@kontourai/flow-agents 3.6.0 → 3.8.0

package/evals/integration/test_public_workflow_cli.sh

@@ -18,23 +18,111 @@ VERSION="$(node -p "require('./package.json').version")"
 CONSUMER="$TMP/consumer"
 ARTIFACT_ROOT="$CONSUMER/.kontourai/flow-agents"
 mkdir -p "$CONSUMER"
+mkdir -p "$CONSUMER/checks"
+printf '#!/usr/bin/env bash\nset -eu\ntest -f "$1"\nprintf "1..1\\nok 1 - session exists\\n"\n' > "$CONSUMER/checks/check-public-workflow.sh"
+chmod +x "$CONSUMER/checks/check-public-workflow.sh"
+printf '#!/usr/bin/env bash\nset -eu\ntouch "$1"\nsleep 1\n' > "$CONSUMER/checks/check-command-lock.sh"
+chmod +x "$CONSUMER/checks/check-command-lock.sh"
+printf '#!/usr/bin/env bash\nset -eu\ntest -f "$1"\nprintf "run\\n" >> "$2"\nprintf "1..1\\nok 1 - session exists\\n"\n' > "$CONSUMER/checks/check-multi-command.sh"
+chmod +x "$CONSUMER/checks/check-multi-command.sh"
+printf '#!/usr/bin/env bash\nset -eu\ntrap "" TERM\n( trap "" TERM; sleep 5; touch "$2" ) &\nchild=$!\nprintf "%s\\n" "$child" > "$1"\nwait "$child"\ntouch "$2"\n' > "$CONSUMER/checks/check-command-timeout.sh"
+chmod +x "$CONSUMER/checks/check-command-timeout.sh"
+printf '#!/usr/bin/env bash\nset -eu\n( trap "" TERM; while ! sleep 5; do :; done; touch "$2" ) &\nprintf "%s\\n" "$!" > "$1"\n' > "$CONSUMER/checks/check-success-background.sh"
+chmod +x "$CONSUMER/checks/check-success-background.sh"
 
 run_candidate() {
   (cd "$CONSUMER" && CODEX_SESSION_ID=public-workflow-eval npx --yes --package="file:$TARBALL" flow-agents workflow "$@")
 }
 
+run_candidate_as() {
+  local actor="$1"
+  shift
+  (cd "$CONSUMER" && CODEX_SESSION_ID="$actor" npx --yes --package="file:$TARBALL" flow-agents workflow "$@")
+}
+
+snapshot_tree() {
+  local root="$1"
+  find "$root" -type f -print0 | sort -z | xargs -0 shasum -a 256
+}
+
 PRIMARY_HELP="$(cd "$CONSUMER" && npx --yes --package="file:$TARBALL" flow-agents --help)"
 WORKFLOW_HELP="$(run_candidate --help)"
 [[ "$PRIMARY_HELP" == *"workflow"* && "$WORKFLOW_HELP" != *"workflow-sidecar"* && "$WORKFLOW_HELP" != *"npm run workflow:sidecar"* ]] || fail "public help exposes internal writer terminology or omits workflow"
 pass "primary help exposes the public workflow command without internal writer terminology"
 
-run_candidate start --artifact-root "$ARTIFACT_ROOT" --flow builder.build --work-item acme/widgets#101 --summary "Release fixture" >/dev/null
+seed_pull_work() {
+  local work_item="$1"
+  local slug
+  slug="$(printf '%s' "$work_item" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9]+/-/g; s/^-+//; s/-+$//')"
+  mkdir -p "$ARTIFACT_ROOT/$slug"
+  printf 'Selected Work Item: %s\n' "$work_item" >"$ARTIFACT_ROOT/$slug/$slug--pull-work.md"
+}
+
+seed_pull_work acme/widgets#101
+run_candidate start --artifact-root "$ARTIFACT_ROOT" --flow builder.build --work-item acme/widgets#101 --assignment-provider local-file --summary "Release fixture" >/dev/null
 RELEASE_SESSION="$ARTIFACT_ROOT/acme-widgets-101"
 [[ -f "$RELEASE_SESSION/state.json" ]] || fail "packed start did not create a session"
 [[ ! -e "$CONSUMER/package.json" ]] || fail "consumer unexpectedly gained package.json"
 pass "packed start works in a non-Node consumer"
+seed_pull_work provider:work-item-123
+run_candidate start --artifact-root "$ARTIFACT_ROOT" --flow builder.build --work-item provider:work-item-123 --assignment-provider local-file --summary "Provider-neutral fixture" >/dev/null
+PROVIDER_STATUS="$(run_candidate status --session-dir "$ARTIFACT_ROOT/provider-work-item-123" --json)"
+node -e 'const r=JSON.parse(process.argv[1]);if(r.definition_id!=="builder.build"||r.current_step!=="design-probe")process.exit(1)' "$PROVIDER_STATUS" || fail "provider-neutral Work Item did not start canonically"
+pass "documented provider-neutral Work Item refs start without GitHub identity inference"
+seed_pull_work provider:externally-owned-456
+PROVIDER_STATE="$CONSUMER/provider-assignment-state.json"
+node - "$PROVIDER_STATE" "$ARTIFACT_ROOT/assignment/acme-widgets-101.json" <<'NODE'
+const fs = require('node:fs');
+const local = JSON.parse(fs.readFileSync(process.argv[3], 'utf8'));
+const subject = 'provider-externally-owned-456';
+const record = { ...local, subject_id: subject, work_item_ref: 'provider:externally-owned-456' };
+fs.writeFileSync(process.argv[2], `${JSON.stringify({ role: 'AssignmentStatus', provider: 'example-provider', assignment: { subject_id: subject, provider: 'example-provider', assignee: local.actor_key, record }, effective: { effective_state: 'held', reason: 'self_is_holder', holder: { actor: local.actor_key } } }, null, 2)}\n`);
+NODE
+run_candidate start --artifact-root "$ARTIFACT_ROOT" --flow builder.build --work-item provider:externally-owned-456 --assignment-provider example-provider --effective-state-json "$PROVIDER_STATE" --summary "Externally assigned fixture" >/dev/null
+EXTERNAL_SESSION="$ARTIFACT_ROOT/provider-externally-owned-456"
+node - "$ARTIFACT_ROOT/assignment/provider-externally-owned-456.json" "$EXTERNAL_SESSION/assignment-provider-state.json" "$EXTERNAL_SESSION/trust.bundle" <<'NODE'
+const fs = require('node:fs');
+const assignment = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+const provider = JSON.parse(fs.readFileSync(process.argv[3], 'utf8'));
+const bundle = JSON.parse(fs.readFileSync(process.argv[4], 'utf8'));
+const selected = bundle.claims.find((claim) => claim.metadata?.gate_claim?.expectation_id === 'selected-work');
+if (assignment.work_item_ref !== 'provider:externally-owned-456' || provider.effective?.reason !== 'self_is_holder' || !selected?.metadata?.artifact_refs?.some((ref) => ref.file?.endsWith('assignment-provider-state.json'))) process.exit(1);
+NODE
+pass "provider-confirmed ownership is retained as evidence and mirrored into a local runtime lease"
+seed_pull_work provider:missing-provider
 set +e
-UNSAFE_START="$(run_candidate start --artifact-root "$ARTIFACT_ROOT" --flow builder.build --work-item acme/widgets#103 --skip-ownership-guard 2>&1)"
+MISSING_PROVIDER="$(run_candidate start --artifact-root "$ARTIFACT_ROOT" --flow builder.build --work-item provider:missing-provider --summary "Missing provider fixture" 2>&1)"
+MISSING_PROVIDER_RC=$?
+set -e
+[[ "$MISSING_PROVIDER_RC" -ne 0 && "$MISSING_PROVIDER" == *"requires --assignment-provider"* && ! -e "$ARTIFACT_ROOT/provider-missing-provider/state.json" ]] || fail "public start inferred an assignment provider or mutated before rejecting it"
+pass "public start requires explicit assignment-provider resolution before mutation"
+set +e
+MISSING_PULL_WORK="$(run_candidate start --artifact-root "$ARTIFACT_ROOT" --flow builder.build --work-item acme/widgets#105 --assignment-provider local-file --summary "Missing selection evidence" 2>&1)"
+MISSING_PULL_WORK_RC=$?
+set -e
+[[ "$MISSING_PULL_WORK_RC" -ne 0 && "$MISSING_PULL_WORK" == *"requires concrete pull-work selection evidence"* && ! -e "$ARTIFACT_ROOT/acme-widgets-105/state.json" ]] || fail "public start produced selected-work without a concrete pull-work report"
+pass "public start requires session-local pull-work selection evidence before auto-producing selected-work"
+run_candidate start --artifact-root "$ARTIFACT_ROOT" --flow builder.shape --task-slug shape-fixture --summary "Shape fixture" >/dev/null
+SHAPE_SESSION="$ARTIFACT_ROOT/shape-fixture"
+SHAPE_STATUS="$(run_candidate status --session-dir "$SHAPE_SESSION" --json)"
+node -e 'const r=JSON.parse(process.argv[1]);if(r.definition_id!=="builder.shape"||r.current_step!=="shape")process.exit(1)' "$SHAPE_STATUS" || fail "shape status did not resolve canonical Flow run"
+node - "$SHAPE_SESSION/work-item.json" <<'NODE'
+const fs = require('node:fs');
+const record = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+if (record.id !== 'shape-fixture' || record.source_provider?.kind !== 'local') process.exit(1);
+NODE
+run_candidate evidence --session-dir "$SHAPE_SESSION" --expectation shaped-problem --status not_verified --summary "Shape fixture remains intentionally unverified." --json >/dev/null
+pass "shape starts as an explicit local Work Item and records public evidence through Flow"
+SHAPE_RETRY_BEFORE="$(snapshot_tree "$ARTIFACT_ROOT/shape-fixture")"
+set +e
+SHAPE_TO_BUILD="$(run_candidate start --artifact-root "$ARTIFACT_ROOT" --flow builder.build --work-item local:shape-fixture --task-slug shape-fixture --assignment-provider local-file --summary "Invalid shape retry" 2>&1)"
+SHAPE_TO_BUILD_RC=$?
+set -e
+SHAPE_RETRY_AFTER="$(snapshot_tree "$ARTIFACT_ROOT/shape-fixture")"
+[[ "$SHAPE_TO_BUILD_RC" -ne 0 && "$SHAPE_TO_BUILD" == *"local shape sessions are not build retries"* && "$SHAPE_RETRY_BEFORE" == "$SHAPE_RETRY_AFTER" ]] || fail "public local shape-to-build retry did not fail clearly before mutation"
+pass "public start rejects local shape-to-build retries; provider Work Items are the build handoff"
+set +e
+UNSAFE_START="$(run_candidate start --artifact-root "$ARTIFACT_ROOT" --flow builder.build --work-item acme/widgets#103 --assignment-provider local-file --skip-ownership-guard 2>&1)"
 UNSAFE_START_RC=$?
 set -e
 [[ "$UNSAFE_START_RC" -ne 0 && "$UNSAFE_START" == *"does not support --skip-ownership-guard"* && ! -e "$ARTIFACT_ROOT/acme-widgets-103" ]] || fail "public start accepted an internal ownership bypass"
@@ -42,7 +130,8 @@ pass "public start rejects internal authority flags before mutation"
 
 LOCAL_RETRY_PROJECT="$TMP/local-retry-project"
 LOCAL_RETRY_ROOT="$LOCAL_RETRY_PROJECT/.kontourai/flow-agents"
-mkdir -p "$LOCAL_RETRY_PROJECT/.kontourai"
+mkdir -p "$LOCAL_RETRY_ROOT/local-retry"
+printf 'Selected Work Item: local:local-retry\n' > "$LOCAL_RETRY_ROOT/local-retry/local-retry--pull-work.md"
 printf 'not a run-store directory\n' >"$LOCAL_RETRY_PROJECT/.kontourai/flow"
 set +e
 (cd "$LOCAL_RETRY_PROJECT" && CODEX_SESSION_ID=public-workflow-eval npx --yes --package="file:$TARBALL" flow-agents-workflow-sidecar ensure-session \
@@ -50,7 +139,8 @@ set +e
   --title "Local retry" --summary "Resume the bound local workflow." --flow-id builder.build >/dev/null 2>&1)
 LOCAL_SEED_RC=$?
 set -e
-[[ "$LOCAL_SEED_RC" -ne 0 ]] || fail "local retry fixture unexpectedly started against an invalid Flow store"
+[[ "$LOCAL_SEED_RC" -eq 0 && ! -e "$LOCAL_RETRY_PROJECT/.kontourai/flow/runs/local-retry/state.json" ]] || fail "private writer advanced canonical Flow instead of only seeding the public retry"
+pass "private workflow writer cannot start or advance canonical Flow"
 LOCAL_RETRY_COMMAND="$(node -p "JSON.parse(require('fs').readFileSync('$LOCAL_RETRY_ROOT/local-retry/state.json')).next_action.command")"
 [[ "$LOCAL_RETRY_COMMAND" == *"'--work-item' 'local:local-retry'"* && "$LOCAL_RETRY_COMMAND" == *"'--task-slug' 'local-retry'"* && "$LOCAL_RETRY_COMMAND" == *"'--artifact-root' '$LOCAL_RETRY_ROOT'"* ]] || fail "emitted local retry did not bind its Work Item, slug, and originating artifact root"
 rm -f "$LOCAL_RETRY_PROJECT/.kontourai/flow"
@@ -61,12 +151,8 @@ EXECUTABLE_RETRY="$(node -e 'process.stdout.write(process.argv[1].replace(proces
 [[ -f "$LOCAL_RETRY_PROJECT/.kontourai/flow/runs/local-retry/state.json" && ! -e "$FOREIGN_RETRY_CWD/.kontourai" ]] || fail "emitted local retry mutated the caller cwd instead of the originating store"
 pass "emitted local retry executes from a foreign cwd against its exact originating store"
 
-snapshot_tree() {
-  local root="$1"
-  find "$root" -type f -print0 | sort -z | xargs -0 shasum -a 256
-}
 BEFORE_STATUS="$(snapshot_tree "$CONSUMER/.kontourai")"
-STATUS_JSON="$(run_candidate status --artifact-root "$ARTIFACT_ROOT" --json)"
+STATUS_JSON="$(run_candidate status --session-dir "$RELEASE_SESSION" --json)"
 AFTER_STATUS="$(snapshot_tree "$CONSUMER/.kontourai")"
 [[ "$BEFORE_STATUS" == "$AFTER_STATUS" ]] || fail "workflow status mutated durable artifacts"
 node -e 'const r=JSON.parse(process.argv[1]); if(r.definition_id!=="builder.build"||r.current_step!=="design-probe")process.exit(1)' "$STATUS_JSON" || fail "status did not report canonical run"
@@ -74,10 +160,187 @@ pass "status is canonical and byte-read-only"
 
 FLOW_MANIFEST="$CONSUMER/.kontourai/flow/runs/acme-widgets-101/evidence/manifest.json"
 BEFORE_EVIDENCE="$(node -p "JSON.parse(require('fs').readFileSync('$FLOW_MANIFEST')).evidence.length")"
-run_candidate evidence --session-dir "$RELEASE_SESSION" --expectation pickup-probe-readiness --status not_verified --summary "Consumer fixture intentionally leaves this claim unverified." --json >/dev/null
+PARTIAL_EVIDENCE="$(run_candidate evidence --session-dir "$RELEASE_SESSION" --expectation pickup-probe-readiness --status not_verified --summary "Consumer fixture intentionally leaves this claim unverified." --json)"
 AFTER_EVIDENCE="$(node -p "JSON.parse(require('fs').readFileSync('$FLOW_MANIFEST')).evidence.length")"
-[[ "$AFTER_EVIDENCE" -eq $((BEFORE_EVIDENCE + 1)) ]] || fail "evidence invocation did not attach exactly once"
-pass "evidence records and synchronizes exactly once"
+[[ "$AFTER_EVIDENCE" -eq "$BEFORE_EVIDENCE" ]] || fail "partial evidence changed the canonical manifest"
+node -e 'const r=JSON.parse(process.argv[1]);if(r.attached!==false||r.awaiting_evidence!==true||r.current_step!=="design-probe")process.exit(1)' "$PARTIAL_EVIDENCE" || fail "partial evidence did not report an explicit awaiting-evidence result"
+pass "partial evidence records locally without evaluation or canonical attachment"
+
+PULL_REPORT="$RELEASE_SESSION/$(basename "$RELEASE_SESSION")--pull-work.md"
+PULL_REPORT_REF="{\"kind\":\"artifact\",\"file\":\"$PULL_REPORT\",\"summary\":\"Concrete selected-work and probe report.\"}"
+READINESS_PARTIAL="$(run_candidate evidence --session-dir "$RELEASE_SESSION" --expectation pickup-probe-readiness --status pass --summary "Complete the consumer readiness expectation after exercising NOT_VERIFIED." --evidence-ref-json "$PULL_REPORT_REF" --json)"
+node -e 'const r=JSON.parse(process.argv[1]);if(r.attached!==false||r.awaiting_evidence!==true||r.current_step!=="design-probe")process.exit(1)' "$READINESS_PARTIAL" || fail "first passing member of a multi-expectation gate did not remain pending"
+PROBE_COMPLETE="$(run_candidate evidence --session-dir "$RELEASE_SESSION" --expectation probe-decisions-or-accepted-gaps --status pass --summary "Complete the consumer probe gate." --evidence-ref-json "$PULL_REPORT_REF" --json)"
+node -e 'const r=JSON.parse(process.argv[1]);if(r.attached!==true||r.awaiting_evidence!==false||r.current_step!=="plan")process.exit(1)' "$PROBE_COMPLETE" || fail "complete multi-expectation gate did not attach and advance exactly once"
+AFTER_COMPLETE_EVIDENCE="$(node -p "JSON.parse(require('fs').readFileSync('$FLOW_MANIFEST')).evidence.length")"
+[[ "$AFTER_COMPLETE_EVIDENCE" -eq $((BEFORE_EVIDENCE + 1)) ]] || fail "complete multi-expectation gate did not attach exactly once"
+pass "multi-expectation evidence attaches atomically only when complete"
+seed_pull_work acme/widgets#104
+run_candidate_as poison-pointer start --artifact-root "$ARTIFACT_ROOT" --flow builder.build --work-item acme/widgets#104 --assignment-provider local-file --summary "Poison global pointer fixture" >/dev/null
+node - "$ARTIFACT_ROOT" "$(basename "$RELEASE_SESSION")" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const [root, releaseSlug] = process.argv.slice(2);
+const actorRoot = path.join(root, 'current');
+for (const name of fs.readdirSync(actorRoot)) {
+  if (!name.endsWith('.json')) continue;
+  const file = path.join(actorRoot, name);
+  const pointer = JSON.parse(fs.readFileSync(file, 'utf8'));
+  if (pointer.active_slug !== releaseSlug) continue;
+  pointer.active_slug = 'acme-widgets-104';
+  pointer.artifact_dir = 'acme-widgets-104';
+  pointer.active_step_id = 'design-probe';
+  fs.writeFileSync(file, `${JSON.stringify(pointer, null, 2)}\n`);
+}
+NODE
+PLAN_REPORT="$RELEASE_SESSION/$(basename "$RELEASE_SESSION")--plan-work.md"
+printf '# Plan Work\n\nReviewed fixture plan and acceptance mapping.\n' > "$PLAN_REPORT"
+PLAN_REPORT_REF="{\"kind\":\"artifact\",\"file\":\"$PLAN_REPORT\",\"summary\":\"Reviewed implementation plan.\"}"
+EXACT_SESSION_RESULT="$(run_candidate evidence --session-dir "$RELEASE_SESSION" --expectation implementation-plan --status pass --summary "Exact session binding must ignore the poisoned global pointer." --evidence-ref-json "$PLAN_REPORT_REF" --json)"
+node -e 'const r=JSON.parse(process.argv[1]);if(r.current_step!=="execute"||!String(r.next_action?.summary).includes("`execute`"))process.exit(1)' "$EXACT_SESSION_RESULT" || fail "public evidence followed a poisoned global pointer or returned a stale next action"
+pass "evidence binds the exact session and returns the locked post-transition next action"
+set +e
+UNRELATED_EVIDENCE="$(run_candidate_as unrelated-caller evidence --session-dir "$RELEASE_SESSION" --expectation implementation-scope --status pass --summary rejected 2>&1)"
+UNRELATED_EVIDENCE_RC=$?
+set -e
+[[ "$UNRELATED_EVIDENCE_RC" -ne 0 && "$UNRELATED_EVIDENCE" == *"active, matching assignment actor"* ]] || fail "public evidence allowed a non-holder to impersonate the assignment actor"
+pass "evidence rejects callers that do not match the exact session assignment"
+
+STALE_STATE="$TMP/stale-state.json"
+cp "$RELEASE_SESSION/state.json" "$STALE_STATE"
+node - "$RELEASE_SESSION/state.json" <<'NODE'
+const fs = require('node:fs');
+const file = process.argv[2];
+const state = JSON.parse(fs.readFileSync(file, 'utf8'));
+state.flow_run.current_step = 'pull-work';
+state.next_action = { status: 'continue', summary: 'tampered projection' };
+fs.writeFileSync(file, `${JSON.stringify(state, null, 2)}\n`);
+NODE
+DELIVER_REPORT="$RELEASE_SESSION/$(basename "$RELEASE_SESSION")--deliver.md"
+DELIVER_REPORT_REF="{\"kind\":\"artifact\",\"file\":\"$DELIVER_REPORT\",\"summary\":\"Executed implementation scope report.\"}"
+REPAIRED_EVIDENCE_RESULT="$(run_candidate evidence --session-dir "$RELEASE_SESSION" --expectation implementation-scope --status pass --summary "Repair stale projection before evidence." --evidence-ref-json "$DELIVER_REPORT_REF" --json)"
+node -e 'const r=JSON.parse(process.argv[1]);if(r.current_step!=="verify"||!String(r.next_action?.summary).includes("`verify`"))process.exit(1)' "$REPAIRED_EVIDENCE_RESULT" || fail "evidence did not return its locked post-transition report"
+pass "evidence returns immutable postconditions captured while the subject lock is held"
+FAILED_ROUTE_RESULT="$(run_candidate evidence --session-dir "$RELEASE_SESSION" --expectation tests-evidence --status fail --route-reason implementation_defect --summary "Failing fixture routes back to execution." --command false --json)"
+node -e 'const r=JSON.parse(process.argv[1]);if(r.current_step!=="execute"||!String(r.next_action?.summary).includes("implementation_defect"))process.exit(1)' "$FAILED_ROUTE_RESULT" || fail "failed command evidence did not select the declared canonical route-back"
+REENTER_VERIFY_RESULT="$(run_candidate evidence --session-dir "$RELEASE_SESSION" --expectation implementation-scope --status pass --summary "Corrected implementation re-enters verification." --evidence-ref-json "$DELIVER_REPORT_REF" --json)"
+node -e 'const r=JSON.parse(process.argv[1]);if(r.current_step!=="verify")process.exit(1)' "$REENTER_VERIFY_RESULT" || fail "corrected implementation did not re-enter verification"
+pass "public evidence records failing command observations and declared route-back reasons"
+set +e
+MISSING_TEST_COMMAND="$(run_candidate evidence --session-dir "$RELEASE_SESSION" --expectation tests-evidence --status pass --summary "Missing runnable test command." 2>&1)"
+MISSING_TEST_COMMAND_RC=$?
+FAILED_TEST_COMMAND="$(run_candidate evidence --session-dir "$RELEASE_SESSION" --expectation tests-evidence --status pass --summary "Failing test command." --command 'false' 2>&1)"
+FAILED_TEST_COMMAND_RC=$?
+VERSION_TEST_COMMAND="$(run_candidate evidence --session-dir "$RELEASE_SESSION" --expectation tests-evidence --status pass --summary "Version-only test command." --command 'node --version' 2>&1)"
+VERSION_TEST_COMMAND_RC=$?
+set -e
+[[ "$MISSING_TEST_COMMAND_RC" -ne 0 && "$MISSING_TEST_COMMAND" == *"--command"* && "$FAILED_TEST_COMMAND_RC" -ne 0 && "$FAILED_TEST_COMMAND" == *"non-vacuous package script"* && "$VERSION_TEST_COMMAND_RC" -ne 0 && "$VERSION_TEST_COMMAND" == *"non-vacuous package script"* ]] || fail "tests-evidence did not require a real passing fixture assertion"
+REJECTED_COMMAND_MARKER="$TMP/rejected-command-marker"
+cp "$RELEASE_SESSION/state.json" "$TMP/rejected-command-state.clean.json"
+node - "$RELEASE_SESSION/state.json" <<'NODE'
+const fs = require('node:fs');
+const file = process.argv[2];
+const state = JSON.parse(fs.readFileSync(file, 'utf8'));
+state.flow_run.current_step = 'pull-work';
+state.next_action = { status: 'continue', summary: 'stale projection must remain untouched on rejection' };
+fs.writeFileSync(file, `${JSON.stringify(state, null, 2)}\n`);
+NODE
+REJECTED_COMMAND_BEFORE="$(snapshot_tree "$RELEASE_SESSION")"
+set +e
+REJECTED_COMMAND="$(run_candidate evidence --session-dir "$RELEASE_SESSION" --expectation tests-evidence --status pass --summary "Rejected prose command must not run." --command "This prose command is invalid; touch '$REJECTED_COMMAND_MARKER'" 2>&1)"
+REJECTED_COMMAND_RC=$?
+set -e
+REJECTED_COMMAND_AFTER="$(snapshot_tree "$RELEASE_SESSION")"
+[[ "$REJECTED_COMMAND_RC" -ne 0 && "$REJECTED_COMMAND" == *"not a runnable shell command"* && ! -e "$REJECTED_COMMAND_MARKER" && "$REJECTED_COMMAND_BEFORE" == "$REJECTED_COMMAND_AFTER" ]] || fail "rejected evidence command executed or mutated durable artifacts"
+mv "$TMP/rejected-command-state.clean.json" "$RELEASE_SESSION/state.json"
+pass "rejected evidence commands have no process or durable-artifact side effects"
+BEFORE_CRITIQUE_MANIFEST="$(shasum -a 256 "$FLOW_MANIFEST" | awk '{print $1}')"
+BEFORE_CRITIQUE_BUNDLE="$(shasum -a 256 "$RELEASE_SESSION/trust.bundle" | awk '{print $1}')"
+CODE_LANE="{\"id\":\"code\",\"status\":\"pass\",\"summary\":\"Code review covered the planned implementation.\",\"evidence_refs\":[{\"kind\":\"artifact\",\"file\":\"$PLAN_REPORT\",\"summary\":\"Reviewed implementation plan.\"}]}"
+SECURITY_LANE="{\"id\":\"security\",\"status\":\"pass\",\"summary\":\"Security review covered the delivered scope.\",\"evidence_refs\":[{\"kind\":\"artifact\",\"file\":\"$DELIVER_REPORT\",\"summary\":\"Reviewed delivered scope.\"}]}"
+set +e
+SAME_ACTOR_CRITIQUE="$(run_candidate critique --session-dir "$RELEASE_SESSION" --id public-review --verdict pass --summary "Implementation actor cannot review its own work." --artifact-ref "$DELIVER_REPORT" --lane-json "$CODE_LANE" --lane-json "$SECURITY_LANE" 2>&1)"
+SAME_ACTOR_CRITIQUE_RC=$?
+set -e
+[[ "$SAME_ACTOR_CRITIQUE_RC" -ne 0 && "$SAME_ACTOR_CRITIQUE" == *"reviewer identity distinct"* ]] || fail "public critique allowed the active implementation actor to self-review"
+run_candidate_as public-reviewer critique --session-dir "$RELEASE_SESSION" --id public-review --verdict pass --summary "Public critique fixture." --artifact-ref "$DELIVER_REPORT" --lane-json "$CODE_LANE" --lane-json "$SECURITY_LANE" --json >/dev/null
+AFTER_CRITIQUE_MANIFEST="$(shasum -a 256 "$FLOW_MANIFEST" | awk '{print $1}')"
+AFTER_CRITIQUE_BUNDLE="$(shasum -a 256 "$RELEASE_SESSION/trust.bundle" | awk '{print $1}')"
+[[ "$BEFORE_CRITIQUE_MANIFEST" == "$AFTER_CRITIQUE_MANIFEST" && "$BEFORE_CRITIQUE_BUNDLE" != "$AFTER_CRITIQUE_BUNDLE" ]] || fail "public critique attached to Flow or did not change trust.bundle"
+pass "critique requires an active assignment but rejects self-review by its implementation actor"
+CRITERION_ID="$(node -p "JSON.parse(require('fs').readFileSync('$RELEASE_SESSION/acceptance.json')).criteria[0].id")"
+TEST_COMMAND="bash checks/check-public-workflow.sh .kontourai/flow-agents/$(basename "$RELEASE_SESSION")/state.json"
+MULTI_COMMAND_ONE="$TMP/multi-command-one"
+MULTI_COMMAND_TWO="$TMP/multi-command-two"
+TEST_COMMAND_TWO="bash checks/check-multi-command.sh .kontourai/flow-agents/$(basename "$RELEASE_SESSION")/state.json '$MULTI_COMMAND_ONE'"
+TEST_COMMAND_THREE="bash checks/check-multi-command.sh .kontourai/flow-agents/$(basename "$RELEASE_SESSION")/state.json '$MULTI_COMMAND_TWO'"
+CRITERION_JSON="$(node - "$CRITERION_ID" "$TEST_COMMAND" "$TEST_COMMAND_TWO" "$TEST_COMMAND_THREE" <<'NODE'
+const [id, ...commands] = process.argv.slice(2);
+process.stdout.write(JSON.stringify({ id, status: 'pass', evidence_refs: commands.map((excerpt) => ({ kind: 'command', excerpt, summary: 'Asserts the bound session state exists.' })) }));
+NODE
+)"
+COMMAND_REF="$(node - "$TEST_COMMAND" <<'NODE'
+const command = process.argv[2];
+process.stdout.write(JSON.stringify({ kind: 'command', excerpt: command, summary: 'Exact project-local public workflow check.' }));
+NODE
+)"
+COMMAND_REF_TWO="$(node - "$TEST_COMMAND_TWO" <<'NODE'
+const command = process.argv[2];
+process.stdout.write(JSON.stringify({ kind: 'command', excerpt: command, summary: 'Exact first additional project-local check.' }));
+NODE
+)"
+COMMAND_REF_THREE="$(node - "$TEST_COMMAND_THREE" <<'NODE'
+const command = process.argv[2];
+process.stdout.write(JSON.stringify({ kind: 'command', excerpt: command, summary: 'Exact second additional project-local check.' }));
+NODE
+)"
+run_candidate evidence --session-dir "$RELEASE_SESSION" --expectation tests-evidence --status pass --summary "Passing fixture assertion." --command "$TEST_COMMAND" --command "$TEST_COMMAND_TWO" --command "$TEST_COMMAND_THREE" --evidence-ref-json "$COMMAND_REF" --evidence-ref-json "$COMMAND_REF_TWO" --evidence-ref-json "$COMMAND_REF_THREE" --criterion-json "$CRITERION_JSON" --json >/dev/null
+node - "$RELEASE_SESSION/trust.bundle" <<'NODE'
+const fs = require('node:fs');
+const bundle = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+const claim = bundle.claims.find((entry) => entry.metadata?.gate_claim?.expectation_id === 'tests-evidence');
+if (!claim || claim.metadata?.output_digest?.algorithm !== 'sha256' || typeof claim.metadata.output_digest.hex !== 'string' || claim.metadata?.observed_commands?.length !== 3) process.exit(1);
+NODE
+[[ "$(wc -l < "$MULTI_COMMAND_ONE" | tr -d ' ')" == 1 && "$(wc -l < "$MULTI_COMMAND_TWO" | tr -d ' ')" == 1 ]] || fail "public evidence did not execute every repeated --command exactly once"
+pass "tests-evidence executes every repeated command once and records matching observations"
+
+ASSIGNMENT="$ARTIFACT_ROOT/assignment/$(basename "$RELEASE_SESSION").json"
+ASSIGNMENT_TARGET="$TMP/assignment-target.json"
+cp "$ASSIGNMENT" "$ASSIGNMENT_TARGET"
+rm "$ASSIGNMENT"
+ln -s "$ASSIGNMENT_TARGET" "$ASSIGNMENT"
+set +e
+SYMLINK_ASSIGNMENT="$(run_candidate critique --session-dir "$RELEASE_SESSION" --summary "Rejected assignment symlink." 2>&1)"
+SYMLINK_ASSIGNMENT_RC=$?
+set -e
+rm "$ASSIGNMENT"
+mv "$ASSIGNMENT_TARGET" "$ASSIGNMENT"
+[[ "$SYMLINK_ASSIGNMENT_RC" -ne 0 && "$SYMLINK_ASSIGNMENT" == *"assignment must be a non-symlink regular file"* ]] || fail "public critique followed a symlinked assignment"
+pass "public assignment readers reject symlinked assignment files"
+node - "$RELEASE_SESSION/trust.bundle" "$RELEASE_SESSION" <<'NODE'
+const fs = require('node:fs');
+const [bundleFile, session] = process.argv.slice(2);
+const bundle = JSON.parse(fs.readFileSync(bundleFile, 'utf8'));
+const critique = bundle.claims.find((claim) => claim.metadata?.origin === 'critique');
+if (!critique || critique.claimType !== 'workflow.critique.review' || critique.metadata?.lanes?.length !== 2 || fs.existsSync(`${session}/critique.json`) || fs.existsSync(`${session}/evidence.json`)) process.exit(1);
+NODE
+pass "public critique is report-only, forwards lanes, and writes only to trust.bundle"
+
+cp "$RELEASE_SESSION/state.json" "$TMP/release-state.clean.json"
+node - "$RELEASE_SESSION/state.json" <<'NODE'
+const fs = require('node:fs');
+const file = process.argv[2];
+const state = JSON.parse(fs.readFileSync(file, 'utf8'));
+state.task_slug = '../outside';
+fs.writeFileSync(file, `${JSON.stringify(state, null, 2)}\n`);
+NODE
+set +e
+TAMPERED_SLUG="$(run_candidate evidence --session-dir "$RELEASE_SESSION" --expectation policy-compliance --status not_verified --summary rejected 2>&1)"
+TAMPERED_SLUG_RC=$?
+set -e
+mv "$TMP/release-state.clean.json" "$RELEASE_SESSION/state.json"
+[[ "$TAMPERED_SLUG_RC" -ne 0 && "$TAMPERED_SLUG" == *"task_slug must exactly match"* ]] || fail "public evidence accepted a tampered task slug"
+pass "public evidence rejects a mismatched or traversal task slug before assignment lookup"
 
 OUTSIDE="$TMP/outside-session"
 mkdir -p "$OUTSIDE"
@@ -97,7 +360,8 @@ run_candidate release --session-dir "$RELEASE_SESSION" --reason "consumer releas
 node -e 'const fs=require("fs");const r=JSON.parse(fs.readFileSync(process.argv[1]));if(r.status!=="released")process.exit(1)' "$ARTIFACT_ROOT/assignment/acme-widgets-101.json" || fail "release did not release assignment"
 pass "pause, resume, and release use the public command"
 
-run_candidate start --artifact-root "$ARTIFACT_ROOT" --flow builder.build --work-item acme/widgets#102 --summary "Cancel fixture" >/dev/null
+seed_pull_work acme/widgets#102
+run_candidate start --artifact-root "$ARTIFACT_ROOT" --flow builder.build --work-item acme/widgets#102 --assignment-provider local-file --summary "Cancel fixture" >/dev/null
 CANCEL_SESSION="$ARTIFACT_ROOT/acme-widgets-102"
 node --input-type=module - "$CONSUMER" "$CANCEL_SESSION" <<'NODE'
 import fs from 'node:fs';
@@ -129,6 +393,62 @@ run_candidate archive --session-dir "$CANCEL_SESSION" --authorization-file "$CON
 [[ -f "$ARTIFACT_ROOT/archive/acme-widgets-102/state.json" && ! -e "$CANCEL_SESSION" ]] || fail "cancel/archive did not retain archived session"
 pass "signed cancel and archive execute through the public command"
 
+seed_pull_work acme/widgets#106
+run_candidate start --artifact-root "$ARTIFACT_ROOT" --flow builder.build --work-item acme/widgets#106 --assignment-provider local-file --summary "Command authority lock fixture" >/dev/null
+LOCK_SESSION="$ARTIFACT_ROOT/acme-widgets-106"
+LOCK_PULL_REPORT="$LOCK_SESSION/$(basename "$LOCK_SESSION")--pull-work.md"
+LOCK_PULL_REF="{\"kind\":\"artifact\",\"file\":\"$LOCK_PULL_REPORT\",\"summary\":\"Lock fixture selected work report.\"}"
+run_candidate evidence --session-dir "$LOCK_SESSION" --expectation pickup-probe-readiness --status pass --summary "Complete lock fixture probe." --evidence-ref-json "$LOCK_PULL_REF" --json >/dev/null
+run_candidate evidence --session-dir "$LOCK_SESSION" --expectation probe-decisions-or-accepted-gaps --status pass --summary "Complete lock fixture decisions." --evidence-ref-json "$LOCK_PULL_REF" --json >/dev/null
+LOCK_PLAN_REPORT="$LOCK_SESSION/$(basename "$LOCK_SESSION")--plan-work.md"
+printf '# Lock Plan\n' > "$LOCK_PLAN_REPORT"
+LOCK_PLAN_REF="{\"kind\":\"artifact\",\"file\":\"$LOCK_PLAN_REPORT\",\"summary\":\"Lock fixture plan.\"}"
+run_candidate evidence --session-dir "$LOCK_SESSION" --expectation implementation-plan --status pass --summary "Complete lock fixture plan." --evidence-ref-json "$LOCK_PLAN_REF" --json >/dev/null
+LOCK_DELIVER_REPORT="$LOCK_SESSION/$(basename "$LOCK_SESSION")--deliver.md"
+LOCK_DELIVER_REF="{\"kind\":\"artifact\",\"file\":\"$LOCK_DELIVER_REPORT\",\"summary\":\"Lock fixture execution report.\"}"
+LOCK_STARTED="$TMP/command-lock.started"
+LOCK_COMMAND="bash checks/check-command-lock.sh '$LOCK_STARTED'"
+run_candidate evidence --session-dir "$LOCK_SESSION" --expectation implementation-scope --status pass --summary "Long command retains authority lock." --evidence-ref-json "$LOCK_DELIVER_REF" --command "$LOCK_COMMAND" --json >"$TMP/command-lock-evidence.out" 2>&1 &
+LOCK_EVIDENCE_PID=$!
+for _ in $(seq 1 250); do [[ -f "$LOCK_STARTED" ]] && break; sleep 0.02; done
+[[ -f "$LOCK_STARTED" ]] || fail "authority-lock fixture command did not start"
+run_candidate release --session-dir "$LOCK_SESSION" --reason "release must wait for the observed command" >"$TMP/command-lock-release.out" 2>&1 &
+LOCK_RELEASE_PID=$!
+sleep 0.1
+kill -0 "$LOCK_RELEASE_PID" 2>/dev/null || fail "lifecycle release bypassed the running command lock"
+node -e 'const fs=require("fs");const r=JSON.parse(fs.readFileSync(process.argv[1]));if(r.status!=="claimed")process.exit(1)' "$ARTIFACT_ROOT/assignment/acme-widgets-106.json" || fail "assignment changed before the locked command completed"
+wait "$LOCK_EVIDENCE_PID" || fail "locked evidence command failed"
+wait "$LOCK_RELEASE_PID" || fail "blocked release failed after command completion"
+node -e 'const fs=require("fs");const r=JSON.parse(fs.readFileSync(process.argv[1]));if(r.status!=="released")process.exit(1)' "$ARTIFACT_ROOT/assignment/acme-widgets-106.json" || fail "release did not complete after the command lock was released"
+pass "authority-bound commands retain the subject lock through lifecycle release"
+
+seed_pull_work acme/widgets#107
+run_candidate start --artifact-root "$ARTIFACT_ROOT" --flow builder.build --work-item acme/widgets#107 --assignment-provider local-file --summary "Process group timeout fixture" >/dev/null
+TIMEOUT_SESSION="$ARTIFACT_ROOT/acme-widgets-107"
+TIMEOUT_CHILD_PID="$TMP/command-timeout-child.pid"
+TIMEOUT_MARKER="$TMP/command-timeout-marker"
+set +e
+(cd "$CONSUMER" && CODEX_SESSION_ID=public-workflow-eval FLOW_AGENTS_EVIDENCE_COMMAND_TIMEOUT_MS=1000 FLOW_AGENTS_EVIDENCE_COMMAND_KILL_GRACE_MS=250 npx --yes --package="file:$TARBALL" flow-agents workflow evidence --session-dir "$TIMEOUT_SESSION" --expectation pickup-probe-readiness --status not_verified --summary "Timeout fixture captures full process-group termination." --command "bash checks/check-command-timeout.sh '$TIMEOUT_CHILD_PID' '$TIMEOUT_MARKER'" --json) >"$TMP/command-timeout.out" 2>&1
+TIMEOUT_RC=$?
+set -e
+[[ "$TIMEOUT_RC" -ne 0 && -s "$TIMEOUT_CHILD_PID" && ! -e "$TIMEOUT_MARKER" ]] || fail "timed-out evidence command did not complete its controlled capture"
+TIMEOUT_CHILD="$(cat "$TIMEOUT_CHILD_PID")"
+kill -0 "$TIMEOUT_CHILD" 2>/dev/null && fail "timed-out evidence command left a child process running"
+pass "timed-out evidence commands terminate their complete process group"
+
+BACKGROUND_CHILD_PID="$TMP/success-background-child.pid"
+BACKGROUND_MARKER="$TMP/success-background-marker"
+TIMEOUT_PULL_REPORT="$TIMEOUT_SESSION/$(basename "$TIMEOUT_SESSION")--pull-work.md"
+(cd "$CONSUMER" && CODEX_SESSION_ID=public-workflow-eval FLOW_AGENTS_EVIDENCE_COMMAND_KILL_GRACE_MS=50 npx --yes --package="file:$TARBALL" flow-agents workflow evidence \
+  --session-dir "$TIMEOUT_SESSION" --expectation pickup-probe-readiness --status pass \
+  --summary "Successful evidence cleans up surviving background processes." \
+  --command "bash checks/check-success-background.sh '$BACKGROUND_CHILD_PID' '$BACKGROUND_MARKER'" \
+  --evidence-ref-json "{\"kind\":\"artifact\",\"file\":\"$TIMEOUT_PULL_REPORT\",\"summary\":\"Selected work for background cleanup fixture.\"}" --json >/dev/null)
+[[ -s "$BACKGROUND_CHILD_PID" && ! -e "$BACKGROUND_MARKER" ]] || fail "successful evidence command did not expose a surviving background child"
+BACKGROUND_CHILD="$(cat "$BACKGROUND_CHILD_PID")"
+kill -0 "$BACKGROUND_CHILD" 2>/dev/null && fail "successful evidence command left a background process running"
+pass "successful evidence commands terminate surviving process-group children before recording"
+
 DOCTOR="$TMP/doctor-consumer"
 mkdir -p "$DOCTOR/node_modules/@kontourai/flow-agents" "$DOCTOR/node_modules/.bin" "$DOCTOR/.flow-agents" "$DOCTOR/kits/builder/flows" "$DOCTOR/.kontourai/flow-agents/doctor-session"
 cat >"$DOCTOR/node_modules/@kontourai/flow-agents/package.json" <<'JSON'
@@ -210,7 +530,7 @@ MISSING_JSON="$(cd "$DOCTOR" && npx --yes --package="file:$TARBALL" flow-agents
 MISSING_RC=$?
 set -e
 [[ "$MISSING_RC" -eq 2 ]] || fail "doctor should fail when an activated Kit is missing"
-node -e 'const r=JSON.parse(process.argv[1]);if(!r.warnings.some(w=>w.includes("Activated Builder Kit is missing"))||!r.warnings.some(w=>w.includes("Activated builder.build definition is missing")))process.exit(1)' "$MISSING_JSON" || fail "doctor did not report missing activated Kit components"
+node -e 'const r=JSON.parse(process.argv[1]);if(!r.warnings.some(w=>w.includes("Activated Builder Kit is missing"))||!r.warnings.some(w=>w.includes("Activated builder.build definition is missing"))||!r.warnings.some(w=>w.includes("Activated builder.shape definition is missing")))process.exit(1)' "$MISSING_JSON" || fail "doctor did not report both missing activated Builder definitions"
 pass "doctor fails closed for missing activated Kit components"
 
 HEALTHY="$TMP/healthy-install"

package/evals/integration/test_pull_work_liveness_preflight.sh

@@ -126,7 +126,7 @@ fi
 # duplicate validation logic was introduced for resolve-slug.
 if flow_agents_node "$WRITER" resolve-slug 'owner/repo' >"$TMPDIR_EVAL/a6.out" 2>"$TMPDIR_EVAL/a6.err"; then
   _fail "resolve-slug should reject a ref with no # separator"
-elif rg -q -- 'owner/repo#id format' "$TMPDIR_EVAL/a6.err"; then
+elif rg -q -- 'provider-neutral provider:id ref or owner/repo#numeric-id' "$TMPDIR_EVAL/a6.err"; then
   _pass "resolve-slug rejects a ref with no # separator using workItemSlug()'s existing message (AC7)"
 else
   _fail "resolve-slug malformed-ref rejection message mismatch: $(cat "$TMPDIR_EVAL/a6.out" "$TMPDIR_EVAL/a6.err")"
@@ -323,71 +323,27 @@ else
   _fail "liveness status unexpectedly did not acquire the lock — F1's bypass may have leaked beyond the whoami action: out=$(cat "$TMPDIR_EVAL/e3.out") err=$(cat "$TMPDIR_EVAL/e3.err")"
 fi
 
