@kontourai/flow-agents 4.0.0 → 4.2.0

package/dist/codex/.agents/skills/standards-authoring/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: "standards-authoring"
+description: "Author or update a repo's Veritas Repo Standards through the kit's standards-authoring flow: run `veritas init --explore`/`--guided` to derive a proposed starter set (project name, repo-shape-adaptive Repo Map nodes, evidence-check inference, and the AGENTS.md/CLAUDE.md governance-block splice), surface it for human approval, then `veritas init --apply` once a human-approved standards-authoring-approval trust.bundle claim satisfies the flow's human-approval gate. Use when adopting Veritas governance in a repo or re-deriving standards after its shape changes — beyond the static starter set `kit provision` scaffolds."
+---
+
+# Standards Authoring
+
+Derive a repo's Veritas Repo Standards, get a human to approve them, then write them — the
+authoring UX `veritas init` provides, driven through the kit's `standards-authoring` flow so
+the write is human-gated.
+
+**Veritas does the derivation and the write; this skill only invokes the `veritas` CLI and
+surfaces its recommendation for approval.** No standards evaluation, derivation, or splice
+logic is reimplemented here (kit non-goal: never fork or reimplement Veritas).
+
+## When to use this vs. `kit provision`
+
+- **`flow-agents kit provision veritas-governance`** copies a *static* starter `.veritas/` set
+  (placeholder project name, generic nodes) — fastest path to a repo that runs
+  `veritas readiness`. See the kit README's "Scaffolding starter standards".
+- **This skill** runs Veritas's *adaptive* authoring: it derives the project name, Repo Map
+  work-area nodes, and evidence-check command from the actual repo, and splices the governance
+  block into existing `AGENTS.md`/`CLAUDE.md` — the per-repo work a verbatim file copy cannot
+  do. Use it to author standards for real, or to re-derive after the repo's shape changes.
+
+## Flow binding
+
+This skill documents how to drive `flows/standards-authoring.flow.json` — a two-step
+**agentless-gate** flow `propose -> apply` with one gate (the kit declares no
+`flow_step_actions`; like `exemption-issuance`, the human produces the gate's approval bundle
+out of band, and this skill is the operator's runbook, not a step-bound action):
+
+- `human-approval-gate` (on `apply`) requires a **verified** `standards-authoring-approval`
+  trust.bundle claim (`subjectType: "repo-governance-change"`) before the apply write is
+  flow-sanctioned.
+
+As with `exemption-issuance`'s `human-approval-gate`, "human-approved" is an **operating
+convention** the gate's claim encodes, not a structural human-only guarantee — Flow's schema
+does not distinguish a human-authored bundle from an agent-authored one (see the kit README's
+"Human-approval evidence: what is and is not enforced"). The gate adds a named claim, a
+documented sequence, and an audit trail on top of the same mitigation `veritas init --apply`
+already carries (it refuses to overwrite existing standards without `--force`).
+
+## Sequence
+
+```bash
+# 1. PROPOSE — derive a recommendation without writing anything.
+veritas init --explore
+#    (or `veritas init --guided --answers <answers.json>` for owner Q&A)
+#    -> writes a hash-pinned recommendation artifact (schema_version, project_name,
+#       repo_insights, artifact_payloads incl. AGENTS.md/CLAUDE.md governance blocks,
+#       artifact_hashes, recommended_repo_map/standards/authority, owner_questions,
+#       reasoning_summary, apply_command). Nothing under .veritas/ is written yet.
+
+# 2. APPROVE — a human reviews the recommendation (its reasoning_summary and owner_questions),
+#    then authors a Hachure trust.bundle asserting the approval:
+#      claimType: "standards-authoring-approval", subjectType: "repo-governance-change",
+#      status: "verified".
+flow init
+flow start kits/veritas-governance/flows/standards-authoring.flow.json --run-id authoring
+flow attach-evidence authoring --gate human-approval-gate --file approval.bundle --bundle
+flow evaluate authoring --gate human-approval-gate --exit-code
+#    exit 0 once the approval claim is verified; exit 1 (block) otherwise.
+
+# 3. APPLY — only after the gate passes, write the approved recommendation.
+veritas init --apply --plan <path-to-recommendation-artifact>
+#    -> validates each artifact_hashes[path] === sha256(payload) (tamper/staleness check
+#       between propose and apply), refuses to overwrite existing starter files without
+#       --force, then writes .veritas/* and splices the governance block into the selected
+#       instruction files.
+```
+
+## Contract
+
+- **Wraps the `veritas` CLI; reimplements nothing.** Project-name derivation, adaptive Repo Map
+  nodes, evidence-check inference, and the governance-block splice all live inside `veritas`
+  (`veritas init` / `src/bootstrap/*` / `src/governance.mjs`). This skill invokes and surfaces;
+  it does not compute standards.
+- **The write is human-gated by convention, not structurally.** The flow's
+  `standards-authoring-approval` claim is the sign-off record; anyone who can
+  `flow attach-evidence --bundle` a conforming claim satisfies it. Read a passing gate as "a
+  verified approval claim of the right shape was attached," not as proof a human attached it.
+- **`veritas init --apply` is create-safe by default:** it refuses to overwrite existing
+  `.veritas/` standards without `--force`. Re-authoring an already-governed repo is therefore an
+  explicit, opt-in action — the skill never silently replaces standards.
+- **No engine dependency, no evaluation.** Nothing here runs or reimplements `veritas readiness`;
+  that stays the `readiness-check` flow's concern.

