@kontourai/flow-agents 3.4.2 → 3.5.0

package/evals/integration/test_builder_entry_enforcement.sh

@@ -17,6 +17,142 @@ WRITER="workflow-sidecar"
 
 echo "=== Builder workflow entry enforcement ==="
 
+NONCANONICAL_ROOT="$TMP/noncanonical-root"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$NONCANONICAL_ROOT" \
+  --task-slug noncanonical \
+  --title "Noncanonical root" \
+  --summary "Builder state must use the product artifact root." \
+  --flow-id builder.build >"$TMP/noncanonical.out" 2>&1; then
+  fail "noncanonical Builder artifact root should be rejected"
+elif [[ ! -e "$NONCANONICAL_ROOT" ]] \
+  && grep -q 'requires --artifact-root <project>/.kontourai/flow-agents' "$TMP/noncanonical.out"; then
+  pass "noncanonical Builder artifact root is rejected before any sidecar write"
+else
+  fail "noncanonical Builder root left partial state or the wrong diagnostic: $(cat "$TMP/noncanonical.out")"
+fi
+
+SYMLINK_PROJECT="$TMP/symlink-project"
+SYMLINK_EXTERNAL="$TMP/symlink-external"
+mkdir -p "$SYMLINK_PROJECT/.kontourai" "$SYMLINK_EXTERNAL"
+ln -s "$SYMLINK_EXTERNAL" "$SYMLINK_PROJECT/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SYMLINK_PROJECT/.kontourai/flow-agents" \
+  --task-slug symlink-root \
+  --title "Symlink root" \
+  --summary "Builder state must not escape the project." \
+  --flow-id builder.build >"$TMP/symlink-root.out" 2>&1; then
+  fail "symlinked Builder artifact root should be rejected"
+elif [[ -z "$(find "$SYMLINK_EXTERNAL" -mindepth 1 -print -quit)" ]] \
+  && grep -q 'requires a non-symlink Flow Agents artifact root' "$TMP/symlink-root.out"; then
+  pass "symlinked Builder artifact root is rejected before any external write"
+else
+  fail "symlinked Builder root wrote externally or returned the wrong diagnostic: $(cat "$TMP/symlink-root.out")"
+fi
+
+SESSION_SYMLINK_PROJECT="$TMP/session-symlink-project"
+SESSION_SYMLINK_ROOT="$SESSION_SYMLINK_PROJECT/.kontourai/flow-agents"
+SESSION_SYMLINK_EXTERNAL="$TMP/session-symlink-external"
+mkdir -p "$SESSION_SYMLINK_ROOT" "$SESSION_SYMLINK_EXTERNAL"
+ln -s "$SESSION_SYMLINK_EXTERNAL" "$SESSION_SYMLINK_ROOT/session-symlink"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_SYMLINK_ROOT" \
+  --task-slug session-symlink \
+  --actor builder-entry-session-symlink \
+  --title "Session symlink" \
+  --summary "Session state must not escape the artifact root." \
+  --flow-id builder.build >"$TMP/session-symlink.out" 2>&1; then
+  fail "symlinked session directory should be rejected"
+elif [[ -z "$(find "$SESSION_SYMLINK_EXTERNAL" -mindepth 1 -print -quit)" ]] \
+  && grep -q 'session directory must be a real directory under the artifact root' "$TMP/session-symlink.out"; then
+  pass "symlinked session directory is rejected before external reads or writes"
+else
+  fail "symlinked session directory escaped or returned the wrong diagnostic: $(cat "$TMP/session-symlink.out")"
+fi
+
+NESTED_PROJECT="$TMP/nested-symlink-project"
+NESTED_ROOT="$NESTED_PROJECT/.kontourai/flow-agents"
+NESTED_EXTERNAL="$TMP/nested-symlink-external.json"
+mkdir -p "$NESTED_ROOT/assignment"
+printf 'external must survive\n' >"$NESTED_EXTERNAL"
+ln -s "$NESTED_EXTERNAL" "$NESTED_ROOT/assignment/nested-symlink.json"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$NESTED_ROOT" \
+  --task-slug nested-symlink \
+  --actor builder-entry-nested-symlink \
+  --title "Nested assignment symlink" \
+  --summary "Assignment evidence must stay inside the product root." \
+  --flow-id builder.build >"$TMP/nested-symlink.out" 2>&1; then
+  fail "symlinked assignment record should be rejected"
+elif [[ "$(cat "$NESTED_EXTERNAL")" == "external must survive" ]] \
+  && [[ ! -e "$NESTED_ROOT/nested-symlink" ]] \
+  && grep -q 'assignment record must be a regular file, not a symlink' "$TMP/nested-symlink.out"; then
+  pass "nested assignment symlink is rejected before external write or trust evidence"
+else
+  fail "nested assignment symlink escaped or returned the wrong diagnostic: $(cat "$TMP/nested-symlink.out")"
+fi
+
+RACE_PROJECT="$TMP/race-project"
+RACE_ROOT="$RACE_PROJECT/.kontourai/flow-agents"
+RACE_MOVED="$RACE_PROJECT/.kontourai/flow-agents-acquired"
+RACE_EXTERNAL="$TMP/race-external"
+mkdir -p "$RACE_ROOT" "$RACE_EXTERNAL"
+FLOW_AGENTS_WORKFLOW_SIDECAR_LOCK_DELAY=1 flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$RACE_ROOT" \
+  --task-slug lock-swap \
+  --title "Lock swap" \
+  --summary "Lock cleanup must remain on the acquired root." \
+  --flow-id builder.build >"$TMP/lock-swap.out" 2>&1 &
+RACE_PID=$!
+node - "$RACE_ROOT/.workflow-sidecar.lockdir" <<'NODE'
+const fs = require('node:fs');
+const lock = process.argv[2];
+const deadline = Date.now() + 5000;
+(function wait() {
+  if (fs.existsSync(lock)) process.exit(0);
+  if (Date.now() > deadline) process.exit(1);
+  setTimeout(wait, 10);
+})();
+NODE
+mv "$RACE_ROOT" "$RACE_MOVED"
+mkdir -p "$RACE_EXTERNAL/.workflow-sidecar.lockdir"
+printf 'outside must survive\n' >"$RACE_EXTERNAL/.workflow-sidecar.lockdir/sentinel"
+ln -s "$RACE_EXTERNAL" "$RACE_ROOT"
+set +e
+wait "$RACE_PID"
+RACE_STATUS=$?
+set -e
+if [[ "$RACE_STATUS" -ne 0 ]] \
+  && [[ -f "$RACE_EXTERNAL/.workflow-sidecar.lockdir/sentinel" ]] \
+  && [[ -d "$RACE_MOVED/.workflow-sidecar.lockdir" ]] \
+  && grep -q 'lock cleanup skipped because root or lock identity changed' "$TMP/lock-swap.out"; then
+  pass "lock cleanup refuses a swapped root and preserves external content"
+else
+  fail "lock cleanup followed a swapped root or lost its identity diagnostic: $(cat "$TMP/lock-swap.out")"
+fi
+
+RELEASE_STATE="$TMP/release-3.4.2-state.json"
+cat >"$RELEASE_STATE" <<'JSON'
+{
+  "schema_version": "1.0",
+  "task_slug": "release-3-4-2",
+  "status": "new",
+  "phase": "pickup",
+  "updated_at": "2026-07-10T00:00:00Z",
+  "next_action": {
+    "status": "continue",
+    "summary": "Start the canonical Flow run.",
+    "command": "flow-agents builder-run start --session-dir .kontourai/flow-agents/release-3-4-2",
+    "enforcement": "before_tool_use"
+  }
+}
+JSON
+if flow_agents_node "validate-workflow-artifacts" --skip-markdown-validation "$RELEASE_STATE" >/dev/null 2>&1; then
+  pass "3.4.2 sidecars remain schema-valid while deprecated enforcement is ignored"
+else
+  fail "3.4.2 sidecar compatibility regressed"
+fi
+
 REFUSED_ROOT="$TMP/refused/.kontourai/flow-agents"
 if flow_agents_node "$WRITER" ensure-session \
   --artifact-root "$REFUSED_ROOT" \
@@ -52,6 +188,7 @@ LOCAL_ROOT="$TMP/local/.kontourai/flow-agents"
 if flow_agents_node "$WRITER" ensure-session \
   --artifact-root "$LOCAL_ROOT" \
   --task-slug local-request \
+  --actor builder-entry-local \
   --title "Local request" \
   --summary "Providerless work still needs an anchor." \
   --flow-id builder.build \
@@ -63,18 +200,25 @@ const root = process.argv[2];
 const current = JSON.parse(fs.readFileSync(path.join(root, 'current.json'), 'utf8'));
 const state = JSON.parse(fs.readFileSync(path.join(root, 'local-request', 'state.json'), 'utf8'));
 const workItem = JSON.parse(fs.readFileSync(path.join(root, 'local-request', 'work-item.json'), 'utf8'));
-if (current.active_flow_id !== 'builder.build' || current.active_step_id !== 'pull-work') process.exit(1);
-if (state.status !== 'new' || state.phase !== 'pickup') process.exit(1);
+const flowState = JSON.parse(fs.readFileSync(path.join(path.dirname(root), 'flow', 'runs', 'local-request', 'state.json'), 'utf8'));
+if (current.active_flow_id !== 'builder.build' || current.active_step_id !== 'design-probe') process.exit(1);
+if (state.status !== 'in_progress' || state.phase !== 'pickup') process.exit(1);
 if (JSON.stringify(state.work_item_refs) !== JSON.stringify(['local:local-request'])) process.exit(1);
 if (workItem.id !== 'local-request' || workItem.title !== 'Local request') process.exit(1);
 if (workItem.source_provider?.kind !== 'local' || workItem.source_provider?.path !== 'work-item.json') process.exit(1);
-if (state.next_action?.command !== 'flow-agents builder-run start --session-dir .kontourai/flow-agents/local-request') process.exit(1);
-if (state.next_action?.enforcement !== 'before_tool_use') process.exit(1);
-if (JSON.stringify(state.next_action?.skills) !== JSON.stringify(['pull-work'])) process.exit(1);
-if (!state.next_action?.summary?.includes('`pull-work`')) process.exit(1);
+if (flowState.current_step !== 'design-probe' || flowState.subject !== 'local:local-request') process.exit(1);
+if (state.flow_run?.current_step !== 'design-probe') process.exit(1);
+if (JSON.stringify(state.next_action?.skills) !== JSON.stringify(['pickup-probe'])) process.exit(1);
+if (!state.next_action?.command?.includes('builder-run sync')) process.exit(1);
+if ('enforcement' in state.next_action) process.exit(1);
+const bundle = JSON.parse(fs.readFileSync(path.join(root, 'local-request', 'trust.bundle'), 'utf8'));
+const selected = (bundle.claims || []).find((claim) => claim.claimType === 'builder.pull-work.selected');
+if (selected?.status !== 'verified') process.exit(1);
+if (selected?.metadata?.workflow_subject_ref !== 'local:local-request') process.exit(1);
+if (!(selected?.metadata?.artifact_refs || []).some((ref) => ref.file === '.kontourai/flow-agents/assignment/local-request.json')) process.exit(1);
 NODE
   then
-    pass "providerless request creates a local Work Item and starts at pull-work"
+    pass "durably acquired local Work Item satisfies pull-work through the trust bundle and Flow advances"
   else
     fail "local Work Item or first-step state is invalid"
   fi
@@ -83,7 +227,16 @@ else
 fi
 
 LOCAL_SESSION="$LOCAL_ROOT/local-request"
-if flow_agents_node builder-run start --session-dir "$LOCAL_SESSION" >"$TMP/builder-start.out" 2>&1 \
+FLOW_DIGEST_BEFORE="$(find "$TMP/local/.kontourai/flow/runs/local-request" -type f -print0 | sort -z | xargs -0 shasum -a 256)"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$LOCAL_ROOT" \
+  --task-slug local-request \
+  --actor builder-entry-local \
+  --title "Local request" \
+  --summary "Providerless work still needs an anchor." \
+  --flow-id builder.build \
+  --timestamp "2026-07-10T00:00:00Z" >"$TMP/builder-ensure-again.out" 2>&1 \
+  && [[ "$FLOW_DIGEST_BEFORE" == "$(find "$TMP/local/.kontourai/flow/runs/local-request" -type f -print0 | sort -z | xargs -0 shasum -a 256)" ]] \
   && node - "$TMP/local" "$LOCAL_SESSION" <<'NODE'
 const fs = require('node:fs');
 const path = require('node:path');
@@ -91,24 +244,69 @@ const project = process.argv[2];
 const session = process.argv[3];
 const flowState = JSON.parse(fs.readFileSync(path.join(project, '.kontourai', 'flow', 'runs', 'local-request', 'state.json'), 'utf8'));
 const sidecar = JSON.parse(fs.readFileSync(path.join(session, 'state.json'), 'utf8'));
-if (flowState.current_step !== 'pull-work' || flowState.subject !== 'local:local-request') process.exit(1);
-if (sidecar.flow_run?.current_step !== 'pull-work') process.exit(1);
-if (JSON.stringify(sidecar.next_action?.skills) !== JSON.stringify(['pull-work'])) process.exit(1);
+if (flowState.current_step !== 'design-probe' || flowState.subject !== 'local:local-request') process.exit(1);
+if (sidecar.flow_run?.current_step !== 'design-probe') process.exit(1);
+if (JSON.stringify(sidecar.next_action?.skills) !== JSON.stringify(['pickup-probe'])) process.exit(1);
 if (!sidecar.next_action?.command?.includes('builder-run sync')) process.exit(1);
 NODE
 then
-  pass "small-model entry command creates canonical Flow run and projects pull-work action"
+  pass "repeated ensure-session loads the canonical Flow run without resetting its history"
 else
-  fail "canonical Builder run did not start or project correctly: $(cat "$TMP/builder-start.out")"
+  fail "canonical Builder ensure was not idempotent: $(cat "$TMP/builder-ensure-again.out")"
 fi
 
-if flow_agents_node "$WRITER" record-gate-claim "$LOCAL_SESSION" \
-  --expectation selected-work \
-  --status pass \
-  --summary "Selected local:local-request with scope and acceptance context." \
-  --evidence-ref-json '{"kind":"artifact","file":".kontourai/flow-agents/local-request/work-item.json","summary":"Provider-neutral local Work Item."}' \
-  >"$TMP/selected-work.out" 2>&1 \
-  && node - "$TMP/local" "$LOCAL_SESSION" <<'NODE'
+BROKEN_PROJECT="$TMP/broken-start"
+BROKEN_ROOT="$BROKEN_PROJECT/.kontourai/flow-agents"
+mkdir -p "$BROKEN_PROJECT/.kontourai"
+printf 'not a run-store directory\n' > "$BROKEN_PROJECT/.kontourai/flow"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$BROKEN_ROOT" \
+  --task-slug broken-start \
+  --actor builder-entry-broken \
+  --title "Broken start" \
+  --summary "Flow startup must fail visibly." \
+  --flow-id builder.build >"$TMP/broken-start.out" 2>&1; then
+  fail "invalid canonical Flow startup should fail ensure-session"
+elif [[ -f "$BROKEN_ROOT/broken-start/state.json" ]] \
+  && [[ ! -e "$BROKEN_PROJECT/.kontourai/flow/runs/broken-start" ]] \
+  && grep -q 'canonical Builder Flow entry failed' "$TMP/broken-start.out" \
+  && grep -q 'Re-run the same ensure-session command' "$TMP/broken-start.out" \
+  && node - "$BROKEN_ROOT/broken-start/state.json" <<'NODE'
+const fs = require('node:fs');
+const state = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+if (state.flow_run) process.exit(1);
+if (!state.next_action?.command?.includes('builder-run start')) process.exit(1);
+NODE
+then
+  pass "failed canonical startup is visible and leaves only retryable sidecar guidance"
+else
+  fail "failed canonical startup forged state or lost recovery guidance: $(cat "$TMP/broken-start.out")"
+fi
+
+rm -f "$BROKEN_PROJECT/.kontourai/flow"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$BROKEN_ROOT" \
+  --task-slug broken-start \
+  --actor builder-entry-broken \
+  --title "Broken start" \
+  --summary "Flow startup must recover from persisted acquisition provenance." \
+  --flow-id builder.build >"$TMP/broken-start-retry.out" 2>&1 \
+  && node - "$BROKEN_PROJECT" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const project = process.argv[2];
+const flowState = JSON.parse(fs.readFileSync(path.join(project, '.kontourai', 'flow', 'runs', 'broken-start', 'state.json'), 'utf8'));
+const bundle = JSON.parse(fs.readFileSync(path.join(project, '.kontourai', 'flow-agents', 'broken-start', 'trust.bundle'), 'utf8'));
+if (flowState.current_step !== 'design-probe') process.exit(1);
+if (!(bundle.claims || []).some((claim) => claim.claimType === 'builder.pull-work.selected' && claim.status === 'verified')) process.exit(1);
+NODE
+then
+  pass "interrupted Flow startup retries from exact persisted acquisition provenance"
+else
+  fail "interrupted acquisition could not recover: $(cat "$TMP/broken-start-retry.out")"
+fi
+
+if node - "$TMP/local" "$LOCAL_SESSION" <<'NODE'
 const fs = require('node:fs');
 const path = require('node:path');
 const project = process.argv[2];
@@ -120,9 +318,158 @@ if (sidecar.flow_run?.current_step !== 'design-probe') process.exit(1);
 if (JSON.stringify(sidecar.next_action?.skills) !== JSON.stringify(['pickup-probe'])) process.exit(1);
 NODE
 then
-  pass "gate-claim write synchronizes Flow and projects the next skill"
+  pass "automatic selected-work claim synchronizes Flow and projects the next skill"
+else
+  fail "automatic selected-work claim did not advance the canonical run"
+fi
+
+SKIPPED_ROOT="$TMP/skipped/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SKIPPED_ROOT" \
+  --task-slug skipped-ownership \
+  --actor builder-entry-skipped \
+  --skip-ownership-guard \
+  --title "Skipped ownership" \
+  --summary "Unproven ownership must remain at pull-work." \
+  --flow-id builder.build >"$TMP/skipped.out" 2>&1 \
+  && node - "$TMP/skipped" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const project = process.argv[2];
+const session = path.join(project, '.kontourai', 'flow-agents', 'skipped-ownership');
+const flowState = JSON.parse(fs.readFileSync(path.join(project, '.kontourai', 'flow', 'runs', 'skipped-ownership', 'state.json'), 'utf8'));
+const sidecar = JSON.parse(fs.readFileSync(path.join(session, 'state.json'), 'utf8'));
+if (flowState.current_step !== 'pull-work' || sidecar.flow_run?.current_step !== 'pull-work') process.exit(1);
+if (JSON.stringify(sidecar.next_action?.skills) !== JSON.stringify(['pull-work'])) process.exit(1);
+if (fs.existsSync(path.join(session, 'trust.bundle'))) process.exit(1);
+if (fs.existsSync(path.join(project, '.kontourai', 'flow-agents', 'assignment', 'skipped-ownership.json'))) process.exit(1);
+NODE
+then
+  pass "skipped ownership remains at pull-work without selected-work evidence"
+else
+  fail "unproven ownership advanced the canonical run: $(cat "$TMP/skipped.out")"
+fi
+
+MISMATCH_ROOT="$TMP/mismatched-subject/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$MISMATCH_ROOT" \
+  --task-slug arbitrary-session-name \
+  --work-item "kontourai/flow-agents#541" \
+  --actor builder-entry-mismatch \
+  --title "Mismatched assignment subject" \
+  --summary "An arbitrary slug is not exact Work Item evidence." \
+  --flow-id builder.build >"$TMP/mismatched-subject.out" 2>&1 \
+  && node - "$TMP/mismatched-subject" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const project = process.argv[2];
+const session = path.join(project, '.kontourai', 'flow-agents', 'arbitrary-session-name');
+const flowState = JSON.parse(fs.readFileSync(path.join(project, '.kontourai', 'flow', 'runs', 'arbitrary-session-name', 'state.json'), 'utf8'));
+const sidecar = JSON.parse(fs.readFileSync(path.join(session, 'state.json'), 'utf8'));
+if (flowState.subject !== 'kontourai/flow-agents#541' || flowState.current_step !== 'pull-work') process.exit(1);
+if (sidecar.flow_run?.current_step !== 'pull-work') process.exit(1);
+if (fs.existsSync(path.join(session, 'trust.bundle'))) process.exit(1);
+if (!fs.existsSync(path.join(project, '.kontourai', 'flow-agents', 'assignment', 'arbitrary-session-name.json'))) process.exit(1);
+NODE
+then
+  pass "assignment subject must canonically match the exact Work Item before pull-work can pass"
+else
+  fail "mismatched assignment subject was treated as exact Work Item evidence: $(cat "$TMP/mismatched-subject.out")"
+fi
+
+COLLISION_ROOT="$TMP/collision/.kontourai/flow-agents"
+if ! flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$COLLISION_ROOT" \
+  --work-item "owner/a.b#541" \
+  --actor builder-entry-collision \
+  --title "Collision seed" \
+  --summary "Bind the first exact Work Item." >/dev/null 2>&1; then
+  fail "collision fixture could not seed the first exact Work Item"
+else
+  COLLISION_ASSIGNMENT="$COLLISION_ROOT/assignment/owner-a-b-541.json"
+  COLLISION_DIGEST="$(shasum -a 256 "$COLLISION_ASSIGNMENT")"
+  if flow_agents_node "$WRITER" ensure-session \
+    --artifact-root "$COLLISION_ROOT" \
+    --work-item "owner/a-b#541" \
+    --actor builder-entry-collision \
+    --title "Collision attempt" \
+    --summary "A colliding slug must not change the exact Work Item." \
+    --flow-id builder.build >"$TMP/collision.out" 2>&1; then
+    fail "colliding exact Work Item refs should be rejected"
+  elif grep -q 'already bound to Work Item "owner/a.b#541", not "owner/a-b#541"' "$TMP/collision.out" \
+    && [[ "$COLLISION_DIGEST" == "$(shasum -a 256 "$COLLISION_ASSIGNMENT")" ]] \
+    && [[ ! -e "$TMP/collision/.kontourai/flow/runs/owner-a-b-541" ]]; then
+    pass "colliding slugs cannot change an existing session's exact Work Item binding"
+  else
+    fail "slug collision mutated ownership or returned the wrong diagnostic: $(cat "$TMP/collision.out")"
+  fi
+fi
+
+ASSIGNMENT_ONLY_ROOT="$TMP/assignment-only-collision/.kontourai/flow-agents"
+mkdir -p "$ASSIGNMENT_ONLY_ROOT/assignment"
+cat >"$ASSIGNMENT_ONLY_ROOT/assignment/owner-a-b-542.json" <<'JSON'
+{
+  "schema_version": "1.0",
+  "role": "AssignmentClaimRecord",
+  "subject_id": "owner-a-b-542",
+  "actor": { "runtime": "codex", "session_id": "interrupted", "host": "eval-host", "human": null },
+  "actor_key": "interrupted",
+  "work_item_ref": "owner/a.b#542",
+  "claimed_at": "2020-01-01T00:00:00Z",
+  "ttl_seconds": 1,
+  "branch": "agent/interrupted/owner-a-b-542",
+  "artifact_dir": "owner-a-b-542",
+  "status": "claimed",
+  "audit_trail": []
+}
+JSON
+ASSIGNMENT_ONLY_FILE="$ASSIGNMENT_ONLY_ROOT/assignment/owner-a-b-542.json"
+ASSIGNMENT_ONLY_DIGEST="$(shasum -a 256 "$ASSIGNMENT_ONLY_FILE")"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$ASSIGNMENT_ONLY_ROOT" \
+  --work-item "owner/a-b#542" \
+  --actor builder-entry-assignment-only-collision \
+  --supersede-stale \
+  --now "2026-07-10T00:00:00Z" \
+  --title "Assignment-only collision" \
+  --summary "A crash before state creation must preserve exact assignment identity." \
+  --flow-id builder.build >"$TMP/assignment-only-collision.out" 2>&1; then
+  fail "assignment-only colliding Work Item should be rejected"
+elif grep -q 'already bound to Work Item "owner/a.b#542", not "owner/a-b#542"' "$TMP/assignment-only-collision.out" \
+  && [[ "$ASSIGNMENT_ONLY_DIGEST" == "$(shasum -a 256 "$ASSIGNMENT_ONLY_FILE")" ]] \
+  && [[ ! -e "$ASSIGNMENT_ONLY_ROOT/owner-a-b-542" ]]; then
+  pass "assignment provenance blocks slug collisions before session state exists"
+else
+  fail "assignment-only collision mutated provenance or returned the wrong diagnostic: $(cat "$TMP/assignment-only-collision.out")"
+fi
+
+PREEXISTING_ROOT="$TMP/preexisting/.kontourai/flow-agents"
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$PREEXISTING_ROOT" \
+  --task-slug preexisting-selection \
+  --actor builder-entry-preexisting \
+  --title "Preexisting selection" \
+  --summary "Seed an assignment before the canonical Builder run." >/dev/null 2>&1 \
+  && flow_agents_node "$WRITER" ensure-session \
+    --artifact-root "$PREEXISTING_ROOT" \
+    --task-slug preexisting-selection \
+    --actor builder-entry-preexisting \
+    --title "Preexisting selection" \
+    --summary "An older self-held assignment is not new selection evidence." \
+    --flow-id builder.build >"$TMP/preexisting.out" 2>&1 \
+  && node - "$TMP/preexisting" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const project = process.argv[2];
+const session = path.join(project, '.kontourai', 'flow-agents', 'preexisting-selection');
+const flowState = JSON.parse(fs.readFileSync(path.join(project, '.kontourai', 'flow', 'runs', 'preexisting-selection', 'state.json'), 'utf8'));
+if (flowState.current_step !== 'pull-work') process.exit(1);
+if (fs.existsSync(path.join(session, 'trust.bundle'))) process.exit(1);
+NODE
+then
+  pass "preexisting self-held assignments do not retroactively satisfy pull-work"
 else
-  fail "selected-work claim did not advance the canonical run: $(cat "$TMP/selected-work.out")"
+  fail "preexisting assignment was treated as current selection evidence: $(cat "$TMP/preexisting.out")"
 fi
 
