@kontourai/flow-agents 3.3.0 → 3.4.1

package/evals/integration/test_hook_category_behaviors.sh

@@ -154,7 +154,14 @@ mkdir -p "$audit_dir/sessions"
 printf '{"session_id":"session-1"}\n' > "$audit_dir/sessions/one.session"
 if printf '%s\n' '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"echo AKIA1234567890ABCDEF && rm -rf /tmp/example"}}' \
   | TELEMETRY_GOVERNANCE=true TELEMETRY_DATA_DIR="$audit_dir" TELEMETRY_SESSION_DIR="$audit_dir/sessions" bash "$ROOT/scripts/hooks/governance-audit.sh" preToolUse dev >"$TMPDIR_EVAL/governance.out" 2>"$TMPDIR_EVAL/governance.err"; then
-  sleep 0.2
+  for _audit_wait in $(seq 1 50); do
+    if [[ -s "$audit_dir/audit.jsonl" ]] \
+      && grep -q '"event_type":"governance.secret_detected"' "$audit_dir/audit.jsonl" \
+      && grep -q '"event_type":"governance.destructive_operation"' "$audit_dir/audit.jsonl"; then
+      break
+    fi
+    sleep 0.1
+  done
   if [[ -s "$audit_dir/audit.jsonl" ]] \
     && grep -q '"event_type":"governance.secret_detected"' "$audit_dir/audit.jsonl" \
     && grep -q '"event_type":"governance.destructive_operation"' "$audit_dir/audit.jsonl"; then

package/evals/integration/test_hook_influence_cases.sh

@@ -31,6 +31,30 @@ else
   _fail "hook influence behavioral cases failed validation: $(cat /tmp/flow-agents-hook-influence.out /tmp/flow-agents-hook-influence.err)"
 fi
 
+TMP_HOOK_INFLUENCE="$(mktemp -d)"
+mkdir -p "$TMP_HOOK_INFLUENCE/source/kits/release-evidence" "$TMP_HOOK_INFLUENCE/dest"
+cat > "$TMP_HOOK_INFLUENCE/source/kits/catalog.json" <<'JSON'
+{"schema_version":"1.0","kits":[{"id":"release-evidence","name":"Release Evidence Kit","path":"kits/release-evidence","description":"Builder-less fixture"}]}
+JSON
+cat > "$TMP_HOOK_INFLUENCE/source/kits/release-evidence/kit.json" <<'JSON'
+{"schema_version":"1.0","id":"release-evidence","name":"Release Evidence Kit","flows":[{"id":"release-evidence.review","path":"flows/review.flow.json"}]}
+JSON
+node - "$CASES" "$TMP_HOOK_INFLUENCE/cases-without-builder.json" <<'NODE'
+const fs = require("node:fs");
+const input = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+input.cases = input.cases.filter((item) => !/^(kit:builder:)?dev-builder-/.test(String(item.id || "")));
+fs.writeFileSync(process.argv[3], JSON.stringify(input, null, 2) + "\n");
+NODE
+
+if FLOW_AGENTS_HOOK_INFLUENCE_SOURCE_ROOT="$TMP_HOOK_INFLUENCE/source" \
+  FLOW_AGENTS_HOOK_INFLUENCE_DEST="$TMP_HOOK_INFLUENCE/dest" \
+  flow_agents_node "$VALIDATOR" "$TMP_HOOK_INFLUENCE/cases-without-builder.json" > /tmp/flow-agents-hook-influence-builderless.out 2> /tmp/flow-agents-hook-influence-builderless.err; then
+  _pass "hook influence validator drops Builder-required cases when Builder is absent from catalog"
+else
+  _fail "hook influence validator still required Builder cases for a Builder-less catalog: $(cat /tmp/flow-agents-hook-influence-builderless.out /tmp/flow-agents-hook-influence-builderless.err)"
+fi
+rm -rf "$TMP_HOOK_INFLUENCE"
+
 if rg -q '"tier": "adapter"' "$CASES" \
   && rg -q '"tier": "live-acceptance"' "$CASES" \
   && rg -q '"tier": "installed-command"' "$CASES" \
@@ -59,7 +83,7 @@ else
   _fail "hook influence cases miss a required #62 Builder Kit loop category"
 fi
 
-rm -f /tmp/flow-agents-hook-influence.out /tmp/flow-agents-hook-influence.err
+rm -f /tmp/flow-agents-hook-influence.out /tmp/flow-agents-hook-influence.err /tmp/flow-agents-hook-influence-builderless.out /tmp/flow-agents-hook-influence-builderless.err
 
 if [[ "$errors" -eq 0 ]]; then
   echo "Hook influence case integration passed."

package/evals/integration/test_install_merge.sh

@@ -58,8 +58,14 @@ cat > "$SEEDED_DEST/.claude/settings.json" << 'JSON'
 {
   "permissions": {
     "allow": ["Bash(usertool:*)"],
+    "defaultMode": "ask",
     "customPermission": true
   },
+  "statusLine": {
+    "type": "command",
+    "command": "echo user-statusline"
+  },
+  "skipDangerousModePermissionPrompt": false,
   "myUserKey": "preserved-value",
   "hooks": {
     "Stop": [
@@ -78,7 +84,8 @@ cat > "$SEEDED_DEST/.claude/settings.json" << 'JSON'
 JSON
 
 # Run install
-(cd "$ROOT_DIR/dist/claude-code" && bash install.sh "$SEEDED_DEST" >/dev/null 2>&1)
+SEEDED_INSTALL_OUT="$TMPDIR_EVAL/seeded-claude-install.out"
+(cd "$ROOT_DIR/dist/claude-code" && bash install.sh "$SEEDED_DEST" >"$SEEDED_INSTALL_OUT" 2>&1)
 
 # Assert: FA hooks present
 if node - "$SEEDED_DEST/.claude/settings.json" << 'NODE'
@@ -135,15 +142,39 @@ const fs = require("node:fs");
 const s = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
 const p = s.permissions || {};
 if (p.customPermission !== true) throw new Error("user permissions.customPermission was clobbered: " + JSON.stringify(p));
+if (p.defaultMode !== "ask") throw new Error("user permissions.defaultMode conflict was not preserved: " + JSON.stringify(p));
 if (!JSON.stringify(p.allow || []).includes("usertool")) throw new Error("user permissions.allow entry not preserved by union: " + JSON.stringify(p.allow));
 console.log("ok");
 NODE
 then
-  _pass "seeded: user custom permissions preserved (deep-merge union, not clobbered)"
+  _pass "seeded: user custom permissions preserved (deep-merge union, scalar conflicts preserved)"
 else
   _fail "seeded: user custom permissions were clobbered"
 fi
 
+# Assert: user-owned scalar/object settings are preserved and surfaced as conflicts.
+if node - "$SEEDED_DEST/.claude/settings.json" << 'NODE'
+const fs = require("node:fs");
+const s = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+if (s.statusLine?.command !== "echo user-statusline") throw new Error("statusLine conflict was not preserved: " + JSON.stringify(s.statusLine));
+if (s.skipDangerousModePermissionPrompt !== false) throw new Error("skipDangerousModePermissionPrompt conflict was not preserved: " + JSON.stringify(s.skipDangerousModePermissionPrompt));
+console.log("ok");
+NODE
+then
+  _pass "seeded: user-owned statusLine and skipDangerousModePermissionPrompt preserved"
+else
+  _fail "seeded: user-owned scalar/object settings were clobbered"
+fi
+
+if rg -q "install-merge: conflict: preserving existing setting 'statusLine'" "$SEEDED_INSTALL_OUT" \
+  && rg -q "install-merge: conflict: preserving existing setting 'permissions.defaultMode'" "$SEEDED_INSTALL_OUT" \
+  && rg -q "install-merge: conflict: preserving existing setting 'skipDangerousModePermissionPrompt'" "$SEEDED_INSTALL_OUT"; then
+  _pass "seeded: install reports preserved setting conflicts to the user"
+else
+  _fail "seeded: install did not report expected setting conflicts"
+  sed -n '1,120p' "$SEEDED_INSTALL_OUT"
+fi
+
 echo ""
 
 # ─── Scenario 2: Version-stamped first install ───────────────────────────────
@@ -403,6 +434,36 @@ else
   _fail "--global: agents were not synced into global destination"
 fi
 
+# Regression guard (#439): --global must also write a per-skill-file sha256 content-hash
+# manifest, a sibling of install.json, so `flow-agents skill-drift-check` and the SessionStart
+# advisory have a baseline to classify installed skill files against.
+if node - "$GLOBAL_SETTINGS_DIR/.flow-agents/skills-manifest.json" << 'NODE'
+const fs = require("node:fs");
+const manifest = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+if (!manifest.files || typeof manifest.files !== "object" || Object.keys(manifest.files).length === 0) throw new Error("skills-manifest.json files is empty: " + JSON.stringify(manifest.files));
+if (!manifest.generatedAt) throw new Error("skills-manifest.json missing generatedAt");
+if (manifest.runtime !== "claude-code") throw new Error("skills-manifest.json wrong runtime: " + manifest.runtime);
+console.log("ok: " + Object.keys(manifest.files).length + " files");
+NODE
+then
+  _pass "--global: skills-manifest.json written with non-empty files after install"
+else
+  _fail "--global: skills-manifest.json missing, empty, or invalid after install"
+fi
+
+# Re-run init --global: the manifest must regenerate (fresh generatedAt) without disturbing any
+# of the settings-merge, skill-sync, and agent-sync assertions already proven above in this scenario.
+FIRST_MANIFEST_GENERATED_AT=$(node -e "console.log(JSON.parse(require('fs').readFileSync('$GLOBAL_SETTINGS_DIR/.flow-agents/skills-manifest.json','utf8')).generatedAt)" 2>/dev/null || echo "")
+FLOW_AGENTS_USER_CLAUDE_SETTINGS="$GLOBAL_SETTINGS_DIR/settings.json" \
+  node "$ROOT_DIR/build/src/cli.js" init --runtime claude-code --global --yes >/dev/null 2>&1 || true
+SECOND_MANIFEST_GENERATED_AT=$(node -e "console.log(JSON.parse(require('fs').readFileSync('$GLOBAL_SETTINGS_DIR/.flow-agents/skills-manifest.json','utf8')).generatedAt)" 2>/dev/null || echo "")
+
+if [[ -n "$FIRST_MANIFEST_GENERATED_AT" && -n "$SECOND_MANIFEST_GENERATED_AT" && "$FIRST_MANIFEST_GENERATED_AT" != "$SECOND_MANIFEST_GENERATED_AT" ]]; then
+  _pass "--global: re-running init regenerates skills-manifest.json (generatedAt changed)"
+else
+  _fail "--global: skills-manifest.json generatedAt did not change on re-run (first=$FIRST_MANIFEST_GENERATED_AT second=$SECOND_MANIFEST_GENERATED_AT)"
+fi
+
 echo ""
 
 # ─── Scenario 6: Manual proof (user-visible) ─────────────────────────────────
@@ -1055,6 +1116,12 @@ echo "--- CH4: codex-home preserves user config, profiles, hooks, local kit stat
 CH4_DEST="$TMPDIR_EVAL/codex-home-ch4"
 mkdir -p "$CH4_DEST/kits/local/repositories/user-kit" "$CH4_DEST/sk""ills/user-owned-skill" "$CH4_DEST/ag""ents"
 