package/dist/codex/.agents/skills/tdd-workflow/context/contracts/execution-contract.md

@@ -42,7 +42,36 @@ Execution may upgrade to a stronger mode when risk increases. Downgrades require
 - Independent tasks with no shared files can run in the same wave.
 - Shared files, generated artifacts, migrations, and cross-cutting contracts should be serialized unless the plan gives explicit file ownership.
 - Worker delegation must name the exact worker role (`tool-worker`) rather than spawning an unnamed/default implementation agent.
-- After each wave, collect results, check conflicts, and update the session artifact before starting the next wave.
+- After each wave, reconcile results against the wave manifest (below), check conflicts, and update the session artifact before starting the next wave.
+
+## Wave Manifest And Reconciliation
+
+Fan-out collection is machine-checkable, not prose. A reduce step that silently
+drops a worker's stream is worse than one that errors.
+
+- **Declare before dispatch.** Before dispatching a wave that delegates work,
+  declare it in the session's `waves.json` sidecar (schema:
+  `schemas/workflow-waves.schema.json`): `wave_id`, owning step, and one
+  `expected_workers` entry per worker. The expected count (M) must exist before
+  any result arrives.
+- **One terminal record per worker.** Each worker lands exactly one terminal
+  status record: `completed`, `failed`, or `blocked`. Duplicate records and
+  undeclared reporters are validation errors.
+- **Reconcile at wave close.** The orchestrator's collect step is
+  reconcile-against-manifest: record every declared worker that has no terminal
+  record as `not_reported` — never silently absorb a missing worker — then
+  record the wave's `reconciliation` with `expected_count` M, `reported_count`
+  N, and an explicit "N of M reported" summary naming the `not_reported`
+  workers (for example "2 of 3 reported; worker-3 not_reported").
+- **Incomplete is visible, never silent.** A wave is `complete` only when N
+  equals M. An incomplete wave stays visible data and routes to re-dispatch, a
+  blocker report, or an explicit accepted gap; it must never be treated as
+  complete because the missing worker was forgotten.
+- **Enforcement boundary (slice 1).** `validate-workflow-artifacts` enforces
+  the shape and the cross-record arithmetic (counts, exactly-one-record,
+  undeclared reporters, impossible `complete` claims) as data-level validation.
+  Stop-hook refusal of wave completion is #663 part 3 (slice 2), deferred until
+  the hook correctness issues (#453/#450/#494) are resolved.
 
 ## Delegation: Model Routing
 

package/dist/codex/.agents/skills/verify-work/context/contracts/execution-contract.md

@@ -42,7 +42,36 @@ Execution may upgrade to a stronger mode when risk increases. Downgrades require
 - Independent tasks with no shared files can run in the same wave.
 - Shared files, generated artifacts, migrations, and cross-cutting contracts should be serialized unless the plan gives explicit file ownership.
 - Worker delegation must name the exact worker role (`tool-worker`) rather than spawning an unnamed/default implementation agent.
-- After each wave, collect results, check conflicts, and update the session artifact before starting the next wave.
+- After each wave, reconcile results against the wave manifest (below), check conflicts, and update the session artifact before starting the next wave.
+
+## Wave Manifest And Reconciliation
+
+Fan-out collection is machine-checkable, not prose. A reduce step that silently
+drops a worker's stream is worse than one that errors.
+
+- **Declare before dispatch.** Before dispatching a wave that delegates work,
+  declare it in the session's `waves.json` sidecar (schema:
+  `schemas/workflow-waves.schema.json`): `wave_id`, owning step, and one
+  `expected_workers` entry per worker. The expected count (M) must exist before
+  any result arrives.
+- **One terminal record per worker.** Each worker lands exactly one terminal
+  status record: `completed`, `failed`, or `blocked`. Duplicate records and
+  undeclared reporters are validation errors.
+- **Reconcile at wave close.** The orchestrator's collect step is
+  reconcile-against-manifest: record every declared worker that has no terminal
+  record as `not_reported` — never silently absorb a missing worker — then
+  record the wave's `reconciliation` with `expected_count` M, `reported_count`
+  N, and an explicit "N of M reported" summary naming the `not_reported`
+  workers (for example "2 of 3 reported; worker-3 not_reported").
+- **Incomplete is visible, never silent.** A wave is `complete` only when N
+  equals M. An incomplete wave stays visible data and routes to re-dispatch, a
+  blocker report, or an explicit accepted gap; it must never be treated as
+  complete because the missing worker was forgotten.
+- **Enforcement boundary (slice 1).** `validate-workflow-artifacts` enforces
+  the shape and the cross-record arithmetic (counts, exactly-one-record,
+  undeclared reporters, impossible `complete` claims) as data-level validation.
+  Stop-hook refusal of wave completion is #663 part 3 (slice 2), deferred until
+  the hook correctness issues (#453/#450/#494) are resolved.
 
