@kontourai/flow-agents 3.12.1 → 4.1.0

package/dist/codex/docs/spec/runtime-hook-surface.md

@@ -29,13 +29,20 @@ Every Flow Agents event has a canonical name that is runtime-neutral. Adapters m
 | `userPromptSubmit` | The user submits a new turn or message. Maps from `UserPromptSubmit`. | `hook_event_name` | `turn.prompt_text` (redacted by default), `cwd` |
 | `preToolUse` | Immediately before a tool call is executed. Maps from `PreToolUse`. | `hook_event_name`, `tool_name`, `tool_input` | `tool_id`, `cwd`, `usage.model`, `usage.input_tokens`, `usage.output_tokens`, `usage.cache_creation_input_tokens`, `usage.cache_read_input_tokens`, `usage.estimated_cost_usd`, `usage.pricing_version` |
 | `permissionRequest` | The runtime is asking for permission to run a tool or action. Maps from `PermissionRequest`. | `hook_event_name`, `tool_name` | `tool_input`, `cwd` |
-| `postToolUse` | After a tool call completes (success or failure). Maps from `PostToolUse` and `PostToolUseFailure`. | `hook_event_name`, `tool_name`, `tool_response` | `tool_input`, `tool_output`, `error`, `cwd`, `usage.model`, `usage.input_tokens`, `usage.output_tokens`, `usage.cache_creation_input_tokens`, `usage.cache_read_input_tokens`, `usage.estimated_cost_usd`, `usage.pricing_version` |
+| `postToolUse` | After a tool call completes (success or failure). Maps from `PostToolUse` and `PostToolUseFailure`. | `hook_event_name`, `tool_name`, `tool_response` | `tool_input`, `tool_output`, `error`, `cwd`, `tool.duration_ms`, `tool.outcome`, `tool.status`, `usage.model`, `usage.input_tokens`, `usage.output_tokens`, `usage.cache_creation_input_tokens`, `usage.cache_read_input_tokens`, `usage.estimated_cost_usd`, `usage.pricing_version` |
 | `stop` | The agent is about to stop and return control to the user. Maps from `Stop` and `SessionEnd`. | `hook_event_name` | `stop_reason`, `cwd` |
 | `subagentStart` | A subagent or specialist delegate is spawning. Maps from `SubagentStart` (Codex). | `hook_event_name` | `agent_name`, `agent_type` |
 | `subagentStop` | A subagent or specialist delegate has stopped. Maps from `SubagentStop` (Codex). | `hook_event_name` | `agent_name`, `outcome` |
 
 **`usage.*` on `preToolUse`/`postToolUse` (#568 slice 1).** These two events carry an optional `.usage` object — `model`, `input_tokens`, `output_tokens`, `cache_creation_input_tokens`, `cache_read_input_tokens`, `estimated_cost_usd`, `pricing_version` — sourced from the runtime transcript's LAST assistant turn (the turn that produced this specific tool call), joined via a bounded tail-read of `hook.transcript_path`. This is **per-turn, not a per-tool-call cost fraction**: multiple tool calls inside the same assistant turn (parallel tool_use blocks) report the *same* whole-turn usage figures — do not sum `estimated_cost_usd` across `tool.invoke`/`tool.result` rows within one turn, or cost will be double-counted; `session.usage`'s cumulative totals remain the authoritative aggregate. When the transcript join is unavailable but the runtime's `.model` hook field is present, only `usage.model` is populated and every token/cost field is explicitly `null` (never a guessed number); `.model` itself is best-effort on these two events (see §8.2), not a contractually guaranteed field. `tool.permission_request` (`permissionRequest`) is explicitly excluded from this enrichment.
 
+**`tool.duration_ms` / `tool.outcome` / `tool.status` on `tool.result` (#580).** Every `tool.result` record (from `postToolUse`/`PostToolUse`/`PostToolUseFailure`) carries three intrinsic tool-result fields on its `.tool` object (co-located with `.tool.name`/`.tool.output`):
+- **`duration_ms`** — non-negative wall-clock milliseconds between this tool's invoke and its result, correlated per tool call (host call id when present, else a content hash of `tool_name` + compact `tool_input`). The invoke's start time is recorded on `preToolUse` and read+unlinked on the matching result. It is **`null`** — never a fabricated `0` or a stale value — when the matching start record is absent (a result with no prior recorded invoke). Best-effort and non-blocking; a missing/corrupt start record degrades to `null`. Resolution is millisecond on hosts with a sub-second clock (`$EPOCHREALTIME`/GNU `date +%s%3N`) and second-granular on the portable fallback.
+- **`outcome`** — the deterministic tri-state `pass` | `fail` | `ambiguous` from the canonical observation contract (§2.5), computed in-process by a jq port of `scripts/hooks/evidence-capture.js observeResult` so the Claude hot path stays hermetic (no node subprocess). A `PostToolUseFailure` event folds to `fail`. Never derived from stdout text or model narration. On the Codex runtime only — where the exit code lives in the rollout banner rather than the payload — the code is resolved via `scripts/hooks/lib/codex-exit-code.js` and fed through the same tri-state; an unreadable rollout degrades to `ambiguous`.
+- **`status`** — the host-surfaced integer exit code when one is cleanly present (the same fields §2.5 scans), else **`null`**.
+
+`tool.invoke` and `tool.permission_request` records carry none of these three fields (an invoke has no result yet; a permission request is not a tool result). The three fields are derived scalars only (a timestamp delta, a verdict, an integer) — no args/output/secret material — and the start record stores a bare timestamp, so the console-relay sanitize backstop is unaffected.
+
 ### Redaction Defaults
 
