@kontourai/flow-agents 3.2.0 → 3.4.0

package/evals/integration/test_telemetry_usage_pipeline.sh

@@ -0,0 +1,228 @@
+#!/usr/bin/env bash
+# test_telemetry_usage_pipeline.sh — Layer 2: hermetic Stop-hook usage pipeline
+#
+# Proves the full telemetry.sh Stop path (add_stop_data_and_emit_usage) yields
+# a session.usage event with real tokens, a concrete (non-"unknown") model,
+# and a non-null estimated_cost_usd when a runtime transcript is supplied —
+# and that tokens still survive (with estimated_cost_usd null) when the
+# pricing registry is forced unavailable. Also guards the kiro-cli
+# non-regression case: with no transcript, model still resolves via the
+# existing usage_get_model() kiro lookup (unaffected by this fix).
+#
+# Uses the same TELEMETRY_DIR resolution convention as test_telemetry.sh
+# (prefers context/scripts/telemetry when present) so this exercises the same
+# copy CI actually runs, while explicitly pointing TELEMETRY_PRICING_FILE at
+# the canonical bundled registry so pricing resolves regardless of which copy
+# is under test (context/scripts/telemetry ships no bundled pricing.json).
+set -uo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+if [[ -d "$ROOT_DIR/context/scripts/telemetry" ]]; then
+  TELEMETRY_DIR="$ROOT_DIR/context/scripts/telemetry"
+else
+  TELEMETRY_DIR="$HOME/.flow-agents/context/scripts/telemetry"
+fi
+TELEMETRY_SH="${TELEMETRY_DIR}/telemetry.sh"
+PRICING_FILE="$ROOT_DIR/scripts/telemetry/pricing.json"
+FIXTURE_TRANSCRIPT="$ROOT_DIR/evals/fixtures/telemetry/usage-transcript-sample.jsonl"
+
+TMPDIR_EVAL=$(mktemp -d /tmp/eval-telemetry-usage-pipeline.XXXXXX)
+TMPLOG="${TMPDIR_EVAL}/test-output.jsonl"
+FAKE_HOME="${TMPDIR_EVAL}/home"
+mkdir -p "$FAKE_HOME" "$TMPDIR_EVAL/sessions"
+
+pass=0; fail=0
+_pass() { echo "  ✓ $1"; pass=$((pass + 1)); }
+_fail() { echo "  ✗ $1"; fail=$((fail + 1)); }
+
+echo "=== Layer 2: Telemetry Usage Pipeline (hermetic fixture) ==="
+echo ""
+
+if [[ ! -f "$TELEMETRY_SH" ]]; then
+  _fail "telemetry.sh not found at $TELEMETRY_SH"
+  echo "Cannot continue without telemetry script"
+  rm -rf "$TMPDIR_EVAL"
+  exit 1
+fi
+if [[ ! -f "$FIXTURE_TRANSCRIPT" ]]; then
+  _fail "fixture transcript not found at $FIXTURE_TRANSCRIPT"
+  rm -rf "$TMPDIR_EVAL"
+  exit 1
+fi
+
+# Wait for a new line to land in TMPLOG (telemetry.sh's Stop path emits
+# asynchronously even in foreground mode's background-adjacent callers).
+_wait_for_line() {
+  local before_lines="$1" i=0 current_lines
+  while [[ $i -lt 50 ]]; do
+    current_lines=$(wc -l < "$TMPLOG" 2>/dev/null | tr -d ' ')
+    [[ "${current_lines:-0}" -gt "$before_lines" ]] && break
+    sleep 0.1; i=$((i + 1))
+  done
+}
+
+_wait_for_file_line() {
+  local file="$1" i=0 current_lines
+  while [[ $i -lt 50 ]]; do
+    current_lines=$(wc -l < "$file" 2>/dev/null | tr -d ' ')
+    [[ "${current_lines:-0}" -gt 0 ]] && break
+    sleep 0.1; i=$((i + 1))
+  done
+}
+
+# Run a real Stop event against a freshly-established session (agentSpawn
+# first, matching real usage — Claude Code always sends SessionStart before
+# Stop). Returns the emitted session.usage event (jq-compact, one line).
+_run_stop() {
+  local input="$1"; shift
+  local extra_env_count="$#"
+  local extra_env=("$@")
+  local common_env=(
+    HOME="$FAKE_HOME"
+    TELEMETRY_ENABLED=true
+    TELEMETRY_CHANNELS=full
+    TELEMETRY_CHANNEL_FULL_LOG_FILE="$TMPLOG"
+    FLOW_AGENTS_TELEMETRY_FOREGROUND=true
+    TELEMETRY_CONFIG_FILE="$TMPDIR_EVAL/telemetry.conf"
+    TELEMETRY_DATA_DIR="$TMPDIR_EVAL"
+    TELEMETRY_SESSION_DIR="$TMPDIR_EVAL/sessions"
+  )
+
+  local before_lines
+  touch "$TMPLOG"
+  before_lines=$(wc -l < "$TMPLOG" | tr -d ' ')
+  echo '{"cwd":"/tmp"}' | env "${common_env[@]}" bash "$TELEMETRY_SH" agentSpawn dev >/dev/null 2>&1
+  _wait_for_line "$before_lines"
+
+  before_lines=$(wc -l < "$TMPLOG" | tr -d ' ')
+  if [[ "$extra_env_count" -gt 0 ]]; then
+    echo "$input" | env "${common_env[@]}" TELEMETRY_USAGE_TRACKING=true "${extra_env[@]}" \
+      bash "$TELEMETRY_SH" Stop dev 2>/dev/null
+  else
+    echo "$input" | env "${common_env[@]}" TELEMETRY_USAGE_TRACKING=true \
+      bash "$TELEMETRY_SH" Stop dev 2>/dev/null
+  fi
+  _wait_for_line "$before_lines"
+
+  tail -n +"$((before_lines + 1))" "$TMPLOG" 2>/dev/null | jq -c 'select(.event_type=="session.usage")' | tail -1
+}
+
+# --- 1. With transcript + pricing available: real tokens, cost, concrete model
+echo "--- Fixture transcript, pricing available ---"
+input1=$(jq -nc --arg tp "$FIXTURE_TRANSCRIPT" '{session_id:"pipeline-1",transcript_path:$tp,hook_event_name:"Stop"}')
+out1=$(_run_stop "$input1" TELEMETRY_PRICING_FILE="$PRICING_FILE")
+
+if [[ -n "$out1" ]]; then
+  model=$(echo "$out1" | jq -r '.usage.model')
+  it=$(echo "$out1" | jq -r '.usage.input_tokens')
+  ot=$(echo "$out1" | jq -r '.usage.output_tokens')
+  cost=$(echo "$out1" | jq -r '.usage.estimated_cost_usd')
+  by_model_len=$(echo "$out1" | jq -r '.usage.by_model | length')
+
+  [[ "$model" != "unknown" && "$model" != "null" && -n "$model" ]] && _pass "model is concrete (got: $model)" || _fail "model should not be unknown (got: $model)"
+  [[ "$model" == "claude-opus-4-8" ]] && _pass "model is the dominant-by-tokens model (claude-opus-4-8)" || _fail "expected dominant model claude-opus-4-8, got $model"
+  [[ "$it" != "null" && "$it" -gt 0 ]] && _pass "input_tokens is real and non-null (got: $it)" || _fail "input_tokens should be non-null/positive (got: $it)"
+  [[ "$ot" != "null" && "$ot" -gt 0 ]] && _pass "output_tokens is real and non-null (got: $ot)" || _fail "output_tokens should be non-null/positive (got: $ot)"
+  cost_positive=$(echo "$out1" | jq -r '(.usage.estimated_cost_usd // 0) > 0')
+  [[ "$cost" != "null" && "$cost_positive" == "true" ]] && _pass "estimated_cost_usd is real and non-null (got: $cost)" || _fail "estimated_cost_usd should be non-null/positive (got: $cost)"
+  [[ "$by_model_len" == "2" ]] && _pass "by_model has 2 entries" || _fail "expected 2 by_model entries, got $by_model_len"
+else
+  _fail "no session.usage event emitted for fixture transcript"
+fi
+
+# --- 1b. Economics attribution: canonical current pointer beats stale legacy
+echo ""
+echo "--- Economics attribution uses canonical current pointer ---"
+ATTR_CWD="${TMPDIR_EVAL}/workspace"
+CANON_SLUG="canonical-task"
+LEGACY_SLUG="legacy-task"
+ECON_LOG="${TMPDIR_EVAL}/economics.jsonl"
+mkdir -p "$ATTR_CWD/.kontourai/flow-agents/$CANON_SLUG" "$ATTR_CWD/.flow-agents/$LEGACY_SLUG"
+: > "$ECON_LOG"
+printf '%s\n' "{\"active_slug\":\"$CANON_SLUG\"}" > "$ATTR_CWD/.kontourai/flow-agents/current.json"
+printf '%s\n' "{\"active_slug\":\"$LEGACY_SLUG\"}" > "$ATTR_CWD/.flow-agents/current.json"
+printf '%s\n' '{"schema_version":"1.0","task_slug":"canonical-task","phase":"execution","verification_verdict":"PASS"}' > "$ATTR_CWD/.kontourai/flow-agents/$CANON_SLUG/state.json"
+printf '%s\n' '{"schema_version":"1.0","task_slug":"legacy-task","phase":"execution","verification_verdict":"PASS"}' > "$ATTR_CWD/.flow-agents/$LEGACY_SLUG/state.json"
+input_attr=$(jq -nc --arg tp "$FIXTURE_TRANSCRIPT" --arg cwd "$ATTR_CWD" '{session_id:"pipeline-attribution",transcript_path:$tp,hook_event_name:"Stop",cwd:$cwd}')
+TELEMETRY_SH_SAVED="$TELEMETRY_SH"
+TELEMETRY_SH="$ROOT_DIR/scripts/telemetry/telemetry.sh"
+out_attr=$(_run_stop "$input_attr" TELEMETRY_PRICING_FILE="$PRICING_FILE" TELEMETRY_ECONOMICS_LOG_FILE="$ECON_LOG")
+TELEMETRY_SH="$TELEMETRY_SH_SAVED"
+_wait_for_file_line "$ECON_LOG"
+
+if [[ -n "$out_attr" && -s "$ECON_LOG" ]]; then
+  attr_task=$(tail -1 "$ECON_LOG" | jq -r '.task_slug')
+  attr_phase=$(tail -1 "$ECON_LOG" | jq -r '.phases[0].phase')
+  [[ "$attr_task" == "$CANON_SLUG" ]] && _pass "economics record task_slug comes from canonical .kontourai current pointer" || _fail "expected canonical task_slug '$CANON_SLUG', got '$attr_task'"
+  [[ "$attr_phase" == "execution" ]] && _pass "economics record phase comes from canonical state.json" || _fail "expected canonical phase execution, got '$attr_phase'"
+else
+  _fail "economics attribution record was not emitted for canonical-current test"
+fi
+
+# --- 2. Pricing forced unavailable: tokens survive, cost is null ------------
+echo ""
+echo "--- Fixture transcript, pricing forced unavailable ---"
+input2=$(jq -nc --arg tp "$FIXTURE_TRANSCRIPT" '{session_id:"pipeline-2",transcript_path:$tp,hook_event_name:"Stop"}')
+out2=$(_run_stop "$input2" TELEMETRY_PRICING_FILE=/nonexistent/pricing.json TELEMETRY_PRICING_URL="" FLOW_AGENTS_PRICING_FILE="" FLOW_AGENTS_PRICING_URL="")
+
+if [[ -n "$out2" ]]; then
+  it2=$(echo "$out2" | jq -r '.usage.input_tokens')
+  ot2=$(echo "$out2" | jq -r '.usage.output_tokens')
+  cost2=$(echo "$out2" | jq -r '.usage.estimated_cost_usd')
+  pv2=$(echo "$out2" | jq -r '.usage.pricing_version')
+  model2=$(echo "$out2" | jq -r '.usage.model')
+
+  [[ "$it2" != "null" && "$it2" -gt 0 ]] && _pass "tokens survive when pricing unavailable (input_tokens=$it2)" || _fail "tokens should survive when pricing unavailable (got input_tokens=$it2)"
+  [[ "$ot2" != "null" && "$ot2" -gt 0 ]] && _pass "output_tokens survive when pricing unavailable (got: $ot2)" || _fail "output_tokens should survive when pricing unavailable (got: $ot2)"
+  [[ "$cost2" == "null" ]] && _pass "estimated_cost_usd is null when pricing unavailable (cost degrades, tokens don't)" || _fail "estimated_cost_usd should be null when pricing unavailable (got: $cost2)"
