Kontour Flow Agents — ensure-session ownership guard
A Flow Agents workflow run's own receipt for its ensure-session ownership guard: two agents claiming the same work item are kept from colliding, recorded as claims with their evidence — including one pre-existing, unrelated test-suite gap the run discloses and waives rather than hides.
These are the statuses the validator works out from the evidence, not the ones written in the file. Run the command further down and you get this row back.
In plain language
Everything it claimed came back supported.
Check it yourself
Download the raw .bundle above and run it through @kontourai/surface — our implementation of the Hachure trust.bundle format, an open spec we publish schemas for but don't own the definition of. The command prints the same status row this page shows, and exits non-zero if the artifact isn't a well-formed trust.bundle.
Want a second opinion from a different codebase? The hachure reference CLI reads the same file against the spec's own schemas and reaches the same verdict. Both are still maintained by us — the implementations are independent, the organization behind them isn't yet.
Prefer the library directly? The CLI just calls it:
Open questions
Straight from the validator's own transparencyGaps and high-impact-unsupported lists — the same lines the command above prints. Not a count this site works out for itself.
0 transparency gapsNothing contradicts anything else, no policy went unsatisfied, and no evidence has aged past what its policy allows.
Claims the run marked high-impact that no verified evidence stands behind. In these receipts that is what a disclosed waiver looks like: the run wrote down what it couldn't stand behind instead of leaving it out. The wording is the run's own, verbatim.
Three eval suites carry failures independently reproduced as pre-existing baselines, unrelated to the #291 iteration-1 fix: test_goal_fit_hook.sh (1 FAIL, exit 1), test_goal_fit_escape_hatch.sh (5 FAIL, exit 1), test_session_resume_roundtrip.sh (13 FAIL, exit 1) -- identical failure counts to the prior (pre-fix) verify pass, confirming the iteration-1 changes introduced no new regressions in these suites.
kontourai-flow-agents-291-pre-existing-failure-baseline.flow-agents-workflow.three-eval-suites-carry-failures-independently-reproduced-as-pr…
Provenance
Merged to main via kontourai/flow-agents#377 ('#291: ensure-session ownership guard + per-actor current.json'); taken verbatim from delivery/trust.bundle at the merge commit.
Recomputing tells you the file is internally consistent and hasn't been edited since. It doesn't tell you nobody rewrote the evidence before publishing — that's what the pinned commit is for. Follow it and compare.
Evidence
npm run context-map -- --check exit 0, "docs/context-map.md is current." (unaffected by F1-F5 fix)
kontourai-flow-agents-291/evidence.json
bash evals/run.sh static: 30 PASS / 0 FAIL, exit 0, including 35/35 node --test pure-helper unit tests (unchanged count vs prior verify)
kontourai-flow-agents-291/evidence.json
bash evals/integration/test_ensure_session_ownership_guard.sh: 36/36 assertions PASS, 0 FAIL, exit 0 (AC1,2,3,4,5,6,9) -- now includes new section 3b (F1 cross-tool self-recognition, fix-plan iteration 1) verifying assignment-provider status --self-actor <bare> recognizes an ensure-session claim made under FLOW_AGENTS_…
kontourai-flow-agents-291/evidence.json
bash evals/integration/test_current_json_per_actor.sh: 22/22 assertions PASS, 0 FAIL, exit 0 (AC7,8,10,11) -- now includes new section 6 (F3, fix-plan iteration 1) pinning the legacy-current.json-wins-over-newer-state.json behavior for a resolved single actor
kontourai-flow-agents-291/evidence.json
bash evals/integration/test_assignment_provider_local_file.sh: 34/34 assertions PASS, 0 FAIL, exit 0 -- #290 back-compat suite stays green after the actor_key additive-field fix
kontourai-flow-agents-291/evidence.json
bash evals/integration/test_assignment_provider_github.sh: 45/45 assertions PASS, 0 FAIL, exit 0 -- #290 back-compat suite unaffected
kontourai-flow-agents-291/evidence.json
bash evals/integration/test_pull_work_assignment_join.sh: 10/10 assertions PASS, 0 FAIL, exit 0 -- #290 back-compat suite unaffected
kontourai-flow-agents-291/evidence.json