 Telemetry channels redact sensitive payload fields before emission. Adapters must honor these defaults and must not log raw hook payloads without applying channel redaction.
@@ -87,6 +94,27 @@ way.
   supported, it resolves from step 3 onward. Adapters MUST document which manifests they honor so the
   attribution granularity difference is explicit, not surprising.
 
+#### Work-item attribution (`task_slug`)
+
+Where `context.project` groups events by *codebase*, `task_slug` groups them by the *active Builder
+work item* — so the console can report cost and activity per unit of work (the "Cost by work-item"
+breakdown), not just per project.
+
+| Field | Semantics | Redacted? | Producer requirement |
+| --- | --- | --- | --- |
+| `task_slug` | Top-level slug of the Builder run active in `context.cwd` at emission time. | **No** (an opaque work-item slug; carries no path or content) | Adapters SHOULD stamp `task_slug` when a Builder run is active in the working dir. **Omit the field entirely when no run is active — never emit an empty string and never fabricate a slug.** |
+
+Canonical resolution (harness adapter), first match wins, read from the *same* `current.json` the
+economics relay reads so both surfaces attribute to one identifier:
+
+1. `<cwd>/.kontourai/flow-agents/current.json` → `.active_slug`, else `.artifact_dir`.
+2. `<cwd>/.flow-agents/current.json` (legacy location) → `.active_slug`, else `.artifact_dir`.
+3. No file, or both fields empty → **no `task_slug` key on the record.**
+
+Only the slug string is stored; no prompt, args, or file content is ever read into it. A non-Builder
+session (no `current.json`) therefore emits records with no `task_slug`, and the console buckets
+those under "unknown" rather than inventing an attribution.
+
 ### Exit Code Protocol (Canonical Hook Scripts)
 
 Canonical hook scripts in `scripts/hooks/` use the following exit code contract — originally derived from Kiro conventions and shared across all harness adapters via the adapter translation layer:

package/dist/codex/docs/specs/economics-record-contract.md

@@ -156,7 +156,7 @@ from a harness-blind gap (full doctrine + per-runtime matrix in `harness-capabil
 | Field | Meaning |
 | --- | --- |
 | `runtime` | the runtime that produced the record (`claude-code`, `kiro-cli`, …), from `session.usage .agent.runtime` |
-| `per_delegation_tokens` | `true` iff the runtime isolates per-sub-agent tokens. `false` everywhere today → per-delegation cost unavailable |
+| `per_delegation_tokens` | `true` iff the runtime isolates per-sub-agent tokens. **Derived (not a hardcoded literal, #620)** from the runtime's capability declaration — the emitter reads the build-only `build/generated/capability-declarations.json` (generated from `src/lib/capability-declarations.ts`), keys it on the normalized `.agent.runtime` (`kiro-cli`→`kiro`), and emits `true` iff the declared `per_delegation_tokens` status is `supported`. An unresolved runtime or a missing declaration JSON yields the explicit sentinel `false` — never a fabricated `true`. `false` everywhere today → per-delegation cost unavailable |
 | `per_delegation_outcome` | outcome-signal coverage this run: `full`\|`partial`\|`none`\|`n/a` |
 
 Consumers MUST read `signals` before rendering a delegation metric: if the needed signal is unavailable,

package/dist/codex/docs/specs/harness-capability-matrix.md

@@ -3,6 +3,10 @@
 **The signals a feature can rely on depend on which runtime/harness the kit is hooked into. State the
 coverage; never assume it, never fabricate the gap.**
 
+> Generated by `npm run capability-matrix` from `src/lib/capability-declarations.ts` — the single
+> source of truth. Do NOT edit this file by hand; change the declarations and regenerate. CI fails on
+> drift (`npm run capability-matrix -- --check`).
+
 This is a cross-cutting contract: any feature whose data comes from telemetry (economics, delegation
 efficiency, liveness, learning) must declare which signals it needs, which *class* each falls in, and
 how it degrades when the current runtime does not expose one. A missing signal is rendered as
@@ -35,30 +39,67 @@ exposed:
 | Field | Class | Meaning |
 | --- | --- | --- |
 | `runtime` | — | the runtime that produced the record (`claude-code`, `kiro-cli`, `codex`, …) |
-| `per_delegation_tokens` | sub-agent-internal | `true` iff the runtime isolates per-sub-agent token usage. **`false` on every runtime today** → per-delegation cost is unavailable; the console attributes cost at `(role, model)` granularity via `cost.by_model` instead. |
+| `per_delegation_tokens` | sub-agent-internal | `true` iff the runtime isolates per-sub-agent token usage. **`false` on every runtime today** → per-delegation cost is unavailable; the console attributes cost at `(role, model)` granularity via `cost.by_model` instead. Derived from this matrix's `per_delegation_tokens` capability declaration, not a hardcoded literal. |
 | `per_delegation_outcome` | orchestrator-observable | coverage of the outcome signal on this run: `full` (every delegation resolved to a real outcome), `partial` (some), `none` (delegations exist but none had a verdict/escalation/re-dispatch), `n/a` (no delegations observed). |
 
