Flow Agents ownership-guard bundle

Provenance

Merged to main via kontourai/flow-agents#377 ('#291: ensure-session ownership guard + per-actor current.json'); taken verbatim from delivery/trust.bundle at the merge commit.

Repository

kontourai/flow-agents

Source path

delivery/trust.bundle

Pinned commit

20eed88f025980eab845ff588ed4cd188f6b0d2a

Bundle source

flow-agents/workflow-sidecar;statusFunctionVersion=2

Claims

What was gated, and how it landed

Each row is a claim the pipeline recorded — its type, the facet it belongs to, the field or behavior it covers, its recorded value, and the trust status the kernel derived. Read straight from the downloadable artifact.

Evidence

What supports the claims

• validation test_output

  npm run context-map -- --check exit 0, "docs/context-map.md is current." (unaffected by F1-F5 fix)

  kontourai-flow-agents-291/evidence.json

• validation test_output

  bash evals/run.sh static: 30 PASS / 0 FAIL, exit 0, including 35/35 node --test pure-helper unit tests (unchanged count vs prior verify)

  kontourai-flow-agents-291/evidence.json

• validation test_output

  bash evals/integration/test_ensure_session_ownership_guard.sh: 36/36 assertions PASS, 0 FAIL, exit 0 (AC1,2,3,4,5,6,9) -- now includes new section 3b (F1 cross-tool self-recognition, fix-plan iteration 1) verifying assignment-provider status --self-actor <bare> recognizes an ensure-session claim made under FLOW_AGENTS_…

  kontourai-flow-agents-291/evidence.json

• validation test_output

  bash evals/integration/test_current_json_per_actor.sh: 22/22 assertions PASS, 0 FAIL, exit 0 (AC7,8,10,11) -- now includes new section 6 (F3, fix-plan iteration 1) pinning the legacy-current.json-wins-over-newer-state.json behavior for a resolved single actor

  kontourai-flow-agents-291/evidence.json

• validation test_output

  bash evals/integration/test_assignment_provider_local_file.sh: 34/34 assertions PASS, 0 FAIL, exit 0 -- #290 back-compat suite stays green after the actor_key additive-field fix

  kontourai-flow-agents-291/evidence.json

• validation test_output

  bash evals/integration/test_assignment_provider_github.sh: 45/45 assertions PASS, 0 FAIL, exit 0 -- #290 back-compat suite unaffected

  kontourai-flow-agents-291/evidence.json

• validation test_output

  bash evals/integration/test_pull_work_assignment_join.sh: 10/10 assertions PASS, 0 FAIL, exit 0 -- #290 back-compat suite unaffected

  kontourai-flow-agents-291/evidence.json

• validation test_output

  bash evals/integration/test_workflow_sidecar_writer.sh: all checks passed, exit 0

  kontourai-flow-agents-291/evidence.json

• validation test_output

  bash evals/integration/test_liveness_heartbeat.sh: all checks passed, exit 0 -- includes F4 hot-path short-circuit restoration coverage (mightHaveActiveSession peek before resolveActor())

  kontourai-flow-agents-291/evidence.json

• validation test_output

  bash evals/integration/test_workflow_steering_hook.sh: 9/9 PASS, exit 0

  kontourai-flow-agents-291/evidence.json

• extraction source_excerpt

  CI reconcile fix (recast, ADR-0020 class #320/#356): the prior recording named a command-backed check with command "npm run validate:source" (no trailing --), which does not literally match the manifest's source-tree-validation entry ("npm run validate:source --") -- and would be redundant with that manifest lane's own…

  kontourai-flow-agents-291/evidence.json

• extraction source_excerpt

  CI reconcile fix (recast, ADR-0020 class #320/#356): bash evals/integration/test_trust_reconcile_manifest.sh is a meta manifest-parity self-check, not itself a manifest/required-lane command, so it cannot be a command-backed (test_output) reconcilable claim -- recast as a non-command-backed folded summary. Result obser…

  kontourai-flow-agents-291/evidence.json

• extraction source_excerpt

  iteration-1 re-verify full-gate narrative (NOT command-backed by design): npm run build --silent exit 0 (folded here, not recorded as a standalone command-backed check, since it is already a prerequisite step inside every npm-run-* manifest command above). Independently reproduced (a) the HIGH fix -- claimed under FLOW…

  kontourai-flow-agents-291/evidence.json

• attestation attestation

  Three eval suites carry failures independently reproduced as pre-existing baselines, unrelated to the #291 iteration-1 fix: test_goal_fit_hook.sh (1 FAIL, exit 1), test_goal_fit_escape_hatch.sh (5 FAIL, exit 1), test_session_resume_roundtrip.sh (13 FAIL, exit 1) -- identical failure counts to the prior (pre-fix) verify…

  kontourai-flow-agents-291/evidence.json

Open questions

Gaps this receipt does not hide

• unsupported Three eval suites carry failures independently reproduced as pre-existing baselines, unrelated to the #291 iteration-1 fix: test_goal_fit_hook.sh (1 FAIL, exit 1), test_goal_fit_escape_hatch.sh (5 FAIL, exit 1), test_session_resume_roundtrip.sh (13 FAIL, exit 1) -- identical failure counts to the prior (pre-fix) verify pass, confirming the iteration-1 changes introduced no new regressions in these suites. — high-impact but status is "assumed".
• transparency AC1 `ensure-session-refuses-fresh-other-actor`: `ensure-session` on a subject with a fresh OTHER-actor local-file assignment claim (liveness fresh, actor differs) exits nonzero with a remediation message naming the holder and suggesting other work or takeover (source: new guard block in `src/cli/workflow-sidecar.ts` `ensureSession()`, inserted before `fs.mkdirSync(dir, ...)`) — no evidence record links to this claim.
• transparency AC2 `ensure-session-supersede-stale-only`: `ensure-session` on a `reclaimable` (stale) subject refuses without `--supersede-stale` (remediation names the flag) and succeeds, transitioning the assignment record to the new actor via the reused supersede logic, when `--supersede-stale` is passed (source: `src/cli/assignment-provider.ts` `performLocalSupersede`, new export, called from `ensureSession()`) — no evidence record links to this claim.
• transparency AC3 `ensure-session-human-held-ask-first`: `ensure-session` on a `human-held` subject refuses (never auto-reclaims), remediation asks the user to confirm before proceeding (source: the same guard block's `human-held` branch) — no evidence record links to this claim.
• transparency AC4 `ensure-session-self-reentry`: `ensure-session` resuming a session under the SAME actor's own fresh claim succeeds with no spurious refusal (source: guard's `self_is_holder` branch) — no evidence record links to this claim.
• transparency AC5 `ensure-session-claims-on-free`: `ensure-session` on a `free` subject succeeds AND establishes a durable local-file assignment claim for the entering actor, verified via `assignment-provider status` immediately after (source: guard's `free` branch calling `performLocalClaim`) — no evidence record links to this claim.
• transparency AC6 `ensure-session-concurrent-race-safety`: two concurrent `ensure-session` invocations on the same fresh-free subject never both become the claim holder, one wins and the loser sees a `held`/refused outcome on retry (source: existing root-level `withLock` in `workflow-sidecar.ts` `main()`, unchanged, plus `withSubjectLock` in `assignment-provider.ts`, unchanged, now reached via the new exported `performLocalClaim`/`performLocalSupersede`) — no evidence record links to this claim.
• transparency AC7 `current-json-per-actor-isolation`: after actor B runs `ensure-session` on a different subject, actor A's own current-session resolution (`workflow:sidecar -- current`, actor-aware) still resolves to A's own session directory (source: per-actor dual-write/read in `writeCurrent()`/`currentDir()`, `src/cli/workflow-sidecar.ts`) — no evidence record links to this claim.
• transparency AC8 `current-json-compat-shim-fallback`: an actor with no per-actor current file yet, or an unresolved actor, still resolves via the legacy global `current.json` exactly as before this change; every named existing consumer (`stop-goal-fit.js`, `evidence-capture.js`, `liveness-heartbeat.js`, `flow-agents-statusline.js`) produces identical output against a legacy-only pre-migration artifact root fixture (source: fallback branch in `scripts/hooks/lib/current-pointer.js` `readCurrentPointer()`) — no evidence record links to this claim.
• transparency AC9 `remediation-sanitized`: refusal/remediation messages never contain raw control/ANSI bytes from actor/holder/assignee/reason fields, verified against a crafted hostile liveness event and a hostile `--effective-state-json` fixture (source: reuse of `stripControlCharsForDisplay`, already in `workflow-sidecar.ts`, at every interpolation site in the new guard's `die()` messages) — no evidence record links to this claim.
• transparency AC10 `config-protection-covers-per-actor-current`: `config-protection.js`'s protected-path and Bash-redirect detectors block direct writes/redirects to `.kontourai/flow-agents/current/<actor>.json` exactly as they already do for `.kontourai/flow-agents/current.json` (source: new pattern in `checkProtectedPathPattern` and `REDIRECT_PROTECTED_RE`) — no evidence record links to this claim.
• transparency AC11 `gate-scoping-actor-correct`: `record-gate-claim` / `writeTrustBundle`'s FlowDefinition dual-emit scoping resolves `active_flow_id`/`active_step_id` from the CALLING actor's own current-pointer, not a different actor's more-recently-written legacy pointer (source: actor-aware update to `declaredClaimTypesFor()`, `writeTrustBundle`'s `_scopedFlowAgentsDir` check, and `resolveActiveFlowStep()` in `src/lib/flow-resolver.ts`) — no evidence record links to this claim.

Verify it yourself

Recompute this exact file

Download the raw .bundle above, then run it through the named validator — validateTrustBundle from @kontourai/surface. The CLI wraps it and exits non-zero if the artifact is not a well-formed trust.bundle.

Prefer the library directly? The CLI just calls it: