@kontourai/flow-agents 3.2.0 → 3.4.0

package/evals/integration/test_effective_backlog_settings.sh

@@ -15,7 +15,7 @@ pass() { echo "  ✓ $1"; }
 fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
 
 json_value() {
-  node -e 'const fs=require("fs"); let cur=JSON.parse(fs.readFileSync(0,"utf8")); for (const part of process.argv[1].split(".")) cur=Array.isArray(cur) ? cur[Number(part)] : cur[part]; console.log(cur);' "$1"
+  NO_COLOR=1 FORCE_COLOR=0 node -e 'const fs=require("fs"); let cur=JSON.parse(fs.readFileSync(0,"utf8")); for (const part of process.argv[1].split(".")) cur=Array.isArray(cur) ? cur[Number(part)] : cur[part]; console.log(cur);' "$1"
 }
 
 echo "=== Effective Backlog Settings ==="

package/evals/integration/test_evidence_capture_hook.sh

@@ -56,6 +56,8 @@ echo "Part A: deterministic capture"
 printf '{"hook_event_name":"PostToolUse","tool_name":"Bash","cwd":"%s","tool_input":{"command":"npm test"},"tool_response":{"exitCode":0,"stdout":"ok"}}' "$A" | capture
 printf '{"hook_event_name":"PostToolUse","tool_name":"Bash","cwd":"%s","tool_input":{"command":"npm run lint"},"error":"command failed"}' "$A" | capture
 printf '{"hook_event_name":"PostToolUse","tool_name":"Bash","cwd":"%s","tool_input":{"command":"make build"},"tool_response":{"exit_code":2}}' "$A" | capture
+# #470 rule-3 default: no exit code, no error, no stderr → ambiguous (never pass).
+printf '{"hook_event_name":"PostToolUse","tool_name":"Bash","cwd":"%s","tool_input":{"command":"echo status-check"}}' "$A" | capture
 # A non-command tool (Write) must NOT be captured.
 printf '{"hook_event_name":"PostToolUse","tool_name":"Write","cwd":"%s","tool_input":{"file_path":"/tmp/x"}}' "$A" | capture
 
@@ -63,7 +65,7 @@ LOG="$A/.kontourai/flow-agents/t1/command-log.jsonl"
 if [[ -f "$LOG" ]]; then _pass "capture writes command-log.jsonl"; else _fail "capture did not write command-log.jsonl"; fi
 
 lines=$(wc -l < "$LOG" | tr -d ' ')
-if [[ "$lines" == "3" ]]; then _pass "capture records 3 command executions (Write tool excluded)"; else _fail "expected 3 log lines, got $lines"; fi
+if [[ "$lines" == "4" ]]; then _pass "capture records 4 command executions (Write tool excluded)"; else _fail "expected 4 log lines, got $lines"; fi
 
 if rg -q '"command":"npm test","observedResult":"pass","exitCode":0' "$LOG"; then
   _pass "clean exit 0 recorded as observedResult:pass exitCode:0"
@@ -77,6 +79,14 @@ if rg -q '"command":"make build","observedResult":"fail","exitCode":2' "$LOG"; t
   _pass "non-zero exit recorded as fail with exitCode"
 else _fail "non-zero-exit command not recorded correctly"; fi
 
+# #470 rule-3 default: absent any positive success evidence, observedResult is
+# "ambiguous" (never "pass"). The error-bearing case above ("npm run lint" →
+# fail, exitCode:null) already proves rule 2 (isFailureIndicated) is unchanged
+# by the rule-3 flip.
+if rg -q '"command":"echo status-check","observedResult":"ambiguous","exitCode":null' "$LOG"; then
+  _pass "no-signal command (no exit code, no error, no stderr) recorded as ambiguous, never pass"
+else _fail "no-signal command not recorded as ambiguous: $(cat "$LOG")"; fi
+
 if rg -q '"source":"postToolUse-capture"' "$LOG"; then _pass "records source:postToolUse-capture"; else _fail "missing source field"; fi
 