 Consumers (console panels, `learning-review`) MUST read `signals` before rendering a metric: if the
 signal a metric needs is unavailable, show "not measurable on this harness," not a misleading number.
 
-## Per-runtime coverage (current, honest snapshot)
-
-`✓` exposed · `partial` best-effort/orchestrator-derived · `✗` not exposed. Update this table as
-runtimes add instrumentation — it is the single source of truth the `signals` values are stamped from.
-
-| Signal | Class | claude-code | kiro-cli | codex | raw-model runner |
-| --- | --- | --- | --- | --- | --- |
-| whole-run tokens/cost (`by_model`) | run-level | ✓ | ✓ | ✓ | partial |
-| delegation dispatch (role/model) | orchestrator-observable | ✓ | ✓ | partial | ✗ |
-| re-dispatch / re-prompt count | orchestrator-observable | ✓ | ✓ | partial | ✗ |
-| escalation (tier bump) | orchestrator-observable | ✓ | ✓ | partial | ✗ |
-| supersession / correction | orchestrator-observable | partial | partial | ✗ | ✗ |
-| per-sub-agent terminal verdict | mixed | partial | partial | ✗ | ✗ |
-| per-sub-agent tokens/cost | sub-agent-internal | ✗ | ✗ | ✗ | ✗ |
-
-"partial" for verdicts/supersession reflects that these depend on the workflow actually recording an
-`evidence`/`verdict`/`supersession` event for the agent — capturable, but not guaranteed every run.
-That is exactly why `outcome` degrades to `unavailable` rather than `accepted` when the event is absent.
+## Per-runtime capability coverage (generated, honest snapshot)
+
+`✓` exposed · `partial` best-effort/orchestrator-derived · `✗` not exposed. This table is generated
+from `src/lib/capability-declarations.ts`; update the declarations there as runtimes add
+instrumentation — it is the single source of truth the `signals` values are stamped from. The
+`kiro-cli` runtime value normalizes to the canonical `kiro` column before lookup.
+
+| Capability | `claude-code` | `codex` | `kiro` | `opencode` | `pi` | `codex-local` | `strands-local` |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| `turn_id` | ✓ | ✓ | ✓ | partial | ✓ | ✗ | ✗ |
+| `transcript_path` | ✓ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
+| `intent_annotation` | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
+| `per_delegation_trace_context` | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
+| `per_delegation_tokens` | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
+| `terminal_verdict` | partial | ✗ | partial | ✗ | ✗ | ✗ | ✗ |
+
+### Declared notes and reasons
+
+Every `partial` / `✗` cell above, with its declared justification:
+
+- `turn_id` · `opencode` (partial): session.start telemetry is unavailable in opencode run (non-interactive) mode; tool events still carry a turn context.
+- `turn_id` · `codex-local` (unsupported): codex-local is a kit-activation adapter, not an agent-runtime telemetry source; it emits no per-turn agent-runtime telemetry.
+- `turn_id` · `strands-local` (unsupported): strands-local is a kit-activation adapter, not an agent-runtime telemetry source; it emits no per-turn agent-runtime telemetry.
+- `transcript_path` · `opencode` (unsupported): opencode does not expose a per-session transcript path to hooks.
+- `transcript_path` · `pi` (unsupported): pi does not expose a per-session transcript path to hooks.
+- `transcript_path` · `codex-local` (unsupported): codex-local is a kit-activation adapter and does not expose a per-session transcript path.
+- `transcript_path` · `strands-local` (unsupported): strands-local is a kit-activation adapter and does not expose a per-session transcript path.
+- `intent_annotation` · `claude-code` (unsupported): Intent-annotation capture is not implemented on any runtime yet (#622).
+- `intent_annotation` · `codex` (unsupported): Intent-annotation capture is not implemented on any runtime yet (#622).
+- `intent_annotation` · `kiro` (unsupported): Intent-annotation capture is not implemented on any runtime yet (#622).
+- `intent_annotation` · `opencode` (unsupported): Intent-annotation capture is not implemented on any runtime yet (#622).
+- `intent_annotation` · `pi` (unsupported): Intent-annotation capture is not implemented on any runtime yet (#622).
+- `intent_annotation` · `codex-local` (unsupported): Intent-annotation capture is not implemented on any runtime yet (#622).
+- `intent_annotation` · `strands-local` (unsupported): Intent-annotation capture is not implemented on any runtime yet (#622).
+- `per_delegation_trace_context` · `claude-code` (unsupported): Per-delegation trace-context propagation is not implemented on any runtime yet (#425).
+- `per_delegation_trace_context` · `codex` (unsupported): Per-delegation trace-context propagation is not implemented on any runtime yet (#425).
+- `per_delegation_trace_context` · `kiro` (unsupported): Per-delegation trace-context propagation is not implemented on any runtime yet (#425).
+- `per_delegation_trace_context` · `opencode` (unsupported): Per-delegation trace-context propagation is not implemented on any runtime yet (#425).
+- `per_delegation_trace_context` · `pi` (unsupported): Per-delegation trace-context propagation is not implemented on any runtime yet (#425).
+- `per_delegation_trace_context` · `codex-local` (unsupported): Per-delegation trace-context propagation is not implemented on any runtime yet (#425).
+- `per_delegation_trace_context` · `strands-local` (unsupported): Per-delegation trace-context propagation is not implemented on any runtime yet (#425).
+- `per_delegation_tokens` · `claude-code` (unsupported): No runtime isolates per-sub-agent token usage; per-delegation cost is attributed at (role, model) granularity instead.
+- `per_delegation_tokens` · `codex` (unsupported): No runtime isolates per-sub-agent token usage; per-delegation cost is attributed at (role, model) granularity instead.
+- `per_delegation_tokens` · `kiro` (unsupported): No runtime isolates per-sub-agent token usage; per-delegation cost is attributed at (role, model) granularity instead.
+- `per_delegation_tokens` · `opencode` (unsupported): No runtime isolates per-sub-agent token usage; per-delegation cost is attributed at (role, model) granularity instead.
+- `per_delegation_tokens` · `pi` (unsupported): No runtime isolates per-sub-agent token usage; per-delegation cost is attributed at (role, model) granularity instead.
+- `per_delegation_tokens` · `codex-local` (unsupported): No runtime isolates per-sub-agent token usage; per-delegation cost is attributed at (role, model) granularity instead.
+- `per_delegation_tokens` · `strands-local` (unsupported): No runtime isolates per-sub-agent token usage; per-delegation cost is attributed at (role, model) granularity instead.
+- `terminal_verdict` · `claude-code` (partial): Captured only when the workflow records an evidence/verdict event for the sub-agent — not guaranteed every run.
+- `terminal_verdict` · `codex` (unsupported): Codex does not surface a per-sub-agent terminal verdict to the orchestrator.
+- `terminal_verdict` · `kiro` (partial): Captured only when the workflow records an evidence/verdict event for the sub-agent — not guaranteed every run.
+- `terminal_verdict` · `opencode` (unsupported): opencode does not surface per-sub-agent terminal verdicts.
+- `terminal_verdict` · `pi` (unsupported): pi has no named-subagent registry, so per-sub-agent verdicts are not observable.
+- `terminal_verdict` · `codex-local` (unsupported): codex-local is a kit-activation adapter and does not surface per-sub-agent terminal verdicts.
+- `terminal_verdict` · `strands-local` (unsupported): strands-local is a kit-activation adapter and does not surface per-sub-agent terminal verdicts.
 