 ## Delegation: Model Routing
 

package/dist/codex/.codex/agents/tool-security-reviewer.toml

@@ -4,4 +4,4 @@ nickname_candidates = ["tool-security-reviewer","security-reviewer","security re
 description = "Delegate to me for security analysis. Checks OWASP Top 10, secrets detection, input validation, injection vulnerabilities, auth/authz, and rate limiting. Read-only analysis with shell for scanning tools."
 model = "gpt-5.6-sol"
 model_reasoning_effort = "high"
-developer_instructions = "You are a security reviewer. You analyze source code for vulnerabilities and produce a structured security report.\n\n## Input\nYou receive:\n- A list of files to review\n- Optional focus area (auth, input handling, DB, etc.)\n\n## Security Checklist\n\nFor each file, check:\n- **Hardcoded secrets**: API keys, tokens, passwords, connection strings, private keys\n- **SQL injection**: string concatenation in queries, missing parameterization\n- **XSS**: unescaped user input in HTML/templates, innerHTML usage\n- **CSRF**: missing CSRF tokens on state-changing endpoints\n- **Path traversal**: user input in file paths without sanitization\n- **Auth bypasses**: missing auth checks, broken access control, privilege escalation\n- **Rate limiting**: unprotected endpoints susceptible to abuse\n- **Error leakage**: stack traces, internal paths, or system info in error responses\n- **Dependency vulnerabilities**: run npm audit / pip-audit / cargo audit if available\n\n## OWASP Top 10 Mapping\n\nTag each finding with its OWASP category:\n- A01: Broken Access Control\n- A02: Cryptographic Failures\n- A03: Injection\n- A04: Insecure Design\n- A05: Security Misconfiguration\n- A06: Vulnerable Components\n- A07: Auth Failures\n- A08: Data Integrity Failures\n- A09: Logging Failures\n- A10: SSRF\n\n## Trigger Conditions\n\nPrioritize review of code involving:\n- Authentication or authorization logic\n- User input handling (forms, query params, headers)\n- Database queries\n- File system operations\n- External API calls\n- Cryptographic operations\n- Payment or financial code\n\n## Secret Patterns\n\nScan for common patterns:\n- `AKIA[0-9A-Z]{16}` (AWS access keys)\n- `-----BEGIN (RSA |EC )?PRIVATE KEY-----`\n- `(password|secret|token|api_key)\\s*[:=]\\s*['\"][^'\"]+['\"]`\n- Base64-encoded strings >40 chars in assignments\n\n## Output\n\nReturn a structured security report:\n```markdown\n## Security Review\n\nFiles analyzed: <count>\nFindings: <count by severity>\n\n### Findings\n\n#### [CRITICAL/HIGH/MEDIUM/LOW] <OWASP-ID> - <file>:<line> - <title>\n<description with evidence>\n**Remediation:** <specific fix>\n\n### Summary\n<overall assessment>\n```\n\n## Rules\n- No false positives without evidence. Show the vulnerable code.\n- Run dependency audit tools if available (npm audit, pip-audit, cargo audit).\n- If no security issues found, say so clearly - don't invent findings.\n- This is read-only analysis. Do not modify any files.\n\n## Export Notes\n\nExported from a Kiro agent spec. Hooks, resource auto-loading, and tool allowlists were converted into prompt guidance only. Any explicit Kiro scheduler commands are preserved as optional shell workflows.\n"
+developer_instructions = "You are a security reviewer. You analyze source code for vulnerabilities and produce a structured security report.\n\n## Input\nYou receive:\n- A list of files to review\n- Optional focus area (auth, input handling, DB, etc.)\n\n## Security Checklist\n\nFor each file, check:\n- **Hardcoded secrets**: API keys, tokens, passwords, connection strings, private keys\n- **SQL injection**: string concatenation in queries, missing parameterization\n- **XSS**: unescaped user input in HTML/templates, innerHTML usage\n- **CSRF**: missing CSRF tokens on state-changing endpoints\n- **Path traversal**: user input in file paths without sanitization\n- **Auth bypasses**: missing auth checks, broken access control, privilege escalation\n- **Rate limiting**: unprotected endpoints susceptible to abuse\n- **Error leakage**: stack traces, internal paths, or system info in error responses\n- **Dependency vulnerabilities**: run npm audit / pip-audit / cargo audit if available\n\n## OWASP Top 10 Mapping\n\nTag each finding with its OWASP category:\n- A01: Broken Access Control\n- A02: Cryptographic Failures\n- A03: Injection\n- A04: Insecure Design\n- A05: Security Misconfiguration\n- A06: Vulnerable Components\n- A07: Auth Failures\n- A08: Data Integrity Failures\n- A09: Logging Failures\n- A10: SSRF\n\n## Trigger Conditions\n\nPrioritize review of code involving:\n- Authentication or authorization logic\n- User input handling (forms, query params, headers)\n- Database queries\n- File system operations\n- External API calls\n- Cryptographic operations\n- Payment or financial code\n\n## Secret Patterns\n\nScan for common patterns:\n- `AKIA[0-9A-Z]{16}` (AWS access keys)\n- `-----BEGIN (RSA |EC )?PRIVATE KEY-----`\n- `(password|secret|token|api_key)\\s*[:=]\\s*['\"][^'\"]+['\"]`\n- Base64-encoded strings >40 chars in assignments\n\n## Output\n\nReturn a structured security report:\n```markdown\n## Security Review\n\nFiles analyzed: <count>\nFindings: <count by severity>\n\n### Findings\n\n#### [CRITICAL/HIGH/MEDIUM/LOW] <OWASP-ID> - <file>:<line> - <title>\n<description with evidence>\n**Remediation:** <specific fix>\n\n### Summary\n<overall assessment>\n```\n\n## Rules\n- No false positives without evidence: cite the exact `file:line` and a one-line description of the weakness as the evidence.\n- Do NOT reproduce exploit payloads, working attack strings, or large copied blocks of vulnerable code in the report. A precise `file:line` reference plus a short description IS the evidence - reproduction detail belongs in the fix pass, not the recorded finding. (This keeps security findings recordable through `workflow critique`, whose reviewer runtime's provider may content-filter exploit-shaped prose.)\n- Run dependency audit tools if available (npm audit, pip-audit, cargo audit).\n- If no security issues found, say so clearly - don't invent findings.\n- This is read-only analysis. Do not modify any files.\n\n## Export Notes\n\nExported from a Kiro agent spec. Hooks, resource auto-loading, and tool allowlists were converted into prompt guidance only. Any explicit Kiro scheduler commands are preserved as optional shell workflows.\n"

