loki-mode 11.17.1 → 11.17.6

package/autonomy/lib/chat.sh

@@ -113,7 +113,7 @@ _chat_sleep_ms() {
 # that was not live before). A start that exits first reports its real error and the log path.
 # Returns non-zero when the start is not proven.
 _chat_run_launch() {
-    local loki="$1" input="$2" root="${LOKI_DIR:-.loki}" log pid rc=0 start_ms deadline_ms now_ms rem_ms iter=0 max_iter before_dir before_state
+    local loki="$1" input="$2" root="${LOKI_DIR:-.loki}" log pid rc=0 start_ms deadline_ms now_ms rem_ms iter=0 clock_failed=0 max_iter before_dir before_state
     log="$root/chat-run.log"
     mkdir -p "$root"
     _chat_clock_pick
@@ -151,14 +151,19 @@ _chat_run_launch() {
             return "$rc"
         fi
         # A failed or non-numeric clock read (perl fork EAGAIN) counts as the deadline: never mix clock bases.
-        now_ms="$(_chat_now_ms)" || break
-        case "$now_ms" in ''|*[!0-9]*) break ;; esac
+        # No $SECONDS fallback here: switching sources mid-launch would mix bases with start_ms.
+        now_ms="$(_chat_now_ms)" || { clock_failed=1; break; }
+        case "$now_ms" in ''|*[!0-9]*) clock_failed=1; break ;; esac
         rem_ms=$(( deadline_ms - now_ms ))
         [ "$rem_ms" -gt 0 ] || break
         [ "$iter" -lt "$max_iter" ] || break
         [ "$rem_ms" -le 200 ] || rem_ms=200
         _chat_sleep_ms "$rem_ms"
     done
+    if [ "$clock_failed" = 1 ]; then
+        echo "Run start unproven (clock read failed while waiting; launcher pid $pid still running). Log: $log" >&2
+        return 1
+    fi
     echo "Run start not confirmed after ${wait_s}s (no live run state; launcher pid $pid still running). Log: $log" >&2
     return 1
 }

package/autonomy/lib/claude-flags.sh

@@ -212,6 +212,93 @@ _loki_apikey_helper_configured() {
     return 1
 }
 
+# ---------- S2: lean child-session flags + cost ledger ----------
+# loki_lean_child_flags <role> prints the lean flag set for a NON-MAIN child
+# `claude -p` session, ONE ARGUMENT PER LINE (never an empty line).
+# Callers read it with a line loop.
+#   - API-key/apiKeyHelper host: "--bare" (gated by loki_subcall_bare_enabled,
+#     which keeps OAuth-only hosts off --bare; it would fail auth there).
+#   - Otherwise: --setting-sources project, --strict-mcp-config, an empty
+#     --mcp-config, --disable-slash-commands.
+#   - Text-only roles additionally get the single argument "--tools=" (no tools). --tools is
+#     variadic: "--tools" plus an empty argument swallows a trailing prompt.
+# Every flag is probed with loki_claude_flag_supported; an unsupported flag and
+# its value are dropped. LOKI_LEAN_CHILDREN=0 prints nothing. Main-session
+# flags are not touched by this helper.
+loki_lean_child_flags() {
+    local role="${1:-}"
+    [ "${LOKI_LEAN_CHILDREN:-1}" = "0" ] && return 0
+    if loki_subcall_bare_enabled; then
+        printf '%s\n' "--bare"
+    else
+        if loki_claude_flag_supported "--setting-sources"; then
+            printf '%s\n' "--setting-sources" "project"
+        fi
+        if loki_claude_flag_supported "--strict-mcp-config"; then
+            printf '%s\n' "--strict-mcp-config"
+        fi
+        if loki_claude_flag_supported "--mcp-config"; then
+            printf '%s\n' "--mcp-config" '{"mcpServers":{}}'
+        fi
+        if loki_claude_flag_supported "--disable-slash-commands"; then
+            printf '%s\n' "--disable-slash-commands"
+        fi
+    fi
+    case "$role" in
+        grill|council|vote|review|reviewer|enrich|wiki|docs|docgen|summary)
+            if loki_claude_flag_supported "--tools"; then
+                printf '%s\n' "--tools="
+            fi
+            ;;
+    esac
+    return 0
+}
+
+# loki_child_ledger_append <phase> <claude --output-format json> appends one
+# line to .loki/metrics/child-sessions.jsonl in the format read by
+# autonomy/lib/efficiency_cost.py read_child_ledger: phase, model,
+# input_tokens, output_tokens, cache_creation_tokens, cache_read_tokens, usd,
+# source. A missing usd is omitted, never written as 0. Returns 1 (writes
+# nothing) when the json is not a parseable result object.
+loki_child_ledger_append() {
+    local phase="${1:-}" payload="${2:-}"
+    [ -n "$phase" ] && [ -n "$payload" ] || return 1
+    local dir="${LOKI_DIR:-.loki}/metrics" line
+    line=$(printf '%s' "$payload" | python3 -I -c '
+import json, sys
+phase = sys.argv[1]
+try:
+    d = json.loads(sys.stdin.read())
+except Exception:
+    sys.exit(1)
+if isinstance(d, list):
+    d = next((x for x in reversed(d) if isinstance(x, dict) and x.get("type") == "result"), None)
+if not isinstance(d, dict):
+    sys.exit(1)
+u = d.get("usage") if isinstance(d.get("usage"), dict) else {}
+def n(v):
+    return v if isinstance(v, int) and not isinstance(v, bool) else 0
+mu = d.get("modelUsage")
+model = next(iter(mu), "") if isinstance(mu, dict) and mu else (d.get("model") or "")
+rec = {
+    "phase": phase,
+    "model": model if isinstance(model, str) else "",
+    "input_tokens": n(u.get("input_tokens")),
+    "output_tokens": n(u.get("output_tokens")),
+    "cache_creation_tokens": n(u.get("cache_creation_input_tokens")),
+    "cache_read_tokens": n(u.get("cache_read_input_tokens")),
+}
+usd = d.get("total_cost_usd", d.get("cost_usd"))
+if isinstance(usd, (int, float)) and not isinstance(usd, bool):
+    rec["usd"] = usd
+rec["source"] = "claude-json"
+print(json.dumps(rec, separators=(",", ":")))
+' "$phase" 2>/dev/null) || return 1
+    [ -n "$line" ] || return 1
+    mkdir -p "$dir" 2>/dev/null || return 1
+    printf '%s\n' "$line" >> "$dir/child-sessions.jsonl" || return 1
+}
+
 # EMBED 3 -- --disallowedTools (reviewer / adversarial subcalls). Motivation: a
 # parallel agent once ran `git reset --hard` and wiped uncommitted work, so a
 # reviewer/voter subcall should not casually mutate the tree. Per `claude --help`
@@ -973,18 +1060,68 @@ loki_export_subagent_capacity() {
 # without each one having to remember to call this.
 loki_export_subagent_capacity
 
-# P12-26: LOKI_PERMISSION_POLICY=compiled swaps --dangerously-skip-permissions for
-# --permission-mode / --allowedTools / --disallowedTools compiled from the task policy
-# by src/policies/claude_permissions.js (shared with the TS permissionArgv). Unset =
-# unchanged. Result lands in _LOKI_PERM_ARGV. A compile failure fails closed to plan.
+# P12-26 / C-C2: the compiled permission policy swaps --dangerously-skip-permissions for
+# --permission-mode / --allowedTools / --disallowedTools compiled from the task policy by
+# src/policies/claude_permissions.js (shared with the TS permissionArgv). Resolution:
+#   LOKI_PERMISSION_POLICY=legacy    -> legacy (old flag, byte-identical)
+#   LOKI_PERMISSION_POLICY=compiled  -> compiled (fail-closed acceptEdits with no policy)
+#   unset                            -> compiled only when an operator claude_permissions
+#                                       policy exists, else legacy (headless acceptEdits
+#                                       with no allowedTools denies npm test / git commit)
+#   any other value                  -> compiled, with a one-time warning per process
+# Result lands in _LOKI_PERM_ARGV. A compile failure fails closed to plan.
+_LOKI_PERM_UNKNOWN_WARNED=0
+_loki_permission_policy_mode() {
+    case "${LOKI_PERMISSION_POLICY:-}" in
+        legacy) echo legacy ;;
+        compiled) echo compiled ;;
+        "")
+            local _helper
+            _helper="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/src/policies/claude_permissions.js"
+            if command -v node >/dev/null 2>&1 && [ -f "$_helper" ] \
+                && [ "$(node "$_helper" --has-operator-policy 2>/dev/null)" = "1" ]; then
+                echo compiled
+            else
+                echo legacy
+            fi
+            ;;
+        *) echo compiled ;;
+    esac
+}
+
+# Unknown-value warning, once per process. Runs in the caller shell (never inside $(...)),
+# so the guard variable persists.
+_loki_permission_warn_unknown_once() {
+    case "${LOKI_PERMISSION_POLICY:-}" in
+        ""|legacy|compiled) return 0 ;;
+    esac
+    [ "${_LOKI_PERM_UNKNOWN_WARNED:-0}" = "1" ] && return 0
+    _LOKI_PERM_UNKNOWN_WARNED=1
+    echo "[loki] WARNING: LOKI_PERMISSION_POLICY=${LOKI_PERMISSION_POLICY}: unknown value; using compiled" >&2
+}
+
+# The one start-banner line naming the active mode.
+loki_permission_policy_banner() {
+    if [ "$(_loki_permission_policy_mode 2>/dev/null)" = "legacy" ]; then
+        if [ -z "${LOKI_PERMISSION_POLICY:-}" ]; then
+            echo "Permission policy: legacy (no operator policy found; add one to use compiled)"
+        else
+            echo "Permission policy: legacy (unset LOKI_PERMISSION_POLICY to use compiled)"
+        fi
+    else
+        echo "Permission policy: compiled (set LOKI_PERMISSION_POLICY=legacy to revert)"
+    fi
+}
+
 _loki_claude_permission_argv() {
     _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
-    [ "${LOKI_PERMISSION_POLICY:-}" = "compiled" ] || return 0
+    _loki_permission_warn_unknown_once
+    [ "$(_loki_permission_policy_mode)" = "legacy" ] && return 0
     local _helper _out _a
     _helper="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/src/policies/claude_permissions.js"
     _LOKI_PERM_ARGV=(--permission-mode plan)
     if ! command -v node >/dev/null 2>&1 || [ ! -f "$_helper" ]; then
-        echo "[loki] WARNING: LOKI_PERMISSION_POLICY=compiled: compiler unavailable; using most restrictive mode (plan)" >&2
+        echo "[loki] WARNING: compiled permission policy: compiler unavailable; using most restrictive mode (plan)" >&2
         return 0
     fi
     _out="$(node "$_helper" "${LOKI_PROJECT_DIR:-$PWD}")" || return 0

package/autonomy/lib/claude_permissions.py

@@ -2,8 +2,9 @@
 
 New file: the python launch sites (dashboard, magic) need the same argv as the
 bash and TS routes; this is a thin caller of src/policies/claude_permissions.js
-(the single compiler), not a second implementation. Unset LOKI_PERMISSION_POLICY
-returns the legacy flag byte-identically.
+(the single compiler), not a second implementation. LOKI_PERMISSION_POLICY=legacy returns
+the legacy flag byte-identically; unset resolves to compiled only when an operator
+claude_permissions policy exists (asked of the same js helper), else legacy (C-C2).
 """
 from __future__ import annotations
 
@@ -15,16 +16,35 @@ from pathlib import Path
 
 _LEGACY = ["--dangerously-skip-permissions"]
 _FAIL_CLOSED = ["--permission-mode", "plan"]
+_unknown_warned = False
+
+
+def _has_operator_policy(node: str | None, helper: Path, env: dict) -> bool:
+    if node is None or not helper.is_file():
+        return False
+    try:
+        done = subprocess.run([node, str(helper), "--has-operator-policy"], capture_output=True,
+                              text=True, timeout=30, env=dict(env), check=False)
+    except (OSError, subprocess.SubprocessError):
+        return False
+    return done.stdout.strip() == "1"
 
 
 def claude_permission_argv(project_dir: str | None = None, env: dict | None = None) -> list:
     env = os.environ if env is None else env
-    if env.get("LOKI_PERMISSION_POLICY", "") != "compiled":
+    mode = env.get("LOKI_PERMISSION_POLICY", "")
+    if mode == "legacy":
         return list(_LEGACY)
+    global _unknown_warned
     helper = Path(__file__).resolve().parents[2] / "src" / "policies" / "claude_permissions.js"
     node = shutil.which("node")
+    if mode == "" and not _has_operator_policy(node, helper, env):
+        return list(_LEGACY)
+    if mode not in ("", "compiled") and not _unknown_warned:
+        _unknown_warned = True
+        print(f"[loki] WARNING: LOKI_PERMISSION_POLICY={mode}: unknown value; using compiled", file=sys.stderr)
     if node is None or not helper.is_file():
-        print("[loki] WARNING: LOKI_PERMISSION_POLICY=compiled: compiler unavailable; using most restrictive mode (plan)", file=sys.stderr)
+        print("[loki] WARNING: compiled permission policy: compiler unavailable; using most restrictive mode (plan)", file=sys.stderr)
         return list(_FAIL_CLOSED)
     target = project_dir or env.get("LOKI_PROJECT_DIR") or os.getcwd()
     try:

package/autonomy/lib/decision_record.py

@@ -168,22 +168,111 @@ def summarize(loki_dir):
     }
 
 
+# DESIGN RECORDS. A second record type next to the dispatch record: why a design
+# approach was chosen, not which model ran. Kept in its own file so
+# summarize() and verdict.py, which read decisions.jsonl as dispatch records,
+# never see a record without model_id. Same rules: fixed allowlist, append-only.
+DESIGN_FIELDS = (
+    "schema_version",
+    "recorded_at",
+    "rationale",      # required: why this approach
+    "alternatives",   # list of approaches considered and not chosen
+    "source",         # what made the call, e.g. plan
+    "scope",          # what the decision covers
+    "decided_at",
+)
+
+
+def _design_path(loki_dir):
+    return os.path.join(loki_dir, "decisions", "design.jsonl")
+
+
+def record_design(loki_dir, fields):
+    """Append one design decision record, or return a named refusal."""
+    clean = {}
+    dropped = []
+    for k, v in (fields or {}).items():
+        if k in DESIGN_FIELDS:
+            clean[k] = v
+        else:
+            dropped.append(k)
+
+    rationale = clean.get("rationale")
+    if not isinstance(rationale, str) or not rationale.strip():
+        return {"status": "UNKNOWN", "reason": "no_rationale",
+                "detail": "a design record without a rationale records nothing about why"}
+    alts = clean.get("alternatives", [])
+    if isinstance(alts, str):
+        alts = [a.strip() for a in alts.split("|") if a.strip()]
+    if not isinstance(alts, list) or not all(isinstance(a, str) for a in alts):
+        return {"status": "UNKNOWN", "reason": "bad_alternatives",
+                "detail": "alternatives must be a list of strings"}
+    for k in ("source", "scope", "decided_at"):
+        if k in clean and not isinstance(clean[k], str):
+            return {"status": "UNKNOWN", "reason": "bad_" + k,
+                    "detail": k + " must be a string"}
+
+    now = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    clean["rationale"] = rationale.strip()
+    clean["alternatives"] = alts
+    clean.setdefault("decided_at", now)
+    clean["schema_version"] = SCHEMA_VERSION
+    clean["recorded_at"] = now
+
+    path = _design_path(loki_dir)
+    try:
+        os.makedirs(os.path.dirname(path), exist_ok=True)
+        with open(path, "a", encoding="utf-8") as fh:
+            fh.write(json.dumps(clean, sort_keys=True) + "\n")
+    except OSError as exc:
+        return {"status": "UNKNOWN", "reason": "unwritable", "detail": str(exc)}
+
+    out = {"status": "recorded", "path": path, "record": clean}
+    if dropped:
+        out["dropped_fields"] = sorted(dropped)
+    return out
+
+
+def read_design(loki_dir):
+    """Return the parseable design records, oldest first."""
+    path = _design_path(loki_dir)
+    recs = []
+    try:
+        with open(path, "r", encoding="utf-8") as fh:
+            for line in fh:
+                try:
+                    recs.append(json.loads(line))
+                except ValueError:
+                    continue
+    except OSError:
+        pass
+    return recs
+
+
 def main(argv):
     if not argv:
-        print("usage: decision_record.py record|summary [--field=value ...]",
+        print("usage: decision_record.py record|design|design-file|summary [--field=value ...]",
               file=sys.stderr)
         return 2
     action = argv[0]
     cwd = os.environ.get("LOKI_DECISION_CWD") or os.getcwd()
     loki_dir = os.environ.get("LOKI_DIR") or os.path.join(cwd, ".loki")
 