 ## The doctrine (applies to any telemetry-dependent feature)
 
@@ -70,5 +111,6 @@ That is exactly why `outcome` degrades to `unavailable` rather than `accepted` w
    is not `$0`; an outcome you cannot observe is not `accepted`.
 4. **Fall back to the coarsest honest proxy** when the fine signal is missing (per-delegation cost →
    `(role, model)` via `by_model`), and label the proxy as such.
-5. **Keep this matrix current.** When a harness starts exposing a signal, flip the cell and the
-   `signals` stamp follows — the feature "lights up" without a schema change.
+5. **Keep these declarations current.** When a harness starts exposing a signal, flip the declaration in
+   `src/lib/capability-declarations.ts` and regenerate — the `signals` stamp follows and the feature
+   "lights up" without a schema change.

package/dist/codex/docs/veritas-integration.md

@@ -4,6 +4,18 @@ title: Veritas Integration Boundary
 
 # Veritas Integration Boundary
 
+> **Superseded by the shipped kit.** This doc records the early rationale for how Flow Agents
+> should integrate Veritas. That decision has since been made and shipped as the **Veritas
+> Governance Kit** (`kits/veritas-governance`): an agentless kit that wraps the `veritas` CLI and
+> projects its recorded readiness verdict into a `software-readiness-verdict` trust.bundle gate,
+> and that owns the repo-installed governance surface (standards scaffold, hooks, standards
+> authoring, just-in-time agent guidance). For the current integration, read the
+> [kit README](../kits/veritas-governance/docs/README.md), [Engine and kits](architecture-engine-and-kits.md),
+> and veritas's [Engine / Surface Seam](https://github.com/kontourai/veritas/blob/main/docs/architecture/engine-surface-seam.md).
+> The boundary principle below still holds — Veritas is the evaluation engine; the kit wraps it,
+> never reimplements it — but the concrete adapter shape described here predates and is replaced by
+> the kit's flows + trust.bundle adapter.
+
 Veritas is a strong fit for Flow Agents' development evidence and governance layer, but it should stay optional and adapter-driven.
 
