agent-control-plane 0.1.0

package/tools/tests/test-agent-project-reconcile-pr-provider-quota-schedules-provider-cooldown.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+FLOW_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SCRIPT="${FLOW_ROOT}/tools/bin/agent-project-reconcile-pr-session"
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+shared_home="$tmpdir/shared-home"
+shared_bin="$shared_home/tools/bin"
+runs_root="$tmpdir/runs"
+history_root="$tmpdir/history"
+repo_root="$tmpdir/repo"
+bin_dir="$tmpdir/bin"
+hook_file="$tmpdir/hooks.sh"
+provider_log="$tmpdir/provider.log"
+retry_reason_file="$tmpdir/retry-reason.txt"
+failed_flag="$tmpdir/failed.flag"
+
+mkdir -p "$shared_bin" "$runs_root/fl-pr-88" "$history_root" "$repo_root" "$bin_dir"
+git -C "$repo_root" init -b main >/dev/null 2>&1
+
+cat >"$runs_root/fl-pr-88/run.env" <<'EOF'
+PR_NUMBER=88
+SESSION=fl-pr-88
+CODING_WORKER=claude
+CLAUDE_MODEL=sonnet
+WORKTREE=/tmp/mock-pr-worktree
+EOF
+
+cat >"$shared_bin/agent-project-worker-status" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+cat <<OUT
+STATUS=FAILED
+FAILURE_REASON=provider-quota-limit
+META_FILE=${runs_root}/fl-pr-88/run.env
+OUT
+EOF
+
+cat >"$shared_bin/agent-project-cleanup-session" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+exit 0
+EOF
+
+cat >"$shared_bin/provider-cooldown-state.sh" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+printf '%s\n' "\$*" >>"${provider_log}"
+printf 'READY=no\n'
+EOF
+
+cat >"$shared_bin/branch-verification-guard.sh" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+exit 0
+EOF
+
+cat >"$hook_file" <<EOF
+pr_schedule_retry() {
+  printf '%s\n' "\$1" >"${retry_reason_file}"
+}
+pr_after_failed() {
+  : >"${failed_flag}"
+}
+pr_after_reconciled() { :; }
+EOF
+
+cat >"$bin_dir/gh" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+if [[ "${1:-}" == "pr" && "${2:-}" == "view" ]]; then
+  printf '{"state":"OPEN","baseRefName":"main"}\n'
+  exit 0
+fi
+exit 0
+EOF
+
+chmod +x \
+  "$shared_bin/agent-project-worker-status" \
+  "$shared_bin/agent-project-cleanup-session" \
+  "$shared_bin/provider-cooldown-state.sh" \
+  "$shared_bin/branch-verification-guard.sh" \
+  "$bin_dir/gh"
+
+output="$(
+  PATH="$bin_dir:$PATH" \
+  SHARED_AGENT_HOME="$shared_home" \
+  bash "$SCRIPT" \
+    --session fl-pr-88 \
+    --repo-slug example/repo \
+    --repo-root "$repo_root" \
+    --runs-root "$runs_root" \
+    --history-root "$history_root" \
+    --hook-file "$hook_file"
+)"
+
+grep -q '^schedule provider-quota-limit$' "$provider_log"
+test "$(cat "$retry_reason_file")" = "provider-quota-limit"
+test -f "$failed_flag"
+grep -q '^STATUS=FAILED$' <<<"$output"
+grep -q '^FAILURE_REASON=provider-quota-limit$' <<<"$output"
+
+echo "pr reconcile provider cooldown scheduling test passed"

package/tools/tests/test-agent-project-reconcile-pr-session-initializes-shared-agent-home.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+shared_agent_home="$tmpdir/shared-agent-home"
+shared_bin="$shared_agent_home/tools/bin"
+shared_assets="$shared_agent_home/assets"
+runs_root="$tmpdir/runs"
+history_root="$tmpdir/history"
+repo_root="$tmpdir/repo-root"
+bin_dir="$tmpdir/bin"
+
+mkdir -p "$shared_bin" "$shared_assets" "$runs_root/fl-pr-999" "$history_root" "$repo_root" "$bin_dir"