bash evals/integration/test_workflow_sidecar_writer.sh: all checks passed, exit 0
kontourai-flow-agents-291/evidence.json
bash evals/integration/test_liveness_heartbeat.sh: all checks passed, exit 0 -- includes F4 hot-path short-circuit restoration coverage (mightHaveActiveSession peek before resolveActor())
kontourai-flow-agents-291/evidence.json
bash evals/integration/test_workflow_steering_hook.sh: 9/9 PASS, exit 0
kontourai-flow-agents-291/evidence.json
CI reconcile fix (recast, ADR-0020 class #320/#356): the prior recording named a command-backed check with command "npm run validate:source" (no trailing --), which does not literally match the manifest's source-tree-validation entry ("npm run validate:source --") -- and would be redundant with that manifest lane's own…
kontourai-flow-agents-291/evidence.json
CI reconcile fix (recast, ADR-0020 class #320/#356): bash evals/integration/test_trust_reconcile_manifest.sh is a meta manifest-parity self-check, not itself a manifest/required-lane command, so it cannot be a command-backed (test_output) reconcilable claim -- recast as a non-command-backed folded summary. Result obser…
kontourai-flow-agents-291/evidence.json
iteration-1 re-verify full-gate narrative (NOT command-backed by design): npm run build --silent exit 0 (folded here, not recorded as a standalone command-backed check, since it is already a prerequisite step inside every npm-run-* manifest command above). Independently reproduced (a) the HIGH fix -- claimed under FLOW…
kontourai-flow-agents-291/evidence.json
Three eval suites carry failures independently reproduced as pre-existing baselines, unrelated to the #291 iteration-1 fix: test_goal_fit_hook.sh (1 FAIL, exit 1), test_goal_fit_escape_hatch.sh (5 FAIL, exit 1), test_session_resume_roundtrip.sh (13 FAIL, exit 1) -- identical failure counts to the prior (pre-fix) verify…
kontourai-flow-agents-291/evidence.json
The artifact
The unedited claim list as it sits in the file. The wording is the pipeline's own note-taking — written for the next run, not for reading — and it's here so you can check that the summary above didn't quietly skip anything.
| Derived status | Subject / field | Type · facet | Value |
|---|---|---|---|
| verified | kontourai-flow-agents-291/context-map-driftnpm run context-map -- --check exit 0, "docs/context-map.md is current." (unaffected by F1-F5 fix) | workflow.check.lintflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/static-eval-suitebash evals/run.sh static: 30 PASS / 0 FAIL, exit 0, including 35/35 node --test pure-helper unit tests (unchanged count vs prior verify) | workflow.check.testflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/ensure-session-ownership-guard-integrationbash evals/integration/test_ensure_session_ownership_guard.sh: 36/36 assertions PASS, 0 FAIL, exit 0 (AC1,2,3,4,5,6,9) -- now includes new section 3b (F1 cross-tool self-recognition, fix-plan iteration 1) verifying assignment-provider status --self-actor <bare> recognizes an ensure-session claim made under FLOW_AGENTS_ACTOR override | workflow.check.testflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/current-json-per-actor-integrationbash evals/integration/test_current_json_per_actor.sh: 22/22 assertions PASS, 0 FAIL, exit 0 (AC7,8,10,11) -- now includes new section 6 (F3, fix-plan iteration 1) pinning the legacy-current.json-wins-over-newer-state.json behavior for a resolved single actor | workflow.check.testflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/assignment-provider-local-file-integrationbash evals/integration/test_assignment_provider_local_file.sh: 34/34 assertions PASS, 0 FAIL, exit 0 -- #290 back-compat suite stays green after the actor_key additive-field fix | workflow.check.testflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/assignment-provider-github-integrationbash evals/integration/test_assignment_provider_github.sh: 45/45 assertions PASS, 0 FAIL, exit 0 -- #290 back-compat suite unaffected | workflow.check.testflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/pull-work-assignment-join-integrationbash evals/integration/test_pull_work_assignment_join.sh: 10/10 assertions PASS, 0 FAIL, exit 0 -- #290 back-compat suite unaffected | workflow.check.testflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/workflow-sidecar-writer-integrationbash evals/integration/test_workflow_sidecar_writer.sh: all checks passed, exit 0 | workflow.check.testflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/liveness-heartbeat-integrationbash evals/integration/test_liveness_heartbeat.sh: all checks passed, exit 0 -- includes F4 hot-path short-circuit restoration coverage (mightHaveActiveSession peek before resolveActor()) | workflow.check.testflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/workflow-steering-hook-integrationbash evals/integration/test_workflow_steering_hook.sh: 9/9 PASS, exit 0 | workflow.check.testflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/source-tree-validation-summaryCI reconcile fix (recast, ADR-0020 class #320/#356): the prior recording named a command-backed check with command "npm run validate:source" (no trailing --), which does not literally match the manifest's source-tree-validation entry ("npm run validate:source --") -- and would be redundant with that manifest lane's own fresh reconciliation on every run even if renamed to match verbatim. Recast as a non-command-backed folded summary carrying no command field at all (dropped, not renamed to the -- form) per coordinator direction. Result observed this pass: npm run validate:source exit 0, "Source tree validation passed." -- the manifest's own source-tree-validation lane entry reconciles this independently every CI run; this check exists only as a session-local narrative confirmation, never a second reconcilable claim for the same command. | workflow.check.diffflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/trust-reconcile-manifest-parity-summaryCI reconcile fix (recast, ADR-0020 class #320/#356): bash evals/integration/test_trust_reconcile_manifest.sh is a meta manifest-parity self-check, not itself a manifest/required-lane command, so it cannot be a command-backed (test_output) reconcilable claim -- recast as a non-command-backed folded summary. Result observed this pass: manifest entries == 44, ci.yml required --check invocations == 44 (44==44), exit 0 -- WS8 manifest self-check parity holds, unchanged from the prior recording. | workflow.check.diffflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/full-gate-summaryiteration-1 re-verify full-gate narrative (NOT command-backed by design): npm run build --silent exit 0 (folded here, not recorded as a standalone command-backed check, since it is already a prerequisite step inside every npm-run-* manifest command above). Independently reproduced (a) the HIGH fix -- claimed under FLOW_AGENTS_ACTOR=xcheck-override-actor via ensure-session, then assignment-provider status --self-actor xcheck-override-actor (bare) with a fresh liveness heartbeat stream: effective_state=held, reason=self_is_holder (would have been reclaimable pre-fix, confirmed by stripping actor_key from the same record and re-running the identical status check); (b) #290 back-compat -- the same record with actor_key stripped falls back to serializeActor(record.actor) and reproduces the pre-fix reclaimable classification exactly, confirming the fallback path (not a new default) is what keeps every #290 fixture green; (c) the liveness join matches the override actor's fresh heartbeat once actor_key is present. Re-confirmed AC6 concurrency (independent 30/30-iteration two-process race harness, one winner each time, 17/13 split) and AC9 sanitization (2 verifier-authored hostile payloads distinct from the eval's own fixtures -- DEL+C1 byte on a liveness holder actor, OSC-8 hyperlink+BEL on an --effective-state-json assignee -- zero raw control codepoints leaked in either case, sanitized non-control text still present) after the guard's own code path changed under F1. | workflow.check.diffflow-agents.workflow | pass |
| assumed | kontourai-flow-agents-291/pre-existing-failure-baselineThree eval suites carry failures independently reproduced as pre-existing baselines, unrelated to the #291 iteration-1 fix: test_goal_fit_hook.sh (1 FAIL, exit 1), test_goal_fit_escape_hatch.sh (5 FAIL, exit 1), test_session_resume_roundtrip.sh (13 FAIL, exit 1) -- identical failure counts to the prior (pre-fix) verify pass, confirming the iteration-1 changes introduced no new regressions in these suites. | workflow.check.policyflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/ac1-ensure-session-refuses-fresh-other-actor-ensure-session-on-a-subject-with-a-fresh-other-actor-local-file-assignment-claim-liveness-fresh-actor-differs-exits-nonzero-with-a-remediation-message-naming-the-holder-and-suggesting-other-work-or-takeover-source-new-guard-block-in-src-cli-workflow-sidecar-ts-ensuresession-inserted-before-fs-mkdirsync-dirAC1 `ensure-session-refuses-fresh-other-actor`: `ensure-session` on a subject with a fresh OTHER-actor local-file assignment claim (liveness fresh, actor differs) exits nonzero with a remediation message naming the holder and suggesting other work or takeover (source: new guard block in `src/cli/workflow-sidecar.ts` `ensureSession()`, inserted before `fs.mkdirSync(dir, ...)`) | workflow.acceptance.criterionflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/ac2-ensure-session-supersede-stale-only-ensure-session-on-a-reclaimable-stale-subject-refuses-without-supersede-stale-remediation-names-the-flag-and-succeeds-transitioning-the-assignment-record-to-the-new-actor-via-the-reused-supersede-logic-when-supersede-stale-is-passed-source-src-cli-assignment-provider-ts-performlocalsupersede-new-export-called-from-ensuresessionAC2 `ensure-session-supersede-stale-only`: `ensure-session` on a `reclaimable` (stale) subject refuses without `--supersede-stale` (remediation names the flag) and succeeds, transitioning the assignment record to the new actor via the reused supersede logic, when `--supersede-stale` is passed (source: `src/cli/assignment-provider.ts` `performLocalSupersede`, new export, called from `ensureSession()`) | workflow.acceptance.criterionflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/ac3-ensure-session-human-held-ask-first-ensure-session-on-a-human-held-subject-refuses-never-auto-reclaims-remediation-asks-the-user-to-confirm-before-proceeding-source-the-same-guard-block-s-human-held-branchAC3 `ensure-session-human-held-ask-first`: `ensure-session` on a `human-held` subject refuses (never auto-reclaims), remediation asks the user to confirm before proceeding (source: the same guard block's `human-held` branch) | workflow.acceptance.criterionflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/ac4-ensure-session-self-reentry-ensure-session-resuming-a-session-under-the-same-actor-s-own-fresh-claim-succeeds-with-no-spurious-refusal-source-guard-s-self-is-holder-branchAC4 `ensure-session-self-reentry`: `ensure-session` resuming a session under the SAME actor's own fresh claim succeeds with no spurious refusal (source: guard's `self_is_holder` branch) | workflow.acceptance.criterionflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/ac5-ensure-session-claims-on-free-ensure-session-on-a-free-subject-succeeds-and-establishes-a-durable-local-file-assignment-claim-for-the-entering-actor-verified-via-assignment-provider-status-immediately-after-source-guard-s-free-branch-calling-performlocalclaimAC5 `ensure-session-claims-on-free`: `ensure-session` on a `free` subject succeeds AND establishes a durable local-file assignment claim for the entering actor, verified via `assignment-provider status` immediately after (source: guard's `free` branch calling `performLocalClaim`) | workflow.acceptance.criterionflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/ac6-ensure-session-concurrent-race-safety-two-concurrent-ensure-session-invocations-on-the-same-fresh-free-subject-never-both-become-the-claim-holder-one-wins-and-the-loser-sees-a-held-refused-outcome-on-retry-source-existing-root-level-withlock-in-workflow-sidecar-ts-main-unchanged-plus-withsubjectlock-in-assignment-provider-ts-unchanged-now-reached-via-the-new-exported-performlocalclaim-performlocalsupersedeAC6 `ensure-session-concurrent-race-safety`: two concurrent `ensure-session` invocations on the same fresh-free subject never both become the claim holder, one wins and the loser sees a `held`/refused outcome on retry (source: existing root-level `withLock` in `workflow-sidecar.ts` `main()`, unchanged, plus `withSubjectLock` in `assignment-provider.ts`, unchanged, now reached via the new exported `performLocalClaim`/`performLocalSupersede`) | workflow.acceptance.criterionflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/ac7-current-json-per-actor-isolation-after-actor-b-runs-ensure-session-on-a-different-subject-actor-a-s-own-current-session-resolution-workflow-sidecar-current-actor-aware-still-resolves-to-a-s-own-session-directory-source-per-actor-dual-write-read-in-writecurrent-currentdir-src-cli-workflow-sidecar-tsAC7 `current-json-per-actor-isolation`: after actor B runs `ensure-session` on a different subject, actor A's own current-session resolution (`workflow:sidecar -- current`, actor-aware) still resolves to A's own session directory (source: per-actor dual-write/read in `writeCurrent()`/`currentDir()`, `src/cli/workflow-sidecar.ts`) | workflow.acceptance.criterionflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/ac8-current-json-compat-shim-fallback-an-actor-with-no-per-actor-current-file-yet-or-an-unresolved-actor-still-resolves-via-the-legacy-global-current-json-exactly-as-before-this-change-every-named-existing-consumer-stop-goal-fit-js-evidence-capture-js-liveness-heartbeat-js-flow-agents-statusline-js-produces-identical-output-against-a-legacy-only-pre-migration-artifact-root-fixture-source-fallback-branch-in-scripts-hooks-lib-current-pointer-js-readcurrentpointerAC8 `current-json-compat-shim-fallback`: an actor with no per-actor current file yet, or an unresolved actor, still resolves via the legacy global `current.json` exactly as before this change; every named existing consumer (`stop-goal-fit.js`, `evidence-capture.js`, `liveness-heartbeat.js`, `flow-agents-statusline.js`) produces identical output against a legacy-only pre-migration artifact root fixture (source: fallback branch in `scripts/hooks/lib/current-pointer.js` `readCurrentPointer()`) | workflow.acceptance.criterionflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/ac9-remediation-sanitized-refusal-remediation-messages-never-contain-raw-control-ansi-bytes-from-actor-holder-assignee-reason-fields-verified-against-a-crafted-hostile-liveness-event-and-a-hostile-effective-state-json-fixture-source-reuse-of-stripcontrolcharsfordisplay-already-in-workflow-sidecar-ts-at-every-interpolation-site-in-the-new-guard-s-die-messagesAC9 `remediation-sanitized`: refusal/remediation messages never contain raw control/ANSI bytes from actor/holder/assignee/reason fields, verified against a crafted hostile liveness event and a hostile `--effective-state-json` fixture (source: reuse of `stripControlCharsForDisplay`, already in `workflow-sidecar.ts`, at every interpolation site in the new guard's `die()` messages) | workflow.acceptance.criterionflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/ac10-config-protection-covers-per-actor-current-config-protection-js-s-protected-path-and-bash-redirect-detectors-block-direct-writes-redirects-to-kontourai-flow-agents-current-actor-json-exactly-as-they-already-do-for-kontourai-flow-agents-current-json-source-new-pattern-in-checkprotectedpathpattern-and-redirect-protected-reAC10 `config-protection-covers-per-actor-current`: `config-protection.js`'s protected-path and Bash-redirect detectors block direct writes/redirects to `.kontourai/flow-agents/current/<actor>.json` exactly as they already do for `.kontourai/flow-agents/current.json` (source: new pattern in `checkProtectedPathPattern` and `REDIRECT_PROTECTED_RE`) | workflow.acceptance.criterionflow-agents.workflow | pass |
| verified | kontourai-flow-agents-291/ac11-gate-scoping-actor-correct-record-gate-claim-writetrustbundle-s-flowdefinition-dual-emit-scoping-resolves-active-flow-id-active-step-id-from-the-calling-actor-s-own-current-pointer-not-a-different-actor-s-more-recently-written-legacy-pointer-source-actor-aware-update-to-declaredclaimtypesfor-writetrustbundle-s-scopedflowagentsdir-check-and-resolveactiveflowstep-in-src-lib-flow-resolver-tsAC11 `gate-scoping-actor-correct`: `record-gate-claim` / `writeTrustBundle`'s FlowDefinition dual-emit scoping resolves `active_flow_id`/`active_step_id` from the CALLING actor's own current-pointer, not a different actor's more-recently-written legacy pointer (source: actor-aware update to `declaredClaimTypesFor()`, `writeTrustBundle`'s `_scopedFlowAgentsDir` check, and `resolveActiveFlowStep()` in `src/lib/flow-resolver.ts`) | workflow.acceptance.criterionflow-agents.workflow | pass |