Flow Agents delivery bundle

Provenance

Committed by the Flow Agents delivery pipeline and tracked in-repo since PR #269; this copy is taken verbatim from origin/main at the pinned commit.

Repository

kontourai/flow-agents

Source path

delivery/trust.bundle

Pinned commit

fe41e3cfbf465a2e186af39d235c7b746b3aee05

Bundle source

flow-agents/workflow-sidecar;statusFunctionVersion=2

Claims

What was gated, and how it landed

Each row is a claim the pipeline recorded — its type, the facet it belongs to, the field or behavior it covers, its recorded value, and the trust status the kernel derived. Read straight from the downloadable artifact.

Evidence

What supports the claims

• attestation attestation

  NON-command-backed summary (ADR 0020 rule: bare `npm run build --silent` is not itself a manifest entry, so it is not recorded as command-backed test_output; it is subsumed by the manifest-matched `source-tree-validation` check below, whose own script runs build first). `npm run build --silent`, this session: exit 0, c…

  kontourai-flow-agents-290/evidence.json

• validation test_output

  Manifest-matched (source-tree-validation). `npm run validate:source --` exits 0; this script's own package.json definition runs `npm run build --silent` first, so a clean run also confirms the CLI modules compile and are correctly registered/mirrored per validate-source-tree.ts's CLI-registration rules.

  kontourai-flow-agents-290/evidence.json

• validation test_output

  Manifest-matched (context-map-drift). `npm run context-map -- --check` exits 0 with 'docs/context-map.md is current.' -- confirms AC10's context-map regeneration is committed and non-drifted.

  kontourai-flow-agents-290/evidence.json

• validation test_output

  Manifest-matched (static-eval-suite). Full static suite exits 0, no failures (35/35 TS unit tests pass; all other static assertion blocks pass). Runs `npm run build` as a prerequisite, so a clean run confirms the whole TypeScript project (including the F1-F5 fix set) compiles.

  kontourai-flow-agents-290/evidence.json

• validation test_output

  Manifest-matched (assignment-provider-local-file-integration). Re-verify iteration-1: all 34/34 assertions pass (up from 30 pre-fix), including three NEW genuine OS-process concurrency-race assertions (F1 fix-plan): two real, simultaneously-launched claim processes for the same subject/different actors, asserting exact…

  kontourai-flow-agents-290/evidence.json

• validation test_output

  Manifest-matched (assignment-provider-github-integration). Re-verify iteration-1: all 45/45 assertions pass (up from 42 pre-fix), including NEW F2 (hostile branch/artifact_dir/actor.human payload with newline+ANSI+[SYSTEM] text is control-char-stripped in status output, both raw and JSON-escaped ANSI forms absent, effe…

  kontourai-flow-agents-290/evidence.json

• validation test_output

  Manifest-matched (pull-work-assignment-join-integration). Re-verify iteration-1: unaffected by F1-F5, still 10/10 assertions pass. Two-actor simulation: subject is free before either session claims; session A claims it; session B's subsequent status/join check reports held (never free); session B selects and claims a d…

  kontourai-flow-agents-290/evidence.json

• validation test_output

  Manifest-matched (pull-work-liveness-preflight-integration). Re-verify iteration-1: 68/68 assertions pass (up from 65 pre-fix), including NEW F5 wording-correction assertions: pull-work now scopes true mutual exclusion to the local-file provider only (via #290's lock), does NOT overclaim true mutual exclusion for the G…

  kontourai-flow-agents-290/evidence.json

• validation test_output

  Manifest-matched (pull-work-provider-integration). Re-verify iteration-1: unaffected by F1-F5, still 69/69 assertions pass -- regression check confirming this issue's changes to pull-work/SKILL.md and the provider CLI did not disturb the existing WorkItemProvider fixture-based eval.

  kontourai-flow-agents-290/evidence.json

• corroboration attestation

  SESSION-LOCAL (no command; not a manifest entry). Independent source-tree grep, re-run this session: `execFileSync|spawnSync|spawn\(|exec\(` naming `gh` anywhere under src/ -> zero hits outside a single explanatory code comment in assignment-provider.ts. Confirms AC9 at the source level, independent of the evals' own s…

  kontourai-flow-agents-290/evidence.json

• auditability policy_rule

  SESSION-LOCAL (kind=policy is non-reconcilable regardless of command presence per ADR 0020's classification table; deliberately recorded without a `command` field since the exact command run this session -- `bash evals/integration/test_trust_reconcile_manifest.sh` -- is a narrower slice of the actual manifest entry 'an…

  kontourai-flow-agents-290/evidence.json

• corroboration attestation

  SESSION-LOCAL (no command; independent of the checked-in eval's own single-iteration race assertion). Re-ran the EXACT 40-iteration concurrent OS-process race script (race40.sh) originally used to reproduce the pre-fix defect (14/15 double-wins, corroborating the code-review subagent's own 29/40 reproduction). Methodol…