+printf '{}\n' >"$shared_assets/workflow-catalog.json"
+
+cp tools/bin/agent-project-reconcile-pr-session "$shared_bin/agent-project-reconcile-pr-session"
+cp tools/bin/flow-shell-lib.sh "$shared_bin/flow-shell-lib.sh"
+cp tools/bin/flow-config-lib.sh "$shared_bin/flow-config-lib.sh"
+
+cat >"$shared_bin/agent-project-worker-status" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+printf 'SESSION=fl-pr-999\n'
+printf 'STATUS=RUNNING\n'
+printf 'META_FILE=%s\n' "$runs_root/fl-pr-999/run.env"
+EOF
+
+cat >"$bin_dir/gh" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "${1:-}" == "pr" && "${2:-}" == "view" ]]; then
+  printf '{"state":"OPEN","baseRefName":"main"}\n'
+  exit 0
+fi
+
+echo "unexpected gh invocation: $*" >&2
+exit 1
+EOF
+
+chmod +x \
+  "$shared_bin/agent-project-reconcile-pr-session" \
+  "$shared_bin/flow-shell-lib.sh" \
+  "$shared_bin/flow-config-lib.sh" \
+  "$shared_bin/agent-project-worker-status" \
+  "$bin_dir/gh"
+
+cat >"$runs_root/fl-pr-999/run.env" <<EOF
+PR_NUMBER=999
+WORKTREE=$tmpdir/pr-worktree
+EOF
+
+output="$(
+  AGENT_CONTROL_PLANE_ROOT="$shared_agent_home" \
+  PATH="$bin_dir:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin" \
+  bash "$shared_bin/agent-project-reconcile-pr-session" \
+    --session fl-pr-999 \
+    --repo-slug example/repo \
+    --repo-root "$repo_root" \
+    --runs-root "$runs_root" \
+    --history-root "$history_root"
+)"
+
+[[ "$output" == *"STATUS=RUNNING"* ]]

package/tools/tests/test-agent-project-reconcile-pr-updated-branch-noop.sh

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+FLOW_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+PR_RECONCILE_SRC="${FLOW_ROOT}/tools/bin/agent-project-reconcile-pr-session"
+FLOW_SHELL_LIB="${FLOW_ROOT}/tools/bin/flow-shell-lib.sh"
+FLOW_CONFIG_LIB="${FLOW_ROOT}/tools/bin/flow-config-lib.sh"
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+shared_agent_home="$tmpdir/shared-agent-home"
+shared_bin="$shared_agent_home/tools/bin"
+runs_root="$tmpdir/runs"
+history_root="$tmpdir/history"
+bin_dir="$tmpdir/bin"
+origin_repo="$tmpdir/origin.git"
+repo_root="$tmpdir/repo-root"
+pr_worktree="$tmpdir/pr-worktree"
+
+mkdir -p "$shared_bin" "$runs_root/fl-pr-200" "$history_root" "$bin_dir"
+
+cp "$PR_RECONCILE_SRC" "$shared_bin/agent-project-reconcile-pr-session"
+cp "$FLOW_SHELL_LIB" "$shared_bin/flow-shell-lib.sh"
+cp "$FLOW_CONFIG_LIB" "$shared_bin/flow-config-lib.sh"
+
+git init --bare "$origin_repo" >/dev/null 2>&1
+git clone "$origin_repo" "$repo_root" >/dev/null 2>&1
+printf 'hello\n' >"$repo_root/README.md"
+git -C "$repo_root" add README.md
+git -C "$repo_root" -c user.name=Test -c user.email=test@example.com commit -m "init" >/dev/null
+git -C "$repo_root" branch -M main >/dev/null 2>&1
+git -C "$repo_root" push origin main >/dev/null 2>&1
+git -C "$repo_root" checkout -b codex/pr-200-noop >/dev/null 2>&1
+git -C "$repo_root" push origin codex/pr-200-noop >/dev/null 2>&1
+
+git clone "$origin_repo" "$pr_worktree" >/dev/null 2>&1
+git -C "$pr_worktree" checkout codex/pr-200-noop >/dev/null 2>&1
+
+cat >"$shared_bin/agent-project-worker-status" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+printf 'SESSION=fl-pr-200\n'
+printf 'STATUS=SUCCEEDED\n'
+printf 'META_FILE=%s\n' "$runs_root/fl-pr-200/run.env"
+EOF
+
+cat >"$shared_bin/agent-project-cleanup-session" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+exit 0
+EOF
+
+cat >"$shared_bin/branch-verification-guard.sh" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+exit 0
+EOF
+
+cat >"$bin_dir/gh" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "${1:-}" == "pr" && "${2:-}" == "view" ]]; then
+  printf '{"state":"OPEN","baseRefName":"main"}\n'
+  exit 0
+fi
+
+echo "unexpected gh invocation: $*" >&2
+exit 1
+EOF
+
+chmod +x \
+  "$shared_bin/agent-project-reconcile-pr-session" \
+  "$shared_bin/flow-shell-lib.sh" \
+  "$shared_bin/flow-config-lib.sh" \
+  "$shared_bin/agent-project-worker-status" \
+  "$shared_bin/agent-project-cleanup-session" \
+  "$shared_bin/branch-verification-guard.sh" \
+  "$bin_dir/gh"
+
+cat >"$runs_root/fl-pr-200/run.env" <<EOF
+PR_NUMBER=200
+WORKTREE=$pr_worktree
+PR_HEAD_REF=codex/pr-200-noop
+EOF
+
+cat >"$runs_root/fl-pr-200/result.env" <<'EOF'
+OUTCOME=updated-branch
+ACTION=host-push-pr-branch
+EOF
+
+pr_reason_file="$tmpdir/pr-retry-reason.txt"
+pr_blocked_file="$tmpdir/pr-blocked.txt"
+pr_hook="$tmpdir/pr-hook.sh"
+
+cat >"$pr_hook" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+pr_schedule_retry() {
+  printf '%s\n' "\$1" >"$pr_reason_file"
+}
+pr_after_blocked() {
+  : >"$pr_blocked_file"
+}
+pr_after_reconciled() { :; }
+EOF
+
+chmod +x "$pr_hook"
+
+pr_out="$(
+  PATH="$bin_dir:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin" \
+  bash "$shared_bin/agent-project-reconcile-pr-session" \
+    --session fl-pr-200 \
+    --repo-slug example/repo \
+    --repo-root "$repo_root" \
+    --runs-root "$runs_root" \
+    --history-root "$history_root" \
+    --hook-file "$pr_hook"
+)"
+
+test "$(cat "$pr_reason_file")" = "updated-branch-no-commits-ahead"
+test -f "$pr_blocked_file"
+grep -q '^STATUS=SUCCEEDED$' <<<"$pr_out"
+grep -q '^OUTCOME=blocked$' <<<"$pr_out"
+grep -q '^ACTION=host-noop-updated-branch$' <<<"$pr_out"
+grep -q '^FAILURE_REASON=updated-branch-no-commits-ahead$' <<<"$pr_out"
+
+echo "agent-project reconcile PR updated-branch noop test passed"

package/tools/tests/test-audit-agent-worktrees-active-launch-skips-git-inspection.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+FLOW_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+AUDIT_SCRIPT="${FLOW_ROOT}/tools/bin/audit-agent-worktrees.sh"
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+repo_root="$tmpdir/repo"
+worktree_root="$tmpdir/worktrees"
+agent_root="$tmpdir/agent"
+shim_dir="$tmpdir/shim"
+
+mkdir -p "$repo_root" "$worktree_root" "$agent_root/runs" "$agent_root/state/pending-launches" "$shim_dir"
+repo_root="$(cd "$repo_root" && pwd -P)"
+worktree_root="$(cd "$worktree_root" && pwd -P)"
+agent_root="$(cd "$agent_root" && pwd -P)"
+shim_dir="$(cd "$shim_dir" && pwd -P)"
+
+git -C "$repo_root" init -b main >/dev/null 2>&1
+git -C "$repo_root" config user.name "Codex"
+git -C "$repo_root" config user.email "codex@example.com"
+printf 'root\n' >"$repo_root/README.md"
+git -C "$repo_root" add README.md
+git -C "$repo_root" commit -m "init" >/dev/null 2>&1
+
+worktree_path="$worktree_root/issue-360-active-launch-skip"
+git -C "$repo_root" worktree add -b "agent/alpha/issue-360-active-launch-skip" "$worktree_path" main >/dev/null 2>&1
+worktree_path="$(cd "$worktree_path" && pwd -P)"
+
+sleep 60 &
+pending_pid=$!
