@kontourai/flow-agents 3.3.0 → 3.4.1

package/evals/integration/test_builder_entry_enforcement.sh

@@ -0,0 +1,241 @@
+#!/usr/bin/env bash
+# Proves first-step workflow entry and provider-neutral local work-item anchoring (#438).
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+source "$ROOT/evals/lib/node.sh"
+
+TMP="$(mktemp -d)"
+errors=0
+trap 'rm -rf "$TMP"' EXIT
+
+pass() { printf '  PASS %s\n' "$1"; }
+fail() { printf '  FAIL %s\n' "$1"; errors=$((errors + 1)); }
+
+WRITER="workflow-sidecar"
+
+echo "=== Builder workflow entry enforcement ==="
+
+REFUSED_ROOT="$TMP/refused/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$REFUSED_ROOT" \
+  --task-slug refused-plan \
+  --title "Refused plan entry" \
+  --summary "Must enter through the declared prefix." \
+  --flow-id builder.build \
+  --step-id plan >"$TMP/refused.out" 2>&1; then
+  fail "fresh later-step entry is rejected"
+elif [[ ! -e "$REFUSED_ROOT" ]] && grep -q 'must start at first step "pull-work"' "$TMP/refused.out"; then
+  pass "fresh later-step entry is rejected before artifact-root creation"
+else
+  fail "later-step refusal wrote files or returned the wrong diagnostic: $(cat "$TMP/refused.out")"
+fi
+
+AD_HOC_ROOT="$TMP/ad-hoc/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$AD_HOC_ROOT" \
+  --task-slug refused-ad-hoc \
+  --title "Refused ad-hoc entry" \
+  --summary "A reason is not workflow authority." \
+  --flow-id builder.build \
+  --step-id plan \
+  --ad-hoc-reason "skip the prefix" >"$TMP/ad-hoc.out" 2>&1; then
+  fail "ad-hoc reason cannot authorize later-step entry"
+elif [[ ! -e "$AD_HOC_ROOT" ]] && grep -q 'cannot authorize workflow entry' "$TMP/ad-hoc.out"; then
+  pass "ad-hoc reason cannot authorize later-step entry or write artifacts"
+else
+  fail "ad-hoc refusal wrote files or returned the wrong diagnostic: $(cat "$TMP/ad-hoc.out")"
+fi
+
+LOCAL_ROOT="$TMP/local/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$LOCAL_ROOT" \
+  --task-slug local-request \
+  --title "Local request" \
+  --summary "Providerless work still needs an anchor." \
+  --flow-id builder.build \
+  --timestamp "2026-07-10T00:00:00Z" >"$TMP/local.out" 2>&1; then
+  if node - "$LOCAL_ROOT" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const root = process.argv[2];
+const current = JSON.parse(fs.readFileSync(path.join(root, 'current.json'), 'utf8'));
+const state = JSON.parse(fs.readFileSync(path.join(root, 'local-request', 'state.json'), 'utf8'));
+const workItem = JSON.parse(fs.readFileSync(path.join(root, 'local-request', 'work-item.json'), 'utf8'));
+if (current.active_flow_id !== 'builder.build' || current.active_step_id !== 'pull-work') process.exit(1);
+if (state.status !== 'new' || state.phase !== 'pickup') process.exit(1);
+if (JSON.stringify(state.work_item_refs) !== JSON.stringify(['local:local-request'])) process.exit(1);
+if (workItem.id !== 'local-request' || workItem.title !== 'Local request') process.exit(1);
+if (workItem.source_provider?.kind !== 'local' || workItem.source_provider?.path !== 'work-item.json') process.exit(1);
+if (!state.next_action?.summary?.includes('builder-run start') || !state.next_action?.summary?.includes('`pull-work`')) process.exit(1);
+NODE
+  then
+    pass "providerless request creates a local Work Item and starts at pull-work"
+  else
+    fail "local Work Item or first-step state is invalid"
+  fi
+else
+  fail "providerless Builder entry failed: $(cat "$TMP/local.out")"
+fi
+
+LOCAL_SESSION="$LOCAL_ROOT/local-request"
+if flow_agents_node builder-run start --session-dir "$LOCAL_SESSION" >"$TMP/builder-start.out" 2>&1 \
+  && node - "$TMP/local" "$LOCAL_SESSION" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const project = process.argv[2];
+const session = process.argv[3];
+const flowState = JSON.parse(fs.readFileSync(path.join(project, '.kontourai', 'flow', 'runs', 'local-request', 'state.json'), 'utf8'));
+const sidecar = JSON.parse(fs.readFileSync(path.join(session, 'state.json'), 'utf8'));
+if (flowState.current_step !== 'pull-work' || flowState.subject !== 'local:local-request') process.exit(1);
+if (sidecar.flow_run?.current_step !== 'pull-work') process.exit(1);
+if (JSON.stringify(sidecar.next_action?.skills) !== JSON.stringify(['pull-work'])) process.exit(1);
+if (!sidecar.next_action?.command?.includes('builder-run sync')) process.exit(1);
+NODE
+then
+  pass "small-model entry command creates canonical Flow run and projects pull-work action"
+else
+  fail "canonical Builder run did not start or project correctly: $(cat "$TMP/builder-start.out")"
+fi
+
+if flow_agents_node "$WRITER" record-gate-claim "$LOCAL_SESSION" \
+  --expectation selected-work \
+  --status pass \
+  --summary "Selected local:local-request with scope and acceptance context." \
+  --evidence-ref-json '{"kind":"artifact","file":".kontourai/flow-agents/local-request/work-item.json","summary":"Provider-neutral local Work Item."}' \
+  >"$TMP/selected-work.out" 2>&1 \
+  && node - "$TMP/local" "$LOCAL_SESSION" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const project = process.argv[2];
+const session = process.argv[3];
+const flowState = JSON.parse(fs.readFileSync(path.join(project, '.kontourai', 'flow', 'runs', 'local-request', 'state.json'), 'utf8'));
+const sidecar = JSON.parse(fs.readFileSync(path.join(session, 'state.json'), 'utf8'));
+if (flowState.current_step !== 'design-probe') process.exit(1);
+if (sidecar.flow_run?.current_step !== 'design-probe') process.exit(1);
+if (JSON.stringify(sidecar.next_action?.skills) !== JSON.stringify(['pickup-probe'])) process.exit(1);
+NODE
+then
+  pass "gate-claim write synchronizes Flow and projects the next skill"
+else
+  fail "selected-work claim did not advance the canonical run: $(cat "$TMP/selected-work.out")"
+fi
+
+if FLOW_AGENTS_GOAL_FIT_MODE=block FLOW_AGENTS_GOAL_FIT_MAX_BLOCKS=100000 \
+  node "$ROOT/scripts/hooks/stop-goal-fit.js" >"$TMP/stop.out" 2>"$TMP/stop.err" <<JSON
+{"hook_event_name":"Stop","cwd":"$TMP/local"}
+JSON
+then
+  fail "active pre-execution Flow run should block Stop"
+else
+  stop_status=$?
+  if [[ "$stop_status" -eq 2 ]] \
+    && grep -q 'required skills: pickup-probe' "$TMP/stop.err" \
+    && grep -q 'builder-run sync' "$TMP/stop.err" \
+    && grep -q 'release skipped for active Flow run' "$TMP/stop.err" \
+    && node - "$LOCAL_SESSION/state.json" <<'NODE'
+const fs = require('node:fs');
+const state = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+if (state.flow_run?.status !== 'active' || state.flow_run?.current_step !== 'design-probe') process.exit(1);
+NODE
+  then
+    pass "active Flow run blocks Stop, preserves liveness, and exposes executable guidance"
+  else
+    fail "active Flow Stop enforcement or guidance was incomplete (exit $stop_status): $(cat "$TMP/stop.err")"
+  fi
+fi
+
+if flow_agents_node "$WRITER" record-gate-claim "$LOCAL_SESSION" \
+  --expectation pickup-probe-readiness \
+  --status pass \
+  --summary "Pickup Probe confirmed scope and planning readiness." \
+  --evidence-ref-json '{"kind":"artifact","file":".kontourai/flow-agents/local-request/work-item.json","summary":"Probe fixture evidence."}' >/dev/null 2>&1 \
+  && flow_agents_node "$WRITER" record-gate-claim "$LOCAL_SESSION" \
+  --expectation probe-decisions-or-accepted-gaps \
+  --status pass \
+  --summary "Probe decisions and accepted gaps are recorded." \
+  --evidence-ref-json '{"kind":"artifact","file":".kontourai/flow-agents/local-request/work-item.json","summary":"Probe decision fixture evidence."}' >/dev/null 2>&1 \
+  && flow_agents_node "$WRITER" record-gate-claim "$LOCAL_SESSION" \
+  --expectation implementation-plan \
+  --status pass \
+  --summary "Implementation plan records files, sequence, and evidence." \
+  --evidence-ref-json '{"kind":"artifact","file":".kontourai/flow-agents/local-request/work-item.json","summary":"Plan fixture evidence."}' >/dev/null 2>&1 \
+  && flow_agents_node "$WRITER" record-gate-claim "$LOCAL_SESSION" \
+  --expectation implementation-scope \
+  --status pass \
+  --summary "Implementation scope and changed files are recorded." \
+  --evidence-ref-json '{"kind":"artifact","file":".kontourai/flow-agents/local-request/work-item.json","summary":"Execution fixture evidence."}' >/dev/null 2>&1 \
+  && flow_agents_node "$WRITER" record-gate-claim "$LOCAL_SESSION" \
+  --expectation tests-evidence \
+  --status fail \
+  --route-reason implementation_defect \
+  --summary "Verification found an implementation defect." \
+  --evidence-ref-json '{"kind":"artifact","file":".kontourai/flow-agents/local-request/work-item.json","summary":"Failed verification fixture evidence."}' >"$TMP/route-back.out" 2>&1 \
+  && node - "$TMP/local" "$LOCAL_SESSION" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const project = process.argv[2];
+const session = process.argv[3];
+const flowState = JSON.parse(fs.readFileSync(path.join(project, '.kontourai', 'flow', 'runs', 'local-request', 'state.json'), 'utf8'));
+const sidecar = JSON.parse(fs.readFileSync(path.join(session, 'state.json'), 'utf8'));
+if (flowState.current_step !== 'execute') process.exit(1);
+if (sidecar.flow_run?.route_back_attempt !== 1 || sidecar.flow_run?.route_back_max_attempts !== 3) process.exit(1);
+if (JSON.stringify(sidecar.next_action?.skills) !== JSON.stringify(['execute-plan'])) process.exit(1);
+if (!sidecar.next_action?.summary?.includes('Route-back history: attempt 1/3')) process.exit(1);
+NODE
+then
+  pass "sidecar failure classifier drives Flow route-back and projects its attempt budget"
+else
+  fail "route-back classifier did not produce the canonical execute retry: $(cat "$TMP/route-back.out" 2>/dev/null)"
+fi
+
+PROVIDER_ROOT="$TMP/provider/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$PROVIDER_ROOT" \
+  --work-item "kontourai/flow-agents#438" \
+  --title "Provider work item" \
+  --summary "Keep the provider reference." \
+  --flow-id builder.build \
+  --timestamp "2026-07-10T00:01:00Z" >/dev/null 2>&1 \
+  && node - "$PROVIDER_ROOT/kontourai-flow-agents-438/state.json" <<'NODE'
+const fs = require('node:fs');
+const state = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+if (JSON.stringify(state.work_item_refs) !== JSON.stringify(['kontourai/flow-agents#438'])) process.exit(1);
+NODE
+then
+  pass "provider-backed request preserves its neutral work-item ref"
+else
+  fail "provider-backed work-item ref was not persisted"
+fi
+
+# A direct primitive remains usable without claiming Builder prefix completion.
+STANDALONE_ROOT="$TMP/standalone/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$STANDALONE_ROOT" \
+  --task-slug standalone-plan \
+  --title "Standalone plan" \
+  --summary "Direct primitive session." \
+  --timestamp "2026-07-10T00:02:00Z" >/dev/null 2>&1 \
+  && node - "$STANDALONE_ROOT" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const root = process.argv[2];
+const current = JSON.parse(fs.readFileSync(path.join(root, 'current.json'), 'utf8'));
+const state = JSON.parse(fs.readFileSync(path.join(root, 'standalone-plan', 'state.json'), 'utf8'));
+if ('active_flow_id' in current || 'active_step_id' in current) process.exit(1);
+if (state.status !== 'planned' || state.phase !== 'planning') process.exit(1);
+if (JSON.stringify(state.work_item_refs) !== JSON.stringify(['local:standalone-plan'])) process.exit(1);
+NODE
+then
+  pass "standalone primitive session remains available without a Builder stamp"
+else
+  fail "standalone primitive session was incorrectly stamped as Builder"
+fi
+
+if [[ "$errors" -gt 0 ]]; then
+  printf 'test_builder_entry_enforcement: %d failure(s)\n' "$errors" >&2
+  exit 1
+fi
+
+echo "test_builder_entry_enforcement: all checks passed"

package/evals/integration/test_builder_step_producers.sh

@@ -41,21 +41,29 @@ trap cleanup EXIT
 
 # ─── Helper: set active_step_id for a step.
 # For steps in the phase_map, use advance-state.
-# For design-probe (no phase mapping), use ensure-session --step-id.
+# For design-probe (no phase mapping), mutate only the test fixture's current pointer.
 # ──────────────────────────────────────────────────────────────────
 set_active_step() {
   local aroot="$1" slug="$2" step="$3"
   case "$step" in
     design-probe)
-      # design-probe has no lifecycle phase in the phase_map — set via ensure-session --step-id
-      flow_agents_node "workflow-sidecar" ensure-session \
-        --artifact-root "$aroot" \
-        --task-slug "$slug" \
-        --title "Producer test: $step" \
-        --summary "Test gate-claim producer at $step." \
-        --flow-id builder.build \
-        --step-id design-probe \
-        --timestamp "2026-06-26T00:00:30Z" >/dev/null 2>&1
+      # The production entry surface cannot select a later step. This producer-focused
+      # fixture sets the pointer directly because design-probe has no legacy phase_map key.
+      node - "$aroot" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const root = process.argv[2];
+const files = [path.join(root, 'current.json')];
+const actorRoot = path.join(root, 'current');
+if (fs.existsSync(actorRoot)) {
+  files.push(...fs.readdirSync(actorRoot).filter((name) => name.endsWith('.json')).map((name) => path.join(actorRoot, name)));
+}
+for (const file of files) {
+  const current = JSON.parse(fs.readFileSync(file, 'utf8'));
+  current.active_step_id = 'design-probe';
+  fs.writeFileSync(file, `${JSON.stringify(current, null, 2)}\n`);
+}
+NODE
       ;;
     pull-work)
       flow_agents_node "workflow-sidecar" advance-state "$aroot/$slug" \

package/evals/integration/test_bundle_install.sh

@@ -86,6 +86,20 @@ else
   _fail "Codex install with Kontour hosted Console telemetry config failed"
 fi
 
+CODEX_HOSTED_CONSOLE_NO_TENANT_DEST="$TMPDIR_EVAL/codex-hosted-console-no-tenant-workspace"
+CODEX_HOSTED_CONSOLE_NO_TENANT_STDERR="$TMPDIR_EVAL/codex-hosted-console-no-tenant-stderr.txt"
+if (cd "$ROOT_DIR/dist/codex" && bash install.sh "$CODEX_HOSTED_CONSOLE_NO_TENANT_DEST" --telemetry-sink kontour-hosted-console --console-token-file "$CONSOLE_TOKEN_FILE" >/dev/null 2>"$CODEX_HOSTED_CONSOLE_NO_TENANT_STDERR"); then
+  _pass "Codex install with hosted Console sink and no --console-tenant still succeeds"
+else
+  _fail "Codex install with hosted Console sink and no --console-tenant unexpectedly failed"
+fi
+
+if rg -q 'warning: install-console-config.sh: a Console telemetry sink was selected with no --console-tenant' "$CODEX_HOSTED_CONSOLE_NO_TENANT_STDERR"; then
+  _pass "Untenanted hosted Console sink install prints DX warning to stderr"
+else
+  _fail "Untenanted hosted Console sink install did not print DX warning to stderr"
+fi
+
 if (cd "$ROOT_DIR/dist/codex" && bash install.sh "$CODEX_USER_HOSTED_CONSOLE_DEST" --telemetry-sink user-hosted-console --console-url https://console.example.test --console-token-file "$CONSOLE_TOKEN_FILE" >/dev/null); then
   _pass "Codex install with user-hosted Console telemetry config succeeded"
 else
@@ -116,6 +130,137 @@ else
   _fail "flow-agents init headless Codex install failed"
 fi
 
+echo ""
+echo "--- Guided Console-Connect Wizard (G2/G3): headless regression + summary/verify ---"
+
+# New (G3): a plain local-files headless install still prints the structured
+# post-install summary block (regardless of the guided wizard, which only
+# fires for interactive installs) -- the summary/verify tail is shared by
+# both install paths.
+BASE_SUMMARY_LOCAL_DEST="$TMPDIR_EVAL/base-summary-local-workspace"
+BASE_SUMMARY_LOCAL_STDOUT="$TMPDIR_EVAL/base-summary-local-stdout.txt"
+if node "$ROOT_DIR/build/src/cli.js" init --dest "$BASE_SUMMARY_LOCAL_DEST" --telemetry-sink local-files --yes >"$BASE_SUMMARY_LOCAL_STDOUT" 2>&1; then
+  _pass "flow-agents init headless local-files install succeeded (G3 summary case)"
+else
+  _fail "flow-agents init headless local-files install failed (G3 summary case)"
+fi
+
+if rg -q 'Console:' "$BASE_SUMMARY_LOCAL_STDOUT"   && rg -q 'local-only' "$BASE_SUMMARY_LOCAL_STDOUT"   && rg -F -q "$BASE_SUMMARY_LOCAL_DEST" "$BASE_SUMMARY_LOCAL_STDOUT"; then
+  _pass "flow-agents init prints G3 post-install summary block for a local-files headless install"
+else
+  _fail "flow-agents init did not print G3 post-install summary block for a local-files headless install"
+fi
+
+# New (G2/G3): a kontour-hosted-console headless install auto-verifies via
+# telemetry-doctor's buildReport in-process, stays within a bounded wall-clock
+# time (never hangs), never prints the raw console token, and prints a
+# console status line -- verified or unverified is acceptable in a sandboxed
+# CI network, as long as the check happened honestly.
+BASE_SUMMARY_HOSTED_DEST="$TMPDIR_EVAL/base-summary-hosted-workspace"
+BASE_SUMMARY_HOSTED_STDOUT="$TMPDIR_EVAL/base-summary-hosted-stdout.txt"
+SECONDS=0
+if node "$ROOT_DIR/build/src/cli.js" init --dest "$BASE_SUMMARY_HOSTED_DEST" --telemetry-sink kontour-hosted-console --console-tenant tenant-x --console-token-file "$CONSOLE_TOKEN_FILE" --yes >"$BASE_SUMMARY_HOSTED_STDOUT" 2>&1; then
+  _pass "flow-agents init headless kontour-hosted-console install succeeded (G2/G3 case)"
+else
+  _fail "flow-agents init headless kontour-hosted-console install failed (G2/G3 case)"
+fi
+HOSTED_SUMMARY_ELAPSED_SECONDS=$SECONDS
+
+if [[ "$HOSTED_SUMMARY_ELAPSED_SECONDS" -le 20 ]]; then
+  _pass "flow-agents init auto-verify (G2) completed within a bounded wall-clock time (${HOSTED_SUMMARY_ELAPSED_SECONDS}s, never hangs)"
+else
+  _fail "flow-agents init auto-verify (G2) took too long (${HOSTED_SUMMARY_ELAPSED_SECONDS}s) -- may be hanging"
+fi
+
+if rg -q 'Console:' "$BASE_SUMMARY_HOSTED_STDOUT" && ! rg -F -q 'test-token' "$BASE_SUMMARY_HOSTED_STDOUT"; then
+  _pass "flow-agents init prints a G2/G3 console status line and never prints the raw console token"
+else
+  _fail "flow-agents init did not print a console status line, or leaked the raw console token"
+fi
+
+# New (regression, RESOLVED OWNER DECISION): the self-hosted blank-URL guard
+# (fallback to local-files with a warning) applies to the INTERACTIVE wizard
+# ONLY. The headless (--yes/--headless) path keeps today's unchanged
+# behavior -- install-console-config.sh's existing die-on-blank for
+# user-hosted-console with no --console-url/--console-endpoint. This asserts
+# the exact same non-zero exit + die message current main() (pre-PR2)
+# already produces, proving headless is byte-for-byte untouched. (The
+# interactive fallback itself is proven by the console-connect-options.test.mjs
+# unit tests on resolveSelfHostedUrlOrFallback + runConsoleConnectWizard.)
+BASE_SELF_HOSTED_NO_URL_DEST="$TMPDIR_EVAL/base-self-hosted-no-url-workspace"
+BASE_SELF_HOSTED_NO_URL_STDERR="$TMPDIR_EVAL/base-self-hosted-no-url-stderr.txt"
+set +e
+node "$ROOT_DIR/build/src/cli.js" init --dest "$BASE_SELF_HOSTED_NO_URL_DEST" --telemetry-sink user-hosted-console --yes >/dev/null 2>"$BASE_SELF_HOSTED_NO_URL_STDERR"
+BASE_SELF_HOSTED_NO_URL_EXIT=$?
+set -e
+
+if [[ "$BASE_SELF_HOSTED_NO_URL_EXIT" -ne 0 ]]   && rg -q 'install-console-config.sh: user-hosted-console requires --console-url or --console-endpoint' "$BASE_SELF_HOSTED_NO_URL_STDERR"; then
+  _pass "flow-agents init headless user-hosted-console with no --console-url still dies exactly as before (self-hosted guard is interactive-only)"
+else
+  _fail "flow-agents init headless user-hosted-console with no --console-url behavior changed (expected unchanged die-on-blank)"
+fi
+
+# New (review fix FIX 1): a self-hosted/BYO Console (non-local https, not the
+# known hosted host) headless install stays honest -- connected-unverified,
+# exit 0, reachability.checked stays false because --allow-network was not
+# passed -- but the summary now includes an actionable next-step hint instead
+# of leaving the operator with a bare "not checked". Never for local-only.
+BASE_SUMMARY_SELFHOSTED_DEST="$TMPDIR_EVAL/base-summary-selfhosted-workspace"
+BASE_SUMMARY_SELFHOSTED_STDOUT="$TMPDIR_EVAL/base-summary-selfhosted-stdout.txt"
+if node "$ROOT_DIR/build/src/cli.js" init --dest "$BASE_SUMMARY_SELFHOSTED_DEST" --telemetry-sink user-hosted-console --console-url https://console.example.test --console-tenant tenant-selfhosted --console-token-file "$CONSOLE_TOKEN_FILE" --yes >"$BASE_SUMMARY_SELFHOSTED_STDOUT" 2>&1; then
+  _pass "flow-agents init headless self-hosted/BYO Console install succeeds (unverified is honest, not a failure)"
+else
+  _fail "flow-agents init headless self-hosted/BYO Console install unexpectedly failed"
+fi
+
+if rg -q 'connected, unverified' "$BASE_SUMMARY_SELFHOSTED_STDOUT" \
+  && rg -F -q 'flow-agents telemetry-doctor --allow-network' "$BASE_SUMMARY_SELFHOSTED_STDOUT" \
+  && ! rg -F -q 'test-token' "$BASE_SUMMARY_SELFHOSTED_STDOUT"; then
+  _pass "flow-agents init summary discloses WHY self-hosted reachability is unverified with an actionable --allow-network hint, and never prints the raw token"
+else
+  _fail "flow-agents init summary did not disclose the self-hosted not-checked reason with the --allow-network hint"
+fi
+
+if rg -F -q 'flow-agents telemetry-doctor --allow-network' "$BASE_SUMMARY_LOCAL_STDOUT"; then
+  _fail "flow-agents init printed the self-hosted --allow-network hint for a local-files-only install (should never appear there)"
+else
+  _pass "flow-agents init does not print the self-hosted --allow-network hint for a local-files-only install"
+fi
+
+# New (review fix FIX 4, security): pin the validate-before-persist ordering
+# invariant. The TS-side wizard validators (console-telemetry-validate.ts) are
+# soft (validate-and-warn, never block); the ONLY reason a malformed value can
+# never land in a persisted telemetry.conf is that install-console-config.sh's
+# bash validators (validate_tenant et al.) run BEFORE any config key is
+# written and `die` (non-zero exit) on failure. A tenant value containing a
+# semicolon fails validate_tenant's charset (^[A-Za-z0-9._:-]+$ --
+# scripts/telemetry/install-console-config.sh); assert the headless install
+# dies non-zero via that exact bash validator, and that the hostile value
+# never appears in the persisted telemetry.conf (which already exists at this
+# point from the rsync'd template, since install-console-config.sh only
+# validates -- and writes nothing -- before dying).
+BASE_HOSTILE_TENANT_DEST="$TMPDIR_EVAL/base-hostile-tenant-workspace"
+BASE_HOSTILE_TENANT_STDERR="$TMPDIR_EVAL/base-hostile-tenant-stderr.txt"
+HOSTILE_TENANT='tenant;rm-rf-evidence'
+set +e
+node "$ROOT_DIR/build/src/cli.js" init --dest "$BASE_HOSTILE_TENANT_DEST" --telemetry-sink user-hosted-console --console-url https://console.example.test --console-tenant "$HOSTILE_TENANT" --yes >/dev/null 2>"$BASE_HOSTILE_TENANT_STDERR"
+BASE_HOSTILE_TENANT_EXIT=$?
+set -e
+
+if [[ "$BASE_HOSTILE_TENANT_EXIT" -ne 0 ]] \
+  && rg -q 'install-console-config.sh: --console-tenant contains unsupported characters' "$BASE_HOSTILE_TENANT_STDERR"; then
+  _pass "flow-agents init headless install with an illegal-character Console tenant dies via the bash validate_tenant gate (non-zero exit)"
+else
+  _fail "flow-agents init headless install with an illegal-character Console tenant did not die via bash validate_tenant as expected"
+fi
+
+if [[ ! -f "$BASE_HOSTILE_TENANT_DEST/scripts/telemetry/telemetry.conf" ]] \
+  || ! rg -F -q "$HOSTILE_TENANT" "$BASE_HOSTILE_TENANT_DEST/scripts/telemetry/telemetry.conf"; then
+  _pass "hostile Console tenant value never lands in telemetry.conf (validate-before-persist ordering invariant holds)"
+else
+  _fail "hostile Console tenant value was persisted into telemetry.conf despite failing bash validate_tenant"
+fi
+
 if (cd "$ROOT_DIR/dist/opencode" && bash install.sh "$OPENCODE_DEST" >/dev/null); then
   _pass "opencode install succeeded"
 else
@@ -708,6 +853,33 @@ else
   _fail "Codex full install is missing base agents"
 fi
 
+if node - "$CODEX_AGENTS_DIR" <<'NODE'
+const fs = require("node:fs");
+const path = require("node:path");
+function stringAssignment(text, key, name) {
+  const matches = [...text.matchAll(new RegExp(`^${key}\\s*=\\s*"([^"]*)"\\s*$`, "gm"))];
+  if (matches.length !== 1) throw new Error(`${name}: expected exactly one ${key} assignment, found ${matches.length}`);
+  return matches[0][1];
+}
+const expected = {
+  "tool-planner.toml": ["gpt-5.6-sol", "high"],
+  "tool-worker.toml": ["gpt-5.6-terra", "high"],
+  "tool-code-reviewer.toml": ["gpt-5.6-sol", "high"],
+  "tool-security-reviewer.toml": ["gpt-5.6-sol", "high"],
+  "tool-verifier.toml": ["gpt-5.6-sol", "high"],
+};
+for (const [name, [model, effort]] of Object.entries(expected)) {
+  const text = fs.readFileSync(path.join(process.argv[2], name), "utf8");
+  if (stringAssignment(text, "model", name) !== model) throw new Error(`${name}: expected model ${model}`);
+  if (stringAssignment(text, "model_reasoning_effort", name) !== effort) throw new Error(`${name}: expected reasoning ${effort}`);
+}
+NODE
+then
+  _pass "Codex full install preserves Builder specialist 5.6 role routing"
+else
+  _fail "Codex full install lost Builder specialist role routing"
+fi
+
 if [[ -d "$CODEX_FULL_DEST/.codex/skills/plan-work" && -d "$CODEX_FULL_DEST/.codex/skills/deliver" && -d "$CODEX_FULL_DEST/.codex/skills/agentic-engineering" ]]; then
   _pass "Codex full install ships kit-skills and standalone skills together"
 else

package/evals/integration/test_console_tenant_isolation.sh

@@ -0,0 +1,167 @@
+#!/usr/bin/env bash
+# test_console_tenant_isolation.sh — multi-tenant install proof (console epic fa#410 item #5).
+#
+# Closes the gap that `test_telemetry.sh` §7 (fake-curl capture) and
+# `test_liveness_console_relay.sh` (real HTTP stub) leave open: both already prove
+# single-tenant header injection, but neither proves that TWO DISTINCT tenants, each installed
+# through the REAL config-writer path (`install-console-config.sh` -> `telemetry.conf` ->
+# `config.sh` -> `transport.sh`), get correctly separated `x-console-tenant-id` /
+# `Authorization: Bearer` headers on the wire with no cross-tenant leakage.
+#
+# IMPORTANT SCOPE BOUNDARY: this eval proves the CLIENT-SIDE WIRE CONTRACT only — that a
+# correctly configured tenant-a install and a correctly configured tenant-b install each send
+# their own (and never each other's) tenant/token headers to the network layer. It does NOT
+# prove server-side Console tenant enforcement (that a token cannot be replayed against another
+# tenant's data, that a misconfigured/malicious client can't spoof a tenant header, etc.) — that
+# is Console-repo scope (console #98-#100 tenant hardening). Do not read a green run here as
+# proof of end-to-end multi-tenant security.
+#
+# Deterministic (a local stub HTTP server, no network/model spend, self-cleaning). The Console
+# POST fires in a detached/backgrounded subshell (transport.sh's console_post_json), so the
+# stub-received assertions poll for the captured file rather than assuming synchronous delivery
+# (mirrors test_liveness_console_relay.sh's wait_for_post).
+# Usage: bash evals/integration/test_console_tenant_isolation.sh
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+source "$ROOT/evals/lib/node.sh"
+
+TMPDIR_EVAL="$(mktemp -d)"
+trap 'rm -rf "$TMPDIR_EVAL"; [[ -n "${STUB_PID:-}" ]] && kill "$STUB_PID" 2>/dev/null' EXIT
+PORT=38796
+RECV="$TMPDIR_EVAL/recv.jsonl"
+
+errors=0
+pass() { echo "  [PASS] $1"; }
+fail() { echo "  [FAIL] $1"; errors=$((errors + 1)); }
+
+# Stub Console endpoint: append each received {method, headers, body} as one JSON line, shared
+# across both tenant phases so the isolation assertions can positively confirm no cross-tenant
+# header leaked into the OTHER tenant's captured request (not just that each phase's own header
+# is correct in isolation).
+start_stub() {
+  node -e '
+const http=require("http"),fs=require("fs");
+const out=process.argv[1];
+const s=http.createServer((req,res)=>{let b="";req.on("data",d=>b+=d);req.on("end",()=>{
+  fs.appendFileSync(out, JSON.stringify({method:req.method,headers:req.headers,body:b})+"\n");
+  res.writeHead(200); res.end("ok");
+});});
+s.listen(Number(process.argv[2]),"127.0.0.1");
+setTimeout(()=>process.exit(0),30000);
+' "$RECV" "$PORT" >/dev/null 2>&1 &
+  STUB_PID=$!
+  # wait for bind
+  for _ in $(seq 1 20); do
+    if node -e 'const n=require("net");const s=n.connect(Number(process.argv[1]),"127.0.0.1");s.on("connect",()=>{s.end();process.exit(0)});s.on("error",()=>process.exit(1))' "$PORT" 2>/dev/null; then return 0; fi
+    sleep 0.2
+  done
+  return 1
+}
+stop_stub() { [[ -n "${STUB_PID:-}" ]] && kill "$STUB_PID" 2>/dev/null; STUB_PID=""; }
+
+# Poll the stub's received file for at least N lines (the POST is detached/async).
+wait_for_lines() {
+  local n="$1" lines
+  for _ in $(seq 1 25); do
+    lines="$(wc -l <"$RECV" 2>/dev/null | tr -d ' ')"
+    [[ -n "$lines" && "$lines" -ge "$n" ]] && return 0
+    sleep 0.2
+  done
+  return 1
+}
+
+ENDPOINT="http://127.0.0.1:${PORT}/records"
+
+# Install a tenant's real telemetry.conf via the REAL config writer, then emit one synthetic
+# event through the REAL runtime path (config.sh's conf-key-to-env mapping, exercised by
+# sourcing it, followed by transport.sh's console_telemetry_emit) — not a re-implementation of
+# either.
+install_and_emit() {
+  local tenant="$1" token_value="$2"
+  local work="$TMPDIR_EVAL/$tenant"
+  mkdir -p "$work"
+  local conf="$work/telemetry.conf"
+  local token_file="$work/token"
+  printf '%s' "$token_value" >"$token_file"
+
+  bash "$ROOT/scripts/telemetry/install-console-config.sh" "$conf" \
+    --console-endpoint "$ENDPOINT" \
+    --console-token-file "$token_file" \
+    --console-tenant "$tenant" >/dev/null
+
+  (
+    export TELEMETRY_CONFIG_FILE="$conf"
+    export TELEMETRY_DATA_DIR="$work/data"
+    export TELEMETRY_SESSION_DIR="$work/data/sessions"
+    unset TELEMETRY_DIR
+    source "$ROOT/scripts/telemetry/lib/config.sh"
+    source "$ROOT/scripts/telemetry/lib/transport.sh"
+    console_telemetry_emit '{"type":"test","note":"tenant-isolation-eval"}'
+  )
+}
+
+# Assert the Nth captured request (1-indexed) carries this tenant's own headers and never the
+# other tenant's tenant-id/token — the actual "no cross-tenant leakage" proof.
+check_capture() {
+  local line_no="$1" label="$2" own_tenant="$3" own_token="$4" other_tenant="$5" other_token="$6"
+  node -e '
+const fs = require("fs");
+const [recvPath, lineNoStr, ownTenant, ownToken, otherTenant, otherToken] = process.argv.slice(1);
+const lineNo = Number(lineNoStr);
+const lines = fs.readFileSync(recvPath, "utf8").trim().split("\n");
+if (lines.length < lineNo) { console.log("BAD missing-captured-request"); process.exit(0); }
+const r = JSON.parse(lines[lineNo - 1]);
+const h = r.headers || {};
+const raw = JSON.stringify(r);
+const checks = [
+  ["method-post", r.method === "POST"],
+  ["own-tenant-header", h["x-console-tenant-id"] === ownTenant],
+  ["own-auth-header", h["authorization"] === ("Bearer " + ownToken)],
+  ["no-other-tenant-id-in-header", h["x-console-tenant-id"] !== otherTenant],
+  ["no-other-token-in-header", h["authorization"] !== ("Bearer " + otherToken)],
+  ["no-other-tenant-id-anywhere", !raw.includes(otherTenant)],
+  ["no-other-token-anywhere", !raw.includes(otherToken)],
+];
+for (const [name, ok] of checks) console.log((ok ? "OK " : "BAD ") + name);
+' "$RECV" "$line_no" "$own_tenant" "$own_token" "$other_tenant" "$other_token" >"$TMPDIR_EVAL/checks-$line_no.txt" 2>&1
+  while IFS= read -r line; do
+    [[ "$line" == OK* ]] && pass "$label: ${line#OK }" || fail "$label: ${line#BAD } — $(cat "$TMPDIR_EVAL/checks-$line_no.txt")"
+  done < <(grep -E '^(OK|BAD) ' "$TMPDIR_EVAL/checks-$line_no.txt")
+}
+
+echo "=== console tenant isolation (multi-tenant install proof, fa#410 item #5) ==="
+
+: >"$RECV"
+start_stub || fail "stub server did not start"
+
+TOKEN_A="tok-a-alnum-111"
+TOKEN_B="tok-b-alnum-222"
+
+# ─── Phase 1 (tenant-a): install + emit, assert its own headers ────────────────────────────────
+echo "--- 1. tenant-a: real install-console-config.sh writes telemetry.conf; emit carries tenant-a headers ---"
+install_and_emit "tenant-a" "$TOKEN_A"
+if wait_for_lines 1; then pass "tenant-a event POSTed to the stub"; else fail "tenant-a event did NOT POST within timeout"; fi
+check_capture 1 "tenant-a" "tenant-a" "$TOKEN_A" "tenant-b" "$TOKEN_B"
+
+# ─── Phase 2 (tenant-b): fresh conf + distinct token, assert its own headers ───────────────────
+echo "--- 2. tenant-b: fresh conf + distinct token; emit carries tenant-b headers ---"
+install_and_emit "tenant-b" "$TOKEN_B"
+if wait_for_lines 2; then pass "tenant-b event POSTed to the stub"; else fail "tenant-b event did NOT POST within timeout"; fi
+check_capture 2 "tenant-b" "tenant-b" "$TOKEN_B" "tenant-a" "$TOKEN_A"
+
+# ─── Isolation: re-check phase 1's record after phase 2 ran, to catch any late cross-write ─────
+echo "--- 3. isolation: tenant-a's captured request still never carries tenant-b's values (and vice versa, above) ---"
+check_capture 1 "tenant-a (post phase-2 recheck)" "tenant-a" "$TOKEN_A" "tenant-b" "$TOKEN_B"
+
+stop_stub
+
+echo ""
+if [[ "$errors" -eq 0 ]]; then
+  echo "test_console_tenant_isolation: all checks passed."
+  exit 0
+else
+  echo "test_console_tenant_isolation: $errors check(s) failed."
+  exit 1
+fi

package/evals/integration/test_critique_supersession_roundtrip.sh

@@ -81,7 +81,10 @@ if [[ $? -eq 0 ]]; then _pass "(a) trust-reconcile exits 0 (resolved session con
 echo ""
 echo "=== (b) HEADLINE --flow-id builder.build/verify: mixed evidence + critique → reconcile 0 ==="
 B_AROOT="$TMP/b/aroot"; B_SLUG="flowid-converge"; B_DIR="$B_AROOT/$B_SLUG"
-seed "$B_AROOT" "$B_SLUG" --flow-id builder.build --step-id verify
+seed "$B_AROOT" "$B_SLUG" --flow-id builder.build
+flow_agents_node "$WRITER" advance-state "$B_DIR" --status in_progress --phase verification \
+  --summary "Testing at verify." --next-action "Record evidence." \
+  --flow-definition builder.build --timestamp "2026-07-01T00:00:30Z" >/dev/null 2>&1
 flow_agents_node "$WRITER" record-evidence "$B_DIR" --verdict pass \
   --check-json '{"id":"k-diff","kind":"diff","status":"pass","summary":"diff excerpt"}' \
   --check-json '{"id":"k-policy","kind":"policy","status":"pass","summary":"policy rule"}' \