loki-mode 10.5.16 → 10.5.17

package/.claude-plugin/marketplace.json

@@ -23,6 +23,18 @@
         "mcp",
         "loki"
       ]
+    },
+    {
+      "name": "loki-seal",
+      "source": "./packages/loki-seal",
+      "description": "Stop hook that refuses 'done' while tests are red or were deleted, skipped, xfailed or weakened. Runs locally, no model calls.",
+      "homepage": "https://github.com/asklokesh/loki-mode",
+      "category": "testing",
+      "keywords": [
+        "verification",
+        "tests",
+        "hooks"
+      ]
     }
   ]
 }

package/README.md

@@ -1,6 +1,8 @@
 Your agent says done. Loki proves it.
 
 An autonomous software factory that knows what it is supposed to deliver, and proves it did.
+Install: `/plugin marketplace add asklokesh/loki-mode` then `/plugin install loki-seal@loki-mode`
+
 
 <!-- 20-second loki-seal GIF: placeholder until recorded. Script: packages/loki-seal/demo/demo.tape -->
 [loki-seal demo script](packages/loki-seal/demo/demo.tape)

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v10.5.16
+# Loki Mode v10.5.17
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v10.5.16 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v10.5.17 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-10.5.16
+10.5.17

package/autonomy/lib/backlog.py

@@ -0,0 +1,280 @@
+#!/usr/bin/env python3
+"""loki backlog: run one v10 issue-mode run per open issue, N in parallel (D51).
+
+    loki backlog owner/repo --all | --label X | --issues 1,2,3
+                 [--concurrency N] [--dry-run]
+
+Each issue gets its own git worktree and branch (loki/backlog-N) beside the
+checkout; the launcher runs inside it. Success = the child exited 0 (the engine's
+ladder: 0 VERIFIED, 1 FAILED, 3 BUDGET_STOP, 4 BLOCKED, 5 STALLED). A draft PR
+from a failed run is still FAILED. Exit: 0 all ok, 3 only budget stops, 1 other
+failures, 2 usage/config error.
+
+Test seam: LOKI_BACKLOG_LAUNCHER replaces the real launcher (called with the
+issue ref, cwd = the issue worktree).
+"""
+import argparse
+import datetime
+import json
+import os
+import re
+import shutil
+import signal
+import subprocess
+import sys
+import time
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+import loki_yaml  # noqa: E402
+
+REPO_ROOT = os.path.abspath(os.path.join(HERE, "..", ".."))
+REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
+
+
+def say(msg):
+    print(msg, flush=True)
+
+
+def die(msg, rc=2):
+    print("loki backlog: " + msg, file=sys.stderr)
+    return rc
+
+
+def redact(text, token):
+    return text.replace(token, "***") if token and len(token) >= 6 else text
+
+
+def git(*args, cwd=None):
+    return subprocess.run(["git", *args], cwd=cwd, capture_output=True, text=True)
+
+
+def origin_slug(cwd):
+    url = git("remote", "get-url", "origin", cwd=cwd).stdout.strip()
+    m = re.search(r"github\.com[:/]([^/]+/[^/]+?)(?:\.git)?/?$", url)
+    return m.group(1) if m else ""
+
+
+def list_issues(repo, label, env):
+    cmd = ["gh", "issue", "list", "--repo", repo, "--state", "open", "--limit", "200",
+           "--json", "number,title,labels"]
+    if label:
+        cmd += ["--label", label]
+    r = subprocess.run(cmd, capture_output=True, text=True, env=env)
+    if r.returncode != 0:
+        raise RuntimeError("gh issue list failed: " + (r.stderr.strip().splitlines() or ["unknown error"])[0])
+    return sorted(({"number": i["number"], "title": i.get("title", "")} for i in json.loads(r.stdout or "[]")),
+                  key=lambda i: i["number"])
+
+
+# ---- daily spend ledger (outside any worktree) -----------------------------
+def ledger_path():
+    return os.path.join(os.path.expanduser("~"), ".loki", "backlog-spend.json")
+
+
+def spent_today():
+    try:
+        with open(ledger_path()) as f:
+            return float(json.load(f).get(datetime.date.today().isoformat(), 0))
+    except (OSError, ValueError):
+        return 0.0
+
+
+def add_spend(usd):
+    p = ledger_path()
+    try:
+        with open(p) as f:
+            data = json.load(f)
+    except (OSError, ValueError):
+        data = {}
+    k = datetime.date.today().isoformat()
+    data[k] = round(float(data.get(k, 0)) + usd, 6)
+    os.makedirs(os.path.dirname(p), exist_ok=True)
+    with open(p, "w") as f:
+        json.dump(data, f)
+
+
+def parse_result(rc, text):
+    """-> (ok, status line text, cost_usd or None)."""