  kontourai-flow-agents-290/evidence.json

• corroboration attestation

  SESSION-LOCAL (no command; independent of the checked-in eval's own hostile fixture). Built a DISTINCT hostile fixture from the eval's own (different marker text, different control bytes: CR + BEL + a distinct ANSI CSI sequence + a '[SYSTEM] ignore prior instructions' trailer) via a forged claim-marker GitHub issue com…

  kontourai-flow-agents-290/evidence.json

• extraction source_excerpt

  Re-verify iteration-1: re-read context/contracts/assignment-provider-contract.md; unchanged in substance from the prior verification pass other than F4's additive argv-array-execution note. Cross-check against docs/adr/0021-assignment-leases-and-stale-claim-takeover.md sections 1-2/4/6 still holds, no paraphrase drift.

  kontourai-flow-agents-290/evidence.json

• extraction source_excerpt

  Re-verify iteration-1: schemas/assignment-provider-settings.schema.json is unchanged by the F1-F5 fix set (confirmed via diff-scope: the fix touches only src/cli/assignment-provider.ts, kits/builder/skills/pull-work/SKILL.md, context/contracts/assignment-provider-contract.md, and eval scripts). Prior independent ajv va…

  kontourai-flow-agents-290/evidence.json

• extraction source_excerpt

  Re-read the diff of kits/builder/skills/pull-work/SKILL.md's F4/F5 changes: an explicit argv-array (never shell-string interpolation) execution note added to the Assignment Claim On Selection section (F4), and the mutual-exclusion claim corrected to scope 'true mutual exclusion' to the local-file provider only via #290…

  kontourai-flow-agents-290/evidence.json

• extraction source_excerpt

  docs/context-map.md drift-checked clean via the command-backed context-map-drift check above. docs/workflow-usage-guide.md's 'Assignment ownership: the third provider leg' subsection re-read, unchanged in substance.

  kontourai-flow-agents-290/evidence.json

• auditability policy_rule

  User outcome now fully met: a selected GitHub issue carries a durable, human-visible ownership record; the same operations work against a local-file record for tracker-less repos/evals with GENUINE mutual exclusion (F1, independently re-confirmed 40/40); human assignees are never silently reclaimed; untrusted GitHub cl…

  kontourai-flow-agents-290/evidence.json

• attestation attestation

  ACCEPTED GAP, waived. This check's underlying record-evidence call carried this check's waiver via the PER-CHECK `_waiver` JSON payload (ADR 0020 rule: a waiver cannot ride the global --accepted-gap-reason/--waived-by flags when the same record-evidence call also includes command-backed checks -- this call includes 8).…

  kontourai-flow-agents-290/evidence.json

Open questions

Gaps this receipt does not hide

• unsupported ACCEPTED GAP, waived. This check's underlying record-evidence call carried this check's waiver via the PER-CHECK `_waiver` JSON payload (ADR 0020 rule: a waiver cannot ride the global --accepted-gap-reason/--waived-by flags when the same record-evidence call also includes command-backed checks -- this call includes 8). The per-check waiver is stamped on this claim's metadata in trust.bundle (status: assumed) and is not duplicated here since this schema does not carry a `_waiver` property; see trust.bundle claim workflow.check.runtime / 'pre-existing-unrelated-eval-failures' for the canonical waiver record (reason: three pre-existing eval failures unrelated to #290's scope, confirmed via diff-scope; approved_by: re-verification session, independent diff-scope confirmation per the task brief's own PRE-EXISTING framing; approved_at: 2026-07-03T18:14:59Z). Three eval scripts (test_goal_fit_hook.sh: 1 failing assertion 'goal-fit hook should not block by default'; test_goal_fit_escape_hatch.sh: 5 failing assertions; test_session_resume_roundtrip.sh: 13 failing assertions) fail in this working tree, independent of this session's #290 re-verification. Diff-scope check (git diff --stat against this branch's merge-base 2e603de) confirms NONE of the source files these evals exercise (goal-fit-hook logic, workflow-steering escape-hatch, session-resume/liveness-warning rendering) are touched by this branch's changed-or-added files (only .github/workflows/ci.yml, docs/context-map.md, docs/fixture-ownership.md, docs/workflow-usage-guide.md, evals/ci/run-baseline.sh, evals/integration/test_fixture_retirement_audit.sh, evals/integration/test_pull_work_liveness_preflight.sh, evals/run.sh, kits/builder/skills/pull-work/SKILL.md, package.json (two additive npm-script lines only), src/cli.ts, src/tools/validate-source-tree.ts, plus the new assignment-provider-only files). Confirmed pre-existing, not a regression introduced by this issue or its iteration-1 fix. (Separately, test_bundle_install.sh -- the fourth eval flagged as possibly pre-existing-broken going into this re-verify -- was re-run this session and PASSED cleanly, 77/77; it is NOT an open gap and is not part of this waiver.) — high-impact but status is "assumed".
• transparency AC1 `contract-doc-covers-adr-0021-sections`: `context/contracts/assignment-provider-contract.md` — no evidence record links to this claim.
• transparency AC2 `settings-schema-validates`: `schemas/assignment-provider-settings.schema.json` — no evidence record links to this claim.
• transparency AC3 `github-render-emits-versioned-comment`: `assignment-provider render-claim --provider — no evidence record links to this claim.
• transparency AC4 `github-status-parses-existing-claim`: `assignment-provider status --provider github` — no evidence record links to this claim.
• transparency AC5 `local-file-round-trip`: `assignment-provider claim|status|supersede|release --provider — no evidence record links to this claim.
• transparency AC6 `list-returns-actor-claims`: `assignment-provider list --actor <actor>` (both provider — no evidence record links to this claim.
• transparency AC7 `concurrent-claim-fails-loud-or-reports-holder`: a second `claim` on an already-claimed — no evidence record links to this claim.
• transparency AC8 `pull-work-wires-durable-claim-at-selection`: `pull-work/SKILL.md`'s selection step — no evidence record links to this claim.
• transparency AC9 `no-live-gh-process-in-evals`: none of this issue's new eval scripts invoke a live or — no evidence record links to this claim.
• transparency AC10 `docs-and-context-map-updated`: `docs/context-map.md` lists the new schema (via — no evidence record links to this claim.
• transparency AC11 `human-assignee-policy-knob-present-and-respected`: the settings schema's — no evidence record links to this claim.
• transparency AC12 `disjoint-selection-simulated`: a two-actor join simulation proves that once actor A's — no evidence record links to this claim.
• transparency 26 files reviewed (12 modified, 14 new). Abstraction, GitHub render/parse path, join logic, and pull-work wiring are solid and well-tested, but the local-file claim path has a reproducible TOCTOU race that silently overwrites a concurrent claim with zero audit trail (29/40 concurrent races), negating AC7 and the issue's 'no lost locks' premise. Independently re-reproduced by verification (14/15 races). A HIGH untrusted-input-sanitization gap (GitHub claim-comment fields) was also found and independently re-reproduced by verification. Verdict: CHANGES_REQUESTED. SUPERSEDED by code-review-290-iteration-1-recheck below: all 5 findings are independently re-confirmed FIXED. — no evidence record links to this claim.
• transparency Focused re-review of the iteration-1 fix for all 5 prior findings. Delta reviewed: src/cli/assignment-provider.ts (withSubjectLock/sanitizeDisplayField/computeEffectiveState's nowMs threading), kits/builder/skills/pull-work/SKILL.md, context/contracts/assignment-provider-contract.md, and the two evals/integration/test_assignment_provider_*.sh files, plus test_pull_work_liveness_preflight.sh's updated static assertions. Findings: 0 CRITICAL, 0 HIGH, 0 MEDIUM, 0 LOW blocking. All 5 prior findings independently reproduced-as-fixed with live repro evidence (not just diff-reading), including a 150-iteration independent concurrency-race reproduction and an explicit vacuous-eval check (patched a copy of withSubjectLock to a no-op and confirmed the new eval genuinely fails 40/40 against the unlocked build, then passes 40/40 against the real lock). No new defects introduced by the fix. Imported from kontourai-flow-agents-290--plan-work-code-review-iter1.md via `npm run workflow:sidecar -- import-critique`. — no evidence record links to this claim.
• transparency SUPERSEDES the original CHANGES_REQUESTED review (same critique id, same reviewer, per #344's reviewer-scoped critique supersession). All 5 findings (1 CRITICAL, 1 HIGH, 2 MEDIUM, 1 LOW) independently re-confirmed FIXED: F1 (withSubjectLock atomicity, 40/40 and 150/150 concurrent-race reproductions, 0 double-wins), F2 (sanitizeDisplayField control-byte stripping, independently reproduced with a distinct hostile payload), F3 (idle_days now --now-governed), F4 (argv-execution contract documented), F5 (mutual-exclusion wording corrected). Corroborated by the separate iteration-1 recheck review (kontourai-flow-agents-290--plan-work-code-review-iter1.md, verdict APPROVE) and this re-verification session's own independent reproductions. — no evidence record links to this claim.

Verify it yourself

Recompute this exact file

Download the raw .bundle above, then run it through the named validator — validateTrustBundle from @kontourai/surface. The CLI wraps it and exits non-zero if the artifact is not a well-formed trust.bundle.

Prefer the library directly? The CLI just calls it: