@kontourai/flow-agents 3.2.0 → 3.3.0

package/docs/decisions/trust-reconcile.md

@@ -1,20 +1,53 @@
 ---
-status: needs-decision
+status: current
 subject: Trust-reconcile and delivery reconciliation
-decided: 2026-07-03
+decided: 2026-07-04
 evidence:
   - kind: adr
     ref: docs/adr/0020-trust-reconcile-manifest-and-claim-classification.md
   - kind: adr
     ref: docs/adr/0022-fail-closed-delivery-reconciliation-with-governed-exemptions.md
+  - kind: doc
+    ref: docs/coordination-guide.md
 ---
 # Trust-reconcile and delivery reconciliation
 
-This subject has provenance in frozen ADR history ([0020-trust-reconcile-manifest-and-claim-classification.md](../adr/0020-trust-reconcile-manifest-and-claim-classification.md), [0022-fail-closed-delivery-reconciliation-with-governed-exemptions.md](../adr/0022-fail-closed-delivery-reconciliation-with-governed-exemptions.md)) but no living
-decision has been ratified yet under the topic-keyed decision registry
-(`context/contracts/decision-registry-contract.md`). This stub records that the
-subject is open and links the frozen ADR(s) as provenance; it is not a decision.
+**Decision.** Delivery is **fail-closed with governed exemptions**. `publishDelivery()` passes a
+bundle through three distinct, type-discriminated tiers — fail-soft (absent bundle tolerated) →
+shape gate (`InvalidBundleShapeError`, #356) → hold gate (`NotFreshHolderError`, #293) — and CI's
+reconcile is fail-closed by default (`onUnderivable: 'fail'`). A local `reconcile-preflight`
+mirrors CI's shape check via the *shared* `scripts/lib/reconcile-shape.js` so the two cannot
+drift. Concurrent deliveries are isolated by **per-session paths** (`delivery/<slug>/`, #379), and
+a checkpoint's `commit_sha` must be an ancestor of HEAD (seal-at-parent) so a stale bundle can't be
+replayed onto a moved branch. See the [coordination guide](../coordination-guide.md#how-delivery-itself-is-made-tamper-resistant).
 
-When a living decision is ratified for Trust-reconcile and delivery reconciliation, update this
-file's `status` to `current`, add rationale, and keep the `adr` evidence
-links as provenance for the history that led here.
+**Rationale.** The default must be safe: an underivable status fails the run rather than passing
+it, and a hard block on the shared publish path is applied only on high-confidence signals so it
+never false-blocks legitimate work. The frozen ADRs ([0020](../adr/0020-trust-reconcile-manifest-and-claim-classification.md),
+[0022](../adr/0022-fail-closed-delivery-reconciliation-with-governed-exemptions.md)) hold the
+immutable rationale.
+
+## Implementation note (#356, iteration 1)
+
+A local, pre-push `reconcile-preflight` now exists (`workflow-sidecar reconcile-preflight
+<artifact-dir>`), reusing — never forking — the shape-classification logic CI's
+`scripts/ci/trust-reconcile.js` enforces via the shared `scripts/lib/reconcile-shape.js`
+module. `publishDelivery()` is itself fail-closed on shape-invalidity: it calls the same
+preflight before copying anything into `delivery/`, and refuses to publish a bundle that
+fails the shape check.
+
+The reduced-coverage degradation (trusting a session-local claim's self-reported status when
+CI-side re-derivation is unavailable) is a **LOCAL-preflight-only** opt-in
+(`sessionLocalShapeIssues(..., { onUnderivable: 'reduce' })`). CI's `trust-reconcile.js`
+always calls the shared function with `{ onUnderivable: 'fail' }` (also the function's
+default when no mode is given) and remains fail-closed: when status re-derivation is
+unavailable, every session-local pass-asserting claim becomes a `status-underivable`
+divergence and the run fails, exactly as before the shape logic was extracted.
+
+## Implementation note (#379, per-session delivery paths)
+
+Concurrent deliveries no longer contend on a shared `delivery/trust.bundle`. Each session writes
+its bundle under `delivery/<slug>/`; CI selects prefer-newest. Publishing must **restore sibling
+`delivery/<slug>/` directories** from `origin/main` before committing — after a soft-reset,
+`git add -A` would otherwise stage the deletion of other sessions' delivery dirs that the branch
+predates. This is the standard step in the publish sequence documented in the coordination guide.

