← All receipts

Kontour Flow Agents — delivery workflow

Flow Agents delivery bundle

The trust.bundle a Flow Agents delivery run emits as its own receipt: every workflow check (build, source-tree validation, verification) recorded as a claim with its evidence and status.

32 verified1 assumed1 proposed

These are the statuses the validator works out from the evidence, not the ones written in the file. Run the command further down and you get this row back.

Download raw .bundleschemaVersion 5 · 34 claims ·19 evidence

In plain language

What this receipt says

Nothing was disputed — but 1 check is flagged as blocking, written down rather than dropped.

What was checked
34 separate claims, each one a single assertion this run makes about itself — not one summary verdict you have to take or leave. The kinds of thing being claimed:
  • workflow.check.runtime
  • workflow.check.command
  • workflow.check.test
  • workflow.check.security
  • workflow.check.policy
  • workflow.check.diff
  • workflow.acceptance.criterion
  • workflow.critique.review
How they came out
32 verified, 1 assumed, 1 proposed.
  • verifiedevidence supports it and a verification event confirmed it
  • assumedaccepted without independent evidence — usually a disclosed waiver
  • proposedrecorded, but nothing has confirmed it yet
What backs them
19 evidence records captured while the commands ran — 18 reporting a pass, 1 reporting a failure. 1 claim carries neither an evidence record nor a verification event, which is why it can't come out verified.
What's still open
1 transparency gap, blocking, listed in full below. The receipt records it rather than dropping it.
Where the file and the answer differ
1 claim in this file stores a status the validator does not agree with. The stored string loses: it isn't part of the format's required shape, and the answer is recomputed from the evidence every time. The raw table below marks which one.
What it doesn't tell you
Whether the code is correct, or whether the checks that ran were the right checks. A receipt records what was asked, what was run, and what came back. It narrows what you have to take on faith; it doesn't get it to zero.

Check it yourself

Recompute this exact file

Download the raw .bundle above and run it through @kontourai/surface — our implementation of the Hachure trust.bundle format, an open spec we publish schemas for but don't own the definition of. The command prints the same status row this page shows, and exits non-zero if the artifact isn't a well-formed trust.bundle.

validate this receipt
$ npx @kontourai/surface@2.14.0 report \
--input flow-agents-delivery.trust.bundle --format summary
# exit 0 prints the trust summary; a broken file exits 1

Want a second opinion from a different codebase? The hachure reference CLI reads the same file against the spec's own schemas and reaches the same verdict. Both are still maintained by us — the implementations are independent, the organization behind them isn't yet.

second opinion — the reference CLI
$ npx -y -p ajv@8.20.0 -p hachure@0.15.0 hachure validate \
flow-agents-delivery.trust.bundle
valid TrustBundle (schemaVersion 5)

Prefer the library directly? The CLI just calls it:

node — the named validator
import { validateTrustBundle } from "@kontourai/surface";
import { readFileSync } from "node:fs";
validateTrustBundle(JSON.parse(readFileSync("flow-agents-delivery.trust.bundle", "utf8")));
# throws if the bundle is invalid; returns the parsed bundle otherwise

Open questions

What this receipt leaves open

Straight from the validator's own transparencyGaps and high-impact-unsupported lists — the same lines the command above prints. Not a count this site works out for itself.

High-impact claims counted as unsupported (1)

Claims the run marked high-impact that no verified evidence stands behind. In these receipts that is what a disclosed waiver looks like: the run wrote down what it couldn't stand behind instead of leaving it out. The wording is the run's own, verbatim.

  • assumed

    ACCEPTED GAP, waived. This check's underlying record-evidence call carried this check's waiver via the PER-CHECK `_waiver` JSON payload (ADR 0020 rule: a waiver cannot ride the global --accepted-gap-reason/--waived-by flags when the same record-evidence call also includes command-backed checks -- this call includes 8). The per-check waiver is stamped on this claim's metadata in trust.bundle (status: assumed) and is not duplicated here since this schema does not carry a `_waiver` property; see trust.bundle claim workflow.check.runtime / 'pre-existing-unrelated-eval-failures' for the canonical w…

    kontourai-flow-agents-290-pre-existing-unrelated-eval-failures.flow-agents-workflow.accepted-gap-waived-this-check-s-underlying-record-evide…

Provenance

Where this file came from

Committed by the Flow Agents delivery pipeline and tracked in-repo since PR #269; this copy is taken verbatim from origin/main at the pinned commit.

Repository
kontourai/flow-agents
Source path
delivery/trust.bundle
Pinned commit
fe41e3cfbf465a2e186af39d235c7b746b3aee05
Bundle source
flow-agents/workflow-sidecar;statusFunctionVersion=2

Recomputing tells you the file is internally consistent and hasn't been edited since. It doesn't tell you nobody rewrote the evidence before publishing — that's what the pinned commit is for. Follow it and compare.

Evidence

What actually ran — 18 passing, 1 failing

The artifact

Every claim, raw

The unedited claim list as it sits in the file. The wording is the pipeline's own note-taking — written for the next run, not for reading — and it's here so you can check that the summary above didn't quietly skip anything.

Show all 34 claims · 1 where the file's stored status disagrees
Derived statusSubject / fieldType · facetValue
verifiedkontourai-flow-agents-290/build-compile-summaryNON-command-backed summary (ADR 0020 rule: bare `npm run build --silent` is not itself a manifest entry, so it is not recorded as command-backed test_output; it is subsumed by the manifest-matched `source-tree-validation` check below, whose own script runs build first). `npm run build --silent`, this session: exit 0, confirming the TypeScript project including the two new CLI modules (assignment-provider.ts, effective-assignment-provider-settings.ts) and the F1-F5 fix set compile clean.workflow.check.runtimeflow-agents.workflowpass
verifiedkontourai-flow-agents-290/source-tree-validationManifest-matched (source-tree-validation). `npm run validate:source --` exits 0; this script's own package.json definition runs `npm run build --silent` first, so a clean run also confirms the CLI modules compile and are correctly registered/mirrored per validate-source-tree.ts's CLI-registration rules.workflow.check.commandflow-agents.workflowpass
verifiedkontourai-flow-agents-290/context-map-driftManifest-matched (context-map-drift). `npm run context-map -- --check` exits 0 with 'docs/context-map.md is current.' -- confirms AC10's context-map regeneration is committed and non-drifted.workflow.check.commandflow-agents.workflowpass
verifiedkontourai-flow-agents-290/static-eval-suiteManifest-matched (static-eval-suite). Full static suite exits 0, no failures (35/35 TS unit tests pass; all other static assertion blocks pass). Runs `npm run build` as a prerequisite, so a clean run confirms the whole TypeScript project (including the F1-F5 fix set) compiles.workflow.check.testflow-agents.workflowpass
verifiedkontourai-flow-agents-290/assignment-provider-local-file-integrationManifest-matched (assignment-provider-local-file-integration). Re-verify iteration-1: all 34/34 assertions pass (up from 30 pre-fix), including three NEW genuine OS-process concurrency-race assertions (F1 fix-plan): two real, simultaneously-launched claim processes for the same subject/different actors, asserting exactly one exits 0, the on-disk record has a single-entry audit trail, and the holder matches the actual winner. Supports AC5, AC6, AC7, AC9.workflow.check.testflow-agents.workflowpass
verifiedkontourai-flow-agents-290/assignment-provider-github-integrationManifest-matched (assignment-provider-github-integration). Re-verify iteration-1: all 45/45 assertions pass (up from 42 pre-fix), including NEW F2 (hostile branch/artifact_dir/actor.human payload with newline+ANSI+[SYSTEM] text is control-char-stripped in status output, both raw and JSON-escaped ANSI forms absent, effective-state classification unchanged) and F3 (idle_days is EXACTLY deterministic via --now, not real wall clock; also confirmed idle_days still falls back correctly to real Date.now() when --now is omitted) assertions. Supports AC3, AC4, AC9, AC11.workflow.check.testflow-agents.workflowpass
verifiedkontourai-flow-agents-290/pull-work-assignment-join-integrationManifest-matched (pull-work-assignment-join-integration). Re-verify iteration-1: unaffected by F1-F5, still 10/10 assertions pass. Two-actor simulation: subject is free before either session claims; session A claims it; session B's subsequent status/join check reports held (never free); session B selects and claims a disjoint subject instead; session A's and session B's claimed-subject lists are disjoint. Supports AC10, AC12.workflow.check.testflow-agents.workflowpass
