@kontourai/flow-agents 3.1.0 → 3.3.0

package/scripts/ci/trust-reconcile.js

@@ -124,6 +124,18 @@ const path = require('path');
 // copy here had drifted (it was missing the trailing `/bin/true` check), which is
 // exactly why this is now imported rather than duplicated.
 const { hasLaunderingOperator } = require('../lib/command-log-chain.js');
+// #356: the bundle-shape classification (classifyBundleClaims) and the pure,
+// shape-level divergence-construction helpers used by Step 2 below are shared with a
+// local pre-push preflight (reconcile-preflight) via this module, so the preflight can
+// never drift from what this CI reconciler actually enforces. See that module's own
+// header comment for the extraction rationale.
+const {
+  classifyBundleClaims,
+  waiverOnCommandIssues,
+  noEvidenceCommandIssues,
+  reconcilableManifestIssues,
+  sessionLocalShapeIssues,
+} = require('../lib/reconcile-shape.js');
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -199,138 +211,6 @@ function runCommand(cmd, repoRoot) {
   };
 }
 
-/**
- * Classify a trust.bundle's claims into: reconcilable command claims (test_output +
- * execution.label), session-local claims (attestation/observation/citation), never-captured
- * or unbacked command claims (not-run divergence), and command-backed claims carrying a
- * waiver (waiver-on-command divergence). Returns
- *   { reconcilable, sessionLocal, noEvidenceCommand, waiverOnCommand }.
- *
- * Source of truth: evidence[].execution.label is the command string recorded at capture time.
- * evidence[].passing (normalized) means the agent claimed this passed. `claim.status` is NOT
- * trusted here — the caller re-derives it CI-side (see derive-claim-status.mjs / finding-3).
- *
- * WS8 iteration-2 hardening:
- *   - finding 1: ANY pass-asserting claim whose evidence is `evidenceType: test_output`
- *     (Surface's default when unset) but which did NOT reconcile — i.e. it has no
- *     manifest-matchable execution.label — is a divergence, NOT session-local. A test_output
- *     claim either reconciles against the manifest or is a divergence; it is never accepted on
- *     self-reported status. (Previously only the literal claimType `workflow.check.command`
- *     was guarded, so a fabricated kind:"test" claim with no command slipped through.)
- *   - finding 4: a command-backed (test_output) claim carrying a waiver is a divergence — a
- *     command-backed check reconciles against CI or fails; it cannot be waived.
- */
-function classifyBundleClaims(bundle) {
-  const evidence = Array.isArray(bundle.evidence) ? bundle.evidence : [];
-  const claims = Array.isArray(bundle.claims) ? bundle.claims : [];
-
-  const claimById = new Map();
-  for (const c of claims) if (c && c.id) claimById.set(c.id, c);
-
-  // Evidence indexing. A missing evidenceType defaults to test_output for backward
-  // compatibility with pre-classification bundles (same default classifyEvidence uses).
-  const claimHasLabeledTestOutput = new Set(); // test_output evidence WITH an execution.label
-  const claimHasTestOutputEvidence = new Set(); // ANY test_output evidence (label or not)
-  // WS8 iteration-4 (converged finding): the session-local (non-test_output) evidenceType per
-  // claim, so the reconciler can name it on the loud ATTESTED marker below — a fabricated
-  // human_attestation/attestation/external claim with no --command is otherwise
-  // indistinguishable, in the reconciler's own output, from a genuinely re-runnable check.
-  const claimEvidenceType = new Map();
-  for (const ev of evidence) {
-    if (!ev || !ev.claimId) continue;
-    const evType = ev.evidenceType || 'test_output';
-    if (evType !== 'test_output') {
-      if (!claimEvidenceType.has(ev.claimId)) claimEvidenceType.set(ev.claimId, evType);
-      continue;
-    }
-    claimHasTestOutputEvidence.add(ev.claimId);
-    if (ev.execution && ev.execution.label) claimHasLabeledTestOutput.add(ev.claimId);
-  }
-
-  // finding 4: a command-backed (test_output-evidence) claim that also carries a waiver.
-  const waiverOnCommand = [];
-  for (const c of claims) {
-    if (!c || !c.id) continue;
-    const waiver = (c.metadata && typeof c.metadata === 'object') ? c.metadata.waiver : undefined;
-    if (waiver && typeof waiver === 'object' && claimHasTestOutputEvidence.has(c.id)) {
-      waiverOnCommand.push({ claimId: c.id, claimType: String(c.claimType || ''), subject: c.subjectId || c.fieldOrBehavior || c.id });
-    }
-  }
-
-  // (A) Reconcilable claimed-passes: evidence items that are test_output (CI-reconcilable),
-  // carry an execution.label, and assert pass. Session-local evidenceTypes
-  // (crawl_observation, human_attestation, attestation, policy_rule, source_excerpt,
-  // document_citation, calculation_trace) are NOT reconciled per-command — they are handled
-  // by the session-local/waiver path below.
-  const reconcilable = [];
-  const reconcilableClaimIds = new Set();
-  const seen = new Set();
-  for (const ev of evidence) {
-    if (!ev || !ev.execution || !ev.execution.label) continue;
-    if (!isPassingValue(ev.passing)) continue;
-    const evType = ev.evidenceType || 'test_output';
-    if (evType !== 'test_output') continue; // session-local — not CI-reconcilable
-    const cmd = normalizeCmd(ev.execution.label);
-    if (!cmd) continue;
-    reconcilableClaimIds.add(ev.claimId);
-    if (seen.has(cmd)) continue;
-    seen.add(cmd);
-    const claim = claimById.get(ev.claimId);
-    reconcilable.push({ cmd, claimId: ev.claimId, evId: ev.id, claimType: claim ? String(claim.claimType || '') : '' });
-  }
-
-  // (B) Session-local claims, never-captured command claims, and unreconciled test_output.
-  const sessionLocal = [];
-  const noEvidenceCommand = [];
-  const seenClaims = new Set();
-  for (const c of claims) {
-    if (!c || !c.id || typeof c.claimType !== 'string') continue;
-    // #267/#282: a superseded critique write is HISTORY — excluded from reconcile evaluation so a
-    // resolved session converges (a fail critique that a later same-reviewer pass superseded no
-    // longer blocks). Scoped to NON-test_output claims so a command-backed claim can never launder
-    // a real failure by carrying superseded_by — a test_output claim always reconciles or diverges.
-    if (c.metadata && typeof c.metadata === 'object' && c.metadata.superseded_by && !claimHasTestOutputEvidence.has(c.id)) continue;
-    if (reconcilableClaimIds.has(c.id)) continue; // handled by (A)
-    if (seenClaims.has(c.id)) continue;
-    const status = String(c.status || '');
-    const assertsPass = isPassingValue(c.value) || status === 'verified' || status === 'assumed';
-    const isFailing = status === 'disputed' || status === 'rejected';
-    if (!assertsPass && !isFailing) continue; // pending/unknown non-asserting — ignore (as before)
-    seenClaims.add(c.id);
-
-    // finding 1: a pass-asserting claim backed by test_output evidence that did NOT reconcile
-    // (it has test_output evidence but no manifest-matchable execution.label — otherwise it
-    // would be in bucket A) is a not-run divergence. A test_output claim reconciles against the
-    // manifest or it is a divergence — it is NEVER accepted as session-local on self-report.
-    if (assertsPass && claimHasTestOutputEvidence.has(c.id)) {
-      const rawCmd = normalizeCmd(c.fieldOrBehavior || c.value || '');
-      noEvidenceCommand.push({ cmd: rawCmd || `[claim:${c.id}]`, claimId: c.id, claimType: c.claimType, reason: 'test_output-unreconciled' });
-      continue;
-    }
-
-    // A workflow.check.command claim with no captured (labeled) evidence is a never-captured
-    // claimed pass — not-run divergence (anti-gaming teeth preserved).
-    if (assertsPass && c.claimType === 'workflow.check.command' && !claimHasLabeledTestOutput.has(c.id)) {
-      const rawCmd = normalizeCmd(c.fieldOrBehavior || c.value || '');
-      noEvidenceCommand.push({ cmd: rawCmd || `[claim:${c.id}:${c.claimType}]`, claimId: c.id, claimType: c.claimType, reason: 'no-evidence-command' });
-      continue;
-    }
-
-    const waiver = (c.metadata && typeof c.metadata === 'object') ? c.metadata.waiver : undefined;
-    sessionLocal.push({
-      claimId: c.id,
-      claimType: c.claimType,
-      assertedStatus: status,
-      value: c.value,
-      waiver: (waiver && typeof waiver === 'object') ? waiver : null,
-      subject: c.subjectId || c.fieldOrBehavior || c.id,
-      evidenceType: claimEvidenceType.get(c.id) || 'unknown',
-    });
-  }
-
-  return { reconcilable, sessionLocal, noEvidenceCommand, waiverOnCommand };
-}
-
 /**
  * WS8 (finding 3): re-derive every claim's status CI-side from the bundle's OWN
  * evidence/events/policies, using @kontourai/surface's canonical deriveClaimStatus (the same
@@ -522,32 +402,139 @@ const DELIVERY_DIR = 'delivery';
 
 /**
  * Single seam: every delivery/ path resolution in this file routes through here.
- * #335 (per-session delivery paths, e.g. delivery/<session-slug>/<filename> instead of
- * one shared path) is expected to change ONLY this function's body — e.g. glob
- * delivery/<slug-glob>/<filename> and return every match in a defined precedence order,
- * or
- * resolve the current PR's session slug and return its single subpath. discoverBundle()
- * and discoverDeclaredMarker() both iterate whatever candidates this returns and pick the
- * first existing one, so a future per-session layout composes with zero call-site changes.
+ *
+ * #335/#379 (per-session delivery paths) is IMPLEMENTED here now, not deferred: a shared
+ * `delivery/<filename>` guarantees a git merge conflict between ANY two concurrent
+ * deliveries — and a conflicting (DIRTY) PR gets NO `pull_request` workflows scheduled, so
+ * the required Trust Reconcile check silently never runs (field incidents #330/#358/#378).
+ * The fix is per-session paths so concurrent deliveries write to DISTINCT files and never
+ * contend.
+ *
+ * Returned candidate order (precedence, first is highest):
+ *   1. the flat `delivery/<filename>` — kept FIRST for full back-compat. A repo that never
+ *      adopts per-session layout sees byte-identical behavior; an already-committed flat
+ *      bundle from before this change still resolves.
+ *   2. `delivery/<slug>/<filename>` for every immediate subdirectory of `delivery/`, sorted
+ *      by name for determinism.
+ *
+ * Ordering here is ONLY the tie-break / fallback. Which candidate actually reconciles is
+ * decided by COMMIT-OWNERSHIP (discoverBundle() + bundleAttestsThisChange()), not directory
+ * order: among the candidates, the one whose checkpoint attests an ancestor-or-equal commit
+ * of THIS change wins, and stale siblings from other concurrent sessions are ignored.
+ * discoverBundle() and discoverDeclaredMarker() both iterate whatever this returns, so the
+ * per-session layout composes with zero call-site changes.
  */
 function resolveDeliveryCandidates(repoRoot, filename) {
-  return [path.join(repoRoot, DELIVERY_DIR, filename)];
+  const deliveryRoot = path.join(repoRoot, DELIVERY_DIR);
+  const candidates = [path.join(deliveryRoot, filename)];
+  // #379: append delivery/<slug>/<filename> for each immediate subdirectory of delivery/.
+  // readdirSync is best-effort — a missing delivery/ (or an unreadable one) yields just the
+  // flat candidate, never throws.
+  let entries = [];
+  try {
+    entries = fs.readdirSync(deliveryRoot, { withFileTypes: true });
+  } catch {
+    entries = [];
+  }
+  const subdirs = entries
+    .filter((e) => e.isDirectory())
+    .map((e) => e.name)
+    .sort();
+  for (const name of subdirs) {
+    candidates.push(path.join(deliveryRoot, name, filename));
+  }
+  return candidates;
 }
 
 /**
  * Auto-discover the delivery bundle when no explicit path is provided.
- * Checks delivery/trust.bundle, then delivery/trust.checkpoint.json under repo root
- * (via resolveDeliveryCandidates()). Returns null if neither is present — the caller
- * then falls through to delivery/DECLARED marker resolution (ADR 0022 §1); bundle
- * absence is no longer fail-open on its own.
+ *
+ * Gathers every existing candidate — flat `delivery/trust.bundle`, flat
+ * `delivery/trust.checkpoint.json`, and their `delivery/<slug>/…` per-session siblings (via
+ * resolveDeliveryCandidates()) — with trust.bundle preferred over trust.checkpoint.json.
+ *
+ * #379 (per-session, ownership-aware selection): when `changeSha` is known, the candidate
+ * whose checkpoint attests an ancestor-or-equal commit of THIS change wins (same
+ * bundleAttestsThisChange() semantics the flat staleness gate already uses). Stale/older
+ * siblings from OTHER concurrent sessions are ignored.
+ *
+ * PREFER-NEWEST among owning candidates. More than one candidate can legitimately "own" the
+ * change at once: an inherited FLAT bundle's commit_sha can be a real ancestor of HEAD in a
+ * merge-commit repo (it was committed on the trunk's linear history before this branch
+ * point), AND this session's fresh per-session bundle attests a NEWER ancestor (the delivery
+ * commit right before HEAD). "First-fresh-wins" would then select the STALE inherited flat
+ * bundle purely because it sorts first — reconciling last delivery's claims against this
+ * change's CI. So among all owning candidates we pick the one attesting the NEWEST commit
+ * (the descendant-most: the owning candidate whose commit_sha every other owning candidate's
+ * commit_sha is an ancestor of), via the same `git merge-base --is-ancestor` primitive. This
+ * makes an inherited/older owning bundle HARMLESS whether or not it was ever pruned — the
+ * fresh per-session bundle wins on recency, not on being deleted first.
+ *
+ * When no candidate owns this change (or `changeSha` is unknown, e.g. a local run with no
+ * TRUST_RECONCILE_SHA), the first existing candidate is returned so the caller's staleness
+ * gate below handles it exactly as before: a stale bundle is treated as absent, a malformed
+ * one still raises the Step 2 read error.
+ *
+ * Returns null if no candidate exists at all — the caller then falls through to
+ * delivery/DECLARED marker resolution (ADR 0022 §1); bundle absence is not fail-open.
  */
-function discoverBundle(repoRoot) {
+function discoverBundle(repoRoot, changeSha) {
+  const candidates = [];
   for (const filename of ['trust.bundle', 'trust.checkpoint.json']) {
     for (const candidate of resolveDeliveryCandidates(repoRoot, filename)) {
-      if (fs.existsSync(candidate)) return candidate;
+      if (fs.existsSync(candidate)) candidates.push(candidate);
     }
   }
-  return null;
+  if (candidates.length === 0) return null;
+
+  const deliveryRoot = path.join(repoRoot, DELIVERY_DIR);
+  const hasPerSession = candidates.some((c) => path.dirname(c) !== deliveryRoot);
+
+  // Ownership-aware selection (#379). Only meaningful when we know this change's sha; a
+  // candidate that fails to parse is skipped here (never treated as owning) — if it turns
+  // out to be the only candidate, it is still returned below so Step 2's "failed to read
+  // bundle" diagnostic fires unchanged.
+  if (changeSha) {
+    const owning = []; // { candidate, bundleSha } — every candidate that attests this change
+    for (const candidate of candidates) {
+      let json = null;
+      try {
+        json = JSON.parse(fs.readFileSync(candidate, 'utf8'));
+      } catch {
+        json = null;
+      }
+      if (!json) continue;
+      const { fresh, bundleSha } = bundleAttestsThisChange(repoRoot, candidate, json, changeSha);
+      if (fresh) owning.push({ candidate, bundleSha });
+    }
+    if (owning.length > 0) {
+      // Prefer the owning candidate attesting the NEWEST (descendant-most) commit. `best` is
+      // upgraded to a candidate whose commit is a strict descendant of the current best's —
+      // i.e. best.sha is an ancestor of cand.sha. Every owning entry has a non-null bundleSha
+      // (bundleAttestsThisChange returns fresh=false otherwise). Ties / incomparable siblings
+      // keep the earlier (candidate-order) entry, so the flat path still wins a genuine tie.
+      let best = owning[0];
+      for (let i = 1; i < owning.length; i++) {
+        const cand = owning[i];
+        if (cand.bundleSha !== best.bundleSha && isAncestorCommit(repoRoot, best.bundleSha, cand.bundleSha)) {
+          best = cand;
+        }
+      }
+      if (hasPerSession) {
+        process.stdout.write(`[trust-reconcile] #379: selected delivery candidate ${path.relative(repoRoot, best.candidate)} — attests this change ${changeSha} (${candidates.length} candidate(s) present across flat + per-session delivery/<slug>/; ${owning.length} owning, newest wins; older/stale ignored)\n`);
+      }
+      return best.candidate;
+    }
+    // No candidate attests this change. When per-session candidates were in play, emit a
+    // loud, grep-stable concurrency hint (#379) so the next agent can tell a concurrent
+    // per-session collision apart from a plain stale/absent bundle — the per-candidate
+    // stale line still prints in runTrustReconcile's staleness gate for the returned one.
+    if (hasPerSession) {
+      const rels = candidates.map((c) => path.relative(repoRoot, c)).join(', ');
+      process.stdout.write(`[trust-reconcile] #379: examined ${candidates.length} delivery candidate(s) (flat + per-session delivery/<slug>/); none attests this change ${changeSha}. If this is a concurrent-delivery collision, the OWNING session's bundle is not on this ref — re-publish this session's delivery, or check whether main moved under the PR. Candidates: ${rels}\n`);
+    }
+  }
+  return candidates[0];
 }
 
 /**
@@ -813,22 +800,30 @@ function resolveDeclaredExemption(repoRoot, ctx) {
  * src/cli/workflow-sidecar.ts). trust.bundle itself carries NO commit/branch metadata
  * (schemaVersion 5: {schemaVersion, source, claims, evidence, policies, events} — confirmed
  * by inspection), so when the discovered bundle IS trust.bundle, this falls through to its
- * sibling delivery/trust.checkpoint.json (same resolveDeliveryCandidates() seam) for the
- * binding — publishDelivery() always copies both together.
+ * SIBLING trust.checkpoint.json for the binding — publishDelivery() always writes both
+ * together into the SAME directory.
+ *
+ * #379: the sibling is resolved from the bundle's OWN directory (path.dirname(bundlePath)),
+ * not from a global resolveDeliveryCandidates() scan. In the per-session layout each session
+ * gets its own delivery/<slug>/ dir, and a global scan would cross-contaminate — pairing a
+ * per-session trust.bundle with the FLAT (or a different session's) trust.checkpoint.json and
+ * reading the wrong commit binding. Same-directory resolution is identical to the prior
+ * behavior for the flat layout (delivery/trust.bundle ↔ delivery/trust.checkpoint.json) and
+ * correct for per-session.
  */
 function extractBundleCommitSha(repoRoot, bundlePath, bundleJson) {
   if (bundleJson && typeof bundleJson.commit_sha === 'string' && bundleJson.commit_sha.trim()) {
     return bundleJson.commit_sha.trim();
   }
-  for (const candidate of resolveDeliveryCandidates(repoRoot, 'trust.checkpoint.json')) {
-    if (candidate === bundlePath || !fs.existsSync(candidate)) continue;
+  const siblingCheckpoint = path.join(path.dirname(bundlePath), 'trust.checkpoint.json');
+  if (siblingCheckpoint !== bundlePath && fs.existsSync(siblingCheckpoint)) {
     try {
-      const checkpoint = JSON.parse(fs.readFileSync(candidate, 'utf8'));
+      const checkpoint = JSON.parse(fs.readFileSync(siblingCheckpoint, 'utf8'));
       if (checkpoint && typeof checkpoint.commit_sha === 'string' && checkpoint.commit_sha.trim()) {
         return checkpoint.commit_sha.trim();
       }
     } catch {
-      // Malformed sibling checkpoint — no usable binding from it; keep looking / fall through.
+      // Malformed sibling checkpoint — no usable binding from it; fall through to null.
     }
   }
   return null;
@@ -907,14 +902,17 @@ function runTrustReconcile({ bundle = null, commands = [], repoRoot = null, mani
   // (.github/workflows/trust-reconcile.yml) never passes --bundle; it always relies on
   // auto-discovery, which is exactly the path PR #278's stale-bundle incident went through.
   const explicitBundlePath = bundle || process.env.TRUST_RECONCILE_BUNDLE || null;
-  let bundlePath = explicitBundlePath || discoverBundle(resolvedRepoRoot) || null;
-  const bundleWasAutoDiscovered = !explicitBundlePath && !!bundlePath;
 
-  // Scope-matching context (ref/actor/sha) — resolved once, reused by both the
-  // bundle-ownership staleness check below and the delivery/DECLARED exemption path
-  // further down (bundle-absent branch).
+  // Scope-matching context (ref/actor/sha) — resolved once, reused by ownership-aware
+  // auto-discovery (#379, immediately below), the bundle-ownership staleness check further
+  // down (ADR 0022 addendum §2), and the delivery/DECLARED exemption path (bundle-absent
+  // branch). Resolved BEFORE auto-discovery because discoverBundle() now uses scopeCtx.sha
+  // to pick, among per-session candidates, the one that attests THIS change.
   const scopeCtx = resolveScopeContext(resolvedRepoRoot);
 
+  let bundlePath = explicitBundlePath || discoverBundle(resolvedRepoRoot, scopeCtx.sha) || null;
+  const bundleWasAutoDiscovered = !explicitBundlePath && !!bundlePath;
+
   // Event-scoped enforcement (ADR 0022 addendum, part 4): bundle-required enforcement
   // (and the staleness-gate consequence of it, immediately below) applies ONLY when this
   // run is gating a proposed change. A push run on main happens AFTER the gating PR run
@@ -1106,50 +1104,24 @@ function runTrustReconcile({ bundle = null, commands = [], repoRoot = null, mani
       }
 
       // finding 4 (server-side): a command-backed (test_output-evidence) claim carrying a
-      // waiver is a divergence — a command-backed check reconciles against CI or fails; it
-      // cannot be waived away.
-      for (const { claimId, claimType, subject } of waiverOnCommand) {
-        issues.push({
-          type: 'waiver-on-command-check',
-          message: `trust divergence: claim '${claimId}' (${subject}, claimType: ${claimType}) carries a waiver but is backed by test_output evidence — a command-backed check reconciles against CI or fails and cannot be waived`,
-        });
-      }
+      // waiver is a divergence — shape-only, delegated to scripts/lib/reconcile-shape.js
+      // (used byte-identically here and by the local reconcile-preflight).
+      issues.push(...waiverOnCommandIssues(waiverOnCommand));
 
       // not-run divergences: never-captured command claims (no evidence) AND test_output
-      // claims that did not reconcile (no manifest-matchable execution.label).
-      for (const { cmd, claimId, claimType, reason } of noEvidenceCommand) {
-        const message = reason === 'test_output-unreconciled'
-          ? `trust divergence: claim '${claimId}' (claimType: ${claimType}) asserts pass with test_output evidence but has no manifest-matched execution.label — a test_output claim must reconcile against the manifest or it is a divergence (never accepted as session-local)`
-          : `trust divergence: claim '${claimId}' (claimType: ${claimType}) asserts pass but has no supporting evidence item — command never captured`;
-        issues.push({ type: 'not-run', cmd, message });
-      }
-
-      // Reconcilable test_output claims: laundering → manifest match → CI fresh result.
-      for (const { cmd } of reconcilable) {
+      // claims that did not reconcile (no manifest-matchable execution.label). Shape-only,
+      // delegated to scripts/lib/reconcile-shape.js.
+      issues.push(...noEvidenceCommandIssues(noEvidenceCommand));
+
+      // Reconcilable test_output claims: laundering → manifest match (shape-only, delegated
+      // to scripts/lib/reconcile-shape.js) → CI fresh result (CI-only, stays here — requires
+      // a live command execution the local preflight must not perform).
+      const { issues: manifestIssues, unresolved: reconcilableUnresolved } =
+        reconcilableManifestIssues(reconcilable, manifestByCmd);
+      issues.push(...manifestIssues);
+      for (const { cmd, manifestEntry: entry } of reconcilableUnresolved) {
         const normalCmd = normalizeCmd(cmd);
 
-        // (a) Laundering operator check — must come first (most specific signal).
-        if (hasLaunderingOperator(cmd)) {
-          issues.push({
-            type: 'laundering',
-            cmd,
-            message: `trust divergence: agent claimed '${cmd}' passed; command contains exit-code-laundering operator (|| ... / ; true / ; exit 0 / etc.)`,
-          });
-          continue;
-        }
-
-        // A test_output claim MUST name a manifest (required-lane) command. An agent
-        // cannot self-label an arbitrary command test_output to dodge the manifest.
-        const entry = manifestByCmd.get(normalCmd);
-        if (!entry) {
-          issues.push({
-            type: 'not-run',
-            cmd,
-            message: `trust divergence: agent claimed '${cmd}' passed; command is not in the reconcile manifest — a test_output claim must name a manifest/required-lane command (CI cannot self-declare an arbitrary command)`,
-          });
-          continue;
-        }
-
         // Prefer the fresh-verify Step 1 result; otherwise re-run this (manifest, and
         // therefore required-lane) command fresh now. Only manifest commands are ever
         // run on demand, so the set is bounded by the registry.
@@ -1185,90 +1157,26 @@ function runTrustReconcile({ bundle = null, commands = [], repoRoot = null, mani
         process.stdout.write(`[trust-reconcile]   RECONCILED: '${cmd}' (manifest id: ${entry.id}) — claimed pass, CI fresh run = PASS\n`);
       }
 
-      // Session-local claims: not CI-reconcilable, but NOT a pass bypass. Each must either
-      // (a) carry a loud, justified waiver, or (b) resolve a real CI-RE-DERIVED `verified`
-      // status. WS8 iteration-2 hardening:
-      //   - finding 3: the status used here is RE-DERIVED CI-side, never the self-reported
-      //     claim.status. A mismatch is a `status-misassertion` divergence. If re-derivation
-      //     is unavailable we fail closed (`status-underivable`) — we never fall back to
-      //     trusting the bundle's own status.
-      //   - finding 2: `assumed` alone is NO LONGER a silent pass. `assumed` is acceptable
-      //     ONLY with a waiver (printed as a loud WAIVED line). An unwaived `assumed` claim is
-      //     an `unwaived-assumed` divergence (restores pre-WS8 semantics where `assumed` alone
-      //     never satisfied assertsPass).
-      //
-      // WS8 iteration-4 (converged iteration-3 finding, both gates): a session-local claim
-      // that re-derives `verified` with NO waiver is, by definition, backed only by
-      // human_attestation/attestation/external/etc. evidence with no --command — i.e.
-      // `deriveClaimStatus` only proves the bundle is internally self-consistent, never that
-      // the underlying attestation is true. A fully fabricated bundle (fake claim + fake
-      // evidence + fake event, all hand-authored to agree) is INDISTINGUISHABLE from a real
-      // one at this layer. This was previously printed as a quiet `SESSION-LOCAL OK` line
-      // indistinguishable from a genuinely reconciled check. It is now always printed as a
-      // loud, distinct `ATTESTED (not independently verifiable at L0)` marker — see ADR 0020
-      // Residuals. This does NOT change the exit code (attestations are not blocked at L0;
-      // blocking every honest human-attestation use is not the fix) — it is a visibility-only
-      // change so a reviewer/downstream tool can grep for and count exactly how many claims in
-      // a passing bundle rest on bundle-internal consistency alone rather than independent
-      // (CI fresh-run or cryptographically-signed) verification.
-      let attestedCount = 0;
-      for (const { claimId, claimType, assertedStatus, waiver, subject, evidenceType } of sessionLocal) {
-        // finding 3: re-derive; never trust the asserted status.
-        let status;
-        if (!derivedStatus) {
-          issues.push({
-            type: 'status-underivable',
-            message: `trust divergence: session-local claim '${claimId}' (claimType: ${claimType}) asserts status '${assertedStatus || 'unknown'}' but CI-side re-derivation is unavailable — refusing to trust a self-reported status (fail-closed)`,
-          });
-          continue;
-        }
-        const derived = derivedStatus.get(claimId);
-        if (derived === undefined || derived === null) {
-          issues.push({
-            type: 'status-underivable',
-            message: `trust divergence: session-local claim '${claimId}' (claimType: ${claimType}) could not be re-derived CI-side from the bundle's own evidence/events/policies — refusing to trust its self-reported status '${assertedStatus || 'unknown'}' (fail-closed)`,
-          });
-          continue;
-        }
-        if (derived !== assertedStatus) {
-          issues.push({
-            type: 'status-misassertion',
-            message: `trust divergence: session-local claim '${claimId}' (claimType: ${claimType}) asserts status '${assertedStatus || 'unknown'}' but CI re-derivation from the bundle's own evidence/events/policies yields '${derived}' — the reconciler does not trust self-reported claim.status`,
-          });
-          continue;
-        }
-        status = derived;
-
-        if (status === 'disputed' || status === 'rejected') {
-          issues.push({
-            type: 'session-local-failed',
-            message: `trust divergence: session-local claim '${claimId}' (claimType: ${claimType}) has re-derived status '${status}' — a failing/rejected claim blocks (session-local classification is not a pass bypass)`,
-          });
-          continue;
-        }
-        // finding 2: a waiver is the ONLY way an `assumed` (or otherwise non-`verified`)
-        // session-local claim passes, and it is printed loudly. `verified` still passes on its
-        // own re-derived status.
-        if (waiver && waiver.reason && waiver.approved_by) {
+      // Session-local claims: not CI-reconcilable, but NOT a pass bypass. Shape-only,
+      // delegated to scripts/lib/reconcile-shape.js (sessionLocalShapeIssues) — see that
+      // module for the full WS8 finding-2/finding-3/iteration-4 rationale (waiver-only pass
+      // for non-`verified` status, CI-re-derived status never self-reported, loud ATTESTED
+      // marker for bundle-internal-only consistency). iteration-1 F1: CI MUST pass
+      // `onUnderivable: 'fail'` explicitly — this is CI's trust anchor and must never silently
+      // degrade to trusting a self-reported status when re-derivation is unavailable (that
+      // reduced-coverage mode is opt-in only, for the LOCAL preflight — see reconcile-shape.js).
+      // iteration-1 F3: the WAIVED/ATTESTED log lines below are driven by the shared function's
+      // own `logEvents` classification (not a parallel re-derivation) so CI's stdout narrative
+      // can never drift from what sessionLocalShapeIssues actually decided.
+      const { issues: sessionLocalIssues, attestedCount, logEvents } =
+        sessionLocalShapeIssues(sessionLocal, derivedStatus, { onUnderivable: 'fail' });
+      issues.push(...sessionLocalIssues);
+      for (const { kind, claimId, claimType, subject, evidenceType, status, waiver } of logEvents) {
+        if (kind === 'waived') {
           process.stdout.write(`[trust-reconcile] WAIVED: ${subject} (${claimType}) status=${status} — ${waiver.reason} (approved by ${waiver.approved_by})\n`);
-          continue;
-        }
-        if (status === 'verified') {
-          attestedCount++;
+        } else if (kind === 'attested') {
           process.stdout.write(`[trust-reconcile] ATTESTED (not independently verifiable at L0): '${claimId}' (${claimType}) evidenceType=${evidenceType} — accepted on bundle-internal consistency only; see ADR 0020 Residuals\n`);
-          continue;
         }
-        if (status === 'assumed') {
-          issues.push({
-            type: 'unwaived-assumed',
-            message: `trust divergence: session-local claim '${claimId}' (claimType: ${claimType}) has re-derived status 'assumed' but carries no waiver — 'assumed' alone is not a pass; it requires a documented waiver (--accepted-gap-reason/--waived-by) to be accepted`,
-          });
-          continue;
-        }
-        issues.push({
-          type: 'unwaived-session-local',
-          message: `trust divergence: session-local claim '${claimId}' (claimType: ${claimType}) asserts pass with re-derived status '${status || 'unknown'}' but has no waiver and no CI-re-derived verified status`,
-        });
       }
 
       // WS8 iteration-4: always emit the summary count, even when zero, so a passing bundle
@@ -1378,6 +1286,41 @@ function main() {
 // The direct-CLI behavior is preserved: when run as a script, main() is called below.
 module.exports.runTrustReconcile = runTrustReconcile;
 
+// #356: manifest-resolution helpers exported for reuse by the local reconcile-preflight
+// (Wave 2) so it resolves the manifest via the EXACT SAME priority chain this CI reconciler
+// uses (CLI --manifest > TRUST_RECONCILE_MANIFEST > package.json > run-baseline.sh
+// --manifest-json > legacy fresh-verify-commands fallback) — never a second implementation.
+// These stay defined here (not moved to scripts/lib/reconcile-shape.js) because they are
+// CI-adjacent resolution logic (they may spawn `evals/ci/run-baseline.sh --manifest-json`,
+// a cheap static-registry emit, not a fresh test run) rather than pure bundle-shape
+// classification.
+module.exports.resolveManifest = resolveManifest;
+module.exports.runBaselineManifest = runBaselineManifest;
+module.exports.normalizeManifestEntries = normalizeManifestEntries;
+module.exports.slugifyLabel = slugifyLabel;
+module.exports.normalizeCmd = normalizeCmd;
+module.exports.isAncestorCommit = isAncestorCommit;
+// #356: resolveManifest's legacy fallback tier (tier 5, "legacy:fresh-verify-commands")
+// folds the CANONICAL verify commands into the manifest when no dedicated manifest source
+// resolves. Exporting resolveCanonicalCommands too so the local preflight's manifest
+// resolution has genuine parity with CI on that fallback tier as well — otherwise a repo (or
+// a fixture/test repo) with no run-baseline.sh/package.json manifest source would silently
+// resolve an EMPTY legacy-fallback manifest locally while CI's own resolution (which always
+// threads its own resolved canonicalCommands into this same fallback) resolves a non-empty
+// one, a real parity gap, not merely a fixture quirk.
+module.exports.resolveCanonicalCommands = resolveCanonicalCommands;
+
+// #356: re-export the shared bundle-shape classification/issue-construction functions
+// (primary home: scripts/lib/reconcile-shape.js) so a caller that already requires
+// trust-reconcile.js (e.g. an existing test harness) can reach them without also needing
+// to know the shared module's path. This is a re-export, not a second implementation —
+// the single definition lives in scripts/lib/reconcile-shape.js.
+module.exports.classifyBundleClaims = classifyBundleClaims;
+module.exports.waiverOnCommandIssues = waiverOnCommandIssues;
+module.exports.noEvidenceCommandIssues = noEvidenceCommandIssues;
+module.exports.reconcilableManifestIssues = reconcilableManifestIssues;
+module.exports.sessionLocalShapeIssues = sessionLocalShapeIssues;
+
 if (require.main === module) {
   main();
 }