package/docs/fixture-ownership.md

@@ -22,9 +22,10 @@ run `npm run validate:source --` and `npm run fixture:retirement-audit --`.
 | `evals/fixtures/hook-influence` | hook influence behavioral cases | `evals/integration/test_hook_influence_cases.sh`, `evals/static/test_workflow_skills.sh`, `scripts/validate-hook-influence-cases.js` | Keep while hook influence cases define agent guidance behavior. |
 | `evals/fixtures/pull-work-provider` | work item provider normalization fixtures | `evals/integration/test_pull_work_provider.sh` | Keep while provider normalization preserves blockers, artifact refs, board membership, and freshness metadata. |
 | `evals/fixtures/pull-work-wip-shepherding` | WIP shepherding state fixtures | `evals/static/test_workflow_skills.sh` | Keep while pull-work documents personal versus global WIP behavior. |
+| `evals/fixtures/reconcile-preflight` | #356 reconcile-preflight shape fixtures not already covered by trust-reconcile-exploits (un-superseded disputed critique, standalone disputed session-local claim) | `evals/integration/test_reconcile_preflight.sh` | Keep while the local `reconcile-preflight` subcommand (#356) is proven against the two shapes trust-reconcile-exploits does not already fixture (un-superseded disputed critique, standalone disputed session-local claim); the other four shapes reuse trust-reconcile-exploits/trust-reconcile-mixed-bundle directly rather than forking near-duplicates. |
 | `evals/fixtures/surface-trust` | Surface trust evidence fixtures | `evals/integration/test_workflow_sidecar_writer.sh` | Keep while sidecar writer maps Surface trust evidence into workflow records. |
-| `evals/fixtures/trust-reconcile-exploits` | WS8 trust-reconcile anti-gaming exploit fixtures (frozen negative regressions) | `evals/integration/test_trust_reconcile_negatives.sh` | Keep while trust-reconcile.js enforces the WS8 iteration-2 soundness properties (no-label test_output, unwaived-assumed, status-misassertion, waiver-on-command); each fixture is a permanent negative regression. |
-| `evals/fixtures/trust-reconcile-mixed-bundle` | WS8 trust-reconcile mixed-evidence end-to-end proof fixture | `evals/integration/test_trust_reconcile_mixed_bundle.sh` | Keep while the trust-reconcile manifest/classification/waiver contract (ADR 0020) is enforced; proves a mixed test_output + session-local + waived bundle passes the CI anchor. |
+| `evals/fixtures/trust-reconcile-exploits` | WS8 trust-reconcile anti-gaming exploit fixtures (frozen negative regressions); also reused by the #356 local reconcile-preflight eval (same shapes, no forked copies) | `evals/integration/test_trust_reconcile_negatives.sh`, `evals/integration/test_reconcile_preflight.sh` | Keep while trust-reconcile.js enforces the WS8 iteration-2 soundness properties (no-label test_output, unwaived-assumed, status-misassertion, waiver-on-command); each fixture is a permanent negative regression. |
+| `evals/fixtures/trust-reconcile-mixed-bundle` | WS8 trust-reconcile mixed-evidence end-to-end proof fixture; also reused by the #356 reconcile-preflight eval as its CLEAN-BUNDLE (AC4) case | `evals/integration/test_trust_reconcile_mixed_bundle.sh`, `evals/integration/test_reconcile_preflight.sh` | Keep while the trust-reconcile manifest/classification/waiver contract (ADR 0020) is enforced; proves a mixed test_output + session-local + waived bundle passes the CI anchor. |
 | `evals/fixtures/trust-reconcile-ws3` | WS8 AC6 backward-compat fixture: real ws3-kit-dependencies-namespacing old-style bundle | `evals/integration/test_trust_reconcile_negatives.sh` | Keep while backward compatibility with pre-classification (all-test_output) bundles is asserted; proves an old-style bundle still FAILS the same way (no silent pass). |
 | `evals/fixtures/usage-feedback` | usage feedback import/outcome fixtures | `evals/integration/test_usage_feedback_import.sh`, `evals/integration/test_usage_feedback_outcomes.sh`, `evals/integration/test_usage_feedback_report.sh` | Keep while usage feedback import, outcome, and report flows accept JSONL fixture input. |
 | `evals/fixtures/veritas-governance-adapter` | Veritas governance adapter fixtures | `evals/integration/test_veritas_governance_adapter.sh` | Keep while the Veritas adapter supports pass, unconfigured, and secret-failure governance paths. |

package/docs/index.md

@@ -118,6 +118,10 @@ Use fix-bug. Reproduce the problem, diagnose root cause, implement the fix, and
     <strong>System Guidebook</strong>
     <span>The plain-language map of how Flow Agents is assembled and how it should feel to use.</span>
   </a>
+  <a class="doc-card" href="coordination-guide.html">
+    <strong>Parallel-Session Coordination</strong>
+    <span>Run many sessions against one repo without collisions: the two-stream model (liveness + assignment), the four guard points, the one hard publish fence, and how delivery defends itself.</span>
+  </a>
   <a class="doc-card" href="skills-map.html">
     <strong>Workflow Map</strong>
     <span>See the core skills, gates, artifacts, and route-back behavior.</span>

package/docs/integrations/flow-agents-console.md

@@ -0,0 +1,108 @@
+---
+title: Flow Agents × Kontour Console
+---
+
+# Flow Agents × Kontour Console
+
+Flow Agents' [coordination substrate](../coordination-guide.md) is **local-first and complete on a
+single machine** — the local liveness stream plus the GitHub `AssignmentProvider` give you full
+parallel-session safety with no server. The **Kontour Console** (`console.kontourai.io`) is the
+**optional fleet tier** layered on top: it never becomes the authority for coordination; it *relays,
+projects, and eventually arbitrates* across machines and teammates.
+
+> This is the design boundary, stated plainly: **single-machine parallelism is fully unlocked
+> locally, for free.** Multi-machine fleets, cross-teammate visibility, human oversight, history, and
+> team-level insight are what the hosted tier adds — and sells. See [ADR 0021 §7](../adr/0021-assignment-leases-and-stale-claim-takeover.md)
+> for the ratifying decision.
+
+**Tracking:** flow-agents epic [#394](https://github.com/kontourai/flow-agents/issues/394) · console
+epic [#123](https://github.com/kontourai/console/issues/123). This doc is the in-repo narrative; the
+issues carry live slice status.
+
+---
+
+## What the Console already is
+
+The Console is a Node/TypeScript monorepo (`console-core` / `console-server` / `console-ui`), backed
+by Postgres (Neon), deployed on Render, running the dogfood instance at `console.kontourai.io`. It
+already ingests and projects agent telemetry:
+
+- **Ingest** — `POST /records` accepts telemetry records; auth via `Bearer` / `X-Console-API-Token`
+  plus `X-Console-Tenant-Id` (tokens configured through `CONSOLE_AUTH_TOKENS_JSON`).
+- **Projection** — `GET /state` returns an `OperatingState` projection; **SSE** streams live updates.
+- **Economics** — per-session cost/usage views (console #117) and an org-scoped registry (#118).
+
+Its multi-tenancy today is **strong at the infrastructure layer** (Postgres primary keys per tenant,
+per-tenant hubs and SSE fan-out) but **weak at the schema layer**: records don't self-identify their
+tenant — tenancy is carried by the request header, not the record body. Closing that gap is part of
+this epic (see *Tenant hardening* below).
+
+## The design invariant: relay, never authority
+
+Two rules keep the Console from compromising the local-first guarantee:
+
+1. **Heartbeats are never written to a provider.** They mirror to the Console relay (the one vantage
+   with global heartbeat visibility) but never to GitHub — rate-limit abuse for no benefit. At most a
+   claim comment refreshes on phase transitions, doubling as board-level progress.
+2. **The advisory stream stays advisory.** The Console projects the same liveness/assignment signals
+   the local substrate computes; in Phase 1 it adds *visibility*, not new authority. Only in Phase 2,
+   opt-in, does a Console-backed `AssignmentProvider` make assignment authoritative across machines —
+   and even then it implements the exact same contract the GitHub/local providers do.
+
+## The phased plan (one epic, two phases)
+
