loki-mode 11.15.0 → 11.17.1

package/autonomy/lib/trust_trajectory.py

@@ -183,7 +183,7 @@ def _cost_value(proof):
 
 
 def _intervention_detail(proof):
-    """(by_type, waited_s) from proof.interventions_detail; None when absent."""
+    """(by_type, waited_s, active_s) from proof.interventions_detail; None when absent."""
     d = _obj(proof.get("interventions_detail"))
     bt = _obj(d.get("by_type"))
     out = {}
@@ -198,7 +198,9 @@ def _intervention_detail(proof):
             any_key = True
     w = d.get("waited_s")
     ws = w if isinstance(w, (int, float)) and not isinstance(w, bool) and w >= 0 else None
-    return (out if any_key else None), ws
+    a = d.get("active_s")
+    act = a if isinstance(a, int) and not isinstance(a, bool) and a >= 0 else None
+    return (out if any_key else None), ws, act
 
 
 def _verdict_evidence(proof):
@@ -229,13 +231,14 @@ def _load_runs(loki_dir):
             # Malformed / partial proof: skip, do not fail the trajectory.
             continue
         verdict, false_verified = _verdict_evidence(proof)
-        by_type, waited_s = _intervention_detail(proof)
+        by_type, waited_s, active_s = _intervention_detail(proof)
         runs.append({
             "verdict": verdict,
             "false_verified": false_verified,
             "cost_usd": _cost_value(proof),
             "interventions_by_type": by_type,
             "waited_s": waited_s,
+            "active_s": active_s,
             "run_id": str(proof.get("run_id") or name),
             "generated_at": proof.get("generated_at"),
             "council_pass_rate": _council_pass_value(proof.get("council")),
@@ -343,6 +346,7 @@ def outcome_effort(series):
         by_type = {k: sum(r["interventions_by_type"][k] for r in with_detail) for k in _IV_TYPES}
     all_iv = bool(series) and all(r["interventions"] is not None for r in series)
     all_waited = bool(series) and all(r["waited_s"] is not None for r in series)
+    all_active = bool(series) and all(r["active_s"] is not None for r in series)
     return {
         "runs": len(series),
         "accepted": accepted,
@@ -356,6 +360,8 @@ def outcome_effort(series):
             round(sum(r["interventions"] for r in series) / accepted, 4) if accepted and all_iv else None),
         "waited_min_per_accepted": (
             round(sum(r["waited_s"] for r in series) / 60.0 / accepted, 1) if accepted and all_waited else None),
+        "active_min_per_accepted": (
+            round(sum(r["active_s"] for r in series) / 60.0 / accepted, 1) if accepted and all_active else None),
     }
 
 
@@ -376,7 +382,9 @@ def _fmt_outcome_effort(e):
     lines.append("  Interventions per accepted: %s" % ("n/a" if ipa is None else ipa))
     w = e.get("waited_min_per_accepted")
     lines.append("  Minutes per accepted: %s" % (
-        "n/a" if w is None else "%s (waited, upper bound; active minutes are not measured)" % w))
+        "n/a" if w is None else "%s (waited, upper bound)" % w))
+    am = e.get("active_min_per_accepted")
+    lines.append("  Active minutes per accepted: %s" % ("n/a (not measured)" if am is None else am))
     return lines
 
 
@@ -397,6 +405,7 @@ def compute_trajectory(loki_dir):
             "cost_usd": r["cost_usd"],
             "interventions_by_type": r["interventions_by_type"],
             "waited_s": r["waited_s"],
+            "active_s": r["active_s"],
             "verdict": r["verdict"],
             "false_verified": r["false_verified"],
         })

package/autonomy/lib/voter-agents.sh

@@ -373,8 +373,10 @@ loki_council_dispatch_agents() {
     # (completion-council.sh:2792). Fail-closed: a hung or timed-out council can
     # never become a false COMPLETE; it always degrades to the heuristic path
     # (which has its own timeout + conservative defaults).
+    _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+    ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
     response=$(timeout "${LOKI_COUNCIL_REVIEW_TIMEOUT:-600}" \
-                      env CAVEMAN_DEFAULT_MODE=off claude --dangerously-skip-permissions \
+                      env CAVEMAN_DEFAULT_MODE=off claude "${_LOKI_PERM_ARGV[@]}" \
                       -p "$prompt" \
                       --agents "$agents_json" \
                       --json-schema "$schema_content" 2>"$stderr_log") || rc=$?

package/autonomy/loki

@@ -132,6 +132,34 @@ _loki_caveman_narration_level() {
     fi
 }
 
+# P12-26b: permission flags for the migrate/doc/heal claude launches. Lazily sources
+# claude-flags.sh (like the caveman wrapper above) and fills _LOKI_PERM_ARGV; unset
+# LOKI_PERMISSION_POLICY keeps --dangerously-skip-permissions byte-identically.
+_loki_perm_argv_for() {
+    _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+    # Unset policy: return before sourcing anything (claude-flags.sh exports caveman vars).
+    [ "${LOKI_PERMISSION_POLICY:-}" = "compiled" ] || return 0
+    _LOKI_PERM_ARGV=(--permission-mode plan)
+    local _pa_lib="${_LOKI_SCRIPT_DIR}/lib/claude-flags.sh" _pa_out _pa_a
+    if [ ! -f "$_pa_lib" ]; then
+        echo "[loki] WARNING: LOKI_PERMISSION_POLICY=compiled: helper missing; using most restrictive mode (plan)" >&2
+        return 0
+    fi
+    # Subshell so the helper's top-level exports never leak into this shell.
+    _pa_out="$(
+        LOKI_PROJECT_DIR="${1:-${LOKI_PROJECT_DIR:-$PWD}}"
+        # shellcheck source=autonomy/lib/claude-flags.sh
+        . "$_pa_lib" >/dev/null 2>&1 || exit 1
+        declare -F _loki_claude_permission_argv >/dev/null 2>&1 || exit 1
+        _loki_claude_permission_argv
+        printf '%s\n' "${_LOKI_PERM_ARGV[@]}"
+    )" || return 0
+    [ -n "$_pa_out" ] || return 0
+    _LOKI_PERM_ARGV=()
+    while IFS= read -r _pa_a; do _LOKI_PERM_ARGV+=("$_pa_a"); done <<< "$_pa_out"
+    return 0
+}
+
 # loki edit: one-pass small change fast path (functions-only, self-guarded).
 if [ -f "$_LOKI_SCRIPT_DIR/edit.sh" ]; then
     # shellcheck source=edit.sh
@@ -1797,7 +1825,7 @@ show_help_all() {
     echo "  stop             Stop execution immediately"
     echo "  pause            Pause after current session"
     echo "  resume           Resume a paused or interrupted run (after Ctrl-C or a crash)"
-    echo "  steer \"<note>\"    Nudge a running build (needs LOKI_PROMPT_INJECTION=1)"
+    echo "  steer \"<note>\"    Nudge a running build (Loki 10 engine; legacy loop needs LOKI_PROMPT_INJECTION=true)"
     echo ""
     echo "Verify / trust:"
     echo "  verify [base]    Deterministic PR verification (CI-gate exit codes)"
@@ -1842,7 +1870,7 @@ show_help_all() {
     echo ""
     echo "Options for 'start':"
     echo "  --provider NAME  AI provider: claude (default), codex, cline, aider, opencode"
-    echo "  --model ID       Model tier or route (e.g. ollama/qwen3-coder)"
+    echo "  (model route: set LOKI_MODEL_ROUTE, e.g. ollama/qwen3-coder; there is no --model flag)"
     echo "  --simple         Force simple complexity tier (3 phases)"
     echo "  --complex        Force complex complexity tier (8 phases)"
     echo "  --no-dashboard   Disable web dashboard"
@@ -2519,6 +2547,37 @@ _loki_start_handoff() {
 }
 
 # Start Loki Mode
+# Every value-taking cmd_start flag (its value is never brief text or a run id).
+# The one list: the --workspace brief scan and the --resume scan both use it.
+# It also names value flags that are not cmd_start's own, so a scan never
+# mistakes their value for a brief or run id. --model is honored nowhere (model
+# routing is LOKI_MODEL_ROUTE); --max-cost only via the engine10 rewrite.
+_loki_start_flag_takes_value() {
+    case "$1" in
+        --provider|--brief|--budget|--prd|--issue|--isolation|--aider-model|--aider-flags|--cline-model|--compliance|--max-duration|--log-level|--bmad-project|--openspec|--mirofish-rounds|--mirofish-timeout|--output|--config|--vars|--env-file|--remote|--attempts|--mirofish-docker|--spec|--model|--max-cost|--max-wait|--base-wait|--max-iterations|--max-retries|--budget-limit|--session-model|--completion-promise) return 0 ;;
+    esac
+    return 1
+}
+
+# Optional-value cmd_start flags (--mirofish [URL]). The one decision on whether
+# the NEXT token is the flag's value: non-empty and not another --flag. The
+# cmd_start --mirofish arm and both scans use it, so they cannot disagree.
+_loki_start_flag_optional_value() { [ "$1" = "--mirofish" ]; }
+_loki_start_optval_consumes() { [[ -n "${1:-}" && "${1:-}" != --* ]]; }
+
+# One exit-code mapping for an engine10 resume, shared by cmd_resume and
+# `loki start --resume`. 0 and 4 (phase reported) -> 0, 5 (publish failed) -> 1.
+# Sets _LOKI_E10_RC and returns 0 when handled; any other code returns 1 with
+# _LOKI_E10_RC set to the raw code (cmd_resume falls through, start returns it).
+_loki_e10_resume_map() {
+    case "$1" in
+        0 | 4) _LOKI_E10_RC=0 ;;
+        5) _LOKI_E10_RC=1 ;;
+        *) _LOKI_E10_RC="$1"; return 1 ;;
+    esac
+    return 0
+}
+
 cmd_start() {
     # First-run welcome (once): open the branded welcome page on the very
     # first start. Writes ~/.loki/.welcomed and never repeats; non-blocking,
@@ -2584,13 +2643,13 @@ cmd_start() {
         local _ps_skip=0
         for _ps_a in ${_ps_rest[@]+"${_ps_rest[@]}"}; do
             if [ "$_ps_skip" = 1 ]; then _ps_skip=0; continue; fi
+            if [ "$_ps_skip" = 3 ]; then _ps_skip=0; if _loki_start_optval_consumes "$_ps_a"; then continue; fi; fi
             if [ "$_ps_skip" = 2 ]; then _ps_skip=0; _ps_brief+=("$_ps_a"); continue; fi
             case "$_ps_a" in
                 --brief=*) _ps_brief+=("${_ps_a#*=}") ;;
                 --brief) _ps_skip=2 ;;
                 # Every value-taking cmd_start flag: its value is never brief text.
-                --provider|--budget|--prd|--issue|--model|--max-cost|--isolation|--aider-model|--aider-flags|--cline-model|--compliance|--max-duration|--log-level|--bmad-project|--openspec|--mirofish-rounds|--mirofish-timeout|--output|--config|--vars|--env-file|--remote|--attempts|--max-wait) _ps_skip=1 ;;
-                -*) ;;
+                -*) if _loki_start_flag_takes_value "$_ps_a"; then _ps_skip=1; elif _loki_start_flag_optional_value "$_ps_a"; then _ps_skip=3; fi ;;
                 *) _ps_brief+=("$_ps_a") ;;
             esac
         done
@@ -2615,6 +2674,34 @@ cmd_start() {
         cmd_deploy "${_ps_dargs[@]}"
         return $?
     fi
+    # P12-07b: a bare `loki start --resume [run-id]` goes to the same engine10
+    # resume path as `loki resume` (util/run_outputs.ts resumeMain), never into a
+    # new build. Exit codes go through _loki_e10_resume_map (0 and 4 -> 0, 5 -> 1); any other code, such as 3 for nothing to resume, is returned as is.
+    local _ps_resume=0 _ps_resume_args=() _ps_rskip=0
+    for _ps_a in ${_ps_rest[@]+"${_ps_rest[@]}"}; do
+        if [ "$_ps_rskip" = 1 ]; then _ps_rskip=0; continue; fi
+        if [ "$_ps_rskip" = 3 ]; then _ps_rskip=0; if _loki_start_optval_consumes "$_ps_a"; then continue; fi; fi
+        case "$_ps_a" in
+            --resume) _ps_resume=1 ;;
+            --*=*) ;;
+            -*) if _loki_start_flag_takes_value "$_ps_a"; then _ps_rskip=1; elif _loki_start_flag_optional_value "$_ps_a"; then _ps_rskip=3; fi ;;
+            *) _ps_resume_args+=("$_ps_a") ;;
+        esac
+    done
+    if [ "$_ps_resume" = 1 ]; then
+        local _ps_rrc=0
+        for _ps_a in ${_ps_resume_args[@]+"${_ps_resume_args[@]}"}; do
+            case "$_ps_a" in
+                e10-[A-Za-z0-9-]*) ;;
+                *)
+                    echo -e "${RED}--resume resumes a sealed run; it takes an optional run id, not a task. Run \`loki start <task>\` for a new run.${NC}" >&2
+                    return 2 ;;
+            esac
+        done
+        ( _loki_bun_delegate engine10 resume ${_ps_resume_args[@]+"${_ps_resume_args[@]}"} ) || _ps_rrc=$?
+        _loki_e10_resume_map "$_ps_rrc" || true
+        return "$_LOKI_E10_RC"
+    fi
     set -- ${_ps_rest[@]+"${_ps_rest[@]}"}
 
     local args=()
@@ -2675,7 +2762,7 @@ cmd_start() {
                 echo "                        Token from LOKI_REMOTE_TOKEN / LOKI_REMOTE_TOKEN_FILE"
                 echo "                        (never an argument). Env: LOKI_REMOTE_URL."
                 echo "  --provider NAME       AI provider: claude (default), codex, cline, aider, opencode"
-                echo "  --model NAME          Model or route override (for example ollama/qwen3-coder)"
+                echo "  (model route: set LOKI_MODEL_ROUTE, for example ollama/qwen3-coder; no --model flag)"
                 echo "  --allow-haiku        Enable Haiku model for the fast tier (default: disabled)"
                 echo "  --simple              Force simple complexity tier (3 phases)"
                 echo "  --complex             Force complex complexity tier (8 phases)"
@@ -2720,6 +2807,7 @@ cmd_start() {
                 echo "  --pr                  Worktree + auto-create PR"
                 echo "  --ship                Worktree + PR + auto-merge"
                 echo "  --detach, -d          Run in background (implies --worktree)"
+                echo "  --resume [RUN_ID]     Resume an interrupted run at the stage it stopped in"
                 echo ""
                 echo "Preview without spending (any input mode):"
                 echo "  loki plan <PRD>       Analyze a spec WITHOUT executing: complexity,"
@@ -3024,7 +3112,7 @@ cmd_start() {
                 shift
                 ;;
             --mirofish)
-                if [[ -n "${2:-}" ]] && [[ "${2:-}" != --* ]]; then
+                if _loki_start_optval_consumes "${2:-}"; then
                     mirofish_url="$2"
                     shift 2
                 else
@@ -5071,15 +5159,19 @@ cmd_pause() {
 # RUN-25 iter 22 (Wave D #3): `loki steer "<note>"` writes an operator directive
 # to .loki/HUMAN_INPUT.md. engine10 reads it before the next plan or implement
 # session (default on; only LOKI_PROMPT_INJECTION=0/false opts out, steer.ts).
-# The legacy loop injects it only when LOKI_PROMPT_INJECTION=1.
+# The legacy loop injects it only when LOKI_PROMPT_INJECTION=true.
 # Each steer is a numbered revision: `## Operator directive rev N (ts) actor=A source=S`.
 # engine10 (util/steer.ts) archives the file and appends the revisions to
 # .loki/intent-revisions.jsonl. Actor and source come from LOKI_STEER_ACTOR
 # (default: git user.name, then $USER) and LOKI_STEER_SOURCE (cli, chat or an
 # https comment URL; default cli). Both are reduced to a safe character set.
 cmd_steer() {
-    case "${1:-}" in
-        --help|-h|help|"")
+    # "--" ends options so guidance beginning with "-" is data, not a flag
+    local _eoo=0
+    if [ "${1:-}" = "--" ]; then _eoo=1; shift; fi
+    case "$_eoo:${1:-}" in
+        1:?*) ;;
+        *:--help|*:-h|*:help|*:"")
             echo -e "${BOLD}Loki Mode -- steer the running build${NC}"
             echo ""
             echo "Usage: loki steer \"<guidance>\""
@@ -5087,11 +5179,13 @@ cmd_steer() {
             echo "Writes your guidance to .loki/HUMAN_INPUT.md as a numbered revision"
             echo "(rev N, actor, source). The Loki 10 engine applies it once, before the"
             echo "next plan or implement session, and records it in .loki/intent-revisions.jsonl."
+            echo "A steer that arrives after the Wall (the frozen acceptance tests) was authored"
+            echo "makes Seal refuse the run; rerun the task with the new intent included."
             echo ""
             echo "  loki steer \"focus on the auth flow, skip the docs for now\""
             echo ""
             echo "Opt out with LOKI_PROMPT_INJECTION=0. The legacy loop reads the note"
-            echo "only when LOKI_PROMPT_INJECTION=1."
+            echo "only when LOKI_PROMPT_INJECTION=true."
             [ -z "${1:-}" ] && return 2
             return 0
             ;;
@@ -5127,6 +5221,7 @@ cmd_steer() {
             echo -e "${DIM}The Loki 10 engine applies it before the next plan or implement session.${NC}"
             # Same text the issue comment ack posts (trigger-server.py steer_ack_text).
             echo "Steer rev $rev received: applies at next plan/implement stage."
+            echo "If the Wall is already frozen, Seal will refuse this run: rerun with the new intent."
             ;;
     esac
     return 0
@@ -5289,10 +5384,7 @@ cmd_resume() {
     if ls "$LOKI_DIR"/runs/e10-*/events.jsonl >/dev/null 2>&1; then
         local _e10_rc=0
         ( _loki_bun_delegate engine10 resume "$@" ) || _e10_rc=$?
-        case "$_e10_rc" in
-            0 | 4) return 0 ;;
-            5) return 1 ;;
-        esac
+        if _loki_e10_resume_map "$_e10_rc"; then return "$_LOKI_E10_RC"; fi
     fi
 
     # Check if there is anything to resume before touching signal files
@@ -6290,7 +6382,7 @@ if _unc and os.path.exists(_unc):
         except Exception:
             pass
     print("  Unstick it   : give the loop a concrete next step:")
-    print("                   loki steer \"<what to try next>\"   (needs LOKI_PROMPT_INJECTION=1)")
+    print("                   loki steer \"<what to try next>\"   (Loki 10 engine; legacy loop needs LOKI_PROMPT_INJECTION=true)")
     print("                 or narrow the spec / fix the blocker, then loki resume.")
 
 # Surface the structured per-iteration error record, if one exists at
@@ -18014,9 +18106,10 @@ Tasks:
             # pre-caveman. No-op when caveman is absent.
             local _loki_mig_cm=""
             _loki_mig_cm="$(_loki_caveman_narration_level)"
+            _loki_perm_argv_for "$codebase_path"
             case "$provider_name" in
                 claude)
-                    { (cd "$codebase_path" && if [ -n "$_loki_mig_cm" ]; then CAVEMAN_DEFAULT_MODE="$_loki_mig_cm" claude --dangerously-skip-permissions -p "$phase_prompt" --output-format stream-json --verbose 2>&1; else claude --dangerously-skip-permissions -p "$phase_prompt" --output-format stream-json --verbose 2>&1; fi) | \
+                    { (cd "$codebase_path" && if [ -n "$_loki_mig_cm" ]; then CAVEMAN_DEFAULT_MODE="$_loki_mig_cm" claude "${_LOKI_PERM_ARGV[@]}" -p "$phase_prompt" --output-format stream-json --verbose 2>&1; else claude "${_LOKI_PERM_ARGV[@]}" -p "$phase_prompt" --output-format stream-json --verbose 2>&1; fi) | \
                         while IFS= read -r line; do
                             # Extract text from stream-json
                             if echo "$line" | python3 -c "
@@ -18191,9 +18284,10 @@ IMPORTANT RULES:
         # branch, byte-identical to pre-caveman (empty mode is NOT inert). No-op absent.
         local _loki_doc_cm=""
         _loki_doc_cm="$(_loki_caveman_narration_level)"
+        _loki_perm_argv_for "$codebase_path"
         case "$provider_name" in
             claude)
-                { (cd "$codebase_path" && if [ -n "$_loki_doc_cm" ]; then CAVEMAN_DEFAULT_MODE="$_loki_doc_cm" claude --dangerously-skip-permissions -p "$doc_prompt" --output-format stream-json --verbose 2>&1; else claude --dangerously-skip-permissions -p "$doc_prompt" --output-format stream-json --verbose 2>&1; fi) | \
+                { (cd "$codebase_path" && if [ -n "$_loki_doc_cm" ]; then CAVEMAN_DEFAULT_MODE="$_loki_doc_cm" claude "${_LOKI_PERM_ARGV[@]}" -p "$doc_prompt" --output-format stream-json --verbose 2>&1; else claude "${_LOKI_PERM_ARGV[@]}" -p "$doc_prompt" --output-format stream-json --verbose 2>&1; fi) | \
                     while IFS= read -r line; do
                         if echo "$line" | python3 -c "
 import sys, json
@@ -19256,7 +19350,8 @@ Begin healing now. Follow the RARV cycle for each action."
     _loki_heal_cm="$(_loki_caveman_narration_level)"
     case "$provider" in
         claude)
-            local run_args=(--dangerously-skip-permissions -p "$heal_prompt" --output-format stream-json --verbose)
+            _loki_perm_argv_for "$codebase_path"
+            local run_args=("${_LOKI_PERM_ARGV[@]}" -p "$heal_prompt" --output-format stream-json --verbose)
             (cd "$codebase_path" && if [ -n "$_loki_heal_cm" ]; then CAVEMAN_DEFAULT_MODE="$_loki_heal_cm" claude "${run_args[@]}" 2>&1; else claude "${run_args[@]}" 2>&1; fi) | \
                 while IFS= read -r line; do
                     if echo "$line" | python3 -c "
@@ -26031,9 +26126,11 @@ _pr_record_merge() {
 
 # Shared merge gate. One PR (number or branch) merges only when it is not a
 # draft, `gh pr checks` exits 0 after polling pending (rc=8), and, with
-# --require-verified, this run's proof headline is VERIFIED (missing proof or
-# an unreadable headline is never VERIFIED). On refusal it prints the exact
-# blocking gate ("gate: draft|verdict|checks") and leaves the PR open.
+# --require-verified, every clean proof recorded for the PR's head commit
+# (facts.git.head_sha == headRefOid, dirty-tree proofs ignored) says VERIFIED; a stale or missing proof
+# refuses ("gate: head"). The merge passes --match-head-commit so a push after
+# the gate cannot land unjudged. On refusal it prints the exact blocking gate
+# ("gate: draft|head|verdict|checks") and leaves the PR open.
 # Usage: _merge_pr_gated <pr> [--require-verified] [--delete-branch]
 _merge_pr_gated() {
     local pr="$1" need_verified=false margs=(--squash) rc d
@@ -26052,14 +26149,59 @@ _merge_pr_gated() {
         _pr_record_merge "$pr" "blocked:draft" "draft"
         return 1
     fi
+    # Pin the merge to the exact head the checks and proof are about to judge.
+    local head=""
+    head="$(gh pr view "$pr" --json headRefOid -q .headRefOid 2>/dev/null)" || head=""
+    case "$head" in
+        *[!0-9a-f]*) head="" ;;
+    esac
+    if [ "${#head}" != "40" ] && [ "${#head}" != "64" ]; then
+        echo "$pr: not merged, gate: head (PR head commit is unreadable); PR left open" >&2
+        _pr_record_merge "$pr" "blocked:head" "head"
+        return 1
+    fi
     if $need_verified; then
-        local pid="" headline=""
+        local pid="" headline="" pj="" ph="" cands=() dirty_n=0 unknown_n=0
+        # Resolve the proof recorded for THIS head: the run pointer first, then
+        # any proof in .loki/proofs whose facts.git.head_sha equals the PR head.
         [ -f .loki/state/last-proof-id.txt ] && pid="$(cat .loki/state/last-proof-id.txt 2>/dev/null)"
-        if [ -n "$pid" ] && [ -f ".loki/proofs/${pid}/proof.json" ] && command -v jq >/dev/null 2>&1; then
-            headline="$(jq -r '.honesty.headline // empty' ".loki/proofs/${pid}/proof.json" 2>/dev/null)"
+        [ -z "$pid" ] || cands+=(".loki/proofs/${pid}/proof.json")
+        cands+=(.loki/proofs/*/proof.json)
+        if command -v jq >/dev/null 2>&1; then
+            # Every clean proof for this head must agree: an older VERIFIED
+            # never overrides a newer NOT_PROVEN. A proof taken on a dirty tree
+            # (facts.git.dirty anything but literal false, incl. missing/null; .loki/ is excluded from that flag) judged
+            # bytes other than the commit and is ignored.
+            local hl="" disagree=false
+            for pj in "${cands[@]}"; do
+                [ -f "$pj" ] || continue
+                ph="$(jq -r '.facts.git.head_sha // empty' "$pj" 2>/dev/null)"
+                [ "$ph" = "$head" ] || continue
+                case "$(jq -r 'if .facts.git.dirty == false then "clean" elif .facts.git.dirty == true then "dirty" else "unknown" end' "$pj" 2>/dev/null)" in
+                    clean) ;;
+                    dirty) dirty_n=$((dirty_n + 1)); continue ;;
+                    *) unknown_n=$((unknown_n + 1)); continue ;;
+                esac
+                hl="$(jq -r '.honesty.headline // empty' "$pj" 2>/dev/null)"
+                [ -n "$hl" ] || hl="UNREADABLE"
+                if [ -z "$headline" ]; then headline="$hl"; elif [ "$headline" != "$hl" ]; then disagree=true; fi
+            done
+            if $disagree; then
+                echo "$pr: not merged, gate: verdict (proofs for PR head ${head:0:12} disagree); PR left open" >&2
+                _pr_record_merge "$pr" "blocked:verdict" "verdict"
+                return 1
+            fi
+        fi
+        if [ -z "$headline" ]; then
+            echo "$pr: not merged, gate: head (no clean proof recorded for PR head ${head:0:12}; proof is stale, dirty ($dirty_n), dirty-unknown ($unknown_n) or missing); PR left open" >&2
+            if [ "$unknown_n" -gt 0 ]; then
+                echo "$pr: $unknown_n proof(s) for this head have an unknown dirty state (the proof predates the dirty flag, or git could not read the tree). Commit or stash local changes, then re-run 'loki start ...' on a clean tree for this head to record a clean proof." >&2
+            fi
+            _pr_record_merge "$pr" "blocked:head" "head"
+            return 1
         fi
         if [ "$headline" != "VERIFIED" ]; then
-            echo "$pr: not merged, gate: verdict (run verdict is '${headline:-missing}', need VERIFIED); PR left open" >&2
+            echo "$pr: not merged, gate: verdict (run verdict is '${headline}', need VERIFIED); PR left open" >&2
             _pr_record_merge "$pr" "blocked:verdict" "verdict"
             return 1
         fi
@@ -26074,7 +26216,14 @@ _merge_pr_gated() {
         esac
         return 1
     fi
-    if ! gh pr merge "$pr" "${margs[@]}" >/dev/null 2>&1; then
+    if ! gh pr merge "$pr" "${margs[@]}" --match-head-commit "$head" >/dev/null 2>&1; then
+        local head_now=""
+        head_now="$(gh pr view "$pr" --json headRefOid -q .headRefOid 2>/dev/null)" || head_now=""
+        if [ -n "$head_now" ] && [ "$head_now" != "$head" ]; then
+            echo "$pr: not merged, gate: head (PR head moved from ${head:0:12} to ${head_now:0:12} during checks); PR left open" >&2
+            _pr_record_merge "$pr" "blocked:head" "head" "passing"
+            return 1
+        fi
         echo "$pr: not merged, gate: merge (gh pr merge failed); PR left open" >&2
         _pr_record_merge "$pr" "blocked:merge" "merge" "passing"
         return 1

package/autonomy/quickstart.sh

@@ -824,12 +824,31 @@ _qs_classify_invoke() {
     local to=""
     if command -v timeout >/dev/null 2>&1; then to="timeout"
     elif command -v gtimeout >/dev/null 2>&1; then to="gtimeout"; fi
+    _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+    if [ "${LOKI_PERMISSION_POLICY:-}" = "compiled" ]; then
+        # P12-26b: nothing on this path sources claude-flags.sh. Compute in a subshell so its
+        # top-level exports (caveman vars) never leak; fail closed to plan when unavailable.
+        local _qs_flags _qs_out _qs_a
+        _qs_flags="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)/lib/claude-flags.sh"
+        _LOKI_PERM_ARGV=(--permission-mode plan)
+        _qs_out="$(
+            # shellcheck source=/dev/null
+            . "$_qs_flags" >/dev/null 2>&1 || exit 1
+            type _loki_claude_permission_argv >/dev/null 2>&1 || exit 1
+            _loki_claude_permission_argv
+            printf '%s\n' "${_LOKI_PERM_ARGV[@]}"
+        )" || _qs_out=""
+        if [ -n "$_qs_out" ]; then
+            _LOKI_PERM_ARGV=()
+            while IFS= read -r _qs_a; do _LOKI_PERM_ARGV+=("$_qs_a"); done <<< "$_qs_out"
+        fi
+    fi
     if [ -n "$to" ]; then
         out=$(CAVEMAN_DEFAULT_MODE=off "$to" "${LOKI_QUICKSTART_CLASSIFY_TIMEOUT}" \
-                  claude --dangerously-skip-permissions -p "$prompt" 2>/dev/null) || rc=$?
+                  claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" 2>/dev/null) || rc=$?
     else
         out=$(CAVEMAN_DEFAULT_MODE=off \
-                  claude --dangerously-skip-permissions -p "$prompt" 2>/dev/null) || rc=$?
+                  claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" 2>/dev/null) || rc=$?
     fi
     [ "$rc" -ne 0 ] && return 1
     [ -z "$out" ] && return 1

package/autonomy/run.sh

@@ -6709,13 +6709,15 @@ spawn_worktree_session() {
                 # Expand the auto-flag array with the bash-3.2 empty-array guard
                 # (${arr[@]+...}) so a bare "${arr[@]}" under set -u does not
                 # abort with "unbound variable" when no flags were collected.
+                _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+                ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
                 if [ -n "$_loki_wt_cm" ]; then
-                    CAVEMAN_DEFAULT_MODE="$_loki_wt_cm" claude --dangerously-skip-permissions \
+                    CAVEMAN_DEFAULT_MODE="$_loki_wt_cm" claude "${_LOKI_PERM_ARGV[@]}" \
                         "${_LOKI_WT_AUTO_FLAGS[@]+"${_LOKI_WT_AUTO_FLAGS[@]}"}" \
                         -p "Loki Mode: $task_prompt. Read .loki/CONTINUITY.md for context." \
                         >> "$log_file" 2>&1 || _wt_exit=$?
                 else
-                    claude --dangerously-skip-permissions \
+                    claude "${_LOKI_PERM_ARGV[@]}" \
                         "${_LOKI_WT_AUTO_FLAGS[@]+"${_LOKI_WT_AUTO_FLAGS[@]}"}" \
                         -p "Loki Mode: $task_prompt. Read .loki/CONTINUITY.md for context." \
                         >> "$log_file" 2>&1 || _wt_exit=$?
@@ -6950,7 +6952,9 @@ Output ONLY the resolved file content with no conflict markers. No explanations.
                 # variable (the shell, not the agent, writes the resolved file).
                 # It needs no hooks, LSP, CLAUDE.md auto-discovery, or MCP, so
                 # --bare is safe and cheaper. Gated + opt-out LOKI_BARE_SUBCALLS=0.
-                local _cr_argv=("--dangerously-skip-permissions")
+                _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+                ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
+                local _cr_argv=("${_LOKI_PERM_ARGV[@]}")
                 if type loki_subcall_bare_enabled >/dev/null 2>&1 && loki_subcall_bare_enabled; then
                     _cr_argv+=("--bare")
                 fi
@@ -16282,7 +16286,9 @@ _dispatch_reviewer() {
             #     Guardrail, not a sandbox -- echo>/sed -i/etc. remain; the
             #     real net is commit-before-agent-wave. Opt out
             #     LOKI_REVIEW_TOOL_GUARD=0. See loki_review_guard_denylist.
-            local _rv_argv=("--dangerously-skip-permissions")
+            _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+            ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
+            local _rv_argv=("${_LOKI_PERM_ARGV[@]}")
             # OPT-IN advisor pin (v7.104.0, LOKI_ADVISOR_MODEL): reviewers still
             # pass NO --model by default (unchanged behavior: they run on the
             # account default). When the operator/user sets LOKI_ADVISOR_MODEL to
@@ -21352,7 +21358,9 @@ ${_commits}"
     # needed, so --bare is safe and cheaper. Opt out LOKI_BARE_SUBCALLS=0.
     # Always at least --dangerously-skip-permissions, so the array is never
     # empty (empty "${arr[@]}" under set -u errors on bash 3.2, stock macOS).
-    local _ic_argv=("--dangerously-skip-permissions")
+    _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+    ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
+    local _ic_argv=("${_LOKI_PERM_ARGV[@]}")
     if type loki_subcall_bare_enabled >/dev/null 2>&1 && loki_subcall_bare_enabled; then
         _ic_argv+=("--bare")
     fi
@@ -25529,7 +25537,9 @@ except Exception as exc:
         # present so the array is never empty (empty "${arr[@]}" under `set -u`
         # is an error on bash 3.2, the stock macOS shell). The autonomy override
         # is appended conditionally.
-        local _loki_claude_argv=("--dangerously-skip-permissions" "--model" "$tier_param")
+        _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+        ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
+        local _loki_claude_argv=("${_LOKI_PERM_ARGV[@]}" "--model" "$tier_param")
         if [ "${LOKI_AUTONOMY_OVERRIDE:-on}" != "off" ] \
            && type _loki_autonomy_override_text >/dev/null 2>&1 \
            && type loki_claude_flag_supported >/dev/null 2>&1 \

package/autonomy/trigger-server.py

@@ -494,16 +494,20 @@ CHILD_ENV_DENYLIST = (
 )
 
 
-def _scoped_child_env():
-    return {k: v for k, v in os.environ.items() if k not in CHILD_ENV_DENYLIST}
+def _scoped_child_env(extra_env=None):
+    env = {k: v for k, v in os.environ.items() if k not in CHILD_ENV_DENYLIST}
+    # Caller values override inherited ones but can never restore a denied secret.
+    env.update({k: v for k, v in (extra_env or {}).items() if k not in CHILD_ENV_DENYLIST})
+    return env
 
 
-def run_loki_outcome(args, dry_run=False, stdout_sink=None):
+def run_loki_outcome(args, dry_run=False, stdout_sink=None, extra_env=None):
     """Run a loki command and report WHICH of the three outcomes occurred.
 
     Returns one of OUTCOME_PASSED / OUTCOME_FAILED / OUTCOME_UNKNOWN. This is
     the honest version of run_loki_command, which answers only "did it launch".
     When stdout_sink is a list, the decoded stdout is appended to it on completion.
+    extra_env adds child env vars (e.g. LOKI_STEER_SOURCE) on top of the scoped env.
     """
     cmd = ["loki"] + args
     if dry_run:
@@ -515,7 +519,7 @@ def run_loki_outcome(args, dry_run=False, stdout_sink=None):
             cmd,
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
-            env=_scoped_child_env(),
+            env=_scoped_child_env(extra_env),
         )
     except (FileNotFoundError, OSError) as e:
         logging.error("Failed to launch %s: %s", " ".join(cmd), e)
@@ -703,7 +707,9 @@ def handle_issue_comment_event(payload, dry_run=False):
     note = "GitHub comment from %s: %s" % (login or "unknown", body)
     summary = "steer %s from comment" % ref
     sink = []
-    outcome = run_loki_outcome(["steer", note], dry_run=dry_run, stdout_sink=sink)
+    # Provenance for the revision log: loki steer records actor= and source= per revision.
+    steer_env = {"LOKI_STEER_SOURCE": "github", "LOKI_STEER_ACTOR": login or "unknown"}
+    outcome = run_loki_outcome(["steer", note], dry_run=dry_run, stdout_sink=sink, extra_env=steer_env)
     # Only a confirmed exit 0 proves the steer was written. A detached child
     # (UNKNOWN) never reports its exit code, so acking would claim an unverified
     # steer; report it as launched but post nothing.

package/completions/loki.bash

@@ -27,7 +27,7 @@ _loki_completion() {
 
             # If the word starts with a dash, show flags
             if [[ "$cur" == -* ]]; then
-                local flags="--provider --max-iterations --parallel --background --bg --simple --complex --github --no-dashboard --sandbox --skip-memory --spec --spec-first --yes --budget --attempts --model --isolation --max-cost --no-pr --explain-route --brief --worktree --pr --ship --detach --workspace --deploy --health-url --auto-rollback --help"
+                local flags="--provider --max-iterations --parallel --background --bg --simple --complex --github --no-dashboard --sandbox --skip-memory --spec --spec-first --yes --budget --attempts --model --isolation --max-cost --no-pr --explain-route --brief --worktree --pr --ship --detach --workspace --deploy --health-url --auto-rollback --resume --help"
                 COMPREPLY=( $(compgen -W "${flags}" -- "$cur") )
                 return 0
             fi
@@ -149,7 +149,7 @@ _loki_completion() {
 
         deploy)
             if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--execute --canary --health-url --auto-rollback --dir --no-clip --allow-unanchored --help" -- "$cur") )
+                COMPREPLY=( $(compgen -W "--execute --canary --health-url --health-match --auto-rollback --dir --no-clip --allow-unanchored --help" -- "$cur") )
                 return 0
             fi
             ;;

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.15.0"
+__version__ = "11.17.1"
 
 __all__ = ["__version__"]

package/dashboard/api_start.py

@@ -12,7 +12,7 @@ argv.
 
 ponytail: run state is in memory (a dashboard restart forgets the queue; the
 runs themselves keep going and their worktrees keep the receipts). The
-v10 engine has no resume-with-answer (--resume was removed), so a BLOCKED
+v10 engine has no resume-with-answer (--resume only resumes a publish-phase run), so a BLOCKED
 question is shown with the re-run command instead of an answer box.
 """
 import json
@@ -472,7 +472,7 @@ def backlog_status():
         for r in _RUNS.values():
             row = {k: r.get(k) for k in ("number", "title", "status", "pr_url", "question", "detail")}
             if r["status"] == "blocked":
-                row["resume_hint"] = ("The engine cannot resume with an answer (--resume was removed). "
+                row["resume_hint"] = ("The engine cannot resume with an answer (--resume only finishes the publish phase of a sealed run, not a blocked one). "
                                       "Answer on the issue, then re-run: loki %s#%d" % (repo, r["number"]))
             out.append(row)
     return {"repo": repo, "concurrency": _concurrency(), "issues": out}