@kontourai/flow-agents 3.6.0 → 3.7.0

package/src/cli/assignment-provider.ts

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { randomBytes } from "node:crypto";
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import { parseArgs, flagString, type ParsedArgs } from "../lib/args.js";
@@ -309,18 +310,28 @@ function subjectLockDir(artifactRoot: string, subjectId: string): string {
   return path.join(assignmentDir, `.${sanitized}.lockdir`);
 }
 
+// Lock age is adjudicated by the current contender, never by metadata written
+// by the lock owner. The environment is only an operator tuning input; clamp it
+// so a caller cannot turn a transient owner-file write into immediate takeover.
+const SUBJECT_LOCK_STALE_MIN_MS = 1_000;
+const SUBJECT_LOCK_STALE_MAX_MS = 30 * 60 * 1_000;
+const SUBJECT_LOCK_STALE_DEFAULT_MS = 5 * 60 * 1_000;
+
+function trustedSubjectLockStaleMs(): number {
+  const configured = Number(process.env.FLOW_AGENTS_ASSIGNMENT_STALE_LOCK_MS);
+  if (!Number.isFinite(configured)) return SUBJECT_LOCK_STALE_DEFAULT_MS;
+  return Math.min(SUBJECT_LOCK_STALE_MAX_MS, Math.max(SUBJECT_LOCK_STALE_MIN_MS, Math.floor(configured)));
+}
+
 /**
  * F1 fix (fix-plan iteration 1, CRITICAL): claimLocalFile/releaseLocalFile/supersedeLocalFile were
  * a plain read -> compare-actor -> write with no lock, so two concurrently-launched OS processes
  * could both read "no conflicting claim" before either wrote, and the second write would silently
  * clobber the first with zero error and zero audit-trail entry for the loser (reproduced 29/40
- * races against the built CLI). This mirrors the EXACT mechanism `withLock` already uses in
- * workflow-sidecar.ts:908 for the same class of shared-state mutation — atomic `fs.mkdirSync`
- * lockdir create as the mutual-exclusion primitive, EEXIST-spin with a staleness-reclaim check
- * (a lock directory older than the stale threshold is presumed abandoned by a crashed process and
- * is reclaimed rather than waited on forever) and a bounded deadline, `finally` rmSync release —
- * as a small LOCAL helper (not a cross-import of that private function, which would pull the
- * entire workflow-sidecar module in for one primitive). Deliberately synchronous (sleepSync's
+ * races against the built CLI). Atomic directory creation establishes ownership before metadata
+ * is written; contenders treat even an ownerless directory as held. Live contention waits with a
+ * bounded deadline; stale or malformed residue fails closed for explicit operator cleanup because portable Node
+ * filesystem APIs cannot compare-and-swap a directory identity safely. Deliberately synchronous (sleepSync's
  * Atomics.wait spin, not setTimeout/await) so claim/release/supersede can stay sync `number`
  * -returning functions and the CLI dispatcher (src/cli.ts, `number | Promise<number>`) does not
  * need any ripple to async. On lock-acquire failure (any error other than a live contested lock,
@@ -331,22 +342,31 @@ function subjectLockDir(artifactRoot: string, subjectId: string): string {
  */
 export function withSubjectLock<T>(artifactRoot: string, subjectId: string, body: () => T): T {
   const lockDir = subjectLockDir(artifactRoot, subjectId);
-  const staleMs = Number(process.env.FLOW_AGENTS_ASSIGNMENT_STALE_LOCK_MS ?? 5 * 60 * 1000);
+  const staleMs = trustedSubjectLockStaleMs();
+  const token = randomBytes(16).toString("hex");
+  const ownerFile = path.join(lockDir, "owner.json");
   const deadline = Date.now() + 30000;
   while (true) {
+    let createdLockDir = false;
     try {
       fs.mkdirSync(lockDir);
+      createdLockDir = true;
+      fs.writeFileSync(ownerFile, `${JSON.stringify({ token, pid: process.pid, acquired_at: isoNow() })}\n`, { flag: "wx", mode: 0o600 });
       break;
     } catch (error) {
       const lockError = error as NodeJS.ErrnoException;
+      if (createdLockDir) fs.rmSync(lockDir, { recursive: true, force: true });
       if (lockError.code !== "EEXIST") {
         throw new Error(`failed to acquire assignment lock for subject ${subjectId}: ${lockDir}: ${lockError.message || lockError.code || String(lockError)}`);
       }
       try {
-        const stat = fs.statSync(lockDir);
-        if (staleMs > 0 && Date.now() - stat.mtimeMs > staleMs) {
-          fs.rmSync(lockDir, { recursive: true, force: true });
-          continue;
+        const owner = readSubjectLockOwner(ownerFile);
+        const stat = fs.lstatSync(owner?.token ? ownerFile : lockDir);
+        if (stat.isSymbolicLink() || !(owner?.token ? stat.isFile() : stat.isDirectory())) {
+          throw new Error(`assignment lock has an unsafe ${owner?.token ? "owner file" : "directory"}: ${lockDir}`);
+        }
+        if (Date.now() - stat.mtimeMs > staleMs) {
+          throw new Error(`assignment lock is stale or malformed and requires explicit operator cleanup after confirming no owner is active: ${lockDir}`);
         }
       } catch (statError) {
         if ((statError as NodeJS.ErrnoException).code === "ENOENT") continue; // lock released between mkdir/EEXIST and stat; retry immediately
@@ -358,7 +378,12 @@ export function withSubjectLock<T>(artifactRoot: string, subjectId: string, body
       sleepSync(20);
     }
   }
-  const release = (): void => fs.rmSync(lockDir, { recursive: true, force: true });
+  let heartbeat: NodeJS.Timeout | undefined;
+  const ownsLock = (): boolean => readSubjectLockOwner(ownerFile)?.token === token;
+  const release = (): void => {
+    if (heartbeat) clearInterval(heartbeat);
+    if (ownsLock()) fs.rmSync(lockDir, { recursive: true, force: true });
+  };
   let result: T;
   try {
     result = body();
@@ -367,12 +392,36 @@ export function withSubjectLock<T>(artifactRoot: string, subjectId: string, body
     throw error;
   }
   if (result && typeof (result as { then?: unknown }).then === "function") {
+    // An async owner can legitimately hold the lock longer than the stale-lock
+    // threshold while an authority-bound command is running. Keep its mtime fresh
+    // so lifecycle operations and takeovers continue to observe the live lock.
+    const heartbeatMs = Math.max(10, Math.min(1_000, Math.floor(staleMs > 0 ? staleMs / 3 : 1_000)));
+    heartbeat = setInterval(() => {
+      try {
+        if (!ownsLock()) return;
+        const timestamp = new Date();
+        fs.utimesSync(ownerFile, timestamp, timestamp);
+        fs.utimesSync(lockDir, timestamp, timestamp);
+      } catch { /* release, reclamation, or process teardown owns cleanup */ }
+    }, heartbeatMs);
     return Promise.resolve(result).finally(release) as T;
   }
   release();
   return result;
 }
 
+function readSubjectLockOwner(file: string): { token?: string } | null {
+  try {
+    const value = JSON.parse(fs.readFileSync(file, "utf8")) as unknown;
+    return value && typeof value === "object" && !Array.isArray(value)
+      ? value as { token?: string }
+      : null;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT" || error instanceof SyntaxError) return null;
+    throw error;
+  }
+}
+
 /**
  * The assignment ⋈ liveness join (contract doc's "assignment ⋈ liveness join" section, ADR 0021
  * §1). Pure function: `{ assignment, freshHoldersList, selfActor, nowMs }` -> one of five

package/src/cli/builder-flow-run-adapter.test.mjs

@@ -17,7 +17,7 @@ import {
   BUILDER_BUILD_FLOW_ID,
   evaluateBuilderBuildRun,
   startBuilderBuildRun,
-} from "../../build/src/index.js";
+} from "../../build/src/builder-flow-run-adapter.js";
 
 const REPO_ROOT = path.resolve(import.meta.dirname, "../..");
 const BUILDER_BUILD_DEFINITION = path.join(REPO_ROOT, "kits/builder/flows/build.flow.json");
@@ -245,6 +245,8 @@ test("all verified parent selectors advance only their persisted gates through p
       subjectType: "flow-step",
       name: "verify-all-selectors",
       bundle: trustBundle({ claims: [
+        claim("workflow.critique.review", "workflow-critique"),
+        claim("workflow.acceptance.criterion", "flow-step"),
         claim("builder.verify.tests", "flow-step"),
         claim("builder.verify.policy-compliance", "artifact"),
       ] }),
@@ -271,7 +273,7 @@ test("all verified parent selectors advance only their persisted gates through p
     { gate_id: "design-probe-gate", status: "pass", matched_expectations: ["pickup-probe-readiness", "probe-decisions-or-accepted-gaps"] },
     { gate_id: "plan-gate", status: "pass", matched_expectations: ["implementation-plan"] },
     { gate_id: "execute-gate", status: "pass", matched_expectations: ["implementation-scope"] },
-    { gate_id: "verify-gate", status: "pass", matched_expectations: ["tests-evidence", "policy-compliance"] },
+    { gate_id: "verify-gate", status: "pass", matched_expectations: ["clean-critique", "acceptance-criteria", "tests-evidence", "policy-compliance"] },
     { gate_id: "merge-ready-gate", status: "pass", matched_expectations: ["merge-readiness"] },
   ]);
 });

package/src/cli/builder-flow-runtime.test.mjs

@@ -3,12 +3,13 @@ import assert from "node:assert/strict";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { generateKeyPairSync, sign } from "node:crypto";
+import { createHash, generateKeyPairSync, sign } from "node:crypto";
 
 import { FLOW_RUN_EVIDENCE_MANIFEST_PATH, runDir } from "@kontourai/flow";
 import {
   archiveBuilderFlowSession,
   cancelBuilderFlowSession,
+  captureReviewWorkspaceSnapshot,
   pauseBuilderFlowSession,
   recoverBuilderFlowSession,
   releaseBuilderFlowAssignment,
@@ -20,6 +21,7 @@ import { builderLifecycleAuthorizationPayload, loadBuilderLifecycleAuthorization
 import { cancelBuilderBuildRun } from "../../build/src/builder-flow-run-adapter.js";
 import { performLocalClaim, readLocalAssignmentStatus, resolveCurrentAssignmentActor } from "../../build/src/cli/assignment-provider.js";
 import { main as builderRunMain } from "../../build/src/cli/builder-run.js";
+import { inferExecutedTestCount } from "../../build/src/cli/workflow-sidecar.js";
 
 const SUBJECT = "local:work-item/runtime-projection";
 const NOW = "2026-07-09T20:00:00.000Z";
@@ -51,6 +53,9 @@ function makeSession(slug = "runtime-projection") {
     schema_version: "1.0",
     keys: [{ id: AUTHORITY_KEY_ID, algorithm: "ed25519", public_key_pem: AUTHORITY_KEYS.publicKey.export({ type: "spki", format: "pem" }) }],
   });
+  fs.mkdirSync(path.join(projectRoot, "review-target"), { recursive: true });
+  fs.writeFileSync(path.join(projectRoot, "review-target", "implementation.txt"), "reviewed implementation\n");
+  fs.writeFileSync(path.join(projectRoot, "review-target", "delivery.md"), "reviewed delivery artifact\n");
   return { projectRoot, artifactRoot, sessionDir, slug };
 }
 
@@ -59,6 +64,15 @@ function writeJson(file, value) {
   fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
 }
 
+test("shell output cannot spoof an executed-test count", () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "flow-agents-test-count-"));
+  fs.mkdirSync(path.join(root, "checks"), { recursive: true });
+  fs.writeFileSync(path.join(root, "checks", "fake-test.sh"), "#!/bin/sh\nset -e\nprintf '1 passed\\n'\n");
+  fs.writeFileSync(path.join(root, "checks", "real-test.sh"), "#!/bin/sh\nset -e\ntest -f checks/real-test.sh\n");
+  assert.equal(inferExecutedTestCount("sh checks/fake-test.sh", root, "1 passed\n"), 0);
+  assert.equal(inferExecutedTestCount("sh checks/real-test.sh", root, "1..1\nok 1 - file exists\n"), 1);
+});
+
 function readJson(file) {
   return JSON.parse(fs.readFileSync(file, "utf8"));
 }
@@ -200,7 +214,7 @@ async function assertRecoveryRejectsWithoutWrites(session, pattern) {
   assert.deepEqual(snapshotProjectionTargets(session), beforeProjection);
 }
 
-function bundleClaim({ expectation, claimType, subjectType, status = "pass", routeReason, subject = SUBJECT }) {
+function bundleClaim({ expectation, claimType, subjectType, status = "pass", routeReason, subject = SUBJECT, testCount = 1, timestamp = NOW }) {
   const claimId = `claim.${expectation}`;
   return {
     claim: {
@@ -212,6 +226,11 @@ function bundleClaim({ expectation, claimType, subjectType, status = "pass", rou
       value: status,
       metadata: {
         workflow_subject_ref: subject,
+        ...(expectation === "tests-evidence" ? {
+          recorded_by: "implementation-actor",
+          artifact_refs: [{ kind: "command", excerpt: "node --test src/cli/builder-flow-runtime.test.mjs", summary: "Runtime fixture assertion." }],
+          observed_commands: [{ command: "node --test src/cli/builder-flow-runtime.test.mjs", exit_code: 0, test_count: testCount, output_sha256: "0".repeat(64) }],
+        } : {}),
         gate_claim: {
           expectation_id: expectation,
           claim_type: claimType,
@@ -219,8 +238,8 @@ function bundleClaim({ expectation, claimType, subjectType, status = "pass", rou
           ...(routeReason ? { route_reason: routeReason } : {}),
         },
       },
-      createdAt: NOW,
-      updatedAt: NOW,
+      createdAt: timestamp,
+      updatedAt: timestamp,
     },
     evidence: {
       id: `evidence.${expectation}`,
@@ -229,7 +248,7 @@ function bundleClaim({ expectation, claimType, subjectType, status = "pass", rou
       method: "attestation",
       sourceRef: "src/cli/builder-flow-runtime.test.mjs",
       excerptOrSummary: `${expectation} fixture`,
-      observedAt: NOW,
+      observedAt: timestamp,
       collectedBy: "flow-agents-test",
     },
     event: {
@@ -239,10 +258,47 @@ function bundleClaim({ expectation, claimType, subjectType, status = "pass", rou
       actor: "flow-agents-test",
       method: "attestation",
       evidenceIds: [`evidence.${expectation}`],
-      createdAt: NOW,
-      verifiedAt: NOW,
+      createdAt: timestamp,
+      verifiedAt: timestamp,
+    },
+  };
+}
+
+function verifiedTestsPrerequisites(session, timestamp = NOW) {
+  const reviewArtifact = path.join(session.projectRoot, "review-target", "delivery.md");
+  const implementation = path.join(session.projectRoot, "review-target", "implementation.txt");
+  const implementationFile = path.relative(session.projectRoot, implementation);
+  const implementationBytes = fs.readFileSync(implementation);
+  const implementationSha256 = createHash("sha256").update(implementationBytes).digest("hex");
+  const workspaceDigest = createHash("sha256")
+    .update("flow-agents:reviewed-files:v1\0")
+    .update(implementationFile).update("\0").update(implementationBytes).update("\0")
+    .digest("hex");
+  const critique = bundleClaim({ expectation: "clean-critique", claimType: "workflow.critique.review", subjectType: "workflow-critique", timestamp });
+  critique.claim.metadata = {
+    workflow_subject_ref: SUBJECT,
+    origin: "critique",
+    reviewer: "reviewer-actor",
+    findings: [],
+    lanes: [{ id: "code", status: "pass" }],
+    review_target: {
+      artifacts: [{ file: path.relative(session.projectRoot, reviewArtifact), sha256: createHash("sha256").update(fs.readFileSync(reviewArtifact)).digest("hex") }],
+      workspace_snapshot: {
+        version: 1,
+        kind: "reviewed-files",
+        algorithm: "sha256",
+        digest: workspaceDigest,
+        files: [{ file: implementationFile, sha256: implementationSha256 }],
+      },
     },
   };
+  const criterion = bundleClaim({ expectation: "verified-criterion", claimType: "workflow.acceptance.criterion", subjectType: "flow-step", timestamp });
+  criterion.claim.metadata = {
+    workflow_subject_ref: SUBJECT,
+    origin: "acceptance",
+    criterion: { id: "ac-runtime", status: "pass", evidence_refs: [{ kind: "command", excerpt: "node --test src/cli/builder-flow-runtime.test.mjs", summary: "Runtime fixture assertion." }] },
+  };
+  return [critique, criterion];
 }
 
 function writeBundle(sessionDir, entries) {
@@ -291,6 +347,53 @@ test("small-model client can start and advance from projected actions without ch
   assert.equal(duplicate.run.manifest.evidence.length, advanced.run.manifest.evidence.length);
 });
 