 if FLOW_AGENTS_GOAL_FIT_MODE=block FLOW_AGENTS_GOAL_FIT_MAX_BLOCKS=100000 \

package/evals/integration/test_builder_step_producers.sh

@@ -139,7 +139,7 @@ test_produce_claim() {
 
   local slug
   slug="$(echo "prod-$step-$expectation" | tr '/' '-' | tr '.' '-')"
-  local aroot="$TMP/$slug"
+  local aroot="$TMP/$slug/.kontourai/flow-agents"
   setup_session_for_produce "$aroot" "$slug" "$step"
 
   if flow_agents_node "workflow-sidecar" record-gate-claim "$aroot/$slug" \

package/evals/integration/test_bundle_install.sh

@@ -592,14 +592,14 @@ function hasWorkflowSteering(file, ...eventNames) {
 }
 for (const file of process.argv.slice(2)) {
   if (!hasWorkflowSteering(file, "UserPromptSubmit", "userPromptSubmit")) throw new Error(`missing prompt-submit workflow steering: ${file}`);
-  if (!hasWorkflowSteering(file, "PreToolUse", "preToolUse")) throw new Error(`missing pre-tool workflow entry enforcement: ${file}`);
+  if (hasWorkflowSteering(file, "PreToolUse", "preToolUse")) throw new Error(`workflow bootstrap must not be model-mediated at pre-tool time: ${file}`);
 }
 console.log("ok");
 NODE
 then
-  _pass "installed bundles wire prompt-submit steering and pre-tool entry enforcement across Claude Code, Codex, and Kiro"
+  _pass "installed bundles keep workflow steering advisory and session bootstrap product-owned"
 else
-  _fail "installed bundles do not wire workflow steering consistently"
+  _fail "installed bundles do not wire prompt-submit workflow steering consistently"
 fi
 
 if [[ -f "$OPENCODE_DEST/.opencode/plugins/flow-agents.js" ]]   && node - "$OPENCODE_DEST/.opencode/plugins/flow-agents.js" <<'NODE'
@@ -881,6 +881,49 @@ else
   _fail "Codex full install lost Builder specialist role routing"
 fi
 
+echo ""
+echo "--- Packed Package Builder Entry ---"
+PACKAGE_CONSUMER="$TMPDIR_EVAL/package-consumer"
+PACKAGE_PROJECT="$TMPDIR_EVAL/package-project"
+PACKAGE_AMBIENT="$TMPDIR_EVAL/package-ambient"
+mkdir -p "$PACKAGE_CONSUMER" "$PACKAGE_PROJECT/.kontourai/flow-agents" "$PACKAGE_AMBIENT/kits/builder/flows"
+cat >"$PACKAGE_AMBIENT/kits/builder/flows/build.flow.json" <<'JSON'
+{
+  "id": "builder.build",
+  "version": "poison-ambient-cwd",
+  "steps": [{ "id": "ambient-poison", "next": null }],
+  "gates": {}
+}
+JSON
+PACKAGE_PACK_LOG="$TMPDIR_EVAL/package-pack.log"
+if (cd "$ROOT_DIR" && npm pack --silent --pack-destination "$TMPDIR_EVAL" >"$PACKAGE_PACK_LOG") \
+  && PACKAGE_TARBALL="$(find "$TMPDIR_EVAL" -maxdepth 1 -type f -name 'kontourai-flow-agents-*.tgz' -print -quit)" \
+  && [[ -n "$PACKAGE_TARBALL" ]] \
+  && npm install --silent --no-audit --no-fund --ignore-scripts --prefix "$PACKAGE_CONSUMER" "$PACKAGE_TARBALL" \
+  && (cd "$PACKAGE_AMBIENT" && node "$PACKAGE_CONSUMER/node_modules/@kontourai/flow-agents/build/src/cli/workflow-sidecar.js" ensure-session \
+    --artifact-root "$PACKAGE_PROJECT/.kontourai/flow-agents" \
+    --task-slug packed-builder-entry \
+    --actor packed-package-consumer \
+    --title "Packed Builder entry" \
+    --summary "Installed package should project pickup-probe." \
+    --flow-id builder.build >/dev/null 2>&1) \
+  && node - "$PACKAGE_PROJECT" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const project = process.argv[2];
+const state = JSON.parse(fs.readFileSync(path.join(project, '.kontourai', 'flow-agents', 'packed-builder-entry', 'state.json'), 'utf8'));
+const flow = JSON.parse(fs.readFileSync(path.join(project, '.kontourai', 'flow', 'runs', 'packed-builder-entry', 'state.json'), 'utf8'));
+const bundle = JSON.parse(fs.readFileSync(path.join(project, '.kontourai', 'flow-agents', 'packed-builder-entry', 'trust.bundle'), 'utf8'));
+if (flow.current_step !== 'design-probe' || state.flow_run?.current_step !== 'design-probe') process.exit(1);
+if (JSON.stringify(state.next_action?.skills) !== JSON.stringify(['pickup-probe'])) process.exit(1);
+if (!(bundle.claims || []).some((claim) => claim.claimType === 'builder.pull-work.selected' && claim.status === 'verified')) process.exit(1);
+NODE
+then
+  _pass "packed npm consumer ignores unrelated ambient Flow definitions and projects pickup-probe"
+else
+  _fail "packed npm consumer did not execute canonical Builder entry"
+fi
+
 if [[ -d "$CODEX_FULL_DEST/.codex/skills/plan-work" && -d "$CODEX_FULL_DEST/.codex/skills/deliver" && -d "$CODEX_FULL_DEST/.codex/skills/agentic-engineering" ]]; then
   _pass "Codex full install ships kit-skills and standalone skills together"
 else

package/evals/integration/test_current_json_per_actor.sh

@@ -117,7 +117,7 @@ fi
 # --- 2. actor A's own current resolution is unaffected by actor B's later call (AC7) ----------
 echo "--- 2. actor A's current resolution survives actor B's later, unrelated ensure-session (AC7) ---"
 
-AC7_ROOT="$TMPDIR_EVAL/ac7-artifact-root"
+AC7_ROOT="$TMPDIR_EVAL/ac7-project/.kontourai/flow-agents"
 
 flow_agents_node "workflow-sidecar" ensure-session \
   --artifact-root "$AC7_ROOT" \
@@ -370,13 +370,14 @@ set -e
 # --- 5. record-gate-claim resolves A's own per-actor flow/step, not B's legacy pointer (AC11) --
 echo "--- 5. record-gate-claim resolves A's own per-actor flow/step, not B's legacy pointer (AC11) ---"
 
-AC11_ROOT="$TMPDIR_EVAL/ac11-artifact-root"
+AC11_ROOT="$TMPDIR_EVAL/ac11-project/.kontourai/flow-agents"
 
 flow_agents_node "workflow-sidecar" ensure-session \
   --artifact-root "$AC11_ROOT" \
   --task-slug gate-actor-a \
   --actor eval-actor-a-session \
   --flow-id builder.build \
+  --skip-ownership-guard \
   --source-request "Actor A is active on a FlowDefinition-driven session." \
   --summary "Actor A, builder.build, pull-work step." \
   --timestamp "2026-07-01T00:00:00Z" \

package/evals/integration/test_dual_emit_flow_step.sh

@@ -34,7 +34,7 @@ cleanup() { rm -rf "$TMP"; }
 trap cleanup EXIT
 
 WRITER="workflow-sidecar"
-SESSION_ROOT="$TMP/.flow-agents"
+SESSION_ROOT="$TMP/.kontourai/flow-agents"
 
 echo "── P-a resolver unit checks ──"
 
@@ -258,6 +258,7 @@ if flow_agents_node "$WRITER" ensure-session \
   --artifact-root "$SESSION_ROOT" \
   --task-slug dual-emit-test \
   --flow-id builder.build \
+  --skip-ownership-guard \
   --title "Declared-Only Test" \
   --summary "Test declared-only emit for ADR 0016 P-d." \
   --criterion "Tests pass" \
@@ -269,11 +270,25 @@ fi
 
 DUAL_DIR="$SESSION_ROOT/dual-emit-test"
 
-flow_agents_node "$WRITER" advance-state "$DUAL_DIR" \
-  --status in_progress --phase verification \
-  --summary "Testing declared-only verify claims." --next-action "Record evidence." \
-  --flow-definition builder.build \
-  --timestamp "2026-06-26T00:00:30Z" >/dev/null 2>&1
+advance_builder_to_verify() {
+  local session_dir="$1"
+  flow_agents_node "$WRITER" record-gate-claim "$session_dir" --status pass --expectation selected-work \
+    --summary "Selected the fixture Work Item." --timestamp "2026-06-26T00:00:10Z" >/dev/null 2>&1 \
+    && flow_agents_node "$WRITER" record-gate-claim "$session_dir" --status pass --expectation pickup-probe-readiness \
+      --summary "Pickup readiness is established." --timestamp "2026-06-26T00:00:20Z" >/dev/null 2>&1 \
+    && flow_agents_node "$WRITER" record-gate-claim "$session_dir" --status pass --expectation probe-decisions-or-accepted-gaps \
+      --summary "Probe decisions are recorded." --timestamp "2026-06-26T00:00:30Z" >/dev/null 2>&1 \
+    && flow_agents_node "$WRITER" record-gate-claim "$session_dir" --status pass --expectation implementation-plan \
+      --summary "Implementation plan is recorded." --timestamp "2026-06-26T00:00:40Z" >/dev/null 2>&1 \
+    && flow_agents_node "$WRITER" record-gate-claim "$session_dir" --status pass --expectation implementation-scope \
+      --summary "Implementation scope is recorded." --timestamp "2026-06-26T00:00:50Z" >/dev/null 2>&1
+}
+
+if advance_builder_to_verify "$DUAL_DIR"; then
+  _pass "canonical Builder Flow advances through required gates to verify"
+else
+  _fail "canonical Builder Flow did not reach verify"
+fi
 
 # Verify current.json carries the flow keys
 if node -e "
@@ -328,8 +343,27 @@ fi
 echo ""
 echo "── P-d declared-only: policy-kind check maps to builder.verify.policy-compliance ──"
 
-# Record a policy check with the same flow context
-if flow_agents_node "$WRITER" record-evidence "$DUAL_DIR" \
+# Use a separate canonical run because the failing tests evidence above legitimately
+# routes its run back to execute before this independent producer assertion.
+if flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$SESSION_ROOT" \
+  --task-slug dual-emit-policy \
+  --flow-id builder.build \
+  --skip-ownership-guard \
+  --title "Declared Policy Test" \
+  --summary "Test declared-only policy emit for ADR 0016 P-d." \
+  --criterion "Policy passes" \
+  --timestamp "2026-06-26T00:01:30Z" >/dev/null 2>&1 \
+  && advance_builder_to_verify "$SESSION_ROOT/dual-emit-policy"; then
+  _pass "policy fixture canonical Builder Flow reaches verify"
+else
+  _fail "policy fixture canonical Builder Flow did not reach verify"
+fi
+
+POLICY_DIR="$SESSION_ROOT/dual-emit-policy"
+POLICY_BUNDLE="$POLICY_DIR/trust.bundle"
+
+if flow_agents_node "$WRITER" record-evidence "$POLICY_DIR" \
   --verdict pass \
   --check-json '{"id":"policy-check","kind":"policy","status":"pass","summary":"Policy compliance passed"}' \
   --timestamp "2026-06-26T00:02:00Z" >"$TMP/policy-evidence.out" 2>"$TMP/policy-evidence.err"; then
@@ -340,7 +374,7 @@ fi
 
 if node -e "
 const fs = require('fs');
-const bundle = JSON.parse(fs.readFileSync('${BUNDLE}', 'utf8'));
+const bundle = JSON.parse(fs.readFileSync('${POLICY_BUNDLE}', 'utf8'));
 const claims = bundle.claims;
 // Declared claim for policy kind should be builder.verify.policy-compliance
 const policyDeclared = claims.find(c => c.claimType === 'builder.verify.policy-compliance');