@kontourai/flow-agents 3.2.0 → 3.4.0

package/scripts/ci/trust-reconcile.js

@@ -91,6 +91,25 @@
  *                                         0022 addendum, part 4) — see
  *                                         resolveEnforcementEvent(). Default (unset/
  *                                         unrecognized): treated as a gating event.
+ *   TRUST_RECONCILE_BASE_REF              Optional PR base ref (falls back to
+ *                                         GITHUB_BASE_REF, set by GitHub Actions on
+ *                                         `pull_request` events only) used SOLELY by the
+ *                                         audit-only runtime-session-trailer diagnostic
+ *                                         below to bound its commit-log scan
+ *                                         (`git log <base>..<sha>`); unset/unresolvable →
+ *                                         diagnostic narrows to scanning just the head
+ *                                         commit's own message (documented, accepted
+ *                                         fallback — never a crash, never widens scope).
+ *                                         Never affects Step 1/Step 2/exit-code logic.
+ *
+ * Runtime-session commit-trailer diagnostic (ADR 0022 §1, issue #305 — AUDIT ONLY, never
+ * gating): every run logs a `[trust-reconcile] identified: runtime-session trailer
+ * '<trailer>' on <ref>` line for each distinct `Claude-Session:` / `Codex-Session:` /
+ * `Opencode-Session:` / `Pi-Session:` commit trailer found in the resolved commit range
+ * (see findRuntimeSessionTrailers()/logRuntimeSessionTrailers()). Logs the trailer KEY only
+ * (e.g. `Claude-Session`) — never the trailer VALUE (typically a session URL) — per the
+ * ADR's own quoted line format. This is diagnostic/attribution only: it never writes to
+ * ciResults/issues[] and never changes the exit code, on any path.
  *
  * Auto-discovery (when no --bundle or TRUST_RECONCILE_BUNDLE is set):
  *   Checks delivery/trust.bundle, then delivery/trust.checkpoint.json under repo root
@@ -124,6 +143,18 @@ const path = require('path');
 // copy here had drifted (it was missing the trailing `/bin/true` check), which is
 // exactly why this is now imported rather than duplicated.
 const { hasLaunderingOperator } = require('../lib/command-log-chain.js');
+// #356: the bundle-shape classification (classifyBundleClaims) and the pure,
+// shape-level divergence-construction helpers used by Step 2 below are shared with a
+// local pre-push preflight (reconcile-preflight) via this module, so the preflight can
+// never drift from what this CI reconciler actually enforces. See that module's own
+// header comment for the extraction rationale.
+const {
+  classifyBundleClaims,
+  waiverOnCommandIssues,
+  noEvidenceCommandIssues,
+  reconcilableManifestIssues,
+  sessionLocalShapeIssues,
+} = require('../lib/reconcile-shape.js');
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -199,138 +230,6 @@ function runCommand(cmd, repoRoot) {
   };
 }
 
-/**
- * Classify a trust.bundle's claims into: reconcilable command claims (test_output +
- * execution.label), session-local claims (attestation/observation/citation), never-captured
- * or unbacked command claims (not-run divergence), and command-backed claims carrying a
- * waiver (waiver-on-command divergence). Returns
- *   { reconcilable, sessionLocal, noEvidenceCommand, waiverOnCommand }.
- *
- * Source of truth: evidence[].execution.label is the command string recorded at capture time.
- * evidence[].passing (normalized) means the agent claimed this passed. `claim.status` is NOT
- * trusted here — the caller re-derives it CI-side (see derive-claim-status.mjs / finding-3).
- *
- * WS8 iteration-2 hardening:
- *   - finding 1: ANY pass-asserting claim whose evidence is `evidenceType: test_output`
- *     (Surface's default when unset) but which did NOT reconcile — i.e. it has no
- *     manifest-matchable execution.label — is a divergence, NOT session-local. A test_output
- *     claim either reconciles against the manifest or is a divergence; it is never accepted on
- *     self-reported status. (Previously only the literal claimType `workflow.check.command`
- *     was guarded, so a fabricated kind:"test" claim with no command slipped through.)
- *   - finding 4: a command-backed (test_output) claim carrying a waiver is a divergence — a
- *     command-backed check reconciles against CI or fails; it cannot be waived.
- */
-function classifyBundleClaims(bundle) {
-  const evidence = Array.isArray(bundle.evidence) ? bundle.evidence : [];
-  const claims = Array.isArray(bundle.claims) ? bundle.claims : [];
-
-  const claimById = new Map();
-  for (const c of claims) if (c && c.id) claimById.set(c.id, c);
-
-  // Evidence indexing. A missing evidenceType defaults to test_output for backward
-  // compatibility with pre-classification bundles (same default classifyEvidence uses).
-  const claimHasLabeledTestOutput = new Set(); // test_output evidence WITH an execution.label
-  const claimHasTestOutputEvidence = new Set(); // ANY test_output evidence (label or not)
-  // WS8 iteration-4 (converged finding): the session-local (non-test_output) evidenceType per
-  // claim, so the reconciler can name it on the loud ATTESTED marker below — a fabricated
-  // human_attestation/attestation/external claim with no --command is otherwise
-  // indistinguishable, in the reconciler's own output, from a genuinely re-runnable check.
-  const claimEvidenceType = new Map();
-  for (const ev of evidence) {
-    if (!ev || !ev.claimId) continue;
-    const evType = ev.evidenceType || 'test_output';
-    if (evType !== 'test_output') {
-      if (!claimEvidenceType.has(ev.claimId)) claimEvidenceType.set(ev.claimId, evType);
-      continue;
-    }
-    claimHasTestOutputEvidence.add(ev.claimId);
-    if (ev.execution && ev.execution.label) claimHasLabeledTestOutput.add(ev.claimId);
-  }
-
-  // finding 4: a command-backed (test_output-evidence) claim that also carries a waiver.
-  const waiverOnCommand = [];
-  for (const c of claims) {
-    if (!c || !c.id) continue;
-    const waiver = (c.metadata && typeof c.metadata === 'object') ? c.metadata.waiver : undefined;
-    if (waiver && typeof waiver === 'object' && claimHasTestOutputEvidence.has(c.id)) {
-      waiverOnCommand.push({ claimId: c.id, claimType: String(c.claimType || ''), subject: c.subjectId || c.fieldOrBehavior || c.id });
-    }
-  }
-
-  // (A) Reconcilable claimed-passes: evidence items that are test_output (CI-reconcilable),
-  // carry an execution.label, and assert pass. Session-local evidenceTypes
-  // (crawl_observation, human_attestation, attestation, policy_rule, source_excerpt,
-  // document_citation, calculation_trace) are NOT reconciled per-command — they are handled
-  // by the session-local/waiver path below.
-  const reconcilable = [];
-  const reconcilableClaimIds = new Set();
-  const seen = new Set();
-  for (const ev of evidence) {
-    if (!ev || !ev.execution || !ev.execution.label) continue;
-    if (!isPassingValue(ev.passing)) continue;
-    const evType = ev.evidenceType || 'test_output';
-    if (evType !== 'test_output') continue; // session-local — not CI-reconcilable
-    const cmd = normalizeCmd(ev.execution.label);
-    if (!cmd) continue;
-    reconcilableClaimIds.add(ev.claimId);
-    if (seen.has(cmd)) continue;
-    seen.add(cmd);
-    const claim = claimById.get(ev.claimId);
-    reconcilable.push({ cmd, claimId: ev.claimId, evId: ev.id, claimType: claim ? String(claim.claimType || '') : '' });
-  }
-
-  // (B) Session-local claims, never-captured command claims, and unreconciled test_output.
-  const sessionLocal = [];
-  const noEvidenceCommand = [];
-  const seenClaims = new Set();
-  for (const c of claims) {
-    if (!c || !c.id || typeof c.claimType !== 'string') continue;
-    // #267/#282: a superseded critique write is HISTORY — excluded from reconcile evaluation so a
-    // resolved session converges (a fail critique that a later same-reviewer pass superseded no
-    // longer blocks). Scoped to NON-test_output claims so a command-backed claim can never launder
-    // a real failure by carrying superseded_by — a test_output claim always reconciles or diverges.
-    if (c.metadata && typeof c.metadata === 'object' && c.metadata.superseded_by && !claimHasTestOutputEvidence.has(c.id)) continue;
-    if (reconcilableClaimIds.has(c.id)) continue; // handled by (A)
-    if (seenClaims.has(c.id)) continue;
-    const status = String(c.status || '');
-    const assertsPass = isPassingValue(c.value) || status === 'verified' || status === 'assumed';
-    const isFailing = status === 'disputed' || status === 'rejected';
-    if (!assertsPass && !isFailing) continue; // pending/unknown non-asserting — ignore (as before)
-    seenClaims.add(c.id);
-
-    // finding 1: a pass-asserting claim backed by test_output evidence that did NOT reconcile
-    // (it has test_output evidence but no manifest-matchable execution.label — otherwise it
-    // would be in bucket A) is a not-run divergence. A test_output claim reconciles against the
-    // manifest or it is a divergence — it is NEVER accepted as session-local on self-report.
-    if (assertsPass && claimHasTestOutputEvidence.has(c.id)) {
-      const rawCmd = normalizeCmd(c.fieldOrBehavior || c.value || '');
-      noEvidenceCommand.push({ cmd: rawCmd || `[claim:${c.id}]`, claimId: c.id, claimType: c.claimType, reason: 'test_output-unreconciled' });
-      continue;
-    }
-
-    // A workflow.check.command claim with no captured (labeled) evidence is a never-captured
-    // claimed pass — not-run divergence (anti-gaming teeth preserved).
-    if (assertsPass && c.claimType === 'workflow.check.command' && !claimHasLabeledTestOutput.has(c.id)) {
-      const rawCmd = normalizeCmd(c.fieldOrBehavior || c.value || '');
-      noEvidenceCommand.push({ cmd: rawCmd || `[claim:${c.id}:${c.claimType}]`, claimId: c.id, claimType: c.claimType, reason: 'no-evidence-command' });
-      continue;
-    }
-
-    const waiver = (c.metadata && typeof c.metadata === 'object') ? c.metadata.waiver : undefined;
-    sessionLocal.push({
-      claimId: c.id,
-      claimType: c.claimType,
-      assertedStatus: status,
-      value: c.value,
-      waiver: (waiver && typeof waiver === 'object') ? waiver : null,
-      subject: c.subjectId || c.fieldOrBehavior || c.id,
-      evidenceType: claimEvidenceType.get(c.id) || 'unknown',
-    });
-  }
-
-  return { reconcilable, sessionLocal, noEvidenceCommand, waiverOnCommand };
-}
-
 /**
  * WS8 (finding 3): re-derive every claim's status CI-side from the bundle's OWN
  * evidence/events/policies, using @kontourai/surface's canonical deriveClaimStatus (the same
@@ -793,6 +692,111 @@ function isShaInRange(repoRoot, sha, from, to) {
   return isAncestorCommit(repoRoot, from, sha) && isAncestorCommit(repoRoot, sha, to);
 }
 
+/**
+ * Runtime-session commit-trailer names this reconciler recognizes for the audit-only
+ * diagnostic below (ADR 0022 §1, table row 1). These are commit-message TRAILER keys
+ * (e.g. `Claude-Session: https://claude.ai/code/session_...`), a distinct vocabulary from
+ * scripts/hooks/lib/actor-identity.js's RUNTIME_SESSION_ID_VARS (env var names) — but the
+ * same four-runtime enumeration (claude-code/codex/opencode/pi).
+ */
+const RUNTIME_SESSION_TRAILER_NAMES = [
+  'Claude-Session',
+  'Codex-Session',
+  'Opencode-Session',
+  'Pi-Session',
+];
+
+/**
+ * Diagnostic-only (ADR 0022 §1): find runtime-session commit trailers (`Claude-Session:`,
+ * `Codex-Session:`, `Opencode-Session:`, `Pi-Session:`) across the commit range this run is
+ * evaluating, and report which trailer KEYS were found — never the trailer VALUE (typically
+ * a session URL). "Commit trailer present — logged by the reconciler ... for audit; does not
+ * change the exit path" (ADR 0022 §1). This function is write-only diagnostics: its return
+ * value / any failure NEVER feeds ciResults, issues[], or the exit code.
+ *
+ * Range resolution (accepted, documented narrower fallback — ADR 0022 §1 Residuals):
+ *   - Prefer `git log <baseRef>..<sha>` when a PR base ref is resolvable
+ *     (TRUST_RECONCILE_BASE_REF env override, else GITHUB_BASE_REF — set by GitHub Actions
+ *     on `pull_request` events only).
+ *   - No base ref resolvable (local/manual invocation, `push`/`workflow_dispatch` events,
+ *     which have no PR base) — falls back to scanning just `ctx.sha`'s own commit message.
+ *     This is a narrower-than-ideal default (misses trailers on other commits in an
+ *     unresolvable range) but is NEVER a crash and NEVER silently expands scope beyond what
+ *     is actually derivable — documented gap, not a silent limitation.
+ *   - No usable sha at all — zero trailers found (nothing to scan).
+ *
+ * @param {string} repoRoot - Repository root (cwd for git subprocess calls).
+ * @param {{ref: string, sha: string}} ctx - Resolved scope context (resolveScopeContext()).
+ * @returns {Array<{trailerName: string, ref: string}>} Distinct (trailerName) diagnostics
+ *   found in range, each paired with the ref to log against. Empty array on any failure or
+ *   when no trailer is present — never throws.
+ */
+function findRuntimeSessionTrailers(repoRoot, ctx) {
+  const sha = (ctx && ctx.sha) || '';
+  if (!sha) return [];
+  const ref = (ctx && ctx.ref) || sha;
+
+  const baseRef = (process.env.TRUST_RECONCILE_BASE_REF || process.env.GITHUB_BASE_REF || '').trim();
+
+  let commitMessages = [];
+  try {
+    if (baseRef) {
+      const res = spawnSync('git', ['log', '--format=%B%x00', `${baseRef}..${sha}`], {
+        cwd: repoRoot, encoding: 'utf8',
+      });
+      if (res && !res.error && res.status === 0 && typeof res.stdout === 'string') {
+        commitMessages = res.stdout.split('\0').map((m) => m.trim()).filter(Boolean);
+      }
+    }
+    // No base ref resolvable, or the ranged log produced nothing usable — fall back to
+    // just the head commit's own message (accepted narrower default, never a crash).
+    if (!baseRef || commitMessages.length === 0) {
+      const res = spawnSync('git', ['log', '--format=%B', '-1', sha], {
+        cwd: repoRoot, encoding: 'utf8',
+      });
+      if (res && !res.error && res.status === 0 && typeof res.stdout === 'string' && res.stdout.trim()) {
+        commitMessages = [res.stdout.trim()];
+      }
+    }
+  } catch {
+    return [];
+  }
+
+  const found = [];
+  const seen = new Set();
+  for (const message of commitMessages) {
+    for (const trailerName of RUNTIME_SESSION_TRAILER_NAMES) {
+      if (seen.has(trailerName)) continue;
+      const prefix = `${trailerName}:`;
+      const hasTrailer = message.split('\n').some((line) => line.trim().startsWith(prefix));
+      if (hasTrailer) {
+        seen.add(trailerName);
+        found.push({ trailerName, ref });
+      }
+    }
+  }
+  return found;
+}
+
+/**
+ * Diagnostic-only (ADR 0022 §1): write the audit line for each runtime-session commit
+ * trailer found in range. Never touches ciResults/issues[]/exit code — wrapped so any
+ * unexpected failure degrades to zero lines written, never a thrown error.
+ *
+ * @param {string} repoRoot
+ * @param {{ref: string, sha: string}} ctx
+ */
+function logRuntimeSessionTrailers(repoRoot, ctx) {
+  try {
+    const trailers = findRuntimeSessionTrailers(repoRoot, ctx);
+    for (const { trailerName, ref } of trailers) {
+      process.stdout.write(`[trust-reconcile] identified: runtime-session trailer '${trailerName}' on ${ref}\n`);
+    }
+  } catch {
+    // Diagnostic-only — any failure here must never affect the reconciler's outcome.
+  }
+}
+
 /**
  * Match a SINGLE scope condition (one of the four forms) against the resolved context.
  * Extracted from matchesScope() so a compound (space-separated, AND) scope can validate
@@ -1030,6 +1034,13 @@ function runTrustReconcile({ bundle = null, commands = [], repoRoot = null, mani
   // to pick, among per-session candidates, the one that attests THIS change.
   const scopeCtx = resolveScopeContext(resolvedRepoRoot);
 
+  // Diagnostic-only (ADR 0022 §1, issue #305): audit-log any runtime-session commit
+  // trailer found in range — logged for attribution, never gating. Runs unconditionally,
+  // regardless of bundle/DECLARED branch, immediately after scopeCtx resolves and before
+  // bundle auto-discovery/Step 1, so it always fires the same way whether or not a bundle
+  // or DECLARED exemption is later found. Never affects ciResults/issues[]/exit code.
+  logRuntimeSessionTrailers(resolvedRepoRoot, scopeCtx);
+
   let bundlePath = explicitBundlePath || discoverBundle(resolvedRepoRoot, scopeCtx.sha) || null;
   const bundleWasAutoDiscovered = !explicitBundlePath && !!bundlePath;
 
@@ -1224,50 +1235,24 @@ function runTrustReconcile({ bundle = null, commands = [], repoRoot = null, mani
       }
 
       // finding 4 (server-side): a command-backed (test_output-evidence) claim carrying a
-      // waiver is a divergence — a command-backed check reconciles against CI or fails; it
-      // cannot be waived away.
-      for (const { claimId, claimType, subject } of waiverOnCommand) {
-        issues.push({
-          type: 'waiver-on-command-check',
-          message: `trust divergence: claim '${claimId}' (${subject}, claimType: ${claimType}) carries a waiver but is backed by test_output evidence — a command-backed check reconciles against CI or fails and cannot be waived`,
-        });
-      }
+      // waiver is a divergence — shape-only, delegated to scripts/lib/reconcile-shape.js
+      // (used byte-identically here and by the local reconcile-preflight).
+      issues.push(...waiverOnCommandIssues(waiverOnCommand));
 
       // not-run divergences: never-captured command claims (no evidence) AND test_output
-      // claims that did not reconcile (no manifest-matchable execution.label).
-      for (const { cmd, claimId, claimType, reason } of noEvidenceCommand) {
-        const message = reason === 'test_output-unreconciled'
-          ? `trust divergence: claim '${claimId}' (claimType: ${claimType}) asserts pass with test_output evidence but has no manifest-matched execution.label — a test_output claim must reconcile against the manifest or it is a divergence (never accepted as session-local)`
-          : `trust divergence: claim '${claimId}' (claimType: ${claimType}) asserts pass but has no supporting evidence item — command never captured`;
-        issues.push({ type: 'not-run', cmd, message });
-      }
-
-      // Reconcilable test_output claims: laundering → manifest match → CI fresh result.
-      for (const { cmd } of reconcilable) {
+      // claims that did not reconcile (no manifest-matchable execution.label). Shape-only,
+      // delegated to scripts/lib/reconcile-shape.js.
+      issues.push(...noEvidenceCommandIssues(noEvidenceCommand));
+
+      // Reconcilable test_output claims: laundering → manifest match (shape-only, delegated
+      // to scripts/lib/reconcile-shape.js) → CI fresh result (CI-only, stays here — requires
+      // a live command execution the local preflight must not perform).
+      const { issues: manifestIssues, unresolved: reconcilableUnresolved } =
+        reconcilableManifestIssues(reconcilable, manifestByCmd);
+      issues.push(...manifestIssues);
+      for (const { cmd, manifestEntry: entry } of reconcilableUnresolved) {
         const normalCmd = normalizeCmd(cmd);
 
-        // (a) Laundering operator check — must come first (most specific signal).
-        if (hasLaunderingOperator(cmd)) {
-          issues.push({
-            type: 'laundering',
-            cmd,
-            message: `trust divergence: agent claimed '${cmd}' passed; command contains exit-code-laundering operator (|| ... / ; true / ; exit 0 / etc.)`,
-          });
-          continue;
-        }
-
-        // A test_output claim MUST name a manifest (required-lane) command. An agent
-        // cannot self-label an arbitrary command test_output to dodge the manifest.
-        const entry = manifestByCmd.get(normalCmd);
-        if (!entry) {
-          issues.push({
-            type: 'not-run',
-            cmd,
-            message: `trust divergence: agent claimed '${cmd}' passed; command is not in the reconcile manifest — a test_output claim must name a manifest/required-lane command (CI cannot self-declare an arbitrary command)`,
-          });
-          continue;
-        }
-
         // Prefer the fresh-verify Step 1 result; otherwise re-run this (manifest, and
         // therefore required-lane) command fresh now. Only manifest commands are ever
         // run on demand, so the set is bounded by the registry.
@@ -1303,90 +1288,26 @@ function runTrustReconcile({ bundle = null, commands = [], repoRoot = null, mani
         process.stdout.write(`[trust-reconcile]   RECONCILED: '${cmd}' (manifest id: ${entry.id}) — claimed pass, CI fresh run = PASS\n`);
       }
 
-      // Session-local claims: not CI-reconcilable, but NOT a pass bypass. Each must either
-      // (a) carry a loud, justified waiver, or (b) resolve a real CI-RE-DERIVED `verified`
-      // status. WS8 iteration-2 hardening:
-      //   - finding 3: the status used here is RE-DERIVED CI-side, never the self-reported
-      //     claim.status. A mismatch is a `status-misassertion` divergence. If re-derivation
-      //     is unavailable we fail closed (`status-underivable`) — we never fall back to
-      //     trusting the bundle's own status.
-      //   - finding 2: `assumed` alone is NO LONGER a silent pass. `assumed` is acceptable
-      //     ONLY with a waiver (printed as a loud WAIVED line). An unwaived `assumed` claim is
-      //     an `unwaived-assumed` divergence (restores pre-WS8 semantics where `assumed` alone
-      //     never satisfied assertsPass).
-      //
-      // WS8 iteration-4 (converged iteration-3 finding, both gates): a session-local claim
-      // that re-derives `verified` with NO waiver is, by definition, backed only by
-      // human_attestation/attestation/external/etc. evidence with no --command — i.e.
-      // `deriveClaimStatus` only proves the bundle is internally self-consistent, never that
-      // the underlying attestation is true. A fully fabricated bundle (fake claim + fake
-      // evidence + fake event, all hand-authored to agree) is INDISTINGUISHABLE from a real
-      // one at this layer. This was previously printed as a quiet `SESSION-LOCAL OK` line
-      // indistinguishable from a genuinely reconciled check. It is now always printed as a
-      // loud, distinct `ATTESTED (not independently verifiable at L0)` marker — see ADR 0020
-      // Residuals. This does NOT change the exit code (attestations are not blocked at L0;
-      // blocking every honest human-attestation use is not the fix) — it is a visibility-only
-      // change so a reviewer/downstream tool can grep for and count exactly how many claims in
-      // a passing bundle rest on bundle-internal consistency alone rather than independent
-      // (CI fresh-run or cryptographically-signed) verification.
-      let attestedCount = 0;
-      for (const { claimId, claimType, assertedStatus, waiver, subject, evidenceType } of sessionLocal) {
-        // finding 3: re-derive; never trust the asserted status.
-        let status;
-        if (!derivedStatus) {
-          issues.push({
-            type: 'status-underivable',
-            message: `trust divergence: session-local claim '${claimId}' (claimType: ${claimType}) asserts status '${assertedStatus || 'unknown'}' but CI-side re-derivation is unavailable — refusing to trust a self-reported status (fail-closed)`,
-          });
-          continue;
-        }
-        const derived = derivedStatus.get(claimId);
-        if (derived === undefined || derived === null) {
-          issues.push({
-            type: 'status-underivable',
-            message: `trust divergence: session-local claim '${claimId}' (claimType: ${claimType}) could not be re-derived CI-side from the bundle's own evidence/events/policies — refusing to trust its self-reported status '${assertedStatus || 'unknown'}' (fail-closed)`,
-          });
-          continue;
-        }
-        if (derived !== assertedStatus) {
-          issues.push({
-            type: 'status-misassertion',
-            message: `trust divergence: session-local claim '${claimId}' (claimType: ${claimType}) asserts status '${assertedStatus || 'unknown'}' but CI re-derivation from the bundle's own evidence/events/policies yields '${derived}' — the reconciler does not trust self-reported claim.status`,
-          });
-          continue;
-        }
-        status = derived;
-
-        if (status === 'disputed' || status === 'rejected') {
-          issues.push({
-            type: 'session-local-failed',
-            message: `trust divergence: session-local claim '${claimId}' (claimType: ${claimType}) has re-derived status '${status}' — a failing/rejected claim blocks (session-local classification is not a pass bypass)`,
-          });
-          continue;
-        }
-        // finding 2: a waiver is the ONLY way an `assumed` (or otherwise non-`verified`)
-        // session-local claim passes, and it is printed loudly. `verified` still passes on its
-        // own re-derived status.
-        if (waiver && waiver.reason && waiver.approved_by) {
+      // Session-local claims: not CI-reconcilable, but NOT a pass bypass. Shape-only,
+      // delegated to scripts/lib/reconcile-shape.js (sessionLocalShapeIssues) — see that
+      // module for the full WS8 finding-2/finding-3/iteration-4 rationale (waiver-only pass
+      // for non-`verified` status, CI-re-derived status never self-reported, loud ATTESTED
+      // marker for bundle-internal-only consistency). iteration-1 F1: CI MUST pass
+      // `onUnderivable: 'fail'` explicitly — this is CI's trust anchor and must never silently
+      // degrade to trusting a self-reported status when re-derivation is unavailable (that
+      // reduced-coverage mode is opt-in only, for the LOCAL preflight — see reconcile-shape.js).
+      // iteration-1 F3: the WAIVED/ATTESTED log lines below are driven by the shared function's
+      // own `logEvents` classification (not a parallel re-derivation) so CI's stdout narrative
+      // can never drift from what sessionLocalShapeIssues actually decided.
+      const { issues: sessionLocalIssues, attestedCount, logEvents } =
+        sessionLocalShapeIssues(sessionLocal, derivedStatus, { onUnderivable: 'fail' });
+      issues.push(...sessionLocalIssues);
+      for (const { kind, claimId, claimType, subject, evidenceType, status, waiver } of logEvents) {
+        if (kind === 'waived') {
           process.stdout.write(`[trust-reconcile] WAIVED: ${subject} (${claimType}) status=${status} — ${waiver.reason} (approved by ${waiver.approved_by})\n`);
-          continue;
-        }
-        if (status === 'verified') {
-          attestedCount++;
+        } else if (kind === 'attested') {
           process.stdout.write(`[trust-reconcile] ATTESTED (not independently verifiable at L0): '${claimId}' (${claimType}) evidenceType=${evidenceType} — accepted on bundle-internal consistency only; see ADR 0020 Residuals\n`);
-          continue;
-        }
-        if (status === 'assumed') {
-          issues.push({
-            type: 'unwaived-assumed',
-            message: `trust divergence: session-local claim '${claimId}' (claimType: ${claimType}) has re-derived status 'assumed' but carries no waiver — 'assumed' alone is not a pass; it requires a documented waiver (--accepted-gap-reason/--waived-by) to be accepted`,
-          });
-          continue;
         }
-        issues.push({
-          type: 'unwaived-session-local',
-          message: `trust divergence: session-local claim '${claimId}' (claimType: ${claimType}) asserts pass with re-derived status '${status || 'unknown'}' but has no waiver and no CI-re-derived verified status`,
-        });
       }
 
       // WS8 iteration-4: always emit the summary count, even when zero, so a passing bundle
@@ -1496,6 +1417,46 @@ function main() {
 // The direct-CLI behavior is preserved: when run as a script, main() is called below.
 module.exports.runTrustReconcile = runTrustReconcile;
 
+// #356: manifest-resolution helpers exported for reuse by the local reconcile-preflight
+// (Wave 2) so it resolves the manifest via the EXACT SAME priority chain this CI reconciler
+// uses (CLI --manifest > TRUST_RECONCILE_MANIFEST > package.json > run-baseline.sh
+// --manifest-json > legacy fresh-verify-commands fallback) — never a second implementation.
+// These stay defined here (not moved to scripts/lib/reconcile-shape.js) because they are
+// CI-adjacent resolution logic (they may spawn `evals/ci/run-baseline.sh --manifest-json`,
+// a cheap static-registry emit, not a fresh test run) rather than pure bundle-shape
+// classification.
+module.exports.resolveManifest = resolveManifest;
+module.exports.runBaselineManifest = runBaselineManifest;
+module.exports.normalizeManifestEntries = normalizeManifestEntries;
+module.exports.slugifyLabel = slugifyLabel;
+module.exports.normalizeCmd = normalizeCmd;
+module.exports.isAncestorCommit = isAncestorCommit;
+// #356: resolveManifest's legacy fallback tier (tier 5, "legacy:fresh-verify-commands")
+// folds the CANONICAL verify commands into the manifest when no dedicated manifest source
+// resolves. Exporting resolveCanonicalCommands too so the local preflight's manifest
+// resolution has genuine parity with CI on that fallback tier as well — otherwise a repo (or
+// a fixture/test repo) with no run-baseline.sh/package.json manifest source would silently
+// resolve an EMPTY legacy-fallback manifest locally while CI's own resolution (which always
+// threads its own resolved canonicalCommands into this same fallback) resolves a non-empty
+// one, a real parity gap, not merely a fixture quirk.
+module.exports.resolveCanonicalCommands = resolveCanonicalCommands;
+
+// #356: re-export the shared bundle-shape classification/issue-construction functions
+// (primary home: scripts/lib/reconcile-shape.js) so a caller that already requires
+// trust-reconcile.js (e.g. an existing test harness) can reach them without also needing
+// to know the shared module's path. This is a re-export, not a second implementation —
+// the single definition lives in scripts/lib/reconcile-shape.js.
+module.exports.classifyBundleClaims = classifyBundleClaims;
+module.exports.waiverOnCommandIssues = waiverOnCommandIssues;
+module.exports.noEvidenceCommandIssues = noEvidenceCommandIssues;
+module.exports.reconcilableManifestIssues = reconcilableManifestIssues;
+module.exports.sessionLocalShapeIssues = sessionLocalShapeIssues;
+
+// Exported for evals (#305 trailer-diagnostic coverage) — read-only diagnostic helpers,
+// never gating; see the header comment's "Runtime-session commit-trailer diagnostic" note.
+module.exports.findRuntimeSessionTrailers = findRuntimeSessionTrailers;
+module.exports.logRuntimeSessionTrailers = logRuntimeSessionTrailers;
+
 if (require.main === module) {
   main();
 }

package/scripts/hooks/codex-hook-adapter.js

@@ -12,6 +12,7 @@
 
 const path = require('path');
 const { spawnSync } = require('child_process');
+const { extractExitCodeFromBanner, readExitCodeFromRollout } = require('./lib/codex-exit-code');
 
 const MAX_STDIN = 1024 * 1024;
 
@@ -127,6 +128,73 @@ function blockedOutput(event, reason) {
   };
 }
 
+/**
+ * enrichEvidenceCapturePayload(raw, hookId, event) → string
+ *
+ * Codex-only, evidence-capture-only enrichment (#470): codex's PostToolUse
+ * payload carries no structured exit code, so `evidence-capture.js`'s rule 3
+ * (no signal) would otherwise fire on every codex command, including
+ * genuinely failing ones. This injects a deterministic `tool_response.exitCode`
+ * extracted from the codex host banner (`Process exited with code N`) BEFORE
+ * the payload reaches evidence-capture, so capture stays host-agnostic and
+ * never itself scans narration (docs/spec/runtime-hook-surface.md §2.5).
+ *
+ * Narrowly gated to hookId === 'evidence-capture' && event === 'PostToolUse'
+ * so every other codex hook (quality-gate, workflow-steering, stop-goal-fit,
+ * ...) is byte-unchanged. Fail-open: any parse error, missing field, or
+ * missing/oversized/unreadable rollout returns `raw` unchanged — a hook must
+ * never crash the agent, and a miss simply lets evidence-capture's own rule 3
+ * (ambiguous default) apply.
+ */
+function enrichEvidenceCapturePayload(raw, hookId, event) {
+  if (hookId !== 'evidence-capture' || event !== 'PostToolUse') return raw;
+  try {
+    const payload = JSON.parse(raw);
+    if (!payload || typeof payload !== 'object') return raw;
+
+    // Tier 1: a payload output field, if codex ever surfaces one directly
+    // (cheap; observed absent on codex today — checked defensively).
+    const outputFields = [
+      payload.tool_response && payload.tool_response.output,
+      payload.tool_response && payload.tool_response.stdout,
+      payload.tool_output && payload.tool_output.output,
+      payload.tool_output && payload.tool_output.stdout,
+      payload.output,
+    ];
+    let exitCode = null;
+    for (const field of outputFields) {
+      if (typeof field !== 'string' || !field) continue;
+      const found = extractExitCodeFromBanner(field);
+      if (found !== null) { exitCode = found; break; }
+    }
+
+    // Tier 2: bounded tail read of the session rollout at transcript_path.
+    if (exitCode === null && typeof payload.transcript_path === 'string' && payload.transcript_path) {
+      // No documented codex field correlates a PostToolUse payload to a
+      // rollout function_call_output's call_id today; try the plausible
+      // candidates defensively and fall back to "last banner in the tail"
+      // when none are present (see codex-exit-code.js doc comment). `command`
+      // is passed alongside for the command cross-check correlation (Decision
+      // B, #470 iteration 2): absent a call_id match, it lets the helper
+      // decline (rather than mis-attribute) when the newest rollout banner's
+      // paired call doesn't match the command that triggered this PostToolUse.
+      const callId = payload.call_id || payload.tool_call_id || payload.id || null;
+      const command = payload.tool_input && payload.tool_input.command;
+      exitCode = readExitCodeFromRollout(payload.transcript_path, { callId, command });
+    }
+
+    if (exitCode === null) return raw;
+
+    const existingResponse = payload.tool_response && typeof payload.tool_response === 'object'
+      ? payload.tool_response
+      : {};
+    payload.tool_response = { ...existingResponse, exitCode };
+    return JSON.stringify(payload);
+  } catch {
+    return raw; // fail-open: malformed payload or helper throw — pass through unchanged
+  }
+}
+
 async function main() {
   const [, , hookId, relScriptPath, profilesCsv] = process.argv;
   const { raw, truncated } = await readStdinRaw();
@@ -138,9 +206,16 @@ async function main() {
     return;
   }
 
+  // Enrich only the evidence-capture PostToolUse invocation with a structured
+  // exit code extracted from the codex host banner (#470). `effectiveRaw` is
+  // used for BOTH the spawn input and the stdout echo-diff below so the two
+  // stay consistent (an enriched-vs-original mismatch would leak the raw JSON
+  // as additionalContext via guidanceFromStdout).
+  const effectiveRaw = enrichEvidenceCapturePayload(raw, hookId, event);
+
   const runHookPath = path.resolve(__dirname, 'run-hook.js');
   const result = spawnSync(process.execPath, [runHookPath, hookId, relScriptPath, profilesCsv || ''], {
-    input: raw,
+    input: effectiveRaw,
     encoding: 'utf8',
     cwd: process.cwd(),
     env: {
@@ -166,7 +241,7 @@ async function main() {
   }
 
   if (result.stderr) process.stderr.write(result.stderr);
-  const output = successOutput(event, guidanceFromStdout(raw, result.stdout));
+  const output = successOutput(event, guidanceFromStdout(effectiveRaw, result.stdout));
   if (output) process.stdout.write(`${JSON.stringify(output)}\n`);
 }