loki-mode 10.6.10 → 10.6.12

package/autonomy/run.sh

@@ -9884,12 +9884,19 @@ setup_agent_branch() {
             # file is gone when the user switches back. On conflict the resume
             # is refused and a fresh session branch (with a fresh snapshot) is
             # minted below.
-            if git checkout --no-overwrite-ignore "$recorded" >/dev/null 2>&1; then
+            local resume_err="" resume_files=""
+            if resume_err="$(git checkout --no-overwrite-ignore "$recorded" 2>&1 >/dev/null)"; then
                 log_info "Resuming on recorded agent branch: ${recorded}"
                 _loki_resume_snapshot
                 return 0
             fi
-            log_warn "Recorded agent branch ${recorded} could not be checked out - creating a new one"
+            # git lists the blocking paths as tab-indented lines.
+            resume_files="$(printf '%s\n' "$resume_err" | sed -n 's/^[[:space:]][[:space:]]*//p' | head -5 | paste -sd, - | sed 's/,/, /g')"
+            if [ -n "$resume_files" ]; then
+                log_warn "Recorded agent branch ${recorded} could not be checked out because it would overwrite your ignored file(s): ${resume_files} - creating a new one; the earlier commits stay on ${recorded}"
+            else
+                log_warn "Recorded agent branch ${recorded} could not be checked out - creating a new one; the earlier commits stay on ${recorded}"
+            fi
         fi
     fi
 
@@ -10640,10 +10647,70 @@ _loki_snapshot_preexisting() {
 # entirely absent from the sealed snapshot this function ultimately feeds.
 _loki_untracked_status() {
     local top="" prefix="" gittool=""
+    local genv=() fk="" fn="" n=0
     gittool="$(_loki_snapshot_git_tool)" || return 1
-    top="$("$gittool" rev-parse --show-toplevel 2>/dev/null)" || return 1
-    prefix="$("$gittool" rev-parse --show-prefix 2>/dev/null)" || return 1
-    "$gittool" -C "$top" --no-optional-locks status --porcelain -z --no-renames -uall \
+    # Version floor: GIT_CONFIG_COUNT needs git >= 2.31 and GIT_NO_LAZY_FETCH
+    # (no hook-running lazy fetch) needs git >= 2.44. Unparseable also refuses.
+    local gver="" gmaj="" gmin=""
+    gver="$(LC_ALL=C "$gittool" --version 2>/dev/null)" || gver=""
+    gver="${gver#git version }"
+    gmaj="${gver%%.*}"
+    gmin="${gver#*.}"
+    gmin="${gmin%%.*}"
+    case "${gmaj}${gmin}" in
+        '' | *[!0-9]*) gmaj="" ;;
+    esac
+    if [ -z "$gmaj" ] || [ -z "$gmin" ] || [ "$gmaj" -lt 2 ] || { [ "$gmaj" -eq 2 ] && [ "$gmin" -lt 44 ]; }; then
+        echo "snapshot: git >= 2.44 required (got '${gver:-unknown}'); refusing to run status unprotected" >&2
+        return 1
+    fi
+    # Inherited GIT_DIR / GIT_WORK_TREE would repoint every call below.
+    top="$(env -u GIT_DIR -u GIT_WORK_TREE "$gittool" rev-parse --show-toplevel 2>/dev/null)" || return 1
+    prefix="$(env -u GIT_DIR -u GIT_WORK_TREE "$gittool" rev-parse --show-prefix 2>/dev/null)" || return 1
+    # BACKLOG 131c: a repo-local core.fsmonitor is a command git runs on
+    # status; the agent can write .git/config, so disable it (and the
+    # untracked cache it could have poisoned) for this one call.
+    # A filter driver named by attributes (clean/smudge/process) is also a
+    # command git runs when status compares a stat-dirty tracked file, so every
+    # configured driver is blanked: clean/smudge/process become empty (never
+    # `cat`, which resolves from PATH) and required is false.
+    # The overrides travel as GIT_CONFIG_KEY_n / GIT_CONFIG_VALUE_n, never as
+    # `-c key=value`: git splits -c at the first "=", so a driver named "x=y"
+    # would be missed. GIT_NO_LAZY_FETCH stops a partial-clone status from
+    # fetching a missing blob over an agent-written core.sshCommand. Inherited
+    # GIT_DIR, GIT_WORK_TREE, GIT_CONFIG_PARAMETERS and GIT_CONFIG_GLOBAL are
+    # dropped and GIT_CONFIG_COUNT is overwritten, never appended to. LC_ALL=C
+    # keeps the name lookup byte-exact for non-UTF-8 driver names.
+    genv=(env -u GIT_DIR -u GIT_WORK_TREE -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_GLOBAL
+        LC_ALL=C GIT_NO_LAZY_FETCH=1)
+    # The NUL-delimited listing goes to a file beside the output path, read by
+    # a loop in this shell (it appends to genv and n); removed right after the
+    # loop, before any later return path.
+    : > "${1}.filters" || return 1
+    "${genv[@]}" "$gittool" -C "$top" config -z --name-only --get-regexp \
+        '^filter\..*\.(clean|smudge|process)$' > "${1}.filters" 2>/dev/null || true
+    while IFS= read -r -d '' fk; do
+        fn="${fk%.*}"
+        genv+=("GIT_CONFIG_KEY_${n}=${fk}" "GIT_CONFIG_VALUE_${n}=")
+        n=$((n + 1))
+        genv+=("GIT_CONFIG_KEY_${n}=${fn}.required" "GIT_CONFIG_VALUE_${n}=false")
+        n=$((n + 1))
+    done < "${1}.filters"
+    rm -f "${1}.filters"
+    # Prove the overrides are visible with a per-call random nonce (a constant
+    # could be planted in .git/config by the agent), or refuse to run.
+    local nonce=""
+    nonce="$(od -An -tx8 -N8 /dev/urandom 2>/dev/null | tr -d ' \n')"
+    [ -n "$nonce" ] || return 1
+    genv+=("GIT_CONFIG_KEY_${n}=loki.snapshot.sentinel" "GIT_CONFIG_VALUE_${n}=${nonce}")
+    n=$((n + 1))
+    genv+=("GIT_CONFIG_COUNT=${n}")
+    if [ "$("${genv[@]}" "$gittool" -C "$top" config --get loki.snapshot.sentinel 2>/dev/null)" != "$nonce" ]; then
+        echo "snapshot: git does not honor GIT_CONFIG_COUNT; refusing to run status unprotected" >&2
+        return 1
+    fi
+    "${genv[@]}" "$gittool" -C "$top" -c core.fsmonitor=false -c core.untrackedCache=false \
+        --no-optional-locks status --porcelain -z --no-renames -uall \
         --ignored=matching --ignore-submodules=all -- ":(exclude,literal)${prefix}.loki" \
         > "$1" 2>/dev/null && return 0
     rm -f "$1"
@@ -11045,12 +11112,23 @@ _loki_untrack_agent_committed_user_files() {
     fi
     mv -f "$rec.new" "$rec"
     names="$(_loki_nul_names "$rec")"
+    # S-220: keep what the agent force-staged. Save the index as a tree, make the
+    # removal commit from the branch tip alone, then restore the saved index minus
+    # the removed paths. A global `git reset -q` here dropped those staged files
+    # from the session commit that follows. No saved tree (unmerged index): the
+    # old full reset still applies.
+    local saved_tree=""
+    saved_tree="$(git write-tree 2>/dev/null)" || saved_tree=""
     git reset -q >/dev/null 2>&1 || true
     if ! git -C "$top" update-index -z --force-remove --stdin < "$rec" >/dev/null 2>&1 \
        || ! git commit -q -m "Loki Mode: untrack pre-existing user files the agent committed" >/dev/null 2>&1; then
         log_warn "The agent committed your pre-existing files on $1 and Loki could not remove them from the branch: ${names}. They are on disk. Before switching branches, run git rm --cached on each and commit, or a checkout of the base deletes them. Left uncommitted: no session commit."
         return 1
     fi
+    if [ -n "$saved_tree" ]; then
+        { git read-tree "$saved_tree" \
+            && git -C "$top" update-index -z --force-remove --stdin < "$rec"; } >/dev/null 2>&1 || true
+    fi
     log_warn "The agent committed your pre-existing untracked or ignored files on $1: ${names}. Loki removed them from the branch tip; they stay on disk, untracked. The branch history still holds them: do not push $1 as-is. To drop them from its history: git reset --soft ${fork} && git commit"
     audit_agent_action "git_untrack_user_files" "Removed pre-existing user files the agent committed" "files=${names}" || true
     return 0
@@ -11156,11 +11234,22 @@ commit_session_changes() {
     # (_commit_path_looks_secret + _commit_scan_secret_file over EVERY staged
     # file) is the actual guarantee for nested/weak secrets; these excludes are a
     # cheap first cut for the obvious top-level files only.
+    # S-219: a failed add must not fall through to the "nothing staged" no-op,
+    # which would silently commit nothing. Unstage any partial result and say so.
+    # rc 1 is benign: git exits 1 after staging everything else when a pathspec
+    # (':!.loki') names an ignored path, which is the normal case. A real
+    # failure (unreadable file, lock) exits 128.
+    local add_rc=0
     git add -A \
         ':!.loki' ':!.loki/' \
         ':!.env' ':!.env.*' ':!*.env' \
         ':!*.key' ':!*.pem' ':!*.p12' ':!*.keystore' \
-        ':!id_rsa*' ':!*.token' ':!credentials*' 2>/dev/null || true
+        ':!id_rsa*' ':!*.token' ':!credentials*' 2>/dev/null || add_rc=$?
+    if [ "$add_rc" -gt 1 ]; then
+        git reset -q >/dev/null 2>&1 || true
+        log_warn "Left uncommitted: could not stage the session's changes (git add failed). Review and commit manually."
+        return 0
+    fi
 
     # Unstage exactly the paths recorded as untracked or gitignored when the
     # session started (setup_agent_branch; a "dir/" entry covers its subtree):

package/autonomy/verify.sh

@@ -68,6 +68,46 @@ VERIFY_EXIT_BLOCKED=2
 VERIFY_EXIT_ERROR=3
 VERIFY_SCHEMA_VERSION="1.0"
 
+# S-216: verify runs from the tree under review (tree="."), and a bare
+# `python3 -c` / `python3 -` puts that cwd first on sys.path, so a planted
+# json.py in the reviewed tree replaced the stdlib module and forged recorded
+# gates (a dependency_audit with high CVEs read as pass). The inline readers
+# run through _verify_py, which resolves the interpreter with
+# _loki_snapshot_py_tool and runs it -I -S. When none resolves it exits 127
+# with no output, exactly as a missing python3 did, so no reader reads as pass.
+# This module does not source run.sh, so it carries a guarded copy; run.sh is
+# the source of truth: keep it byte-identical. Pinned by
+# tests/test-verify-no-cwd-shadow.sh and tests/test-council-py-tool-identity.sh.
+# Only the unittest run stays on bare python3: it runs the reviewed tree's own
+# tests on purpose. py_compile is a stdlib verdict, so it runs isolated too.
+declare -F _loki_snapshot_py_tool >/dev/null 2>&1 || \
+_loki_snapshot_py_tool() {
+    local c
+    for c in /usr/bin/python3 /bin/python3; do
+        [ -x "$c" ] && [ ! -d "$c" ] && "$c" -I -S -c '' >/dev/null 2>&1 && { printf '%s\n' "$c"; return 0; }
+    done
+    local dir
+    local IFS=:
+    for dir in $PATH; do
+        case "$dir" in
+            /*) ;;
+            *) continue ;;
+        esac
+        if [ -x "$dir/python3" ] && [ ! -d "$dir/python3" ] \
+           && "$dir/python3" -I -S -c '' >/dev/null 2>&1; then
+            printf '%s\n' "$dir/python3"
+            return 0
+        fi
+    done
+    return 1
+}
+
+_verify_py() {
+    local py
+    py="$(_loki_snapshot_py_tool)" || return 127
+    "$py" -I -S "$@"
+}
+
 # Resolve tool version from the VERSION file shipped alongside the repo.
 # ---------------------------------------------------------------------------
 # LLM review stage (v9.26.0). Phase 2 of the spec; the deterministic MVP shipped
@@ -187,7 +227,7 @@ SCHEMA
 
     # Parse defensively: a malformed payload is "unavailable", never a pass.
     local parsed
-    parsed="$(printf '%s' "$out" | python3 -c '
+    parsed="$(printf '%s' "$out" | _verify_py -c '
 import json, sys
 try:
     d = json.load(sys.stdin)
@@ -588,7 +628,7 @@ ZT_MATCHES_EOF
 _verify_pkg_test_script() {
     local tree="$1"
     [ -f "$tree/package.json" ] || return 0
-    python3 -c '
+    _verify_py -c '
 import json,sys
 try:
     with open(sys.argv[1]) as fh:
@@ -918,7 +958,7 @@ verify_gate_static() {
             [ -z "$f" ] && continue
             [ -f "$tree/$f" ] || continue
             checked=$((checked + 1))
-            python3 -m py_compile "$tree/$f" >/dev/null 2>&1 || {
+            _verify_py -m py_compile "$tree/$f" >/dev/null 2>&1 || {
                 findings=$((findings + 1))
                 details="${details}Python syntax error: $f. "
                 _verify_add_finding "Medium" "lint" "deterministic:py_compile" "$f" "null" \
@@ -1266,9 +1306,9 @@ verify_gate_dependency_audit() {
             out="$(cd "$tree" && npm audit --json 2>/dev/null)" || rc=$?
             # npm audit exits nonzero when vulns are found; rc alone is not an
             # error. Distinguish "ran and found vulns" from "could not run".
-            if printf '%s' "$out" | python3 -c "import sys,json; json.load(sys.stdin)" >/dev/null 2>&1; then
+            if printf '%s' "$out" | _verify_py -c "import sys,json; json.load(sys.stdin)" >/dev/null 2>&1; then
                 local sev
-                sev="$(printf '%s' "$out" | python3 -c '
+                sev="$(printf '%s' "$out" | _verify_py -c '
 import sys, json
 d = json.load(sys.stdin)
 v = d.get("metadata", {}).get("vulnerabilities", {})
@@ -1292,7 +1332,7 @@ print("%d %d %d %d" % (crit, high, mod, low))
                     # count different dependency graphs, so arithmetic on the
                     # totals would not be sound.
                     local _prod_hc=""
-                    _prod_hc="$(cd "$tree" && npm audit --omit=dev --json 2>/dev/null | python3 -c '
+                    _prod_hc="$(cd "$tree" && npm audit --omit=dev --json 2>/dev/null | _verify_py -c '
 import sys, json
 try:
     v = json.load(sys.stdin).get("metadata", {}).get("vulnerabilities", {})
@@ -1334,9 +1374,9 @@ print(v.get("critical", 0) + v.get("high", 0))
         if command -v pip-audit >/dev/null 2>&1; then
             local out rc=0
             out="$(cd "$tree" && pip-audit --format json 2>/dev/null)" || rc=$?
-            if printf '%s' "$out" | python3 -c "import sys,json; json.load(sys.stdin)" >/dev/null 2>&1; then
+            if printf '%s' "$out" | _verify_py -c "import sys,json; json.load(sys.stdin)" >/dev/null 2>&1; then
                 local count
-                count="$(printf '%s' "$out" | python3 -c '
+                count="$(printf '%s' "$out" | _verify_py -c '
 import sys, json
 d = json.load(sys.stdin)
 deps = d.get("dependencies", d if isinstance(d, list) else [])
@@ -1438,7 +1478,7 @@ _verify_runtime_detect() {
     # 0b. Rank 9 setup recipe (opportunistic; NOT yet built -- absence is normal).
     if [ -z "$method" ] && [ -f "$dir/.loki/setup-recipe.json" ] && command -v python3 >/dev/null 2>&1; then
         local recipe
-        recipe="$(python3 - "$dir/.loki/setup-recipe.json" <<'PYEOF' 2>/dev/null || true
+        recipe="$(_verify_py - "$dir/.loki/setup-recipe.json" <<'PYEOF' 2>/dev/null || true
 import json, sys
 try:
     with open(sys.argv[1]) as f:
@@ -1611,7 +1651,7 @@ _verify_write_setup_recipe() {
     _SR_DIR="$tree/.loki" _SR_INSTALL="$install" _SR_SEED="$seed" \
     _SR_START="$start" _SR_HEALTH="$health_path" _SR_PORT="$port" \
     _SR_ENVSRC="$env_src" \
-    python3 - <<'PYEOF' 2>/dev/null || return 0
+    _verify_py - <<'PYEOF' 2>/dev/null || return 0
 import json, os, re
 
 out_dir = os.environ["_SR_DIR"]
@@ -1815,7 +1855,7 @@ verify_gate_runtime() {
     # reproducible (command + url + status + artifact are all captured).
     _VR_DIR="$artifact_dir" _VR_METHOD="$method" _VR_URL="$url" \
     _VR_STATUS="$http_status" _VR_ART="$artifact_field" _VR_TO="$boot_timeout" \
-    python3 - <<'PYEOF' 2>/dev/null || true
+    _verify_py - <<'PYEOF' 2>/dev/null || true
 import json, os
 rec = {
     "start_command": os.environ.get("_VR_METHOD", ""),
@@ -2213,7 +2253,7 @@ verify_emit_evidence() {
     _V_SCOPE_SOFT_NET="${VERIFY_SCOPE_SOFT_NET_LINES:-}" \
     _V_SCOPE_MAX_FILES="${VERIFY_SCOPE_MAX_FILES:-}" \
     _V_SCOPE_MAX_NET="${VERIFY_SCOPE_MAX_NET_LINES:-}" \
-    python3 - <<'PYEOF'
+    _verify_py - <<'PYEOF'
 import json, os, hashlib, sys
 
 out_dir = os.environ["_VERIFY_OUT_DIR"]
@@ -2671,7 +2711,7 @@ verify_expectation_ledger_gate() {
         _LK_ITER="$iter" \
         _LK_OBSERVED="$observed_file" \
         _LK_MOD="$mod" \
-        python3 - <<'PYEOF' 2>/dev/null
+        _verify_py - <<'PYEOF' 2>/dev/null
 import importlib.util, json, os, sys
 
 mod_path = os.environ["_LK_MOD"]
@@ -2856,7 +2896,7 @@ verify_hosted_enrich() {
 
     # Fold the engine payload into evidence.json under "hosted". A parse failure
     # at any step leaves the file byte-for-byte unchanged.
-    _V_EV="$ev_path" _V_ENGINE="$engine_out" python3 - <<'PYEOF' || {
+    _V_EV="$ev_path" _V_ENGINE="$engine_out" _verify_py - <<'PYEOF' || {
 import json, os, sys
 
 ev_path = os.environ["_V_EV"]
@@ -2906,7 +2946,7 @@ PYEOF
     # Built from the engine payload via python3 (already a precondition above);
     # any parse hiccup leaves the summary empty and the banner simply omits the
     # line -- never a fabricated summary.
-    VERIFY_HOSTED_SUMMARY="$(_V_ENGINE="$engine_out" _V_VERDICT="${VERIFY_VERDICT:-}" python3 - <<'PYEOF' 2>/dev/null || true
+    VERIFY_HOSTED_SUMMARY="$(_V_ENGINE="$engine_out" _V_VERDICT="${VERIFY_VERDICT:-}" _verify_py - <<'PYEOF' 2>/dev/null || true
 import json, os
 try:
     e = json.loads(os.environ["_V_ENGINE"])
@@ -3002,7 +3042,7 @@ _verify_check_fresh() {
     # Parse the graded head_sha out of the evidence document. python3 is the same
     # dependency the emitter uses; a parse failure is fail-closed (ERROR).
     local graded_head parse_rc
-    graded_head="$(_VF_EV="$ev_path" python3 - <<'PYEOF' 2>/dev/null
+    graded_head="$(_VF_EV="$ev_path" _verify_py - <<'PYEOF' 2>/dev/null
 import json, os, sys
 try:
     doc = json.load(open(os.environ["_VF_EV"]))
@@ -3053,9 +3093,26 @@ PYEOF
 _verify_receipt_digest() {
     local rid pj lib rc=0
     rid="$(cat .loki/state/last-proof-id.txt 2>/dev/null || true)"
-    case "$rid" in '' | *[!A-Za-z0-9._-]*) return 0 ;; esac
+    # D76: a missing or unusable run-id pointer must not silently skip the receipt check.
+    # Proofs on disk with no pointer to one is NOT VERIFIED; a tree that never recorded a
+    # proof (nothing to verify) says so aloud and does not claim a receipt check.
+    if [ -z "$rid" ]; then
+        if compgen -G ".loki/proofs/*/proof.json" >/dev/null 2>&1; then
+            echo "receipt: NOT VERIFIED (no last-proof-id.txt pointer, but proofs exist under .loki/proofs; the receipt was not checked)"
+            return 1
+        fi
+        echo "receipt: NONE (no proof was recorded in this tree; no receipt was checked)"
+        return 0
+    fi
+    case "$rid" in *[!A-Za-z0-9._-]*)
+        echo "receipt: NOT VERIFIED (last-proof-id.txt holds an unusable id; the receipt was not checked)"
+        return 1 ;;
+    esac
     pj=".loki/proofs/$rid/proof.json"
-    [ -f "$pj" ] || return 0
+    if [ ! -f "$pj" ]; then
+        echo "receipt: NOT VERIFIED (last-proof-id.txt names ${rid} but .loki/proofs/${rid}/proof.json is missing; the receipt was not checked)"
+        return 1
+    fi
     lib="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib"
     python3 -E -c "import sys; sys.path[:] = [p for p in sys.path if p not in ('', '.')]
 import importlib.util, json
@@ -3069,9 +3126,9 @@ print('receipt_sha256: ' + h if ok else 'receipt: TAMPERED (integrity hash does
 sys.exit(0 if ok else 3)" "$lib" "$pj" 2>/dev/null || rc=$?
     [ "$rc" -ne 3 ] || return 1
     # Provenance: the deploy gate's own verdict (Ed25519 attestation against the local
-    # key plus LOKI_RECEIPT_RETIRED_PUBKEYS; unknown kid or no key is UNCHECKED).
+    # key plus LOKI_RECEIPT_RETIRED_PUBKEYS; unknown kid or no key is UNCHECKED, which fails per D76).
     # Defined in autonomy/loki, so it is absent when verify.sh runs standalone.
-    declare -f _deploy_receipt_verdict >/dev/null 2>&1 || { echo "attestation: UNCHECKED (run via loki verify)"; return 0; }
+    declare -f _deploy_receipt_verdict >/dev/null 2>&1 || { echo "attestation: UNCHECKED (run via loki verify)"; return 1; }
     local att
     att="$(_deploy_receipt_verdict "$pj")"
     # D47: UNSIGNED is never a pass; --allow-unsigned / LOKI_VERIFY_ALLOW_UNSIGNED=1 accepts it, said aloud.
@@ -3084,6 +3141,16 @@ sys.exit(0 if ok else 3)" "$lib" "$pj" 2>/dev/null || rc=$?
         return 1
     fi
     printf 'attestation: %s\n' "$att"
+    # D76: UNCHECKED (a well-formed token whose kid no local key matches, or a check that
+    # could not run) is not a pass: anyone can mint a foreign-kid token. rc 2, VERDICT not VERIFIED.
+    if [ "$att" = "UNCHECKED" ]; then
+        echo "  Not verified: no local key matches this attestation, so who signed it is unproven."
+        echo "  Cross-machine path: loki verify --pubkey FILE <run-id> checks a Loki 10 run receipt"
+        echo "  (.loki/runs/<run-id>/receipt.json) against the signer's public key (JWK or PEM)."
+        echo "  It does not read a legacy .loki/proofs proof.json; for that, add the signer's public"
+        echo "  key to LOKI_RECEIPT_RETIRED_PUBKEYS on this machine."
+        return 1
+    fi
     [ "$att" != "TAMPERED" ]
 }
 

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "10.6.10"
+__version__ = "10.6.12"
 
 # Expose the control app for easy import
 try:

package/dashboard/api_operator.py

@@ -294,3 +294,30 @@ def operator_phases():
         return api_phases.phase_history(_loki_dir())
     except Exception as exc:
         _fail("phase history", exc)
+
+
+@router.get("/workspaces/runs", dependencies=_READ)
+def operator_workspace_runs():
+    """Multi-repo workspace runs, read from each run's integration.json.
+
+    A corrupt file is a row with state "unreadable", never dropped.
+    """
+    try:
+        from . import api_workspaces
+        return api_workspaces.list_runs(_loki_dir())
+    except Exception as exc:
+        _fail("workspace runs", exc)
+
+
+@router.get("/workspaces/runs/{ws}/{run_id}", dependencies=_READ)
+def operator_workspace_run(ws: str, run_id: str):
+    """One workspace run with per-repo stale detection (recorded vs worktree head)."""
+    from . import api_workspaces
+    try:
+        return api_workspaces.get_run(_loki_dir(), ws, run_id)
+    except api_workspaces.BadName:
+        raise HTTPException(status_code=400, detail="invalid workspace or run id")
+    except api_workspaces.NotFound:
+        raise HTTPException(status_code=404, detail="unknown run")
+    except Exception as exc:
+        _fail("workspace run", exc)

package/dashboard/api_runs.py

@@ -158,6 +158,44 @@ def _efficiency_module():
 # per-iteration cost, from the current run's efficiency records
 # ---------------------------------------------------------------------------
 
+def _errno_text(exc: OSError) -> str:
+    return "errno %s %s" % (exc.errno, exc.strerror or type(exc).__name__)
+
+
+def _events_read_error(loki_dir: str) -> Optional[str]:
+    """errno text when trust-events.jsonl exists but cannot be read, else None.
+
+    A missing file (ENOENT) is not an error: it means nothing was recorded.
+    """
+    try:
+        with open(_p(loki_dir, *_TRUST_EVENTS), "r", encoding="utf-8") as fh:
+            fh.read(1)
+    except FileNotFoundError:
+        return None
+    except OSError as exc:
+        return _errno_text(exc)
+    return None
+
+
+def _iterations_read_error(loki_dir: str) -> Optional[str]:
+    """Why iteration records are unreadable or corrupt, else None.
+
+    None means the directory is absent or holds no iteration-*.json files at
+    all, i.e. genuinely nothing recorded.
+    """
+    eff_dir = _p(loki_dir, *_EFFICIENCY_DIR)
+    try:
+        names = os.listdir(eff_dir)
+    except FileNotFoundError:
+        return None
+    except OSError as exc:
+        return _errno_text(exc)
+    cands = [n for n in names if n.startswith("iteration-") and n.endswith(".json")]
+    if cands and not _iteration_records(loki_dir):
+        return "%d iteration file(s) present but none parsed" % len(cands)
+    return None
+
+
 def _iteration_records(loki_dir: str) -> list:
     """[(iteration_int, record_dict, path)] sorted by iteration.
 
@@ -399,6 +437,13 @@ def list_runs(loki_dir: str, now: Optional[float] = None) -> dict:
     if current_id and current_id not in ids:
         ids.append(current_id)
 
+    if not ids and _events_read_error(loki_dir):
+        envelope["reason"] = (
+            "unreadable: .loki/metrics/trust-events.jsonl could not be read (%s)"
+            % _events_read_error(loki_dir)
+        )
+        return envelope
+
     if not ids:
         envelope["reason"] = (
             "no run id found: .loki/state/trust-run-id is absent and "
@@ -463,6 +508,13 @@ def get_run(loki_dir: str, run_id: str, now: Optional[float] = None) -> dict:
 
     mod = _efficiency_module()
     recs = _iteration_records(loki_dir)
+    if not recs and _iterations_read_error(loki_dir):
+        envelope["reason"] = (
+            "per-iteration records unreadable or corrupt at "
+            ".loki/metrics/efficiency/iteration-*.json (%s)"
+            % _iterations_read_error(loki_dir)
+        )
+        return envelope
     if not recs:
         envelope["reason"] = (
             "no per-iteration records at .loki/metrics/efficiency/iteration-*.json"

