY PR →
+#   NO pull_request workflows → the required check silently never ran (field #330/#358/#378).
+echo ""
+echo "=== 8. #379 per-session delivery paths (concurrent-delivery collision) ==="
+
+PERSESSION_TMPROOT="$(mktemp -d)"
+# Chain per-session cleanup onto the existing DECLARED cleanup without clobbering the trap.
+trap 'cleanup_declared; rm -rf "$PERSESSION_TMPROOT"' EXIT
+
+# write_session_seal <repo_root> <slug> <label> <commit_sha>
+# Writes delivery/<slug>/trust.bundle (a well-formed schemaVersion-5 bundle whose only
+# claimed-pass command is <label>) + delivery/<slug>/trust.checkpoint.json (naming
+# <commit_sha>) — the per-session analogue of write_fresh_bundle + write_stale_checkpoint.
+write_session_seal() {
+  local repo_root="$1" slug="$2" label="$3" sha="$4"
+  local sdir="$repo_root/delivery/$slug"
+  mkdir -p "$sdir"
+  cat > "$sdir/trust.bundle" << EOF
+{
+  "schemaVersion": 5,
+  "source": "test-fixture:per-session:$slug",
+  "claims": [
+    {
+      "id": "c1", "claimType": "workflow.check.build", "value": "pass", "status": "verified",
+      "subjectId": "$slug/build", "facet": "flow-agents.workflow", "subjectType": "workflow-check",
+      "fieldOrBehavior": "build", "createdAt": "2026-07-01T00:00:00Z", "updatedAt": "2026-07-01T00:00:00Z",
+      "impactLevel": "high", "verificationPolicyId": "policy:workflow.check.build"
+    }
+  ],
+  "evidence": [
+    {
+      "id": "ev1", "claimId": "c1", "evidenceType": "test_output", "method": "validation",
+      "sourceRef": "$slug/command-log.jsonl", "excerptOrSummary": "build",
+      "observedAt": "2026-07-01T00:00:00Z", "collectedBy": "flow-agents/evidence-capture",
+      "passing": true,
+      "execution": { "runner": "bash", "label": "$label", "isError": false, "exitCode": 0 }
+    }
+  ],
+  "policies": [], "events": []
+}
+EOF
+  printf '{"schema_version":"1.0","slug":"%s","work_item":null,"status":"delivered","phase":"release","sealed_at":"2026-01-01T00:00:00Z","commit_sha":"%s","checkpoint":{"asOf":"2026-01-01T00:00:00.000Z","statusByClaimId":{}}}' \
+    "$slug" "$sha" > "$sdir/trust.checkpoint.json"
+}
+
+FRESH_LABEL_8="node -e 'process.exit(0)'"
+
+# 8a. OWNER WINS: two sibling session dirs — one OWNING (checkpoint commit_sha == this
+#     change's sha), one STALE (a different sha). The reconciler MUST pick the owner and
+#     reconcile it; the stale sibling is ignored, NOT a failure.
+CASE8A="$PERSESSION_TMPROOT/collision-owner-wins"
+write_session_seal "$CASE8A" "owning-session" "$FRESH_LABEL_8" "$OURS_SHA"
+write_session_seal "$CASE8A" "stale-sibling" "echo stale-should-never-be-reconciled" "$STALE_SHA"
+out8a="$(TRUST_RECONCILE_SHA="$OURS_SHA" TRUST_RECONCILE_COMMANDS="$FRESH_LABEL_8" \
+  node "$RECONCILE" --repo-root "$CASE8A" 2>&1)"
+code8a=$?
+if [[ $code8a -eq 0 ]]; then
+  _pass "persession-owner-wins: reconciler exits 0 (owning per-session candidate selected, stale sibling ignored)"
+else
+  _fail "persession-owner-wins: expected exit 0, got $code8a -- output: $out8a"
+fi
+if echo "$out8a" | grep -qF "selected delivery candidate delivery/owning-session/trust.bundle"; then
+  _pass "persession-owner-wins: emitted the #379 selection line naming the owning session dir"
+else
+  _fail "persession-owner-wins: expected the #379 selection line for delivery/owning-session/trust.bundle -- output: $out8a"
+fi
+if echo "$out8a" | grep -qF "RECONCILED"; then
+  _pass "persession-owner-wins: Step 2 reconciled the owning candidate's claimed-pass command"
+else
+  _fail "persession-owner-wins: expected RECONCILED -- output: $out8a"
+fi
+if echo "$out8a" | grep -qF "bundle-required-no-declared-marker"; then
+  _fail "persession-owner-wins: must NOT fail closed — an owning candidate exists"
+else
+  _pass "persession-owner-wins: does not fail closed (owning candidate found)"
+fi
+
+# 8b. NO OWNER: two sibling session dirs, BOTH stale (neither attests this change), no
+#     DECLARED marker -> fail closed EXACTLY as bundle-absence, plus the #379 concurrency
+#     hint so the next agent can diagnose a collision rather than a plain stale bundle.
+CASE8B="$PERSESSION_TMPROOT/collision-no-owner"
+OTHER_STALE_SHA="1111111111111111111111111111111111111111"
+write_session_seal "$CASE8B" "session-a" "echo a" "$STALE_SHA"
+write_session_seal "$CASE8B" "session-b" "echo b" "$OTHER_STALE_SHA"
+out8b="$(TRUST_RECONCILE_SHA="$OURS_SHA" TRUST_RECONCILE_COMMANDS="$FRESH_LABEL_8" \
+  node "$RECONCILE" --repo-root "$CASE8B" 2>&1)"
+code8b=$?
+if [[ $code8b -ne 0 ]]; then
+  _pass "persession-no-owner: reconciler exits non-zero ($code8b) -- no candidate attests this change, fail closed"
+else
+  _fail "persession-no-owner: expected non-zero exit, got 0 -- output: $out8b"
+fi
+if echo "$out8b" | grep -qF "none attests this change $OURS_SHA"; then
+  _pass "persession-no-owner: emitted the #379 concurrency hint (none attests this change)"
+else
+  _fail "persession-no-owner: expected the #379 'none attests this change' hint -- output: $out8b"
+fi
+if echo "$out8b" | grep -qF "bundle-required-no-declared-marker"; then
+  _pass "persession-no-owner: emitted 'bundle-required-no-declared-marker' (same fail-closed path as bundle-absence)"
+else
+  _fail "persession-no-owner: expected 'bundle-required-no-declared-marker' -- output: $out8b"
+fi
+
+# 8c. BACK-COMPAT COEXISTENCE: a flat legacy owner (delivery/trust.bundle) alongside a stale
+#     per-session sibling -> the flat owner is still selected and reconciled (the flat path
+#     stays supported; per-session discovery does not break it).
+CASE8C="$PERSESSION_TMPROOT/flat-owner-persession-stale"
+write_fresh_bundle "$CASE8C" "$FRESH_LABEL_8"          # flat delivery/trust.bundle
+write_stale_checkpoint "$CASE8C" "$OURS_SHA"           # flat delivery/trust.checkpoint.json (owns)
+write_session_seal "$CASE8C" "stale-session" "echo ignored" "$STALE_SHA"  # per-session stale sibling
+out8c="$(TRUST_RECONCILE_SHA="$OURS_SHA" TRUST_RECONCILE_COMMANDS="$FRESH_LABEL_8" \
+  node "$RECONCILE" --repo-root "$CASE8C" 2>&1)"
+code8c=$?
+if [[ $code8c -eq 0 ]]; then
+  _pass "flat-owner-coexist: reconciler exits 0 (flat legacy owner selected despite a stale per-session sibling)"
+else
+  _fail "flat-owner-coexist: expected exit 0, got $code8c -- output: $out8c"
+fi
+if echo "$out8c" | grep -qF "RECONCILED"; then
+  _pass "flat-owner-coexist: Step 2 reconciled the flat owner (back-compat preserved)"
+else
+  _fail "flat-owner-coexist: expected RECONCILED -- output: $out8c"
+fi
+
+# 8d. PREFER-NEWEST among multiple OWNING candidates (the merge-commit-repo / concurrent-PR
+#   coexistence case). An inherited FLAT bundle can attest a REAL ANCESTOR of this change
+#   (committed on the trunk before this branch), AND this session's per-session bundle attests
+#   a NEWER ancestor. "First-fresh-wins" would wrongly pick the stale flat bundle because it
+#   sorts first; the reconciler must instead pick the NEWEST-owning candidate (the per-session
+#   one). Uses a REAL git repo so `git merge-base --is-ancestor` resolves the parent→child
+#   relationship (synthetic shas cannot exercise the ancestor comparison).
+NEWEST_REPO="$PERSESSION_TMPROOT/prefer-newest-git"
+mkdir -p "$NEWEST_REPO"
+git -C "$NEWEST_REPO" init -q
+git -C "$NEWEST_REPO" config user.email "test@example.com"
+git -C "$NEWEST_REPO" config user.name "Test"
+echo "base" > "$NEWEST_REPO/f.txt"; git -C "$NEWEST_REPO" add f.txt; git -C "$NEWEST_REPO" commit -q -m "base (inherited flat seal sealed here)"
+FLAT_ANCESTOR_SHA="$(git -C "$NEWEST_REPO" rev-parse HEAD)"
+echo "delivery" >> "$NEWEST_REPO/f.txt"; git -C "$NEWEST_REPO" add f.txt; git -C "$NEWEST_REPO" commit -q -m "this session's delivery commit"
+PERSESSION_OWNER_SHA="$(git -C "$NEWEST_REPO" rev-parse HEAD)"
+echo "head" >> "$NEWEST_REPO/f.txt"; git -C "$NEWEST_REPO" add f.txt; git -C "$NEWEST_REPO" commit -q -m "seal commit (HEAD)"
+NEWEST_HEAD_SHA="$(git -C "$NEWEST_REPO" rev-parse HEAD)"
+# Flat owner attesting the OLD ancestor; per-session owner attesting the NEWER ancestor.
+write_fresh_bundle "$NEWEST_REPO" "$FRESH_LABEL_8"                 # flat delivery/trust.bundle
+write_stale_checkpoint "$NEWEST_REPO" "$FLAT_ANCESTOR_SHA"          # flat checkpoint -> OLD ancestor
+write_session_seal "$NEWEST_REPO" "this-session" "$FRESH_LABEL_8" "$PERSESSION_OWNER_SHA"  # per-session -> NEWER ancestor
+out8d="$(TRUST_RECONCILE_SHA="$NEWEST_HEAD_SHA" TRUST_RECONCILE_COMMANDS="$FRESH_LABEL_8" \
+  node "$RECONCILE" --repo-root "$NEWEST_REPO" 2>&1)"
+code8d=$?
+if [[ $code8d -eq 0 ]]; then
+  _pass "prefer-newest: reconciler exits 0 (both flat and per-session own; newest selected)"
+else
+  _fail "prefer-newest: expected exit 0, got $code8d -- output: $out8d"
+fi
+if echo "$out8d" | grep -qF "selected delivery candidate delivery/this-session/trust.bundle"; then
+  _pass "prefer-newest: selected the NEWER per-session bundle over the older inherited flat bundle"
+else
+  _fail "prefer-newest: expected the per-session bundle to be selected (newest-owning) -- output: $out8d"
+fi
+if echo "$out8d" | grep -qF "owning, newest wins"; then
+  _pass "prefer-newest: emitted the 'owning, newest wins' selection detail"
+else
+  _fail "prefer-newest: expected 'owning, newest wins' in the selection line -- output: $out8d"
+fi
+
+# 9. [iteration-1 F1 CRITICAL regression guard] CI trust-reconcile.js MUST stay fail-closed
+#   when scripts/ci/derive-claim-status.mjs is unavailable (Surface unresolvable, spawn
+#   failure, malformed bundle, etc.) -- deriveClaimStatuses() returns null in that case, and
+#   BEFORE #356's extraction the inline session-local loop turned every session-local
+#   pass-asserting claim into a `status-underivable` divergence (hard FAIL). The extraction's
+#   shared sessionLocalShapeIssues() briefly made that a caller-controlled `onUnderivable` mode
+#   (see reconcile-shape.js) -- this section proves CI still defaults/forces the safe 'fail'
+#   mode, and (paired) that the LOCAL reconcile-preflight intentionally diverges into the
+#   'reduce' mode on the exact same bundle. Without the fix, case 9a below FAILS (exits 0
+#   instead of 1) -- this is the single regression eval that let the CRITICAL through
+#   code-review-356 iteration 0.
+echo ""
+echo "=== 9. derive-claim-status.mjs unavailable: CI fail-closed vs local-preflight reduced-coverage (iteration-1 F1) ==="
+
+DERIVE_HELPER="$ROOT/scripts/ci/derive-claim-status.mjs"
+DERIVE_HELPER_HIDDEN="$DERIVE_HELPER.hidden-by-test-9"
+
+# hide_derive_helper / restore_derive_helper: rename the real ESM helper out of the way so
+# scripts/ci/trust-reconcile.js's deriveClaimStatuses() -- which does fs.existsSync(helper)
+# before ever spawning it -- returns null exactly as it would if Surface could not resolve.