package/dist/codex/build/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@kontourai/flow-agents",
-  "version": "4.0.0",
+  "version": "4.2.0",
   "type": "module"
 }

package/dist/codex/build/src/cli/init.js

@@ -8,6 +8,7 @@ import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { parseArgs, flagBool, flagList, flagString } from "../lib/args.js";
 import { activateCodexLocal } from "../runtime-adapters.js";
+import { provisionKit, ProvisionConflictError } from "../flow-kit/provision.js";
 import { main as buildBundles } from "../tools/build-universal-bundles.js";
 import { root } from "../tools/common.js";
 import { defaultCodexHome, durableInstallRecordPath, skillsManifestPath } from "../lib/local-artifact-root.js";
@@ -571,7 +572,21 @@ function installBundle(bundle, options) {
     }
     return result.status ?? 1;
 }
-function activateKits(options) {
+function kitPathForInit(kitId, dest) {
+    const catalogPath = path.join(root, "kits", "catalog.json");
+    if (fs.existsSync(catalogPath)) {
+        const catalog = JSON.parse(fs.readFileSync(catalogPath, "utf8"));
+        const entry = Array.isArray(catalog.kits)
+            ? catalog.kits.find((item) => typeof item === "object" && item !== null && item.id === kitId)
+            : undefined;
+        const rel = entry && typeof entry === "object" ? entry.path : undefined;
+        if (typeof rel === "string")
+            return path.resolve(root, rel);
+    }
+    const installed = path.join(dest, "kits", "local", "repositories", kitId);
+    return fs.existsSync(installed) ? installed : null;
+}
+async function activateKits(options) {
     const activeKitIds = options.activeKitIds ?? [];
     if (!options.activateKits || activeKitIds.length === 0 || options.runtime !== "codex")
         return 0;
@@ -582,6 +597,23 @@ function activateKits(options) {
     }
     const generated = Array.isArray(result.generated_runtime_files) ? result.generated_runtime_files : [];
     console.log(`Activated ${generated.length} Codex local runtime asset(s)`);
+    for (const kitId of activeKitIds) {
+        const kitDir = kitPathForInit(kitId, options.dest);
+        if (!kitDir)
+            throw new Error(`activated kit '${kitId}' could not be resolved for provisioning`);
+        try {
+            const provisioned = await provisionKit(kitDir, options.dest);
+            if (provisioned.files.length > 0)
+                console.log(`Provisioned ${provisioned.files.length} file(s) from kit '${kitId}'`);
+        }
+        catch (error) {
+            if (!(error instanceof ProvisionConflictError))
+                throw error;
+            for (const conflict of error.conflicts) {
+                console.warn(`flow-agents init: warning: skipped existing provision '${conflict.target}' from kit '${kitId}'`);
+            }
+        }
+    }
     return 0;
 }
 /**
@@ -809,7 +841,7 @@ export async function main(argv = process.argv.slice(2)) {
             if (installed !== 0)
                 return installed;
             writeInstallRecord(options.dest, "codex", true, options.activeKitIds ?? []);
-            return activateKits(options);
+            return await activateKits(options);
         }
         // --global for pi: NOT_VERIFIED (no documented global dir). Warn and fall through to workspace install.
         if (options.global && options.runtime === "pi") {
@@ -822,7 +854,7 @@ export async function main(argv = process.argv.slice(2)) {
         if (installed !== 0)
             return installed;
         writeInstallRecord(options.dest, options.runtime, options.global, options.activeKitIds ?? []);
-        const activated = activateKits(options);
+        const activated = await activateKits(options);
         // G2/G3: shared post-install auto-verify + summary tail. Applies
         // identically whether main() reached here via headlessOptions() or
         // interactiveOptions() -- never changes `activated`'s exit code.