+test("sync attaches the staged trust.bundle bytes when the session bundle is replaced", async () => {
+  const session = makeSession("snapshot-attachment");
+  await startBuilderFlowSession({ sessionDir: session.sessionDir });
+  const originalEntries = [bundleClaim({ expectation: "selected-work", claimType: "builder.pull-work.selected", subjectType: "work-item" })];
+  writeBundle(session.sessionDir, originalEntries);
+  const bundleFile = path.join(session.sessionDir, "trust.bundle");
+  const originalDigest = createHash("sha256").update(fs.readFileSync(bundleFile)).digest("hex");
+  let replaceBundle;
+  const replaced = new Promise((resolve) => { replaceBundle = resolve; });
+  const watcher = fs.watch(session.sessionDir, (_event, filename) => {
+    if (String(filename) !== ".trust-bundle-snapshots") return;
+    fs.writeFileSync(bundleFile, "{\"claims\":[]}");
+    replaceBundle();
+  });
+  try {
+    const syncing = syncBuilderFlowSession({ sessionDir: session.sessionDir });
+    await Promise.race([
+      replaced,
+      new Promise((_, reject) => setTimeout(() => reject(new Error("trust.bundle snapshot was not staged")), 2_000)),
+    ]);
+    const synced = await syncing;
+    assert.equal(synced.attached, true);
+  } finally {
+    watcher.close();
+  }
+  const manifest = readJson(path.join(runDir(session.slug, session.projectRoot), FLOW_RUN_EVIDENCE_MANIFEST_PATH));
+  assert.equal(manifest.evidence.at(-1).sha256, originalDigest);
+  assert.equal(fs.existsSync(path.join(session.sessionDir, ".trust-bundle-snapshots")), false);
+});
+
+test("start rejects a requested Builder flow that differs from the existing run before projection mutation", async (t) => {
+  for (const [existingFlowId, requestedFlowId] of [["builder.shape", "builder.build"], ["builder.build", "builder.shape"]]) {
+    await t.test(`${existingFlowId} cannot resume as ${requestedFlowId}`, async () => {
+      const session = makeSession(`flow-mismatch-${existingFlowId.replace('.', '-')}`);
+      await startBuilderFlowSession({ sessionDir: session.sessionDir, flowId: existingFlowId });
+      const beforeFlow = snapshotTree(runDir(session.slug, session.projectRoot));
+      const beforeProjection = snapshotProjectionTargets(session);
+      await assert.rejects(
+        () => startBuilderFlowSession({ sessionDir: session.sessionDir, flowId: requestedFlowId }),
+        new RegExp(`requested ${requestedFlowId} does not match the existing ${existingFlowId} run`),
+      );
+      assert.deepEqual(snapshotTree(runDir(session.slug, session.projectRoot)), beforeFlow);
+      assert.deepEqual(snapshotProjectionTargets(session), beforeProjection);
+    });
+  }
+});
+
 test("pause and resume preserve the current Flow step and active assignment", async () => {
   const session = makeSession("lifecycle-pause-resume");
   claimAmbientSessionAssignment(session);
@@ -546,6 +649,8 @@ test("builder-run exposes lifecycle actions without caller-selected Flow identit
   const ambient = resolveCurrentAssignmentActor();
   performLocalClaim(session.artifactRoot, session.slug, ambient.actor, { actorKey: ambient.actorKey, ttlSeconds: 1800, branch: `agent/${session.slug}`, artifactDir: session.sessionDir, workItemRef: SUBJECT, reason: "test" });
   await startBuilderFlowSession({ sessionDir: session.sessionDir });
+  assert.equal(await builderRunMain(["start", "--session-dir", session.sessionDir]), 64);
+  assert.equal(await builderRunMain(["sync", "--session-dir", session.sessionDir]), 64);
   assert.equal(await builderRunMain([
     "pause", "--session-dir", session.sessionDir,
     "--reason", "cli pause",
@@ -644,6 +749,87 @@ test("failed verification projects Flow-owned route-back attempt and budget", as
   assert.equal(routed.projection.flow_run.route_back_max_attempts, 3);
   assert.match(routed.projection.next_action.summary, /Route-back history: attempt 1\/3 returned to `execute` for `implementation_defect`/);
   assert.deepEqual(routed.projection.next_action.skills, ["execute-plan"]);
+
+  const reentered = await writeAndSync(session, [bundleClaim({
+    expectation: "implementation-scope",
+    claimType: "builder.execute.scope",
+    subjectType: "change",
+    timestamp: new Date().toISOString(),
+  })]);
+  assert.equal(reentered.run.state.current_step, "verify");
+  const correctedAt = new Date(Date.parse(reentered.run.state.transitions.at(-1).at) + 1).toISOString();
+  const corrected = await writeAndSync(session, [
+    bundleClaim({ expectation: "tests-evidence", claimType: "builder.verify.tests", subjectType: "flow-step", timestamp: correctedAt }),
+    ...verifiedTestsPrerequisites(session, correctedAt),
+  ]);
+  assert.equal(corrected.run.state.current_step, "merge-ready");
+  const verifyEvidence = corrected.run.manifest.evidence.filter((entry) => entry.gate_id === "verify-gate");
+  assert.equal(verifyEvidence.length, 2);
+  assert.equal(verifyEvidence[0].superseded_by, verifyEvidence[1].id);
+});
+
+test("passing tests-evidence rejects a critique whose reviewed artifact changed", async () => {
+  const session = makeSession("stale-critique-artifact");
+  await startBuilderFlowSession({ sessionDir: session.sessionDir });
+  await writeAndSync(session, [bundleClaim({ expectation: "selected-work", claimType: "builder.pull-work.selected", subjectType: "work-item" })]);
+  await writeAndSync(session, [
+    bundleClaim({ expectation: "pickup-probe-readiness", claimType: "builder.design-probe.pickup-readiness", subjectType: "work-item" }),
+    bundleClaim({ expectation: "probe-decisions-or-accepted-gaps", claimType: "builder.design-probe.decisions", subjectType: "decision" }),
+  ]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-plan", claimType: "builder.plan.implementation", subjectType: "artifact" })]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-scope", claimType: "builder.execute.scope", subjectType: "change" })]);
+  const prerequisites = verifiedTestsPrerequisites(session);
+  fs.writeFileSync(path.join(session.projectRoot, "review-target", "delivery.md"), "changed after review\n");
+  await assert.rejects(
+    () => writeAndSync(session, [bundleClaim({ expectation: "tests-evidence", claimType: "builder.verify.tests", subjectType: "flow-step" }), ...prerequisites]),
+    /review_target\.artifacts\.sha256.*does not match/,
+  );
+});
+
+test("passing tests-evidence rejects a successful command that executed zero tests", async () => {
+  const session = makeSession("zero-test-evidence");
+  await startBuilderFlowSession({ sessionDir: session.sessionDir });
+  await writeAndSync(session, [bundleClaim({ expectation: "selected-work", claimType: "builder.pull-work.selected", subjectType: "work-item" })]);
+  await writeAndSync(session, [
+    bundleClaim({ expectation: "pickup-probe-readiness", claimType: "builder.design-probe.pickup-readiness", subjectType: "work-item" }),
+    bundleClaim({ expectation: "probe-decisions-or-accepted-gaps", claimType: "builder.design-probe.decisions", subjectType: "decision" }),
+  ]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-plan", claimType: "builder.plan.implementation", subjectType: "artifact" })]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-scope", claimType: "builder.execute.scope", subjectType: "change" })]);
+  await assert.rejects(
+    () => writeAndSync(session, [
+      bundleClaim({ expectation: "tests-evidence", claimType: "builder.verify.tests", subjectType: "flow-step", testCount: 0 }),
+      ...verifiedTestsPrerequisites(session),
+    ]),
+    /positive executed-test count/,
+  );
+});
+
+test("passing tests-evidence rejects a critique after implementation source changed", async () => {
+  const session = makeSession("stale-critique-workspace");
+  await startBuilderFlowSession({ sessionDir: session.sessionDir });
+  await writeAndSync(session, [bundleClaim({ expectation: "selected-work", claimType: "builder.pull-work.selected", subjectType: "work-item" })]);
+  await writeAndSync(session, [
+    bundleClaim({ expectation: "pickup-probe-readiness", claimType: "builder.design-probe.pickup-readiness", subjectType: "work-item" }),
+    bundleClaim({ expectation: "probe-decisions-or-accepted-gaps", claimType: "builder.design-probe.decisions", subjectType: "decision" }),
+  ]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-plan", claimType: "builder.plan.implementation", subjectType: "artifact" })]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-scope", claimType: "builder.execute.scope", subjectType: "change" })]);
+  const prerequisites = verifiedTestsPrerequisites(session);
+  fs.writeFileSync(path.join(session.projectRoot, "review-target", "implementation.txt"), "source changed after review\n");
+  await assert.rejects(
+    () => writeAndSync(session, [bundleClaim({ expectation: "tests-evidence", claimType: "builder.verify.tests", subjectType: "flow-step" }), ...prerequisites]),
+    /review_target\.workspace_snapshot\.digest.*does not match/,
+  );
+});
+
+test("workspace review fails closed when a Git worktree marker cannot be inspected", () => {
+  const session = makeSession("git-inspection-unavailable");
+  fs.mkdirSync(path.join(session.projectRoot, ".git"));
+  assert.throws(
+    () => captureReviewWorkspaceSnapshot(session.projectRoot, [{ file: "review-target/delivery.md", sha256: createHash("sha256").update("reviewed delivery\n").digest("hex") }]),
+    /could not inspect the Git worktree/,
+  );
 });
 
 test("verified sidecar claims drive the composed publish and learning prefix to completion", async () => {
@@ -658,7 +844,7 @@ test("verified sidecar claims drive the composed publish and learning prefix to
     ],
     [bundleClaim({ expectation: "implementation-plan", claimType: "builder.plan.implementation", subjectType: "artifact" })],
     [bundleClaim({ expectation: "implementation-scope", claimType: "builder.execute.scope", subjectType: "change" })],
-    [bundleClaim({ expectation: "tests-evidence", claimType: "builder.verify.tests", subjectType: "flow-step" })],
+    [bundleClaim({ expectation: "tests-evidence", claimType: "builder.verify.tests", subjectType: "flow-step" }), ...verifiedTestsPrerequisites(session)],
     [bundleClaim({ expectation: "merge-readiness", claimType: "builder.merge-ready.readiness", subjectType: "change" })],
   ];
   for (const entries of steps) await writeAndSync(session, entries);

package/src/cli/builder-run.ts

@@ -6,11 +6,9 @@ import {
   recoverBuilderFlowSession,
   releaseBuilderFlowAssignment,
   resumeBuilderFlowSession,
-  startBuilderFlowSession,
-  syncBuilderFlowSession,
 } from "../builder-flow-runtime.js";
 
-const USAGE = "Usage: flow-agents builder-run <start|sync|recover|pause|resume|cancel|release-assignment|archive> --session-dir <path> [--reason <text> | --authorization-file <path>]";
+const USAGE = "Usage: flow-agents builder-run <recover|pause|resume|cancel|release-assignment|archive> --session-dir <path> [--reason <text> | --authorization-file <path>]";
 
 export async function main(argv: string[]): Promise<number> {
   const parsed = parseArgs(argv);
@@ -29,7 +27,7 @@ export async function main(argv: string[]): Promise<number> {
     console.error("builder-run requires --session-dir .kontourai/flow-agents/<slug>");
     return 64;
   }
-  if (!action || !["start", "sync", "recover", "pause", "resume", "cancel", "release-assignment", "archive"].includes(action)) {
+  if (!action || !["recover", "pause", "resume", "cancel", "release-assignment", "archive"].includes(action)) {
     console.error(USAGE);
     return 64;
   }
@@ -53,11 +51,7 @@ export async function main(argv: string[]): Promise<number> {
     console.error(USAGE);
     return 64;
   }
-  const result = action === "start"
-    ? await startBuilderFlowSession({ sessionDir })
-    : action === "sync"
-      ? await syncBuilderFlowSession({ sessionDir })
-      : action === "recover"
+  const result = action === "recover"
         ? await recoverBuilderFlowSession({ sessionDir })
         : action === "pause"
           ? await pauseBuilderFlowSession({ sessionDir, reason: reason! })