 # Capture is non-blocking: it always exits 0 and echoes stdin.
@@ -165,8 +175,13 @@ fi
 # ============================================================================
 echo "Part B5: free-form model command re-run is opt-in only"
 F="$TMP/recheck"; seed_repo "$F" t1
+# #494: the opt-in RECHECK re-run of model-recorded free-form commands applies to IN-FLIGHT
+# sessions. On terminal delivered/done sessions the model-asserted RECHECK is skipped (captured
+# execution evidence + L2 CI remain the anchors) — terminal-skip is covered in test_goal_fit_hook.sh.
+# seed_repo defaults to delivered/done, so make this session in-flight to exercise the opt-in re-run.
+printf '%s' '{"schema_version":"1.0","task_slug":"t1","status":"in_progress","phase":"verification","updated_at":"2026-06-23T00:00:00Z","next_action":{"status":"continue","summary":"verify command evidence"}}' > "$F/.kontourai/flow-agents/t1/state.json"
 printf '%s' '{"schema_version":"1.0","task_slug":"t1","verdict":"pass","checks":[{"id":"custom","kind":"command","status":"pass","command":"exit 5","summary":"ran custom"}]}' > "$F/.kontourai/flow-agents/t1/evidence.json"
-# Opt-in ON: the model's free-form "exit 5" is re-run and fails → block.
+# Opt-in ON (in-flight): the model's free-form "exit 5" is re-run and fails → block.
 if FLOW_AGENTS_GOAL_FIT_MODE=block FLOW_AGENTS_GOAL_FIT_RECHECK=true node "$GATE" >/dev/null 2>"$TMP/b5.err" <<JSON
 {"hook_event_name":"Stop","cwd":"$F"}
 JSON

package/evals/integration/test_exemption_usage_review.sh

@@ -0,0 +1,198 @@
+#!/usr/bin/env bash
+# test_exemption_usage_review.sh — Integration eval for the Veritas Governance Kit's
+# exemption-usage-review skill (issue #303, ADR 0022 §3).
+#
+# Proves review-exemptions.mjs correctly:
+#   AC1  review-lists-exemptions: parses a delivery/DECLARED fixture and lists every entry
+#        with scope, reason, approved_by, and computed age (deterministic via --as-of).
+#   AC2  review-flags-stale: against a mixed fresh/stale fixture, flags ONLY the entry
+#        outside --stale-days as stale, using exact age math.
+#   AC3  review-process-only-no-mutation: running the review does not modify
+#        delivery/DECLARED (byte-identical before/after) and does not change
+#        scripts/ci/trust-reconcile.js's exit code run against the same fixture tree
+#        before/after the review executes.
+#   AC9  no-fork: the skill/helper contains no copy of matchesScopeCondition/matchesScope/
+#        parseDeclaredMarker function bodies (structural grep, mirrors
+#        test_veritas_governance_kit.sh's no-fork assertion pattern).
+#   Output shape: --json emits {scope, reason, approved_by, declared_at, age_days, stale}
+#        per entry.
+#   Exit-0-always-informational: the script's own exit code is 0 regardless of how many
+#        entries are flagged stale (staleness is informational, never a script failure).
+#
+# Deterministic (--as-of pins "now"), no model spend, self-cleaning.
+# Usage: bash evals/integration/test_exemption_usage_review.sh
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+KIT="$ROOT/kits/veritas-governance"
+HELPER="$KIT/skills/exemption-usage-review/review-exemptions.mjs"
+SKILL_MD="$KIT/skills/exemption-usage-review/SKILL.md"
+FIXTURE="$KIT/fixtures/exemption-review/mixed-fresh-stale.DECLARED.json"
+RECONCILE="$ROOT/scripts/ci/trust-reconcile.js"
+
+errors=0
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+pass() { echo "  ✓ $1"; }
+fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
+
+echo "=== exemption-usage-review skill — integration eval ==="
+
+# --- Sanity: required files exist ------------------------------------------------
+if [[ -f "$HELPER" && -f "$SKILL_MD" && -f "$FIXTURE" ]]; then
+  pass "helper, SKILL.md, and fixture all exist"
+else
+  fail "one or more required files missing (helper=$HELPER skill=$SKILL_MD fixture=$FIXTURE)"
+fi
+
+# --- AC1/AC2: listing + staleness math, deterministic via --as-of ----------------
+echo "--- AC1/AC2: listing + staleness flagging ---"
+AS_OF="2026-07-05T00:00:00Z"
+STALE_DAYS=90
+
+json_out="$(node "$HELPER" --declared-path "$FIXTURE" --repo-root "$ROOT" --as-of "$AS_OF" --stale-days "$STALE_DAYS" --json 2>&1)"
+json_code=$?
+
+if [[ "$json_code" -eq 0 ]]; then
+  pass "review-exemptions.mjs exits 0 on a clean run against the mixed fixture"
+else
+  fail "review-exemptions.mjs expected exit 0, got $json_code — output: $json_out"
+fi
+
+echo "$json_out" > "$TMP_DIR/report.json"
+
+if node -e "
+const r = JSON.parse(require('fs').readFileSync('$TMP_DIR/report.json', 'utf8'));
+if (!Array.isArray(r.entries) || r.entries.length !== 2) process.exit(1);
+"; then
+  pass "AC1: exactly 2 entries listed from the mixed-fresh-stale fixture"
+else
+  fail "AC1: expected exactly 2 entries in the report — output: $json_out"
+fi
+
+if node -e "
+const r = JSON.parse(require('fs').readFileSync('$TMP_DIR/report.json', 'utf8'));
+const [fresh, stale] = r.entries;
+const required = ['scope', 'reason', 'approved_by', 'declared_at', 'age_days', 'stale'];
+for (const e of r.entries) {
+  for (const f of required) {
+    if (!(f in e)) process.exit(1);
+  }
+}
+if (fresh.age_days !== 15) process.exit(1);
+if (stale.age_days !== 185) process.exit(1);
+"; then
+  pass "AC1: age_days computed correctly (15 for the fresh entry, 185 for the stale entry) against as-of $AS_OF"
+else
+  fail "AC1: age_days math did not match expected values — output: $json_out"
+fi
+
+if node -e "
+const r = JSON.parse(require('fs').readFileSync('$TMP_DIR/report.json', 'utf8'));
+const [fresh, stale] = r.entries;
+if (fresh.stale !== false) process.exit(1);
+if (stale.stale !== true) process.exit(1);
+"; then
+  pass "AC2: ONLY the entry outside the $STALE_DAYS-day threshold is flagged stale (fresh entry: false, stale entry: true)"
+else
+  fail "AC2: staleness flagging diverged from expected (fresh=false, stale=true) — output: $json_out"
+fi
+
+# --- AC2 negative/flip case: lowering the threshold flips the fresh entry too ----
+flip_out="$(node "$HELPER" --declared-path "$FIXTURE" --repo-root "$ROOT" --as-of "$AS_OF" --stale-days 10 --json 2>&1)"
+echo "$flip_out" > "$TMP_DIR/flip.json"
+if node -e "
+const r = JSON.parse(require('fs').readFileSync('$TMP_DIR/flip.json', 'utf8'));
+if (r.entries.length !== 2) process.exit(1);
+if (!r.entries.every((e) => e.stale === true)) process.exit(1);
+"; then
+  pass "AC2 threshold-flip: lowering --stale-days to 10 flips BOTH entries to stale (age math is threshold-relative, not hardcoded)"
+else
+  fail "AC2 threshold-flip: lowering the threshold did not flip both entries stale — output: $flip_out"
+fi
+
+# --- Output-shape: human-readable mode also runs clean ---------------------------
+human_out="$(node "$HELPER" --declared-path "$FIXTURE" --repo-root "$ROOT" --as-of "$AS_OF" --stale-days "$STALE_DAYS" 2>&1)"
+human_code=$?
+if [[ "$human_code" -eq 0 ]] && echo "$human_out" | grep -qF "PROCESS-ONLY: read-only report."; then
+  pass "human-readable report mode exits 0 and states the process-only boundary plainly"
+else
+  fail "human-readable report mode did not exit 0 or did not state the process-only boundary — output: $human_out"
+fi
+
+# --- AC3: process-only, no mutation of delivery/DECLARED or trust-reconcile exit code --
+echo "--- AC3: no-mutation lock (byte-diff DECLARED + reconciler exit-code identity) ---"
+DECLARED_WORK="$TMP_DIR/declared-work"
+mkdir -p "$DECLARED_WORK/delivery"
+cp "$FIXTURE" "$DECLARED_WORK/delivery/DECLARED"
+
+sha_before="$(shasum -a 256 "$DECLARED_WORK/delivery/DECLARED" | awk '{print $1}')"
+RECONCILE_CMD="node -e 'process.exit(0)'"
+recon_before_out="$(TRUST_RECONCILE_ACTOR="dependabot[bot]" TRUST_RECONCILE_COMMANDS="$RECONCILE_CMD" \
+  node "$RECONCILE" --repo-root "$DECLARED_WORK" 2>&1)"
+recon_before_code=$?
+
+# Run the review against the SAME fixture tree's DECLARED file (not the read-only source
+# fixture) — this is the file whose byte-identity and reconciler-exit-code-identity we lock.
+review_out="$(node "$HELPER" --declared-path "$DECLARED_WORK/delivery/DECLARED" --repo-root "$DECLARED_WORK" --as-of "$AS_OF" --stale-days "$STALE_DAYS" --json 2>&1)"
+review_code=$?
+
+sha_after="$(shasum -a 256 "$DECLARED_WORK/delivery/DECLARED" | awk '{print $1}')"
+recon_after_out="$(TRUST_RECONCILE_ACTOR="dependabot[bot]" TRUST_RECONCILE_COMMANDS="$RECONCILE_CMD" \
+  node "$RECONCILE" --repo-root "$DECLARED_WORK" 2>&1)"
+recon_after_code=$?
+
+if [[ "$review_code" -eq 0 ]]; then
+  pass "review-exemptions.mjs itself exits 0 (informational only, regardless of stale entries present)"
+else
+  fail "review-exemptions.mjs expected exit 0, got $review_code — output: $review_out"
+fi
+
+if [[ "$sha_before" == "$sha_after" ]]; then
+  pass "AC3: delivery/DECLARED bytes are IDENTICAL before/after the review ran (sha256 $sha_before)"
+else
+  fail "AC3: delivery/DECLARED bytes CHANGED after the review ran (before=$sha_before after=$sha_after) — review mutated a file it must never touch"
+fi
+
+if [[ "$recon_before_code" == "$recon_after_code" ]]; then
+  pass "AC3: trust-reconcile.js's exit code is IDENTICAL before/after the review ran (both: $recon_before_code)"
+else
+  fail "AC3: trust-reconcile.js's exit code DIVERGED before ($recon_before_code) vs after ($recon_after_code) the review ran — the audit-vs-enforcement boundary is broken"
+fi
+
+# --- AC9: no-fork — helper/SKILL.md contain no copy of the reconciler's scope-matching --
+echo "--- AC9: no-fork (structural grep for vendored reconciler logic) ---"
+if grep -nE "startsWith\('ref:'\)|startsWith\('commit:'\)|startsWith\('author:'\)|startsWith\('branch-prefix:'\)" "$HELPER" >/dev/null 2>&1; then
+  fail "AC9: review-exemptions.mjs contains vendored matchesScopeCondition-style branch logic (no-fork violated)"
+else
+  pass "AC9: review-exemptions.mjs contains no vendored matchesScopeCondition branch logic"
+fi
+
+if grep -nE "^function (matchesScope|matchesScopeCondition|parseDeclaredMarker)\(" "$HELPER" "$SKILL_MD" >/dev/null 2>&1; then
+  fail "AC9: a matchesScope/matchesScopeCondition/parseDeclaredMarker function DEFINITION was found in the skill's own files (no-fork violated)"
+else
+  pass "AC9: no matchesScope/matchesScopeCondition/parseDeclaredMarker function definition exists in the skill's own files (references-only, per SKILL.md's explicit non-reuse note)"
+fi
+
+# --- kit.json registration sanity (skill is registered, kit still validates) -----
+FLOW_CLI="$ROOT/node_modules/@kontourai/flow/dist/cli.js"
+if node "$FLOW_CLI" kit validate "$KIT" >"$TMP_DIR/kitval.out" 2>&1; then
+  pass "kit container still validates with the exemption-usage-review skill present"
+else
+  fail "kit container failed validation with the skill present"; sed -n '1,40p' "$TMP_DIR/kitval.out"
+fi
+if grep -q '"id": *"veritas-governance\.exemption-usage-review"' "$KIT/kit.json" && grep -q '"path": *"skills/exemption-usage-review/SKILL.md"' "$KIT/kit.json"; then
+  pass "exemption-usage-review skill is registered in kit.json skills[]"
+else
+  fail "exemption-usage-review skill is NOT registered in kit.json skills[]"
+fi
+
+echo ""
+if [[ "$errors" -eq 0 ]]; then
+  echo "PASS: exemption-usage-review skill (listing, staleness, no-mutation lock, no-fork)"
+  exit 0
+else
+  echo "FAIL: $errors check(s) failed"
+  exit 1
+fi

package/evals/integration/test_fixture_retirement_audit.sh

@@ -21,9 +21,9 @@ json_query() {
   node -e 'const fs=require("fs"); let cur=JSON.parse(fs.readFileSync(process.argv[1],"utf8")); for (const part of process.argv[2].split(".")) cur=Array.isArray(cur) ? cur[Number(part)] : cur[part]; console.log(cur);' "$1" "$2"
 }
 
-[[ "$(json_query "$TMPDIR_EVAL/audit.json" "totals.scanned")" == "15" ]] && pass "audit scans all fixture groups" || fail "audit scans all fixture groups"
+[[ "$(json_query "$TMPDIR_EVAL/audit.json" "totals.scanned")" == "19" ]] && pass "audit scans all fixture groups" || fail "audit scans all fixture groups"
 [[ "$(json_query "$TMPDIR_EVAL/audit.json" "totals.retire_candidates")" == "0" ]] && pass "audit finds no unowned retire candidates" || fail "audit finds no unowned retire candidates"
-[[ "$(json_query "$TMPDIR_EVAL/audit.json" "totals.kept")" == "15" ]] && pass "audit keeps all owned fixture groups" || fail "audit keeps all owned fixture groups"
+[[ "$(json_query "$TMPDIR_EVAL/audit.json" "totals.kept")" == "19" ]] && pass "audit keeps all owned fixture groups" || fail "audit keeps all owned fixture groups"
 
 node - "$TMPDIR_EVAL/audit.json" <<'NODE'
 const fs = require("node:fs");

package/evals/integration/test_flow_kit_install_git.sh

@@ -46,6 +46,27 @@ else
   sed -n '1,80p' "$default_out"
 fi
 
+# Named acceptance outcomes must exercise the real catalog manifests, not only
+# the generic resolver fixture.
+for named_kit in builder knowledge; do
+  NAMED_HOME="$TMP_DIR/named-$named_kit-codex-home"
+  mkdir -p "$NAMED_HOME"
+  named_out="$TMP_DIR/named-$named_kit.out"
+  if CODEX_HOME="$NAMED_HOME" flow_agents_node "$CLI" install "$named_kit" >"$named_out" 2>&1 \
+    && [[ -f "$NAMED_HOME/kits/local/repositories/$named_kit/kit.json" ]] \
+    && node - "$NAMED_HOME/kits/local/installed-kits.json" "$named_kit" <<'NODE'
+const fs = require("node:fs");
+const registry = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+if (!registry.kits.some((kit) => kit.id === process.argv[3])) process.exit(1);
+NODE
+  then
+    pass "$named_kit kit install without --dest uses isolated CODEX_HOME"
+  else
+    fail "$named_kit kit install without --dest did not use isolated CODEX_HOME"
+    sed -n '1,100p' "$named_out"
+  fi
+done
+
 list_out="$TMP_DIR/default-list.out"
 if CODEX_HOME="$DEFAULT_CODEX_HOME" flow_agents_node "$CLI" list >"$list_out" 2>&1 \
   && grep -q "example-kit" "$list_out"; then
@@ -205,6 +226,68 @@ else
   fail "source kits/catalog.json changed during install-git test"
 fi
 
+# --- Security regressions: symlink escapes and local-source overlap ---
+REGISTRY_ESCAPE_DEST="$TMP_DIR/registry-escape-dest"
+REGISTRY_ESCAPE_OUTSIDE="$TMP_DIR/registry-escape-outside.json"
+mkdir -p "$REGISTRY_ESCAPE_DEST/kits/local"
+printf '{"outside":"unchanged"}\n' > "$REGISTRY_ESCAPE_OUTSIDE"
+ln -s "$REGISTRY_ESCAPE_OUTSIDE" "$REGISTRY_ESCAPE_DEST/kits/local/installed-kits.json"
+if flow_agents_node "$CLI" install "$VALID_SRC" --dest "$REGISTRY_ESCAPE_DEST" >"$TMP_DIR/registry-escape.out" 2>&1; then
+  fail "symlinked kit registry should fail closed"
+elif grep -q '"outside":"unchanged"' "$REGISTRY_ESCAPE_OUTSIDE"; then
+  pass "symlinked kit registry fails closed without outside write"
+else
+  fail "symlinked kit registry modified outside file"
+fi
+
+REPOSITORY_ESCAPE_DEST="$TMP_DIR/repository-escape-dest"
+REPOSITORY_ESCAPE_OUTSIDE="$TMP_DIR/repository-escape-outside"
+mkdir -p "$REPOSITORY_ESCAPE_DEST/kits/local/repositories" "$REPOSITORY_ESCAPE_OUTSIDE"
+printf 'unchanged\n' > "$REPOSITORY_ESCAPE_OUTSIDE/sentinel"
+ln -s "$REPOSITORY_ESCAPE_OUTSIDE" "$REPOSITORY_ESCAPE_DEST/kits/local/repositories/example-kit"
+if flow_agents_node "$CLI" install "$VALID_SRC" --dest "$REPOSITORY_ESCAPE_DEST" >"$TMP_DIR/repository-escape.out" 2>&1; then
+  fail "symlinked kit repository should fail closed"
+elif [[ "$(cat "$REPOSITORY_ESCAPE_OUTSIDE/sentinel")" == "unchanged" && ! -e "$REPOSITORY_ESCAPE_OUTSIDE/kit.json" ]]; then
+  pass "symlinked kit repository fails closed without outside write"
+else
+  fail "symlinked kit repository modified outside directory"
+fi
+
+SELF_DEST="$TMP_DIR/self-overlap-dest"
+SELF_SOURCE="$SELF_DEST/kits/local/repositories/example-kit"
+mkdir -p "$(dirname "$SELF_SOURCE")"
+cp -R "$VALID_SRC" "$SELF_SOURCE"
+if flow_agents_node "$CLI" install "$SELF_SOURCE" --dest "$SELF_DEST" >"$TMP_DIR/self-overlap.out" 2>&1; then
+  fail "exact local-kit self-install should be rejected"
+elif [[ -f "$SELF_SOURCE/kit.json" ]] && grep -q "refusing overlapping paths" "$TMP_DIR/self-overlap.out"; then
+  pass "exact local-kit self-install is rejected before source mutation"
+else
+  fail "exact local-kit self-install did not preserve its source"
+fi
+
+DESCENDANT_DEST="$TMP_DIR/descendant-overlap-dest"
+cp -R "$VALID_SRC" "$DESCENDANT_DEST"
+if flow_agents_node "$CLI" install "$DESCENDANT_DEST" --dest "$DESCENDANT_DEST" >"$TMP_DIR/descendant-overlap.out" 2>&1; then
+  fail "kit target nested beneath source should be rejected"
+elif [[ -f "$DESCENDANT_DEST/kit.json" ]] && grep -q "refusing overlapping paths" "$TMP_DIR/descendant-overlap.out"; then
+  pass "kit target nested beneath source is rejected before mutation"
+else
+  fail "source-ancestor overlap did not preserve source"
+fi
+
+ANCESTOR_DEST="$TMP_DIR/ancestor-overlap-dest"
+ANCESTOR_TARGET="$ANCESTOR_DEST/kits/local/repositories/example-kit"
+ANCESTOR_SOURCE="$ANCESTOR_TARGET/nested-source"
+mkdir -p "$ANCESTOR_TARGET"
+cp -R "$VALID_SRC" "$ANCESTOR_SOURCE"
+if flow_agents_node "$CLI" install "$ANCESTOR_SOURCE" --dest "$ANCESTOR_DEST" >"$TMP_DIR/ancestor-overlap.out" 2>&1; then
+  fail "kit source nested beneath target should be rejected"
+elif [[ -f "$ANCESTOR_SOURCE/kit.json" ]] && grep -q "refusing overlapping paths" "$TMP_DIR/ancestor-overlap.out"; then
+  pass "kit source nested beneath target is rejected before mutation"
+else
+  fail "target-ancestor overlap did not preserve source"
+fi
+
 echo ""
 if [[ "$errors" -eq 0 ]]; then
   echo "install-git checks passed."

package/evals/integration/test_flowdef_session_activation.sh

@@ -143,7 +143,6 @@ flow_agents_node "$WRITER" ensure-session \
   --title "Tamper verify test" \
   --summary "Testing tamper detection at verify step." \
   --flow-id builder.build \
-  --step-id verify \
   --timestamp "2026-06-01T02:00:00Z" >/dev/null 2>&1
 
 flow_agents_node "$WRITER" init-plan "$TAMPER_DIR/.kontourai/flow-agents/$TAMPER_SLUG/$TAMPER_SLUG--deliver.md" \

package/evals/integration/test_flowdef_session_history_preservation.sh

@@ -39,20 +39,25 @@ SLUG="history-flow-test"
 SESSION_DIR="$FLOW_AROOT/$SLUG"
 mkdir -p "$FLOW_AROOT"
 
-# Create a FlowDefinition-driven session at the verify step (builder.verify.tests is declared)
+# Start at the declared first step, then establish the verify-state fixture.
 flow_agents_node "$WRITER" ensure-session \
   --artifact-root "$FLOW_AROOT" \
   --task-slug "$SLUG" \
   --title "History preservation test" \
   --summary "Test that declared builder.* claims survive round-trips." \
   --flow-id builder.build \
-  --step-id verify \
   --timestamp "2026-06-01T00:00:00Z" >/dev/null 2>&1
 
 flow_agents_node "$WRITER" init-plan "$SESSION_DIR/$SLUG--deliver.md" \
   --source-request "Test" --summary "Testing" \
   --timestamp "2026-06-01T00:00:00Z" >/dev/null 2>&1
 
+flow_agents_node "$WRITER" advance-state "$SESSION_DIR" \
+  --status in_progress --phase verification \
+  --summary "Testing at verify." --next-action "Record evidence." \
+  --flow-definition builder.build \
+  --timestamp "2026-06-01T00:00:30Z" >/dev/null 2>&1
+
 # Record a passing check (produces ONLY builder.verify.tests declared claim — no legacy shadow, P-d)
 flow_agents_node "$WRITER" record-evidence "$SESSION_DIR" \
   --verdict pass \
@@ -196,13 +201,18 @@ flow_agents_node "$WRITER" ensure-session \
   --title "Dogfood clean test" \
   --summary "Test evidenceClean/critiqueClean on builder.build session." \
   --flow-id builder.build \
-  --step-id verify \
   --timestamp "2026-06-01T20:00:00Z" >/dev/null 2>&1
 
 flow_agents_node "$WRITER" init-plan "$DOGFOOD_DIR/$DOGFOOD_SLUG--deliver.md" \
   --source-request "Test" --summary "Testing" \
   --timestamp "2026-06-01T20:00:00Z" >/dev/null 2>&1
 