+CH4_GENERIC_DIRS=(agent-cards build context docs evals integrations packaging powers prompts schemas scripts kits)
+for CH4_DIR in "${CH4_GENERIC_DIRS[@]}"; do
+  mkdir -p "$CH4_DEST/$CH4_DIR"
+  printf 'user-owned-%s\n' "$CH4_DIR" > "$CH4_DEST/$CH4_DIR/user-owned.txt"
+done
+
 cat > "$CH4_DEST/config.toml" << 'EOF_CFG'
 model = "user-model"
 EOF_CFG
@@ -1181,6 +1248,17 @@ else
   _fail "CH4: installed scripts/kit.js could not run with installed build bundle"
 fi
 
+CODEX_REAL_HOME="$TMPDIR_EVAL/fake-real-codex" bash "$ROOT_DIR/scripts/install-codex-home.sh" "$CH4_DEST" >/dev/null 2>&1
+CH4_GENERIC_PRESERVED=1
+for CH4_DIR in "${CH4_GENERIC_DIRS[@]}"; do
+  [[ "$(cat "$CH4_DEST/$CH4_DIR/user-owned.txt" 2>/dev/null)" == "user-owned-$CH4_DIR" ]] || CH4_GENERIC_PRESERVED=0
+done
+if [[ "$CH4_GENERIC_PRESERVED" -eq 1 && -f "$CH4_DEST/.flow-agents/codex-install-manifest.json" ]]; then
+  _pass "CH4: unrelated files in every shared bundle directory survive install and reinstall"
+else
+  _fail "CH4: install or reinstall removed unrelated files from a shared bundle directory"
+fi
+
 echo ""
 
 # ─── codex-home: CH5: destination symlink containment ───────────────────────
@@ -1201,6 +1279,153 @@ for CH5_REL in scripts kits sk""ills hooks.json; do
   fi
 done
 
+echo ""
+echo "--- CH6: codex-home rejects canonical source/destination overlap before writes ---"
+CH6_ROOT="$TMPDIR_EVAL/ch6-fixture-root"
+CH6_FAKE_BIN="$TMPDIR_EVAL/ch6-bin"
+CH_FIXTURE_SCRIPTS="scr""ipts"
+CH_FIXTURE_SKILLS="sk""ills"
+CH_FIXTURE_AGENTS="ag""ents"
+mkdir -p "$CH6_ROOT/$CH_FIXTURE_SCRIPTS" "$CH6_ROOT/dist/codex/$CH_FIXTURE_SCRIPTS" "$CH6_FAKE_BIN"
+cp "$ROOT_DIR/scripts/install-codex-home.sh" "$ROOT_DIR/scripts/install-owned-files.js" "$CH6_ROOT/$CH_FIXTURE_SCRIPTS/"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$CH6_FAKE_BIN/npm"
+chmod +x "$CH6_FAKE_BIN/npm"
+printf 'fixture\n' > "$CH6_ROOT/dist/codex/$CH_FIXTURE_SCRIPTS/fixture.txt"
+mkdir -p "$CH6_ROOT/dist/codex/.codex/$CH_FIXTURE_SKILLS/legacy-collision" "$CH6_ROOT/dist/codex/.codex/$CH_FIXTURE_AGENTS"
+printf 'flow-agents-new-skill\n' > "$CH6_ROOT/dist/codex/.codex/$CH_FIXTURE_SKILLS/legacy-collision/SKILL.md"
+printf 'name = "flow-agents-new-agent"\n' > "$CH6_ROOT/dist/codex/.codex/$CH_FIXTURE_AGENTS/legacy-collision.toml"
+
+for CH6_CASE in equal descendant ancestor; do
+  case "$CH6_CASE" in
+    equal) CH6_DEST="$CH6_ROOT" ;;
+    descendant) CH6_DEST="$CH6_ROOT/nested-destination" ;;
+    ancestor) CH6_DEST="$TMPDIR_EVAL" ;;
+  esac
+  if PATH="$CH6_FAKE_BIN:$PATH" HOME="$TMPDIR_EVAL/ch6-home" bash "$CH6_ROOT/$CH_FIXTURE_SCRIPTS/install-codex-home.sh" "$CH6_DEST" >"$TMPDIR_EVAL/ch6-$CH6_CASE.out" 2>&1; then
+    _fail "CH6: installer accepted $CH6_CASE source/destination overlap"
+  elif grep -q 'overlaps' "$TMPDIR_EVAL/ch6-$CH6_CASE.out" && [[ -f "$CH6_ROOT/dist/codex/$CH_FIXTURE_SCRIPTS/fixture.txt" ]]; then
+    _pass "CH6: installer rejects $CH6_CASE canonical overlap before source mutation"
+  else
+    _fail "CH6: installer did not safely reject $CH6_CASE overlap"
+  fi
+done
+
+CH6_AUTH_DEST="$TMPDIR_EVAL/ch6-auth-dest"
+CH6_AUTH_ALIAS="$TMPDIR_EVAL/ch6-auth-alias"
+mkdir -p "$CH6_AUTH_DEST"
+printf '{"user":"preserved"}\n' > "$CH6_AUTH_DEST/auth.json"
+ln -s "$CH6_AUTH_DEST" "$CH6_AUTH_ALIAS"
+if PATH="$CH6_FAKE_BIN:$PATH" HOME="$TMPDIR_EVAL/ch6-home" CODEX_REAL_HOME="$CH6_AUTH_ALIAS" bash "$CH6_ROOT/$CH_FIXTURE_SCRIPTS/install-codex-home.sh" "$CH6_AUTH_DEST" >"$TMPDIR_EVAL/ch6-auth.out" 2>&1 \
+  && grep -q '"user":"preserved"' "$CH6_AUTH_DEST/auth.json"; then
+  _pass "CH6: canonical auth-home alias is treated as self-copy and preserved"
+else
+  _fail "CH6: canonical auth-home alias caused a self-copy failure or mutation"
+fi
+
+echo ""
+echo "--- CH7: pre-manifest ownership bootstrap is evidence-bound ---"
+seed_ch7_legacy() {
+  local destination="$1"
+  local installed_at="$2"
+  mkdir -p "$destination/.flow-agents" "$destination/$CH_FIXTURE_SCRIPTS"
+  printf 'old-release\n' > "$destination/$CH_FIXTURE_SCRIPTS/fixture.txt"
+  cat > "$destination/.flow-agents/install.json" <<JSON
+{"version":"3.2.0","installedAt":"$installed_at","runtime":"codex"}
+JSON
+  cat > "$destination/hooks.json" <<'JSON'
+{"hooks":{"Stop":[{"hooks":[{"statusMessage":"Recording Flow Agents telemetry"}]}]}}
+JSON
+}
+
+CH7_LEGACY="$TMPDIR_EVAL/ch7-genuine-legacy"
+seed_ch7_legacy "$CH7_LEGACY" "2099-01-01T00:00:00.000Z"
+if PATH="$CH6_FAKE_BIN:$PATH" HOME="$TMPDIR_EVAL/ch7-home" CODEX_REAL_HOME="$TMPDIR_EVAL/ch7-real" bash "$CH6_ROOT/$CH_FIXTURE_SCRIPTS/install-codex-home.sh" "$CH7_LEGACY" >"$TMPDIR_EVAL/ch7-legacy.out" 2>&1 \
+  && [[ "$(cat "$CH7_LEGACY/$CH_FIXTURE_SCRIPTS/fixture.txt")" == "fixture" ]] \
+  && [[ -f "$CH7_LEGACY/.flow-agents/codex-install-manifest.json" ]]; then
+  _pass "CH7: corroborated pre-manifest legacy owned file upgrades and gains a manifest"
+else
+  _fail "CH7: genuine pre-manifest legacy install did not upgrade"
+fi
+
+CH7_ARBITRARY="$TMPDIR_EVAL/ch7-arbitrary-collision"
+mkdir -p "$CH7_ARBITRARY/$CH_FIXTURE_SCRIPTS"
+printf 'user-arbitrary\n' > "$CH7_ARBITRARY/$CH_FIXTURE_SCRIPTS/fixture.txt"
+if PATH="$CH6_FAKE_BIN:$PATH" HOME="$TMPDIR_EVAL/ch7-home" CODEX_REAL_HOME="$TMPDIR_EVAL/ch7-real" bash "$CH6_ROOT/$CH_FIXTURE_SCRIPTS/install-codex-home.sh" "$CH7_ARBITRARY" >"$TMPDIR_EVAL/ch7-arbitrary.out" 2>&1; then
+  _fail "CH7: first install overwrote an arbitrary unowned collision"
+elif [[ "$(cat "$CH7_ARBITRARY/$CH_FIXTURE_SCRIPTS/fixture.txt")" == "user-arbitrary" ]] && grep -q 'unowned or ambiguous' "$TMPDIR_EVAL/ch7-arbitrary.out"; then
+  _pass "CH7: arbitrary unowned collision fails before mutation and survives"
+else
+  _fail "CH7: arbitrary collision was not preserved cleanly"
+fi
+
+CH7_MODIFIED="$TMPDIR_EVAL/ch7-modified-ambiguous"
+seed_ch7_legacy "$CH7_MODIFIED" "2000-01-01T00:00:00.000Z"
+printf 'user-modified-after-install\n' > "$CH7_MODIFIED/$CH_FIXTURE_SCRIPTS/fixture.txt"
+if PATH="$CH6_FAKE_BIN:$PATH" HOME="$TMPDIR_EVAL/ch7-home" CODEX_REAL_HOME="$TMPDIR_EVAL/ch7-real" bash "$CH6_ROOT/$CH_FIXTURE_SCRIPTS/install-codex-home.sh" "$CH7_MODIFIED" >"$TMPDIR_EVAL/ch7-modified.out" 2>&1; then
+  _fail "CH7: ambiguous post-install modification was overwritten"
+elif [[ "$(cat "$CH7_MODIFIED/$CH_FIXTURE_SCRIPTS/fixture.txt")" == "user-modified-after-install" ]] && grep -q 'unowned or ambiguous' "$TMPDIR_EVAL/ch7-modified.out"; then
+  _pass "CH7: modified ambiguous legacy-path file fails before mutation and survives"
+else
+  _fail "CH7: modified ambiguous file was not preserved cleanly"
+fi
+
+CH7_EXTENSIBLE="$TMPDIR_EVAL/ch7-user-extensible"
+seed_ch7_legacy "$CH7_EXTENSIBLE" "2099-01-01T00:00:00.000Z"
+mkdir -p "$CH7_EXTENSIBLE/$CH_FIXTURE_SKILLS/legacy-collision" "$CH7_EXTENSIBLE/$CH_FIXTURE_AGENTS"
+printf 'older-user-skill\n' > "$CH7_EXTENSIBLE/$CH_FIXTURE_SKILLS/legacy-collision/SKILL.md"
+printf 'name = "older-user-agent"\n' > "$CH7_EXTENSIBLE/$CH_FIXTURE_AGENTS/legacy-collision.toml"
+if PATH="$CH6_FAKE_BIN:$PATH" HOME="$TMPDIR_EVAL/ch7-home" CODEX_REAL_HOME="$TMPDIR_EVAL/ch7-real" bash "$CH6_ROOT/$CH_FIXTURE_SCRIPTS/install-codex-home.sh" "$CH7_EXTENSIBLE" >"$TMPDIR_EVAL/ch7-extensible.out" 2>&1; then
+  _fail "CH7: legacy inference claimed a pre-existing user skill or agent"
+elif [[ "$(cat "$CH7_EXTENSIBLE/$CH_FIXTURE_SKILLS/legacy-collision/SKILL.md")" == "older-user-skill" ]] \
+  && grep -q 'older-user-agent' "$CH7_EXTENSIBLE/$CH_FIXTURE_AGENTS/legacy-collision.toml" \
+  && grep -q 'unowned or ambiguous' "$TMPDIR_EVAL/ch7-extensible.out"; then
+  _pass "CH7: older user skill and agent collisions remain ambiguous and preserved"
+else
+  _fail "CH7: user-extensible skill or agent collision was not preserved cleanly"
+fi
+
+CH7_RETRY="$TMPDIR_EVAL/ch7-interrupted-retry"
+mkdir -p "$CH7_RETRY/.flow-agents" "$CH7_RETRY/$CH_FIXTURE_SCRIPTS"
+printf 'fixture\n' > "$CH7_RETRY/$CH_FIXTURE_SCRIPTS/fixture.txt"
+printf 'stale-old\n' > "$CH7_RETRY/$CH_FIXTURE_SCRIPTS/stale.txt"
+CH7_OLD_HASH="$(printf 'old-release\n' | shasum -a 256 | awk '{print $1}')"
+CH7_STALE_HASH="$(shasum -a 256 "$CH7_RETRY/$CH_FIXTURE_SCRIPTS/stale.txt" | awk '{print $1}')"
+cat > "$CH7_RETRY/.flow-agents/codex-install-manifest.json" <<JSON
+{"schema_version":"1.0","files":[{"path":"$CH_FIXTURE_SCRIPTS/fixture.txt","sha256":"$CH7_OLD_HASH"},{"path":"$CH_FIXTURE_SCRIPTS/stale.txt","sha256":"$CH7_STALE_HASH"}]}
+JSON
+if PATH="$CH6_FAKE_BIN:$PATH" HOME="$TMPDIR_EVAL/ch7-home" CODEX_REAL_HOME="$TMPDIR_EVAL/ch7-real" bash "$CH6_ROOT/$CH_FIXTURE_SCRIPTS/install-codex-home.sh" "$CH7_RETRY" >"$TMPDIR_EVAL/ch7-retry.out" 2>&1 \
+  && [[ "$(cat "$CH7_RETRY/$CH_FIXTURE_SCRIPTS/fixture.txt")" == "fixture" ]] \
+  && [[ ! -e "$CH7_RETRY/$CH_FIXTURE_SCRIPTS/stale.txt" ]]; then
+  _pass "CH7: interrupted apply retries when current content already matches incoming and removes stale owned files"
+else
+  _fail "CH7: interrupted apply state was not retry-safe"
+fi
+
+CH7_THIRD="$TMPDIR_EVAL/ch7-interrupted-third-content"
+mkdir -p "$CH7_THIRD/.flow-agents" "$CH7_THIRD/$CH_FIXTURE_SCRIPTS"
+printf 'third-party-change\n' > "$CH7_THIRD/$CH_FIXTURE_SCRIPTS/fixture.txt"
+cat > "$CH7_THIRD/.flow-agents/codex-install-manifest.json" <<JSON
+{"schema_version":"1.0","files":[{"path":"$CH_FIXTURE_SCRIPTS/fixture.txt","sha256":"$CH7_OLD_HASH"}]}
+JSON
+if PATH="$CH6_FAKE_BIN:$PATH" HOME="$TMPDIR_EVAL/ch7-home" CODEX_REAL_HOME="$TMPDIR_EVAL/ch7-real" bash "$CH6_ROOT/$CH_FIXTURE_SCRIPTS/install-codex-home.sh" "$CH7_THIRD" >"$TMPDIR_EVAL/ch7-third.out" 2>&1; then
+  _fail "CH7: retry safety accepted arbitrary third content"
+elif [[ "$(cat "$CH7_THIRD/$CH_FIXTURE_SCRIPTS/fixture.txt")" == "third-party-change" ]] && grep -q 'modified Flow Agents file' "$TMPDIR_EVAL/ch7-third.out"; then
+  _pass "CH7: retry safety still rejects and preserves arbitrary third content"
+else
+  _fail "CH7: arbitrary third content was not rejected cleanly"
+fi
+
+CH7_FRESH="$TMPDIR_EVAL/ch7-fresh"
+mkdir -p "$CH7_FRESH/$CH_FIXTURE_SCRIPTS"
+printf 'user-unrelated\n' > "$CH7_FRESH/$CH_FIXTURE_SCRIPTS/user-owned.txt"
+if PATH="$CH6_FAKE_BIN:$PATH" HOME="$TMPDIR_EVAL/ch7-home" CODEX_REAL_HOME="$TMPDIR_EVAL/ch7-real" bash "$CH6_ROOT/$CH_FIXTURE_SCRIPTS/install-codex-home.sh" "$CH7_FRESH" >"$TMPDIR_EVAL/ch7-fresh.out" 2>&1 \
+  && [[ "$(cat "$CH7_FRESH/$CH_FIXTURE_SCRIPTS/fixture.txt")" == "fixture" ]] \
+  && [[ "$(cat "$CH7_FRESH/$CH_FIXTURE_SCRIPTS/user-owned.txt")" == "user-unrelated" ]]; then
+  _pass "CH7: safe first install writes owned files and preserves unrelated files"
+else
+  _fail "CH7: safe first install or unrelated-file preservation regressed"
+fi
+
 echo ""
 
 # ─── opencode --global: OG1: seed user key → install --global → key survives + $schema + stamp ─

package/evals/integration/test_kit_conformance_levels.sh

@@ -201,17 +201,17 @@ fi
 
 # ===================================================================
 echo ""
-echo "=== 8. Trust axis: first-party allowlist (builder and knowledge) ==="
+echo "=== 8. Trust axis: built-in kits are unverified without runtime privilege ==="
 # ===================================================================
 
 for kit_name in builder knowledge; do
   out="$TMP_DIR/trust-${kit_name}.out"
   run_inspect "$ROOT/kits/$kit_name" "$out" || true
   trust=$(node -e "const d=require('fs').readFileSync('$out','utf8'); console.log(JSON.parse(d).trust)" 2>/dev/null)
-  if [[ "$trust" == "first-party" ]]; then
-    pass "$kit_name kit trust: first-party (in Kontour allowlist)"
+  if [[ "$trust" == "unverified" ]]; then
+    pass "$kit_name kit trust: unverified (official catalog metadata grants no runtime privilege)"
   else
-    fail "$kit_name kit trust: expected first-party, got '$trust'"
+    fail "$kit_name kit trust: expected unverified, got '$trust'"
     cat "$out"
   fi
 done
@@ -226,7 +226,7 @@ for fixture in k0-flows-only k1-agent-extension k2-with-evals third-party-extens
   run_inspect "$ROOT/evals/fixtures/kit-conformance-levels/$fixture" "$out" || true
   trust=$(node -e "const d=require('fs').readFileSync('$out','utf8'); console.log(JSON.parse(d).trust)" 2>/dev/null)
   if [[ "$trust" == "unverified" ]]; then
-    pass "$fixture fixture trust: unverified (not in first-party allowlist)"
+    pass "$fixture fixture trust: unverified"
   else
     fail "$fixture fixture trust: expected unverified, got '$trust'"
     cat "$out"
@@ -244,7 +244,7 @@ if node -e "
 const d = require('fs').readFileSync('$out', 'utf8');
 const r = JSON.parse(d);
 if (!('trust' in r)) throw new Error('missing key: trust');
-const valid = ['first-party', 'verified', 'unverified'];
+const valid = ['verified', 'unverified'];
 if (!valid.includes(r.trust)) throw new Error('trust must be one of: ' + valid.join(', ') + '; got: ' + r.trust);
 " 2>/dev/null; then
   pass "inspect JSON output includes trust field with valid value"