@kontourai/flow-agents 3.3.0 → 3.4.1

package/evals/integration/test_publish_delivery.sh

@@ -12,6 +12,34 @@
 #   6. AC6 SHAPE-INVALID-REFUSED (#356): a shape-invalid trust.bundle (test_output claim
 #      naming a non-manifest command) is REFUSED by publishDelivery() -- non-zero exit, loud
 #      message, nothing copied to delivery/. Distinct from FAIL-SOFT (bundle absent).
+#   7. AC1 HEAD-MISMATCH-REFUSED (#413 Facet A): a real git repo whose sealed
+#      trust.checkpoint.json commit_sha names commit A, but the repo's actual HEAD has been
+#      advanced to an unrelated orphan commit B (no ancestor relationship) -- publish-delivery
+#      REFUSES loudly (non-zero exit, RepoHeadMismatchError message), nothing copied to
+#      delivery/. The happy path (HEAD matches the sealed commit_sha) still publishes.
+#   8. AC2 CROSS-SESSION-SEAL-SURVIVES (#413 Facet B): a fixture delivery/<other-slug>/ seal
+#      pre-exists before publishing a DIFFERENT slug -- the other slug's seal directory
+#      survives byte-identical; pruneSupersededSeals only ever touches its OWN keepSlug
+#      directory, never another session's.
+#   9. FIX 4 SHALLOW-UNDETERMINABLE-WARNS-NOT-REFUSES (#413 iteration-2): a REAL shallow clone
+#      (git clone --depth 1) whose sealed trust.checkpoint.json commit_sha names a commit the
+#      shallow clone's object database does not have (so ancestry is UNDETERMINABLE, not
+#      positively confirmed absent) -- publish-delivery WARNS but still PUBLISHES (exit 0, bundle
+#      copied). Distinct from AC1 HEAD-MISMATCH-REFUSED above, which is a POSITIVELY-DETERMINABLE
+#      mismatch and correctly still hard-refuses.
+#  10. NON-GIT-REPOROOT-WITH-SEALED-COMMIT-ALLOWS (#413 iteration-2 Fix 5, REVERTED in
+#      iteration-3): a sealed trust.checkpoint.json names a real commit_sha, but the resolved
+#      repoRoot is NOT a git working tree at all (a bare mkdir -p, no .git) -- publish-delivery
+#      still PUBLISHES (exit 0, bundle copied). This is a SUPPORTED flow (e.g. checkpoint-signing
+#      against a scratch/non-git dir -- see evals/integration/test_checkpoint_signing.sh TEST 2),
+#      not a mismatch signal: iteration-2's Fix 5 briefly hard-refused this case ("a sealed
+#      delivery implies the target should be a real git repo"), but that premise is false and
+#      regressed the supported scratch-dir flow, so it was reverted. Wrong-tree protection for a
+#      REAL git repoRoot still relies on the shape-check, verify-hold, and HEAD-vs-commit_sha
+#      ancestry gates (TEST 6/7/9 above), which correctly no-op (allow) here since there is no git
+#      HEAD to compare against. The pre-existing "no checkpoint / no commit_sha -> allow"
+#      no-opinion case (already covered by TEST 1/2/5/6 above, which use bare mkdir -p repos with
+#      no checkpoint at all) stays exactly the same allow behavior.
 #
 # Deterministic, no model spend, self-cleaning.
 # Usage: bash evals/integration/test_publish_delivery.sh
@@ -116,6 +144,14 @@ AROOT1="$REPO1/.flow-agents"
 SLUG1="pd-release-test"
 SESSION_DIR1="$AROOT1/$SLUG1"
 mkdir -p "$REPO1/kits"
+printf '# marker\n' > "$REPO1/kits/.keep"
+# REPO1 is a bare mkdir -p, not a real git working tree (#413 iteration-2 Fix 5 briefly required a
+# real git repo here since it hard-refused a non-git repoRoot with a sealed commit_sha; Fix 5 was
+# reverted in iteration-3 -- see checkpointHeadAncestry's doc comment -- so the bare-dir fixture is
+# restored). record-release's sealTrustCheckpoint() calls resolveCommitSha(), which is deliberately
+# AMBIENT (cwd-inheriting, never --repo-root-scoped) and fails (returns null) since $TMP itself is
+# not inside any git working tree -- so no commit_sha is ever sealed here, and this test never
+# touches the HEAD-vs-commit_sha ancestry gate at all (mismatchKind stays "none").
 
 FIXTURE1="$TMP/fixture1.json"
 write_bundle_to "$FIXTURE1" "node --version" "true"
@@ -128,7 +164,7 @@ setup_session "$AROOT1" "$SLUG1" "$FIXTURE1"
 # into the manifest. Setting it here makes this fixture genuinely shape-valid (a
 # manifest-matched command claim), matching what CI would actually accept for a repo whose
 # canonical verify is "node --version" — not a preflight-specific carve-out.
-rr_out1=$(TRUST_RECONCILE_COMMANDS="node --version" flow_agents_node "$WRITER" record-release "$SESSION_DIR1" \
+rr_out1=$(cd "$REPO1" && TRUST_RECONCILE_COMMANDS="node --version" flow_agents_node "$WRITER" record-release "$SESSION_DIR1" \
   --decision merge \
   --gate-json '{"name":"merge","status":"pass","summary":"Ready."}' \
   --summary "Release." --repo-root "$REPO1" \
@@ -339,6 +375,300 @@ else
   _fail "AC6 SHAPE-INVALID-REFUSED: delivery/$SLUG6/trust.bundle was created despite invalid shape"
 fi
 
+# ==== TEST 7: AC1 HEAD-MISMATCH-REFUSED (#413 Facet A) ==============
+# publishDelivery() now refuses loudly when the resolved repoRoot's HEAD is not an
+# ancestor-or-equal of the session's sealed trust.checkpoint.json commit_sha -- a real git
+# repo is required here (not a bare mkdir -p fixture) so `git rev-parse HEAD` genuinely
+# resolves and the ancestor check has real commits to compare.
+echo ""
+echo "=== TEST 7: AC1 HEAD-MISMATCH-REFUSED ==="
+
+REPO7="$TMP/repo7"
+AROOT7="$REPO7/.flow-agents"
+SLUG7="pd-head-mismatch-test"
+SESSION_DIR7="$AROOT7/$SLUG7"
+mkdir -p "$REPO7/kits"
+printf '# marker\n' > "$REPO7/kits/.keep"
+(cd "$REPO7" && git init -q && git config user.email "test@test.local" && git config user.name "test" && git add -A && git commit -q -m "commit A")
+SHA_A="$(cd "$REPO7" && git rev-parse HEAD)"
+
+FIXTURE7="$TMP/fixture7.json"
+write_bundle_to "$FIXTURE7" "node --version" "true"
+setup_session "$AROOT7" "$SLUG7" "$FIXTURE7"
+# Seal a checkpoint naming commit A as the trusted commit_sha -- mirrors write_checkpoint_to's
+# minimal, well-formed shape but targets the SESSION dir (where publishDelivery reads it from),
+# not the delivery/ dir (write_checkpoint_to's existing target for the reconcile tests above).
+printf '{"schema_version":"1.0","slug":"%s","work_item":null,"status":"delivered","phase":"release","sealed_at":"2026-06-27T00:00:00Z","commit_sha":"%s","checkpoint":{"asOf":"2026-06-27T00:00:00.000Z","statusByClaimId":{}}}' \
+  "$SLUG7" "$SHA_A" > "$SESSION_DIR7/trust.checkpoint.json"
+
+# Advance repo7's HEAD to a genuinely UNRELATED orphan commit B -- no ancestor relationship
+# with commit A at all.
+(cd "$REPO7" && git checkout -q --orphan orphan-branch && git rm -rq --cached . >/dev/null 2>&1)
+(cd "$REPO7" && mkdir -p kits && printf 'unrelated\n' > kits/unrelated.txt && git add -A && git commit -q -m "commit B (unrelated orphan)")
+SHA_B="$(cd "$REPO7" && git rev-parse HEAD)"
+
+if [[ "$SHA_A" != "$SHA_B" ]]; then
+  _pass "TEST 7 setup: commit A and commit B are genuinely distinct shas"
+else
+  _fail "TEST 7 setup: commit A and commit B unexpectedly matched"
+fi
+
+mismatch_out=$(TRUST_RECONCILE_COMMANDS="node --version" flow_agents_node "$WRITER" publish-delivery "$SESSION_DIR7"   --repo-root "$REPO7" 2>&1)
+mismatch_exit=$?
+
+if [[ $mismatch_exit -ne 0 ]]; then
+  _pass "AC1 HEAD-MISMATCH-REFUSED: publish-delivery exits non-zero when repoRoot HEAD does not match the sealed commit_sha"
+else
+  _fail "AC1 HEAD-MISMATCH-REFUSED: expected non-zero exit, got 0 -- $mismatch_out"
+fi
+
+if echo "$mismatch_out" | grep -q "REFUSING to publish"; then
+  _pass "AC1 HEAD-MISMATCH-REFUSED: output names the refusal loudly (REFUSING to publish)"
+else
+  _fail "AC1 HEAD-MISMATCH-REFUSED: expected a loud REFUSING to publish message, got: $mismatch_out"
+fi
+
+if echo "$mismatch_out" | grep -qF "$SHA_A" && echo "$mismatch_out" | grep -qF "$SHA_B"; then
+  _pass "AC1 HEAD-MISMATCH-REFUSED: refusal message names both the checkpoint commit_sha and the mismatched HEAD sha"
+else
+  _fail "AC1 HEAD-MISMATCH-REFUSED: refusal message did not name both shas: $mismatch_out"
+fi
+
+DELIVERY_BUNDLE7="$REPO7/delivery/$SLUG7/trust.bundle"
+if [[ ! -f "$DELIVERY_BUNDLE7" ]]; then
+  _pass "AC1 HEAD-MISMATCH-REFUSED: delivery/$SLUG7/trust.bundle NOT created on HEAD mismatch"
+else
+  _fail "AC1 HEAD-MISMATCH-REFUSED: delivery/$SLUG7/trust.bundle was created despite the HEAD mismatch"
+fi
+
+# Happy path: seal a SECOND session's checkpoint against the repo's CURRENT (matching) HEAD --
+# publish-delivery must still succeed. Proves the gate is scoped strictly to the mismatch case,
+# never a spurious refusal.
+SLUG7B="pd-head-match-test"
+SESSION_DIR7B="$AROOT7/$SLUG7B"
+FIXTURE7B="$TMP/fixture7b.json"
+write_bundle_to "$FIXTURE7B" "node --version" "true"
+setup_session "$AROOT7" "$SLUG7B" "$FIXTURE7B"
+printf '{"schema_version":"1.0","slug":"%s","work_item":null,"status":"delivered","phase":"release","sealed_at":"2026-06-27T00:00:00Z","commit_sha":"%s","checkpoint":{"asOf":"2026-06-27T00:00:00.000Z","statusByClaimId":{}}}'   "$SLUG7B" "$SHA_B" > "$SESSION_DIR7B/trust.checkpoint.json"
+
+match_out=$(TRUST_RECONCILE_COMMANDS="node --version" flow_agents_node "$WRITER" publish-delivery "$SESSION_DIR7B"   --repo-root "$REPO7" 2>&1)
+match_exit=$?
+
+if [[ $match_exit -eq 0 ]]; then
+  _pass "AC1 happy path: publish-delivery succeeds when repoRoot HEAD matches the sealed commit_sha"
+else
+  _fail "AC1 happy path: publish-delivery unexpectedly failed on a matching HEAD/commit_sha: $match_out"
+fi
+if [[ -f "$REPO7/delivery/$SLUG7B/trust.bundle" ]]; then
+  _pass "AC1 happy path: delivery/$SLUG7B/trust.bundle created when HEAD matches commit_sha"
+else
+  _fail "AC1 happy path: delivery/$SLUG7B/trust.bundle NOT created despite a matching HEAD/commit_sha"
+fi
+
+# ==== TEST 8: AC2 CROSS-SESSION-SEAL-SURVIVES (#413 Facet B) ========
+# pruneSupersededSeals must never delete another session's delivery/<other-slug>/ directory --
+# only its OWN keepSlug directory. Seed a fixture other-session seal BEFORE publishing a
+# DIFFERENT slug, then assert the fixture survives byte-identical.
+echo ""
+echo "=== TEST 8: AC2 CROSS-SESSION-SEAL-SURVIVES ==="
+
+REPO8="$TMP/repo8"
+AROOT8="$REPO8/.flow-agents"
+SLUG8="pd-cross-session-test"
+SESSION_DIR8="$AROOT8/$SLUG8"
+mkdir -p "$REPO8/kits"
+
+OTHER_SLUG="pd-other-inflight-session"
+OTHER_SEAL_DIR="$REPO8/delivery/$OTHER_SLUG"
+mkdir -p "$OTHER_SEAL_DIR"
+printf '{"marker":"other-session-trust-bundle","schemaVersion":5}' > "$OTHER_SEAL_DIR/trust.bundle"
+printf '{"schema_version":"1.0","slug":"%s","work_item":null,"status":"delivered","phase":"release","sealed_at":"2026-06-27T00:00:00Z","commit_sha":"deadbeefdeadbeefdeadbeefdeadbeefdeadbeef","checkpoint":{"asOf":"2026-06-27T00:00:00.000Z","statusByClaimId":{}}}'   > "$OTHER_SEAL_DIR/trust.checkpoint.json"
+OTHER_BUNDLE_BEFORE="$(cat "$OTHER_SEAL_DIR/trust.bundle")"
+OTHER_CHECKPOINT_BEFORE="$(cat "$OTHER_SEAL_DIR/trust.checkpoint.json")"
+
+FIXTURE8="$TMP/fixture8.json"
+write_bundle_to "$FIXTURE8" "node --version" "true"
+setup_session "$AROOT8" "$SLUG8" "$FIXTURE8"
+
+cross_out=$(TRUST_RECONCILE_COMMANDS="node --version" flow_agents_node "$WRITER" publish-delivery "$SESSION_DIR8"   --repo-root "$REPO8" 2>&1)
+cross_exit=$?
+
+if [[ $cross_exit -eq 0 ]]; then
+  _pass "AC2 CROSS-SESSION-SEAL-SURVIVES: publish-delivery for $SLUG8 exits 0"
+else
+  _fail "AC2 CROSS-SESSION-SEAL-SURVIVES: publish-delivery for $SLUG8 unexpectedly failed: $cross_out"
+fi
+
+if [[ -f "$REPO8/delivery/$SLUG8/trust.bundle" ]]; then
+  _pass "AC2 CROSS-SESSION-SEAL-SURVIVES: this session's OWN delivery/$SLUG8/trust.bundle was written"
+else
+  _fail "AC2 CROSS-SESSION-SEAL-SURVIVES: delivery/$SLUG8/trust.bundle was not written"
+fi
+
+if [[ -d "$OTHER_SEAL_DIR" ]]; then
+  _pass "AC2 CROSS-SESSION-SEAL-SURVIVES: the OTHER session's delivery/$OTHER_SLUG/ directory SURVIVES"
+else
+  _fail "AC2 CROSS-SESSION-SEAL-SURVIVES: the other session's delivery/$OTHER_SLUG/ directory was deleted -- cross-slug pruning regressed"
+fi
+
+if [[ -f "$OTHER_SEAL_DIR/trust.bundle" && "$(cat "$OTHER_SEAL_DIR/trust.bundle" 2>/dev/null)" == "$OTHER_BUNDLE_BEFORE" ]]; then
+  _pass "AC2 CROSS-SESSION-SEAL-SURVIVES: the other session's trust.bundle is byte-identical after this publish"
+else
+  _fail "AC2 CROSS-SESSION-SEAL-SURVIVES: the other session's trust.bundle was mutated or removed"
+fi
+
+if [[ -f "$OTHER_SEAL_DIR/trust.checkpoint.json" && "$(cat "$OTHER_SEAL_DIR/trust.checkpoint.json" 2>/dev/null)" == "$OTHER_CHECKPOINT_BEFORE" ]]; then
+  _pass "AC2 CROSS-SESSION-SEAL-SURVIVES: the other session's trust.checkpoint.json is byte-identical after this publish"
+else
+  _fail "AC2 CROSS-SESSION-SEAL-SURVIVES: the other session's trust.checkpoint.json was mutated or removed"
+fi
+
+# Mutation-test note (prune scoping): this eval passes ONLY because pruneSupersededSeals was
+# scoped to keepSlug's own directory (#413 Facet B). Prior to that fix, this loop deleted ANY
+# non-keepSlug directory under delivery/ that looked like a seal (contained trust.bundle or
+# trust.checkpoint.json) -- exactly OTHER_SEAL_DIR's shape -- so this test would have failed
+# the two directory/byte-identical checks above against the pre-fix implementation.
+
+# ==== TEST 9: FIX 4 SHALLOW-UNDETERMINABLE-WARNS-NOT-REFUSES (#413 iteration-2) =====
+# A REAL shallow clone (git clone --depth 1) whose sealed trust.checkpoint.json commit_sha names
+# an OLDER commit the shallow clone's object database genuinely does not have -- `git merge-base
+# --is-ancestor` cannot determine ancestry here (exit 128, not 0 or 1), which is the
+# UNDETERMINABLE case Fix 4 must warn-and-allow, never hard-refuse. Distinct from TEST 7's
+# POSITIVELY-DETERMINABLE orphan-commit mismatch, which correctly still hard-refuses.
+echo ""
+echo "=== TEST 9: FIX 4 SHALLOW-UNDETERMINABLE-WARNS-NOT-REFUSES ==="
+
+SRC9="$TMP/src9"
+mkdir -p "$SRC9/kits"
+(cd "$SRC9" && git init -q && git config user.email "test@test.local" && git config user.name "test" \
+  && printf 'a\n' > kits/.keep && git add -A && git commit -q -m "commit A (older, will be missing from the shallow clone)")
+SHA9_A="$(cd "$SRC9" && git rev-parse HEAD)"
+(cd "$SRC9" && printf 'b\n' > kits/b.txt && git add -A && git commit -q -m "commit B")
+(cd "$SRC9" && printf 'c\n' > kits/c.txt && git add -A && git commit -q -m "commit C (HEAD, shallow clone's only commit)")
+
+REPO9="$TMP/repo9"
+if git clone -q --depth 1 --no-local "file://$SRC9" "$REPO9" >/dev/null 2>"$TMP/shallow-clone9.err"; then
+  _pass "TEST 9 setup: a real shallow clone (--depth 1) was created"
+else
+  _fail "TEST 9 setup: shallow clone failed: $(cat "$TMP/shallow-clone9.err")"
+fi
+SHA9_HEAD="$(cd "$REPO9" && git rev-parse HEAD)"
+
+# Confirm the shallow clone genuinely cannot determine ancestry for the older, missing commit --
+# the exact precondition this test depends on.
+if ! (cd "$REPO9" && git cat-file -e "$SHA9_A" 2>/dev/null); then
+  _pass "TEST 9 setup: the shallow clone's object database genuinely lacks commit A (the precondition for UNDETERMINABLE ancestry)"
+else
+  _fail "TEST 9 setup: the shallow clone unexpectedly has commit A -- this fixture no longer exercises the undeterminable path"
+fi
+
+AROOT9="$REPO9/.flow-agents"
+SLUG9="pd-shallow-undeterminable-test"
+SESSION_DIR9="$AROOT9/$SLUG9"
+mkdir -p "$REPO9/kits" # kits/ already exists from the clone, but keep parity with other tests' setup shape
+
+FIXTURE9="$TMP/fixture9.json"
+write_bundle_to "$FIXTURE9" "node --version" "true"
+setup_session "$AROOT9" "$SLUG9" "$FIXTURE9"
+# Seal a checkpoint naming the OLDER commit (A) the shallow clone does not have -- mirrors TEST
+# 7's shape but targets a genuinely shallow repo.
+printf '{"schema_version":"1.0","slug":"%s","work_item":null,"status":"delivered","phase":"release","sealed_at":"2026-06-27T00:00:00Z","commit_sha":"%s","checkpoint":{"asOf":"2026-06-27T00:00:00.000Z","statusByClaimId":{}}}' \
+  "$SLUG9" "$SHA9_A" > "$SESSION_DIR9/trust.checkpoint.json"
+
+shallow_out=$(TRUST_RECONCILE_COMMANDS="node --version" flow_agents_node "$WRITER" publish-delivery "$SESSION_DIR9" --repo-root "$REPO9" 2>&1)
+shallow_exit=$?
+
+if [[ $shallow_exit -eq 0 ]]; then
+  _pass "FIX 4: publish-delivery from a shallow clone with an undeterminable checkpoint ancestry still exits 0 (warns, does not refuse)"
+else
+  _fail "FIX 4: publish-delivery unexpectedly refused (non-zero exit) for the shallow/undeterminable case: $shallow_out"
+fi
+
+if echo "$shallow_out" | grep -qi "WARNING.*could not determine"; then
+  _pass "FIX 4: output contains a loud WARNING naming the undeterminable ancestry"
+else
+  _fail "FIX 4: expected a loud WARNING for the undeterminable ancestry case, got: $shallow_out"
+fi
+
+if echo "$shallow_out" | grep -q "REFUSING to publish"; then
+  _fail "FIX 4: unexpectedly REFUSED the shallow/undeterminable case -- this must warn and allow, never hard-refuse"
+else
+  _pass "FIX 4: no REFUSING to publish message -- the shallow/undeterminable case is correctly NOT treated as a hard refuse"
+fi
+
+if [[ -f "$REPO9/delivery/$SLUG9/trust.bundle" ]]; then
+  _pass "FIX 4: delivery/$SLUG9/trust.bundle WAS published despite the undeterminable ancestry (warn-and-allow, not refuse)"
+else
+  _fail "FIX 4: delivery/$SLUG9/trust.bundle was NOT published -- the shallow/undeterminable case was incorrectly blocked"
+fi
+
+# Mutation-test note (Fix 4): this test passes ONLY because checkpointHeadAncestry's
+# mismatchKind classification distinguishes "positive" (git merge-base --is-ancestor exits 1,
+# a real answer) from "undeterminable-shallow" (exit 128 / spawn failure, e.g. this shallow
+# clone's missing commit object). Prior to Fix 4, the collapsed isAncestorCommit() boolean
+# treated shallow-missing exactly the same as a positively-confirmed non-ancestor, and this
+# test would have failed the REFUSING/exit-0/bundle-published assertions above.
+
+# ==== TEST 10: NON-GIT-REPOROOT-WITH-SEALED-COMMIT-ALLOWS (#413 iteration-2 Fix 5, reverted) ====
+# repoRoot resolves to a real path, but it is NOT a git working tree at all (a bare mkdir -p,
+# no .git anywhere) -- while the session's sealed trust.checkpoint.json names a real commit_sha.
+# This is a SUPPORTED flow (scratch/checkpoint-signing dirs, see
+# evals/integration/test_checkpoint_signing.sh TEST 2), so publish-delivery must still PUBLISH
+# (exit 0, bundle copied) -- not the FIX 5 hard-refuse iteration-2 briefly added and iteration-3
+# reverted. Distinct from the pre-existing "no checkpoint / no commit_sha -> allow" no-opinion
+# case TEST 1/2/5/6 already cover with their own bare mkdir -p repos that have no checkpoint at
+# all -- this test's REPO10 DOES have a sealed checkpoint with a real-looking commit_sha, and
+# still allows.
+echo ""
+echo "=== TEST 10: NON-GIT-REPOROOT-WITH-SEALED-COMMIT-ALLOWS ==="
+
+REPO10="$TMP/repo10"
+AROOT10="$REPO10/.flow-agents"
+SLUG10="pd-non-git-reporoot-test"
+SESSION_DIR10="$AROOT10/$SLUG10"
+mkdir -p "$REPO10/kits" # kits/ marker only -- deliberately NO git init anywhere under REPO10
+
+FIXTURE10="$TMP/fixture10.json"
+write_bundle_to "$FIXTURE10" "node --version" "true"
+setup_session "$AROOT10" "$SLUG10" "$FIXTURE10"
+# Seal a checkpoint naming a plausible-looking (but unverifiable, since there's no git repo here
+# at all) commit_sha.
+printf '{"schema_version":"1.0","slug":"%s","work_item":null,"status":"delivered","phase":"release","sealed_at":"2026-06-27T00:00:00Z","commit_sha":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","checkpoint":{"asOf":"2026-06-27T00:00:00.000Z","statusByClaimId":{}}}' \
+  > "$SESSION_DIR10/trust.checkpoint.json"
+
+if [[ ! -d "$REPO10/.git" ]]; then
+  _pass "TEST 10 setup: REPO10 genuinely has no .git -- not a git working tree at all"
+else
+  _fail "TEST 10 setup: REPO10 unexpectedly has a .git directory"
+fi
+
+nongit_out=$(TRUST_RECONCILE_COMMANDS="node --version" flow_agents_node "$WRITER" publish-delivery "$SESSION_DIR10" --repo-root "$REPO10" 2>&1)
+nongit_exit=$?
+
+if [[ $nongit_exit -eq 0 ]]; then
+  _pass "NON-GIT-REPOROOT-ALLOWS: publish-delivery exits 0 for a non-git repoRoot with a sealed commit_sha"
+else
+  _fail "NON-GIT-REPOROOT-ALLOWS: expected exit 0 for a non-git repoRoot with a sealed commit_sha, got $nongit_exit -- $nongit_out"
+fi
+
+if ! echo "$nongit_out" | grep -q "REFUSING to publish"; then
+  _pass "NON-GIT-REPOROOT-ALLOWS: output does not contain a REFUSING to publish message"
+else
+  _fail "NON-GIT-REPOROOT-ALLOWS: unexpected REFUSING to publish message, got: $nongit_out"
+fi
+
+if [[ -f "$REPO10/delivery/$SLUG10/trust.bundle" ]]; then
+  _pass "NON-GIT-REPOROOT-ALLOWS: delivery/$SLUG10/trust.bundle created for a non-git repoRoot with a sealed commit_sha"
+else
+  _fail "NON-GIT-REPOROOT-ALLOWS: delivery/$SLUG10/trust.bundle NOT created despite the supported non-git-repoRoot flow"
+fi
+
+# Mutation-test note: this test passes only because checkpointHeadAncestry's non-git-repoRoot
+# path resolves headSha to empty (git rev-parse HEAD fails outside a working tree) and returns
+# mismatchKind:"none" (the same "no opinion, allow" result as the genuinely no-checkpoint case) --
+# never the iteration-2 Fix 5 non-git-repo refuse arm, which this test's own removal proves is
+# gone.
+
 # ---- Summary ----
 echo ""
 echo "----------------------------------------------"

package/evals/integration/test_pull_work_board.sh

@@ -0,0 +1,200 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+source "$ROOT/evals/lib/env.sh"
+flow_agents_eval_bootstrap "$ROOT" || exit $?
+SCRIPT="$ROOT/scripts/pull-work-provider.js"
+TMPDIR_EVAL="$(mktemp -d)"
+trap 'rm -rf "$TMPDIR_EVAL"' EXIT
+
+errors=0
+pass() { echo "  ✓ $1"; }
+fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
+
+json_query() {
+  NO_COLOR=1 FORCE_COLOR=0 node -e 'const fs=require("fs"); let cur=JSON.parse(fs.readFileSync(process.argv[1],"utf8")); for (const part of process.argv[2].split(".")) cur=part==="length" ? cur.length : (Array.isArray(cur) ? cur[Number(part)] : cur[part]); console.log(cur);' "$1" "$2"
+}
+
+cat > "$TMPDIR_EVAL/settings.json" <<'JSON'
+{
+  "schema_version": "1.0",
+  "projects": [
+    {
+      "project": { "repo": { "owner": "kontourai", "name": "flow-agents" } },
+      "work_item_provider": {
+        "role": "WorkItemProvider",
+        "kind": "github",
+        "repo": { "owner": "kontourai", "name": "flow-agents" },
+        "capabilities": ["issues", "labels"]
+      },
+      "board_provider": {
+        "role": "BoardProvider",
+        "kind": "github",
+        "repo": { "owner": "kontourai", "name": "flow-agents" },
+        "board": { "type": "github_project", "owner": "kontourai", "number": 1 },
+        "capabilities": ["projects_boards", "status_fields", "custom_fields"]
+      },
+      "selection": {
+        "filters": {
+          "issue_state": "open",
+          "include_labels": [],
+          "ready_statuses": ["ready"],
+          "exclude_statuses": ["in_progress", "blocked", "review", "verification", "done"]
+        },
+        "wip_policy": {
+          "prefer_finishing_active_work": true,
+          "active_statuses": ["in_progress", "review", "verification"],
+          "block_new_work_when_active_count_exceeds": 0
+        }
+      }
+    }
+  ]
+}
+JSON
+
+cat > "$TMPDIR_EVAL/items.json" <<'JSON'
+{
+  "items": [
+    {
+      "id": "PVTI_1",
+      "position": 0,
+      "fieldValues": [
+        { "field": { "name": "Status" }, "name": "Ready" },
+        { "field": { "name": "Priority" }, "name": "P1" }
+      ],
+      "content": {
+        "id": "I_7",
+        "number": 7,
+        "title": "P1 ready board item",
+        "body": "## Scope\nDo P1 work.\n\n## Acceptance criteria\nDone.",
+        "state": "OPEN",
+        "url": "https://github.com/kontourai/flow-agents/issues/7",
+        "repository": { "name": "flow-agents", "owner": { "login": "kontourai" } },
+        "labels": { "nodes": [{ "name": "builder" }] }
+      }
+    },
+    {
+      "id": "PVTI_2",
+      "position": 1,
+      "status": "In Progress",
+      "priority": "P0",
+      "content": {
+        "id": "I_8",
+        "number": 8,
+        "title": "Active item excluded from ready queue",
+        "body": "## Scope\nAlready active.",
+        "state": "OPEN",
+        "url": "https://github.com/kontourai/flow-agents/issues/8",
+        "repository": { "name": "flow-agents", "owner": { "login": "kontourai" } },
+        "labels": []
+      }
+    },
+    {
+      "id": "PVTI_3",
+      "position": 2,
+      "status": "ready",
+      "priority": "P0",
+      "content": {
+        "id": "I_5",
+        "number": 5,
+        "title": "P0 lower-case ready item",
+        "body": "## Scope\nDo P0 work.\n\n## Acceptance criteria\nDone.",
+        "state": "OPEN",
+        "url": "https://github.com/kontourai/flow-agents/issues/5",
+        "repository": { "name": "flow-agents", "owner": { "login": "kontourai" } },
+        "labels": []
+      }
+    },
+    {
+      "id": "PVTI_4",
+      "position": 3,
+      "status": "Ready",
+      "priority": "P2",
+      "content": {
+        "id": "I_9",
+        "number": 9,
+        "title": "P2 ready board item",
+        "body": "## Scope\nDo P2 work.\n\n## Acceptance criteria\nDone.",
+        "state": "OPEN",
+        "url": "https://github.com/kontourai/flow-agents/issues/9",
+        "repository": { "name": "flow-agents", "owner": { "login": "kontourai" } },
+        "labels": []
+      }
+    }
+  ],
+  "open_issues": [
+    {
+      "id": "I_5",
+      "number": 5,
+      "title": "P0 lower-case ready item",
+      "state": "OPEN",
+      "url": "https://github.com/kontourai/flow-agents/issues/5",
+      "labels": []
+    },
+    {
+      "id": "I_11",
+      "number": 11,
+      "title": "Open issue missing from board",
+      "state": "OPEN",
+      "url": "https://github.com/kontourai/flow-agents/issues/11",
+      "labels": [{ "name": "intake" }]
+    }
+  ]
+}
+JSON
+
+cat > "$TMPDIR_EVAL/zero-ready.json" <<'JSON'
+{
+  "items": [
+    {
+      "id": "PVTI_10",
+      "position": 0,
+      "status": "Blocked",
+      "priority": "P0",
+      "content": {
+        "id": "I_10",
+        "number": 10,
+        "title": "Blocked board item",
+        "state": "OPEN",
+        "url": "https://github.com/kontourai/flow-agents/issues/10",
+        "labels": []
+      }
+    }
+  ],
+  "open_issues": []
+}
+JSON
+
+echo "=== Pull Work Board Ready Queue ==="
+
+node "$SCRIPT" \
+  --settings-json "$TMPDIR_EVAL/settings.json" \
+  --items-json "$TMPDIR_EVAL/items.json" \
+  > "$TMPDIR_EVAL/board.json"
+status=$?
+[[ "$status" -eq 0 ]] && pass "board reader exits successfully" || fail "board reader exits successfully"
+
+[[ "$(json_query "$TMPDIR_EVAL/board.json" "ready_queue.length")" == "3" ]] && pass "filters only ready board items" || fail "filters only ready board items"
+[[ "$(json_query "$TMPDIR_EVAL/board.json" "ready_queue.0.id")" == "github:kontourai/flow-agents#5" ]] && pass "orders P0 before P1 and preserves board position tiebreak" || fail "orders P0 before P1 and preserves board position tiebreak"
+[[ "$(json_query "$TMPDIR_EVAL/board.json" "ready_queue.1.id")" == "github:kontourai/flow-agents#7" ]] && pass "orders P1 before P2" || fail "orders P1 before P2"
+[[ "$(json_query "$TMPDIR_EVAL/board.json" "ready_queue.2.id")" == "github:kontourai/flow-agents#9" ]] && pass "keeps P2 ready after higher priorities" || fail "keeps P2 ready after higher priorities"
+[[ "$(json_query "$TMPDIR_EVAL/board.json" "ready_queue.0.status")" == "ready" ]] && pass "matches ready status case-insensitively" || fail "matches ready status case-insensitively"
+[[ "$(json_query "$TMPDIR_EVAL/board.json" "ready_queue.0.board_membership.priority")" == "P0" ]] && pass "preserves board priority on candidate" || fail "preserves board priority on candidate"
+[[ "$(json_query "$TMPDIR_EVAL/board.json" "intake_gaps.length")" == "1" ]] && pass "detects open WorkItemProvider issues absent from board" || fail "detects open WorkItemProvider issues absent from board"
+[[ "$(json_query "$TMPDIR_EVAL/board.json" "intake_gaps.0.id")" == "github:kontourai/flow-agents#11" ]] && pass "reports missing issue as intake gap" || fail "reports missing issue as intake gap"
+
+node "$SCRIPT" \
+  --settings-json "$TMPDIR_EVAL/settings.json" \
+  --items-json "$TMPDIR_EVAL/zero-ready.json" \
+  > "$TMPDIR_EVAL/zero-ready-output.json"
+[[ "$(json_query "$TMPDIR_EVAL/zero-ready-output.json" "ready_queue.length")" == "0" ]] && pass "zero-ready fixture has empty ready queue" || fail "zero-ready fixture has empty ready queue"
+[[ "$(json_query "$TMPDIR_EVAL/zero-ready-output.json" "warnings.0.code")" == "zero_ready_items" ]] && pass "zero ready emits loud warning" || fail "zero ready emits loud warning"
+
+if [[ "$errors" -eq 0 ]]; then
+  echo "Pull work board checks passed"
+else
+  echo "Pull work board checks failed: $errors"
+fi
+
+exit "$errors"

package/evals/integration/test_pull_work_provider.sh

@@ -13,7 +13,7 @@ pass() { echo "  ✓ $1"; }
 fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
 
 json_query() {
-  node -e 'const fs=require("fs"); let cur=JSON.parse(fs.readFileSync(process.argv[1],"utf8")); for (const part of process.argv[2].split(".")) cur=part==="length" ? cur.length : (Array.isArray(cur) ? cur[Number(part)] : cur[part]); console.log(cur);' "$1" "$2"
+  NO_COLOR=1 FORCE_COLOR=0 node -e 'const fs=require("fs"); let cur=JSON.parse(fs.readFileSync(process.argv[1],"utf8")); for (const part of process.argv[2].split(".")) cur=part==="length" ? cur.length : (Array.isArray(cur) ? cur[Number(part)] : cur[part]); console.log(cur);' "$1" "$2"
 }
 
 echo "=== Pull Work Provider Normalization ==="