@kontourai/flow-agents 4.0.0 → 4.2.0

package/evals/integration/test_liveness_console_relay.sh

@@ -18,6 +18,13 @@ source "$ROOT/evals/lib/node.sh"
 
 TMPDIR_EVAL="$(mktemp -d)"
 trap 'rm -rf "$TMPDIR_EVAL"; [[ -n "${STUB_PID:-}" ]] && kill "$STUB_PID" 2>/dev/null' EXIT
+
+# Hermetic HOME: the conf-driven relay resolver (#567) reads ~/.flow-agents/telemetry-console.conf
+# as a resolution slot. Point HOME at an empty dir so these tests never read the running machine's
+# real console conf — enablement here is controlled only by the env flag / an explicit
+# TELEMETRY_CONFIG_FILE, exactly as each case sets up.
+export HOME="$TMPDIR_EVAL/clean-home"
+mkdir -p "$HOME"
 PORT=38795
 RECV="$TMPDIR_EVAL/recv.jsonl"
 
@@ -29,6 +36,12 @@ fail() { echo "  [FAIL] $1"; errors=$((errors + 1)); }
 # controls the response — "ok" (200) or "fail" (500) — to exercise the relay-failure path.
 start_stub() {
   local mode="$1"
+  # Fresh port per stub: the relay POST is detached/async, so a late POST from a PRIOR "on" case
+  # could otherwise race into the next case's freshly-cleared RECV on a reused port and cause a
+  # spurious "a POST happened" failure in a "no POST" assertion. A new port each time sends any
+  # stray prior-case POST to a now-dead port (connection refused), never into this case's RECV.
+  PORT=$((PORT + 1))
+  ENDPOINT="http://127.0.0.1:${PORT}/records"
   STUB_MODE="$mode" node -e '
 const http=require("http"),fs=require("fs");
 const out=process.argv[1], mode=process.env.STUB_MODE||"ok";
@@ -67,7 +80,7 @@ echo "=== console liveness relay (#295) ==="
 echo "--- 1. relay on+configured: liveness emit mirrors to the Console with Bearer + tenant ---"
 : > "$RECV"; start_stub ok || { fail "stub server did not start"; }
 ROOT_A="$TMPDIR_EVAL/a"
-EVT1='{"type":"claim","subjectId":"relay-subj-1","actor":"claude-code:sessA:host","actor_key":"claude-code:sessA:host","at":"2026-07-05T00:00:00Z","ttlSeconds":1800,"host":"host","branch":"agent/a/relay-subj-1","artifact_dir":"relay-subj-1"}'
+EVT1='{"type":"claim","subjectId":"relay-subj-1","actor":"claude-code:sessA:host","actor_key":"claude-code:sessA:host","at":"2026-07-05T00:00:00Z","ttlSeconds":1800,"host":"host","branch":"agent/a/relay-subj-1","artifact_dir":"relay-subj-1","source":"tool-activity","activity":{"tool":"Bash"}}'
 (
   export FLOW_AGENTS_CONSOLE_LIVENESS_RELAY=1
   export FLOW_AGENTS_CONSOLE_LIVENESS_ENDPOINT_URL="$ENDPOINT"
@@ -92,6 +105,8 @@ const checks=[
   ["subjectId", b.subjectId==="relay-subj-1"],
   ["actor", b.actor==="claude-code:sessA:host"],
   ["branch", b.branch==="agent/a/relay-subj-1"],
+  ["source tool-activity", b.source==="tool-activity"],
+  ["activity.tool Bash (richer real-liveness rides to the Console)", !!b.activity && b.activity.tool==="Bash"],
 ];
 for(const [name,ok] of checks) console.log((ok?"OK ":"BAD ")+name);
 ' "$RECV" > "$TMPDIR_EVAL/checks.txt" 2>&1
@@ -156,6 +171,81 @@ console.log(hasRawCtl?"RAW":"ESCAPED");
 if grep -q ESCAPED "$TMPDIR_EVAL/inj.txt"; then pass "hostile actor/branch control bytes are JSON-escaped, never raw in the POST body (injection discipline)"; else fail "raw control bytes reached the POST body: $(cat "$TMPDIR_EVAL/inj.txt")"; fi
 stop_stub
 
+# ─── 6. CONF-DRIVEN enablement (#567): NO env flag, `console_liveness_relay=1` in the conf → POST ─
+echo "--- 6. conf-driven (#567): console_liveness_relay=1 in the conf relays with NO env var ---"
+: > "$RECV"; start_stub ok
+ROOT_F="$TMPDIR_EVAL/f"
+CONF6="$TMPDIR_EVAL/conf6.conf"
+printf 'console_telemetry_url=https://example.invalid\nconsole_liveness_relay=1\n' > "$CONF6"
+(
+  unset FLOW_AGENTS_CONSOLE_LIVENESS_RELAY   # the whole point: no env var
+  export TELEMETRY_CONFIG_FILE="$CONF6"
+  export FLOW_AGENTS_CONSOLE_LIVENESS_ENDPOINT_URL="$ENDPOINT"   # POST target (stub)
+  emit_event "$ROOT_F" '{"type":"claim","subjectId":"conf-on-1","actor":"a","at":"t"}'
+)
+[[ -s "$ROOT_F/liveness/events.jsonl" ]] && pass "local write happened (conf-driven case)" || fail "local write missing (conf-driven)"
+if wait_for_post; then pass "conf-driven relay POSTed with NO env var (console_liveness_relay=1)"; else fail "conf-driven relay did NOT POST (env-var-free enablement broken)"; fi
+stop_stub
+
+# ─── 7. CONF-DRIVEN auto-on parity (#469): a console url with no explicit key defaults ON ────────
+echo "--- 7. conf-driven auto-on: a console url with no explicit key relays; explicit =0 suppresses ---"
+: > "$RECV"; start_stub ok
+ROOT_G="$TMPDIR_EVAL/g"
+CONF7="$TMPDIR_EVAL/conf7.conf"
+printf 'console_telemetry_url=https://example.invalid\n' > "$CONF7"   # url only, no explicit key
+(
+  unset FLOW_AGENTS_CONSOLE_LIVENESS_RELAY
+  export TELEMETRY_CONFIG_FILE="$CONF7"
+  export FLOW_AGENTS_CONSOLE_LIVENESS_ENDPOINT_URL="$ENDPOINT"
+  emit_event "$ROOT_G" '{"type":"claim","subjectId":"auto-on-1","actor":"a","at":"t"}'
+)
+if wait_for_post; then pass "auto-on: a configured console url defaults the relay ON (#469 parity)"; else fail "auto-on did NOT POST (console-url default-on broken)"; fi
+stop_stub
+
+: > "$RECV"; start_stub ok
+ROOT_H="$TMPDIR_EVAL/h"
+CONF8="$TMPDIR_EVAL/conf8.conf"
+printf 'console_telemetry_url=https://example.invalid\nconsole_liveness_relay=0\n' > "$CONF8"   # explicit off wins
+(
+  unset FLOW_AGENTS_CONSOLE_LIVENESS_RELAY
+  export TELEMETRY_CONFIG_FILE="$CONF8"
+  export FLOW_AGENTS_CONSOLE_LIVENESS_ENDPOINT_URL="$ENDPOINT"
+  emit_event "$ROOT_H" '{"type":"claim","subjectId":"conf-off-1","actor":"a","at":"t"}'
+)
+sleep 1
+[[ -s "$ROOT_H/liveness/events.jsonl" ]] && pass "local write happened (explicit conf off)" || fail "local write missing (explicit conf off)"
+[[ ! -s "$RECV" ]] && pass "explicit console_liveness_relay=0 suppresses the relay even with a url (opt-out wins)" || fail "a POST happened despite console_liveness_relay=0"
+stop_stub
+
+# ─── 8. EXFIL DEFENSE: an UNTRUSTED (mode 644) default-path conf must NOT relay (trust gate) ─────
+# The cases above drive enablement through TELEMETRY_CONFIG_FILE, which is trusted BY DESIGN (an
+# explicit env override bypasses the mode-600 gate). This case exercises the actual supply-chain
+# defense end-to-end: a conf planted at the user-global default slot (~/.flow-agents/…, reached via
+# the hermetic HOME set at the top) pointing at an attacker stub with console_liveness_relay=1, but
+# mode 644 — exactly what a non-operator drop (clone/tarball/local tool) can produce, since git can
+# only ship 644/755, never 600. relay.sh re-sources config.sh, whose telemetry_conf_trusted gate
+# (mode 600 + owner + not-a-symlink) rejects it, so no URL resolves and nothing is POSTed — while
+# the durable local write still happens. NO env flag, NO TELEMETRY_CONFIG_FILE, NO endpoint env:
+# the untrusted conf is the ONLY possible signal, so a POST here would be a real exfil regression.
+echo "--- 8. exfil defense: an untrusted (mode 644) ~/.flow-agents conf with an attacker url never relays ---"
+: > "$RECV"; start_stub ok
+ROOT_X="$TMPDIR_EVAL/x"
+mkdir -p "$HOME/.flow-agents"
+UNTRUSTED_CONF="$HOME/.flow-agents/telemetry-console.conf"
+printf 'console_telemetry_url=http://127.0.0.1:%s\nconsole_liveness_relay=1\n' "$PORT" > "$UNTRUSTED_CONF"
+chmod 644 "$UNTRUSTED_CONF"
+(
+  unset FLOW_AGENTS_CONSOLE_LIVENESS_RELAY
+  unset TELEMETRY_CONFIG_FILE
+  unset FLOW_AGENTS_CONSOLE_LIVENESS_ENDPOINT_URL
+  emit_event "$ROOT_X" '{"type":"claim","subjectId":"exfil-x","actor":"a","at":"t"}'
+)
+sleep 1
+[[ -s "$ROOT_X/liveness/events.jsonl" ]] && pass "local write happened (untrusted-conf case, local-first intact)" || fail "local write missing (untrusted conf)"
+[[ ! -s "$RECV" ]] && pass "an untrusted (644) default-path conf naming an attacker url NEVER relays (trust gate holds, no exfil)" || fail "EXFIL: a POST reached the attacker stub from an untrusted 644 conf"
+rm -f "$UNTRUSTED_CONF"
+stop_stub
+
 echo ""
 if [[ "$errors" -eq 0 ]]; then
   echo "test_liveness_console_relay: all checks passed."

package/evals/integration/test_liveness_heartbeat.sh

@@ -704,6 +704,72 @@ else
   _fail "maybeEmitHeartbeat did not neutralize an orphan heartbeat as expected: $J1_OUT"
 fi
 
+# ─── K. Richer "real liveness": activity descriptor on the emitted heartbeat ────────────────
+echo "--- K. Activity enrichment (tool name on the pulse) ---"
+
+# call_heartbeat_activity <scratch_root> <env_json> <now_iso> <activity_json>
+# Like call_heartbeat, but passes an `activity` descriptor through opts so we can prove the emitted
+# heartbeat carries a sanitized activity field (the "what is this agent doing right now" signal).
+call_heartbeat_activity() {
+  local root="$1" env_json="$2" now="$3" activity_json="$4"
+  MODULE_ARG="$HEARTBEAT_MODULE" ROOT_ARG="$root" ENV_JSON_ARG="$env_json" NOW_ARG="$now" ACTIVITY_ARG="$activity_json" \
+    node - <<'NODE'
+const { maybeEmitHeartbeat } = require(process.env.MODULE_ARG);
+const env = JSON.parse(process.env.ENV_JSON_ARG);
+const opts = { cwd: process.env.ROOT_ARG, env, now: process.env.NOW_ARG, activity: JSON.parse(process.env.ACTIVITY_ARG) };
+process.stdout.write(JSON.stringify(maybeEmitHeartbeat(opts)));
+NODE
+}
+
+# K1: a clean tool name rides through onto the emitted heartbeat as activity.tool.
+K1_ROOT="$(new_scratch)"
+seed_claim "$K1_ROOT" "k1-subj" "agent-k1" "2026-06-25T12:00:00.000Z" 1800
+K1_RESULT="$(call_heartbeat_activity "$K1_ROOT" '{"FLOW_AGENTS_ACTOR":"agent-k1"}' "2026-06-25T12:01:00.000Z" '{"tool":"Bash"}')"
+K1_LINE="$(tail -n 1 "$(stream_file "$K1_ROOT")" 2>/dev/null)"
+if [[ "$K1_RESULT" == '{"emitted":true}' ]] \
+  && grep -q '"type":"heartbeat"' <<<"$K1_LINE" \
+  && grep -q '"activity":{"tool":"Bash"}' <<<"$K1_LINE"; then
+  _pass "the emitted heartbeat carries a sanitized activity.tool (what the agent is doing right now)"
+else
+  _fail "the heartbeat did not carry the expected activity.tool: result=$K1_RESULT line=$K1_LINE"
+fi
+
+# K2: an MCP-style tool name (double underscores + hyphens) survives sanitizeSegment intact.
+K2_ROOT="$(new_scratch)"
+seed_claim "$K2_ROOT" "k2-subj" "agent-k2" "2026-06-25T12:00:00.000Z" 1800
+call_heartbeat_activity "$K2_ROOT" '{"FLOW_AGENTS_ACTOR":"agent-k2"}' "2026-06-25T12:01:00.000Z" '{"tool":"mcp__claude-in-chrome__navigate"}' >/dev/null
+K2_LINE="$(tail -n 1 "$(stream_file "$K2_ROOT")" 2>/dev/null)"
+if grep -q '"activity":{"tool":"mcp__claude-in-chrome__navigate"}' <<<"$K2_LINE"; then
+  _pass "an MCP tool name (double underscores + hyphens) rides through the allowlist sanitizer intact"
+else
+  _fail "the MCP tool name was not preserved on the activity descriptor: line=$K2_LINE"
+fi
+
+# K3: a hostile tool name (control bytes / injection payload) is stripped to the allowlist charset —
+# never emitted raw into the append-only stream.
+K3_ROOT="$(new_scratch)"
+seed_claim "$K3_ROOT" "k3-subj" "agent-k3" "2026-06-25T12:00:00.000Z" 1800
+call_heartbeat_activity "$K3_ROOT" '{"FLOW_AGENTS_ACTOR":"agent-k3"}' "2026-06-25T12:01:00.000Z" '{"tool":"Ba\"sh\n{\"x\":1}"}' >/dev/null
+K3_LINE="$(tail -n 1 "$(stream_file "$K3_ROOT")" 2>/dev/null)"
+# The allowlist keeps only [A-Za-z0-9_.-], so the payload collapses to "Bashx1".
+if grep -q '"activity":{"tool":"Bashx1"}' <<<"$K3_LINE" && ! grep -q 'Ba"sh' <<<"$K3_LINE"; then
+  _pass "a hostile tool name is stripped to the allowlist charset, never emitted raw (injection discipline)"
+else
+  _fail "the hostile tool name was not sanitized as expected: line=$K3_LINE"
+fi
+
+# K4: no activity supplied → the heartbeat is a plain aliveness pulse with NO activity key (the field
+# is omitted, not emitted empty).
+K4_ROOT="$(new_scratch)"
+seed_claim "$K4_ROOT" "k4-subj" "agent-k4" "2026-06-25T12:00:00.000Z" 1800
+call_heartbeat "$K4_ROOT" '{"FLOW_AGENTS_ACTOR":"agent-k4"}' "2026-06-25T12:01:00.000Z" >/dev/null
+K4_LINE="$(tail -n 1 "$(stream_file "$K4_ROOT")" 2>/dev/null)"
+if grep -q '"type":"heartbeat"' <<<"$K4_LINE" && ! grep -q '"activity"' <<<"$K4_LINE"; then
+  _pass "with no activity supplied the heartbeat omits the activity field entirely (no empty-object noise)"
+else
+  _fail "the no-activity heartbeat unexpectedly carried an activity field: line=$K4_LINE"
+fi
+
 echo ""
 if [[ "$errors" -eq 0 ]]; then
   echo "Liveness heartbeat integration passed."

package/evals/integration/test_pull_work_provider.sh

@@ -131,6 +131,24 @@ node "$SCRIPT" \
 [[ "$(json_query "$TMPDIR_EVAL/unresolved.json" "items.11.dependency_impacts.0.impact_state")" == "unknown" ]] && pass "structured-only dependency impact state is unknown without resolved ref" || fail "structured-only dependency impact state is unknown without resolved ref"
 [[ "$(json_query "$TMPDIR_EVAL/unresolved.json" "items.11.readiness.classification")" == "blocked" ]] && pass "structured-only blocker blocks without prose parsing" || fail "structured-only blocker blocks without prose parsing"
 
+# Readiness Source Integrity (docs/decisions/backlog-readiness-source.md):
+# reaching the issue-listing path while a BoardProvider is configured is a
+# bypass of the canonical readiness source and must be loud, never silent.
+[[ "$(json_query "$TMPDIR_EVAL/normalized.json" "warnings.0.code")" == "board_provider_bypassed" ]] && pass "issue-listing path with configured board surfaces board_provider_bypassed" || fail "issue-listing path with configured board surfaces board_provider_bypassed"
+
+node -e '
+const fs = require("fs");
+const doc = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+const settings = doc.projects[0];
+delete settings.board_provider;
+fs.writeFileSync(process.argv[2], JSON.stringify(settings, null, 2));
+' "$SETTINGS" "$TMPDIR_EVAL/boardless-settings.json"
+node "$SCRIPT" \
+  --settings-json "$TMPDIR_EVAL/boardless-settings.json" \
+  --issues-json "$FIXTURE" \
+  > "$TMPDIR_EVAL/boardless.json"
+[[ "$(json_query "$TMPDIR_EVAL/boardless.json" "warnings.length")" == "0" ]] && pass "issue-listing path without a configured board emits no bypass warning" || fail "issue-listing path without a configured board emits no bypass warning"
+
 if [[ "$errors" -eq 0 ]]; then
   echo "Pull work provider checks passed"
 else

package/evals/integration/test_veritas_governance_kit.sh

@@ -133,6 +133,72 @@ echo "--- exemption-issuance: gate blocks without a verified approval, passes wi
 exemption_gate_case "$KIT/fixtures/exemption/approved.trust-bundle.json"     "exemption-positive" 0
 exemption_gate_case "$KIT/fixtures/exemption/not-approved.trust-bundle.json" "exemption-negative" 1
 
+# --- standards-authoring flow (Slice 2 PR3): registration, gate shape, gate cases ---
+# Agentless propose -> apply flow whose human-approval-gate blocks the `veritas init --apply`
+# write until a human-authored standards-authoring-approval claim is verified. The kit only
+# gates the sign-off; Veritas does the derivation and the write (no evaluation reimplemented).
+AUTHORING_FLOWDEF="$KIT/flows/standards-authoring.flow.json"
+if node -e "const f=require('$AUTHORING_FLOWDEF'); if(f.id!=='veritas-governance.standards-authoring') process.exit(1);" 2>/dev/null; then
+  pass "standards-authoring flow file has id veritas-governance.standards-authoring"
+else
+  fail "standards-authoring flow file missing or has unexpected id"
+fi
+if rg -q '"id": *"veritas-governance\.standards-authoring"' "$KIT/kit.json" && rg -q '"path": *"flows/standards-authoring\.flow\.json"' "$KIT/kit.json"; then
+  pass "standards-authoring flow is registered in kit.json flows[]"
+else
+  fail "standards-authoring flow is NOT registered in kit.json flows[]"
+fi
+if rg -q '"id": *"veritas-governance\.standards-authoring"' "$KIT/kit.json" && rg -q '"path": *"skills/standards-authoring/SKILL.md"' "$KIT/kit.json"; then
+  pass "standards-authoring skill is registered in kit.json skills[]"
+else
+  fail "standards-authoring skill is NOT registered in kit.json skills[]"
+fi
+# Agentless invariant: the kit declares no flow_step_actions (would opt into Builder's
+# producer-ownership contract and break the agentless gate flows).
+if rg -q 'flow_step_actions' "$KIT/kit.json"; then
+  fail "kit.json declares flow_step_actions — veritas-governance flows are agentless"
+else
+  pass "kit stays agentless (no flow_step_actions)"
+fi
+if node -e "
+const f=require('$AUTHORING_FLOWDEF');
+const g=f.gates['human-approval-gate'];
+const bc=g.expects[0].bundle_claim;
+if (g.expects[0].kind!=='trust.bundle') process.exit(1);
+if (bc.claimType!=='standards-authoring-approval') process.exit(1);
+if (bc.subjectType!=='repo-governance-change') process.exit(1);
+if (JSON.stringify(bc.accepted_statuses)!=='[\"verified\"]') process.exit(1);
+" 2>/dev/null; then
+  pass "standards-authoring gate expects[] kind is trust.bundle and pins claimType/subjectType/accepted_statuses exactly"
+else
+  fail "standards-authoring gate expects[] shape does not match the pinned claim selector"
+fi
+# Positive/negative gate cases against the committed fixtures. $1 bundle, $2 label, $3 expect.
+authoring_gate_case() {
+  local bundle="$1" label="$2" expect="$3"
+  local work="$TMP_DIR/$label"; mkdir -p "$work"; ( cd "$work" && node "$FLOW_CLI" init >/dev/null 2>&1 )
+  ( cd "$work" && node "$FLOW_CLI" start "$AUTHORING_FLOWDEF" --run-id "$label" >/dev/null 2>&1 )
+  ( cd "$work" && node "$FLOW_CLI" attach-evidence "$label" --gate human-approval-gate --file "$bundle" --bundle >"$work/attach.out" 2>&1 )
+  if ! rg -q 'kind: trust.bundle' "$work/attach.out"; then
+    fail "[$label] evidence did not attach as kind: trust.bundle"; sed -n '1,20p' "$work/attach.out"; return
+  fi
+  ( cd "$work" && node "$FLOW_CLI" evaluate "$label" --gate human-approval-gate --exit-code >"$work/eval.out" 2>&1 )
+  local got=$?
+  if [[ "$got" == "$expect" ]]; then
+    pass "[$label] standards-authoring gate evaluate exit $got as expected"
+  else
+    fail "[$label] standards-authoring gate evaluate exit $got, expected $expect"; sed -n '1,20p' "$work/eval.out"
+  fi
+}
+authoring_gate_case "$KIT/fixtures/standards-authoring/approved.trust-bundle.json"     "authoring-positive" 0
+authoring_gate_case "$KIT/fixtures/standards-authoring/not-approved.trust-bundle.json" "authoring-negative" 1
+# No-fork: the authoring skill wraps the veritas CLI; it must not vendor rule/claim evaluation.
+if rg -q -i 'evaluateRepoStandards|evidence-check-runner\.mjs|class +[A-Za-z]*RuleEngine|repo-standards/default\.repo-standards\.json' "$KIT/skills/standards-authoring" "$KIT/flows/standards-authoring.flow.json" 2>/dev/null; then
+  fail "standards-authoring skill/flow appears to vendor Veritas evaluation logic (no-fork violated)"
+else
+  pass "no-fork: standards-authoring wraps the veritas CLI, no vendored rule/claim engine"
+fi
+
 # --- exemption-issuance: issue-step DECLARED append semantics (AC4) --------------
 # Seed a scratch delivery/DECLARED with main's real 2-entry array (inlined here, not read
 # live from the repo, so this eval is not coupled to that file's future contents), then
@@ -364,6 +430,196 @@ else
   echo "  - SKIP live Veritas leg (set VERITAS_BIN + VERITAS_GOVERNED_REPO to enable); fixtures are captured real output"
 fi
 
+# --- Starter-standards provisioning (Slice 2 PR2): the kit scaffolds a runnable .veritas/ ---
+# The kit declares its starter Repo Standards as provisions[]; `kit provision` copies them into
+# a consumer repo. This asserts the scaffold lands and is well-formed; when a Veritas binary is
+# available it further asserts `veritas readiness` runs end-to-end against the scaffolded repo.
+echo "--- starter-standards provisioning ---"
+FA_CLI="$ROOT/build/src/cli.js"
+if [[ ! -f "$FA_CLI" ]]; then
+  fail "flow-agents CLI not built at build/src/cli.js (run npm run build)"
+else
+  prov="$TMP_DIR/provisioned-repo"; mkdir -p "$prov"
+  if node "$FA_CLI" kit provision "$KIT" --target "$prov" >"$TMP_DIR/provision.out" 2>&1; then
+    pass "kit provision scaffolds starter standards into a consumer repo"
+  else
+    fail "kit provision failed"; sed -n '1,20p' "$TMP_DIR/provision.out"
+  fi
+  # Every declared provision target must land and (for JSON) parse.
+  starter_targets=(
+    ".veritas/repo-map.json"
+    ".veritas/repo-standards/default.repo-standards.json"
+    ".veritas/authority/default.authority-settings.json"
+    ".veritas/GOVERNANCE.md"
+    ".veritas/README.md"
+    "veritas.claims.json"
+  )
+  for rel in "${starter_targets[@]}"; do
+    if [[ -f "$prov/$rel" ]]; then
+      if [[ "$rel" == *.json ]]; then
+        if node -e "JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'))" "$prov/$rel" >/dev/null 2>&1; then
+          pass "scaffolded $rel is present and valid JSON"
+        else
+          fail "scaffolded $rel is not valid JSON"
+        fi
+      else
+        pass "scaffolded $rel is present"
+      fi
+    else
+      fail "expected scaffolded file missing: $rel"
+    fi
+  done
+  # The scaffold must reference the Veritas engine's OWN starter output, not reimplement it:
+  # every provision source lives under assets/, never in adapter/ or flows/ (no-fork already
+  # scopes there). Assert the declared sources exist inside the kit's assets tree.
+  if node -e "
+    const fs=require('fs'),path=require('path');
+    const kit=JSON.parse(fs.readFileSync(process.argv[1]+'/kit.json','utf8'));
+    const bad=(kit.provisions||[]).filter(p=>!p.path.startsWith('assets/')||!fs.existsSync(path.join(process.argv[1],p.path)));
+    if(bad.length){console.error('bad provisions:',bad.map(p=>p.id).join(','));process.exit(1)}
+  " "$KIT" >/dev/null 2>&1; then
+    pass "all starter provisions source from the kit's assets/ tree"
+  else
+    fail "a starter provision points outside assets/ or at a missing file"
+  fi
+  # Live: a Veritas binary must be able to run readiness against the scaffolded repo.
+  VBIN2="${VERITAS_BIN:-veritas}"
+  if command -v "$VBIN2" >/dev/null 2>&1 || [[ -x "$VBIN2" ]]; then
+    ( cd "$prov" && git init -q && printf '{"name":"scaffold-eval","scripts":{"test":"node -e \"process.exit(0)\""}}\n' > package.json \
+        && git add -A && git -c user.email=eval@local -c user.name=eval commit -qm scaffold ) >/dev/null 2>&1
+    if ( cd "$prov" && "$VBIN2" readiness --working-tree >/dev/null 2>&1 ); then :; fi
+    if ls "$prov/.kontourai/veritas/evidence/"*.json >/dev/null 2>&1; then
+      pass "veritas readiness runs end-to-end on the kit-scaffolded repo (evidence report produced)"
+    else
+      fail "veritas readiness produced no evidence report on the scaffolded repo"
+    fi
+  else
+    echo "  - SKIP scaffold readiness leg (no Veritas binary; set VERITAS_BIN to enable)"
+  fi
+fi
+
+# --- Governance git-hook provisioning (Slice 3 PR / #648) --------------------------
+# The kit ships the two governance git hooks as provisions[]; `kit provision` lands them
