@kontourai/flow-agents 3.3.0 → 3.4.1

package/evals/integration/test_workflow_sidecar_writer.sh

@@ -2800,6 +2800,52 @@ else
   _fail "trust.bundle capture-authoritative setup failed: $(cat "$TMPDIR_EVAL/tb-capture-evidence.out" "$TMPDIR_EVAL/tb-capture-evidence.err")"
 fi
 
+# ─── #470 iteration 2 (finding #2, HIGH): captureByCommand treats ambiguous as
+# non-confirming, never coerced to "pass" (would reconcile as a verified event + passing:true,
+# reintroducing the #470 false-pass). A command-log entry whose only capture is
+# observedResult:"ambiguous" (e.g. a codex no-signal capture, or the #362 grep/diff absence
+# carve-out) paired with a claimed-pass check must build a bundle claim whose value is the
+# EXISTING canonical non-confirming status "not_verified", an evidence item stamped
+# passing:false, and NO verification event for that claim. ------------------------------------
+TB_AMBIGUOUS_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/trust-bundle-ambiguous"
+mkdir -p "$TB_AMBIGUOUS_DIR"
+cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$TB_AMBIGUOUS_DIR/trust-bundle-ambiguous--deliver.md"
+flow_agents_node "$WRITER" init-plan "$TB_AMBIGUOUS_DIR/trust-bundle-ambiguous--deliver.md" \
+  --source-request "Ambiguous-capture non-confirming trust bundle fixture (#470 iteration 2)." \
+  --summary "Ambiguous-capture non-confirming trust bundle fixture." \
+  --next-action "Seed a claimed-pass check whose only capture is observedResult:ambiguous." \
+  --timestamp "2026-05-09T00:00:00Z" >"$TMPDIR_EVAL/tb-ambiguous-init.out" 2>"$TMPDIR_EVAL/tb-ambiguous-init.err"
+# Deterministic capture log: the command produced NO usable pass/fail signal (codex no-signal
+# default / #362 absence carve-out), recorded before record-evidence.
+printf '%s\n' '{"command":"npm test","observedResult":"ambiguous","exitCode":null}' > "$TB_AMBIGUOUS_DIR/command-log.jsonl"
+if flow_agents_node "$WRITER" record-evidence "$TB_AMBIGUOUS_DIR" \
+  --verdict pass \
+  --check-json '{"id":"tb-ambiguous-check","kind":"test","status":"pass","summary":"Claimed pass.","command":"npm test"}' \
+  --timestamp "2026-05-09T00:01:00Z" >"$TMPDIR_EVAL/tb-ambiguous-evidence.out" 2>"$TMPDIR_EVAL/tb-ambiguous-evidence.err" \
+  && [[ -f "$TB_AMBIGUOUS_DIR/trust.bundle" ]]; then
+  if node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/tb-ambiguous-assert.err"
+import { readFileSync } from 'node:fs';
+const bundle = JSON.parse(readFileSync('${TB_AMBIGUOUS_DIR}/trust.bundle', 'utf8'));
+const claim = bundle.claims.find((c) => c.subjectId && c.subjectId.endsWith('/tb-ambiguous-check'));
+if (!claim) { process.stderr.write('missing claim for /tb-ambiguous-check\n'); process.exit(1); }
+if (claim.value !== 'not_verified') { process.stderr.write('claimed-pass check with captured ambiguous had claim.value ' + claim.value + ', expected not_verified\n'); process.exit(1); }
+if (claim.status === 'verified') { process.stderr.write('claimed-pass check with captured ambiguous derived claim.status verified -- ambiguous must never confirm\n'); process.exit(1); }
+const ev = bundle.evidence.find((e) => e.claimId === claim.id);
+if (!ev) { process.stderr.write('missing evidence item for ambiguous-captured claim\n'); process.exit(1); }
+if (ev.passing !== false) { process.stderr.write('ambiguous-captured evidence item had passing=' + ev.passing + ', expected false\n'); process.exit(1); }
+if (ev.execution && ev.execution.isError !== false) { process.stderr.write('ambiguous-captured evidence item had execution.isError=' + (ev.execution && ev.execution.isError) + ', expected false (ambiguous is not an error)\n'); process.exit(1); }
+const verifiedEvent = bundle.events.find((e) => e.claimId === claim.id && e.status === 'verified');
+if (verifiedEvent) { process.stderr.write('a verified event was emitted for an ambiguous-captured claim -- #470 false-pass reintroduced\n'); process.exit(1); }
+NODEOF
+  then
+    _pass "trust.bundle ambiguous non-confirming (#470 iter2): claimed-pass + captured-ambiguous -> claim.value=not_verified, passing:false, no verified event"
+  else
+    _fail "trust.bundle ambiguous non-confirming assertion failed: $(cat "$TMPDIR_EVAL/tb-ambiguous-assert.err")"
+  fi
+else
+  _fail "trust.bundle ambiguous non-confirming setup failed: $(cat "$TMPDIR_EVAL/tb-ambiguous-evidence.out" "$TMPDIR_EVAL/tb-ambiguous-evidence.err")"
+fi
+
 # ---- #347: hard cutover -- an unstamped (pre-#344) claim in a session trust bundle is a loud,
 # typed error; checksFromBundle/critiquesFromBundle carry NO claimType-derivation fallback (that
 # fallback WAS the #268 defect kept reachable). ----------------------------------------------
@@ -3388,6 +3434,1355 @@ else
   _fail "missing slug error message lacked 'task-slug is required': $(cat "$TMPDIR_EVAL/wi-no-slug.out")"
 fi
 
+# ─── #270/#298 compose layer: gate-claim accumulation, gate-claim typing survives rebuild, ──
+# compose-two/three/four-writer round-trip, waiver + artifact_refs/standard_refs round-trip,
+# runnability rejection at record time (AC1-AC6, AC8, AC10) ──────────────────────────────────
+COMPOSE_ROOT="$TMPDIR_EVAL/compose-root"
+COMPOSE_SLUG="compose-270"
+COMPOSE_DIR="$COMPOSE_ROOT/$COMPOSE_SLUG"
+mkdir -p "$COMPOSE_ROOT"
+
+flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$COMPOSE_ROOT" \
+  --task-slug "$COMPOSE_SLUG" \
+  --actor compose-actor \
+  --flow-id builder.build \
+  --title "Compose layer session" \
+  --source-request "Compose-safe writer layer smoke session." \
+  --summary "Seed session for compose-layer round-trip assertions." \
+  --criterion "Compose layer round-trips losslessly" \
+  --timestamp "2026-07-05T09:00:00Z" >"$TMPDIR_EVAL/compose-seed.out" 2>"$TMPDIR_EVAL/compose-seed.err"
+
+_compose_claims_json() {
+  cat "$COMPOSE_DIR/trust.bundle"
+}
+
+# ─── AC3/AC6: record-evidence #1 — command-backed check carrying artifact_refs/standard_refs ──
+if flow_agents_node "$WRITER" record-evidence "$COMPOSE_DIR" \
+  --verdict pass \
+  --check-json '{"id":"compose-build-check","kind":"build","status":"pass","summary":"Build passed","command":"npm run build","artifact_refs":[{"kind":"artifact","file":"build/out.js","summary":"build output"}],"standard_refs":[{"standard":"junit","file":"build/out.xml"}]}' \
+  --timestamp "2026-07-05T09:05:00Z" >"$TMPDIR_EVAL/compose-ev1.out" 2>"$TMPDIR_EVAL/compose-ev1.err" \
+  && [[ -f "$COMPOSE_DIR/trust.bundle" ]]; then
+  _pass "compose: record-evidence #1 (command-backed check w/ artifact_refs/standard_refs) writes trust.bundle"
+else
+  _fail "compose: record-evidence #1 failed: $(cat "$TMPDIR_EVAL/compose-ev1.out" "$TMPDIR_EVAL/compose-ev1.err")"
+fi
+
+if node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/compose-ev1-assert.err"
+import { readFileSync } from 'node:fs';
+const bundle = JSON.parse(readFileSync('${COMPOSE_DIR}/trust.bundle', 'utf8'));
+const claim = bundle.claims.find((c) => c.subjectId && c.subjectId.endsWith('/compose-build-check'));
+if (!claim) { process.stderr.write('missing compose-build-check claim\n'); process.exit(1); }
+const md = claim.metadata || {};
+if (!Array.isArray(md.artifact_refs) || md.artifact_refs.length !== 1) { process.stderr.write('artifact_refs did not stamp onto claim.metadata: ' + JSON.stringify(md.artifact_refs) + '\n'); process.exit(1); }
+if (!Array.isArray(md.standard_refs) || md.standard_refs.length !== 1) { process.stderr.write('standard_refs did not stamp onto claim.metadata: ' + JSON.stringify(md.standard_refs) + '\n'); process.exit(1); }
+NODEOF
+then
+  _pass "AC6: artifact_refs/standard_refs stamp onto claim.metadata on FIRST write (#298, previously silently dropped)"
+else
+  _fail "AC6: artifact_refs/standard_refs did not stamp onto claim.metadata: $(cat "$TMPDIR_EVAL/compose-ev1-assert.err")"
+fi
+
+# ─── AC5: record-evidence #2 — a SEPARATE call records a waived session-local check ──────────
+if flow_agents_node "$WRITER" record-evidence "$COMPOSE_DIR" \
+  --verdict pass \
+  --check-json '{"id":"compose-manual-check","kind":"external","status":"pass","summary":"Manual review confirmed no regressions"}' \
+  --accepted-gap-reason "manual check waived for compose eval" \
+  --waived-by "compose-tester" \
+  --timestamp "2026-07-05T09:06:00Z" >"$TMPDIR_EVAL/compose-ev2.out" 2>"$TMPDIR_EVAL/compose-ev2.err"; then
+  _pass "compose: record-evidence #2 (waived session-local check) succeeds"
+else
+  _fail "compose: record-evidence #2 failed: $(cat "$TMPDIR_EVAL/compose-ev2.out" "$TMPDIR_EVAL/compose-ev2.err")"
+fi
+
+# ─── AC3: compose-two-writer — check #1 (with artifact_refs/standard_refs) survives the SECOND
+# record-evidence call (#298's core complaint: record-evidence previously REPLACED all checks) ──
+if node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/compose-two-writer.err"
+import { readFileSync } from 'node:fs';
+const bundle = JSON.parse(readFileSync('${COMPOSE_DIR}/trust.bundle', 'utf8'));
+const claims = bundle.claims;
+const buildClaim = claims.find((c) => c.subjectId && c.subjectId.endsWith('/compose-build-check'));
+const manualClaim = claims.find((c) => c.subjectId && c.subjectId.endsWith('/compose-manual-check'));
+const acClaim = claims.find((c) => c.metadata && c.metadata.origin === 'acceptance');
+if (!buildClaim) { process.stderr.write('compose-build-check claim LOST after second record-evidence call (#298 regression)\n'); process.exit(1); }
+if (!manualClaim) { process.stderr.write('compose-manual-check claim missing after its own record-evidence call\n'); process.exit(1); }
+if (!acClaim) { process.stderr.write('acceptance criterion claim LOST after second record-evidence call\n'); process.exit(1); }
+const md = buildClaim.metadata || {};
+if (!Array.isArray(md.artifact_refs) || md.artifact_refs.length !== 1) { process.stderr.write('artifact_refs did not survive the SECOND writer pass (AC6 second-writer round-trip)\n'); process.exit(1); }
+if (!Array.isArray(md.standard_refs) || md.standard_refs.length !== 1) { process.stderr.write('standard_refs did not survive the SECOND writer pass\n'); process.exit(1); }
+const waiverMd = manualClaim.metadata || {};
+if (!waiverMd.waiver || waiverMd.waiver.approved_by !== 'compose-tester') { process.stderr.write('waiver did not stamp onto compose-manual-check claim\n'); process.exit(1); }
+if (claims.length !== 3) { process.stderr.write('expected exactly 3 claims after 2 record-evidence calls (2 checks + 1 acceptance criterion), got ' + claims.length + '\n'); process.exit(1); }
+NODEOF
+then
+  _pass "AC3: compose-two-writer — record-evidence #1's check (+ artifact_refs/standard_refs) AND the acceptance criterion survive record-evidence #2's call, not replaced"
+else
+  _fail "AC3: compose-two-writer assertion failed: $(cat "$TMPDIR_EVAL/compose-two-writer.err")"
+fi
+
+# ─── AC1/AC10: record-gate-claim (pull-work-gate/selected-work) with --command ───────────────
+if flow_agents_node "$WRITER" record-gate-claim "$COMPOSE_DIR" \
+  --actor compose-actor \
+  --status pass \
+  --summary "Work item selected for compose session" \
+  --command "npm run validate:source --" \
+  --timestamp "2026-07-05T09:07:00Z" >"$TMPDIR_EVAL/compose-gate1.out" 2>"$TMPDIR_EVAL/compose-gate1.err"; then
+  _pass "compose: record-gate-claim (selected-work) with --command succeeds"
+else
+  _fail "compose: record-gate-claim (selected-work) failed: $(cat "$TMPDIR_EVAL/compose-gate1.out" "$TMPDIR_EVAL/compose-gate1.err")"
+fi
+
+if node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/compose-gate1-assert.err"
+import { readFileSync } from 'node:fs';
+const bundle = JSON.parse(readFileSync('${COMPOSE_DIR}/trust.bundle', 'utf8'));
+const claims = bundle.claims;
+const buildClaim = claims.find((c) => c.subjectId && c.subjectId.endsWith('/compose-build-check'));
+const manualClaim = claims.find((c) => c.subjectId && c.subjectId.endsWith('/compose-manual-check'));
+const gateClaim = claims.find((c) => c.metadata && c.metadata.gate_claim && c.metadata.gate_claim.expectation_id === 'selected-work');
+if (!buildClaim || !manualClaim) { process.stderr.write('record-gate-claim clobbered prior checks (#270 21-claims-to-1 wipe class)\n'); process.exit(1); }
+if (!gateClaim) { process.stderr.write('gate claim missing metadata.gate_claim stamp\n'); process.exit(1); }
+if (gateClaim.claimType !== 'builder.pull-work.selected' || gateClaim.subjectType !== 'work-item') { process.stderr.write('gate claim typed incorrectly: ' + gateClaim.claimType + '/' + gateClaim.subjectType + '\n'); process.exit(1); }
+const ev = bundle.evidence.find((e) => e.claimId === gateClaim.id);
+if (!ev || !ev.execution || ev.execution.label !== 'npm run validate:source --') { process.stderr.write('AC10: --command did not stamp execution.label on the gate claim evidence\n'); process.exit(1); }
+if (claims.length !== 4) { process.stderr.write('expected exactly 4 claims after record-gate-claim (2 checks + 1 acceptance + 1 gate claim), got ' + claims.length + '\n'); process.exit(1); }
+NODEOF
+then
+  _pass "AC1/AC10: record-gate-claim accumulates (prior checks/criteria survive) and --command sets execution.label on the gate claim"
+else
+  _fail "AC1/AC10: record-gate-claim accumulation/command assertion failed: $(cat "$TMPDIR_EVAL/compose-gate1-assert.err")"
+fi
+
+# ─── advance to `plan` step (phase_map.planning → plan) so a SECOND gate claim can target a ──
+# DIFFERENT expectation than pull-work-gate's single "selected-work" entry ────────────────────
+if flow_agents_node "$WRITER" advance-state "$COMPOSE_DIR" \
+  --actor compose-actor \
+  --status in_progress \
+  --phase planning \
+  --summary "Advance to plan step for a second, different-expectation gate claim" \
+  --next-action "Continue" \
+  --flow-definition builder.build \
+  --route-back-reason implementation_defect \
+  --timestamp "2026-07-05T09:07:15Z" >"$TMPDIR_EVAL/compose-advance-plan.out" 2>"$TMPDIR_EVAL/compose-advance-plan.err"; then
+  _pass "compose: advance-state moves active step to plan"
+else
+  _fail "compose: advance-state (to plan) failed: $(cat "$TMPDIR_EVAL/compose-advance-plan.out" "$TMPDIR_EVAL/compose-advance-plan.err")"
+fi
+
+# ─── AC1: a SECOND gate claim against a DIFFERENT expectation (plan-gate/implementation-plan) ──
+# is additive, not a replacement, of the FIRST gate claim (pull-work-gate/selected-work) ───────
+if flow_agents_node "$WRITER" record-gate-claim "$COMPOSE_DIR" \
+  --actor compose-actor \
+  --status pass \
+  --summary "Implementation plan recorded for compose session" \
+  --expectation implementation-plan \
+  --timestamp "2026-07-05T09:07:30Z" >"$TMPDIR_EVAL/compose-gate2.out" 2>"$TMPDIR_EVAL/compose-gate2.err"; then
+  _pass "compose: second record-gate-claim (different expectation, implementation-plan) succeeds"
+else
+  _fail "compose: second record-gate-claim failed: $(cat "$TMPDIR_EVAL/compose-gate2.out" "$TMPDIR_EVAL/compose-gate2.err")"
+fi
+
+if node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/compose-gate2-assert.err"
+import { readFileSync } from 'node:fs';
+const bundle = JSON.parse(readFileSync('${COMPOSE_DIR}/trust.bundle', 'utf8'));
+const claims = bundle.claims;
+const gate1 = claims.find((c) => c.metadata && c.metadata.gate_claim && c.metadata.gate_claim.expectation_id === 'selected-work');
+const gate2 = claims.find((c) => c.metadata && c.metadata.gate_claim && c.metadata.gate_claim.expectation_id === 'implementation-plan');
+if (!gate1) { process.stderr.write('first gate claim (selected-work) LOST after second gate-claim call (#270 wipe class)\n'); process.exit(1); }
+if (!gate2) { process.stderr.write('second gate claim (implementation-plan) missing\n'); process.exit(1); }
+if (gate2.claimType !== 'builder.plan.implementation' || gate2.subjectType !== 'artifact') { process.stderr.write('second gate claim typed incorrectly: ' + gate2.claimType + '/' + gate2.subjectType + '\n'); process.exit(1); }
+if (claims.length !== 5) { process.stderr.write('expected exactly 5 claims after 2 gate claims (2 checks + 1 acceptance + 2 gate claims), got ' + claims.length + '\n'); process.exit(1); }
+NODEOF
+then
+  _pass "AC1: two record-gate-claim calls against DIFFERENT expectations are both additive (neither clobbers the other or prior checks)"
+else
+  _fail "AC1: two-gate-claim additivity assertion failed: $(cat "$TMPDIR_EVAL/compose-gate2-assert.err")"
+fi
+
+# ─── AC2: gate-claim typing survives rebuild after the ACTIVE STEP moves to N+1 ──────────────
+if flow_agents_node "$WRITER" advance-state "$COMPOSE_DIR" \
+  --actor compose-actor \
+  --status in_progress \
+  --phase goal_fit \
+  --summary "Advance to merge-ready for AC2 rebuild assertion" \
+  --next-action "Continue" \
+  --flow-definition builder.build \
+  --timestamp "2026-07-05T09:08:00Z" >"$TMPDIR_EVAL/compose-advance.out" 2>"$TMPDIR_EVAL/compose-advance.err"; then
+  _pass "compose: advance-state moves active step to merge-ready (N+1 relative to pull-work/plan)"
+else
+  _fail "compose: advance-state failed: $(cat "$TMPDIR_EVAL/compose-advance.out" "$TMPDIR_EVAL/compose-advance.err")"
+fi
+
+# record-critique REBUILDS the bundle (checksFromBundle + writeTrustBundle) while the active
+# step is merge-ready — the gate claims recorded at pull-work/plan above must NOT be silently
+# re-typed as merge-ready claims (that re-typing IS the #270(c) defect).
+if flow_agents_node "$WRITER" record-critique "$COMPOSE_DIR" \
+  --id compose-review \
+  --reviewer compose-reviewer \
+  --verdict pass \
+  --summary "Compose review looks good" \
+  --timestamp "2026-07-05T09:09:00Z" >"$TMPDIR_EVAL/compose-critique.out" 2>"$TMPDIR_EVAL/compose-critique.err"; then
+  _pass "compose: record-critique rebuilds the bundle at the new active step (merge-ready)"
+else
+  _fail "compose: record-critique failed: $(cat "$TMPDIR_EVAL/compose-critique.out" "$TMPDIR_EVAL/compose-critique.err")"
+fi
+
+if node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/compose-ac2-assert.err"
+import { readFileSync } from 'node:fs';
+const bundle = JSON.parse(readFileSync('${COMPOSE_DIR}/trust.bundle', 'utf8'));
+const claims = bundle.claims;
+const gateClaim1 = claims.find((c) => c.metadata && c.metadata.gate_claim && c.metadata.gate_claim.expectation_id === 'selected-work');
+const gateClaim2 = claims.find((c) => c.metadata && c.metadata.gate_claim && c.metadata.gate_claim.expectation_id === 'implementation-plan');
+if (!gateClaim1 || !gateClaim2) { process.stderr.write('a gate claim was LOST after rebuild at a later step\n'); process.exit(1); }
+if (gateClaim1.claimType !== 'builder.pull-work.selected' || gateClaim1.subjectType !== 'work-item') {
+  process.stderr.write('AC2 REGRESSION: gate claim recorded at pull-work was re-typed to ' + gateClaim1.claimType + '/' + gateClaim1.subjectType + ' after rebuild at merge-ready (the #270(c) defect)\n');
+  process.exit(1);
+}
+if (gateClaim2.claimType !== 'builder.plan.implementation' || gateClaim2.subjectType !== 'artifact') {
+  process.stderr.write('AC2 REGRESSION: gate claim recorded at plan was re-typed to ' + gateClaim2.claimType + '/' + gateClaim2.subjectType + ' after rebuild at merge-ready\n');
+  process.exit(1);
+}
+if (gateClaim1.metadata.gate_claim.step_id !== 'pull-work') { process.stderr.write('gate_claim.step_id was overwritten to the currently-active step instead of staying pull-work: ' + gateClaim1.metadata.gate_claim.step_id + '\n'); process.exit(1); }
+if (gateClaim2.metadata.gate_claim.step_id !== 'plan') { process.stderr.write('gate_claim.step_id was overwritten to the currently-active step instead of staying plan: ' + gateClaim2.metadata.gate_claim.step_id + '\n'); process.exit(1); }
+// Meanwhile a PLAIN check claim (no gate_claim stamp) IS correctly re-typed to the new active step —
+// this is legitimate, documented behavior (only a stamped gate claim is frozen).
+const buildClaim = claims.find((c) => c.subjectId && c.subjectId.endsWith('/compose-build-check'));
+if (!buildClaim || buildClaim.claimType !== 'builder.merge-ready.readiness') { process.stderr.write('plain check claim did not re-type to the new active step as expected (unrelated to AC2, sanity check): ' + (buildClaim && buildClaim.claimType) + '\n'); process.exit(1); }
+NODEOF
+then
+  _pass "AC2: gate-claim typing (claimType/subjectType/step_id) survives a rebuild after the active step advances — frozen at record time, not re-derived (#270(a)/(c))"
+else
+  _fail "AC2: gate-claim-typing-survives-rebuild assertion failed: $(cat "$TMPDIR_EVAL/compose-ac2-assert.err")"
+fi
+
+# ─── AC4: compose-three-writer (five writer calls total: evidence x2, gate-claim x2, critique, ──
+# then record-learning) — all claim families present and correctly typed in the final bundle ──
+if flow_agents_node "$WRITER" record-learning "$COMPOSE_DIR" \
+  --status learned \
+  --summary "Compose layer round-trips losslessly" \
+  --record-json '{"source_refs":[],"facts":["compose layer round-trips losslessly"],"routing":[],"outcome":"success","correction":{"needed":false,"evidence":"compose eval passed"}}' \
+  --timestamp "2026-07-05T09:10:00Z" >"$TMPDIR_EVAL/compose-learning.out" 2>"$TMPDIR_EVAL/compose-learning.err"; then
+  _pass "compose: record-learning (fourth distinct writer family) succeeds"
+else
+  _fail "compose: record-learning failed: $(cat "$TMPDIR_EVAL/compose-learning.out" "$TMPDIR_EVAL/compose-learning.err")"
+fi
+
+if node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/compose-ac4-assert.err"
+import { readFileSync } from 'node:fs';
+const bundle = JSON.parse(readFileSync('${COMPOSE_DIR}/trust.bundle', 'utf8'));
+const claims = bundle.claims;
+const origins = claims.map((c) => (c.metadata || {}).origin);
+const originCounts = origins.reduce((acc, o) => { acc[o] = (acc[o] || 0) + 1; return acc; }, {});
+// Expect: 2 plain "check" claims (build-check, manual-check) + 2 gate-claim checks (also origin
+// "check", distinguished by metadata.gate_claim) + 1 "acceptance" + 1 "critique" = 6 total.
+if (originCounts.check !== 4) { process.stderr.write('expected 4 origin:check claims (2 plain checks + 2 gate claims), got ' + originCounts.check + ' (' + JSON.stringify(originCounts) + ')\n'); process.exit(1); }
+if (originCounts.acceptance !== 1) { process.stderr.write('expected 1 origin:acceptance claim, got ' + originCounts.acceptance + '\n'); process.exit(1); }
+if (originCounts.critique !== 1) { process.stderr.write('expected 1 origin:critique claim, got ' + originCounts.critique + '\n'); process.exit(1); }
+if (claims.length !== 6) { process.stderr.write('expected exactly 6 claims total after the full 6-writer sequence, got ' + claims.length + '\n'); process.exit(1); }
+const gateClaim1 = claims.find((c) => c.metadata && c.metadata.gate_claim && c.metadata.gate_claim.expectation_id === 'selected-work');
+const gateClaim2 = claims.find((c) => c.metadata && c.metadata.gate_claim && c.metadata.gate_claim.expectation_id === 'implementation-plan');
+const manualClaim = claims.find((c) => c.subjectId && c.subjectId.endsWith('/compose-manual-check'));
+if (!gateClaim1 || gateClaim1.claimType !== 'builder.pull-work.selected') { process.stderr.write('gate claim 1 typing did not survive the FIFTH rebuild (record-learning)\n'); process.exit(1); }
+if (!gateClaim2 || gateClaim2.claimType !== 'builder.plan.implementation') { process.stderr.write('gate claim 2 typing did not survive the FIFTH rebuild (record-learning)\n'); process.exit(1); }
+if (!manualClaim || !manualClaim.metadata.waiver) { process.stderr.write('waiver did not survive the fifth writer rebuild\n'); process.exit(1); }
+NODEOF
+then
+  _pass "AC4: compose-three-writer (six writer calls total: evidence x2, gate-claim x2, critique, learning) — all claim families present and correctly typed in the final bundle"
+else
+  _fail "AC4: compose-three-writer assertion failed: $(cat "$TMPDIR_EVAL/compose-ac4-assert.err")"
+fi
+
+# ─── AC8: a kind:"command" evidence_refs entry carrying PROSE excerpt is rejected at record ──
+# time by record-evidence (validateAcceptanceEvidenceRefs), not silently accepted for the ─────
+# Stop-hook backstop to catch later. ───────────────────────────────────────────────────────────
+AC8_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/ac8-runnability"
+mkdir -p "$AC8_DIR"
+cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$AC8_DIR/ac8-runnability--deliver.md"
+flow_agents_node "$WRITER" init-plan "$AC8_DIR/ac8-runnability--deliver.md" \
+  --source-request "AC8 runnability rejection fixture." \
+  --summary "AC8 runnability rejection fixture." \
+  --next-action "Seed a prose kind:command evidence_ref." \
+  --timestamp "2026-07-05T09:00:00Z" >"$TMPDIR_EVAL/ac8-init.out" 2>"$TMPDIR_EVAL/ac8-init.err"
+
+# Overwrite acceptance.json's criterion with a kind:"command" ref whose excerpt is prose — the
+# split-literal convention (see test_validate_source_kit_asset_scope.sh's "self-scan hazard"
+# comments) is not needed here since this file is not itself scanned for the phrase.
+node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/ac8-mutate.err"
+import { readFileSync, writeFileSync } from 'node:fs';
+const file = '${AC8_DIR}/acceptance.json';
+const data = JSON.parse(readFileSync(file, 'utf8'));
+if (!Array.isArray(data.criteria) || data.criteria.length === 0) { process.stderr.write('no criteria to mutate\n'); process.exit(1); }
+data.criteria[0].evidence_refs = [{ kind: 'command', excerpt: 'Manually confirmed the output looks correct.' }];
+writeFileSync(file, JSON.stringify(data, null, 2) + '\n');
+NODEOF
+
+if flow_agents_node "$WRITER" record-evidence "$AC8_DIR" \
+  --verdict pass \
+  --check-json '{"id":"ac8-check","kind":"test","status":"pass","summary":"AC8 fixture check passed."}' \
+  --timestamp "2026-07-05T09:01:00Z" >"$TMPDIR_EVAL/ac8-evidence.out" 2>"$TMPDIR_EVAL/ac8-evidence.err"; then
+  _fail "AC8 REGRESSION: record-evidence accepted a kind:\"command\" evidence_ref with prose excerpt instead of rejecting it at record time"
+elif grep -qi "not a runnable shell command" "$TMPDIR_EVAL/ac8-evidence.out" "$TMPDIR_EVAL/ac8-evidence.err"; then
+  _pass "AC8: record-evidence rejects a kind:\"command\" evidence_ref with a prose excerpt at record time, with an actionable error"
+else
+  _fail "AC8: record-evidence rejected the prose ref but without the expected 'not a runnable shell command' message: $(cat "$TMPDIR_EVAL/ac8-evidence.out" "$TMPDIR_EVAL/ac8-evidence.err")"
+fi
+
+# ─── #270 MEDIUM security fix eval: --skip-evidence-ref-runnability-guard is a logged bypass, ──
+# never silent (mirrors --skip-ownership-guard's existing pattern) — reusing AC8_DIR's already-
+# mutated prose-in-excerpt fixture (same lockout AC8 above proves is otherwise unconditional).
+if flow_agents_node "$WRITER" record-evidence "$AC8_DIR" \
+  --verdict pass \
+  --check-json '{"id":"ac8-bypass-check","kind":"test","status":"pass","summary":"AC8 bypass fixture check passed."}' \
+  --skip-evidence-ref-runnability-guard \
+  --timestamp "2026-07-05T09:01:30Z" >"$TMPDIR_EVAL/ac8-bypass.out" 2>"$TMPDIR_EVAL/ac8-bypass.err"; then
+  if grep -qi "evidence-ref runnability guard skipped via --skip-evidence-ref-runnability-guard" "$TMPDIR_EVAL/ac8-bypass.out" "$TMPDIR_EVAL/ac8-bypass.err"; then
+    _pass "#270: --skip-evidence-ref-runnability-guard bypasses the lockout AND logs it loudly (never silent), mirroring --skip-ownership-guard's pattern"
+  else
+    _fail "#270: --skip-evidence-ref-runnability-guard bypassed the guard but did NOT log it (silent bypass regression): $(cat "$TMPDIR_EVAL/ac8-bypass.out" "$TMPDIR_EVAL/ac8-bypass.err")"
+  fi
+else
+  _fail "#270: --skip-evidence-ref-runnability-guard should have bypassed the lockout, but record-evidence still failed: $(cat "$TMPDIR_EVAL/ac8-bypass.out" "$TMPDIR_EVAL/ac8-bypass.err")"
+fi
+
+# ─── #362 AC7: validateAcceptanceEvidenceRefs' ADVISORY (non-fatal) ambiguous-absence-command ──
+# nudge — a kind:"command" evidence ref whose excerpt is a bare (non-negated, non-count-asserted)
+# grep/diff invocation gets a stderr advisory suggesting the self-asserting rewrite, but the
+# record-evidence call is NOT blocked (this is guidance, not enforcement — distinct from the
+# runnability guard immediately above, which stays fatal/unchanged).
+AC7_ADV_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/ac7-ambiguous-advisory"
+mkdir -p "$AC7_ADV_DIR"
+cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$AC7_ADV_DIR/ac7-ambiguous-advisory--deliver.md"
+flow_agents_node "$WRITER" init-plan "$AC7_ADV_DIR/ac7-ambiguous-advisory--deliver.md"   --source-request "AC7 ambiguous-absence-command advisory fixture."   --summary "AC7 ambiguous-absence-command advisory fixture."   --next-action "Seed a bare-grep kind:command evidence_ref."   --timestamp "2026-07-05T09:02:00Z" >"$TMPDIR_EVAL/ac7-init.out" 2>"$TMPDIR_EVAL/ac7-init.err"
+
+node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/ac7-mutate.err"
+import { readFileSync, writeFileSync } from 'node:fs';
+const file = '${AC7_ADV_DIR}/acceptance.json';
+const data = JSON.parse(readFileSync(file, 'utf8'));
+if (!Array.isArray(data.criteria) || data.criteria.length === 0) { process.stderr.write('no criteria to mutate\n'); process.exit(1); }
+data.criteria[0].evidence_refs = [{ kind: 'command', excerpt: "grep -E 'this-pattern-does-not-exist-anywhere' package.json" }];
+writeFileSync(file, JSON.stringify(data, null, 2) + '\n');
+NODEOF
+
+if flow_agents_node "$WRITER" record-evidence "$AC7_ADV_DIR"   --verdict pass   --check-json '{"id":"ac7-adv-check","kind":"test","status":"pass","summary":"AC7 advisory fixture check passed."}'   --timestamp "2026-07-05T09:02:30Z" >"$TMPDIR_EVAL/ac7-adv.out" 2>"$TMPDIR_EVAL/ac7-adv.err"; then
+  _pass "AC7: record-evidence with a bare-grep-shaped kind:\"command\" evidence ref succeeds (advisory is non-fatal, does NOT block the write)"
+else
+  _fail "AC7 REGRESSION: record-evidence with a bare-grep-shaped evidence ref should succeed (advisory only), but it was rejected: $(cat "$TMPDIR_EVAL/ac7-adv.out" "$TMPDIR_EVAL/ac7-adv.err")"
+fi
+
+if grep -qi "advisory" "$TMPDIR_EVAL/ac7-adv.err" && grep -qi "self-asserting\|ambiguous" "$TMPDIR_EVAL/ac7-adv.err"; then
+  _pass "AC7: record-evidence emits an advisory stderr note recommending the self-asserting form for a bare-grep evidence ref"
+else
+  _fail "AC7: expected advisory stderr note (mentioning 'advisory' and 'self-asserting'/'ambiguous') was missing: $(cat "$TMPDIR_EVAL/ac7-adv.err")"
+fi
+
+if [[ -f "$AC7_ADV_DIR/acceptance.json" ]] && node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/ac7-adv-assert.err"
+import { readFileSync } from 'node:fs';
+const data = JSON.parse(readFileSync('${AC7_ADV_DIR}/acceptance.json', 'utf8'));
+const ref = data.criteria[0].evidence_refs[0];
+if (ref.kind !== 'command') { process.stderr.write('expected the ref to remain kind:"command", got: ' + ref.kind + '\n'); process.exit(1); }
+if (ref.excerpt !== "grep -E 'this-pattern-does-not-exist-anywhere' package.json") { process.stderr.write('the advisory must NOT alter the ref excerpt: got ' + JSON.stringify(ref.excerpt) + '\n'); process.exit(1); }
+NODEOF
+then
+  _pass "AC7: the advisory does not alter or reject the existing evidence ref (excerpt unchanged, still kind:\"command\")"
+else
+  _fail "AC7: evidence-ref-unchanged assertion failed: $(cat "$TMPDIR_EVAL/ac7-adv-assert.err")"
+fi
+
+# Regression guard: a self-asserting form (`! grep ...`, the NATURAL negated form -- not a
+# count-assertion workaround; isRunnableCommandText now strips a leading `!` before evaluating
+# runnability, per the coherence fix, so the runnability guard ACCEPTS this excerpt) never
+# triggers the advisory.
+AC7_NEG_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/ac7-self-asserting-no-advisory"
+mkdir -p "$AC7_NEG_DIR"
+cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$AC7_NEG_DIR/ac7-self-asserting-no-advisory--deliver.md"
+flow_agents_node "$WRITER" init-plan "$AC7_NEG_DIR/ac7-self-asserting-no-advisory--deliver.md" --source-request "AC7 self-asserting-form no-advisory regression fixture." --summary "AC7 self-asserting-form no-advisory regression fixture." --next-action "Seed a negated-grep kind:command evidence_ref." --timestamp "2026-07-05T09:03:00Z" >"$TMPDIR_EVAL/ac7-neg-init.out" 2>"$TMPDIR_EVAL/ac7-neg-init.err"
+
+node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/ac7-neg-mutate.err"
+import { readFileSync, writeFileSync } from 'node:fs';
+const file = '${AC7_NEG_DIR}/acceptance.json';
+const data = JSON.parse(readFileSync(file, 'utf8'));
+if (!Array.isArray(data.criteria) || data.criteria.length === 0) { process.stderr.write('no criteria to mutate\n'); process.exit(1); }
+data.criteria[0].evidence_refs = [{ kind: 'command', excerpt: "! grep -E 'this-pattern-does-not-exist-anywhere' package.json" }];
+writeFileSync(file, JSON.stringify(data, null, 2) + '\n');
+NODEOF
+
+if flow_agents_node "$WRITER" record-evidence "$AC7_NEG_DIR" --verdict pass --check-json '{"id":"ac7-neg-check","kind":"test","status":"pass","summary":"AC7 negation regression fixture check passed."}' --timestamp "2026-07-05T09:03:30Z" >"$TMPDIR_EVAL/ac7-neg.out" 2>"$TMPDIR_EVAL/ac7-neg.err"; then
+  if grep -qi "not a runnable shell command" "$TMPDIR_EVAL/ac7-neg.out" "$TMPDIR_EVAL/ac7-neg.err"; then
+    _fail "REGRESSION: record-evidence rejected a '! grep ...' evidence ref as non-runnable — isRunnableCommandText's leading-'!' strip is not working"
+  else
+    _pass "record-evidence ACCEPTS a '! grep ...' evidence ref as runnable (leading '!' is stripped before evaluation)"
+  fi
+  if grep -qi "advisory" "$TMPDIR_EVAL/ac7-neg.err"; then
+    _fail "regression: a self-asserting '! grep ...' evidence ref should NOT trigger the ambiguous-absence advisory, but it did: $(cat "$TMPDIR_EVAL/ac7-neg.err")"
+  else
+    _pass "regression guard: a self-asserting '! grep ...' evidence ref does not trigger the ambiguous-absence advisory"
+  fi
+else
+  _fail "regression fixture: record-evidence with a self-asserting negated-grep evidence ref unexpectedly failed: $(cat "$TMPDIR_EVAL/ac7-neg.out" "$TMPDIR_EVAL/ac7-neg.err")"
+fi
+
+# ─── #270 MEDIUM fix eval: parseCriterion routes a PROSE "- Evidence:" line through the REAL ──
+# init-plan parse path (definitionAcceptanceLines -> parseCriterion), not a hand-mutated
+# acceptance.json — asserting the resulting acceptance.json ref carries the prose in `summary`
+# and has NO `excerpt` (never validated for runnability, never executed), per the #412 contract
+# ("prose belongs in ref.summary"). This is a DIRECT eval of parseCriterion's classification
+# behavior (distinct from AC8 above, which exercises the record-time REJECTION of an
+# already-mutated prose-in-excerpt ref).
+PARSE_CRITERION_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/parse-criterion-prose"
+mkdir -p "$PARSE_CRITERION_DIR"
+cat > "$PARSE_CRITERION_DIR/parse-criterion-prose--deliver.md" <<'MARKDOWN'
+# parseCriterion prose Evidence line eval
+
+status: delivered
+type: deliver
+
+## Plan
+
+Exercise parseCriterion's classification of a prose Evidence line through the real parse path.
+
+## Definition Of Done
+
+- **User outcome:** Prose evidence is classified correctly at parse time.
+- **Scope:** parseCriterion / definitionAcceptanceLines.
+- **Acceptance criteria:**
+  - [ ] Dashboard reviewed - Evidence: manual review of the dashboard.
+- **Usefulness checks:**
+  - [ ] User-facing workflow is documented or discoverable
+- **Stop-short risks:** none
+- **Durable docs target:** not needed
+- **Sandbox mode:** local-edit
+
+## Verification Report
+
+Build: [NOT_VERIFIED] pending
+
+### Verdict: NOT_VERIFIED
+
+## Goal Fit Gate
+
+- [ ] Original user goal restated
+
+## Final Acceptance
+
+- [ ] CI/relevant checks passed or local equivalent recorded
+MARKDOWN
+
+if flow_agents_node "$WRITER" init-plan "$PARSE_CRITERION_DIR/parse-criterion-prose--deliver.md"   --source-request "parseCriterion prose Evidence line eval."   --summary "Exercise the real parse path for a prose Evidence line."   --next-action "Assert the resulting acceptance.json ref."   --timestamp "2026-07-05T09:00:00Z" >"$TMPDIR_EVAL/parse-criterion-init.out" 2>"$TMPDIR_EVAL/parse-criterion-init.err"; then
+  _pass "parseCriterion eval: init-plan runs against the prose-Evidence-line fixture"
+else
+  _fail "parseCriterion eval: init-plan failed: $(cat "$TMPDIR_EVAL/parse-criterion-init.out" "$TMPDIR_EVAL/parse-criterion-init.err")"
+fi
+
+if node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/parse-criterion-assert.err"
+import { readFileSync } from 'node:fs';
+const data = JSON.parse(readFileSync('${PARSE_CRITERION_DIR}/acceptance.json', 'utf8'));
+const criterion = Array.isArray(data.criteria) ? data.criteria.find((c) => c.description && c.description.includes('Dashboard reviewed')) : null;
+if (!criterion) { process.stderr.write('no matching criterion found in acceptance.json: ' + JSON.stringify(data.criteria) + '\n'); process.exit(1); }
+if (!Array.isArray(criterion.evidence_refs) || criterion.evidence_refs.length !== 1) { process.stderr.write('expected exactly one evidence_refs entry, got: ' + JSON.stringify(criterion.evidence_refs) + '\n'); process.exit(1); }
+const ref = criterion.evidence_refs[0];
+if (ref.kind !== 'command') { process.stderr.write('expected kind:"command" (still a structured ref; only WHICH field carries the text differs), got: ' + ref.kind + '\n'); process.exit(1); }
+if (typeof ref.summary !== 'string' || !ref.summary.includes('manual review of the dashboard')) { process.stderr.write('prose text did not land in ref.summary: ' + JSON.stringify(ref) + '\n'); process.exit(1); }
+if (ref.excerpt !== undefined && ref.excerpt !== '') { process.stderr.write('ref.excerpt should be absent/empty for prose evidence (prose never belongs in excerpt), got: ' + JSON.stringify(ref.excerpt) + '\n'); process.exit(1); }
+NODEOF
+then
+  _pass "#270: parseCriterion (via the real init-plan parse path) routes a prose \"- Evidence:\" line into ref.summary with no excerpt, not a hand-mutated acceptance.json"
+else
+  _fail "#270: parseCriterion prose-routing assertion failed: $(cat "$TMPDIR_EVAL/parse-criterion-assert.err")"
+fi
+
+# ─── AC10: record-gate-claim --command with PROSE is rejected at record time ─────────────────
+if flow_agents_node "$WRITER" record-gate-claim "$COMPOSE_DIR" \
+  --actor compose-actor \
+  --status pass \
+  --summary "Manual review" \
+  --expectation merge-readiness \
+  --command "Manually verified the output looks correct." \
+  --timestamp "2026-07-05T09:11:00Z" >"$TMPDIR_EVAL/compose-gate-prose.out" 2>"$TMPDIR_EVAL/compose-gate-prose.err"; then
+  _fail "AC10 REGRESSION: record-gate-claim --command accepted prose instead of rejecting it at record time"
+elif grep -qi "not a runnable shell command" "$TMPDIR_EVAL/compose-gate-prose.out" "$TMPDIR_EVAL/compose-gate-prose.err"; then
+  _pass "AC10: record-gate-claim --command rejects a prose value at record time, with an actionable error"
+else
+  _fail "AC10: record-gate-claim --command prose rejection message was unexpected: $(cat "$TMPDIR_EVAL/compose-gate-prose.out" "$TMPDIR_EVAL/compose-gate-prose.err")"
+fi
+
+# ─── AC11: command-backed check claims reject prose; external prose remains valid ─────────────
+CHECK_PROSE_DIR="$TMPDIR_EVAL/repo/.kontourai/flow-agents/check-prose-guard"
+mkdir -p "$CHECK_PROSE_DIR"
+cp "$ARTIFACT_DIR/auto-sidecars--deliver.md" "$CHECK_PROSE_DIR/check-prose-guard--deliver.md"
+flow_agents_node "$WRITER" init-plan "$CHECK_PROSE_DIR/check-prose-guard--deliver.md" \
+  --source-request "Check command prose guard fixture." \
+  --summary "Check command prose guard fixture." \
+  --next-action "Exercise command check runnability validation." \
+  --timestamp "2026-07-05T09:11:10Z" >"$TMPDIR_EVAL/check-prose-init.out" 2>"$TMPDIR_EVAL/check-prose-init.err"
+
+if flow_agents_node "$WRITER" record-evidence "$CHECK_PROSE_DIR" \
+  --verdict pass \
+  --check-json '{"id":"prose-command-check","kind":"command","status":"pass","summary":"External CI is green.","command":"External CI ground truth: PR #475 is merged and all checks are green."}' \
+  --timestamp "2026-07-05T09:11:20Z" >"$TMPDIR_EVAL/check-prose-command.out" 2>"$TMPDIR_EVAL/check-prose-command.err"; then
+  _fail "AC11 REGRESSION: record-evidence accepted a kind:\"command\" check whose command text is prose"
+elif grep -qi "not a runnable shell command" "$TMPDIR_EVAL/check-prose-command.out" "$TMPDIR_EVAL/check-prose-command.err" \
+  && grep -qi "kind:\"external\"" "$TMPDIR_EVAL/check-prose-command.out" "$TMPDIR_EVAL/check-prose-command.err"; then
+  _pass "AC11: record-evidence rejects prose command-backed check claims with external-attestation remediation"
+else
+  _fail "AC11: record-evidence prose command rejection message was unexpected: $(cat "$TMPDIR_EVAL/check-prose-command.out" "$TMPDIR_EVAL/check-prose-command.err")"
+fi
+
+if flow_agents_node "$WRITER" record-check "$CHECK_PROSE_DIR" \
+  --command "External CI ground truth: PR #475 is merged and all checks are green." \
+  >"$TMPDIR_EVAL/record-check-prose.out" 2>"$TMPDIR_EVAL/record-check-prose.err"; then
+  _fail "AC11 REGRESSION: record-check --command accepted prose instead of rejecting it"
+elif grep -qi "not a runnable shell command" "$TMPDIR_EVAL/record-check-prose.out" "$TMPDIR_EVAL/record-check-prose.err"; then
+  _pass "AC11: record-check --command rejects prose before it can become execution.label"
+else
+  _fail "AC11: record-check prose rejection message was unexpected: $(cat "$TMPDIR_EVAL/record-check-prose.out" "$TMPDIR_EVAL/record-check-prose.err")"
+fi
+
+for AC494_PROSE in "External CI (green)" "Reconciled after merge; all green"; do
+  AC494_ID="$(printf '%s' "$AC494_PROSE" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9._-]/-/g; s/--*/-/g; s/^-//; s/-$//')"
+  if flow_agents_node "$WRITER" record-evidence "$CHECK_PROSE_DIR" \
+    --verdict pass \
+    --check-json "{\"id\":\"ac494-${AC494_ID}\",\"kind\":\"command\",\"status\":\"pass\",\"summary\":\"AC494 prose punctuation fixture.\",\"command\":\"${AC494_PROSE}\"}" \
+    --timestamp "2026-07-05T09:11:24Z" >"$TMPDIR_EVAL/ac494-${AC494_ID}-evidence.out" 2>"$TMPDIR_EVAL/ac494-${AC494_ID}-evidence.err"; then
+    _fail "AC-FIX-2 REGRESSION: record-evidence accepted incidental-punctuation prose as kind:\"command\": ${AC494_PROSE}"
+  elif grep -qi "not a runnable shell command" "$TMPDIR_EVAL/ac494-${AC494_ID}-evidence.out" "$TMPDIR_EVAL/ac494-${AC494_ID}-evidence.err"; then
+    _pass "AC-FIX-2: record-evidence rejects incidental-punctuation prose as kind:\"command\": ${AC494_PROSE}"
+  else
+    _fail "AC-FIX-2: record-evidence rejection for '${AC494_PROSE}' had unexpected output: $(cat "$TMPDIR_EVAL/ac494-${AC494_ID}-evidence.out" "$TMPDIR_EVAL/ac494-${AC494_ID}-evidence.err")"
+  fi
+
+  if flow_agents_node "$WRITER" record-check "$CHECK_PROSE_DIR" \
+    --command "$AC494_PROSE" \
+    >"$TMPDIR_EVAL/ac494-${AC494_ID}-record-check.out" 2>"$TMPDIR_EVAL/ac494-${AC494_ID}-record-check.err"; then
+    _fail "AC-FIX-2 REGRESSION: record-check --command accepted incidental-punctuation prose: ${AC494_PROSE}"
+  elif grep -qi "not a runnable shell command" "$TMPDIR_EVAL/ac494-${AC494_ID}-record-check.out" "$TMPDIR_EVAL/ac494-${AC494_ID}-record-check.err"; then
+    _pass "AC-FIX-2: record-check --command rejects incidental-punctuation prose: ${AC494_PROSE}"
+  else
+    _fail "AC-FIX-2: record-check rejection for '${AC494_PROSE}' had unexpected output: $(cat "$TMPDIR_EVAL/ac494-${AC494_ID}-record-check.out" "$TMPDIR_EVAL/ac494-${AC494_ID}-record-check.err")"
+  fi
+done
+
+if node - "$ROOT/scripts/hooks/lib/runnable-command.js" <<'NODEEOF' >"$TMPDIR_EVAL/ac494-runnable-contract.out" 2>"$TMPDIR_EVAL/ac494-runnable-contract.err"
+const { isRunnableCommandText } = require(process.argv[2]);
+const cases = [
+  ['exit 42', true],
+  ['false', true],
+  ['true', true],
+  ['cd nonexistent', true],
+  ['FOO=bar npm test', true],
+  ['npm test', true],
+  ['./script.sh', true],
+  ['test -f somefile', true],
+  ['set -e', true],
+  ['export FOO=bar', true],
+  ['echo hi > out.txt', true],
+  ['source ./env.sh', true],
+  [': noop', true],
+  ['test coverage improved across the suite', false],
+  ['set the stage for the next release', false],
+  ['export controls apply to this build', false],
+  ['source of truth confirmed by CI', false],
+  ['echo of the original design', false],
+  ['return on investment was high', false],
+  ['true to the original plan', false],
+  ['false alarm, everything passed', false],
+  ['cd into the details later', false],
+  ['Test coverage improved', false],
+  ['Set up the environment first', false],
+  ['External CI (green)', false],
+  ['Reconciled after merge; all green', false],
+  ['Reconciled after merge: PR #475 is orchestrator-confirmed MERGED with Trust Reconcile, Source and Static, Runtime and Kit, Integration Coverage, Workflow Contracts, Usage Feedback, and Secret Scan all SUCCESS.', false],
+  ['A codex-shaped PostToolUse payload whose only failure signal is the host prose banner is never captured as observedResult:pass', false],
+];
+let ok = true;
+for (const [text, expected] of cases) {
+  const actual = isRunnableCommandText(text);
+  if (actual !== expected) {
+    ok = false;
+    console.error(`${actual ? 'RUNNABLE' : 'PROSE'} != ${expected ? 'RUNNABLE' : 'PROSE'} :: ${text}`);
+  }
+}
+process.exit(ok ? 0 : 1);
+NODEEOF
+then
+  _pass "AC-FIX-3: shared runnable-command detector classifies shell keyword commands and plain-English prose per contract"
+else
+  _fail "AC-FIX-3: shared runnable-command detector contract failed: $(cat "$TMPDIR_EVAL/ac494-runnable-contract.err")"
+fi
+
+if flow_agents_node "$WRITER" record-evidence "$CHECK_PROSE_DIR" \
+  --verdict pass \
+  --check-json '{"id":"external-ci-attestation","kind":"external","status":"pass","summary":"External CI ground truth: PR #475 is merged and all checks are green."}' \
+  --timestamp "2026-07-05T09:11:30Z" >"$TMPDIR_EVAL/check-prose-external.out" 2>"$TMPDIR_EVAL/check-prose-external.err"; then
+  if node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/check-prose-external-assert.err"
+import { readFileSync } from 'node:fs';
+const bundle = JSON.parse(readFileSync('${CHECK_PROSE_DIR}/trust.bundle', 'utf8'));
+const claim = bundle.claims.find((c) => c.subjectId && c.subjectId.endsWith('/external-ci-attestation'));
+const evidence = bundle.evidence.find((e) => e.claimId === (claim && claim.id));
+if (!claim) { process.stderr.write('external attestation claim missing\n'); process.exit(1); }
+if (claim.claimType !== 'workflow.check.external') { process.stderr.write('expected external claim type, got ' + claim.claimType + '\n'); process.exit(1); }
+if (evidence && evidence.execution && evidence.execution.label) { process.stderr.write('external attestation must not carry execution.label: ' + JSON.stringify(evidence.execution) + '\n'); process.exit(1); }
+NODEOF
+  then
+    _pass "AC11: kind:\"external\" prose attestation is accepted and carries no execution.label"
+  else
+    _fail "AC11: external prose attestation bundle shape was wrong: $(cat "$TMPDIR_EVAL/check-prose-external-assert.err")"
+  fi
+else
+  _fail "AC11: kind:\"external\" prose attestation should be accepted: $(cat "$TMPDIR_EVAL/check-prose-external.out" "$TMPDIR_EVAL/check-prose-external.err")"
+fi
+
+# ─── #270 CRITICAL/HIGH fix evals: forged-stamp negative + pre-cluster missing-stamp negative ──
+# Both mutate a FRESH COPY of the compose session's trust.bundle (never COMPOSE_DIR itself) so
+# these negative fixtures stay isolated from the compose-layer assertions above.
+
+# ─── Forged-stamp negative: hand-edit metadata.gate_claim.expectation_id to a nonexistent ─────
+# expects[] id. Any rebuild (record-critique) must die naming the stamp AND the claim id — never
+# silently fall through to matchExpectsEntry (the exact #270 CRITICAL/HIGH defect this closes).
+# Copy the WHOLE compose root (not just COMPOSE_DIR) — current.json / current/<actor>.json live
+# in the PARENT of the session dir, and resolveActiveFlowStep (hence sessionFlowId/flowRepoRoot in
+# buildTrustBundle) needs them to resolve the flow definition for stamp validation. Copying only
+# the session dir would silently make sessionFlowId resolve to null, which changes what's being
+# tested (the "no flow definition resolvable" edge case) rather than the forged-stamp case.
+FORGED_ROOT="$TMPDIR_EVAL/forged-stamp-root"
+cp -r "$COMPOSE_ROOT" "$FORGED_ROOT"
+FORGED_DIR="$FORGED_ROOT/$COMPOSE_SLUG"
+
+node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/forged-mutate.err"
+import { readFileSync, writeFileSync } from 'node:fs';
+const file = '${FORGED_DIR}/trust.bundle';
+const bundle = JSON.parse(readFileSync(file, 'utf8'));
+const claim = bundle.claims.find((c) => c.metadata && c.metadata.gate_claim && c.metadata.gate_claim.expectation_id === 'selected-work');
+if (!claim) { process.stderr.write('setup: selected-work gate claim not found to forge\n'); process.exit(1); }
+claim.metadata.gate_claim.expectation_id = 'nonexistent-expectation-id';
+writeFileSync(file, JSON.stringify(bundle, null, 2) + '\n');
+NODEOF
+
+if [[ -s "$TMPDIR_EVAL/forged-mutate.err" ]]; then
+  _fail "eval setup: forging metadata.gate_claim.expectation_id failed: $(cat "$TMPDIR_EVAL/forged-mutate.err")"
+fi
+
+if flow_agents_node "$WRITER" record-critique "$FORGED_DIR" \
+  --id forged-stamp-review \
+  --reviewer forged-stamp-tester \
+  --verdict pass \
+  --summary "Rebuild attempt against a forged gate_claim stamp" \
+  --timestamp "2026-07-05T09:12:00Z" >"$TMPDIR_EVAL/forged-critique.out" 2>"$TMPDIR_EVAL/forged-critique.err"; then
+  _fail "FORGED-STAMP REGRESSION: record-critique succeeded against a bundle with a forged metadata.gate_claim.expectation_id (silent re-typing fall-through, the #270 CRITICAL/HIGH defect)"
+elif grep -qi "forged or corrupt" "$TMPDIR_EVAL/forged-critique.out" "$TMPDIR_EVAL/forged-critique.err" \
+  && grep -q "nonexistent-expectation-id" "$TMPDIR_EVAL/forged-critique.out" "$TMPDIR_EVAL/forged-critique.err"; then
+  _pass "#270 CRITICAL/HIGH: a forged metadata.gate_claim stamp (nonexistent expectation_id) makes any rebuild die loudly, naming the stamp — never silently re-typed"
+else
+  _fail "#270 forged-stamp rejection message was unexpected: $(cat "$TMPDIR_EVAL/forged-critique.out" "$TMPDIR_EVAL/forged-critique.err")"
+fi
+
+# ─── Pre-cluster missing-stamp negative: strip metadata.gate_claim from a gate-claim-SHAPED ────
+# claim (origin:"check", check_kind:"external", kit-typed claimType) — mimicking the real
+# kontourai-flow-agents-303 bundle shape (a claim recorded before the gate_claim stamp existed).
+# Any rebuild must die with the re-record remedy, never silently re-type via matchExpectsEntry.
+PRECLUSTER_ROOT="$TMPDIR_EVAL/precluster-missing-stamp-root"
+cp -r "$COMPOSE_ROOT" "$PRECLUSTER_ROOT"
+PRECLUSTER_DIR="$PRECLUSTER_ROOT/$COMPOSE_SLUG"
+
+node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/precluster-mutate.err"
+import { readFileSync, writeFileSync } from 'node:fs';
+const file = '${PRECLUSTER_DIR}/trust.bundle';
+const bundle = JSON.parse(readFileSync(file, 'utf8'));
+const claim = bundle.claims.find((c) => c.metadata && c.metadata.gate_claim && c.metadata.gate_claim.expectation_id === 'implementation-plan');
+if (!claim) { process.stderr.write('setup: implementation-plan gate claim not found to strip\n'); process.exit(1); }
+delete claim.metadata.gate_claim;
+writeFileSync(file, JSON.stringify(bundle, null, 2) + '\n');
+NODEOF
+
+if [[ -s "$TMPDIR_EVAL/precluster-mutate.err" ]]; then
+  _fail "eval setup: stripping metadata.gate_claim failed: $(cat "$TMPDIR_EVAL/precluster-mutate.err")"
+fi
+
+if flow_agents_node "$WRITER" record-critique "$PRECLUSTER_DIR" \
+  --id precluster-review \
+  --reviewer precluster-tester \
+  --verdict pass \
+  --summary "Rebuild attempt against a pre-cluster-270 unstamped gate claim" \
+  --timestamp "2026-07-05T09:13:00Z" >"$TMPDIR_EVAL/precluster-critique.out" 2>"$TMPDIR_EVAL/precluster-critique.err"; then
+  _fail "PRE-CLUSTER-270 REGRESSION: record-critique succeeded against a bundle with an unstamped gate-claim-shaped claim (silent re-typing fall-through)"
+elif grep -qi "pre-cluster-270 gate claim" "$TMPDIR_EVAL/precluster-critique.out" "$TMPDIR_EVAL/precluster-critique.err" \
+  && grep -qi "re-record it (record-gate-claim) to regenerate" "$TMPDIR_EVAL/precluster-critique.out" "$TMPDIR_EVAL/precluster-critique.err"; then
+  _pass "#270 pre-cluster-270 missing-stamp: an unstamped gate-claim-shaped claim makes any rebuild die with the re-record remedy — never silently re-typed"
+else
+  _fail "#270 pre-cluster missing-stamp rejection message was unexpected: $(cat "$TMPDIR_EVAL/precluster-critique.out" "$TMPDIR_EVAL/precluster-critique.err")"
+fi
+
+# ─── #270 HIGH fix (iteration 3): reserve the "gate-claim-" check-id namespace ─────────────────
+# (a) reserved-prefix rejection via record-evidence --check-json (exit + message)
+if flow_agents_node "$WRITER" record-evidence "$COMPOSE_DIR" \
+  --verdict pass \
+  --check-json '{"id":"gate-claim-caller-supplied","kind":"external","status":"pass","summary":"A caller-chosen id that collides with the reserved gate-claim- prefix"}' \
+  --timestamp "2026-07-05T09:15:30Z" >"$TMPDIR_EVAL/reserved-prefix.out" 2>"$TMPDIR_EVAL/reserved-prefix.err"; then
+  _fail "#270 HIGH REGRESSION: record-evidence --check-json accepted a caller-supplied id starting with the reserved 'gate-claim-' prefix"
+elif grep -qi 'reserved for record-gate-claim' "$TMPDIR_EVAL/reserved-prefix.out" "$TMPDIR_EVAL/reserved-prefix.err" \
+  && grep -q 'gate-claim-caller-supplied' "$TMPDIR_EVAL/reserved-prefix.out" "$TMPDIR_EVAL/reserved-prefix.err"; then
+  _pass "#270 HIGH: record-evidence --check-json rejects a caller-supplied id starting with the reserved 'gate-claim-' prefix, naming the offending id"
+else
+  _fail "#270 HIGH: reserved-prefix rejection message was unexpected: $(cat "$TMPDIR_EVAL/reserved-prefix.out" "$TMPDIR_EVAL/reserved-prefix.err")"
+fi
+
+# Confirm record-check's --id is covered by the same guard (a second writer of caller-supplied ids).
+if flow_agents_node "$WRITER" record-check "$COMPOSE_DIR" --id "gate-claim-record-check-collision" -- true \
+  >"$TMPDIR_EVAL/reserved-prefix-record-check.out" 2>"$TMPDIR_EVAL/reserved-prefix-record-check.err"; then
+  _fail "#270 HIGH REGRESSION: record-check accepted a caller-supplied --id starting with the reserved 'gate-claim-' prefix"
+elif grep -qi 'reserved for record-gate-claim' "$TMPDIR_EVAL/reserved-prefix-record-check.out" "$TMPDIR_EVAL/reserved-prefix-record-check.err"; then
+  _pass "#270 HIGH: record-check --id is covered by the same reserved-prefix guard as record-evidence"
+else
+  _fail "#270 HIGH: record-check reserved-prefix rejection message was unexpected: $(cat "$TMPDIR_EVAL/reserved-prefix-record-check.out" "$TMPDIR_EVAL/reserved-prefix-record-check.err")"
+fi
+
+# Confirm record-gate-claim's OWN internally-constructed gate-claim-<id> is still accepted — the
+# guard must reject only CALLER-supplied ids on other writers, never record-gate-claim's own path.
+# (compose-gate1's earlier record-gate-claim call above already exercises and asserts this; this
+# is a targeted re-assertion scoped to the reserved-prefix fix itself.)
+if node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/reserved-prefix-gate-claim-own.err"
+import { readFileSync } from 'node:fs';
+const bundle = JSON.parse(readFileSync('${COMPOSE_DIR}/trust.bundle', 'utf8'));
+const gateClaim = bundle.claims.find((c) => c.subjectId && c.subjectId.endsWith('/gate-claim-selected-work'));
+if (!gateClaim) { process.stderr.write('record-gate-claims own gate-claim-selected-work id was not found — its own reserved-prefix construction must still succeed\n'); process.exit(1); }
+if (!gateClaim.metadata || !gateClaim.metadata.gate_claim) { process.stderr.write('record-gate-claims own claim is missing its metadata.gate_claim stamp\n'); process.exit(1); }
+NODEOF
+then
+  _pass "#270 HIGH: record-gate-claim's own internally-constructed 'gate-claim-<id>' still succeeds (the guard applies only to caller-supplied ids on OTHER writers)"
+else
+  _fail "#270 HIGH: record-gate-claim's own id-construction regressed: $(cat "$TMPDIR_EVAL/reserved-prefix-gate-claim-own.err")"
+fi
+
+# (b) collision regression scenario end-to-end: the EXACT pre-cluster-false-positive collision —
+# a caller-chosen record-evidence check id starting with "gate-claim-" that would, absent this
+# fix, get declared-typed via matchExpectsEntry's P-d fallback (kit-typed, unstamped) and then be
+# misclassified as an unstamped pre-cluster-270 gate claim on the NEXT rebuild — is now rejected
+# AT RECORD TIME instead, in a FRESH session (isolated from COMPOSE_DIR) so no rebuild landmine
+# is ever created.
+COLLISION_ROOT="$TMPDIR_EVAL/collision-root"
+COLLISION_SLUG="collision-270"
+COLLISION_DIR="$COLLISION_ROOT/$COLLISION_SLUG"
+mkdir -p "$COLLISION_ROOT"
+
+flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$COLLISION_ROOT" \
+  --task-slug "$COLLISION_SLUG" \
+  --actor collision-actor \
+  --flow-id builder.build \
+  --title "Collision regression session" \
+  --source-request "Regression: gate-claim- id collision must die at record time, not rebuild time." \
+  --summary "Seed session for the collision regression eval." \
+  --criterion "Collision regression is caught at record time" \
+  --timestamp "2026-07-05T09:16:00Z" >"$TMPDIR_EVAL/collision-seed.out" 2>"$TMPDIR_EVAL/collision-seed.err"
+
+if flow_agents_node "$WRITER" record-evidence "$COLLISION_DIR" \
+  --verdict pass \
+  --check-json '{"id":"gate-claim-my-custom-check","kind":"external","status":"pass","summary":"A caller-chosen check id colliding with the reserved prefix, at the active pull-work step (kit-typed via matchExpectsEntry fallback)"}' \
+  --timestamp "2026-07-05T09:16:15Z" >"$TMPDIR_EVAL/collision-record.out" 2>"$TMPDIR_EVAL/collision-record.err"; then
+  _fail "#270 HIGH REGRESSION: the collision scenario's record-evidence call succeeded — this recreates the pre-cluster false-positive rebuild landmine"
+elif grep -qi 'reserved for record-gate-claim' "$TMPDIR_EVAL/collision-record.out" "$TMPDIR_EVAL/collision-record.err" \
+  && [[ ! -f "$COLLISION_DIR/trust.bundle" || ! $(node --input-type=module -e "
+import { readFileSync } from 'node:fs';
+const b = JSON.parse(readFileSync('${COLLISION_DIR}/trust.bundle', 'utf8'));
+process.stdout.write(String(b.claims.some((c) => c.subjectId && c.subjectId.endsWith('/gate-claim-my-custom-check'))));
+" 2>/dev/null) == "true" ]]; then
+  _pass "#270 HIGH: the collision scenario is rejected AT RECORD TIME (record-evidence), never lands in trust.bundle, and no rebuild landmine is created"
+else
+  _fail "#270 HIGH: collision regression assertion failed: $(cat "$TMPDIR_EVAL/collision-record.out" "$TMPDIR_EVAL/collision-record.err")"
+fi
+
+# Now prove a REBUILD against the (empty/unaffected) collision session succeeds cleanly — there is
+# no landmine left behind by the rejected record-evidence call above.
+if flow_agents_node "$WRITER" record-critique "$COLLISION_DIR" \
+  --id collision-rebuild-review \
+  --reviewer collision-tester \
+  --verdict pass \
+  --summary "Rebuild after the rejected collision write — must succeed, no landmine" \
+  --timestamp "2026-07-05T09:16:30Z" >"$TMPDIR_EVAL/collision-rebuild.out" 2>"$TMPDIR_EVAL/collision-rebuild.err"; then
+  _pass "#270 HIGH: a rebuild (record-critique) after the rejected collision write succeeds cleanly — no rebuild-time landmine"
+else
+  _fail "#270 HIGH REGRESSION: rebuild after the rejected collision write unexpectedly failed: $(cat "$TMPDIR_EVAL/collision-rebuild.out" "$TMPDIR_EVAL/collision-rebuild.err")"
+fi
+
+# ─── #270 MEDIUM fix (iteration 3): unresolvable FlowDefinition dies with the dedicated ────────
+# "cannot be loaded" message, never "forged or corrupt". Create a REAL stamped gate claim first
+# (real flow, real record-gate-claim), then break resolution by pointing active_flow_id at a
+# bogus flow id that cannot resolve under kits/ (mirrors the re-reviewer's approach of pointing
+# at an unresolvable kits/ path), in an ISOLATED fixture copied from a fresh session.
+UNRESOLVABLE_ROOT="$TMPDIR_EVAL/unresolvable-root"
+UNRESOLVABLE_SLUG="unresolvable-270"
+UNRESOLVABLE_DIR="$UNRESOLVABLE_ROOT/$UNRESOLVABLE_SLUG"
+mkdir -p "$UNRESOLVABLE_ROOT"
+
+flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$UNRESOLVABLE_ROOT" \
+  --task-slug "$UNRESOLVABLE_SLUG" \
+  --actor unresolvable-actor \
+  --flow-id builder.build \
+  --title "Unresolvable FlowDefinition regression" \
+  --source-request "Regression: an unresolvable FlowDefinition must die with the dedicated cannot-be-loaded message." \
+  --summary "Seed session with a REAL flow so a real stamped gate claim can be recorded." \
+  --criterion "Unresolvable FlowDefinition dies with the dedicated message" \
+  --timestamp "2026-07-05T09:17:00Z" >"$TMPDIR_EVAL/unresolvable-seed.out" 2>"$TMPDIR_EVAL/unresolvable-seed.err"
+
+if flow_agents_node "$WRITER" record-gate-claim "$UNRESOLVABLE_DIR" \
+  --actor unresolvable-actor \
+  --status pass \
+  --summary "Work item selected for unresolvable-flow-definition regression" \
+  --timestamp "2026-07-05T09:17:15Z" >"$TMPDIR_EVAL/unresolvable-gate-claim.out" 2>"$TMPDIR_EVAL/unresolvable-gate-claim.err"; then
+  _pass "#270 MEDIUM setup: real stamped gate claim recorded before breaking FlowDefinition resolution"
+else
+  _fail "#270 MEDIUM setup: record-gate-claim (real flow) failed: $(cat "$TMPDIR_EVAL/unresolvable-gate-claim.out" "$TMPDIR_EVAL/unresolvable-gate-claim.err")"
+fi
+
+# Break resolution: point BOTH the legacy and per-actor current-pointer files at a flow id with
+# no corresponding kits/<kit>/flows/<name>.flow.json file.
+node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/unresolvable-mutate.err"
+import { readFileSync, writeFileSync } from 'node:fs';
+for (const f of ['${UNRESOLVABLE_ROOT}/current.json', '${UNRESOLVABLE_ROOT}/current/unresolvable-actor.json']) {
+  const d = JSON.parse(readFileSync(f, 'utf8'));
+  d.active_flow_id = 'builder.bogus-nonexistent-flow-270';
+  writeFileSync(f, JSON.stringify(d, null, 2) + '\n');
+}
+NODEOF
+
+if [[ -s "$TMPDIR_EVAL/unresolvable-mutate.err" ]]; then
+  _fail "eval setup: pointing active_flow_id at a bogus flow id failed: $(cat "$TMPDIR_EVAL/unresolvable-mutate.err")"
+fi
+
+if flow_agents_node "$WRITER" record-critique "$UNRESOLVABLE_DIR" \
+  --id unresolvable-review \
+  --reviewer unresolvable-tester \
+  --verdict pass \
+  --summary "Rebuild attempt against an unresolvable FlowDefinition" \
+  --timestamp "2026-07-05T09:17:30Z" >"$TMPDIR_EVAL/unresolvable-critique.out" 2>"$TMPDIR_EVAL/unresolvable-critique.err"; then
+  _fail "#270 MEDIUM REGRESSION: record-critique succeeded against a stamped gate claim whose FlowDefinition cannot be loaded"
+elif grep -qi "cannot be loaded" "$TMPDIR_EVAL/unresolvable-critique.out" "$TMPDIR_EVAL/unresolvable-critique.err" \
+  && grep -qi "cannot validate the gate-claim stamp" "$TMPDIR_EVAL/unresolvable-critique.out" "$TMPDIR_EVAL/unresolvable-critique.err" \
+  && ! grep -qi "forged or corrupt" "$TMPDIR_EVAL/unresolvable-critique.out" "$TMPDIR_EVAL/unresolvable-critique.err"; then
+  _pass "#270 MEDIUM: an unresolvable FlowDefinition dies with the dedicated 'cannot be loaded' message, naming the flow id — NEVER the 'forged or corrupt' message"
+else
+  _fail "#270 MEDIUM: unresolvable-FlowDefinition rejection message was unexpected: $(cat "$TMPDIR_EVAL/unresolvable-critique.out" "$TMPDIR_EVAL/unresolvable-critique.err")"
+fi
+
+# ─── Mutation test (#270 HIGH reserved-prefix guard): temporarily disable normalizeCheck's ──────
+# reserved-"gate-claim-"-prefix rejection in a SCRATCH COPY of the compiled build/ output,
+# confirm the reserved-prefix fixture above now SUCCEEDS against that mutated binary (eval "goes
+# red" without the guard), then restore the original compiled file immediately. Proves the eval
+# is actually exercising this specific guard, not passing vacuously for an unrelated reason.
+DIST_SIDECAR="$ROOT/build/src/cli/workflow-sidecar.js"
+RESERVED_PREFIX_SCRATCH="$TMPDIR_EVAL/reserved-prefix-mutation-scratch"
+mkdir -p "$RESERVED_PREFIX_SCRATCH"
+
+if [[ -f "$DIST_SIDECAR" ]]; then
+  cp "$DIST_SIDECAR" "$RESERVED_PREFIX_SCRATCH/workflow-sidecar.orig.js"
+  node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/reserved-prefix-mutation-patch.err"
+import { readFileSync, writeFileSync } from 'node:fs';
+const file = '${RESERVED_PREFIX_SCRATCH}/workflow-sidecar.orig.js';
+let src = readFileSync(file, 'utf8');
+const needle = 'if (!allowGateClaimPrefix && typeof check.id === "string" && check.id.startsWith("gate-claim-")) {';
+if (!src.includes(needle)) { process.stderr.write('mutation: reserved-prefix guard text not found — source pattern drifted, cannot mutation-test\n'); process.exit(1); }
+src = src.split(needle).join('if (false) {');
+writeFileSync('${RESERVED_PREFIX_SCRATCH}/workflow-sidecar.mutated.js', src);
+NODEOF
+
+  if [[ -s "$TMPDIR_EVAL/reserved-prefix-mutation-patch.err" ]]; then
+    _fail "mutation-test setup failed (reserved-prefix guard source pattern did not match compiled output): $(cat "$TMPDIR_EVAL/reserved-prefix-mutation-patch.err")"
+  else
+    if node --check "$RESERVED_PREFIX_SCRATCH/workflow-sidecar.mutated.js" 2>"$TMPDIR_EVAL/reserved-prefix-mutation-syntax.err"; then
+      cp "$RESERVED_PREFIX_SCRATCH/workflow-sidecar.mutated.js" "$DIST_SIDECAR"
+
+      if flow_agents_node "$WRITER" record-evidence "$COMPOSE_DIR" \
+        --verdict pass \
+        --check-json '{"id":"gate-claim-mutation-test","kind":"external","status":"pass","summary":"Mutation-test: reserved-prefix guard disabled, must go red"}' \
+        --timestamp "2026-07-05T09:17:45Z" >"$TMPDIR_EVAL/reserved-prefix-mutation.out" 2>"$TMPDIR_EVAL/reserved-prefix-mutation.err"; then
+        _pass "mutation-test: with the reserved-prefix guard neutered, a caller-supplied 'gate-claim-' id now SUCCEEDS (eval correctly goes red without the guard, proving the eval exercises it)"
+      else
+        _fail "mutation-test: reserved-prefix fixture still rejected even with the guard neutered — the eval may not be exercising the intended guard: $(cat "$TMPDIR_EVAL/reserved-prefix-mutation.out" "$TMPDIR_EVAL/reserved-prefix-mutation.err")"
+      fi
+    else
+      _fail "mutation-test setup: mutated workflow-sidecar.js (reserved-prefix guard) failed a syntax check, refusing to run it: $(cat "$TMPDIR_EVAL/reserved-prefix-mutation-syntax.err")"
+    fi
+
+    # Restore the real compiled guard immediately — never leave the mutated binary in place — and
+    # re-run the reserved-prefix negative to confirm the restored binary rejects it again.
+    cp "$RESERVED_PREFIX_SCRATCH/workflow-sidecar.orig.js" "$DIST_SIDECAR"
+    if flow_agents_node "$WRITER" record-evidence "$COMPOSE_DIR" \
+      --verdict pass \
+      --check-json '{"id":"gate-claim-restore-check","kind":"external","status":"pass","summary":"Restore check: reserved-prefix guard must be back after mutation-test cleanup"}' \
+      --timestamp "2026-07-05T09:18:00Z" >"$TMPDIR_EVAL/reserved-prefix-restore.out" 2>"$TMPDIR_EVAL/reserved-prefix-restore.err"; then
+      _fail "mutation-test cleanup REGRESSION: the reserved-prefix guard did not come back after restoring the original compiled file"
+    else
+      _pass "mutation-test cleanup: the real compiled reserved-prefix guard is restored and rejects a caller-supplied 'gate-claim-' id again"
+    fi
+  fi
+else
+  _fail "mutation-test setup: could not locate the compiled build/src/cli/workflow-sidecar.js to mutate for the reserved-prefix guard (ran 'npm run build' first?)"
+fi
+
+
+# ─── #270 follow-up fix (publish-preflight, iteration 5): reserved-prefix rejection applies ────
+# ONLY to NEW mints — a caller-supplied id that ALREADY EXISTS as a check claim id in the
+# session's CURRENT trust.bundle is a CORRECTION (supersession), not a new mint, and must be
+# allowed even when it starts with the reserved "gate-claim-" prefix. Without this exemption a
+# mis-recorded gate-claim-* check (e.g. one mistakenly recorded kind:"test" with no manifest
+# label, exactly the real kontourai-flow-agents-270 wedge this closes) can NEVER be corrected:
+# every attempt to re-record that exact id — the only way to supersede/fix it — is itself
+# rejected by the guard, permanently wedging that id and blocking publish-preflight forever.
+CORRECTION_ROOT="$TMPDIR_EVAL/correction-root"
+CORRECTION_SLUG="correction-270"
+CORRECTION_DIR="$CORRECTION_ROOT/$CORRECTION_SLUG"
+mkdir -p "$CORRECTION_ROOT"
+
+# A dedicated, FRESH session (never copied from COMPOSE_ROOT/COMPOSE_DIR) — COMPOSE_DIR's bundle
+# already carries the reserved-prefix mutation-test's own transient (deliberately unstamped,
+# guard-neutered) 'gate-claim-mutation-test' claim by this point in the script; copying it here
+# would poison this fixture with an unrelated pre-cluster-270 unstamped-claim landmine that has
+# nothing to do with the correction-path behavior under test.
+flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$CORRECTION_ROOT" \
+  --task-slug "$CORRECTION_SLUG" \
+  --actor correction-actor \
+  --flow-id builder.build \
+  --title "Correction-path session" \
+  --source-request "Regression: a mis-recorded gate-claim-* id (kind test, no manifest label) must be correctable via supersession, not permanently wedged." \
+  --summary "Seed session for the reserved-prefix existing-id correction eval." \
+  --criterion "Mis-recorded gate-claim-* ids are correctable via same-id supersession" \
+  --timestamp "2026-07-05T09:10:45Z" >"$TMPDIR_EVAL/correction-seed.out" 2>"$TMPDIR_EVAL/correction-seed.err"
+
+# A real record-gate-claim call creates the FIRST trust.bundle write (ensure-session alone does
+# not write trust.bundle yet) — a real, properly-stamped gate claim at pull-work-gate/selected-work,
+# exactly the compose-layer pattern above, so this session has a normal, valid bundle to seed the
+# mis-recorded claim alongside (never the sole content of the bundle).
+flow_agents_node "$WRITER" record-gate-claim "$CORRECTION_DIR" \
+  --actor correction-actor \
+  --status pass \
+  --summary "Work item selected for correction-path session" \
+  --timestamp "2026-07-05T09:10:50Z" >"$TMPDIR_EVAL/correction-gate-seed.out" 2>"$TMPDIR_EVAL/correction-gate-seed.err"
+
+if [[ ! -f "$CORRECTION_DIR/trust.bundle" ]]; then
+  _fail "eval setup: record-gate-claim did not create trust.bundle for the correction-path session: $(cat "$TMPDIR_EVAL/correction-gate-seed.out" "$TMPDIR_EVAL/correction-gate-seed.err")"
+fi
+
+# Seed the EXACT real wedge shape by hand-editing a copy of trust.bundle (the current, already-
+# fixed binary can no longer MINT a fresh gate-claim-* id via record-evidence/record-check, so a
+# hand-constructed claim is how a pre-fix mis-recording is replicated here — same idiom the
+# forged-stamp/pre-cluster-missing-stamp negatives above already use for defect-class shapes the
+# CLI itself must never be able to produce). Mirrors the real wedged claim byte-for-byte in
+# shape: origin:"check", check_kind:"test" (WS8's classifyEvidence always maps kind:"test" to
+# evidenceType:"test_output" regardless of a command), no execution.label on its evidence entry
+# (no manifest-matchable command — the "without manifest labels" defect) — exactly what makes
+# reconcile-preflight's sessionLocalShapeIssues/noEvidenceCommandIssues path a divergence
+# ('test_output-unreconciled') and blocks publish.
+CORRECTION_CHECK_ID="gate-claim-accumulates"
+node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/correction-seed-mutate.err"
+import { readFileSync, writeFileSync } from 'node:fs';
+const file = '${CORRECTION_DIR}/trust.bundle';
+const bundle = JSON.parse(readFileSync(file, 'utf8'));
+const ts = '2026-07-05T09:11:00Z';
+const claimId = 'correction-270-${CORRECTION_CHECK_ID}';
+bundle.claims.push({
+  id: claimId,
+  subjectType: 'change',
+  subjectId: '${CORRECTION_SLUG}/${CORRECTION_CHECK_ID}',
+  facet: 'flow-agents.workflow',
+  claimType: 'builder.execute.scope',
+  fieldOrBehavior: 'Mis-recorded (pre-fix) gate claim: kind test, no manifest label — the exact real wedge shape.',
+  value: 'pass',
+  createdAt: ts,
+  updatedAt: ts,
+  impactLevel: 'high',
+  verificationPolicyId: 'policy:builder.execute.scope:test_output',
+  metadata: { origin: 'check', check_kind: 'test' },
+  status: 'verified',
+});
+bundle.evidence.push({
+  id: 'ev:' + claimId,
+  claimId,
+  evidenceType: 'test_output',
+  method: 'validation',
+  sourceRef: '${CORRECTION_SLUG}/evidence.json',
+  excerptOrSummary: 'Mis-recorded (pre-fix) gate claim: kind test, no manifest label.',
+  observedAt: ts,
+  collectedBy: 'flow-agents/workflow-sidecar',
+  passing: true,
+});
+writeFileSync(file, JSON.stringify(bundle, null, 2) + '\n');
+NODEOF
+
+if [[ -s "$TMPDIR_EVAL/correction-seed-mutate.err" ]]; then
+  _fail "eval setup: seeding the mis-recorded gate-claim-* (kind:test, no manifest label) wedge claim failed: $(cat "$TMPDIR_EVAL/correction-seed-mutate.err")"
+fi
+
+# Sanity: reconcile-preflight FAILS against the wedged bundle (the real defect this closes) —
+# an unreconciled test_output claim with no manifest-matchable command is a divergence.
+if flow_agents_node "$WRITER" reconcile-preflight "$CORRECTION_DIR" --repo-root "$ROOT" \
+  >"$TMPDIR_EVAL/correction-preflight-before.out" 2>"$TMPDIR_EVAL/correction-preflight-before.err"; then
+  _fail "eval setup REGRESSION: reconcile-preflight unexpectedly PASSED against the seeded wedge claim (kind:test, no manifest label) — the wedge fixture is not actually reproducing the real defect"
+else
+  _pass "eval setup: reconcile-preflight FAILS against the seeded wedge claim (mis-recorded kind:test, no manifest label) — reproduces the real publish-preflight defect before the correction"
+fi
+
+# ─── Eval 1 (correction path): record-evidence --check-json with the SAME id, kind "policy" ────
+# (no command) — must SUCCEED and supersede the mis-recorded claim, even though the id starts
+# with the reserved "gate-claim-" prefix, because that id ALREADY EXISTS in the bundle.
+if flow_agents_node "$WRITER" record-evidence "$CORRECTION_DIR" \
+  --verdict pass \
+  --check-json "{\"id\":\"${CORRECTION_CHECK_ID}\",\"kind\":\"policy\",\"status\":\"pass\",\"summary\":\"Correction: re-recorded as a policy claim, superseding the mis-recorded kind:test entry.\"}" \
+  --timestamp "2026-07-05T09:11:15Z" >"$TMPDIR_EVAL/correction-record.out" 2>"$TMPDIR_EVAL/correction-record.err"; then
+  _pass "correction path: record-evidence supersedes an EXISTING gate-claim-* id (kind test -> policy) instead of rejecting it as a new mint"
+else
+  _fail "correction path REGRESSION: record-evidence rejected supersession of an EXISTING gate-claim-* id: $(cat "$TMPDIR_EVAL/correction-record.out" "$TMPDIR_EVAL/correction-record.err")"
+fi
+
+if node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/correction-assert.err"
+import { readFileSync } from 'node:fs';
+const bundle = JSON.parse(readFileSync('${CORRECTION_DIR}/trust.bundle', 'utf8'));
+const claims = bundle.claims.filter((c) => c.subjectId && c.subjectId.endsWith('/${CORRECTION_CHECK_ID}'));
+if (claims.length !== 1) { process.stderr.write('expected exactly ONE claim for ${CORRECTION_CHECK_ID} after supersession (same-id resupply must replace, not duplicate), found ' + claims.length + '\n'); process.exit(1); }
+const claim = claims[0];
+if (!claim.metadata || claim.metadata.check_kind !== 'policy') { process.stderr.write('claim.metadata.check_kind is not policy after the correction: ' + JSON.stringify(claim.metadata) + '\n'); process.exit(1); }
+NODEOF
+then
+  _pass "correction path: the bundle's claim for gate-claim-accumulates now has check_kind:policy (superseded, not duplicated)"
+else
+  _fail "correction path assertion failed: $(cat "$TMPDIR_EVAL/correction-assert.err")"
+fi
+
+# Assert reconcile-preflight now PASSES (or at least no longer reports the corrected claim as a
+# divergence) — the correction is what publish-preflight needed to unwedge.
+if flow_agents_node "$WRITER" reconcile-preflight "$CORRECTION_DIR" --repo-root "$ROOT" \
+  >"$TMPDIR_EVAL/correction-preflight-after.out" 2>"$TMPDIR_EVAL/correction-preflight-after.err"; then
+  _pass "correction path: reconcile-preflight now PASSES after the correction (policy claim is session-local, not an unreconciled test_output divergence)"
+else
+  _fail "correction path: reconcile-preflight still fails after the correction: $(cat "$TMPDIR_EVAL/correction-preflight-after.out" "$TMPDIR_EVAL/correction-preflight-after.err")"
+fi
+
+# ─── Eval 2 (new-mint rejection still enforced): a NOVEL gate-claim-* id (never seen in this ───
+# session's bundle) is still rejected exactly as before — the exemption above must be scoped
+# strictly to ids that already exist, never a blanket bypass.
+if flow_agents_node "$WRITER" record-evidence "$CORRECTION_DIR" \
+  --verdict pass \
+  --check-json '{"id":"gate-claim-novel-never-seen-before","kind":"policy","status":"pass","summary":"A brand-new gate-claim- id that has never existed in this bundle before."}' \
+  --timestamp "2026-07-05T09:11:30Z" >"$TMPDIR_EVAL/correction-novel.out" 2>"$TMPDIR_EVAL/correction-novel.err"; then
+  _fail "new-mint REGRESSION: record-evidence accepted a NOVEL gate-claim-* id that never existed in the bundle — the existing-id exemption must not apply to brand-new mints"
+elif grep -qi 'reserved for record-gate-claim' "$TMPDIR_EVAL/correction-novel.out" "$TMPDIR_EVAL/correction-novel.err" \
+  && grep -q 'gate-claim-novel-never-seen-before' "$TMPDIR_EVAL/correction-novel.out" "$TMPDIR_EVAL/correction-novel.err"; then
+  _pass "new-mint rejection: a NOVEL gate-claim-* id (not already present) is still rejected with the reserved-prefix message"
+else
+  _fail "new-mint rejection message was unexpected: $(cat "$TMPDIR_EVAL/correction-novel.out" "$TMPDIR_EVAL/correction-novel.err")"
+fi
+
+# ─── Eval 3 (#270 CRITICAL, iteration 6 — the reviewer's exact repro): superseding a REAL, ─────
+# STAMPED gate claim via record-evidence --check-json must DIE, and the stamp must survive
+# UNTOUCHED. The iteration-5 exemption treated "id already exists in the bundle" as sufficient
+# for supersession, which also exempted overwriting a live, properly-stamped record-gate-claim
+# output — silently destroying its metadata.gate_claim stamp, and the caller fully controls
+# check_kind so the replacement claim can be shaped to evade gateClaimShapeUnstampedId's detector
+# (which requires check_kind==="external"). This eval reproduces that exact attack end-to-end
+# against the CURRENT (narrowed) binary and asserts it now dies, with the stamp intact afterward.
+STAMPED_ROOT="$TMPDIR_EVAL/stamped-claim-root"
+STAMPED_SLUG="stamped-claim-270"
+STAMPED_DIR="$STAMPED_ROOT/$STAMPED_SLUG"
+mkdir -p "$STAMPED_ROOT"
+
+flow_agents_node "$WRITER" ensure-session   --artifact-root "$STAMPED_ROOT"   --task-slug "$STAMPED_SLUG"   --actor stamped-claim-actor   --flow-id builder.build   --title "Stamped gate-claim supersession attack session"   --source-request "Regression: a REAL, stamped gate claim must never be supersedable via record-evidence/record-check/dogfood-pass."   --summary "Seed session for the stamped-claim supersession negative."   --criterion "A stamped gate claim id cannot be superseded by record-evidence"   --timestamp "2026-07-05T09:12:30Z" >"$TMPDIR_EVAL/stamped-claim-seed.out" 2>"$TMPDIR_EVAL/stamped-claim-seed.err"
+
+# Real record-gate-claim call — a genuine, properly-stamped gate claim (metadata.gate_claim is
+# stamped by buildTrustBundle itself, never hand-constructed).
+flow_agents_node "$WRITER" record-gate-claim "$STAMPED_DIR"   --actor stamped-claim-actor   --status pass   --summary "Work item selected for stamped-claim supersession session"   --timestamp "2026-07-05T09:12:35Z" >"$TMPDIR_EVAL/stamped-claim-gate.out" 2>"$TMPDIR_EVAL/stamped-claim-gate.err"
+
+if [[ ! -f "$STAMPED_DIR/trust.bundle" ]]; then
+  _fail "eval setup: record-gate-claim did not create trust.bundle for the stamped-claim session: $(cat "$TMPDIR_EVAL/stamped-claim-gate.out" "$TMPDIR_EVAL/stamped-claim-gate.err")"
+fi
+
+STAMPED_CHECK_ID="gate-claim-selected-work"
+if node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/stamped-claim-preassert.err"
+import { readFileSync } from 'node:fs';
+const bundle = JSON.parse(readFileSync('${STAMPED_DIR}/trust.bundle', 'utf8'));
+const claim = bundle.claims.find((c) => c.subjectId && c.subjectId.endsWith('/${STAMPED_CHECK_ID}'));
+if (!claim) { process.stderr.write('eval setup: no claim found for ${STAMPED_CHECK_ID} after record-gate-claim\n'); process.exit(1); }
+if (!claim.metadata || !claim.metadata.gate_claim || typeof claim.metadata.gate_claim !== 'object') { process.stderr.write('eval setup: record-gate-claim did NOT stamp metadata.gate_claim — cannot exercise this eval: ' + JSON.stringify(claim.metadata) + '\n'); process.exit(1); }
+NODEOF
+then
+  _pass "eval setup: record-gate-claim produced a REAL, stamped claim for ${STAMPED_CHECK_ID} (metadata.gate_claim present)"
+else
+  _fail "eval setup: stamped-claim precondition failed: $(cat "$TMPDIR_EVAL/stamped-claim-preassert.err")"
+fi
+
+cp "$STAMPED_DIR/trust.bundle" "$TMPDIR_EVAL/stamped-claim-trust-bundle.before"
+
+# The attack: record-evidence --check-json with the SAME id, caller-chosen kind:"policy" — must
+# now DIE (the narrowed iteration-6 rule), not silently supersede and destroy the stamp.
+if flow_agents_node "$WRITER" record-evidence "$STAMPED_DIR"   --verdict pass   --check-json "{\"id\":\"${STAMPED_CHECK_ID}\",\"kind\":\"policy\",\"status\":\"pass\",\"summary\":\"Attack: attempt to supersede a live stamped gate claim via record-evidence.\"}"   --timestamp "2026-07-05T09:12:45Z" >"$TMPDIR_EVAL/stamped-claim-attack.out" 2>"$TMPDIR_EVAL/stamped-claim-attack.err"; then
+  _fail "#270 CRITICAL REGRESSION: record-evidence --check-json SUCCEEDED in superseding a live, stamped gate claim (${STAMPED_CHECK_ID}) — the narrowed guard did not fire"
+elif grep -qi 'live, properly-stamped gate claim' "$TMPDIR_EVAL/stamped-claim-attack.out" "$TMPDIR_EVAL/stamped-claim-attack.err"   && grep -q "${STAMPED_CHECK_ID}" "$TMPDIR_EVAL/stamped-claim-attack.out" "$TMPDIR_EVAL/stamped-claim-attack.err"   && grep -qi 'only record-gate-claim' "$TMPDIR_EVAL/stamped-claim-attack.out" "$TMPDIR_EVAL/stamped-claim-attack.err"; then
+  _pass "#270 CRITICAL: record-evidence --check-json dies when attempting to supersede a live, stamped gate claim, naming the id and pointing at record-gate-claim as the only legitimate path"
+else
+  _fail "#270 CRITICAL: stamped-claim supersession rejection message was unexpected: $(cat "$TMPDIR_EVAL/stamped-claim-attack.out" "$TMPDIR_EVAL/stamped-claim-attack.err")"
+fi
+
+# Assert the bundle is BYTE-IDENTICAL to before the attack — the die must happen before ANY
+# write, so the stamp (and everything else) survives completely untouched.
+if cmp -s "$TMPDIR_EVAL/stamped-claim-trust-bundle.before" "$STAMPED_DIR/trust.bundle"; then
+  _pass "#270 CRITICAL: trust.bundle is byte-identical after the rejected attack — the die is fail-closed BEFORE any write"
+else
+  _fail "#270 CRITICAL REGRESSION: trust.bundle changed after the rejected supersession attempt — the die is not fail-closed before writing"
+fi
+
+# Semantic re-assertion: metadata.gate_claim is still present and unchanged (belt-and-suspenders
+# on top of the byte-identical check above).
+if node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/stamped-claim-postassert.err"
+import { readFileSync } from 'node:fs';
+const before = JSON.parse(readFileSync('${TMPDIR_EVAL}/stamped-claim-trust-bundle.before', 'utf8'));
+const after = JSON.parse(readFileSync('${STAMPED_DIR}/trust.bundle', 'utf8'));
+const claimBefore = before.claims.find((c) => c.subjectId && c.subjectId.endsWith('/${STAMPED_CHECK_ID}'));
+const claimAfter = after.claims.find((c) => c.subjectId && c.subjectId.endsWith('/${STAMPED_CHECK_ID}'));
+if (!claimAfter || !claimAfter.metadata || !claimAfter.metadata.gate_claim) { process.stderr.write('metadata.gate_claim is MISSING after the attack attempt — the stamp was destroyed\n'); process.exit(1); }
+if (JSON.stringify(claimAfter.metadata.gate_claim) !== JSON.stringify(claimBefore.metadata.gate_claim)) { process.stderr.write('metadata.gate_claim CHANGED after the attack attempt: before=' + JSON.stringify(claimBefore.metadata.gate_claim) + ' after=' + JSON.stringify(claimAfter.metadata.gate_claim) + '\n'); process.exit(1); }
+if (claimAfter.metadata.check_kind === 'policy') { process.stderr.write('claim.metadata.check_kind was overwritten to policy — the attack partially succeeded\n'); process.exit(1); }
+NODEOF
+then
+  _pass "#270 CRITICAL: metadata.gate_claim stamp is semantically intact (present, unchanged) after the rejected attack"
+else
+  _fail "#270 CRITICAL: stamp-intact semantic assertion failed: $(cat "$TMPDIR_EVAL/stamped-claim-postassert.err")"
+fi
+
+# ─── Mutation test (existing-id exists-check, iteration 5, needle updated iteration 6): neuter ──
+# the EXISTING-ID LOOKUP in a scratch copy of the compiled build/ output (force
+# existingHasStamp to always be `undefined`, i.e. always treated as "not already present") — the
+# correction eval above must go RED (the mis-recorded, unstamped wedge id becomes uncorrectable
+# again, since `undefined` now routes to the new-mint die), proving the eval actually exercises
+# the exists-check, not passing vacuously.
+EXISTS_CHECK_SCRATCH="$TMPDIR_EVAL/exists-check-mutation-scratch"
+mkdir -p "$EXISTS_CHECK_SCRATCH"
+
+if [[ -f "$DIST_SIDECAR" ]]; then
+  cp "$DIST_SIDECAR" "$EXISTS_CHECK_SCRATCH/workflow-sidecar.orig.js"
+  node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/exists-check-neuter-allowance.err"
+import { readFileSync, writeFileSync } from 'node:fs';
+const file = '${EXISTS_CHECK_SCRATCH}/workflow-sidecar.orig.js';
+let src = readFileSync(file, 'utf8');
+const needle = 'const existingHasStamp = existingCheckStampById?.get(check.id);';
+if (!src.includes(needle)) { process.stderr.write('mutation: existing-id stamp-map lookup text not found — source pattern drifted, cannot mutation-test\n'); process.exit(1); }
+src = src.split(needle).join('const existingHasStamp = undefined;');
+writeFileSync('${EXISTS_CHECK_SCRATCH}/workflow-sidecar.mutated-neuter-allowance.js', src);
+NODEOF
+
+  if [[ -s "$TMPDIR_EVAL/exists-check-neuter-allowance.err" ]]; then
+    _fail "mutation-test setup failed (existing-id allowance source pattern did not match compiled output): $(cat "$TMPDIR_EVAL/exists-check-neuter-allowance.err")"
+  else
+    if node --check "$EXISTS_CHECK_SCRATCH/workflow-sidecar.mutated-neuter-allowance.js" 2>"$TMPDIR_EVAL/exists-check-neuter-allowance-syntax.err"; then
+      cp "$EXISTS_CHECK_SCRATCH/workflow-sidecar.mutated-neuter-allowance.js" "$DIST_SIDECAR"
+
+      MUTATION_CORRECTION_ROOT="$TMPDIR_EVAL/mutation-correction-root"
+      cp -r "$CORRECTION_ROOT" "$MUTATION_CORRECTION_ROOT"
+      MUTATION_CORRECTION_DIR="$MUTATION_CORRECTION_ROOT/$CORRECTION_SLUG"
+
+      if flow_agents_node "$WRITER" record-evidence "$MUTATION_CORRECTION_DIR" \
+        --verdict pass \
+        --check-json "{\"id\":\"${CORRECTION_CHECK_ID}\",\"kind\":\"policy\",\"status\":\"pass\",\"summary\":\"Correction attempt with the existing-id allowance neutered — must go red.\"}" \
+        --timestamp "2026-07-05T09:11:45Z" >"$TMPDIR_EVAL/exists-check-neuter-allowance-run.out" 2>"$TMPDIR_EVAL/exists-check-neuter-allowance-run.err"; then
+        _fail "mutation-test: with the existing-id allowance neutered, the correction still SUCCEEDED — the eval may not be exercising the intended exists-check"
+      else
+        _pass "mutation-test: with the existing-id allowance neutered, the SAME correction that succeeded above now FAILS (eval correctly goes red without the exists-check, proving it exercises the exemption)"
+      fi
+    else
+      _fail "mutation-test setup: mutated workflow-sidecar.js (existing-id allowance) failed a syntax check, refusing to run it: $(cat "$TMPDIR_EVAL/exists-check-neuter-allowance-syntax.err")"
+    fi
+
+    # Restore the real compiled guard immediately.
+    cp "$EXISTS_CHECK_SCRATCH/workflow-sidecar.orig.js" "$DIST_SIDECAR"
+  fi
+else
+  _fail "mutation-test setup: could not locate the compiled build/src/cli/workflow-sidecar.js to mutate for the existing-id allowance (ran 'npm run build' first?)"
+fi
+
+# ─── Mutation test (new-mint rejection, iteration 5): neuter the reserved-prefix rejection ─────
+# ITSELF (force the whole `if` to false, same technique as the original reserved-prefix mutation
+# test below but re-run here against the NOVEL-id eval) — Eval 2 (new-mint rejection) must go
+# RED, proving that eval still exercises the underlying rejection and is not vacuously green
+# just because the existing-id exemption happens to be present.
+if [[ -f "$DIST_SIDECAR" ]]; then
+  cp "$DIST_SIDECAR" "$EXISTS_CHECK_SCRATCH/workflow-sidecar.orig2.js"
+  node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/exists-check-neuter-rejection.err"
+import { readFileSync, writeFileSync } from 'node:fs';
+const file = '${EXISTS_CHECK_SCRATCH}/workflow-sidecar.orig2.js';
+let src = readFileSync(file, 'utf8');
+const needle = 'if (!allowGateClaimPrefix && typeof check.id === "string" && check.id.startsWith("gate-claim-")) {';
+if (!src.includes(needle)) { process.stderr.write('mutation: reserved-prefix guard text not found — source pattern drifted, cannot mutation-test\n'); process.exit(1); }
+src = src.split(needle).join('if (false) {');
+writeFileSync('${EXISTS_CHECK_SCRATCH}/workflow-sidecar.mutated-neuter-rejection.js', src);
+NODEOF
+
+  if [[ -s "$TMPDIR_EVAL/exists-check-neuter-rejection.err" ]]; then
+    _fail "mutation-test setup failed (reserved-prefix guard source pattern did not match compiled output for the new-mint mutation test): $(cat "$TMPDIR_EVAL/exists-check-neuter-rejection.err")"
+  else
+    if node --check "$EXISTS_CHECK_SCRATCH/workflow-sidecar.mutated-neuter-rejection.js" 2>"$TMPDIR_EVAL/exists-check-neuter-rejection-syntax.err"; then
+      cp "$EXISTS_CHECK_SCRATCH/workflow-sidecar.mutated-neuter-rejection.js" "$DIST_SIDECAR"
+
+      if flow_agents_node "$WRITER" record-evidence "$CORRECTION_DIR" \
+        --verdict pass \
+        --check-json '{"id":"gate-claim-novel-mutation-red-check","kind":"policy","status":"pass","summary":"New-mint attempt with the reserved-prefix rejection neutered — must go red."}' \
+        --timestamp "2026-07-05T09:12:00Z" >"$TMPDIR_EVAL/exists-check-neuter-rejection-run.out" 2>"$TMPDIR_EVAL/exists-check-neuter-rejection-run.err"; then
+        _pass "mutation-test: with the reserved-prefix rejection neutered, a NOVEL gate-claim-* id now SUCCEEDS (eval correctly goes red without the rejection, proving Eval 2 exercises it)"
+      else
+        _fail "mutation-test: NOVEL gate-claim-* id still rejected even with the rejection neutered — Eval 2 may not be exercising the intended rejection: $(cat "$TMPDIR_EVAL/exists-check-neuter-rejection-run.out" "$TMPDIR_EVAL/exists-check-neuter-rejection-run.err")"
+      fi
+    else
+      _fail "mutation-test setup: mutated workflow-sidecar.js (reserved-prefix rejection) failed a syntax check, refusing to run it: $(cat "$TMPDIR_EVAL/exists-check-neuter-rejection-syntax.err")"
+    fi
+
+    # Restore the real compiled guard immediately, and re-run BOTH evals to confirm green again.
+    cp "$EXISTS_CHECK_SCRATCH/workflow-sidecar.orig2.js" "$DIST_SIDECAR"
+    if flow_agents_node "$WRITER" record-evidence "$CORRECTION_DIR" \
+      --verdict pass \
+      --check-json '{"id":"gate-claim-novel-restore-check","kind":"policy","status":"pass","summary":"Restore check: new-mint rejection must be back after mutation-test cleanup."}' \
+      --timestamp "2026-07-05T09:12:15Z" >"$TMPDIR_EVAL/exists-check-restore-novel.out" 2>"$TMPDIR_EVAL/exists-check-restore-novel.err"; then
+      _fail "mutation-test cleanup REGRESSION: the new-mint reserved-prefix rejection did not come back after restoring the original compiled file"
+    else
+      _pass "mutation-test cleanup: the real compiled new-mint rejection is restored and rejects a caller-supplied 'gate-claim-' id again"
+    fi
+  fi
+else
+  _fail "mutation-test setup: could not locate the compiled build/src/cli/workflow-sidecar.js to mutate for the new-mint rejection (ran 'npm run build' first?)"
+fi
+
+# ─── Mutation test (#270 CRITICAL, iteration 6): neuter the STAMPED-CLAIM GUARD itself (force ──
+# `existingHasStamp === true` to never be treated as stamped) in a scratch copy of the compiled
+# build/ output — the Eval 3 negative above (stamped-claim supersession must die) must go RED
+# (the attack SUCCEEDS against the mutated binary), proving Eval 3 actually exercises the new
+# narrowed guard and is not vacuously green for an unrelated reason.
+STAMPED_GUARD_SCRATCH="$TMPDIR_EVAL/stamped-guard-mutation-scratch"
+mkdir -p "$STAMPED_GUARD_SCRATCH"
+
+if [[ -f "$DIST_SIDECAR" ]]; then
+  cp "$DIST_SIDECAR" "$STAMPED_GUARD_SCRATCH/workflow-sidecar.orig.js"
+  node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/stamped-guard-neuter.err"
+import { readFileSync, writeFileSync } from 'node:fs';
+const file = '${STAMPED_GUARD_SCRATCH}/workflow-sidecar.orig.js';
+let src = readFileSync(file, 'utf8');
+const needle = 'if (existingHasStamp === true)';
+if (!src.includes(needle)) { process.stderr.write('mutation: stamped-claim guard text not found — source pattern drifted, cannot mutation-test\n'); process.exit(1); }
+src = src.split(needle).join('if (false)');
+writeFileSync('${STAMPED_GUARD_SCRATCH}/workflow-sidecar.mutated-neuter-stamp-guard.js', src);
+NODEOF
+
+  if [[ -s "$TMPDIR_EVAL/stamped-guard-neuter.err" ]]; then
+    _fail "mutation-test setup failed (stamped-claim guard source pattern did not match compiled output): $(cat "$TMPDIR_EVAL/stamped-guard-neuter.err")"
+  else
+    if node --check "$STAMPED_GUARD_SCRATCH/workflow-sidecar.mutated-neuter-stamp-guard.js" 2>"$TMPDIR_EVAL/stamped-guard-neuter-syntax.err"; then
+      cp "$STAMPED_GUARD_SCRATCH/workflow-sidecar.mutated-neuter-stamp-guard.js" "$DIST_SIDECAR"
+
+      MUTATION_STAMPED_ROOT="$TMPDIR_EVAL/mutation-stamped-root"
+      cp -r "$STAMPED_ROOT" "$MUTATION_STAMPED_ROOT"
+      MUTATION_STAMPED_DIR="$MUTATION_STAMPED_ROOT/$STAMPED_SLUG"
+
+      if flow_agents_node "$WRITER" record-evidence "$MUTATION_STAMPED_DIR"         --verdict pass         --check-json "{\"id\":\"${STAMPED_CHECK_ID}\",\"kind\":\"policy\",\"status\":\"pass\",\"summary\":\"Mutation-test: stamped-claim guard disabled, attack must now succeed.\"}"         --timestamp "2026-07-05T09:13:00Z" >"$TMPDIR_EVAL/stamped-guard-neuter-run.out" 2>"$TMPDIR_EVAL/stamped-guard-neuter-run.err"; then
+        _pass "mutation-test: with the stamped-claim guard neutered, superseding a live stamped gate claim now SUCCEEDS (eval correctly goes red without the guard, proving Eval 3 exercises it)"
+      else
+        _fail "mutation-test: stamped-claim supersession attack still rejected even with the guard neutered — Eval 3 may not be exercising the intended guard: $(cat "$TMPDIR_EVAL/stamped-guard-neuter-run.out" "$TMPDIR_EVAL/stamped-guard-neuter-run.err")"
+      fi
+    else
+      _fail "mutation-test setup: mutated workflow-sidecar.js (stamped-claim guard) failed a syntax check, refusing to run it: $(cat "$TMPDIR_EVAL/stamped-guard-neuter-syntax.err")"
+    fi
+
+    # Restore the real compiled guard immediately, and re-run the negative to confirm green again.
+    cp "$STAMPED_GUARD_SCRATCH/workflow-sidecar.orig.js" "$DIST_SIDECAR"
+    if flow_agents_node "$WRITER" record-evidence "$STAMPED_DIR"       --verdict pass       --check-json "{\"id\":\"${STAMPED_CHECK_ID}\",\"kind\":\"policy\",\"status\":\"pass\",\"summary\":\"Restore check: stamped-claim guard must be back after mutation-test cleanup.\"}"       --timestamp "2026-07-05T09:13:15Z" >"$TMPDIR_EVAL/stamped-guard-restore.out" 2>"$TMPDIR_EVAL/stamped-guard-restore.err"; then
+      _fail "mutation-test cleanup REGRESSION: the stamped-claim guard did not come back after restoring the original compiled file"
+    else
+      _pass "mutation-test cleanup: the real compiled stamped-claim guard is restored and rejects supersession of a live stamped gate claim again"
+    fi
+  fi
+else
+  _fail "mutation-test setup: could not locate the compiled build/src/cli/workflow-sidecar.js to mutate for the stamped-claim guard (ran 'npm run build' first?)"
+fi
+
+# ─── Mutation test (forged-stamp guard): temporarily disable assertStampedGateClaimValid's ────
+# die() in a SCRATCH COPY of the compiled build/ output, confirm the forged-stamp fixture above
+# now SUCCEEDS against that mutated binary (eval "goes red" — i.e. would no longer catch the
+# defect — without the guard), then restore the original compiled file immediately. Proves the
+# eval is actually exercising this guard, not passing vacuously for an unrelated reason.
+MUTATION_SCRATCH="$TMPDIR_EVAL/mutation-scratch"
+mkdir -p "$MUTATION_SCRATCH"
+
+if [[ -f "$DIST_SIDECAR" ]]; then
+  cp "$DIST_SIDECAR" "$MUTATION_SCRATCH/workflow-sidecar.orig.js"
+  node --input-type=module <<NODEOF 2>"$TMPDIR_EVAL/mutation-patch.err"
+import { readFileSync, writeFileSync } from 'node:fs';
+const file = '${MUTATION_SCRATCH}/workflow-sidecar.orig.js';
+let src = readFileSync(file, 'utf8');
+// Neuter the stamp-tuple-mismatch check (assertStampedGateClaimValid's SECOND die call — the
+// mismatch guard, not the no-flow-definition guard) by short-circuiting 'const match = ...' to
+// an unconditional 'const match = true;' via a simple, exact single-line string replacement (no
+// regex, no unbalanced parens) so the mutated file stays syntactically valid.
+const matchNeedle = 'const match = allExpects.some((entry) => entry.gateExpects.some((exp) => exp.id === stamp.expectationId\n            && exp.bundle_claim.claimType === stamp.claimType\n            && exp.bundle_claim.subjectType === stamp.subjectType\n            && (stamp.stepId === null || stamp.stepId === entry.stepId)));';
+if (!src.includes(matchNeedle)) { process.stderr.write('mutation: assertStampedGateClaimValid match-check text not found — source pattern drifted, cannot mutation-test\n'); process.exit(1); }
+src = src.split(matchNeedle).join('const match = true;');
+// Neuter the pre-cluster-270 unstamped-guard's if() condition the same way — exact single-line
+// string replacement, no regex.
+const unstampedNeedle = 'if (gateClaimShapeUnstampedClaimId) {';
+if (!src.includes(unstampedNeedle)) { process.stderr.write('mutation: gateClaimShapeUnstampedClaimId guard text not found — source pattern drifted\n'); process.exit(1); }
+src = src.split(unstampedNeedle).join('if (false && gateClaimShapeUnstampedClaimId) {');
+writeFileSync('${MUTATION_SCRATCH}/workflow-sidecar.mutated.js', src);
+NODEOF
+
+  if [[ -s "$TMPDIR_EVAL/mutation-patch.err" ]]; then
+    _fail "mutation-test setup failed (guard source pattern did not match compiled output): $(cat "$TMPDIR_EVAL/mutation-patch.err")"
+  else
+    # Syntax-check the mutated file before swapping it in — a broken mutation must not corrupt
+    # the eval run itself.
+    if node --check "$MUTATION_SCRATCH/workflow-sidecar.mutated.js" 2>"$TMPDIR_EVAL/mutation-syntax.err"; then
+      cp "$MUTATION_SCRATCH/workflow-sidecar.mutated.js" "$DIST_SIDECAR"
+      # Copy the WHOLE root again (see the FORGED_ROOT/PRECLUSTER_ROOT comment above) — same
+      # current.json/current/<actor>.json resolution requirement applies here.
+      MUTATION_FORGED_ROOT="$TMPDIR_EVAL/mutation-forged-root"
+      cp -r "$FORGED_ROOT" "$MUTATION_FORGED_ROOT"
+      MUTATION_FORGED_DIR="$MUTATION_FORGED_ROOT/$COMPOSE_SLUG"
+      MUTATION_PRECLUSTER_ROOT="$TMPDIR_EVAL/mutation-precluster-root"
+      cp -r "$PRECLUSTER_ROOT" "$MUTATION_PRECLUSTER_ROOT"
+      MUTATION_PRECLUSTER_DIR="$MUTATION_PRECLUSTER_ROOT/$COMPOSE_SLUG"
+
+      if flow_agents_node "$WRITER" record-critique "$MUTATION_FORGED_DIR" \
+        --id mutation-forged-review --reviewer mutation-tester --verdict pass \
+        --summary "Mutation-test: forged-stamp guard disabled, must go red" \
+        --timestamp "2026-07-05T09:14:00Z" >"$TMPDIR_EVAL/mutation-forged.out" 2>"$TMPDIR_EVAL/mutation-forged.err"; then
+        _pass "mutation-test: with the stamp-mismatch guard neutered, the forged-stamp fixture now SUCCEEDS (eval correctly goes red without the guard, proving the guard is what the eval exercises)"
+      else
+        _fail "mutation-test: forged-stamp fixture still failed even with the guard neutered — the eval may not be exercising the intended guard: $(cat "$TMPDIR_EVAL/mutation-forged.out" "$TMPDIR_EVAL/mutation-forged.err")"
+      fi
+
+      if flow_agents_node "$WRITER" record-critique "$MUTATION_PRECLUSTER_DIR" \
+        --id mutation-precluster-review --reviewer mutation-tester --verdict pass \
+        --summary "Mutation-test: pre-cluster-270 guard disabled, must go red" \
+        --timestamp "2026-07-05T09:14:30Z" >"$TMPDIR_EVAL/mutation-precluster.out" 2>"$TMPDIR_EVAL/mutation-precluster.err"; then
+        _pass "mutation-test: with the pre-cluster-270 unstamped guard neutered, the missing-stamp fixture now SUCCEEDS (eval correctly goes red without the guard)"
+      else
+        _fail "mutation-test: pre-cluster missing-stamp fixture still failed even with the guard neutered: $(cat "$TMPDIR_EVAL/mutation-precluster.out" "$TMPDIR_EVAL/mutation-precluster.err")"
+      fi
+    else
+      _fail "mutation-test setup: mutated workflow-sidecar.js failed a syntax check, refusing to run it: $(cat "$TMPDIR_EVAL/mutation-syntax.err")"
+    fi
+
+    # Restore the real compiled guard immediately — never leave the mutated binary in place, and
+    # re-run BOTH negatives to confirm the restored binary rejects them again (guard is back).
+    cp "$MUTATION_SCRATCH/workflow-sidecar.orig.js" "$DIST_SIDECAR"
+    RESTORE_FORGED_ROOT="$TMPDIR_EVAL/restore-check-forged-root"
+    cp -r "$FORGED_ROOT" "$RESTORE_FORGED_ROOT"
+    RESTORE_FORGED_DIR="$RESTORE_FORGED_ROOT/$COMPOSE_SLUG"
+    if flow_agents_node "$WRITER" record-critique "$RESTORE_FORGED_DIR" \
+      --id restore-check-review --reviewer restore-check-tester --verdict pass \
+      --summary "Restore check: forged-stamp guard must be back after mutation-test cleanup" \
+      --timestamp "2026-07-05T09:15:00Z" >"$TMPDIR_EVAL/mutation-restore.out" 2>"$TMPDIR_EVAL/mutation-restore.err"; then
+      _fail "mutation-test cleanup REGRESSION: the forged-stamp guard did not come back after restoring the original compiled file"
+    else
+      _pass "mutation-test cleanup: the real compiled guard is restored and rejects the (already-forged) fixture again"
+    fi
+  fi
+else
+  _fail "mutation-test setup: could not locate the compiled build/src/cli/workflow-sidecar.js to mutate (ran 'npm run build' first?)"
+fi
+
+
 
 if [[ "$errors" -eq 0 ]]; then
   echo "Workflow sidecar writer integration passed."