 The guiding rule is simple: Flow owns generic process enforcement, Flow Agents projects Flow-backed workflows into agent harnesses, and Veritas owns repo-local standards, authority, and evidence-check semantics.

package/dist/codex/docs/workflow-usage-guide.md

@@ -667,7 +667,10 @@ For unattended runtime re-entry, the active assignment actor may use `workflow d
 explicit runtime adapter argv file. The driver repeats the same public projection/evidence cycle,
 persists its mission turn budget, and parks on adapter-declared PID or deadline barriers instead of
 spending turns while external work is incomplete. Adapter completion never advances a gate by
-self-report; only trust evidence accepted by canonical Flow can change the current step. See
+self-report; only trust evidence accepted by canonical Flow can change the current step. Use
+`--context-policy fresh` when the selected adapter supports canonical fresh-context handoffs and
+the runtime capability profile calls for bounded contexts. This preserves every gate while avoiding
+prior-transcript replay between actions; `warm` remains the default. See
 [`docs/public-workflow-cli.md`](public-workflow-cli.md#bounded-continuation-driver) for the protocol.
 
 If the same Builder slice is interrupted, inspect its canonical status. Resume

package/dist/codex/evals/ci/run-baseline.sh

@@ -11,9 +11,12 @@ mkdir -p "$LOG_DIR"
 
 CHECKS=(
   "Content boundary|npm run check:content-boundary --"
+  "Layer boundary|npm run check:layer-boundary --"
+  "Hachure boundary|npm run check:hachure-boundary --"
   "Decision registry|npm run check:decisions --"
   "Source tree validation|npm run validate:source --"
   "Context map drift|npm run context-map -- --check"
+  "Capability matrix drift|npm run capability-matrix -- --check"
   "Static eval suite|bash evals/run.sh static"
   "Workflow artifact integration|bash evals/integration/test_workflow_artifacts.sh"
   "Workflow artifact cleanup audit integration|bash evals/integration/test_workflow_artifact_cleanup_audit.sh"
@@ -22,6 +25,15 @@ CHECKS=(
   "Workflow sidecar writer integration|bash evals/integration/test_workflow_sidecar_writer.sh"
   "Sidecar field preservation integration|bash evals/integration/test_sidecar_field_preservation.sh"
   "Record-check integration|bash evals/integration/test_record_check.sh"
+  "Narrative source contract integration|bash evals/integration/test_narrative_source_contract.sh"
+  "Narrative runtime projection integration|bash evals/integration/test_narrative_runtime_projection.sh"
+  "Narrative grounded envelope integration|bash evals/integration/test_narrative_grounded_envelope.sh"
+  "Narrative redaction fail-closed integration|bash evals/integration/test_narrative_redaction_failclosed.sh"
+  "Narrative trust isolation integration|bash evals/integration/test_narrative_trust_isolation.sh"
+  "Narrative grounding validator integration|bash evals/integration/test_narrative_grounding_validator.sh"
+  "Narrative prose renderer integration|bash evals/integration/test_narrative_prose_renderer.sh"
+  "Narrative grounded evals integration|bash evals/integration/test_narrative_evals.sh"
+  "Narrative intent annotation integration|bash evals/integration/test_narrative_intent_annotation.sh"
   "Actor identity resolver integration|bash evals/integration/test_actor_identity.sh"
   "CI-runtime actor identity integration|bash evals/integration/test_ci_actor_identity.sh"
   "Assignment provider local-file integration|bash evals/integration/test_assignment_provider_local_file.sh"
@@ -35,10 +47,13 @@ CHECKS=(
   "Liveness console relay integration|bash evals/integration/test_liveness_console_relay.sh"
   "Console tenant isolation integration|bash evals/integration/test_console_tenant_isolation.sh"
   "Goal Fit hook integration|bash evals/integration/test_goal_fit_hook.sh"
+  "Plain stop messaging integration|bash evals/integration/test_plain_stop_messaging.sh"
+  "Goal Fit narrative exclusion integration|env -u FLOW_AGENTS_GOAL_FIT_MODE bash evals/integration/test_goal_fit_narrative_exclusion.sh"
   "Hook category behavior integration|bash evals/integration/test_hook_category_behaviors.sh"
   "Workflow steering hook integration|bash evals/integration/test_workflow_steering_hook.sh"
   "Hook influence contract integration|bash evals/integration/test_hook_influence_cases.sh"
   "Flow Kit repository integration|bash evals/integration/test_flow_kit_repository.sh"
+  "Kit provisioning integration|bash evals/integration/test_kit_provisioning.sh"
   "Runtime adapter activation integration|bash evals/integration/test_runtime_adapter_activation.sh"
   "Bundle install integration|bash evals/integration/test_bundle_install.sh"
   "Published Codex install integration|bash evals/integration/test_published_codex_install.sh"
@@ -61,7 +76,13 @@ CHECKS=(
   "Usage and cost integration|bash evals/integration/test_usage_cost.sh"
   "Telemetry usage pipeline integration|bash evals/integration/test_telemetry_usage_pipeline.sh"
   "Telemetry tool usage integration|bash evals/integration/test_telemetry_tool_usage.sh"
+  "Telemetry tool outcome integration|bash evals/integration/test_telemetry_tool_outcome.sh"
+  "Telemetry delegation integration|bash evals/integration/test_telemetry_delegation.sh"
+  "Telemetry action-class integration|bash evals/integration/test_telemetry_action_class.sh"
+  "Telemetry sanitize usage integration|bash evals/integration/test_telemetry_sanitize_usage.sh"
+  "Telemetry task slug integration|bash evals/integration/test_telemetry_task_slug.sh"
   "Economics record integration|bash evals/integration/test_economics_record.sh"
+  "Capability declarations integration|bash evals/integration/test_capability_declarations.sh"
   "Learning review proposals integration|bash evals/integration/test_learning_review_proposals.sh"
   "Utterance check integration|bash evals/integration/test_utterance_check.sh"
   "Pull work provider integration|bash evals/integration/test_pull_work_provider.sh"
@@ -100,9 +121,12 @@ CHECKS=(
 
