loki-mode 10.5.16 → 10.5.19

package/autonomy/lib/proof-generator.py

@@ -1115,6 +1115,230 @@ def _empty_tree_sha(repo_dir):
     return out.stdout.strip() if out.returncode == 0 else ""
 
 
+# A-118 / D47: tests_integrity. Did the run WEAKEN the tests that vouch for it?
+# CFG_ALWAYS is copied from loki-ts/src/engine10/stages/verify.ts (A-115); keep in sync.
+# The comparison is base vs the final WORKING TREE plus untracked files (like
+# collect_workspace_diff), so uncommitted work is covered.
+_TI_CFG_ALWAYS = re.compile(r"(^|/)(conftest\.py|\.?pytest\.(?:ini|toml)|tox\.ini|jest\.config\.[\w.]+|vitest\.config\.[\w.]+|\.mocharc[\w.]*)$")
+_TI_CFG_SHARED = re.compile(r"(^|/)(setup\.cfg|pyproject\.toml|package\.json)$")
+_TI_TEST_FILE = re.compile(
+    r"(^|/)(tests?|__tests__|spec|specs)/|\.(test|spec)\.[\w]+$|(^|/)test_[^/]*\.py$|_test\.(py|go|rs)$|(^|/)conftest\.py$")
+_TI_SKIP_JS = re.compile(
+    # options object only as the 2nd argument: title (string or identifier), then `, {`
+    r"\b(test|it|describe|suite|context|specify)\s*\(\s*(?:'[^'\n]*'|\"[^\"\n]*\"|`[^`\n]*`|[\w.$]+)\s*,\s*\{[^}]*\b(skip|todo)\s*:\s*(?!(?:false|0|null|undefined)\b)\S"
+    r"|\b(it|test|describe|suite|context|specify)\s*\.\s*(skip|only|todo)\b"
+    r"|\bx(it|test|describe)\s*\(|\bf(it|describe)\s*\("
+    r"|\b(t|ctx)\s*\.\s*(skip|todo)\s*\(")
+_TI_SKIP_PY = re.compile(
+    r"\b(?:pytest\.)?mark\.(skip|skipif|xfail)\b|\bpytest\.(skip|xfail|importorskip)\s*\("
+    r"|@(?:unittest\.)?(skip|skipIf|skipUnless|expectedFailure)\b|\bSkipTest\b|\bskipTest\s*\(")
+_TI_SKIP_GO = re.compile(r"\b[tb]\.Skip(f|Now)?\s*\(")
+_TI_SKIP_RS = re.compile(r"#\[ignore")
+_TI_SKIP_BY_EXT = (
+    (("js", "jsx", "ts", "tsx", "mjs", "cjs"), _TI_SKIP_JS),
+    (("py",), _TI_SKIP_PY), (("go",), _TI_SKIP_GO), (("rs",), _TI_SKIP_RS))
+_TI_ASSERT = re.compile(r"\bassert|\bexpect\(|\.should\b|\.to[A-Z]\w*\(|\bt\.(Error|Fatal)")
+_TI_PKG_KEYS = ("jest", "mocha", "vitest", "ava")
+
+
+def _ti_skip_re(path):
+    ext = path.rsplit(".", 1)[-1].lower() if "." in path else ""
+    for exts, rx in _TI_SKIP_BY_EXT:
+        if ext in exts:
+            return rx
+    return None
+
+
+def _ti_run(repo, *args):
+    """Run a read-only git command; returns text decoded from bytes (so a lone
+    CR is never a line break; callers split on \\n only), or None on failure."""
+    try:
+        r = subprocess.run(["git", "-c", "core.quotePath=false", *args], cwd=repo,
+                           capture_output=True, timeout=30)
+    except Exception:
+        return None
+    if r.returncode != 0:
+        return None
+    return r.stdout.decode("utf-8", "replace")
+
+
+def _ti_pkg_view(text, _path=""):
+    """Test-relevant slice of a package.json, or None when unparseable."""
+    try:
+        d = json.loads(text) if text.strip() else {}
+    except ValueError:
+        return None
+    if not isinstance(d, dict):
+        return None
+    scripts = d.get("scripts") if isinstance(d.get("scripts"), dict) else {}
+    view = {k: v for k, v in scripts.items() if re.match(r"^(pre|post)?test(:.*)?$", k)}
+    return {"scripts": view, **{k: d[k] for k in _TI_PKG_KEYS if k in d}}
+
+
+_TI_PYTEST_KEYS = ("addopts", "testpaths", "python_files", "python_functions",
+                   "python_classes", "norecursedirs")
+
+
+def _ti_pytest_view(text, path):
+    """The test-selection keys of a pytest config, or None when unparseable.
+    Parsed (tomllib / configparser), so a multi-line addopts edit is seen.
+    ponytail: without tomllib (python < 3.11) try tomli, else compare only the
+    whitespace-normalized [tool.pytest.ini_options] section text."""
+    if not text.strip():
+        return {}
+    if path.endswith(".toml"):
+        try:
+            try:
+                import tomllib
+            except ImportError:
+                import tomli as tomllib
+        except ImportError:
+            m = re.search(r"^\[tool\.pytest\.ini_options\][ \t]*(?:#.*)?$(.*?)(?=^\[[^\[\]\n]+\][ \t]*(?:#.*)?$|\Z)",
+                          text, re.M | re.S)
+            return {"ini_options": " ".join(m.group(1).split())} if m else {}
+        try:
+            d = tomllib.loads(text)
+        except Exception:
+            return None
+        t = d.get("tool", {}).get("pytest", {})
+        t = t.get("ini_options", t) if isinstance(t, dict) else {}
+        return {k: t[k] for k in _TI_PYTEST_KEYS if k in t}
+    import configparser
+    cp = configparser.ConfigParser(interpolation=None, strict=False)
+    try:
+        cp.read_string(text)
+    except Exception:
+        return None
+    out = {}
+    for sec in ("pytest", "tool:pytest"):
+        if cp.has_section(sec):
+            for k in _TI_PYTEST_KEYS:
+                if cp.has_option(sec, k):
+                    out[sec + "." + k] = cp.get(sec, k)
+    return out
+
+
+_TI_SELECT_PY = re.compile(r"\bcollect_ignore(?:_glob)?\b|\bpytest_collection_modifyitems\b")
+_TI_PYTEST_NAMED = re.compile(r"(^|/)(conftest\.py|\.?pytest\.ini|tox\.ini)$")
+
+
+def _ti_base_has_pytest_config(target_dir, base):
+    names = _ti_run(target_dir, "ls-tree", "-r", "--name-only", "-z", base) or ""
+    for n in names.split("\0"):
+        if _TI_PYTEST_NAMED.search(n):
+            return True
+        if n.endswith(("pyproject.toml", "setup.cfg")) and \
+                _ti_pytest_view(_ti_run(target_dir, "show", "%s:./%s" % (base, n)) or "", n):
+            return True
+    return False
+
+
+def _ti_added_config_selects(path, text):
+    """True when a newly added pytest config changes test selection (unparseable counts)."""
+    if path.endswith(".py"):
+        return bool(_TI_SELECT_PY.search(text))
+    if path.endswith((".ini", ".toml", ".cfg")):
+        v = _ti_pytest_view(text, path)
+        return v is None or bool(v)
+    return False
+
+
+def _collect_tests_integrity(target_dir, base):
+    """Return {"weakened": [...], "assertions_edited": [...], "disclosed": [...]} or None.
+
+    Derived from base vs the final working tree (committed, staged, unstaged and
+    untracked). None when there is no usable diff (no repo, no base)."""
+    if not base:
+        return None
+    names = _ti_run(target_dir, "diff", "--relative", "--name-status", "-M", "-z", base, "--")
+    if names is None:
+        return None
+    weakened, edited, disclosed = [], [], []
+    greenfield = base == _empty_tree_sha(target_dir)
+    toks = names.split("\0")
+    entries, i = [], 0  # (status, old_path, new_path)
+    while i < len(toks) and toks[i]:
+        st = toks[i][:1]
+        if st in "RC" and i + 2 < len(toks):
+            entries.append((st, toks[i + 1], toks[i + 2]))
+            i += 3
+        else:
+            entries.append((st, toks[i + 1] if i + 1 < len(toks) else "", toks[i + 1] if i + 1 < len(toks) else ""))
+            i += 2
+    untracked = _ti_run(target_dir, "ls-files", "--others", "--exclude-standard", "-z") or ""
+    for u in untracked.split("\0"):
+        if u and not u.startswith(".loki/"):
+            entries.append(("A", u, u))
+    for st, old, new in entries:
+        if st in ("D", "R") and _TI_TEST_FILE.search(old):
+            weakened.append("test file %s: %s" % ("deleted" if st == "D" else "renamed", old))
+    if not greenfield:
+        for st, old, new in entries:
+            path = new if st != "D" else old
+            is_always = bool(_TI_CFG_ALWAYS.search(path))
+            if not (is_always or _TI_CFG_SHARED.search(path)):
+                continue
+            if st == "A":  # no base version: disclose, unless it re-selects tests over a base pytest config
+                try:
+                    with open(os.path.join(target_dir, new), encoding="utf-8", errors="replace") as h:
+                        text = h.read()
+                except OSError:
+                    text = ""
+                if _ti_added_config_selects(path, text) and _ti_base_has_pytest_config(target_dir, base):
+                    weakened.append("test runner config changed: " + path)
+                else:
+                    disclosed.append("new test runner config: " + path)
+            elif is_always:
+                weakened.append("test runner config changed: " + path)
+            else:
+                before = _ti_run(target_dir, "show", "%s:./%s" % (base, old)) or ""
+                try:
+                    with open(os.path.join(target_dir, new), encoding="utf-8", errors="replace") as h:
+                        after = h.read()
+                except OSError:
+                    after = ""
+                view = _ti_pkg_view if path.endswith("package.json") else _ti_pytest_view
+                b, a = view(before, path), view(after, path)
+                if b is None or a is None or b != a:
+                    weakened.append("test runner config changed: " + path)
+    # Skip markers: added lines of tracked test files, and the content of untracked ones.
+    patch = _ti_run(target_dir, "diff", "--relative", "-U0", "-M", base, "--") or ""
+    cur, rx, removed_assert = None, None, False
+    for line in patch.split("\n") + ["diff --git a/ b/"]:
+        if line.startswith("diff --git "):
+            if cur and removed_assert and cur not in edited:
+                edited.append(cur)
+            cur, rx, removed_assert = None, None, False
+        elif line.startswith("+++ b/"):
+            cur = line[6:] if _TI_TEST_FILE.search(line[6:]) else None
+            rx = _ti_skip_re(cur) if cur else None
+        elif cur and line.startswith("+") and rx and rx.search(line):
+            weakened.append("skip added in %s" % cur)
+        elif cur and line.startswith("-") and not line.startswith("---") \
+                and _TI_ASSERT.search(line):
+            removed_assert = True
+    for u in untracked.split("\0"):
+        if not u or u.startswith(".loki/") or not _TI_TEST_FILE.search(u):
+            continue
+        rx = _ti_skip_re(u)
+        if not rx:
+            continue
+        try:
+            with open(os.path.join(target_dir, u), "rb") as h:
+                text = h.read().decode("utf-8", "replace")
+        except OSError:
+            continue
+        if any(rx.search(ln) for ln in text.split("\n")):
+            weakened.append("skip added in %s" % u)
+    uniq = []
+    for w in weakened:
+        if w not in uniq:
+            uniq.append(w)
+    if not uniq and not edited and not disclosed:
+        return None
+    return {"weakened": uniq, "assertions_edited": edited, "disclosed": disclosed}
+
+
 def _collect_iterations(loki_dir):
     completed = _read_json(os.path.join(loki_dir, "queue", "completed.json"), default=[])
     failed = _read_json(os.path.join(loki_dir, "queue", "failed.json"), default=[])
@@ -1455,6 +1679,10 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
     # only, never read by _compute_headline / _compute_degraded.
     if journey:
         facts["journey"] = journey
+    # A-118: additive, present only when the diff touched test integrity.
+    _ti = _collect_tests_integrity(target_dir, diff_base_sha)
+    if _ti:
+        facts["tests_integrity"] = _ti
     ablation = _collect_ablation(loki_dir)
     if ablation is not None:
         facts["ablation"] = ablation
@@ -1517,6 +1745,24 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
             "post_headline": True,
         })
 
