loki-mode 11.54.3 → 11.55.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Runs an autonomous software factory that knows what it is supposed to deliver and proves it did, with a signed receipt. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.54.3
+# Loki Mode v11.55.0
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -476,4 +476,4 @@ Implemented, planned and deprecated items, with the version each landed in: `ski
 
 ---
 
-**v11.54.3 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.55.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.54.3
+11.55.0

package/autonomy/lib/fast_verify.py

@@ -42,11 +42,13 @@ WHAT THIS DELIBERATELY DOES NOT DO
 from __future__ import annotations
 
 import hashlib
+import hmac
 import json
 import os
 import re
 import subprocess
 import sys
+import tempfile
 import time
 from dataclasses import dataclass, field, asdict
 from pathlib import Path
@@ -210,43 +212,165 @@ def discover(root: str, diff_base: str = "") -> list:
 
 # --- Content-addressed cache -------------------------------------------------
 
+def _producer_fingerprint() -> str | None:
+    """Digest of this file's own bytes. Every cached verdict is bound to the
+    exact rules that produced it, so any rule edit orphans old entries with no
+    hand-bumped version to forget. None when the source cannot be read, in
+    which case the cache is off."""
+    try:
+        with open(os.path.abspath(__file__), "rb") as fh:
+            return hashlib.blake2b(fh.read(), digest_size=16).hexdigest()
+    except OSError:
+        return None
+
+
+PRODUCER = _producer_fingerprint()
+
+
+def cache_key(rel: str, raw: bytes) -> str:
+    """A verdict depends on the rules, the path (is_test selects which rules
+    run) and the content, so all three are in the key."""
+    h = hashlib.blake2b(digest_size=16)
+    h.update((PRODUCER or "").encode("ascii"))
+    h.update(b"\0")
+    h.update(rel.encode("utf-8", "replace"))
+    h.update(b"\0")
+    h.update(raw)
+    return h.hexdigest()
+
+
+def cache_dir() -> str:
+    """User-owned cache root, outside every repo the agent works in
+    (LOKI_FAST_VERIFY_CACHE_DIR overrides it, for tests and sandboxes)."""
+    return os.environ.get("LOKI_FAST_VERIFY_CACHE_DIR") or os.path.join(
+        os.path.expanduser("~"), ".loki", "cache", "fast-verify")
+
+
+def cache_path(root: str) -> str:
+    tag = hashlib.blake2b(os.path.realpath(root).encode("utf-8", "replace"), digest_size=8).hexdigest()
+    return os.path.join(cache_dir(), tag + ".json")
+
+
+def _private_dir(path: str) -> bool:
+    """Create the cache dir and force it to 0700, including a pre-existing one
+    created loose. A dir this user cannot chmod is not ours: refuse it."""
+    try:
+        os.makedirs(path, mode=0o700, exist_ok=True)
+        os.chmod(path, 0o700)
+        return True
+    except OSError:
+        return False
+
+
+def _write_private(path: str, data: bytes, replace: bool) -> None:
+    """Write data to a 0600 temp file in the same dir, then publish it
+    atomically: os.replace, or os.link so an existing file is never clobbered
+    and no reader sees a partial one."""
+    fd, tmp = tempfile.mkstemp(dir=os.path.dirname(path), prefix=".tmp-")
+    try:
+        os.fchmod(fd, 0o600)
+        with os.fdopen(fd, "wb") as fh:
+            fh.write(data)
+        if replace:
+            os.replace(tmp, path)
+        else:
+            os.link(tmp, path)
+    finally:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+
+
+def _read_key(path: str) -> bytes | None:
+    try:
+        st = os.stat(path)
+        if st.st_mode & 0o077 or st.st_uid != os.getuid():
+            return None  # a key others could read or write proves nothing
+        with open(path, "rb") as fh:
+            key = fh.read()
+        return key if len(key) >= 32 else None
+    except OSError:
+        return None
+
+
+def _cache_secret() -> bytes | None:
+    """Per-user HMAC key kept beside the cache, never inside the repo. None when
+    it can be neither read nor created, in which case the cache is off."""
+    if PRODUCER is None or not _private_dir(cache_dir()):
+        return None
+    path = os.path.join(cache_dir(), "key")
+    key = _read_key(path)
+    if key is not None:
+        return key
+    try:
+        _write_private(path, os.urandom(32), replace=False)
+    except FileExistsError:
+        pass
+    except OSError:
+        return None
+    return _read_key(path)
+
+
 class Cache:
     """Findings keyed by content hash, so unchanged files are never re-read.
 
-    Correctness note: the key is the file's CONTENT, not its path or mtime. A
-    file that moves keeps its result; a file that changes gets a new key. There
-    is no staleness window to reason about, which is what makes it safe to trust
-    a cache hit as if the scan had just run.
+    The key covers the producing rules (this file's own digest), the path and
+    the content, never mtime, so there is no staleness window and a verdict
+    cannot outlive a rule change or follow a file to a path where other rules
+    apply. Content addressing does not make an entry trustworthy
+    on its own: the key is computable by anyone, so an entry written by the
+    agent under review could suppress a finding. Each entry therefore carries
+    an HMAC under a per-user secret held outside the repo, and an entry whose
+    MAC does not verify is a miss: the file is rescanned. Without a secret
+    the cache is disabled.
     """
 
     def __init__(self, path: str):
         self.path = path
         self.data = {}
         self.hits = 0
+        self.secret = _cache_secret()
+        if self.secret is None:
+            return
         try:
             with open(path, encoding="utf-8") as fh:
                 blob = json.load(fh)
-            if isinstance(blob, dict) and blob.get("schema") == SCHEMA_VERSION:
-                self.data = blob.get("entries", {})
+            if isinstance(blob, dict) and blob.get("producer") == PRODUCER:
+                entries = blob.get("entries", {})
+                if isinstance(entries, dict):
+                    self.data = entries
         except (OSError, ValueError):
             self.data = {}
 
+    def _mac(self, key: str, findings: list) -> str:
+        body = json.dumps([PRODUCER, key, findings], sort_keys=True, separators=(",", ":"))
+        return hmac.new(self.secret, body.encode("utf-8"), "sha256").hexdigest()
+
     def get(self, key: str):
-        v = self.data.get(key)
-        if v is not None:
-            self.hits += 1
-        return v
+        entry = self.data.get(key)
+        if self.secret is None or not isinstance(entry, dict):
+            return None
+        findings, mac = entry.get("findings"), entry.get("mac")
+        if not isinstance(findings, list) or not isinstance(mac, str):
+            return None
+        if not hmac.compare_digest(mac, self._mac(key, findings)):
+            return None
+        self.hits += 1
+        return findings
 
     def put(self, key: str, findings: list) -> None:
-        self.data[key] = findings
+        if self.secret is not None:
+            self.data[key] = {"findings": findings, "mac": self._mac(key, findings)}
 
     def save(self) -> None:
+        if self.secret is None:
+            return
         try:
-            os.makedirs(os.path.dirname(self.path), exist_ok=True)
-            tmp = self.path + ".tmp"
-            with open(tmp, "w", encoding="utf-8") as fh:
-                json.dump({"schema": SCHEMA_VERSION, "entries": self.data}, fh)
-            os.replace(tmp, self.path)
+            if not _private_dir(os.path.dirname(self.path)):
+                return
+            blob = json.dumps({"producer": PRODUCER, "entries": self.data})
+            _write_private(self.path, blob.encode("utf-8"), replace=True)
         except OSError:
             pass  # a cache that cannot be written must never break a verdict
 
@@ -256,7 +380,7 @@ class Cache:
 def verify(root: str = ".", diff_base: str = "", use_cache: bool = True) -> Result:
     t0 = time.perf_counter()
     root = os.path.abspath(root)
-    cache = Cache(os.path.join(root, ".loki", "cache", "fast-verify.json")) if use_cache else None
+    cache = Cache(cache_path(root)) if use_cache else None
 
     findings = []
     scanned = 0
@@ -270,7 +394,7 @@ def verify(root: str = ".", diff_base: str = "", use_cache: bool = True) -> Resu
             continue
         scanned += 1
 
-        key = hashlib.blake2b(raw, digest_size=16).hexdigest()
+        key = cache_key(rel, raw)
         if cache is not None:
             hit = cache.get(key)
             if hit is not None:

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.54.3"
+__version__ = "11.55.0"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.54.3. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.55.0. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.54.3
+**Version:** v11.55.0
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/FAILURE-CLASSES.md

@@ -1417,9 +1417,18 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Fixture: loki-ts/tests/engine10/seal_group.test.ts "#317: local HEAD ahead of origin/HEAD, every unit starts at the journal-key base". Red before the fix (unit base undefined), green after.
 
 ## FC-TRUSTED-CACHE-VERDICT fast_verify trusts an agent-writable content-hash cache as a fresh scan, so a planted entry (an empty list suppressing a high finding, or injected finding text) decides the verdict
-- User-visible vs raw: user-visible. A planted `.loki/cache/fast-verify.json` entry keyed by a file's content hash is returned as that file's findings without rescanning. `[]` makes a file with a high finding PASS; a crafted message reaches the MCP client as trusted tool output. Tracked in #319.
+- User-visible vs raw: user-visible. A planted `.loki/cache/fast-verify.json` entry keyed by a file's content hash is returned as that file's findings without rescanning. `[]` makes a file with a high finding PASS; a crafted message reaches the MCP client as trusted tool output. Closed by #319.
 - Law: a verdict is derived from the content being judged, never from a file the judged agent can write (EL exogenous gates).
 - Cause (measured): autonomy/lib/fast_verify.py Cache reads entries by blake2b(content) and returns them unvalidated; mcp/server.py listed loki_verify_fast in _TRUSTED_TOOLS so its finding text skipped the untrusted envelope.
-- Siblings swept: every registered MCP tool and resource, via the runtime-derived guard in tests/mcp/test_phase1_tools.py (seeds this cache with the marker; the observer now also sees os.scandir, os.stat, Path.iterdir and glob); the JS mirror declares its fields in src/protocols and counts them in tests/protocols/mcp-server.test.js.
-- Mechanism: part 1 (this change) moves loki_verify_fast findings under untrusted_content via _UNTRUSTED_FIELDS. The verdict-suppression half is open in #319 (cache entries must be authenticated or re-derived, then the row is closed).
-- Fixture: tests/mcp/test_phase1_tools.py test_stored_text_appears_only_inside_untrusted_content (red with loki_verify_fast trusted: leaks ['loki_verify_fast']; green after).
+- Siblings swept (grep for cache files under .loki and ~/.loki in loki-ts/src, autonomy, mcp): engine10/cache.ts repomap/testmap cache lives under ~/.loki/cache/v10, outside the repo, keyed by tree hash, no MAC (same-user write is out of this row's threat model; it selects tests, it does not return findings); run.sh `.loki/cache/install` is in-repo and agent-writable but stores node_modules, not a verdict; router history and update_check feed estimates and notices, not a verdict. No other in-repo cache returns findings. Every MCP tool and resource is covered by the runtime-derived guard in tests/mcp/test_phase1_tools.py.
+- Mechanism: two layers. (1) loki_verify_fast findings sit under untrusted_content via _UNTRUSTED_FIELDS. (2) fast_verify.Cache lives at ~/.loki/cache/fast-verify/<realpath hash>.json (LOKI_FAST_VERIFY_CACHE_DIR overrides), and each entry carries an HMAC under a per-user 0600 key beside it. The cache key and the MAC body are derived from everything the verdict depends on: a producer fingerprint (blake2b of fast_verify.py's own bytes, computed at import, so any rule edit orphans every old entry and there is no hand-bumped schema constant), the repo-relative path (is_test decides which rules run, so a file moved from a test path to a product path is rescanned), and the content. An entry whose MAC fails is a miss and the file is rescanned; with no readable key, no readable source or an unusable cache dir the cache is off. The key is created through a 0600 temp file and os.link (never clobbered, never partial), the cache dir is forced to 0700 even when it pre-exists loose, a key that is group or other accessible or not owned by the user is refused, and the cache json is written at 0600 through a temp file and os.replace. The old repo-local `.loki/cache/fast-verify.json` is never read. Closes #319.
+- Trust boundary: closed for repo content and for any write the judged agent makes inside the repo. NOT closed against a same-user process that can read ~/.loki/cache/fast-verify/key: it can forge a valid MAC. A same-user agent that is allowed to read the home directory therefore defeats this cache; the only complete answer for that threat is --no-cache (the fast scan is milliseconds), which the exogenous gates should use.
+- Sibling not closed (engine10 cache): loki-ts/src/engine10/cache.ts keys repomap and testmap by HEAD^{tree} plus a hand-bumped "repomap2-" prefix, so a builder change does not invalidate stored maps (same class as the hand-bumped CACHE_SCHEMA removed here). It selects tests and does not return findings, so it is not a verdict, but the fix is the same idea: derive the builder version from the builder's bytes at build time instead of a manual prefix. Tracked as a follow-up, not changed here because the TS bundle has no stable source path to hash at runtime.
+- Fixture: tests/mcp/test_phase1_tools.py test_stored_text_appears_only_inside_untrusted_content (red with loki_verify_fast trusted: leaks ['loki_verify_fast']; green after) and tests/test-fast-verify.sh CACHE BINDING block (planted repo-local and forged-MAC empty-list entries; red when the MAC check is replaced by `if False:`, green with it), plus the CACHE KEY and CACHE FILES blocks there: a test-path file moved to a product path must FAIL (red when the path is dropped from cache_key), a copy of fast_verify.py with disabled rules must not poison the real rules' cache (red when PRODUCER is a fixed string), the key and cache json are 0600 and the dir 0700 (red when the key is written 0666), and no verify cache file appears in a repo (red when cache_path points at root/.loki/cache/fast-verify.json). Tests that run fast_verify set LOKI_FAST_VERIFY_CACHE_DIR to a run tmp or pass --no-cache, never the real ~/.loki.
+
+## FC-CATALOG-CAPABILITY-DRIFT-UNCHECKED A catalog entry whose capabilities drifted from the API failed only at request time
+- User-visible: a catalog entry whose thinking types or effort levels drifted from what the model accepts fails only at request time, as an API error mid-run. Raw: the catalog (providers/model_catalog.json) is static and never compared with models.retrieve.
+- Law broken: a capability the harness relies on is claimed without being checked against its source of truth.
+- Siblings swept: effortForTier clamp (bash and Bun, parity-checked), claudeEffortLevels, the catalog freshness row (age only, offline).
+- Mechanism: loki doctor "Model capabilities" row. With ANTHROPIC_API_KEY it calls models.retrieve per claude catalog id and prints each mismatch (effort levels, API-expressible thinking types); without a key or offline it warns and never changes the tally or exit code. The bench runner takes --effort sweep, expanding to the catalog levels for --model.
+- Fixture: loki-ts/tests/commands/doctor.test.ts "model capability row", tests/test_bench_runner.py sweep tests, tests/test-bash-bun-parity.sh effort clamp cells. Red when the comparison, the sweep catalog read or the clamp model argument is removed.