loki-mode 11.12.1 → 11.17.1

package/autonomy/lib/proof-generator.py

@@ -1441,6 +1441,25 @@ def _collect_journey(loki_dir):
         n = iv.get("count")
         if isinstance(n, int) and n >= 0:
             out["interventions"] = n
+        # by_type / waited_s exist only for counters written by the current
+        # handle_pause. A count-only legacy file yields no detail (unmeasured,
+        # never a fabricated zero). waited_s is wall-clock blocked seconds, an
+        # upper bound on human attention, not active time.
+        bt = iv.get("by_type")
+        ws = iv.get("waited_s")
+        if isinstance(bt, dict) and isinstance(ws, int) and not isinstance(ws, bool) and ws >= 0:
+            out["interventions_detail"] = {
+                "by_type": {
+                    k: (bt[k] if isinstance(bt.get(k), int) and not isinstance(bt.get(k), bool) and bt[k] >= 0 else 0)
+                    for k in ("steer", "input", "authorization", "repair")
+                },
+                "waited_s": ws,
+            }
+            # active_s (measured active human seconds) rides along only when
+            # recorded; absent stays absent, never a fabricated 0.
+            act = iv.get("active_s")
+            if isinstance(act, int) and not isinstance(act, bool) and act >= 0:
+                out["interventions_detail"]["active_s"] = act
 
     # PR state/URL, written by the consent-gated PR step. "prepared" means a PR
     # body exists locally and GitHub was NOT mutated.
@@ -1847,6 +1866,8 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
     # "unavailable" rather than showing a fabricated zero.
     if isinstance(journey, dict) and isinstance(journey.get("interventions"), int):
         proof["interventions"] = journey["interventions"]
+    if isinstance(journey, dict) and isinstance(journey.get("interventions_detail"), dict):
+        proof["interventions_detail"] = journey["interventions_detail"]
 
     return proof, run_id
 

package/autonomy/lib/proof-verify.py

@@ -1173,10 +1173,34 @@ def git_head(repo):
     return out.strip() if out and out.strip() else ""
 
 
+def _sparse_included(repo, paths):
+    """Set of `paths` git's own sparse matcher includes; None when git cannot answer.
+
+    One `git sparse-checkout check-rules` call for the whole batch: it echoes
+    the paths the patterns include, for cone, non-cone and negation alike.
+    Known limit: a .git directory writable by the subject can drop paths from
+    info/sparse-checkout. That hole predates this check (core.sparseCheckout=true
+    alone was enough).
+    """
+    enc = [p.encode("utf-8", "surrogateescape") for p in paths]
+    try:
+        r = subprocess.run(
+            ["git", "-C", repo or ".", "sparse-checkout", "check-rules", "-z"],
+            input=b"".join(e + b"\0" for e in enc),
+            capture_output=True, timeout=60, env=_scoped_env())
+    except (OSError, subprocess.SubprocessError, ValueError):
+        return None
+    if r.returncode != 0:
+        return None
+    out = set(r.stdout.split(b"\0"))
+    return set(p for p, e in zip(paths, enc) if e in out)
+
+
 def git_dirty(repo):
     """True/False, or None when git cannot answer. .loki/ is excluded: the
     verifier writes its own artifacts there."""
-    out = _vr_git_args(repo, ["status", "--porcelain"])
+    out = _vr_git_args(repo, ["status", "--porcelain", "--untracked-files=all",
+                                "--no-renames", "--ignore-submodules=none"])
     if out is None:
         return None
     for line in out.splitlines():
@@ -1185,6 +1209,90 @@ def git_dirty(repo):
             path = path.strip('"')
         if not (path.startswith(".loki/") or path == ".loki"):
             return True
+    # A skip-worktree (S/s) or assume-unchanged (lowercase tag) flag hides edits
+    # from status. A flagged path is dirty only when its content differs from
+    # the index; a skip-worktree path absent on disk is sparse-excluded (clean).
+    flagged = _vr_git_args(repo, ["ls-files", "-v", "-z"])
+    if flagged is None:
+        return None
+    cand = []
+    for ent in flagged.split("\0"):
+        tag, path = ent[:1], ent[2:]
+        if not path or path.startswith(".loki/"):
+            continue
+        if tag in ("S", "s") or tag.islower():
+            cand.append((tag in ("S", "s"), path))
+    if not cand:
+        return False
+    staged = _vr_git_args(repo, ["ls-files", "-s", "-z"])
+    if staged is None:
+        return None
+    blobs = {}
+    for ent in staged.split("\0"):
+        meta, _, p = ent.partition("\t")
+        f = meta.split()
+        if len(f) == 3 and f[2] == "0":
+            blobs[p] = (f[0], f[1])
+    sparse = (_vr_git_args(repo, ["config", "--bool", "core.sparseCheckout"]) or "").strip() == "true"
+    root = repo or "."
+    bad = None
+    todo = []
+    sparse_missing = []
+    for skip, path in cand:
+        full = os.path.join(root, path)
+        mode, want = blobs.get(path, ("", ""))
+        if not os.path.lexists(full):
+            if skip and sparse:
+                # Decided after the loop in one batched git call: clean only when
+                # git's sparse patterns exclude the path. An in-cone path flagged
+                # by hand and deleted is a real deletion; fail closed otherwise.
+                sparse_missing.append(path)
+                continue
+            bad = (skip, path)
+            break
+        if mode == "160000":
+            continue
+        if os.path.islink(full):
+            data = os.readlink(full).encode("utf-8", "surrogateescape")
+            if hashlib.sha1(b"blob %d\0" % len(data) + data).hexdigest() != want:
+                bad = (skip, path)
+                break
+            continue
+        todo.append((skip, path))
+    if sparse_missing and not bad:
+        included = _sparse_included(repo, sparse_missing)
+        for path in sparse_missing:
+            if included is None or path in included:
+                bad = (True, path)
+                break
+    for i in range(0, len(todo), 200):
+        if bad:
+            break
+        chunk = todo[i:i + 200]
+        out = _vr_git_args(repo, ["hash-object", "--"] + [p for _, p in chunk])
+        if out is None:
+            return None
+        miss = [(s, p) for (s, p), h in zip(chunk, out.split())
+                if h != blobs.get(p, ("", ""))[1]]
+        if miss:
+            # Identical raw bytes mean clean (CRLF in the index plus autocrlf).
+            # The clean filter is not idempotent: the index may hold unfiltered
+            # bytes that a filtered hash of the worktree file never reproduces,
+            # so the filtered hash alone would call such a file dirty.
+            raw = _vr_git_args(repo, ["hash-object", "--no-filters", "--"] + [p for _, p in miss])
+            if raw is None:
+                return None
+            for (skip, path), h in zip(miss, raw.split()):
+                if h != blobs.get(path, ("", ""))[1]:
+                    bad = (skip, path)
+                    break
+    if bad:
+        skip, path = bad
+        kind, fix = (("skip-worktree", "--no-skip-worktree") if skip
+                     else ("assume-unchanged", "--no-assume-unchanged"))
+        sys.stderr.write("dirty: %s is flagged %s and differs from the index, which hides edits from the proof. "
+                         "Run: git update-index %s -- %s\n" % (path, kind, fix, path))
+        return True
     return False
 
 

package/autonomy/lib/trust_trajectory.py

@@ -21,6 +21,14 @@ Direction (up/down/flat) is computed by a median half-split: mean of the later
 half minus mean of the earlier half. Robust to one noisy run, no float
 regression needed, and a 2-run series degrades to last-vs-first.
 
+Outcome effort definitions (shared with loki-ts/src/metrics/trust.ts and
+benchmarks/bench/attribution.py; see docs/EVALUATING.md "Outcome analytics"):
+accepted = verdict VERIFIED and not later contradicted; misleading completion =
+false_verified / VERIFIED-claimed (attribution false_completion); cost per
+accepted = total spend over ALL runs / accepted, None when nothing was accepted
+or any run's cost is unmeasured. Waited seconds are wall-clock blocked time, an
+upper bound on human attention; active minutes are NOT measured.
+
 Public API:
   compute_trajectory(loki_dir) -> dict   (schema_version 1)
   format_trajectory_human(traj) -> str
@@ -160,6 +168,52 @@ def _interventions_value(proof):
     return None
 
 
+_IV_TYPES = ("steer", "input", "authorization", "repair")
+
+
+def _cost_value(proof):
+    usd = _obj(proof.get("cost")).get("usd")
+    if usd is None or isinstance(usd, bool):
+        return None
+    try:
+        n = float(usd)
+    except (TypeError, ValueError):
+        return None
+    return n if n >= 0 and n == n and n != float("inf") else None
+
+
+def _intervention_detail(proof):
+    """(by_type, waited_s, active_s) from proof.interventions_detail; None when absent."""
+    d = _obj(proof.get("interventions_detail"))
+    bt = _obj(d.get("by_type"))
+    out = {}
+    any_key = False
+    for k in _IV_TYPES:
+        try:
+            n = int(bt.get(k))
+        except (TypeError, ValueError):
+            n = 0
+        out[k] = n if n >= 0 else 0
+        if bt.get(k) is not None:
+            any_key = True
+    w = d.get("waited_s")
+    ws = w if isinstance(w, (int, float)) and not isinstance(w, bool) and w >= 0 else None
+    a = d.get("active_s")
+    act = a if isinstance(a, int) and not isinstance(a, bool) and a >= 0 else None
+    return (out if any_key else None), ws, act
+
+
+def _verdict_evidence(proof):
+    raw = str(proof.get("verdict") or "").strip().upper()
+    verdict = raw or None
+    later = str(proof.get("later_verdict") or "").strip().upper()
+    if proof.get("false_verified") is True:
+        return verdict, True
+    if verdict is None:
+        return verdict, None
+    return verdict, verdict == "VERIFIED" and later == "FAILED"
+
+
 def _load_runs(loki_dir):
     """Read every .loki/proofs/<id>/proof.json into a time-ordered run list."""
     proofs_dir = os.path.join(loki_dir, "proofs")
@@ -176,7 +230,15 @@ def _load_runs(loki_dir):
         if not isinstance(proof, dict):
             # Malformed / partial proof: skip, do not fail the trajectory.
             continue
+        verdict, false_verified = _verdict_evidence(proof)
+        by_type, waited_s, active_s = _intervention_detail(proof)
         runs.append({
+            "verdict": verdict,
+            "false_verified": false_verified,
+            "cost_usd": _cost_value(proof),
+            "interventions_by_type": by_type,
+            "waited_s": waited_s,
+            "active_s": active_s,
             "run_id": str(proof.get("run_id") or name),
             "generated_at": proof.get("generated_at"),
             "council_pass_rate": _council_pass_value(proof.get("council")),
@@ -262,6 +324,70 @@ def _direction_for_axis(axis, ordered_values):
     }
 
 
+def outcome_effort(series):
+    """Effort-per-outcome block; every unmeasured input yields None, never 0."""
+    accepted = sum(1 for r in series if r["verdict"] == "VERIFIED" and r["false_verified"] is not True)
+    claimed = sum(1 for r in series if r["verdict"] == "VERIFIED" or r["false_verified"] is True)
+    false_v = sum(1 for r in series if r["false_verified"] is True)
+    unmeasured = sum(1 for r in series if r["cost_usd"] is None)
+    cost = None
+    cost_note = None
+    if not series:
+        cost_note = "no runs"
+    elif accepted == 0:
+        cost_note = "no accepted run, cost per accepted is undefined"
+    elif unmeasured:
+        cost_note = "cost unmeasured for %d of %d runs, a partial sum is not a total" % (unmeasured, len(series))
+    else:
+        cost = round(sum(r["cost_usd"] for r in series) / accepted, 6)
+    with_detail = [r for r in series if r["interventions_by_type"] is not None]
+    by_type = None
+    if with_detail:
+        by_type = {k: sum(r["interventions_by_type"][k] for r in with_detail) for k in _IV_TYPES}
+    all_iv = bool(series) and all(r["interventions"] is not None for r in series)
+    all_waited = bool(series) and all(r["waited_s"] is not None for r in series)
+    all_active = bool(series) and all(r["active_s"] is not None for r in series)
+    return {
+        "runs": len(series),
+        "accepted": accepted,
+        "claimed_verified": claimed,
+        "false_verified": false_v,
+        "misleading_completion_rate": round(false_v / claimed, 4) if claimed else None,
+        "cost_per_accepted_usd": cost,
+        "cost_note": cost_note,
+        "interventions_by_type": by_type,
+        "interventions_per_accepted": (
+            round(sum(r["interventions"] for r in series) / accepted, 4) if accepted and all_iv else None),
+        "waited_min_per_accepted": (
+            round(sum(r["waited_s"] for r in series) / 60.0 / accepted, 1) if accepted and all_waited else None),
+        "active_min_per_accepted": (
+            round(sum(r["active_s"] for r in series) / 60.0 / accepted, 1) if accepted and all_active else None),
+    }
+
+
+def _fmt_outcome_effort(e):
+    mc = e.get("misleading_completion_rate")
+    lines = ["Outcome effort"]
+    lines.append("  Accepted (VERIFIED): %d of %d runs" % (e["accepted"], e["runs"]))
+    lines.append("  Misleading completion: %s" % (
+        "n/a (no VERIFIED claims)" if mc is None else
+        "%d of %d VERIFIED claims (%s%%)" % (e["false_verified"], e["claimed_verified"], round(mc * 100, 1))))
+    lines.append("  Cost per accepted: %s" % (
+        "n/a (%s)" % (e.get("cost_note") or "unmeasured") if e["cost_per_accepted_usd"] is None
+        else "$%.2f" % e["cost_per_accepted_usd"]))
+    bt = e.get("interventions_by_type")
+    lines.append("  Interventions by type: %s" % (
+        "not recorded" if bt is None else ", ".join("%s %d" % (k, bt[k]) for k in _IV_TYPES)))
+    ipa = e.get("interventions_per_accepted")
+    lines.append("  Interventions per accepted: %s" % ("n/a" if ipa is None else ipa))
+    w = e.get("waited_min_per_accepted")
+    lines.append("  Minutes per accepted: %s" % (
+        "n/a" if w is None else "%s (waited, upper bound)" % w))
+    am = e.get("active_min_per_accepted")
+    lines.append("  Active minutes per accepted: %s" % ("n/a (not measured)" if am is None else am))
+    return lines
+
+
 def compute_trajectory(loki_dir):
     """Return the R4 trust trajectory snapshot for a project's .loki dir."""
     runs = _load_runs(loki_dir)
@@ -276,6 +402,12 @@ def compute_trajectory(loki_dir):
             "gate_pass_rate": r["gate_pass_rate"],
             "iterations": r["iterations"],
             "interventions": r["interventions"],
+            "cost_usd": r["cost_usd"],
+            "interventions_by_type": r["interventions_by_type"],
+            "waited_s": r["waited_s"],
+            "active_s": r["active_s"],
+            "verdict": r["verdict"],
+            "false_verified": r["false_verified"],
         })
 
     axes = {}
@@ -317,6 +449,7 @@ def compute_trajectory(loki_dir):
         "regressing_axes": regressing_axes,
         "series": series,
         "notes": notes,
+        "outcome_effort": outcome_effort(series),
     }
 
 
@@ -376,6 +509,9 @@ def format_trajectory_human(traj):
         lines.append("Not enough history yet.")
         lines.append("Trust trajectory needs 2+ recorded runs to show a direction.")
         lines.append("Each `loki start` run writes a proof-of-run; come back after the next run.")
+        if traj.get("runs_count") and traj.get("outcome_effort"):
+            lines.append("")
+            lines.extend(_fmt_outcome_effort(traj["outcome_effort"]))
         if traj.get("notes"):
             lines.append("")
             lines.append("Notes")
@@ -398,6 +534,9 @@ def format_trajectory_human(traj):
         lines.append("Overall: mixed (%d improving / %d regressing)." % (imp, reg))
     else:
         lines.append("Overall: stable.")
+    if traj.get("outcome_effort"):
+        lines.append("")
+        lines.extend(_fmt_outcome_effort(traj["outcome_effort"]))
     if traj.get("notes"):
         lines.append("")
         lines.append("Notes")

package/autonomy/lib/voter-agents.sh

@@ -373,8 +373,10 @@ loki_council_dispatch_agents() {
     # (completion-council.sh:2792). Fail-closed: a hung or timed-out council can
     # never become a false COMPLETE; it always degrades to the heuristic path
     # (which has its own timeout + conservative defaults).
+    _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+    ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
     response=$(timeout "${LOKI_COUNCIL_REVIEW_TIMEOUT:-600}" \
-                      env CAVEMAN_DEFAULT_MODE=off claude --dangerously-skip-permissions \
+                      env CAVEMAN_DEFAULT_MODE=off claude "${_LOKI_PERM_ARGV[@]}" \
                       -p "$prompt" \
                       --agents "$agents_json" \
                       --json-schema "$schema_content" 2>"$stderr_log") || rc=$?

package/autonomy/lib/workspace.py

@@ -222,8 +222,7 @@ def run_integration(ws, run_dir, worktrees, heads):
     """Run the integration command once; return the evidence dict."""
     integ = ws.get("integration") or {}
     cmd = integ.get("command")
-    ev = {"heads": heads, "exit_code": None, "log_sha256": None, "status": "not_configured",
-          "seal": False, "note": "integration evidence is bound by composite.json only when the run seals one"}
+    ev = {"heads": heads, "exit_code": None, "log_sha256": None, "status": "not_configured"}
     if not cmd:
         return ev
     timeout = integ.get("timeout_s", 900)
@@ -245,7 +244,7 @@ def run_integration(ws, run_dir, worktrees, heads):
             p.wait()
             rc = 124
             ev["status"] = "failed"
-            ev["note"] += "; timeout after %ss" % timeout
+            ev["note"] = "timeout after %ss" % timeout
     ev["exit_code"] = rc
     with open(log_path, "rb") as f:
         ev["log_sha256"] = hashlib.sha256(f.read()).hexdigest()