package/dashboard/api_workspaces.py

@@ -0,0 +1,140 @@
+"""Read-only view over multi-repo workspace runs (D51-B13r).
+
+`loki workspace run` records one integration.json per run under
+<loki_dir>/workspaces/<workspace>/<run_id>/. That file is the ONLY evidence a
+run leaves (runs never produce group.json), so this reader lists and returns
+exactly it.
+
+Honesty rules:
+  - A missing workspaces directory is {runs: [], reason}, never a bare empty.
+  - An unreadable or corrupt integration.json is a row with state
+    "unreadable" and an error. It is never dropped.
+  - stale is True/False only when both the recorded head and the worktree head
+    are known. A missing worktree or recorded head reads None with a reason.
+
+Nothing here mutates a run.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import subprocess
+from typing import Any, Optional
+
+__all__ = ["list_runs", "get_run", "valid_name", "NotFound", "BadName"]
+
+_NAME_RE = re.compile(r"^[A-Za-z0-9._-]+$")
+_GIT_TIMEOUT_S = 5
+
+
+class BadName(ValueError):
+    pass
+
+
+class NotFound(LookupError):
+    pass
+
+
+def valid_name(name: str) -> bool:
+    return bool(name) and ".." not in name and _NAME_RE.match(name) is not None
+
+
+def _slug(repo: str) -> str:
+    # Mirrors autonomy/lib/workspace.py _slug.
+    return repo.replace("/", "__")
+
+
+def _worktree_head(run_dir: str, repo: str) -> tuple:
+    wt = os.path.join(run_dir, "worktrees", _slug(repo))
+    if not os.path.isdir(wt):
+        return None, "worktree missing"
+    try:
+        r = subprocess.run(["git", "-C", wt, "rev-parse", "HEAD"],
+                           capture_output=True, text=True, timeout=_GIT_TIMEOUT_S)
+    except (OSError, subprocess.SubprocessError) as exc:
+        return None, "git failed: %s" % type(exc).__name__
+    if r.returncode != 0:
+        return None, "git rev-parse failed"
+    return r.stdout.strip(), None
+
+
+def _repo_rows(run_dir: str, ev: dict) -> list:
+    heads = ev.get("heads")
+    rows = []
+    if not isinstance(heads, dict):
+        return rows
+    for repo in sorted(heads):
+        recorded = heads[repo]
+        row: dict[str, Any] = {"repo": repo, "head": recorded,
+                               "current_head": None, "stale": None, "reason": None}
+        if not recorded:
+            row["reason"] = "no recorded head"
+        else:
+            cur, why = _worktree_head(run_dir, repo)
+            row["current_head"] = cur
+            if cur is None:
+                row["reason"] = why
+            else:
+                row["stale"] = cur != recorded
+        rows.append(row)
+    return rows
+
+
+def _row(root: str, ws: str, run_id: str, with_repos: bool = True) -> dict:
+    run_dir = os.path.join(root, ws, run_id)
+    path = os.path.join(run_dir, "integration.json")
+    row: dict[str, Any] = {"workspace": ws, "run_id": run_id, "state": "ok",
+                           "status": None, "exit_code": None, "error": None,
+                           "repos": []}
+    try:
+        with open(path) as fh:
+            ev = json.load(fh)
+        if not isinstance(ev, dict):
+            raise ValueError("integration.json is not an object")
+    except (OSError, ValueError) as exc:
+        row["state"] = "unreadable"
+        row["error"] = "%s: %s" % (type(exc).__name__, exc)
+        return row
+    row["status"] = ev.get("status")
+    row["exit_code"] = ev.get("exit_code")
+    row["outcomes"] = ev.get("outcomes") if isinstance(ev.get("outcomes"), dict) else {}
+    if with_repos:
+        row["repos"] = _repo_rows(run_dir, ev)
+    return row
+
+
+def list_runs(loki_dir: str) -> dict:
+    root = os.path.join(loki_dir, "workspaces")
+    if not os.path.isdir(root):
+        return {"runs": [], "reason": "no workspaces directory at %s" % root,
+                "source": root}
+    runs = []
+    try:
+        names = sorted(os.listdir(root))
+    except OSError as exc:
+        return {"runs": [], "reason": "workspaces directory unreadable: %s" % exc,
+                "source": root}
+    for ws in names:
+        wdir = os.path.join(root, ws)
+        if not valid_name(ws) or not os.path.isdir(wdir):
+            continue
+        try:
+            ids = sorted(os.listdir(wdir))
+        except OSError:
+            continue
+        for run_id in ids:
+            if valid_name(run_id) and os.path.isdir(os.path.join(wdir, run_id)):
+                runs.append(_row(root, ws, run_id))
+    reason: Optional[str] = None if runs else "no workspace runs recorded"
+    return {"runs": runs, "reason": reason, "source": root}
+
+
+def get_run(loki_dir: str, ws: str, run_id: str) -> dict:
+    if not valid_name(ws) or not valid_name(run_id):
+        raise BadName("invalid workspace or run id")
+    root = os.path.join(loki_dir, "workspaces")
+    if not os.path.isdir(os.path.join(root, ws, run_id)):
+        raise NotFound("unknown run")
+    return _row(root, ws, run_id)

package/dashboard/audit.py

@@ -862,7 +862,10 @@ def _unified_cli() -> int:
         python3 dashboard/audit.py verify <audit_dir>
 
     Prints a single JSON object to stdout. Returns process exit code 0
-    on a valid chain, 1 on an invalid chain, 2 on usage error.
+    on a valid chain, 1 on an invalid chain, 2 on usage error. `verify`
+    also exits 2 when it checked zero files (missing dir, empty dir, or
+    only pre-integrity files): nothing checked is not a verified chain.
+    `tip` keeps exiting 0 on an empty chain (src/audit/crosslink.js reads it).
     """
     argv = sys.argv[1:]
     if len(argv) < 2 or argv[0] not in ("tip", "verify", "prefix"):
@@ -889,7 +892,10 @@ def _unified_cli() -> int:
         return 0 if out.get("found", False) else 1
     out = verify_all_logs_in_dir(audit_dir)
     print(json.dumps(out))
-    return 0 if out.get("valid", False) else 1
+    if not out.get("valid", False):
+        return 1
+    # `valid` stays True for an empty chain; checking nothing is not a pass.
+    return 0 if out.get("files_checked", 0) > 0 else 2
 
 
 if __name__ == "__main__":