+    # D47: edited assertion lines are disclosed but never move the headline or rc.
+    _ae = (facts.get("tests_integrity") or {}).get("assertions_edited")
+    if _ae:
+        degraded.append({
+            "item": "tests_integrity:assertions_edited",
+            "status": "inconclusive",
+            "reason": "assertion lines edited in: " + ", ".join(_ae),
+            "post_headline": True,
+        })
+    _di = (facts.get("tests_integrity") or {}).get("disclosed")
+    if _di:
+        degraded.append({
+            "item": "tests_integrity:config_added",
+            "status": "inconclusive",
+            "reason": "; ".join(_di),
+            "post_headline": True,
+        })
+
     honesty = {
         "headline": headline,
         "degraded": degraded,
@@ -1653,6 +1899,10 @@ def _compute_degraded(facts):
         out.append({"item": "security", "status": "findings",
                     "reason": "%s un-waived HIGH security finding(s)"
                               % sec.get("high_active")})
+    ti = facts.get("tests_integrity") or {}
+    if ti.get("weakened"):
+        out.append({"item": "tests_integrity", "status": "failed",
+                    "reason": "tests weakened: " + "; ".join(ti["weakened"])})
     git = facts.get("git") or {}
     if not (git.get("diff") or {}).get("count"):
         out.append({"item": "git.diff", "status": "not_run",
@@ -1748,6 +1998,7 @@ def _compute_headline(facts, degraded):
                if _is_exogenous(g))
         or sec_high
         or fn_failed
+        or bool((facts.get("tests_integrity") or {}).get("weakened"))
     )
     if any_failed:
         return "NOT VERIFIED"

package/autonomy/lib/proof-verify.py

@@ -331,6 +331,7 @@ def _compute_headline(facts, degraded):
                if _is_exogenous(g))
         or sec_high
         or fn_failed
+        or bool((facts.get("tests_integrity") or {}).get("weakened"))
     )
     if any_failed:
         return "NOT VERIFIED"

package/autonomy/loki

@@ -1627,6 +1627,7 @@ show_help() {
     echo "Build:"
     echo "  start [SPEC]     Start a build (PRD file, GitHub/GitLab/Jira/Azure issue, or no arg)"
     echo "  plan <PRD-file>  Dry-run analysis: complexity, cost, execution plan"
+    echo "  backlog <owner/repo> --all|--label X|--issues N,N   Run every matching open issue, N in parallel"
     echo "  quickstart [idea]  Guided first build: setup, idea, template, plan, go"
     echo ""
     echo "Session:"
@@ -1765,7 +1766,7 @@ show_help() {
     # missing from this list, so a new command cannot ship invisible.
     echo ""
     echo "All commands:"
-    echo "  agent analyze api assets audit bench checkpoint (cp) ci cleanup"
+    echo "  agent analyze api assets audit backlog bench checkpoint (cp) ci cleanup"
     echo "  cluster cockpit code compliance completions compound config context (ctx)"
     echo "  cost council crash dashboard demo deploy docker docs doctor dogfood"
     echo "  enterprise estimate explain export failover github grill heal help"
@@ -1849,6 +1850,48 @@ show_help_aliases() {
     echo "See internal/CLI-CONSOLIDATION-DESIGN.md for the full migration plan."
 }
 
+# D51: bare `loki`. Reuse a running dashboard, else start one on a free
+# loopback port, then open /start (or just print the URL when headless).
+loki_ui_free_port() {
+    python3 - "$1" <<'PY'
+import socket, sys
+for p in range(int(sys.argv[1]), int(sys.argv[1]) + 100):
+    s = socket.socket()
+    try:
+        s.bind(("127.0.0.1", p))
+    except OSError:
+        continue
+    finally:
+        s.close()
+    print(p)
+    break
+PY
+}
+
+cmd_ui() {
+    local port="" pid=""
+    if [ -f "$DASHBOARD_PID_FILE" ]; then
+        pid=$(cat "$DASHBOARD_PID_FILE" 2>/dev/null)
+        if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then
+            port=$(cat "${DASHBOARD_PID_DIR}/port" 2>/dev/null)
+        fi
+    fi
+    if [ -z "$port" ]; then
+        port=$(loki_ui_free_port "${LOKI_DASHBOARD_PORT:-$DASHBOARD_DEFAULT_PORT}")
+        [ -n "$port" ] || { echo "loki: no free local port found" >&2; return 1; }
+        # The WS-origin allowlist must name the chosen port on both loopback names.
+        LOKI_PROJECT_DIR="$PWD" \
+            LOKI_DASHBOARD_CORS="http://localhost:$port,http://127.0.0.1:$port" \
+            cmd_dashboard_start --host 127.0.0.1 --port "$port" >&2 || return 1
+    fi
+    local url="http://127.0.0.1:${port}/start"
+    if [ "${LOKI_HEADLESS:-0}" = "1" ] || [ "${1:-}" = "--no-open" ]; then
+        echo "$url"
+    else
+        loki_open_url "$url" || echo "$url"
+    fi
+}
+
 # Tight newcomer landing for the bare `loki` invocation (no args).
 # v7.28.x UX: the full 70-command table lives in `loki help`; a no-args run
 # now shows only a calm ~12-line orientation so the "what do I do first"
@@ -3396,7 +3439,7 @@ cmd_start() {
                         ${LOKI_MIROFISH_ROUNDS:+--max-rounds "$LOKI_MIROFISH_ROUNDS"} \
                         ${LOKI_MIROFISH_TIMEOUT:+--timeout "$LOKI_MIROFISH_TIMEOUT"}
                     # PID is tracked in .loki/mirofish/pipeline-state.json by the adapter
-                    echo -e "${CYAN}MiroFish pipeline started in background. Check status: loki mirofish status${NC}"
+                    echo -e "${CYAN}MiroFish pipeline started in background. Status: $LOKI_DIR/mirofish/pipeline-state.json${NC}"
                 else
                     echo -e "${YELLOW}Warning: PRD validation for MiroFish failed. Continuing without.${NC}"
                     unset MIROFISH_URL
@@ -9306,6 +9349,32 @@ _deploy_receipt_verdict() {
     # evaluated, so no key set is written and the verdict is UNCHECKED, never
     # TAMPERED: the hash is fine, we just cannot vouch for who signed it. A
     # local key only proves "a holder of this key", not an independent build.
+    # Token SHAPE before any key lookup (mirrors engine10 checkAttestation): a present
+    # attestation that is not a string, not a 3-part JWS, or whose header/payload are not
+    # JSON with alg EdDSA is junk, so TAMPERED, never UNCHECKED, with or without a key.
+    if ! python3 -E - "$pj" >/dev/null 2>&1 <<'PYSHAPE'
+import sys
+sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+import json, base64
+def dec(x):
+    return json.loads(base64.urlsafe_b64decode(x + "=" * (-len(x) % 4)))
+v = json.load(open(sys.argv[1])).get("verification") or {}
+t = v.get("attestation")
+if t is None or t == "":
+    sys.exit(0)
+if not isinstance(t, str):
+    sys.exit(1)
+parts = t.split(".")
+if len(parts) != 3 or not all(parts):
+    sys.exit(1)
+try:
+    h = dec(parts[0]); dec(parts[1])
+except Exception:
+    sys.exit(1)
+sys.exit(0 if isinstance(h, dict) and h.get("alg") == "EdDSA" else 1)
+PYSHAPE
+    then printf '%s' "TAMPERED"; return 0; fi
+
     local jwks att
     jwks="$(mktemp "${TMPDIR:-/tmp}/loki-jwks.XXXXXX")" || { printf '%s' "UNCHECKED"; return 0; }
     python3 -E - "${_LOKI_SCRIPT_DIR}" "$pj" >"$jwks" 2>/dev/null <<'PY' || true
@@ -12593,7 +12662,7 @@ cmd_config() {
             echo "  get KEY         Get a configuration value"
             echo "  example         Print an annotated config template (for --config)"
             echo "  schema          Print the key -> env-var mapping table"
-            echo "  validate FILE   Validate a config file (--config) without applying it"
+            echo "  validate [FILE] Validate loki.yaml (no FILE: repo root, then ~/.loki) or a --config file"
             echo ""
             echo "Settable keys (v6.0.0):"
             echo "  maxTier              Cost ceiling: opus, sonnet, haiku (default: opus)"
@@ -12797,14 +12866,43 @@ cmd_config_schema() {
     loki_config_generate_schema
 }
 
+# D51: headless backlog runner. One v10 issue-mode run per open issue, each in
+# its own worktree and branch, at most N in parallel (loki.yaml concurrency).
+cmd_backlog() {
+    case "${1:-}" in
+        ""|--help|-h|help)
+            echo -e "${BOLD}loki backlog${NC} - run a v10 issue-mode run for every matching open issue"
+            echo ""
+            echo "Usage: loki backlog owner/repo (--all | --label X | --issues 1,2,3) [--concurrency N] [--dry-run]"
+            echo ""
+            echo "  --all             Every open issue"
+            echo "  --label X         Open issues with label X"
+            echo "  --issues 1,2,3    Exactly these issue numbers"
+            echo "  --concurrency N   Max runs in parallel (default: loki.yaml concurrency, else 2)"
+            echo "  --dry-run         List what would run; launch nothing"
+            echo ""
+            echo "Run from a checkout of owner/repo. Each issue runs in its own worktree on loki/backlog-N."
+            echo "Config: loki.yaml (repo root, then ~/.loki/loki.yaml); see docs/loki.yaml.example."
+            echo "Exit: 0 every issue ended VERIFIED or with a PR; 3 only budget stops; 1 otherwise; 2 usage."
+            return 0
+            ;;
+    esac
+    command -v python3 >/dev/null 2>&1 || { echo -e "${RED}loki backlog: python3 is required${NC}" >&2; return 2; }
+    python3 "$_LOKI_SCRIPT_DIR/lib/backlog.py" "$@"
+}
+
 # #691: validate a config file (--config) WITHOUT applying it. Reports
 # unresolved ${VAR} refs, raw-secret literals (error), and per-value validation
 # failures. Non-zero exit on any failure.
 cmd_config_validate() {
-    local file="${1:-}"
-    if [ -z "$file" ]; then
-        echo -e "${RED}Usage: loki config validate <file>${NC}" >&2
-        return 2
+    local file="${1:-}" _loki_yaml
+    # D51: loki.yaml (UI + headless config) has its own schema; no argument
+    # validates the discovered loki.yaml (repo root, then ~/.loki/loki.yaml).
+    case "$(basename -- "$file")" in "" | loki.yaml | loki.yml | loki.yaml.example) _loki_yaml=1 ;; *) _loki_yaml=0 ;; esac
+    if [ "$_loki_yaml" = 1 ]; then
+        command -v python3 >/dev/null 2>&1 || { echo -e "${RED}config validate: python3 is required${NC}" >&2; return 2; }
+        python3 "$_LOKI_SCRIPT_DIR/lib/loki_yaml.py" validate ${file:+"$file"}
+        return $?
     fi
     if ! declare -f loki_config_validate_file >/dev/null 2>&1; then
         echo -e "${RED}config validate: config-map.sh helper not loaded${NC}" >&2
@@ -21530,11 +21628,15 @@ main() {
         exit 1
     fi
 
-    if [ $# -eq 0 ]; then
-        # v7.28.x UX: bare `loki` shows a tight newcomer landing, not the full
-        # command wall. `loki help`/`--help` still print show_help unchanged.
-        show_landing
-        exit 0
+    if [ $# -eq 0 ] || { [ $# -eq 1 ] && [ "$1" = "--no-open" ]; }; then
+        # D51: bare `loki` starts the local UI. LOKI_LANDING=1 keeps the v7.28
+        # newcomer landing (tests and scripts that parse it set it).
+        if [ "${LOKI_LANDING:-0}" = "1" ]; then
+            show_landing
+            exit 0
+        fi
+        cmd_ui "$@"
+        exit $?
     fi
 
     local command="$1"
@@ -21767,6 +21869,9 @@ main() {
         assets)
             cmd_assets "$@"
             ;;
+        backlog)
+            cmd_backlog "$@"
+            ;;
         config)
             cmd_config "$@"
             ;;

package/autonomy/run.sh

@@ -11252,6 +11252,27 @@ _loki_proof_json_for_pr() {
 }
 
 # A-134: compact quiet-mode receipt for the outer shell (see top of file) to print.
+# A-118 / D47: a quick run that weakened its own tests exits 3. Prints the rc to use:
+# only ever RAISES a 0 (never lowers a non-zero rc); NOT VERIFIED from unproven gates alone keeps 0.
+_loki_quick_integrity_rc() {
+    local rc="${1:-0}" ld="${TARGET_DIR:-.}/.loki" rid pj
+    [ "$rc" = "0" ] || { echo "$rc"; return 0; }
+    rid="$(cat "$ld/state/last-proof-id.txt" 2>/dev/null || true)"
+    case "$rid" in '' | *[!A-Za-z0-9._-]*) echo 0; return 0 ;; esac
+    pj="$ld/proofs/$rid/proof.json"
+    if [ -f "$pj" ] && python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
+import json
+d = json.load(open(sys.argv[1]))
+g = (d.get('facts') or {}).get('git') or {}
+if sys.argv[2] and g.get('head_sha') != sys.argv[2]:
+    sys.exit(1)
+sys.exit(0 if any(isinstance(x, dict) and x.get('item') == 'tests_integrity' and x.get('status') == 'failed' for x in ((d.get('honesty') or {}).get('degraded') or [])) else 1)" "$pj" "$(git -C "${TARGET_DIR:-.}" rev-parse HEAD 2>/dev/null || true)" 2>/dev/null; then
+        echo 3
+    else
+        echo 0
+    fi
+}
+
 _loki_quick_receipt_write() {
     local ld="${TARGET_DIR:-.}/.loki" rid pj
     rid="$(cat "$ld/state/last-proof-id.txt" 2>/dev/null || true)"
@@ -11266,8 +11287,10 @@ v = d.get('verification') or {}
 if sys.argv[3] and g.get('head_sha') != sys.argv[3]:
     print('Evidence Receipt: unavailable (final proof generation failed; newest proof predates the session commit)')
     sys.exit(0)
-deg = [str(x.get('item') or '').split(':')[-1] for x in ((d.get('honesty') or {}).get('degraded') or []) if isinstance(x, dict)]
-notes = ([] if (v.get('gpg_signature') or v.get('attestation')) else ['unsigned']) + (['%d not proven: %s' % (len(deg), ', '.join(deg))] if deg else [])
+dg = [x for x in ((d.get('honesty') or {}).get('degraded') or []) if isinstance(x, dict)]
+tw = [str(x.get('reason') or 'tests weakened') for x in dg if x.get('item') == 'tests_integrity' and x.get('status') == 'failed']
+deg = [str(x.get('item') or '').split(':')[-1] for x in dg if x.get('item') != 'tests_integrity']
+notes = tw[:1] + ([] if (v.get('gpg_signature') or v.get('attestation')) else ['unsigned']) + (['%d not proven: %s' % (len(deg), ', '.join(deg))] if deg else [])
 print('Evidence Receipt: ' + str((d.get('honesty') or {}).get('headline') or 'unavailable') + (' (' + '; '.join(notes) + ')' if notes else ''))
 print('receipt_sha256: ' + str(v.get('hash') or ''))
 print('Head sha: ' + str(g.get('head_sha') or '') + '  Diff sha256: ' + str(g.get('diff_sha256') or ''))
@@ -29402,6 +29425,8 @@ except Exception:
     if [ "${LOKI_PROOF:-1}" != "0" ]; then
         generate_proof_of_run "$result" || true
     fi
+    # A-118: a quick run that weakened its tests exits 3 (quiet and verbose alike).
+    ! _loki_is_quick_prd "${PRD_PATH:-}" || result="$(_loki_quick_integrity_rc "$result")"
     [ -z "${LOKI_QUICK_INNER:-}" ] || _loki_quick_receipt_write
     # Trusted post-session step. NOT wrapped in _loki_with_github_tokens as a
     # whole (round 5): its push (_loki_trusted_push) and gh calls each re-grant

package/autonomy/verify.sh

@@ -3074,6 +3074,15 @@ sys.exit(0 if ok else 3)" "$lib" "$pj" 2>/dev/null || rc=$?
     declare -f _deploy_receipt_verdict >/dev/null 2>&1 || return 0
     local att
     att="$(_deploy_receipt_verdict "$pj")"
+    # D47: UNSIGNED is never a pass; --allow-unsigned / LOKI_VERIFY_ALLOW_UNSIGNED=1 accepts it, said aloud.
+    if [ "$att" = "UNSIGNED" ]; then
+        if [ "${VERIFY_ALLOW_UNSIGNED:-0}" = "1" ] || [ "${LOKI_VERIFY_ALLOW_UNSIGNED:-}" = "1" ]; then
+            printf 'attestation: UNSIGNED (accepted by --allow-unsigned; integrity not attested)\n'
+            return 0
+        fi
+        printf 'attestation: UNSIGNED, integrity not attested; refusing (pass --allow-unsigned to accept)\n'
+        return 1
+    fi
     printf 'attestation: %s\n' "$att"
     [ "$att" != "TAMPERED" ]
 }
@@ -3093,6 +3102,7 @@ verify_main() {
     VERIFY_CHECK_FRESH=0
     # Opt-in machine-readable stdout (--json). Default 0 = exactly today.
     VERIFY_JSON=0
+    VERIFY_ALLOW_UNSIGNED=0
 
     # Fail-closed defaults. These globals are read at the end of this function
     # (the VERDICT banner and the function return code). verify_compute_verdict()
@@ -3158,6 +3168,7 @@ verify_main() {
                 # verdict above stays authoritative for the exit code. Unset =
                 # exactly today's behavior. See verify_hosted_enrich().
                 VERIFY_HOSTED=1; shift ;;
+            --allow-unsigned) VERIFY_ALLOW_UNSIGNED=1; shift ;;
             --) shift; break ;;
             -*)
                 _verify_err "unknown option: $1"; verify_help; return $VERIFY_EXIT_ERROR ;;

package/completions/_loki

@@ -205,6 +205,7 @@ function _loki_commands {
         'crash:Crash report management'
         'otel:OpenTelemetry management'
         'wiki:Wiki commands'
+        'backlog:Run every matching open issue, N in parallel'
         'explain:Explain Loki concepts'
         'optimize:Optimization commands'
         'review:Code review commands'

package/completions/loki.bash

@@ -5,8 +5,8 @@ _loki_completion() {
     _init_completion || return
 
     # Main subcommands (must match autonomy/loki main case statement)
-    local main_commands="start quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt outcomes explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
-    local main_commands="start quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue intent config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
+    local main_commands="start backlog quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt outcomes explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
+    local main_commands="start backlog quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue intent config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
 
     # 1. If we are on the first argument (subcommand)
     if [[ $cword -eq 1 ]]; then

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "10.5.16"
+__version__ = "10.5.19"
 
 # Expose the control app for easy import
 try: