loki-mode 11.15.0 → 11.17.1

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.15.0
+# Loki Mode v11.17.1
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -200,7 +200,7 @@ This protocol governs **skill module** loading -- task-scoped instruction files
 <!-- generated:commands -->
 Commands (generated from `loki-ts/src/cli/registry.ts`; full reference in `docs/CLI-REFERENCE.md`):
 
-`version`, `status`, `doctor`, `provider`, `memory`, `rollback`, `proof`, `wiki`, `control`, `intent`, `kpis`, `report`, `trust`, `crash`, `contract`, `start`, `slack`, `queue`, `issues`, `undo`, `verify-pr`, `answer`, `engine10`, `help`, `chat`, `edit`, `diff`, `models`, `setup`, `quick`, `quickstart`, `init`, `template`, `verify`, `keys`, `review`, `dashboard`, `config`, `mcp`, `acp`, `stop`, `pause`, `resume`, `why`, `next`, `logs`, `ship`, `deploy`, `import`, `github`, `issue`, `ci`, `modernize`, `share`, `assets`, `export`, `notify`, `tour`, `welcome`, `onboard`, `setup-skill`, `self-update`, `remote`, `cockpit`, `code`, `context`, `secrets`, `api`, `sandbox`, `docker`, `web`, `preview`, `telemetry`, `syslog`, `explain`, `docs`, `test`, `bench`, `voice`, `own`, `secure`, `compliance`, `enterprise`, `projects`, `audit`, `cost`, `metrics`, `sentrux`, `magic`
+`version`, `status`, `doctor`, `provider`, `memory`, `rollback`, `proof`, `wiki`, `control`, `intent`, `kpis`, `report`, `trust`, `crash`, `contract`, `start`, `slack`, `queue`, `issues`, `undo`, `verify-pr`, `answer`, `engine10`, `help`, `chat`, `edit`, `diff`, `models`, `setup`, `quick`, `quickstart`, `init`, `template`, `verify`, `keys`, `review`, `dashboard`, `config`, `mcp`, `acp`, `stop`, `pause`, `resume`, `why`, `next`, `logs`, `ship`, `deploy`, `import`, `github`, `issue`, `ci`, `modernize`, `share`, `assets`, `export`, `notify`, `tour`, `welcome`, `onboard`, `setup-skill`, `self-update`, `remote`, `cockpit`, `code`, `context`, `secrets`, `api`, `sandbox`, `docker`, `web`, `preview`, `telemetry`, `syslog`, `explain`, `docs`, `test`, `bench`, `voice`, `own`, `secure`, `compliance`, `enterprise`, `projects`, `audit`, `cost`, `metrics`, `sentrux`, `magic`, `steer`
 <!-- /generated -->
 
 ---
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.15.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.1 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.15.0
+11.17.1

package/autonomy/grill.sh

@@ -245,7 +245,9 @@ grill_invoke_provider() {
             #     must never mutate the tree (defense-in-depth). Deny Edit/Write/
             #     NotebookEdit + git mutations. Opt out LOKI_REVIEW_TOOL_GUARD=0.
             # Type-guarded so an environment without the helper degrades cleanly.
-            local _gr_argv=("--dangerously-skip-permissions" "--model" "${LOKI_GRILL_MODEL:-sonnet}")
+            _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+            ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
+            local _gr_argv=("${_LOKI_PERM_ARGV[@]}" "--model" "${LOKI_GRILL_MODEL:-sonnet}")
             if type loki_subcall_bare_enabled >/dev/null 2>&1 && loki_subcall_bare_enabled; then
                 _gr_argv+=("--bare")
             fi

package/autonomy/hooks/validate-bash.sh

@@ -28,8 +28,16 @@ case "${LOKI_HOST_GUARD:-0}" in
     1|true|yes|on) HOST_GUARD=true ;;
 esac
 
+# P12-26d: under LOKI_PERMISSION_POLICY=compiled the compiled allow/deny list
+# and permission mode decide. An explicit hook "allow" skips the permission
+# prompt for every command that passes the blocklist, which would widen the
+# compiled policy, so the hook never emits one and fails closed on bad input.
+COMPILED_POLICY=false
+[ "${LOKI_PERMISSION_POLICY:-}" = "compiled" ] && COMPILED_POLICY=true
+
 if ! command -v python3 >/dev/null 2>&1; then
     "$HOST_GUARD" && deny "LOKI_HOST_GUARD: python3 is unavailable, so the Bash command cannot be inspected safely."
+    "$COMPILED_POLICY" && deny "LOKI_PERMISSION_POLICY=compiled: python3 is unavailable, so the Bash command cannot be inspected safely."
     printf '%s' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}'
     exit 0
 fi
@@ -46,6 +54,7 @@ if not isinstance(command, str) or not command.strip():
 sys.stdout.write(command)
 '); then
     "$HOST_GUARD" && deny "LOKI_HOST_GUARD: malformed or missing Bash command input was denied."
+    "$COMPILED_POLICY" && deny "LOKI_PERMISSION_POLICY=compiled: malformed or missing Bash command input was denied."
     printf '%s' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}'
     exit 0
 fi
@@ -342,24 +351,50 @@ BLOCKED_PATTERNS=(
     ":\(\) *\{.*\|.*&"
 )
 
-# Safe path patterns that override blocked pattern matches
+# Safe path patterns that override blocked pattern matches. They are matched
+# per SEGMENT (the command split on ; & | newline CR), never against the whole
+# string: an unanchored or per-line match let `rm -rf /tmp/x; rm -rf /` and
+# `rm -rf /tmp/x<newline>rm -rf /` ride the override. Only the segment that hit
+# a blocked pattern must be safe; an optional trailing /dev/null redirection is
+# allowed, and `*` and `$$` in /tmp names. A `..` anywhere in the segment is
+# never safe.
+_SAFE_REDIR='([[:space:]]+[0-9]*>>?[[:space:]]*/dev/null)*[[:space:]]*'
+_SAFE_ENV='([A-Za-z_][A-Za-z0-9_]*=[A-Za-z0-9._/:-]*[[:space:]]+)*'
+# A dot-leading path component with a glob char (`/tmp/.*` expands to `/tmp/..`).
+_DOT_GLOB='/\.[^/[:space:]]*[*?[]'
 SAFE_PATTERNS=(
-    "rm -rf /tmp/"
-    "rm -rf \.loki/queue/dead-letter"
+    '^[[:space:]]*'"$_SAFE_ENV"'rm -rf (/tmp/([A-Za-z0-9._/*-]|\$\$)+[[:space:]]*)+'"$_SAFE_REDIR"'$'
+    '^[[:space:]]*'"$_SAFE_ENV"'rm -rf \.loki/queue/dead-letter[A-Za-z0-9._/-]*'"$_SAFE_REDIR"'$'
 )
 
+_segment_is_safe() {
+    local seg="$1" safe
+    [[ "$seg" == *".."* ]] && return 1
+    [[ "$seg" =~ $_DOT_GLOB ]] && return 1
+    for safe in "${SAFE_PATTERNS[@]}"; do
+        [[ "$seg" =~ $safe ]] && return 0
+    done
+    return 1
+}
+
+# Succeeds when every segment hitting $1 is safe and at least one segment hits
+# (a pattern that only matches across segments, like `curl x | sh`, is unsafe).
+_blocked_hits_all_safe() {
+    local pat="$1" flat seg hit=false
+    # Strip fd duplication (2>&1) first: its `&` is not a command separator, and removing it hides no command.
+    flat=$(printf '%s' "$COMMAND" | sed -E 's/[0-9]*>&[0-9]+//g' | tr ';&|\r' '\n')
+    while IFS= read -r seg; do
+        printf '%s' "$seg" | grep -qE "$pat" || continue
+        hit=true
+        _segment_is_safe "$seg" || return 1
+    done <<< "$flat"
+    "$hit"
+}
+
 # Check for blocked patterns
 for pattern in "${BLOCKED_PATTERNS[@]}"; do
     if echo "$COMMAND" | grep -qE "$pattern"; then
-        # Check if a safe pattern also matches (whitelist override)
-        is_safe=false
-        for safe in "${SAFE_PATTERNS[@]}"; do
-            if echo "$COMMAND" | grep -qE "$safe"; then
-                is_safe=true
-                break
-            fi
-        done
-        "$is_safe" && continue
+        _blocked_hits_all_safe "$pattern" && continue
         deny "Blocked: potentially dangerous command pattern detected"
     fi
 done
@@ -370,7 +405,10 @@ mkdir -p "$LOG_DIR"
 printf '%s' "{\"timestamp\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"command\":$(echo "$COMMAND" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read()))')}" >> "$LOG_DIR/bash-audit.jsonl"
 echo >> "$LOG_DIR/bash-audit.jsonl"
 
-# Allow command
+# Allow command. Compiled policy: no decision, the permission flow decides.
+if "$COMPILED_POLICY"; then
+    exit 0
+fi
 printf '%s' '{"hookSpecificOutput": {"hookEventName": "PreToolUse", "permissionDecision": "allow"}}'
 
 exit 0

package/autonomy/lib/chat.sh

@@ -3,7 +3,7 @@
 # Sourced by autonomy/loki; defines cmd_chat. Free text goes to the provider
 # in the current mode; slash commands delegate to existing loki commands.
 
-_LOKI_CHAT_SYSTEM_PROMPT="You are running inside Loki Mode chat. Be concise. Prefer small, verifiable changes. Loki commands available to the user: loki start (also --workspace and --deploy), loki quick, loki verify, loki receipt, loki undo."
+_LOKI_CHAT_SYSTEM_PROMPT="You are running inside Loki Mode chat. Be concise. Prefer small, verifiable changes. Loki commands available to the user: loki start (also --workspace and --deploy), loki quick, loki verify, loki receipt, loki undo. During a run, /steer sends a mid-run directive via loki steer (applied at the next plan or implement stage); /pause and /resume control the run, and /answer replies to a blocked run."
 
 _chat_loki_bin() {
     local d="${_LOKI_SCRIPT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
@@ -41,7 +41,14 @@ _chat_help() {
 Loki chat commands:
   /plan              read-only mode (no edits)
   /build             edit mode
-  /run <prd|brief>   loki start with this session's model and provider (same run as the shell)
+  /run <prd|brief>   loki start with this session's model and provider, in the background (alias /start)
+  /start <prd|brief> alias of /run
+  /status            loki status
+  /steer <msg>       send a mid-run directive via loki steer (shows the "Steer rev N received" ack)
+  /stop              loki stop
+  /pause             loki pause (the run halts at the next iteration boundary)
+  /resume            loki resume
+  /answer <text>     loki answer --text: answer a BLOCKED run with a follow-up run
   /workspace <name> <brief>  loki start --workspace (multi-repo run, composite receipt)
   /deploy [--health-url U] [--auto-rollback]  loki deploy --execute after you confirm (gated on a VERIFIED receipt)
   /attach            attach to the current or most recent loki start run in this repo
@@ -64,6 +71,98 @@ HLP
 }
 
 
+# /steer: record source=chat and the chat user as actor (D02). Echo loki steer's own
+# "Steer rev N received" ack; never claim receipt it did not print.
+_chat_steer() {
+    local loki="$1" msg="$2" out rc=0 first
+    case "$msg" in
+        ""|help|h) echo "usage: /steer <message> (not help)"; return 0 ;;
+    esac
+    out="$(LOKI_STEER_SOURCE=chat LOKI_STEER_ACTOR="${LOKI_STEER_ACTOR:-${USER:-chat}}" "$loki" steer -- "$msg" 2>&1)" || rc=$?
+    [ -z "$out" ] || printf '%s\n' "$out"
+    if [ "$rc" -ne 0 ]; then echo "(exit $rc)"
+    elif ! printf '%s\n' "$out" | grep -q 'Steer rev [0-9][0-9]* received'; then
+        first="$(printf '%s\n' "$out" | tr -d '\000-\010\013-\037\177' | sed -n '/[^[:space:]]/{p;q;}' | cut -c1-120)"
+        echo "Steer not confirmed: ${first:-no confirmation from loki steer}"
+    fi
+    return 0
+}
+
+# Monotonic milliseconds and a ms sleep; both are functions so tests can inject a fake clock.
+# The clock source is chosen once per launch (_CHAT_CLOCK) so every read shares one base:
+# perl clock_gettime, else whole seconds from $SECONDS.
+_chat_clock_pick() {
+    if perl -MTime::HiRes=clock_gettime,CLOCK_MONOTONIC -e 'exit 0' >/dev/null 2>&1; then _CHAT_CLOCK=perl; else _CHAT_CLOCK=seconds; fi
+}
+_chat_now_ms() {
+    [ -n "${_CHAT_CLOCK:-}" ] || _chat_clock_pick
+    if [ "$_CHAT_CLOCK" = perl ]; then
+        perl -MTime::HiRes=clock_gettime,CLOCK_MONOTONIC -e 'printf "%d\n", clock_gettime(CLOCK_MONOTONIC) * 1000'
+    else
+        echo $(( SECONDS * 1000 ))
+    fi
+}
+_chat_sleep_ms() {
+    local ms="$1"
+    [ "$ms" -gt 0 ] 2>/dev/null || return 0
+    sleep "$(( ms / 1000 )).$(printf '%03d' $(( ms % 1000 )))"
+}
+
+# /run launch: background `loki start`, then print "Run started" only after the same
+# signals `loki status` reads show a live new run (a new engine10 run dir or a live pid file
+# that was not live before). A start that exits first reports its real error and the log path.
+# Returns non-zero when the start is not proven.
+_chat_run_launch() {
+    local loki="$1" input="$2" root="${LOKI_DIR:-.loki}" log pid rc=0 start_ms deadline_ms now_ms rem_ms iter=0 max_iter before_dir before_state
+    log="$root/chat-run.log"
+    mkdir -p "$root"
+    _chat_clock_pick
+    start_ms="$(_chat_now_ms)" || start_ms=""
+    case "$start_ms" in
+        ''|*[!0-9]*)
+            echo "Run not started (clock read failed before launch). Retry /run." >&2
+            return 1
+            ;;
+    esac
+    before_dir="$(_chat_run_dir)"; before_state="$(_chat_run_state "$before_dir")"
+    _chat_run_start "$loki" "$input" < /dev/null > "$log" 2>&1 &
+    pid=$!
+    local wait_s="${LOKI_CHAT_START_WAIT:-15}"
+    case "$wait_s" in ''|*[!0-9]*) wait_s=15 ;; esac
+    [ "$wait_s" -ge 1 ] || wait_s=1
+    deadline_ms=$(( start_ms + wait_s * 1000 ))
+    # Whole-second clock floors, so allow 1s of slack rather than give up early.
+    [ "$_CHAT_CLOCK" = perl ] || deadline_ms=$(( deadline_ms + 1000 ))
+    max_iter=$(( wait_s * 5 + 10 ))
+    while :; do
+        iter=$(( iter + 1 ))
+        local nd ns
+        nd="$(_chat_run_dir)"; ns="$(_chat_run_state "$nd")"
+        if [ "$ns" = "running" ] && { { [ "$nd" != "$before_dir" ] && _chat_pidfile_live "$nd/run.pid"; } || { [ "$nd" = "$before_dir" ] && [ "$before_state" != "running" ]; }; }; then
+            echo "Run started in the background (pid $pid). Output: $log"
+            return 0
+        fi
+        if ! kill -0 "$pid" 2>/dev/null; then
+            wait "$pid" 2>/dev/null || true
+            rc="$(sed -n 's/.*(run finished, exit \([0-9][0-9]*\).*/\1/p' "$log" 2>/dev/null | tail -n1)"
+            case "$rc" in ''|0) rc=1 ;; esac
+            echo "Run did not start (loki start exited $rc before a live run appeared). Log: $log" >&2
+            tail -n 5 "$log" 2>/dev/null | cut -c1-200 >&2
+            return "$rc"
+        fi
+        # A failed or non-numeric clock read (perl fork EAGAIN) counts as the deadline: never mix clock bases.
+        now_ms="$(_chat_now_ms)" || break
+        case "$now_ms" in ''|*[!0-9]*) break ;; esac
+        rem_ms=$(( deadline_ms - now_ms ))
+        [ "$rem_ms" -gt 0 ] || break
+        [ "$iter" -lt "$max_iter" ] || break
+        [ "$rem_ms" -le 200 ] || rem_ms=200
+        _chat_sleep_ms "$rem_ms"
+    done
+    echo "Run start not confirmed after ${wait_s}s (no live run state; launcher pid $pid still running). Log: $log" >&2
+    return 1
+}
+
 # Run a delegate without letting a non-zero exit end the session (autonomy/loki runs under set -e).
 _chat_do() { local _rc=0; "$@" || _rc=$?; [ "$_rc" -eq 0 ] || echo "(exit $_rc)"; return 0; }
 
@@ -318,7 +417,7 @@ Question: $line" || true
                 /status) _chat_do "$loki" status; continue ;;
                 /steer)
                     [ -n "$rest" ] || { echo "usage: /steer <message>"; continue; }
-                    _chat_do "$loki" steer "$rest"; continue ;;
+                    _chat_steer "$loki" "$rest"; continue ;;
                 /stop) _chat_do "$loki" stop; continue ;;
                 /detach) attached=0; echo "Detached."; continue ;;
             esac
@@ -328,10 +427,10 @@ Question: $line" || true
             /help) _chat_help ;;
             /plan) mode="plan"; echo "Plan mode: read-only." ;;
             /build) mode="build"; echo "Build mode: edits allowed." ;;
-            /run)
+            /run|/start)
                 [ -n "$rest" ] || { echo "usage: /run <prd|brief>"; continue; }
-                _chat_run_start "$loki" "$rest"
-                _chat_attach_banner || true ;;
+                local _lrc=0; _chat_run_launch "$loki" "$rest" || _lrc=$?
+                if [ "$_lrc" -eq 0 ]; then _chat_attach_banner || true; else echo "(exit $_lrc)"; fi ;;
             /workspace)
                 local _ws_name="${rest%% *}" _ws_brief=""
                 [ "$_ws_name" != "$rest" ] && _ws_brief="${rest#* }"
@@ -344,8 +443,13 @@ Question: $line" || true
             /status) _chat_do "$loki" status ;;
             /steer)
                 [ -n "$rest" ] || { echo "usage: /steer <message>"; continue; }
-                _chat_do "$loki" steer "$rest" ;;
+                _chat_steer "$loki" "$rest" ;;
             /stop) _chat_do "$loki" stop ;;
+            /pause) _chat_do "$loki" pause ;;
+            /resume) _chat_do "$loki" resume ;;
+            /answer)
+                [ -n "$rest" ] || { echo "usage: /answer <text>"; continue; }
+                _chat_do "$loki" answer --text "$rest" ;;
             /detach) echo "Not attached." ;;
             /quick)
                 [ -n "$rest" ] || { echo "usage: /quick <task>"; continue; }

package/autonomy/lib/claude-flags.sh

@@ -972,3 +972,23 @@ loki_export_subagent_capacity() {
 # subprocess tree inherits it, so every subcall site gets the same capacity
 # without each one having to remember to call this.
 loki_export_subagent_capacity
+
+# P12-26: LOKI_PERMISSION_POLICY=compiled swaps --dangerously-skip-permissions for
+# --permission-mode / --allowedTools / --disallowedTools compiled from the task policy
+# by src/policies/claude_permissions.js (shared with the TS permissionArgv). Unset =
+# unchanged. Result lands in _LOKI_PERM_ARGV. A compile failure fails closed to plan.
+_loki_claude_permission_argv() {
+    _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+    [ "${LOKI_PERMISSION_POLICY:-}" = "compiled" ] || return 0
+    local _helper _out _a
+    _helper="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/src/policies/claude_permissions.js"
+    _LOKI_PERM_ARGV=(--permission-mode plan)
+    if ! command -v node >/dev/null 2>&1 || [ ! -f "$_helper" ]; then
+        echo "[loki] WARNING: LOKI_PERMISSION_POLICY=compiled: compiler unavailable; using most restrictive mode (plan)" >&2
+        return 0
+    fi
+    _out="$(node "$_helper" "${LOKI_PROJECT_DIR:-$PWD}")" || return 0
+    [ -n "$_out" ] || return 0
+    _LOKI_PERM_ARGV=()
+    while IFS= read -r _a; do _LOKI_PERM_ARGV+=("$_a"); done <<< "$_out"
+}

package/autonomy/lib/claude_permissions.py

@@ -0,0 +1,40 @@
+"""P12-26b: Python entry to the shared Claude permission policy.
+
+New file: the python launch sites (dashboard, magic) need the same argv as the
+bash and TS routes; this is a thin caller of src/policies/claude_permissions.js
+(the single compiler), not a second implementation. Unset LOKI_PERMISSION_POLICY
+returns the legacy flag byte-identically.
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+_LEGACY = ["--dangerously-skip-permissions"]
+_FAIL_CLOSED = ["--permission-mode", "plan"]
+
+
+def claude_permission_argv(project_dir: str | None = None, env: dict | None = None) -> list:
+    env = os.environ if env is None else env
+    if env.get("LOKI_PERMISSION_POLICY", "") != "compiled":
+        return list(_LEGACY)
+    helper = Path(__file__).resolve().parents[2] / "src" / "policies" / "claude_permissions.js"
+    node = shutil.which("node")
+    if node is None or not helper.is_file():
+        print("[loki] WARNING: LOKI_PERMISSION_POLICY=compiled: compiler unavailable; using most restrictive mode (plan)", file=sys.stderr)
+        return list(_FAIL_CLOSED)
+    target = project_dir or env.get("LOKI_PROJECT_DIR") or os.getcwd()
+    try:
+        done = subprocess.run([node, str(helper), str(target)], capture_output=True, text=True,
+                              timeout=30, env=dict(env), check=False)
+    except (OSError, subprocess.SubprocessError):
+        return list(_FAIL_CLOSED)
+    if done.stderr:
+        sys.stderr.write(done.stderr)
+    args = [a for a in done.stdout.split("\n") if a]
+    if done.returncode != 0 or not args:
+        return list(_FAIL_CLOSED)
+    return args

package/autonomy/lib/done-recognition.sh

@@ -157,13 +157,15 @@ _loki_done_recog_invoke() {
         local _dr_schema_content _dr_json _dr_obj
         _dr_schema_content="$(cat "$_dr_schema" 2>/dev/null)" || _dr_schema_content=""
         if [ -n "$_dr_schema_content" ]; then
+            _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+            ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
             if command -v timeout >/dev/null 2>&1; then
                 _dr_json=$(CAVEMAN_DEFAULT_MODE=off timeout "${LOKI_DONE_RECOG_TIMEOUT}" \
-                    claude --dangerously-skip-permissions -p "$prompt" \
+                    claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" \
                     --json-schema "$_dr_schema_content" --output-format json 2>/dev/null) || _dr_json=""
             else
                 _dr_json=$(CAVEMAN_DEFAULT_MODE=off \
-                    claude --dangerously-skip-permissions -p "$prompt" \
+                    claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" \
                     --json-schema "$_dr_schema_content" --output-format json 2>/dev/null) || _dr_json=""
             fi
             local _dr_py
@@ -192,12 +194,14 @@ except Exception:
 
     local rc=0
     local out=""
+    _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+    ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
     if command -v timeout >/dev/null 2>&1; then
         out=$(CAVEMAN_DEFAULT_MODE=off timeout "${LOKI_DONE_RECOG_TIMEOUT}" \
-                  claude --dangerously-skip-permissions -p "$prompt" 2>/dev/null) || rc=$?
+                  claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" 2>/dev/null) || rc=$?
     else
         out=$(CAVEMAN_DEFAULT_MODE=off \
-                  claude --dangerously-skip-permissions -p "$prompt" 2>/dev/null) || rc=$?
+                  claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" 2>/dev/null) || rc=$?
     fi
     [ "$rc" -ne 0 ] && return 1
     [ -z "$out" ] && return 1

package/autonomy/lib/engine10-push.sh

@@ -2,7 +2,8 @@
 # Loki 10 engine P4 push child (ENGINE.md sections 6 and 7).
 #
 #   engine10-push.sh push-pr <repo-dir> <branch> <title> <body-file> [--draft] [--base <branch>]
-#   engine10-push.sh check-origin   (exit 0 when the pinned origin is acceptable to push-pr, else the refusal; no network)
+#   engine10-push.sh pr-ready <repo-dir> <branch> <body-file> <pr-url>   (reused open PR: replace its body, then mark it ready; <pr-url> must be the pinned-owner PR)
+#   engine10-push.sh check-origin  (exit 0 when the pinned origin is acceptable to push-pr, else the refusal; no network)
 #   engine10-push.sh comment <pr-number> <body-file>
 #   engine10-push.sh issue-comment [--update] <issue-ref> <body-file>
 #   engine10-push.sh status  <sha> <pending|success|failure|error> <description>
@@ -117,6 +118,16 @@ _e10_local_push() {
 
 _e10_gh() { _loki_with_github_tokens _loki_run_neutral "$_e10_repo" command gh "$@"; }
 
+# The one open-PR lookup for push-pr reuse and pr-ready. gh cannot filter --head by owner, so a stranger's fork PR with the
+# same branch name would match; select only a same-repo PR from the pinned owner. Prints the URL, or nothing.
+_e10_find_pr() {
+    local owner="${_e10_repo%%/*}"
+    case "$owner" in '' | *[!A-Za-z0-9_.-]*) return 1 ;; esac
+    _e10_gh pr list --repo "$_e10_repo" --head "$1" --state open \
+        --json url,isCrossRepository,headRepositoryOwner,headRefName,state \
+        --jq "[.[] | select(.isCrossRepository == false and .state == \"OPEN\" and (.headRepositoryOwner.login | ascii_downcase) == \"$(printf '%s' "$owner" | tr '[:upper:]' '[:lower:]')\")] | .[0].url // empty"
+}
+
 mode="${1:-}"
 shift || true
 case "$mode" in
@@ -157,10 +168,9 @@ case "$mode" in
         else
             _loki_trusted_push _loki_with_github_tokens "$dir" "$branch" || die "push refused or failed (rc=$?)"
         fi
-        url="$(_e10_gh pr list --repo "$_e10_repo" --head "$branch" --state open --json url --jq '.[0].url')" \
-            || die "gh pr list failed"
+        url="$(_e10_find_pr "$branch")" || die "gh pr list failed"
         _e10_pr_state=reused
-        if [ -z "$url" ] || [ "$url" = "null" ]; then
+        if [ -z "$url" ]; then
             _e10_pr_state=created
             url="$(_e10_gh pr create --repo "$_e10_repo" --head "$branch" --title "$title" --body-file "$body" "${draft[@]}" "${base[@]}")" \
                 || die "gh pr create failed"
@@ -169,6 +179,21 @@ case "$mode" in
         printf '%s\n' "$_e10_pr_state"  # marker line before the URL: reused (open PR found) or created
         printf '%s\n' "$url"
         ;;
+    pr-ready)
+        # M-21 N3: a reused wave PR whose units are all PROVEN keeps its old draft state and body; fix both, same pinned origin and tokens as push-pr.
+        [ "$#" -eq 4 ] || die "usage: pr-ready <repo-dir> <branch> <body-file> <pr-url>"
+        branch="$2" body="$3" want_url="$4"
+        [ -f "$body" ] || die "body file not found: $body"
+        git check-ref-format --branch "$branch" >/dev/null 2>&1 || die "invalid branch: $branch"
+        case "$branch" in main | master | HEAD) die "refusing to edit a PR for default branch: $branch" ;; esac
+        [ -z "$_e10_local" ] || { log_info "local origin: no PR to mark ready (no-op)"; exit 0; }
+        url="$(_e10_find_pr "$branch")" || die "gh pr list failed"
+        [ -n "$url" ] || die "no open PR from $_e10_repo for branch: $branch"
+        [ "$url" = "$want_url" ] || die "refusing: PR $want_url is not the pinned-owner PR for $branch ($url)"
+        _e10_gh pr edit "$url" --repo "$_e10_repo" --body-file "$body" >/dev/null || die "gh pr edit failed"
+        _e10_gh pr ready "$url" --repo "$_e10_repo" >/dev/null || die "gh pr ready failed"
+        printf '%s\n' "$url"
+        ;;
     comment)
         [ "$#" -eq 2 ] || die "usage: comment <pr-number> <body-file>"
         case "$1" in '' | *[!0-9]*) die "pr number must be digits" ;; esac
@@ -215,5 +240,5 @@ case "$mode" in
         _e10_gh api "repos/$_e10_repo/statuses/$1" -f "state=$2" -f context=loki/deep-verify \
             -f "description=$3" >/dev/null || die "gh api status failed"
         ;;
-    *) die "usage: engine10-push.sh push-pr|comment|issue-comment|status ..." ;;
+    *) die "usage: engine10-push.sh push-pr|pr-ready|comment|issue-comment|status ..." ;;
 esac

package/autonomy/lib/prd-enrich.sh

@@ -86,14 +86,16 @@ _loki_prd_enrich_invoke() {
     command -v claude >/dev/null 2>&1 || return 1
     local rc=0
     local out=""
+    _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+    ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
     if command -v timeout >/dev/null 2>&1; then
         out=$(CAVEMAN_DEFAULT_MODE=off timeout "${LOKI_PRD_ENRICH_TIMEOUT}" \
-                  claude --dangerously-skip-permissions -p "$prompt" 2>/dev/null) || rc=$?
+                  claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" 2>/dev/null) || rc=$?
     else
         # No coreutils timeout (e.g. bare macOS). Run without it; the model
         # call is a one-shot and the caller still tolerates failure.
         out=$(CAVEMAN_DEFAULT_MODE=off \
-                  claude --dangerously-skip-permissions -p "$prompt" 2>/dev/null) || rc=$?
+                  claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" 2>/dev/null) || rc=$?
     fi
     [ "$rc" -ne 0 ] && return 1
     [ -z "$out" ] && return 1

package/autonomy/lib/proof-generator.py

@@ -1455,6 +1455,11 @@ def _collect_journey(loki_dir):
                 },
                 "waited_s": ws,
             }
+            # active_s (measured active human seconds) rides along only when
+            # recorded; absent stays absent, never a fabricated 0.
+            act = iv.get("active_s")
+            if isinstance(act, int) and not isinstance(act, bool) and act >= 0:
+                out["interventions_detail"]["active_s"] = act
 
     # PR state/URL, written by the consent-gated PR step. "prepared" means a PR
     # body exists locally and GitHub was NOT mutated.

package/autonomy/lib/proof-verify.py

@@ -1173,10 +1173,34 @@ def git_head(repo):
     return out.strip() if out and out.strip() else ""
 
 
+def _sparse_included(repo, paths):
+    """Set of `paths` git's own sparse matcher includes; None when git cannot answer.
+
+    One `git sparse-checkout check-rules` call for the whole batch: it echoes
+    the paths the patterns include, for cone, non-cone and negation alike.
+    Known limit: a .git directory writable by the subject can drop paths from
+    info/sparse-checkout. That hole predates this check (core.sparseCheckout=true
+    alone was enough).
+    """
+    enc = [p.encode("utf-8", "surrogateescape") for p in paths]
+    try:
+        r = subprocess.run(
+            ["git", "-C", repo or ".", "sparse-checkout", "check-rules", "-z"],
+            input=b"".join(e + b"\0" for e in enc),
+            capture_output=True, timeout=60, env=_scoped_env())
+    except (OSError, subprocess.SubprocessError, ValueError):
+        return None
+    if r.returncode != 0:
+        return None
+    out = set(r.stdout.split(b"\0"))
+    return set(p for p, e in zip(paths, enc) if e in out)
+
+
 def git_dirty(repo):
     """True/False, or None when git cannot answer. .loki/ is excluded: the
     verifier writes its own artifacts there."""
-    out = _vr_git_args(repo, ["status", "--porcelain"])
+    out = _vr_git_args(repo, ["status", "--porcelain", "--untracked-files=all",
+                                "--no-renames", "--ignore-submodules=none"])
     if out is None:
         return None
     for line in out.splitlines():
@@ -1185,6 +1209,90 @@ def git_dirty(repo):
             path = path.strip('"')
         if not (path.startswith(".loki/") or path == ".loki"):
             return True
+    # A skip-worktree (S/s) or assume-unchanged (lowercase tag) flag hides edits
+    # from status. A flagged path is dirty only when its content differs from
+    # the index; a skip-worktree path absent on disk is sparse-excluded (clean).
+    flagged = _vr_git_args(repo, ["ls-files", "-v", "-z"])
+    if flagged is None:
+        return None
+    cand = []
+    for ent in flagged.split("\0"):
+        tag, path = ent[:1], ent[2:]
+        if not path or path.startswith(".loki/"):
+            continue
+        if tag in ("S", "s") or tag.islower():
+            cand.append((tag in ("S", "s"), path))
+    if not cand:
+        return False
+    staged = _vr_git_args(repo, ["ls-files", "-s", "-z"])
+    if staged is None:
+        return None
+    blobs = {}
+    for ent in staged.split("\0"):
+        meta, _, p = ent.partition("\t")
+        f = meta.split()
+        if len(f) == 3 and f[2] == "0":
+            blobs[p] = (f[0], f[1])
+    sparse = (_vr_git_args(repo, ["config", "--bool", "core.sparseCheckout"]) or "").strip() == "true"
+    root = repo or "."
+    bad = None
+    todo = []
+    sparse_missing = []
+    for skip, path in cand:
+        full = os.path.join(root, path)
+        mode, want = blobs.get(path, ("", ""))
+        if not os.path.lexists(full):
+            if skip and sparse:
+                # Decided after the loop in one batched git call: clean only when
+                # git's sparse patterns exclude the path. An in-cone path flagged
+                # by hand and deleted is a real deletion; fail closed otherwise.
+                sparse_missing.append(path)
+                continue
+            bad = (skip, path)
+            break
+        if mode == "160000":
+            continue
+        if os.path.islink(full):
+            data = os.readlink(full).encode("utf-8", "surrogateescape")
+            if hashlib.sha1(b"blob %d\0" % len(data) + data).hexdigest() != want:
+                bad = (skip, path)
+                break
+            continue
+        todo.append((skip, path))
+    if sparse_missing and not bad:
+        included = _sparse_included(repo, sparse_missing)
+        for path in sparse_missing:
+            if included is None or path in included:
+                bad = (True, path)
+                break
+    for i in range(0, len(todo), 200):
+        if bad:
+            break
+        chunk = todo[i:i + 200]
+        out = _vr_git_args(repo, ["hash-object", "--"] + [p for _, p in chunk])
+        if out is None:
+            return None
+        miss = [(s, p) for (s, p), h in zip(chunk, out.split())
+                if h != blobs.get(p, ("", ""))[1]]
+        if miss:
+            # Identical raw bytes mean clean (CRLF in the index plus autocrlf).
+            # The clean filter is not idempotent: the index may hold unfiltered
+            # bytes that a filtered hash of the worktree file never reproduces,
+            # so the filtered hash alone would call such a file dirty.
+            raw = _vr_git_args(repo, ["hash-object", "--no-filters", "--"] + [p for _, p in miss])
+            if raw is None:
+                return None
+            for (skip, path), h in zip(miss, raw.split()):
+                if h != blobs.get(path, ("", ""))[1]:
+                    bad = (skip, path)
+                    break
+    if bad:
+        skip, path = bad
+        kind, fix = (("skip-worktree", "--no-skip-worktree") if skip
+                     else ("assume-unchanged", "--no-assume-unchanged"))
+        sys.stderr.write("dirty: %s is flagged %s and differs from the index, which hides edits from the proof. "
+                         "Run: git update-index %s -- %s\n" % (path, kind, fix, path))
+        return True
     return False