@kontourai/flow-agents 3.9.0 → 3.10.0

package/evals/integration/test_current_json_per_actor.sh

@@ -169,8 +169,19 @@ else
   fail "legacy global current.json did not name B as expected: got '$LEGACY_SLUG' (err: $(cat "$TMPDIR_EVAL/ac7-current-legacy.err"))"
 fi
 
-PER_ACTOR_FILE_A="$AC7_ROOT/current/eval-actor-a-session.json"
-PER_ACTOR_FILE_B="$AC7_ROOT/current/eval-actor-b-session.json"
+# #440 fix-wave 2: the per-actor filename is now collision-resistant (sanitized prefix + hash of
+# the FULL actor key, see current-pointer.js's perActorCurrentFile) -- compute the expected path
+# via the real function rather than re-deriving the naming rule by hand.
+PER_ACTOR_FILE_A="$(CP_HELPER_ARG="$CURRENT_POINTER_HELPER" ROOT_ARG="$AC7_ROOT" ACTOR_ARG="eval-actor-a-session" node - <<'NODE'
+const { perActorCurrentFile } = require(process.env.CP_HELPER_ARG);
+process.stdout.write(perActorCurrentFile(process.env.ROOT_ARG, process.env.ACTOR_ARG));
+NODE
+)"
+PER_ACTOR_FILE_B="$(CP_HELPER_ARG="$CURRENT_POINTER_HELPER" ROOT_ARG="$AC7_ROOT" ACTOR_ARG="eval-actor-b-session" node - <<'NODE'
+const { perActorCurrentFile } = require(process.env.CP_HELPER_ARG);
+process.stdout.write(perActorCurrentFile(process.env.ROOT_ARG, process.env.ACTOR_ARG));
+NODE
+)"
 [[ -f "$PER_ACTOR_FILE_A" ]] && pass "actor A's per-actor current file exists on disk" || fail "actor A's per-actor current file was not written"
 [[ -f "$PER_ACTOR_FILE_B" ]] && pass "actor B's per-actor current file exists on disk" || fail "actor B's per-actor current file was not written"
 
@@ -178,9 +189,13 @@ PER_ACTOR_FILE_B="$AC7_ROOT/current/eval-actor-b-session.json"
 echo "--- 3. legacy-only fixture: existing consumers resolve identically to pre-#291 output (AC8) ---"
 
 # 3a. stop-goal-fit.js -- reuses test_goal_fit_hook.sh's own fixture/assertion verbatim, run
-# under a DIFFERENT ambient actor that has no per-actor current file -- proves the compat shim
-# falls straight through to the legacy file (same output regardless of actor) exactly as
-# pre-#291 (when this file had no actor-awareness at all).
+# under a genuinely UNRESOLVED actor (FLOW_AGENTS_ACTOR_TEST_FORCE_UNRESOLVED escape hatch,
+# matching test_stop_hook_release.sh's F(iii) convention) -- proves the compat shim falls
+# straight through to the legacy file exactly as pre-#291 (when this file had no actor-awareness
+# at all). #440: a RESOLVED actor with no own per-actor pointer no longer falls back to this
+# legacy file for BLOCKING purposes (see new section 7) -- that distinct, resolved-actor case is
+# the bug #440 fixes, so this section must force a genuinely unresolved actor to keep testing the
+# unchanged compat-shim path AC4 is about, not the now-intentionally-changed resolved-actor path.
 GOAL_FIT_REPO="$TMPDIR_EVAL/goal-fit-legacy/repo"
 mkdir -p "$GOAL_FIT_REPO/.kontourai/flow-agents/feedback-loop"
 LEGACY_POINTER_LINE="{\"schema_version\":\"1.0\",\"active_slug\":\"feedback-loop\",\"artifact_dir\":\"feedback-loop\"}"
@@ -200,7 +215,7 @@ type: deliver
 Implementation plan exists, but no goal fit state exists yet.
 MARKDOWN
 
-if FLOW_AGENTS_ACTOR=eval-actor-no-per-actor-file FLOW_AGENTS_GOAL_FIT_MODE=warn FLOW_AGENTS_GOAL_FIT_MAX_BLOCKS=100000 \
+if FLOW_AGENTS_ACTOR_TEST_FORCE_UNRESOLVED=1 NODE_ENV=test FLOW_AGENTS_GOAL_FIT_MODE=warn FLOW_AGENTS_GOAL_FIT_MAX_BLOCKS=100000 \
   node "$GOAL_FIT_GATE" >"$TMPDIR_EVAL/goal-fit-legacy.out" 2>"$TMPDIR_EVAL/goal-fit-legacy.err" <<JSON
 {"hook_event_name":"Stop","cwd":"$GOAL_FIT_REPO"}
 JSON
@@ -216,7 +231,8 @@ fi
 
 # 3b. evidence-capture.js's resolveArtifactDir -- reuses test_command_log_concurrency.sh's
 # fixture: current.json (legacy-only) names a slug; a captured PostToolUse event must land in
-# THAT slug's command-log.jsonl, under a different ambient actor with no per-actor file.
+# THAT slug's command-log.jsonl, under a genuinely UNRESOLVED actor (#440: see 3a's comment --
+# a RESOLVED actor with no own pointer now intentionally returns null here instead, see section 7).
 EVIDENCE_REPO="$TMPDIR_EVAL/evidence-legacy/repo"
 EVIDENCE_SLUG="legacy-evidence-slug"
 mkdir -p "$EVIDENCE_REPO/.kontourai/flow-agents/$EVIDENCE_SLUG"
@@ -230,7 +246,7 @@ printf '%s' "$EVIDENCE_STATE_LINE" | safe_write "$EVIDENCE_REPO/.kontourai/flow-
 