verifiedkontourai-flow-agents-290/pull-work-liveness-preflight-integrationManifest-matched (pull-work-liveness-preflight-integration). Re-verify iteration-1: 68/68 assertions pass (up from 65 pre-fix), including NEW F5 wording-correction assertions: pull-work now scopes true mutual exclusion to the local-file provider only (via #290's lock), does NOT overclaim true mutual exclusion for the GitHub provider (advisory/last-writer, detect not prevent), and explicitly warns #290 does not close the GitHub race.workflow.check.testflow-agents.workflowpass
verifiedkontourai-flow-agents-290/pull-work-provider-integrationManifest-matched (pull-work-provider-integration). Re-verify iteration-1: unaffected by F1-F5, still 69/69 assertions pass -- regression check confirming this issue's changes to pull-work/SKILL.md and the provider CLI did not disturb the existing WorkItemProvider fixture-based eval.workflow.check.testflow-agents.workflowpass
verifiedkontourai-flow-agents-290/gh-process-absence-source-scanSESSION-LOCAL (no command; not a manifest entry). Independent source-tree grep, re-run this session: `execFileSync|spawnSync|spawn\(|exec\(` naming `gh` anywhere under src/ -> zero hits outside a single explanatory code comment in assignment-provider.ts. Confirms AC9 at the source level, independent of the evals' own self-checks.workflow.check.securityflow-agents.workflowpass
verifiedkontourai-flow-agents-290/trust-reconcile-manifest-paritySESSION-LOCAL (kind=policy is non-reconcilable regardless of command presence per ADR 0020's classification table; deliberately recorded without a `command` field since the exact command run this session -- `bash evals/integration/test_trust_reconcile_manifest.sh` -- is a narrower slice of the actual manifest entry 'anti-gaming-and-trust-suite', not that entry itself). Re-run this session: exit 0, 'manifest entries: 42 ; ci.yml --check invocations: 42', both PASS lines ('every ci.yml required --check invocation is a manifest entry'; 'every manifest entry is invoked by a required ci.yml job'). Own independent recount (grep-based diff of run-baseline.sh --manifest-json ids vs ci.yml's required --check slugs, usage-feedback excluded) reproduces 42==42 with an empty diff both directions. Aside: a full run of the actual manifest command (`bash evals/ci/antigaming-suite.sh`, id 'anti-gaming-and-trust-suite') was also attempted this session for rigor; it failed on an UNRELATED sub-test (evals/acceptance/prove-capture-teeth.sh's 'shipped bundle install' step: 'Claude Code install.sh failed' / 'Codex install.sh failed'). Root-caused as environment flake, not a #290 regression or a manifest-parity defect: (a) this branch's diff touches none of dist/, install.sh, or evidence-capture; (b) re-running prove-capture-teeth.sh standalone immediately after passed cleanly (8/8, exit 0); (c) the trust-reconcile-manifest sub-test itself was unaffected in both runs. Per the verification contract's flaky-test rule, this is disclosed rather than silently re-run to green and is NOT claimed as manifest-command-backed evidence for this check -- hence the session-local (no-command) classification above.workflow.check.policyflow-agents.workflowpass
verifiedkontourai-flow-agents-290/concurrency-race-independent-reproductionSESSION-LOCAL (no command; independent of the checked-in eval's own single-iteration race assertion). Re-ran the EXACT 40-iteration concurrent OS-process race script (race40.sh) originally used to reproduce the pre-fix defect (14/15 double-wins, corroborating the code-review subagent's own 29/40 reproduction). Methodology: for each of 40 iterations, spawn two REAL, simultaneously-launched `assignment-provider claim` processes for a fresh subject, different actors, via background `&` + `wait` (genuine OS-level race, not sequential); assert exactly one process exits 0; verify the on-disk record's audit_trail length is exactly 1; verify no leftover lockdir. POST-FIX RESULT: exactly_one_winner_count=40/40, both_succeeded_count=0/40, neither_succeeded_count=0/40. No 'UNEXPECTED AUDIT STATE' or 'LEFTOVER LOCKDIR' lines were emitted (the script prints those only on failure) across all 40 iterations. This is a full reversal of the pre-fix result and directly proves AC7 and the ADR 0021 'no lost locks' premise for the local-file provider.workflow.check.securityflow-agents.workflowpass
verifiedkontourai-flow-agents-290/f2-hostile-payload-independent-reproductionSESSION-LOCAL (no command; independent of the checked-in eval's own hostile fixture). Built a DISTINCT hostile fixture from the eval's own (different marker text, different control bytes: CR + BEL + a distinct ANSI CSI sequence + a '[SYSTEM] ignore prior instructions' trailer) via a forged claim-marker GitHub issue comment (any commenter can post one), then ran `assignment-provider status --provider github` against it. RESULT: the raw payload (with its control bytes intact) is absent from stdout; the ESC and BEL bytes are absent from stdout; the parsed JSON's `assignment.record.branch`, `.artifact_dir`, and `.actor.human` fields all equal the control-char-stripped expected value (computed independently via a C0/DEL/C1 codepoint filter, not by importing the implementation's own sanitizer); `effective.effective_state` remains 'human-held', proving sanitization does not perturb the human-assignee presence gate. Confirms F2 is fixed and generalizes beyond the eval's specific fixture string.workflow.check.securityflow-agents.workflowpass
verifiedkontourai-flow-agents-290/ac1-contract-doc-reviewRe-verify iteration-1: re-read context/contracts/assignment-provider-contract.md; unchanged in substance from the prior verification pass other than F4's additive argv-array-execution note. Cross-check against docs/adr/0021-assignment-leases-and-stale-claim-takeover.md sections 1-2/4/6 still holds, no paraphrase drift.workflow.check.diffflow-agents.workflowpass
verifiedkontourai-flow-agents-290/ac2-settings-schema-independent-validationRe-verify iteration-1: schemas/assignment-provider-settings.schema.json is unchanged by the F1-F5 fix set (confirmed via diff-scope: the fix touches only src/cli/assignment-provider.ts, kits/builder/skills/pull-work/SKILL.md, context/contracts/assignment-provider-contract.md, and eval scripts). Prior independent ajv validation (good instance valid=true; missing provider.kind valid=false; github kind missing repo valid=false) carried forward as still-applicable.workflow.check.diffflow-agents.workflowpass
verifiedkontourai-flow-agents-290/ac8-pull-work-skill-wiring-reviewRe-read the diff of kits/builder/skills/pull-work/SKILL.md's F4/F5 changes: an explicit argv-array (never shell-string interpolation) execution note added to the Assignment Claim On Selection section (F4), and the mutual-exclusion claim corrected to scope 'true mutual exclusion' to the local-file provider only via #290's lock, explicitly NOT claiming it for the GitHub provider, which remains advisory/last-writer (F5). No other functional change to the selection-step wiring verified in the prior pass.workflow.check.diffflow-agents.workflowpass
verifiedkontourai-flow-agents-290/ac10-docs-and-context-map-reviewdocs/context-map.md drift-checked clean via the command-backed context-map-drift check above. docs/workflow-usage-guide.md's 'Assignment ownership: the third provider leg' subsection re-read, unchanged in substance.workflow.check.diffflow-agents.workflowpass
verifiedkontourai-flow-agents-290/goal-fitUser outcome now fully met: a selected GitHub issue carries a durable, human-visible ownership record; the same operations work against a local-file record for tracker-less repos/evals with GENUINE mutual exclusion (F1, independently re-confirmed 40/40); human assignees are never silently reclaimed; untrusted GitHub claim-comment fields no longer leak unsanitized into agent-facing output (F2, independently re-confirmed); idle_days is deterministic under --now (F3); the argv-execution contract is explicit (F4); SKILL.md no longer overclaims GitHub-side mutual exclusion (F5). Design Decision 1's render/execute divergence remains explicitly documented and owner-confirmed (state.json history, session 9ce76bbb). Durable docs target (contract doc + workflow-usage-guide subsection) is met.workflow.check.policyflow-agents.workflowpass
assumedkontourai-flow-agents-290/pre-existing-unrelated-eval-failuresACCEPTED GAP, waived. This check's underlying record-evidence call carried this check's waiver via the PER-CHECK `_waiver` JSON payload (ADR 0020 rule: a waiver cannot ride the global --accepted-gap-reason/--waived-by flags when the same record-evidence call also includes command-backed checks -- this call includes 8). The per-check waiver is stamped on this claim's metadata in trust.bundle (status: assumed) and is not duplicated here since this schema does not carry a `_waiver` property; see trust.bundle claim workflow.check.runtime / 'pre-existing-unrelated-eval-failures' for the canonical waiver record (reason: three pre-existing eval failures unrelated to #290's scope, confirmed via diff-scope; approved_by: re-verification session, independent diff-scope confirmation per the task brief's own PRE-EXISTING framing; approved_at: 2026-07-03T18:14:59Z). Three eval scripts (test_goal_fit_hook.sh: 1 failing assertion 'goal-fit hook should not block by default'; test_goal_fit_escape_hatch.sh: 5 failing assertions; test_session_resume_roundtrip.sh: 13 failing assertions) fail in this working tree, independent of this session's #290 re-verification. Diff-scope check (git diff --stat against this branch's merge-base 2e603de) confirms NONE of the source files these evals exercise (goal-fit-hook logic, workflow-steering escape-hatch, session-resume/liveness-warning rendering) are touched by this branch's changed-or-added files (only .github/workflows/ci.yml, docs/context-map.md, docs/fixture-ownership.md, docs/workflow-usage-guide.md, evals/ci/run-baseline.sh, evals/integration/test_fixture_retirement_audit.sh, evals/integration/test_pull_work_liveness_preflight.sh, evals/run.sh, kits/builder/skills/pull-work/SKILL.md, package.json (two additive npm-script lines only), src/cli.ts, src/tools/validate-source-tree.ts, plus the new assignment-provider-only files). Confirmed pre-existing, not a regression introduced by this issue or its iteration-1 fix. (Separately, test_bundle_install.sh -- the fourth eval flagged as possibly pre-existing-broken going into this re-verify -- was re-run this session and PASSED cleanly, 77/77; it is NOT an open gap and is not part of this waiver.)workflow.check.runtimeflow-agents.workflowskip
verifiedkontourai-flow-agents-290/ac1-contract-doc-covers-adr-0021-sections-context-contracts-assignment-provider-contract-mdAC1 `contract-doc-covers-adr-0021-sections`: `context/contracts/assignment-provider-contract.md`workflow.acceptance.criterionflow-agents.workflowpass
verifiedkontourai-flow-agents-290/ac2-settings-schema-validates-schemas-assignment-provider-settings-schema-jsonAC2 `settings-schema-validates`: `schemas/assignment-provider-settings.schema.json`workflow.acceptance.criterionflow-agents.workflowpass
verifiedkontourai-flow-agents-290/ac3-github-render-emits-versioned-comment-assignment-provider-render-claim-providerAC3 `github-render-emits-versioned-comment`: `assignment-provider render-claim --providerworkflow.acceptance.criterionflow-agents.workflowpass
verifiedkontourai-flow-agents-290/ac4-github-status-parses-existing-claim-assignment-provider-status-provider-githubAC4 `github-status-parses-existing-claim`: `assignment-provider status --provider github`workflow.acceptance.criterionflow-agents.workflowpass
verifiedkontourai-flow-agents-290/ac5-local-file-round-trip-assignment-provider-claim-status-supersede-release-providerAC5 `local-file-round-trip`: `assignment-provider claim|status|supersede|release --providerworkflow.acceptance.criterionflow-agents.workflowpass
verifiedkontourai-flow-agents-290/ac6-list-returns-actor-claims-assignment-provider-list-actor-actor-both-providerAC6 `list-returns-actor-claims`: `assignment-provider list --actor <actor>` (both providerworkflow.acceptance.criterionflow-agents.workflowpass
verifiedkontourai-flow-agents-290/ac7-concurrent-claim-fails-loud-or-reports-holder-a-second-claim-on-an-already-claimedAC7 `concurrent-claim-fails-loud-or-reports-holder`: a second `claim` on an already-claimedworkflow.acceptance.criterionflow-agents.workflowpass
verifiedkontourai-flow-agents-290/ac8-pull-work-wires-durable-claim-at-selection-pull-work-skill-md-s-selection-stepAC8 `pull-work-wires-durable-claim-at-selection`: `pull-work/SKILL.md`'s selection stepworkflow.acceptance.criterionflow-agents.workflowpass
verifiedkontourai-flow-agents-290/ac9-no-live-gh-process-in-evals-none-of-this-issue-s-new-eval-scripts-invoke-a-live-orAC9 `no-live-gh-process-in-evals`: none of this issue's new eval scripts invoke a live orworkflow.acceptance.criterionflow-agents.workflowpass
verifiedkontourai-flow-agents-290/ac10-docs-and-context-map-updated-docs-context-map-md-lists-the-new-schema-viaAC10 `docs-and-context-map-updated`: `docs/context-map.md` lists the new schema (viaworkflow.acceptance.criterionflow-agents.workflowpass
verifiedkontourai-flow-agents-290/ac11-human-assignee-policy-knob-present-and-respected-the-settings-schema-sAC11 `human-assignee-policy-knob-present-and-respected`: the settings schema'sworkflow.acceptance.criterionflow-agents.workflowpass
verifiedkontourai-flow-agents-290/ac12-disjoint-selection-simulated-a-two-actor-join-simulation-proves-that-once-actor-a-sAC12 `disjoint-selection-simulated`: a two-actor join simulation proves that once actor A'sworkflow.acceptance.criterionflow-agents.workflowpass
proposedfile says “superseded”kontourai-flow-agents-290/code-review-290-iteration-126 files reviewed (12 modified, 14 new). Abstraction, GitHub render/parse path, join logic, and pull-work wiring are solid and well-tested, but the local-file claim path has a reproducible TOCTOU race that silently overwrites a concurrent claim with zero audit trail (29/40 concurrent races), negating AC7 and the issue's 'no lost locks' premise. Independently re-reproduced by verification (14/15 races). A HIGH untrusted-input-sanitization gap (GitHub claim-comment fields) was also found and independently re-reproduced by verification. Verdict: CHANGES_REQUESTED. SUPERSEDED by code-review-290-iteration-1-recheck below: all 5 findings are independently re-confirmed FIXED.workflow.critique.reviewflow-agents.workflowfail
verifiedkontourai-flow-agents-290/code-review-290-iteration-1-recheckFocused re-review of the iteration-1 fix for all 5 prior findings. Delta reviewed: src/cli/assignment-provider.ts (withSubjectLock/sanitizeDisplayField/computeEffectiveState's nowMs threading), kits/builder/skills/pull-work/SKILL.md, context/contracts/assignment-provider-contract.md, and the two evals/integration/test_assignment_provider_*.sh files, plus test_pull_work_liveness_preflight.sh's updated static assertions. Findings: 0 CRITICAL, 0 HIGH, 0 MEDIUM, 0 LOW blocking. All 5 prior findings independently reproduced-as-fixed with live repro evidence (not just diff-reading), including a 150-iteration independent concurrency-race reproduction and an explicit vacuous-eval check (patched a copy of withSubjectLock to a no-op and confirmed the new eval genuinely fails 40/40 against the unlocked build, then passes 40/40 against the real lock). No new defects introduced by the fix. Imported from kontourai-flow-agents-290--plan-work-code-review-iter1.md via `npm run workflow:sidecar -- import-critique`.workflow.critique.reviewflow-agents.workflowpass
verifiedkontourai-flow-agents-290/code-review-290-iteration-1SUPERSEDES the original CHANGES_REQUESTED review (same critique id, same reviewer, per #344's reviewer-scoped critique supersession). All 5 findings (1 CRITICAL, 1 HIGH, 2 MEDIUM, 1 LOW) independently re-confirmed FIXED: F1 (withSubjectLock atomicity, 40/40 and 150/150 concurrent-race reproductions, 0 double-wins), F2 (sanitizeDisplayField control-byte stripping, independently reproduced with a distinct hostile payload), F3 (idle_days now --now-governed), F4 (argv-execution contract documented), F5 (mutual-exclusion wording corrected). Corroborated by the separate iteration-1 recheck review (kontourai-flow-agents-290--plan-work-code-review-iter1.md, verdict APPROVE) and this re-verification session's own independent reproductions.workflow.critique.reviewflow-agents.workflowpass

Next

← All receiptsWhere these come fromWhat this still can't catchThe format spec