+flow_agents_node "$WRITER" advance-state "$DOGFOOD_DIR" \
+  --status in_progress --phase verification \
+  --summary "Testing at verify." --next-action "Record evidence." \
+  --flow-definition builder.build \
+  --timestamp "2026-06-01T20:00:30Z" >/dev/null 2>&1
+
 # Record pass evidence (produces builder.verify.tests declared claim, status=verified)
 flow_agents_node "$WRITER" record-evidence "$DOGFOOD_DIR" \
   --verdict pass \

package/evals/integration/test_gate_lockdown.sh

@@ -872,6 +872,11 @@ cp "$ROOT/scripts/hooks/lib/local-artifact-paths.js" "$ISO_DIR/lib/"
 # section is testing.
 cp "$ROOT/scripts/hooks/lib/actor-identity.js" "$ISO_DIR/lib/"
 cp "$ROOT/scripts/hooks/lib/current-pointer.js" "$ISO_DIR/lib/"
+# #412: stop-goal-fit.js now also requires scripts/hooks/lib/runnable-command.js (the shared
+# isRunnableCommandText heuristic, single-sourced with workflow-sidecar.ts) — mirror it too, or
+# the isolated gate crashes on MODULE_NOT_FOUND before it ever reaches the surface-unavailable
+# fail-closed path this section is testing.
+cp "$ROOT/scripts/hooks/lib/runnable-command.js" "$ISO_DIR/lib/"
 printf '# Repo\n' > "$ISO_DIR/repo/AGENTS.md"
 # Non-terminal session (execution phase, in_progress status)
 printf '%s' '{"schema_version":"1.0","task_slug":"surftest","status":"in_progress","phase":"execution","updated_at":"2026-06-27T00:00:00Z","next_action":{"status":"in_progress","summary":"running"}}' \
@@ -921,6 +926,8 @@ cp "$ROOT/scripts/hooks/lib/local-artifact-paths.js" "$ISO2_DIR/lib/"
 # #291: same rationale as ISO_DIR above -- mirror the two new scripts/hooks/lib dependencies.
 cp "$ROOT/scripts/hooks/lib/actor-identity.js" "$ISO2_DIR/lib/"
 cp "$ROOT/scripts/hooks/lib/current-pointer.js" "$ISO2_DIR/lib/"
+# #412: see the ISO_DIR mirror above — same requirement applies to this second isolated copy.
+cp "$ROOT/scripts/hooks/lib/runnable-command.js" "$ISO2_DIR/lib/"
 printf '# Repo\n' > "$ISO2_DIR/repo/AGENTS.md"
 printf '%s' '{"schema_version":"1.0","task_slug":"lowtest","status":"in_progress","phase":"execution","updated_at":"2026-06-27T00:00:00Z","next_action":{"status":"in_progress","summary":"running"}}' \
   > "$ISO2_DIR/repo/.kontourai/flow-agents/lowtest/state.json"

package/evals/integration/test_gate_review_inquiry_records.sh

@@ -25,6 +25,14 @@ trap cleanup EXIT
 _pass() { echo "  ✓ $1"; }
 _fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
 
+hook_tree_digest() {
+  find "$ROOT/scripts/hooks" -type f -print | LC_ALL=C sort | while IFS= read -r file; do
+    shasum -a 256 "$file"
+  done | shasum -a 256 | awk '{print $1}'
+}
+
+HOOKS_BEFORE="$(hook_tree_digest)"
+
 echo "=== Gate Review InquiryRecord Tests (AC1 + AC2) ==="
 
 # ── helpers ──────────────────────────────────────────────────────────────────
@@ -385,7 +393,7 @@ fi
 # ── AC3: no hooks changed ─────────────────────────────────────────────────────
 echo ""
 echo "--- AC3: hooks unchanged ---"
-if git -C "$ROOT" diff origin/main -- scripts/hooks/ 2>/dev/null | grep -q '^[+-]'; then
+if [[ "$(hook_tree_digest)" != "$HOOKS_BEFORE" ]]; then
   _fail "AC3: scripts/hooks/ was modified (gate-review must not touch hooks)"
 else
   _pass "AC3: scripts/hooks/ unchanged"