package/scripts/hooks/config-protection.js

@@ -180,7 +180,9 @@ function checkProtectedPathPattern(filePath) {
   // copy a forged bundle here to corrupt the CI trust check.
   // SAFE: publishDelivery writes via fs.copyFileSync (not Write/Edit tool).
   // RESIDUAL: runtime-constructed paths and fs writes are unaffected.
-  if (/(?:^|\/)delivery\/trust\.bundle$/.test(norm)) {
+  // #379: the optional (?:[^/]+\/)? segment also covers the per-session path
+  // delivery/<slug>/trust.bundle — the forgery surface moved with the write path.
+  if (/(?:^|\/)delivery\/(?:[^/]+\/)?trust\.bundle$/.test(norm)) {
     return {
       name: "delivery/trust.bundle",
       reason: "an agent could write a forged bundle to corrupt the CI trust-reconcile anchor",
@@ -189,7 +191,8 @@ function checkProtectedPathPattern(filePath) {
 
   // delivery/trust.checkpoint.json -- the signed checkpoint companion.
   // SAFE: publishDelivery writes via fs.copyFileSync, NOT via Write/Edit tool.
-  if (/(?:^|\/)delivery\/trust\.checkpoint\.json$/.test(norm)) {
+  // #379: optional (?:[^/]+\/)? segment also covers delivery/<slug>/trust.checkpoint.json.
+  if (/(?:^|\/)delivery\/(?:[^/]+\/)?trust\.checkpoint\.json$/.test(norm)) {
     return {
       name: "delivery/trust.checkpoint.json",
       reason: "an agent could forge a signed delivery by writing a tampered checkpoint",
@@ -421,7 +424,9 @@ function checkCommandForBypass(command) {
  * .kontourai/flow-agents/<slug>/trust.bundle, and deprecated runtime-shaped
  * .flow-agents equivalents.
  */
-const REDIRECT_PROTECTED_RE = /(?:^|\/|~\/)(\.bash_profile|\.bashrc|\.profile|\.zprofile|\.zshrc)$|(?:^|\/)\.claude\/settings(?:\.local)?\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/current\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/current\/[^/]+\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/\.goal-fit-block-streak\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/[^/]+\/state\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/[^/]+\/trust\.bundle$|(?:^|\/)delivery\/trust\.bundle$|(?:^|\/)delivery\/trust\.checkpoint\.json$/;
+// #379: the delivery/ arms carry an optional (?:[^/]+\/)? segment so redirects/tee to the
+// per-session path delivery/<slug>/trust.bundle (+ checkpoint) are caught, not just the flat path.
+const REDIRECT_PROTECTED_RE = /(?:^|\/|~\/)(\.bash_profile|\.bashrc|\.profile|\.zprofile|\.zshrc)$|(?:^|\/)\.claude\/settings(?:\.local)?\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/current\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/current\/[^/]+\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/\.goal-fit-block-streak\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/[^/]+\/state\.json$|(?:^|\/)(?:\.kontourai\/flow-agents|\.flow-agents)\/[^/]+\/trust\.bundle$|(?:^|\/)delivery\/(?:[^/]+\/)?trust\.bundle$|(?:^|\/)delivery\/(?:[^/]+\/)?trust\.checkpoint\.json$/;
 
 /**
  * Return true when a token (an unquoted redirect target or tee argument) matches
@@ -569,8 +574,10 @@ function checkInterpreterWriteToProtected(command) {
  * Delivery-protected path regex: delivery/trust.bundle and delivery/trust.checkpoint.json.
  * These are the CI anchor files whose contents must not be agent-forged.
  * Used by checkCopyMoveToProtected to catch `cp x delivery/trust.bundle`.
+ * #379: the optional (?:[^/]+\/)? segment also catches the per-session path
+ * `cp forged.json delivery/<slug>/trust.bundle`.
  */
-const DELIVERY_COPY_PROTECTED_RE = /(?:^|\/)delivery\/trust\.bundle$|(?:^|\/)delivery\/trust\.checkpoint\.json$/;
+const DELIVERY_COPY_PROTECTED_RE = /(?:^|\/)delivery\/(?:[^/]+\/)?trust\.bundle$|(?:^|\/)delivery\/(?:[^/]+\/)?trust\.checkpoint\.json$/;
 
 /**
  * Return true when a normalized token matches a delivery-protected path.