loki-mode 11.15.0 → 11.17.5

package/autonomy/lib/engine10-push.sh

@@ -2,7 +2,8 @@
 # Loki 10 engine P4 push child (ENGINE.md sections 6 and 7).
 #
 #   engine10-push.sh push-pr <repo-dir> <branch> <title> <body-file> [--draft] [--base <branch>]
-#   engine10-push.sh check-origin   (exit 0 when the pinned origin is acceptable to push-pr, else the refusal; no network)
+#   engine10-push.sh pr-ready <repo-dir> <branch> <body-file> <pr-url>   (reused open PR: replace its body, then mark it ready; <pr-url> must be the pinned-owner PR)
+#   engine10-push.sh check-origin  (exit 0 when the pinned origin is acceptable to push-pr, else the refusal; no network)
 #   engine10-push.sh comment <pr-number> <body-file>
 #   engine10-push.sh issue-comment [--update] <issue-ref> <body-file>
 #   engine10-push.sh status  <sha> <pending|success|failure|error> <description>
@@ -117,6 +118,16 @@ _e10_local_push() {
 
 _e10_gh() { _loki_with_github_tokens _loki_run_neutral "$_e10_repo" command gh "$@"; }
 
+# The one open-PR lookup for push-pr reuse and pr-ready. gh cannot filter --head by owner, so a stranger's fork PR with the
+# same branch name would match; select only a same-repo PR from the pinned owner. Prints the URL, or nothing.
+_e10_find_pr() {
+    local owner="${_e10_repo%%/*}"
+    case "$owner" in '' | *[!A-Za-z0-9_.-]*) return 1 ;; esac
+    _e10_gh pr list --repo "$_e10_repo" --head "$1" --state open \
+        --json url,isCrossRepository,headRepositoryOwner,headRefName,state \
+        --jq "[.[] | select(.isCrossRepository == false and .state == \"OPEN\" and (.headRepositoryOwner.login | ascii_downcase) == \"$(printf '%s' "$owner" | tr '[:upper:]' '[:lower:]')\")] | .[0].url // empty"
+}
+
 mode="${1:-}"
 shift || true
 case "$mode" in
@@ -157,10 +168,9 @@ case "$mode" in
         else
             _loki_trusted_push _loki_with_github_tokens "$dir" "$branch" || die "push refused or failed (rc=$?)"
         fi
-        url="$(_e10_gh pr list --repo "$_e10_repo" --head "$branch" --state open --json url --jq '.[0].url')" \
-            || die "gh pr list failed"
+        url="$(_e10_find_pr "$branch")" || die "gh pr list failed"
         _e10_pr_state=reused
-        if [ -z "$url" ] || [ "$url" = "null" ]; then
+        if [ -z "$url" ]; then
             _e10_pr_state=created
             url="$(_e10_gh pr create --repo "$_e10_repo" --head "$branch" --title "$title" --body-file "$body" "${draft[@]}" "${base[@]}")" \
                 || die "gh pr create failed"
@@ -169,6 +179,21 @@ case "$mode" in
         printf '%s\n' "$_e10_pr_state"  # marker line before the URL: reused (open PR found) or created
         printf '%s\n' "$url"
         ;;
+    pr-ready)
+        # M-21 N3: a reused wave PR whose units are all PROVEN keeps its old draft state and body; fix both, same pinned origin and tokens as push-pr.
+        [ "$#" -eq 4 ] || die "usage: pr-ready <repo-dir> <branch> <body-file> <pr-url>"
+        branch="$2" body="$3" want_url="$4"
+        [ -f "$body" ] || die "body file not found: $body"
+        git check-ref-format --branch "$branch" >/dev/null 2>&1 || die "invalid branch: $branch"
+        case "$branch" in main | master | HEAD) die "refusing to edit a PR for default branch: $branch" ;; esac
+        [ -z "$_e10_local" ] || { log_info "local origin: no PR to mark ready (no-op)"; exit 0; }
+        url="$(_e10_find_pr "$branch")" || die "gh pr list failed"
+        [ -n "$url" ] || die "no open PR from $_e10_repo for branch: $branch"
+        [ "$url" = "$want_url" ] || die "refusing: PR $want_url is not the pinned-owner PR for $branch ($url)"
+        _e10_gh pr edit "$url" --repo "$_e10_repo" --body-file "$body" >/dev/null || die "gh pr edit failed"
+        _e10_gh pr ready "$url" --repo "$_e10_repo" >/dev/null || die "gh pr ready failed"
+        printf '%s\n' "$url"
+        ;;
     comment)
         [ "$#" -eq 2 ] || die "usage: comment <pr-number> <body-file>"
         case "$1" in '' | *[!0-9]*) die "pr number must be digits" ;; esac
@@ -215,5 +240,5 @@ case "$mode" in
         _e10_gh api "repos/$_e10_repo/statuses/$1" -f "state=$2" -f context=loki/deep-verify \
             -f "description=$3" >/dev/null || die "gh api status failed"
         ;;
-    *) die "usage: engine10-push.sh push-pr|comment|issue-comment|status ..." ;;
+    *) die "usage: engine10-push.sh push-pr|pr-ready|comment|issue-comment|status ..." ;;
 esac

package/autonomy/lib/modernize/py_capture.py

@@ -454,6 +454,25 @@ def _check_boundary(name, value, declared):
     return None
 
 
+def _declared_for_case(declared, per_case, bound_names, call_args, call_kwargs):
+    """Per-case boundary declarations (optional "boundaries" key on a --cases line):
+    {"args": [kind|null, ...], "kwargs": {name: kind}, "return": kind|null}. This is how a replay declares
+    the kinds the ORACLE recorded, so a text argument is not "undeclared". It adds to the --boundaries file,
+    never overrides it, and a runtime type that differs from the declared kind is still flagged."""
+    if not isinstance(per_case, dict):
+        return declared
+    merged = dict(declared)
+    arg_kinds = per_case.get("args") or []
+    kw_kinds = per_case.get("kwargs") or {}
+    for i, name in enumerate(bound_names):
+        kind = arg_kinds[i] if i < len(call_args) and i < len(arg_kinds) else kw_kinds.get(name)
+        if kind in ("text", "bytes") and name not in merged:
+            merged[name] = kind
+    if per_case.get("return") in ("text", "bytes") and "return" not in merged:
+        merged["return"] = per_case["return"]
+    return merged
+
+
 def _unsupported_not_proven(tagged, path):
     """Recurse into an already-tagged structure (a return value or an
     exception arg) and turn every 'unsupported' tag at any nesting depth
@@ -519,6 +538,36 @@ def run_case(func, args, kwargs):
 # CLI
 # --------------------------------------------------------------------------
 
+def _stub_unit_functions(namespace, unit_path):
+    """No-op ablation: every plain function defined in the unit file becomes a
+    stub returning None. runpy.run_path returns a copy of the module globals, so
+    only the entry's own stub matters here; functions called internally still
+    see the real module. __wrapped__ keeps the original signature visible to the
+    boundary check on Python 3 (inspect.signature follows it). Returns the set of
+    names replaced; an entry outside it (imported function, bound-method alias,
+    functools.partial, callable instance) was NOT stubbed."""
+    import types
+    want = os.path.realpath(unit_path)
+    replaced = set()
+    for name in list(namespace.keys()):
+        func = namespace[name]
+        if not isinstance(func, types.FunctionType):
+            continue
+        if os.path.realpath(func.__code__.co_filename) != want:
+            continue
+        namespace[name] = _make_stub(func)
+        replaced.add(name)
+    return replaced
+
+
+def _make_stub(original):
+    def stub(*_args, **_kwargs):
+        return None
+    stub.__name__ = original.__name__
+    stub.__wrapped__ = original
+    return stub
+
+
 def main(argv=None):
     parser = argparse.ArgumentParser(description="Python 2/3 capture tracer (Loki Modernize M-09)")
     parser.add_argument("--unit", required=True, help="path to the unit's .py source")
@@ -526,6 +575,8 @@ def main(argv=None):
     parser.add_argument("--out", required=True, help="output cases.jsonl path")
     parser.add_argument("--coverage", help="output coverage.json path")
     parser.add_argument("--boundaries", help="JSON file of declared text/bytes boundaries")
+    parser.add_argument("--stub", action="store_true",
+                        help="no-op ablation: replace every function defined in the unit file with a stub returning None")
     args = parser.parse_args(argv)
 
     unit_path = os.path.abspath(args.unit)
@@ -547,6 +598,10 @@ def main(argv=None):
         sys.stderr.write("py_capture: failed to load unit %s: %s\n" % (args.unit, exc))
         return 2
 
+    stubbed = None
+    if args.stub:
+        stubbed = _stub_unit_functions(namespace, unit_path)
+
     with open(args.cases, "r") as fh:
         case_lines = [line for line in fh if line.strip()]
 
@@ -556,6 +611,9 @@ def main(argv=None):
         spec = json.loads(line)
         entry = spec["entry"]
         entries_used.add(entry)
+        if stubbed is not None and entry not in stubbed:
+            sys.stderr.write("py_capture: --stub could not stub entry %s\n" % entry)
+            return 2
         func = namespace.get(entry)
         if func is None or not callable(func):
             sys.stderr.write("py_capture: entry not found or not callable: %s\n" % entry)
@@ -570,17 +628,18 @@ def main(argv=None):
 
         not_proven = []
         bound_names = _bound_names(func, call_args, call_kwargs)
+        case_declared = _declared_for_case(declared, spec.get("boundaries"), bound_names, call_args, call_kwargs)
         for i, name in enumerate(bound_names):
             if i < len(call_args):
-                reason = _check_boundary(name, call_args[i], declared)
+                reason = _check_boundary(name, call_args[i], case_declared)
             elif name in call_kwargs:
-                reason = _check_boundary(name, call_kwargs[name], declared)
+                reason = _check_boundary(name, call_kwargs[name], case_declared)
             else:
                 reason = None
             if reason:
                 not_proven.append(reason)
         if outcome["had_result"]:
-            reason = _check_boundary("return", outcome["result"], declared)
+            reason = _check_boundary("return", outcome["result"], case_declared)
             if reason:
                 not_proven.append(reason)
             not_proven.extend(_unsupported_not_proven(outcome["result_tag"], "return"))

package/autonomy/lib/prd-enrich.sh

@@ -86,14 +86,42 @@ _loki_prd_enrich_invoke() {
     command -v claude >/dev/null 2>&1 || return 1
     local rc=0
     local out=""
+    _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+    ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
+    # S8: lean child flags (no user-scope settings/MCP/tools) + ledger line.
+    type loki_lean_child_flags >/dev/null 2>&1 \
+        || . "$(dirname "${BASH_SOURCE[0]}")/claude-flags.sh" 2>/dev/null || true
+    local _pe_argv=("${_LOKI_PERM_ARGV[@]}") _pe_lf _pe_ledger=false
+    if type loki_lean_child_flags >/dev/null 2>&1; then
+        while IFS= read -r _pe_lf; do
+            [ -n "$_pe_lf" ] && _pe_argv+=("$_pe_lf")
+        done < <(loki_lean_child_flags enrich 2>/dev/null)
+    fi
+    if type loki_child_ledger_append >/dev/null 2>&1; then
+        _pe_ledger=true
+        _pe_argv+=("--output-format" "json")
+    fi
     if command -v timeout >/dev/null 2>&1; then
         out=$(CAVEMAN_DEFAULT_MODE=off timeout "${LOKI_PRD_ENRICH_TIMEOUT}" \
-                  claude --dangerously-skip-permissions -p "$prompt" 2>/dev/null) || rc=$?
+                  claude "${_pe_argv[@]}" -p "$prompt" 2>/dev/null) || rc=$?
     else
         # No coreutils timeout (e.g. bare macOS). Run without it; the model
         # call is a one-shot and the caller still tolerates failure.
         out=$(CAVEMAN_DEFAULT_MODE=off \
-                  claude --dangerously-skip-permissions -p "$prompt" 2>/dev/null) || rc=$?
+                  claude "${_pe_argv[@]}" -p "$prompt" 2>/dev/null) || rc=$?
+    fi
+    if [ "$rc" -eq 0 ] && [ "$_pe_ledger" = true ] && [ -n "$out" ]; then
+        loki_child_ledger_append enrich "$out" >/dev/null 2>&1 || true
+        out=$(printf '%s' "$out" | python3 -I -c 'import json,sys
+raw = sys.stdin.read()
+try:
+    d = json.loads(raw)
+except Exception:
+    d = None
+if isinstance(d, list):
+    d = next((x for x in reversed(d) if isinstance(x, dict) and x.get("type") == "result"), {})
+# A CLI or stub that ignores --output-format json returns plain text: keep it.
+sys.stdout.write(str(d.get("result", "")) if isinstance(d, dict) else raw)' 2>/dev/null)
     fi
     [ "$rc" -ne 0 ] && return 1
     [ -z "$out" ] && return 1

package/autonomy/lib/proof-generator.py

@@ -1455,6 +1455,11 @@ def _collect_journey(loki_dir):
                 },
                 "waited_s": ws,
             }
+            # active_s (measured active human seconds) rides along only when
+            # recorded; absent stays absent, never a fabricated 0.
+            act = iv.get("active_s")
+            if isinstance(act, int) and not isinstance(act, bool) and act >= 0:
+                out["interventions_detail"]["active_s"] = act
 
     # PR state/URL, written by the consent-gated PR step. "prepared" means a PR
     # body exists locally and GitHub was NOT mutated.

package/autonomy/lib/proof-verify.py

@@ -1173,10 +1173,34 @@ def git_head(repo):
     return out.strip() if out and out.strip() else ""
 
 
+def _sparse_included(repo, paths):
+    """Set of `paths` git's own sparse matcher includes; None when git cannot answer.
+
+    One `git sparse-checkout check-rules` call for the whole batch: it echoes
+    the paths the patterns include, for cone, non-cone and negation alike.
+    Known limit: a .git directory writable by the subject can drop paths from
+    info/sparse-checkout. That hole predates this check (core.sparseCheckout=true
+    alone was enough).
+    """
+    enc = [p.encode("utf-8", "surrogateescape") for p in paths]
+    try:
+        r = subprocess.run(
+            ["git", "-C", repo or ".", "sparse-checkout", "check-rules", "-z"],
+            input=b"".join(e + b"\0" for e in enc),
+            capture_output=True, timeout=60, env=_scoped_env())
+    except (OSError, subprocess.SubprocessError, ValueError):
+        return None
+    if r.returncode != 0:
+        return None
+    out = set(r.stdout.split(b"\0"))
+    return set(p for p, e in zip(paths, enc) if e in out)
+
+
 def git_dirty(repo):
     """True/False, or None when git cannot answer. .loki/ is excluded: the
     verifier writes its own artifacts there."""
-    out = _vr_git_args(repo, ["status", "--porcelain"])
+    out = _vr_git_args(repo, ["status", "--porcelain", "--untracked-files=all",
+                                "--no-renames", "--ignore-submodules=none"])
     if out is None:
         return None
     for line in out.splitlines():
@@ -1185,6 +1209,90 @@ def git_dirty(repo):
             path = path.strip('"')
         if not (path.startswith(".loki/") or path == ".loki"):
             return True
+    # A skip-worktree (S/s) or assume-unchanged (lowercase tag) flag hides edits
+    # from status. A flagged path is dirty only when its content differs from
+    # the index; a skip-worktree path absent on disk is sparse-excluded (clean).
+    flagged = _vr_git_args(repo, ["ls-files", "-v", "-z"])
+    if flagged is None:
+        return None
+    cand = []
+    for ent in flagged.split("\0"):
+        tag, path = ent[:1], ent[2:]
+        if not path or path.startswith(".loki/"):
+            continue
+        if tag in ("S", "s") or tag.islower():
+            cand.append((tag in ("S", "s"), path))
+    if not cand:
+        return False
+    staged = _vr_git_args(repo, ["ls-files", "-s", "-z"])
+    if staged is None:
+        return None
+    blobs = {}
+    for ent in staged.split("\0"):
+        meta, _, p = ent.partition("\t")
+        f = meta.split()
+        if len(f) == 3 and f[2] == "0":
+            blobs[p] = (f[0], f[1])
+    sparse = (_vr_git_args(repo, ["config", "--bool", "core.sparseCheckout"]) or "").strip() == "true"
+    root = repo or "."
+    bad = None
+    todo = []
+    sparse_missing = []
+    for skip, path in cand:
+        full = os.path.join(root, path)
+        mode, want = blobs.get(path, ("", ""))
+        if not os.path.lexists(full):
+            if skip and sparse:
+                # Decided after the loop in one batched git call: clean only when
+                # git's sparse patterns exclude the path. An in-cone path flagged
+                # by hand and deleted is a real deletion; fail closed otherwise.
+                sparse_missing.append(path)
+                continue
+            bad = (skip, path)
+            break
+        if mode == "160000":
+            continue
+        if os.path.islink(full):
+            data = os.readlink(full).encode("utf-8", "surrogateescape")
+            if hashlib.sha1(b"blob %d\0" % len(data) + data).hexdigest() != want:
+                bad = (skip, path)
+                break
+            continue
+        todo.append((skip, path))
+    if sparse_missing and not bad:
+        included = _sparse_included(repo, sparse_missing)
+        for path in sparse_missing:
+            if included is None or path in included:
+                bad = (True, path)
+                break
+    for i in range(0, len(todo), 200):
+        if bad:
+            break
+        chunk = todo[i:i + 200]
+        out = _vr_git_args(repo, ["hash-object", "--"] + [p for _, p in chunk])
+        if out is None:
+            return None
+        miss = [(s, p) for (s, p), h in zip(chunk, out.split())
+                if h != blobs.get(p, ("", ""))[1]]
+        if miss:
+            # Identical raw bytes mean clean (CRLF in the index plus autocrlf).
+            # The clean filter is not idempotent: the index may hold unfiltered
+            # bytes that a filtered hash of the worktree file never reproduces,
+            # so the filtered hash alone would call such a file dirty.
+            raw = _vr_git_args(repo, ["hash-object", "--no-filters", "--"] + [p for _, p in miss])
+            if raw is None:
+                return None
+            for (skip, path), h in zip(miss, raw.split()):
+                if h != blobs.get(path, ("", ""))[1]:
+                    bad = (skip, path)
+                    break
+    if bad:
+        skip, path = bad
+        kind, fix = (("skip-worktree", "--no-skip-worktree") if skip
+                     else ("assume-unchanged", "--no-assume-unchanged"))
+        sys.stderr.write("dirty: %s is flagged %s and differs from the index, which hides edits from the proof. "
+                         "Run: git update-index %s -- %s\n" % (path, kind, fix, path))
+        return True
     return False
 
 

package/autonomy/lib/trust_trajectory.py

@@ -183,7 +183,7 @@ def _cost_value(proof):
 
 
 def _intervention_detail(proof):
-    """(by_type, waited_s) from proof.interventions_detail; None when absent."""
+    """(by_type, waited_s, active_s) from proof.interventions_detail; None when absent."""
     d = _obj(proof.get("interventions_detail"))
     bt = _obj(d.get("by_type"))
     out = {}
@@ -198,7 +198,9 @@ def _intervention_detail(proof):
             any_key = True
     w = d.get("waited_s")
     ws = w if isinstance(w, (int, float)) and not isinstance(w, bool) and w >= 0 else None
-    return (out if any_key else None), ws
+    a = d.get("active_s")
+    act = a if isinstance(a, int) and not isinstance(a, bool) and a >= 0 else None
+    return (out if any_key else None), ws, act
 
 
 def _verdict_evidence(proof):
@@ -229,13 +231,14 @@ def _load_runs(loki_dir):
             # Malformed / partial proof: skip, do not fail the trajectory.
             continue
         verdict, false_verified = _verdict_evidence(proof)
-        by_type, waited_s = _intervention_detail(proof)
+        by_type, waited_s, active_s = _intervention_detail(proof)
         runs.append({
             "verdict": verdict,
             "false_verified": false_verified,
             "cost_usd": _cost_value(proof),
             "interventions_by_type": by_type,
             "waited_s": waited_s,
+            "active_s": active_s,
             "run_id": str(proof.get("run_id") or name),
             "generated_at": proof.get("generated_at"),
             "council_pass_rate": _council_pass_value(proof.get("council")),
@@ -343,6 +346,7 @@ def outcome_effort(series):
         by_type = {k: sum(r["interventions_by_type"][k] for r in with_detail) for k in _IV_TYPES}
     all_iv = bool(series) and all(r["interventions"] is not None for r in series)
     all_waited = bool(series) and all(r["waited_s"] is not None for r in series)
+    all_active = bool(series) and all(r["active_s"] is not None for r in series)
     return {
         "runs": len(series),
         "accepted": accepted,
@@ -356,6 +360,8 @@ def outcome_effort(series):
             round(sum(r["interventions"] for r in series) / accepted, 4) if accepted and all_iv else None),
         "waited_min_per_accepted": (
             round(sum(r["waited_s"] for r in series) / 60.0 / accepted, 1) if accepted and all_waited else None),
+        "active_min_per_accepted": (
+            round(sum(r["active_s"] for r in series) / 60.0 / accepted, 1) if accepted and all_active else None),
     }
 
 
@@ -376,7 +382,9 @@ def _fmt_outcome_effort(e):
     lines.append("  Interventions per accepted: %s" % ("n/a" if ipa is None else ipa))
     w = e.get("waited_min_per_accepted")
     lines.append("  Minutes per accepted: %s" % (
-        "n/a" if w is None else "%s (waited, upper bound; active minutes are not measured)" % w))
+        "n/a" if w is None else "%s (waited, upper bound)" % w))
+    am = e.get("active_min_per_accepted")
+    lines.append("  Active minutes per accepted: %s" % ("n/a (not measured)" if am is None else am))
     return lines
 
 
@@ -397,6 +405,7 @@ def compute_trajectory(loki_dir):
             "cost_usd": r["cost_usd"],
             "interventions_by_type": r["interventions_by_type"],
             "waited_s": r["waited_s"],
+            "active_s": r["active_s"],
             "verdict": r["verdict"],
             "false_verified": r["false_verified"],
         })

package/autonomy/lib/voter-agents.sh

@@ -110,6 +110,11 @@ complexity = os.environ.get("_VA_COMPLEXITY", "standard")
 _effort_bump = {"low": "medium", "medium": "high", "high": "xhigh"}
 def _effort(base):
     return _effort_bump.get(base, base) if complexity == "complex" else base
+# Cost S7: the three base voters run on haiku for small/standard work; the
+# complex tier keeps the original opus/sonnet roster. haiku takes no effort knob.
+_lean = complexity != "complex"
+def _model(default):
+    return "haiku" if _lean else default
 prd_clause = (
     f"PRD at {prd}. Read it for ground-truth requirements."
     if prd else
@@ -118,8 +123,7 @@ prd_clause = (
 agents = {
     "requirements-verifier": {
         "description": "Verifies the iteration delivered the PRD-required behavior.",
-        "model": "opus",
-        "effort": _effort("high"),
+        "model": _model("opus"),
         "tools": ["Read", "Grep", "Bash"],
         "prompt": (
             f"You are the requirements-verifier for iteration {iter_n}. "
@@ -131,8 +135,7 @@ agents = {
     },
     "test-auditor": {
         "description": "Audits test coverage and pass status for the iteration.",
-        "model": "sonnet",
-        "effort": _effort("high"),
+        "model": _model("sonnet"),
         "tools": ["Read", "Grep", "Bash"],
         "prompt": (
             f"You are the test-auditor for iteration {iter_n}. "
@@ -144,8 +147,7 @@ agents = {
     },
     "convergence-voter": {
         "description": "Checks code churn and progress signals to judge convergence.",
-        "model": "sonnet",
-        "effort": _effort("medium"),
+        "model": _model("sonnet"),
         "tools": ["Read", "Grep", "Bash"],
         "prompt": (
             f"You are the convergence-voter for iteration {iter_n} on tier {tier}. "
@@ -156,6 +158,9 @@ agents = {
         ),
     },
 }
+if not _lean:
+    for _k, _b in (("requirements-verifier", "high"), ("test-auditor", "high"), ("convergence-voter", "medium")):
+        agents[_k]["effort"] = _effort(_b)
 print(json.dumps(agents, separators=(",", ":")))
 '
     return 0
@@ -289,6 +294,13 @@ loki_council_dispatch_agents() {
     local prompt
     prompt=$(printf 'Loki council iteration %s. Run each declared agent against the current workspace, return one finding per agent matching the provided JSON Schema. Be terse, be honest.' "$iteration")
 
