@kontourai/flow-agents 3.2.0 → 3.4.0

package/evals/integration/test_builder_entry_enforcement.sh

@@ -0,0 +1,241 @@
+#!/usr/bin/env bash
+# Proves first-step workflow entry and provider-neutral local work-item anchoring (#438).
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+source "$ROOT/evals/lib/node.sh"
+
+TMP="$(mktemp -d)"
+errors=0
+trap 'rm -rf "$TMP"' EXIT
+
+pass() { printf '  PASS %s\n' "$1"; }
+fail() { printf '  FAIL %s\n' "$1"; errors=$((errors + 1)); }
+
+WRITER="workflow-sidecar"
+
+echo "=== Builder workflow entry enforcement ==="
+
+REFUSED_ROOT="$TMP/refused/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$REFUSED_ROOT" \
+  --task-slug refused-plan \
+  --title "Refused plan entry" \
+  --summary "Must enter through the declared prefix." \
+  --flow-id builder.build \
+  --step-id plan >"$TMP/refused.out" 2>&1; then
+  fail "fresh later-step entry is rejected"
+elif [[ ! -e "$REFUSED_ROOT" ]] && grep -q 'must start at first step "pull-work"' "$TMP/refused.out"; then
+  pass "fresh later-step entry is rejected before artifact-root creation"
+else
+  fail "later-step refusal wrote files or returned the wrong diagnostic: $(cat "$TMP/refused.out")"
+fi
+
+AD_HOC_ROOT="$TMP/ad-hoc/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$AD_HOC_ROOT" \
+  --task-slug refused-ad-hoc \
+  --title "Refused ad-hoc entry" \
+  --summary "A reason is not workflow authority." \
+  --flow-id builder.build \
+  --step-id plan \
+  --ad-hoc-reason "skip the prefix" >"$TMP/ad-hoc.out" 2>&1; then
+  fail "ad-hoc reason cannot authorize later-step entry"
+elif [[ ! -e "$AD_HOC_ROOT" ]] && grep -q 'cannot authorize workflow entry' "$TMP/ad-hoc.out"; then
+  pass "ad-hoc reason cannot authorize later-step entry or write artifacts"
+else
+  fail "ad-hoc refusal wrote files or returned the wrong diagnostic: $(cat "$TMP/ad-hoc.out")"
+fi
+
+LOCAL_ROOT="$TMP/local/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$LOCAL_ROOT" \
+  --task-slug local-request \
+  --title "Local request" \
+  --summary "Providerless work still needs an anchor." \
+  --flow-id builder.build \
+  --timestamp "2026-07-10T00:00:00Z" >"$TMP/local.out" 2>&1; then
+  if node - "$LOCAL_ROOT" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const root = process.argv[2];
+const current = JSON.parse(fs.readFileSync(path.join(root, 'current.json'), 'utf8'));
+const state = JSON.parse(fs.readFileSync(path.join(root, 'local-request', 'state.json'), 'utf8'));
+const workItem = JSON.parse(fs.readFileSync(path.join(root, 'local-request', 'work-item.json'), 'utf8'));
+if (current.active_flow_id !== 'builder.build' || current.active_step_id !== 'pull-work') process.exit(1);
+if (state.status !== 'new' || state.phase !== 'pickup') process.exit(1);
+if (JSON.stringify(state.work_item_refs) !== JSON.stringify(['local:local-request'])) process.exit(1);
+if (workItem.id !== 'local-request' || workItem.title !== 'Local request') process.exit(1);
+if (workItem.source_provider?.kind !== 'local' || workItem.source_provider?.path !== 'work-item.json') process.exit(1);
+if (!state.next_action?.summary?.includes('builder-run start') || !state.next_action?.summary?.includes('`pull-work`')) process.exit(1);
+NODE
+  then
+    pass "providerless request creates a local Work Item and starts at pull-work"
+  else
+    fail "local Work Item or first-step state is invalid"
+  fi
+else
+  fail "providerless Builder entry failed: $(cat "$TMP/local.out")"
+fi
+
+LOCAL_SESSION="$LOCAL_ROOT/local-request"
+if flow_agents_node builder-run start --session-dir "$LOCAL_SESSION" >"$TMP/builder-start.out" 2>&1 \
+  && node - "$TMP/local" "$LOCAL_SESSION" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const project = process.argv[2];
+const session = process.argv[3];
+const flowState = JSON.parse(fs.readFileSync(path.join(project, '.kontourai', 'flow', 'runs', 'local-request', 'state.json'), 'utf8'));
+const sidecar = JSON.parse(fs.readFileSync(path.join(session, 'state.json'), 'utf8'));
+if (flowState.current_step !== 'pull-work' || flowState.subject !== 'local:local-request') process.exit(1);
+if (sidecar.flow_run?.current_step !== 'pull-work') process.exit(1);
+if (JSON.stringify(sidecar.next_action?.skills) !== JSON.stringify(['pull-work'])) process.exit(1);
+if (!sidecar.next_action?.command?.includes('builder-run sync')) process.exit(1);
+NODE
+then
+  pass "small-model entry command creates canonical Flow run and projects pull-work action"
+else
+  fail "canonical Builder run did not start or project correctly: $(cat "$TMP/builder-start.out")"
+fi
+
+if flow_agents_node "$WRITER" record-gate-claim "$LOCAL_SESSION" \
+  --expectation selected-work \
+  --status pass \
+  --summary "Selected local:local-request with scope and acceptance context." \
+  --evidence-ref-json '{"kind":"artifact","file":".kontourai/flow-agents/local-request/work-item.json","summary":"Provider-neutral local Work Item."}' \
+  >"$TMP/selected-work.out" 2>&1 \
+  && node - "$TMP/local" "$LOCAL_SESSION" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const project = process.argv[2];
+const session = process.argv[3];
+const flowState = JSON.parse(fs.readFileSync(path.join(project, '.kontourai', 'flow', 'runs', 'local-request', 'state.json'), 'utf8'));
+const sidecar = JSON.parse(fs.readFileSync(path.join(session, 'state.json'), 'utf8'));
+if (flowState.current_step !== 'design-probe') process.exit(1);
+if (sidecar.flow_run?.current_step !== 'design-probe') process.exit(1);
+if (JSON.stringify(sidecar.next_action?.skills) !== JSON.stringify(['pickup-probe'])) process.exit(1);
+NODE
+then
+  pass "gate-claim write synchronizes Flow and projects the next skill"
+else
+  fail "selected-work claim did not advance the canonical run: $(cat "$TMP/selected-work.out")"
+fi
+
+if FLOW_AGENTS_GOAL_FIT_MODE=block FLOW_AGENTS_GOAL_FIT_MAX_BLOCKS=100000 \
+  node "$ROOT/scripts/hooks/stop-goal-fit.js" >"$TMP/stop.out" 2>"$TMP/stop.err" <<JSON
+{"hook_event_name":"Stop","cwd":"$TMP/local"}
+JSON
+then
+  fail "active pre-execution Flow run should block Stop"
+else
+  stop_status=$?