+    pr = re.search(r"^PR:\s+(https?://\S+)", text, re.M)
+    why = re.search(r"^Reason:\s+(.+)$", text, re.M)
+    cost = re.search(r"^Cost:\s+(?:partial:\s+)?\$([0-9]+(?:\.[0-9]+)?)", text, re.M)
+    usd = float(cost.group(1)) if cost else None
+    reason = why.group(1).strip() if why else ""
+    if rc == 0:
+        return True, ("PR " + pr.group(1)) if pr else "VERIFIED", usd
+    if rc == 4:
+        return False, "BLOCKED: " + (reason or "see the run log"), usd
+    if rc == 3:
+        return False, "BUDGET_STOP: " + (reason or "run cost cap reached"), usd
+    return False, "FAILED: " + (reason or "exit %d" % rc), usd
+
+
+def main(argv):
+    ap = argparse.ArgumentParser(prog="loki backlog", add_help=True)
+    ap.add_argument("repo")
+    sel = ap.add_mutually_exclusive_group()
+    sel.add_argument("--all", action="store_true")
+    sel.add_argument("--label")
+    sel.add_argument("--issues")
+    ap.add_argument("--concurrency", type=int)
+    ap.add_argument("--dry-run", action="store_true")
+    a = ap.parse_args(argv)
+
+    if not REPO_RE.match(a.repo):
+        return die("repo must be owner/repo, got %r" % a.repo)
+    if not (a.all or a.label or a.issues):
+        return die("choose one of --all, --label X, --issues 1,2,3")
+    numbers = None
+    if a.issues:
+        if not re.match(r"^\d+(,\d+)*$", a.issues):
+            return die("--issues takes a comma-separated list of numbers, got %r" % a.issues)
+        numbers = [int(n) for n in a.issues.split(",")]
+
+    try:
+        cfg, cfg_path, errors = loki_yaml.load()
+    except loki_yaml.CannotCheck as e:
+        return die("could not read loki.yaml: %s" % e)
+    if errors:
+        print("loki backlog: invalid configuration (%s):" % (cfg_path or "environment"), file=sys.stderr)
+        for e in errors:
+            print("  - " + e, file=sys.stderr)
+        return 2
+    conc = a.concurrency or cfg.get("concurrency", 2)
+    if conc < 1:
+        return die("--concurrency must be >= 1")
+
+    env = dict(os.environ)
+    token = ""
+    tok_env = cfg.get("git", {}).get("token_env")
+    if tok_env:
+        token = os.environ.get(tok_env, "")
+        if not token:
+            return die("git.token_env names %s but that environment variable is not set" % tok_env)
+        env["GH_TOKEN"] = env["GITHUB_TOKEN"] = token
+
+    top = git("rev-parse", "--show-toplevel").stdout.strip()
+    if not top:
+        return die("run this from a checkout of %s" % a.repo)
+    if origin_slug(top).lower() != a.repo.lower():
+        return die("this checkout's origin is %r, not %s; cd into a checkout of %s"
+                   % (origin_slug(top) or "unknown", a.repo, a.repo))
+
+    try:
+        issues = ([{"number": n, "title": ""} for n in numbers] if numbers
+                  else list_issues(a.repo, a.label, env))
+    except RuntimeError as e:
+        return die(redact(str(e), token), 1)
+
+    say("backlog: %s concurrency %d, %d issue(s)" % (a.repo, conc, len(issues)))
+    if a.dry_run:
+        for i in issues:
+            say("backlog: would run #%d %s" % (i["number"], i["title"]))
+        return 0
+    if not issues:
+        say("backlog: nothing to do")
+        return 0
+
+    # ---- launch ------------------------------------------------------------
+    wt_root = top.rstrip("/") + "-backlog"
+    os.makedirs(os.path.join(wt_root, "logs"), exist_ok=True)
+    launcher = os.environ.get("LOKI_BACKLOG_LAUNCHER") or os.path.join(REPO_ROOT, "bin", "loki")
+    child_env = dict(env, LOKI_ENGINE="v10", LOKI_NO_BROWSER="1")
+    for key, var in (("models.default", "LOKI_MODEL_DEVELOPMENT"), ("models.cheap", "LOKI_MODEL_FAST")):
+        sect, name = key.split(".")
+        if cfg.get(sect, {}).get(name):
+            child_env[var] = cfg[sect][name]
+    if cfg.get("provider"):
+        child_env["LOKI_PROVIDER"] = cfg["provider"]
+    # ponytail: per-run cap is forwarded only; the v10 engine itself caps on time
+    if cfg.get("budgets", {}).get("per_run_usd"):
+        child_env["LOKI_BUDGET_LIMIT"] = str(cfg["budgets"]["per_run_usd"])
+    day_cap = cfg.get("budgets", {}).get("per_day_usd")
+
+    state = {i["number"]: {"status": "queued", "ok": None, "cost": None, "ran": False} for i in issues}
+    for n in state:
+        say("backlog: #%d queued" % n)
+    pending = [i["number"] for i in issues]
+    running = {}  # n -> (Popen, log path, worktree)
+    unmeasured = 0
+
+    def stop_children(*_):
+        for p, _l, _w in running.values():
+            try:
+                os.killpg(p.pid, signal.SIGTERM)
+            except OSError:
+                pass
+        sys.exit(130)
+    signal.signal(signal.SIGTERM, stop_children)
+    signal.signal(signal.SIGINT, stop_children)
+
+    def finish(n):
+        nonlocal unmeasured
+        p, log, wt = running.pop(n)
+        try:
+            with open(log, errors="replace") as f:
+                text = redact(f.read(), token)
+            with open(log, "w") as f:
+                f.write(text)
+        except OSError:
+            text = ""
+        ok, status, usd = parse_result(p.returncode, text)
+        if usd is None:
+            unmeasured += 1
+        else:
+            add_spend(usd)
+        state[n].update(status=status, ok=ok, cost=usd)
+        say("backlog: #%d %s" % (n, status))
+        if ok:
+            git("worktree", "remove", "--force", wt, cwd=top)
+            git("branch", "-D", "loki/backlog-%d" % n, cwd=top)
+
+    def launch(n):
+        wt = os.path.join(wt_root, "issue-%d" % n)
+        if os.path.exists(wt):
+            git("worktree", "remove", "--force", wt, cwd=top)
+        r = git("worktree", "add", "-B", "loki/backlog-%d" % n, wt, "HEAD", cwd=top)
+        if r.returncode != 0:
+            err = (r.stderr.strip().splitlines() or ["git error"])[-1]
+            state[n].update(status="FAILED: worktree: " + redact(err, token), ok=False)
+            say("backlog: #%d %s" % (n, state[n]["status"]))
+            return
+        log = os.path.join(wt_root, "logs", "issue-%d.log" % n)
+        cmd = [launcher, "%s#%d" % (a.repo, n)]
+        with open(log, "w") as lf:
+            p = subprocess.Popen(cmd, cwd=wt, env=child_env, stdout=lf, stderr=subprocess.STDOUT,
+                                 stdin=subprocess.DEVNULL, start_new_session=True)
+        running[n] = (p, log, wt)
+        state[n].update(status="running", ran=True)
+        say("backlog: #%d running" % n)
+
+    while pending or running:
+        for n in [n for n, (p, _l, _w) in running.items() if p.poll() is not None]:
+            finish(n)
+        while pending and len(running) < conc:
+            if day_cap and spent_today() >= day_cap:
+                for n in pending:
+                    state[n].update(status="BUDGET_STOP: daily budget $%.2f reached ($%.2f spent)" % (day_cap, spent_today()), ok=False)
+                    say("backlog: #%d %s" % (n, state[n]["status"]))
+                pending = []
+                break
+            launch(pending.pop(0))
+        if running:
+            time.sleep(0.2)
+
+    # ---- summary -----------------------------------------------------------
+    say("")
+    say("Summary: %s" % a.repo)
+    say("%-8s %-8s %s" % ("ISSUE", "COST", "RESULT"))
+    for n, s in state.items():
+        say("%-8s %-8s %s" % ("#%d" % n, ("$%.2f" % s["cost"] if s["cost"] is not None else "unmeasured" if s["ran"] else "-"), s["status"]))
+    measured = sum(s["cost"] or 0 for s in state.values())
+    say("Total measured cost: $%.2f%s" % (measured, " (%d run(s) unmeasured, not counted as $0)" % unmeasured if unmeasured else ""))
+    bad = [s for s in state.values() if not s["ok"]]
+    if not bad:
+        return 0
+    return 3 if all(s["status"].startswith("BUDGET_STOP") for s in bad) else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/autonomy/lib/loki_yaml.py

@@ -0,0 +1,225 @@
+#!/usr/bin/env python3
+"""loki.yaml: lookup, env overrides and validation (D51).
+
+Shared by `loki backlog`, `loki config validate` and the dashboard.
+Single source of truth for the key set: schemas/loki-yaml.schema.json.
+
+    from loki_yaml import load
+    cfg, path, errors = load()
+
+CLI:
+    loki_yaml.py validate [FILE]    rc 0 ok, 1 invalid or none found, 2 cannot check
+    loki_yaml.py show               effective config as JSON (env overrides applied)
+
+Never echoes a string value for an x-secret-ref field: a user who pastes a real
+token into token_env must not see it printed back.
+"""
+import json
+import os
+import subprocess
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+SCHEMA_PATH = os.path.join(HERE, "..", "..", "schemas", "loki-yaml.schema.json")
+
+# dotted key -> env var (CLI flag > env > loki.yaml > default)
+ENV_OVERRIDES = {
+    "provider": "LOKI_PROVIDER",
+    "models.default": "LOKI_MODEL_DEVELOPMENT",
+    "models.cheap": "LOKI_MODEL_FAST",
+    "git.token_env": "LOKI_GIT_TOKEN_ENV",
+    "concurrency": "LOKI_BACKLOG_CONCURRENCY",
+    "budgets.per_run_usd": "LOKI_BUDGET_PER_RUN_USD",
+    "budgets.per_day_usd": "LOKI_BUDGET_PER_DAY_USD",
+    "notifications.slack_webhook_env": "LOKI_SLACK_WEBHOOK_ENV",
+}
+
+
+class CannotCheck(Exception):
+    """No usable YAML parser: callers must not read this as 'valid'."""
+
+
+def load_schema():
+    with open(SCHEMA_PATH) as f:
+        return json.load(f)
+
+
+def find_config(cwd=None, home=None):
+    """Repo-root loki.yaml first, else ~/.loki/loki.yaml. First found wins."""
+    cwd = cwd or os.getcwd()
+    home = home or os.path.expanduser("~")
+    try:
+        top = subprocess.run(["git", "-C", cwd, "rev-parse", "--show-toplevel"],
+                             capture_output=True, text=True).stdout.strip()
+    except OSError:
+        top = ""
+    for cand in (os.path.join(top or cwd, "loki.yaml"),
+                 os.path.join(home, ".loki", "loki.yaml")):
+        if os.path.isfile(cand):
+            return cand
+    return None
+
+
+def parse_yaml(path):
+    try:
+        import yaml
+        with open(path) as f:
+            return yaml.safe_load(f)
+    except ImportError:
+        pass
+    try:
+        r = subprocess.run(["yq", "eval", "-o=json", ".", path], capture_output=True, text=True)
+    except OSError:
+        raise CannotCheck("no YAML parser: install PyYAML (pip install pyyaml) or yq")
+    if r.returncode != 0:
+        raise ValueError("invalid YAML: " + (r.stderr.strip().splitlines() or ["parse error"])[0])
+    return json.loads(r.stdout)
+
+
+def _type_ok(val, t):
+    if t == "object":
+        return isinstance(val, dict)
+    if t == "array":
+        return isinstance(val, list)
+    if t == "string":
+        return isinstance(val, str)
+    if t == "integer":
+        return isinstance(val, int) and not isinstance(val, bool)
+    if t == "number":
+        return isinstance(val, (int, float)) and not isinstance(val, bool)
+    return True
+
+
+def validate(data, schema, path="", out=None):
+    """Validate against the JSON-schema subset used by loki-yaml.schema.json."""