-    if action == "record":
+    if action in ("record", "design"):
         fields = {}
         for arg in argv[1:]:
             if arg.startswith("--") and "=" in arg:
                 k, v = arg[2:].split("=", 1)
                 fields[k] = v
-        res = record(loki_dir, fields)
+        res = (record_design if action == "design" else record)(loki_dir, fields)
+    elif action == "design-file" and len(argv) == 2:
+        try:
+            with open(argv[1], "r", encoding="utf-8") as fh:
+                data = json.load(fh)
+        except (OSError, ValueError):
+            data = None
+        res = record_design(loki_dir, data) if isinstance(data, dict) else {
+            "status": "UNKNOWN", "reason": "unreadable_file"}
     elif action == "summary":
         res = summarize(loki_dir)
     else:

package/autonomy/lib/efficiency_cost.py

@@ -29,6 +29,7 @@ import os
 __all__ = [
     "collect_efficiency",
     "record_is_measured",
+    "read_child_ledger",
     "load_prices",
     "price_from_tokens",
     "DEFAULT_PRICES_PATH",
@@ -223,9 +224,110 @@ def collect_efficiency(loki_dir):
             "cache_read_tokens", "cache_creation_tokens",
         ):
             cost[key] = None
+    _merge_child_ledger(loki_dir, cost)
     return cost, model
 
 
+# ---------------------------------------------------------------------------
+# child-session ledger (S1 of the cost program)
+# ---------------------------------------------------------------------------
+
+LEDGER_RELPATH = os.path.join("metrics", "child-sessions.jsonl")
+_LEDGER_TOKEN_KEYS = (
+    "input_tokens", "output_tokens", "cache_read_tokens", "cache_creation_tokens",
+)
+
+
+def read_child_ledger(loki_dir):
+    """Read .loki/metrics/child-sessions.jsonl, one JSON object per child session.
+
+    Record format: phase, model, input_tokens, output_tokens,
+    cache_creation_tokens, cache_read_tokens, usd, source.
+
+    Returns (records, invalid_lines) or (None, 0) when the file is absent or
+    unreadable. None is the honest "no ledger" signal: callers must not treat
+    it as zero child spend. Blank lines are ignored; non-JSON lines and
+    non-object lines are skipped and counted.
+    """
+    path = os.path.join(loki_dir, LEDGER_RELPATH)
+    try:
+        with open(path, "r", encoding="utf-8") as fh:
+            lines = fh.read().splitlines()
+    except Exception:
+        return None, 0
+    records, invalid = [], 0
+    for line in lines:
+        line = line.strip()
+        if not line:
+            continue
+        try:
+            rec = json.loads(line)
+        except Exception:
+            invalid += 1
+            continue
+        if isinstance(rec, dict):
+            records.append(rec)
+        else:
+            invalid += 1
+    return records, invalid
+
+
+def _merge_child_ledger(loki_dir, cost):
+    """Fold the child-session ledger into the cost dict, in place.
+
+    The main RARV session's efficiency record is only one of 11-20 child
+    `claude -p` sessions per run (grill, reviewers, council, docgen); summing
+    it alone undercounts true spend. Always sets cost["ledger"] to "present" or
+    "absent" so a missing ledger is visible, never a silent zero. A ledger line
+    without a usd value is unpriced (counted, never treated as 0.0), and the
+    total then becomes a lower bound via cost_partial.
+    """
+    records, invalid = read_child_ledger(loki_dir)
+    main_usd = cost.get("usd")
+    by_phase = {}
+    if main_usd is not None:
+        by_phase["implement"] = main_usd
+    if records is None:
+        cost["ledger"] = "absent"
+        if by_phase:
+            cost["cost_by_phase"] = by_phase
+        return
+    cost["ledger"] = "present"
+    cost["ledger_records"] = len(records)
+    cost["ledger_invalid_lines"] = invalid
+    if not records:
+        if by_phase:
+            cost["cost_by_phase"] = by_phase
+        return
+    ledger_usd, priced, unpriced = 0.0, 0, 0
+    main_known = bool(cost.get("available"))
+    tokens = {k: cost.get(k) for k in _LEDGER_TOKEN_KEYS}
+    if not main_known:
+        tokens = {k: 0 for k in _LEDGER_TOKEN_KEYS}
+    for rec in records:
+        usd = rec.get("usd")
+        if isinstance(usd, (int, float)) and not isinstance(usd, bool):
+            ledger_usd += float(usd)
+            priced += 1
+            phase = str(rec.get("phase") or "unknown")
+            by_phase[phase] = by_phase.get(phase, 0.0) + float(usd)
+        else:
+            unpriced += 1
+        for k in _LEDGER_TOKEN_KEYS:
+            if tokens[k] is not None:
+                tokens[k] += _to_int(rec.get(k))
+    cost.update(tokens)
+    cost["available"] = True
+    if priced:
+        cost["usd"] = round((main_usd or 0.0) + ledger_usd, 4)
+        cost["cost_available"] = True
+    partial = bool(cost.get("cost_partial")) or unpriced > 0 or not main_known
+    cost["cost_partial"] = partial
+    cost["cost_unpriced_records"] = int(cost.get("cost_unpriced_records") or 0) + unpriced
+    if by_phase:
+        cost["cost_by_phase"] = {k: round(v, 4) for k, v in by_phase.items()}
+
+
 # ---------------------------------------------------------------------------
 # uniform token -> USD pricing (R2 benchmark; not used by the proof generator)
 # ---------------------------------------------------------------------------

package/autonomy/lib/modernize/py_capture.py

@@ -454,6 +454,25 @@ def _check_boundary(name, value, declared):
     return None
 
 
+def _declared_for_case(declared, per_case, bound_names, call_args, call_kwargs):
+    """Per-case boundary declarations (optional "boundaries" key on a --cases line):
+    {"args": [kind|null, ...], "kwargs": {name: kind}, "return": kind|null}. This is how a replay declares
+    the kinds the ORACLE recorded, so a text argument is not "undeclared". It adds to the --boundaries file,
+    never overrides it, and a runtime type that differs from the declared kind is still flagged."""
+    if not isinstance(per_case, dict):
+        return declared
+    merged = dict(declared)
+    arg_kinds = per_case.get("args") or []
+    kw_kinds = per_case.get("kwargs") or {}
+    for i, name in enumerate(bound_names):
+        kind = arg_kinds[i] if i < len(call_args) and i < len(arg_kinds) else kw_kinds.get(name)
+        if kind in ("text", "bytes") and name not in merged:
+            merged[name] = kind
+    if per_case.get("return") in ("text", "bytes") and "return" not in merged:
+        merged["return"] = per_case["return"]
+    return merged
+
+
 def _unsupported_not_proven(tagged, path):
     """Recurse into an already-tagged structure (a return value or an
     exception arg) and turn every 'unsupported' tag at any nesting depth
@@ -519,6 +538,36 @@ def run_case(func, args, kwargs):
 # CLI
 # --------------------------------------------------------------------------
 
+def _stub_unit_functions(namespace, unit_path):
+    """No-op ablation: every plain function defined in the unit file becomes a
+    stub returning None. runpy.run_path returns a copy of the module globals, so
+    only the entry's own stub matters here; functions called internally still
+    see the real module. __wrapped__ keeps the original signature visible to the
+    boundary check on Python 3 (inspect.signature follows it). Returns the set of
+    names replaced; an entry outside it (imported function, bound-method alias,
+    functools.partial, callable instance) was NOT stubbed."""
+    import types
+    want = os.path.realpath(unit_path)
+    replaced = set()
+    for name in list(namespace.keys()):
+        func = namespace[name]
+        if not isinstance(func, types.FunctionType):
+            continue
+        if os.path.realpath(func.__code__.co_filename) != want:
+            continue
+        namespace[name] = _make_stub(func)
+        replaced.add(name)
+    return replaced
+
+
+def _make_stub(original):
+    def stub(*_args, **_kwargs):
+        return None
+    stub.__name__ = original.__name__
+    stub.__wrapped__ = original
+    return stub
+
+
 def main(argv=None):
     parser = argparse.ArgumentParser(description="Python 2/3 capture tracer (Loki Modernize M-09)")
     parser.add_argument("--unit", required=True, help="path to the unit's .py source")
@@ -526,6 +575,8 @@ def main(argv=None):
     parser.add_argument("--out", required=True, help="output cases.jsonl path")
     parser.add_argument("--coverage", help="output coverage.json path")
     parser.add_argument("--boundaries", help="JSON file of declared text/bytes boundaries")
+    parser.add_argument("--stub", action="store_true",
+                        help="no-op ablation: replace every function defined in the unit file with a stub returning None")
     args = parser.parse_args(argv)
 
     unit_path = os.path.abspath(args.unit)
@@ -547,6 +598,10 @@ def main(argv=None):
         sys.stderr.write("py_capture: failed to load unit %s: %s\n" % (args.unit, exc))
         return 2
 