-# ─── D. Static skill-text assertions (AC6, AC8) ─────────────────────────────
-echo "--- D. Static skill-text assertions ---"
-
-require_text "$PULL" '### 1a\. Liveness Selection Preflight' "pull-work documents the Liveness Selection Preflight subsection (AC1, AC8)"
-require_text "$PULL" 'liveness whoami --json' "pull-work references liveness whoami --json by exact command name (AC1, AC8)"
-require_text "$PULL" 'liveness status --json' "pull-work references liveness status --json by exact command name (AC1, AC8)"
-require_text "$PULL" 'resolve-slug <owner>/<repo>#<issue-number>' "pull-work references resolve-slug by exact command name (AC1, AC4, AC8)"
-require_text "$PULL" 'liveness claim <subjectId>' "pull-work references liveness claim <subjectId> by exact command name (AC4, AC8)"
-require_text "$PULL" 'reading each row.s raw .status. field \(never .label.\)' "pull-work instructs consuming raw status, never label (AC1, AC8)"
-require_text "$PULL" 'a .verified. row for an actor other than self.*.held.' "pull-work documents held classification (AC1, AC2, AC8)"
-require_text "$PULL" 'excluded from the ready set by default' "pull-work excludes held candidates by default (AC2, AC8)"
-require_text "$PULL" 'effective_state: .reclaimable.' "pull-work documents reclaimable classification via the assignment-provider join (AC1, AC3, AC8, #290)"
-require_text "$PULL" 'requires an explicit recorded opt-in' "pull-work requires an explicit recorded opt-in for reclaimable selection (AC3, AC8)"
-require_text "$PULL" 'never a silent normal pick' "pull-work states reclaimable is never a silent normal pick (AC3, AC8)"
-require_text "$PULL" 'a .verified. row for the resolved self actor.*.mine.' "pull-work documents mine classification (AC1, AC5, AC8)"
-require_text "$PULL" 'do not re-offer as new, do not exclude as held-by-other' "pull-work folds own-actor mine into WIP logic, not re-offered or re-excluded (AC5, AC8)"
-require_text "$PULL" 'An explicit user instruction to proceed despite a .held. or .reclaimable. classification' "pull-work documents the --force/explicit-instruction override (AC2, AC3, AC8)"
-require_text "$PULL" '.--force.' "pull-work names --force as the override mechanism (AC2, AC8)"
-require_text "$PULL" 'override and its stated reason must be recorded in the artifact' "pull-work requires the override + reason to be recorded (AC2, AC8)"
-require_text "$PULL" 'do not mutate GitHub Projects, provider fields, or cross-repo provider state from this skill' "pull-work's existing no-provider-mutation sentence is present verbatim and unchanged (AC6, AC8)"
-require_text "$PULL" 'read/write the local runtime liveness stream, never GitHub issue/label/assignee state' "pull-work states the liveness claim is local runtime state, not a provider mutation (AC6, AC8)"
-require_text "$PULL" 'this is not\s*$|this is not a provider mutation' "pull-work explicitly states the liveness claim is not a provider mutation (AC6, AC8)"
-require_text "$PULL" '#290' "pull-work names #290 as the deferred assignment-provider seam (AC6, AC8)"
-require_text "$PULL" 'liveness_preflight' "pull-work artifact contract records liveness_preflight (AC1, AC8)"
-require_text "$PULL" 'liveness_claim' "pull-work artifact contract records liveness_claim (AC4, AC8)"
-require_text "$PICKUP_PROBE" 'flags the selected item .reclaimable., treat the recorded opt-in as a decision to re-confirm' "pickup-probe re-confirms (not silently accepts) a reclaimable opt-in on drift (AC3, AC8)"
-
-# ─── F2-F6 (fix-plan iteration 1) static assertions ─────────────────────────
-require_text "$PULL" 'group all rows for that .subjectId. by subject' "pull-work classifies per-subject (grouped rows), not per-row (F2, AC1, AC8)"
-require_text "$PULL" 'classify in this precedence order' "pull-work states the classification is an ordered precedence rule (F2, AC8)"
-# F2's original numbered precedence list was liveness-only (#166); #290 (Wave 3) replaced it with
-# the full ADR 0021 §1 assignment ⋈ liveness join, computed via `assignment-provider status`'s
-# `effective_state`/`reason` fields. These assertions are updated to match the new five-row list
-# (mine/held/reclaimable/human-held/free) rather than the old four-row liveness-only list.
-require_text "$PULL" '^1\. .effective_state: .held.. with .reason: .self_is_holder..' "pull-work's precedence rule step 1 (mine, via self_is_holder) is numbered verbatim (F2, #290, AC8)"
-require_text "$PULL" '^2\. else .effective_state: .held..' "pull-work's precedence rule step 2 (held, excluded) is numbered verbatim (F2, #290, AC8)"
-require_text "$PULL" '^3\. else .effective_state: .reclaimable..' "pull-work's precedence rule step 3 (reclaimable) is numbered verbatim (F2, #290, AC8)"
-require_text "$PULL" '^4\. else .effective_state: .human-held..' "pull-work's precedence rule step 4 (human-held) is numbered verbatim (F2, #290, AC11, AC8)"
-require_text "$PULL" '^5\. else .effective_state: .free..' "pull-work's precedence rule step 5 (free) is numbered verbatim (F2, #290, AC8)"
-require_text "$PULL" 'double-hold' "pull-work names the own-actor + other-actor co-existing row combination a double-hold (F2, AC8)"
-require_text "$PULL" 'explicit conflict warning \(per ADR 0012 §4 detection' "pull-work cites ADR 0012 §4 detection for the double-hold conflict warning (F2, AC8)"
-require_text "$PULL" 'never silently resolve it to .mine.' "pull-work states a double-hold is never silently resolved to mine (F2, AC8)"
-
-require_text "$PULL" 'pin it for reuse' "pull-work pins self_actor for reuse across the pass (F3, AC8)"
-require_text "$PULL" 'Capture the returned .actor. value as .self_actor.' "pull-work captures self_actor exactly once per pass from whoami (F3, AC8)"
-require_text "$PULL" 'liveness claim <subjectId> --actor <self_actor>' "pull-work's claim-on-selection command passes --actor <self_actor> explicitly (F3, AC4, AC8)"
-require_text "$PULL" 'always pass .--actor <self_actor>. explicitly on every claim in this pass' "pull-work requires --actor <self_actor> on every claim in the pass, not just the first (F3, AC8)"
-require_text "$PULL" 'never a fresh derivation per claim call' "pull-work states the actor is never re-derived per claim call (F3, AC8)"
-
-require_text "$PULL" 'On any claim-emit failure \(non-zero exit, unresolved actor, or liveness disabled/unavailable\)' "pull-work names the precise claim-emit failure modes covered by fail-open (F4, AC8)"
-require_text "$PULL" '\{skipped: <stderr reason>\}' "pull-work's fail-open shape records {skipped: <stderr reason>} (F4, AC8)"
-require_text "$PULL" 'also surface that skip reason in pull-work.s user-facing output' "pull-work requires the skip reason to be surfaced in user-facing output, never silent (F4, AC8)"
-require_text "$PULL" 'unresolved-actor failure.? additionally names? the remediation' "pull-work requires unresolved-actor failures to additionally name the remediation (F4, AC8)"
-
-require_text "$PULL" '.reclaimable_override.: recorded only when a .reclaimable.' "pull-work's Artifact Contract declares the reclaimable_override field (F5, AC8)"
-
-require_text "$PULL" '### Post-Claim Conflict Re-check' "pull-work documents the Post-Claim Conflict Re-check subsection (F6, AC8)"
-require_text "$PULL" 'coexists with this session.s own just-emitted claim on the same subject' "pull-work's post-claim re-check detects a double-hold against the just-emitted claim (F6, AC8)"
-require_text "$PULL" 'surface the conflict prominently in the user-facing output and instruct the user to coordinate before proceeding' "pull-work instructs surfacing the post-claim conflict prominently and coordinating before proceeding, not silently continuing (F6, AC8)"
-require_text "$PULL" 'does not provide true mutual exclusion across the read-then-write race window itself' "pull-work's honesty note states the exclusion guarantee still does not provide true mutual exclusion across the read-then-write race window (F6, AC8; updated #320 wording — see also test_liveness_verdict.sh)"
-require_text "$PULL" '.#290.\x27s provider assignment lease closes this gap for the .{0,2}local-file.{0,2} provider only' "pull-work scopes true mutual exclusion to the local-file provider only, via #290's lock (fix-plan iteration 1, F5, AC8)"
-require_text "$PULL" 'two concurrent local-file .claim. calls on the same subject genuinely cannot both win' "pull-work states local-file claim/claim races genuinely cannot both win under #290's lock (fix-plan iteration 1, F5, AC8)"
-require_text "$PULL" 'The .{0,2}GitHub.{0,2} provider \(assignee/label/claim-comment\) remains advisory/last-writer' "pull-work does NOT overclaim true mutual exclusion for the GitHub provider — advisory/last-writer, detect not prevent (fix-plan iteration 1, F5, AC8)"
-require_text "$PULL" 'Do not read .provider assignment lease. as closing the GitHub race; only the .verify-hold. publish gate \(#293\)' "pull-work explicitly warns not to read #290 as closing the GitHub race — only #293's verify-hold gate would (fix-plan iteration 1, F5, AC8)"
-
+# ─── D. Provider-neutral skill contract assertions ─────────────────────────
+echo "--- D. Provider-neutral skill contract assertions ---"
+
+require_text "$PULL" 'Assignment And Liveness Selection Preflight' "pull-work documents assignment/liveness preflight"
+require_text "$PULL" 'AssignmentProvider\.status' "pull-work consumes assignment status through the provider"
+require_text "$PULL" 'classify the subject, not individual observation rows' "pull-work classifies grouped subject state"
+require_text "$PULL" 'in this precedence' "pull-work documents ordered ownership states"
+require_text "$PULL" 'raw provider status' "pull-work consumes raw status instead of display labels"
+require_text "$PULL" 'double-hold conflict' "pull-work detects own/other live conflicts"
+require_text "$PULL" 'Exclude it by default' "pull-work excludes held work by default"
+require_text "$PULL" 'explicit recorded opt-in' "pull-work requires explicit reclaimable takeover"
+require_text "$PULL" 'reclaimable_override' "pull-work records reclaimable overrides"
+require_text "$PULL" 'takeover is resumption, not restart' "pull-work preserves incumbent continuation"
+require_text "$PULL" 'AssignmentProvider\.claim' "pull-work claims through the provider boundary"
+require_text "$PULL" 'After .AssignmentProvider\.claim' "pull-work rechecks ownership after claim"
+require_text "$PULL" 'post-claim' "pull-work records post-claim conflicts"
+require_text "$PULL" 'does not imply universal mutual exclusion' "pull-work does not overclaim race prevention"
+require_text "$PULL" 'local-file provider' "pull-work scopes serialized claims to capable providers"
+require_text "$PULL" 'without compare-and-swap' "pull-work treats non-atomic remote providers honestly"
+require_text "$PULL" 'unrelated provider state' "pull-work limits provider mutation"
+require_text "$PICKUP_PROBE" 're-confirm the recorded takeover opt-in' "pickup-probe re-confirms reclaimable takeover after drift"
 
 echo ""
 if [[ "$errors" -eq 0 ]]; then