+printf '%s\n' "$pending_pid" >"$agent_root/state/pending-launches/issue-360.pid"
+
+cat >"$shim_dir/git" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+real_git="$(command -v git)"
+protected_worktree="${worktree_path}"
+
+if [[ "\${1:-}" == "-C" && "\${2:-}" == "\$protected_worktree" ]]; then
+  case "\${3:-}" in
+    rev-parse|status)
+      echo "unexpected git inspection for active-launch worktree" >&2
+      exit 99
+      ;;
+  esac
+fi
+
+exec "\$real_git" "\$@"
+EOF
+chmod +x "$shim_dir/git"
+
+output="$(
+  PATH="$shim_dir:$PATH" \
+  F_LOSNING_AGENT_REPO_ROOT="$repo_root" \
+  F_LOSNING_WORKTREE_ROOT="$worktree_root" \
+  F_LOSNING_AGENT_ROOT="$agent_root" \
+  bash "$AUDIT_SCRIPT" --cleanup
+)"
+
+kill "$pending_pid" >/dev/null 2>&1 || true
+wait "$pending_pid" 2>/dev/null || true
+
+grep -q '^LEGACY_AGENT_WORKTREE_COUNT=0$' <<<"$output"
+test -d "$worktree_path"
+
+echo "audit agent worktrees active-launch inspection skip test passed"

package/tools/tests/test-audit-agent-worktrees-broken-worktree.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+FLOW_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+AUDIT_SCRIPT="${FLOW_ROOT}/tools/bin/audit-agent-worktrees.sh"
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+repo_root="$tmpdir/repo"
+worktree_root="$tmpdir/worktrees"
+agent_root="$tmpdir/agent"
+
+mkdir -p "$repo_root" "$worktree_root" "$agent_root/runs"
+repo_root="$(cd "$repo_root" && pwd -P)"
+worktree_root="$(cd "$worktree_root" && pwd -P)"
+agent_root="$(cd "$agent_root" && pwd -P)"
+
+git -C "$repo_root" init -b main >/dev/null 2>&1
+git -C "$repo_root" config user.name "Codex"
+git -C "$repo_root" config user.email "codex@example.com"
+printf 'root\n' >"$repo_root/README.md"
+git -C "$repo_root" add README.md
+git -C "$repo_root" commit -m "init" >/dev/null 2>&1
+
+broken_branch="agent/alpha/issue-360-broken-test"
+broken_worktree="$worktree_root/issue-360-broken-test"
+git -C "$repo_root" worktree add -b "$broken_branch" "$broken_worktree" main >/dev/null 2>&1
+rm -f "$broken_worktree/.git"
+
+output="$(
+  F_LOSNING_AGENT_REPO_ROOT="$repo_root" \
+  F_LOSNING_WORKTREE_ROOT="$worktree_root" \
+  F_LOSNING_AGENT_ROOT="$agent_root" \
+  bash "$AUDIT_SCRIPT" --cleanup
+)"
+
+grep -q '^BROKEN_WORKTREE=yes$' <<<"$output"
+grep -q '^CLEANUP=removed$' <<<"$output"
+grep -q '^LEGACY_AGENT_WORKTREE_CLEANED=1$' <<<"$output"
+test ! -e "$broken_worktree"
+
+echo "audit agent worktrees broken-worktree cleanup test passed"

package/tools/tests/test-audit-agent-worktrees-pending-launch-owner.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+FLOW_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+AUDIT_SCRIPT="${FLOW_ROOT}/tools/bin/audit-agent-worktrees.sh"
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+repo_root="$tmpdir/repo"
+worktree_root="$tmpdir/worktrees"
+agent_root="$tmpdir/agent"
+
+mkdir -p "$repo_root" "$worktree_root" "$agent_root/runs" "$agent_root/state/pending-launches"
+repo_root="$(cd "$repo_root" && pwd -P)"
+worktree_root="$(cd "$worktree_root" && pwd -P)"
+agent_root="$(cd "$agent_root" && pwd -P)"
+
+git -C "$repo_root" init -b main >/dev/null 2>&1
+git -C "$repo_root" config user.name "Codex"
+git -C "$repo_root" config user.email "codex@example.com"
+printf 'root\n' >"$repo_root/README.md"
+git -C "$repo_root" add README.md
+git -C "$repo_root" commit -m "init" >/dev/null 2>&1
+
+worktree_path="$worktree_root/issue-360-pending-test"
+git -C "$repo_root" worktree add -b "agent/alpha/issue-360-pending-test" "$worktree_path" main >/dev/null 2>&1
+
+sleep 60 &
+pending_pid=$!
+printf '%s\n' "$pending_pid" >"$agent_root/state/pending-launches/issue-360.pid"
+
+output="$(
+  F_LOSNING_AGENT_REPO_ROOT="$repo_root" \
+  F_LOSNING_WORKTREE_ROOT="$worktree_root" \
+  F_LOSNING_AGENT_ROOT="$agent_root" \
+  bash "$AUDIT_SCRIPT" --cleanup
+)"
+
+kill "$pending_pid" >/dev/null 2>&1 || true
+wait "$pending_pid" 2>/dev/null || true
+
+grep -q '^LEGACY_AGENT_WORKTREE_COUNT=0$' <<<"$output"
+test -d "$worktree_path"
+
+echo "audit agent worktrees pending-launch owner test passed"

package/tools/tests/test-audit-agent-worktrees-unreconciled-owner.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+FLOW_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+AUDIT_SCRIPT="${FLOW_ROOT}/tools/bin/audit-agent-worktrees.sh"
+CONFIG_LIB="${FLOW_ROOT}/tools/bin/flow-config-lib.sh"
+SHELL_LIB="${FLOW_ROOT}/tools/bin/flow-shell-lib.sh"
+
+tmpdir="$(mktemp -d)"
+cleanup() {
+  rm -rf "$tmpdir"
+}
+trap cleanup EXIT
+
+repo_root="$tmpdir/repo"
+worktree_root="$tmpdir/worktrees"
+agent_root="$tmpdir/agent"
+bin_dir="$tmpdir/bin"
+
+mkdir -p "$repo_root" "$worktree_root" "$agent_root/runs/fl-issue-250" "$agent_root/state/pending-launches" "$bin_dir"
+repo_root="$(cd "$repo_root" && pwd -P)"
+worktree_root="$(cd "$worktree_root" && pwd -P)"
+agent_root="$(cd "$agent_root" && pwd -P)"
+bin_dir="$(cd "$bin_dir" && pwd -P)"
+
+git -C "$repo_root" init -b main >/dev/null 2>&1
+git -C "$repo_root" config user.name "Codex"
+git -C "$repo_root" config user.email "codex@example.com"
+printf 'root\n' >"$repo_root/README.md"
+git -C "$repo_root" add README.md
+git -C "$repo_root" commit -m "init" >/dev/null 2>&1
+
+worktree_path="$worktree_root/issue-250-unreconciled-owner"
+git -C "$repo_root" worktree add -b "agent/acp/issue-250-unreconciled-owner" "$worktree_path" main >/dev/null 2>&1
+worktree_path="$(cd "$worktree_path" && pwd -P)"
+
+cp "$AUDIT_SCRIPT" "$bin_dir/audit-agent-worktrees.sh"
+cp "$CONFIG_LIB" "$bin_dir/flow-config-lib.sh"
+cp "$SHELL_LIB" "$bin_dir/flow-shell-lib.sh"
+chmod +x "$bin_dir/audit-agent-worktrees.sh"
+chmod +x "$bin_dir/flow-config-lib.sh" "$bin_dir/flow-shell-lib.sh"
+
+cat >"$bin_dir/agent-project-worker-status" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+printf 'STATUS=SUCCEEDED\n'
+EOF
+chmod +x "$bin_dir/agent-project-worker-status"
+
+cat >"$bin_dir/agent-cleanup-worktree" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+echo "cleanup should not be called for unreconciled owner" >&2
+exit 99
+EOF
+chmod +x "$bin_dir/agent-cleanup-worktree"
+
+mkdir -p "$agent_root/runs/acp-issue-250"
+cat >"$agent_root/runs/acp-issue-250/run.env" <<EOF
+SESSION=acp-issue-250
+WORKTREE=$worktree_path
+BRANCH=agent/acp/issue-250-unreconciled-owner
+EOF
+
+output="$(
+  ACP_ISSUE_SESSION_PREFIX="acp-issue-" \
+  ACP_PR_SESSION_PREFIX="acp-pr-" \
+  ACP_ISSUE_BRANCH_PREFIX="agent/acp/issue" \
+  ACP_MANAGED_PR_BRANCH_GLOBS="agent/acp/* codex/* openclaw/*" \
+  F_LOSNING_AGENT_REPO_ROOT="$repo_root" \
+  F_LOSNING_WORKTREE_ROOT="$worktree_root" \
+  F_LOSNING_AGENT_ROOT="$agent_root" \
+  bash "$bin_dir/audit-agent-worktrees.sh" --cleanup
+)"
+
+grep -q '^LEGACY_AGENT_WORKTREE_COUNT=0$' <<<"$output"
+test -d "$worktree_path"
+
+echo "audit agent worktrees unreconciled owner test passed"

package/tools/tests/test-audit-issue-routing-managed-branch-globs.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+FLOW_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SCRIPT="${FLOW_ROOT}/bin/audit-issue-routing.sh"