+### Phase 1 — read-only fleet insight (the relay)
+
+Turn per-repo coordination into a team-wide view, without changing where authority lives.
+
+| Slice | Repo | What it does |
+| --- | --- | --- |
+| **ApiSink** ([console #73]) | console | The ingest substrate the relay rides on — the prerequisite. |
+| **Liveness relay** (flow-agents [#295]) | flow-agents | An optional sink: sessions mirror `claim`/`heartbeat`/`release` events to the Console, reusing its idempotent ingest + tenant auth + SSE. Off by default; strictly additive. |
+| **Fleet projection** | console | Active actors, `held`/`reclaimable` subjects, and per-session cost, projected per tenant — the fleet view. |
+| **In-hub janitor** | console | The [coordination janitor](../coordination-guide.md#10-takeover-protocol-forthcoming--294) run centrally: the Console is the one vantage with global heartbeat visibility, so stale-claim reaping for a *fleet* is its natural first cross-machine duty. (Decision: the janitor lives **in the console hub**, not per-client.) |
+
+Phase 1 delivers the "see everyone's active sessions, and your own usage in team context" outcome —
+project/team insight views alongside individual ones — while coordination authority stays exactly
+where it is today (local + GitHub).
+
+### Phase 2 — authoritative fleet coordination
+
+Opt-in, for teams that want cross-machine assignment arbitration:
+
+- **Console `AssignmentProvider`** — a third implementation of the [assignment-provider contract](https://github.com/kontourai/flow-agents/blob/main/context/contracts/assignment-provider-contract.md),
+  making assignment authoritative across machines (not just within one repo's GitHub board). Same
+  `claim`/`release`/`supersede`/`status`/`list` operations; same effective-state join. This is also
+  what lets [verify-hold](../coordination-guide.md#8-guard-point-3--the-verify-hold-publish-gate-the-one-hard-fence)
+  enforce against a *fleet-wide* holder, not just a local one.
+- **Tenant hardening** (console #98–#100) — close the schema-level gap: put an **explicit `tenant_id`
+  on records** (decision) so tenancy is self-describing in the body, not only in the request header,
+  hardening the phased auth model end-to-end.
+- **Native init step** — `flow-agents init` gains a first-class, optional Console-integration step:
+  configure the relay sink, tenant, and (Phase 2) the Console provider at install time, so joining a
+  fleet is a setup choice rather than manual wiring.
+
+## How CI fits (paired with #398)
+
+The [CI-runtime actor identity tier (#398)](https://github.com/kontourai/flow-agents/issues/398) makes
+CI sessions carry a **stable identity** (e.g. `github-actions:<run-id>` plus `GITHUB_ACTOR`/repo/SHA).
+That has two payoffs here: the [verify-hold gate](../coordination-guide.md#1-the-actor-model--who-am-i)
+upgrades from *advisory* to *enforcing* in CI, and CI becomes an **attributable participant** in the
+fleet — its records land in the same Console projections, so team/project/individual insight views
+include automated work, not just interactive sessions. #398 is the keystone that makes the Console
+fleet view whole.
+
+## Dogfooding
+
+`console.kontourai.io` runs from the `console` repo; the deployment lives in `console-deploy` (the
+dogfood instance). Flow Agents development itself is intended to run against it — the fleet view of our
+own parallel Builder sessions is both the first real test and the first sales demo of the tier.
+
+---
+
+## Status
+
+Designed and ratified ([ADR 0021 §7](../adr/0021-assignment-leases-and-stale-claim-takeover.md)); the
+local substrate it builds on is complete (see the [coordination guide](../coordination-guide.md)). Phase
+1 begins with console #73 (ApiSink) → flow-agents #295 (relay). This is forward-looking: no Console
+integration ships in the coordination substrate itself — it is strictly the optional tier above it.

package/docs/integrations/index.md

@@ -49,6 +49,10 @@ The <a href="../spec/runtime-hook-surface.html">Runtime Hook Surface spec</a> de
     <strong>Knowledge Kit Live Example</strong>
     <span>End-to-end proof of the Knowledge Kit ingest + compile flows against a real Strands agent (OllamaModel / qwen3:1.7b). No API key required. Includes acceptance test with telemetry and provenance assertions.</span>
   </a>
+  <a class="doc-card" href="flow-agents-console.html">
+    <strong>Flow Agents × Console</strong>
+    <span>The optional fleet tier over the local coordination substrate: a liveness relay, team/project insight views, an in-hub janitor, and (Phase 2) a Console-backed AssignmentProvider. Local-first stands; the Console never becomes the authority.</span>
+  </a>
 </div>
 
 ---

package/docs/workflow-artifact-lifecycle.md

@@ -19,10 +19,47 @@ npm run workflow-artifact-cleanup-audit -- --artifact-root .flow-agents --json
 
 The default root for local runtime artifacts is `.kontourai/flow-agents`. `.flow-agents` may hold explicit durable Flow Agents config/install state, but it is not a runtime fallback. Move old local sessions with the migration script instead of relying on automatic fallback reads.
 
-The command scans immediate workflow directories, skips non-workflow lanes such as `archive/`, and reports active WIP separately from cleanup candidates, terminal done records, active learning follow-ups, and invalid sidecars. This first slice is dry-run classification only: it does not delete, archive, move, or rewrite runtime artifacts by default, and it has no apply mode.
+The command scans immediate workflow directories, skips non-workflow lanes such as `archive/`, and reports active WIP separately from cleanup candidates, terminal done records, active learning follow-ups, and invalid sidecars.
 
 Use the Current-State Semantics and Local Retention Policy sections below to interpret each bucket. In particular, learning records with `learning.status: followup_required` or any `routing[].status: open` remain active learning follow-ups until every route is completed, opened elsewhere, deferred with a trigger, accepted, or rejected.
 
+## Apply Mode
+
+Dry-run classification is the default and remains a zero-side-effect, read-only pass. Pass `--apply` to actually archive-move the sessions the classifier already puts in `cleanup_candidate` (and aged `terminal_done` sessions past the retention window) out of the active listing:
+
+```bash
+# Dry-run (unchanged; still the default with no flags)
+npm run workflow-artifact-cleanup-audit -- --artifact-root .kontourai/flow-agents
+
+# Archive-move cleanup_candidate / aged terminal_done sessions
+npm run workflow-artifact-cleanup-audit -- --artifact-root .kontourai/flow-agents --apply
+
+# Also archive-move lifecycle-ambiguous and genuinely-stub invalid sessions (second gate)
+npm run workflow-artifact-cleanup-audit -- --artifact-root .kontourai/flow-agents --apply --apply-ambiguous
+
+# Custom retention window and destination
+npm run workflow-artifact-cleanup-audit -- --artifact-root .kontourai/flow-agents \
+  --apply --freshness-window-hours 72 --archive-root /path/to/archive
+```
+
+**Two-gate model.** `--apply` alone only ever moves `cleanup_candidate` sessions and aged `terminal_done` sessions (the same buckets the manual Session Archival Policy procedure in `context/contracts/artifact-contract.md` already selects by hand) — it never touches anything the classifier calls `active_wip`, `active_learning_followup`, or `invalid`. A session the classifier marks `invalid` with an "unrecognized lifecycle shape" reason (a delivered/accepted session whose shape doesn't fit a known terminal pattern, but is otherwise a real, substantive record) is reported separately as **ambiguous** and is moved only when `--apply-ambiguous` is *also* passed — this is a deliberate second opt-in, not a default, because confirming that kind of straggler is genuinely done (e.g. its referenced PR actually merged) is a human/flow judgment call this tool does not make for you (see `--confirm` below).
+
+**Safety rails.** Regardless of flags, `--apply`/`--apply-ambiguous` never touch:
+
+1. **Active work** — `active_wip` and `active_learning_followup` sessions are hard-excluded; no flag combination overrides this.
+2. **A session someone else is holding** — if the local liveness stream shows a fresh claim on a session's slug (any actor, not just the current one), that session is skipped and reported as blocked by a held liveness claim, even if the classifier would otherwise archive it.
+3. **Anything too recent** — a session newer than the freshness window (`--freshness-window-hours`, default 48) is never moved, using `state.json`'s `updated_at` as the primary signal; directory modification time is used only as a fallback when `state.json` is missing or unparsable, never preferred over `updated_at` when it is present (bulk worktree operations can reset file mtimes without touching the actual session content, so mtime alone is not a trustworthy freshness signal).
+4. **Infrastructure directories** — per-agent claim/assignment tracking, the runtime adapter's generated output, the skills catalog, and similar structural directories are recognized by their own shape (they carry their own top-level pointer/lock files, i.e. they are themselves a workflow-sidecar-managed root, not a session) and are never treated as sessions to begin with, so a nested runtime tree with real sub-sessions of its own is never flattened into a single misclassified entry or partially swept.
+5. **Substantive sessions with a schema nit** — an `invalid` session that actually has real `state.json` plus `learning.json` and/or `trust.bundle` content is always report-only, even under `--apply --apply-ambiguous`; only a genuinely empty/stub `invalid` directory (no state at all, or state with no sidecar content) is ever eligible for the ambiguous-archive path.
+
+**Never delete.** Every move is an archive-move (rename, or copy-then-verify-then-remove-source when a plain rename can't cross filesystems) — the tool has no delete capability of any kind, in any mode.
+
+**Where things land.** `--apply` moves matching sessions to `<archive-root>/<date>-<runid>/<slug>/`, where `--archive-root` defaults to a sibling `.kontourai/flow-agents-archive/` next to the artifact root. This is a deliberately *different* destination from the manual, in-tree `<artifact-root>/archive/<slug>/` convention the Session Archival Policy section of `context/contracts/artifact-contract.md` documents for hand-driven moves: giving every automated `--apply` invocation its own dated, run-scoped directory means two same-day runs never collide, and it keeps the artifact root's own scan set immutable while a run is in progress. A human archiving a session by hand may still use the in-tree `archive/<slug>/` path from that section; the two destinations serve the same retirement intent through different (manual vs. automated) procedures — this mode automates the `cleanup_candidate`/aged-`terminal_done` selection that section already specifies, it does not replace the manual path for everything else.
+
+**Manifest.** Any `--apply` run that moves at least one session writes `MANIFEST.md` into that run's archive directory, listing each moved session's slug, classification, last-updated timestamp, and the classifier's own reason text. A run that moves nothing writes no manifest and creates no new archive directory. `--confirm <slug>=<evidence>` (repeatable) lets the invoking human or flow record, verbatim, evidence they already independently gathered (for example, that a straggler's referenced PR is confirmed merged) into that slug's manifest row — a slug moved without a matching `--confirm` entry shows `"none recorded"` rather than a fabricated value. This tool makes no network or `gh` calls itself; it only records evidence it is told.
+
+This is the same procedure a 2026-07-05 live triage sweep of this repo's own `.kontourai/flow-agents/` tree ran by hand before `--apply` existed (see that sweep's own `MANIFEST.md` for the real cases — stale stubs, aged cleanup candidates, confirmed-merged-PR stragglers, and the infrastructure/schema-nit exclusions above) — the sweep's findings are what shaped the safety rails above; `--apply` automates exactly that already-proven procedure.
+
 ## Artifact Lanes
 
 Use one local non-durable lane under `.kontourai/flow-agents/`:

package/evals/ci/antigaming-suite.sh

@@ -35,6 +35,7 @@ TESTS=(
   "evals/integration/test_trust_reconcile_manifest.sh"
   "evals/integration/test_trust_reconcile_mixed_bundle.sh"
   "evals/integration/test_trust_reconcile_negatives.sh"
+  "evals/integration/test_reconcile_preflight.sh"
   "evals/integration/test_goal_fit_ghost_session.sh"
 )
 

package/evals/ci/run-baseline.sh

@@ -22,11 +22,14 @@ CHECKS=(
   "Workflow sidecar writer integration|bash evals/integration/test_workflow_sidecar_writer.sh"
   "Sidecar field preservation integration|bash evals/integration/test_sidecar_field_preservation.sh"
   "Actor identity resolver integration|bash evals/integration/test_actor_identity.sh"
+  "CI-runtime actor identity integration|bash evals/integration/test_ci_actor_identity.sh"
   "Assignment provider local-file integration|bash evals/integration/test_assignment_provider_local_file.sh"
   "Assignment provider github integration|bash evals/integration/test_assignment_provider_github.sh"
   "Stop hook release-with-handoff integration|bash evals/integration/test_stop_hook_release.sh"
   "Pull work assignment join integration|bash evals/integration/test_pull_work_assignment_join.sh"
   "Ensure-session ownership guard integration|bash evals/integration/test_ensure_session_ownership_guard.sh"
+  "Verify-hold gate integration|bash evals/integration/test_verify_hold.sh"
+  "Takeover protocol integration|bash evals/integration/test_takeover_protocol.sh"
   "Current.json per-actor integration|bash evals/integration/test_current_json_per_actor.sh"
   "Goal Fit hook integration|bash evals/integration/test_goal_fit_hook.sh"
   "Hook category behavior integration|bash evals/integration/test_hook_category_behaviors.sh"
@@ -78,11 +81,14 @@ LANE_WORKFLOW_CONTRACTS=(
   "Workflow sidecar writer integration"
   "Sidecar field preservation integration"
   "Actor identity resolver integration"
+  "CI-runtime actor identity integration"
   "Assignment provider local-file integration"
   "Assignment provider github integration"
   "Stop hook release-with-handoff integration"
   "Pull work assignment join integration"
   "Ensure-session ownership guard integration"
+  "Verify-hold gate integration"
+  "Takeover protocol integration"
   "Current.json per-actor integration"
 )
 

package/evals/fixtures/reconcile-preflight/disputed-critique-unsuperseded.json

@@ -0,0 +1,48 @@
+{
+  "schemaVersion": 5,
+  "source": "reconcile-preflight-fixture:disputed-critique-unsuperseded",
+  "note": "#356 shape 3: an un-superseded workflow.critique.review claim with a 'fail' verdict derives status 'disputed' — session-local-failed divergence (a disputed critique always blocks reconcile unless a later same-reviewer pass superseded it via metadata.superseded_by).",
+  "claims": [
+    {
+      "id": "c-disputed-critique",
+      "claimType": "workflow.critique.review",
+      "value": "fail",
+      "status": "disputed",
+      "subjectId": "reconcile-preflight-fixture/review-1",
+      "facet": "flow-agents.workflow",
+      "subjectType": "workflow-critique",
+      "fieldOrBehavior": "Found a critical security issue in the auth handler.",
+      "createdAt": "2026-07-04T00:00:00Z",
+      "updatedAt": "2026-07-04T00:00:00Z",
+      "impactLevel": "medium",
+      "verificationPolicyId": "policy:workflow.critique.review",
+      "metadata": { "origin": "critique", "reviewer": "tool-code-reviewer", "reviewed_at": "2026-07-04T00:00:00Z" }
+    }
+  ],
+  "evidence": [],
+  "policies": [
+    {
+      "id": "policy:workflow.critique.review",
+      "claimType": "workflow.critique.review",
+      "requiredEvidence": [],
+      "acceptanceCriteria": ["A verified verification event must support a workflow.critique.review claim."],
+      "reviewAuthority": "system",
+      "validityRule": { "kind": "manual" },
+      "stalenessTriggers": [],
+      "conflictRules": [],
+      "impactLevel": "medium"
+    }
+  ],
+  "events": [
+    {
+      "id": "evt-disputed-critique",
+      "claimId": "c-disputed-critique",
+      "status": "disputed",
+      "actor": "flow-agents/workflow-sidecar",
+      "method": "validation",
+      "evidenceIds": [],
+      "createdAt": "2026-07-04T00:00:00Z",
+      "verifiedAt": "2026-07-04T00:00:00Z"
+    }
+  ]
+}

package/evals/fixtures/reconcile-preflight/standalone-disputed-session-local.json

@@ -0,0 +1,59 @@
+{
+  "schemaVersion": 5,
+  "source": "reconcile-preflight-fixture:standalone-disputed-session-local",
+  "note": "#356 shape 4 (the #292/#384 variant): a NON-critique session-local claim (workflow.check.external, human_attestation-backed) with a re-derived status of 'disputed' and no waiver. Distinct from shape 3 (an un-superseded disputed CRITIQUE) only in claimType/subject — both land on the same session-local-failed divergence, proving a disjoint pre-existing failure can never be smuggled in as a standalone claim; the fix hint directs the agent to document it as prose in a waived non-command summary instead.",
+  "claims": [
+    {
+      "id": "c-standalone-disputed",
+      "claimType": "workflow.check.external",
+      "value": "fail",
+      "status": "disputed",
+      "subjectId": "reconcile-preflight-fixture/pre-existing-flaky-integration",
+      "facet": "flow-agents.workflow",
+      "subjectType": "workflow-check",
+      "fieldOrBehavior": "pre-existing integration test failure unrelated to this change",
+      "createdAt": "2026-07-04T00:00:00Z",
+      "updatedAt": "2026-07-04T00:00:00Z",
+      "impactLevel": "high",
+      "verificationPolicyId": "policy:workflow.check.external:human_attestation"
+    }
+  ],
+  "evidence": [
+    {
+      "id": "ev-standalone-disputed",
+      "claimId": "c-standalone-disputed",
+      "evidenceType": "human_attestation",
+      "method": "attestation",
+      "sourceRef": "reconcile-preflight-fixture/evidence.json",
+      "excerptOrSummary": "pre-existing integration test failure, unrelated to this change, observed but not fixed",
+      "observedAt": "2026-07-04T00:00:00Z",
+      "collectedBy": "flow-agents/workflow-sidecar",
+      "passing": false
+    }
+  ],
+  "policies": [
+    {
+      "id": "policy:workflow.check.external:human_attestation",
+      "claimType": "workflow.check.external",
+      "requiredEvidence": ["human_attestation"],
+      "acceptanceCriteria": ["A verified verification event must support a workflow.check.external claim."],
+      "reviewAuthority": "system",
+      "validityRule": { "kind": "manual" },
+      "stalenessTriggers": [],
+      "conflictRules": [],
+      "impactLevel": "high"
+    }
+  ],
+  "events": [
+    {
+      "id": "evt-standalone-disputed",
+      "claimId": "c-standalone-disputed",
+      "status": "disputed",
+      "actor": "flow-agents/workflow-sidecar",
+      "method": "attestation",
+      "evidenceIds": ["ev-standalone-disputed"],
+      "createdAt": "2026-07-04T00:00:00Z",
+      "verifiedAt": "2026-07-04T00:00:00Z"
+    }
+  ]
+}

package/evals/integration/test_checkpoint_signing.sh

@@ -278,14 +278,22 @@ flow_agents_node "$WRITER" init-plan "$SESSION_DIR2/${SLUG2}--deliver.md" \
   --source-request "Test" --summary "Test" \
   --timestamp "2026-06-26T11:01:00Z" >/dev/null 2>&1
 
+# #356: the check-json below carries a real "command" so its test_output evidence
+# has a manifest-matchable execution.label (evidence.execution.label) -- otherwise the new
+# reconcile-preflight gate inside publishDelivery() (#356 Wave 3, AC6) correctly refuses to
+# publish a "kind":"build" claim with test_output evidence but no captured command (a
+# genuinely shape-invalid claim CI's own trust-reconcile.js would ALSO reject -- this is not
+# a preflight-specific false positive, see reconcile-shape.js's finding-1 hardening).
+# TRUST_RECONCILE_COMMANDS makes "node --version" resolve via resolveManifest's legacy
+# fallback tier, matching what a real repo configured with that canonical verify would do.
 flow_agents_node "$WRITER" record-evidence "$SESSION_DIR2" \
   --verdict pass \
-  --check-json '{"id":"build","kind":"build","status":"pass","summary":"build passed"}' \
+  --check-json '{"id":"build","kind":"build","status":"pass","summary":"build passed","command":"node --version"}' \
   --timestamp "2026-06-26T11:02:00Z" >/dev/null 2>&1
 
 # advance-state to delivered: this is the other code path that seals the checkpoint
 SEAL_EXIT=0
-flow_agents_node "$WRITER" advance-state "$SESSION_DIR2" \
+TRUST_RECONCILE_COMMANDS="node --version" flow_agents_node "$WRITER" advance-state "$SESSION_DIR2" \
   --status delivered \
   --phase release \
   --summary "Delivered." \