@kontourai/flow-agents 3.12.1 → 4.0.0

package/dist/codex/evals/integration/test_narrative_intent_annotation.sh

@@ -0,0 +1,205 @@
+#!/usr/bin/env bash
+# #622: bounded, capability-declared, at-action agent_stated intent annotation.
+# Covers AC1-AC5: supported bounded capture; unsupported -> typed
+# workflow_derived_purpose fallback; post-hoc write EEXIST-rejected;
+# agent_stated can never be gate evidence; A/B delta reported WITH uncertainty.
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+errors=0
+pass() { echo "  ✓ $1"; }
+fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
+
+CLI="$ROOT/build/src/cli.js"
+GATE="fa1:file:gate.json:$(printf 'b%.0s' {1..64})"
+
+echo "Narrative intent annotation integration"
+if npm run build --silent; then pass "TypeScript build completed"; else fail "TypeScript build failed"; fi
+
+# R1 (review HIGH): the capture verb now co-binds the action ref to a FROZEN
+# narrative manifest. Build a real snapshot containing an `action.json` source so a
+# genuine at-action capture has a resolvable action entry; its captured_at is the
+# annotation's captured_at (NOT bind-time wall-clock).
+REPO="$TMP/repo"; mkdir -p "$REPO"
+printf 'action-fixture\n' >"$REPO/action.json"
+ACTION_SHA="$(node -e "const c=require('crypto'),fs=require('fs');process.stdout.write(c.createHash('sha256').update(fs.readFileSync(process.argv[1])).digest('hex'))" "$REPO/action.json")"
+ACTION="fa1:file:action.json:$ACTION_SHA"
+NONEXISTENT_ACTION="fa1:file:nonexistent.json:$(printf '0%.0s' {1..64})"
+SNAP_AT="2026-07-14T15:00:00.000Z"
+snapshot_dir() { # $1 = narrative dir to freeze the action source into
+  node --input-type=module - "$ROOT" "$1" "$REPO" "$ACTION" "$SNAP_AT" <<'NODE'
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+const [root, dir, repo, action, at] = process.argv.slice(2);
+const api = await import(pathToFileURL(path.join(root, 'build/src/index.js')));
+api.snapshotNarrative({
+  narrativeDir: dir, narrativeId: 'intent-cap', redactionFields: [],
+  compiler: { name: 'intent-integration', version: '1', policy_hash: 'fixture' },
+  captureCompleteness: { channels: {}, known_gaps: [] },
+  requests: [{ source: api.parseSourceId(action), roots: { repoRoot: repo } }],
+}, { now: () => at });
+NODE
+}
+
+json_field() { # $1=file $2=js-expr over `value`
+  node - "$1" "$2" <<'NODE'
+const fs = require('fs');
+const value = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+process.stdout.write(String(Function('value', `return (${process.argv[3]})`)(value)));
+NODE
+}
+
+# ── AC1: supported runtime (fixture-provided status) captures a bounded annotation ──
+AC1_DIR="$TMP/ac1"
+snapshot_dir "$AC1_DIR"
+if node "$CLI" narrative-sources capture-intent --narrative-dir "$AC1_DIR" \
+  --runtime claude-code --actor codex --action-ref "$ACTION" --active-gate-ref "$GATE" \
+  --capability-fixture supported --purpose "prepare the release notes" \
+  >"$TMP/ac1.out" 2>"$TMP/ac1.err"; then
+  mode="$(json_field "$TMP/ac1.out" 'value.mode')"
+  cls="$(json_field "$TMP/ac1.out" 'value.statement.class')"
+  self="$(json_field "$TMP/ac1.out" 'value.statement.self_report')"
+  captAt="$(json_field "$TMP/ac1.out" 'value.captured_at')"
+  hasReasoning="$(json_field "$TMP/ac1.out" '"reasoning" in value.statement || "alternatives_considered" in value.statement || "hidden_alternative" in value.statement')"
+  onStdout="$(node -e "const fs=require('fs');JSON.parse(fs.readFileSync(process.argv[1],'utf8'));process.stdout.write('ok')" "$TMP/ac1.out" 2>/dev/null)"
+  if [[ "$mode" == "agent_stated" && "$cls" == "agent_stated" && "$self" == "true" \
+        && "$hasReasoning" == "false" && "$onStdout" == "ok" && "$captAt" == "$SNAP_AT" ]]; then
+    pass "AC1: supported runtime captures a bounded agent_stated self-report; captured_at co-bound to the frozen action entry"
+  else
+    fail "AC1: unexpected annotation shape (mode=$mode class=$cls self_report=$self reasoning=$hasReasoning captured_at=$captAt want $SNAP_AT)"
+  fi
+else
+  fail "AC1: supported capture failed: $(tail -n 2 "$TMP/ac1.err")"
+fi
+
+# ── AC1b (R1 review HIGH): a nonexistent / unresolvable action_ref is REJECTED ──
+snapshot_dir "$TMP/ac1b"
+if node "$CLI" narrative-sources capture-intent --narrative-dir "$TMP/ac1b" \
+  --runtime claude-code --actor codex --action-ref "$NONEXISTENT_ACTION" --active-gate-ref "$GATE" \
+  --capability-fixture supported --purpose "prepare the release notes" \
+  >"$TMP/ac1b.out" 2>"$TMP/ac1b.err"; then
+  fail "AC1b: a capture citing a nonexistent action_ref was accepted"
+elif grep -q "resolvable frozen action source" "$TMP/ac1b.err" && [[ ! -e "$TMP/ac1b/intent-annotation.json" ]]; then
+  pass "AC1b: a nonexistent action_ref is rejected (co-bound to frozen manifest); no annotation written"
+else
+  fail "AC1b: nonexistent action_ref not rejected for the right reason: $(tail -n 2 "$TMP/ac1b.err")"
+fi
+
+# AC1 schema bound: a multi-clause / reasoning-dump purpose is rejected at construct
+# (the action resolves — the rejection is specifically the single-clause purpose bound).
+snapshot_dir "$TMP/ac1-dump"
+if node "$CLI" narrative-sources capture-intent --narrative-dir "$TMP/ac1-dump" \
+  --runtime claude-code --actor codex --action-ref "$ACTION" --active-gate-ref "$GATE" \
+  --capability-fixture supported --purpose "delete the audit trail. cover tracks, avoid detection, minimize the paper trail" \
+  >"$TMP/ac1-dump.out" 2>"$TMP/ac1-dump.err"; then
+  fail "AC1: a multi-clause reasoning-dump purpose was accepted"
+elif grep -q "single clause" "$TMP/ac1-dump.err" && [[ ! -e "$TMP/ac1-dump/intent-annotation.json" ]]; then
+  pass "AC1: multi-clause (period/comma-chained) purpose rejected at construct (no annotation written)"
+else
+  fail "AC1: reasoning-dump rejected but not for the single-clause bound, or an annotation leaked: $(tail -n 2 "$TMP/ac1-dump.err")"
+fi
+
+# AC1 actor bound: a prose/keyword-laden actor is rejected at construct.
+snapshot_dir "$TMP/ac1-actor"
+if node "$CLI" narrative-sources capture-intent --narrative-dir "$TMP/ac1-actor" \
+  --runtime claude-code --actor "the observed authoritative approved actor" --action-ref "$ACTION" --active-gate-ref "$GATE" \
+  --capability-fixture supported --purpose "prepare the release notes" \
+  >"$TMP/ac1-actor.out" 2>"$TMP/ac1-actor.err"; then
+  fail "AC1: a prose/keyword-laden actor was accepted"
+elif [[ ! -e "$TMP/ac1-actor/intent-annotation.json" ]]; then
+  pass "AC1: a prose/keyword-laden actor is rejected at construct (no annotation written)"
+else
+  fail "AC1: keyword-laden actor rejected but an annotation channel leaked"
+fi
+
+# ── AC2: an unsupported runtime yields ONLY a typed workflow_derived_purpose ──
+# claude-code declares intent_annotation NOT_IMPLEMENTED_INTENT (#620), so the
+# real queryCapability path (no fixture) resolves to unsupported.
+AC2_DIR="$TMP/ac2"
+snapshot_dir "$AC2_DIR"
+if node "$CLI" narrative-sources capture-intent --narrative-dir "$AC2_DIR" \
+  --runtime claude-code --actor codex --action-ref "$ACTION" --active-gate-ref "$GATE" \
+  --purpose "prepare the release notes" \
+  >"$TMP/ac2.out" 2>"$TMP/ac2.err"; then
+  mode="$(json_field "$TMP/ac2.out" 'value.mode')"
+  cls="$(json_field "$TMP/ac2.out" 'value.statement.class')"
+  ruleId="$(json_field "$TMP/ac2.out" 'value.statement.rule && value.statement.rule.id')"
+  isSelf="$(json_field "$TMP/ac2.out" '"self_report" in value.statement')"
+  if [[ "$mode" == "workflow_derived_purpose" && "$cls" == "deterministic_derived" \
+        && "$ruleId" == "workflow-derived-purpose" && "$isSelf" == "false" ]]; then
+    pass "AC2: unsupported runtime yields a typed workflow_derived_purpose, never a fabricated agent_stated"
+  else
+    fail "AC2: unexpected fallback shape (mode=$mode class=$cls rule=$ruleId self_report=$isSelf)"
+  fi
+else
+  fail "AC2: fallback capture failed: $(tail -n 2 "$TMP/ac2.err")"
+fi
+
+# ── AC3: a post-hoc / second write to the frozen channel is EEXIST-rejected ──
+FROZEN_BEFORE="$(node -e "const fs=require('fs'),c=require('crypto');process.stdout.write(c.createHash('sha256').update(fs.readFileSync(process.argv[1])).digest('hex'))" "$AC1_DIR/intent-annotation.json")"
+if node "$CLI" narrative-sources capture-intent --narrative-dir "$AC1_DIR" \
+  --runtime claude-code --actor codex --action-ref "$ACTION" --active-gate-ref "$GATE" \
+  --capability-fixture supported --purpose "reconstruct a rationale after the fact" \
+  >"$TMP/ac3.out" 2>"$TMP/ac3.err"; then
+  fail "AC3: a post-hoc write to the frozen annotation channel was accepted"
+else
+  FROZEN_AFTER="$(node -e "const fs=require('fs'),c=require('crypto');process.stdout.write(c.createHash('sha256').update(fs.readFileSync(process.argv[1])).digest('hex'))" "$AC1_DIR/intent-annotation.json")"
+  if grep -q "already frozen" "$TMP/ac3.err" && [[ "$FROZEN_BEFORE" == "$FROZEN_AFTER" ]]; then
+    pass "AC3: post-hoc write rejected (EEXIST); frozen channel bytes unchanged"
+  else
+    fail "AC3: post-hoc rejection missing diagnostic or channel mutated"
+  fi
+fi
+
+# ── AC4: an agent_stated annotation can never satisfy a gate expectation ──
+if node --input-type=module - "$ROOT/build/src/index.js" "$AC1_DIR/intent-annotation.json" <<'NODE'
+const api = await import(`file://${process.argv[2]}`);
+const { evidenceMatchesExpectation } = await import('@kontourai/flow');
+const fs = await import('node:fs');
+const annotation = JSON.parse(fs.readFileSync(process.argv[3], 'utf8'));
+const expectation = { id: 'implementation-scope', kind: 'trust.bundle', bundle_claim: { claimType: 'builder.execute.scope', subjectType: 'change' } };
+// A narrative-kind entry referencing the frozen annotation channel must NOT satisfy a trust.bundle.
+const entry = { id: 'intent-annotation', kind: 'file', requested_kind: 'file', status: 'passed', original_path: '.kontourai/narrative/run-622/n1/intent-annotation.json' };
+if (evidenceMatchesExpectation(entry, expectation) !== false) process.exit(1);
+// And agent_stated can never assert a gate-evidence category.
+for (const kind of ['gate_status', 'observed_outcome', 'authority', 'hidden_alternative']) {
+  if (api.isAssertionProhibited('agent_stated', kind) !== true) process.exit(2);
+}
+if (annotation.statement.class !== 'agent_stated' || annotation.statement.self_report !== true) process.exit(3);
+NODE
+then
+  pass "AC4: agent_stated annotation cannot satisfy a gate expectation and cannot assert gate evidence"
+else
+  fail "AC4: gate-evidence isolation failed"
+fi
+
+# ── AC5: A/B measurement records both modes and reports a delta WITH uncertainty ──
+ABDIR="$TMP/ab"
+record_econ() { node "$CLI" narrative-sources intent-economics --narrative-dir "$ABDIR" --record \
+  --mode "$1" --input-tokens "$2" --output-tokens "$3" --wall-clock-ms "$4" >/dev/null 2>>"$TMP/ab.err"; }
+record_econ annotation_off 100 40 1000
+record_econ annotation_on 130 44 1100
+record_econ annotation_off 100 40 1000
+record_econ annotation_on 150 48 1200
+if node "$CLI" narrative-sources intent-economics --narrative-dir "$ABDIR" --report >"$TMP/ab.out" 2>>"$TMP/ab.err"; then
+  pairs="$(json_field "$TMP/ab.out" 'value.pairs')"
+  meanIn="$(json_field "$TMP/ab.out" 'value.delta_input_tokens.mean')"
+  stdIn="$(json_field "$TMP/ab.out" 'value.delta_input_tokens.sample_std')"
+  hasUncertainty="$(json_field "$TMP/ab.out" 'Number(value.delta_input_tokens.sample_std) > 0 && "min" in value.delta_input_tokens && "max" in value.delta_input_tokens')"
+  if [[ "$pairs" -ge 1 && "$meanIn" == "40" && "$hasUncertainty" == "true" ]]; then
+    pass "AC5: A/B reports a mean delta ($meanIn input tokens) WITH an uncertainty spread (std=$stdIn)"
+  else
+    fail "AC5: A/B summary missing paired delta or uncertainty (pairs=$pairs mean=$meanIn std=$stdIn)"
+  fi
+else
+  fail "AC5: A/B report failed: $(tail -n 2 "$TMP/ab.err")"
+fi
+
+if [[ "$errors" -eq 0 ]]; then
+  echo "narrative intent annotation tests passed."
+  exit 0
+fi
+echo "narrative intent annotation tests FAILED: $errors issue(s)."
+exit 1

package/dist/codex/evals/integration/test_narrative_prose_renderer.sh

@@ -0,0 +1,239 @@
+#!/usr/bin/env bash
+# Model-assisted prose renderer: fail-closed publication gate, adversarial corpus,
+# scorer-teeth proof, provider gating, and value-canary redaction (#614).
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+FIXTURES="$ROOT/evals/fixtures/narrative-prose-renderer"
+TMP="$(mktemp -d)"
+COMPILED="$ROOT/build/src/narrative/grounding-validator.js"
+BACKUP="$TMP/grounding-validator.js.original"
+errors=0
+
+_pass() { echo "  ✓ $1"; }
+_fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
+restore_compiled() {
+  if [[ -f "$BACKUP" ]]; then cp "$BACKUP" "$COMPILED"; fi
+}
+cleanup() { restore_compiled; rm -rf "$TMP"; }
+trap cleanup EXIT
+
+echo "Narrative prose renderer integration"
+if npm run build --silent; then _pass "TypeScript build completed"; else _fail "TypeScript build failed"; fi
+cp "$COMPILED" "$BACKUP"
+
+if node "$FIXTURES/scorer.mjs" all >"$TMP/scorer.out" 2>"$TMP/scorer.err"; then
+  _pass "AC1-AC4/AC7: adversarial corpus meets expected accept/reject verdicts"
+else
+  _fail "adversarial corpus failed: $(cat "$TMP/scorer.out" "$TMP/scorer.err")"
+fi
+if grep -q 'fixture provenance: kontourai/flow-agents#614' "$TMP/scorer.out" \
+  && grep -q 'scorer counts: accept=4 reject=2 total=6' "$TMP/scorer.out" \
+  && grep -q 'unsupported published-sentence rate=0' "$TMP/scorer.out"; then
+  _pass "scorer prints fixture provenance and enforces the zero unsupported-sentence threshold"
+else
+  _fail "scorer report is incomplete: $(cat "$TMP/scorer.out")"
+fi
+if grep -q 'no-op-loop: expected=accept actual=accept' "$TMP/scorer.out"; then
+  _pass "AC7: an idle/no-op turn is rendered as lack-of-progress, never success wording"
+else
+  _fail "AC7: no-op-loop fixture did not confirm lack-of-progress wording"
+fi
+if grep -q 'prompt-injection-control: expected=accept actual=accept' "$TMP/scorer.out" \
+  && grep -q 'prompt-injection-adversarial: expected=accept actual=accept' "$TMP/scorer.out"; then
+  _pass "AC4: cited prompt injection leaves coverage/citations intact (failure still reported)"
+else
+  _fail "AC4 prompt-injection fixtures did not confirm coverage was preserved"
+fi
+
+# scorer teeth: disabling the new D3 provenance-subset check (grounding-check:summary)
+# must flip the ONE fixture that depends exclusively on it (a resolvable-but-uncited
+# flow-report citation, which the citation resolver alone would happily accept).
+node - "$COMPILED" <<'NODE'
+const fs=require('fs'); const file=process.argv[2]; let text=fs.readFileSync(file,'utf8');
+const anchor='/* grounding-check:summary */';
+const needle=`${anchor}\n    violations.push(...summaryViolations(statements));`;
+if (!text.includes(needle)) throw new Error('summary mutation anchor missing');
+text=text.replace(needle, `${anchor}\n    // mutation: check deliberately disabled`);
+fs.writeFileSync(file,text);
+NODE
+if ! node --check "$COMPILED" >/dev/null; then
+  _fail "summary-check mutation produced invalid JavaScript"
+elif node "$FIXTURES/scorer.mjs" summary >"$TMP/mutation-summary.out" 2>"$TMP/mutation-summary.err"; then
+  _fail "summary corpus still passed after its validator branch was disabled"
+elif grep -q 'unsupported-summary-foreign-citation: expected=reject actual=accept' "$TMP/mutation-summary.out"; then
+  _pass "scorer teeth: disabling grounding-check:summary flips the foreign-citation fixture from reject to accept"
+else
+  _fail "summary-check mutation failed for an unrelated reason: $(cat "$TMP/mutation-summary.out" "$TMP/mutation-summary.err")"
+fi
+restore_compiled
+if cmp -s "$BACKUP" "$COMPILED" && node "$FIXTURES/scorer.mjs" summary >/dev/null; then
+  _pass "summary-check compiled branch restored byte-for-byte and corpus rejects again"
+else
+  _fail "summary-check compiled branch did not restore cleanly"
+fi
+
+# ── Build one real frozen narrative directory via the built CLI, for the CLI-level checks below. ──
+node --input-type=module - "$ROOT" "$TMP" <<'NODE'
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+const root=process.argv[2], tmp=process.argv[3];
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const sha8=bytes=>sha256(bytes).slice(0,8);
+const sessionDir=path.join(tmp,'cli-fixture','session'); fs.mkdirSync(sessionDir,{recursive:true});
+const commandLine=JSON.stringify({command:'npm test',result:'fail',exitCode:1});
+fs.writeFileSync(path.join(sessionDir,'command-log.jsonl'), commandLine+'\n');
+fs.writeFileSync(path.join(tmp,'cli-fixture-cmd-source.txt'), `fa1:cmdlog:session:line-1/${sha8(Buffer.from(commandLine))}\n`);
+NODE
+CLI_SESSION="$TMP/cli-fixture/session"
+CLI_CMD_SOURCE="$(cat "$TMP/cli-fixture-cmd-source.txt")"
+CLI_NARRATIVE_DIR="$TMP/cli-narrative"
+if node "$ROOT/build/src/cli.js" narrative-sources snapshot \
+  --artifact-root "$TMP/cli-artifact-root" --narrative-id cli-fixture \
+  --source "$CLI_CMD_SOURCE" --session-root "$CLI_SESSION" \
+  >"$TMP/cli-snapshot.out" 2>"$TMP/cli-snapshot.err"; then
+  CLI_NARRATIVE_DIR="$TMP/cli-artifact-root/.kontourai/narrative/cli-fixture"
+  _pass "R1/R4: real narrative snapshot built for the CLI-level fail-closed proofs"
+else
+  _fail "CLI snapshot for the render fixture failed: $(cat "$TMP/cli-snapshot.err")"
+fi
+
+# AC8/LB7: hosted generator WITHOUT opt-in must refuse a non-local endpoint with NO
+# socket attempt (fast rejection), not a graceful network failure (slow).
+START_NS="$(date +%s%N)"
+node "$ROOT/build/src/cli.js" narrative-render render \
+  --narrative-dir "$CLI_NARRATIVE_DIR" --compiled-at "2026-07-14T16:00:00.000Z" \
+  --out-dir "$TMP/hosted-no-opt-in-out" --generator hosted --model test-model --provider test-provider \
+  --endpoint "https://model-provider.example/v1/generate" --timeout-ms 8000 \
+  >"$TMP/hosted-no-opt-in.out" 2>"$TMP/hosted-no-opt-in.err"
+hosted_exit=$?
+END_NS="$(date +%s%N)"
+ELAPSED_MS=$(( (END_NS - START_NS) / 1000000 ))
+if [[ "$hosted_exit" -eq 0 ]] && grep -q '"outcome": "deterministic_only"' "$TMP/hosted-no-opt-in.out" \
+  && grep -qi 'not allowed' "$TMP/hosted-no-opt-in.out" \
+  && [[ ! -d "$TMP/hosted-no-opt-in-out" || -z "$(find "$TMP/hosted-no-opt-in-out" -name '*.prose.json' 2>/dev/null)" ]] \
+  && [[ "$ELAPSED_MS" -lt 3000 ]]; then
+  _pass "AC8/LB7: hosted generator without opt-in refused a non-local endpoint in ${ELAPSED_MS}ms with zero prose artifacts (no socket attempt)"
+else
+  _fail "AC8 hosted-without-opt-in did not fail closed fast enough or wrote a prose artifact (exit=$hosted_exit elapsed=${ELAPSED_MS}ms): $(cat "$TMP/hosted-no-opt-in.out" "$TMP/hosted-no-opt-in.err")"
+fi
+
+# Opt-in missing a required field (data_residency/payload_policy) must still refuse.
+node "$ROOT/build/src/cli.js" narrative-render render \
+  --narrative-dir "$CLI_NARRATIVE_DIR" --compiled-at "2026-07-14T16:00:00.000Z" \
+  --out-dir "$TMP/hosted-partial-opt-in-out" --generator hosted --model test-model --provider test-provider \
+  --endpoint "https://model-provider.example/v1/generate" --timeout-ms 2000 \
+  --opt-in-tenant acme \
+  >"$TMP/hosted-partial-opt-in.out" 2>"$TMP/hosted-partial-opt-in.err"
+if grep -q '"outcome": "deterministic_only"' "$TMP/hosted-partial-opt-in.out" \
+  && [[ ! -d "$TMP/hosted-partial-opt-in-out" || -z "$(find "$TMP/hosted-partial-opt-in-out" -name '*.prose.json' 2>/dev/null)" ]]; then
+  _pass "AC8: opt-in missing data_residency/payload_policy still refuses the hosted endpoint"
+else
+  _fail "AC8: partial opt-in incorrectly allowed the hosted endpoint"
+fi
+
+# AC2/LB1: a generator error (nothing listening on the configured local endpoint) still
+# writes the deterministic narrative and ZERO prose artifacts through the real CLI binary.
+node "$ROOT/build/src/cli.js" narrative-render render \
+  --narrative-dir "$CLI_NARRATIVE_DIR" --compiled-at "2026-07-14T16:00:00.000Z" \
+  --out-dir "$TMP/local-error-out" --generator local --model test-model --provider local \
+  --endpoint "http://127.0.0.1:1" --timeout-ms 3000 \
+  >"$TMP/local-error.out" 2>"$TMP/local-error.err"
+local_exit=$?
+if [[ "$local_exit" -eq 0 ]] && grep -q '"outcome": "deterministic_only"' "$TMP/local-error.out" \
+  && [[ -n "$(find "$TMP/local-error-out" -name '*.json' -not -name '*.prose.json' 2>/dev/null)" ]] \
+  && [[ -z "$(find "$TMP/local-error-out" -name '*.prose.json' 2>/dev/null)" ]]; then
+  _pass "AC2/LB1: a real generator connection failure still writes the deterministic narrative and zero prose artifacts"
+else
+  _fail "AC2 local-generator-error did not fail closed as expected (exit=$local_exit): $(cat "$TMP/local-error.out" "$TMP/local-error.err")"
+fi
+
+# R8/AC5/D7: a value-based secret canary planted in a redacted field must never surface
+# in prose, the generator's own request/response view (sourceViews), the economics sink,
+# or stderr -- even against a generator that deliberately echoes everything it was given.
+node --input-type=module - "$ROOT" "$TMP" <<'NODE' >"$TMP/canary.out" 2>"$TMP/canary.err"
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+const root=process.argv[2], tmp=process.argv[3];
+const api=await import(pathToFileURL(path.join(root,'build/src/index.js')));
+const sha256=b=>createHash('sha256').update(b).digest('hex');
+const sha8=b=>sha256(b).slice(0,8);
+const CANARY='NPR614_SECRET_CANARY_9f2c';
+const fixtureRoot=path.join(tmp,'canary-fixture');
+const sessionDir=path.join(fixtureRoot,'session'), telemetryDir=path.join(fixtureRoot,'telemetry'), repoRoot=path.join(fixtureRoot,'repo'), narrativeDir=path.join(fixtureRoot,'narrative');
+fs.mkdirSync(sessionDir,{recursive:true}); fs.mkdirSync(telemetryDir,{recursive:true}); fs.mkdirSync(repoRoot,{recursive:true});
+const commandLine=JSON.stringify({command:'npm test',result:'fail',exitCode:1});
+fs.writeFileSync(path.join(sessionDir,'command-log.jsonl'), commandLine+'\n');
+const canaryRecord={session_id:'canary-session',event_id:'canary-evt',event_type:'tool.result',tool:{name:'execute_bash',input:{command:'printenv',secret:CANARY}},exit_code:1};
+const canaryLine=JSON.stringify(canaryRecord);
+fs.writeFileSync(path.join(telemetryDir,'full.jsonl'), canaryLine+'\n');
+const fileBytes=Buffer.from('{"kind":"created-file-fixture","status":"created"}\n');
+fs.writeFileSync(path.join(repoRoot,'created.json'), fileBytes);
+api.snapshotNarrative({
+  narrativeDir, narrativeId:'canary', redactionFields:['tool.input'],
+  compiler:{name:'canary-check',version:'1',policy_hash:'fixture'}, captureCompleteness:{channels:{full:'active'},known_gaps:[]},
+  requests:[
+    {source:api.parseSourceId(`fa1:cmdlog:session:line-1/${sha8(Buffer.from(commandLine))}`),roots:{sessionDir}},
+    {source:api.parseSourceId(`fa1:telemetry:full/canary-session:canary-evt/${sha8(Buffer.from(canaryLine))}`),roots:{telemetryDir}},
+    {source:api.parseSourceId(`fa1:file:created.json:${sha256(fileBytes)}`),roots:{repoRoot}},
+  ],
+},{now:()=>'2026-07-14T15:00:00.000Z'});
+
+// Deliberately adversarial: echoes every source view's raw content into one summary
+// sentence citing every atomic statement's refs (a maximally leak-seeking generator).
+const echoEverythingGenerator = {
+  identity:{model:'echo-everything',provider:'test',config_hash:'x'},
+  async generate(input) {
+    const allRefs=[...new Set(input.statements.flatMap(s=>s.source_refs))];
+    const dump=input.sourceViews.map(v=>v.content).join(' ').replace(/[\r\n`]/g,' ').replace(/;\s/g,', ');
+    return { sentences:[{ text:`Evidence dump: ${dump || 'no evidence'}`, statement_refs: allRefs }], usage:{input_tokens:10,output_tokens:10} };
+  },
+};
+const outDir=path.join(tmp,'canary-out');
+let result;
+try {
+  result = await api.renderProse(narrativeDir, { compiledAt:'2026-07-14T16:00:00.000Z', outDir, generator: echoEverythingGenerator });
+} catch (error) {
+  console.error('renderProse threw:', error instanceof Error ? error.message : error);
+  process.exitCode = 1;
+}
+if (result) {
+  console.log('outcome:', result.outcome, result.reason ?? '');
+  console.log('economics file:', fs.readFileSync(path.join(narrativeDir, api.PROSE_ECONOMICS_FILE), 'utf8'));
+  if (result.outcome === 'prose_published') console.log('prose:', fs.readFileSync(result.prose.path, 'utf8'));
+  if (result.written.renderPath) console.log('deterministic markdown:', fs.readFileSync(result.written.renderPath, 'utf8'));
+}
+
+// PUBLISH-PATH canary: run the benign stub generator over the SAME redacted-canary
+// fixture into a fresh out-dir. The stub produces publishable prose (it never restates
+// banned outcome verbs), so this exercises the prose_published path -- proving the
+// redacted secret is absent from PUBLISHED prose + economics, not merely on the reject
+// path. (The generator only ever sees the frozen, policy-filtered resolveSource view,
+// in which tool.input -- where the canary lives -- is nulled.)
+const pubOutDir=path.join(tmp,'canary-pub-out');
+const pub = await api.renderProse(narrativeDir, { compiledAt:'2026-07-14T16:00:00.000Z', outDir: pubOutDir, generator: api.stubGenerator });
+console.log('publish outcome:', pub.outcome, pub.reason ?? '');
+console.log('publish economics:', fs.readFileSync(path.join(narrativeDir, api.PROSE_ECONOMICS_FILE), 'utf8'));
+if (pub.outcome === 'prose_published') console.log('published prose:', fs.readFileSync(pub.prose.path, 'utf8'));
+NODE
+if grep -q -- 'NPR614_SECRET_CANARY_9f2c' "$TMP/canary.out" "$TMP/canary.err"; then
+  _fail "R8/AC5: value-based canary leaked into prose, economics, or generator diagnostics"
+else
+  _pass "R8/AC5/D7: redacted value-based canary never surfaces in prose, economics, or stderr, even against an echo-everything generator"
+fi
+if grep -q 'publish outcome: prose_published' "$TMP/canary.out"; then
+  _pass "R8/AC5/D7 (publish path): benign generator over the redacted-canary fixture actually publishes prose"
+else
+  _fail "R8/AC5/D7 publish-path canary did not exercise the prose_published path: $(grep 'publish outcome' "$TMP/canary.out")"
+fi
+
+echo ""
+if [[ "$errors" -eq 0 ]]; then
+  echo "narrative prose renderer tests passed: 12/12."
+  exit 0
+fi
+echo "narrative prose renderer tests FAILED: $errors issue(s)."
+exit 1

package/dist/codex/evals/integration/test_narrative_redaction_failclosed.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# Narrative redaction is value-free and fail-closed: secrets never enter snapshot blobs or diagnostics.
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+FIXTURES="$ROOT/evals/fixtures/narrative-sources"
+TMP="$(mktemp -d)"
+errors=0
+_pass() { echo "  ✓ $1"; }
+_fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
+cleanup() { rm -rf "$TMP"; }
+trap cleanup EXIT
+
+json_assert() { # $1=file $2=JavaScript expression using value
+  node - "$1" "$2" <<'NODE'
+const fs = require('fs');
+const value = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+if (!Function('value', `return Boolean(${process.argv[3]})`)(value)) process.exit(1);
+NODE
+}
+
+echo "Narrative redaction fail-closed integration"
+if npm run build --silent; then _pass "TypeScript build completed"; else _fail "TypeScript build failed"; fi
+
+RAW="$TMP/raw-telemetry"
+ARTIFACT_ROOT="$TMP/artifacts"
+AC6_CANARY="NARRATIVE_AC6_SECRET_7b31e9" # deliberate test canary, never a real credential
+cp -R "$FIXTURES/telemetry" "$RAW"
+# Telemetry IDs carry a content pin: sha8 of the exact fixture line.
+PIN="$(node -e "const fs=require('fs'),c=require('crypto');const line=fs.readFileSync(process.argv[1],'utf8').split('\n').find(l=>l.trim()&&JSON.parse(l).event_id==='evt-redaction');process.stdout.write(c.createHash('sha256').update(Buffer.from(line)).digest('hex').slice(0,8))" "$RAW/full.jsonl")"
+SOURCE_ID="fa1:telemetry:full/session-fixture:evt-redaction/$PIN"
+
+node "$ROOT/build/src/cli.js" narrative-sources snapshot \
+  --artifact-root "$ARTIFACT_ROOT" \
+  --narrative-id redacted-success \
+  --source "$SOURCE_ID" \
+  --telemetry-root "$RAW" \
+  --redact-fields tool.input \
+  >"$TMP/snapshot-success.json" 2>"$TMP/snapshot-success.stderr"
+success_exit=$?
+SUCCESS_DIR="$ARTIFACT_ROOT/.kontourai/narrative/redacted-success"
+SUCCESS_MANIFEST="$SUCCESS_DIR/source-manifest.json"
+if [[ "$success_exit" -eq 0 && -f "$SUCCESS_MANIFEST" ]]; then
+  _pass "AC6: redacted snapshot completed"
+else
+  _fail "AC6: redacted snapshot failed (exit=$success_exit): $(<"$TMP/snapshot-success.stderr")"
+  echo "narrative redaction fail-closed tests FAILED: $errors issue(s)."
+  exit 1
+fi
+
+if json_assert "$SUCCESS_MANIFEST" 'value.sources.length === 1 && value.sources[0].status === "snapshotted" && value.sources[0].redactions.includes("tool.input")'; then
+  _pass "AC6: manifest records only the redacted field name"
+else
+  _fail "AC6: redaction field-name metadata missing"
+fi
+
+node "$ROOT/build/src/cli.js" narrative-sources resolve \
+  --narrative-dir "$SUCCESS_DIR" --source-id "$SOURCE_ID" --out "$TMP/redacted-record.json" \
+  >"$TMP/resolve-success.json" 2>"$TMP/resolve-success.stderr"
+if [[ "$?" -eq 0 ]] && json_assert "$TMP/redacted-record.json" 'value.tool.input === null && value.tool.output === null'; then
+  _pass "AC6: seeded tool.input secret is nulled in resolved bytes"
+else
+  _fail "AC6: resolved record did not null sensitive tool fields"
+fi
+
+if ! grep -R -F -q -- "$AC6_CANARY" "$SUCCESS_DIR" && ! grep -F -q -- "$AC6_CANARY" "$TMP/snapshot-success.stderr" "$TMP/resolve-success.stderr"; then
+  _pass "AC6: zero secret hits in narrative directory and captured stderr"
+else
+  _fail "AC6: secret leaked into snapshot artifacts or diagnostics"
+fi
+
+# An invalid policy field is a deterministic integration-level filter failure.
+# The source must be recorded unavailable/redacted without writing candidate bytes.
+node "$ROOT/build/src/cli.js" narrative-sources snapshot \
+  --artifact-root "$ARTIFACT_ROOT" \
+  --narrative-id redacted-failure \
+  --source "$SOURCE_ID" \
+  --telemetry-root "$RAW" \
+  --redact-fields __proto__ \
+  >"$TMP/snapshot-failure.json" 2>"$TMP/snapshot-failure.stderr"
+failure_exit=$?
+FAILURE_DIR="$ARTIFACT_ROOT/.kontourai/narrative/redacted-failure"
+FAILURE_MANIFEST="$FAILURE_DIR/source-manifest.json"
+if [[ "$failure_exit" -eq 0 && -f "$FAILURE_MANIFEST" ]]; then
+  _pass "AC6: filter failure still emits an auditable manifest"
+else
+  _fail "AC6: filter-failure snapshot failed (exit=$failure_exit): $(<"$TMP/snapshot-failure.stderr")"
+  echo "narrative redaction fail-closed tests FAILED: $errors issue(s)."
+  exit 1
+fi
+
+if json_assert "$FAILURE_MANIFEST" 'value.sources.length === 1 && value.sources[0].status === "unavailable" && value.sources[0].unavailable_reason === "redacted" && !Object.hasOwn(value.sources[0], "sha256")'; then
+  _pass "AC6: filter failure becomes unavailable/redacted with no blob hash"
+else
+  _fail "AC6: filter failure did not fail closed"
+fi
+
+blob_count=0
+if [[ -d "$FAILURE_DIR/sources" ]]; then blob_count="$(find "$FAILURE_DIR/sources" -type f | wc -l | tr -d ' ')"; fi
+if [[ "$blob_count" -eq 0 ]]; then _pass "AC6: filter failure writes zero source blobs"; else _fail "AC6: filter failure wrote $blob_count source blob(s)"; fi
+
+if ! grep -R -F -q -- "$AC6_CANARY" "$FAILURE_DIR" && ! grep -F -q -- "$AC6_CANARY" "$TMP/snapshot-failure.stderr"; then
+  _pass "AC6: failed-filter artifacts and stderr contain no secret value"
+else
+  _fail "AC6: failed-filter path leaked the secret value"
+fi
+
+if grep -F -q -- '__proto__' "$FAILURE_MANIFEST" || grep -F -q -- '__proto__' "$TMP/snapshot-failure.json" "$TMP/snapshot-failure.stderr"; then
+  _pass "AC6: failed-filter diagnostics identify the field name, not its value"
+else
+  _fail "AC6: failed-filter diagnostic omitted the invalid field name"
+fi
+
+echo ""
+if [[ "$errors" -eq 0 ]]; then
+  echo "narrative redaction fail-closed tests passed: 9/9."
+  exit 0
+fi
+echo "narrative redaction fail-closed tests FAILED: $errors issue(s)."
+exit 1