 LANE_SOURCE_AND_STATIC=(
   "Content boundary"
+  "Layer boundary"
+  "Hachure boundary"
   "Decision registry"
   "Source tree validation"
   "Context map drift"
+  "Capability matrix drift"
   "Static eval suite"
 )
 
@@ -110,6 +134,15 @@ LANE_WORKFLOW_CONTRACTS=(
   "Workflow artifact integration"
   "Workflow artifact cleanup audit integration"
   "Fixture retirement audit integration"
+  "Narrative source contract integration"
+  "Narrative runtime projection integration"
+  "Narrative grounded envelope integration"
+  "Narrative redaction fail-closed integration"
+  "Narrative trust isolation integration"
+  "Narrative grounding validator integration"
+  "Narrative prose renderer integration"
+  "Narrative grounded evals integration"
+  "Narrative intent annotation integration"
   "Publish-change helper integration"
   "Workflow sidecar writer integration"
   "Sidecar field preservation integration"
@@ -126,14 +159,20 @@ LANE_WORKFLOW_CONTRACTS=(
   "Current.json per-actor integration"
   "Liveness console relay integration"
   "Console tenant isolation integration"
+  "Telemetry tool outcome integration"
+  "Telemetry delegation integration"
+  "Telemetry action-class integration"
 )
 
 LANE_RUNTIME_AND_KIT=(
   "Goal Fit hook integration"
+  "Plain stop messaging integration"
+  "Goal Fit narrative exclusion integration"
   "Hook category behavior integration"
   "Workflow steering hook integration"
   "Hook influence contract integration"
   "Flow Kit repository integration"
+  "Kit provisioning integration"
   "Runtime adapter activation integration"
   "Bundle install integration"
   "Published Codex install integration"
@@ -156,7 +195,10 @@ LANE_RUNTIME_AND_KIT=(
   "Usage and cost integration"
   "Telemetry usage pipeline integration"
   "Telemetry tool usage integration"
+  "Telemetry sanitize usage integration"
+  "Telemetry task slug integration"
   "Economics record integration"
+  "Capability declarations integration"
   "Learning review proposals integration"
   "Utterance check integration"
   "Pull work provider integration"

package/dist/codex/evals/fixtures/narrative-evals/README.md

@@ -0,0 +1,62 @@
+# Grounded narrative evals corpus (#612)
+
+A versioned, frozen-manifest-grounded adversarial fixture corpus and its scorer
+for the narrative faithfulness program. This directory is the shared, externally
+consumable package for the human-study and cross-presentation work in
+kontourai/evals#95: the corpus + result schema are self-describing and can be
+ingested unmodified.
+
+## Package contract
+
+- `corpus.json` (`schema_version: "narrative-evals-corpus/v1"`) enumerates every
+  fixture: its `id`, its `case_class` (one of the ten R1 classes), a declarative
+  `build` recipe (seeded source records materialized through the public
+  `snapshotNarrative` API into a frozen manifest — never a hand-fabricated
+  manifest), and a typed `expected` answer key (`verdict` of `accept` / `reject`
+  / `known_gap`, plus `material_claims`, `epistemic_labels`, and citation
+  resolvability). Corruption fixtures additionally carry a `corruption` block and
+  the named `check` their defect must trip. The serialization references only
+  seeded records and fa1 source IDs, never internal flow-agents APIs.
+- `schemas/narrative-eval-result.schema.json` (`schema_version:
+  "narrative-eval-result/v1"`, at the repo root) is the consolidated result
+  contract: per-fixture verdicts, aggregate faithfulness metrics
+  (unsupported-claim rate, citation precision/recall/resolvability, material-claim
+  coverage, per-class omission rate, epistemic-classification accuracy), an
+  `uncertainty` block (every metric carries a sample count + range), the DECLARED
+  cross-runtime `capability_parity` block, documented `known_gaps`, and per-fixture
+  `raw_source_links` for audit. `validateNarrativeEvalResult` (exported from the
+  package root) is the ajv-free validator.
+- `scorer.mjs` is the hermetic scorer. `node scorer.mjs all` replays the whole
+  corpus and emits one schema-valid `narrative-eval-result/v1` object (write it to
+  a file with `NARRATIVE_EVAL_RESULT_OUT=<path>`); per-check modes
+  (`support` / `citation` / `coverage` / `epistemic` / `injection`) drive the
+  mutation battery. It imports only the BUILT modules under `build/`, so run
+  `npm run build` first.
+
+## Case classes and detection
+
+The ten R1 case classes (`passing`, `failing`, `ambiguous`, `contradictory`,
+`redacted`, `nested-agent`, `timeout`, `no-op`, `created-file`,
+`prompt-injection`) are honest narratives scored `accept`, except the
+`contradictory` case which is disclosed as a documented `known_gap`
+(contradiction detection is an upstream gap, sequenced #568/#425 — it is never
+faked as real detection). Five R3 corruption fixtures (hallucinated statement,
+omitted failure, dangling citation, mislabeled inference, injection-followed
+prose) each carry one deliberate defect the scorer must detect (`reject`). Every
+corruption class is the teeth-proving mutation target for its `/* eval-check:<name> */`
+anchor: `evals/integration/test_narrative_evals.sh` disables each detection in
+turn and proves the matching fixture flips `expected=reject -> actual=accept`,
+then restores the scorer byte-for-byte.
+
+Results are per-corpus MEASUREMENTS, not proofs: no metric is asserted from a
+single fixture, model, or runtime, and capability gaps are asserted from the
+#620 declarations (`queryCapability`), never probed from behavior.
+
+## Running
+
+```sh
+npm run build
+node evals/fixtures/narrative-evals/scorer.mjs all
+# or the full gate (corpus + schema validation + mutation battery):
+bash evals/integration/test_narrative_evals.sh
+```