+  [[ "$pv2" == "null" ]] && _pass "pricing_version is null when pricing unavailable" || _fail "pricing_version should be null when pricing unavailable (got: $pv2)"
+  [[ "$model2" == "claude-opus-4-8" ]] && _pass "model still resolves from transcript when pricing unavailable" || _fail "expected model claude-opus-4-8, got $model2"
+else
+  _fail "no session.usage event emitted when pricing forced unavailable"
+fi
+
+# --- 3. No transcript (kiro-cli style): model still resolves via kiro fallback, no regression
+echo ""
+echo "--- No transcript (kiro-cli non-regression) ---"
+input3='{"session_id":"pipeline-3","hook_event_name":"Stop"}'
+out3=$(_run_stop "$input3")
+
+if [[ -n "$out3" ]]; then
+  model3=$(echo "$out3" | jq -r '.usage.model')
+  it3=$(echo "$out3" | jq -r '.usage.input_tokens')
+  by_model3=$(echo "$out3" | jq -r '.usage.by_model')
+
+  # FAKE_HOME has no ~/.kiro/agents spec, so usage_get_model's kiro lookup
+  # falls through to "unknown" — this is the pre-existing, unfixed kiro path
+  # and must be untouched by the transcript-model override (transcript_usage
+  # is null here, so model is never overridden).
+  [[ "$model3" == "unknown" ]] && _pass "no-transcript path still resolves via usage_get_model kiro fallback (unknown, no regression)" || _fail "expected kiro fallback 'unknown' with no transcript, got $model3"
+  [[ "$it3" == "null" ]] && _pass "input_tokens is null with no transcript (expected)" || _fail "expected null input_tokens with no transcript, got $it3"
+  [[ "$by_model3" == "null" ]] && _pass "by_model is null with no transcript (expected)" || _fail "expected null by_model with no transcript, got $by_model3"
+else
+  _fail "no session.usage event emitted for no-transcript case"
+fi
+
+# --- 4. Empty transcript + TELEMETRY_USAGE_DEBUG=1: debug reason is emitted -
+echo ""
+echo "--- Empty transcript, TELEMETRY_USAGE_DEBUG=1 (debug path) ---"
+EMPTY_TRANSCRIPT="${TMPDIR_EVAL}/empty-transcript.jsonl"
+: > "$EMPTY_TRANSCRIPT"
+DEBUG_DRIFT_LOG="${TMPDIR_EVAL}/debug-drift.log"
+input4=$(jq -nc --arg tp "$EMPTY_TRANSCRIPT" '{session_id:"pipeline-4",transcript_path:$tp,hook_event_name:"Stop"}')
+out4=$(_run_stop "$input4" TELEMETRY_USAGE_DEBUG=1 TELEMETRY_DRIFT_LOG="$DEBUG_DRIFT_LOG")
+
+if grep -q '\[telemetry\] usage_parse_transcript:' "$DEBUG_DRIFT_LOG" 2>/dev/null; then
+  _pass "debug reason line emitted for empty-transcript no-usage scenario"
+else
+  _fail "expected a usage_parse_transcript debug reason line in $DEBUG_DRIFT_LOG"
+fi
+
+model4=$(echo "$out4" | jq -r '.usage.model // "unknown"' 2>/dev/null)
+[[ -z "$out4" || "$model4" == "unknown" ]] && _pass "empty-transcript path emits no real usage (no regression)" || _fail "expected no/unknown usage for empty transcript, got model=$model4"
+
+rm -rf "$TMPDIR_EVAL"
+
+echo ""
+echo "Telemetry usage pipeline: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]

package/evals/integration/test_trust_reconcile_negatives.sh

@@ -9,21 +9,23 @@
 #
 #   1. no-label-bypass       (finding 1) → not-run: a test_output claim with no
 #      manifest-matched execution.label is a divergence, never session-local.
-#   2. skip-assumed-bypass   (finding 2) → unwaived-assumed: 'assumed' alone is not a pass.
-#   3. status-misassertion   (finding 3) → status-misassertion: CI re-derives status; a
+#   2. mcp-degrade           (issue 492) → not-run: an MCP-shaped execution.label is not a
+#      manifest command and can never be RECONCILED as a CI-verified command check.
+#   3. skip-assumed-bypass   (finding 2) → unwaived-assumed: 'assumed' alone is not a pass.
+#   4. status-misassertion   (finding 3) → status-misassertion: CI re-derives status; a
 #      self-reported status that does not match the bundle's own evidence is rejected.
-#   4. waived-command-check  (finding 4) → waiver-on-command-check: a command-backed
+#   5. waived-command-check  (finding 4) → waiver-on-command-check: a command-backed
 #      (test_output) check cannot be waived.
-#   5. ws3-old-style-bundle  (AC6) → old all-test_output bundle FAILS the same way (exit 1,
+#   6. ws3-old-style-bundle  (AC6) → old all-test_output bundle FAILS the same way (exit 1,
 #      divergences) under the new reconciler as under the old one — no soundness regression.
-#   6. fabricated-attestation (iteration-4, converged iteration-3 finding, both gates) → a
+#   7. fabricated-attestation (iteration-4, converged iteration-3 finding, both gates) → a
 #      fully self-consistent, hand-fabricated no-command 'security' claim+evidence+event
 #      triple (indistinguishable from a genuine attestation at the reconciler's own
 #      re-derivation layer) MUST still pass (exit 0 — blocking attestations at L0 would break
 #      every honest human-attestation use) BUT MUST be loudly, distinctly marked
 #      'ATTESTED (not independently verifiable at L0)' plus the summary count line — never a
 #      quiet SESSION-LOCAL OK indistinguishable from a reconciled check. See ADR 0020 Residuals.
-#   7. delivery/DECLARED marker regressions (ADR 0022 §1/§2, section 7 below) — bundle-absent
+#   8. delivery/DECLARED marker regressions (ADR 0022 §1/§2, section 7 below) — bundle-absent
 #      fail-closed default, malformed/empty-array/missing-field diagnostics, and all four
 #      matchesScope() forms (ref:, commit: single + range, author:, branch-prefix:) including
 #      positive AND near-miss coverage, plus the compound (space-separated AND) scope form a
@@ -40,6 +42,7 @@
 set -uo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+source "$ROOT/evals/lib/node.sh"
 RECONCILE="$ROOT/scripts/ci/trust-reconcile.js"
 FX="$ROOT/evals/fixtures/trust-reconcile-exploits"
 WS3="$ROOT/evals/fixtures/trust-reconcile-ws3/ws3-bundle.json"
@@ -48,10 +51,12 @@ errors=0
 _pass() { echo "  PASS: $1"; }
 _fail() { echo "  FAIL: $1"; errors=$((errors + 1)); }
 
-# run_case <label> <bundle> <needle>
-# Asserts: reconciler exits non-zero AND stdout/stderr contains <needle>.
+# run_case <label> <bundle> <needle> [forbidden]
+# Asserts: reconciler exits non-zero, stdout/stderr contains <needle>, and optionally does
+# NOT contain <forbidden>.
 run_case() {
   local label="$1" bundle="$2" needle="$3"
+  local forbidden="${4:-}"
   echo "=== $label ==="
   if [[ ! -f "$bundle" ]]; then _fail "$label: fixture not found at $bundle"; return; fi
   local out code
@@ -68,25 +73,38 @@ run_case() {
   else
     _fail "$label: expected divergence \"$needle\" not found — output: $out"
   fi
+  if [[ -n "$forbidden" ]]; then
+    if echo "$out" | grep -qF "$forbidden"; then
+      _fail "$label: must NOT emit \"$forbidden\" — output: $out"
+    else
+      _pass "$label: does not emit \"$forbidden\""
+    fi
+  fi
 }
 
 # 1. Reviewer's no-label exploit → not-run (test_output must reconcile against the manifest).
 run_case "no-label-bypass (finding 1)" "$FX/no-label-bypass.json" \
   "no manifest-matched execution.label"
 
-# 2. Verifier's skip->assumed exploit → unwaived-assumed.
+# 2. Issue #492: MCP-shaped self-reported pass → not-run (not manifest-matched), never
+#    RECONCILED as a CI-verified command check.
+run_case "mcp-degrade (issue 492)" "$FX/mcp-degrade.json" \
+  "command is not in the reconcile manifest" \
+  "RECONCILED"
+
+# 3. Verifier's skip->assumed exploit → unwaived-assumed.
 run_case "skip-assumed-bypass (finding 2)" "$FX/skip-assumed-bypass.json" \
   "[unwaived-assumed]"
 
-# 3. Status-misassertion exploit → status re-derived CI-side; asserted != derived.
+# 4. Status-misassertion exploit → status re-derived CI-side; asserted != derived.
 run_case "status-misassertion (finding 3)" "$FX/status-misassertion.json" \
   "[status-misassertion]"
 
-# 4. Waived command-backed check → waiver-on-command-check.
+# 5. Waived command-backed check → waiver-on-command-check.
 run_case "waived-command-check (finding 4)" "$FX/waived-command-check.json" \
   "[waiver-on-command-check]"
 
-# 5. AC6 backward-compat regression: the real ws3-kit-dependencies-namespacing/trust.bundle
+# 6. AC6 backward-compat regression: the real ws3-kit-dependencies-namespacing/trust.bundle
 #    (an old-style all-test_output bundle whose commands are not manifest-matched) FAILS the
 #    same way under the new reconciler as under the old one — same FAIL verdict, divergences
 #    present, no silent pass introduced.
@@ -114,7 +132,7 @@ else
   fi
 fi
 
-# 6. Fabricated-attestation (iteration-4): passes (exit 0) but MUST carry the loud ATTESTED
+# 7. Fabricated-attestation (iteration-4): passes (exit 0) but MUST carry the loud ATTESTED
 #    marker and the summary count line — NOT the old quiet SESSION-LOCAL OK. This is a
 #    visibility assertion, not a divergence assertion (unlike run_case above): a fabricated
 #    self-consistent attestation bundle is, by construction, indistinguishable from a genuine
@@ -919,6 +937,96 @@ else
   _fail "prefer-newest: expected 'owning, newest wins' in the selection line -- output: $out8d"
 fi
 
+# 9. [iteration-1 F1 CRITICAL regression guard] CI trust-reconcile.js MUST stay fail-closed
+#   when scripts/ci/derive-claim-status.mjs is unavailable (Surface unresolvable, spawn
+#   failure, malformed bundle, etc.) -- deriveClaimStatuses() returns null in that case, and
+#   BEFORE #356's extraction the inline session-local loop turned every session-local
+#   pass-asserting claim into a `status-underivable` divergence (hard FAIL). The extraction's
+#   shared sessionLocalShapeIssues() briefly made that a caller-controlled `onUnderivable` mode
+#   (see reconcile-shape.js) -- this section proves CI still defaults/forces the safe 'fail'
+#   mode, and (paired) that the LOCAL reconcile-preflight intentionally diverges into the
+#   'reduce' mode on the exact same bundle. Without the fix, case 9a below FAILS (exits 0
+#   instead of 1) -- this is the single regression eval that let the CRITICAL through
+#   code-review-356 iteration 0.
+echo ""
+echo "=== 9. derive-claim-status.mjs unavailable: CI fail-closed vs local-preflight reduced-coverage (iteration-1 F1) ==="
+
+DERIVE_HELPER="$ROOT/scripts/ci/derive-claim-status.mjs"
+DERIVE_HELPER_HIDDEN="$DERIVE_HELPER.hidden-by-test-9"
+
+# hide_derive_helper / restore_derive_helper: rename the real ESM helper out of the way so
+# scripts/ci/trust-reconcile.js's deriveClaimStatuses() -- which does fs.existsSync(helper)
+# before ever spawning it -- returns null exactly as it would if Surface could not resolve.
+# Always restored via trap, including on a hard failure of this script.
+hide_derive_helper() {
+  if [[ -f "$DERIVE_HELPER" ]]; then
+    mv "$DERIVE_HELPER" "$DERIVE_HELPER_HIDDEN"
+  fi
+}
+restore_derive_helper() {
+  if [[ -f "$DERIVE_HELPER_HIDDEN" ]]; then
+    mv "$DERIVE_HELPER_HIDDEN" "$DERIVE_HELPER"
+  fi
+}
+trap 'cleanup_declared; rm -rf "$PERSESSION_TMPROOT"; restore_derive_helper' EXIT
+
+# A one-claim, session-local, pass-asserting bundle (reuses the finding-3 exploit fixture --
+# a human_attestation-backed claim asserting status "verified"; any session-local
+# pass-asserting claim exercises this path since the whole derivedStatus map is null, not a
+# single claim's lookup).
+CASE9_BUNDLE="$FX/status-misassertion.json"
+
+hide_derive_helper
+
+# 9a. CI (real scripts/ci/trust-reconcile.js): derive-claim-status.mjs unavailable -> MUST
+#     still exit non-zero (status-underivable, fail-closed) -- the pre-#356 guarantee.
+out9a="$(TRUST_RECONCILE_COMMANDS="node -e 'process.exit(0)'" \
+  node "$RECONCILE" --bundle "$CASE9_BUNDLE" --repo-root "$ROOT" 2>&1)"
+code9a=$?
+if [[ $code9a -ne 0 ]]; then
+  _pass "derive-unavailable-ci: reconciler exits non-zero ($code9a) -- fail-closed preserved when re-derivation is unavailable"
+else
+  _fail "derive-unavailable-ci: expected non-zero exit (fail-closed), got 0 -- output: $out9a"
+fi
+if echo "$out9a" | grep -qF "[status-underivable]"; then
+  _pass "derive-unavailable-ci: emitted the status-underivable divergence"
+else
+  _fail "derive-unavailable-ci: expected a [status-underivable] divergence -- output: $out9a"
+fi
+if echo "$out9a" | grep -qF "refusing to trust a self-reported status (fail-closed)"; then
+  _pass "derive-unavailable-ci: emitted the verbatim fail-closed message"
+else
+  _fail "derive-unavailable-ci: expected the verbatim fail-closed message -- output: $out9a"
+fi
+
+# 9b. Paired proof the modes diverge intentionally: the LOCAL reconcile-preflight, on the
+#     SAME bundle with the SAME helper hidden, DEGRADES -- it does not hard-fail on the
+#     underivable-status dimension (it opts into reduce mode explicitly; see
+#     src/cli/workflow-sidecar.ts's runReconcilePreflight).
+# Nested under a subdirectory (not the raw mktemp -d path) -- mktemp -d's own
+# "tmp.XXXXXXXXXX" basename contains a dot that path.extname()/artifactDirFrom() would
+# misparse as a file extension, incorrectly stripping the directory segment.
+CASE9_TMPROOT="$(mktemp -d)"
+CASE9_SESSION="$CASE9_TMPROOT/session"
+mkdir -p "$CASE9_SESSION"
+cp "$CASE9_BUNDLE" "$CASE9_SESSION/trust.bundle"
+out9b="$(flow_agents_node workflow-sidecar reconcile-preflight "$CASE9_SESSION" --repo-root "$ROOT" 2>&1)"
+code9b=$?
+rm -rf "$CASE9_TMPROOT"
+if [[ $code9b -eq 0 ]]; then
+  _pass "derive-unavailable-local-preflight: reconcile-preflight exits 0 (reduced-coverage degrade, not a hard fail) -- proves the CI/local modes diverge intentionally"
+else
+  _fail "derive-unavailable-local-preflight: expected exit 0 (reduced-coverage degrade), got $code9b -- output: $out9b"
+fi
+if echo "$out9b" | grep -qF "status-underivable"; then
+  _fail "derive-unavailable-local-preflight: must NOT emit status-underivable in reduced-coverage mode -- output: $out9b"
+else
+  _pass "derive-unavailable-local-preflight: does not emit status-underivable (reduced-coverage checks only)"
+fi
+
+restore_derive_helper
+
+
 echo ""
 if [[ $errors -eq 0 ]]; then
   echo "test_trust_reconcile_negatives: all checks passed."