@kontourai/flow-agents 3.6.0 → 3.8.0

package/src/cli/builder-flow-runtime.test.mjs

@@ -3,12 +3,13 @@ import assert from "node:assert/strict";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { generateKeyPairSync, sign } from "node:crypto";
+import { createHash, generateKeyPairSync, sign } from "node:crypto";
 
 import { FLOW_RUN_EVIDENCE_MANIFEST_PATH, runDir } from "@kontourai/flow";
 import {
   archiveBuilderFlowSession,
   cancelBuilderFlowSession,
+  captureReviewWorkspaceSnapshot,
   pauseBuilderFlowSession,
   recoverBuilderFlowSession,
   releaseBuilderFlowAssignment,
@@ -18,8 +19,9 @@ import {
 } from "../../build/src/builder-flow-runtime.js";
 import { builderLifecycleAuthorizationPayload, loadBuilderLifecycleAuthorization, recordAuthorizationConsumed } from "../../build/src/builder-lifecycle-authority.js";
 import { cancelBuilderBuildRun } from "../../build/src/builder-flow-run-adapter.js";
-import { performLocalClaim, readLocalAssignmentStatus, resolveCurrentAssignmentActor } from "../../build/src/cli/assignment-provider.js";
+import { performLocalClaim, performLocalRelease, readLocalAssignmentStatus, resolveCurrentAssignmentActor } from "../../build/src/cli/assignment-provider.js";
 import { main as builderRunMain } from "../../build/src/cli/builder-run.js";
+import { buildTrustBundle, inferExecutedTestCount, main as workflowSidecarMain } from "../../build/src/cli/workflow-sidecar.js";
 
 const SUBJECT = "local:work-item/runtime-projection";
 const NOW = "2026-07-09T20:00:00.000Z";
@@ -51,6 +53,9 @@ function makeSession(slug = "runtime-projection") {
     schema_version: "1.0",
     keys: [{ id: AUTHORITY_KEY_ID, algorithm: "ed25519", public_key_pem: AUTHORITY_KEYS.publicKey.export({ type: "spki", format: "pem" }) }],
   });
+  fs.mkdirSync(path.join(projectRoot, "review-target"), { recursive: true });
+  fs.writeFileSync(path.join(projectRoot, "review-target", "implementation.txt"), "reviewed implementation\n");
+  fs.writeFileSync(path.join(projectRoot, "review-target", "delivery.md"), "reviewed delivery artifact\n");
   return { projectRoot, artifactRoot, sessionDir, slug };
 }
 
@@ -59,6 +64,15 @@ function writeJson(file, value) {
   fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
 }
 
+test("shell output cannot spoof an executed-test count", () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "flow-agents-test-count-"));
+  fs.mkdirSync(path.join(root, "checks"), { recursive: true });
+  fs.writeFileSync(path.join(root, "checks", "fake-test.sh"), "#!/bin/sh\nset -e\nprintf '1 passed\\n'\n");
+  fs.writeFileSync(path.join(root, "checks", "real-test.sh"), "#!/bin/sh\nset -e\ntest -f checks/real-test.sh\n");
+  assert.equal(inferExecutedTestCount("sh checks/fake-test.sh", root, "1 passed\n"), 0);
+  assert.equal(inferExecutedTestCount("sh checks/real-test.sh", root, "1..1\nok 1 - file exists\n"), 1);
+});
+
 function readJson(file) {
   return JSON.parse(fs.readFileSync(file, "utf8"));
 }
@@ -200,7 +214,7 @@ async function assertRecoveryRejectsWithoutWrites(session, pattern) {
   assert.deepEqual(snapshotProjectionTargets(session), beforeProjection);
 }
 
-function bundleClaim({ expectation, claimType, subjectType, status = "pass", routeReason, subject = SUBJECT }) {
+function bundleClaim({ expectation, claimType, subjectType, status = "pass", routeReason, subject = SUBJECT, testCount = 1, timestamp = new Date().toISOString() }) {
   const claimId = `claim.${expectation}`;
   return {
     claim: {
@@ -212,6 +226,11 @@ function bundleClaim({ expectation, claimType, subjectType, status = "pass", rou
       value: status,
       metadata: {
         workflow_subject_ref: subject,
+        ...(expectation === "tests-evidence" ? {
+          recorded_by: "implementation-actor",
+          artifact_refs: [{ kind: "command", excerpt: "node --test src/cli/builder-flow-runtime.test.mjs", summary: "Runtime fixture assertion." }],
+          observed_commands: [{ command: "node --test src/cli/builder-flow-runtime.test.mjs", exit_code: 0, test_count: testCount, output_sha256: "0".repeat(64) }],
+        } : {}),
         gate_claim: {
           expectation_id: expectation,
           claim_type: claimType,
@@ -219,8 +238,8 @@ function bundleClaim({ expectation, claimType, subjectType, status = "pass", rou
           ...(routeReason ? { route_reason: routeReason } : {}),
         },
       },
-      createdAt: NOW,
-      updatedAt: NOW,
+      createdAt: timestamp,
+      updatedAt: timestamp,
     },
     evidence: {
       id: `evidence.${expectation}`,
@@ -229,7 +248,7 @@ function bundleClaim({ expectation, claimType, subjectType, status = "pass", rou
       method: "attestation",
       sourceRef: "src/cli/builder-flow-runtime.test.mjs",
       excerptOrSummary: `${expectation} fixture`,
-      observedAt: NOW,
+      observedAt: timestamp,
       collectedBy: "flow-agents-test",
     },
     event: {
@@ -239,10 +258,47 @@ function bundleClaim({ expectation, claimType, subjectType, status = "pass", rou
       actor: "flow-agents-test",
       method: "attestation",
       evidenceIds: [`evidence.${expectation}`],
-      createdAt: NOW,
-      verifiedAt: NOW,
+      createdAt: timestamp,
+      verifiedAt: timestamp,
+    },
+  };
+}
+
+function verifiedTestsPrerequisites(session, timestamp = new Date().toISOString()) {
+  const reviewArtifact = path.join(session.projectRoot, "review-target", "delivery.md");
+  const implementation = path.join(session.projectRoot, "review-target", "implementation.txt");
+  const implementationFile = path.relative(session.projectRoot, implementation);
+  const implementationBytes = fs.readFileSync(implementation);
+  const implementationSha256 = createHash("sha256").update(implementationBytes).digest("hex");
+  const workspaceDigest = createHash("sha256")
+    .update("flow-agents:reviewed-files:v1\0")
+    .update(implementationFile).update("\0").update(implementationBytes).update("\0")
+    .digest("hex");
+  const critique = bundleClaim({ expectation: "clean-critique", claimType: "workflow.critique.review", subjectType: "workflow-critique", timestamp });
+  critique.claim.metadata = {
+    workflow_subject_ref: SUBJECT,
+    origin: "critique",
+    reviewer: "reviewer-actor",
+    findings: [],
+    lanes: [{ id: "code", status: "pass" }],
+    review_target: {
+      artifacts: [{ file: path.relative(session.projectRoot, reviewArtifact), sha256: createHash("sha256").update(fs.readFileSync(reviewArtifact)).digest("hex") }],
+      workspace_snapshot: {
+        version: 1,
+        kind: "reviewed-files",
+        algorithm: "sha256",
+        digest: workspaceDigest,
+        files: [{ file: implementationFile, sha256: implementationSha256 }],
+      },
     },
   };
+  const criterion = bundleClaim({ expectation: "verified-criterion", claimType: "workflow.acceptance.criterion", subjectType: "flow-step", timestamp });
+  criterion.claim.metadata = {
+    workflow_subject_ref: SUBJECT,
+    origin: "acceptance",
+    criterion: { id: "ac-runtime", status: "pass", evidence_refs: [{ kind: "command", excerpt: "node --test src/cli/builder-flow-runtime.test.mjs", summary: "Runtime fixture assertion." }] },
+  };
+  return [critique, criterion];
 }
 
 function writeBundle(sessionDir, entries) {
@@ -256,6 +312,24 @@ function writeBundle(sessionDir, entries) {
   });
 }
 
+function historicalProducerSuperseded(entry, suffix = "historical") {
+  const copy = withIdentitySuffix(entry, suffix);
+  copy.claim.producerStatus = "superseded";
+  return copy;
+}
+
+function withIdentitySuffix(entry, suffix) {
+  const copy = structuredClone(entry);
+  const priorId = copy.claim.id;
+  copy.claim.id = `${priorId}.${suffix}`;
+  copy.evidence.id = `${copy.evidence.id}.${suffix}`;
+  copy.evidence.claimId = copy.claim.id;
+  copy.event.id = `${copy.event.id}.${suffix}`;
+  copy.event.claimId = copy.claim.id;
+  copy.event.evidenceIds = [copy.evidence.id];
+  return copy;
+}
+
 async function writeAndSync(session, entries) {
   writeBundle(session.sessionDir, entries);
   return syncBuilderFlowSession({ sessionDir: session.sessionDir });
@@ -291,6 +365,53 @@ test("small-model client can start and advance from projected actions without ch
   assert.equal(duplicate.run.manifest.evidence.length, advanced.run.manifest.evidence.length);
 });
 
+test("sync attaches the staged trust.bundle bytes when the session bundle is replaced", async () => {
+  const session = makeSession("snapshot-attachment");
+  await startBuilderFlowSession({ sessionDir: session.sessionDir });
+  const originalEntries = [bundleClaim({ expectation: "selected-work", claimType: "builder.pull-work.selected", subjectType: "work-item" })];
+  writeBundle(session.sessionDir, originalEntries);
+  const bundleFile = path.join(session.sessionDir, "trust.bundle");
+  const originalDigest = createHash("sha256").update(fs.readFileSync(bundleFile)).digest("hex");
+  let replaceBundle;
+  const replaced = new Promise((resolve) => { replaceBundle = resolve; });
+  const watcher = fs.watch(session.sessionDir, (_event, filename) => {
+    if (String(filename) !== ".trust-bundle-snapshots") return;
+    fs.writeFileSync(bundleFile, "{\"claims\":[]}");
+    replaceBundle();
+  });
+  try {
+    const syncing = syncBuilderFlowSession({ sessionDir: session.sessionDir });
+    await Promise.race([
+      replaced,
+      new Promise((_, reject) => setTimeout(() => reject(new Error("trust.bundle snapshot was not staged")), 2_000)),
+    ]);
+    const synced = await syncing;
+    assert.equal(synced.attached, true);
+  } finally {
+    watcher.close();
+  }
+  const manifest = readJson(path.join(runDir(session.slug, session.projectRoot), FLOW_RUN_EVIDENCE_MANIFEST_PATH));
+  assert.equal(manifest.evidence.at(-1).sha256, originalDigest);
+  assert.equal(fs.existsSync(path.join(session.sessionDir, ".trust-bundle-snapshots")), false);
+});
+
+test("start rejects a requested Builder flow that differs from the existing run before projection mutation", async (t) => {
+  for (const [existingFlowId, requestedFlowId] of [["builder.shape", "builder.build"], ["builder.build", "builder.shape"]]) {
+    await t.test(`${existingFlowId} cannot resume as ${requestedFlowId}`, async () => {
+      const session = makeSession(`flow-mismatch-${existingFlowId.replace('.', '-')}`);
+      await startBuilderFlowSession({ sessionDir: session.sessionDir, flowId: existingFlowId });
+      const beforeFlow = snapshotTree(runDir(session.slug, session.projectRoot));
+      const beforeProjection = snapshotProjectionTargets(session);
+      await assert.rejects(
+        () => startBuilderFlowSession({ sessionDir: session.sessionDir, flowId: requestedFlowId }),
+        new RegExp(`requested ${requestedFlowId} does not match the existing ${existingFlowId} run`),
+      );
+      assert.deepEqual(snapshotTree(runDir(session.slug, session.projectRoot)), beforeFlow);
+      assert.deepEqual(snapshotProjectionTargets(session), beforeProjection);
+    });
+  }
+});
+
 test("pause and resume preserve the current Flow step and active assignment", async () => {
   const session = makeSession("lifecycle-pause-resume");
   claimAmbientSessionAssignment(session);
@@ -546,6 +667,8 @@ test("builder-run exposes lifecycle actions without caller-selected Flow identit
   const ambient = resolveCurrentAssignmentActor();
   performLocalClaim(session.artifactRoot, session.slug, ambient.actor, { actorKey: ambient.actorKey, ttlSeconds: 1800, branch: `agent/${session.slug}`, artifactDir: session.sessionDir, workItemRef: SUBJECT, reason: "test" });
   await startBuilderFlowSession({ sessionDir: session.sessionDir });
+  assert.equal(await builderRunMain(["start", "--session-dir", session.sessionDir]), 64);
+  assert.equal(await builderRunMain(["sync", "--session-dir", session.sessionDir]), 64);
   assert.equal(await builderRunMain([
     "pause", "--session-dir", session.sessionDir,
     "--reason", "cli pause",
@@ -631,19 +754,297 @@ test("failed verification projects Flow-owned route-back attempt and budget", as
   const verify = await writeAndSync(session, [bundleClaim({ expectation: "implementation-scope", claimType: "builder.execute.scope", subjectType: "change" })]);
   assert.equal(verify.run.state.current_step, "verify");
 
+  const failureTimestamp = new Date().toISOString();
   const routed = await writeAndSync(session, [bundleClaim({
     expectation: "tests-evidence",
     claimType: "builder.verify.tests",
     subjectType: "flow-step",
     status: "fail",
     routeReason: "implementation_defect",
-  })]);
+    timestamp: failureTimestamp,
+  }), ...verifiedTestsPrerequisites(session, failureTimestamp)]);
 
   assert.equal(routed.run.state.current_step, "execute");
   assert.equal(routed.projection.flow_run.route_back_attempt, 1);
   assert.equal(routed.projection.flow_run.route_back_max_attempts, 3);
   assert.match(routed.projection.next_action.summary, /Route-back history: attempt 1\/3 returned to `execute` for `implementation_defect`/);
   assert.deepEqual(routed.projection.next_action.skills, ["execute-plan"]);
+
+  const reentered = await writeAndSync(session, [withIdentitySuffix(bundleClaim({
+    expectation: "implementation-scope",
+    claimType: "builder.execute.scope",
+    subjectType: "change",
+    timestamp: new Date().toISOString(),
+  }), "reentry")]);
+  assert.equal(reentered.run.state.current_step, "verify");
+  const staleRetry = await writeAndSync(session, [bundleClaim({
+    expectation: "tests-evidence",
+    claimType: "builder.verify.tests",
+    subjectType: "flow-step",
+    status: "fail",
+    routeReason: "implementation_defect",
+    timestamp: NOW,
+  })]);
+  assert.equal(staleRetry.attached, false);
+  assert.equal(staleRetry.run.state.current_step, "verify");
+  assert.equal(staleRetry.run.state.transitions.filter((transition) => transition.type === "route_back").length, 1);
+  const correctedAt = new Date(Date.parse(reentered.run.state.transitions.at(-1).at) + 1).toISOString();
+  const corrected = await writeAndSync(session, [
+    withIdentitySuffix(bundleClaim({ expectation: "tests-evidence", claimType: "builder.verify.tests", subjectType: "flow-step", timestamp: correctedAt }), "corrected"),
+    ...verifiedTestsPrerequisites(session, correctedAt).map((entry, index) => withIdentitySuffix(entry, `corrected-${index}`)),
+  ]);
+  assert.equal(corrected.run.state.current_step, "merge-ready");
+  const verifyEvidence = corrected.run.manifest.evidence.filter((entry) => entry.gate_id === "verify-gate");
+  assert.equal(verifyEvidence.length, 2);
+  assert.equal(verifyEvidence[0].superseded_by, verifyEvidence[1].id);
+});
+
+test("producer-superseded FAIL is audit history and live PASS drives verify", async () => {
+  const session = makeSession("producer-superseded-verify");
+  await startBuilderFlowSession({ sessionDir: session.sessionDir });
+  await writeAndSync(session, [bundleClaim({ expectation: "selected-work", claimType: "builder.pull-work.selected", subjectType: "work-item" })]);
+  await writeAndSync(session, [
+    bundleClaim({ expectation: "pickup-probe-readiness", claimType: "builder.design-probe.pickup-readiness", subjectType: "work-item" }),
+    bundleClaim({ expectation: "probe-decisions-or-accepted-gaps", claimType: "builder.design-probe.decisions", subjectType: "decision" }),
+  ]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-plan", claimType: "builder.plan.implementation", subjectType: "artifact" })]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-scope", claimType: "builder.execute.scope", subjectType: "change" })]);
+
+  const livePass = bundleClaim({ expectation: "tests-evidence", claimType: "builder.verify.tests", subjectType: "flow-step" });
+  const historicalFail = historicalProducerSuperseded(bundleClaim({
+    expectation: "tests-evidence",
+    claimType: "builder.verify.tests",
+    subjectType: "flow-step",
+    status: "fail",
+    routeReason: "implementation_defect",
+  }));
+  const result = await writeAndSync(session, [historicalFail, livePass, ...verifiedTestsPrerequisites(session)]);
+
+  assert.equal(result.run.state.current_step, "merge-ready");
+  const attached = result.run.manifest.evidence.filter((entry) => entry.gate_id === "verify-gate" && !entry.superseded_by);
+  assert.equal(attached.length, 1);
+  assert.deepEqual(attached[0].expectation_ids.sort(), ["acceptance-criteria", "clean-critique", "tests-evidence"]);
+});
+
+test("partial passing review snapshot waits for the complete verify expectation set", async () => {
+  const session = makeSession("atomic-review-sync");
+  await startBuilderFlowSession({ sessionDir: session.sessionDir });
+  await writeAndSync(session, [bundleClaim({ expectation: "selected-work", claimType: "builder.pull-work.selected", subjectType: "work-item" })]);
+  await writeAndSync(session, [
+    bundleClaim({ expectation: "pickup-probe-readiness", claimType: "builder.design-probe.pickup-readiness", subjectType: "work-item" }),
+    bundleClaim({ expectation: "probe-decisions-or-accepted-gaps", claimType: "builder.design-probe.decisions", subjectType: "decision" }),
+  ]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-plan", claimType: "builder.plan.implementation", subjectType: "artifact" })]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-scope", claimType: "builder.execute.scope", subjectType: "change" })]);
+
+  const disputedCritique = verifiedTestsPrerequisites(session)[0];
+  disputedCritique.claim.value = "fail";
+  disputedCritique.claim.status = "disputed";
+  disputedCritique.event.status = "disputed";
+  const disputedPartial = await writeAndSync(session, [disputedCritique]);
+  assert.equal(disputedPartial.attached, false);
+  assert.equal(disputedPartial.run.state.transitions.filter((transition) => transition.type === "route_back").length, 0);
+
+  const partial = await writeAndSync(session, verifiedTestsPrerequisites(session).slice(0, 1));
+  assert.equal(partial.attached, false);
+  assert.equal(partial.run.state.current_step, "verify");
+  assert.equal(partial.run.state.transitions.filter((transition) => transition.type === "route_back").length, 0);
+
+  const complete = await writeAndSync(session, [
+    bundleClaim({ expectation: "tests-evidence", claimType: "builder.verify.tests", subjectType: "flow-step" }),
+    ...verifiedTestsPrerequisites(session),
+  ]);
+  assert.equal(complete.run.state.current_step, "merge-ready");
+});
+
+test("initial gate boundary rejects pre-run and far-future claims", async () => {
+  for (const [name, timestamp] of [
+    ["pre-run", NOW],
+    ["far-future", new Date(Date.now() + 60 * 60_000).toISOString()],
+  ]) {
+    const session = makeSession(`freshness-${name}`);
+    await startBuilderFlowSession({ sessionDir: session.sessionDir });
+    const result = await writeAndSync(session, [bundleClaim({
+      expectation: "selected-work",
+      claimType: "builder.pull-work.selected",
+      subjectType: "work-item",
+      timestamp,
+    })]);
+    assert.equal(result.attached, false, name);
+    assert.equal(result.run.state.current_step, "pull-work", name);
+  }
+});
+
+test("prior claim identity is rejected after re-entry and a new identity can recover", async () => {
+  const session = makeSession("same-digest-reentry");
+  await startBuilderFlowSession({ sessionDir: session.sessionDir });
+  await writeAndSync(session, [bundleClaim({ expectation: "selected-work", claimType: "builder.pull-work.selected", subjectType: "work-item" })]);
+  await writeAndSync(session, [
+    bundleClaim({ expectation: "pickup-probe-readiness", claimType: "builder.design-probe.pickup-readiness", subjectType: "work-item" }),
+    bundleClaim({ expectation: "probe-decisions-or-accepted-gaps", claimType: "builder.design-probe.decisions", subjectType: "decision" }),
+  ]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-plan", claimType: "builder.plan.implementation", subjectType: "artifact" })]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-scope", claimType: "builder.execute.scope", subjectType: "change" })]);
+  const future = new Date(Date.now() + 10_000).toISOString();
+  const failure = [bundleClaim({ expectation: "tests-evidence", claimType: "builder.verify.tests", subjectType: "flow-step", status: "fail", routeReason: "implementation_defect", timestamp: future }), ...verifiedTestsPrerequisites(session, future)];
+  const first = await writeAndSync(session, failure);
+  assert.equal(first.run.state.current_step, "execute");
+  await writeAndSync(session, [withIdentitySuffix(bundleClaim({ expectation: "implementation-scope", claimType: "builder.execute.scope", subjectType: "change", timestamp: future }), "reentry")]);
+  const replay = await writeAndSync(session, failure);
+  assert.equal(replay.attached, false);
+  assert.equal(replay.run.state.current_step, "verify");
+  assert.equal(replay.run.state.transitions.filter((transition) => transition.type === "route_back").length, 1);
+  const newIdentity = failure.map((entry, index) => withIdentitySuffix(entry, `visit-2-${index}`));
+  const second = await writeAndSync(session, newIdentity);
+  assert.equal(second.run.state.current_step, "execute");
+  const verifyEvidence = second.run.manifest.evidence.filter((entry) => entry.gate_id === "verify-gate");
+  assert.equal(verifyEvidence.length, 2);
+  assert.equal(verifyEvidence[0].superseded_by, verifyEvidence[1].id);
+});
+
+test("legacy colon-bearing assignment actor releases only through its normalized equivalent", () => {
+  const session = makeSession("legacy-actor-release");
+  const legacyActor = { runtime: "unknown", session_id: "legacy-session", host: "Kontour", human: null };
+  performLocalClaim(session.artifactRoot, session.slug, legacyActor, {
+    ttlSeconds: 1800,
+    actorKey: "unknown:legacy-session:Kontour",
+    branch: `agent/${session.slug}`,
+    artifactDir: session.sessionDir,
+    workItemRef: SUBJECT,
+    reason: "legacy fixture",
+  });
+  assert.throws(() => performLocalRelease(session.artifactRoot, session.slug, legacyActor, {
+    actorKey: "different-actor",
+  }), /refusing to release/);
+  assert.throws(() => performLocalRelease(session.artifactRoot, session.slug, { ...legacyActor, session_id: "different" }, {
+    actorKey: "unknownlegacy-sessionKontour",
+  }), /refusing to release/);
+  const released = performLocalRelease(session.artifactRoot, session.slug, legacyActor, {
+    actorKey: "unknownlegacy-sessionKontour",
+  });
+  assert.equal(released.status, "released");
+});
+
+test("string-only legacy liveness identity cannot be released by a colliding modern actor", async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "flow-agents-legacy-liveness-"));
+  const eventsFile = path.join(root, "liveness", "events.jsonl");
+  fs.mkdirSync(path.dirname(eventsFile), { recursive: true });
+  fs.writeFileSync(eventsFile, `${JSON.stringify({
+    type: "claim",
+    subjectId: "legacy-subject",
+    actor: "unknown:anc-123456789abc:Kontour",
+    at: NOW,
+    ttlSeconds: 1800,
+  })}\n`);
+
+  await assert.rejects(() => workflowSidecarMain([
+    "liveness", "release", "legacy-subject",
+    "--actor", "unknownanc-123456789abcKontour",
+    "--artifact-root", root,
+    "--at", "2026-07-09T20:01:00.000Z",
+  ]), /prior claim/);
+  const events = fs.readFileSync(eventsFile, "utf8").trim().split("\n").map(JSON.parse);
+  assert.equal(events.length, 1);
+});
+
+test("lossy modern liveness key collision cannot release a non-reversible legacy actor", async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "flow-agents-lossy-liveness-"));
+  const eventsFile = path.join(root, "liveness", "events.jsonl");
+  fs.mkdirSync(path.dirname(eventsFile), { recursive: true });
+  fs.writeFileSync(eventsFile, `${JSON.stringify({ type: "claim", subjectId: "collision", actor: "a:b", at: NOW, ttlSeconds: 1800 })}\n`);
+  await assert.rejects(() => workflowSidecarMain([
+    "liveness", "release", "collision", "--actor", "ab", "--artifact-root", root,
+  ]), /prior claim/);
+  assert.equal(fs.readFileSync(eventsFile, "utf8").trim().split("\n").length, 1);
+});
+
+test("upgrade rebuild preserves legacy critique identity until a versioned new review", async () => {
+  const legacy = {
+    id: "upgrade-review",
+    reviewer: "reviewer",
+    reviewed_at: "2026-07-01T00:00:00Z",
+    verdict: "pass",
+    summary: "Legacy clean review",
+    findings: [],
+    lanes: [{ id: "code", status: "pass" }],
+    review_target: { artifacts: [] },
+    artifact_refs: [],
+  };
+  const beforeUpgrade = await buildTrustBundle("upgrade-fixture", "2026-07-01T00:00:00Z", [], [], [legacy]);
+  const rebuiltAfterUpgrade = await buildTrustBundle("upgrade-fixture", "2026-07-12T00:00:00Z", [], [], [legacy]);
+  const newReview = await buildTrustBundle("upgrade-fixture", "2026-07-12T00:01:00Z", [], [], [{
+    ...legacy,
+    reviewed_at: "2026-07-12T00:01:00Z",
+    identity_version: 2,
+  }]);
+  assert.equal(beforeUpgrade.claims[0].id, rebuiltAfterUpgrade.claims[0].id);
+  assert.notEqual(newReview.claims[0].id, beforeUpgrade.claims[0].id);
+  assert.equal(rebuiltAfterUpgrade.claims[0].metadata.identity_version, undefined);
+  assert.equal(newReview.claims[0].metadata.identity_version, 2);
+});
+
+test("passing tests-evidence rejects a critique whose reviewed artifact changed", async () => {
+  const session = makeSession("stale-critique-artifact");
+  await startBuilderFlowSession({ sessionDir: session.sessionDir });
+  await writeAndSync(session, [bundleClaim({ expectation: "selected-work", claimType: "builder.pull-work.selected", subjectType: "work-item" })]);
+  await writeAndSync(session, [
+    bundleClaim({ expectation: "pickup-probe-readiness", claimType: "builder.design-probe.pickup-readiness", subjectType: "work-item" }),
+    bundleClaim({ expectation: "probe-decisions-or-accepted-gaps", claimType: "builder.design-probe.decisions", subjectType: "decision" }),
+  ]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-plan", claimType: "builder.plan.implementation", subjectType: "artifact" })]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-scope", claimType: "builder.execute.scope", subjectType: "change" })]);
+  const prerequisites = verifiedTestsPrerequisites(session);
+  fs.writeFileSync(path.join(session.projectRoot, "review-target", "delivery.md"), "changed after review\n");
+  await assert.rejects(
+    () => writeAndSync(session, [bundleClaim({ expectation: "tests-evidence", claimType: "builder.verify.tests", subjectType: "flow-step" }), ...prerequisites]),
+    /review_target\.artifacts\.sha256.*does not match/,
+  );
+});
+
+test("passing tests-evidence rejects a successful command that executed zero tests", async () => {
+  const session = makeSession("zero-test-evidence");
+  await startBuilderFlowSession({ sessionDir: session.sessionDir });
+  await writeAndSync(session, [bundleClaim({ expectation: "selected-work", claimType: "builder.pull-work.selected", subjectType: "work-item" })]);
+  await writeAndSync(session, [
+    bundleClaim({ expectation: "pickup-probe-readiness", claimType: "builder.design-probe.pickup-readiness", subjectType: "work-item" }),
+    bundleClaim({ expectation: "probe-decisions-or-accepted-gaps", claimType: "builder.design-probe.decisions", subjectType: "decision" }),
+  ]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-plan", claimType: "builder.plan.implementation", subjectType: "artifact" })]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-scope", claimType: "builder.execute.scope", subjectType: "change" })]);
+  await assert.rejects(
+    () => writeAndSync(session, [
+      bundleClaim({ expectation: "tests-evidence", claimType: "builder.verify.tests", subjectType: "flow-step", testCount: 0 }),
+      ...verifiedTestsPrerequisites(session),
+    ]),
+    /positive executed-test count/,
+  );
+});
+
+test("passing tests-evidence rejects a critique after implementation source changed", async () => {
+  const session = makeSession("stale-critique-workspace");
+  await startBuilderFlowSession({ sessionDir: session.sessionDir });
+  await writeAndSync(session, [bundleClaim({ expectation: "selected-work", claimType: "builder.pull-work.selected", subjectType: "work-item" })]);
+  await writeAndSync(session, [
+    bundleClaim({ expectation: "pickup-probe-readiness", claimType: "builder.design-probe.pickup-readiness", subjectType: "work-item" }),
+    bundleClaim({ expectation: "probe-decisions-or-accepted-gaps", claimType: "builder.design-probe.decisions", subjectType: "decision" }),
+  ]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-plan", claimType: "builder.plan.implementation", subjectType: "artifact" })]);
+  await writeAndSync(session, [bundleClaim({ expectation: "implementation-scope", claimType: "builder.execute.scope", subjectType: "change" })]);
+  const prerequisites = verifiedTestsPrerequisites(session);
+  fs.writeFileSync(path.join(session.projectRoot, "review-target", "implementation.txt"), "source changed after review\n");
+  await assert.rejects(
+    () => writeAndSync(session, [bundleClaim({ expectation: "tests-evidence", claimType: "builder.verify.tests", subjectType: "flow-step" }), ...prerequisites]),
+    /review_target\.workspace_snapshot\.digest.*does not match/,
+  );
+});
+
+test("workspace review fails closed when a Git worktree marker cannot be inspected", () => {
+  const session = makeSession("git-inspection-unavailable");
+  fs.mkdirSync(path.join(session.projectRoot, ".git"));
+  assert.throws(
+    () => captureReviewWorkspaceSnapshot(session.projectRoot, [{ file: "review-target/delivery.md", sha256: createHash("sha256").update("reviewed delivery\n").digest("hex") }]),
+    /could not inspect the Git worktree/,
+  );
 });
 
 test("verified sidecar claims drive the composed publish and learning prefix to completion", async () => {
@@ -651,25 +1052,30 @@ test("verified sidecar claims drive the composed publish and learning prefix to
   claimSessionAssignment(session);
   await startBuilderFlowSession({ sessionDir: session.sessionDir });
   const steps = [
-    [bundleClaim({ expectation: "selected-work", claimType: "builder.pull-work.selected", subjectType: "work-item" })],
-    [
+    () => [bundleClaim({ expectation: "selected-work", claimType: "builder.pull-work.selected", subjectType: "work-item" })],
+    () => [
       bundleClaim({ expectation: "pickup-probe-readiness", claimType: "builder.design-probe.pickup-readiness", subjectType: "work-item" }),
       bundleClaim({ expectation: "probe-decisions-or-accepted-gaps", claimType: "builder.design-probe.decisions", subjectType: "decision" }),
     ],
-    [bundleClaim({ expectation: "implementation-plan", claimType: "builder.plan.implementation", subjectType: "artifact" })],
-    [bundleClaim({ expectation: "implementation-scope", claimType: "builder.execute.scope", subjectType: "change" })],
-    [bundleClaim({ expectation: "tests-evidence", claimType: "builder.verify.tests", subjectType: "flow-step" })],
-    [bundleClaim({ expectation: "merge-readiness", claimType: "builder.merge-ready.readiness", subjectType: "change" })],
+    () => [bundleClaim({ expectation: "implementation-plan", claimType: "builder.plan.implementation", subjectType: "artifact" })],
+    () => [bundleClaim({ expectation: "implementation-scope", claimType: "builder.execute.scope", subjectType: "change" })],
+    () => [bundleClaim({ expectation: "tests-evidence", claimType: "builder.verify.tests", subjectType: "flow-step" }), ...verifiedTestsPrerequisites(session)],
+    () => [bundleClaim({ expectation: "merge-readiness", claimType: "builder.merge-ready.readiness", subjectType: "change" })],
   ];
-  for (const entries of steps) await writeAndSync(session, entries);
+  for (const entries of steps) await writeAndSync(session, entries());
 
   const prOpen = readJson(path.join(session.sessionDir, "state.json"));
   assert.equal(prOpen.flow_run.current_step, "pr-open");
+  assert.equal(readJson(path.join(session.artifactRoot, "current.json")).active_step_id, "pr-open");
   assert.deepEqual(prOpen.next_action.skills, []);
   assert.deepEqual(prOpen.next_action.operations, ["publish-change"]);
 
-  await writeAndSync(session, [bundleClaim({ expectation: "pull-request-opened", claimType: "builder.pr-open.pull-request", subjectType: "pull-request" })]);
-  await writeAndSync(session, [bundleClaim({ expectation: "ci-merge-readiness", claimType: "builder.merge-ready-ci.readiness", subjectType: "pull-request" })]);
+  const mergeReadyCi = await writeAndSync(session, [bundleClaim({ expectation: "pull-request-opened", claimType: "builder.pr-open.pull-request", subjectType: "pull-request" })]);
+  assert.equal(mergeReadyCi.run.state.current_step, "merge-ready-ci");
+  assert.equal(readJson(path.join(session.artifactRoot, "current.json")).active_step_id, "merge-ready-ci");
+  const learn = await writeAndSync(session, [bundleClaim({ expectation: "ci-merge-readiness", claimType: "builder.merge-ready-ci.readiness", subjectType: "pull-request" })]);
+  assert.equal(learn.run.state.current_step, "learn");
+  assert.equal(readJson(path.join(session.artifactRoot, "current.json")).active_step_id, "learn");
   const completed = await writeAndSync(session, [
     bundleClaim({ expectation: "decision-evidence", claimType: "builder.learn.decisions", subjectType: "decision" }),
     bundleClaim({ expectation: "learning-evidence", claimType: "builder.learn.evidence", subjectType: "release" }),
@@ -679,6 +1085,18 @@ test("verified sidecar claims drive the composed publish and learning prefix to
   assert.equal(completed.run.state.status, "completed");
   assert.equal(completed.projection.status, "delivered");
   assert.deepEqual(completed.projection.next_action, { status: "done", summary: "Canonical Flow run is complete." });
+  const liveEvidence = completed.run.manifest.evidence.filter((entry) => !entry.superseded_by);
+  assert.deepEqual(liveEvidence.map((entry) => entry.expectation_ids), [
+    ["selected-work"],
+    ["pickup-probe-readiness", "probe-decisions-or-accepted-gaps"],
+    ["implementation-plan"],
+    ["implementation-scope"],
+    ["clean-critique", "acceptance-criteria", "tests-evidence"],
+    ["merge-readiness"],
+    ["pull-request-opened"],
+    ["ci-merge-readiness"],
+    ["decision-evidence", "learning-evidence"],
+  ]);
 
   const flowDirectory = runDir(session.slug, session.projectRoot);
   const beforeFlow = snapshotTree(flowDirectory);

package/src/cli/builder-run.ts

@@ -6,11 +6,9 @@ import {
   recoverBuilderFlowSession,
   releaseBuilderFlowAssignment,
   resumeBuilderFlowSession,
-  startBuilderFlowSession,
-  syncBuilderFlowSession,
 } from "../builder-flow-runtime.js";
 
-const USAGE = "Usage: flow-agents builder-run <start|sync|recover|pause|resume|cancel|release-assignment|archive> --session-dir <path> [--reason <text> | --authorization-file <path>]";
+const USAGE = "Usage: flow-agents builder-run <recover|pause|resume|cancel|release-assignment|archive> --session-dir <path> [--reason <text> | --authorization-file <path>]";
 
 export async function main(argv: string[]): Promise<number> {
   const parsed = parseArgs(argv);
@@ -29,7 +27,7 @@ export async function main(argv: string[]): Promise<number> {
     console.error("builder-run requires --session-dir .kontourai/flow-agents/<slug>");
     return 64;
   }
-  if (!action || !["start", "sync", "recover", "pause", "resume", "cancel", "release-assignment", "archive"].includes(action)) {
+  if (!action || !["recover", "pause", "resume", "cancel", "release-assignment", "archive"].includes(action)) {
     console.error(USAGE);
     return 64;
   }
@@ -53,11 +51,7 @@ export async function main(argv: string[]): Promise<number> {
     console.error(USAGE);
     return 64;
   }
-  const result = action === "start"
-    ? await startBuilderFlowSession({ sessionDir })
-    : action === "sync"
-      ? await syncBuilderFlowSession({ sessionDir })
-      : action === "recover"
+  const result = action === "recover"
         ? await recoverBuilderFlowSession({ sessionDir })
         : action === "pause"
           ? await pauseBuilderFlowSession({ sessionDir, reason: reason! })