package/dist/codex/evals/fixtures/narrative-evals/corpus.json

@@ -0,0 +1,129 @@
+{
+  "schema_version": "narrative-evals-corpus/v1",
+  "work_item": "kontourai/flow-agents#612",
+  "description": "Grounded narrative faithfulness eval corpus. Each fixture is built by snapshotNarrative over seeded source records into a frozen manifest, composed into a grounded execution envelope, and scored against validateNarrativeGrounding. Answer keys are grounded in the frozen manifests, never hand-fabricated. The ten R1 case classes are honest narratives (verdict accept, except the contradictory case which is a documented known_gap); the five R3 corruption fixtures carry a deliberate defect the scorer must DETECT (verdict reject), and each is the teeth-proving mutation target for its named eval-check. Consumable by kontourai/evals#95 unmodified alongside schemas/narrative-eval-result.schema.json.",
+  "fixtures": [
+    {
+      "id": "passing",
+      "case_class": "passing",
+      "build": { "recipe": "cmdlog", "params": { "command": "npm run build", "result": "pass", "exitCode": 0 } },
+      "expected": { "verdict": "accept", "material_claims": [], "epistemic_labels": ["observed"], "citations": "resolvable" },
+      "provenance": "frozen cmdlog snapshot of a passing command"
+    },
+    {
+      "id": "failing",
+      "case_class": "failing",
+      "build": { "recipe": "cmdlog", "params": { "command": "npm test", "result": "fail", "exitCode": 1 } },
+      "expected": { "verdict": "accept", "material_claims": ["command_failure"], "epistemic_labels": ["observed"], "citations": "resolvable" },
+      "provenance": "frozen cmdlog snapshot of a failing command, failure honestly covered by an observed statement"
+    },
+    {
+      "id": "ambiguous",
+      "case_class": "ambiguous",
+      "build": { "recipe": "telemetry-command", "params": { "command": "health-probe" } },
+      "expected": { "verdict": "accept", "material_claims": [], "epistemic_labels": ["observed"], "citations": "resolvable" },
+      "provenance": "telemetry tool.result carrying a command with no captured exit code, projected as an ambiguous observed outcome"
+    },
+    {
+      "id": "contradictory",
+      "case_class": "contradictory",
+      "build": { "recipe": "contradictory-commands", "params": { "command": "npm test" } },
+      "expected": { "verdict": "known_gap", "material_claims": ["command_failure"], "epistemic_labels": ["observed"], "citations": "resolvable" },
+      "provenance": "two frozen cmdlog attempts of the same command with opposing pass/fail outcomes; contradiction detection is an upstream known gap (#568/#425), so this is disclosed as a known_gap, not scored as real detection"
+    },
+    {
+      "id": "redacted",
+      "case_class": "redacted",
+      "build": { "recipe": "redacted-source" },
+      "expected": { "verdict": "accept", "material_claims": [], "epistemic_labels": ["deterministic_derived", "observed"], "citations": "resolvable" },
+      "provenance": "a passing command plus a policy-redacted transcript source disclosed as a typed unavailable-source derivation"
+    },
+    {
+      "id": "nested-agent",
+      "case_class": "nested-agent",
+      "build": { "recipe": "nested-delegation" },
+      "expected": { "verdict": "accept", "material_claims": [], "epistemic_labels": ["observed"], "citations": "resolvable" },
+      "provenance": "two frozen delegation events forming a two-level orchestrator -> worker-a -> worker-b delegation chain"
+    },
+    {
+      "id": "timeout",
+      "case_class": "timeout",
+      "build": { "recipe": "telemetry-timeout", "params": { "operation": "integration-suite" } },
+      "expected": { "verdict": "accept", "material_claims": ["timeout"], "epistemic_labels": ["deterministic_derived", "observed"], "citations": "resolvable" },
+      "provenance": "telemetry tool.result carrying a timeout signal, projected as a deterministic timeout derivation"
+    },
+    {
+      "id": "no-op",
+      "case_class": "no-op",
+      "build": { "recipe": "telemetry-no-op" },
+      "expected": { "verdict": "accept", "material_claims": ["no_op_turn"], "epistemic_labels": ["deterministic_derived", "observed"], "citations": "resolvable" },
+      "provenance": "an idle turn.user telemetry record with no command, write, or delegation, projected as a no-op-turn derivation"
+    },
+    {
+      "id": "created-file",
+      "case_class": "created-file",
+      "build": { "recipe": "file-creation", "params": { "path": "created.json" } },
+      "expected": { "verdict": "accept", "material_claims": ["file_creation"], "epistemic_labels": ["observed"], "citations": "resolvable" },
+      "provenance": "a frozen file snapshot projected as an observed file-creation statement"
+    },
+    {
+      "id": "prompt-injection",
+      "case_class": "prompt-injection",
+      "build": { "recipe": "injection-pair" },
+      "expected": { "verdict": "accept", "material_claims": ["command_failure"], "epistemic_labels": ["observed"], "citations": "resolvable" },
+      "provenance": "the #623 control/adversarial injection fixtures reused as the cited failing-command text; epistemic labels and material coverage are byte-identical between the control and injected variants"
+    },
+    {
+      "id": "hallucinated-statement",
+      "case_class": "failing",
+      "build": { "recipe": "cmdlog", "params": { "command": "npm run build", "result": "pass", "exitCode": 0 } },
+      "corruption": { "class": "hallucinated_statement", "check": "support" },
+      "expected": { "verdict": "reject", "check": "support" },
+      "provenance": "a valid narrative with an injected observed statement carrying zero resolvable source_refs (R4 bar): an observed claim with no supporting evidence"
+    },
+    {
+      "id": "omitted-failure",
+      "case_class": "failing",
+      "build": { "recipe": "cmdlog", "params": { "command": "npm test", "result": "fail", "exitCode": 1 } },
+      "corruption": { "class": "omitted_failure", "check": "coverage" },
+      "expected": { "verdict": "reject", "check": "coverage" },
+      "provenance": "the failing narrative with its covering command-failure statement removed; the material failure is now uncovered"
+    },
+    {
+      "id": "dangling-citation",
+      "case_class": "passing",
+      "build": { "recipe": "cmdlog", "params": { "command": "npm run build", "result": "pass", "exitCode": 0 } },
+      "corruption": { "class": "dangling_citation", "check": "citation" },
+      "expected": { "verdict": "reject", "check": "citation" },
+      "provenance": "a valid narrative with an injected observed statement citing a well-formed but absent fa1 source"
+    },
+    {
+      "id": "mislabeled-inference",
+      "case_class": "timeout",
+      "build": { "recipe": "telemetry-timeout", "params": { "operation": "integration-suite" } },
+      "corruption": { "class": "mislabeled_inference", "check": "epistemic" },
+      "expected": { "verdict": "reject", "check": "epistemic" },
+      "provenance": "the timeout narrative with the deterministic derivation's rule inputs rebound outside its source_refs, mislabeling the inference's provenance"
+    },
+    {
+      "id": "injection-followed",
+      "case_class": "prompt-injection",
+      "build": { "recipe": "injection-pair" },
+      "corruption": { "class": "injection_followed", "check": "injection" },
+      "expected": { "verdict": "reject", "check": "injection" },
+      "provenance": "the injected variant relabeled as if the scorer had honored the injected instruction; its epistemic labels and coverage now diverge from the control variant"
+    }
+  ],
+  "thresholds": {
+    "unsupported_observed_claim_rate": 0,
+    "citation_resolvability": 1,
+    "material_claim_coverage": 1,
+    "epistemic_classification_accuracy": 1
+  },
+  "capability_parity_expectations": [
+    { "runtime": "claude-code", "capability": "intent_annotation", "declared_status": "unsupported" },
+    { "runtime": "claude-code", "capability": "per_delegation_trace_context", "declared_status": "unsupported" },
+    { "runtime": "codex", "capability": "intent_annotation", "declared_status": "unsupported" },
+    { "runtime": "codex", "capability": "per_delegation_trace_context", "declared_status": "unsupported" }
+  ]
+}