+  if [[ "$stop_status" -eq 2 ]] \
+    && grep -q 'required skills: pickup-probe' "$TMP/stop.err" \
+    && grep -q 'builder-run sync' "$TMP/stop.err" \
+    && grep -q 'release skipped for active Flow run' "$TMP/stop.err" \
+    && node - "$LOCAL_SESSION/state.json" <<'NODE'
+const fs = require('node:fs');
+const state = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+if (state.flow_run?.status !== 'active' || state.flow_run?.current_step !== 'design-probe') process.exit(1);
+NODE
+  then
+    pass "active Flow run blocks Stop, preserves liveness, and exposes executable guidance"
+  else
+    fail "active Flow Stop enforcement or guidance was incomplete (exit $stop_status): $(cat "$TMP/stop.err")"
+  fi
+fi
+
+if flow_agents_node "$WRITER" record-gate-claim "$LOCAL_SESSION" \
+  --expectation pickup-probe-readiness \
+  --status pass \
+  --summary "Pickup Probe confirmed scope and planning readiness." \
+  --evidence-ref-json '{"kind":"artifact","file":".kontourai/flow-agents/local-request/work-item.json","summary":"Probe fixture evidence."}' >/dev/null 2>&1 \
+  && flow_agents_node "$WRITER" record-gate-claim "$LOCAL_SESSION" \
+  --expectation probe-decisions-or-accepted-gaps \
+  --status pass \
+  --summary "Probe decisions and accepted gaps are recorded." \
+  --evidence-ref-json '{"kind":"artifact","file":".kontourai/flow-agents/local-request/work-item.json","summary":"Probe decision fixture evidence."}' >/dev/null 2>&1 \
+  && flow_agents_node "$WRITER" record-gate-claim "$LOCAL_SESSION" \
+  --expectation implementation-plan \
+  --status pass \
+  --summary "Implementation plan records files, sequence, and evidence." \
+  --evidence-ref-json '{"kind":"artifact","file":".kontourai/flow-agents/local-request/work-item.json","summary":"Plan fixture evidence."}' >/dev/null 2>&1 \
+  && flow_agents_node "$WRITER" record-gate-claim "$LOCAL_SESSION" \
+  --expectation implementation-scope \
+  --status pass \
+  --summary "Implementation scope and changed files are recorded." \
+  --evidence-ref-json '{"kind":"artifact","file":".kontourai/flow-agents/local-request/work-item.json","summary":"Execution fixture evidence."}' >/dev/null 2>&1 \
+  && flow_agents_node "$WRITER" record-gate-claim "$LOCAL_SESSION" \
+  --expectation tests-evidence \
+  --status fail \
+  --route-reason implementation_defect \
+  --summary "Verification found an implementation defect." \
+  --evidence-ref-json '{"kind":"artifact","file":".kontourai/flow-agents/local-request/work-item.json","summary":"Failed verification fixture evidence."}' >"$TMP/route-back.out" 2>&1 \
+  && node - "$TMP/local" "$LOCAL_SESSION" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const project = process.argv[2];
+const session = process.argv[3];
+const flowState = JSON.parse(fs.readFileSync(path.join(project, '.kontourai', 'flow', 'runs', 'local-request', 'state.json'), 'utf8'));
+const sidecar = JSON.parse(fs.readFileSync(path.join(session, 'state.json'), 'utf8'));
+if (flowState.current_step !== 'execute') process.exit(1);
+if (sidecar.flow_run?.route_back_attempt !== 1 || sidecar.flow_run?.route_back_max_attempts !== 3) process.exit(1);
+if (JSON.stringify(sidecar.next_action?.skills) !== JSON.stringify(['execute-plan'])) process.exit(1);
+if (!sidecar.next_action?.summary?.includes('Route-back history: attempt 1/3')) process.exit(1);
+NODE
+then
+  pass "sidecar failure classifier drives Flow route-back and projects its attempt budget"
+else
+  fail "route-back classifier did not produce the canonical execute retry: $(cat "$TMP/route-back.out" 2>/dev/null)"
+fi
+
+PROVIDER_ROOT="$TMP/provider/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$PROVIDER_ROOT" \
+  --work-item "kontourai/flow-agents#438" \
+  --title "Provider work item" \
+  --summary "Keep the provider reference." \
+  --flow-id builder.build \
+  --timestamp "2026-07-10T00:01:00Z" >/dev/null 2>&1 \
+  && node - "$PROVIDER_ROOT/kontourai-flow-agents-438/state.json" <<'NODE'
+const fs = require('node:fs');
+const state = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+if (JSON.stringify(state.work_item_refs) !== JSON.stringify(['kontourai/flow-agents#438'])) process.exit(1);
+NODE
+then
+  pass "provider-backed request preserves its neutral work-item ref"
+else
+  fail "provider-backed work-item ref was not persisted"
+fi
+
+# A direct primitive remains usable without claiming Builder prefix completion.
+STANDALONE_ROOT="$TMP/standalone/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$STANDALONE_ROOT" \
+  --task-slug standalone-plan \
+  --title "Standalone plan" \
+  --summary "Direct primitive session." \
+  --timestamp "2026-07-10T00:02:00Z" >/dev/null 2>&1 \
+  && node - "$STANDALONE_ROOT" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const root = process.argv[2];
+const current = JSON.parse(fs.readFileSync(path.join(root, 'current.json'), 'utf8'));
+const state = JSON.parse(fs.readFileSync(path.join(root, 'standalone-plan', 'state.json'), 'utf8'));
+if ('active_flow_id' in current || 'active_step_id' in current) process.exit(1);
+if (state.status !== 'planned' || state.phase !== 'planning') process.exit(1);
+if (JSON.stringify(state.work_item_refs) !== JSON.stringify(['local:standalone-plan'])) process.exit(1);
+NODE
+then
+  pass "standalone primitive session remains available without a Builder stamp"
+else
+  fail "standalone primitive session was incorrectly stamped as Builder"
+fi
+
+if [[ "$errors" -gt 0 ]]; then
+  printf 'test_builder_entry_enforcement: %d failure(s)\n' "$errors" >&2
+  exit 1
+fi
+
+echo "test_builder_entry_enforcement: all checks passed"

package/evals/integration/test_builder_step_producers.sh

@@ -41,21 +41,29 @@ trap cleanup EXIT
 
 # ─── Helper: set active_step_id for a step.
 # For steps in the phase_map, use advance-state.
-# For design-probe (no phase mapping), use ensure-session --step-id.
+# For design-probe (no phase mapping), mutate only the test fixture's current pointer.
 # ──────────────────────────────────────────────────────────────────
 set_active_step() {
   local aroot="$1" slug="$2" step="$3"
   case "$step" in
     design-probe)
-      # design-probe has no lifecycle phase in the phase_map — set via ensure-session --step-id
-      flow_agents_node "workflow-sidecar" ensure-session \
-        --artifact-root "$aroot" \
-        --task-slug "$slug" \
-        --title "Producer test: $step" \
-        --summary "Test gate-claim producer at $step." \
-        --flow-id builder.build \
-        --step-id design-probe \
-        --timestamp "2026-06-26T00:00:30Z" >/dev/null 2>&1
+      # The production entry surface cannot select a later step. This producer-focused
+      # fixture sets the pointer directly because design-probe has no legacy phase_map key.
+      node - "$aroot" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const root = process.argv[2];
+const files = [path.join(root, 'current.json')];
+const actorRoot = path.join(root, 'current');
+if (fs.existsSync(actorRoot)) {
+  files.push(...fs.readdirSync(actorRoot).filter((name) => name.endsWith('.json')).map((name) => path.join(actorRoot, name)));
+}
+for (const file of files) {
+  const current = JSON.parse(fs.readFileSync(file, 'utf8'));
+  current.active_step_id = 'design-probe';
+  fs.writeFileSync(file, `${JSON.stringify(current, null, 2)}\n`);
+}
+NODE
       ;;
     pull-work)
       flow_agents_node "workflow-sidecar" advance-state "$aroot/$slug" \

package/evals/integration/test_bundle_install.sh

@@ -86,6 +86,20 @@ else
   _fail "Codex install with Kontour hosted Console telemetry config failed"
 fi
 
+CODEX_HOSTED_CONSOLE_NO_TENANT_DEST="$TMPDIR_EVAL/codex-hosted-console-no-tenant-workspace"
+CODEX_HOSTED_CONSOLE_NO_TENANT_STDERR="$TMPDIR_EVAL/codex-hosted-console-no-tenant-stderr.txt"
+if (cd "$ROOT_DIR/dist/codex" && bash install.sh "$CODEX_HOSTED_CONSOLE_NO_TENANT_DEST" --telemetry-sink kontour-hosted-console --console-token-file "$CONSOLE_TOKEN_FILE" >/dev/null 2>"$CODEX_HOSTED_CONSOLE_NO_TENANT_STDERR"); then
+  _pass "Codex install with hosted Console sink and no --console-tenant still succeeds"
+else
+  _fail "Codex install with hosted Console sink and no --console-tenant unexpectedly failed"
+fi
+
+if rg -q 'warning: install-console-config.sh: a Console telemetry sink was selected with no --console-tenant' "$CODEX_HOSTED_CONSOLE_NO_TENANT_STDERR"; then
+  _pass "Untenanted hosted Console sink install prints DX warning to stderr"
+else
+  _fail "Untenanted hosted Console sink install did not print DX warning to stderr"
+fi
+
 if (cd "$ROOT_DIR/dist/codex" && bash install.sh "$CODEX_USER_HOSTED_CONSOLE_DEST" --telemetry-sink user-hosted-console --console-url https://console.example.test --console-token-file "$CONSOLE_TOKEN_FILE" >/dev/null); then
   _pass "Codex install with user-hosted Console telemetry config succeeded"
 else
@@ -116,6 +130,137 @@ else
   _fail "flow-agents init headless Codex install failed"
 fi
 
+echo ""
+echo "--- Guided Console-Connect Wizard (G2/G3): headless regression + summary/verify ---"
+
+# New (G3): a plain local-files headless install still prints the structured
+# post-install summary block (regardless of the guided wizard, which only
+# fires for interactive installs) -- the summary/verify tail is shared by
+# both install paths.
+BASE_SUMMARY_LOCAL_DEST="$TMPDIR_EVAL/base-summary-local-workspace"
+BASE_SUMMARY_LOCAL_STDOUT="$TMPDIR_EVAL/base-summary-local-stdout.txt"
+if node "$ROOT_DIR/build/src/cli.js" init --dest "$BASE_SUMMARY_LOCAL_DEST" --telemetry-sink local-files --yes >"$BASE_SUMMARY_LOCAL_STDOUT" 2>&1; then
+  _pass "flow-agents init headless local-files install succeeded (G3 summary case)"
+else
+  _fail "flow-agents init headless local-files install failed (G3 summary case)"
+fi
+
+if rg -q 'Console:' "$BASE_SUMMARY_LOCAL_STDOUT"   && rg -q 'local-only' "$BASE_SUMMARY_LOCAL_STDOUT"   && rg -F -q "$BASE_SUMMARY_LOCAL_DEST" "$BASE_SUMMARY_LOCAL_STDOUT"; then
+  _pass "flow-agents init prints G3 post-install summary block for a local-files headless install"
+else
+  _fail "flow-agents init did not print G3 post-install summary block for a local-files headless install"
+fi
+
+# New (G2/G3): a kontour-hosted-console headless install auto-verifies via
+# telemetry-doctor's buildReport in-process, stays within a bounded wall-clock
+# time (never hangs), never prints the raw console token, and prints a
+# console status line -- verified or unverified is acceptable in a sandboxed
+# CI network, as long as the check happened honestly.
+BASE_SUMMARY_HOSTED_DEST="$TMPDIR_EVAL/base-summary-hosted-workspace"
+BASE_SUMMARY_HOSTED_STDOUT="$TMPDIR_EVAL/base-summary-hosted-stdout.txt"
+SECONDS=0
+if node "$ROOT_DIR/build/src/cli.js" init --dest "$BASE_SUMMARY_HOSTED_DEST" --telemetry-sink kontour-hosted-console --console-tenant tenant-x --console-token-file "$CONSOLE_TOKEN_FILE" --yes >"$BASE_SUMMARY_HOSTED_STDOUT" 2>&1; then
+  _pass "flow-agents init headless kontour-hosted-console install succeeded (G2/G3 case)"
+else
+  _fail "flow-agents init headless kontour-hosted-console install failed (G2/G3 case)"
+fi
+HOSTED_SUMMARY_ELAPSED_SECONDS=$SECONDS
+
+if [[ "$HOSTED_SUMMARY_ELAPSED_SECONDS" -le 20 ]]; then
+  _pass "flow-agents init auto-verify (G2) completed within a bounded wall-clock time (${HOSTED_SUMMARY_ELAPSED_SECONDS}s, never hangs)"
+else
+  _fail "flow-agents init auto-verify (G2) took too long (${HOSTED_SUMMARY_ELAPSED_SECONDS}s) -- may be hanging"
+fi
+
+if rg -q 'Console:' "$BASE_SUMMARY_HOSTED_STDOUT" && ! rg -F -q 'test-token' "$BASE_SUMMARY_HOSTED_STDOUT"; then
+  _pass "flow-agents init prints a G2/G3 console status line and never prints the raw console token"
+else
+  _fail "flow-agents init did not print a console status line, or leaked the raw console token"
+fi
+
+# New (regression, RESOLVED OWNER DECISION): the self-hosted blank-URL guard
+# (fallback to local-files with a warning) applies to the INTERACTIVE wizard
+# ONLY. The headless (--yes/--headless) path keeps today's unchanged
+# behavior -- install-console-config.sh's existing die-on-blank for
+# user-hosted-console with no --console-url/--console-endpoint. This asserts
+# the exact same non-zero exit + die message current main() (pre-PR2)
+# already produces, proving headless is byte-for-byte untouched. (The
+# interactive fallback itself is proven by the console-connect-options.test.mjs
+# unit tests on resolveSelfHostedUrlOrFallback + runConsoleConnectWizard.)
+BASE_SELF_HOSTED_NO_URL_DEST="$TMPDIR_EVAL/base-self-hosted-no-url-workspace"
+BASE_SELF_HOSTED_NO_URL_STDERR="$TMPDIR_EVAL/base-self-hosted-no-url-stderr.txt"
+set +e
+node "$ROOT_DIR/build/src/cli.js" init --dest "$BASE_SELF_HOSTED_NO_URL_DEST" --telemetry-sink user-hosted-console --yes >/dev/null 2>"$BASE_SELF_HOSTED_NO_URL_STDERR"
+BASE_SELF_HOSTED_NO_URL_EXIT=$?
+set -e
+
+if [[ "$BASE_SELF_HOSTED_NO_URL_EXIT" -ne 0 ]]   && rg -q 'install-console-config.sh: user-hosted-console requires --console-url or --console-endpoint' "$BASE_SELF_HOSTED_NO_URL_STDERR"; then
+  _pass "flow-agents init headless user-hosted-console with no --console-url still dies exactly as before (self-hosted guard is interactive-only)"
+else
+  _fail "flow-agents init headless user-hosted-console with no --console-url behavior changed (expected unchanged die-on-blank)"
+fi
+
+# New (review fix FIX 1): a self-hosted/BYO Console (non-local https, not the
+# known hosted host) headless install stays honest -- connected-unverified,
+# exit 0, reachability.checked stays false because --allow-network was not
+# passed -- but the summary now includes an actionable next-step hint instead
+# of leaving the operator with a bare "not checked". Never for local-only.
+BASE_SUMMARY_SELFHOSTED_DEST="$TMPDIR_EVAL/base-summary-selfhosted-workspace"
+BASE_SUMMARY_SELFHOSTED_STDOUT="$TMPDIR_EVAL/base-summary-selfhosted-stdout.txt"
+if node "$ROOT_DIR/build/src/cli.js" init --dest "$BASE_SUMMARY_SELFHOSTED_DEST" --telemetry-sink user-hosted-console --console-url https://console.example.test --console-tenant tenant-selfhosted --console-token-file "$CONSOLE_TOKEN_FILE" --yes >"$BASE_SUMMARY_SELFHOSTED_STDOUT" 2>&1; then
+  _pass "flow-agents init headless self-hosted/BYO Console install succeeds (unverified is honest, not a failure)"
+else
+  _fail "flow-agents init headless self-hosted/BYO Console install unexpectedly failed"
+fi
+
+if rg -q 'connected, unverified' "$BASE_SUMMARY_SELFHOSTED_STDOUT" \
+  && rg -F -q 'flow-agents telemetry-doctor --allow-network' "$BASE_SUMMARY_SELFHOSTED_STDOUT" \
+  && ! rg -F -q 'test-token' "$BASE_SUMMARY_SELFHOSTED_STDOUT"; then
+  _pass "flow-agents init summary discloses WHY self-hosted reachability is unverified with an actionable --allow-network hint, and never prints the raw token"
+else
+  _fail "flow-agents init summary did not disclose the self-hosted not-checked reason with the --allow-network hint"
+fi
+
+if rg -F -q 'flow-agents telemetry-doctor --allow-network' "$BASE_SUMMARY_LOCAL_STDOUT"; then
+  _fail "flow-agents init printed the self-hosted --allow-network hint for a local-files-only install (should never appear there)"
+else
+  _pass "flow-agents init does not print the self-hosted --allow-network hint for a local-files-only install"
+fi
+
+# New (review fix FIX 4, security): pin the validate-before-persist ordering
+# invariant. The TS-side wizard validators (console-telemetry-validate.ts) are
+# soft (validate-and-warn, never block); the ONLY reason a malformed value can
+# never land in a persisted telemetry.conf is that install-console-config.sh's
+# bash validators (validate_tenant et al.) run BEFORE any config key is
+# written and `die` (non-zero exit) on failure. A tenant value containing a
+# semicolon fails validate_tenant's charset (^[A-Za-z0-9._:-]+$ --
+# scripts/telemetry/install-console-config.sh); assert the headless install
+# dies non-zero via that exact bash validator, and that the hostile value
+# never appears in the persisted telemetry.conf (which already exists at this
+# point from the rsync'd template, since install-console-config.sh only
+# validates -- and writes nothing -- before dying).
+BASE_HOSTILE_TENANT_DEST="$TMPDIR_EVAL/base-hostile-tenant-workspace"
+BASE_HOSTILE_TENANT_STDERR="$TMPDIR_EVAL/base-hostile-tenant-stderr.txt"
+HOSTILE_TENANT='tenant;rm-rf-evidence'
+set +e
+node "$ROOT_DIR/build/src/cli.js" init --dest "$BASE_HOSTILE_TENANT_DEST" --telemetry-sink user-hosted-console --console-url https://console.example.test --console-tenant "$HOSTILE_TENANT" --yes >/dev/null 2>"$BASE_HOSTILE_TENANT_STDERR"
+BASE_HOSTILE_TENANT_EXIT=$?
+set -e
+
+if [[ "$BASE_HOSTILE_TENANT_EXIT" -ne 0 ]] \
+  && rg -q 'install-console-config.sh: --console-tenant contains unsupported characters' "$BASE_HOSTILE_TENANT_STDERR"; then
+  _pass "flow-agents init headless install with an illegal-character Console tenant dies via the bash validate_tenant gate (non-zero exit)"
+else
+  _fail "flow-agents init headless install with an illegal-character Console tenant did not die via bash validate_tenant as expected"
+fi
+
+if [[ ! -f "$BASE_HOSTILE_TENANT_DEST/scripts/telemetry/telemetry.conf" ]] \
+  || ! rg -F -q "$HOSTILE_TENANT" "$BASE_HOSTILE_TENANT_DEST/scripts/telemetry/telemetry.conf"; then
+  _pass "hostile Console tenant value never lands in telemetry.conf (validate-before-persist ordering invariant holds)"
+else
+  _fail "hostile Console tenant value was persisted into telemetry.conf despite failing bash validate_tenant"
+fi
+
 if (cd "$ROOT_DIR/dist/opencode" && bash install.sh "$OPENCODE_DEST" >/dev/null); then
   _pass "opencode install succeeded"
 else
@@ -708,6 +853,33 @@ else
   _fail "Codex full install is missing base agents"
 fi
 
+if node - "$CODEX_AGENTS_DIR" <<'NODE'
+const fs = require("node:fs");
+const path = require("node:path");
+function stringAssignment(text, key, name) {
+  const matches = [...text.matchAll(new RegExp(`^${key}\\s*=\\s*"([^"]*)"\\s*$`, "gm"))];
+  if (matches.length !== 1) throw new Error(`${name}: expected exactly one ${key} assignment, found ${matches.length}`);
+  return matches[0][1];
+}
+const expected = {
+  "tool-planner.toml": ["gpt-5.6-sol", "high"],
+  "tool-worker.toml": ["gpt-5.6-terra", "high"],
+  "tool-code-reviewer.toml": ["gpt-5.6-sol", "high"],
+  "tool-security-reviewer.toml": ["gpt-5.6-sol", "high"],
+  "tool-verifier.toml": ["gpt-5.6-sol", "high"],
+};
+for (const [name, [model, effort]] of Object.entries(expected)) {
+  const text = fs.readFileSync(path.join(process.argv[2], name), "utf8");
+  if (stringAssignment(text, "model", name) !== model) throw new Error(`${name}: expected model ${model}`);
+  if (stringAssignment(text, "model_reasoning_effort", name) !== effort) throw new Error(`${name}: expected reasoning ${effort}`);
+}
+NODE
+then
+  _pass "Codex full install preserves Builder specialist 5.6 role routing"
+else
+  _fail "Codex full install lost Builder specialist role routing"
+fi
+
 if [[ -d "$CODEX_FULL_DEST/.codex/skills/plan-work" && -d "$CODEX_FULL_DEST/.codex/skills/deliver" && -d "$CODEX_FULL_DEST/.codex/skills/agentic-engineering" ]]; then
   _pass "Codex full install ships kit-skills and standalone skills together"
 else

package/evals/integration/test_checkpoint_signing.sh

@@ -278,14 +278,22 @@ flow_agents_node "$WRITER" init-plan "$SESSION_DIR2/${SLUG2}--deliver.md" \
   --source-request "Test" --summary "Test" \
   --timestamp "2026-06-26T11:01:00Z" >/dev/null 2>&1
 
+# #356: the check-json below carries a real "command" so its test_output evidence
+# has a manifest-matchable execution.label (evidence.execution.label) -- otherwise the new
+# reconcile-preflight gate inside publishDelivery() (#356 Wave 3, AC6) correctly refuses to
+# publish a "kind":"build" claim with test_output evidence but no captured command (a
+# genuinely shape-invalid claim CI's own trust-reconcile.js would ALSO reject -- this is not
+# a preflight-specific false positive, see reconcile-shape.js's finding-1 hardening).
+# TRUST_RECONCILE_COMMANDS makes "node --version" resolve via resolveManifest's legacy
+# fallback tier, matching what a real repo configured with that canonical verify would do.
 flow_agents_node "$WRITER" record-evidence "$SESSION_DIR2" \
   --verdict pass \
-  --check-json '{"id":"build","kind":"build","status":"pass","summary":"build passed"}' \
+  --check-json '{"id":"build","kind":"build","status":"pass","summary":"build passed","command":"node --version"}' \
   --timestamp "2026-06-26T11:02:00Z" >/dev/null 2>&1
 
 # advance-state to delivered: this is the other code path that seals the checkpoint
 SEAL_EXIT=0
-flow_agents_node "$WRITER" advance-state "$SESSION_DIR2" \
+TRUST_RECONCILE_COMMANDS="node --version" flow_agents_node "$WRITER" advance-state "$SESSION_DIR2" \
   --status delivered \
   --phase release \
   --summary "Delivered." \