@kontourai/flow-agents 3.9.0 → 3.10.0

package/evals/integration/test_install_merge.sh

@@ -1169,7 +1169,11 @@ EOF_CFG
 
 cat > "$CH4_DEST/AGENTS.md" << 'EOF_AGENTS'
 # User Codex Instructions
+
+Arbitrary user bytes must survive exactly.
+Unicode: café / 雪
 EOF_AGENTS
+CH4_AGENTS_BEFORE="$(shasum -a 256 "$CH4_DEST/AGENTS.md" | awk '{print $1}')"
 
 cat > "$CH4_DEST/hooks.json" << 'JSON'
 {
@@ -1213,7 +1217,8 @@ CODEX_REAL_HOME="$TMPDIR_EVAL/fake-real-codex" FLOW_AGENTS_SKILLS_DIR="$CH4_SKIL
 
 if grep -q 'user-model' "$CH4_DEST/config.toml" \
   && grep -q 'user-profile-model' "$CH4_DEST/custom.config.toml" \
-  && grep -q 'User Codex Instructions' "$CH4_DEST/AGENTS.md"; then
+  && grep -q 'User Codex Instructions' "$CH4_DEST/AGENTS.md" \
+  && [[ "$CH4_AGENTS_BEFORE" == "$(shasum -a 256 "$CH4_DEST/AGENTS.md" | awk '{print $1}')" ]]; then
   _pass "CH4: user-owned config.toml, profile, and AGENTS.md preserved"
 else
   _fail "CH4: user-owned config.toml, profile, or AGENTS.md was overwritten"
@@ -1308,6 +1313,22 @@ for CH5_REL in scripts kits hooks.json; do
   fi
 done
 
+CH8_FIXTURES="$ROOT_DIR/evals/fixtures/codex-legacy-agents"
+CH8_PREFLIGHT="$TMPDIR_EVAL/codex-home-ch8-later-preflight"
+mkdir -p "$CH8_PREFLIGHT/scripts"
+cp "$CH8_FIXTURES/5273878130bdafc8a024a650bb5b66c9b003f1f859b5dc6e5b588cbf4ab23228.md" "$CH8_PREFLIGHT/AGENTS.md"
+printf 'unowned collision\n' > "$CH8_PREFLIGHT/scripts/kit.js"
+CH8_PREFLIGHT_BEFORE="$(shasum -a 256 "$CH8_PREFLIGHT/AGENTS.md" | awk '{print $1}')"
+if CODEX_REAL_HOME="$TMPDIR_EVAL/fake-real-codex" FLOW_AGENTS_SKILLS_DIR="$TMPDIR_EVAL/ch8-preflight-skills" \
+  bash "$ROOT_DIR/scripts/install-codex-home.sh" "$CH8_PREFLIGHT" >"$TMPDIR_EVAL/ch8-preflight.out" 2>&1; then
+  _fail "CH8: later owned-overlay collision unexpectedly installed"
+elif [[ "$CH8_PREFLIGHT_BEFORE" == "$(shasum -a 256 "$CH8_PREFLIGHT/AGENTS.md" | awk '{print $1}')" ]] \
+  && [[ ! -e "$CH8_PREFLIGHT/.flow-agents/manual-recovery" && ! -e "$CH8_PREFLIGHT/hooks.json" ]]; then
+  _pass "CH8: complete install preflight failure leaves exact legacy source and destination untouched"
+else
+  _fail "CH8: later install preflight failure partially migrated or mutated destination"
+fi
+
 echo ""
 echo "--- CH6: codex-home rejects canonical source/destination overlap before writes ---"
 CH6_ROOT="$TMPDIR_EVAL/ch6-fixture-root"
@@ -1315,8 +1336,9 @@ CH6_FAKE_BIN="$TMPDIR_EVAL/ch6-bin"
 CH_FIXTURE_SCRIPTS="scr""ipts"
 CH_FIXTURE_SKILLS="sk""ills"
 CH_FIXTURE_AGENTS="ag""ents"
-mkdir -p "$CH6_ROOT/$CH_FIXTURE_SCRIPTS" "$CH6_ROOT/dist/codex/$CH_FIXTURE_SCRIPTS" "$CH6_FAKE_BIN"
-cp "$ROOT_DIR/scripts/install-codex-home.sh" "$ROOT_DIR/scripts/install-owned-files.js" "$CH6_ROOT/$CH_FIXTURE_SCRIPTS/"
+mkdir -p "$CH6_ROOT/$CH_FIXTURE_SCRIPTS" "$CH6_ROOT/packaging" "$CH6_ROOT/dist/codex/$CH_FIXTURE_SCRIPTS" "$CH6_FAKE_BIN"
+cp "$ROOT_DIR/scripts/install-codex-home.sh" "$ROOT_DIR/scripts/install-owned-files.js" "$ROOT_DIR/scripts/classify-codex-legacy-agents.js" "$CH6_ROOT/$CH_FIXTURE_SCRIPTS/"
+cp "$ROOT_DIR/packaging/codex-legacy-agents-fingerprints.json" "$CH6_ROOT/packaging/"
 printf '#!/usr/bin/env bash\nexit 0\n' > "$CH6_FAKE_BIN/npm"
 chmod +x "$CH6_FAKE_BIN/npm"
 printf 'fixture\n' > "$CH6_ROOT/dist/codex/$CH_FIXTURE_SCRIPTS/fixture.txt"
@@ -1658,6 +1680,122 @@ fi
 
 echo ""
 
+# ─── codex-home: CH8: global instruction cleanup and preservation ───────────
+echo "--- CH8: codex-home does not install global instructions and safely migrates exact legacy files ---"
+
+CH8_SKILLS="$TMPDIR_EVAL/codex-home-ch8-skills"
+CH8_CLEAN="$TMPDIR_EVAL/codex-home-ch8-clean"
+mkdir -p "$CH8_CLEAN"
+CH8_CLEAN_OUT="$TMPDIR_EVAL/ch8-clean.out"
+if CODEX_REAL_HOME="$TMPDIR_EVAL/fake-real-codex" FLOW_AGENTS_SKILLS_DIR="$CH8_SKILLS" \
+  bash "$ROOT_DIR/scripts/install-codex-home.sh" "$CH8_CLEAN" >"$CH8_CLEAN_OUT" 2>&1 \
+  && [[ ! -e "$CH8_CLEAN/AGENTS.md" ]] \
+  && [[ -f "$CH8_CLEAN/hooks.json" && -f "$CH8_CLEAN/ag""ents/tool-worker.toml" ]] \
+  && [[ -f "$CH8_SKILLS/plan-work/SKILL.md" ]]; then
+  _pass "CH8: clean install leaves global AGENTS.md absent while runtime assets and universal skills install"
+else
+  _fail "CH8: clean install created global instructions or lost required install assets"
+fi
+
+CH8_FIXTURES="$ROOT_DIR/evals/fixtures/codex-legacy-agents"
+while IFS=$'\t' read -r CH8_HASH CH8_BYTES; do
+  CH8_LEGACY="$TMPDIR_EVAL/codex-home-ch8-legacy-$CH8_HASH"
+  CH8_LEGACY_SKILLS="$TMPDIR_EVAL/codex-home-ch8-legacy-skills-$CH8_HASH"
+  mkdir -p "$CH8_LEGACY"
+  CH8_LEGACY_REAL="$(cd "$CH8_LEGACY" && pwd -P)"
+  cp "$CH8_FIXTURES/$CH8_HASH.md" "$CH8_LEGACY/AGENTS.md"
+  printf 'destination sentinel\n' > "$CH8_LEGACY/preflight-sentinel"
+  printf 'skills sentinel\n' > "$CH8_LEGACY_SKILLS.sentinel"
+  CH8_SOURCE_BEFORE="$(shasum -a 256 "$CH8_LEGACY/AGENTS.md" | awk '{print $1}')"
+  CH8_OUT="$TMPDIR_EVAL/ch8-$CH8_HASH.out"
+  if CODEX_REAL_HOME="$TMPDIR_EVAL/fake-real-codex" FLOW_AGENTS_SKILLS_DIR="$CH8_LEGACY_SKILLS" \
+    bash "$ROOT_DIR/scripts/install-codex-home.sh" "$CH8_LEGACY" >"$CH8_OUT" 2>&1; then
+    _fail "CH8: audited legacy fingerprint $CH8_HASH did not refuse installation"
+  elif [[ "$CH8_SOURCE_BEFORE" == "$(shasum -a 256 "$CH8_LEGACY/AGENTS.md" | awk '{print $1}')" ]] \
+    && [[ "$(cat "$CH8_LEGACY/preflight-sentinel")" == "destination sentinel" ]] \
+    && [[ ! -e "$CH8_LEGACY/hooks.json" && ! -e "$CH8_LEGACY_SKILLS" ]] \
+    && grep -F -q "path=$CH8_LEGACY_REAL/AGENTS.md" "$CH8_OUT" \
+    && grep -F -q "sha256=$CH8_HASH bytes=$CH8_BYTES" "$CH8_OUT" \
+    && grep -q 'matching_releases=v2.4.0@bee760272b8bb770df02400ccc5881bd3dbc8806' "$CH8_OUT" \
+    && grep -F -q "evidence command (hash): shasum -a 256 -- '$CH8_LEGACY_REAL/AGENTS.md'" "$CH8_OUT" \
+    && grep -F -q "evidence command (bytes): wc -c < '$CH8_LEGACY_REAL/AGENTS.md'" "$CH8_OUT" \
+    && grep -q 'Stop all agent and writer processes' "$CH8_OUT" \
+    && grep -q 'Move the file manually without overwrite using operator-trusted tooling' "$CH8_OUT" \
+    && ! grep -Eq '(^|: )(mv|rm|cp)( |$)| && (mv|rm|cp) ' "$CH8_OUT"; then
+    _pass "CH8: audited legacy fingerprint $CH8_HASH refuses before mutation with exact evidence and manual checklist"
+  else
+    _fail "CH8: audited legacy fingerprint $CH8_HASH refusal mutated state or lacked actionable evidence"
+  fi
+  mkdir -p "$CH8_LEGACY/.flow-agents/manual-recovery"
+  mv "$CH8_LEGACY/AGENTS.md" "$CH8_LEGACY/.flow-agents/manual-recovery/legacy-generated-AGENTS.$CH8_HASH.md"
+  if CODEX_REAL_HOME="$TMPDIR_EVAL/fake-real-codex" FLOW_AGENTS_SKILLS_DIR="$CH8_LEGACY_SKILLS" \
+    bash "$ROOT_DIR/scripts/install-codex-home.sh" "$CH8_LEGACY" >/dev/null 2>&1 \
+    && cmp -s "$CH8_FIXTURES/$CH8_HASH.md" "$CH8_LEGACY/.flow-agents/manual-recovery/legacy-generated-AGENTS.$CH8_HASH.md" \
+    && [[ ! -e "$CH8_LEGACY/AGENTS.md" && -f "$CH8_LEGACY/hooks.json" && -f "$CH8_LEGACY_SKILLS/plan-work/SKILL.md" ]]; then
+    _pass "CH8: simulated operator remediation enables install without recreating AGENTS.md"