package/dist/codex/build/src/cli/kit.js

@@ -6,7 +6,8 @@ import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs, flagBool, flagString } from "../lib/args.js";
 import { assertPathContained, assertPathsDisjoint, atomicWriteJson, copyDirAtomic, ensureSafeDirectory, isoNow, readJson, walkFiles } from "../lib/fs.js";
-import { assertKitRepository, deriveKitTargets, parseKitDependencies } from "../flow-kit/validate.js";
+import { assertKitRepository, deriveKitTargets, parseKitDependencies, validateKitRepositoryDiagnostics } from "../flow-kit/validate.js";
+import { provisionKit, ProvisionConflictError } from "../flow-kit/provision.js";
 import { activateCodexLocal, activateStrandsLocal } from "../runtime-adapters.js";
 import { defaultCodexHome } from "../lib/local-artifact-root.js";
 import { root } from "../tools/common.js";
@@ -35,6 +36,18 @@ function resolveCatalogKitSource(source) {
         return null;
     return path.resolve(path.dirname(repoCatalogPath), "..", rel);
 }
+function resolveProvisionKitSource(source, dest) {
+    const localPath = path.resolve(source);
+    if (fs.existsSync(localPath))
+        return localPath;
+    const installed = loadRegistry(dest).kits.find((entry) => entry.id === source);
+    if (installed) {
+        const installedSource = installedPath(dest, source);
+        if (fs.existsSync(installedSource))
+            return installedSource;
+    }
+    return resolveCatalogKitSource(source);
+}
 function loadRegistry(dest) {
     const file = registryPath(dest);
     if (!fs.existsSync(file))
@@ -64,6 +77,17 @@ function warnUninstalledDependencies(manifest, manifestPath, dest) {
         }
     }
 }
+/**
+ * Print non-blocking kit-validation warnings (e.g. an agent-spawning trigger surface
+ * declared without complete guard config — context/contracts/trigger-guards.md).
+ * Shared by BOTH install source forms (local path and git clone) so the standing
+ * warning contract cannot silently diverge between them. Same non-blocking
+ * `warning:` convention as warnUninstalledDependencies above.
+ */
+async function printKitValidationWarnings(kitDir) {
+    for (const warning of (await validateKitRepositoryDiagnostics(kitDir)).warnings)
+        console.log(`warning: ${warning}`);
+}
 function contentHash(root) {
     const hash = crypto.createHash("sha256");
     for (const file of walkFiles(root)) {
@@ -122,6 +146,7 @@ async function installLocalSource(source, argv) {
     let manifest;
     try {
         manifest = await assertKitRepository(source);
+        await printKitValidationWarnings(source);
     }
     catch (error) {
         console.log("Flow Kit repository validation failed:");
@@ -211,6 +236,7 @@ async function installGitSource(rawUrl, argv) {
         let manifest;
         try {
             manifest = await assertKitRepository(tmpBase);
+            await printKitValidationWarnings(tmpBase);
         }
         catch (error) {
             console.log("Flow Kit repository validation failed:");
@@ -321,6 +347,69 @@ function activate(argv) {
     console.log(JSON.stringify(result, null, 2));
     return Array.isArray(result.errors) && result.errors.length ? 1 : 0;
 }
+async function validate(argv) {
+    const args = parseArgs(argv);
+    const kitDir = path.resolve(args.positionals[0] ?? ".");
+    const diagnostics = await validateKitRepositoryDiagnostics(kitDir);
+    for (const warning of diagnostics.warnings)
+        console.log(`warning: ${warning}`);
+    if (diagnostics.errors.length) {
+        console.log("Flow Kit repository validation failed:");
+        for (const error of diagnostics.errors)
+            console.log(` - ${error}`);
+        return 1;
+    }
+    console.log(`Flow Kit repository validation passed: ${kitDir}`);
+    return 0;
+}
+async function provision(argv) {
+    const args = parseArgs(argv);
+    const source = args.positionals[0];
+    if (!source) {
+        console.error("provision: missing <kit-id-or-path> argument");
+        console.error("usage: flow-agents kit provision <kit-id-or-path> [--target <dir>] [--force] [--dry-run]");
+        return 2;
+    }
+    const dest = resolveDest(args.flags);
+    const kitDir = resolveProvisionKitSource(source, dest);
+    if (!kitDir) {
+        console.error(`provision: kit '${source}' was not found as a local path, installed kit, or catalog kit`);
+        return 1;
+    }
+    const target = path.resolve(flagString(args.flags, "target", process.cwd()) ?? process.cwd());
+    try {
+        const result = await provisionKit(kitDir, target, {
+            force: flagBool(args.flags, "force"),
+            dryRun: flagBool(args.flags, "dry-run"),
+        });
+        for (const file of result.files)
+            console.log(`${result.dry_run ? "would provision" : "provisioned"}: ${file.source} -> ${file.destination}`);
+        if (result.dry_run)
+            console.log(`dry-run: ${result.files.length} file(s) declared by kit '${result.kit_id}'; no files written`);
+        else if (result.files.length === 0)
+            console.log(`kit '${result.kit_id}' declares no provisions`);
+        else
+            console.log(`provisioned ${result.files.length} file(s) from kit '${result.kit_id}' into ${target}`);
+        return 0;
+    }
+    catch (error) {
+        if (error instanceof ProvisionConflictError) {
+            console.error(`provision: ${error.message}; rerun with --force to overwrite`);
+            for (const conflict of error.conflicts)
+                console.error(`conflict: ${conflict.target} (${conflict.destination})`);
+            return 1;
+        }
+        const diagnostics = error.diagnostics;
+        if (diagnostics?.length) {
+            console.error("Flow Kit repository validation failed:");
+            for (const diagnostic of diagnostics)
+                console.error(` - ${diagnostic}`);
+        }
+        else
+            console.error(`provision: ${error.message}`);
+        return 1;
+    }
+}
 /**
  * inspect <kit-dir> [--json]
  *
@@ -375,9 +464,13 @@ export async function main(argv = process.argv.slice(2)) {
         return status(rest);
     if (command === "activate")
         return activate(rest);
+    if (command === "validate")
+        return await validate(rest);
+    if (command === "provision")
+        return await provision(rest);
     if (command === "inspect")
         return await inspect(rest);
-    console.error("usage: flow-agents kit <install|activate|inspect|list|status> ...");
+    console.error("usage: flow-agents kit <install|activate|validate|provision|inspect|list|status> ...");
     return 2;
 }
 // Use process.exitCode (not process.exit) to allow stdout to be flushed before exit.

