@kontourai/flow-agents 3.6.0 → 3.8.0

package/evals/integration/test_critique_supersession_roundtrip.sh

@@ -48,15 +48,20 @@ seed() {
 # ─── (a) same-reviewer supersession: fail → pass ──────────────────────────────
 echo ""
 echo "=== (a) record-critique fail→pass (same reviewer) supersedes, history intact, reconcile 0 ==="
-A_AROOT="$TMP/a/aroot"; A_SLUG="supersede-same"; A_DIR="$A_AROOT/$A_SLUG"
+A_AROOT="$TMP/a/.kontourai/flow-agents"; A_SLUG="supersede-same"; A_DIR="$A_AROOT/$A_SLUG"
 seed "$A_AROOT" "$A_SLUG"
 flow_agents_node "$WRITER" record-evidence "$A_DIR" --verdict pass \
   --check-json '{"id":"c1","kind":"diff","status":"pass","summary":"diff check"}' \
   --timestamp "2026-07-01T00:01:00Z" >/dev/null 2>&1
 flow_agents_node "$WRITER" record-critique "$A_DIR" --id rv --reviewer alice --verdict fail \
-  --summary "found a bug" --timestamp "2026-07-01T00:02:00Z" >/dev/null 2>&1
+  --summary "found a bug" \
+  --lane-json "{\"id\":\"code\",\"status\":\"fail\",\"summary\":\"bug found\",\"evidence_refs\":[{\"kind\":\"artifact\",\"file\":\"$A_DIR/$A_SLUG--deliver.md\",\"summary\":\"Reviewed the failing delivery artifact.\"}]}" \
+  --timestamp "2026-07-01T00:02:00Z" >/dev/null 2>&1
 flow_agents_node "$WRITER" record-critique "$A_DIR" --id rv --reviewer alice --verdict pass \
-  --summary "bug fixed" --timestamp "2026-07-01T00:03:00Z" >/dev/null 2>&1
+  --summary "bug fixed" \
+  --lane-json "{\"id\":\"code\",\"status\":\"pass\",\"summary\":\"fix verified\",\"evidence_refs\":[{\"kind\":\"artifact\",\"file\":\"$A_DIR/$A_SLUG--deliver.md\",\"summary\":\"Reviewed the corrected delivery artifact.\"}]}" \
+  --artifact-ref "$A_DIR/$A_SLUG--deliver.md" \
+  --timestamp "2026-07-01T00:03:00Z" >/dev/null 2>&1
 
 node - "$A_DIR/trust.bundle" << 'NODE'
 const fs = require('fs');
@@ -80,7 +85,7 @@ if [[ $? -eq 0 ]]; then _pass "(a) trust-reconcile exits 0 (resolved session con
 # ─── (b) HEADLINE: --flow-id session converges ────────────────────────────────
 echo ""
 echo "=== (b) HEADLINE --flow-id builder.build/verify: mixed evidence + critique → reconcile 0 ==="
-B_AROOT="$TMP/b/aroot"; B_SLUG="flowid-converge"; B_DIR="$B_AROOT/$B_SLUG"
+B_AROOT="$TMP/b/.kontourai/flow-agents"; B_SLUG="flowid-converge"; B_DIR="$B_AROOT/$B_SLUG"
 seed "$B_AROOT" "$B_SLUG" --flow-id builder.build
 flow_agents_node "$WRITER" advance-state "$B_DIR" --status in_progress --phase verification \
   --summary "Testing at verify." --next-action "Record evidence." \
@@ -91,7 +96,10 @@ flow_agents_node "$WRITER" record-evidence "$B_DIR" --verdict pass \
   --check-json '{"id":"k-ext","kind":"external","status":"pass","summary":"attested"}' \
   --timestamp "2026-07-01T00:01:00Z" >/dev/null 2>&1
 flow_agents_node "$WRITER" record-critique "$B_DIR" --id code-review --reviewer alice --verdict pass \
-  --summary "looks good" --timestamp "2026-07-01T00:02:00Z" >/dev/null 2>&1
+  --summary "looks good" \
+  --lane-json "{\"id\":\"code\",\"status\":\"pass\",\"summary\":\"review passed\",\"evidence_refs\":[{\"kind\":\"artifact\",\"file\":\"$B_DIR/$B_SLUG--deliver.md\",\"summary\":\"Reviewed the delivery artifact.\"}]}" \
+  --artifact-ref "$B_DIR/$B_SLUG--deliver.md" \
+  --timestamp "2026-07-01T00:02:00Z" >/dev/null 2>&1
 
 node - "$B_DIR/trust.bundle" << 'NODE'
 const fs = require('fs');
@@ -132,15 +140,20 @@ if [[ $? -eq 0 ]]; then _pass "(c) critique history survives a later record-evid
 # ─── (d) ANTI-GAMING: cross-reviewer cannot supersede a reviewer fail ─────────
 echo ""
 echo "=== (d) ANTI-GAMING: a different reviewer cannot supersede a reviewer's fail ==="
-D_AROOT="$TMP/d/aroot"; D_SLUG="supersede-cross"; D_DIR="$D_AROOT/$D_SLUG"
+D_AROOT="$TMP/d/.kontourai/flow-agents"; D_SLUG="supersede-cross"; D_DIR="$D_AROOT/$D_SLUG"
 seed "$D_AROOT" "$D_SLUG"
 flow_agents_node "$WRITER" record-evidence "$D_DIR" --verdict pass \
   --check-json '{"id":"c1","kind":"diff","status":"pass","summary":"diff check"}' \
   --timestamp "2026-07-01T00:01:00Z" >/dev/null 2>&1
 flow_agents_node "$WRITER" record-critique "$D_DIR" --id rv --reviewer reviewer-bob --verdict fail \
-  --summary "reviewer found a real bug" --timestamp "2026-07-01T00:02:00Z" >/dev/null 2>&1
+  --summary "reviewer found a real bug" \
+  --lane-json "{\"id\":\"code\",\"status\":\"fail\",\"summary\":\"bug found\",\"evidence_refs\":[{\"kind\":\"artifact\",\"file\":\"$D_DIR/$D_SLUG--deliver.md\",\"summary\":\"Reviewed the failing delivery artifact.\"}]}" \
+  --timestamp "2026-07-01T00:02:00Z" >/dev/null 2>&1
 flow_agents_node "$WRITER" record-critique "$D_DIR" --id rv --reviewer worker-mallory --verdict pass \
-  --summary "worker claims fixed" --timestamp "2026-07-01T00:03:00Z" >/dev/null 2>&1
+  --summary "worker claims fixed" \
+  --lane-json "{\"id\":\"code\",\"status\":\"pass\",\"summary\":\"worker claims review passed\",\"evidence_refs\":[{\"kind\":\"artifact\",\"file\":\"$D_DIR/$D_SLUG--deliver.md\",\"summary\":\"Reviewed the claimed correction.\"}]}" \
+  --artifact-ref "$D_DIR/$D_SLUG--deliver.md" \
+  --timestamp "2026-07-01T00:03:00Z" >/dev/null 2>&1
 node - "$D_DIR/trust.bundle" << 'NODE'
 const fs = require('fs');
 const b = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));

package/evals/integration/test_current_json_per_actor.sh

@@ -371,6 +371,7 @@ set -e
 echo "--- 5. record-gate-claim resolves A's own per-actor flow/step, not B's legacy pointer (AC11) ---"
 
 AC11_ROOT="$TMPDIR_EVAL/ac11-project/.kontourai/flow-agents"
+AC11_WORK_ITEM="local:gate-actor-a"
 
 flow_agents_node "workflow-sidecar" ensure-session \
   --artifact-root "$AC11_ROOT" \
@@ -388,6 +389,16 @@ flow_agents_node "workflow-sidecar" init-plan "$AC11_DELIVER_MD" \
   --source-request "Test" --summary "Testing" \
   --timestamp "2026-07-01T00:00:30Z" >"$TMPDIR_EVAL/ac11-a-initplan.out" 2>"$TMPDIR_EVAL/ac11-a-initplan.err"
 
+# A passing selected-work claim must cite pull-work's declared durable artifact. Keep it in A's
+# session so the generic producer/evidence contract is exercised without weakening AC11's
+# per-actor pointer differential.
+AC11_PULL_WORK_ARTIFACT="$AC11_ROOT/gate-actor-a/gate-actor-a--pull-work.md"
+safe_write "$AC11_PULL_WORK_ARTIFACT" <<EOF
+# Pull Work
+
+Selected Work Item: $AC11_WORK_ITEM
+EOF
+
 # Actor B runs a LATER, plain (non-FlowDefinition) ensure-session on an unrelated subject on the
 # SAME artifact root -- this overwrites the LEGACY global current.json (last-writer-wins, no
 # active_flow_id/active_step_id at all) while leaving actor A's own per-actor current file
@@ -416,6 +427,7 @@ if flow_agents_node "workflow-sidecar" record-gate-claim "$AC11_GATE_ACTOR_A_DIR
   --status pass \
   --summary "Selected issue #291 for implementation." \
   --expectation selected-work \
+  --evidence-ref-json "{\"kind\":\"artifact\",\"file\":\"$AC11_PULL_WORK_ARTIFACT\",\"summary\":\"Declared pull-work artifact naming bound Work Item $AC11_WORK_ITEM.\"}" \
   --timestamp "2026-07-01T00:02:00Z" \
   >"$TMPDIR_EVAL/ac11-gate-claim.out" 2>"$TMPDIR_EVAL/ac11-gate-claim.err"; then
   pass "record-gate-claim (actor A) succeeds by resolving A's OWN per-actor current pointer, not B's stale legacy pointer (AC11)"

package/evals/integration/test_dual_emit_flow_step.sh

@@ -251,43 +251,71 @@ fi
 echo ""
 echo "── P-d declared-only: session WITH active_flow_id=builder.build / active_step_id=verify ──"
 
-# Create a session at the declared first step, then use the transition surface to
-# establish the verify-state fixture exercised by this producer test.
+# Each fixture starts at the declared first step with selected-work evidence,
+# then advances by recording the durable artifacts that the declared producers
+# require. current.json is only projected by the writer during those transitions.
 mkdir -p "$SESSION_ROOT"
-if flow_agents_node "$WRITER" ensure-session \
-  --artifact-root "$SESSION_ROOT" \
-  --task-slug dual-emit-test \
-  --flow-id builder.build \
-  --skip-ownership-guard \
-  --title "Declared-Only Test" \
-  --summary "Test declared-only emit for ADR 0016 P-d." \
-  --criterion "Tests pass" \
-  --timestamp "2026-06-26T00:00:00Z" >"$TMP/ensure.out" 2>"$TMP/ensure.err"; then
-  _pass "ensure-session with --flow-id succeeds at the declared first step"
-else
-  _fail "ensure-session with --flow-id failed: $(cat "$TMP/ensure.out" "$TMP/ensure.err")"
-fi
-
-DUAL_DIR="$SESSION_ROOT/dual-emit-test"
 
 advance_builder_to_verify() {
-  local session_dir="$1"
-  flow_agents_node "$WRITER" record-gate-claim "$session_dir" --status pass --expectation selected-work \
-    --summary "Selected the fixture Work Item." --timestamp "2026-06-26T00:00:10Z" >/dev/null 2>&1 \
-    && flow_agents_node "$WRITER" record-gate-claim "$session_dir" --status pass --expectation pickup-probe-readiness \
-      --summary "Pickup readiness is established." --timestamp "2026-06-26T00:00:20Z" >/dev/null 2>&1 \
-    && flow_agents_node "$WRITER" record-gate-claim "$session_dir" --status pass --expectation probe-decisions-or-accepted-gaps \
-      --summary "Probe decisions are recorded." --timestamp "2026-06-26T00:00:30Z" >/dev/null 2>&1 \
-    && flow_agents_node "$WRITER" record-gate-claim "$session_dir" --status pass --expectation implementation-plan \
-      --summary "Implementation plan is recorded." --timestamp "2026-06-26T00:00:40Z" >/dev/null 2>&1 \
-    && flow_agents_node "$WRITER" record-gate-claim "$session_dir" --status pass --expectation implementation-scope \
-      --summary "Implementation scope is recorded." --timestamp "2026-06-26T00:00:50Z" >/dev/null 2>&1
+  local slug="$1"
+  local title="$2"
+  local summary="$3"
+  local session_dir="$SESSION_ROOT/$slug"
+  local pull_work="$session_dir/$slug--pull-work.md"
+  local plan="$session_dir/$slug--plan-work.md"
+  local deliver="$session_dir/$slug--deliver.md"
+  local work_item="${slug/-/:}"
+
+  mkdir -p "$session_dir"
+  printf 'Selected Work Item: %s\n' "$work_item" > "$pull_work"
+  FLOW_AGENTS_ACTOR="$slug-fixture-actor" node "$ROOT/build/src/cli.js" workflow start \
+    --artifact-root "$SESSION_ROOT" \
+    --flow builder.build \
+    --work-item "$work_item" \
+    --assignment-provider local-file \
+    --title "$title" \
+    --summary "$summary" \
+    --criterion "Fixture producer artifacts reach verify." >/dev/null 2>&1 || return 1
+  flow_agents_node "$WRITER" init-plan "$deliver" \
+    --source-request "Test declared-only producer artifacts." \
+    --summary "Fixture plan for declared-only producer artifacts." \
+    --timestamp "2026-06-26T00:00:05Z" >/dev/null 2>&1 || return 1
+  node - "$session_dir" "$slug" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const [dir, slug] = process.argv.slice(2);
+fs.writeFileSync(path.join(dir, `${slug}--plan-work.md`), '# Plan\n\n- AC-1: Reach verify through declared producer artifacts.\n', 'utf8');
+fs.writeFileSync(path.join(dir, 'acceptance.json'), JSON.stringify({
+  schema_version: '1.0',
+  task_slug: slug,
+  criteria: [{
+    id: 'AC-1',
+    description: 'Reach verify through declared producer artifacts.',
+    status: 'pending',
+    evidence_refs: [],
+  }],
+  goal_fit: { status: 'pending', summary: 'Fixture has not completed Goal Fit review.' },
+}, null, 2), 'utf8');
+NODE
+  FLOW_AGENTS_ACTOR="$slug-fixture-actor" node "$ROOT/build/src/cli.js" workflow evidence --session-dir "$session_dir" --status pass --expectation pickup-probe-readiness \
+    --summary "Pickup readiness is recorded in the selected-work artifact." \
+    --evidence-ref-json "{\"kind\":\"artifact\",\"file\":\"$pull_work\",\"summary\":\"Declared durable producer artifact for pickup-probe-readiness.\"}" >/dev/null 2>&1 || return 1
+  FLOW_AGENTS_ACTOR="$slug-fixture-actor" node "$ROOT/build/src/cli.js" workflow evidence --session-dir "$session_dir" --status pass --expectation probe-decisions-or-accepted-gaps \
+    --summary "Probe decisions are recorded in the selected-work artifact." \
+    --evidence-ref-json "{\"kind\":\"artifact\",\"file\":\"$pull_work\",\"summary\":\"Declared durable producer artifact for probe decisions.\"}" >/dev/null 2>&1 || return 1
+  FLOW_AGENTS_ACTOR="$slug-fixture-actor" node "$ROOT/build/src/cli.js" workflow evidence --session-dir "$session_dir" --status pass --expectation implementation-plan \
+    --summary "Implementation plan is recorded in the plan artifact." \
+    --evidence-ref-json "{\"kind\":\"artifact\",\"file\":\"$plan\",\"summary\":\"Declared durable producer artifact for implementation-plan.\"}" >/dev/null 2>&1 || return 1
+  FLOW_AGENTS_ACTOR="$slug-fixture-actor" node "$ROOT/build/src/cli.js" workflow evidence --session-dir "$session_dir" --status pass --expectation implementation-scope \
+    --summary "Implementation scope is recorded in the delivery artifact." \
+    --evidence-ref-json "{\"kind\":\"artifact\",\"file\":\"$deliver\",\"summary\":\"Declared durable producer artifact for implementation-scope.\"}" >/dev/null 2>&1 || return 1
 }
 
-if advance_builder_to_verify "$DUAL_DIR"; then
-  _pass "canonical Builder Flow advances through required gates to verify"
+DUAL_DIR="$SESSION_ROOT/dual-emit-test"
+if advance_builder_to_verify "dual-emit-test" "Declared-Only Test" "Test declared-only emit for ADR 0016 P-d."; then
+  _pass "canonical Builder Flow advances through declared producer artifacts to verify"
 else
-  _fail "canonical Builder Flow did not reach verify"
+  _fail "canonical Builder Flow did not reach verify through declared producer artifacts"
 fi
 
 # Verify current.json carries the flow keys
@@ -345,19 +373,10 @@ echo "── P-d declared-only: policy-kind check maps to builder.verify.policy-
 
 # Use a separate canonical run because the failing tests evidence above legitimately
 # routes its run back to execute before this independent producer assertion.
-if flow_agents_node "$WRITER" ensure-session \
-  --artifact-root "$SESSION_ROOT" \
-  --task-slug dual-emit-policy \
-  --flow-id builder.build \
-  --skip-ownership-guard \
-  --title "Declared Policy Test" \
-  --summary "Test declared-only policy emit for ADR 0016 P-d." \
-  --criterion "Policy passes" \
-  --timestamp "2026-06-26T00:01:30Z" >/dev/null 2>&1 \
-  && advance_builder_to_verify "$SESSION_ROOT/dual-emit-policy"; then
-  _pass "policy fixture canonical Builder Flow reaches verify"
+if advance_builder_to_verify "dual-emit-policy" "Declared Policy Test" "Test declared-only policy emit for ADR 0016 P-d."; then
+  _pass "policy fixture canonical Builder Flow reaches verify through declared producer artifacts"
 else
-  _fail "policy fixture canonical Builder Flow did not reach verify"
+  _fail "policy fixture canonical Builder Flow did not reach verify through declared producer artifacts"
 fi
 
 POLICY_DIR="$SESSION_ROOT/dual-emit-policy"

package/evals/integration/test_flowdef_session_activation.sh

@@ -6,11 +6,11 @@
 # correctly sets active_step_id via the phase_map at each phase.
 #
 # Tests:
-#   1. ensure-session --flow-id builder.build writes active_flow_id + default
-#      active_step_id (pull-work) to current.json.
+#   1. Pre-seeded concrete pull-work evidence lets ensure-session --flow-id
+#      builder.build bind the local Work Item and project the canonical Flow.
 #   2. advance-state through phases (planning→execution→verification) sets correct
 #      active_step_id via phase_map at each transition.
-#   3. At the verify step, record-gate-claim for tests-evidence produces
+#   3. At the verify step, public workflow evidence for tests-evidence produces
 #      builder.verify.tests (status=verified) in the bundle — producer fires.
 #   4. A TAMPERED builder.verify.tests bundle at the verify step BLOCKS (exit 2)
 #      with the tamper warning naming the declared claimType.
@@ -46,17 +46,17 @@ echo "=== 1. ensure-session --flow-id builder.build activates FlowDefinition-dri
 MAIN_AROOT="$TMP/main-project/.kontourai/flow-agents"
 SLUG="activation-test"
 SESSION_DIR="$MAIN_AROOT/$SLUG"
-mkdir -p "$MAIN_AROOT"
+mkdir -p "$SESSION_DIR"
+printf 'Selected Work Item: activation:test\n' > "$SESSION_DIR/$SLUG--pull-work.md"
 
-if flow_agents_node "$WRITER" ensure-session \
+if FLOW_AGENTS_ACTOR=activation-test-actor node "$ROOT/build/src/cli.js" workflow start \
   --artifact-root "$MAIN_AROOT" \
-  --task-slug "$SLUG" \
-  --actor activation-test-actor \
+  --flow builder.build \
+  --work-item activation:test \
+  --assignment-provider local-file \
   --title "Step 1 activation test" \
   --summary "Test that --flow-id builder.build activates the FlowDefinition-driven path." \
-  --criterion "All gates produce declared claims" \
-  --flow-id builder.build \
-  --timestamp "2026-06-01T00:00:00Z" >/dev/null 2>&1; then
+  --criterion "All gates produce declared claims" >/dev/null 2>&1; then
   _pass "ensure-session starts the canonical Builder Flow from a canonical artifact root"
 else
   _fail "ensure-session failed to start the canonical Builder Flow"
@@ -76,17 +76,54 @@ console.log('current.json: active_flow_id=' + c.active_flow_id + ' active_step_i
   && _pass "ensure-session records trusted selection and projects the canonical Flow run at design-probe" \
   || _fail "ensure-session did not create and project the canonical Flow run"
 
+if node - "$ROOT/kits/builder/kit.json" "$ROOT" <<'NODE'
+const fs = require('node:fs');
+const kit = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+const { workflowTriggersFor } = require(`${process.argv[3]}/scripts/hooks/lib/kit-catalog.js`);
+const roles = new Map(kit.skill_roles.map((entry) => [entry.skill_id.replace(/^builder\./, ''), entry.role]));
+const trigger = kit.workflow_triggers.find((entry) => entry.id === 'builder-build-work');
+if (roles.get(trigger.default_skill) !== 'entrypoint') process.exit(1);
+if (!trigger.conditional_skills.every((entry) => roles.get(entry.skill) === 'profile')) process.exit(2);
+const [rendered] = workflowTriggersFor(process.argv[3], 'implementation-work-detected');
+if (!rendered?.steering.includes('activate `tdd-workflow`; otherwise activate `deliver`')) process.exit(5);
+if (!rendered.steering.includes('public `flow-agents workflow` interface') || rendered.steering.includes('workflow:sidecar')) process.exit(6);
+for (const action of kit.flow_step_actions) {
+  if (!action.skills.every((skill) => roles.get(skill) === 'step')) process.exit(3);
+}
+for (const skill of ['design-probe', 'continue-work', 'gate-review', 'fix-bug']) {
+  if (kit.flow_step_actions.some((action) => action.skills.includes(skill))) process.exit(4);
+  if (rendered.steering.includes(`activate \`${skill}\``)) process.exit(7);
+}
+NODE
+then
+  _pass "runtime steering activates the entrypoint/profile and keeps primitives/extensions outside automatic step actions"
+else
+  _fail "activation metadata blurred entrypoint, profile, step, primitive, or extension roles"
+fi
+
 # ─── TEST 2: advance-state sets active_step_id via phase_map ─────────────────
 echo ""
 echo "=== 2. advance-state through phases sets active_step_id via phase_map ==="
 
-flow_agents_node "$WRITER" init-plan "$SESSION_DIR/$SLUG--deliver.md" \
+PHASE_AROOT="$TMP/phase-project/.kontourai/flow-agents"
+PHASE_SLUG="phase-map-test"
+PHASE_DIR="$PHASE_AROOT/$PHASE_SLUG"
+mkdir -p "$PHASE_AROOT"
+
+flow_agents_node "$WRITER" ensure-session \
+  --artifact-root "$PHASE_AROOT" \
+  --task-slug "$PHASE_SLUG" \
+  --title "Phase map test" \
+  --summary "Test FlowDefinition phase-map projection without an active Flow run." \
+  --timestamp "2026-06-01T00:00:30Z" >/dev/null 2>&1
+
+flow_agents_node "$WRITER" init-plan "$PHASE_DIR/$PHASE_SLUG--deliver.md" \
   --source-request "Test" --summary "Testing" \
   --timestamp "2026-06-01T00:00:30Z" >/dev/null 2>&1
 
 test_phase_step() {
   local phase="$1" expected_step="$2"
-  flow_agents_node "$WRITER" advance-state "$SESSION_DIR" \
+  flow_agents_node "$WRITER" advance-state "$PHASE_DIR" \
     --status in_progress --phase "$phase" \
     --summary "Testing phase $phase." \
     --next-action "Continue." \
@@ -95,7 +132,7 @@ test_phase_step() {
   local actual
   actual=$(node -e "
     const fs = require('fs');
-    const c = JSON.parse(fs.readFileSync('$MAIN_AROOT/current.json', 'utf8'));
+    const c = JSON.parse(fs.readFileSync('$PHASE_AROOT/current.json', 'utf8'));
     console.log(c.active_step_id || '');
   " 2>/dev/null)
   if [ "$actual" = "$expected_step" ]; then
@@ -109,18 +146,95 @@ test_phase_step "planning"     "plan"
 test_phase_step "execution"    "execute"
 test_phase_step "verification" "verify"
 
-# ─── TEST 3: at verify step, record-gate-claim produces builder.verify.tests ──
+node - "$SESSION_DIR" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const dir = process.argv[2];
+const slug = path.basename(dir);
+fs.writeFileSync(path.join(dir, `${slug}--plan-work.md`), '# Plan\n\n- AC-1: Verify FlowDefinition producer evidence.\n', 'utf8');
+fs.writeFileSync(path.join(dir, 'acceptance.json'), JSON.stringify({ schema_version: '1.0', task_slug: slug, criteria: [{ id: 'AC-1', description: 'Verify FlowDefinition producer evidence.', status: 'pending', evidence_refs: [] }], goal_fit: { status: 'pending', summary: 'Fixture has not completed Goal Fit review.' } }, null, 2), 'utf8');
+NODE
+mkdir -p "$TMP/main-project/checks"
+cat > "$TMP/main-project/checks/check-flow-step.test.mjs" <<'JS'
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+
+test('the canonical Builder run reached verify', () => {
+  const state = JSON.parse(fs.readFileSync('.kontourai/flow-agents/activation-test/state.json', 'utf8'));
+  assert.equal(state.flow_run?.current_step, 'verify');
+});
+JS
+
+record_passing_producer_evidence() {
+  local expectation="$1" artifact="$2"
+  if FLOW_AGENTS_ACTOR=activation-test-actor node "$ROOT/build/src/cli.js" workflow evidence \
+    --session-dir "$SESSION_DIR" \
+    --status pass \
+    --expectation "$expectation" \
+    --summary "Fixture records passing $expectation evidence from its declared durable artifact." \
+    --evidence-ref-json "{\"kind\":\"artifact\",\"file\":\"$artifact\",\"summary\":\"Declared durable producer artifact for $expectation.\"}" >/dev/null 2>&1; then
+    _pass "public workflow evidence records declared durable producer evidence for $expectation"
+  else
+    _fail "public workflow evidence did not record declared durable producer evidence for $expectation"
+  fi
+}
+
+# Satisfy the canonical Flow itself. advance-state above tests phase-map projection;
+# these producer claims advance the persisted Flow run to verify.
+record_passing_producer_evidence "pickup-probe-readiness" "$SESSION_DIR/$SLUG--pull-work.md"
+record_passing_producer_evidence "probe-decisions-or-accepted-gaps" "$SESSION_DIR/$SLUG--pull-work.md"
+record_passing_producer_evidence "implementation-plan" "$SESSION_DIR/$SLUG--plan-work.md"
+record_passing_producer_evidence "implementation-scope" "$SESSION_DIR/$SLUG--deliver.md"
+
+# ─── TEST 3: clean critique + complete tests evidence at verify ───────────────
 echo ""
-echo "=== 3. verify step: producer fires — record-gate-claim produces builder.verify.tests ==="
+echo "=== 3. verify step: clean critique and criterion-backed producer evidence ==="
+
+if FLOW_AGENTS_ACTOR=activation-reviewer node "$ROOT/build/src/cli.js" workflow critique \
+  --session-dir "$SESSION_DIR" \
+  --id "activation-review" \
+  --verdict pass \
+  --summary "Fixture review found no open findings before verification." \
+  --artifact-ref "$SESSION_DIR/$SLUG--deliver.md" \
+  --lane-json "{\"id\":\"code-review\",\"status\":\"pass\",\"summary\":\"Reviewed the delivered activation fixture.\",\"evidence_refs\":[{\"kind\":\"artifact\",\"file\":\"$SESSION_DIR/$SLUG--deliver.md\",\"summary\":\"Reviewed delivery artifact.\"}]}" >/dev/null 2>&1; then
+  _pass "public workflow critique records a clean review before passing tests-evidence"
+else
+  _fail "public workflow critique did not record a clean review before tests-evidence"
+fi
 
-if flow_agents_node "$WRITER" record-gate-claim "$SESSION_DIR" \
+TEST_COMMAND="node --test checks/check-flow-step.test.mjs"
+CRITERION_JSON="$(node - "$TEST_COMMAND" <<'NODE'
+const command = process.argv[2];
+process.stdout.write(JSON.stringify({
+  id: 'AC-1',
+  status: 'pass',
+  evidence_refs: [{
+    kind: 'command',
+    excerpt: command,
+    summary: 'Asserts the exact session is at the verify Flow step.',
+  }],
+}));
+NODE
+)"
+COMMAND_REF="$(node - "$TEST_COMMAND" <<'NODE'
+const command = process.argv[2];
+process.stdout.write(JSON.stringify({ kind: 'command', excerpt: command, summary: 'Runs the project-local verify-step assertion.' }));
+NODE
+)"
+
+TEST_EVIDENCE_OUTPUT="$(FLOW_AGENTS_ACTOR=activation-test-actor node "$ROOT/build/src/cli.js" workflow evidence \
+  --session-dir "$SESSION_DIR" \
   --status pass \
-  --summary "All tests pass." \
+  --summary "The substantive producer fixture command passed for every declared criterion." \
   --expectation "tests-evidence" \
-  --timestamp "2026-06-01T00:02:00Z" >/dev/null 2>&1; then
-  _pass "record-gate-claim at verify step succeeds (expectation=tests-evidence)"
+  --command "$TEST_COMMAND" \
+  --criterion-json "$CRITERION_JSON" \
+  --evidence-ref-json "$COMMAND_REF" 2>&1)"
+if [ "$?" -eq 0 ]; then
+  _pass "public workflow evidence records passing criterion-backed tests-evidence at verify"
 else
-  _fail "record-gate-claim at verify step FAILED"
+  _fail "public workflow evidence did not record passing criterion-backed tests-evidence: $TEST_EVIDENCE_OUTPUT"
 fi
 
 node -e "
@@ -128,13 +242,17 @@ const fs = require('fs');
 const bundlePath = '$SESSION_DIR/trust.bundle';
 if (!fs.existsSync(bundlePath)) throw new Error('trust.bundle not found');
 const bundle = JSON.parse(fs.readFileSync(bundlePath, 'utf8'));
-const declared = (bundle.claims || []).find(c => c.claimType === 'builder.verify.tests');
+const declared = (bundle.claims || []).find(c => c.metadata?.gate_claim?.expectation_id === 'tests-evidence');
 if (!declared) throw new Error('MISSING builder.verify.tests; claims: ' + (bundle.claims||[]).map(c=>c.claimType).join(', '));
-if (declared.status !== 'verified') throw new Error('expected status=verified, got ' + declared.status);
-console.log('builder.verify.tests: subjectType=' + declared.subjectType + ' status=' + declared.status + ' value=' + declared.value);
+if (declared.claimType !== 'builder.verify.tests' || declared.status !== 'verified') throw new Error('expected verified builder.verify.tests, got ' + JSON.stringify({ claimType: declared.claimType, status: declared.status }));
+const critique = (bundle.claims || []).find(c => c.metadata?.origin === 'critique' && c.value === 'pass' && !c.metadata?.superseded_by);
+if (!critique) throw new Error('MISSING clean live critique before tests-evidence');
+const criterion = (bundle.claims || []).find(c => c.metadata?.origin === 'acceptance' && c.metadata?.criterion?.id === 'AC-1');
+if (!criterion || criterion.value !== 'pass' || criterion.status !== 'verified') throw new Error('MISSING verified completed AC-1 criterion');
+console.log('builder.verify.tests: subjectType=' + declared.subjectType + ' status=' + declared.status + ' value=' + declared.value + '; clean critique and AC-1 verified');
 " 2>&1 \
-  && _pass "bundle contains builder.verify.tests (subjectType=flow-step, status=verified, value=pass)" \
-  || _fail "bundle missing or incorrect builder.verify.tests claim"
+  && _pass "bundle contains declared tests evidence with a clean critique and completed AC-1" \
+  || _fail "bundle lacks declared tests evidence, clean critique, or completed AC-1"
 
 # ─── TEST 4: tampered bundle at verify step BLOCKS ────────────────────────────
 echo ""
@@ -145,10 +263,12 @@ TAMPER_SLUG="tamper-verify-test"
 mkdir -p "$TAMPER_DIR"
 printf '# Test repo\n' > "$TAMPER_DIR/AGENTS.md"
 mkdir -p "$TAMPER_DIR/.kontourai/flow-agents/$TAMPER_SLUG"
+printf 'Selected Work Item: local:%s\n' "$TAMPER_SLUG" > "$TAMPER_DIR/.kontourai/flow-agents/$TAMPER_SLUG/$TAMPER_SLUG--pull-work.md"
 
 flow_agents_node "$WRITER" ensure-session \
   --artifact-root "$TAMPER_DIR/.kontourai/flow-agents" \
   --task-slug "$TAMPER_SLUG" \
+  --actor tamper-verify-actor \
   --title "Tamper verify test" \
   --summary "Testing tamper detection at verify step." \
   --flow-id builder.build \

package/evals/integration/test_flowdef_session_history_preservation.sh

@@ -2,7 +2,7 @@
 # test_flowdef_session_history_preservation.sh — Integration eval for ADR 0016 Step 0.
 #
 # Proves:
-#   1. A FlowDefinition-driven session (ensure-session --flow-id builder.build, step=verify)
+#   1. A noncanonical FlowDefinition-projected session (advance-state, step=verify)
 #      records a check via the declared builder.verify.tests path, then record-critique and
 #      record-learning PRESERVE the prior declared check + critique claims in the rebuilt
 #      bundle (no history loss).
@@ -34,18 +34,18 @@ WRITER="workflow-sidecar"
 echo ""
 echo "=== 1. FlowDefinition-driven session: record-critique/record-learning preserve declared claims ==="
 
-FLOW_AROOT="$TMP/flow-aroot"
+FLOW_AROOT="$TMP/flow-project/.kontourai/flow-agents"
 SLUG="history-flow-test"
 SESSION_DIR="$FLOW_AROOT/$SLUG"
 mkdir -p "$FLOW_AROOT"
 
-# Start at the declared first step, then establish the verify-state fixture.
+# Create a plain sidecar session, then project it onto the verify step. This test covers the
+# generic ADR 0016 sidecar path; canonical Builder runs are covered by the public workflow tests.
 flow_agents_node "$WRITER" ensure-session \
   --artifact-root "$FLOW_AROOT" \
   --task-slug "$SLUG" \
   --title "History preservation test" \
   --summary "Test that declared builder.* claims survive round-trips." \
-  --flow-id builder.build \
   --timestamp "2026-06-01T00:00:00Z" >/dev/null 2>&1
 
 flow_agents_node "$WRITER" init-plan "$SESSION_DIR/$SLUG--deliver.md" \
@@ -80,6 +80,8 @@ flow_agents_node "$WRITER" record-critique "$SESSION_DIR" \
   --id "code-review" \
   --verdict pass \
   --summary "Code review passed." \
+  --lane-json "{\"id\":\"code\",\"status\":\"pass\",\"summary\":\"Code review passed.\",\"evidence_refs\":[{\"kind\":\"artifact\",\"file\":\"$SESSION_DIR/$SLUG--deliver.md\",\"summary\":\"Reviewed the delivery artifact.\"}]}" \
+  --artifact-ref "$SESSION_DIR/$SLUG--deliver.md" \
   --timestamp "2026-06-01T00:02:00Z" >/dev/null 2>&1
 
 # Assert builder.verify.tests survived the record-critique round-trip
@@ -93,24 +95,21 @@ console.log('after record-critique: builder.verify.tests status=' + declared.sta
   && _pass "builder.verify.tests declared claim preserved after record-critique (no history loss)" \
   || _fail "builder.verify.tests declared claim LOST after record-critique (history loss)"
 
-# Also verify the critique claim itself is present.
-# In a flow-driven session (verify step), critique maps to the declared builder.verify.policy-compliance
-# (the critique heuristic matches: subjectType=artifact + claimType contains "compliance").
-# workflow.critique.review is emitted in no-flow sessions only (P-d: shadow retired).
+# Also verify the critique claim itself is present and remains distinct from optional policy
+# evidence. The Builder runtime consumes metadata.origin=critique directly; a code review must
+# not be relabeled as builder.verify.policy-compliance merely because that expectation is open.
 node -e "
 const fs = require('fs');
 const bundle = JSON.parse(fs.readFileSync('$SESSION_DIR/trust.bundle', 'utf8'));
 const claims = bundle.claims || [];
-// Declared critique claim for verify-step: builder.verify.policy-compliance
-const crit = claims.find(c => c.claimType === 'builder.verify.policy-compliance');
-if (!crit) throw new Error('MISSING builder.verify.policy-compliance critique claim after record-critique; claims: ' + claims.map(c=>c.claimType).join(', '));
-// Must NOT have workflow.critique.review in a flow-driven session (no shadow, P-d)
-const legacy = claims.find(c => c.claimType === 'workflow.critique.review');
-if (legacy) throw new Error('UNEXPECTED workflow.critique.review in flow-driven session (P-d retired shadow); id=' + legacy.id);
-console.log('declared critique claim: claimType=' + crit.claimType + ' value=' + crit.value);
+const crit = claims.find(c => c.claimType === 'workflow.critique.review' && c.metadata?.origin === 'critique');
+if (!crit) throw new Error('MISSING first-class critique claim after record-critique; claims: ' + claims.map(c=>c.claimType).join(', '));
+const mislabeled = claims.find(c => c.claimType === 'builder.verify.policy-compliance' && c.metadata?.origin === 'critique');
+if (mislabeled) throw new Error('critique was mislabeled as optional policy-compliance evidence: ' + mislabeled.id);
+console.log('critique claim remains distinct: claimType=' + crit.claimType + ' value=' + crit.value);
 " 2>&1 \
-  && _pass "builder.verify.policy-compliance declared critique claim present (no workflow.critique.review shadow, P-d)" \
-  || _fail "declared critique claim MISSING or unexpected workflow.critique.review found after record-critique"
+  && _pass "first-class critique preserved without policy-compliance mislabeling" \
+  || _fail "critique claim missing or mislabeled after record-critique"
 
 # Now do record-learning (second round-trip)
 flow_agents_node "$WRITER" record-learning "$SESSION_DIR" \
@@ -140,7 +139,7 @@ console.log('after record-learning: builder.verify.tests status=' + declared.sta
 echo ""
 echo "=== 2. workflow.* session (no --flow-id): round-trip unchanged ==="
 
-NOFLOW_AROOT="$TMP/noflow-aroot"
+NOFLOW_AROOT="$TMP/noflow-project/.kontourai/flow-agents"
 NOFLOW_SLUG="history-noflow-test"
 NOFLOW_DIR="$NOFLOW_AROOT/$NOFLOW_SLUG"
 mkdir -p "$NOFLOW_AROOT"
@@ -167,6 +166,8 @@ flow_agents_node "$WRITER" record-critique "$NOFLOW_DIR" \
   --id "noflow-review" \
   --verdict pass \
   --summary "Review passed." \
+  --lane-json "{\"id\":\"code\",\"status\":\"pass\",\"summary\":\"Review passed.\",\"evidence_refs\":[{\"kind\":\"artifact\",\"file\":\"$NOFLOW_DIR/$NOFLOW_SLUG--deliver.md\",\"summary\":\"Reviewed the delivery artifact.\"}]}" \
+  --artifact-ref "$NOFLOW_DIR/$NOFLOW_SLUG--deliver.md" \
   --timestamp "2026-06-01T10:02:00Z" >/dev/null 2>&1
 
 # Assert only workflow.* claims survived (no builder.* contamination)
@@ -189,8 +190,8 @@ console.log('after record-critique: workflow.check.test + workflow.critique.revi
 echo ""
 echo "=== 3. evidenceClean/critiqueClean correct for builder.* bundle ==="
 
-# Create a fresh builder.build session at verify step for dogfood-pass test
-DOGFOOD_AROOT="$TMP/dogfood-aroot"
+# Create a fresh noncanonical FlowDefinition-projected session at verify for dogfood-pass.
+DOGFOOD_AROOT="$TMP/dogfood-project/.kontourai/flow-agents"
 DOGFOOD_SLUG="dogfood-clean-test"
 DOGFOOD_DIR="$DOGFOOD_AROOT/$DOGFOOD_SLUG"
 mkdir -p "$DOGFOOD_AROOT"
@@ -200,7 +201,6 @@ flow_agents_node "$WRITER" ensure-session \
   --task-slug "$DOGFOOD_SLUG" \
   --title "Dogfood clean test" \
   --summary "Test evidenceClean/critiqueClean on builder.build session." \
-  --flow-id builder.build \
   --timestamp "2026-06-01T20:00:00Z" >/dev/null 2>&1
 
 flow_agents_node "$WRITER" init-plan "$DOGFOOD_DIR/$DOGFOOD_SLUG--deliver.md" \
@@ -224,6 +224,8 @@ flow_agents_node "$WRITER" record-critique "$DOGFOOD_DIR" \
   --id "ev-critique" \
   --verdict pass \
   --summary "Critique passed." \
+  --lane-json "{\"id\":\"code\",\"status\":\"pass\",\"summary\":\"Critique passed.\",\"evidence_refs\":[{\"kind\":\"artifact\",\"file\":\"$DOGFOOD_DIR/$DOGFOOD_SLUG--deliver.md\",\"summary\":\"Reviewed the delivery artifact.\"}]}" \
+  --artifact-ref "$DOGFOOD_DIR/$DOGFOOD_SLUG--deliver.md" \
   --timestamp "2026-06-01T20:02:00Z" >/dev/null 2>&1
 
 # dogfood-pass --verdict pass should succeed: evidenceClean=true (builder.verify.tests passes)

package/evals/integration/test_gate_lockdown.sh

@@ -1156,16 +1156,14 @@ echo "=== Diff scope check ==="
 # Verify that ONLY the allowed files were modified.
 # Round 2 (fix/gate-lockdown) scope: config-protection.js, stop-goal-fit.js, evidence-capture.js.
 # The security-hardening files (config-protection.js, stop-goal-fit.js, workflow-sidecar.ts,
-# flow-resolver.ts, evidence-capture.js) are legitimately modified across the rounds, so the
-# only true invariants this scope-check enforces are the hard collision boundaries.
+# flow-resolver.ts, evidence-capture.js) are legitimately modified across the rounds. This
+# check protects the cross-kit collision boundary; it must not reject legitimate changes to
+# Builder skills merely because another issue originally treated them as out of scope.
 # Use grep patterns to avoid triggering the source path validator.
 FORBIDDEN_MODIFIED=""
 FORBIDDEN_PATTERNS=(
   "kits/knowledge/"
 )
-# continue-work: the collision boundary skill file (not in scripts/hooks/).
-# Use a conservative basename check to avoid a false src-path reference.
-FORBIDDEN_PATTERNS+=("continue-work")
 for pat in "${FORBIDDEN_PATTERNS[@]}"; do
   if git -C "$ROOT" diff --name-only HEAD 2>/dev/null | grep -q "$pat"; then
     FORBIDDEN_MODIFIED="$FORBIDDEN_MODIFIED $pat"