+  else
+    _fail "CH8: operator-remediated rerun failed or recreated global instructions"
+  fi
+done < <(node - "$ROOT_DIR/packaging/codex-legacy-agents-fingerprints.json" <<'NODE'
+const fs = require("node:fs");
+const manifest = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+for (const entry of manifest.files || []) console.log(`${entry.sha256}\t${entry.bytes}`);
+NODE
+)
+
+CH8_QUOTED="$TMPDIR_EVAL/codex-home-ch8-operator-'quoted"
+mkdir -p "$CH8_QUOTED"
+cp "$CH8_FIXTURES/5273878130bdafc8a024a650bb5b66c9b003f1f859b5dc6e5b588cbf4ab23228.md" "$CH8_QUOTED/AGENTS.md"
+CH8_QUOTED_OUT="$TMPDIR_EVAL/ch8-quoted.out"
+if node "$ROOT_DIR/scripts/classify-codex-legacy-agents.js" "$CH8_QUOTED" "$ROOT_DIR/packaging/codex-legacy-agents-fingerprints.json" >"$CH8_QUOTED_OUT" 2>&1; then
+  _fail "CH8: quoted-path exact legacy classifier did not refuse"
+else
+  CH8_QUOTED_HASH_COMMAND="$(sed -n 's/^classify-codex-legacy-agents: evidence command (hash): //p' "$CH8_QUOTED_OUT")"
+  CH8_QUOTED_BYTES_COMMAND="$(sed -n 's/^classify-codex-legacy-agents: evidence command (bytes): //p' "$CH8_QUOTED_OUT")"
+  if [[ "$CH8_QUOTED_HASH_COMMAND" == *"'\"'\"'"* && "$CH8_QUOTED_BYTES_COMMAND" == *"'\"'\"'"* ]] \
+    && bash -n -c "$CH8_QUOTED_HASH_COMMAND" && bash -n -c "$CH8_QUOTED_BYTES_COMMAND"; then
+    _pass "CH8: evidence commands safely shell-quote apostrophes in paths"
+  else
+    _fail "CH8: evidence commands are not safely shell-quoted"
+  fi
+fi
+
+CH8_NEAR="$TMPDIR_EVAL/codex-home-ch8-near"
+mkdir -p "$CH8_NEAR"
+cp "$CH8_FIXTURES/5273878130bdafc8a024a650bb5b66c9b003f1f859b5dc6e5b588cbf4ab23228.md" "$CH8_NEAR/AGENTS.md"
+printf 'user modification\n' >> "$CH8_NEAR/AGENTS.md"
+CH8_NEAR_BEFORE="$(shasum -a 256 "$CH8_NEAR/AGENTS.md" | awk '{print $1}')"
+if CODEX_REAL_HOME="$TMPDIR_EVAL/fake-real-codex" FLOW_AGENTS_SKILLS_DIR="$TMPDIR_EVAL/ch8-near-skills" \
+  bash "$ROOT_DIR/scripts/install-codex-home.sh" "$CH8_NEAR" >"$TMPDIR_EVAL/ch8-near.out" 2>&1 \
+  && [[ "$CH8_NEAR_BEFORE" == "$(shasum -a 256 "$CH8_NEAR/AGENTS.md" | awk '{print $1}')" ]] \
+  && grep -q 'preserved unrecognized or user-owned' "$TMPDIR_EVAL/ch8-near.out"; then
+  _pass "CH8: near-match legacy-looking user instructions are byte-preserved"
+else
+  _fail "CH8: near-match user instructions changed or lacked preservation diagnostic"
+fi
+
+for CH8_KIND in symlink directory; do
+  CH8_UNSAFE="$TMPDIR_EVAL/codex-home-ch8-$CH8_KIND"
+  mkdir -p "$CH8_UNSAFE"
+  printf 'must remain untouched\n' > "$CH8_UNSAFE/preflight-sentinel"
+  case "$CH8_KIND" in
+    symlink) printf 'target\n' > "$CH8_UNSAFE/user-target"; ln -s user-target "$CH8_UNSAFE/AGENTS.md" ;;
+    directory) mkdir "$CH8_UNSAFE/AGENTS.md" ;;
+  esac
+  if CODEX_REAL_HOME="$TMPDIR_EVAL/fake-real-codex" FLOW_AGENTS_SKILLS_DIR="$TMPDIR_EVAL/ch8-$CH8_KIND-skills" \
+    bash "$ROOT_DIR/scripts/install-codex-home.sh" "$CH8_UNSAFE" >"$TMPDIR_EVAL/ch8-$CH8_KIND.out" 2>&1 \
+    && [[ "$(cat "$CH8_UNSAFE/preflight-sentinel")" == "must remain untouched" ]] \
+    && [[ -e "$CH8_UNSAFE/hooks.json" ]] \
+    && { [[ "$CH8_KIND" == "symlink" && -L "$CH8_UNSAFE/AGENTS.md" && "$(cat "$CH8_UNSAFE/user-target")" == "target" ]] \
+      || [[ "$CH8_KIND" == "directory" && -d "$CH8_UNSAFE/AGENTS.md" ]]; }; then
+    _pass "CH8: read-only classifier preserves ambiguous $CH8_KIND AGENTS.md object"
+  else
+    _fail "CH8: classifier altered ambiguous $CH8_KIND AGENTS.md object"
+  fi
+done
+
+echo ""
+
 # ─── pi --global: PG1: warns NOT_VERIFIED + falls back to workspace default ──
 echo "--- PG1: pi --global warns NOT_VERIFIED + falls back to workspace default ---"
 

