@kontourai/flow-agents 3.1.0 → 3.3.0

package/kits/veritas-governance/flows/exemption-issuance.flow.json

@@ -0,0 +1,35 @@
+{
+  "id": "veritas-governance.exemption-issuance",
+  "version": "1.0",
+  "steps": [
+    { "id": "request", "next": "issue" },
+    { "id": "issue", "next": null }
+  ],
+  "gates": {
+    "human-approval-gate": {
+      "step": "issue",
+      "expects": [
+        {
+          "id": "exemption-approval",
+          "kind": "trust.bundle",
+          "required": true,
+          "description": "A human maintainer has approved this delivery-scope exemption from Trust Reconcile's bundle-required enforcement (ADR 0022 §1/§2), recorded as a verified no-agent-delivery-exemption-approval trust.bundle claim.",
+          "explore_hint": "A human approver authors a Hachure trust.bundle carrying a no-agent-delivery-exemption-approval / delivery-scope claim with status verified, then `flow attach-evidence <run> --gate human-approval-gate --file <bundle> --bundle`.",
+          "bundle_claim": {
+            "claimType": "no-agent-delivery-exemption-approval",
+            "subjectType": "delivery-scope",
+            "accepted_statuses": ["verified"]
+          }
+        }
+      ],
+      "on_route_back": {
+        "missing_evidence": "issue",
+        "default": "issue"
+      },
+      "route_back_policy": {
+        "max_attempts": 3,
+        "on_exceeded": "block"
+      }
+    }
+  }
+}

package/kits/veritas-governance/kit.json

@@ -8,6 +8,11 @@
       "id": "veritas-governance.readiness-check",
       "path": "flows/readiness-check.flow.json",
       "description": "Single-gate agentless flow: requires a verified software-readiness-verdict trust.bundle claim (projected from `veritas readiness --check evidence --working-tree`) before the gate-check step can pass. CI-callable, K0."
+    },
+    {
+      "id": "veritas-governance.exemption-issuance",
+      "path": "flows/exemption-issuance.flow.json",
+      "description": "Agentless K0 flow issuing a delivery/DECLARED no-agent-delivery exemption (ADR 0022 §2/§3): step request -> gate human-approval-gate (requires a verified no-agent-delivery-exemption-approval trust.bundle claim, satisfiable only by a human-authored approval bundle by convention -- see docs/README.md) -> step issue, which appends the approved entry to delivery/DECLARED. CI-callable."
     }
   ],
   "docs": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontourai/flow-agents",
-  "version": "3.1.0",
+  "version": "3.3.0",
   "description": "Flow Agents — a Kontour product that applies Flow and Veritas discipline as a portable process layer inside the agent tools you already use: Claude Code, Codex, Kiro, opencode, pi, and GitHub Actions — with framework adapters (AWS Strands preview) on the same policy-engine contract.",
   "keywords": [
     "agents",

package/schemas/workflow-handoff.schema.json

@@ -47,6 +47,12 @@
       "items": {
         "type": "string"
       }
+    },
+    "provider_release_pending": {
+      "type": "boolean"
+    },
+    "provider_release_next_command": {
+      "type": "string"
     }
   }
 }

package/scripts/ci/mint-attestation.js

@@ -104,23 +104,50 @@ function loadCiResults(repoRoot) {
   };
 }
 
+/**
+ * Discover the delivery trust.bundle across the flat and per-session (#379) layouts.
+ * Prefers the flat `delivery/trust.bundle` (back-compat), then `delivery/<slug>/trust.bundle`
+ * for each immediate subdirectory (sorted). Returns the first existing path, or null.
+ * This mirrors scripts/ci/trust-reconcile.js resolveDeliveryCandidates() precedence so the
+ * attestation subject binds to the same bundle the reconciler read. best-effort — a missing
+ * or unreadable delivery/ yields null.
+ */
+function discoverDeliveryBundle(repoRoot) {
+  const deliveryRoot = path.join(repoRoot, 'delivery');
+  const flat = path.join(deliveryRoot, 'trust.bundle');
+  if (fs.existsSync(flat)) return flat;
+  let entries = [];
+  try {
+    entries = fs.readdirSync(deliveryRoot, { withFileTypes: true });
+  } catch {
+    return null;
+  }
+  const subdirs = entries.filter((e) => e.isDirectory()).map((e) => e.name).sort();
+  for (const name of subdirs) {
+    const candidate = path.join(deliveryRoot, name, 'trust.bundle');
+    if (fs.existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+
 /**
  * Determine the subject artifact for the in-toto statement.
  *
- * If delivery/trust.bundle is present, use it as the subject (sha256 of its bytes).
- * Otherwise synthesize a results artifact from the predicate and use that.
+ * If a delivery trust.bundle is present (flat or per-session, #379), use it as the subject
+ * (sha256 of its bytes). Otherwise synthesize a results artifact from the predicate.
  *
  * @param {object} predicate  — the predicate that will appear in the statement
  * @param {string} repoRoot
  * @returns {{ subjectName: string, subjectDigest: string, fromBundle: boolean }}
  */
 function resolveSubject(predicate, repoRoot) {
-  const bundlePath = path.join(repoRoot, 'delivery', 'trust.bundle');
-  if (fs.existsSync(bundlePath)) {
+  const bundlePath = discoverDeliveryBundle(repoRoot);
+  if (bundlePath) {
     const bundleBytes = fs.readFileSync(bundlePath);
     const digest = sha256hex(bundleBytes);
-    process.stdout.write(`[mint-attestation] subject: delivery/trust.bundle sha256=${digest.slice(0, 16)}...\n`);
-    return { subjectName: 'delivery/trust.bundle', subjectDigest: digest, fromBundle: true };
+    const rel = path.relative(repoRoot, bundlePath);
+    process.stdout.write(`[mint-attestation] subject: ${rel} sha256=${digest.slice(0, 16)}...\n`);
+    return { subjectName: rel, subjectDigest: digest, fromBundle: true };
   }
 
   // No bundle present: synthesize subject from predicate JSON (self-attesting the results).