+# (non-executable), and a documented chmod + core.hooksPath step activates them. This asserts
+# the hook files land with the expected bodies and that, once activated, the pre-push hook fires.
+echo "--- governance git-hook provisioning ---"
+FA_CLI2="$ROOT/build/src/cli.js"
+if [[ ! -f "$FA_CLI2" ]]; then
+  fail "flow-agents CLI not built at build/src/cli.js (run npm run build)"
+else
+  hookrepo="$TMP_DIR/hook-provisioned-repo"; mkdir -p "$hookrepo"
+  ( cd "$hookrepo" && git init -q && printf '{"name":"hook-eval","scripts":{"prepush":"echo PREPUSH-RAN"}}\n' > package.json )
+  if node "$FA_CLI2" kit provision "$KIT" --target "$hookrepo" >"$TMP_DIR/hookprov.out" 2>&1; then
+    pass "kit provision lands the governance git hooks"
+  else
+    fail "kit provision (hooks) failed"; sed -n '1,20p' "$TMP_DIR/hookprov.out"
+  fi
+  # Both hook files present, match the committed kit assets byte-for-byte, AND carry their
+  # defining command. The byte-match alone cannot catch a corrupted kit asset (a bad asset is
+  # copied verbatim and still matches itself), so a content assertion pins what each hook must do.
+  declare -A hook_must_contain=(
+    [pre-push]='npm run --if-present prepush'
+    [post-commit]='veritas readiness --changed-from HEAD~1 --changed-to HEAD'
+  )
+  for hook in pre-push post-commit; do
+    if [[ -f "$hookrepo/.githooks/$hook" ]]; then
+      if cmp -s "$hookrepo/.githooks/$hook" "$KIT/assets/starter-hooks/githooks/$hook"; then
+        pass "scaffolded .githooks/$hook matches the kit asset byte-for-byte"
+      else
+        fail "scaffolded .githooks/$hook differs from the kit asset"
+      fi
+      if grep -qF "${hook_must_contain[$hook]}" "$hookrepo/.githooks/$hook"; then
+        pass "scaffolded .githooks/$hook invokes its defining command (${hook_must_contain[$hook]})"
+      else
+        fail "scaffolded .githooks/$hook is missing its defining command (${hook_must_contain[$hook]}) — corrupted asset?"
+      fi
+    else
+      fail "expected git hook missing: .githooks/$hook"
+    fi
+  done
+  # Provisions land non-executable by design (the engine copy is agent-blind) — assert for BOTH.
+  for hook in pre-push post-commit; do
+    if [[ -x "$hookrepo/.githooks/$hook" ]]; then
+      fail "provisioned .githooks/$hook is already executable — provisioning should be agent-blind (no +x)"
+    else
+      pass "provisioned .githooks/$hook lands non-executable (agent-blind copy; activation is explicit)"
+    fi
+  done
+  ( cd "$hookrepo" && chmod +x .githooks/pre-push .githooks/post-commit && git config core.hooksPath .githooks )
+  if [[ "$(cd "$hookrepo" && git config --get core.hooksPath)" == ".githooks" ]]; then
+    pass "activation sets core.hooksPath to .githooks"
+  else
+    fail "activation did not set core.hooksPath"
+  fi
+  # Prove GIT actually dispatches the hook via core.hooksPath — not just direct invocation. Push
+  # to a local bare remote; the pre-push hook (runs `npm run --if-present prepush`) fires through
+  # git's own hook machinery. Output captured to a file so pipefail + git's SIGPIPE can't interfere.
+  ( cd "$hookrepo" && git -c user.email=eval@local -c user.name=eval commit -qm base --allow-empty ) >/dev/null 2>&1
+  bare="$TMP_DIR/hook-remote.git"; git init --bare -q "$bare"
+  ( cd "$hookrepo" && git remote add origin "$bare" && git push -q origin HEAD:refs/heads/main ) >"$TMP_DIR/gitpush.out" 2>&1
+  if grep -qF PREPUSH-RAN "$TMP_DIR/gitpush.out"; then
+    pass "git dispatches the pre-push hook via core.hooksPath (real git push fires it)"
+  else
+    fail "git push did not fire the pre-push hook via core.hooksPath"; sed -n '1,12p' "$TMP_DIR/gitpush.out"
+  fi
+  # No-fork: hook assets live under assets/, and invoke the veritas CLI — they must not vendor
+  # rule/claim evaluation. (assets/ is outside the adapter/flows no-fork scope; assert explicitly.)
+  if rg -q -i 'evaluateRepoStandards|evidence-check-runner\.mjs|class +[A-Za-z]*RuleEngine' "$KIT/assets/starter-hooks" 2>/dev/null; then
+    fail "governance hook assets appear to vendor Veritas evaluation logic (no-fork violated)"
+  else
+    pass "no-fork: governance hooks invoke the veritas CLI only (no vendored rule/claim engine)"
+  fi
+fi
+
+# --- consult-standards skill (Slice 4 / #649): JIT guidance via `veritas explain` ---------
+# A pull-based advisory skill telling an agent to run `veritas explain --file <path>` before
+# editing. No MCP server; wraps the veritas CLI, reimplements no evaluation.
+echo "--- consult-standards skill ---"
+CONSULT_SKILL="$KIT/skills/consult-standards/SKILL.md"
+if [[ -f "$CONSULT_SKILL" ]]; then
+  pass "consult-standards SKILL.md is present"
+else
+  fail "consult-standards SKILL.md is missing"
+fi
+if rg -q '"id": *"veritas-governance\.consult-standards"' "$KIT/kit.json" && rg -q '"path": *"skills/consult-standards/SKILL.md"' "$KIT/kit.json"; then
+  pass "consult-standards skill is registered in kit.json skills[]"
+else
+  fail "consult-standards skill is NOT registered in kit.json skills[]"
+fi
+# It must point agents at `veritas explain` (the JIT producer), not vendor evaluation.
+if grep -qF 'veritas explain' "$CONSULT_SKILL"; then
+  pass "consult-standards points at the veritas explain CLI"
+else
+  fail "consult-standards does not reference veritas explain"
+fi
+if rg -q -i 'evaluateRepoStandards|evidence-check-runner\.mjs|class +[A-Za-z]*RuleEngine' "$KIT/skills/consult-standards" 2>/dev/null; then
+  fail "consult-standards appears to vendor Veritas evaluation logic (no-fork violated)"
+else
+  pass "no-fork: consult-standards wraps the veritas CLI, no vendored rule/claim engine"
+fi
+# No-MCP invariant (#649 / ADR 0011): the kit ships no MCP server CODE and declares no MCP
+# dependency. Scoped to non-markdown files so the docs' explicit "no MCP server" prose (which
+# names the concept precisely to say the kit avoids it) does not trip the check.
+if rg -q -i 'modelcontextprotocol|new +McpServer|StdioServerTransport|createMcpServer' "$KIT" --glob '!*.md' 2>/dev/null; then
+  fail "kit ships MCP server code/dependency — #649 guidance is a skill, not an MCP server (ADR 0011)"
+else
+  pass "no MCP server: JIT guidance is an agent-pull skill (ADR 0011)"
+fi
+# Live leg: with a Veritas binary, a scaffolded repo's `veritas explain --file` produces JIT context.
+VBIN3="${VERITAS_BIN:-veritas}"
+if command -v "$VBIN3" >/dev/null 2>&1 || [[ -x "$VBIN3" ]]; then
+  cs="$TMP_DIR/consult-repo"; mkdir -p "$cs"
+  ( cd "$cs" && git init -q && printf '{"name":"consult-eval","scripts":{"test":"node -e \\"process.exit(0)\\""}}\n' > package.json && "$VBIN3" init >/dev/null 2>&1 )
+  explain_out="$( cd "$cs" && "$VBIN3" explain --file package.json 2>&1 )"
+  if printf '%s' "$explain_out" | grep -qF 'Veritas JIT Context'; then
+    pass "veritas explain --file produces JIT context on a governed repo (the guidance the skill invokes)"
+  else
+    fail "veritas explain --file did not produce JIT context"; printf '%s\n' "$explain_out" | sed -n '1,8p'
+  fi
+else
+  echo "  - SKIP consult-standards live leg (no Veritas binary; set VERITAS_BIN to enable)"
+fi
+
 echo ""
 if [[ "$errors" -eq 0 ]]; then
   echo "PASS: veritas-governance kit gate demo (positive passes, negative blocks)"