package/evals/integration/test_liveness_conflict_injection.sh

@@ -43,6 +43,7 @@ set -uo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 LIB_DIR="$ROOT/scripts/hooks/lib"
+CURRENT_POINTER_HELPER="$LIB_DIR/current-pointer.js"
 HEARTBEAT_MODULE="$LIB_DIR/liveness-heartbeat.js"
 READ_MODULE="$LIB_DIR/liveness-read.js"
 ACTOR_MODULE="$LIB_DIR/actor-identity.js"
@@ -76,6 +77,30 @@ new_scratch() {
   mktemp -d "$TMPDIR_EVAL/scratch-XXXXXX"
 }
 
+# seed_current_snapshot <root> <slug> [actor] — #440 FIXTURE-GAP: this suite's fixtures were
+# written before #440's per-actor ownership scoping and never establish a per-actor current
+# pointer for the invoking actor -- under a RESOLVED actor (every hook invocation below sets an
+# explicit FLOW_AGENTS_ACTOR override), liveness-heartbeat.js's readActiveSlug (via
+# readOwnCurrentPointer) now scopes to that actor's own (nonexistent) pointer and never reaches
+# the fixture-under-test. Writes BOTH the legacy current.json AND, when actor is given, the
+# per-actor current/<actor>.json pointer with the SAME minimal {"active_slug": slug} payload --
+# mirroring test_liveness_heartbeat.sh's own seed_current_snapshot helper and, ultimately,
+# workflow-sidecar.ts's real writeCurrent() dual-write via current-pointer.js's own
+# writePerActorCurrent.
+seed_current_snapshot() {
+  local root="$1" slug="$2" actor="${3:-}"
+  local artifact_root="$root/.kontourai/flow-agents"
+  mkdir -p "$artifact_root"
+  printf '{"active_slug":"%s"}\n' "$slug" >"$artifact_root/$SNAPSHOT_FILENAME"
+  if [[ -n "$actor" ]]; then
+    CP_HELPER_ARG="$CURRENT_POINTER_HELPER" FLOW_AGENTS_DIR_ARG="$artifact_root" \
+      SLUG_ARG="$slug" ACTOR_ARG="$actor" node - <<'NODE'
+const { writePerActorCurrent } = require(process.env.CP_HELPER_ARG);
+writePerActorCurrent(process.env.FLOW_AGENTS_DIR_ARG, process.env.ACTOR_ARG, { active_slug: process.env.SLUG_ARG });
+NODE
+  fi
+}
+
 # seed_claim <scratch_root> <slug> <actor> <at_iso> [ttl_seconds]
 # Seeds <root>/.kontourai/flow-agents/current.json (active_slug) and OVERWRITES
 # liveness/events.jsonl with a single `claim` event for <actor>.
@@ -83,7 +108,7 @@ seed_claim() {
   local root="$1" slug="$2" actor="$3" at="$4" ttl="${5:-1800}"
   local artifact_root="$root/.kontourai/flow-agents"
   mkdir -p "$artifact_root/liveness"
-  printf '{"active_slug":"%s"}\n' "$slug" >"$artifact_root/$SNAPSHOT_FILENAME"
+  seed_current_snapshot "$root" "$slug" "$actor"
   printf '{"type":"claim","subjectId":"%s","actor":"%s","at":"%s","ttlSeconds":%s}\n' \
     "$slug" "$actor" "$at" "$ttl" >"$artifact_root/liveness/events.jsonl"
 }
@@ -261,7 +286,7 @@ build_large_stream_with_conflict() {
   local root="$1" slug="$2" actor="$3" claim_at="$4" other_actor="$5" other_at="$6"
   local artifact_root="$root/.kontourai/flow-agents"
   mkdir -p "$artifact_root/liveness"
-  printf '{"active_slug":"%s"}\n' "$slug" >"$artifact_root/$SNAPSHOT_FILENAME"
+  seed_current_snapshot "$root" "$slug" "$actor"
   SLUG_ARG="$slug" ACTOR_ARG="$actor" CLAIM_AT_ARG="$claim_at" OTHER_ACTOR_ARG="$other_actor" \
   OTHER_AT_ARG="$other_at" STREAM_ARG="$artifact_root/liveness/events.jsonl" node - <<'NODE'
 const fs = require('fs');
@@ -498,9 +523,20 @@ fi
 # ─── G. Fail-open on a corrupted sidecar snapshot ────────────────────────────
 echo "--- G. Fail-open on a corrupted sidecar snapshot ---"
 
+# #440 FIX 2 (de-vacuate, delta review): corrupt agent-hb's OWN per-actor pointer file (the new
+# collision-resistant mapping via perActorCurrentFile), not the legacy current.json -- a resolved
+# actor never reads the legacy file at all (#440 D1), so corrupting only that no longer exercises
+# anything (the assertion would pass via "no own pointer", not malformed-pointer tolerance).
+# Mirrors test_liveness_heartbeat.sh's D2 precedent.
 G_ROOT="$(new_scratch)"
 mkdir -p "$G_ROOT/.kontourai/flow-agents/liveness"
-printf '{not valid json' >"$G_ROOT/.kontourai/flow-agents/$SNAPSHOT_FILENAME"
+G_PER_ACTOR_FILE="$(CP_HELPER_ARG="$CURRENT_POINTER_HELPER" ROOT_ARG="$G_ROOT/.kontourai/flow-agents" ACTOR_ARG="agent-hb" node - <<'NODE'
+const { perActorCurrentFile } = require(process.env.CP_HELPER_ARG);
+process.stdout.write(perActorCurrentFile(process.env.ROOT_ARG, process.env.ACTOR_ARG));
+NODE
+)"
+mkdir -p "$(dirname "$G_PER_ACTOR_FILE")"
+printf '{not valid json' >"$G_PER_ACTOR_FILE"
 G_OUT="$(cd "$G_ROOT" && TELEMETRY_ENABLED=false FLOW_AGENTS_ACTOR=agent-hb \
   node "$CLAUDE_HOOK" PostToolUse dev <"$POST_TOOL_USE_PAYLOAD_FILE" 2>"$TMPDIR_EVAL/g.err")"
 G_STATUS=$?

package/evals/integration/test_liveness_heartbeat.sh

@@ -40,6 +40,7 @@ POLICY_MODULE="$LIB_DIR/liveness-policy.js"
 HEARTBEAT_MODULE="$LIB_DIR/liveness-heartbeat.js"
 READ_MODULE="$LIB_DIR/liveness-read.js"
 ACTOR_MODULE="$LIB_DIR/actor-identity.js"
+CURRENT_POINTER_HELPER="$LIB_DIR/current-pointer.js"
 CLAUDE_HOOK="$ROOT/scripts/hooks/claude-telemetry-hook.js"
 CODEX_HOOK="$ROOT/scripts/hooks/codex-telemetry-hook.js"
 