+# Always restored via trap, including on a hard failure of this script.
+hide_derive_helper() {
+  if [[ -f "$DERIVE_HELPER" ]]; then
+    mv "$DERIVE_HELPER" "$DERIVE_HELPER_HIDDEN"
+  fi
+}
+restore_derive_helper() {
+  if [[ -f "$DERIVE_HELPER_HIDDEN" ]]; then
+    mv "$DERIVE_HELPER_HIDDEN" "$DERIVE_HELPER"
+  fi
+}
+trap 'cleanup_declared; rm -rf "$PERSESSION_TMPROOT"; restore_derive_helper' EXIT
+
+# A one-claim, session-local, pass-asserting bundle (reuses the finding-3 exploit fixture --
+# a human_attestation-backed claim asserting status "verified"; any session-local
+# pass-asserting claim exercises this path since the whole derivedStatus map is null, not a
+# single claim's lookup).
+CASE9_BUNDLE="$FX/status-misassertion.json"
+
+hide_derive_helper
+
+# 9a. CI (real scripts/ci/trust-reconcile.js): derive-claim-status.mjs unavailable -> MUST
+#     still exit non-zero (status-underivable, fail-closed) -- the pre-#356 guarantee.
+out9a="$(TRUST_RECONCILE_COMMANDS="node -e 'process.exit(0)'" \
+  node "$RECONCILE" --bundle "$CASE9_BUNDLE" --repo-root "$ROOT" 2>&1)"
+code9a=$?
+if [[ $code9a -ne 0 ]]; then
+  _pass "derive-unavailable-ci: reconciler exits non-zero ($code9a) -- fail-closed preserved when re-derivation is unavailable"
+else
+  _fail "derive-unavailable-ci: expected non-zero exit (fail-closed), got 0 -- output: $out9a"
+fi
+if echo "$out9a" | grep -qF "[status-underivable]"; then
+  _pass "derive-unavailable-ci: emitted the status-underivable divergence"
+else
+  _fail "derive-unavailable-ci: expected a [status-underivable] divergence -- output: $out9a"
+fi
+if echo "$out9a" | grep -qF "refusing to trust a self-reported status (fail-closed)"; then
+  _pass "derive-unavailable-ci: emitted the verbatim fail-closed message"
+else
+  _fail "derive-unavailable-ci: expected the verbatim fail-closed message -- output: $out9a"
+fi
+
+# 9b. Paired proof the modes diverge intentionally: the LOCAL reconcile-preflight, on the
+#     SAME bundle with the SAME helper hidden, DEGRADES -- it does not hard-fail on the
+#     underivable-status dimension (it opts into reduce mode explicitly; see
+#     src/cli/workflow-sidecar.ts's runReconcilePreflight).
+# Nested under a subdirectory (not the raw mktemp -d path) -- mktemp -d's own
+# "tmp.XXXXXXXXXX" basename contains a dot that path.extname()/artifactDirFrom() would
+# misparse as a file extension, incorrectly stripping the directory segment.
+CASE9_TMPROOT="$(mktemp -d)"
+CASE9_SESSION="$CASE9_TMPROOT/session"
+mkdir -p "$CASE9_SESSION"
+cp "$CASE9_BUNDLE" "$CASE9_SESSION/trust.bundle"
+out9b="$(flow_agents_node workflow-sidecar reconcile-preflight "$CASE9_SESSION" --repo-root "$ROOT" 2>&1)"
+code9b=$?
+rm -rf "$CASE9_TMPROOT"
+if [[ $code9b -eq 0 ]]; then
+  _pass "derive-unavailable-local-preflight: reconcile-preflight exits 0 (reduced-coverage degrade, not a hard fail) -- proves the CI/local modes diverge intentionally"
+else
+  _fail "derive-unavailable-local-preflight: expected exit 0 (reduced-coverage degrade), got $code9b -- output: $out9b"
+fi
+if echo "$out9b" | grep -qF "status-underivable"; then
+  _fail "derive-unavailable-local-preflight: must NOT emit status-underivable in reduced-coverage mode -- output: $out9b"
+else
+  _pass "derive-unavailable-local-preflight: does not emit status-underivable (reduced-coverage checks only)"
+fi
+
+restore_derive_helper
+
+
 echo ""
 if [[ $errors -eq 0 ]]; then
   echo "test_trust_reconcile_negatives: all checks passed."