 EVIDENCE_EVENT_LINE="{\"hook_event_name\":\"PostToolUse\",\"tool_name\":\"Bash\",\"cwd\":\"$EVIDENCE_REPO\",\"tool_input\":{\"command\":\"echo legacy-actor-check\"},\"tool_response\":{\"exitCode\":0,\"stdout\":\"ok\"}}"
 printf '%s' "$EVIDENCE_EVENT_LINE" \
-  | FLOW_AGENTS_ACTOR=eval-actor-no-per-actor-file node "$EVIDENCE_CAPTURE" >"$TMPDIR_EVAL/evidence-legacy.out" 2>"$TMPDIR_EVAL/evidence-legacy.err"
+  | FLOW_AGENTS_ACTOR_TEST_FORCE_UNRESOLVED=1 NODE_ENV=test node "$EVIDENCE_CAPTURE" >"$TMPDIR_EVAL/evidence-legacy.out" 2>"$TMPDIR_EVAL/evidence-legacy.err"
 
 EVIDENCE_LOG_FILE="$EVIDENCE_REPO/.kontourai/flow-agents/$EVIDENCE_SLUG/command-log.jsonl"
 if [[ -f "$EVIDENCE_LOG_FILE" ]] && grep -qF "legacy-actor-check" "$EVIDENCE_LOG_FILE"; then
@@ -295,7 +311,8 @@ else
 fi
 
 # 3d. workflow-steering.js's ambient state lookup -- reuses test_workflow_steering_hook.sh's
-# steering-demo fixture/assertion verbatim, under a different ambient actor.
+# steering-demo fixture/assertion verbatim, under a genuinely UNRESOLVED actor (#440: see 3a's
+# comment -- a RESOLVED actor with no own pointer now intentionally sees no banner, see section 7).
 STEERING_REPO="$TMPDIR_EVAL/steering-legacy/repo"
 mkdir -p "$STEERING_REPO/.kontourai/flow-agents/steering-demo"
 mkdir -p "$STEERING_REPO/docs"
@@ -317,7 +334,7 @@ safe_write "$STEERING_REPO/.kontourai/flow-agents/steering-demo/state.json" <<'J
 }
 JSON
 
-STEERING_OUT="$(FLOW_AGENTS_ACTOR=eval-actor-no-per-actor-file node "$STEERING" <<JSON
+STEERING_OUT="$(FLOW_AGENTS_ACTOR_TEST_FORCE_UNRESOLVED=1 NODE_ENV=test node "$STEERING" <<JSON
 {"hook_event_name":"UserPromptSubmit","cwd":"$STEERING_REPO","prompt":"continue"}
 JSON
 )"
@@ -451,16 +468,19 @@ fi
 
 # --- 6. F3 (fix-plan iteration 1, code-review-291 MEDIUM): legacy current.json names a
 # still-ACTIVE, non-newest-mtime session while a NEWER active state.json exists elsewhere under
-# the same artifact root, under a RESOLVED actor with no per-actor current file. Pre-#291,
+# the same artifact root, under a genuinely UNRESOLVED actor (#440: this section's fixture uses
+# the FLOW_AGENTS_ACTOR_TEST_FORCE_UNRESOLVED escape hatch -- a RESOLVED actor with no per-actor
+# current file no longer falls through to the legacy pointer at all, see section 7; this section
+# is specifically about the unchanged D3/unresolved-actor compat path). Pre-#291,
 # latestWorkflowState() was a pure global newest-mtime scan with zero current.json involvement,
 # so the newer state.json would win. Post-#291, actorScopedWorkflowState() is consulted first and
-# falls through to the legacy current.json for an actor with no per-actor file (the compat-shim
-# guarantee section 3 already covers) -- but if that legacy pointer names a still-ACTIVE session,
-# it is now returned IMMEDIATELY, without ever comparing mtimes against the newer state.json. This
-# section test-pins that specific, deliberate behavior change (current.json preference wins over
-# newest-mtime) for the single-actor/resolved-actor case, not just the multi-actor case AC7/AC8
+# falls through to the legacy current.json for an unresolved actor (the compat-shim guarantee
+# section 3 already covers) -- but if that legacy pointer names a still-ACTIVE session, it is now
+# returned IMMEDIATELY, without ever comparing mtimes against the newer state.json. This section
+# test-pins that specific, deliberate behavior change (current.json preference wins over
+# newest-mtime) for the single-actor/unresolved-actor case, not just the multi-actor case AC7/AC8
 # are framed around -- the review's flagged, previously test-uncovered edge.
-echo "--- 6. legacy current.json (non-newest, still-active) wins over a newer state.json elsewhere, under a resolved actor (F3, fix-plan iteration 1) ---"
+echo "--- 6. legacy current.json (non-newest, still-active) wins over a newer state.json elsewhere, under an unresolved actor (F3, fix-plan iteration 1) ---"
 
 F3_REPO="$TMPDIR_EVAL/f3-legacy-vs-newest/repo"
 mkdir -p "$F3_REPO/.kontourai/flow-agents/older-named-slug"
@@ -506,20 +526,395 @@ safe_write "$F3_REPO/.kontourai/flow-agents/newer-unnamed-slug/state.json" <<'JS
 }
 JSON
 
-# A RESOLVED actor (FLOW_AGENTS_ACTOR set) with no per-actor current file -- actorScopedWorkflowState
-# falls through to the legacy current.json (same compat-shim guarantee as section 3), which names
+# A genuinely UNRESOLVED actor (#440: see 3a's comment -- a RESOLVED actor with no per-actor
+# current file no longer falls through here, see section 7) -- actorScopedWorkflowState falls
+# through to the legacy current.json (same compat-shim guarantee as section 3), which names
 # the OLDER-but-still-active session.
-F3_OUT="$(FLOW_AGENTS_ACTOR=eval-actor-f3-resolved node "$ROOT/scripts/hooks/workflow-steering.js" <<JSON
+F3_OUT="$(FLOW_AGENTS_ACTOR_TEST_FORCE_UNRESOLVED=1 NODE_ENV=test node "$ROOT/scripts/hooks/workflow-steering.js" <<JSON
 {"hook_event_name":"UserPromptSubmit","cwd":"$F3_REPO","prompt":"continue"}
 JSON
 )"
 
 if [[ "$F3_OUT" == *"older-named-slug"* && "$F3_OUT" != *"newer-unnamed-slug"* ]]; then
-  pass "workflow-steering.js prefers the legacy current.json's named ACTIVE session over a newer-mtime state.json elsewhere, under a resolved actor with no per-actor file (F3 -- pins the post-#291 behavior change explicitly, not just AC7/AC8's multi-actor framing)"
+  pass "workflow-steering.js prefers the legacy current.json's named ACTIVE session over a newer-mtime state.json elsewhere, under an unresolved actor (F3 -- pins the post-#291 behavior change explicitly, not just AC7/AC8's multi-actor framing; #440: a resolved actor with no per-actor file no longer takes this path at all, see section 7)"
 else
   fail "workflow-steering.js did not prefer the legacy-named active session over the newer-mtime one: $F3_OUT"
 fi
 
+# --- 7. #440: two-session ownership isolation (readOwnCurrentPointer) --------------------------
+# Distinct from section 2 (AC7, both A and B have run ensure-session): here actor A does NOT run
+# ensure-session at all before the "not own pointer" assertions below -- the "resolved actor, no
+# own per-actor pointer at all" case readOwnCurrentPointer's D1 rule (never fall back to the
+# shared legacy current.json / a global scan) is specifically about. Positive controls (actor A's
+# own gate/banner/capture keep working once A DOES have its own pointer) run last, in their own
+# subsection, so they never contaminate the "no own pointer" preconditions the earlier assertions
+# depend on.
+echo "--- 7. #440: two-session ownership isolation (readOwnCurrentPointer) ---"
+
+# This file's own header only sets `set -uo pipefail` (no errexit) -- but section 4's
+# config-protection.js checks toggle `set -e` back ON after their own `set +e`/`set -e`
+# bracketing and never restore the header's original (errexit-off) mode, so errexit is (latently,
+# unintentionally) still active by the time execution reaches here. This section deliberately
+# invokes commands expected to exit nonzero (e.g. the AC2 anti-gaming positive control, which
+# must itself observe a block/exit!=0) via plain `VAR="$(...)"` assignments -- under errexit a
+# nonzero-returning command substitution assignment terminates the whole script immediately, with
+# no error message, silently truncating every assertion after it. `set +e` restores this section to
+# the file's own declared header mode for the remainder of the file (safe: sections 1-6 above are
+# unaffected since they already ran; nothing below this section depends on errexit being on).
+set +e
+
+AC440_REPO="$TMPDIR_EVAL/ac440-project"
+AC440_ROOT="$AC440_REPO/.kontourai/flow-agents"
+mkdir -p "$AC440_REPO/docs"
+printf '# Test Repo\n' > "$AC440_REPO/AGENTS.md"
+printf '# Context Map\n' > "$AC440_REPO/docs/context-map.md"
+
+# 7.0 Setup: actor B runs ensure-session on a real Work Item (establishing B's own per-actor
+# current/eval-actor-440-b.json AND the shared legacy current.json, exactly like section 2's
+# AC7_ROOT setup), then B's session is mutated into a genuine, blocking evidence gap (execution
+# phase, no trust.bundle) so the "not blocked by B" assertions below are a real differential test,
+# not a tautology -- mirrors this file's own section 3a fixture shape (status:executing markdown +
+# no trust.bundle) and test_stop_hook_release.sh's seed_session/write_session_state convention.
+flow_agents_node "workflow-sidecar" ensure-session \
+  --artifact-root "$AC440_ROOT" \
+  --work-item "kontourai/flow-agents#94401" \
+  --actor eval-actor-440-b \
+  --source-request "Actor B's own subject, with a real evidence gap." \
+  --summary "Actor B session with a deliberate evidence gap." \
+  >"$TMPDIR_EVAL/ac440-b-ensure.out" 2>"$TMPDIR_EVAL/ac440-b-ensure.err"
+AC440_B_STATUS=$?
+
+AC440_B_SLUG="kontourai-flow-agents-94401"
+AC440_B_DIR="$AC440_ROOT/$AC440_B_SLUG"
+
+if [[ "$AC440_B_STATUS" -eq 0 && -d "$AC440_B_DIR" ]]; then
+  pass "setup: actor B's ensure-session establishes B's own per-actor current file and a real session dir"
+else
+  fail "setup: actor B's ensure-session failed: $(cat "$TMPDIR_EVAL/ac440-b-ensure.out" "$TMPDIR_EVAL/ac440-b-ensure.err")"
+fi
+
+AC440_B_STATE_LINE="{\"schema_version\":\"1.0\",\"task_slug\":\"$AC440_B_SLUG\",\"status\":\"in_progress\",\"phase\":\"execution\",\"updated_at\":\"2026-07-13T00:00:00Z\",\"next_action\":{\"status\":\"continue\",\"summary\":\"Actor B's own unresolved evidence gap.\"}}"
+printf '%s' "$AC440_B_STATE_LINE" | safe_write "$AC440_B_DIR/state.json"
+
+cat > "$AC440_B_DIR/${AC440_B_SLUG}--deliver.md" <<MARKDOWN
+# ${AC440_B_SLUG}
+
+branch: main
+worktree: main
+created: 2026-07-13
+status: executing
+type: deliver
+
+## Plan
+
+Actor B's own session, deliberately left with a genuine evidence gap (no trust.bundle) so this
+section's "actor A is not blocked by B's gap" assertions are a real differential test.
+MARKDOWN
+
+# 7.1 AC1 (liveness): a `claim` liveness event for B's own subject/actor already exists in the
+# shared liveness stream (ensure-session emits one as part of its own claim). Invoking the Stop
+# hook as actor A (who has NOT run ensure-session -- no own per-actor pointer at all) must never
+# append a `release`/other event attributed to A's own actor string for B's subject -- readActiveSlug
+# resolving B's slug for A would be exactly the liveness half of the bug #440 fixes.
+AC440_LIVENESS_FILE="$AC440_ROOT/liveness/events.jsonl"
+AC440_LIVENESS_LINES_BEFORE=0
+[[ -f "$AC440_LIVENESS_FILE" ]] && AC440_LIVENESS_LINES_BEFORE="$(wc -l < "$AC440_LIVENESS_FILE" | tr -d ' ')"
+
+FLOW_AGENTS_ACTOR=eval-actor-440-a FLOW_AGENTS_GOAL_FIT_MODE=warn node "$GOAL_FIT_GATE" \
+  >"$TMPDIR_EVAL/ac440-a-liveness.out" 2>"$TMPDIR_EVAL/ac440-a-liveness.err" <<JSON
+{"hook_event_name":"Stop","cwd":"$AC440_REPO"}
+JSON
+
+if grep -q "\"subjectId\":\"$AC440_B_SLUG\",\"actor\":\"eval-actor-440-a\"" "$AC440_LIVENESS_FILE" 2>/dev/null; then
+  fail "AC1: actor A's Stop hook emitted a liveness event naming B's slug under A's own actor identity"
+else
+  pass "AC1: actor A's Stop hook (no own per-actor pointer) emits no liveness event naming B's subject under A's actor identity"
+fi
+
+# 7.2 AC2 (not blocked by B): actor A's Stop hook, in block mode, must exit 0 and never mention
+# B's slug -- B's own real evidence gap is informational-only from A's perspective, never blocking.
+AC440_A_NOTBLOCKED_OUT="$(FLOW_AGENTS_ACTOR=eval-actor-440-a FLOW_AGENTS_GOAL_FIT_MODE=block node "$GOAL_FIT_GATE" 2>"$TMPDIR_EVAL/ac440-a-notblocked.err" <<JSON
+{"hook_event_name":"Stop","cwd":"$AC440_REPO"}
+JSON
+)"
+AC440_A_NOTBLOCKED_STATUS=$?
+
+if [[ "$AC440_A_NOTBLOCKED_STATUS" -eq 0 ]]; then
+  pass "AC2: actor A's Stop hook (no own pointer, B has a real evidence gap) exits 0 -- not blocked by B's gap"
+else
+  fail "AC2: actor A's Stop hook unexpectedly blocked (exit=$AC440_A_NOTBLOCKED_STATUS): $AC440_A_NOTBLOCKED_OUT $(cat "$TMPDIR_EVAL/ac440-a-notblocked.err")"
+fi
+
+if grep -qF "$AC440_B_SLUG" "$TMPDIR_EVAL/ac440-a-notblocked.err"; then
+  fail "AC2: actor A's Stop hook stderr unexpectedly named B's slug: $(cat "$TMPDIR_EVAL/ac440-a-notblocked.err")"
+else
+  pass "AC2: actor A's Stop hook stderr never names B's slug"
+fi
+
+# 7.3 AC1 (banner): workflow-steering.js's SessionStart RESUME banner must never re-ground onto
+# B's active session for actor A (no own per-actor pointer).
+AC440_STEERING_A_OUT="$(FLOW_AGENTS_ACTOR=eval-actor-440-a node "$STEERING" <<JSON
+{"hook_event_name":"SessionStart","cwd":"$AC440_REPO"}
+JSON
+)"
+
+if [[ "$AC440_STEERING_A_OUT" != *"RESUME:"* && "$AC440_STEERING_A_OUT" != *"$AC440_B_SLUG"* ]]; then
+  pass "AC1: workflow-steering.js's SessionStart banner (actor A, no own pointer) shows no RESUME and never names B's slug"
+else
+  fail "AC1: workflow-steering.js's SessionStart banner unexpectedly showed RESUME or B's slug for actor A: $AC440_STEERING_A_OUT"
+fi
+
+# 7.4 Evidence-capture (Task 2.4 coverage): a PostToolUse event captured while actor A has no own
+# per-actor pointer must never land in B's command-log.jsonl.
+AC440_B_LOG="$AC440_B_DIR/command-log.jsonl"
+AC440_EVIDENCE_EVENT="{\"hook_event_name\":\"PostToolUse\",\"tool_name\":\"Bash\",\"cwd\":\"$AC440_REPO\",\"tool_input\":{\"command\":\"echo actor-a-must-not-land-in-b-log\"},\"tool_response\":{\"exitCode\":0,\"stdout\":\"ok\"}}"
+printf '%s' "$AC440_EVIDENCE_EVENT" \
+  | FLOW_AGENTS_ACTOR=eval-actor-440-a node "$EVIDENCE_CAPTURE" >"$TMPDIR_EVAL/ac440-evidence-a.out" 2>"$TMPDIR_EVAL/ac440-evidence-a.err"
+
+if [[ -f "$AC440_B_LOG" ]] && grep -qF "actor-a-must-not-land-in-b-log" "$AC440_B_LOG"; then
+  fail "evidence-capture.js (actor A, no own pointer) wrote A's tool activity into B's command-log.jsonl"
+else
+  pass "evidence-capture.js (actor A, no own pointer) never writes A's tool activity into B's command-log.jsonl"
+fi
+
+# 7.5 Positive controls: actor A's OWN gate/banner/capture keep working exactly as before, once A
+# has its own per-actor pointer -- the critical anti-gaming assertion (own gaps still gate; own
+# work still steers/captures). Run last so the earlier "no own pointer" assertions above are never
+# contaminated by A's own session existing.
+flow_agents_node "workflow-sidecar" ensure-session \
+  --artifact-root "$AC440_ROOT" \
+  --work-item "kontourai/flow-agents#94402" \
+  --actor eval-actor-440-a \
+  --source-request "Actor A's own subject, with its own deliberate evidence gap." \
+  --summary "Actor A session with its own deliberate evidence gap." \
+  >"$TMPDIR_EVAL/ac440-a-ensure.out" 2>"$TMPDIR_EVAL/ac440-a-ensure.err"
+AC440_A_STATUS=$?
+
+AC440_A_SLUG="kontourai-flow-agents-94402"
+AC440_A_DIR="$AC440_ROOT/$AC440_A_SLUG"
+
+if [[ "$AC440_A_STATUS" -eq 0 && -d "$AC440_A_DIR" ]]; then
+  pass "positive control setup: actor A's own ensure-session establishes A's own per-actor current file"
+else
+  fail "positive control setup: actor A's own ensure-session failed: $(cat "$TMPDIR_EVAL/ac440-a-ensure.out" "$TMPDIR_EVAL/ac440-a-ensure.err")"
+fi
+
+AC440_A_STATE_LINE="{\"schema_version\":\"1.0\",\"task_slug\":\"$AC440_A_SLUG\",\"status\":\"in_progress\",\"phase\":\"execution\",\"updated_at\":\"2026-07-13T00:00:00Z\",\"next_action\":{\"status\":\"continue\",\"summary\":\"Actor A's own unresolved evidence gap.\"}}"
+printf '%s' "$AC440_A_STATE_LINE" | safe_write "$AC440_A_DIR/state.json"
+
+cat > "$AC440_A_DIR/${AC440_A_SLUG}--deliver.md" <<MARKDOWN
+# ${AC440_A_SLUG}
+
+branch: main
+worktree: main
+created: 2026-07-13
+status: executing
+type: deliver
+
+## Plan
+
+Actor A's own session, deliberately left with its own genuine evidence gap (no trust.bundle) --
+own-work gating must remain unaffected by the #440 fix (anti-gaming guarantee).
+MARKDOWN
+
+AC440_A_BLOCKED_OUT="$(FLOW_AGENTS_ACTOR=eval-actor-440-a FLOW_AGENTS_GOAL_FIT_MODE=block node "$GOAL_FIT_GATE" 2>"$TMPDIR_EVAL/ac440-a-blocked.err" <<JSON
+{"hook_event_name":"Stop","cwd":"$AC440_REPO"}
+JSON
+)"
+AC440_A_BLOCKED_STATUS=$?
+
+if [[ "$AC440_A_BLOCKED_STATUS" -ne 0 ]]; then
+  pass "AC2 (anti-gaming): actor A's Stop hook STILL blocks on A's own evidence gap once A has its own per-actor pointer"
+else
+  fail "AC2 (anti-gaming): actor A's Stop hook unexpectedly did NOT block on A's own evidence gap: $AC440_A_BLOCKED_OUT $(cat "$TMPDIR_EVAL/ac440-a-blocked.err")"
+fi
+
+AC440_STEERING_A_OWN_OUT="$(FLOW_AGENTS_ACTOR=eval-actor-440-a node "$STEERING" <<JSON
+{"hook_event_name":"SessionStart","cwd":"$AC440_REPO"}
+JSON
+)"
+
+if [[ "$AC440_STEERING_A_OWN_OUT" == *"RESUME: $AC440_A_SLUG"* ]]; then
+  pass "AC1 (positive control): workflow-steering.js's SessionStart banner shows RESUME: <A's own slug> once A has its own per-actor pointer"
+else
+  fail "AC1 (positive control): workflow-steering.js's SessionStart banner did not show RESUME: $AC440_A_SLUG: $AC440_STEERING_A_OWN_OUT"
+fi
+
+AC440_A_LOG="$AC440_A_DIR/command-log.jsonl"
+AC440_EVIDENCE_EVENT_OWN="{\"hook_event_name\":\"PostToolUse\",\"tool_name\":\"Bash\",\"cwd\":\"$AC440_REPO\",\"tool_input\":{\"command\":\"echo actor-a-own-capture-check\"},\"tool_response\":{\"exitCode\":0,\"stdout\":\"ok\"}}"
+printf '%s' "$AC440_EVIDENCE_EVENT_OWN" \
+  | FLOW_AGENTS_ACTOR=eval-actor-440-a node "$EVIDENCE_CAPTURE" >"$TMPDIR_EVAL/ac440-evidence-a-own.out" 2>"$TMPDIR_EVAL/ac440-evidence-a-own.err"
+
+if [[ -f "$AC440_A_LOG" ]] && grep -qF "actor-a-own-capture-check" "$AC440_A_LOG"; then
+  pass "evidence-capture.js (positive control): actor A's own capture still works once A has its own per-actor pointer"
+else
+  fail "evidence-capture.js (positive control): actor A's own capture did not work: $(cat "$TMPDIR_EVAL/ac440-evidence-a-own.out" "$TMPDIR_EVAL/ac440-evidence-a-own.err")"
+fi
+
+# 7.6 FIX 1 (HIGH, collision -- independent review): two distinct resolved actor keys sharing a
+# >=64-char common sanitized prefix (differing only in a tail the pre-#440-fix-wave-2 64-char
+# truncation would have discarded) must map to DISTINCT per-actor pointer files, and each actor's
+# OWN read must resolve its OWN pointer -- never the other's -- proving neither session grounds
+# onto the other. Reproduces the exact collision the review found:
+# perActorCurrentFile(dir, A) === perActorCurrentFile(dir, B) under the pre-fix mapping.
+AC440_COLLIDE_DIR="$TMPDIR_EVAL/collide-root/.kontourai/flow-agents"
+if CP_HELPER_ARG="$CURRENT_POINTER_HELPER" DIR_ARG="$AC440_COLLIDE_DIR" node - <<'NODE' 2>"$TMPDIR_EVAL/ac440-collide.err"
+const { perActorCurrentFile, writePerActorCurrent, readOwnCurrentPointer } = require(process.env.CP_HELPER_ARG);
+const dir = process.env.DIR_ARG;
+const prefix = 'claude-code:' + 's'.repeat(52);
+const keyA = prefix + ':host-a';
+const keyB = prefix + ':host-b';
+
+const fileA = perActorCurrentFile(dir, keyA);
+const fileB = perActorCurrentFile(dir, keyB);
+if (fileA === fileB) {
+  console.error(`FILES_COLLIDE: ${fileA}`);
+  process.exit(1);
+}
+
+writePerActorCurrent(dir, keyA, { active_slug: 'collide-a-slug' });
+writePerActorCurrent(dir, keyB, { active_slug: 'collide-b-slug' });
+
+const resultA = readOwnCurrentPointer(dir, keyA);
+const resultB = readOwnCurrentPointer(dir, keyB);
+if (!resultA.payload || resultA.payload.active_slug !== 'collide-a-slug') {
+  console.error(`ACTOR_A_WRONG_SLUG: ${JSON.stringify(resultA)}`);
+  process.exit(1);
+}
+if (!resultB.payload || resultB.payload.active_slug !== 'collide-b-slug') {
+  console.error(`ACTOR_B_WRONG_SLUG: ${JSON.stringify(resultB)}`);
+  process.exit(1);
+}
+NODE
+then
+  pass "FIX 1: two actor keys sharing a >=64-char common sanitized prefix map to DISTINCT per-actor pointer files, and each actor's own read resolves its own session, never the other's (collision-resistant naming)"
+else
+  fail "FIX 1: colliding actor keys did not map to distinct files / grounded onto each other's session: $(cat "$TMPDIR_EVAL/ac440-collide.err")"
+fi
+
+# 7.7 FIX 1 (legacy-name fallback -- independent review): a pointer written under the PRE-fix-wave-2
+# filename scheme (legacyPerActorCurrentFile -- sanitizeSegment(actorKey) alone, no hash) with NO
+# new-scheme file present must still resolve for its owning actor -- the transition-window compat
+# guarantee (a still-running published-3.9.0-era session's pointer keeps resolving).
+if CP_HELPER_ARG="$CURRENT_POINTER_HELPER" DIR_ARG="$AC440_COLLIDE_DIR" node - <<'NODE' 2>"$TMPDIR_EVAL/ac440-legacy-fallback.err"
+const fs = require('fs');
+const path = require('path');
+const { legacyPerActorCurrentFile, perActorCurrentFile, readOwnCurrentPointer } = require(process.env.CP_HELPER_ARG);
+const dir = process.env.DIR_ARG;
+const actorKey = 'eval-actor-440-legacy-fallback';
+
+const newFile = perActorCurrentFile(dir, actorKey);
+if (fs.existsSync(newFile)) { console.error(`NEW_FILE_UNEXPECTEDLY_EXISTS: ${newFile}`); process.exit(1); }
+
+const legacyFile = legacyPerActorCurrentFile(dir, actorKey);
+fs.mkdirSync(path.dirname(legacyFile), { recursive: true });
+fs.writeFileSync(legacyFile, JSON.stringify({ active_slug: 'legacy-fallback-slug' }));
+
+const result = readOwnCurrentPointer(dir, actorKey);
+if (!result.payload || result.payload.active_slug !== 'legacy-fallback-slug') {
+  console.error(`FALLBACK_DID_NOT_RESOLVE: ${JSON.stringify(result)}`);
+  process.exit(1);
+}
+if (result.file !== legacyFile) {
+  console.error(`FALLBACK_FILE_MISMATCH: got ${result.file} expected ${legacyFile}`);
+  process.exit(1);
+}
+NODE
+then
+  pass "FIX 1: a pointer written under the pre-fix-wave-2 legacy filename (no new-scheme file present) still resolves for its owning actor (transition-window fallback)"
+else
+  fail "FIX 1: legacy-filename fallback did not resolve as expected: $(cat "$TMPDIR_EVAL/ac440-legacy-fallback.err")"
+fi
+
+# 7.8 FINDING 1 (MED, independent review delta): record-agent-event's updateCurrentAgent must
+# migrate a LEGACY-only per-actor pointer (as a still-running published-3.9.0-era sidecar would
+# have written, pre-fix-wave-2) to the new collision-resistant filename on first touch, applying
+# the active_agents/updated_at projection -- not silently skip that projection because it only
+# read the new filename directly (fs.existsSync/readFileSync on perActorCurrentFile() alone,
+# never falling back to legacyPerActorCurrentFile()).
+AC440_MIGRATE_ROOT="$TMPDIR_EVAL/ac440-migrate-project/.kontourai/flow-agents"
+AC440_MIGRATE_ACTOR="eval-actor-440-legacy-migrate"
+AC440_MIGRATE_AGENT_ID="tool-worker"
+
+flow_agents_node "workflow-sidecar" ensure-session \
+  --artifact-root "$AC440_MIGRATE_ROOT" \
+  --work-item "kontourai/flow-agents#94405" \
+  --actor "$AC440_MIGRATE_ACTOR" \
+  --source-request "Actor establishing a session whose pointer will be downgraded to legacy-only." \
+  --summary "Legacy-pointer migration regression session." \
+  >"$TMPDIR_EVAL/ac440-migrate-ensure.out" 2>"$TMPDIR_EVAL/ac440-migrate-ensure.err"
+AC440_MIGRATE_SLUG="kontourai-flow-agents-94405"
+AC440_MIGRATE_DIR="$AC440_MIGRATE_ROOT/$AC440_MIGRATE_SLUG"
+
+# Downgrade the per-actor pointer to LEGACY-ONLY: capture the payload ensure-session wrote under
+# the NEW filename, delete the new file, and re-write the SAME payload under the pre-fix-wave-2
+# legacy filename -- reproducing exactly what a pointer a still-running published-3.9.0 sidecar
+# (pre-fix-wave-2) would have on disk.
+if CP_HELPER_ARG="$CURRENT_POINTER_HELPER" DIR_ARG="$AC440_MIGRATE_ROOT" ACTOR_ARG="$AC440_MIGRATE_ACTOR" node - <<'NODE' 2>"$TMPDIR_EVAL/ac440-migrate-downgrade.err"
+const fs = require('fs');
+const { perActorCurrentFile, legacyPerActorCurrentFile } = require(process.env.CP_HELPER_ARG);
+const dir = process.env.DIR_ARG;
+const actorKey = process.env.ACTOR_ARG;
+const newFile = perActorCurrentFile(dir, actorKey);
+if (!fs.existsSync(newFile)) { console.error(`NEW_FILE_MISSING: ${newFile}`); process.exit(1); }
+const payload = fs.readFileSync(newFile, 'utf8');
+fs.unlinkSync(newFile);
+const legacyFile = legacyPerActorCurrentFile(dir, actorKey);
+fs.writeFileSync(legacyFile, payload);
+NODE
+then
+  pass "setup: actor's per-actor pointer downgraded to legacy-only (new-name file removed, same payload re-written under the pre-fix-wave-2 legacy filename)"
+else
+  fail "setup: failed to downgrade the per-actor pointer to legacy-only: $(cat "$TMPDIR_EVAL/ac440-migrate-downgrade.err")"
+fi
+
+flow_agents_node "workflow-sidecar" record-agent-event \
+  --artifact-root "$AC440_MIGRATE_ROOT" \
+  --actor "$AC440_MIGRATE_ACTOR" \
+  --agent-id "$AC440_MIGRATE_AGENT_ID" \
+  --kind note \
+  --status active \
+  --summary "legacy-pointer migration regression probe" \
+  >"$TMPDIR_EVAL/ac440-migrate-record.out" 2>"$TMPDIR_EVAL/ac440-migrate-record.err"
+AC440_MIGRATE_RECORD_STATUS=$?
+
+# (source-tree legacy-ref scan note: the agent-events relative path below is built through a
+# variable, not a literal contiguous "agents/" + agent-id token, matching
+# test_model_routing_escalation.sh's own path.join(sdir, "agents", agent, "events.jsonl")
+# convention -- a literal contiguous "agents/<agent-id>/..."-shaped string in an eval file is
+# flagged by validate-source-tree.ts's legacy-ref scanner as a possible stale repo-path
+# reference.)
+if [[ "$AC440_MIGRATE_RECORD_STATUS" -eq 0 ]] && [[ -f "$AC440_MIGRATE_DIR/agents/$AC440_MIGRATE_AGENT_ID/events.jsonl" ]]; then
+  pass "FINDING 1: record-agent-event succeeds and records the agent event against a legacy-only per-actor pointer"
+else
+  fail "FINDING 1: record-agent-event did not succeed/record against a legacy-only pointer: status=$AC440_MIGRATE_RECORD_STATUS $(cat "$TMPDIR_EVAL/ac440-migrate-record.out" "$TMPDIR_EVAL/ac440-migrate-record.err")"
+fi
+
+# The CORE regression: updateCurrentAgent must have migrated the pointer to the NEW filename with
+# the active_agents projection applied -- not silently skipped it because it only checked the new
+# (at that point, absent) filename directly.
+if CP_HELPER_ARG="$CURRENT_POINTER_HELPER" DIR_ARG="$AC440_MIGRATE_ROOT" ACTOR_ARG="$AC440_MIGRATE_ACTOR" node - <<'NODE' 2>"$TMPDIR_EVAL/ac440-migrate-verify.err"
+const fs = require('fs');
+const { perActorCurrentFile } = require(process.env.CP_HELPER_ARG);
+const dir = process.env.DIR_ARG;
+const actorKey = process.env.ACTOR_ARG;
+const newFile = perActorCurrentFile(dir, actorKey);
+if (!fs.existsSync(newFile)) { console.error(`NEW_FILE_STILL_MISSING_AFTER_RECORD_AGENT_EVENT: ${newFile}`); process.exit(1); }
+const payload = JSON.parse(fs.readFileSync(newFile, 'utf8'));
+const active = Array.isArray(payload.active_agents) ? payload.active_agents : [];
+const entry = active.find((a) => a && a.agent_id === 'tool-worker');
+if (!entry || entry.status !== 'active') {
+  console.error(`ACTIVE_AGENTS_PROJECTION_MISSING: ${JSON.stringify(payload)}`);
+  process.exit(1);
+}
+NODE
+then
+  pass "FINDING 1: record-agent-event migrates a legacy-only per-actor pointer to the new collision-resistant filename on first touch, with the active_agents projection correctly applied (not silently skipped)"
+else
+  fail "FINDING 1: record-agent-event did not migrate/update the per-actor pointer as expected: $(cat "$TMPDIR_EVAL/ac440-migrate-verify.err")"
+fi
+
+
 echo ""
 if [[ "$errors" -eq 0 ]]; then
   echo "test_current_json_per_actor: all checks passed."

package/evals/integration/test_enforcer_expects_driven.sh

@@ -19,6 +19,17 @@
 set -uo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+# #440 FIXTURE-GAP: this suite's fixtures were written before #440's per-actor ownership scoping
+# and never establish a per-actor current pointer for the invoking actor -- under a RESOLVED
+# ambient actor (ancestry-derived locally, GITHUB_RUN_ID-derived CI-runtime in CI), stop-goal-fit.js's
+# analyze() now scopes to that actor's own (nonexistent) pointer and never reaches the
+# fixture-under-test at all. This suite is about anti-gaming/gate mechanics, not #440's ownership
+# scoping, so forcing the documented test-only unresolved-actor escape hatch restores EXACTLY this
+# suite's pre-#440 behavior (D3 compat: an unresolved actor keeps the unchanged legacy-fallback/
+# global-scan discovery every assertion below was written against).
+export FLOW_AGENTS_ACTOR_TEST_FORCE_UNRESOLVED=1
+export NODE_ENV=test
 GATE="$ROOT/scripts/hooks/stop-goal-fit.js"
 
 export FLOW_AGENTS_GOAL_FIT_MAX_BLOCKS=100000

package/evals/integration/test_ensure_session_ownership_guard.sh

@@ -427,6 +427,45 @@ fi
 [[ "$(json_query "$TMPDIR_EVAL/status-race.json" "assignment.assignee")" == *"$EXPECTED_RACE_HOLDER"* ]] && pass "on-disk record holder matches the process that actually exited 0 (no silent overwrite by the loser) (AC6)" || fail "on-disk record holder does not match the winning process: $(cat "$TMPDIR_EVAL/status-race.json")"
 
 echo ""
+
+# 7. #554: ensure-session consumes the helper-owned safe struct and re-enters as self.
+CODEX_PRIVATE_ROOT="$TMPDIR_EVAL/codex-private-root"
+CODEX_PRIVATE_RAW='ENSURE-PRIVATE-SENTINEL:thread/value'
+CODEX_PRIVATE_WORK="kontourai/flow-agents#9554"
+CODEX_PRIVATE_SLUG="kontourai-flow-agents-9554"
+if CODEX_THREAD_ID="$CODEX_PRIVATE_RAW" CODEX_SESSION_ID= flow_agents_node "workflow-sidecar" ensure-session \
+  --artifact-root "$CODEX_PRIVATE_ROOT" --work-item "$CODEX_PRIVATE_WORK" \
+  --source-request "Canonical Codex identity fixture." --summary "Privacy-safe actor fixture." \
+  >"$TMPDIR_EVAL/codex-private-first.out" 2>"$TMPDIR_EVAL/codex-private-first.err"; then
+  pass "ensure-session succeeds with CODEX_THREAD_ID"
+else
+  fail "ensure-session failed with CODEX_THREAD_ID: $(cat "$TMPDIR_EVAL/codex-private-first.out" "$TMPDIR_EVAL/codex-private-first.err")"
+fi
+CODEX_PRIVATE_RECORD="$CODEX_PRIVATE_ROOT/assignment/$CODEX_PRIVATE_SLUG.json"
+if node - "$CODEX_PRIVATE_RECORD" "$ROOT/scripts/hooks/lib/actor-identity.js" <<'NODE'
+const fs = require('fs');
+const record = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+const { serializeActor } = require(process.argv[3]);
+if (record.actor.runtime !== 'codex' || !/^thread-[a-f0-9]{24}$/.test(record.actor.session_id)) throw new Error('unsafe actor struct');
+if (record.actor_key !== serializeActor(record.actor)) throw new Error('key/struct mismatch');
+NODE
+then pass "ensure-session persists a canonical Codex actor struct whose serialization equals actor_key"
+else fail "ensure-session persisted a divergent or unsafe Codex actor struct/key"
+fi
+if rg -qF 'ENSURE-PRIVATE-SENTINEL' "$CODEX_PRIVATE_ROOT" "$TMPDIR_EVAL/codex-private-first.out" "$TMPDIR_EVAL/codex-private-first.err"; then
+  fail "raw CODEX_THREAD_ID sentinel leaked into ensure-session artifacts or output"
+else
+  pass "raw CODEX_THREAD_ID sentinel is absent from the complete ensure-session artifact/output set"
+fi
+if CODEX_THREAD_ID="$CODEX_PRIVATE_RAW" CODEX_SESSION_ID= flow_agents_node "workflow-sidecar" ensure-session \
+  --artifact-root "$CODEX_PRIVATE_ROOT" --work-item "$CODEX_PRIVATE_WORK" \
+  --source-request "Canonical Codex identity fixture reentry." --summary "Privacy-safe actor fixture reentry." \
+  >"$TMPDIR_EVAL/codex-private-second.out" 2>"$TMPDIR_EVAL/codex-private-second.err"; then
+  pass "second ensure-session recognizes the first canonical Codex claim as self"
+else
+  fail "second ensure-session did not recognize the canonical Codex claim as self: $(cat "$TMPDIR_EVAL/codex-private-second.out" "$TMPDIR_EVAL/codex-private-second.err")"
+fi
+
 if [[ "$errors" -eq 0 ]]; then
   echo "test_ensure_session_ownership_guard: all checks passed."
 else