+    stubbed = None
+    if args.stub:
+        stubbed = _stub_unit_functions(namespace, unit_path)
+
     with open(args.cases, "r") as fh:
         case_lines = [line for line in fh if line.strip()]
 
@@ -556,6 +611,9 @@ def main(argv=None):
         spec = json.loads(line)
         entry = spec["entry"]
         entries_used.add(entry)
+        if stubbed is not None and entry not in stubbed:
+            sys.stderr.write("py_capture: --stub could not stub entry %s\n" % entry)
+            return 2
         func = namespace.get(entry)
         if func is None or not callable(func):
             sys.stderr.write("py_capture: entry not found or not callable: %s\n" % entry)
@@ -570,17 +628,18 @@ def main(argv=None):
 
         not_proven = []
         bound_names = _bound_names(func, call_args, call_kwargs)
+        case_declared = _declared_for_case(declared, spec.get("boundaries"), bound_names, call_args, call_kwargs)
         for i, name in enumerate(bound_names):
             if i < len(call_args):
-                reason = _check_boundary(name, call_args[i], declared)
+                reason = _check_boundary(name, call_args[i], case_declared)
             elif name in call_kwargs:
-                reason = _check_boundary(name, call_kwargs[name], declared)
+                reason = _check_boundary(name, call_kwargs[name], case_declared)
             else:
                 reason = None
             if reason:
                 not_proven.append(reason)
         if outcome["had_result"]:
-            reason = _check_boundary("return", outcome["result"], declared)
+            reason = _check_boundary("return", outcome["result"], case_declared)
             if reason:
                 not_proven.append(reason)
             not_proven.extend(_unsupported_not_proven(outcome["result_tag"], "return"))

package/autonomy/lib/prd-enrich.sh

@@ -88,14 +88,40 @@ _loki_prd_enrich_invoke() {
     local out=""
     _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
     ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
+    # S8: lean child flags (no user-scope settings/MCP/tools) + ledger line.
+    type loki_lean_child_flags >/dev/null 2>&1 \
+        || . "$(dirname "${BASH_SOURCE[0]}")/claude-flags.sh" 2>/dev/null || true
+    local _pe_argv=("${_LOKI_PERM_ARGV[@]}") _pe_lf _pe_ledger=false
+    if type loki_lean_child_flags >/dev/null 2>&1; then
+        while IFS= read -r _pe_lf; do
+            [ -n "$_pe_lf" ] && _pe_argv+=("$_pe_lf")
+        done < <(loki_lean_child_flags enrich 2>/dev/null)
+    fi
+    if type loki_child_ledger_append >/dev/null 2>&1; then
+        _pe_ledger=true
+        _pe_argv+=("--output-format" "json")
+    fi
     if command -v timeout >/dev/null 2>&1; then
         out=$(CAVEMAN_DEFAULT_MODE=off timeout "${LOKI_PRD_ENRICH_TIMEOUT}" \
-                  claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" 2>/dev/null) || rc=$?
+                  claude "${_pe_argv[@]}" -p "$prompt" 2>/dev/null) || rc=$?
     else
         # No coreutils timeout (e.g. bare macOS). Run without it; the model
         # call is a one-shot and the caller still tolerates failure.
         out=$(CAVEMAN_DEFAULT_MODE=off \
-                  claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" 2>/dev/null) || rc=$?
+                  claude "${_pe_argv[@]}" -p "$prompt" 2>/dev/null) || rc=$?
+    fi
+    if [ "$rc" -eq 0 ] && [ "$_pe_ledger" = true ] && [ -n "$out" ]; then
+        loki_child_ledger_append enrich "$out" >/dev/null 2>&1 || true
+        out=$(printf '%s' "$out" | python3 -I -c 'import json,sys
+raw = sys.stdin.read()
+try:
+    d = json.loads(raw)
+except Exception:
+    d = None
+if isinstance(d, list):
+    d = next((x for x in reversed(d) if isinstance(x, dict) and x.get("type") == "result"), {})
+# A CLI or stub that ignores --output-format json returns plain text: keep it.
+sys.stdout.write(str(d.get("result", "")) if isinstance(d, dict) else raw)' 2>/dev/null)
     fi
     [ "$rc" -ne 0 ] && return 1
     [ -z "$out" ] && return 1