@@ -68,6 +69,29 @@ new_scratch() {
   mktemp -d "$TMPDIR_EVAL/scratch-XXXXXX"
 }
 
+# seed_current_snapshot <root> <slug> [actor] — #440: writes BOTH the legacy current.json
+# (SNAPSHOT_FILENAME, unconditional — every fixture below keeps writing this) AND, when actor is
+# given, the per-actor current/<actor>.json pointer with the SAME minimal {"active_slug": slug}
+# payload — mirroring workflow-sidecar.ts's real writeCurrent() dual-write, via the shared
+# current-pointer.js helper's own writePerActorCurrent (not a hand-rolled reimplementation of its
+# sanitize/path rule), so #440's readOwnCurrentPointer finds this fixture's claimed subject
+# exactly like a real session would. Every builder below that seeds a sidecar snapshot for a
+# RESOLVED actor (the FLOW_AGENTS_ACTOR value the corresponding call_heartbeat/wrapper invocation
+# uses) now routes through this, instead of hand-writing SNAPSHOT_FILENAME directly.
+seed_current_snapshot() {
+  local root="$1" slug="$2" actor="${3:-}"
+  local artifact_root="$root/.kontourai/flow-agents"
+  mkdir -p "$artifact_root"
+  printf '{"active_slug":"%s"}\n' "$slug" >"$artifact_root/$SNAPSHOT_FILENAME"
+  if [[ -n "$actor" ]]; then
+    CP_HELPER_ARG="$CURRENT_POINTER_HELPER" FLOW_AGENTS_DIR_ARG="$artifact_root" \
+      SLUG_ARG="$slug" ACTOR_ARG="$actor" node - <<'NODE'
+const { writePerActorCurrent } = require(process.env.CP_HELPER_ARG);
+writePerActorCurrent(process.env.FLOW_AGENTS_DIR_ARG, process.env.ACTOR_ARG, { active_slug: process.env.SLUG_ARG });
+NODE
+  fi
+}
+
 # seed_claim <scratch_root> <slug> <actor> <at_iso> [ttl_seconds]
 # Seeds <root>/.kontourai/flow-agents/<SNAPSHOT_FILENAME> (active_slug) and a
 # single `claim` event in liveness/events.jsonl for <actor>, matching the
@@ -77,7 +101,7 @@ seed_claim() {
   local root="$1" slug="$2" actor="$3" at="$4" ttl="${5:-1800}"
   local artifact_root="$root/.kontourai/flow-agents"
   mkdir -p "$artifact_root/liveness"
-  printf '{"active_slug":"%s"}\n' "$slug" >"$artifact_root/$SNAPSHOT_FILENAME"
+  seed_current_snapshot "$root" "$slug" "$actor"
   printf '{"type":"claim","subjectId":"%s","actor":"%s","at":"%s","ttlSeconds":%s}\n' \
     "$slug" "$actor" "$at" "$ttl" >"$artifact_root/liveness/events.jsonl"
 }
@@ -292,8 +316,9 @@ fi
 
 # C2: the sidecar snapshot names a slug with no prior events at all -> no-claim.
 C2_ROOT="$(new_scratch)"
-mkdir -p "$C2_ROOT/.kontourai/flow-agents"
-printf '{"active_slug":"c2-subj"}\n' >"$C2_ROOT/.kontourai/flow-agents/$SNAPSHOT_FILENAME"
+# #440 FIXTURE-GAP: agent-c2 owns c2-subj (never claimed) -- needs its own per-actor pointer so
+# readOwnCurrentPointer finds it and the code reaches the no-claim check, not an earlier no-current.
+seed_current_snapshot "$C2_ROOT" "c2-subj" "agent-c2"
 C2_RESULT="$(call_heartbeat "$C2_ROOT" '{"FLOW_AGENTS_ACTOR":"agent-c2"}')"
 if [[ "$C2_RESULT" == '{"emitted":false,"reason":"no-claim"}' ]]; then
   _pass "maybeEmitHeartbeat returns no-claim when the named subject has no prior claim for the actor (AC4)"
@@ -360,9 +385,19 @@ fi
 
 # D2: a corrupted sidecar snapshot (malformed JSON) fails open — wrapper still exits 0
 # with its normal stdout contract, and no heartbeat is fabricated from unparseable state.
+# #440 FIX 2 (de-vacuate, independent review): corrupt agent-hb's OWN per-actor pointer file (the
+# new collision-resistant mapping), not the legacy current.json — a resolved actor never reads
+# the legacy file at all (#440 D1), so corrupting only that no longer exercises anything; this
+# now proves fail-open tolerance for a corrupt OWN pointer, the actually-reachable code path.
 D2_ROOT="$(new_scratch)"
 mkdir -p "$D2_ROOT/.kontourai/flow-agents/liveness"
-printf '{not valid json' >"$D2_ROOT/.kontourai/flow-agents/$SNAPSHOT_FILENAME"
+D2_PER_ACTOR_FILE="$(CP_HELPER_ARG="$CURRENT_POINTER_HELPER" ROOT_ARG="$D2_ROOT/.kontourai/flow-agents" ACTOR_ARG="agent-hb" node - <<'NODE'
+const { perActorCurrentFile } = require(process.env.CP_HELPER_ARG);
+process.stdout.write(perActorCurrentFile(process.env.ROOT_ARG, process.env.ACTOR_ARG));
+NODE
+)"
+mkdir -p "$(dirname "$D2_PER_ACTOR_FILE")"
+printf '{not valid json' >"$D2_PER_ACTOR_FILE"
 D2_OUT="$(cd "$D2_ROOT" && TELEMETRY_ENABLED=false FLOW_AGENTS_ACTOR=agent-hb \
   node "$CLAUDE_HOOK" PostToolUse dev <"$POST_TOOL_USE_PAYLOAD_FILE" 2>"$TMPDIR_EVAL/d2.err")"
 D2_STATUS=$?
@@ -436,7 +471,7 @@ build_large_liveness_stream() {
   local root="$1" slug="$2" actor="$3" claim_at="$4" include_hb="${5:-false}" hb_at="${6:-}"
   local artifact_root="$root/.kontourai/flow-agents"
   mkdir -p "$artifact_root/liveness"
-  printf '{"active_slug":"%s"}\n' "$slug" >"$artifact_root/$SNAPSHOT_FILENAME"
+  seed_current_snapshot "$root" "$slug" "$actor"
   SLUG_ARG="$slug" ACTOR_ARG="$actor" CLAIM_AT_ARG="$claim_at" INCLUDE_HB_ARG="$include_hb" \
   HB_AT_ARG="$hb_at" STREAM_ARG="$artifact_root/liveness/events.jsonl" node - <<'NODE'
 const fs = require('fs');
@@ -564,8 +599,7 @@ build_large_liveness_stream_release() {
   local root="$1" slug="$2" actor="$3" claim_at="$4" release_at="$5"
   local artifact_root="$root/.kontourai/flow-agents"
   mkdir -p "$artifact_root/liveness"
-  printf '{"active_slug":"%s"}
-' "$slug" >"$artifact_root/$SNAPSHOT_FILENAME"
+  seed_current_snapshot "$root" "$slug" "$actor"
   SLUG_ARG="$slug" ACTOR_ARG="$actor" CLAIM_AT_ARG="$claim_at" RELEASE_AT_ARG="$release_at"   STREAM_ARG="$artifact_root/liveness/events.jsonl" node - <<'NODE'
 const fs = require('fs');
 const filler = (i) =>
@@ -624,7 +658,10 @@ const { sanitizeSegment } = require(process.env.ACTOR_MODULE_ARG);
 process.stdout.write(sanitizeSegment(process.env.RAW_ARG));
 NODE
 )"
-printf '{"active_slug":"%s"}\n' "$I_RAW_SLUG" >"$I_ROOT/.kontourai/flow-agents/$SNAPSHOT_FILENAME"
+# #440 FIXTURE-GAP: agent-hb-i owns this (hostile-slug-named) subject -- needs its own per-actor
+# pointer. seed_current_snapshot writes the payload's active_slug verbatim (no pre-sanitization on
+# the write side), preserving this scenario's whole point: sanitization happens at READ time.
+seed_current_snapshot "$I_ROOT" "$I_RAW_SLUG" "agent-hb-i"
 printf '{"type":"claim","subjectId":"%s","actor":"agent-hb-i","at":"2026-06-25T11:00:00.000Z","ttlSeconds":1800}\n' \
   "$I_SANITIZED_SLUG" >"$(stream_file "$I_ROOT")"
 I_RESULT="$(call_heartbeat "$I_ROOT" '{"FLOW_AGENTS_ACTOR":"agent-hb-i"}' "2026-06-25T11:05:00.000Z")"
@@ -648,7 +685,7 @@ seed_heartbeat_only() {
   local root="$1" slug="$2" actor="$3" at="$4"
   local artifact_root="$root/.kontourai/flow-agents"
   mkdir -p "$artifact_root/liveness"
-  printf '{"active_slug":"%s"}\n' "$slug" >"$artifact_root/$SNAPSHOT_FILENAME"
+  seed_current_snapshot "$root" "$slug" "$actor"
   printf '{"type":"heartbeat","subjectId":"%s","actor":"%s","at":"%s"}\n' \
     "$slug" "$actor" "$at" >"$artifact_root/liveness/events.jsonl"
 }

package/evals/integration/test_phase_map_and_gate_claim.sh

@@ -417,11 +417,20 @@ node -e "
 " 2>/dev/null
 rm -f "$C_DIR/.kontourai/flow-agents/$CLEAN_SLUG/$CLEAN_SLUG--deliver.md"
 
+# #440 FIXTURE-GAP: this session was established under FLOW_AGENTS_ACTOR=clean-fixture-actor
+# (line ~394) -- the Stop hook must run as that SAME actor so stop-goal-fit.js's ownership-scoped
+# analyze() finds clean-fixture-actor's own per-actor pointer (established by workflow start's
+# dual-write) rather than finding nothing for the ambient/unrelated invoking actor. Do NOT force
+# an unresolved actor here: workflow start's own automatic selected-work gate-claim recording (and
+# the resulting pull-work -> design-probe canonical-Flow auto-transition this section's assertion
+# depends on) itself requires a genuinely RESOLVED actor to fire -- forcing unresolved for the
+# setup step silently suppresses that transition, a real behavior difference, not just a
+# fixture-reachability issue.
 clean_out=""
 clean_exit=0
 for attempt in 1 2; do
   set +e
-  attempt_out="$(FLOW_AGENTS_GOAL_FIT_MODE=block FLOW_AGENTS_GOAL_FIT_MAX_BLOCKS=2 FLOW_AGENTS_GOAL_FIT_BACKSTOP=skip \
+  attempt_out="$(FLOW_AGENTS_ACTOR=clean-fixture-actor FLOW_AGENTS_GOAL_FIT_MODE=block FLOW_AGENTS_GOAL_FIT_MAX_BLOCKS=2 FLOW_AGENTS_GOAL_FIT_BACKSTOP=skip \
       node "$GATE" 2>&1 <<< "{\"hook_event_name\":\"Stop\",\"cwd\":\"$C_DIR\"}")"
   attempt_exit="$?"
   set -e

package/evals/integration/test_public_workflow_cli.sh

@@ -31,13 +31,13 @@ printf '#!/usr/bin/env bash\nset -eu\n( trap "" TERM; while ! sleep 5; do :; don
 chmod +x "$CONSUMER/checks/check-success-background.sh"
 
 run_candidate() {
-  (cd "$CONSUMER" && CODEX_SESSION_ID=public-workflow-eval npx --yes --package="file:$TARBALL" flow-agents workflow "$@")
+  (cd "$CONSUMER" && env -u CODEX_THREAD_ID CODEX_SESSION_ID=public-workflow-eval npx --yes --package="file:$TARBALL" flow-agents workflow "$@")
 }
 
 run_candidate_as() {
   local actor="$1"
   shift
-  (cd "$CONSUMER" && CODEX_SESSION_ID="$actor" npx --yes --package="file:$TARBALL" flow-agents workflow "$@")
+  (cd "$CONSUMER" && env -u CODEX_THREAD_ID CODEX_SESSION_ID="$actor" npx --yes --package="file:$TARBALL" flow-agents workflow "$@")
 }
 
 snapshot_tree() {
@@ -134,7 +134,7 @@ mkdir -p "$LOCAL_RETRY_ROOT/local-retry"
 printf 'Selected Work Item: local:local-retry\n' > "$LOCAL_RETRY_ROOT/local-retry/local-retry--pull-work.md"
 printf 'not a run-store directory\n' >"$LOCAL_RETRY_PROJECT/.kontourai/flow"
 set +e
-(cd "$LOCAL_RETRY_PROJECT" && CODEX_SESSION_ID=public-workflow-eval npx --yes --package="file:$TARBALL" flow-agents-workflow-sidecar ensure-session \
+(cd "$LOCAL_RETRY_PROJECT" && env -u CODEX_THREAD_ID CODEX_SESSION_ID=public-workflow-eval npx --yes --package="file:$TARBALL" flow-agents-workflow-sidecar ensure-session \
   --artifact-root "$LOCAL_RETRY_ROOT" --task-slug local-retry \
   --title "Local retry" --summary "Resume the bound local workflow." --flow-id builder.build >/dev/null 2>&1)
 LOCAL_SEED_RC=$?
@@ -147,7 +147,7 @@ rm -f "$LOCAL_RETRY_PROJECT/.kontourai/flow"
 FOREIGN_RETRY_CWD="$TMP/foreign-retry-cwd"
 mkdir -p "$FOREIGN_RETRY_CWD"
 EXECUTABLE_RETRY="$(node -e 'process.stdout.write(process.argv[1].replace(process.argv[2], process.argv[3]))' "$LOCAL_RETRY_COMMAND" "'@kontourai/flow-agents@$VERSION'" "'file:$TARBALL'")"
-(cd "$FOREIGN_RETRY_CWD" && CODEX_SESSION_ID=public-workflow-eval eval "$EXECUTABLE_RETRY" >/dev/null)
+(cd "$FOREIGN_RETRY_CWD" && unset CODEX_THREAD_ID && export CODEX_SESSION_ID=public-workflow-eval && eval "$EXECUTABLE_RETRY" >/dev/null)
 [[ -f "$LOCAL_RETRY_PROJECT/.kontourai/flow/runs/local-retry/state.json" && ! -e "$FOREIGN_RETRY_CWD/.kontourai" ]] || fail "emitted local retry mutated the caller cwd instead of the originating store"
 pass "emitted local retry executes from a foreign cwd against its exact originating store"
 
@@ -428,7 +428,7 @@ TIMEOUT_SESSION="$ARTIFACT_ROOT/acme-widgets-107"
 TIMEOUT_CHILD_PID="$TMP/command-timeout-child.pid"
 TIMEOUT_MARKER="$TMP/command-timeout-marker"
 set +e
-(cd "$CONSUMER" && CODEX_SESSION_ID=public-workflow-eval FLOW_AGENTS_EVIDENCE_COMMAND_TIMEOUT_MS=1000 FLOW_AGENTS_EVIDENCE_COMMAND_KILL_GRACE_MS=250 npx --yes --package="file:$TARBALL" flow-agents workflow evidence --session-dir "$TIMEOUT_SESSION" --expectation pickup-probe-readiness --status not_verified --summary "Timeout fixture captures full process-group termination." --command "bash checks/check-command-timeout.sh '$TIMEOUT_CHILD_PID' '$TIMEOUT_MARKER'" --json) >"$TMP/command-timeout.out" 2>&1
+(cd "$CONSUMER" && env -u CODEX_THREAD_ID CODEX_SESSION_ID=public-workflow-eval FLOW_AGENTS_EVIDENCE_COMMAND_TIMEOUT_MS=1000 FLOW_AGENTS_EVIDENCE_COMMAND_KILL_GRACE_MS=250 npx --yes --package="file:$TARBALL" flow-agents workflow evidence --session-dir "$TIMEOUT_SESSION" --expectation pickup-probe-readiness --status not_verified --summary "Timeout fixture captures full process-group termination." --command "bash checks/check-command-timeout.sh '$TIMEOUT_CHILD_PID' '$TIMEOUT_MARKER'" --json) >"$TMP/command-timeout.out" 2>&1
 TIMEOUT_RC=$?
 set -e
 [[ "$TIMEOUT_RC" -ne 0 && -s "$TIMEOUT_CHILD_PID" && ! -e "$TIMEOUT_MARKER" ]] || fail "timed-out evidence command did not complete its controlled capture"
@@ -439,7 +439,7 @@ pass "timed-out evidence commands terminate their complete process group"
 BACKGROUND_CHILD_PID="$TMP/success-background-child.pid"
 BACKGROUND_MARKER="$TMP/success-background-marker"
 TIMEOUT_PULL_REPORT="$TIMEOUT_SESSION/$(basename "$TIMEOUT_SESSION")--pull-work.md"
-(cd "$CONSUMER" && CODEX_SESSION_ID=public-workflow-eval FLOW_AGENTS_EVIDENCE_COMMAND_KILL_GRACE_MS=50 npx --yes --package="file:$TARBALL" flow-agents workflow evidence \
+(cd "$CONSUMER" && env -u CODEX_THREAD_ID CODEX_SESSION_ID=public-workflow-eval FLOW_AGENTS_EVIDENCE_COMMAND_KILL_GRACE_MS=50 npx --yes --package="file:$TARBALL" flow-agents workflow evidence \
   --session-dir "$TIMEOUT_SESSION" --expectation pickup-probe-readiness --status pass \
   --summary "Successful evidence cleans up surviving background processes." \
   --command "bash checks/check-success-background.sh '$BACKGROUND_CHILD_PID' '$BACKGROUND_MARKER'" \

package/evals/integration/test_session_resume_roundtrip.sh

@@ -13,6 +13,7 @@
 set -uo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+CURRENT_POINTER_HELPER="$ROOT/scripts/hooks/lib/current-pointer.js"
 
 TMPDIR_EVAL="$(mktemp -d)"
 errors=0
@@ -25,6 +26,30 @@ trap cleanup EXIT
 _pass() { echo "  ✓ $1"; }
 _fail() { echo "  ✗ $1"; errors=$((errors + 1)); }
 
+# seed_current_pointer <flow_agents_dir> <slug> <actor> — #440 FIXTURE-GAP: this suite's fixtures
+# were written before #440's per-actor ownership scoping and never establish a per-actor current
+# pointer for the invoking actor -- under a RESOLVED actor (every hook invocation below sets an
+# explicit FLOW_AGENTS_ACTOR override, or derives one from an injected CLAUDE_CODE_SESSION_ID),
+# workflow-steering.js's actorScopedWorkflowState now scopes to that actor's own (nonexistent)
+# pointer and never reaches the fixture-under-test. Seeds BOTH the legacy current.json AND the
+# per-actor current/<actor>.json pointer with the SAME payload, mirroring workflow-sidecar.ts's
+# real writeCurrent() dual-write via current-pointer.js's own writePerActorCurrent.
+seed_current_pointer() {
+  local flow_agents_dir="$1" slug="$2" actor="$3"
+  CP_HELPER_ARG="$CURRENT_POINTER_HELPER" DIR_ARG="$flow_agents_dir" SLUG_ARG="$slug" ACTOR_ARG="$actor" node - <<'NODE'
+const fs = require('fs');
+const path = require('path');
+const { writePerActorCurrent } = require(process.env.CP_HELPER_ARG);
+const dir = process.env.DIR_ARG;
+const slug = process.env.SLUG_ARG;
+const actor = process.env.ACTOR_ARG;
+const payload = { schema_version: '1.0', active_slug: slug, artifact_dir: slug };
+fs.mkdirSync(dir, { recursive: true });
+fs.writeFileSync(path.join(dir, 'current.json'), JSON.stringify(payload, null, 2) + '\n');
+writePerActorCurrent(dir, actor, payload);
+NODE
+}
+
 # ─── Portable sha256 helper ────────────────────────────────────────────────────
 sha256_file() {
   if command -v sha256sum >/dev/null 2>&1; then
@@ -112,6 +137,8 @@ FIVE_MIN_AGO="$(node -e "process.stdout.write(new Date(Date.now()-300000).toISOS
 printf '{"type":"claim","subjectId":"test-slug-153","actor":"other-agent","at":"%s","ttlSeconds":1800}\n' "$FIVE_MIN_AGO" > "$REPO/.kontourai/flow-agents/liveness/events.jsonl"
 printf '{"type":"heartbeat","subjectId":"test-slug-153","actor":"self-actor","at":"%s"}\n' "$FIVE_MIN_AGO" >> "$REPO/.kontourai/flow-agents/liveness/events.jsonl"
 
+seed_current_pointer "$REPO/.kontourai/flow-agents" "$SLUG" "self-actor"
+
 # ─── Snapshot checksums before hook run ───────────────────────────────────────
 CKSUM_STATE_BEFORE="$(sha256_file "$TASK_DIR/state.json")"
 CKSUM_HANDOFF_BEFORE="$(sha256_file "$TASK_DIR/handoff.json")"
@@ -260,6 +287,7 @@ cp "$TASK_DIR/handoff.json" "$TASK_DIR2/handoff.json"
 cp "$TASK_DIR/trust.bundle" "$TASK_DIR2/trust.bundle"
 printf 'test-slug-153--plan-work.md stub\n' > "$TASK_DIR2/test-slug-153--plan-work.md"
 # No liveness directory → empty stream
+seed_current_pointer "$REPO2/.kontourai/flow-agents" "$SLUG" "self-actor"
 
 echo "{\"hook_event_name\":\"SessionStart\",\"cwd\":\"$REPO2\"}" | \
   FLOW_AGENTS_ACTOR="self-actor" node "$ROOT/scripts/hooks/workflow-steering.js" > "$TMPDIR_EVAL/nolive.out" 2>&1
@@ -330,6 +358,7 @@ fi
 FIVE_MIN_AGO_3="$(node -e "process.stdout.write(new Date(Date.now()-300000).toISOString().replace(/\\.\\d{3}Z$/,'Z'))")"
 printf '{"type":"claim","subjectId":"%s","actor":"other-agent-derived","at":"%s","ttlSeconds":1800}\n' "$SLUG3" "$FIVE_MIN_AGO_3" > "$REPO3/.kontourai/flow-agents/liveness/events.jsonl"
 printf '{"type":"heartbeat","subjectId":"%s","actor":"%s","at":"%s"}\n' "$SLUG3" "$DERIVED_SELF_ACTOR" "$FIVE_MIN_AGO_3" >> "$REPO3/.kontourai/flow-agents/liveness/events.jsonl"
+seed_current_pointer "$REPO3/.kontourai/flow-agents" "$SLUG3" "$DERIVED_SELF_ACTOR"
 
 echo "{\"hook_event_name\":\"SessionStart\",\"cwd\":\"$REPO3\"}" | \
   CLAUDE_CODE_SESSION_ID="$SELF_SESSION_ID" FLOW_AGENTS_ACTOR="" node "$ROOT/scripts/hooks/workflow-steering.js" > "$TMPDIR_EVAL/derived-actor.out" 2>&1
@@ -397,6 +426,7 @@ const fs = require('fs');
 const line = JSON.stringify({ type: 'claim', subjectId: process.argv[1], actor: JSON.parse(process.argv[2]), at: process.argv[3], ttlSeconds: 1800 });
 fs.writeFileSync(process.argv[4], line + '\n');
 " "$SLUG4" "$HOSTILE_ACTOR_JSON" "$FIVE_MIN_AGO_4" "$LIVENESS_FILE_4"
+seed_current_pointer "$REPO4/.kontourai/flow-agents" "$SLUG4" "self-actor-t2-hostile-check"
 
 echo "{\"hook_event_name\":\"SessionStart\",\"cwd\":\"$REPO4\"}" | \
   FLOW_AGENTS_ACTOR="self-actor-t2-hostile-check" node "$ROOT/scripts/hooks/workflow-steering.js" > "$TMPDIR_EVAL/hostile-actor.out" 2>&1