+    import re
+    out = [] if out is None else out
+    label = path or "(top level)"
+    t = schema.get("type")
+    secret = schema.get("x-secret-ref")
+    shown = "" if secret or not isinstance(data, (str, int, float)) else " (got %r)" % (data,)
+    if t and not _type_ok(data, t):
+        out.append("%s: must be %s%s" % (label, {"integer": "an integer", "object": "a mapping",
+                   "array": "a list", "string": "a string", "number": "a number"}[t], shown))
+        return out
+    if isinstance(data, dict):
+        props = schema.get("properties", {})
+        for k, v in data.items():
+            kp = (path + "." if path else "") + str(k)
+            if k not in props:
+                if schema.get("additionalProperties") is False:
+                    out.append("%s: unknown key (allowed: %s)" % (kp, ", ".join(sorted(props))))
+            else:
+                validate(v, props[k], kp, out)
+    elif isinstance(data, list):
+        for i, v in enumerate(data):
+            validate(v, schema.get("items", {}), "%s[%d]" % (path, i), out)
+    elif isinstance(data, str):
+        if secret and not re.match(schema.get("pattern", ""), data):
+            out.append("%s: must be the NAME of an environment variable (UPPER_CASE letters, "
+                       "digits, underscore), not the secret itself" % label)
+        elif "pattern" in schema and not re.match(schema["pattern"], data):
+            out.append("%s: does not match %s%s" % (label, schema["pattern"], shown))
+        elif "enum" in schema and data not in schema["enum"]:
+            out.append("%s: must be one of %s%s" % (label, ", ".join(schema["enum"]), shown))
+        elif len(data) < schema.get("minLength", 0):
+            out.append("%s: must not be empty" % label)
+    if _type_ok(data, "number") and not isinstance(data, bool):
+        if "minimum" in schema and data < schema["minimum"]:
+            out.append("%s: must be >= %s%s" % (label, schema["minimum"], shown))
+        elif "maximum" in schema and data > schema["maximum"]:
+            out.append("%s: must be <= %s%s" % (label, schema["maximum"], shown))
+        elif "exclusiveMinimum" in schema and data <= schema["exclusiveMinimum"]:
+            out.append("%s: must be > %s%s" % (label, schema["exclusiveMinimum"], shown))
+    return out
+
+
+def _schema_type(schema, dotted):
+    for part in dotted.split("."):
+        schema = schema["properties"][part]
+    return schema.get("type")
+
+
+def apply_env(cfg, schema, env):
+    """Overlay env overrides onto cfg. Returns {dotted_key: env_var} of what was applied."""
+    applied = {}
+    for dotted, var in ENV_OVERRIDES.items():
+        raw = env.get(var)
+        if raw is None or raw == "":
+            continue
+        val = raw
+        t = _schema_type(schema, dotted)
+        try:
+            if t == "integer":
+                val = int(raw)
+            elif t == "number":
+                val = float(raw)
+        except ValueError:
+            pass  # stays a string; validation reports it, naming the env var
+        node = cfg
+        parts = dotted.split(".")
+        for p in parts[:-1]:
+            node = node.setdefault(p, {})
+        node[parts[-1]] = val
+        applied[dotted] = var
+    return applied
+
+
+def load(cwd=None, env=None, home=None, path=None):
+    """Return (cfg, path_or_None, errors). Raises CannotCheck when YAML cannot be parsed."""
+    env = os.environ if env is None else env
+    schema = load_schema()
+    path = path or find_config(cwd, home)
+    cfg, errors = {}, []
+    if path:
+        try:
+            data = parse_yaml(path)
+        except CannotCheck:
+            raise
+        except Exception as e:
+            return {}, path, ["%s: %s" % (path, e)]
+        if data is None:
+            data = {}
+        if not isinstance(data, dict):
+            return {}, path, ["%s: top level must be a mapping" % path]
+        cfg = data
+    applied = apply_env(cfg, schema, env)
+    for e in validate(cfg, schema):
+        key = e.split(":", 1)[0]
+        if key in applied:
+            e = e.replace(key + ":", "%s (from env %s):" % (key, applied[key]), 1)
+        errors.append(e)
+    return cfg, path, errors
+
+
+def main(argv):
+    cmd = argv[0] if argv else ""
+    if cmd not in ("validate", "show"):
+        print("usage: loki_yaml.py validate [FILE] | show", file=sys.stderr)
+        return 2
+    explicit = argv[1] if cmd == "validate" and len(argv) > 1 else None
+    if explicit and not os.path.isfile(explicit):
+        print("loki: config validate: file not found: %s" % explicit, file=sys.stderr)
+        return 1
+    try:
+        cfg, path, errors = load(path=explicit)
+    except CannotCheck as e:
+        print("loki: config validate: could not check: %s" % e, file=sys.stderr)
+        return 2
+    if cmd == "show":
+        print(json.dumps({"path": path, "config": cfg, "errors": errors}, indent=2))
+        return 1 if errors else 0
+    if path is None and not errors:
+        print("loki: no loki.yaml found (looked in the repo root and ~/.loki/loki.yaml)", file=sys.stderr)
+        return 1
+    if errors:
+        print("INVALID: %s" % (path or "environment overrides"))
+        for e in errors:
+            print("  - " + e)
+        return 1
+    print("OK: %s" % path)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/autonomy/loki

@@ -1627,6 +1627,7 @@ show_help() {
     echo "Build:"
     echo "  start [SPEC]     Start a build (PRD file, GitHub/GitLab/Jira/Azure issue, or no arg)"
     echo "  plan <PRD-file>  Dry-run analysis: complexity, cost, execution plan"
+    echo "  backlog <owner/repo> --all|--label X|--issues N,N   Run every matching open issue, N in parallel"
     echo "  quickstart [idea]  Guided first build: setup, idea, template, plan, go"
     echo ""
     echo "Session:"
@@ -1765,7 +1766,7 @@ show_help() {
     # missing from this list, so a new command cannot ship invisible.
     echo ""
     echo "All commands:"
-    echo "  agent analyze api assets audit bench checkpoint (cp) ci cleanup"
+    echo "  agent analyze api assets audit backlog bench checkpoint (cp) ci cleanup"
     echo "  cluster cockpit code compliance completions compound config context (ctx)"
     echo "  cost council crash dashboard demo deploy docker docs doctor dogfood"
     echo "  enterprise estimate explain export failover github grill heal help"
@@ -9306,6 +9307,32 @@ _deploy_receipt_verdict() {
     # evaluated, so no key set is written and the verdict is UNCHECKED, never
     # TAMPERED: the hash is fine, we just cannot vouch for who signed it. A
     # local key only proves "a holder of this key", not an independent build.
+    # Token SHAPE before any key lookup (mirrors engine10 checkAttestation): a present
+    # attestation that is not a string, not a 3-part JWS, or whose header/payload are not
+    # JSON with alg EdDSA is junk, so TAMPERED, never UNCHECKED, with or without a key.
+    if ! python3 -E - "$pj" >/dev/null 2>&1 <<'PYSHAPE'
+import sys
+sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+import json, base64
+def dec(x):
+    return json.loads(base64.urlsafe_b64decode(x + "=" * (-len(x) % 4)))
+v = json.load(open(sys.argv[1])).get("verification") or {}
+t = v.get("attestation")
+if t is None or t == "":
+    sys.exit(0)
+if not isinstance(t, str):
+    sys.exit(1)
+parts = t.split(".")
+if len(parts) != 3 or not all(parts):
+    sys.exit(1)
+try:
+    h = dec(parts[0]); dec(parts[1])
+except Exception:
+    sys.exit(1)
+sys.exit(0 if isinstance(h, dict) and h.get("alg") == "EdDSA" else 1)
+PYSHAPE
+    then printf '%s' "TAMPERED"; return 0; fi
+
     local jwks att
     jwks="$(mktemp "${TMPDIR:-/tmp}/loki-jwks.XXXXXX")" || { printf '%s' "UNCHECKED"; return 0; }
     python3 -E - "${_LOKI_SCRIPT_DIR}" "$pj" >"$jwks" 2>/dev/null <<'PY' || true
@@ -12593,7 +12620,7 @@ cmd_config() {
             echo "  get KEY         Get a configuration value"
             echo "  example         Print an annotated config template (for --config)"
             echo "  schema          Print the key -> env-var mapping table"
-            echo "  validate FILE   Validate a config file (--config) without applying it"
+            echo "  validate [FILE] Validate loki.yaml (no FILE: repo root, then ~/.loki) or a --config file"
             echo ""
             echo "Settable keys (v6.0.0):"
             echo "  maxTier              Cost ceiling: opus, sonnet, haiku (default: opus)"
@@ -12797,14 +12824,43 @@ cmd_config_schema() {
     loki_config_generate_schema
 }
 
+# D51: headless backlog runner. One v10 issue-mode run per open issue, each in
+# its own worktree and branch, at most N in parallel (loki.yaml concurrency).
+cmd_backlog() {
+    case "${1:-}" in
+        ""|--help|-h|help)
+            echo -e "${BOLD}loki backlog${NC} - run a v10 issue-mode run for every matching open issue"
+            echo ""
+            echo "Usage: loki backlog owner/repo (--all | --label X | --issues 1,2,3) [--concurrency N] [--dry-run]"
+            echo ""
+            echo "  --all             Every open issue"
+            echo "  --label X         Open issues with label X"
+            echo "  --issues 1,2,3    Exactly these issue numbers"
+            echo "  --concurrency N   Max runs in parallel (default: loki.yaml concurrency, else 2)"
+            echo "  --dry-run         List what would run; launch nothing"
+            echo ""
+            echo "Run from a checkout of owner/repo. Each issue runs in its own worktree on loki/backlog-N."
+            echo "Config: loki.yaml (repo root, then ~/.loki/loki.yaml); see docs/loki.yaml.example."
+            echo "Exit: 0 every issue ended VERIFIED or with a PR; 3 only budget stops; 1 otherwise; 2 usage."
+            return 0
+            ;;
+    esac
+    command -v python3 >/dev/null 2>&1 || { echo -e "${RED}loki backlog: python3 is required${NC}" >&2; return 2; }
+    python3 "$_LOKI_SCRIPT_DIR/lib/backlog.py" "$@"
+}
+
 # #691: validate a config file (--config) WITHOUT applying it. Reports
 # unresolved ${VAR} refs, raw-secret literals (error), and per-value validation
 # failures. Non-zero exit on any failure.
 cmd_config_validate() {
-    local file="${1:-}"
-    if [ -z "$file" ]; then
-        echo -e "${RED}Usage: loki config validate <file>${NC}" >&2
-        return 2
+    local file="${1:-}" _loki_yaml
+    # D51: loki.yaml (UI + headless config) has its own schema; no argument
+    # validates the discovered loki.yaml (repo root, then ~/.loki/loki.yaml).
+    case "$(basename -- "$file")" in "" | loki.yaml | loki.yml | loki.yaml.example) _loki_yaml=1 ;; *) _loki_yaml=0 ;; esac
+    if [ "$_loki_yaml" = 1 ]; then
+        command -v python3 >/dev/null 2>&1 || { echo -e "${RED}config validate: python3 is required${NC}" >&2; return 2; }
+        python3 "$_LOKI_SCRIPT_DIR/lib/loki_yaml.py" validate ${file:+"$file"}
+        return $?
     fi
     if ! declare -f loki_config_validate_file >/dev/null 2>&1; then
         echo -e "${RED}config validate: config-map.sh helper not loaded${NC}" >&2
@@ -21767,6 +21823,9 @@ main() {
         assets)
             cmd_assets "$@"
             ;;
+        backlog)
+            cmd_backlog "$@"
+            ;;
         config)
             cmd_config "$@"
             ;;