package/dist/codex/build/src/cli/pull-work-provider.js

@@ -804,7 +804,13 @@ export function main(argv = process.argv.slice(2)) {
         const freshness = revisionFreshness(item, freshnessInputs);
         return { ...item, dependency_impacts: dependencyImpacts(item, resolved), revision_freshness: freshness, readiness: applyFreshnessToReadiness(classify(item, settings, resolved), freshness) };
     });
-    console.log(JSON.stringify({ items }, null, 2));
+    // A configured BoardProvider is the canonical readiness source (docs/decisions/backlog-readiness-source.md).
+    // Reaching this issue-level listing path with a board configured is a bypass that must be loud, never silent.
+    const bypassedBoard = asRecord(asRecord(settings.board_provider)?.board);
+    const warnings = bypassedBoard
+        ? [{ code: "board_provider_bypassed", message: "A BoardProvider is configured but this pass used WorkItemProvider issue-level listing; board-driven selection is the canonical readiness source. Surface this bypass in the pull-work artifact instead of treating issue listing as a silent fallback." }]
+        : [];
+    console.log(JSON.stringify({ items, warnings }, null, 2));
     return 0;
 }
 // Use process.exitCode (not process.exit) to allow stdout to be flushed before exit.

package/dist/codex/build/src/cli/validate-workflow-artifacts.js

@@ -18,6 +18,7 @@ const sidecarSchemas = {
     "critique.json": "schemas/workflow-critique.schema.json",
     "release.json": "schemas/workflow-release.schema.json",
     "learning.json": "schemas/workflow-learning.schema.json",
+    "waves.json": "schemas/workflow-waves.schema.json",
 };
 // Runtime coordination records live below a session but are not workflow
 // sidecars. Recursing into them would validate continuation-driver/state.json
@@ -386,11 +387,63 @@ function validateSidecar(file) {
                 issues.push({ path: file, message: "deploy decision requires post_deploy_checks to be planned or pass" });
         }
     }
+    if (path.basename(file) === "waves.json") {
+        validateWaves(file, value, issues);
+    }
     if (path.basename(file) === "state.json" && value && typeof value === "object" && !Array.isArray(value) && !("branch" in value)) {
         warnings.push({ path: file, message: "state.json has no branch field (legacy/pre-#289 session) — re-run `ensure-session` to backfill agent/<actor>/<slug>." });
     }
     return { issues, warnings };
 }
+// #663 slice 1: wave-result reconciliation is machine-checkable, not prose. The schema
+// (schemas/workflow-waves.schema.json) validates the shape; these semantic checks enforce the
+// cross-record arithmetic the mini schema engine cannot express: exactly one terminal status
+// record per declared worker, no undeclared reporters, reconciliation counts that match the
+// records, and a `complete` claim that is impossible while any expected worker lacks a
+// worker-landed terminal status. Missing workers must be recorded explicitly as not_reported —
+// a reconciled wave never silently absorbs a dropped worker. Enforcement here is data-level
+// validation only; stop-hook refusal of wave completion is #663 part 3 (slice 2).
+function validateWaves(file, value, issues) {
+    const waves = Array.isArray(value?.waves) ? value.waves : [];
+    waves.forEach((wave, index) => {
+        const loc = `waves.json.waves[${index}]`;
+        const expected = Array.isArray(wave?.expected_workers) ? wave.expected_workers : [];
+        const results = Array.isArray(wave?.worker_results) ? wave.worker_results : [];
+        const expectedIds = expected.map((w) => w?.worker_id).filter((id) => typeof id === "string" && id.length > 0);
+        const expectedIdSet = new Set(expectedIds);
+        if (expectedIdSet.size !== expectedIds.length)
+            issues.push({ path: file, message: `${loc}.expected_workers must declare unique worker_id values` });
+        const resultIds = results.map((r) => r?.worker_id).filter((id) => typeof id === "string" && id.length > 0);
+        const seen = new Set();
+        for (const id of resultIds) {
+            if (seen.has(id))
+                issues.push({ path: file, message: `${loc}.worker_results has more than one terminal status record for worker ${id}; each worker lands exactly one` });
+            seen.add(id);
+            if (!expectedIdSet.has(id))
+                issues.push({ path: file, message: `${loc}.worker_results records worker ${id} that is not declared in expected_workers; declare every worker in the manifest before dispatch` });
+        }
+        const reconciliation = wave?.reconciliation;
+        if (!reconciliation || typeof reconciliation !== "object" || Array.isArray(reconciliation))
+            return;
+        const expectedCount = expectedIds.length;
+        const reportedIds = new Set(results.filter((r) => ["completed", "failed", "blocked"].includes(r?.status) && expectedIdSet.has(r?.worker_id)).map((r) => r.worker_id));
+        const reportedCount = reportedIds.size;
+        if (reconciliation.expected_count !== expectedCount)
+            issues.push({ path: file, message: `${loc}.reconciliation.expected_count is ${reconciliation.expected_count} but expected_workers declares ${expectedCount}` });
+        if (reconciliation.reported_count !== reportedCount)
+            issues.push({ path: file, message: `${loc}.reconciliation.reported_count is ${reconciliation.reported_count} but ${reportedCount} of ${expectedCount} expected workers have a worker-landed terminal status (completed|failed|blocked)` });
+        const missing = expectedIds.filter((id) => !results.some((r) => r?.worker_id === id));
+        for (const id of missing)
+            issues.push({ path: file, message: `${loc} is reconciled but worker ${id} has no terminal status record; record it explicitly as not_reported — never silently absorb a missing worker` });
+        const notReported = results.filter((r) => r?.status === "not_reported" && expectedIdSet.has(r?.worker_id));
+        if (reconciliation.status === "complete" && (missing.length > 0 || notReported.length > 0 || reportedCount !== expectedCount)) {
+            issues.push({ path: file, message: `${loc}.reconciliation.status complete requires every expected worker to have a worker-landed terminal status; got ${reportedCount} of ${expectedCount} reported` });
+        }
+        if (reconciliation.status === "incomplete" && missing.length === 0 && notReported.length === 0 && reportedCount === expectedCount) {
+            issues.push({ path: file, message: `${loc}.reconciliation.status incomplete contradicts the records: all ${expectedCount} expected workers reported` });
+        }
+    });
+}
 function validateLearningCorrections(file, status, records, issues) {
     records.forEach((record, index) => {
         const correction = record?.correction;

package/dist/codex/build/src/cli/workflow.js

@@ -733,7 +733,11 @@ function assertDistinctReviewActor(sessionDir, slug) {
     const assignment = readActiveAssignment(sessionDir, slug);
     const caller = resolveCurrentAssignmentActor();
     if (assignment.actor_key === caller.actorKey) {
-        throw new Error("workflow critique requires a reviewer identity distinct from the active implementation assignment actor");
+        throw new Error("workflow critique requires a reviewer identity distinct from the active implementation assignment actor. " +
+            "The reviewer identity is derived from the runtime actor, so an orchestrator that implemented and now reviews " +
+            "resolves to the same actor. To record an independent review, run the reviewer under a distinct actor: set " +
+            "FLOW_AGENTS_ACTOR=<reviewer-id> on the reviewing process, or run the reviewer in a separate runtime session " +
+            "(the runtime session id seeds the actor).");
     }
     return caller;
 }

package/dist/codex/build/src/flow-kit/provision.d.ts

@@ -0,0 +1,23 @@
+export type ProvisionedFile = {
+    id: string;
+    target: string;
+};
+export type ProvisionPlanEntry = ProvisionedFile & {
+    source: string;
+    destination: string;
+};
+export type ProvisionResult = {
+    kit_id: string;
+    kit_hash?: string;
+    files: ProvisionPlanEntry[];
+    manifest_path?: string;
+    dry_run: boolean;
+};
+export declare class ProvisionConflictError extends Error {
+    readonly conflicts: ProvisionPlanEntry[];
+    constructor(conflicts: ProvisionPlanEntry[]);
+}
+export declare function provisionKit(kitDir: string, targetDir: string, options?: {
+    force?: boolean;
+    dryRun?: boolean;
+}): Promise<ProvisionResult>;

package/dist/codex/build/src/flow-kit/provision.js

@@ -0,0 +1,99 @@
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { atomicCopyFile, atomicWriteJson, canonicalProspectivePath, walkFiles } from "../lib/fs.js";
+import { PROVISION_MANIFEST_DIR, assertKitRepository } from "./validate.js";
+export class ProvisionConflictError extends Error {
+    conflicts;
+    constructor(conflicts) {
+        super(`provisioning conflicts with ${conflicts.length} existing destination(s)`);
+        this.name = "ProvisionConflictError";
+        this.conflicts = conflicts;
+    }
+}
+function kitContentHash(kitDir) {
+    const hash = crypto.createHash("sha256");
+    for (const file of walkFiles(kitDir)) {
+        const rel = path.relative(kitDir, file).split(path.sep).join("/");
+        if (rel.split("/").some((part) => [".git", "__pycache__", ".pytest_cache"].includes(part)))
+            continue;
+        hash.update(rel);
+        hash.update("\0");
+        hash.update(fs.readFileSync(file));
+        hash.update("\0");
+    }
+    return `sha256:${hash.digest("hex")}`;
+}
+function isContained(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function assertSafeDestination(rootReal, destination) {
+    const prospective = canonicalProspectivePath(destination);
+    if (!isContained(rootReal, prospective))
+        throw new Error(`provision target escapes consumer repository: ${destination}`);
+    if (!fs.existsSync(destination))
+        return;
+    const stat = fs.lstatSync(destination);
+    if (stat.isSymbolicLink())
+        throw new Error(`refusing provision target symlink: ${destination}`);
+    if (!stat.isFile())
+        throw new Error(`provision target is not a regular file: ${destination}`);
+}
+function manifestProvisions(manifest) {
+    if (!Array.isArray(manifest.provisions))
+        return [];
+    return manifest.provisions.map((entry) => {
+        const record = entry;
+        return {
+            id: String(record.id),
+            path: String(record.path),
+            target: path.posix.normalize(String(record.target).replace(/\\/g, "/")),
+            ...(typeof record.description === "string" ? { description: record.description } : {}),
+        };
+    });
+}
+export async function provisionKit(kitDir, targetDir, options = {}) {
+    const kitRoot = fs.realpathSync(path.resolve(kitDir));
+    const targetPath = path.resolve(targetDir);
+    if (!fs.existsSync(targetPath) || !fs.statSync(targetPath).isDirectory()) {
+        throw new Error(`provision target must exist and be a directory: ${targetPath}`);
+    }
+    const targetRoot = fs.realpathSync(targetPath);
+    const manifest = await assertKitRepository(kitRoot);
+    const kitId = String(manifest.id);
+    const files = manifestProvisions(manifest).map((entry) => ({
+        id: entry.id,
+        target: entry.target,
+        source: path.resolve(kitRoot, entry.path),
+        destination: path.resolve(targetRoot, ...entry.target.split("/")),
+    }));
+    for (const file of files)
+        assertSafeDestination(targetRoot, file.destination);
+    // Defense in depth against a source swapped to a link after validation: re-assert the
+    // link-resolved source stays inside the kit before we read and copy its bytes.
+    for (const file of files) {
+        const realSource = fs.realpathSync(file.source);
+        if (realSource !== kitRoot && !realSource.startsWith(`${kitRoot}${path.sep}`)) {
+            throw new Error(`provision source escapes the kit directory: ${file.id}`);
+        }
+    }
+    const conflicts = options.force ? [] : files.filter((file) => fs.existsSync(file.destination));
+    if (conflicts.length)
+        throw new ProvisionConflictError(conflicts);
+    const kitHash = kitContentHash(kitRoot);
+    if (options.dryRun || files.length === 0)
+        return { kit_id: kitId, kit_hash: kitHash, files, dry_run: Boolean(options.dryRun) };
+    const manifestPath = path.join(targetRoot, ...PROVISION_MANIFEST_DIR.split("/"), `${kitId}.json`);
+    assertSafeDestination(targetRoot, manifestPath);
+    for (const file of files)
+        atomicCopyFile(targetRoot, file.source, file.destination);
+    atomicWriteJson(targetRoot, manifestPath, {
+        schema_version: "1.0",
+        kit_id: kitId,
+        kit_hash: kitHash,
+        provisioned_at: new Date().toISOString(),
+        files: files.map(({ id, target }) => ({ id, target })),
+    });
+    return { kit_id: kitId, kit_hash: kitHash, files, manifest_path: manifestPath, dry_run: false };
+}