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+bin_dir="$tmpdir/bin"
+mkdir -p "$bin_dir"
+
+cat >"$bin_dir/gh" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "${1:-}" == "pr" && "${2:-}" == "list" ]]; then
+  cat <<'JSON'
+[
+  {"headRefName":"agent/acp/issue-501-slice","body":"","labels":[],"comments":[]}
+]
+JSON
+  exit 0
+fi
+
+if [[ "${1:-}" == "issue" && "${2:-}" == "list" ]]; then
+  cat <<'JSON'
+[
+  {"number":501,"title":"linked issue","createdAt":"2026-03-15T10:00:00Z","updatedAt":"2026-03-15T10:15:00Z","labels":[{"name":"agent-running"}]},
+  {"number":502,"title":"stale running issue","createdAt":"2026-03-15T10:05:00Z","updatedAt":"2026-03-15T10:20:00Z","labels":[{"name":"agent-running"}]}
+]
+JSON
+  exit 0
+fi
+
+echo "unexpected gh args: $*" >&2
+exit 1
+EOF
+
+chmod +x "$bin_dir/gh"
+
+output="$(
+  PATH="$bin_dir:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin" \
+  F_LOSNING_REPO_SLUG="example/repo" \
+  ACP_MANAGED_PR_BRANCH_GLOBS="agent/acp/* codex/* openclaw/*" \
+  bash "$SCRIPT" 0
+)"
+
+grep -q $'^502\tstale-agent-running\t' <<<"$output"
+if grep -q $'^501\t' <<<"$output"; then
+  echo "issue linked by custom managed branch unexpectedly remained routable" >&2
+  printf '%s\n' "$output" >&2
+  exit 1
+fi
+
+echo "audit issue routing managed branch globs test passed"

package/tools/tests/test-branch-verification-guard-generated-artifacts.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+FLOW_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+GUARD_SCRIPT="${FLOW_ROOT}/tools/bin/branch-verification-guard.sh"
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+origin_repo="$tmpdir/origin.git"
+repo_root="$tmpdir/repo-root"
+run_dir="$tmpdir/run"
+
+mkdir -p "$run_dir"
+
+git init --bare "$origin_repo" >/dev/null 2>&1
+git clone "$origin_repo" "$repo_root" >/dev/null 2>&1
+mkdir -p "$repo_root/src"
+
+cat >"$repo_root/package.json" <<'EOF'
+{
+  "name": "guard-demo",
+  "private": true,
+  "scripts": {
+    "test": "node --test"
+  }
+}
+EOF
+
+cat >"$repo_root/src/index.js" <<'EOF'
+export const status = 'ready';
+EOF
+
+git -C "$repo_root" add .
+git -C "$repo_root" -c user.name=Test -c user.email=test@example.com commit -m "init" >/dev/null
+git -C "$repo_root" branch -M main >/dev/null 2>&1
+git -C "$repo_root" push origin main >/dev/null 2>&1
+
+git -C "$repo_root" checkout -b guard/generated-artifacts >/dev/null 2>&1
+
+cat >"$repo_root/src/index.js" <<'EOF'
+export const status = 'updated';
+EOF
+
+cat >"$repo_root/.agent-session.env" <<'EOF'
+export ACP_SESSION='demo-issue-1'
+EOF
+
+cat >"$repo_root/pnpm-lock.yaml" <<'EOF'
+lockfileVersion: '9.0'
+EOF
+
+cat >"$run_dir/verification.jsonl" <<'EOF'
+{"status":"pass","command":"npm test"}
+EOF
+
+set +e
+guard_output="$("$GUARD_SCRIPT" --worktree "$repo_root" --base-ref origin/main --run-dir "$run_dir" 2>&1)"
+guard_status=$?
+set -e
+
+test "$guard_status" = "43"
+grep -q 'generated agent/session artifacts were included in the branch diff' <<<"$guard_output"
+grep -q 'lockfile changes were introduced without dependency manifest changes' <<<"$guard_output"
+grep -q '.agent-session.env' <<<"$guard_output"
+grep -q 'pnpm-lock.yaml' <<<"$guard_output"
+
+rm -f "$repo_root/.agent-session.env" "$repo_root/pnpm-lock.yaml"
+
+"$GUARD_SCRIPT" --worktree "$repo_root" --base-ref origin/main --run-dir "$run_dir" >/dev/null
+
+echo "branch verification guard generated artifacts test passed"