+    # Cost S7: hand the council the PRD path so voters stop reporting "No PRD was
+    # provided". A missing/unreadable PRD adds nothing; voters then vote
+    # CANNOT_VALIDATE, which never approves.
+    if [ -n "$prd_path" ] && [ -r "$prd_path" ]; then
+        prompt="${prompt} PRD file: ${prd_path} (read it for ground-truth requirements)."
+    fi
+
     # Shared dispatch state (declared once, before either the SDK or claude arm).
     local response=""
     local rc=0
@@ -373,11 +385,56 @@ loki_council_dispatch_agents() {
     # (completion-council.sh:2792). Fail-closed: a hung or timed-out council can
     # never become a false COMPLETE; it always degrades to the heuristic path
     # (which has its own timeout + conservative defaults).
+    _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+    ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
+    # Cost S7 lean child: council role flags (no hooks/MCP/tools on the main
+    # child) and --output-format json so usage lands in the child ledger. The
+    # envelope is unwrapped back to the {findings:[...]} object below.
+    local _va_lean=() _va_lf
+    if type loki_lean_child_flags >/dev/null 2>&1; then
+        while IFS= read -r _va_lf; do
+            [ -n "$_va_lf" ] && _va_lean+=("$_va_lf")
+        done < <(loki_lean_child_flags council 2>/dev/null)
+    fi
+    local _va_fmt=()
+    if loki_claude_flag_supported "--output-format"; then
+        _va_fmt=(--output-format json)
+    fi
     response=$(timeout "${LOKI_COUNCIL_REVIEW_TIMEOUT:-600}" \
-                      env CAVEMAN_DEFAULT_MODE=off claude --dangerously-skip-permissions \
+                      env CAVEMAN_DEFAULT_MODE=off claude "${_LOKI_PERM_ARGV[@]}" \
+                      ${_va_lean[@]+"${_va_lean[@]}"} \
+                      ${_va_fmt[@]+"${_va_fmt[@]}"} \
                       -p "$prompt" \
                       --agents "$agents_json" \
                       --json-schema "$schema_content" 2>"$stderr_log") || rc=$?
+    if [ "$rc" -eq 0 ] && [ -n "$response" ] && [ "${#_va_fmt[@]}" -gt 0 ]; then
+        if type loki_child_ledger_append >/dev/null 2>&1; then
+            loki_child_ledger_append council "$response" >/dev/null 2>&1 || true
+        fi
+        local _va_unwrapped _va_upy
+        if _va_upy="$(_loki_snapshot_py_tool)"; then
+            # Unwrap the CLI envelope: structured_output, else a JSON string in
+            # result. A bare {findings:[...]} object passes through unchanged. Any
+            # other shape leaves the response as-is, so the parser fails closed.
+            _va_unwrapped=$(printf '%s' "$response" | "$_va_upy" -I -S -c 'import sys; sys.path[:] = [p for p in sys.path if p not in ("", ".")]; import json
+try:
+    e = json.load(sys.stdin)
+    if isinstance(e, dict) and "findings" in e:
+        p = e
+    else:
+        p = e.get("structured_output") if isinstance(e, dict) else None
+        if not isinstance(p, dict):
+            r = e.get("result") if isinstance(e, dict) else None
+            p = json.loads(r) if isinstance(r, str) else None
+    if isinstance(p, dict):
+        sys.stdout.write(json.dumps(p))
+    else:
+        sys.exit(1)
+except Exception:
+    sys.exit(1)' 2>/dev/null) || _va_unwrapped=""
+            if [ -n "$_va_unwrapped" ]; then response="$_va_unwrapped"; fi
+        fi
+    fi
     fi  # end claude-dispatch guard (SDK path skips it, already has $response)
 
     # Shared fail-closed check for BOTH paths: any non-zero exit (claude/SDK